1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase
4
5import (
6 "context"
7 "crypto/rsa"
8 "slices"
9 "time"
10
11 "bnema.dev/ermite-actions/expr"
12 "bnema.dev/ermite-actions/template"
13 "bnema.dev/ermite-actions/workflow"
14 "bnema.dev/ermite/internal/domain"
15 "bnema.dev/ermite/internal/ports"
16)
17
18// AuthorOf exposes authorOf to the tests.
19func AuthorOf(p domain.Principal) string { return authorOf(p) }
20
21// Sweep exposes the daily sweep to the tests.
22func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }
23
24// RunTitle gives the title of a run as startRun sets it: the evaluated
25// run-name, else commitTitle.
26func (c *CI) RunTitle(ctx context.Context, wf *workflow.Workflow, githubJSON, commitTitle string) string {
27 if name, ok := c.evalRunName(ctx, wf, githubJSON, expr.NewDictionary()); ok {
28 return name
29 }
30 return commitTitle
31}
32
33// CheckRunID exposes checkRunID to the tests.
34func CheckRunID(ctx context.Context, run domain.CIRun, index, combo int) int64 {
35 return checkRunID(ctx, run, index, combo)
36}
37
38// SecretUse is the result of SecretsUsedBy.
39type SecretUse = secretUse
40
41// SecretsUsedBy exposes secretsUsedBy to the tests.
42func SecretsUsedBy(workflowYAML, jobID string) SecretUse {
43 return secretsUsedBy(workflowYAML, jobID)
44}
45
46// SecretWalks is the number of YAML walks made so far.
47func SecretWalks() int64 { return secretWalks.Load() }
48
49// SecretUseCache is a wfCache exposed to the tests.
50type SecretUseCache struct{ c *wfCache }
51
52// NewSecretUseCache builds a cache for up to max runs.
53func NewSecretUseCache(max int) *SecretUseCache { return &SecretUseCache{newWfCache(max)} }
54
55// Use is wfCache.secretUse.
56func (s *SecretUseCache) Use(runID int64, yaml, jobKey string) SecretUse {
57 return s.c.secretUse(runID, yaml, jobKey)
58}
59
60// Drop is wfCache.drop.
61func (s *SecretUseCache) Drop(runID int64) { s.c.drop(runID) }
62
63// EvalConcurrency exposes evalConcurrency to the tests.
64func EvalConcurrency(ctx context.Context, tok template.Token, env template.Env) (domain.CIConcurrency, error) {
65 return evalConcurrency(ctx, tok, env)
66}
67
68// MatchPullRequest exposes the pull_request filter to the tests.
69func MatchPullRequest(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
70 return matchPullRequest(wf, "pull_request", action, base, files, truncated)
71}
72
73// MatchPullRequestTarget exposes the pull_request_target filter to the tests.
74func MatchPullRequestTarget(wf *workflow.Workflow, action, base string, files []string, truncated bool) bool {
75 return matchPullRequest(wf, "pull_request_target", action, base, files, truncated)
76}
77
78// MatchWorkflowRun exposes the workflow_run filter to the tests.
79func MatchWorkflowRun(wf *workflow.Workflow, name, action, headBranch string) bool {
80 return matchWorkflowRun(wf, name, action, headBranch)
81}
82
83// ResolveDispatchInputs exposes resolveDispatchInputs to the tests.
84func ResolveDispatchInputs(defs []workflow.Input, given map[string]string) (map[string]string, error) {
85 return resolveDispatchInputs(defs, given)
86}
87
88// PullFilesLink exposes the Link header of the files endpoint to the tests.
89func PullFilesLink(base string, page, perPage, total int) string {
90 return pullFilesLink(base, page, perPage, total)
91}
92
93// FilePatch exposes the patch text of a file of the files endpoint to the tests.
94func FilePatch(f domain.FileDiff) (string, bool) { return filePatch(f) }
95
96// PullTipsTrusted exposes the trust check of an activity of a merge request to
97// the tests, on a CI that has cfg and no workers.
98func PullTipsTrusted(ctx context.Context, cfg CIConfig, repo domain.RepoName, ev ports.PullRequestEvent) (bool, domain.ObjectID) {
99 return (&CI{cfg: cfg}).pullTipsTrusted(ctx, repo, ev)
100}
101
102// Thumbprint exposes thumbprint to the tests.
103func Thumbprint(pub *rsa.PublicKey) string { return thumbprint(pub) }
104
105// IDTokenClaims gives the claims idTokenClaims builds, decoded.
106func IDTokenClaims(contextsJSON, environment, issuer, audience string, at time.Time) (map[string]any, []string, error) {
107 claims, err := idTokenClaims(contextsJSON, environment, idTokenMeta{issuer: issuer, audience: audience, jti: "jti", now: at})
108 if err != nil {
109 return nil, nil, err
110 }
111 out := make(map[string]any, len(claims))
112 keys := make([]string, 0, len(claims))
113 for _, p := range claims {
114 out[p.k] = p.v
115 keys = append(keys, p.k)
116 }
117 return out, keys, nil
118}
119
120// SignForTest signs claims (in the order of their keys) with the signing key.
121func (o *OIDC) SignForTest(claims map[string]any) (string, error) {
122 keys := make([]string, 0, len(claims))
123 for k := range claims {
124 keys = append(keys, k)
125 }
126 slices.Sort(keys)
127 out := make(ordered, 0, len(keys))
128 for _, k := range keys {
129 out = append(out, pair{k, claims[k]})
130 }
131 return o.sign(out)
132}