mosaicstack/stack
25
0
Fork 1
Code Issues 340 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

feat(queue): Piece D, reviews as issue comments, raw per-seat token helper (row 12, #1508)

Browse Source 
queue move ID in-review posts the review request as a Gitea comment and
review record reads verdicts back, so reviews stop being files in
docs/plans/reviews/. On a comment round, in-review to waiting-on-jason
now needs every listed reviewer's approval for the current round, the
same as in-review to done (Filbert r1 C1). scripts/gitea-api.sh reads
the raw per-seat token files (lead decisions 37 to 39): config built and
checked before curl starts, export attribute cleared, fixed base URL.
test-queue.sh skips its live checks outside the canonical root.

Darkwing authored. Filbert approved D r2 (cf1d3fd0) after r1 (a2dc2302)
and corrected the plan (293747cd). Rocko reviewed the helper (e896192f,
2096b0a3), and Sage's lead check passed under decision 38. Manifest
b402fb38, 19 files.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-09-27 10:07:29 -05:00
co-authored by Claude Opus 5.5
parent cdcedb2741
commit f539466fcb
19 changed files with 2541 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitea-api.sh
+45 -20
View File
@@ -7,6 +7,11 @@
# Security:
# - Reads credentials from ~/secrets/mosaic.gitea.json (or
# MOSAIC_GITEA_CREDENTIAL_FILE); file must be 0600, non-symlink.
# - A file that parses as JSON must hold mosaicstack.url and api_token.
# A file that does not parse is a raw per-seat token file: exactly 40
# lowercase hex characters, optionally followed by one newline. Its base
# URL is fixed at https://git.mosaicstack.dev, with no override. Any other
# content refuses (exit 3) before a request is made.
# - Token is passed to curl via a config stream (never argv, never disk,
# never stdout/stderr).
# - Prints the response body on stdout and "HTTP <code>" on stderr.
@@ -23,35 +28,55 @@ command -v node >/dev/null || { echo "gitea-api: node not found" >&2; exit 1; }
export MOSAIC_GITEA_CREDENTIAL_FILE="${MOSAIC_GITEA_CREDENTIAL_FILE:-$HOME/secrets/mosaic.gitea.json}"
# Validate credential file; emit only the non-secret base URL on stdout.
BASE="$(node -e '
# Validate the credential file. `base` prints only the non-secret base URL;
# `cfg` prints the curl config stream. Both run every check, so the second
# read refuses a file that changed after the first.
CRED_JS='
const fs = require("fs");
const p = process.env.MOSAIC_GITEA_CREDENTIAL_FILE;
let s;
try { s = fs.lstatSync(p); } catch { process.exit(3); }
if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) process.exit(3);
let e;
try { e = JSON.parse(fs.readFileSync(p, "utf8")).mosaicstack || {}; } catch { process.exit(3); }
const base = String(e.url || "").replace(/\/+$/, "");
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
process.stdout.write(base);
')"
let text;
try { text = fs.readFileSync(p, "utf8"); } catch { process.exit(3); }
let base, token;
let e = null;
try { e = JSON.parse(text).mosaicstack || {}; } catch (err) { if (!(err instanceof SyntaxError)) process.exit(3); }
if (e !== null) {
base = String(e.url || "").replace(/\/+$/, "");
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
token = e.api_token;
} else {
const n = Buffer.byteLength(text);
if ((s.size !== 40 && s.size !== 41) || n !== s.size || !/^[0-9a-f]{40}\n?$/.test(text)) process.exit(3);
base = "https://git.mosaicstack.dev";
token = text.slice(0, 40);
}
if (process.argv[1] === "cfg") {
process.stdout.write("header = \"Authorization: token " + token + "\"\n");
process.stdout.write("header = \"Content-Type: application/json\"\n");
} else {
process.stdout.write(base);
}
'
BASE="$(node -e "$CRED_JS" base)"
# Repo path from the configured origin remote (never from credentials).
REMOTE_URL="$(git remote get-url origin)"
REPO_PATH="${REMOTE_URL#https://git.mosaicstack.dev/}"
REPO_PATH="${REPO_PATH%.git}"
# curl config stream: auth header via fd, never argv.
gen_curl_cfg() {
node -e '
const fs = require("fs");
const e = JSON.parse(fs.readFileSync(process.env.MOSAIC_GITEA_CREDENTIAL_FILE, "utf8")).mosaicstack || {};
process.stdout.write("header = \"Authorization: token " + e.api_token + "\"\n");
process.stdout.write("header = \"Content-Type: application/json\"\n");
'
}
# curl config stream: auth header via fd, never argv. The second read
# finishes, and must succeed, before curl starts: a refusal inside <(...)
# would lose its exit status and leave curl an empty config. A CFG
# inherited from the environment keeps its export attribute on assignment,
# and SHELLOPTS=allexport exports every assignment, so export -n clears the
# attribute before any child starts. printf is a builtin, so
# the token is in no argv.
CFG="$(node -e "$CRED_JS" cfg)" || exit 3
export -n CFG
[ -n "$CFG" ] || exit 3
BODY_FILE=""
cleanup() { if [ -n "$BODY_FILE" ]; then rm -f "$BODY_FILE"; fi; }
@@ -64,11 +89,11 @@ fi
URL="$BASE/api/v1/$API_PATH"
if [ -n "$BODY_FILE" ]; then
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
HTTP_CODE="$(curl -sS -K <(printf '%s\n' "$CFG") -o /tmp/gitea-api-response.$$ \
-w '%{http_code}' -X "$METHOD" "$URL" --data-binary @"$BODY_FILE")" || {
echo "gitea-api: request failed" >&2; exit 1; }
else
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
HTTP_CODE="$(curl -sS -K <(printf '%s\n' "$CFG") -o /tmp/gitea-api-response.$$ \
-w '%{http_code}' -X "$METHOD" "$URL")" || {
echo "gitea-api: request failed" >&2; exit 1; }
fi
scripts/test-queue.sh
+20 -8
View File
@@ -9,8 +9,10 @@
# Once HEAD holds docs/plans/queue.json (the genesis commit), the suite also
# runs `verify` and `render --check` on the live queue through
# `scripts/mosaic queue`. Each takes the queue lock for a moment and writes
# nothing. Before genesis it only checks that `scripts/mosaic queue help`
# answers, which reads no queue file and takes no lock.
# nothing. Before genesis, or in a checkout that is not the queue's
# canonicalRoot (an export or a review clone), it skips them and says why;
# `scripts/mosaic queue help` still runs, reading no queue file and taking no
# lock.
set -uo pipefail
cd "$(dirname "$0")/.."
@@ -54,13 +56,23 @@ check "node --test packages/queue/tests/" "$rc"
# --- the dispatch, then the live queue once genesis is committed ---
scripts/mosaic queue help > "$SANDBOX/help.out" 2>&1 && grep -q '^usage: queue list' "$SANDBOX/help.out"
check "scripts/mosaic queue help" $?
if git cat-file -e HEAD:docs/plans/queue.json 2>/dev/null; then
scripts/mosaic queue verify
check "scripts/mosaic queue verify (live queue)" $?
scripts/mosaic queue render --check
check "scripts/mosaic queue render --check (live queue)" $?
else
if ! git cat-file -e HEAD:docs/plans/queue.json 2>/dev/null; then
echo "skip queue verify and render --check: HEAD has no docs/plans/queue.json (before the genesis commit)"
else
CANON="$(git show HEAD:docs/plans/queue.json | node -e 'let s="";process.stdin.on("data",(d)=>{s+=d}).on("end",()=>{const r=JSON.parse(s).canonicalRoot;if(typeof r==="string")process.stdout.write(r)})' 2>/dev/null)"
TOP="$(realpath "$(git rev-parse --show-toplevel)")"
if [ -z "$CANON" ]; then
check "HEAD's docs/plans/queue.json names a canonicalRoot" 1
elif [ "$TOP" != "$CANON" ]; then
# The queue refuses outside its canonical root (8.3), so an export or
# a review clone can't run these two. Say so instead of failing them.
echo "skip queue verify and render --check: this checkout ($TOP) is not the queue's canonical root ($CANON)"
else
scripts/mosaic queue verify
check "scripts/mosaic queue verify (live queue)" $?
scripts/mosaic queue render --check
check "scripts/mosaic queue render --check (live queue)" $?
fi
fi
echo