feat(model-client): added IModelClientV2.loadVersion(RepositoryId ...)

Reading a version should always be done in the context of a repository
so that we can check the permissions.
If the version hash is leaked somewhere it still shouldn't be possible
to access the content. The permission check is not implemented yet, but
introducing the method now makes it easier to enfore the permission in
the future.

Author: slisson

model-client/src/commonMain/kotlin/org/modelix/model/client2/IModelClientV2.kt

@@ -43,8 +43,11 @@ interface IModelClientV2 {
 
     suspend fun listBranches(repository: RepositoryId): List<BranchReference>
 
+    @Deprecated("repository ID is required for permission checks")
     suspend fun loadVersion(versionHash: String, baseVersion: IVersion?): IVersion
 
+    suspend fun loadVersion(repositoryId: RepositoryId, versionHash: String, baseVersion: IVersion?): IVersion
+
     /**
      * The pushed version is merged automatically by the server with the current head.
      * The merge result is returned.

model-client/src/commonMain/kotlin/org/modelix/model/client2/ModelClientV2.kt

@@ -122,6 +122,7 @@ class ModelClientV2(
         }.bodyAsText().lines().map { repository.getBranchReference(it) }
     }
 
+    @Deprecated("repository ID is required for permission checks")
     override suspend fun loadVersion(versionHash: String, baseVersion: IVersion?): IVersion {
         val response = httpClient.post {
             url {
@@ -133,7 +134,25 @@ class ModelClientV2(
             }
         }
         val delta = Json.decodeFromString<VersionDelta>(response.bodyAsText())
-        return createVersion(null, delta)
+        return createVersion(baseVersion as CLVersion?, delta)
+    }
+
+    override suspend fun loadVersion(
+        repositoryId: RepositoryId,
+        versionHash: String,
+        baseVersion: IVersion?,
+    ): IVersion {
+        val response = httpClient.post {
+            url {
+                takeFrom(baseUrl)
+                appendPathSegments("repositories", repositoryId.id, "versions", versionHash)
+                if (baseVersion != null) {
+                    parameters["lastKnown"] = (baseVersion as CLVersion).getContentHash()
+                }
+            }
+        }
+        val delta = Json.decodeFromString<VersionDelta>(response.bodyAsText())
+        return createVersion(baseVersion as CLVersion?, delta)
     }
 
     override suspend fun push(branch: BranchReference, version: IVersion, baseVersion: IVersion?): IVersion {

model-server/src/main/kotlin/org/modelix/model/server/handlers/ModelReplicationServer.kt

@@ -215,6 +215,10 @@ class ModelReplicationServer(val repositoriesManager: RepositoriesManager) {
         }
         route("versions") {
             get("{versionHash}") {
+                // TODO versions should be stored inside a repository with permission checks.
+                //      Knowing a version hash should not give you access to the content.
+                //      This handler was already moved to the 'repositories' route. Removing it here would be a breaking
+                //      change, but should be done in some future version.
                 val baseVersionHash = call.request.queryParameters["lastKnown"]
                 val versionHash = call.parameters["versionHash"]!!
                 if (storeClient[versionHash] == null) {
@@ -230,47 +234,6 @@ class ModelReplicationServer(val repositoriesManager: RepositoriesManager) {
                 TODO()
             }
         }
-        route("objects") {
-            post {
-                val values = call.receive<List<String>>()
-                storeClient.putAll(values.associateBy { HashUtil.sha256(it) }, true)
-                call.respondText("OK")
-            }
-            get("{hash}") {
-                val key = call.parameters["hash"]!!
-                val value = storeClient[key]
-                if (value == null) {
-                    call.respondText("object '$key' not found", status = HttpStatusCode.NotFound)
-                } else {
-                    call.respondText(value)
-                }
-            }
-        }
-        route("modelql") {
-            put {
-                val params = call.receiveParameters()
-                val queryFromClient = params["query"]
-                if (queryFromClient == null) {
-                    call.respondText(text = "'query' is missing", status = HttpStatusCode.BadRequest)
-                    return@put
-                }
-                val query = ModelQuery.fromJson(queryFromClient)
-                val json = query.toJson()
-                val hash = HashUtil.sha256(json)
-                storeClient.put(hash, json)
-                call.respondText(text = hash)
-            }
-            get("{hash}") {
-                val hash = call.parameters["hash"]!!
-                val json = storeClient[hash]
-                if (json == null) {
-                    call.respondText(status = HttpStatusCode.NotFound, text = "ModelQL with hash '$hash' doesn't exist")
-                    return@get
-                }
-                ModelQuery.fromJson(json) // ensure it's a valid ModelQuery
-                call.respondText(json, ContentType.Application.Json)
-            }
-        }
     }
 
     private suspend fun ApplicationCall.respondDelta(versionHash: String, baseVersionHash: String?) {