alice.pds.demo.boltless.dev
This repository has no description
1package xrpc
2
3import (
4 "encoding/json"
5 "fmt"
6 "net/http"
7 "time"
8
9 "github.com/bluesky-social/indigo/api/atproto"
10 "github.com/bluesky-social/indigo/atproto/syntax"
11 "github.com/bluesky-social/indigo/xrpc"
12 securejoin "github.com/cyphar/filepath-securejoin"
13 "tangled.org/core/api/tangled"
14 "tangled.org/core/rbac"
15 "tangled.org/core/spindle/secrets"
16 xrpcerr "tangled.org/core/xrpc/errors"
17)
18
19func (x *Xrpc) ListSecrets(w http.ResponseWriter, r *http.Request) {
20 l := x.Logger
21 fail := func(e xrpcerr.XrpcError) {
22 l.Error("failed", "kind", e.Tag, "error", e.Message)
23 writeError(w, e, http.StatusBadRequest)
24 }
25
26 actorDid, ok := r.Context().Value(ActorDid).(syntax.DID)
27 if !ok {
28 fail(xrpcerr.MissingActorDidError)
29 return
30 }
31
32 repoParam := r.URL.Query().Get("repo")
33 if repoParam == "" {
34 fail(xrpcerr.GenericError(fmt.Errorf("empty params")))
35 return
36 }
37
38 // unfortunately we have to resolve repo-at here
39 repoAt, err := syntax.ParseATURI(repoParam)
40 if err != nil {
41 fail(xrpcerr.InvalidRepoError(repoParam))
42 return
43 }
44
45 // resolve this aturi to extract the repo record
46 ident, err := x.Resolver.ResolveIdent(r.Context(), repoAt.Authority().String())
47 if err != nil || ident.Handle.IsInvalidHandle() {
48 fail(xrpcerr.GenericError(fmt.Errorf("failed to resolve handle: %w", err)))
49 return
50 }
51
52 xrpcc := xrpc.Client{Host: ident.PDSEndpoint()}
53 resp, err := atproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String())
54 if err != nil {
55 fail(xrpcerr.GenericError(err))
56 return
57 }
58
59 if _, ok := resp.Value.Val.(*tangled.Repo); !ok {
60 fail(xrpcerr.RepoNotFoundError)
61 return
62 }
63 didPath, err := securejoin.SecureJoin(ident.DID.String(), repoAt.RecordKey().String())
64 if err != nil {
65 fail(xrpcerr.GenericError(err))
66 return
67 }
68
69 if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil {
70 l.Error("insufficient permissions", "did", actorDid.String())
71 writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
72 return
73 }
74
75 ls, err := x.Vault.GetSecretsLocked(r.Context(), secrets.RepoIdentifier(didPath))
76 if err != nil {
77 l.Error("failed to get secret from vault", "did", actorDid.String(), "err", err)
78 writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
79 return
80 }
81
82 var out tangled.RepoListSecrets_Output
83 for _, l := range ls {
84 out.Secrets = append(out.Secrets, &tangled.RepoListSecrets_Secret{
85 Repo: repoAt.String(),
86 Key: l.Key,
87 CreatedAt: l.CreatedAt.Format(time.RFC3339),
88 CreatedBy: l.CreatedBy.String(),
89 })
90 }
91
92 w.Header().Set("Content-Type", "application/json")
93 w.WriteHeader(http.StatusOK)
94 json.NewEncoder(w).Encode(out)
95}