jason.woltje
c3d29e796a
- scripts/mosaic-config.mjs: bootstrap | validate | env operations - Exclusive creation (O_EXCL 'wx'); existing config validated, never rewritten - Strict schema: unknown keys rejected, configVersion===1, backend docker only - dataRoot guards: absolute, canonical, not root/home/ancestor-of-config - MOSAIC_CONFIG override for sandboxed tests; exit codes 0/2/3 - scripts/bootstrap.sh: explicit bootstrap entry point Closes #1
84 lines
3.0 KiB
Bash
Executable File
84 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Minimal Gitea API client for this repository.
|
|
#
|
|
# Usage: scripts/gitea-api.sh METHOD api/path [json-body]
|
|
# e.g. scripts/gitea-api.sh GET repos/mosaicstack/stack-v2/issues
|
|
#
|
|
# Security:
|
|
# - Reads credentials from ~/secrets/mosaic.gitea.json (or
|
|
# MOSAIC_GITEA_CREDENTIAL_FILE); file must be 0600, non-symlink.
|
|
# - Token is passed to curl via a config stream (never argv, never disk,
|
|
# never stdout/stderr).
|
|
# - Prints the response body on stdout and "HTTP <code>" on stderr.
|
|
# Exits nonzero when the API reports an error.
|
|
set -euo pipefail
|
|
|
|
METHOD="${1:?usage: gitea-api.sh METHOD api/path [json-body]}"
|
|
API_PATH="${2:?missing api/path}"
|
|
API_PATH="${API_PATH#/}"
|
|
BODY="${3:-}"
|
|
|
|
command -v curl >/dev/null || { echo "gitea-api: curl not found" >&2; exit 1; }
|
|
command -v node >/dev/null || { echo "gitea-api: node not found" >&2; exit 1; }
|
|
|
|
export MOSAIC_GITEA_CREDENTIAL_FILE="${MOSAIC_GITEA_CREDENTIAL_FILE:-$HOME/secrets/mosaic.gitea.json}"
|
|
|
|
# Validate credential file; emit only the non-secret base URL on stdout.
|
|
BASE="$(node -e '
|
|
const fs = require("fs");
|
|
const p = process.env.MOSAIC_GITEA_CREDENTIAL_FILE;
|
|
let s;
|
|
try { s = fs.lstatSync(p); } catch { process.exit(3); }
|
|
if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) process.exit(3);
|
|
let e;
|
|
try { e = JSON.parse(fs.readFileSync(p, "utf8")).mosaicstack || {}; } catch { process.exit(3); }
|
|
const base = String(e.url || "").replace(/\/+$/, "");
|
|
if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
|
|
if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
|
|
process.stdout.write(base);
|
|
')"
|
|
|
|
# Repo path from the configured origin remote (never from credentials).
|
|
REMOTE_URL="$(git remote get-url origin)"
|
|
REPO_PATH="${REMOTE_URL#https://git.mosaicstack.dev/}"
|
|
REPO_PATH="${REPO_PATH%.git}"
|
|
|
|
# curl config stream: auth header via fd, never argv.
|
|
gen_curl_cfg() {
|
|
node -e '
|
|
const fs = require("fs");
|
|
const e = JSON.parse(fs.readFileSync(process.env.MOSAIC_GITEA_CREDENTIAL_FILE, "utf8")).mosaicstack || {};
|
|
process.stdout.write("header = \"Authorization: token " + e.api_token + "\"\n");
|
|
process.stdout.write("header = \"Content-Type: application/json\"\n");
|
|
'
|
|
}
|
|
|
|
BODY_FILE=""
|
|
cleanup() { [ -n "$BODY_FILE" ] && rm -f "$BODY_FILE"; }
|
|
trap cleanup EXIT
|
|
if [ -n "$BODY" ]; then
|
|
BODY_FILE="$(mktemp)"
|
|
chmod 600 "$BODY_FILE"
|
|
printf '%s' "$BODY" > "$BODY_FILE"
|
|
fi
|
|
|
|
URL="$BASE/api/v1/$API_PATH"
|
|
if [ -n "$BODY_FILE" ]; then
|
|
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
|
|
-w '%{http_code}' -X "$METHOD" "$URL" --data-binary @"$BODY_FILE")" || {
|
|
echo "gitea-api: request failed" >&2; exit 1; }
|
|
else
|
|
HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
|
|
-w '%{http_code}' -X "$METHOD" "$URL")" || {
|
|
echo "gitea-api: request failed" >&2; exit 1; }
|
|
fi
|
|
|
|
cat /tmp/gitea-api-response.$$ 2>/dev/null || true
|
|
rm -f /tmp/gitea-api-response.$$
|
|
echo "HTTP $HTTP_CODE" >&2
|
|
|
|
case "$HTTP_CODE" in
|
|
2*) exit 0 ;;
|
|
*) echo "gitea-api: $METHOD $API_PATH failed (HTTP $HTTP_CODE)" >&2; exit 1 ;;
|
|
esac
|