1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3// Package kvstore implements the metadata ports over ermite-kv. Values are
4// the protobuf messages of proto/ermite/storage.
5package kvstore
6
7import (
8 "context"
9 "errors"
10 "fmt"
11 "slices"
12
13 kv "bnema.dev/ermite-kv"
14 "github.com/bnema/zerowrap"
15 "google.golang.org/protobuf/proto"
16
17 storagepb "bnema.dev/ermite/gen/ermite/storage"
18 "bnema.dev/ermite/internal/domain"
19 "bnema.dev/ermite/internal/ports"
20)
21
22// SchemaVersion is the storage schema this build reads and writes. Version 2
23// adds branch prefixes to tokens: a build that does not know them would treat
24// a branch-limited token as unrestricted, so it must refuse the data
25// (ErrSchemaTooNew) instead. Version 3 adds the records of CI-3 that an older
26// build would misread: the call and scoped jobs of reusable workflows (it would
27// run the jobs of a called workflow as jobs of the caller's file, and plan the
28// call itself), the head commit of the runs of merge requests
29// (CIRun.head_sha: it would attach their checks to the merge commit, where
30// nothing looks for them), and the index of the open merge requests by source
31// branch (mropen/: an older build would not keep it up to date; the upgrade
32// builds it once, see BuildOpenIndex). Version 4 adds the issues (is/, isc/,
33// isopen/, numbered from the same mrseq/ sequence as the merge requests, and
34// RepoSettings.issues): an older build would not delete them with their
35// repository, nor keep the numbers apart, and it would misread the issue:write
36// scope, so it must refuse the data. It also adds the pending issues of the
37// public form (ispend/<repo>/<id>, removed with their repository), the bans of
38// their submitters (isban/<hex hash>) and the form's server key
39// (meta/issuekey). The upgrade also adds mr:review and issue:write (each only
40// if missing) to the stored tokens that held all nine original scopes with no
41// repository list and no branch prefix, so that they keep the owner rights (see
42// upgradeTokens). Version 5 grants mr:force-merge to unrestricted tokens
43// holding all eleven previous scopes, preserving their owner rights.
44const SchemaVersion = 5
45
46const schemaKey = "meta/schema"
47
48// ErrSchemaTooNew means the data was written by a newer ermite.
49var ErrSchemaTooNew = errors.New("storage schema is newer than this ermite supports")
50
51// Store is the ermite-kv backed metadata store.
52type Store struct {
53 db *kv.DB
54 locks *numberLocks // shared by the merge request and issue stores
55}
56
57var _ ports.RepoMetaStore = (*Store)(nil)
58
59// Open opens (or creates) the database in dir and checks the storage schema:
60// a missing version is written as SchemaVersion, a lower one is upgraded to it,
61// a higher one stops with ErrSchemaTooNew. dir must exist.
62func Open(ctx context.Context, dir string) (*Store, error) {
63 db, err := kv.Open(ctx, dir, kv.Options{})
64 if err != nil {
65 return nil, fmt.Errorf("open ermite-kv in %s: %w", dir, err)
66 }
67 s := &Store{db: db, locks: new(numberLocks)}
68 if err := s.checkSchema(ctx); err != nil {
69 _ = db.Close(context.WithoutCancel(ctx))
70 return nil, err
71 }
72 // Part of the schema 3 upgrade: the index of the open merge requests.
73 if err := s.BuildOpenIndex(ctx); err != nil {
74 _ = db.Close(context.WithoutCancel(ctx))
75 return nil, err
76 }
77 return s, nil
78}
79
80// Close stops the database after the writes in progress.
81func (s *Store) Close(ctx context.Context) error {
82 if err := s.db.Close(ctx); err != nil {
83 return fmt.Errorf("close ermite-kv: %w", err)
84 }
85 return nil
86}
87
88// Check reports whether the database accepts writes. It returns the failure
89// once ermite-kv is closed or failed, and writes nothing.
90//
91// ermite-kv has no state accessor, and an empty batch sent through Apply would
92// queue behind the writes in progress. Apply looks at the state of the database
93// before it looks at its context, though, and an ended context stops it before
94// the writer channel: Apply on a cancelled context therefore answers ErrClosed
95// or ErrFailed when the database is stopped, and context.Canceled when it is
96// healthy, without waiting for the writer.
97func (s *Store) Check(ctx context.Context) error {
98 if err := ctx.Err(); err != nil {
99 return err
100 }
101 probe, cancel := context.WithCancel(context.WithoutCancel(ctx))
102 cancel()
103 var b kv.Batch
104 if _, err := s.db.Apply(probe, &b); err != nil && !errors.Is(err, context.Canceled) {
105 return fmt.Errorf("ermite-kv: %w", err)
106 }
107 return nil
108}
109
110func (s *Store) checkSchema(ctx context.Context) error {
111 log := zerowrap.FromCtx(ctx)
112 key := []byte(schemaKey)
113 for range 4 {
114 item, ok := s.db.Get(ctx, key)
115 if !ok {
116 var b kv.Batch
117 b.RequireAbsent(key)
118 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: SchemaVersion}))
119 _, err := s.db.Apply(ctx, &b)
120 if errors.Is(err, kv.ErrConflict) {
121 continue // written meanwhile: read it
122 }
123 if err != nil {
124 return fmt.Errorf("write storage schema: %w", err)
125 }
126 log.Info().Uint32("schema", SchemaVersion).Msg("storage schema initialized")
127 return nil
128 }
129 var sv storagepb.SchemaVersion
130 if err := proto.Unmarshal(item.Value, &sv); err != nil {
131 return fmt.Errorf("decode storage schema: %w", err)
132 }
133 switch {
134 case sv.GetVersion() > SchemaVersion:
135 return fmt.Errorf("%w: found %d, supported %d", ErrSchemaTooNew, sv.GetVersion(), SchemaVersion)
136 case sv.GetVersion() == 0:
137 return fmt.Errorf("decode storage schema: invalid version 0")
138 }
139 if sv.GetVersion() < SchemaVersion {
140 // Older data stays readable as it is (the changes are additive);
141 // the new version is recorded so that older builds refuse it.
142 // The tokens are upgraded in the same batch, so that a crash
143 // leaves the old version and the upgrade runs again.
144 target := uint32(SchemaVersion)
145 if sv.GetVersion() < 4 {
146 target = 4
147 }
148 var b kv.Batch
149 b.RequireVersion(key, item.Version)
150 if sv.GetVersion() < 4 {
151 if err := s.upgradeTokens(ctx, &b); err != nil {
152 return err
153 }
154 }
155 if sv.GetVersion() == 4 {
156 if err := s.upgradeForceMergeTokens(ctx, &b); err != nil {
157 return err
158 }
159 }
160 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: target}))
161 _, err := s.db.Apply(ctx, &b)
162 if errors.Is(err, kv.ErrConflict) {
163 continue // changed meanwhile: read it again
164 }
165 if err != nil {
166 return fmt.Errorf("upgrade storage schema: %w", err)
167 }
168 log.Info().Uint32("from", sv.GetVersion()).Uint32("schema", target).Msg("storage schema upgraded")
169 if target < SchemaVersion {
170 continue
171 }
172 return nil
173 }
174 log.Info().Uint32("schema", sv.GetVersion()).Msg("storage schema checked")
175 return nil
176 }
177 return errors.New("write storage schema: concurrent initialization did not settle")
178}
179
180func mustMarshal(m proto.Message) []byte {
181 b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
182 if err != nil {
183 panic(fmt.Sprintf("kvstore: marshal %T: %v", m, err)) // only for invalid UTF-8 strings, checked by callers
184 }
185 return b
186}
187
188// preIssueScopes are the nine original scopes, before mr:review and issue:write.
189var preIssueScopes = []domain.Scope{
190 domain.ScopeRepoRead, domain.ScopeRepoWrite, domain.ScopeRepoAdmin,
191 domain.ScopeMRWrite, domain.ScopeMRMerge,
192 domain.ScopeCIWrite, domain.ScopeSecretsWrite, domain.ScopeRunnerRegister,
193 domain.ScopeTokenAdmin,
194}
195
196// upgradeTokens adds to b the schema 4 upgrade of the tokens: a token that
197// holds all of preIssueScopes, limited to no repository and no branch prefix,
198// had the owner rights, which schema 4 needed mr:review and issue:write
199// for, so it gets each of them if missing (this is no escalation). Every other
200// token is left as it is. The batch requires each token to be at the version it
201// was read at.
202func (s *Store) upgradeTokens(ctx context.Context, b *kv.Batch) error {
203 return s.upgradeTokenScopes(ctx, b, preIssueScopes, []domain.Scope{domain.ScopeMRReview, domain.ScopeIssueWrite})
204}
205
206// preForceMergeScopes are the eleven scopes of schema 4, before mr:force-merge.
207var preForceMergeScopes = append(slices.Clone(preIssueScopes), domain.ScopeMRReview, domain.ScopeIssueWrite)
208
209// upgradeForceMergeTokens adds to b the schema 5 upgrade of the tokens: a
210// token that holds all of preForceMergeScopes, limited to no repository and no
211// branch prefix, had the owner rights, which AllScopes also needs
212// mr:force-merge for, so it gets it. Every other token is left as it is.
213func (s *Store) upgradeForceMergeTokens(ctx context.Context, b *kv.Batch) error {
214 return s.upgradeTokenScopes(ctx, b, preForceMergeScopes, []domain.Scope{domain.ScopeMRForceMerge})
215}
216
217func (s *Store) upgradeTokenScopes(ctx context.Context, b *kv.Batch, required, addedScopes []domain.Scope) error {
218 for key, item := range s.db.Snapshot(ctx).Prefix(ctx, []byte(tokenPrefix)) {
219 pb := &storagepb.Token{}
220 if err := proto.Unmarshal(item.Value, pb); err != nil {
221 return fmt.Errorf("upgrade token %s: %w", key, err)
222 }
223 if len(pb.GetRepos()) > 0 || len(pb.GetBranchPrefixes()) > 0 {
224 continue
225 }
226 full := true
227 for _, sc := range required {
228 if !slices.Contains(pb.GetScopes(), sc.String()) {
229 full = false
230 break
231 }
232 }
233 if !full {
234 continue
235 }
236 added := false
237 for _, sc := range addedScopes {
238 if !slices.Contains(pb.GetScopes(), sc.String()) {
239 pb.Scopes = append(pb.Scopes, sc.String())
240 added = true
241 }
242 }
243 if !added {
244 continue
245 }
246 b.RequireVersion(slices.Clone(key), item.Version)
247 b.Put(slices.Clone(key), mustMarshal(pb))
248 }
249 return nil
250}