alice.pds.demo.boltless.dev
This repository has no description
1package xrpc
2
3import (
4 "encoding/json"
5 "fmt"
6 "net/http"
7 "time"
8
9 "github.com/bluesky-social/indigo/api/atproto"
10 "github.com/bluesky-social/indigo/atproto/syntax"
11 "github.com/bluesky-social/indigo/xrpc"
12 "tangled.org/core/api/tangled"
13 "tangled.org/core/spindle/secrets"
14 xrpcerr "tangled.org/core/xrpc/errors"
15)
16
17func (x *Xrpc) ListSecrets(w http.ResponseWriter, r *http.Request) {
18 l := x.Logger
19 fail := func(e xrpcerr.XrpcError) {
20 l.Error("failed", "kind", e.Tag, "error", e.Message)
21 writeError(w, e, http.StatusBadRequest)
22 }
23
24 actorDid, ok := r.Context().Value(ActorDid).(syntax.DID)
25 if !ok {
26 fail(xrpcerr.MissingActorDidError)
27 return
28 }
29
30 repoParam := r.URL.Query().Get("repo")
31 if repoParam == "" {
32 fail(xrpcerr.GenericError(fmt.Errorf("empty params")))
33 return
34 }
35
36 // unfortunately we have to resolve repo-at here
37 repoAt, err := syntax.ParseATURI(repoParam)
38 if err != nil {
39 fail(xrpcerr.InvalidRepoError(repoParam))
40 return
41 }
42
43 // resolve this aturi to extract the repo record
44 ident, err := x.Resolver.ResolveIdent(r.Context(), repoAt.Authority().String())
45 if err != nil || ident.Handle.IsInvalidHandle() {
46 fail(xrpcerr.GenericError(fmt.Errorf("failed to resolve handle: %w", err)))
47 return
48 }
49
50 xrpcc := xrpc.Client{Host: ident.PDSEndpoint()}
51 resp, err := atproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String())
52 if err != nil {
53 fail(xrpcerr.GenericError(err))
54 return
55 }
56
57 repoRec, ok := resp.Value.Val.(*tangled.Repo)
58 if !ok {
59 fail(xrpcerr.RepoNotFoundError)
60 return
61 }
62 if repoRec.RepoDid == nil || *repoRec.RepoDid == "" {
63 fail(xrpcerr.GenericError(fmt.Errorf("repo record %s has no repoDid", repoAt)))
64 return
65 }
66 repoDid, err := syntax.ParseDID(*repoRec.RepoDid)
67 if err != nil {
68 fail(xrpcerr.GenericError(fmt.Errorf("repo record %q has invalid repoDid: %q", repoAt, *repoRec.RepoDid)))
69 return
70 }
71
72 if ok, err := x.Enforcer.IsRepoSecretsAllowed(actorDid, repoDid); !ok || err != nil {
73 l.Error("insufficient permissions", "did", actorDid.String())
74 writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized)
75 return
76 }
77
78 ls, err := x.Vault.GetSecretsLocked(r.Context(), secrets.RepoIdentifier(repoDid))
79 if err != nil {
80 l.Error("failed to get secret from vault", "did", actorDid.String(), "err", err)
81 writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
82 return
83 }
84
85 var out tangled.RepoListSecrets_Output
86 for _, l := range ls {
87 out.Secrets = append(out.Secrets, &tangled.RepoListSecrets_Secret{
88 Repo: repoAt.String(),
89 Key: l.Key,
90 CreatedAt: l.CreatedAt.Format(time.RFC3339),
91 CreatedBy: l.CreatedBy.String(),
92 })
93 }
94
95 w.Header().Set("Content-Type", "application/json")
96 w.WriteHeader(http.StatusOK)
97 json.NewEncoder(w).Encode(out)
98}