server.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package rpc
4
5import (
6	"context"
7	"errors"
8	"slices"
9
10	"connectrpc.com/connect"
11
12	pb "bnema.dev/ermite-api/gen/ermite"
13	"bnema.dev/ermite/internal/domain"
14	"bnema.dev/ermite/internal/ports"
15)
16
17// serverService implements ermiteconnect.ServerServiceHandler.
18type serverService struct {
19	version  string
20	features []string
21	key      ports.SigningKeyService
22	// oidc rotates the key of the ID tokens; nil when the server issues none.
23	oidc ports.OIDCKeyService
24}
25
26func (s *serverService) GetVersion(context.Context, *connect.Request[pb.GetVersionRequest]) (*connect.Response[pb.GetVersionResponse], error) {
27	return connect.NewResponse(&pb.GetVersionResponse{Version: s.version, Features: slices.Clone(s.features)}), nil
28}
29
30// GetSigningKey returns the public key of the commits ermite signs. It needs
31// no authentication (see the interceptor).
32func (s *serverService) GetSigningKey(context.Context, *connect.Request[pb.GetSigningKeyRequest]) (*connect.Response[pb.GetSigningKeyResponse], error) {
33	info := s.key.Info()
34	return connect.NewResponse(&pb.GetSigningKeyResponse{
35		PublicKey:      info.Key.AuthorizedKey,
36		Fingerprint:    info.Key.Fingerprint,
37		CommitterName:  info.Committer.Name,
38		CommitterEmail: info.Committer.Email,
39		AllowedSigners: info.AllowedSigners(),
40	}), nil
41}
42
43// RotateOIDCKey replaces the key that signs the ID tokens of CI jobs. Only the
44// owner may; failed_precondition when the server issues no ID tokens.
45func (s *serverService) RotateOIDCKey(ctx context.Context, _ *connect.Request[pb.RotateOIDCKeyRequest]) (*connect.Response[pb.RotateOIDCKeyResponse], error) {
46	p := caller(ctx)
47	if s.oidc == nil {
48		if !p.HasOwnerRights() {
49			return nil, connectError(ctx, domain.ErrForbidden)
50		}
51		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.New("the server issues no OIDC ID tokens: it has no ERMITE_SECRETS_KEY"))
52	}
53	r, err := s.oidc.RotateKey(ctx, p)
54	if err != nil {
55		return nil, connectError(ctx, err)
56	}
57	out := &pb.RotateOIDCKeyResponse{Issuer: r.Issuer, Kid: r.Kid, RetiredKid: r.RetiredKid}
58	if r.RetiredKid != "" {
59		out.RetiredUntil = timestamp(r.RetiredUntil)
60	}
61	return connect.NewResponse(out), nil
62}