@@ -0,0 +1,330 @@ |
| 1 | +// SPDX-License-Identifier: AGPL-3.0-or-later |
| 2 | + |
| 3 | +package main |
| 4 | + |
| 5 | +import ( |
| 6 | + "bufio" |
| 7 | + "context" |
| 8 | + "errors" |
| 9 | + "fmt" |
| 10 | + "io" |
| 11 | + "log/slog" |
| 12 | + "os" |
| 13 | + "strconv" |
| 14 | + "strings" |
| 15 | + "time" |
| 16 | + |
| 17 | + "github.com/jackc/pgx/v5" |
| 18 | + "github.com/jackc/pgx/v5/pgtype" |
| 19 | + "github.com/jackc/pgx/v5/pgxpool" |
| 20 | + "github.com/spf13/cobra" |
| 21 | + |
| 22 | + "github.com/tenseleyFlow/shithub/internal/infra/config" |
| 23 | + "github.com/tenseleyFlow/shithub/internal/infra/db" |
| 24 | + usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc" |
| 25 | + "github.com/tenseleyFlow/shithub/internal/worker" |
| 26 | + workerdb "github.com/tenseleyFlow/shithub/internal/worker/sqlc" |
| 27 | +) |
| 28 | + |
| 29 | +// hookCmd is the umbrella for `shithubd hook <name>`. Each named hook |
| 30 | +// is a leaf subcommand; the symlink shim installed by hooks.Install |
| 31 | +// invokes one of them. Hidden because no human runs these directly. |
| 32 | +var hookCmd = &cobra.Command{ |
| 33 | + Use: "hook", |
| 34 | + Short: "Git hook entrypoints (post-receive, pre-receive)", |
| 35 | + Hidden: true, |
| 36 | +} |
| 37 | + |
| 38 | +// hookPreReceiveCmd implements the minimum-gates pre-receive hook |
| 39 | +// described in S14. Full branch-protection gates land in S20. |
| 40 | +// |
| 41 | +// Stdin lines: "<old_sha> <new_sha> <ref>". |
| 42 | +// |
| 43 | +// Exit codes: |
| 44 | +// - 0: accept the push. |
| 45 | +// - 1: reject; git aborts and prints whatever we wrote to stderr. |
| 46 | +// |
| 47 | +// Latency budget: under 100ms for the common case (no archive/suspension). |
| 48 | +// We re-check user/repo state from the DB to avoid trusting potentially |
| 49 | +// stale env vars from long-lived SSH sessions. |
| 50 | +var hookPreReceiveCmd = &cobra.Command{ |
| 51 | + Use: "pre-receive", |
| 52 | + Short: "Hook: pre-receive — minimum-gates accept/reject", |
| 53 | + Hidden: true, |
| 54 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| 55 | + ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second) |
| 56 | + defer cancel() |
| 57 | + |
| 58 | + hook, err := loadHookCtx(ctx) |
| 59 | + if err != nil { |
| 60 | + fmt.Fprintln(cmd.ErrOrStderr(), friendlyHookErr(err)) |
| 61 | + return err |
| 62 | + } |
| 63 | + defer hook.pool.Close() |
| 64 | + |
| 65 | + // Drain stdin so git doesn't EPIPE — we don't actually need the |
| 66 | + // per-ref data for the minimum gates, but a future protection |
| 67 | + // engine (S20) does. Reading and discarding is the safe contract. |
| 68 | + _, _ = io.Copy(io.Discard, cmd.InOrStdin()) |
| 69 | + |
| 70 | + if err := preReceiveCheck(ctx, hook); err != nil { |
| 71 | + fmt.Fprintln(cmd.ErrOrStderr(), friendlyHookErr(err)) |
| 72 | + return err |
| 73 | + } |
| 74 | + return nil |
| 75 | + }, |
| 76 | +} |
| 77 | + |
| 78 | +// hookPostReceiveCmd records each pushed ref as a push_events row, |
| 79 | +// enqueues a push:process job per ref, and NOTIFYs idle workers. |
| 80 | +// Latency budget: under 100ms for typical small pushes; we keep the |
| 81 | +// hook to INSERT + NOTIFY + exit. No HTTP calls, no derivation work. |
| 82 | +var hookPostReceiveCmd = &cobra.Command{ |
| 83 | + Use: "post-receive", |
| 84 | + Short: "Hook: post-receive — enqueue async processing", |
| 85 | + Hidden: true, |
| 86 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| 87 | + ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second) |
| 88 | + defer cancel() |
| 89 | + |
| 90 | + hook, err := loadHookCtx(ctx) |
| 91 | + if err != nil { |
| 92 | + // post-receive is non-fatal: the push has already landed. We |
| 93 | + // log to stderr (the user's git client sees it) but exit 0 |
| 94 | + // so the push isn't reported as failed. |
| 95 | + fmt.Fprintln(cmd.ErrOrStderr(), "shithub: warning: post-receive enqueue skipped:", err) |
| 96 | + return nil |
| 97 | + } |
| 98 | + defer hook.pool.Close() |
| 99 | + |
| 100 | + refs, err := readRefLines(cmd.InOrStdin()) |
| 101 | + if err != nil || len(refs) == 0 { |
| 102 | + return nil |
| 103 | + } |
| 104 | + |
| 105 | + if err := postReceiveEnqueue(ctx, hook, refs); err != nil { |
| 106 | + fmt.Fprintln(cmd.ErrOrStderr(), "shithub: warning: post-receive enqueue:", err) |
| 107 | + } |
| 108 | + return nil |
| 109 | + }, |
| 110 | +} |
| 111 | + |
| 112 | +// hookCtx bundles the deps each hook subcommand needs. Loaded once per |
| 113 | +// invocation; closed by the caller via defer. |
| 114 | +type hookCtx struct { |
| 115 | + cfg config.Config |
| 116 | + pool *pgxpool.Pool |
| 117 | + logger *slog.Logger |
| 118 | + |
| 119 | + userID int64 |
| 120 | + username string |
| 121 | + repoID int64 |
| 122 | + repoFull string |
| 123 | + protocol string |
| 124 | + remoteIP string |
| 125 | + requestID string |
| 126 | +} |
| 127 | + |
| 128 | +func loadHookCtx(ctx context.Context) (*hookCtx, error) { |
| 129 | + cfg, err := config.Load(nil) |
| 130 | + if err != nil { |
| 131 | + return nil, fmt.Errorf("config: %w", err) |
| 132 | + } |
| 133 | + if cfg.DB.URL == "" { |
| 134 | + return nil, errors.New("DB URL not set") |
| 135 | + } |
| 136 | + |
| 137 | + pool, err := db.Open(ctx, db.Config{ |
| 138 | + URL: cfg.DB.URL, MaxConns: 2, MinConns: 0, |
| 139 | + ConnectTimeout: 1500 * time.Millisecond, |
| 140 | + }) |
| 141 | + if err != nil { |
| 142 | + return nil, fmt.Errorf("db: %w", err) |
| 143 | + } |
| 144 | + |
| 145 | + logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo})) |
| 146 | + |
| 147 | + uid, _ := strconv.ParseInt(os.Getenv("SHITHUB_USER_ID"), 10, 64) |
| 148 | + rid, _ := strconv.ParseInt(os.Getenv("SHITHUB_REPO_ID"), 10, 64) |
| 149 | + return &hookCtx{ |
| 150 | + cfg: cfg, |
| 151 | + pool: pool, |
| 152 | + logger: logger, |
| 153 | + userID: uid, |
| 154 | + username: os.Getenv("SHITHUB_USERNAME"), |
| 155 | + repoID: rid, |
| 156 | + repoFull: os.Getenv("SHITHUB_REPO_FULL_NAME"), |
| 157 | + protocol: os.Getenv("SHITHUB_PROTOCOL"), |
| 158 | + remoteIP: os.Getenv("SHITHUB_REMOTE_IP"), |
| 159 | + requestID: os.Getenv("SHITHUB_REQUEST_ID"), |
| 160 | + }, nil |
| 161 | +} |
| 162 | + |
| 163 | +// errHookGate is the typed error pre-receive returns for each rejection |
| 164 | +// reason. friendlyHookErr maps these back to user-facing messages. |
| 165 | +type errHookGate struct{ kind string } |
| 166 | + |
| 167 | +func (e errHookGate) Error() string { return "shithub-hook: " + e.kind } |
| 168 | + |
| 169 | +var ( |
| 170 | + errHookSuspended = errHookGate{"user suspended"} |
| 171 | + errHookArchived = errHookGate{"repo archived"} |
| 172 | + errHookDeleted = errHookGate{"repo deleted"} |
| 173 | + errHookMissing = errHookGate{"missing context"} |
| 174 | +) |
| 175 | + |
| 176 | +func friendlyHookErr(err error) string { |
| 177 | + switch { |
| 178 | + case errors.Is(err, errHookSuspended): |
| 179 | + return "shithub: your account is suspended; pushes are disabled." |
| 180 | + case errors.Is(err, errHookArchived): |
| 181 | + return "shithub: this repository is archived; pushes are disabled." |
| 182 | + case errors.Is(err, errHookDeleted): |
| 183 | + return "shithub: this repository has been deleted." |
| 184 | + case errors.Is(err, errHookMissing): |
| 185 | + return "shithub: server error: hook context missing. Contact the operator." |
| 186 | + default: |
| 187 | + return "shithub: server error: " + err.Error() |
| 188 | + } |
| 189 | +} |
| 190 | + |
| 191 | +func preReceiveCheck(ctx context.Context, h *hookCtx) error { |
| 192 | + if h.userID == 0 || h.repoID == 0 { |
| 193 | + return errHookMissing |
| 194 | + } |
| 195 | + uq := usersdb.New() |
| 196 | + user, err := uq.GetUserByID(ctx, h.pool, h.userID) |
| 197 | + if err != nil { |
| 198 | + return fmt.Errorf("user lookup: %w", err) |
| 199 | + } |
| 200 | + if user.SuspendedAt.Valid { |
| 201 | + return errHookSuspended |
| 202 | + } |
| 203 | + |
| 204 | + row := h.pool.QueryRow(ctx, |
| 205 | + `SELECT is_archived, deleted_at FROM repos WHERE id = $1`, h.repoID) |
| 206 | + var archived bool |
| 207 | + var deletedAt pgtype.Timestamptz |
| 208 | + if err := row.Scan(&archived, &deletedAt); err != nil { |
| 209 | + return fmt.Errorf("repo lookup: %w", err) |
| 210 | + } |
| 211 | + if deletedAt.Valid { |
| 212 | + return errHookDeleted |
| 213 | + } |
| 214 | + if archived { |
| 215 | + return errHookArchived |
| 216 | + } |
| 217 | + return nil |
| 218 | +} |
| 219 | + |
| 220 | +func postReceiveEnqueue(ctx context.Context, h *hookCtx, refs []refUpdate) error { |
| 221 | + if h.repoID == 0 { |
| 222 | + return errHookMissing |
| 223 | + } |
| 224 | + |
| 225 | + tx, err := h.pool.Begin(ctx) |
| 226 | + if err != nil { |
| 227 | + return fmt.Errorf("begin: %w", err) |
| 228 | + } |
| 229 | + committed := false |
| 230 | + defer func() { |
| 231 | + if !committed { |
| 232 | + _ = tx.Rollback(ctx) |
| 233 | + } |
| 234 | + }() |
| 235 | + |
| 236 | + wq := workerdb.New() |
| 237 | + protocol := h.protocol |
| 238 | + if protocol == "" { |
| 239 | + protocol = "ssh" // safe fallback when env is missing |
| 240 | + } |
| 241 | + for _, r := range refs { |
| 242 | + event, err := wq.InsertPushEvent(ctx, tx, workerdb.InsertPushEventParams{ |
| 243 | + RepoID: h.repoID, |
| 244 | + BeforeSha: r.before, |
| 245 | + AfterSha: r.after, |
| 246 | + Ref: r.ref, |
| 247 | + Protocol: protocol, |
| 248 | + PusherUserID: pgtype.Int8{Int64: h.userID, Valid: h.userID != 0}, |
| 249 | + RequestID: pgtype.Text{String: h.requestID, Valid: h.requestID != ""}, |
| 250 | + }) |
| 251 | + if err != nil { |
| 252 | + return fmt.Errorf("insert push_event: %w", err) |
| 253 | + } |
| 254 | + if _, err := worker.Enqueue(ctx, tx, worker.KindPushProcess, |
| 255 | + map[string]any{"push_event_id": event.ID}, |
| 256 | + worker.EnqueueOptions{}); err != nil { |
| 257 | + return fmt.Errorf("enqueue push:process: %w", err) |
| 258 | + } |
| 259 | + } |
| 260 | + if err := worker.Notify(ctx, tx); err != nil { |
| 261 | + // Notify failure inside tx is non-fatal — workers also poll. |
| 262 | + h.logger.WarnContext(ctx, "post-receive: NOTIFY failed", "error", err) |
| 263 | + } |
| 264 | + if err := tx.Commit(ctx); err != nil { |
| 265 | + return fmt.Errorf("commit: %w", err) |
| 266 | + } |
| 267 | + committed = true |
| 268 | + return nil |
| 269 | +} |
| 270 | + |
| 271 | +// refUpdate is one stdin line as parsed by readRefLines. |
| 272 | +type refUpdate struct { |
| 273 | + before, after, ref string |
| 274 | +} |
| 275 | + |
| 276 | +func readRefLines(r io.Reader) ([]refUpdate, error) { |
| 277 | + var out []refUpdate |
| 278 | + sc := bufio.NewScanner(r) |
| 279 | + sc.Buffer(make([]byte, 0, 64<<10), 1<<20) |
| 280 | + for sc.Scan() { |
| 281 | + line := strings.TrimSpace(sc.Text()) |
| 282 | + if line == "" { |
| 283 | + continue |
| 284 | + } |
| 285 | + parts := strings.Fields(line) |
| 286 | + if len(parts) != 3 { |
| 287 | + continue |
| 288 | + } |
| 289 | + out = append(out, refUpdate{before: parts[0], after: parts[1], ref: parts[2]}) |
| 290 | + } |
| 291 | + return out, sc.Err() |
| 292 | +} |
| 293 | + |
| 294 | +// hooksReinstallCmd reinstalls hook symlinks on every active repo, used |
| 295 | +// after a binary path change in production deploys. --repo runs against |
| 296 | +// a single owner/name; --all walks every repo via the DB. |
| 297 | +var hooksReinstallCmd = &cobra.Command{ |
| 298 | + Use: "reinstall", |
| 299 | + Short: "Reinstall hook symlinks on existing repos", |
| 300 | + RunE: func(cmd *cobra.Command, _ []string) error { |
| 301 | + all, _ := cmd.Flags().GetBool("all") |
| 302 | + repo, _ := cmd.Flags().GetString("repo") |
| 303 | + if !all && repo == "" { |
| 304 | + return errors.New("hooks reinstall: pass --all or --repo owner/name") |
| 305 | + } |
| 306 | + return runHooksReinstall(cmd.Context(), all, repo, cmd.OutOrStdout()) |
| 307 | + }, |
| 308 | +} |
| 309 | + |
| 310 | +// hooksParentCmd is the umbrella so the operator command reads as |
| 311 | +// `shithubd hooks reinstall ...`. |
| 312 | +var hooksParentCmd = &cobra.Command{ |
| 313 | + Use: "hooks", |
| 314 | + Short: "Operator commands for git hook installation", |
| 315 | +} |
| 316 | + |
| 317 | +func init() { |
| 318 | + hookCmd.AddCommand(hookPreReceiveCmd) |
| 319 | + hookCmd.AddCommand(hookPostReceiveCmd) |
| 320 | + hooksReinstallCmd.Flags().Bool("all", false, "Reinstall on every active repo") |
| 321 | + hooksReinstallCmd.Flags().String("repo", "", "Reinstall on owner/name only") |
| 322 | + hooksParentCmd.AddCommand(hooksReinstallCmd) |
| 323 | + |
| 324 | + rootCmd.AddCommand(hookCmd) |
| 325 | + rootCmd.AddCommand(hooksParentCmd) |
| 326 | +} |
| 327 | + |
| 328 | +// silence unused import warnings during incremental builds — the pgx |
| 329 | +// import is used through the hookCtx pool helper above. |
| 330 | +var _ = pgx.ErrNoRows |