| Login | {self.login} | |
|---|---|---|
| Created | {c}s ago | {self.created} |
| Last updated | {u}s ago | {self.updated} |
| Auth Expires In | t + {self.expires_in}s | {ein} |
| Refresh Expires In | t + {self.refresh_token_expires_in}s | {rin} |
| Type | {self.token_type} |
{ods}
+
+
+"""
+ # Use the token to figure out the username of the user associated with the
+ # token.
+ headers = {
+ "Accept": "application/vnd.github.v3+json",
+ "Authorization": f"{od['token_type']} {od['access_token']}",
+ }
+ ud = requests.get(
+ url="https://api.github.com/user",
+ headers=headers,
+ ).json()
+ assert ud['login'] == login, (ud['login'], login)
+
+ od['login'] = login
+ return cls.from_json(od)
+
+ @classmethod
+ def from_json(cls, od):
+ assert 'access_token' in od, od
+ assert 'token_type' in od, od
+ assert 'expires_in' in od, od
+ od['expires_in'] = int(od['expires_in'])
+ assert 'refresh_token' in od, od
+ assert 'refresh_token_expires_in' in od, od
+ od['refresh_token_expires_in'] = int(od['refresh_token_expires_in'])
+ return cls(**od)
+
+
+client = ndb.Client()
diff --git a/apps/common/inc.mk b/apps/common/inc.mk
new file mode 100644
index 0000000..8d424b4
--- /dev/null
+++ b/apps/common/inc.mk
@@ -0,0 +1,72 @@
+# Copyright 2021 OpenROAD Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+MAKE_DIR := $(realpath $(dir $(lastword $(MAKEFILE_LIST))))
+
+include $(MAKE_DIR)/config.mk
+
+SRCS=\
+ ../common/Dockerfile \
+ ../common/.dockerignore \
+ ../common/db.py \
+ ../common/utils.py \
+ *.py \
+ *.txt \
+ ../../github_api
+
+PYTHONPATH=$(abspath $(PWD)/../common):$(abspath $(PWD)/../../)
+export PYTHONPATH
+
+BUILD_DIR=$(PROJECT_NAME)-build
+
+build:
+ rm -rf $(BUILD_DIR)
+ mkdir $(BUILD_DIR)
+ cp -a $(SRCS) ./$(BUILD_DIR)/
+ find $(BUILD_DIR) -name '*.pem' -delete
+ find $(BUILD_DIR) -name '*.pyc' -delete
+ find $(BUILD_DIR) -name '.*.sw*' -delete
+ find $(BUILD_DIR) -type d -empty -delete
+ find $(BUILD_DIR) | sort
+ cd $(BUILD_DIR); gcloud --project=$(PROJECT_ID) \
+ builds submit \
+ --tag gcr.io/$(PROJECT_ID)/$(PROJECT_NAME)
+
+.PHONY: build
+
+SECRETS_ENV=CLIENT_ID CLIENT_SECRET APP_ID
+SECRETS_CENV=CLIENT_TOKEN
+
+SECRETS_CMDLINE_ENV=$(shell echo $(SECRETS_ENV) | sed -e's/\([^ ]\+\) \?/\1=$(SECRETS_PREFIX)_\1:latest,/g' -e's/,$$//')
+SECRETS_CMDLINE_CENV=$(shell echo $(SECRETS_CENV) | sed -e's/\([^ ]\+\) \?/,\1=COMMON_\1:latest,/g' -e's/,$$//')
+SECRETS_CMDLINE_PEM=,/keys/app.private-key.pem=$(SECRETS_PREFIX)_CLIENT_KEY:latest
+
+deploy:
+ gcloud --project=$(PROJECT_ID) beta \
+ run deploy \
+ $(PROJECT_NAME) \
+ --image gcr.io/$(PROJECT_ID)/$(PROJECT_NAME) \
+ --platform managed --region=$(REGION) \
+ --allow-unauthenticated \
+ --set-env-vars PROJECT_ID=$(PROJECT_ID),CLIENT_KEY=/keys/app.private-key.pem \
+ --service-account=$(SERVICE_ACCOUNT)@$(PROJECT_ID).iam.gserviceaccount.com \
+ --set-secrets=$(SECRETS_CMDLINE_ENV)$(SECRETS_CMDLINE_CENV)$(SECRETS_CMDLINE_PEM)
+
+.PHONY: deploy
+
+DATASTORE_EMULATOR_HOST=localhost:8081
+db:
+ gcloud beta emulators datastore start
diff --git a/apps/common/index.yaml b/apps/common/index.yaml
new file mode 100644
index 0000000..fd9abce
--- /dev/null
+++ b/apps/common/index.yaml
@@ -0,0 +1,6 @@
+indexes:
+- kind: Token
+ properties:
+ - name: login
+ - name: created
+ direction: desc
diff --git a/apps/common/utils.py b/apps/common/utils.py
new file mode 100755
index 0000000..7a16779
--- /dev/null
+++ b/apps/common/utils.py
@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Copyright 2021 OpenROAD Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+
+import os
+from collections import namedtuple
+
+import tokenlib
+
+
+_PRInfo = namedtuple("PRInfo", "user org repo pr rev")
+
+
+class PRInfo(_PRInfo):
+
+ @classmethod
+ def _tm(cls, tm_store=[]):
+ if not tm_store:
+ tm_store.append(SimpleTokenManager(
+ secret=os.environ['CLIENT_TOKEN']))
+ return tm_store[0]
+
+ @property
+ def pr_url(self):
+ """
+ >>> i = PRInfo.parse("mithro:The-OpenROAD-Project/OpenROAD/2@main")
+ >>> i.pr_url
+ 'https://github.com/The-OpenROAD-Project/OpenROAD/pull/2'
+ """
+ return f"https://github.com/{self.org}/{self.repo}/pull/{self.pr}"
+
+ @property
+ def auth_url(self):
+ return f'https://pr.gha.openroad.tools/auth?state='+self.to_token()
+
+ @property
+ def hook_url(self):
+ return f'https://a.gha.openroad.tools/hook?state='+self.to_token()
+
+ @property
+ def revoke_url(self):
+ return f'https://a.gha.openroad.tools/revoke?state='+self.to_token()
+
+ @property
+ def slug(self):
+ return f"{self.org}/{self.repo}"
+
+ @classmethod
+ def check(cls, s):
+ """
+ >>> PRInfo.check("mithro:The-OpenROAD-Project/OpenROAD/2@main")
+ True
+ >>> PRInfo.check("mithro:The-OpenROAD-Project/OpenROAD/2@")
+ False
+ """
+ try:
+ user, org, repo, pr, rev = cls.parse(s)
+ assert user, s
+ assert org, s
+ assert repo, s
+ assert pr, s
+ assert rev , s
+ return True
+ except Exception as e:
+ return False
+
+ @classmethod
+ def from_token(cls, estate):
+ assert estate is not None, estate
+ state = cls._tm().parse_token(estate)
+ return cls.parse(state)
+
+ def to_token(self, salt=None):
+ """
+ >>> i = PRInfo.parse("mithro:The-OpenROAD-Project/OpenROAD/2@main")
+ >>> t = i.to_token(b'AAA')
+ >>> t
+ 'QUFBbWl0aHJvOlRoZS1PcGVuUk9BRC1Qcm9qZWN0L09wZW5ST0FELzJAbWFpbtXQMDVIcDMABpYwq0bR16ASrpgL6HVjgv8ibtahoZzg'
+ >>> PRInfo.from_token(t)
+ PRInfo(user='mithro', org='The-OpenROAD-Project', repo='OpenROAD', pr=2, rev='main')
+ >>> t = i.to_token(b'AAB')
+ >>> t
+ 'QUFCbWl0aHJvOlRoZS1PcGVuUk9BRC1Qcm9qZWN0L09wZW5ST0FELzJAbWFpbgwv3YQAVjJL-ewHxQqxEA8aBzOSopyLwO5nW9IUnlma'
+ >>> PRInfo.from_token(t)
+ PRInfo(user='mithro', org='The-OpenROAD-Project', repo='OpenROAD', pr=2, rev='main')
+ """
+ return self._tm().make_token(str(self), salt=salt)
+
+ @classmethod
+ def from_request(cls, r):
+ estate = r.args.get('state')
+ assert estate is not None, r.args
+ return cls.from_token(estate)
+
+ @classmethod
+ def from_json(cls, j):
+ return cls(
+ j['user']['login'],
+ *j['base']['repo']['full_name'].split('/'),
+ j['number'],
+ j['head']['sha'])
+
+ @classmethod
+ def parse(cls, s):
+ """
+ >>> PRInfo.parse("mithro:The-OpenROAD-Project/OpenROAD/2@main")
+ PRInfo(user='mithro', org='The-OpenROAD-Project', repo='OpenROAD', pr=2, rev='main')
+
+ """
+ assert ':' in s, s
+ assert '/' in s, s
+ assert '@' in s, s
+ rest = s
+
+ user, rest = rest.split(':', maxsplit=1)
+ org, repo, rest = rest.split('/', maxsplit=2)
+ pr, rev = rest.split('@', maxsplit=1)
+ pr = int(pr)
+ return cls(user, org, repo, pr, rev)
+
+ def __str__(self):
+ """
+
+ >>> str(PRInfo('mithro', 'The-OpenROAD-Project', 'OpenROAD', 2, 'main'))
+ 'mithro:The-OpenROAD-Project/OpenROAD/2@main'
+
+ >>> str(PRInfo('mithro', 'The-OpenROAD-Project', 'OpenROAD', '2', 'main'))
+ 'mithro:The-OpenROAD-Project/OpenROAD/2@main'
+
+ """
+ return f"{self.user}:{self.org}/{self.repo}/{self.pr}@{self.rev}"
+
+
+class SimpleTokenManager(tokenlib.TokenManager):
+ salt_length = 3
+
+ def make_token(self, data, salt=None):
+ """Generate a new token embedding the given dict of data.
+
+ The token is a JSON dump of the given data along with an expiry
+ time and salt. It has a HMAC signature appended and is b64-encoded
+ for transmission.
+ """
+ if salt is None:
+ salt = os.urandom(self.salt_length)
+ else:
+ assert len(salt) == self.salt_length, self.salt_length
+ payload = salt+data.encode("utf8")
+ sig = self._get_signature(payload)
+ assert len(sig) == self.hashmod_digest_size
+ return tokenlib.utils.encode_token_bytes(payload + sig)
+
+ def parse_token(self, token, now=None):
+ """Extract the data embedded in the given token, if valid.
+
+ The token is valid if it has a valid signature and if the embedded
+ expiry time has not passed. If the token is not valid then this
+ method raises ValueError.
+ """
+ # Parse the payload and signature from the token.
+ try:
+ decoded_token = tokenlib.utils.decode_token_bytes(token)
+ except (TypeError, ValueError) as e:
+ raise tokenlib.errors.MalformedTokenError(str(e))
+ payload = decoded_token[:-self.hashmod_digest_size]
+ sig = decoded_token[-self.hashmod_digest_size:]
+ # Carefully check the signature.
+ # This is a deliberately slow string-compare to avoid timing attacks.
+ # Read the docstring of strings_differ for more details.
+ expected_sig = self._get_signature(payload)
+ if tokenlib.utils.strings_differ(sig, expected_sig):
+ raise tokenlib.errors.InvalidSignatureError()
+ # Only decode *after* we've confirmed the signature.
+ # This should never fail, but well, you can't be too careful.
+ return payload[self.salt_length:].decode('utf-8')
+
+
+if __name__ == "__main__":
+ os.environ['CLIENT_TOKEN'] = 'doctest'
+ import doctest
+ doctest.testmod()
diff --git a/apps/pull-request-sender-auth-check/Makefile b/apps/pull-request-sender-auth-check/Makefile
new file mode 100644
index 0000000..9eb0552
--- /dev/null
+++ b/apps/pull-request-sender-auth-check/Makefile
@@ -0,0 +1,23 @@
+# Copyright 2021 OpenROAD Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+
+PROJECT_NAME=pull-request-sender-auth-check
+SECRETS_PREFIX=AUTH
+SERVICE_ACCOUNT=pull-request-sender
+
+
+include ../common/inc.mk
diff --git a/apps/pull-request-sender-auth-check/app.py b/apps/pull-request-sender-auth-check/app.py
new file mode 100755
index 0000000..d0d2f70
--- /dev/null
+++ b/apps/pull-request-sender-auth-check/app.py
@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Copyright 2021 OpenROAD Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+
+import datetime
+import json
+import os
+import pprint
+
+import flask
+
+import db
+import utils
+
+import github_api as gapi
+from github_api import checks
+
+
+app = flask.Flask(__name__)
+
+
+BASE_URL = "a.gha.openroad.tools"
+
+PROJECT_ID = os.environ['PROJECT_ID']
+
+CLIENT_ID = os.environ['CLIENT_ID']
+CLIENT_SECRET = os.environ['CLIENT_SECRET']
+
+# ----------------------------
+NAME = 'PR Sender Authentication'
+EXTERNAL_ID = 'pr-auth'
+
+
+def auth_check_on_private_pr(info):
+ assert isinstance(info, utils.PRInfo), info
+
+ if info.slug not in ('mithro/OpenROAD-1',):
+ return
+
+ url = f"https://api.github.com/repos/{info.slug}/commits/{info.rev}/check-runs"
+ os.environ['GITHUB_REPOSITORY'] = info.slug
+ check_runs_json = gapi.get_github_json(url)
+ assert 'check_runs' in check_runs_json, pprint.pformat(check_runs_json)
+
+ existing_checks = []
+ for c in check_runs_json['check_runs']:
+ c.pop('app')
+ if c['external_id'] != EXTERNAL_ID:
+ continue
+ if c['id'] in (2688818725,):
+ continue
+ existing_checks.append(c)
+
+ t = db.Token.latest(info.user)
+
+ now = datetime.datetime.utcnow()
+ if t is None:
+ new_check = checks.CheckRunCreate(
+ name = NAME,
+ head_sha = info.rev,
+ external_id = EXTERNAL_ID,
+
+ status = checks.CheckStatus.completed,
+ started_at = now,
+
+ conclusion = checks.CheckConclusion.action_required,
+ details_url = info.auth_url,
+ completed_at = now,
+
+ output = checks.CheckRunCreateOutput(
+ title = "Missing credentials for " +info.user,
+ summary = f"""\
+The pull request sending robot has not be authorized to send pull requests for {info.user}.
+
+[Resolve by having {info.user} click this link.]({info.auth_url})
+""",
+ text = None,
+ ),
+ actions = [],
+ )
+ else:
+ # Create the login okay status check.
+ new_check = checks.CheckRunCreate(
+ name = NAME,
+ head_sha = info.rev,
+ external_id = EXTERNAL_ID,
+
+ status = checks.CheckStatus.completed,
+ started_at = now,
+
+ conclusion = checks.CheckConclusion.success,
+ details_url = None,
+ completed_at = now,
+
+ output = checks.CheckRunCreateOutput(
+ title = "Credentials found for "+info.user,
+ summary = f"""\
+The pull request sending robot found authorization for {info.user}.
+
+[Double check by having {info.user} click this link.]({info.auth_url})
+
+([Revoke authorization]({info.revoke_url}))
+""",
+ text = None,
+ ),
+ actions = [],
+ )
+
+ uurl = f"https://api.github.com/repos/{info.slug}/check-runs"
+ if not existing_checks:
+ r = gapi.send_github_json(uurl, 'POST', new_check)
+ return 'Need to *create* this check.'+'\n'+pprint.pformat(r)+'\n'
+ else:
+ existing_id = existing_checks[0]['id']
+ purl = uurl+'/'+str(existing_id)
+ r = gapi.send_github_json(purl, 'PATCH', new_check)
+ return f'Needed to *update* this check with {existing_id}.'+'\n'+pprint.pformat(r)+'\n'
+
+# ----------------------------
+
+@app.route("/revoke", methods=['GET', 'POST'])
+def revoke():
+ info = utils.PRInfo.from_request(flask.request)
+ db.Token.delete(info.user)
+ r = auth_check_on_private_pr(info)
+ return flask.redirect(info.pr_url)
+
+# ----------------------------
+
+@app.route("/hook", methods=['GET', 'POST'])
+def hook():
+ if flask.request.method == 'POST':
+ payload = json.loads(flask.request.get_data())
+ if 'pull_request' in payload:
+ info = utils.PRInfo.from_json(payload['pull_request'])
+ r = auth_check_on_private_pr(info)
+ if r is not None:
+ return r
+ return 'Unknown hook action?\n'+json.dumps(payload, sort_keys=True, indent=2)
+ else:
+ info = utils.PRInfo.from_request(flask.request)
+ r = auth_check_on_private_pr(info)
+ return flask.redirect(info.pr_url)
+
+# ----------------------------
+
+# Redirect {BASE_URL}/localhost/