@@ -0,0 +1,330 @@ |
| | 1 | +// SPDX-License-Identifier: AGPL-3.0-or-later |
| | 2 | + |
| | 3 | +package main |
| | 4 | + |
| | 5 | +import ( |
| | 6 | + "bufio" |
| | 7 | + "context" |
| | 8 | + "errors" |
| | 9 | + "fmt" |
| | 10 | + "io" |
| | 11 | + "log/slog" |
| | 12 | + "os" |
| | 13 | + "strconv" |
| | 14 | + "strings" |
| | 15 | + "time" |
| | 16 | + |
| | 17 | + "github.com/jackc/pgx/v5" |
| | 18 | + "github.com/jackc/pgx/v5/pgtype" |
| | 19 | + "github.com/jackc/pgx/v5/pgxpool" |
| | 20 | + "github.com/spf13/cobra" |
| | 21 | + |
| | 22 | + "github.com/tenseleyFlow/shithub/internal/infra/config" |
| | 23 | + "github.com/tenseleyFlow/shithub/internal/infra/db" |
| | 24 | + usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc" |
| | 25 | + "github.com/tenseleyFlow/shithub/internal/worker" |
| | 26 | + workerdb "github.com/tenseleyFlow/shithub/internal/worker/sqlc" |
| | 27 | +) |
| | 28 | + |
| | 29 | +// hookCmd is the umbrella for `shithubd hook <name>`. Each named hook |
| | 30 | +// is a leaf subcommand; the symlink shim installed by hooks.Install |
| | 31 | +// invokes one of them. Hidden because no human runs these directly. |
| | 32 | +var hookCmd = &cobra.Command{ |
| | 33 | + Use: "hook", |
| | 34 | + Short: "Git hook entrypoints (post-receive, pre-receive)", |
| | 35 | + Hidden: true, |
| | 36 | +} |
| | 37 | + |
| | 38 | +// hookPreReceiveCmd implements the minimum-gates pre-receive hook |
| | 39 | +// described in S14. Full branch-protection gates land in S20. |
| | 40 | +// |
| | 41 | +// Stdin lines: "<old_sha> <new_sha> <ref>". |
| | 42 | +// |
| | 43 | +// Exit codes: |
| | 44 | +// - 0: accept the push. |
| | 45 | +// - 1: reject; git aborts and prints whatever we wrote to stderr. |
| | 46 | +// |
| | 47 | +// Latency budget: under 100ms for the common case (no archive/suspension). |
| | 48 | +// We re-check user/repo state from the DB to avoid trusting potentially |
| | 49 | +// stale env vars from long-lived SSH sessions. |
| | 50 | +var hookPreReceiveCmd = &cobra.Command{ |
| | 51 | + Use: "pre-receive", |
| | 52 | + Short: "Hook: pre-receive — minimum-gates accept/reject", |
| | 53 | + Hidden: true, |
| | 54 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| | 55 | + ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second) |
| | 56 | + defer cancel() |
| | 57 | + |
| | 58 | + hook, err := loadHookCtx(ctx) |
| | 59 | + if err != nil { |
| | 60 | + fmt.Fprintln(cmd.ErrOrStderr(), friendlyHookErr(err)) |
| | 61 | + return err |
| | 62 | + } |
| | 63 | + defer hook.pool.Close() |
| | 64 | + |
| | 65 | + // Drain stdin so git doesn't EPIPE — we don't actually need the |
| | 66 | + // per-ref data for the minimum gates, but a future protection |
| | 67 | + // engine (S20) does. Reading and discarding is the safe contract. |
| | 68 | + _, _ = io.Copy(io.Discard, cmd.InOrStdin()) |
| | 69 | + |
| | 70 | + if err := preReceiveCheck(ctx, hook); err != nil { |
| | 71 | + fmt.Fprintln(cmd.ErrOrStderr(), friendlyHookErr(err)) |
| | 72 | + return err |
| | 73 | + } |
| | 74 | + return nil |
| | 75 | + }, |
| | 76 | +} |
| | 77 | + |
| | 78 | +// hookPostReceiveCmd records each pushed ref as a push_events row, |
| | 79 | +// enqueues a push:process job per ref, and NOTIFYs idle workers. |
| | 80 | +// Latency budget: under 100ms for typical small pushes; we keep the |
| | 81 | +// hook to INSERT + NOTIFY + exit. No HTTP calls, no derivation work. |
| | 82 | +var hookPostReceiveCmd = &cobra.Command{ |
| | 83 | + Use: "post-receive", |
| | 84 | + Short: "Hook: post-receive — enqueue async processing", |
| | 85 | + Hidden: true, |
| | 86 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| | 87 | + ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second) |
| | 88 | + defer cancel() |
| | 89 | + |
| | 90 | + hook, err := loadHookCtx(ctx) |
| | 91 | + if err != nil { |
| | 92 | + // post-receive is non-fatal: the push has already landed. We |
| | 93 | + // log to stderr (the user's git client sees it) but exit 0 |
| | 94 | + // so the push isn't reported as failed. |
| | 95 | + fmt.Fprintln(cmd.ErrOrStderr(), "shithub: warning: post-receive enqueue skipped:", err) |
| | 96 | + return nil |
| | 97 | + } |
| | 98 | + defer hook.pool.Close() |
| | 99 | + |
| | 100 | + refs, err := readRefLines(cmd.InOrStdin()) |
| | 101 | + if err != nil || len(refs) == 0 { |
| | 102 | + return nil |
| | 103 | + } |
| | 104 | + |
| | 105 | + if err := postReceiveEnqueue(ctx, hook, refs); err != nil { |
| | 106 | + fmt.Fprintln(cmd.ErrOrStderr(), "shithub: warning: post-receive enqueue:", err) |
| | 107 | + } |
| | 108 | + return nil |
| | 109 | + }, |
| | 110 | +} |
| | 111 | + |
| | 112 | +// hookCtx bundles the deps each hook subcommand needs. Loaded once per |
| | 113 | +// invocation; closed by the caller via defer. |
| | 114 | +type hookCtx struct { |
| | 115 | + cfg config.Config |
| | 116 | + pool *pgxpool.Pool |
| | 117 | + logger *slog.Logger |
| | 118 | + |
| | 119 | + userID int64 |
| | 120 | + username string |
| | 121 | + repoID int64 |
| | 122 | + repoFull string |
| | 123 | + protocol string |
| | 124 | + remoteIP string |
| | 125 | + requestID string |
| | 126 | +} |
| | 127 | + |
| | 128 | +func loadHookCtx(ctx context.Context) (*hookCtx, error) { |
| | 129 | + cfg, err := config.Load(nil) |
| | 130 | + if err != nil { |
| | 131 | + return nil, fmt.Errorf("config: %w", err) |
| | 132 | + } |
| | 133 | + if cfg.DB.URL == "" { |
| | 134 | + return nil, errors.New("DB URL not set") |
| | 135 | + } |
| | 136 | + |
| | 137 | + pool, err := db.Open(ctx, db.Config{ |
| | 138 | + URL: cfg.DB.URL, MaxConns: 2, MinConns: 0, |
| | 139 | + ConnectTimeout: 1500 * time.Millisecond, |
| | 140 | + }) |
| | 141 | + if err != nil { |
| | 142 | + return nil, fmt.Errorf("db: %w", err) |
| | 143 | + } |
| | 144 | + |
| | 145 | + logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo})) |
| | 146 | + |
| | 147 | + uid, _ := strconv.ParseInt(os.Getenv("SHITHUB_USER_ID"), 10, 64) |
| | 148 | + rid, _ := strconv.ParseInt(os.Getenv("SHITHUB_REPO_ID"), 10, 64) |
| | 149 | + return &hookCtx{ |
| | 150 | + cfg: cfg, |
| | 151 | + pool: pool, |
| | 152 | + logger: logger, |
| | 153 | + userID: uid, |
| | 154 | + username: os.Getenv("SHITHUB_USERNAME"), |
| | 155 | + repoID: rid, |
| | 156 | + repoFull: os.Getenv("SHITHUB_REPO_FULL_NAME"), |
| | 157 | + protocol: os.Getenv("SHITHUB_PROTOCOL"), |
| | 158 | + remoteIP: os.Getenv("SHITHUB_REMOTE_IP"), |
| | 159 | + requestID: os.Getenv("SHITHUB_REQUEST_ID"), |
| | 160 | + }, nil |
| | 161 | +} |
| | 162 | + |
| | 163 | +// errHookGate is the typed error pre-receive returns for each rejection |
| | 164 | +// reason. friendlyHookErr maps these back to user-facing messages. |
| | 165 | +type errHookGate struct{ kind string } |
| | 166 | + |
| | 167 | +func (e errHookGate) Error() string { return "shithub-hook: " + e.kind } |
| | 168 | + |
| | 169 | +var ( |
| | 170 | + errHookSuspended = errHookGate{"user suspended"} |
| | 171 | + errHookArchived = errHookGate{"repo archived"} |
| | 172 | + errHookDeleted = errHookGate{"repo deleted"} |
| | 173 | + errHookMissing = errHookGate{"missing context"} |
| | 174 | +) |
| | 175 | + |
| | 176 | +func friendlyHookErr(err error) string { |
| | 177 | + switch { |
| | 178 | + case errors.Is(err, errHookSuspended): |
| | 179 | + return "shithub: your account is suspended; pushes are disabled." |
| | 180 | + case errors.Is(err, errHookArchived): |
| | 181 | + return "shithub: this repository is archived; pushes are disabled." |
| | 182 | + case errors.Is(err, errHookDeleted): |
| | 183 | + return "shithub: this repository has been deleted." |
| | 184 | + case errors.Is(err, errHookMissing): |
| | 185 | + return "shithub: server error: hook context missing. Contact the operator." |
| | 186 | + default: |
| | 187 | + return "shithub: server error: " + err.Error() |
| | 188 | + } |
| | 189 | +} |
| | 190 | + |
| | 191 | +func preReceiveCheck(ctx context.Context, h *hookCtx) error { |
| | 192 | + if h.userID == 0 || h.repoID == 0 { |
| | 193 | + return errHookMissing |
| | 194 | + } |
| | 195 | + uq := usersdb.New() |
| | 196 | + user, err := uq.GetUserByID(ctx, h.pool, h.userID) |
| | 197 | + if err != nil { |
| | 198 | + return fmt.Errorf("user lookup: %w", err) |
| | 199 | + } |
| | 200 | + if user.SuspendedAt.Valid { |
| | 201 | + return errHookSuspended |
| | 202 | + } |
| | 203 | + |
| | 204 | + row := h.pool.QueryRow(ctx, |
| | 205 | + `SELECT is_archived, deleted_at FROM repos WHERE id = $1`, h.repoID) |
| | 206 | + var archived bool |
| | 207 | + var deletedAt pgtype.Timestamptz |
| | 208 | + if err := row.Scan(&archived, &deletedAt); err != nil { |
| | 209 | + return fmt.Errorf("repo lookup: %w", err) |
| | 210 | + } |
| | 211 | + if deletedAt.Valid { |
| | 212 | + return errHookDeleted |
| | 213 | + } |
| | 214 | + if archived { |
| | 215 | + return errHookArchived |
| | 216 | + } |
| | 217 | + return nil |
| | 218 | +} |
| | 219 | + |
| | 220 | +func postReceiveEnqueue(ctx context.Context, h *hookCtx, refs []refUpdate) error { |
| | 221 | + if h.repoID == 0 { |
| | 222 | + return errHookMissing |
| | 223 | + } |
| | 224 | + |
| | 225 | + tx, err := h.pool.Begin(ctx) |
| | 226 | + if err != nil { |
| | 227 | + return fmt.Errorf("begin: %w", err) |
| | 228 | + } |
| | 229 | + committed := false |
| | 230 | + defer func() { |
| | 231 | + if !committed { |
| | 232 | + _ = tx.Rollback(ctx) |
| | 233 | + } |
| | 234 | + }() |
| | 235 | + |
| | 236 | + wq := workerdb.New() |
| | 237 | + protocol := h.protocol |
| | 238 | + if protocol == "" { |
| | 239 | + protocol = "ssh" // safe fallback when env is missing |
| | 240 | + } |
| | 241 | + for _, r := range refs { |
| | 242 | + event, err := wq.InsertPushEvent(ctx, tx, workerdb.InsertPushEventParams{ |
| | 243 | + RepoID: h.repoID, |
| | 244 | + BeforeSha: r.before, |
| | 245 | + AfterSha: r.after, |
| | 246 | + Ref: r.ref, |
| | 247 | + Protocol: protocol, |
| | 248 | + PusherUserID: pgtype.Int8{Int64: h.userID, Valid: h.userID != 0}, |
| | 249 | + RequestID: pgtype.Text{String: h.requestID, Valid: h.requestID != ""}, |
| | 250 | + }) |
| | 251 | + if err != nil { |
| | 252 | + return fmt.Errorf("insert push_event: %w", err) |
| | 253 | + } |
| | 254 | + if _, err := worker.Enqueue(ctx, tx, worker.KindPushProcess, |
| | 255 | + map[string]any{"push_event_id": event.ID}, |
| | 256 | + worker.EnqueueOptions{}); err != nil { |
| | 257 | + return fmt.Errorf("enqueue push:process: %w", err) |
| | 258 | + } |
| | 259 | + } |
| | 260 | + if err := worker.Notify(ctx, tx); err != nil { |
| | 261 | + // Notify failure inside tx is non-fatal — workers also poll. |
| | 262 | + h.logger.WarnContext(ctx, "post-receive: NOTIFY failed", "error", err) |
| | 263 | + } |
| | 264 | + if err := tx.Commit(ctx); err != nil { |
| | 265 | + return fmt.Errorf("commit: %w", err) |
| | 266 | + } |
| | 267 | + committed = true |
| | 268 | + return nil |
| | 269 | +} |
| | 270 | + |
| | 271 | +// refUpdate is one stdin line as parsed by readRefLines. |
| | 272 | +type refUpdate struct { |
| | 273 | + before, after, ref string |
| | 274 | +} |
| | 275 | + |
| | 276 | +func readRefLines(r io.Reader) ([]refUpdate, error) { |
| | 277 | + var out []refUpdate |
| | 278 | + sc := bufio.NewScanner(r) |
| | 279 | + sc.Buffer(make([]byte, 0, 64<<10), 1<<20) |
| | 280 | + for sc.Scan() { |
| | 281 | + line := strings.TrimSpace(sc.Text()) |
| | 282 | + if line == "" { |
| | 283 | + continue |
| | 284 | + } |
| | 285 | + parts := strings.Fields(line) |
| | 286 | + if len(parts) != 3 { |
| | 287 | + continue |
| | 288 | + } |
| | 289 | + out = append(out, refUpdate{before: parts[0], after: parts[1], ref: parts[2]}) |
| | 290 | + } |
| | 291 | + return out, sc.Err() |
| | 292 | +} |
| | 293 | + |
| | 294 | +// hooksReinstallCmd reinstalls hook symlinks on every active repo, used |
| | 295 | +// after a binary path change in production deploys. --repo runs against |
| | 296 | +// a single owner/name; --all walks every repo via the DB. |
| | 297 | +var hooksReinstallCmd = &cobra.Command{ |
| | 298 | + Use: "reinstall", |
| | 299 | + Short: "Reinstall hook symlinks on existing repos", |
| | 300 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| | 301 | + all, _ := cmd.Flags().GetBool("all") |
| | 302 | + repo, _ := cmd.Flags().GetString("repo") |
| | 303 | + if !all && repo == "" { |
| | 304 | + return errors.New("hooks reinstall: pass --all or --repo owner/name") |
| | 305 | + } |
| | 306 | + return runHooksReinstall(cmd.Context(), all, repo, cmd.OutOrStdout()) |
| | 307 | + }, |
| | 308 | +} |
| | 309 | + |
| | 310 | +// hooksParentCmd is the umbrella so the operator command reads as |
| | 311 | +// `shithubd hooks reinstall ...`. |
| | 312 | +var hooksParentCmd = &cobra.Command{ |
| | 313 | + Use: "hooks", |
| | 314 | + Short: "Operator commands for git hook installation", |
| | 315 | +} |
| | 316 | + |
| | 317 | +func init() { |
| | 318 | + hookCmd.AddCommand(hookPreReceiveCmd) |
| | 319 | + hookCmd.AddCommand(hookPostReceiveCmd) |
| | 320 | + hooksReinstallCmd.Flags().Bool("all", false, "Reinstall on every active repo") |
| | 321 | + hooksReinstallCmd.Flags().String("repo", "", "Reinstall on owner/name only") |
| | 322 | + hooksParentCmd.AddCommand(hooksReinstallCmd) |
| | 323 | + |
| | 324 | + rootCmd.AddCommand(hookCmd) |
| | 325 | + rootCmd.AddCommand(hooksParentCmd) |
| | 326 | +} |
| | 327 | + |
| | 328 | +// silence unused import warnings during incremental builds — the pgx |
| | 329 | +// import is used through the hookCtx pool helper above. |
| | 330 | +var _ = pgx.ErrNoRows |