Implement user authorization

buildit-utils/Cargo.toml

@@ -9,13 +9,13 @@ edition = "2024"
 octocrab = "0.44"
 jsonwebtoken = "9"
 anyhow = "1"
-tokio = { version = "1.44", features = ["macros", "rt-multi-thread", "process", "sync", "fs"] }
+tokio = { version = "1.46", features = ["macros", "rt-multi-thread", "process", "sync", "fs"] }
 gix = { version = "0.72", default-features = false, features = ["revision"] }
-walkdir = "2.4.0"
+walkdir = "2.5.0"
 abbs-meta-apml = { git = "https://github.com/AOSC-Dev/abbs-meta-rs", package = "abbs-meta-apml", rev = "4a592937b44e8bb93103edd34eff384169a3248a" }
 fancy-regex = "0.14"
 thiserror ="2"
-tracing = "0.1.40"
-once_cell = "1.19.0"
+tracing = "0.1.41"
+once_cell = "1.21.3"
 abbs-update-checksum-core = { git = "https://github.com/AOSC-Dev/abbs-update-checksum", package = "abbs-update-checksum-core", tag = "v0.4.1" }
 regex = "1.11.1"

common/Cargo.toml

@@ -6,4 +6,4 @@ edition = "2024"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-serde = { version = "1.0.196", features = ["derive"] }
+serde = { version = "1.0.219", features = ["derive"] }

server/Cargo.toml

@@ -6,36 +6,36 @@ edition = "2024"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-anyhow = "1.0.80"
-chrono = "0.4.34"
-clap = { version = "4.5.1", features = ["derive", "env"] }
+anyhow = "1.0.98"
+chrono = "0.4.41"
+clap = { version = "4.5.40", features = ["derive", "env"] }
 common = { path = "../common" }
-dotenvy = "0.15.0"
+dotenvy = "0.15.7"
 octocrab = "0.44"
-once_cell = "1.19.0"
+once_cell = "1.21.3"
 reqwest = "0.12"
-serde = { version = "1.0.196", features = ["derive"] }
-serde_json = "1.0.113"
-teloxide = { version = "0.15", features = ["macros"] }
+serde = { version = "1.0.219", features = ["derive"] }
+serde_json = "1.0.140"
+teloxide = { version = "0.16", features = ["macros"] }
 timeago = { version = "0.4.2", features = ["chrono"] }
-tokio = { version = "1.44.2", features = ["macros", "rt-multi-thread", "process", "sync", "time"] }
-console = "0.15.8"
+tokio = { version = "1.46.0", features = ["macros", "rt-multi-thread", "process", "sync", "time"] }
+console = "0.16.0"
 buildit-utils = { path = "../buildit-utils" }
-jsonwebtoken = "9.2.0"
+jsonwebtoken = "9.3.1"
 size = "0.5"
 dickens = { git = "https://github.com/AOSC-Dev/dickens.git", version = "0.1.0" }
 axum = { version = "0.8", features = ["ws"] }
-tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
-tracing = "0.1.40"
+tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
+tracing = "0.1.41"
 tower-http = { version = "0.6", features = ["trace", "fs", "cors"] }
-diesel = { version = "2.2.9", features = ["postgres", "chrono", "r2d2", "numeric"] }
-bigdecimal = { version = "0.4.3", features = ["serde"] }
-opentelemetry = "0.22.0"
-tracing-opentelemetry = "0.23.0"
-opentelemetry-otlp = { version = "0.15.0", features = ["http-proto", "reqwest-client"] }
-opentelemetry_sdk = { version = "0.22.1", features = ["rt-tokio"] }
+diesel = { version = "2.2.11", features = ["postgres", "chrono", "r2d2", "numeric"] }
+bigdecimal = { version = "0.4.8", features = ["serde"] }
+opentelemetry = "0.30.0"
+tracing-opentelemetry = "0.31.0"
+opentelemetry-otlp = { version = "0.30.0", features = ["http-proto", "reqwest-client"] }
+opentelemetry_sdk = { version = "0.30.0", features = ["rt-tokio"] }
 rand = "0.9"
-hyper-util = "0.1.5"
-hyper = "1.3.1"
+hyper-util = "0.1.14"
+hyper = "1.6.0"
 tower = "0.5"
-futures = "0.3.30"
+futures = "0.3.31"

server/migrations/2025-07-04-132107_add_user_token/down.sql

@@ -0,0 +1 @@
+ALTER TABLE users DROP COLUMN token;

server/migrations/2025-07-04-132107_add_user_token/up.sql

@@ -0,0 +1 @@
+ALTER TABLE users ADD token VARCHAR(64) NOT NULL DEFAULT '';

server/src/api.rs

@@ -28,7 +28,7 @@ pub enum JobSource {
     /// GitHub PR comment
     GitHub { pr: u64, user: i64 },
     /// Manual
-    Manual,
+    Manual(Option<i32>),
 }
 
 // create github check run for the specified git commit
@@ -166,7 +166,7 @@ pub async fn pipeline_new(
             let creator_user_id = user.map(|user| user.id);
             ("github", Some(pr), telegram_user, creator_user_id)
         }
-        JobSource::Manual => ("manual", github_pr, None, None),
+        JobSource::Manual(user_id) => ("manual", github_pr, None, user_id),
     };
     let new_pipeline = NewPipeline {
         packages: packages.to_string(),

server/src/bot.rs

@@ -6,11 +6,11 @@ use crate::{
     models::{NewUser, User},
     paste_to_aosc_io,
 };
-use anyhow::{Context, bail};
+use anyhow::{Context, anyhow, bail};
 use buildit_utils::{find_update_and_update_checksum, github::OpenPRRequest};
 use chrono::Local;
 use diesel::{Connection, ExpressionMethods, OptionalExtension, QueryDsl, RunQueryDsl};
-use rand::{rng, seq::IndexedRandom};
+use rand::{distr::SampleString, rng, seq::IndexedRandom};
 use reqwest::ClientBuilder;
 use serde::{Deserialize, Serialize};
 use std::{
@@ -30,7 +30,7 @@ use teloxide::{
     utils::command::BotCommands,
 };
 use tokio::time::sleep;
-use tracing::{Instrument, warn};
+use tracing::{Instrument, info, warn};
 
 #[derive(BotCommands, Clone, Debug)]
 #[command(
@@ -70,6 +70,10 @@ pub enum Command {
     Bump(String),
     #[command(description = "Roll anicca 10 packages")]
     Roll,
+    #[command(description = "Show your API token")]
+    Token,
+    #[command(rename = "resettoken", description = "Reset your API token")]
+    ResetToken,
 }
 
 async fn wait_with_send_typing<T, F: Future<Output = T>, B: Borrow<Bot>>(
@@ -309,6 +313,42 @@ async fn get_user(pool: DbPool, chat_id: ChatId, access_token: String) -> anyhow
     bail!("Failed to get user info")
 }
 
+#[tracing::instrument(skip(pool))]
+async fn get_api_token(pool: DbPool, chat_id: ChatId, force_reset: bool) -> anyhow::Result<String> {
+    let mut conn = pool
+        .get()
+        .context("Failed to get db connection from pool")?;
+
+    use crate::schema::users::dsl::*;
+    if let Some(mut user) = users
+        .filter(telegram_chat_id.eq(&chat_id.0))
+        .first::<User>(&mut conn)
+        .optional()?
+    {
+        let api_token = if force_reset {
+            None
+        } else {
+            user.get_api_token()
+        };
+        match api_token {
+            Some(api_token) => Ok(api_token),
+            None => {
+                info!("Resetting API token for {}", user.id);
+                let new_token = rand::distr::Alphanumeric.sample_string(&mut rand::rng(), 64);
+                diesel::update(users.find(user.id))
+                    .set((token.eq(&new_token),))
+                    .execute(&mut conn)?;
+                user.token = new_token;
+                Ok(user
+                    .get_api_token()
+                    .ok_or_else(|| anyhow!("user token unavailable after reset"))?)
+            }
+        }
+    } else {
+        bail!("Failed to get user info")
+    }
+}
+
 async fn create_pipeline_from_pr(
     pool: DbPool,
     pr_number: u64,
@@ -972,6 +1012,47 @@ pub async fn answer(bot: Bot, msg: Message, cmd: Command, pool: DbPool) -> Respo
                 .await?;
             }
         },
+        Command::Token => match wait_with_send_typing(
+            get_api_token(pool, msg.chat.id, false),
+            &bot,
+            msg.chat.id.0,
+        )
+        .await
+        {
+            Ok(token) => {
+                bot.send_message(
+                    msg.chat.id,
+                    format!("Your current API token is: `{}`", token),
+                )
+                .parse_mode(ParseMode::MarkdownV2)
+                .await?;
+            }
+            Err(e) => {
+                bot.send_message(
+                    msg.chat.id,
+                    truncate(&format!("Failed to get API token: {}", e)),
+                )
+                .await?;
+            }
+        },
+        Command::ResetToken => {
+            match wait_with_send_typing(get_api_token(pool, msg.chat.id, true), &bot, msg.chat.id.0)
+                .await
+            {
+                Ok(token) => {
+                    bot.send_message(msg.chat.id, format!("Your new API token is: `{}`", token))
+                        .parse_mode(ParseMode::MarkdownV2)
+                        .await?;
+                }
+                Err(e) => {
+                    bot.send_message(
+                        msg.chat.id,
+                        truncate(&format!("Failed to reset API token: {}", e)),
+                    )
+                    .await?;
+                }
+            }
+        }
     };
 
     Ok(())

server/src/main.rs

@@ -5,19 +5,11 @@ use axum::{Router, routing::get};
 use diesel::pg::PgConnection;
 use diesel::r2d2::ConnectionManager;
 use diesel::r2d2::Pool;
-use opentelemetry::KeyValue;
+use opentelemetry::trace::TracerProvider;
 use opentelemetry_otlp::WithExportConfig;
-use opentelemetry_sdk::Resource;
-use opentelemetry_sdk::trace;
 use server::bot::{Command, answer, answer_callback};
 use server::recycler::recycler_worker;
-use server::routes::{
-    AppState, WSStateMap, dashboard_status, job_info, job_list, job_restart, ping, pipeline_info,
-    pipeline_list, pipeline_new_pr, webhook_handler, worker_info, worker_job_update, worker_list,
-    worker_poll, ws_viewer_handler, ws_worker_handler,
-};
-use server::routes::{pipeline_new, worker_heartbeat};
-use server::routes::{pipeline_status, worker_status};
+use server::routes::*;
 use server::{ARGS, DbPool, RemoteAddr};
 use std::collections::HashMap;
 use std::os::unix::fs::PermissionsExt;
@@ -36,20 +28,17 @@ async fn main() -> anyhow::Result<()> {
     // setup opentelemetry
     if let Some(otlp_url) = &ARGS.otlp_url {
         // setup otlp
-        let exporter = opentelemetry_otlp::new_exporter()
-            .http()
-            .with_endpoint(otlp_url);
-        let otlp_tracer =
-            opentelemetry_otlp::new_pipeline()
-                .tracing()
-                .with_trace_config(trace::config().with_resource(Resource::new(vec![
-                    KeyValue::new("service.name", "buildit"),
-                ])))
-                .with_exporter(exporter)
-                .install_batch(opentelemetry_sdk::runtime::Tokio)?;
+        let exporter = opentelemetry_otlp::SpanExporter::builder()
+            .with_http()
+            .with_endpoint(otlp_url)
+            .build()?;
+        let otlp_tracer = opentelemetry_sdk::trace::SdkTracerProvider::builder()
+            .with_simple_exporter(exporter)
+            .build();
 
         // let tracing crate output to opentelemetry
-        let tracing_layer = tracing_opentelemetry::layer().with_tracer(otlp_tracer);
+        let tracing_layer =
+            tracing_opentelemetry::layer().with_tracer(otlp_tracer.tracer("buildit"));
         let subscriber = Registry::default();
         // respect RUST_LOG
         let env_filter = EnvFilter::try_from_default_env().unwrap_or(EnvFilter::new("INFO"));
@@ -126,6 +115,7 @@ async fn main() -> anyhow::Result<()> {
         .route("/api/ws/viewer/{hostname}", get(ws_viewer_handler))
         .route("/api/ws/worker/{hostname}", get(ws_worker_handler))
         .route("/api/webhook", post(webhook_handler))
+        .route("/api/user/self", get(user_self))
         .nest_service("/assets", ServeDir::new("frontend/dist/assets"))
         .route_service("/favicon.ico", ServeFile::new("frontend/dist/favicon.ico"))
         .fallback_service(ServeFile::new("frontend/dist/index.html"))

server/src/models.rs

@@ -121,6 +121,17 @@ pub struct User {
     pub github_avatar_url: Option<String>,
     pub github_email: Option<String>,
     pub telegram_chat_id: Option<i64>,
+    pub token: String,
+}
+
+impl User {
+    pub fn get_api_token(&self) -> Option<String> {
+        if self.token.is_empty() {
+            None
+        } else {
+            Some(format!("aoscbldit1_{}_{}", self.id, self.token))
+        }
+    }
 }
 
 #[derive(Insertable, AsChangeset)]