rebuilderd 0.27.0

rebuilderd - independent build verification daemon
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

use crate::api;
use crate::config::Config;
use crate::models::Worker;
use crate::schema::workers;
use actix_web::HttpRequest;
use diesel::QueryDsl;
use diesel::SqliteExpressionMethods;
use diesel::{RunQueryDsl, SqliteConnection};
use log::debug;
use rebuilderd_common::api::{AUTH_COOKIE_HEADER, SIGNUP_SECRET_HEADER, WORKER_KEY_HEADER};
use rebuilderd_common::errors::{Context, bail};

pub fn admin(cfg: &Config, req: &HttpRequest) -> rebuilderd_common::errors::Result<()> {
    let auth_cookie = api::header(req, AUTH_COOKIE_HEADER).context("Failed to get auth cookie")?;

    if cfg.auth_cookie != auth_cookie {
        bail!("Wrong auth cookie")
    }

    Ok(())
}

pub fn worker(
    cfg: &Config,
    req: &HttpRequest,
    connection: &mut SqliteConnection,
) -> rebuilderd_common::errors::Result<Worker> {
    let worker_key = api::header(req, WORKER_KEY_HEADER).context("Failed to get worker key")?;

    if !cfg.worker.authorized_workers.is_empty()
        && !cfg
            .worker
            .authorized_workers
            .iter()
            .any(|x| x == worker_key)
    {
        bail!("Worker key is not on allow-list");
    }

    let key_is_registered = diesel::dsl::select(diesel::dsl::exists(
        workers::table.filter(workers::key.is(worker_key)),
    ))
    .get_result::<bool>(connection)?;

    if !key_is_registered {
        bail!("Worker is not registered")
    }

    let worker = Worker::get_and_refresh(worker_key, connection)?;
    Ok(worker)
}

pub fn signup(cfg: &Config, req: &HttpRequest) -> rebuilderd_common::errors::Result<()> {
    let worker_key = api::header(req, WORKER_KEY_HEADER).context("Failed to get worker key")?;

    if !cfg.worker.authorized_workers.is_empty()
        && !cfg
            .worker
            .authorized_workers
            .iter()
            .any(|x| x == worker_key)
    {
        bail!("Worker key is not on allow-list");
    }

    if let Some(expected_signup_secret) = &cfg.worker.signup_secret {
        let signup_secret =
            api::header(req, SIGNUP_SECRET_HEADER).context("Failed to get signup secret")?;

        if signup_secret == expected_signup_secret {
            debug!("worker authenticated with signup secret");
            return Ok(());
        } else {
            bail!("Signup secret mismatched");
        }
    }

    Ok(())
}