Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

feat: project repository keys across public clients

Browse Source
This commit is contained in:
Hare
2026-09-02 19:03:55 +09:00
parent c97b3b7b77
commit 96349721cb
56 changed files with 791 additions and 380 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workspace-server/src/authority.rs
+45 -9
View File
@@ -918,13 +918,33 @@ impl SqliteWorkspaceAuthority {
self.merge_revision_source
.resolve_subject_ref(&request.repository_id, selector)
});
Some(merge_request_summary(request, current_subject_ref))
let repository_key = self
.store
.get_repository(&self.workspace_id, &request.repository_id)?
.map(|repository| repository.repository_key)
.ok_or_else(|| Error::UnknownRepository(request.repository_id.clone()))?;
Some(merge_request_summary(
request,
repository_key,
current_subject_ref,
))
}
Err(MergeRequestError::NotFound) => None,
Err(error) => return Err(Error::Store(error.to_string())),
};
let repository_key = ticket
.meta
.repository_id
.as_deref()
.map(|repository_id| {
self.store
.get_repository(&self.workspace_id, repository_id)?
.map(|repository| repository.repository_key)
.ok_or_else(|| Error::UnknownRepository(repository_id.to_string()))
})
.transpose()?;
let evidence = ticket_evidence_summary(
ticket.meta.repository_id.as_deref(),
repository_key.as_deref(),
&ticket.events,
merge_request.as_ref(),
);
@@ -980,7 +1000,7 @@ impl SqliteWorkspaceAuthority {
item_revision,
queued_by: ticket.meta.queued_by,
queued_at: ticket.meta.queued_at,
repository_id: ticket.meta.repository_id,
repository_key,
ref_selector: ticket.meta.ref_selector,
risk_flags: ticket.meta.risk_flags,
body,
@@ -1742,6 +1762,7 @@ fn ticket_evidence_event(sequence: usize, event: &TicketEvent) -> TicketEvidence
pub(crate) fn merge_request_summary(
request: MergeRequest,
repository_key: String,
current_subject_ref: Option<String>,
) -> TicketMergeRequestSummary {
let latest_review_request = request.thread.iter().rev().find_map(|event| match event {
@@ -1790,7 +1811,7 @@ pub(crate) fn merge_request_summary(
TicketMergeRequestSummary {
merge_request_id: request.merge_request_id.clone(),
repository_id: request.repository_id.clone(),
repository_key,
state,
review_status,
selector_from: request.selector_from.clone(),
@@ -1835,7 +1856,7 @@ fn ticket_evidence_summary(
let linked_merge_request = merge_request.filter(|request| {
request.state == "open"
&& ticket_repository_id
.is_some_and(|repository_id| repository_id == request.repository_id)
.is_some_and(|repository_id| repository_id == request.repository_key)
});
let has_merge_request = linked_merge_request.is_some();
let has_current_subject_ref = linked_merge_request.is_some_and(|request| {
@@ -1886,7 +1907,7 @@ fn ticket_evidence_summary(
Some(request) if request.state != "open" => missing.push("open_merge_request".to_string()),
Some(request)
if ticket_repository_id
.is_none_or(|repository_id| repository_id != request.repository_id) =>
.is_none_or(|repository_id| repository_id != request.repository_key) =>
{
missing.push("merge_request_repository".to_string())
}
@@ -2823,6 +2844,7 @@ mod tests {
fn merge_request_summary_uses_the_provider_resolved_current_subject() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
assert_eq!(approved.review_status, "approved");
@@ -2834,6 +2856,7 @@ mod tests {
let moved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-2".to_string()),
);
assert_eq!(moved.review_status, "pending");
@@ -2846,6 +2869,7 @@ mod tests {
fn ticket_readiness_requires_current_unrevoked_approval_without_a_report() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&approved));
@@ -2866,6 +2890,7 @@ mod tests {
let revoked = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, true),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&revoked));
@@ -2874,6 +2899,7 @@ mod tests {
let changes = merge_request_summary(
reviewed_merge_request(ReviewDecision::RequestChanges, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&changes));
@@ -2883,8 +2909,11 @@ mod tests {
#[test]
fn ticket_readiness_fails_closed_for_missing_or_closed_current_merge_request() {
let unresolved =
merge_request_summary(reviewed_merge_request(ReviewDecision::Approve, false), None);
let unresolved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
None,
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&unresolved));
assert!(!evidence.has_current_subject_ref);
assert!(!evidence.has_commit);
@@ -2892,7 +2921,11 @@ mod tests {
let mut closed_request = reviewed_merge_request(ReviewDecision::Approve, false);
closed_request.state = MergeRequestState::Closed;
let closed = merge_request_summary(closed_request, Some("commit-1".to_string()));
let closed = merge_request_summary(
closed_request,
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&closed));
assert!(!evidence.has_merge_request);
assert!(!evidence.complete_for_integration);
@@ -2903,6 +2936,7 @@ mod tests {
fn ticket_readiness_requires_request_and_approval_after_substantive_rescope() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let fresh = ticket_evidence_summary(
@@ -2946,6 +2980,7 @@ mod tests {
fn ticket_query_filters_map_to_current_merge_request_evidence() {
let approved_summary = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let approved = ticket_evidence_summary(Some("main"), &[], Some(&approved_summary));
@@ -2962,6 +2997,7 @@ mod tests {
let pending_summary = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-2".to_string()),
);
let pending = ticket_evidence_summary(Some("main"), &[], Some(&pending_summary));
crates/workspace-server/src/hosts.rs
+6 -5
View File
@@ -313,6 +313,7 @@ impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
pub(crate) fn workspace_worker_summary(
summary: WorkerSummary,
resource_key: String,
working_directory: Option<workspace_api::WorkingDirectorySummary>,
) -> workspace_api::WorkerSummary {
workspace_api::WorkerSummary {
runtime_id: summary.worker.runtime_id,
@@ -341,7 +342,7 @@ pub(crate) fn workspace_worker_summary(
can_stop: summary.capabilities.can_stop,
can_spawn_followup: summary.capabilities.can_spawn_followup,
},
working_directory: summary.working_directory,
working_directory,
diagnostics: summary.diagnostics.into_iter().map(Into::into).collect(),
}
}
@@ -402,10 +403,10 @@ pub struct RuntimeWorkingDirectoryResult {
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct WorkerSpawnWorkingDirectoryRequest {
/// Safe configured Repository id. The host resolves this id to repository
/// authority from server-side config; browser callers cannot provide raw
/// source paths or runtime-internal storage paths.
pub repository_id: String,
/// Safe configured Repository key. The host resolves this key to internal
/// Repository authority; browser callers cannot provide Backend UUIDs, raw
/// source paths, or Runtime-internal storage paths.
pub repository_key: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub selector: Option<String>,
}
crates/workspace-server/src/records.rs
+2 -2
View File
@@ -78,7 +78,7 @@ pub struct TicketDetail {
pub item_revision: String,
pub queued_by: Option<String>,
pub queued_at: Option<String>,
pub repository_id: Option<String>,
pub repository_key: Option<String>,
pub ref_selector: Option<String>,
pub risk_flags: Vec<String>,
pub body: String,
@@ -301,7 +301,7 @@ pub struct TicketActionEligibility {
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
pub struct TicketMergeRequestSummary {
pub merge_request_id: String,
pub repository_id: String,
pub repository_key: String,
pub state: String,
pub review_status: String,
pub selector_from: Option<String>,
crates/workspace-server/src/repositories.rs
+8 -1
View File
@@ -97,7 +97,14 @@ impl RepositoryRegistryReader {
}
}
pub fn summary(
pub fn summary(&self, id: &str) -> Result<RepositorySummary, RepositoryLookupError> {
let repository = self
.find(id)
.ok_or_else(|| RepositoryLookupError::UnknownRepository { id: id.to_string() })?;
Ok(self.summary_for_config(repository))
}
pub fn summary_by_key(
&self,
repository_key: &str,
) -> Result<RepositorySummary, RepositoryLookupError> {
crates/workspace-server/src/repository_access.rs
+16 -15
View File
@@ -146,16 +146,17 @@ fn project_repository_access_evaluation(
Error::InvalidInput(format!("invalid Repository access config: {error}"))
})?;
let mut bindings = Vec::with_capacity(config.repository_access.len());
for (repository_id, access) in config.repository_access {
validate_identifier("repository_id", &repository_id)?;
for (repository_key, access) in config.repository_access {
workspace_api::validate_repository_key(&repository_key)
.map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
validate_identifier("credential_id", &access.ssh.credential)?;
validate_identifier("host_trust_id", &access.ssh.host_trust)?;
let repository = store
.get_repository(workspace_id, &repository_id)?
.ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_id}`")))?;
.get_repository_by_key(workspace_id, &repository_key)?
.ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_key}`")))?;
if repository.source.kind != workspace_api::RepositorySourceKind::Ssh {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` is not an ssh:// Repository"
"Repository `{repository_key}` is not an ssh:// Repository"
)));
}
let credential = secrets
@@ -182,34 +183,34 @@ fn project_repository_access_evaluation(
})?;
let uri = url::Url::parse(&repository.source.uri).map_err(|_| {
Error::InvalidInput(format!(
"Repository `{repository_id}` has an invalid SSH URI"
"Repository `{repository_key}` has an invalid SSH URI"
))
})?;
if uri.scheme() != "ssh" || uri.username().is_empty() || uri.password().is_some() {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` must use ssh://user@host[:port]/path without credentials"
"Repository `{repository_key}` must use ssh://user@host[:port]/path without credentials"
)));
}
let hostname = uri.host_str().ok_or_else(|| {
Error::InvalidInput(format!(
"Repository `{repository_id}` SSH URI has no hostname"
"Repository `{repository_key}` SSH URI has no hostname"
))
})?;
let port = uri.port().unwrap_or(22);
if hostname != host_trust.hostname || port != host_trust.port {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` SSH host does not match host trust `{}`",
"Repository `{repository_key}` SSH host does not match host trust `{}`",
access.ssh.host_trust
)));
}
bindings.push(RepositorySshAccessBinding {
repository_id,
repository_key,
credential_id: access.ssh.credential,
host_trust_id: access.ssh.host_trust,
access: access.ssh.access,
});
}
bindings.sort_by(|left, right| left.repository_id.cmp(&right.repository_id));
bindings.sort_by(|left, right| left.repository_key.cmp(&right.repository_key));
Ok(RepositoryAccessProjection {
workspace_id: workspace_id.to_string(),
config_revision,
@@ -1441,7 +1442,7 @@ fn credential_references(
.bindings
.iter()
.filter(|binding| binding.credential_id == credential_id)
.map(|binding| binding.repository_id.clone())
.map(|binding| binding.repository_key.clone())
.collect()
}
@@ -1453,7 +1454,7 @@ fn host_trust_references(
.bindings
.iter()
.filter(|binding| binding.host_trust_id == host_trust_id)
.map(|binding| binding.repository_id.clone())
.map(|binding| binding.repository_key.clone())
.collect()
}
@@ -1912,7 +1913,7 @@ mod tests {
let projection =
project_repository_access_state(&*store, &service, "workspace-a", &state).unwrap();
assert_eq!(projection.bindings.len(), 1);
assert_eq!(projection.bindings[0].repository_id, "remote");
assert_eq!(projection.bindings[0].repository_key, "remote");
assert_eq!(
projection.bindings[0].access,
RepositoryAccessMode::ReadOnly
@@ -1999,7 +2000,7 @@ mod tests {
config_revision: 3,
projection_digest: "sha256:test".to_string(),
bindings: vec![RepositorySshAccessBinding {
repository_id: "main".to_string(),
repository_key: "main".to_string(),
credential_id: "deploy".to_string(),
host_trust_id: "host".to_string(),
access: RepositoryAccessMode::ReadOnly,
crates/workspace-server/src/server.rs
+357 -146
View File
File diff suppressed because it is too large Load Diff
crates/workspace-server/src/store.rs
+38
View File
@@ -1298,6 +1298,16 @@ impl SqliteWorkspaceStore {
repairs.push("create missing worker_diagnostics_archives table".to_string());
}
if current_schema_version < 50 && table_exists(&source, "repositories")? {
let repository_count: i64 =
source.query_row("SELECT COUNT(*) FROM repositories", [], |row| row.get(0))?;
if repository_count > 0 {
repairs.push(format!(
"replace {repository_count} legacy public Repository id(s) with UUIDv7 internal ids, retain each prior id as repository_key, and retire free-form Repository names"
));
}
}
let mut candidate = Connection::open_in_memory()?;
{
let backup = Backup::new(&source, &mut candidate)?;
@@ -12568,6 +12578,18 @@ INSERT INTO worker_registry (
'1', '1', 'local_path', '/repo-a', 1, 'sha256:a', 'unverified'),
('workspace-b', 'main', 'Legacy B', 'git', 'git', '/repo-b', 'develop',
'1', '1', 'local_path', '/repo-b', 1, 'sha256:b', 'unverified');
INSERT INTO typed_tickets (
workspace_id, ticket_id, slug, title, status, kind, priority, body,
workflow_state, workflow_state_explicit, repository_id
) VALUES
('workspace-a', 'ticket-a', 'ticket-a', 'Ticket A', 'open', 'task', 'normal', '', 'planning', 1, 'main'),
('workspace-b', 'ticket-b', 'ticket-b', 'Ticket B', 'open', 'task', 'normal', '', 'planning', 1, 'main');
INSERT INTO merge_requests (
workspace_id, merge_request_id, repository_id, state,
selector_from, selector_to, created_at, updated_at
) VALUES
('workspace-a', 'mr-a', 'main', 'open', 'work/a', 'develop', '1', '1'),
('workspace-b', 'mr-b', 'main', 'open', 'work/b', 'develop', '1', '1');
INSERT INTO artifacts (
workspace_id, artifact_id, kind, uri, created_at,
created_by_kind, created_by_key, created_by_display, repository_id
@@ -12628,8 +12650,24 @@ INSERT INTO worker_registry (
|row| row.get(0),
)
.unwrap();
let ticket_repository_id: String = conn
.query_row(
"SELECT repository_id FROM typed_tickets WHERE workspace_id = ?1",
params![workspace_id],
|row| row.get(0),
)
.unwrap();
let merge_request_repository_id: String = conn
.query_row(
"SELECT repository_id FROM merge_requests WHERE workspace_id = ?1",
params![workspace_id],
|row| row.get(0),
)
.unwrap();
assert_eq!(&artifact_repository_id, repository_id);
assert_eq!(&workdir_repository_id, repository_id);
assert_eq!(&ticket_repository_id, repository_id);
assert_eq!(&merge_request_repository_id, repository_id);
}
assert!(
table_columns(&conn, "repositories")
crates/workspace-server/src/workspace_subscription.rs
+20
View File
@@ -408,6 +408,9 @@ async fn run_workspace_workers(
continue;
};
worker.resource_key = Some(resource_key);
if !project_repository_key(&api, &mut worker) {
continue;
}
let worker_ref = RuntimeWorkerRef::new(&runtime_id, worker.worker_id.as_str());
let revision = next_revision(&mut revisions, &worker_ref);
worker.subject_revision = revision;
@@ -507,11 +510,28 @@ fn install_snapshot(
continue;
};
worker.resource_key = Some(resource_key);
if !project_repository_key(api, &mut worker) {
continue;
}
projected.insert(worker.worker_id.to_string(), worker);
}
workers.insert(runtime_id.to_string(), projected);
}
fn project_repository_key(api: &WorkspaceApi, worker: &mut SubscriptionWorker) -> bool {
let Some(repository_id) = worker.repository_id.take() else {
return true;
};
let Ok(Some(repository)) = api
.store
.get_repository(&api.config.workspace_id, &repository_id)
else {
return false;
};
worker.repository_key = Some(repository.repository_key);
true
}
async fn send_event(
outbound: &mpsc::Sender<WsMessage>,
subscription_id: &SubscriptionId,