1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3// Package kvstore implements the metadata ports over ermite-kv. Values are
4// the protobuf messages of proto/ermite/storage.
5package kvstore
6
7import (
8 "context"
9 "errors"
10 "fmt"
11 "slices"
12
13 kv "bnema.dev/ermite-kv"
14 "github.com/bnema/zerowrap"
15 "google.golang.org/protobuf/proto"
16
17 storagepb "bnema.dev/ermite/gen/ermite/storage"
18 "bnema.dev/ermite/internal/domain"
19 "bnema.dev/ermite/internal/ports"
20)
21
22// SchemaVersion is the storage schema this build reads and writes. Version 2
23// adds branch prefixes to tokens: a build that does not know them would treat
24// a branch-limited token as unrestricted, so it must refuse the data
25// (ErrSchemaTooNew) instead. Version 3 adds the records of CI-3 that an older
26// build would misread: the call and scoped jobs of reusable workflows (it would
27// run the jobs of a called workflow as jobs of the caller's file, and plan the
28// call itself), the head commit of the runs of merge requests
29// (CIRun.head_sha: it would attach their checks to the merge commit, where
30// nothing looks for them), and the index of the open merge requests by source
31// branch (mropen/: an older build would not keep it up to date; the upgrade
32// builds it once, see BuildOpenIndex). Version 4 adds the issues (is/, isc/,
33// isopen/, numbered from the same mrseq/ sequence as the merge requests, and
34// RepoSettings.issues): an older build would not delete them with their
35// repository, nor keep the numbers apart, and it would misread the issue:write
36// scope, so it must refuse the data. It also adds the pending issues of the
37// public form (ispend/<repo>/<id>, removed with their repository), the bans of
38// their submitters (isban/<hex hash>) and the form's server key
39// (meta/issuekey). The upgrade also adds mr:review and issue:write (each only
40// if missing) to the stored tokens that held all nine original scopes with no
41// repository list and no branch prefix, so that they keep the owner rights (see
42// upgradeTokens). Version 5 grants mr:force-merge to unrestricted tokens
43// holding all eleven previous scopes, preserving their owner rights. Version 6
44// adds releases and release:write; older builds cannot clean up their metadata
45// or preserve the owner rights of upgraded tokens (see upgradeReleaseTokens).
46const SchemaVersion = 6
47
48const schemaKey = "meta/schema"
49
50// ErrSchemaTooNew means the data was written by a newer ermite.
51var ErrSchemaTooNew = errors.New("storage schema is newer than this ermite supports")
52
53// Store is the ermite-kv backed metadata store.
54type Store struct {
55 db *kv.DB
56 locks *numberLocks // shared by the merge request and issue stores
57}
58
59var _ ports.RepoMetaStore = (*Store)(nil)
60
61// Open opens (or creates) the database in dir and checks the storage schema:
62// a missing version is written as SchemaVersion, a lower one is upgraded to it,
63// a higher one stops with ErrSchemaTooNew. dir must exist.
64func Open(ctx context.Context, dir string) (*Store, error) {
65 db, err := kv.Open(ctx, dir, kv.Options{})
66 if err != nil {
67 return nil, fmt.Errorf("open ermite-kv in %s: %w", dir, err)
68 }
69 s := &Store{db: db, locks: new(numberLocks)}
70 if err := s.checkSchema(ctx); err != nil {
71 _ = db.Close(context.WithoutCancel(ctx))
72 return nil, err
73 }
74 // Part of the schema 3 upgrade: the index of the open merge requests.
75 if err := s.BuildOpenIndex(ctx); err != nil {
76 _ = db.Close(context.WithoutCancel(ctx))
77 return nil, err
78 }
79 return s, nil
80}
81
82// Close stops the database after the writes in progress.
83func (s *Store) Close(ctx context.Context) error {
84 if err := s.db.Close(ctx); err != nil {
85 return fmt.Errorf("close ermite-kv: %w", err)
86 }
87 return nil
88}
89
90// Check reports whether the database accepts writes. It returns the failure
91// once ermite-kv is closed or failed, and writes nothing.
92//
93// ermite-kv has no state accessor, and an empty batch sent through Apply would
94// queue behind the writes in progress. Apply looks at the state of the database
95// before it looks at its context, though, and an ended context stops it before
96// the writer channel: Apply on a cancelled context therefore answers ErrClosed
97// or ErrFailed when the database is stopped, and context.Canceled when it is
98// healthy, without waiting for the writer.
99func (s *Store) Check(ctx context.Context) error {
100 if err := ctx.Err(); err != nil {
101 return err
102 }
103 probe, cancel := context.WithCancel(context.WithoutCancel(ctx))
104 cancel()
105 var b kv.Batch
106 if _, err := s.db.Apply(probe, &b); err != nil && !errors.Is(err, context.Canceled) {
107 return fmt.Errorf("ermite-kv: %w", err)
108 }
109 return nil
110}
111
112func (s *Store) checkSchema(ctx context.Context) error {
113 log := zerowrap.FromCtx(ctx)
114 key := []byte(schemaKey)
115 for range 5 {
116 item, ok := s.db.Get(ctx, key)
117 if !ok {
118 var b kv.Batch
119 b.RequireAbsent(key)
120 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: SchemaVersion}))
121 _, err := s.db.Apply(ctx, &b)
122 if errors.Is(err, kv.ErrConflict) {
123 continue // written meanwhile: read it
124 }
125 if err != nil {
126 return fmt.Errorf("write storage schema: %w", err)
127 }
128 log.Info().Uint32("schema", SchemaVersion).Msg("storage schema initialized")
129 return nil
130 }
131 var sv storagepb.SchemaVersion
132 if err := proto.Unmarshal(item.Value, &sv); err != nil {
133 return fmt.Errorf("decode storage schema: %w", err)
134 }
135 switch {
136 case sv.GetVersion() > SchemaVersion:
137 return fmt.Errorf("%w: found %d, supported %d", ErrSchemaTooNew, sv.GetVersion(), SchemaVersion)
138 case sv.GetVersion() == 0:
139 return fmt.Errorf("decode storage schema: invalid version 0")
140 }
141 if sv.GetVersion() < SchemaVersion {
142 // Older data stays readable as it is (the changes are additive);
143 // the new version is recorded so that older builds refuse it.
144 // The tokens are upgraded in the same batch, so that a crash
145 // leaves the old version and the upgrade runs again.
146 target := uint32(SchemaVersion)
147 switch {
148 case sv.GetVersion() < 4:
149 target = 4
150 case sv.GetVersion() == 4:
151 target = 5
152 }
153 var b kv.Batch
154 b.RequireVersion(key, item.Version)
155 if sv.GetVersion() < 4 {
156 if err := s.upgradeTokens(ctx, &b); err != nil {
157 return err
158 }
159 }
160 if sv.GetVersion() == 4 {
161 if err := s.upgradeForceMergeTokens(ctx, &b); err != nil {
162 return err
163 }
164 }
165 if sv.GetVersion() == 5 {
166 if err := s.upgradeReleaseTokens(ctx, &b); err != nil {
167 return err
168 }
169 }
170 b.Put(key, mustMarshal(&storagepb.SchemaVersion{Version: target}))
171 _, err := s.db.Apply(ctx, &b)
172 if errors.Is(err, kv.ErrConflict) {
173 continue // changed meanwhile: read it again
174 }
175 if err != nil {
176 return fmt.Errorf("upgrade storage schema: %w", err)
177 }
178 log.Info().Uint32("from", sv.GetVersion()).Uint32("schema", target).Msg("storage schema upgraded")
179 if target < SchemaVersion {
180 continue
181 }
182 return nil
183 }
184 log.Info().Uint32("schema", sv.GetVersion()).Msg("storage schema checked")
185 return nil
186 }
187 return errors.New("write storage schema: concurrent initialization did not settle")
188}
189
190func mustMarshal(m proto.Message) []byte {
191 b, err := proto.MarshalOptions{Deterministic: true}.Marshal(m)
192 if err != nil {
193 panic(fmt.Sprintf("kvstore: marshal %T: %v", m, err)) // only for invalid UTF-8 strings, checked by callers
194 }
195 return b
196}
197
198// preIssueScopes are the nine original scopes, before mr:review and issue:write.
199var preIssueScopes = []domain.Scope{
200 domain.ScopeRepoRead, domain.ScopeRepoWrite, domain.ScopeRepoAdmin,
201 domain.ScopeMRWrite, domain.ScopeMRMerge,
202 domain.ScopeCIWrite, domain.ScopeSecretsWrite, domain.ScopeRunnerRegister,
203 domain.ScopeTokenAdmin,
204}
205
206// upgradeTokens adds to b the schema 4 upgrade of the tokens: a token that
207// holds all of preIssueScopes, limited to no repository and no branch prefix,
208// had the owner rights, which schema 4 needed mr:review and issue:write
209// for, so it gets each of them if missing (this is no escalation). Every other
210// token is left as it is. The batch requires each token to be at the version it
211// was read at.
212func (s *Store) upgradeTokens(ctx context.Context, b *kv.Batch) error {
213 return s.upgradeTokenScopes(ctx, b, preIssueScopes, []domain.Scope{domain.ScopeMRReview, domain.ScopeIssueWrite})
214}
215
216// preForceMergeScopes are the eleven scopes of schema 4, before mr:force-merge.
217var preForceMergeScopes = append(slices.Clone(preIssueScopes), domain.ScopeMRReview, domain.ScopeIssueWrite)
218
219// upgradeForceMergeTokens adds to b the schema 5 upgrade of the tokens: a
220// token that holds all of preForceMergeScopes, limited to no repository and no
221// branch prefix, had the owner rights, which AllScopes also needs
222// mr:force-merge for, so it gets it. Every other token is left as it is.
223func (s *Store) upgradeForceMergeTokens(ctx context.Context, b *kv.Batch) error {
224 return s.upgradeTokenScopes(ctx, b, preForceMergeScopes, []domain.Scope{domain.ScopeMRForceMerge})
225}
226
227// preReleaseScopes are the twelve scopes of schema 5, before release:write.
228var preReleaseScopes = append(slices.Clone(preForceMergeScopes), domain.ScopeMRForceMerge)
229
230// upgradeReleaseTokens adds to b the schema 6 upgrade of the tokens: a token
231// that holds all of preReleaseScopes, limited to no repository and no branch
232// prefix, had the owner rights, which AllScopes also needs release:write for,
233// so it gets it. Restricted or partial tokens are left as they are.
234func (s *Store) upgradeReleaseTokens(ctx context.Context, b *kv.Batch) error {
235 return s.upgradeTokenScopes(ctx, b, preReleaseScopes, []domain.Scope{domain.ScopeReleaseWrite})
236}
237
238func (s *Store) upgradeTokenScopes(ctx context.Context, b *kv.Batch, required, addedScopes []domain.Scope) error {
239 for key, item := range s.db.Snapshot(ctx).Prefix(ctx, []byte(tokenPrefix)) {
240 pb := &storagepb.Token{}
241 if err := proto.Unmarshal(item.Value, pb); err != nil {
242 return fmt.Errorf("upgrade token %s: %w", key, err)
243 }
244 if len(pb.GetRepos()) > 0 || len(pb.GetBranchPrefixes()) > 0 {
245 continue
246 }
247 full := true
248 for _, sc := range required {
249 if !slices.Contains(pb.GetScopes(), sc.String()) {
250 full = false
251 break
252 }
253 }
254 if !full {
255 continue
256 }
257 added := false
258 for _, sc := range addedScopes {
259 if !slices.Contains(pb.GetScopes(), sc.String()) {
260 pb.Scopes = append(pb.Scopes, sc.String())
261 added = true
262 }
263 }
264 if !added {
265 continue
266 }
267 b.RequireVersion(slices.Clone(key), item.Version)
268 b.Put(slices.Clone(key), mustMarshal(pb))
269 }
270 return nil
271}