397 lines
13 KiB
Perl
397 lines
13 KiB
Perl
package Hydra::Controller::API;
|
|
|
|
use utf8;
|
|
use strict;
|
|
use warnings;
|
|
use base 'Hydra::Base::Controller::REST';
|
|
use Hydra::Helper::Nix;
|
|
use Hydra::Helper::CatalystUtils;
|
|
use Hydra::Controller::Project;
|
|
use JSON::MaybeXS;
|
|
use DateTime;
|
|
use Digest::SHA qw(sha256_hex);
|
|
use Text::Diff;
|
|
use IPC::Run qw(run);
|
|
use Digest::SHA qw(hmac_sha256_hex);
|
|
use String::Compare::ConstantTime qw(equals);
|
|
use IPC::Run3;
|
|
|
|
|
|
sub api : Chained('/') PathPart('api') CaptureArgs(0) {
|
|
my ($self, $c) = @_;
|
|
$c->response->content_type('application/json');
|
|
}
|
|
|
|
|
|
sub buildToHash {
|
|
my ($build) = @_;
|
|
my $result = {
|
|
id => $build->id,
|
|
project => $build->jobset->get_column("project"),
|
|
jobset => $build->jobset->get_column("name"),
|
|
job => $build->get_column("job"),
|
|
system => $build->system,
|
|
nixname => $build->nixname,
|
|
finished => $build->finished,
|
|
timestamp => $build->timestamp
|
|
};
|
|
|
|
if($build->finished) {
|
|
$result->{'buildstatus'} = $build->get_column("buildstatus");
|
|
} else {
|
|
$result->{'priority'} = $build->get_column("priority");
|
|
}
|
|
|
|
return $result;
|
|
};
|
|
|
|
|
|
sub latestbuilds : Chained('api') PathPart('latestbuilds') Args(0) {
|
|
my ($self, $c) = @_;
|
|
my $nr = $c->request->params->{nr};
|
|
error($c, "Parameter not defined!") if !defined $nr;
|
|
|
|
my $project = $c->request->params->{project};
|
|
my $jobset = $c->request->params->{jobset};
|
|
my $job = $c->request->params->{job};
|
|
my $system = $c->request->params->{system};
|
|
|
|
my $filter = {finished => 1};
|
|
$filter->{"jobset.project"} = $project if ! $project eq "";
|
|
$filter->{"jobset.name"} = $jobset if ! $jobset eq "";
|
|
$filter->{job} = $job if !$job eq "";
|
|
$filter->{system} = $system if !$system eq "";
|
|
|
|
my @latest = $c->model('DB::Builds')->search(
|
|
$filter,
|
|
{
|
|
rows => $nr,
|
|
order_by => ["id DESC"],
|
|
join => [ "jobset" ]
|
|
});
|
|
|
|
my @list;
|
|
push @list, buildToHash($_) foreach @latest;
|
|
|
|
$c->stash->{'plain'} = {
|
|
data => scalar (encode_json(\@list))
|
|
};
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub jobsetToHash {
|
|
my ($jobset) = @_;
|
|
return {
|
|
project => $jobset->get_column('project'),
|
|
name => $jobset->name,
|
|
nrscheduled => $jobset->get_column("nrscheduled"),
|
|
nrsucceeded => $jobset->get_column("nrsucceeded"),
|
|
nrfailed => $jobset->get_column("nrfailed"),
|
|
nrtotal => $jobset->get_column("nrtotal"),
|
|
lastcheckedtime => $jobset->lastcheckedtime,
|
|
starttime => $jobset->starttime,
|
|
checkinterval => $jobset->checkinterval,
|
|
triggertime => $jobset->triggertime,
|
|
fetcherrormsg => $jobset->fetcherrormsg,
|
|
errortime => $jobset->errortime,
|
|
haserrormsg => defined($jobset->errormsg) && $jobset->errormsg ne "" ? JSON::MaybeXS::true : JSON::MaybeXS::false
|
|
};
|
|
}
|
|
|
|
|
|
sub jobsets : Chained('api') PathPart('jobsets') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
my $projectName = $c->request->params->{project};
|
|
error($c, "Parameter 'project' not defined!") if !defined $projectName;
|
|
|
|
my $project = $c->model('DB::Projects')->find($projectName)
|
|
or notFound($c, "Project $projectName doesn't exist.");
|
|
|
|
my @jobsets = jobsetOverview($c, $project);
|
|
|
|
my @list;
|
|
push @list, jobsetToHash($_) foreach @jobsets;
|
|
|
|
$c->stash->{'plain'} = {
|
|
data => scalar (encode_json(\@list))
|
|
};
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub queue : Chained('api') PathPart('queue') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
my $nr = $c->request->params->{nr};
|
|
error($c, "Parameter not defined!") if !defined $nr;
|
|
|
|
my @builds = $c->model('DB::Builds')->search({finished => 0}, {rows => $nr, order_by => ["priority DESC", "id"]});
|
|
|
|
my @list;
|
|
push @list, buildToHash($_) foreach @builds;
|
|
|
|
$c->stash->{'plain'} = {
|
|
data => scalar (encode_json(\@list))
|
|
};
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub nrqueue : Chained('api') PathPart('nrqueue') Args(0) {
|
|
my ($self, $c) = @_;
|
|
my $nrQueuedBuilds = $c->model('DB::Builds')->search({finished => 0})->count();
|
|
$c->stash->{'plain'} = {
|
|
data => "$nrQueuedBuilds"
|
|
};
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub nrbuilds : Chained('api') PathPart('nrbuilds') Args(0) {
|
|
my ($self, $c) = @_;
|
|
my $nr = $c->request->params->{nr};
|
|
my $period = $c->request->params->{period};
|
|
|
|
error($c, "Parameter not defined!") if !defined $nr || !defined $period;
|
|
my $base;
|
|
|
|
my $project = $c->request->params->{project};
|
|
my $jobset = $c->request->params->{jobset};
|
|
my $job = $c->request->params->{job};
|
|
my $system = $c->request->params->{system};
|
|
|
|
my $filter = {finished => 1};
|
|
$filter->{"jobset.project"} = $project if ! $project eq "";
|
|
$filter->{"jobset.name"} = $jobset if ! $jobset eq "";
|
|
$filter->{job} = $job if !$job eq "";
|
|
$filter->{system} = $system if !$system eq "";
|
|
|
|
$base = 60*60 if($period eq "hour");
|
|
$base = 24*60*60 if($period eq "day");
|
|
|
|
my @stats = $c->model('DB::Builds')->search(
|
|
$filter,
|
|
{
|
|
select => [{ count => "*" }],
|
|
as => ["nr"],
|
|
group_by => ["timestamp - timestamp % $base"],
|
|
order_by => "timestamp - timestamp % $base DESC",
|
|
rows => $nr,
|
|
join => [ "jobset" ]
|
|
}
|
|
);
|
|
my @arr;
|
|
push @arr, int($_->get_column("nr")) foreach @stats;
|
|
@arr = reverse(@arr);
|
|
|
|
$c->stash->{'plain'} = {
|
|
data => scalar (encode_json(\@arr))
|
|
};
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub scmdiff : Path('/api/scmdiff') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
my $uri = $c->request->params->{uri};
|
|
my $type = $c->request->params->{type};
|
|
my $rev1 = $c->request->params->{rev1};
|
|
my $rev2 = $c->request->params->{rev2};
|
|
|
|
die("invalid revisions: [$rev1] [$rev2]") if $rev1 !~ m/^[a-zA-Z0-9_.]+$/ || $rev2 !~ m/^[a-zA-Z0-9_.]+$/;
|
|
|
|
# FIXME: injection danger.
|
|
|
|
my $diff = "";
|
|
if ($type eq "hg") {
|
|
my $clonePath = getSCMCacheDir . "/hg/" . sha256_hex($uri);
|
|
die "repository '$uri' is not in the SCM cache\n" if ! -d $clonePath;
|
|
my $out;
|
|
run(["hg", "log", "-R", $clonePath, "-r", "reverse($rev1::$rev2) and not($rev1)"], \undef, \$out)
|
|
or die "hg log failed";
|
|
$diff .= $out;
|
|
run(["hg", "diff", "-R", $clonePath, "-r", "$rev1::$rev2"], \undef, \$out)
|
|
or die "hg diff failed";
|
|
$diff .= $out;
|
|
} elsif ($type eq "git") {
|
|
my $clonePath = getSCMCacheDir . "/git/" . sha256_hex($uri);
|
|
die if ! -d $clonePath;
|
|
my ($stdout1, $stderr1);
|
|
run3(['git', '-C', $clonePath, 'log', "$rev1..$rev2"], \undef, \$stdout1, \$stderr1);
|
|
$diff .= $stdout1 if $? == 0;
|
|
|
|
my ($stdout2, $stderr2);
|
|
run3(['git', '-C', $clonePath, 'diff', "$rev1..$rev2"], \undef, \$stdout2, \$stderr2);
|
|
$diff .= $stdout2 if $? == 0;
|
|
}
|
|
|
|
$c->stash->{'plain'} = { data => (scalar $diff) || " " };
|
|
$c->forward('Hydra::View::Plain');
|
|
}
|
|
|
|
|
|
sub triggerJobset {
|
|
my ($self, $c, $jobset, $force) = @_;
|
|
print STDERR "triggering jobset ", $jobset->get_column('project') . ":" . $jobset->name, "\n";
|
|
$c->model('DB')->schema->txn_do(sub {
|
|
$jobset->update({ triggertime => time });
|
|
$jobset->update({ forceeval => 1 }) if $force;
|
|
});
|
|
push @{$c->{stash}->{json}->{jobsetsTriggered}}, $jobset->get_column('project') . ":" . $jobset->name;
|
|
}
|
|
|
|
|
|
sub push : Chained('api') PathPart('push') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
requirePost($c);
|
|
|
|
$c->{stash}->{json}->{jobsetsTriggered} = [];
|
|
|
|
my $force = exists $c->request->query_params->{force};
|
|
my @jobsets = split /,/, ($c->request->query_params->{jobsets} // "");
|
|
foreach my $s (@jobsets) {
|
|
my ($p, $j) = parseJobsetName($s);
|
|
my $jobset = $c->model('DB::Jobsets')->find($p, $j);
|
|
requireEvalJobsetPrivileges($c, $jobset->project);
|
|
next unless defined $jobset && ($force || ($jobset->project->enabled && $jobset->enabled));
|
|
triggerJobset($self, $c, $jobset, $force);
|
|
}
|
|
|
|
my @repos = split /,/, ($c->request->query_params->{repos} // "");
|
|
foreach my $r (@repos) {
|
|
my @jobsets = $c->model('DB::Jobsets')->search(
|
|
{ 'project.enabled' => 1, 'me.enabled' => 1 },
|
|
{
|
|
join => 'project',
|
|
where => \ [ 'exists (select 1 from JobsetInputAlts where project = me.project and jobset = me.name and value = ?)', [ 'value', $r ] ],
|
|
order_by => 'me.id DESC'
|
|
});
|
|
foreach my $jobset (@jobsets) {
|
|
requireEvalJobsetPrivileges($c, $jobset->project);
|
|
triggerJobset($self, $c, $jobset, $force)
|
|
}
|
|
}
|
|
|
|
$self->status_ok(
|
|
$c,
|
|
entity => { jobsetsTriggered => $c->stash->{json}->{jobsetsTriggered} }
|
|
);
|
|
}
|
|
|
|
sub verifyWebhookSignature {
|
|
my ($c, $platform, $header_name, $signature_prefix) = @_;
|
|
|
|
# Get secrets from config
|
|
my $webhook_config = $c->config->{webhooks} // {};
|
|
my $platform_config = $webhook_config->{$platform} // {};
|
|
my $secrets = $platform_config->{secret};
|
|
|
|
# Normalize to array
|
|
$secrets = [] unless defined $secrets;
|
|
$secrets = [$secrets] unless ref($secrets) eq 'ARRAY';
|
|
|
|
# Trim whitespace from secrets
|
|
my @secrets = grep { defined && length } map { s/^\s+|\s+$//gr } @$secrets;
|
|
|
|
if (@secrets) {
|
|
my $signature = $c->request->header($header_name);
|
|
|
|
if (!$signature) {
|
|
$c->log->warn("Webhook authentication failed for $platform: Missing signature from IP " . $c->request->address);
|
|
$c->response->status(401);
|
|
$c->stash->{json} = { error => "Missing webhook signature" };
|
|
$c->forward('View::JSON');
|
|
return 0;
|
|
}
|
|
|
|
# Get the raw body content from the buffered PSGI input
|
|
# For JSON requests, Catalyst will have already read and buffered the body
|
|
my $input = $c->request->env->{'psgi.input'};
|
|
$input->seek(0, 0);
|
|
local $/;
|
|
my $payload = <$input>;
|
|
$input->seek(0, 0); # Reset for any other consumers
|
|
|
|
unless (defined $payload && length $payload) {
|
|
$c->log->warn("Webhook authentication failed for $platform: Empty request body from IP " . $c->request->address);
|
|
$c->response->status(400);
|
|
$c->stash->{json} = { error => "Empty request body" };
|
|
$c->forward('View::JSON');
|
|
return 0;
|
|
}
|
|
|
|
my $valid = 0;
|
|
for my $secret (@secrets) {
|
|
my $expected = $signature_prefix . hmac_sha256_hex($payload, $secret);
|
|
if (equals($signature, $expected)) {
|
|
$valid = 1;
|
|
last;
|
|
}
|
|
}
|
|
|
|
if (!$valid) {
|
|
$c->log->warn("Webhook authentication failed for $platform: Invalid signature from IP " . $c->request->address);
|
|
$c->response->status(401);
|
|
$c->stash->{json} = { error => "Invalid webhook signature" };
|
|
$c->forward('View::JSON');
|
|
return 0;
|
|
}
|
|
|
|
return 1;
|
|
} else {
|
|
$c->log->warn("Webhook authentication failed for $platform: Unable to validate signature from IP " . $c->request->address . " because no secrets are configured");
|
|
$c->response->status(401);
|
|
$c->stash->{json} = { error => "Invalid webhook signature" };
|
|
$c->forward('View::JSON');
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
sub push_github : Chained('api') PathPart('push-github') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
$c->{stash}->{json}->{jobsetsTriggered} = [];
|
|
|
|
return unless verifyWebhookSignature($c, 'github', 'X-Hub-Signature-256', 'sha256=');
|
|
|
|
my $in = $c->request->{data};
|
|
my $owner = ($in->{repository}->{owner}->{name} // $in->{repository}->{owner}->{login}) or die;
|
|
my $repo = $in->{repository}->{name} or die;
|
|
print STDERR "got push from GitHub repository $owner/$repo\n";
|
|
|
|
triggerJobset($self, $c, $_, 0) foreach $c->model('DB::Jobsets')->search(
|
|
{ 'project.enabled' => 1, 'me.enabled' => 1 },
|
|
{ join => 'project'
|
|
, where => \ [ 'me.flake like ? or exists (select 1 from JobsetInputAlts where project = me.project and jobset = me.name and value like ?)', [ 'flake', "%github%$owner/$repo%"], [ 'value', "%github.com%$owner/$repo%" ] ]
|
|
});
|
|
$c->response->body("");
|
|
}
|
|
|
|
sub push_gitea : Chained('api') PathPart('push-gitea') Args(0) {
|
|
my ($self, $c) = @_;
|
|
|
|
$c->{stash}->{json}->{jobsetsTriggered} = [];
|
|
|
|
# Note: Gitea doesn't use sha256= prefix
|
|
return unless verifyWebhookSignature($c, 'gitea', 'X-Gitea-Signature', '');
|
|
|
|
my $in = $c->request->{data};
|
|
my $url = $in->{repository}->{clone_url} or die;
|
|
$url =~ s/.git$//;
|
|
print STDERR "got push from Gitea repository $url\n";
|
|
|
|
triggerJobset($self, $c, $_, 0) foreach $c->model('DB::Jobsets')->search(
|
|
{ 'project.enabled' => 1, 'me.enabled' => 1 },
|
|
{ join => 'project'
|
|
, where => \ [ 'me.flake like ? or exists (select 1 from JobsetInputAlts where project = me.project and jobset = me.name and value like ?)', [ 'flake', "%$url%"], [ 'value', "%$url%" ] ]
|
|
});
|
|
$c->response->body("");
|
|
}
|
|
|
|
|
|
1;
|