1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3// Package kvstore implements the metadata ports over ermite-kv. Values are
4// the protobuf messages of proto/ermite/storage.
5package kvstore
6
7import (
8 "context"
9 "errors"
10 "fmt"
11 "slices"
12
13 kv "bnema.dev/ermite-kv"
14 "github.com/bnema/zerowrap"
15 "google.golang.org/protobuf/proto"
16
17 storagepb "bnema.dev/ermite/gen/ermite/storage"
18 "bnema.dev/ermite/internal/domain"
19 "bnema.dev/ermite/internal/ports"
20)
21
22// SchemaVersion is the storage schema this build reads and writes. Version 2
23// adds branch prefixes to tokens: a build that does not know them would treat
24// a branch-limited token as unrestricted, so it must refuse the data
25// (ErrSchemaTooNew) instead. Version 3 adds the records of CI-3 that an older
26// build would misread: the call and scoped jobs of reusable workflows (it would
27// run the jobs of a called workflow as jobs of the caller's file, and plan the
28// call itself), the head commit of the runs of merge requests
29// (CIRun.head_sha: it would attach their checks to the merge commit, where
30// nothing looks for them), and the index of the open merge requests by source
31// branch (mropen/: an older build would not keep it up to date; the upgrade
32// builds it once, see BuildOpenIndex). Version 4 adds the issues (is/, isc/,
33// isopen/, numbered from the same mrseq/ sequence as the merge requests, and
34// RepoSettings.issues): an older build would not delete them with their
35// repository, nor keep the numbers apart, and it would misread the issue:write
36// scope, so it must refuse the data. It also adds the pending issues of the
37// public form (ispend/<repo>/<id>, removed with their repository), the bans of
38// their submitters (isban/<hex hash>) and the form's server key
39// (meta/issuekey). The upgrade also adds mr:review and issue:write (each only
40// if missing) to the stored tokens that held all nine original scopes with no
41// repository list and no branch prefix, so that they keep the owner rights (see
42// upgradeTokens). Version 5 grants mr:force-merge to unrestricted tokens
43// holding all eleven previous scopes, preserving their owner rights. Version 6
44// adds releases and release:write; older builds cannot clean up their metadata
45// or preserve the owner rights of upgraded tokens (see upgradeReleaseTokens).
46// Version 7 adds the latest-release index; older writers would leave it stale.
47const SchemaVersion = 7
48
49const schemaKey = "meta/schema"
50
51// ErrSchemaTooNew means the data was written by a newer ermite.
52var ErrSchemaTooNew = errors.New("storage schema is newer than this ermite supports")
53
54// Store is the ermite-kv backed metadata store.
55type Store struct {
56 db *kv.DB
57 locks *numberLocks // shared by the merge request and issue stores
58}
59
60var _ ports.RepoMetaStore = (*Store)(nil)
61
62// Open opens (or creates) the database in dir and checks the storage schema:
63// a missing version is written as SchemaVersion, a lower one is upgraded to it,
64// a higher one stops with ErrSchemaTooNew. dir must exist.
65func Open(ctx context.Context, dir string) (*Store, error) {
66 db, err := kv.Open(ctx, dir, kv.Options{})
67 if err != nil {
68 return nil, fmt.Errorf("open ermite-kv in %s: %w", dir, err)
69 }
70 s := &Store{db: db, locks: new(numberLocks)}
71 if err := s.checkSchema(ctx); err != nil {
72 _ = db.Close(context.WithoutCancel(ctx))
73 return nil, err
74 }
75 // Part of the schema 3 upgrade: the index of the open merge requests.
76 if err := s.BuildOpenIndex(ctx); err != nil {
77 _ = db.Close(context.WithoutCancel(ctx))
78 return nil, err
79 }
80 if err := s.buildReleaseLatestIndex(ctx); err != nil {
81 _ = db.Close(context.WithoutCancel(ctx))
82 return nil, err
83 }
84 return s, nil
85}
86
87// Close stops the database after the writes in progress.
88func (s *Store) Close(ctx context.Context) error {
89 if err := s.db.Close(ctx); err != nil {
90 return fmt.Errorf("close ermite-kv: %w", err)
91 }
92 return nil
93}
94
95// Check reports whether the database accepts writes. It returns the failure
96// once ermite-kv is closed or failed, and writes nothing.
97//
98// ermite-kv has no state accessor, and an empty batch sent through Apply would
99// queue behind the writes in progress. Apply looks at the state of the database
100// before it looks at its context, though, and an ended context stops it before
101// the writer channel: Apply on a cancelled context therefore answers ErrClosed
102// or ErrFailed when the database is stopped, and context.Canceled when it is
103// healthy, without waiting for the writer.
104func (s *Store) Check(ctx context.Context) error {
105 if err := ctx.Err(); err != nil {
106 return err
107 }
108 probe, cancel := context.WithCancel(context.WithoutCancel(ctx))
109 cancel()
110 var b kv.Batch
111 if _, err := s.db.Apply(probe, &b); err != nil && !errors.Is(err, context.Canceled) {
112 return fmt.Errorf("ermite-kv: %w", err)
113 }
114 return nil
115}
116
117func (s *Store) checkSchema(ctx context.Context) error {
118 log := zerowrap.FromCtx(ctx)
119 key := []byte(schemaKey)
120 for range 5 {
121 item, ok := s.db.Get(ctx, key)
122 if !ok {
123 var b kv.Batch
124 b.RequireAbsent(key)
125 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: SchemaVersion}))
126 _, err := s.db.Apply(ctx, &b)
127 if errors.Is(err, kv.ErrConflict) {
128 continue // written meanwhile: read it
129 }
130 if err != nil {
131 return fmt.Errorf("write storage schema: %w", err)
132 }
133 log.Info().Uint32("schema", SchemaVersion).Msg("storage schema initialized")
134 return nil
135 }
136 var sv storagepb.SchemaVersion
137 if err := proto.Unmarshal(item.Value, &sv); err != nil {
138 return fmt.Errorf("decode storage schema: %w", err)
139 }
140 switch {
141 case sv.GetVersion() > SchemaVersion:
142 return fmt.Errorf("%w: found %d, supported %d", ErrSchemaTooNew, sv.GetVersion(), SchemaVersion)
143 case sv.GetVersion() == 0:
144 return fmt.Errorf("decode storage schema: invalid version 0")
145 }
146 if sv.GetVersion() < SchemaVersion {
147 // Older data stays readable as it is (the changes are additive);
148 // the new version is recorded so that older builds refuse it.
149 // The tokens are upgraded in the same batch, so that a crash
150 // leaves the old version and the upgrade runs again.
151 target := uint32(SchemaVersion)
152 switch {
153 case sv.GetVersion() < 4:
154 target = 4
155 case sv.GetVersion() == 4:
156 target = 5
157 }
158 var b kv.Batch
159 b.RequireVersion(key, item.Version)
160 if sv.GetVersion() < 4 {
161 if err := s.upgradeTokens(ctx, &b); err != nil {
162 return err
163 }
164 }
165 if sv.GetVersion() == 4 {
166 if err := s.upgradeForceMergeTokens(ctx, &b); err != nil {
167 return err
168 }
169 }
170 if sv.GetVersion() == 5 {
171 if err := s.upgradeReleaseTokens(ctx, &b); err != nil {
172 return err
173 }
174 }
175 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: target}))
176 _, err := s.db.Apply(ctx, &b)
177 if errors.Is(err, kv.ErrConflict) {
178 continue // changed meanwhile: read it again
179 }
180 if err != nil {
181 return fmt.Errorf("upgrade storage schema: %w", err)
182 }
183 log.Info().Uint32("from", sv.GetVersion()).Uint32("schema", target).Msg("storage schema upgraded")
184 if target < SchemaVersion {
185 continue
186 }
187 return nil
188 }
189 log.Info().Uint32("schema", sv.GetVersion()).Msg("storage schema checked")
190 return nil
191 }
192 return errors.New("write storage schema: concurrent initialization did not settle")
193}
194
195func mustMarshal(m proto.Message) []byte {
196 b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
197 if err != nil {
198 panic(fmt.Sprintf("kvstore: marshal %T: %v", m, err)) // only for invalid UTF-8 strings, checked by callers
199 }
200 return b
201}
202
203// preIssueScopes are the nine original scopes, before mr:review and issue:write.
204var preIssueScopes = []domain.Scope{
205 domain.ScopeRepoRead, domain.ScopeRepoWrite, domain.ScopeRepoAdmin,
206 domain.ScopeMRWrite, domain.ScopeMRMerge,
207 domain.ScopeCIWrite, domain.ScopeSecretsWrite, domain.ScopeRunnerRegister,
208 domain.ScopeTokenAdmin,
209}
210
211// upgradeTokens adds to b the schema 4 upgrade of the tokens: a token that
212// holds all of preIssueScopes, limited to no repository and no branch prefix,
213// had the owner rights, which schema 4 needed mr:review and issue:write
214// for, so it gets each of them if missing (this is no escalation). Every other
215// token is left as it is. The batch requires each token to be at the version it
216// was read at.
217func (s *Store) upgradeTokens(ctx context.Context, b *kv.Batch) error {
218 return s.upgradeTokenScopes(ctx, b, preIssueScopes, []domain.Scope{domain.ScopeMRReview, domain.ScopeIssueWrite})
219}
220
221// preForceMergeScopes are the eleven scopes of schema 4, before mr:force-merge.
222var preForceMergeScopes = append(slices.Clone(preIssueScopes), domain.ScopeMRReview, domain.ScopeIssueWrite)
223
224// upgradeForceMergeTokens adds to b the schema 5 upgrade of the tokens: a
225// token that holds all of preForceMergeScopes, limited to no repository and no
226// branch prefix, had the owner rights, which AllScopes also needs
227// mr:force-merge for, so it gets it. Every other token is left as it is.
228func (s *Store) upgradeForceMergeTokens(ctx context.Context, b *kv.Batch) error {
229 return s.upgradeTokenScopes(ctx, b, preForceMergeScopes, []domain.Scope{domain.ScopeMRForceMerge})
230}
231
232// preReleaseScopes are the twelve scopes of schema 5, before release:write.
233var preReleaseScopes = append(slices.Clone(preForceMergeScopes), domain.ScopeMRForceMerge)
234
235// upgradeReleaseTokens adds to b the schema 6 upgrade of the tokens: a token
236// that holds all of preReleaseScopes, limited to no repository and no branch
237// prefix, had the owner rights, which AllScopes also needs release:write for,
238// so it gets it. Restricted or partial tokens are left as they are.
239func (s *Store) upgradeReleaseTokens(ctx context.Context, b *kv.Batch) error {
240 return s.upgradeTokenScopes(ctx, b, preReleaseScopes, []domain.Scope{domain.ScopeReleaseWrite})
241}
242
243func (s *Store) upgradeTokenScopes(ctx context.Context, b *kv.Batch, required, addedScopes []domain.Scope) error {
244 for key, item := range s.db.Snapshot(ctx).Prefix(ctx, []byte(tokenPrefix)) {
245 pb := &storagepb.Token{}
246 if err := proto.Unmarshal(item.Value, pb); err != nil {
247 return fmt.Errorf("upgrade token %s: %w", key, err)
248 }
249 if len(pb.GetRepos()) > 0 || len(pb.GetBranchPrefixes()) > 0 {
250 continue
251 }
252 full := true
253 for _, sc := range required {
254 if !slices.Contains(pb.GetScopes(), sc.String()) {
255 full = false
256 break
257 }
258 }
259 if !full {
260 continue
261 }
262 added := false
263 for _, sc := range addedScopes {
264 if !slices.Contains(pb.GetScopes(), sc.String()) {
265 pb.Scopes = append(pb.Scopes, sc.String())
266 added = true
267 }
268 }
269 if !added {
270 continue
271 }
272 b.RequireVersion(slices.Clone(key), item.Version)
273 b.Put(slices.Clone(key), mustMarshal(pb))
274 }
275 return nil
276}