urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
126 lines
4.5 KiB
Go
126 lines
4.5 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
|
|
"urapt/shared/models"
|
|
)
|
|
|
|
// CreateRepository inserts a new repository owned by userID.
|
|
func (s *Store) CreateRepository(ctx context.Context, name, ownerUserID string, visibility models.Visibility, description string) (*models.Repository, error) {
|
|
id := newID()
|
|
now := s.now()
|
|
_, err := s.exec(ctx, `INSERT INTO repositories (id, name, owner_user_id, visibility, description, created_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)`, id, name, ownerUserID, string(visibility), description, now, now)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("insert repository: %w", err)
|
|
}
|
|
return &models.Repository{
|
|
ID: id, Name: name, OwnerUserID: ownerUserID, Visibility: visibility,
|
|
Description: description, CreatedAt: now, UpdatedAt: now,
|
|
}, nil
|
|
}
|
|
|
|
// ListReposVisible returns repositories visible to userID: owned, public, or
|
|
// where the user is a member.
|
|
func (s *Store) ListReposVisible(ctx context.Context, userID string) ([]*models.Repository, error) {
|
|
rows, err := s.db.QueryContext(ctx, `
|
|
SELECT DISTINCT r.id, r.name, r.owner_user_id, r.visibility, r.description, r.created_at, r.updated_at
|
|
FROM repositories r
|
|
WHERE r.owner_user_id = ?
|
|
OR r.visibility = 'public'
|
|
OR EXISTS (SELECT 1 FROM repository_members m WHERE m.repository_id = r.id AND m.user_id = ?)
|
|
ORDER BY r.name`, userID, userID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("list repos: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
var out []*models.Repository
|
|
for rows.Next() {
|
|
r := &models.Repository{}
|
|
if err := rows.Scan(&r.ID, &r.Name, &r.OwnerUserID, &r.Visibility, &r.Description, &r.CreatedAt, &r.UpdatedAt); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, r)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// UpdateRepository mutates a repository's name, visibility, and description.
|
|
// Empty strings leave the field unchanged.
|
|
func (s *Store) UpdateRepository(ctx context.Context, id, name string, visibility *models.Visibility, description *string) error {
|
|
now := s.now()
|
|
if name != "" {
|
|
if _, err := s.exec(ctx, `UPDATE repositories SET name = ?, updated_at = ? WHERE id = ?`, name, now, id); err != nil {
|
|
return fmt.Errorf("update repo name: %w", err)
|
|
}
|
|
}
|
|
if visibility != nil {
|
|
if _, err := s.exec(ctx, `UPDATE repositories SET visibility = ?, updated_at = ? WHERE id = ?`, string(*visibility), now, id); err != nil {
|
|
return fmt.Errorf("update repo visibility: %w", err)
|
|
}
|
|
}
|
|
if description != nil {
|
|
if _, err := s.exec(ctx, `UPDATE repositories SET description = ?, updated_at = ? WHERE id = ?`, *description, now, id); err != nil {
|
|
return fmt.Errorf("update repo description: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// DeleteRepository deletes a repository and all its child rows (cascade).
|
|
// The caller must have already handled blob ref-count cleanup.
|
|
func (s *Store) DeleteRepository(ctx context.Context, id string) error {
|
|
if _, err := s.exec(ctx, `DELETE FROM repositories WHERE id = ?`, id); err != nil {
|
|
return fmt.Errorf("delete repository: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GetRepositoryByName returns a repository by its unique name.
|
|
func (s *Store) GetRepositoryByName(ctx context.Context, name string) (*models.Repository, error) {
|
|
row := s.db.QueryRowContext(ctx,
|
|
`SELECT id, name, owner_user_id, visibility, description, created_at, updated_at
|
|
FROM repositories WHERE name = ?`, name)
|
|
return scanRepo(row)
|
|
}
|
|
|
|
// GetRepositoryByID returns a repository by id.
|
|
func (s *Store) GetRepositoryByID(ctx context.Context, id string) (*models.Repository, error) {
|
|
row := s.db.QueryRowContext(ctx,
|
|
`SELECT id, name, owner_user_id, visibility, description, created_at, updated_at
|
|
FROM repositories WHERE id = ?`, id)
|
|
return scanRepo(row)
|
|
}
|
|
|
|
func scanRepo(row *sql.Row) (*models.Repository, error) {
|
|
r := &models.Repository{}
|
|
err := row.Scan(&r.ID, &r.Name, &r.OwnerUserID, &r.Visibility, &r.Description, &r.CreatedAt, &r.UpdatedAt)
|
|
if isErrNoRows(err) {
|
|
return nil, ErrNotFound
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return r, nil
|
|
}
|
|
|
|
// GetMemberAccess returns the access level granted to userID on repoID, or
|
|
// ("", false) if the user is not an explicit member.
|
|
func (s *Store) GetMemberAccess(ctx context.Context, repoID, userID string) (models.Access, bool, error) {
|
|
row := s.db.QueryRowContext(ctx,
|
|
`SELECT access FROM repository_members WHERE repository_id = ? AND user_id = ?`,
|
|
repoID, userID)
|
|
var access string
|
|
err := row.Scan(&access)
|
|
if isErrNoRows(err) {
|
|
return "", false, nil
|
|
}
|
|
if err != nil {
|
|
return "", false, fmt.Errorf("get member access: %w", err)
|
|
}
|
|
return models.Access(access), true, nil
|
|
}
|