alexei.dolgolyov
be6ad15efc
Security: apply AdminOnly middleware to mutating routes, require ENCRYPTION_KEY and ADMIN_PASSWORD (no insecure defaults), restrict CORS to same-origin, fix OIDC token delivery via cookie instead of URL query param, add rate limiting on login, add MaxBytesReader, validate volume paths against traversal, add security headers, validate user roles, add Secure flag to OIDC cookie. Performance: set SQLite MaxOpenConns(1) to prevent SQLITE_BUSY, add FK indexes on 8 columns, track notifier goroutines with WaitGroup for graceful shutdown, use GetRegistryByName instead of GetAllRegistries in deployer, pass basePath param to avoid redundant settings query, return empty slices from store to remove reflection. Quality: refactor TriggerDeploy to delegate to runDeploy (~100 lines removed), consolidate duplicated utilities (extractPort, boolToInt, now, isTerminalStatus) into shared exports, migrate all log.Printf to slog structured logging, use consistent webhook response envelope, remove dead code (parseEnvVars, duplicate auth types). UX: clean up NPM proxy on instance removal via API, add README with quickstart guide, add .env.example, require ADMIN_PASSWORD in docker-compose, document staging-net prerequisite.
113 lines
2.9 KiB
Go
113 lines
2.9 KiB
Go
package store
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
// CreateVolume inserts a new volume configuration for a project.
|
|
func (s *Store) CreateVolume(vol Volume) (Volume, error) {
|
|
vol.ID = uuid.New().String()
|
|
vol.CreatedAt = Now()
|
|
vol.UpdatedAt = vol.CreatedAt
|
|
|
|
if vol.Mode == "" {
|
|
vol.Mode = "shared"
|
|
}
|
|
|
|
_, err := s.db.Exec(
|
|
`INSERT INTO volumes (id, project_id, source, target, mode, created_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)`,
|
|
vol.ID, vol.ProjectID, vol.Source, vol.Target, vol.Mode,
|
|
vol.CreatedAt, vol.UpdatedAt,
|
|
)
|
|
if err != nil {
|
|
return Volume{}, fmt.Errorf("insert volume: %w", err)
|
|
}
|
|
return vol, nil
|
|
}
|
|
|
|
// GetVolumesByProjectID returns all volume configurations for a project.
|
|
func (s *Store) GetVolumesByProjectID(projectID string) ([]Volume, error) {
|
|
rows, err := s.db.Query(
|
|
`SELECT id, project_id, source, target, mode, created_at, updated_at
|
|
FROM volumes WHERE project_id = ? ORDER BY target`, projectID,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("query volumes: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
vols := []Volume{}
|
|
for rows.Next() {
|
|
vol, err := scanVolume(rows)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
vols = append(vols, vol)
|
|
}
|
|
return vols, rows.Err()
|
|
}
|
|
|
|
// GetVolumeByID returns a single volume by its ID.
|
|
func (s *Store) GetVolumeByID(id string) (Volume, error) {
|
|
var vol Volume
|
|
err := s.db.QueryRow(
|
|
`SELECT id, project_id, source, target, mode, created_at, updated_at
|
|
FROM volumes WHERE id = ?`, id,
|
|
).Scan(&vol.ID, &vol.ProjectID, &vol.Source, &vol.Target, &vol.Mode,
|
|
&vol.CreatedAt, &vol.UpdatedAt)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return Volume{}, fmt.Errorf("volume %s: %w", id, ErrNotFound)
|
|
}
|
|
if err != nil {
|
|
return Volume{}, fmt.Errorf("query volume: %w", err)
|
|
}
|
|
return vol, nil
|
|
}
|
|
|
|
// UpdateVolume updates an existing volume configuration.
|
|
func (s *Store) UpdateVolume(vol Volume) error {
|
|
vol.UpdatedAt = Now()
|
|
result, err := s.db.Exec(
|
|
`UPDATE volumes SET source=?, target=?, mode=?, updated_at=?
|
|
WHERE id=?`,
|
|
vol.Source, vol.Target, vol.Mode, vol.UpdatedAt, vol.ID,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("update volume: %w", err)
|
|
}
|
|
n, _ := result.RowsAffected()
|
|
if n == 0 {
|
|
return fmt.Errorf("volume %s: %w", vol.ID, ErrNotFound)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeleteVolume removes a volume configuration by ID.
|
|
func (s *Store) DeleteVolume(id string) error {
|
|
result, err := s.db.Exec(`DELETE FROM volumes WHERE id = ?`, id)
|
|
if err != nil {
|
|
return fmt.Errorf("delete volume: %w", err)
|
|
}
|
|
n, _ := result.RowsAffected()
|
|
if n == 0 {
|
|
return fmt.Errorf("volume %s: %w", id, ErrNotFound)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// scanVolume scans a volume row from a *sql.Rows cursor.
|
|
func scanVolume(rows *sql.Rows) (Volume, error) {
|
|
var vol Volume
|
|
err := rows.Scan(&vol.ID, &vol.ProjectID, &vol.Source, &vol.Target, &vol.Mode,
|
|
&vol.CreatedAt, &vol.UpdatedAt)
|
|
if err != nil {
|
|
return Volume{}, fmt.Errorf("scan volume: %w", err)
|
|
}
|
|
return vol, nil
|
|
}
|