WIP

Author: Turbo87

Cargo.lock

@@ -70,6 +70,7 @@ crates_io_env_vars = { path = "crates/crates_io_env_vars" }
 crates_io_github = { path = "crates/crates_io_github" }
 crates_io_index = { path = "crates/crates_io_index" }
 crates_io_markdown = { path = "crates/crates_io_markdown" }
+crates_io_oidc = { path = "crates/crates_io_oidc" }
 crates_io_pagerduty = { path = "crates/crates_io_pagerduty" }
 crates_io_session = { path = "crates/crates_io_session" }
 crates_io_tarball = { path = "crates/crates_io_tarball" }
@@ -139,13 +140,15 @@ utoipa-axum = "=0.2.0"
 bytes = "=1.10.1"
 crates_io_github = { path = "crates/crates_io_github", features = ["mock"] }
 crates_io_index = { path = "crates/crates_io_index", features = ["testing"] }
+crates_io_oidc = { path = "crates/crates_io_oidc", features = ["mock"] }
 crates_io_tarball = { path = "crates/crates_io_tarball", features = ["builder"] }
 crates_io_team_repo = { path = "crates/crates_io_team_repo", features = ["mock"] }
 crates_io_test_db = { path = "crates/crates_io_test_db" }
 claims = "=0.8.0"
 diesel = { version = "=2.2.9", features = ["r2d2"] }
 googletest = "=0.14.0"
 insta = { version = "=1.42.2", features = ["glob", "json", "redactions"] }
+jsonwebtoken = "=9.3.1"
 regex = "=1.11.1"
 sentry = { version = "=0.37.0", features = ["test"] }
 tokio = "=1.44.2"

Cargo.toml

@@ -0,0 +1,37 @@
+use crate::schema::github_oidc_configs;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Identifiable, Queryable, Selectable)]
+#[diesel(table_name = github_oidc_configs, check_for_backend(diesel::pg::Pg))]
+pub struct GitHubOidcConfig {
+    pub id: i32,
+    pub crate_id: i32,
+    pub repository_owner: String,
+    pub repository_owner_id: i32,
+    pub repository_name: String,
+    pub workflow_filename: String,
+    pub environment: Option<String>,
+    pub created_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = github_oidc_configs, check_for_backend(diesel::pg::Pg))]
+pub struct NewGitHubOidcConfig<'a> {
+    pub crate_id: i32,
+    pub repository_owner: &'a str,
+    pub repository_owner_id: i32,
+    pub repository_name: &'a str,
+    pub workflow_filename: &'a str,
+    pub environment: Option<&'a str>,
+}
+
+impl NewGitHubOidcConfig<'_> {
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<GitHubOidcConfig> {
+        self.insert_into(github_oidc_configs::table)
+            .returning(GitHubOidcConfig::as_returning())
+            .get_result(conn)
+            .await
+    }
+}

crates/crates_io_database/src/models/github_oidc_config.rs

@@ -14,6 +14,7 @@ pub use self::krate::{Crate, CrateName, NewCrate, RecentCrateDownloads};
 pub use self::owner::{CrateOwner, Owner, OwnerKind};
 pub use self::team::{NewTeam, Team};
 pub use self::token::ApiToken;
+pub use self::used_oidc_jti::NewUsedOidcJti;
 pub use self::user::{NewUser, User};
 pub use self::version::{NewVersion, TopVersions, Version};
 
@@ -28,10 +29,13 @@ pub mod dependency;
 pub mod download;
 mod email;
 mod follow;
+pub mod github_oidc_config;
 mod keyword;
 pub mod krate;
+pub mod oidc_token;
 mod owner;
 pub mod team;
 pub mod token;
+pub mod used_oidc_jti;
 pub mod user;
 pub mod version;

crates/crates_io_database/src/models/mod.rs

@@ -0,0 +1,24 @@
+use crate::schema::oidc_tokens;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = oidc_tokens, check_for_backend(diesel::pg::Pg))]
+pub struct NewOidcToken<'a> {
+    pub crate_id: i32,
+    pub hashed_token: &'a [u8],
+    pub expires_at: DateTime<Utc>,
+}
+
+impl NewOidcToken<'_> {
+    pub async fn insert_all(
+        new_tokens: &[Self],
+        conn: &mut AsyncPgConnection,
+    ) -> QueryResult<usize> {
+        diesel::insert_into(oidc_tokens::table)
+            .values(new_tokens)
+            .execute(conn)
+            .await
+    }
+}

crates/crates_io_database/src/models/oidc_token.rs

@@ -0,0 +1,24 @@
+use crate::schema::used_oidc_jti;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = used_oidc_jti, check_for_backend(diesel::pg::Pg))]
+pub struct NewUsedOidcJti<'a> {
+    pub jti: &'a str,
+    pub expires_at: DateTime<Utc>,
+}
+
+impl<'a> NewUsedOidcJti<'a> {
+    pub fn new(jti: &'a str, expires_at: DateTime<Utc>) -> Self {
+        Self { jti, expires_at }
+    }
+
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<usize> {
+        diesel::insert_into(used_oidc_jti::table)
+            .values(self)
+            .execute(conn)
+            .await
+    }
+}

crates/crates_io_database/src/models/used_oidc_jti.rs

@@ -91,7 +91,7 @@ pub struct NewVersion<'a> {
     license: Option<&'a str>,
     #[builder(default, name = "size")]
     crate_size: i32,
-    published_by: i32,
+    published_by: Option<i32>,
     checksum: &'a str,
     links: Option<&'a str>,
     rust_version: Option<&'a str>,
@@ -110,7 +110,7 @@ impl NewVersion<'_> {
     pub async fn save(
         &self,
         conn: &mut AsyncPgConnection,
-        published_by_email: &str,
+        published_by_email: Option<&str>,
     ) -> QueryResult<Version> {
         use diesel::insert_into;
 
@@ -122,13 +122,15 @@ impl NewVersion<'_> {
                     .get_result(conn)
                     .await?;
 
-                insert_into(versions_published_by::table)
-                    .values((
-                        versions_published_by::version_id.eq(version.id),
-                        versions_published_by::email.eq(published_by_email),
-                    ))
-                    .execute(conn)
-                    .await?;
+                if let Some(published_by_email) = published_by_email {
+                    insert_into(versions_published_by::table)
+                        .values((
+                            versions_published_by::version_id.eq(version.id),
+                            versions_published_by::email.eq(published_by_email),
+                        ))
+                        .execute(conn)
+                        .await?;
+                }
 
                 Ok(version)
             }