Ref writers, server side: the pre-receive hook, run tokens, admission

rust/crates/conversation-protocol/Cargo.toml

@@ -9,6 +9,9 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha1 = "0.10"
 sha2 = "0.10"
+# Optional: only what signs or verifies a ref write needs it
+# (design/ref-writers.md); a std tool that pushes with a run token does not.
+ed25519-dalek = { version = "3", optional = true }
 
 [features]
 # On by default so the dependency artifact cargo builds for caos-cli (which asks
@@ -17,6 +20,7 @@ sha2 = "0.10"
 default = ["git-cli"]
 git-cli = []
 memory-store = []
+ed25519 = ["dep:ed25519-dalek"]
 
 [dependencies.git-locator]
 path = "../git-locator"

rust/crates/conversation-protocol/src/v3/git_store.rs

@@ -36,10 +36,15 @@ pub struct GitStore {
     remote_tip: RefCell<Option<Oid>>,
     batch: RefCell<Option<BatchReader>>,
     batch_dirty: Cell<bool>,
+    push_auth: Option<PushAuth>,
     #[cfg(test)]
     command_count: Cell<usize>,
 }
 
+/// Proves a push to a governed ref (design/ref-writers.md): the `caos-auth`
+/// push option for the commands being pushed.
+pub type PushAuth = Box<dyn Fn(&[super::writers::Command]) -> String>;
+
 static NEXT_OBJECT_TEMP: AtomicU64 = AtomicU64::new(1);
 
 fn quote_config_value(value: &str) -> Result<String, String> {
@@ -144,7 +149,20 @@ impl GitStore {
         );
         fs::write(dir.join("config"), config)
             .map_err(|error| format!("writing scratch config: {error}"))?;
-        GitStore::open(&dir, Some("origin"))
+        let mut store = GitStore::open(&dir, Some("origin"))?;
+        // A scratch store is a worker's; a job the server granted writes
+        // pushes with the token it injected, and any other job has none.
+        if let Some(token) = super::writers::injected_token() {
+            let option = super::writers::Auth::Run { token }.option();
+            store.set_push_auth(Box::new(move |_: &[super::writers::Command]| {
+                option.clone()
+            }));
+        }
+        Ok(store)
+    }
+
+    pub fn set_push_auth(&mut self, auth: PushAuth) {
+        self.push_auth = Some(auth);
     }
 
     pub fn open(dir: &Path, remote: Option<&str>) -> Result<GitStore, String> {
@@ -157,6 +175,7 @@ impl GitStore {
             remote_tip: RefCell::new(None),
             batch: RefCell::new(None),
             batch_dirty: Cell::new(false),
+            push_auth: None,
             #[cfg(test)]
             command_count: Cell::new(0),
         };
@@ -304,6 +323,19 @@ impl GitStore {
         if updates.len() > 1 {
             arguments.push("--atomic".to_string());
         }
+        if let Some(auth) = &self.push_auth {
+            let commands: Vec<super::writers::Command> = updates
+                .iter()
+                .map(|u| {
+                    super::writers::Command::new(
+                        &u.refname,
+                        u.expected.as_ref().map(Oid::as_str),
+                        u.new.as_ref().map(Oid::as_str),
+                    )
+                })
+                .collect();
+            arguments.push(format!("--push-option={}", auth(&commands)));
+        }
         for update in updates {
             let expected = update.expected.as_ref().map(Oid::as_str).unwrap_or("");
             arguments.push(format!("--force-with-lease={}:{expected}", update.refname));

rust/crates/conversation-protocol/src/v3/mod.rs

@@ -19,9 +19,10 @@ pub use tasks::{TaskRecord, TaskStatus};
 pub mod source_trees;
 pub mod validate;
 pub mod view;
+pub mod writers;
 
 #[cfg(feature = "git-cli")]
-pub use git_store::{GitStore, RefUpdate};
+pub use git_store::{GitStore, PushAuth, RefUpdate};
 pub use kinds::Kind;
 pub use oid::Oid;
 pub use reconcile::{reconcile, CodeOps};