mosaicstack/stack
25
0
Fork 1
Code Issues 340 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

feat(queue): Piece D, reviews as issue comments, raw per-seat token helper (row 12, #1508)

Browse Source 
queue move ID in-review posts the review request as a Gitea comment and
review record reads verdicts back, so reviews stop being files in
docs/plans/reviews/. On a comment round, in-review to waiting-on-jason
now needs every listed reviewer's approval for the current round, the
same as in-review to done (Filbert r1 C1). scripts/gitea-api.sh reads
the raw per-seat token files (lead decisions 37 to 39): config built and
checked before curl starts, export attribute cleared, fixed base URL.
test-queue.sh skips its live checks outside the canonical root.

Darkwing authored. Filbert approved D r2 (cf1d3fd0) after r1 (a2dc2302)
and corrected the plan (293747cd). Rocko reviewed the helper (e896192f,
2096b0a3), and Sage's lead check passed under decision 38. Manifest
b402fb38, 19 files.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jason.woltje
2026-09-27 10:07:29 -05:00
co-authored by Claude Opus 5.5
parent cdcedb2741
commit f539466fcb
19 changed files with 2541 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitea-api.sh
+45 -20
View File
@@ -7,6 +7,11 @@
# Security:
# - Reads credentials from ~/secrets/mosaic.gitea.json (or
# MOSAIC_GITEA_CREDENTIAL_FILE); file must be 0600, non-symlink.
# - A file that parses as JSON must hold mosaicstack.url and api_token.
# A file that does not parse is a raw per-seat token file: exactly 40
# lowercase hex characters, optionally followed by one newline. Its base
# URL is fixed at https://git.mosaicstack.dev, with no override. Any other
# content refuses (exit 3) before a request is made.
# - Token is passed to curl via a config stream (never argv, never disk,
# never stdout/stderr).
# - Prints the response body on stdout and "HTTP <code>" on stderr.
@@ -23,35 +28,55 @@ command -v node >/dev/null || { echo "gitea-api: node not found" >&2; exit 1; }
export MOSAIC_GITEA_CREDENTIAL_FILE="${MOSAIC_GITEA_CREDENTIAL_FILE:-$HOME/secrets/mosaic.gitea.json}"
# Validate credential file; emit only the non-secret base URL on stdout.
BASE="$(node -e '
# Validate the credential file. `base` prints only the non-secret base URL;
# `cfg` prints the curl config stream. Both run every check, so the second
# read refuses a file that changed after the first.
CRED_JS='
const fs = require("fs");
const p = process.env.MOSAIC_GITEA_CREDENTIAL_FILE;
let s;
try { s = fs.lstatSync(p); } catch { process.exit(3); }
if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) process.exit(3);
let e;
try { e = JSON.parse(fs.readFileSync(p, "utf8")).mosaicstack || {}; } catch { process.exit(3); }
const base = String(e.url || "").replace(/\/+$/, "");
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
process.stdout.write(base);
')"
let text;
try { text = fs.readFileSync(p, "utf8"); } catch { process.exit(3); }
let base, token;
let e = null;
try { e = JSON.parse(text).mosaicstack || {}; } catch (err) { if (!(err instanceof SyntaxError)) process.exit(3); }
if (e !== null) {
base = String(e.url || "").replace(/\/+$/, "");
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
token = e.api_token;
} else {
const n = Buffer.byteLength(text);
if ((s.size !== 40 && s.size !== 41) || n !== s.size || !/^[0-9a-f]{40}\n?$/.test(text)) process.exit(3);
base = "https://git.mosaicstack.dev";
token = text.slice(0, 40);
}
if (process.argv[1] === "cfg") {
process.stdout.write("header = \"Authorization: token " + token + "\"\n");
process.stdout.write("header = \"Content-Type: application/json\"\n");
} else {
process.stdout.write(base);
}
'
BASE="$(node -e "$CRED_JS" base)"
# Repo path from the configured origin remote (never from credentials).
REMOTE_URL="$(git remote get-url origin)"
REPO_PATH="${REMOTE_URL#https://git.mosaicstack.dev/}"
REPO_PATH="${REPO_PATH%.git}"
# curl config stream: auth header via fd, never argv.
gen_curl_cfg() {
node -e '
const fs = require("fs");
const e = JSON.parse(fs.readFileSync(process.env.MOSAIC_GITEA_CREDENTIAL_FILE, "utf8")).mosaicstack || {};
process.stdout.write("header = \"Authorization: token " + e.api_token + "\"\n");
process.stdout.write("header = \"Content-Type: application/json\"\n");
'
}
# curl config stream: auth header via fd, never argv. The second read
# finishes, and must succeed, before curl starts: a refusal inside <(...)
# would lose its exit status and leave curl an empty config. A CFG
# inherited from the environment keeps its export attribute on assignment,
# and SHELLOPTS=allexport exports every assignment, so export -n clears the
# attribute before any child starts. printf is a builtin, so
# the token is in no argv.
CFG="$(node -e "$CRED_JS" cfg)" || exit 3
export -n CFG
[ -n "$CFG" ] || exit 3
BODY_FILE=""
cleanup() { if [ -n "$BODY_FILE" ]; then rm -f "$BODY_FILE"; fi; }
@@ -64,11 +89,11 @@ fi
URL="$BASE/api/v1/$API_PATH"
if [ -n "$BODY_FILE" ]; then
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
HTTP_CODE="$(curl -sS -K <(printf '%s\n' "$CFG") -o /tmp/gitea-api-response.$$ \
-w '%{http_code}' -X "$METHOD" "$URL" --data-binary @"$BODY_FILE")" || {
echo "gitea-api: request failed" >&2; exit 1; }
else
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
HTTP_CODE="$(curl -sS -K <(printf '%s\n' "$CFG") -o /tmp/gitea-api-response.$$ \
-w '%{http_code}' -X "$METHOD" "$URL")" || {
echo "gitea-api: request failed" >&2; exit 1; }
fi