server.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package rpc
4
5import (
6	"context"
7	"errors"
8	"slices"
9
10	"connectrpc.com/connect"
11
12	pb "bnema.dev/ermite-api/gen/ermite"
13	"bnema.dev/ermite/internal/ports"
14)
15
16// serverService implements ermiteconnect.ServerServiceHandler.
17type serverService struct {
18	version  string
19	features []string
20	key      ports.SigningKeyService
21	// oidc manages key rotation, including the disabled-provider response.
22	oidc ports.OIDCKeyService
23}
24
25func (s *serverService) GetVersion(context.Context, *connect.Request[pb.GetVersionRequest]) (*connect.Response[pb.GetVersionResponse], error) {
26	return connect.NewResponse(&pb.GetVersionResponse{Version: s.version, Features: slices.Clone(s.features)}), nil
27}
28
29// GetSigningKey returns the public key of the commits ermite signs. It needs
30// no authentication (see the interceptor).
31func (s *serverService) GetSigningKey(context.Context, *connect.Request[pb.GetSigningKeyRequest]) (*connect.Response[pb.GetSigningKeyResponse], error) {
32	info := s.key.Info()
33	return connect.NewResponse(&pb.GetSigningKeyResponse{
34		PublicKey:      info.Key.AuthorizedKey,
35		Fingerprint:    info.Key.Fingerprint,
36		CommitterName:  info.Committer.Name,
37		CommitterEmail: info.Committer.Email,
38		AllowedSigners: info.AllowedSigners(),
39	}), nil
40}
41
42// RotateOIDCKey replaces the key that signs the ID tokens of CI jobs. Only the
43// owner may; failed_precondition when the server issues no ID tokens. An API
44// built without an OIDC key service answers unimplemented.
45func (s *serverService) RotateOIDCKey(ctx context.Context, _ *connect.Request[pb.RotateOIDCKeyRequest]) (*connect.Response[pb.RotateOIDCKeyResponse], error) {
46	if s.oidc == nil {
47		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("this API serves no OIDC key service"))
48	}
49	p := caller(ctx)
50	r, err := s.oidc.RotateKey(ctx, p)
51	if err != nil {
52		return nil, connectError(ctx, err)
53	}
54	out := &pb.RotateOIDCKeyResponse{Issuer: r.Issuer, Kid: r.Kid, RetiredKid: r.RetiredKid}
55	if r.RetiredKid != "" {
56		out.RetiredUntil = timestamp(r.RetiredUntil)
57	}
58	return connect.NewResponse(out), nil
59}