rise-deploy 0.16.4

A simple and powerful CLI for deploying containerized applications
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

use axum::{
    extract::{Extension, Query, State},
    Json,
};

use super::models::{GetRegistryCredsRequest, GetRegistryCredsResponse};
use crate::db::models::User;
use crate::db::{projects, teams as db_teams};
use crate::server::error::{ServerError, ServerErrorExt};
use crate::server::state::AppState;
use uuid::Uuid;

/// Check if user has permission to deploy to the project
async fn check_deploy_permission(
    state: &AppState,
    project: &crate::db::models::Project,
    user_id: Uuid,
) -> Result<(), ServerError> {
    // If project is owned by the user directly, allow
    if let Some(owner_user_id) = project.owner_user_id {
        if owner_user_id == user_id {
            return Ok(());
        }
    }

    // If project is owned by a team, check if user is an owner of that team
    if let Some(team_id) = project.owner_team_id {
        let is_owner = db_teams::is_owner(&state.db_pool, team_id, user_id)
            .await
            .internal_err("Failed to check team ownership")?;

        if is_owner {
            return Ok(());
        }

        let team = db_teams::find_by_id(&state.db_pool, team_id)
            .await
            .internal_err("Failed to fetch team")?
            .ok_or_else(|| ServerError::not_found("Team not found"))?;

        return Err(ServerError::forbidden(format!(
            "You must be an owner of team '{}' to deploy to this project",
            team.name
        )));
    }

    Err(ServerError::forbidden(
        "You do not have permission to deploy to this project",
    ))
}

/// Get registry credentials for a project
pub async fn get_registry_credentials(
    State(state): State<AppState>,
    Extension(user): Extension<User>,
    Query(params): Query<GetRegistryCredsRequest>,
) -> Result<Json<GetRegistryCredsResponse>, ServerError> {
    // Query project by name
    let project = projects::find_by_name(&state.db_pool, &params.project)
        .await
        .internal_err("Failed to query project")
        .map_err(|e| e.with_context("project_name", &params.project))?
        .ok_or_else(|| ServerError::not_found(format!("Project '{}' not found", params.project)))?;

    // Check if user has permission to deploy to this project
    check_deploy_permission(&state, &project, user.id).await?;

    // Get credentials from the registry provider
    // The repository name is typically the project name
    let repository = params.project.clone();

    let credentials = state
        .registry_provider
        .get_credentials(&repository)
        .await
        .internal_err("Failed to get registry credentials")
        .map_err(|e| {
            e.with_context("project_name", &params.project)
                .with_context("repository", &repository)
        })?;

    Ok(Json(GetRegistryCredsResponse {
        credentials,
        repository,
    }))
}