1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase
4
5import (
6 "context"
7 "crypto/rsa"
8 "slices"
9 "strconv"
10 "time"
11
12 "bnema.dev/ermite-actions/expr"
13 "bnema.dev/ermite-actions/template"
14 "bnema.dev/ermite-actions/workflow"
15 "bnema.dev/ermite/internal/domain"
16 "bnema.dev/ermite/internal/ports"
17)
18
19// Sweep exposes the daily sweep to the tests.
20func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }
21
22// RunTitle gives the title of a run as startRun sets it: the evaluated
23// run-name, else commitTitle.
24func (c *CI) RunTitle(ctx context.Context, wf *workflow.Workflow, githubJSON, commitTitle string) string {
25 if name, ok := c.evalRunName(ctx, wf, githubJSON, expr.NewDictionary()); ok {
26 return name
27 }
28 return commitTitle
29}
30
31// CheckRunID exposes checkRunID to the tests.
32func CheckRunID(ctx context.Context, run domain.CIRun, index, combo int) int64 {
33 return checkRunID(ctx, run, index, combo)
34}
35
36// SecretUse is the result of SecretsUsedBy.
37type SecretUse = secretUse
38
39// SecretsUsedBy exposes secretsUsedBy to the tests.
40func SecretsUsedBy(workflowYAML, jobID string) SecretUse {
41 return secretsUsedBy(workflowYAML, jobID)
42}
43
44// SecretWalks is the number of YAML walks made so far.
45func SecretWalks() int64 { return secretWalks.Load() }
46
47// SecretUseCache is a wfCache exposed to the tests.
48type SecretUseCache struct{ c *wfCache }
49
50// NewSecretUseCache builds a cache for up to max runs.
51func NewSecretUseCache(max int) *SecretUseCache { return &SecretUseCache{newWfCache(max)} }
52
53// Use is wfCache.secretUse.
54func (s *SecretUseCache) Use(runID int64, yaml, jobKey string) SecretUse {
55 return s.c.secretUse(runID, yaml, jobKey)
56}
57
58// Drop is wfCache.drop.
59func (s *SecretUseCache) Drop(runID int64) { s.c.drop(runID) }
60
61// EvalConcurrency exposes evalConcurrency to the tests.
62func EvalConcurrency(ctx context.Context, tok template.Token, env template.Env) (domain.CIConcurrency, error) {
63 return evalConcurrency(ctx, tok, env)
64}
65
66// MatchPullRequest exposes the pull_request filter to the tests.
67func MatchPullRequest(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
68 return matchPullRequest(wf, "pull_request", action, base, files, truncated)
69}
70
71// MatchPullRequestTarget exposes the pull_request_target filter to the tests.
72func MatchPullRequestTarget(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
73 return matchPullRequest(wf, "pull_request_target", action, base, files, truncated)
74}
75
76// MatchWorkflowRun exposes the workflow_run filter to the tests.
77func MatchWorkflowRun(wf *workflow.Workflow, name, action, headBranch string) bool {
78 return matchWorkflowRun(wf, name, action, headBranch)
79}
80
81// ResolveDispatchInputs exposes resolveDispatchInputs to the tests.
82func ResolveDispatchInputs(defs []workflow.Input, given map[string]string) (map[string]string, error) {
83 return resolveDispatchInputs(defs, given)
84}
85
86// PullFilesLink exposes the Link header of the files endpoint to the tests.
87func PullFilesLink(base string, page, perPage, total int) string {
88 return pullFilesLink(base, page, perPage, total)
89}
90
91// FilePatch exposes the patch text of a file of the files endpoint to the tests.
92func FilePatch(f domain.FileDiff) (string, bool) { return filePatch(f) }
93
94// PullTipsTrusted exposes the trust check of an activity of a merge request to
95// the tests, on a CI that has cfg and no workers.
96func PullTipsTrusted(ctx context.Context, cfg CIConfig, repo domain.RepoName, ev ports.PullRequestEvent) (bool, domain.ObjectID) {
97 return (&CI{cfg: cfg}).pullTipsTrusted(ctx, repo, ev)
98}
99
100// Thumbprint exposes thumbprint to the tests.
101func Thumbprint(pub *rsa.PublicKey) string { return thumbprint(pub) }
102
103// IDTokenClaims gives the claims idTokenClaims builds, decoded.
104func IDTokenClaims(contextsJSON, environment, issuer, audience string, at time.Time) (map[string]any, []string, error) {
105 claims, err := idTokenClaims(contextsJSON, environment, idTokenMeta{issuer: issuer, audience: audience, jti: "jti", now: at})
106 if err != nil {
107 return nil, nil, err
108 }
109 out := make(map[string]any, len(claims))
110 keys := make([]string, 0, len(claims))
111 for _, p := range claims {
112 out[p.k] = p.v
113 keys = append(keys, p.k)
114 }
115 return out, keys, nil
116}
117
118// SignForTest signs claims (in the order of their keys) with the signing key.
119func (o *OIDC) SignForTest(claims map[string]any) (string, error) {
120 keys := make([]string, 0, len(claims))
121 for k := range claims {
122 keys = append(keys, k)
123 }
124 slices.Sort(keys)
125 out := make(ordered, 0, len(keys))
126 for _, k := range keys {
127 out = append(out, pair{k, claims[k]})
128 }
129 return o.sign(out)
130}
131
132// DifficultyFor exposes the adaptive difficulty with the production base and
133// cap to the tests.
134func DifficultyFor(perAddr, global int) int {
135 return difficultyFor(baseDifficulty, maxDifficulty, perAddr, global)
136}
137
138// Production parameters of the submission, for the tests.
139const (
140 BaseDifficulty = baseDifficulty
141 MaxDifficulty = maxDifficulty
142 MinFillTime = minFillTime
143 ChallengeTTL = challengeTTL
144)
145
146// SpentLen is the number of nonces the submission remembers as spent.
147func (s *IssueSubmissions) SpentLen() int {
148 s.mu.Lock()
149 defer s.mu.Unlock()
150 return len(s.spent)
151}
152
153// FillSpent fills the spent set with n unexpired nonces.
154func (s *IssueSubmissions) FillSpent(n int, exp time.Time) {
155 s.mu.Lock()
156 defer s.mu.Unlock()
157 for i := range n {
158 s.spent["fill"+strconv.Itoa(i)] = exp
159 }
160}
161
162// MaxSpent is the bound of the spent set.
163const MaxSpent = maxSpent