+65 -75

api/tangled/cbor_gen.go

··· 216 216 217 217 return nil 218 218 } 219 219 - func (t *KnotPolicy) MarshalCBOR(w io.Writer) error { 219 219 + func (t *KnotMember) MarshalCBOR(w io.Writer) error { 220 220 if t == nil { 221 221 _, err := w.Write(cbg.CborNull) 222 222 return err 223 223 } 224 224 225 225 cw := cbg.NewCborWriter(w) 226 226 + fieldCount := 4 226 227 227 227 - if _, err := cw.Write([]byte{165}); err != nil { 228 228 + if t.AddedAt == nil { 229 229 + fieldCount-- 230 230 + } 231 231 + 232 232 + if _, err := cw.Write(cbg.CborEncodeMajorType(cbg.MajMap, uint64(fieldCount))); err != nil { 228 233 return err 229 234 } 230 235 ··· 240 245 return err 241 246 } 242 247 243 243 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("sh.tangled.knot.policy"))); err != nil { 244 244 - return err 245 245 - } 246 246 - if _, err := cw.WriteString(string("sh.tangled.knot.policy")); err != nil { 248 248 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("sh.tangled.knot.member"))); err != nil { 247 249 return err 248 250 } 249 249 - 250 250 - // t.Action (string) (string) 251 251 - if len("action") > 1000000 { 252 252 - return xerrors.Errorf("Value in field \"action\" was too long") 253 253 - } 254 254 - 255 255 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("action"))); err != nil { 256 256 - return err 257 257 - } 258 258 - if _, err := cw.WriteString(string("action")); err != nil { 259 259 - return err 260 260 - } 261 261 - 262 262 - if len(t.Action) > 1000000 { 263 263 - return xerrors.Errorf("Value in field t.Action was too long") 264 264 - } 265 265 - 266 266 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Action))); err != nil { 267 267 - return err 268 268 - } 269 269 - if _, err := cw.WriteString(string(t.Action)); err != nil { 251 251 + if _, err := cw.WriteString(string("sh.tangled.knot.member")); err != nil { 270 252 return err 271 253 } 272 254 ··· 293 275 return err 294 276 } 295 277 296 296 - // t.Object (string) (string) 297 297 - if len("object") > 1000000 { 298 298 - return xerrors.Errorf("Value in field \"object\" was too long") 278 278 + // t.Member (string) (string) 279 279 + if len("member") > 1000000 { 280 280 + return xerrors.Errorf("Value in field \"member\" was too long") 299 281 } 300 282 301 301 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("object"))); err != nil { 283 283 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("member"))); err != nil { 302 284 return err 303 285 } 304 304 - if _, err := cw.WriteString(string("object")); err != nil { 286 286 + if _, err := cw.WriteString(string("member")); err != nil { 305 287 return err 306 288 } 307 289 308 308 - if len(t.Object) > 1000000 { 309 309 - return xerrors.Errorf("Value in field t.Object was too long") 290 290 + if len(t.Member) > 1000000 { 291 291 + return xerrors.Errorf("Value in field t.Member was too long") 310 292 } 311 293 312 312 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Object))); err != nil { 294 294 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Member))); err != nil { 313 295 return err 314 296 } 315 315 - if _, err := cw.WriteString(string(t.Object)); err != nil { 297 297 + if _, err := cw.WriteString(string(t.Member)); err != nil { 316 298 return err 317 299 } 318 300 319 319 - // t.Subject (string) (string) 320 320 - if len("subject") > 1000000 { 321 321 - return xerrors.Errorf("Value in field \"subject\" was too long") 322 322 - } 301 301 + // t.AddedAt (string) (string) 302 302 + if t.AddedAt != nil { 323 303 324 324 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("subject"))); err != nil { 325 325 - return err 326 326 - } 327 327 - if _, err := cw.WriteString(string("subject")); err != nil { 328 328 - return err 329 329 - } 304 304 + if len("addedAt") > 1000000 { 305 305 + return xerrors.Errorf("Value in field \"addedAt\" was too long") 306 306 + } 330 307 331 331 - if len(t.Subject) > 1000000 { 332 332 - return xerrors.Errorf("Value in field t.Subject was too long") 333 333 - } 308 308 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("addedAt"))); err != nil { 309 309 + return err 310 310 + } 311 311 + if _, err := cw.WriteString(string("addedAt")); err != nil { 312 312 + return err 313 313 + } 334 314 335 335 - if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Subject))); err != nil { 336 336 - return err 337 337 - } 338 338 - if _, err := cw.WriteString(string(t.Subject)); err != nil { 339 339 - return err 315 315 + if t.AddedAt == nil { 316 316 + if _, err := cw.Write(cbg.CborNull); err != nil { 317 317 + return err 318 318 + } 319 319 + } else { 320 320 + if len(*t.AddedAt) > 1000000 { 321 321 + return xerrors.Errorf("Value in field t.AddedAt was too long") 322 322 + } 323 323 + 324 324 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(*t.AddedAt))); err != nil { 325 325 + return err 326 326 + } 327 327 + if _, err := cw.WriteString(string(*t.AddedAt)); err != nil { 328 328 + return err 329 329 + } 330 330 + } 340 331 } 341 332 return nil 342 333 } 343 334 344 344 - func (t *KnotPolicy) UnmarshalCBOR(r io.Reader) (err error) { 345 345 - *t = KnotPolicy{} 335 335 + func (t *KnotMember) UnmarshalCBOR(r io.Reader) (err error) { 336 336 + *t = KnotMember{} 346 337 347 338 cr := cbg.NewCborReader(r) 348 339 ··· 361 352 } 362 353 363 354 if extra > cbg.MaxLength { 364 364 - return fmt.Errorf("KnotPolicy: map struct too large (%d)", extra) 355 355 + return fmt.Errorf("KnotMember: map struct too large (%d)", extra) 365 356 } 366 357 367 358 n := extra ··· 393 384 394 385 t.LexiconTypeID = string(sval) 395 386 } 396 396 - // t.Action (string) (string) 397 397 - case "action": 398 398 - 399 399 - { 400 400 - sval, err := cbg.ReadStringWithMax(cr, 1000000) 401 401 - if err != nil { 402 402 - return err 403 403 - } 404 404 - 405 405 - t.Action = string(sval) 406 406 - } 407 387 // t.Domain (string) (string) 408 388 case "domain": 409 389 ··· 415 395 416 396 t.Domain = string(sval) 417 397 } 418 418 - // t.Object (string) (string) 419 419 - case "object": 398 398 + // t.Member (string) (string) 399 399 + case "member": 420 400 421 401 { 422 402 sval, err := cbg.ReadStringWithMax(cr, 1000000) ··· 424 404 return err 425 405 } 426 406 427 427 - t.Object = string(sval) 407 407 + t.Member = string(sval) 428 408 } 429 429 - // t.Subject (string) (string) 430 430 - case "subject": 409 409 + // t.AddedAt (string) (string) 410 410 + case "addedAt": 431 411 432 412 { 433 433 - sval, err := cbg.ReadStringWithMax(cr, 1000000) 413 413 + b, err := cr.ReadByte() 434 414 if err != nil { 435 415 return err 436 416 } 417 417 + if b != cbg.CborNull[0] { 418 418 + if err := cr.UnreadByte(); err != nil { 419 419 + return err 420 420 + } 437 421 438 438 - t.Subject = string(sval) 422 422 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 423 423 + if err != nil { 424 424 + return err 425 425 + } 426 426 + 427 427 + t.AddedAt = (*string)(&sval) 428 428 + } 439 429 } 440 430 441 431 default:

+25

api/tangled/knotmember.go

··· 1 1 + // Code generated by cmd/lexgen (see Makefile's lexgen); DO NOT EDIT. 2 2 + 3 3 + package tangled 4 4 + 5 5 + // schema: sh.tangled.knot.member 6 6 + 7 7 + import ( 8 8 + "github.com/bluesky-social/indigo/lex/util" 9 9 + ) 10 10 + 11 11 + const ( 12 12 + KnotMemberNSID = "sh.tangled.knot.member" 13 13 + ) 14 14 + 15 15 + func init() { 16 16 + util.RegisterType("sh.tangled.knot.member", &KnotMember{}) 17 17 + } // 18 18 + // RECORDTYPE: KnotMember 19 19 + type KnotMember struct { 20 20 + LexiconTypeID string `json:"$type,const=sh.tangled.knot.member" cborgen:"$type,const=sh.tangled.knot.member"` 21 21 + AddedAt *string `json:"addedAt,omitempty" cborgen:"addedAt,omitempty"` 22 22 + // domain: domain that this member now belongs to 23 23 + Domain string `json:"domain" cborgen:"domain"` 24 24 + Member string `json:"member" cborgen:"member"` 25 25 + }

-29

api/tangled/knotpolicy.go

··· 1 1 - // Code generated by cmd/lexgen (see Makefile's lexgen); DO NOT EDIT. 2 2 - 3 3 - package tangled 4 4 - 5 5 - // schema: sh.tangled.knot.policy 6 6 - 7 7 - import ( 8 8 - "github.com/bluesky-social/indigo/lex/util" 9 9 - ) 10 10 - 11 11 - const ( 12 12 - KnotPolicyNSID = "sh.tangled.knot.policy" 13 13 - ) 14 14 - 15 15 - func init() { 16 16 - util.RegisterType("sh.tangled.knot.policy", &KnotPolicy{}) 17 17 - } // 18 18 - // RECORDTYPE: KnotPolicy 19 19 - type KnotPolicy struct { 20 20 - LexiconTypeID string `json:"$type,const=sh.tangled.knot.policy" cborgen:"$type,const=sh.tangled.knot.policy"` 21 21 - // action: action associated with the key 22 22 - Action string `json:"action" cborgen:"action"` 23 23 - // domain: domain of the key 24 24 - Domain string `json:"domain" cborgen:"domain"` 25 25 - // object: object associated with the key 26 26 - Object string `json:"object" cborgen:"object"` 27 27 - // subject: subject of the key 28 28 - Subject string `json:"subject" cborgen:"subject"` 29 29 - }

+1

appview/consts.go

··· 11 11 SessionExpiry = "expiry" 12 12 SessionAuthenticated = "authenticated" 13 13 TimeLayout = "2006-01-02 15:04:05.999999999 -0700 MST" 14 14 + SqliteDbPath = "appview.db" 14 15 )

+3 -4

appview/state/rbac.go rbac/rbac.go

··· 1 1 - package state 1 1 + package rbac 2 2 3 3 import ( 4 4 "database/sql" ··· 37 37 return matched 38 38 } 39 39 40 40 - func NewEnforcer() (*Enforcer, error) { 40 40 + func NewEnforcer(path string) (*Enforcer, error) { 41 41 m, err := model.NewModelFromString(Model) 42 42 if err != nil { 43 43 return nil, err 44 44 } 45 45 46 46 - // TODO: conf this 47 47 - db, err := sql.Open("sqlite3", "appview.db") 46 46 + db, err := sql.Open("sqlite3", path) 48 47 if err != nil { 49 48 return nil, err 50 49 }

+35 -11

appview/state/state.go

··· 22 22 "github.com/sotangled/tangled/appview/auth" 23 23 "github.com/sotangled/tangled/appview/db" 24 24 "github.com/sotangled/tangled/appview/pages" 25 25 + "github.com/sotangled/tangled/rbac" 25 26 ) 26 27 27 28 type State struct { 28 29 db *db.DB 29 30 auth *auth.Auth 30 30 - enforcer *Enforcer 31 31 + enforcer *rbac.Enforcer 31 32 } 32 33 33 34 func Make() (*State, error) { 34 34 - db, err := db.Make("appview.db") 35 35 + 36 36 + db, err := db.Make(appview.SqliteDbPath) 35 37 if err != nil { 36 38 return nil, err 37 39 } ··· 41 43 return nil, err 42 44 } 43 45 44 44 - enforcer, err := NewEnforcer() 46 46 + enforcer, err := rbac.NewEnforcer(appview.SqliteDbPath) 45 47 if err != nil { 46 48 return nil, err 47 49 } ··· 175 177 Collection: tangled.PublicKeyNSID, 176 178 Repo: did, 177 179 Rkey: uuid.New().String(), 178 178 - Record: &lexutil.LexiconTypeDecoder{Val: &tangled.PublicKey{ 179 179 - Created: time.Now().String(), 180 180 - Key: key, 181 181 - Name: name, 182 182 - }}, 180 180 + Record: &lexutil.LexiconTypeDecoder{ 181 181 + Val: &tangled.PublicKey{ 182 182 + Created: time.Now().Format(time.RFC3339), 183 183 + Key: key, 184 184 + Name: name, 185 185 + }}, 183 186 }) 184 184 - 185 187 // invalid record 186 188 if err != nil { 187 189 log.Printf("failed to create record: %s", err) ··· 382 384 w.Write([]byte("failed to resolve member did to a handle")) 383 385 return 384 386 } 385 385 - 386 387 log.Printf("adding %s to %s\n", memberIdent.Handle.String(), domain) 387 388 389 389 + // announce this relation into the firehose, store into owners' pds 390 390 + client, _ := s.auth.AuthorizedClient(r) 391 391 + currentUser := s.auth.GetUser(r) 392 392 + addedAt := time.Now().Format(time.RFC3339) 393 393 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 394 394 + Collection: tangled.KnotMemberNSID, 395 395 + Repo: currentUser.Did, 396 396 + Rkey: uuid.New().String(), 397 397 + Record: &lexutil.LexiconTypeDecoder{ 398 398 + Val: &tangled.KnotMember{ 399 399 + Member: memberIdent.DID.String(), 400 400 + Domain: domain, 401 401 + AddedAt: &addedAt, 402 402 + }}, 403 403 + }) 404 404 + // invalid record 405 405 + if err != nil { 406 406 + log.Printf("failed to create record: %s", err) 407 407 + return 408 408 + } 409 409 + 410 410 + log.Println("created atproto record: ", resp.Uri) 411 411 + 388 412 err = s.enforcer.AddMember(domain, memberIdent.DID.String()) 389 413 if err != nil { 390 414 w.Write([]byte(fmt.Sprint("failed to add member: ", err))) ··· 481 505 r.Post("/key", s.RegistrationKey) 482 506 483 507 r.Route("/{domain}", func(r chi.Router) { 484 484 - r.Get("/", s.KnotServerInfo) 485 508 r.Post("/init", s.InitKnotServer) 509 509 + r.Get("/", s.KnotServerInfo) 486 510 r.Route("/member", func(r chi.Router) { 487 511 r.Use(RoleMiddleware(s, "server:owner")) 488 512 r.Get("/", s.ListMembers)

+1 -1

cmd/gen.go

··· 15 15 "api/tangled/cbor_gen.go", 16 16 "tangled", 17 17 shtangled.PublicKey{}, 18 18 - shtangled.KnotPolicy{}, 18 18 + shtangled.KnotMember{}, 19 19 ); err != nil { 20 20 panic(err) 21 21 }

+7 -1

cmd/knotserver/main.go

··· 11 11 "github.com/sotangled/tangled/knotserver" 12 12 "github.com/sotangled/tangled/knotserver/config" 13 13 "github.com/sotangled/tangled/knotserver/db" 14 14 + "github.com/sotangled/tangled/rbac" 14 15 ) 15 16 16 17 func main() { ··· 34 35 log.Fatalf("failed to setup db: %s", err) 35 36 } 36 37 37 37 - mux, err := knotserver.Setup(ctx, c, db) 38 38 + e, err := rbac.NewEnforcer(c.Server.DBPath) 39 39 + if err != nil { 40 40 + log.Fatalf("failed to setup rbac enforcer: %s", err) 41 41 + } 42 42 + 43 43 + mux, err := knotserver.Setup(ctx, c, db, e) 38 44 if err != nil { 39 45 log.Fatal(err) 40 46 }

+26 -4

knotserver/handler.go

··· 12 12 "github.com/sotangled/tangled/knotserver/config" 13 13 "github.com/sotangled/tangled/knotserver/db" 14 14 "github.com/sotangled/tangled/knotserver/jsclient" 15 15 + "github.com/sotangled/tangled/rbac" 16 16 + ) 17 17 + 18 18 + const ( 19 19 + ThisServer = "thisserver" // resource identifier for rbac enforcement 15 20 ) 16 21 17 22 type Handle struct { 18 23 c *config.Config 19 24 db *db.DB 20 25 js *jsclient.JetstreamClient 26 26 + e *rbac.Enforcer 21 27 22 28 // init is a channel that is closed when the knot has been initailized 23 29 // i.e. when the first user (knot owner) has been added. ··· 25 31 knotInitialized bool 26 32 } 27 33 28 28 - func Setup(ctx context.Context, c *config.Config, db *db.DB) (http.Handler, error) { 34 34 + func Setup(ctx context.Context, c *config.Config, db *db.DB, e *rbac.Enforcer) (http.Handler, error) { 29 35 r := chi.NewRouter() 30 36 31 37 h := Handle{ 32 38 c: c, 33 39 db: db, 40 40 + e: e, 34 41 init: make(chan struct{}), 35 42 } 36 43 37 37 - err := h.StartJetstream(ctx) 44 44 + err := e.AddDomain(ThisServer) 45 45 + if err != nil { 46 46 + return nil, fmt.Errorf("failed to setup enforcer: %w", err) 47 47 + } 48 48 + 49 49 + err = h.StartJetstream(ctx) 38 50 if err != nil { 39 51 return nil, fmt.Errorf("failed to start jetstream: %w", err) 40 52 } ··· 94 106 } 95 107 96 108 func (h *Handle) StartJetstream(ctx context.Context) error { 97 97 - colections := []string{tangled.PublicKeyNSID} 109 109 + collections := []string{tangled.PublicKeyNSID, tangled.KnotMemberNSID} 98 110 dids := []string{} 99 111 100 100 - h.js = jsclient.NewJetstreamClient(colections, dids) 112 112 + h.js = jsclient.NewJetstreamClient(collections, dids) 101 113 messages, err := h.js.ReadJetstream(ctx) 102 114 if err != nil { 103 115 return fmt.Errorf("failed to read from jetstream: %w", err) ··· 126 138 log.Printf("failed to add public key: %v", err) 127 139 } else { 128 140 log.Printf("added public key from firehose: %s", data["did"]) 141 141 + } 142 142 + case tangled.KnotMemberNSID: 143 143 + did := data["did"].(string) 144 144 + record := commit["record"].(map[string]interface{}) 145 145 + ok, err := h.e.E.Enforce(did, ThisServer, ThisServer, "server:invite") 146 146 + if err != nil || !ok { 147 147 + log.Printf("failed to add member from did %s", did) 148 148 + } else { 149 149 + log.Printf("adding member") 150 150 + h.e.AddMember(ThisServer, record["member"].(string)) 129 151 } 130 152 default: 131 153 }

+8

knotserver/jsclient/jetstream.go

··· 55 55 j.triggerReconnect() 56 56 } 57 57 58 58 + // Adds one did to the did list 59 59 + func (j *JetstreamClient) AddDid(did string) { 60 60 + j.mu.Lock() 61 61 + j.dids = append(j.dids, did) 62 62 + j.mu.Unlock() 63 63 + j.triggerReconnect() 64 64 + } 65 65 + 58 66 func (j *JetstreamClient) triggerReconnect() { 59 67 select { 60 68 case j.reconnectCh <- struct{}{}:

+1

knotserver/routes.go

··· 432 432 } 433 433 434 434 h.js.UpdateDids([]string{data.Did}) 435 435 + h.e.AddOwner(ThisServer, data.Did) 435 436 // Signal that the knot is ready 436 437 close(h.init) 437 438

+33

lexicons/member.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.knot.member", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "member", 14 14 + "domain" 15 15 + ], 16 16 + "properties": { 17 17 + "member": { 18 18 + "type": "string", 19 19 + "format": "did" 20 20 + }, 21 21 + "domain": { 22 22 + "type": "string", 23 23 + "description": "domain that this member now belongs to" 24 24 + }, 25 25 + "addedAt": { 26 26 + "type": "string", 27 27 + "format": "datetime" 28 28 + } 29 29 + } 30 30 + } 31 31 + } 32 32 + } 33 33 + }

-34

lexicons/policy.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.knot.policy", 4 4 - "needsCbor": true, 5 5 - "needsType": true, 6 6 - "defs": { 7 7 - "main": { 8 8 - "type": "record", 9 9 - "key": "tid", 10 10 - "record": { 11 11 - "type": "object", 12 12 - "required": ["subject", "domain", "object", "action"], 13 13 - "properties": { 14 14 - "subject": { 15 15 - "type": "string", 16 16 - "description": "subject of the key" 17 17 - }, 18 18 - "domain": { 19 19 - "type": "string", 20 20 - "description": "domain of the key" 21 21 - }, 22 22 - "object": { 23 23 - "type": "string", 24 24 - "description": "object associated with the key" 25 25 - }, 26 26 - "action": { 27 27 - "type": "string", 28 28 - "description": "action associated with the key" 29 29 - } 30 30 - } 31 31 - } 32 32 - } 33 33 - } 34 34 - }