-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-.git

-.github

-.task

-build

-cmd/mirum-agent/.zig-cache

-cmd/mirum-agent/zig-out

-cmd/mirum-agent/zig-pkg

-cmd/mirum-server/apipb

-cmd/mirum-server/static

-cmd/mirum-server/web/gen

-cmd/mirum-server/web/node_modules

-internal/protocol/wirepb

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-root = true

-

-[*]

-charset = utf-8

-end_of_line = lf

-insert_final_newline = true

-trim_trailing_whitespace = true

-indent_style = space

-indent_size = 2

-

-[*.go]

-indent_style = tab

-

-[{Makefile,*.mk}]

-indent_style = tab

-

-[*.md]

-trim_trailing_whitespace = false

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-# NOTE: Don't extend it; keep the logic in the Taskfile.

-# We're using GitHub Actions as a temporary solution

-# until Mirum can handle its own maintenance.

-

-name: Build

-

-on:

- push:

- branches: [main]

- tags: ["v*"]

- pull_request:

- branches: [main]

-

-jobs:

- build:

- name: Build and publish Nightly

- runs-on: ubuntu-latest

- concurrency:

- group: >-

- package-publish-mirum-${{ github.ref == 'refs/heads/main' && 'nightly'

- || startsWith(github.ref, 'refs/tags/v') && 'stable' || github.ref }}

- cancel-in-progress: false

- permissions:

- contents: write

- steps:

- - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

- with:

- fetch-depth: 0

-

- - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3

- with:

- version: 2026.7.5

- experimental: true

- install: false

-

- - name: Install dependencies

- run: mise bootstrap --locked --yes --update

-

- - name: Build and package

- run: task package GIT_REF=${{ github.ref }} GPG_KEY_ID=${{ vars.GPG_KEY_ID }}

- env:

- GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

- GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

- APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

- PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

-

- - name: Lint

- run: task lint

-

- - name: Tests

- run: task test

-

- - name: Upload container binaries

- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0

- with:

- name: container-binaries

- path: |

- build/mirum-server-linux-amd64

- build/mirum-server-linux-arm64

- build/mirum-worker-linux-amd64

- build/mirum-worker-linux-arm64

- if-no-files-found: error

-

- - name: Publish

- if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')

- run: |

- git config user.name "github-actions[bot]"

- git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

- . build/dist/build.env

- task publish:release CHANNEL=$CHANNEL VERSION=$VERSION

- mise run publish -- \

- --service mirum \

- --channel "$CHANNEL" \

- --input build/dist \

- deb rpm apk

- env:

- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

- GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

- GPG_KEY_ID: ${{ vars.GPG_KEY_ID }}

- APK_PRIVATE_KEY: ${{ secrets.APK_PRIVATE_KEY }}

- PACKAGE_KEY_VERSION: ${{ vars.PACKAGE_KEY_VERSION }}

- S3_BUCKET: ${{ vars.S3_BUCKET }}

- S3_ENDPOINT: ${{ vars.S3_ENDPOINT }}

- S3_PUBLIC_URL: ${{ vars.S3_PUBLIC_URL }}

- S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}

- S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

-

- oci:

- name: OCI artifacts

- needs: [build]

- runs-on: ubuntu-latest

- permissions:

- contents: read

- packages: write

- steps:

- - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

-

- - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3

- with:

- version: 2026.7.5

- experimental: true

- install: false

-

- - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0

- with:

- name: container-binaries

- path: .container

-

- - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

-

- - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

-

- - name: Determine artifact version

- id: artifact

- shell: bash

- run: |

- base_version=$(cat VERSION)

- if [[ "$GITHUB_REF" == refs/heads/main ]]; then

- version="$base_version-nightly.$(git log -1 --format=%ct)"

- elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then

- version="${GITHUB_REF_NAME#v}"

- if [[ "$version" != "$base_version" ]]; then

- echo "Tag version $version does not match VERSION $base_version" >&2

- exit 1

- fi

- else

- version="$base_version-pr.$GITHUB_RUN_NUMBER"

- fi

- echo "version=$version" >> "$GITHUB_OUTPUT"

-

- - name: Log in to GHCR

- if: github.event_name != 'pull_request'

- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4

- with:

- registry: ghcr.io

- username: ${{ github.actor }}

- password: ${{ secrets.GITHUB_TOKEN }}

-

- - name: Log Helm in to GHCR

- if: github.event_name != 'pull_request'

- env:

- GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- run: |

- printf '%s' "$GHCR_TOKEN" | mise x helm@4.1.1 -- \

- helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin

-

- - name: Build and publish OCI artifacts

- shell: bash

- run: |

- version="${{ steps.artifact.outputs.version }}"

- image_output=()

- chart_output=()

-

- if [[ "${{ github.event_name }}" != pull_request ]]; then

- image_output+=(--push)

- chart_output+=(--push "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/charts")

- fi

-

- for service in server worker; do

- image="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/mirum-$service"

- tags=(

- --tag "$image:sha-$GITHUB_SHA"

- --tag "$image:$version"

- )

- labels=(

- --label "org.opencontainers.image.revision=$GITHUB_SHA"

- --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"

- --label "org.opencontainers.image.version=$version"

- )

-

- if [[ "$GITHUB_REF" == refs/heads/main ]]; then

- tags+=(--tag "$image:nightly")

- elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then

- tags+=(--tag "$image:latest")

- fi

-

- mise run container -- \

- --context . \

- --file "cmd/mirum-$service/Dockerfile" \

- --platform linux/amd64,linux/arm64 \

- --cache-scope "mirum-$service" \

- "${tags[@]}" "${labels[@]}" "${image_output[@]}"

- done

-

- mise run chart -- \

- --chart charts/mirum \

- --version "$version" \

- --app-version "$version" \

- "${chart_output[@]}"

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-name: Legal

-

-on:

- push:

- branches: [main]

- tags: ["v*"]

- pull_request:

- branches: [main]

-

-permissions:

- contents: read

-

-jobs:

- legal:

- name: Legal checks

- runs-on: ubuntu-latest

- steps:

- - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

- with:

- fetch-depth: 0

-

- - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3

- with:

- version: 2026.7.5

- experimental: true

- install: false

-

- - name: Check contribution sign-off

- run: mise run signoff

-

- - name: Check licensing policy

- run: mise run licenses

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-/dev

-/.container

-mise.local.toml

-mise.*.local.toml

-cmd/mirum-server/static

-cmd/mirum-server/web/node_modules

-

-# zig build artifacts

-.zig-cache/

-zig-out/

-zig-pkg/

-

-# grpc generated code

-/internal/protocol/wirepb

-/cmd/mirum-server/apipb

-/cmd/mirum-server/web/gen

-# Add new entries in alphabetical order

-

-Nikolay Govorov <me@govorov.online>

-Nikolay Govorov <mr@dimidiumlabs.io>

-pauline nemchak <doublewebstandards@gmail.com>

-# Mirum Individual Contributor License Agreement

-Version 1.0

-> This agreement is based on the Harmony Individual Contributor License

-> Agreement Version 1.0 licensed under a

-> [Creative Commons Attribution 3.0 Unported License](https://creativecommons.org/licenses/by/3.0/).

-

-Thank you for your interest in contributing to Mirum (the "Project"). In this

-Agreement, "We" and "Us" mean Nikolay Govorov.

-

-This contributor agreement ("Agreement") documents the rights granted by

-contributors to Us. To make this document effective, You must personally add

-the following trailers to every commit You Submit:

-

-```text

-CLA-Version: 1.0

-Signed-off-by: Your Name <your.email@example.com>

-```

-

-The name and email address in `Signed-off-by` must identify You and match the

-commit author. By Submitting a commit containing these trailers, You

-electronically sign and accept this Agreement. No other person or automated

-system may add the `Signed-off-by` trailer on Your behalf. This is a legally

-binding document, so please read it carefully before agreeing to it.

-"You" means the individual who Submits a Contribution to Us.

-which You own or assert ownership of the Copyright. If You do not own the

-Copyright in the entire work of authorship, please follow the instructions in

-Section 3(d).

-by You, including copyright, moral and neighboring rights, as appropriate, for

-the full term of their existence including any extensions by You.

-parties as part of the Project. After You Submit the Contribution, it may be

-included in the Material.

-claims which You own, control or have the right to grant,

-Any rights not expressly licensed under this section are expressly

-(b) You own the Copyright and patent claims covering the

-(c) The grant of rights under Section 2 does not violate any grant

-(d) If You do not own the Copyright in the entire work of authorship Submitted,

-You have clearly identified the third-party work, its source, and its license in

-the Submission.

-PURPOSE AND NON-INFRINGEMENT ARE EXPRESSLY DISCLAIMED BY YOU TO US.

-TO THE EXTENT THAT ANY SUCH WARRANTIES CANNOT BE DISCLAIMED, SUCH WARRANTY

-TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL YOU BE

-LIABLE FOR ANY LOSS OF PROFITS, LOSS OF ANTICIPATED SAVINGS, LOSS OF DATA,

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-* @mrdimidium

-cmd/mirum-server/web/ @PaulineNemchak

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-//go:build !licensegen

-

-// This package is a small hack for embedding LICENSE into a project.

-// Go sensibly prohibits embedding files from parent folders,

-// so this file is only needed to bypass the restriction.

-package mirum

-

-import _ "embed"

-

-//go:embed LICENSE

-var License string

-

-//go:embed build/licenses.json

-var Licenses []byte

-Creative Commons Legal Code

-

-Attribution 3.0 Unported

-

- CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE

- LEGAL SERVICES. DISTRIBUTION OF THIS LICENSE DOES NOT CREATE AN

- ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS

- INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES

- REGARDING THE INFORMATION PROVIDED, AND DISCLAIMS LIABILITY FOR

- DAMAGES RESULTING FROM ITS USE.

-

-License

-

-THE WORK (AS DEFINED BELOW) IS PROVIDED UNDER THE TERMS OF THIS CREATIVE

-COMMONS PUBLIC LICENSE ("CCPL" OR "LICENSE"). THE WORK IS PROTECTED BY

-COPYRIGHT AND/OR OTHER APPLICABLE LAW. ANY USE OF THE WORK OTHER THAN AS

-AUTHORIZED UNDER THIS LICENSE OR COPYRIGHT LAW IS PROHIBITED.

-

-BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED HERE, YOU ACCEPT AND AGREE

-TO BE BOUND BY THE TERMS OF THIS LICENSE. TO THE EXTENT THIS LICENSE MAY

-BE CONSIDERED TO BE A CONTRACT, THE LICENSOR GRANTS YOU THE RIGHTS

-CONTAINED HERE IN CONSIDERATION OF YOUR ACCEPTANCE OF SUCH TERMS AND

-CONDITIONS.

-

-1. Definitions

-

- a. "Adaptation" means a work based upon the Work, or upon the Work and

- other pre-existing works, such as a translation, adaptation,

- derivative work, arrangement of music or other alterations of a

- literary or artistic work, or phonogram or performance and includes

- cinematographic adaptations or any other form in which the Work may be

- recast, transformed, or adapted including in any form recognizably

- derived from the original, except that a work that constitutes a

- Collection will not be considered an Adaptation for the purpose of

- this License. For the avoidance of doubt, where the Work is a musical

- work, performance or phonogram, the synchronization of the Work in

- timed-relation with a moving image ("synching") will be considered an

- Adaptation for the purpose of this License.

- b. "Collection" means a collection of literary or artistic works, such as

- encyclopedias and anthologies, or performances, phonograms or

- broadcasts, or other works or subject matter other than works listed

- in Section 1(f) below, which, by reason of the selection and

- arrangement of their contents, constitute intellectual creations, in

- which the Work is included in its entirety in unmodified form along

- with one or more other contributions, each constituting separate and

- independent works in themselves, which together are assembled into a

- collective whole. A work that constitutes a Collection will not be

- considered an Adaptation (as defined above) for the purposes of this

- License.

- c. "Distribute" means to make available to the public the original and

- copies of the Work or Adaptation, as appropriate, through sale or

- other transfer of ownership.

- d. "Licensor" means the individual, individuals, entity or entities that

- offer(s) the Work under the terms of this License.

- e. "Original Author" means, in the case of a literary or artistic work,

- the individual, individuals, entity or entities who created the Work

- or if no individual or entity can be identified, the publisher; and in

- addition (i) in the case of a performance the actors, singers,

- musicians, dancers, and other persons who act, sing, deliver, declaim,

- play in, interpret or otherwise perform literary or artistic works or

- expressions of folklore; (ii) in the case of a phonogram the producer

- being the person or legal entity who first fixes the sounds of a

- performance or other sounds; and, (iii) in the case of broadcasts, the

- organization that transmits the broadcast.

- f. "Work" means the literary and/or artistic work offered under the terms

- of this License including without limitation any production in the

- literary, scientific and artistic domain, whatever may be the mode or

- form of its expression including digital form, such as a book,

- pamphlet and other writing; a lecture, address, sermon or other work

- of the same nature; a dramatic or dramatico-musical work; a

- choreographic work or entertainment in dumb show; a musical

- composition with or without words; a cinematographic work to which are

- assimilated works expressed by a process analogous to cinematography;

- a work of drawing, painting, architecture, sculpture, engraving or

- lithography; a photographic work to which are assimilated works

- expressed by a process analogous to photography; a work of applied

- art; an illustration, map, plan, sketch or three-dimensional work

- relative to geography, topography, architecture or science; a

- performance; a broadcast; a phonogram; a compilation of data to the

- extent it is protected as a copyrightable work; or a work performed by

- a variety or circus performer to the extent it is not otherwise

- considered a literary or artistic work.

- g. "You" means an individual or entity exercising rights under this

- License who has not previously violated the terms of this License with

- respect to the Work, or who has received express permission from the

- Licensor to exercise rights under this License despite a previous

- violation.

- h. "Publicly Perform" means to perform public recitations of the Work and

- to communicate to the public those public recitations, by any means or

- process, including by wire or wireless means or public digital

- performances; to make available to the public Works in such a way that

- members of the public may access these Works from a place and at a

- place individually chosen by them; to perform the Work to the public

- by any means or process and the communication to the public of the

- performances of the Work, including by public digital performance; to

- broadcast and rebroadcast the Work by any means including signs,

- sounds or images.

- i. "Reproduce" means to make copies of the Work by any means including

- without limitation by sound or visual recordings and the right of

- fixation and reproducing fixations of the Work, including storage of a

- protected performance or phonogram in digital form or other electronic

- medium.

-

-2. Fair Dealing Rights. Nothing in this License is intended to reduce,

-limit, or restrict any uses free from copyright or rights arising from

-limitations or exceptions that are provided for in connection with the

-copyright protection under copyright law or other applicable laws.

-

-3. License Grant. Subject to the terms and conditions of this License,

-Licensor hereby grants You a worldwide, royalty-free, non-exclusive,

-perpetual (for the duration of the applicable copyright) license to

-exercise the rights in the Work as stated below:

-

- a. to Reproduce the Work, to incorporate the Work into one or more

- Collections, and to Reproduce the Work as incorporated in the

- Collections;

- b. to create and Reproduce Adaptations provided that any such Adaptation,

- including any translation in any medium, takes reasonable steps to

- clearly label, demarcate or otherwise identify that changes were made

- to the original Work. For example, a translation could be marked "The

- original work was translated from English to Spanish," or a

- modification could indicate "The original work has been modified.";

- c. to Distribute and Publicly Perform the Work including as incorporated

- in Collections; and,

- d. to Distribute and Publicly Perform Adaptations.

- e. For the avoidance of doubt:

-

- i. Non-waivable Compulsory License Schemes. In those jurisdictions in

- which the right to collect royalties through any statutory or

- compulsory licensing scheme cannot be waived, the Licensor

- reserves the exclusive right to collect such royalties for any

- exercise by You of the rights granted under this License;

- ii. Waivable Compulsory License Schemes. In those jurisdictions in

- which the right to collect royalties through any statutory or

- compulsory licensing scheme can be waived, the Licensor waives the

- exclusive right to collect such royalties for any exercise by You

- of the rights granted under this License; and,

- iii. Voluntary License Schemes. The Licensor waives the right to

- collect royalties, whether individually or, in the event that the

- Licensor is a member of a collecting society that administers

- voluntary licensing schemes, via that society, from any exercise

- by You of the rights granted under this License.

-

-The above rights may be exercised in all media and formats whether now

-known or hereafter devised. The above rights include the right to make

-such modifications as are technically necessary to exercise the rights in

-other media and formats. Subject to Section 8(f), all rights not expressly

-granted by Licensor are hereby reserved.

-

-4. Restrictions. The license granted in Section 3 above is expressly made

-subject to and limited by the following restrictions:

-

- a. You may Distribute or Publicly Perform the Work only under the terms

- of this License. You must include a copy of, or the Uniform Resource

- Identifier (URI) for, this License with every copy of the Work You

- Distribute or Publicly Perform. You may not offer or impose any terms

- on the Work that restrict the terms of this License or the ability of

- the recipient of the Work to exercise the rights granted to that

- recipient under the terms of the License. You may not sublicense the

- Work. You must keep intact all notices that refer to this License and

- to the disclaimer of warranties with every copy of the Work You

- Distribute or Publicly Perform. When You Distribute or Publicly

- Perform the Work, You may not impose any effective technological

- measures on the Work that restrict the ability of a recipient of the

- Work from You to exercise the rights granted to that recipient under

- the terms of the License. This Section 4(a) applies to the Work as

- incorporated in a Collection, but this does not require the Collection

- apart from the Work itself to be made subject to the terms of this

- License. If You create a Collection, upon notice from any Licensor You

- must, to the extent practicable, remove from the Collection any credit

- as required by Section 4(b), as requested. If You create an

- Adaptation, upon notice from any Licensor You must, to the extent

- practicable, remove from the Adaptation any credit as required by

- Section 4(b), as requested.

- b. If You Distribute, or Publicly Perform the Work or any Adaptations or

- Collections, You must, unless a request has been made pursuant to

- Section 4(a), keep intact all copyright notices for the Work and

- provide, reasonable to the medium or means You are utilizing: (i) the

- name of the Original Author (or pseudonym, if applicable) if supplied,

- and/or if the Original Author and/or Licensor designate another party

- or parties (e.g., a sponsor institute, publishing entity, journal) for

- attribution ("Attribution Parties") in Licensor's copyright notice,

- terms of service or by other reasonable means, the name of such party

- or parties; (ii) the title of the Work if supplied; (iii) to the

- extent reasonably practicable, the URI, if any, that Licensor

- specifies to be associated with the Work, unless such URI does not

- refer to the copyright notice or licensing information for the Work;

- and (iv) , consistent with Section 3(b), in the case of an Adaptation,

- a credit identifying the use of the Work in the Adaptation (e.g.,

- "French translation of the Work by Original Author," or "Screenplay

- based on original Work by Original Author"). The credit required by

- this Section 4 (b) may be implemented in any reasonable manner;

- provided, however, that in the case of a Adaptation or Collection, at

- a minimum such credit will appear, if a credit for all contributing

- authors of the Adaptation or Collection appears, then as part of these

- credits and in a manner at least as prominent as the credits for the

- other contributing authors. For the avoidance of doubt, You may only

- use the credit required by this Section for the purpose of attribution

- in the manner set out above and, by exercising Your rights under this

- License, You may not implicitly or explicitly assert or imply any

- connection with, sponsorship or endorsement by the Original Author,

- Licensor and/or Attribution Parties, as appropriate, of You or Your

- use of the Work, without the separate, express prior written

- permission of the Original Author, Licensor and/or Attribution

- Parties.

- c. Except as otherwise agreed in writing by the Licensor or as may be

- otherwise permitted by applicable law, if You Reproduce, Distribute or

- Publicly Perform the Work either by itself or as part of any

- Adaptations or Collections, You must not distort, mutilate, modify or

- take other derogatory action in relation to the Work which would be

- prejudicial to the Original Author's honor or reputation. Licensor

- agrees that in those jurisdictions (e.g. Japan), in which any exercise

- of the right granted in Section 3(b) of this License (the right to

- make Adaptations) would be deemed to be a distortion, mutilation,

- modification or other derogatory action prejudicial to the Original

- Author's honor and reputation, the Licensor will waive or not assert,

- as appropriate, this Section, to the fullest extent permitted by the

- applicable national law, to enable You to reasonably exercise Your

- right under Section 3(b) of this License (right to make Adaptations)

- but not otherwise.

-

-5. Representations, Warranties and Disclaimer

-

-UNLESS OTHERWISE MUTUALLY AGREED TO BY THE PARTIES IN WRITING, LICENSOR

-OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY

-KIND CONCERNING THE WORK, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE,

-INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY,

-FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF

-LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS,

-WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION

-OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU.

-

-6. Limitation on Liability. EXCEPT TO THE EXTENT REQUIRED BY APPLICABLE

-LAW, IN NO EVENT WILL LICENSOR BE LIABLE TO YOU ON ANY LEGAL THEORY FOR

-ANY SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES

-ARISING OUT OF THIS LICENSE OR THE USE OF THE WORK, EVEN IF LICENSOR HAS

-BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

-

-7. Termination

-

- a. This License and the rights granted hereunder will terminate

- automatically upon any breach by You of the terms of this License.

- Individuals or entities who have received Adaptations or Collections

- from You under this License, however, will not have their licenses

- terminated provided such individuals or entities remain in full

- compliance with those licenses. Sections 1, 2, 5, 6, 7, and 8 will

- survive any termination of this License.

- b. Subject to the above terms and conditions, the license granted here is

- perpetual (for the duration of the applicable copyright in the Work).

- Notwithstanding the above, Licensor reserves the right to release the

- Work under different license terms or to stop distributing the Work at

- any time; provided, however that any such election will not serve to

- withdraw this License (or any other license that has been, or is

- required to be, granted under the terms of this License), and this

- License will continue in full force and effect unless terminated as

- stated above.

-

-8. Miscellaneous

-

- a. Each time You Distribute or Publicly Perform the Work or a Collection,

- the Licensor offers to the recipient a license to the Work on the same

- terms and conditions as the license granted to You under this License.

- b. Each time You Distribute or Publicly Perform an Adaptation, Licensor

- offers to the recipient a license to the original Work on the same

- terms and conditions as the license granted to You under this License.

- c. If any provision of this License is invalid or unenforceable under

- applicable law, it shall not affect the validity or enforceability of

- the remainder of the terms of this License, and without further action

- by the parties to this agreement, such provision shall be reformed to

- the minimum extent necessary to make such provision valid and

- enforceable.

- d. No term or provision of this License shall be deemed waived and no

- breach consented to unless such waiver or consent shall be in writing

- and signed by the party to be charged with such waiver or consent.

- e. This License constitutes the entire agreement between the parties with

- respect to the Work licensed here. There are no understandings,

- agreements or representations with respect to the Work not specified

- here. Licensor shall not be bound by any additional provisions that

- may appear in any communication from You. This License may not be

- modified without the mutual written agreement of the Licensor and You.

- f. The rights granted under, and the subject matter referenced, in this

- License were drafted utilizing the terminology of the Berne Convention

- for the Protection of Literary and Artistic Works (as amended on

- September 28, 1979), the Rome Convention of 1961, the WIPO Copyright

- Treaty of 1996, the WIPO Performances and Phonograms Treaty of 1996

- and the Universal Copyright Convention (as revised on July 24, 1971).

- These rights and subject matter take effect in the relevant

- jurisdiction in which the License terms are sought to be enforced

- according to the corresponding provisions of the implementation of

- those treaty provisions in the applicable national law. If the

- standard suite of rights granted under applicable copyright law

- includes additional rights not granted under this License, such

- additional rights are deemed to be included in the License; this

- License is not intended to restrict the license of any rights under

- applicable law.

-

-

-Creative Commons Notice

-

- Creative Commons is not a party to this License, and makes no warranty

- whatsoever in connection with the Work. Creative Commons will not be

- liable to You or any party on any legal theory for any damages

- whatsoever, including without limitation any general, special,

- incidental or consequential damages arising in connection to this

- license. Notwithstanding the foregoing two (2) sentences, if Creative

- Commons has expressly identified itself as the Licensor hereunder, it

- shall have all rights and obligations of Licensor.

-

- Except for the limited purpose of indicating to the public that the

- Work is licensed under the CCPL, Creative Commons does not authorize

- the use by either party of the trademark "Creative Commons" or any

- related trademark or logo of Creative Commons without the prior

- written consent of Creative Commons. Any permitted use will be in

- compliance with Creative Commons' then-current trademark usage

- guidelines, as may be published on its website or otherwise made

- available upon request from time to time. For the avoidance of doubt,

- this trademark restriction does not form part of this License.

-

- Creative Commons may be contacted at https://creativecommons.org/.

-Creative Commons Attribution 4.0 International

-

- Creative Commons Corporation (“Creative Commons”) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is” basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.

-

-Using Creative Commons Public Licenses

-

-Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.

-

-Considerations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors.

-

-Considerations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described. Although not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public.

-

-Creative Commons Attribution 4.0 International Public License

-

-By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.

-

-Section 1 – Definitions.

-

- a. Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.

-

- b. Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.

-

- c. Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.

-

- d. Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.

-

- e. Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.

-

- f. Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.

-

- g. Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.

-

- h. Licensor means the individual(s) or entity(ies) granting rights under this Public License.

-

- i. Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.

-

- j. Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.

-

- k. You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.

-

-Section 2 – Scope.

-

- a. License grant.

-

- 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:

-

- A. reproduce and Share the Licensed Material, in whole or in part; and

-

- B. produce, reproduce, and Share Adapted Material.

-

- 2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.

-

- 3. Term. The term of this Public License is specified in Section 6(a).

-

- 4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.

-

- 5. Downstream recipients.

-

- A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.

-

- B. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.

-

- 6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).

-

-b. Other rights.

-

- 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.

-

- 2. Patent and trademark rights are not licensed under this Public License.

-

- 3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.

-

-Section 3 – License Conditions.

-

-Your exercise of the Licensed Rights is expressly made subject to the following conditions.

-

- a. Attribution.

-

- 1. If You Share the Licensed Material (including in modified form), You must:

-

- A. retain the following if it is supplied by the Licensor with the Licensed Material:

-

- i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);

-

- ii. a copyright notice;

-

- iii. a notice that refers to this Public License;

-

- iv. a notice that refers to the disclaimer of warranties;

-

- v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable;

-

- B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and

-

- C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.

-

- 2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.

-

- 3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.

-

- 4. If You Share Adapted Material You produce, the Adapter's License You apply must not prevent recipients of the Adapted Material from complying with this Public License.

-

-Section 4 – Sui Generis Database Rights.

-

-Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:

-

- a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;

-

- b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material; and

-

- c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.

-For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.

-

-Section 5 – Disclaimer of Warranties and Limitation of Liability.

-

- a. Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.

-

- b. To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.

-

- c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.

-

-Section 6 – Term and Termination.

-

- a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.

-

- b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:

-

- 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or

-

- 2. upon express reinstatement by the Licensor.

-

- c. For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.

-

- d. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.

-

- e. Sections 1, 5, 6, 7, and 8 survive termination of this Public License.

-

-Section 7 – Other Terms and Conditions.

-

- a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.

-

- b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.

-

-Section 8 – Interpretation.

-

- a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.

-

- b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.

-

- c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.

-

- d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.

-

-Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.

-

-Creative Commons may be contacted at creativecommons.org.

-MIT License

-

-Copyright (c) <year> <copyright holders>

-

-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and

-associated documentation files (the "Software"), to deal in the Software without restriction, including

-without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

-copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the

-following conditions:

-

-The above copyright notice and this permission notice shall be included in all copies or substantial

-portions of the Software.

-

-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT

-LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO

-EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER

-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE

-USE OR OTHER DEALINGS IN THE SOFTWARE.

-# Mirum

-

-> [!CAUTION]

-> This document describes the design and rationale of the system. It does

-> not reflect the current state — almost everything is still

-> unimplemented. For the canonical user-facing API of the configuration

-> file, see [`mirumfile.md`](./docs/mirumfile.md).

-

-An experimental portable CI platform with VM-first isolation,

-programmable pipelines, local execution parity and Starlark configs.

-

-## Development

-

-Install the language toolchains, build utilities, and required system packages

-declared by the repository:

-

-```console

-mise bootstrap

-mise exec -- task --list

-```

-

-`task` remains the runner until the task definitions are migrated to mise.

-

-## [Why](https://xkcd.com/927/)

-

-The goal of this project is to build a CI system that's both convenient for tiny

-projects and suitable for gigantic C++ codebases like Chromium or llvm.

-

-For this to work, several key decisions need to be made:

-

-**Open source.**

-You can and should build SaaS, but the user must be able to deploy the entire

-system themselves. Self-hosted runners aren't enough.

-

-**Portability and cross-platform support.**

-You should be able to run on at least x64, arm64, riscv64, powerpc, s390x, and

-loongarch64, as well as Linux, {Free,Open,Net}BSD, Windows, and macOS. Users

-should be able to add exotic features like Haiku and Plan9, or even a custom kernel.

-

-**Hermitic builds.**

-All official platforms should support sealed builds with declarative environment

-descriptions (like Docker, yes). Hosted builds should work everywhere.

-

-**Different deployment models.**

-Not everyone can deploy themselves, and not everyone wants to. Offer open-source

-SaaS, cloud and self-hosted runners, and fully autonomous solutions. The degree

-of autonomy is the user's choice.

-

-**Dynamic pipelines.**

-Don't assume that all tasks are described by a static YAML/TOML configuration.

-This is often the case, but you should have a path for dynamic pipelines when they

-are needed.

-

-**Security and Isolation.**

-CI is the most security-sensitive platform, affecting testing, deployment to production,

-and releases.

-CI has access to both the code and the production environment.

-Since the "just hide it behind a VPN" option doesn't work for either SaaS or open

-source projects where CI must be public, you can't be overly paranoid about architectural

-decisions. Consider that the code for your pacemaker might be tested here.

-

-**Local debugging.**

-You should be able to run the build locally, get the console into the sandbox, and

-attach a debugger. There's nothing more pointless and merciless than trying to fix

-automation than the cycle of "test commit -> push to Git Forge -> hope it works."

-

-- `mirum task` — run a single task on the host without spinning up a VM,

- for fast iteration during development

-- `mirum run` — run the pipeline locally with the same VMs but with a local copy

- of your code and a debugger

-- `mirum ssh` — connect to a failed VM over SSH and debug on real hardware

-- `mirum try` — run a build from local changes on the cluster without creating

- throwaway commits

-

-## How

-

-The architecture is built on two key solutions:

-[Virtual Machines](https://en.wikipedia.org/wiki/Virtualization#Hardware_virtualization)

-and [Starlark](https://starlark-lang.org/).

-

-### Virtualization vs. Containers vs. Host

-

-Modern CI must provide a reproducible and hermetic environment for every task.

-Despite the popularity of container isolation, it's a Linux-specific technology

-with many limitations. As soon as you need Windows, a specific kernel version,

-or even systemd, you're forced to revert to bare, stateful runners you've manually

-configured.

-

-A solution was proposed in Sourcehut: use ephemeral VMs from a snapshot for isolated

-builds. Unlike a container, a VM can run any guest system, can emulate inaccessible

-architectures, provides a full stack including the kernel, and provides sufficient

-isolation to allow a user to access the build machine via SSH.

-

-The idea is to split the runner into two layers:

-

-- mirum-agent, a highly portable statically linked C binary that can copy files,

- execute bash commands, and collect logs and resources.

-- mirum-worker, a full-fledged runtime that launches a disposable VM for each task,

- launching and managing mirum-agent within the VM.

-

-This architecture allows for full support on official platforms, including isolation,

-SSH access, and so on. On the other hand, if you're testing an exotic system

-(for example, on bare metal without any OS at all), port mirum-agent and you'll

-be able to connect to a regular mirum server. You can also offer specialized versions

-of mirum-worker for containers/clouds/lambdas, or any custom environment.

-Simply run mirum-agent in a sandbox and issue commands to it.

-

-Using VMs also significantly simplifies infrastructure.

-One x64 host can run Linux, Windows, and *BSD,

-while one arm64 mac mini can run macOS, Linux, and Windows on arm64.

-

-### Starlark

-

-Today, there are two ways to describe pipelines: statically in yaml or by writing

-a script in a scripting language like JavaScript/Python/Ruby.

-

-Mirum occupies a niche between the two and offers Starlark as a configuration language.

-Starlark is a specialized embedded programming language developed for the Bazel

-build system. On the one hand, you have variable conditions and loops, imports,

-objects, and arrays.

-

-Unlike yaml, you don't have to reinvent the wheel. Settings are variables, tasks

-are functions, build matrices are loops, and the reusable actions library is

-a simple import. Python syntax is well-known and doesn't require learning your DSL.

-

-On the other hand, it's not an algorithmically complete language. There are no side

-effects, no need for a separate sandbox, and no need to drag in a runtime. The CI

-server has total control over Starlark execution. But unlike Kotlin DSL (TeamCity),

-Groovy (Jenkins), or Python (Buildbot), Starlark forbids side effects: no network,

-no filesystem, no arbitrary imports. Eval is safe for untrusted code

-(PRs from external contributors), deterministic, and cacheable.

-

-## Installation

-

-Please note that the project is in its infancy and is **not** intended for production use.

-

-**Debian/Ubuntu:**

-

-```bash

-sudo apt install curl gnupg

-

-curl -fsSL https://pkg.dimidiumlabs.io/packages.gpg | sudo gpg --dearmor -o /usr/share/keyrings/dimidiumlabs.gpg

-echo "deb [signed-by=/usr/share/keyrings/dimidiumlabs.gpg] https://pkg.dimidiumlabs.io/mirum/apt/ nightly main" | sudo tee /etc/apt/sources.list.d/mirum.list

-sudo apt update && sudo apt install mirum

-

-# Start the server

-sudo systemctl enable --now mirum-server

-

-# Start a worker (optional, can run on a different host)

-sudo systemctl enable --now mirum-worker@default

-```

-

-**Fedora/RHEL:**

-

-```bash

-# DNF5 (Fedora 41+, RHEL 10+)

-sudo dnf config-manager addrepo --from-repofile=https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

-

-# DNF4 (Fedora 40 and older, RHEL 8/9)

-sudo curl -o /etc/yum.repos.d/mirum-nightly.repo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/mirum-nightly.repo

-

-sudo dnf install mirum

-

-# Start the server

-sudo systemctl enable --now mirum-server

-

-# Start a worker (optional, can run on a different host)

-sudo systemctl enable --now mirum-worker@default

-```

-

-**openSUSE:**

-

-```bash

-sudo rpm --import https://pkg.dimidiumlabs.io/packages.gpg

-sudo zypper addrepo https://pkg.dimidiumlabs.io/mirum/rpm/nightly/ mirum-nightly

-sudo zypper refresh

-sudo zypper install mirum

-

-# Start the server

-sudo systemctl enable --now mirum-server

-

-# Start a worker (optional, can run on a different host)

-sudo systemctl enable --now mirum-worker@default

-```

-

-**Alpine:**

-

-```sh

-sudo wget -O /etc/apk/keys/packages.0001.rsa.pub https://pkg.dimidiumlabs.io/keys/packages.0001.rsa.pub

-echo "https://pkg.dimidiumlabs.io/mirum/apk/nightly" | sudo tee -a /etc/apk/repositories

-sudo apk update

-sudo apk add mirum

-

-# Start the server

-sudo rc-update add mirum-server default

-sudo rc-service mirum-server start

-

-# Start a worker (optional, can run on a different host).

-# mirum-worker is a templated service — symlink it per instance name:

-sudo ln -s mirum-worker /etc/init.d/mirum-worker.default

-sudo rc-update add mirum-worker.default default

-sudo rc-service mirum-worker.default start

-```

-

-## Contributing

-

-We welcome your contributions, including code, bug reports, ideas, and success

-stories.

-

-If you are making a contribution for the first time or from a new email, please

-add yourself to the `.mailmap`.

-

-### Signoff

-

-To include your code, we ask that you read and agree to the [CLA](./CLA.md). To

-sign, add a `CLA-Version: 1.0` and a `Signed-off-by` trailer to every commit

-(`git commit -s --trailer "CLA-Version: 1.0"`). Each commit in a pull request

-must carry a valid `Signed-off-by` line matching the commit author. Please use

-your real name. We cannot include code from anonymous contributors.

-

-AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the

-Contributor License Agreement.

-

-### AI policy

-

-You may use AI agents when writing code and documentation. AI is not allowed for

-media including images, videos, fonts at all. You must fully read, understand,

-and cleanup any code generated by the agent. We ask that you disclose the

-agent's use and indicate the tool, model, and extent of contribution.

-

-Contributions should include an Assisted-by tag in the following format:

-`Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]`, for example:

-`Assisted-by: Claude:claude-4.6-opus coccinelle sparse`

-

-Remember, AI agents should make software better, not worse.

-

-## Licensing

-

-Mirum source code is licensed under AGPL-3.0-or-later. Documentation is licensed

-under CC-BY-4.0.

-

-The bundled shadcn UI components are licensed under MIT.

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

- ".mailmap",

- "VERSION",

- "cmd/mirum-agent/build.zig.zon",

- "cmd/mirum-server/web/*.json",

- "mise.lock",

- "packaging/dl/*",

- "packaging/logo.svg",

- "charts/mirum/templates/*",

- "buf.*",

-SPDX-FileCopyrightText = "2026 Nikolay Govorov"

-

-[[annotations]]

-path = [

- "CLA.md",

-]

-SPDX-FileCopyrightText = "2026 Nikolay Govorov"

-SPDX-License-Identifier = "CC-BY-3.0"

-

-[[annotations]]

-path = [

- "README.md",

- "charts/mirum/README.md",

- "docs/**.md",

-]

-SPDX-FileCopyrightText = "2026 Nikolay Govorov"

-SPDX-License-Identifier = "CC-BY-4.0"

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-version: "3"

-

-output: prefixed

-

-env:

- CGO_ENABLED: "0" # cgo forbidden in mirum, do not change this behavior.

- SOURCE_DATE_EPOCH:

- sh: 'if [ -z "$(git status --porcelain)" ]; then git log -1 --format=%ct; else date +%s; fi'

- DOCKER: "false"

- DEV_DB: mirum-local-dev

- DIST_DIR: build/dist

- LINUX_PKG_TARGETS: amd64 arm64 riscv64 ppc64le loong64 s390x

- # Guest matrix for mirum-agent — a strict superset of the host cross

- # matrix. Extend here as more guest targets are supported.

- AGENT_TARGETS: >-

- linux-amd64 linux-arm64 linux-riscv64 linux-ppc64le linux-loong64 linux-s390x

- darwin-amd64 darwin-arm64

- windows-amd64 windows-arm64

- freebsd-amd64 freebsd-arm64 freebsd-riscv64

- netbsd-amd64 netbsd-arm64

- openbsd-amd64 openbsd-arm64

- # Production build pipeline

- web:install:

- desc: Install frontend dependencies

- run: once

- dir: cmd/mirum-server/web

- sources:

- - package.json

- - package-lock.json

- generates:

- - node_modules/.package-lock.json

- cmds:

- - npm ci

-

- proto:

- desc: Generate ConnectRPC code from proto files

- run: once

- deps: [web:install]

- sources:

- - internal/protocol/proto/*.proto

- - internal/protocol/proto/buf.gen.yaml

- - cmd/mirum-server/proto/*.proto

- - cmd/mirum-server/proto/buf.gen.yaml

- - buf.yaml

- generates:

- - internal/protocol/wirepb/**/*.go

- - cmd/mirum-server/apipb/**/*.go

- - cmd/mirum-server/web/gen/**/*.ts

- cmds:

- - rm -rf internal/protocol/wirepb cmd/mirum-server/apipb cmd/mirum-server/web/gen

- - cd internal/protocol/proto && buf generate

- - cd cmd/mirum-server/proto && buf generate

- # api_pb.ts imports file_buf_validate_validate from buf/validate/validate_pb.js.

- # buf.validate carries only server-side field annotations that the browser

- # never decodes, so replace the 200+ KB generated schema with an empty

- # descriptor stub that satisfies the GenFile type.

- - mkdir -p cmd/mirum-server/web/gen/buf/validate

- - |

- cat > cmd/mirum-server/web/gen/buf/validate/validate_pb.ts <<'EOF'

- // Stub: see Taskfile.yml proto task. buf.validate is server-only.

- import { fileDesc, type GenFile } from "@bufbuild/protobuf/codegenv2"

- export const file_buf_validate_validate: GenFile = /*@__PURE__*/ fileDesc("")

- EOF

-

- web:build:

- desc: Build the frontend into cmd/mirum-server/static

- run: once

- dir: cmd/mirum-server/web

- deps: [web:install, proto]

- sources:

- - api/**/*

- - gen/**/*

- - lib/**/*

- - pages/**/*

- - components/**/*

- - index.css

- - vite.config.ts

- - tsconfig.json

- - tsconfig.app.json

- generates:

- - ../static/**/*

- cmds:

- - npm run build

-

- licenses:

- desc: Regenerate third-party license manifest (build/licenses.json)

- run: once

- deps: [proto, web:build]

- sources:

- - go.sum

- - cmd/mirum-server/web/package-lock.json

- - tools/licensegen/**/*.go

- - LICENSES.go

- - LICENSES/*.txt

- generates:

- - build/licenses.json

- cmds:

- - mkdir -p {{.BUILD_DIR}}

- - go run -tags licensegen ./tools/licensegen -out {{.BUILD_DIR}}/licenses.json

-

- desc: "Build binaries (override GOOS/GOARCH for cross-compilation)"

- deps: [proto, licenses, web:build]

- vars:

- GOOS: { sh: "echo ${GOOS:-$(go env GOOS)}" }

- GOARCH: { sh: "echo ${GOARCH:-$(go env GOARCH)}" }

- LDFLAGS: "-s -w"

- env:

- GOOS: "{{.GOOS}}"

- GOARCH: "{{.GOARCH}}"

- GOFLAGS: "-trimpath"

- - go build -ldflags="{{.LDFLAGS}}" -o {{.BUILD_DIR}}/mirum-server-{{.GOOS}}-{{.GOARCH}} ./cmd/mirum-server

- - go build -ldflags="{{.LDFLAGS}}" -o {{.BUILD_DIR}}/mirum-worker-{{.GOOS}}-{{.GOARCH}} ./cmd/mirum-worker

- - go build -ldflags="{{.LDFLAGS}}" -o {{.BUILD_DIR}}/mirum-{{.GOOS}}-{{.GOARCH}} ./cmd/mirum

-

- agent:build:

- desc: "Build mirum-agent for one guest target (override GOOS/GOARCH)"

- dir: cmd/mirum-agent

- vars:

- GOOS: { sh: "echo ${GOOS:-$(go env GOOS)}" }

- GOARCH: { sh: "echo ${GOARCH:-$(go env GOARCH)}" }

- cmds:

- - |

- case "{{.GOARCH}}" in

- amd64) za=x86_64 ;;

- arm64) za=aarch64 ;;

- riscv64) za=riscv64 ;;

- ppc64le) za=powerpc64le ;;

- loong64) za=loongarch64 ;;

- s390x) za=s390x ;;

- *) echo "agent: unsupported arch {{.GOARCH}}" >&2; exit 1 ;;

- esac

- case "{{.GOOS}}" in

- linux) ztriple="${za}-linux" ;;

- darwin) ztriple="${za}-macos" ;;

- windows) ztriple="${za}-windows-gnu" ;;

- freebsd) ztriple="${za}-freebsd" ;;

- openbsd) ztriple="${za}-openbsd" ;;

- netbsd) ztriple="${za}-netbsd" ;;

- *) echo "agent: unsupported os {{.GOOS}}" >&2; exit 1 ;;

- esac

- ext=""; [ "{{.GOOS}}" = windows ] && ext=.exe

- zig build -Dtarget="$ztriple" -Doptimize=ReleaseFast -Dstrip

- mkdir -p ../../{{.BUILD_DIR}}/agent

- cp "zig-out/bin/mirum-agent${ext}" "../../{{.BUILD_DIR}}/agent/mirum-agent-{{.GOOS}}-{{.GOARCH}}${ext}"

-

- agent:cross:

- desc: Cross-compile mirum-agent for the full guest matrix

- cmds:

- - rm -rf {{.BUILD_DIR}}/agent

- - for: { var: AGENT_TARGETS }

- cmd: |

- target="{{.ITEM}}"

- task agent:build GOOS="${target%-*}" GOARCH="${target##*-}"

-

- agent:test:

- desc: Build and run mirum-agent unit tests

- dir: cmd/mirum-agent

- cmds:

- - zig build test

-

- cross:

- desc: Cross-compile and archive binaries for all supported platforms

- deps: [agent:cross]

- cmds:

- - mkdir -p {{.DIST_DIR}}

- - for: [

- darwin-amd64, darwin-arm64,

- windows-amd64, windows-arm64,

- netbsd-amd64, netbsd-arm64,

- openbsd-amd64, openbsd-arm64,

- freebsd-amd64, freebsd-arm64, freebsd-riscv64,

- linux-amd64, linux-arm64, linux-riscv64, linux-ppc64le, linux-loong64, linux-s390x,

- ]

- cmd: |

- target="{{ .ITEM }}"

- os="${target%%-*}"

- arch="${target#*-}"

- task build GOOS="$os" GOARCH="$arch"

-

- ext=""

- [ "$os" = "windows" ] && ext=".exe"

-

- staging=$(mktemp -d)

- cp README.md "$staging/"

- cp -r LICENSES "$staging/"

- for cmd in cmd/*/; do

- bin=$(basename "$cmd")

- [ "$bin" = "mirum-agent" ] && continue

- cp "{{.BUILD_DIR}}/${bin}-${os}-${arch}" "${staging}/${bin}${ext}"

- done

- cp -r "{{.BUILD_DIR}}/agent" "$staging/agent"

-

- format=tar.gz

- [ "$os" = "windows" ] && format=zip

- mise run package -- \

- --output "{{.DIST_DIR}}" \

- --archive-root "$staging" \

- --archive-name "mirum-${target}" \

- "$format"

- rm -rf "$staging"

- - cd {{.DIST_DIR}} && sha256sum *.tar.gz *.zip > SHA256SUMS

-

- package:

- desc: Cross-compile all platforms and build deb/rpm packages for Linux

- deps: [cross]

- vars:

- VERSION:

- sh: |

- ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* ]]; then

- echo "${ref#refs/tags/v}"

- elif [[ "$ref" == v* ]]; then

- echo "${ref#v}"

- else

- echo "$(cat VERSION)~nightly.$(git log -1 --format=%ct)"

- fi

- CHANNEL:

- sh: |

- ref="${GIT_REF:-$(git describe --tags --exact-match 2>/dev/null || echo "")}"

- if [[ "$ref" == refs/tags/v* || "$ref" == v* ]]; then echo stable; else echo nightly; fi

- env:

- VERSION: "{{.VERSION}}"

- cmds:

- - |

- for arch in {{.LINUX_PKG_TARGETS}}; do

- mkdir -p {{.BUILD_DIR}}/tmp

- for cmd in cmd/*/; do

- bin=$(basename "$cmd")

- [ "$bin" = "mirum-agent" ] && continue

- cp "{{.BUILD_DIR}}/${bin}-linux-${arch}" "{{.BUILD_DIR}}/tmp/${bin}"

- done

-

- formats="deb rpm"

- # Alpine does not build for loong64

- if [ "$arch" != "loong64" ]; then

- formats="$formats apk"

- fi

- GPG_KEY_ID="{{.GPG_KEY_ID}}" mise run package -- \

- --version "{{.VERSION}}" \

- --arch "$arch" \

- --output "{{.DIST_DIR}}" \

- $formats

- rm -rf {{.BUILD_DIR}}/tmp

- done

-

- printf 'VERSION={{.VERSION}}\nCHANNEL={{.CHANNEL}}\n' > {{.DIST_DIR}}/build.env

-

- publish:release:

- desc: Create or update a GitHub Release

- requires:

- vars: [CHANNEL, VERSION]

- cmds:

- - |

- if [ "{{.CHANNEL}}" = "stable" ]; then

- TAG="v{{.VERSION}}"

- NAME="{{.VERSION}}"

- else

- TAG="nightly"

- NAME="nightly"

- git tag -f nightly

- git push origin --force tag nightly

- for asset in $(gh release view nightly --json assets --jq '.assets[].name' 2>/dev/null || true); do

- gh release delete-asset nightly "$asset" --yes

- done

- fi

-

- gh release create "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS \

- --title "$NAME" \

- $( [ "{{.CHANNEL}}" = "nightly" ] && echo "--prerelease" ) \

- --notes "**Version**: {{.VERSION}}" \

- || gh release upload "$TAG" {{.DIST_DIR}}/*.deb {{.DIST_DIR}}/*.rpm {{.DIST_DIR}}/*.apk {{.DIST_DIR}}/*.tar.gz {{.DIST_DIR}}/*.zip {{.DIST_DIR}}/SHA256SUMS --clobber

-

- # Local dev env

- devenv:config:

- desc: Write dev/mirum-server.yaml if missing

- status:

- - test -f dev/mirum-server.yaml

- cmds:

- - mkdir -p dev

- - |

- cat > dev/mirum-server.yaml <<EOF

- web_addr: ":3000"

- grpc_addr: ":2026"

- admin_socket: "/tmp/mirum-admin.sock"

- database_uri: "postgres://{{.DEV_DB}}:{{.DEV_DB}}@localhost:5432/{{.DEV_DB}}?sslmode=disable"

- pepper: "dev-pepper"

- webhook_secret: "dev-secret"

- grpc_tls:

- cert: "dev/server.crt"

- key: "dev/server.key"

- EOF

-

- devenv:keys:

- desc: Generate dev TLS cert and worker key pair

- status:

- - test -f dev/server.crt

- - test -f dev/worker.key

- - test -f dev/worker.pub

- cmds:

- - mkdir -p dev

- - >-

- test -f dev/server.crt ||

- openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1

- -keyout dev/server.key -out dev/server.crt

- -days 365 -nodes -subj "/CN=mirum-server"

- -addext "subjectAltName=DNS:mirum-server,DNS:localhost"

- - >-

- test -f dev/worker.key ||

- openssl genpkey -algorithm ed25519 -out dev/worker.key

- - >-

- test -f dev/worker.pub ||

- openssl pkey -in dev/worker.key -pubout -out dev/worker.pub

-

- devenv:db:local:

- internal: true

- desc: Create the dev postgres role and database on a local install (needs sudo)

- status:

- - '[ "{{.DOCKER}}" = "true" ] || PGPASSWORD={{.DEV_DB}} psql -h localhost -U {{.DEV_DB}} -d {{.DEV_DB}} -c "SELECT 1" >/dev/null 2>&1'

- cmds:

- - |

- sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='{{.DEV_DB}}'" | grep -q 1 ||

- sudo -u postgres psql -c "CREATE ROLE \"{{.DEV_DB}}\" LOGIN PASSWORD '{{.DEV_DB}}'"

- - |

- sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='{{.DEV_DB}}'" | grep -q 1 ||

- sudo -u postgres psql -c "CREATE DATABASE \"{{.DEV_DB}}\" OWNER \"{{.DEV_DB}}\""

-

- devenv:db:docker:

- internal: true

- desc: Start a Postgres Docker container for dev

- status:

- - '[ "{{.DOCKER}}" != "true" ] || docker exec {{.DEV_DB}} pg_isready -U {{.DEV_DB}} >/dev/null 2>&1 || nc -z localhost 5432 2>/dev/null'

- cmds:

- - docker run -d

- --name {{.DEV_DB}}

- -e POSTGRES_USER={{.DEV_DB}}

- -e POSTGRES_PASSWORD={{.DEV_DB}}

- -e POSTGRES_DB={{.DEV_DB}}

- -p 5432:5432

- postgres:18

- - |

- echo "Waiting for postgres..."

- until docker exec {{.DEV_DB}} pg_isready -U {{.DEV_DB}} >/dev/null 2>&1; do

- sleep 1

- done

-

- devenv:db:

- desc: "Create the dev postgres role and database (set DOCKER=true for Docker)"

- deps: [devenv:db:local, devenv:db:docker]

-

- devenv:

- desc: Provision a full local dev environment (keys, config, database)

- deps: [devenv:keys, devenv:config, devenv:db]

-

- web:dev:

- desc: Run Vite dev server (use with `go run -tags dev ./cmd/mirum-server`)

- dir: cmd/mirum-server/web

- deps: [web:install, proto]

- prefix: vite

- env:

- NO_COLOR: "1"

- CI: "true"

- cmds:

- - npm run dev

-

- dev:server:

- desc: Build mirum-server with -tags dev and run it against the dev environment

- deps: [proto, licenses, devenv]

- prefix: mirum-server

- cmds:

- - mkdir -p {{.BUILD_DIR}}

- - go build -tags dev -o {{.BUILD_DIR}}/mirum-server ./cmd/mirum-server

- - "{{.BUILD_DIR}}/mirum-server daemon --config dev/mirum-server.yaml"

-

- run:

- desc: Build and run mirum-server against the dev environment

- deps: [build, devenv]

- vars:

- GOOS: { sh: go env GOOS }

- GOARCH: { sh: go env GOARCH }

- cmds:

- - "{{.BUILD_DIR}}/mirum-server-{{.GOOS}}-{{.GOARCH}} daemon --config dev/mirum-server.yaml"

-

- dev:

- desc: Run Vite dev server and mirum-server together (HMR-enabled)

- deps: [web:dev, dev:server]

-

- # Test and lint checks

- signoff:

- desc: Verify contributor identities and commit sign-offs

- cmds:

- - mise run signoff

-

- legal:

- desc: Verify contribution and licensing policy

- cmds:

- - task: signoff

- - mise run licenses

-

- web:lint:

- desc: Lint and check the frontend

- dir: cmd/mirum-server/web

- deps: [web:build]

- cmds:

- - npm run lint

- - npm run size

-

- go:lint:

- desc: Lint and check the go

- deps: [proto, web:build, licenses]

- cmds:

- - gofmt -l . | grep . && exit 1 || true

- - go vet ./...

- - go tool govulncheck ./...

- - go tool golangci-lint run ./...

-

- lint:

- desc: Run static checks

- deps: [go:lint, web:lint]

- cmds:

- - task: go:lint

- - task: web:lint

-

- test:

- desc: Run all tests

- deps: [build]

- env:

- CGO_ENABLED: "1" # required for -race

- cmds:

- - go test -race -count=1 ./...

- - task: agent:test

-0.1.0

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-// This package is a small hack for embedding VERSION into a project.

-// Go sensibly prohibits embedding files from parent folders,

-// so this file is only needed to bypass the restriction.

-package mirum

-

-import _ "embed"

-

-//go:embed VERSION

-var Version string

-# Generated by buf. DO NOT EDIT.

-version: v2

-deps:

- - name: buf.build/bufbuild/protovalidate

- commit: 80ab13bee0bf4272b6161a72bf7034e0

- digest: b5:1aa6a965be5d02d64e1d81954fa2e78ef9d1e33a0c30f92bc2626039006a94deb3a5b05f14ed8893f5c3ffce444ac008f7e968188ad225c4c29c813aa5f2daa1

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-version: v2

-modules:

- - path: internal/protocol/proto

- - path: cmd/mirum-server/proto

-deps:

- - buf.build/bufbuild/protovalidate

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-apiVersion: v2

-type: application

-version: 0.1.0

-

-name: mirum

-home: https://github.com/dimidiumlabs/mirum

-description: Mirum CI server and workers

-{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}}

-{{/* vim: set filetype=helm: */}}

-{{- define "mirum.name" -}}

-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}

-{{- end -}}

-

-{{- define "mirum.fullname" -}}

-{{- if .Values.fullnameOverride -}}

-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}

-{{- else -}}

-{{- printf "%s-%s" .Release.Name (include "mirum.name" .) | trunc 63 | trimSuffix "-" -}}

-{{- end -}}

-{{- end -}}

-

-{{- define "mirum.labels" -}}

-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}

-app.kubernetes.io/name: {{ include "mirum.name" . }}

-app.kubernetes.io/instance: {{ .Release.Name }}

-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

-app.kubernetes.io/managed-by: {{ .Release.Service }}

-{{- end -}}

-

-{{- define "mirum.componentLabels" -}}

-{{ include "mirum.labels" .root }}

-app.kubernetes.io/component: {{ .component }}

-{{- end -}}

-

-{{- define "mirum.selectorLabels" -}}

-app.kubernetes.io/name: {{ include "mirum.name" .root }}

-app.kubernetes.io/instance: {{ .root.Release.Name }}

-app.kubernetes.io/component: {{ .component }}

-{{- end -}}

-

-{{- define "mirum.image" -}}

-{{- if .image.digest -}}

-{{- printf "%s@%s" .image.repository .image.digest -}}

-{{- else -}}

-{{- printf "%s:%s" .image.repository (default .root.Chart.AppVersion .image.tag) -}}

-{{- end -}}

-{{- end -}}

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-{{- if and .Values.server.enabled (ne (int .Values.server.replicaCount) 1) }}

-{{- fail "mirum: server.replicaCount must be 1 while the task queue is process-local" }}

-{{- end }}

-{{- if and .Values.server.enabled .Values.server.postgresqlMtls.enabled (not .Values.server.serviceAccountName) }}

-{{- fail "mirum: server.serviceAccountName is required when server.postgresqlMtls.enabled=true" }}

-{{- end }}

-{{- if .Values.server.enabled }}

-apiVersion: apps/v1

-kind: Deployment

-metadata:

- name: {{ include "mirum.fullname" . }}-server

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- replicas: {{ .Values.server.replicaCount }}

- strategy:

- type: Recreate

- selector:

- matchLabels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 6 }}

- template:

- metadata:

- annotations:

- {{- with .Values.server.podAnnotations }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- labels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 8 }}

- {{- with .Values.server.podLabels }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- spec:

- automountServiceAccountToken: false

- {{- with .Values.server.serviceAccountName }}

- serviceAccountName: {{ . | quote }}

- {{- end }}

- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}

- securityContext:

- runAsNonRoot: true

- runAsUser: 10000

- runAsGroup: 10000

- fsGroup: 10000

- fsGroupChangePolicy: OnRootMismatch

- {{- with .Values.imagePullSecrets }}

- imagePullSecrets:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- containers:

- - name: server

- image: {{ include "mirum.image" (dict "root" . "image" .Values.server.image) | quote }}

- imagePullPolicy: {{ .Values.server.image.pullPolicy }}

- args: ["daemon", "--config=/etc/mirum/secret/config.yaml"]

- securityContext:

- allowPrivilegeEscalation: false

- capabilities:

- drop: [ALL]

- readOnlyRootFilesystem: true

- ports:

- - name: web

- containerPort: {{ .Values.server.webPort }}

- - name: grpc

- containerPort: {{ .Values.server.grpcPort }}

- {{- with .Values.server.extraEnv }}

- env:

- {{- toYaml . | nindent 12 }}

- {{- end }}

- startupProbe:

- tcpSocket: { port: web }

- failureThreshold: 30

- periodSeconds: 2

- readinessProbe:

- tcpSocket: { port: web }

- livenessProbe:

- tcpSocket: { port: web }

- periodSeconds: 20

- resources:

- {{- toYaml .Values.server.resources | nindent 12 }}

- volumeMounts:

- - name: config

- mountPath: /etc/mirum/secret

- readOnly: true

- {{- with .Values.server.grpcTls.existingSecret }}

- - name: grpc-tls

- mountPath: /etc/mirum/grpc-tls

- readOnly: true

- {{- end }}

- {{- if .Values.server.postgresqlMtls.enabled }}

- - name: postgresql-tls

- mountPath: {{ .Values.server.postgresqlMtls.mountPath }}

- readOnly: true

- {{- end }}

- - name: run

- mountPath: /run/mirum-server

- volumes:

- - name: config

- secret:

- secretName: {{ .Values.server.existingSecret }}

- defaultMode: 0440

- {{- with .Values.server.grpcTls.existingSecret }}

- - name: grpc-tls

- secret:

- secretName: {{ . }}

- defaultMode: 0440

- {{- end }}

- {{- if .Values.server.postgresqlMtls.enabled }}

- - name: postgresql-tls

- csi:

- driver: csi.cert-manager.io

- readOnly: true

- volumeAttributes:

- csi.cert-manager.io/issuer-name: {{ required "mirum: server.postgresqlMtls.issuerName is required" .Values.server.postgresqlMtls.issuerName | quote }}

- csi.cert-manager.io/issuer-kind: {{ .Values.server.postgresqlMtls.issuerKind | quote }}

- csi.cert-manager.io/common-name: {{ required "mirum: server.postgresqlMtls.commonName is required" .Values.server.postgresqlMtls.commonName | quote }}

- csi.cert-manager.io/uri-sans: {{ .Values.server.postgresqlMtls.uriSan | quote }}

- csi.cert-manager.io/key-algorithm: "ECDSA"

- csi.cert-manager.io/key-size: "256"

- csi.cert-manager.io/key-encoding: "PKCS8"

- csi.cert-manager.io/key-usages: "digital signature,client auth"

- csi.cert-manager.io/duration: {{ .Values.server.postgresqlMtls.duration | quote }}

- csi.cert-manager.io/renew-before: {{ .Values.server.postgresqlMtls.renewBefore | quote }}

- csi.cert-manager.io/fs-group: {{ .Values.server.postgresqlMtls.fsGroup | quote }}

- {{- end }}

- - name: run

- emptyDir: {}

- {{- with .Values.server.nodeSelector }}

- nodeSelector:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.server.affinity }}

- affinity:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.server.tolerations }}

- tolerations:

- {{- toYaml . | nindent 8 }}

- {{- end }}

-{{- end }}

-

-# vim: set filetype=helm:

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-{{- if and .Values.server.enabled .Values.server.route.enabled }}

-apiVersion: gateway.networking.k8s.io/v1

-kind: HTTPRoute

-metadata:

- name: {{ include "mirum.fullname" . }}

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- {{- with .Values.server.route.parentRefs }}

- parentRefs:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- {{- with .Values.server.route.hostnames }}

- hostnames:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- rules:

- - backendRefs:

- - name: {{ include "mirum.fullname" . }}

- port: {{ .Values.server.webPort }}

-{{- end }}

-

-# vim: set filetype=helm:

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-{{- if .Values.server.enabled }}

-apiVersion: v1

-kind: Service

-metadata:

- name: {{ include "mirum.fullname" . }}

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- selector:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "server") | nindent 4 }}

- ports:

- - name: web

- port: {{ .Values.server.webPort }}

- targetPort: web

- - name: grpc

- port: {{ .Values.server.grpcPort }}

- targetPort: grpc

-{{- end }}

-

-# vim: set filetype=helm:

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-{{- if and .Values.server.enabled .Values.server.grpcRoute.enabled }}

-apiVersion: gateway.networking.k8s.io/v1

-kind: TCPRoute

-metadata:

- name: {{ include "mirum.fullname" . }}-grpc

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}

-spec:

- {{- with .Values.server.grpcRoute.parentRefs }}

- parentRefs:

- {{- toYaml . | nindent 4 }}

- {{- end }}

- rules:

- - backendRefs:

- - name: {{ include "mirum.fullname" . }}

- port: {{ .Values.server.grpcPort }}

-{{- end }}

-

-# vim: set filetype=helm:

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-{{- if .Values.worker.enabled }}

-apiVersion: apps/v1

-kind: Deployment

-metadata:

- name: {{ include "mirum.fullname" . }}-worker

- labels:

- {{- include "mirum.componentLabels" (dict "root" . "component" "worker") | nindent 4 }}

-spec:

- replicas: {{ .Values.worker.replicaCount }}

- selector:

- matchLabels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "worker") | nindent 6 }}

- template:

- metadata:

- annotations:

- {{- with .Values.worker.podAnnotations }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- labels:

- {{- include "mirum.selectorLabels" (dict "root" . "component" "worker") | nindent 8 }}

- {{- with .Values.worker.podLabels }}

- {{- toYaml . | nindent 8 }}

- {{- end }}

- spec:

- automountServiceAccountToken: false

- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}

- securityContext:

- runAsNonRoot: true

- runAsUser: 10000

- runAsGroup: 10000

- fsGroup: 10000

- fsGroupChangePolicy: OnRootMismatch

- {{- with .Values.imagePullSecrets }}

- imagePullSecrets:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- containers:

- - name: worker

- image: {{ include "mirum.image" (dict "root" . "image" .Values.worker.image) | quote }}

- imagePullPolicy: {{ .Values.worker.image.pullPolicy }}

- args: ["--config=/etc/mirum/secret/config.yaml"]

- securityContext:

- allowPrivilegeEscalation: false

- capabilities:

- drop: [ALL]

- readOnlyRootFilesystem: true

- {{- with .Values.worker.extraEnv }}

- env:

- {{- toYaml . | nindent 12 }}

- {{- end }}

- resources:

- {{- toYaml .Values.worker.resources | nindent 12 }}

- volumeMounts:

- - name: config

- mountPath: /etc/mirum/secret

- readOnly: true

- - name: workspace

- mountPath: /var/lib/mirum-worker

- - name: tmp

- mountPath: /tmp

- volumes:

- - name: config

- secret:

- secretName: {{ .Values.worker.existingSecret }}

- defaultMode: 0440

- - name: workspace

- emptyDir: {}

- - name: tmp

- emptyDir: {}

- {{- with .Values.worker.nodeSelector }}

- nodeSelector:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.worker.affinity }}

- affinity:

- {{- toYaml . | nindent 8 }}

- {{- end }}

- {{- with .Values.worker.tolerations }}

- tolerations:

- {{- toYaml . | nindent 8 }}

- {{- end }}

-{{- end }}

-

-# vim: set filetype=helm:

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-imagePullSecrets: []

-nameOverride: ""

-fullnameOverride: ""

-

-server:

- enabled: true

- replicaCount: 1

- image:

- repository: ghcr.io/dimidiumlabs/mirum-server

- tag: ""

- digest: ""

- pullPolicy: IfNotPresent

- # Must contain config.yaml and any private files other than the gRPC

- # certificate. Keep database_uri, pepper, token, and webhook_secret in this

- # Secret rather than Helm values.

- existingSecret: mirum-server

- # Optional existing ServiceAccount used by the server. The default empty

- # value preserves the current Deployment and external database path.

- serviceAccountName: ""

- postgresqlMtls:

- # Opt-in client-certificate mount for passwordless PostgreSQL mTLS. Disabled

- # by default; no CSI resources or volume mounts are rendered unless enabled.

- enabled: false

- mountPath: /etc/mirum/postgresql-tls

- issuerName: ""

- issuerKind: ClusterIssuer

- commonName: ""

- uriSan: "spiffe://ddlabs.internal/ns/${POD_NAMESPACE}/sa/${SERVICE_ACCOUNT_NAME}/pod/${POD_UID}"

- duration: 2160h

- renewBefore: 360h

- fsGroup: 10000

- grpcTls:

- # Optional cert-manager-style Secret containing tls.crt and tls.key. The

- # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference.

- existingSecret: ""

- webPort: 3000

- grpcPort: 2000

- route:

- enabled: false

- hostnames: []

- parentRefs: []

- grpcRoute:

- enabled: false

- parentRefs: []

- resources: {}

- extraEnv: []

- podAnnotations: {}

- podLabels: {}

- nodeSelector: {}

- tolerations: []

- affinity: {}

-

-worker:

- enabled: false

- replicaCount: 1

- image:

- repository: ghcr.io/dimidiumlabs/mirum-worker

- tag: ""

- digest: ""

- pullPolicy: IfNotPresent

- # Must contain config.yaml, the Ed25519 key referenced by key_file, and an

- # optional CA file referenced by tls_ca.

- existingSecret: mirum-worker

- resources: {}

- extraEnv: []

- podAnnotations: {}

- podLabels: {}

- nodeSelector: {}

- tolerations: []

- affinity: {}

-

-terminationGracePeriodSeconds: 40

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-const std = @import("std");

-

-pub fn build(b: *std.Build) void {

- const target = b.standardTargetOptions(.{

- .default_target = .{ .abi = .musl },

- });

- const optimize = b.standardOptimizeOption(.{});

-

- const strip = b.option(bool, "strip", "Strip debug info from the agent binary") orelse false;

-

- // Strict flags for our own C. Unity is compiled separately, without

- // them — a third-party header should not have to satisfy our lint.

- const cflags: []const []const u8 = &.{

- "-std=c99",

- "-Wall",

- "-Wextra",

- "-Wconversion",

- "-Wshadow",

- "-Wstrict-prototypes",

- };

-

- // libmirum-agent: the agent logic, compiled once and exposed only

- // through mirum-agent.h. Both the executable and the tests link it.

- const lib = b.addLibrary(.{

- .name = "mirum-agent",

- .linkage = .static,

- .root_module = b.createModule(.{

- .target = target,

- .optimize = optimize,

- .strip = strip,

- .link_libc = true,

- .link_libcpp = false,

- }),

- });

- lib.root_module.addIncludePath(b.path(""));

- lib.root_module.addCSourceFile(.{

- .file = b.path("mirum-agent.c"),

- .flags = cflags,

- });

-

- // mirum-agent: the executable entry point, links the library.

- const exe = b.addExecutable(.{

- .name = "mirum-agent",

- .root_module = b.createModule(.{

- .target = target,

- .optimize = optimize,

- .strip = strip,

- .link_libc = true,

- .link_libcpp = false,

- }),

- });

- exe.root_module.addIncludePath(b.path(""));

- exe.root_module.addCSourceFile(.{

- .file = b.path("main.c"),

- .flags = cflags,

- });

- exe.root_module.linkLibrary(lib);

-

- b.installArtifact(exe);

-

- const run_cmd = b.addRunArtifact(exe);

- run_cmd.step.dependOn(b.getInstallStep());

- if (b.args) |args| run_cmd.addArgs(args);

-

- const run_step = b.step("run", "Run the agent");

- run_step.dependOn(&run_cmd.step);

-

- // Unity: built as its own library so its sources never see our flags.

- const unity_dep = b.dependency("unity", .{});

- const unity = b.addLibrary(.{

- .name = "unity",

- .linkage = .static,

- .root_module = b.createModule(.{

- .target = target,

- .optimize = optimize,

- .link_libc = true,

- .link_libcpp = false,

- }),

- });

- unity.root_module.addIncludePath(unity_dep.path("src"));

- unity.root_module.addCSourceFile(.{

- .file = unity_dep.path("src/unity.c"),

- });

-

- // test: links libmirum-agent through its public header only — the

- // agent sources are never recompiled into the test binary. Unity's

- // headers go on the system path so they bypass our warnings.

- const exe_tests = b.addExecutable(.{

- .name = "test",

- .root_module = b.createModule(.{

- .target = target,

- .optimize = optimize,

- .link_libc = true,

- .link_libcpp = false,

- }),

- });

- exe_tests.root_module.addIncludePath(b.path(""));

- exe_tests.root_module.addSystemIncludePath(unity_dep.path("src"));

- exe_tests.root_module.addCSourceFile(.{

- .file = b.path("test.c"),

- .flags = cflags,

- });

- exe_tests.root_module.linkLibrary(lib);

- exe_tests.root_module.linkLibrary(unity);

-

- const run_exe_tests = b.addRunArtifact(exe_tests);

-

- const test_step = b.step("test", "Run tests");

- test_step.dependOn(&run_exe_tests.step);

-}

-.{

- .name = .agent,

- .version = "0.0.0",

- .fingerprint = 0x268b9c9d6e24fb9b, // Changing this has security and trust implications.

- .minimum_zig_version = "0.16.0", // keep in sync with github actions

- .dependencies = .{

- .unity = .{

- .url = "https://github.com/ThrowTheSwitch/Unity/archive/refs/tags/v2.6.1.tar.gz",

- .hash = "N-V-__8AAAQfEgAjW551lOzfHoVAve6KndztgTjCXsJvElP9",

- },

- },

- .paths = .{

- "build.zig", "build.zig.zon",

- "test.c", "main.c",

- "mirum-agent.c", "mirum-agent.h",

- },

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-#include "mirum-agent.h"

-

-int main(int argc, const char *argv[]) {

- mirum_init();

-

- return 0;

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-#include <stdio.h>

-

-#include "mirum-agent.h"

-

-void mirum_init(void) {

- printf("This is %s\n", "mirum-agent");

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-#ifndef MIRUM_AGENT_H

-#define MIRUM_AGENT_H

-

-void mirum_init(void);

-

-#endif // MIRUM_AGENT_H

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-#include "unity.h"

-

-#include "mirum-agent.h"

-

-void setUp(void) {}

-void tearDown(void) {}

-

-// Smoke test: the public entry point links and runs without crashing.

-// Substantive suites (TLV decode, channel state machine) land with that

-// code, exercising mirum-agent.h the same way.

-static void test_mirum_init_runs(void) {

- mirum_init();

-}

-

-int main(void) {

- UNITY_BEGIN();

- RUN_TEST(test_mirum_init_runs);

- return UNITY_END();

-}

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-FROM gcr.io/distroless/static-debian13:nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7

-

-ARG TARGETARCH

-

-LABEL org.opencontainers.image.source="https://github.com/dimidiumlabs/mirum" \

- org.opencontainers.image.licenses="AGPL-3.0-or-later" \

- org.opencontainers.image.title="mirum-server"

-

-COPY --chown=root:root --chmod=0755 .container/mirum-server-linux-${TARGETARCH} /usr/local/bin/mirum-server

-COPY LICENSE README.md /usr/share/doc/mirum/

-

-USER 10000:10000

-EXPOSE 3000 2000

-ENTRYPOINT ["/usr/local/bin/mirum-server"]

-CMD ["daemon", "--config=/etc/mirum/config.yaml"]

-

-# syntax=docker/dockerfile:

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "errors"

- "slices"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb"

-

- "github.com/google/uuid"

- "github.com/jackc/pgx/v5"

-)

-

-var (

- ErrPermissionDenied = errors.New("database: permission denied")

- ErrUnauthenticated = errors.New("database: authentication required")

-)

-

-var anonPermissions = []apipb.Perm{

- apipb.Perm_PERM_ORG_READ,

-}

-

-var userGlobalPermissions = []apipb.Perm{

- apipb.Perm_PERM_ORG_READ,

- apipb.Perm_PERM_ORG_WRITE,

- apipb.Perm_PERM_USER_READ,

-}

-

-// rolePermissions is the single source of truth for role → perm bundles.

-// RLS checks only tenancy (membership); action authz lives here.

-var rolePermissions = map[string][]apipb.Perm{

- "owner": {

- apipb.Perm_PERM_ORG_READ,

- apipb.Perm_PERM_ORG_WRITE,

- apipb.Perm_PERM_ORG_DELETE,

- apipb.Perm_PERM_ORG_MEMBER_READ,

- apipb.Perm_PERM_ORG_MEMBER_WRITE,

- apipb.Perm_PERM_WORKER_READ,

- apipb.Perm_PERM_WORKER_WRITE,

- },

- "admin": {

- apipb.Perm_PERM_ORG_READ,

- apipb.Perm_PERM_ORG_WRITE,

- apipb.Perm_PERM_ORG_MEMBER_READ,

- apipb.Perm_PERM_ORG_MEMBER_WRITE,

- apipb.Perm_PERM_WORKER_READ,

- apipb.Perm_PERM_WORKER_WRITE,

- },

- "member": {

- apipb.Perm_PERM_ORG_READ,

- apipb.Perm_PERM_ORG_MEMBER_READ,

- apipb.Perm_PERM_WORKER_READ,

- },

-}

-

-// Actor is the principal making a database request. It carries identity,

-// display metadata, and coarse capability. Zero value is invalid: dbID

-// panics, so a missing initialisation cannot silently grant privileges.

-//

-// Synthetic actors (System/Operator/Anon) live only as Go constants —

-// they are not rows in the users table, so they cannot be logged in as

-// even if somebody writes a password into the DB.

-//

-// Authorization is divided into two planes:

-// - Tenancy: an actor can only see a subset of resources to which

-// they have access (public or through organization membership).

-// Any select statement will return only records accessible to the actor.

-// - RBAC: what the actor can do with records (create/read/write) is implemented here.

-// Any rights we grant here are a strict subset of the Tenancy rights.

-// The list of perms can be either explicit (for tokens) or implied (for user roles).

-type Actor struct {

- kind actorKind

- id uuid.UUID

- email string

- superuser bool

-}

-

-type actorKind uint8

-

-const (

- actorInvalid actorKind = iota

- actorUser

- actorOperator

- actorSystem

- actorAnon

-)

-

-// ActorKind is the exported form of actorKind for audit sinks and logging.

-type ActorKind uint8

-

-const (

- KindInvalid ActorKind = iota

- KindUser

- KindOperator

- KindSystem

- KindAnon

-)

-

-var (

- anonUUID = uuid.MustParse("ffffffff-ffff-ffff-ffff-ffffffffffff")

- systemUUID = uuid.MustParse("00000000-0000-0000-0000-000000000001")

- operatorUUID = uuid.MustParse("00000000-0000-0000-0000-000000000002")

-)

-

-// UserActor identifies an authenticated user from a session or token.

-func UserActor(id UserID, email string, superuser bool) Actor {

- if id.IsZero() {

- panic("database: UserActor with nil UUID")

- }

- if email == "" {

- panic("database: UserActor with empty email")

- }

- return Actor{kind: actorUser, id: id.UUID(), email: email, superuser: superuser}

-}

-

-// OperatorActor is the principal for externally invoked privileged

-// operations (admin socket). Distinguishable from System in audit logs.

-func OperatorActor() Actor {

- return Actor{kind: actorOperator, id: operatorUUID, email: "operator@mirum.local", superuser: true}

-}

-

-// SystemActor is the principal for internal machinery (mTLS handshake,

-// session bootstrap, background jobs). Not an operator action.

-func SystemActor() Actor {

- return Actor{kind: actorSystem, id: systemUUID, email: "system@mirum.local", superuser: true}

-}

-

-// AnonActor is the principal for unauthenticated public requests.

-func AnonActor() Actor {

- return Actor{kind: actorAnon, id: anonUUID, email: "anonymous@mirum.local"}

-}

-

-func (a Actor) Kind() ActorKind {

- switch a.kind {

- case actorUser:

- return KindUser

- case actorOperator:

- return KindOperator

- case actorSystem:

- return KindSystem

- case actorAnon:

- return KindAnon

- }

- return KindInvalid

-}

-

-func (a Actor) UserID() UserID { return UserID(a.id) }

-func (a Actor) Email() string { return a.email }

-func (a Actor) IsSuperuser() bool { return a.superuser }

-

-// dbID returns the UUID to write into app.user_id. Panics on zero value.

-func (a Actor) dbID() uuid.UUID {

- if a.id == uuid.Nil {

- panic("database: zero-value Actor; use UserActor/SystemActor/OperatorActor/AnonActor")

- }

- return a.id

-}

-

-// kindString returns the string written into app.actor_kind.

-// It must match the values tested by app_issuper() in the SQL migration.

-func (a Actor) kindString() string {

- switch a.kind {

- case actorUser:

- return "user"

- case actorOperator:

- return "operator"

- case actorSystem:

- return "system"

- case actorAnon:

- return "anon"

- }

- panic("database: zero-value Actor; use UserActor/SystemActor/OperatorActor/AnonActor")

-}

-

-// checkGlobal checks a global-scope perm (no specific org). Pure, no DB.

-func checkGlobal(actor Actor, perm apipb.Perm) error {

- switch actor.kind {

- case actorOperator, actorSystem:

- return nil

- case actorAnon:

- if slices.Contains(anonPermissions, perm) {

- return nil

- }

- return ErrUnauthenticated

- case actorUser:

- if actor.superuser {

- return nil

- }

- if slices.Contains(userGlobalPermissions, perm) {

- return nil

- }

- return ErrPermissionDenied

- default:

- return ErrPermissionDenied

- }

-}

-

-// checkPerm checks an org-scoped perm within an existing transaction.

-func checkPerm(ctx context.Context, tx pgx.Tx, actor Actor, orgID OrgID, perm apipb.Perm) error {

- switch actor.kind {

- case actorOperator, actorSystem:

- return nil

- case actorAnon:

- return ErrUnauthenticated

- case actorUser:

- if actor.superuser {

- return nil

- }

- var role string

- err := tx.QueryRow(ctx,

- `SELECT role FROM org_members WHERE org_id = $1 AND user_id = $2`,

- orgID, actor.id,

- ).Scan(&role)

- if err != nil {

- return ErrPermissionDenied

- }

- if !slices.Contains(rolePermissions[role], perm) {

- return ErrPermissionDenied

- }

- return nil

- default:

- return ErrPermissionDenied

- }

-}

-

-// checkSystem checks that actor is the internal system principal.

-func checkSystem(actor Actor) error {

- if actor.kind == actorSystem {

- return nil

- }

- return ErrPermissionDenied

-}

-

-// checkSelf checks that actor is the target user or superuser.

-func checkSelf(actor Actor, targetID UserID) error {

- switch actor.kind {

- case actorOperator, actorSystem:

- return nil

- case actorAnon:

- return ErrUnauthenticated

- case actorUser:

- if actor.superuser || targetID == actor.UserID() {

- return nil

- }

- return ErrPermissionDenied

- default:

- return ErrPermissionDenied

- }

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-// Console CLI is generated from api.proto at startup via protoreflect.

-// RPC name is camelCase-split into a cobra path: UserCreate -> "user create",

-// OrgMemberAdd -> "org member add". Flags come from request fields, dispatch

-// goes through reflect on apipbconnect.ConsoleClient.

-

-import (

- "context"

- "crypto/ed25519"

- "crypto/x509"

- "encoding/base64"

- "fmt"

- "os"

- "reflect"

- "strings"

- "unicode"

-

- "github.com/spf13/cobra"

- "github.com/spf13/pflag"

- "google.golang.org/protobuf/proto"

- "google.golang.org/protobuf/reflect/protoreflect"

- "google.golang.org/protobuf/reflect/protoregistry"

- "google.golang.org/protobuf/types/known/timestamppb"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb"

- "dimidiumlabs/mirum/cmd/mirum-server/apipb/apipbconnect"

-)

-

-// mkClient is called per-invocation so persistent flags (e.g. --socket) are

-// already parsed by the time it runs.

-func buildConsoleCLI(root *cobra.Command, mkClient func() apipbconnect.ConsoleClient) {

- methods := apipb.File_api_proto.Services().ByName("Console").Methods()

- for i := 0; i < methods.Len(); i++ {

- md := methods.Get(i)

- path := splitCamel(string(md.Name()))

- parent := ensureGroups(root, path[:len(path)-1])

- parent.AddCommand(buildMethodCmd(md, path[len(path)-1], mkClient))

- }

-}

-

-// "OrgMemberAdd" -> ["org","member","add"].

-func splitCamel(s string) []string {

- var parts []string

- start := 0

- for i := 1; i < len(s); i++ {

- if unicode.IsUpper(rune(s[i])) {

- parts = append(parts, strings.ToLower(s[start:i]))

- start = i

- }

- }

- return append(parts, strings.ToLower(s[start:]))

-}

-

-func ensureGroups(root *cobra.Command, path []string) *cobra.Command {

- parent := root

- for _, name := range path {

- var next *cobra.Command

- for _, c := range parent.Commands() {

- if c.Name() == name {

- next = c

- break

- }

- }

- if next == nil {

- next = &cobra.Command{Use: name, Short: "Manage " + name}

- parent.AddCommand(next)

- }

- parent = next

- }

- return parent

-}

-

-// fieldSetter writes one flag value into the request message.

-type fieldSetter func(*pflag.FlagSet, protoreflect.Message) error

-

-func buildMethodCmd(md protoreflect.MethodDescriptor, leaf string, mkClient func() apipbconnect.ConsoleClient) *cobra.Command {

- reqDesc := md.Input()

- rpcName := string(md.Name())

- cmd := &cobra.Command{

- Use: leaf,

- Short: rpcName,

- }

- setters := registerRequestFlags(cmd, reqDesc)

- cmd.Run = func(c *cobra.Command, _ []string) {

- req, err := buildRequest(reqDesc, c.Flags(), setters)

- if err != nil {

- fmt.Fprintln(os.Stderr, err)

- os.Exit(1)

- }

- resp, err := dispatchConsole(mkClient(), rpcName, req)

- if err != nil {

- fmt.Fprintln(os.Stderr, err)

- os.Exit(1)

- }

- printResponse(resp)

- }

- return cmd

-}

-

-func registerRequestFlags(cmd *cobra.Command, desc protoreflect.MessageDescriptor) []fieldSetter {

- var setters []fieldSetter

- fields := desc.Fields()

- for i := 0; i < fields.Len(); i++ {

- if s := registerField(cmd, fields.Get(i)); s != nil {

- setters = append(setters, s)

- }

- }

- return setters

-}

-

-func registerField(cmd *cobra.Command, fd protoreflect.FieldDescriptor) fieldSetter {

- flagName := strings.ReplaceAll(string(fd.Name()), "_", "-")

- // Required iff non-optional in the schema; bools default to false, so

- // marking them required makes no sense.

- required := !fd.HasOptionalKeyword() && fd.Kind() != protoreflect.BoolKind

- flags := cmd.Flags()

-

- markRequired := func() {

- if required {

- _ = cmd.MarkFlagRequired(flagName)

- }

- }

-

- switch fd.Kind() {

- case protoreflect.StringKind:

- flags.String(flagName, "", string(fd.Name()))

- markRequired()

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- v, _ := fs.GetString(flagName)

- if v == "" {

- return nil

- }

- m.Set(fd, protoreflect.ValueOfString(v))

- return nil

- }

-

- case protoreflect.BoolKind:

- flags.Bool(flagName, false, string(fd.Name()))

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- // Preserve "unset" vs "false" for optional bools.

- if fd.HasOptionalKeyword() && !fs.Changed(flagName) {

- return nil

- }

- v, _ := fs.GetBool(flagName)

- m.Set(fd, protoreflect.ValueOfBool(v))

- return nil

- }

-

- case protoreflect.BytesKind:

- flags.String(flagName, "", string(fd.Name()))

- markRequired()

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- v, _ := fs.GetString(flagName)

- if v == "" {

- return nil

- }

- b, err := parseBytesFlag(string(fd.Name()), v)

- if err != nil {

- return fmt.Errorf("--%s: %w", flagName, err)

- }

- m.Set(fd, protoreflect.ValueOfBytes(b))

- return nil

- }

-

- case protoreflect.EnumKind:

- flags.String(flagName, "", string(fd.Name()))

- markRequired()

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- v, _ := fs.GetString(flagName)

- if v == "" {

- return nil

- }

- n, err := parseEnumFlag(fd.Enum(), v)

- if err != nil {

- return fmt.Errorf("--%s: %w", flagName, err)

- }

- m.Set(fd, protoreflect.ValueOfEnum(n))

- return nil

- }

-

- case protoreflect.MessageKind:

- return registerMessageField(cmd, fd, flagName, required)

- }

-

- if required {

- panic(fmt.Sprintf("consolecli: unhandled required field %s (kind=%s)", fd.FullName(), fd.Kind()))

- }

- return nil

-}

-

-// Only UserRef/OrgRef are flattened (to the string arm of their oneof);

-// PageRequest is skipped; anything else required panics at startup so

-// schema changes can't silently send malformed requests.

-func registerMessageField(cmd *cobra.Command, fd protoreflect.FieldDescriptor, flagName string, required bool) fieldSetter {

- flags := cmd.Flags()

- markRequired := func() {

- if required {

- _ = cmd.MarkFlagRequired(flagName)

- }

- }

-

- switch fd.Message().FullName() {

- case "mirum.api.UserRef":

- flags.String(flagName, "", "user email")

- markRequired()

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- v, _ := fs.GetString(flagName)

- if v == "" {

- return nil

- }

- ref := &apipb.UserRef{Ref: &apipb.UserRef_Email{Email: v}}

- m.Set(fd, protoreflect.ValueOfMessage(ref.ProtoReflect()))

- return nil

- }

-

- case "mirum.api.OrgRef":

- flags.String(flagName, "", "org slug")

- markRequired()

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- v, _ := fs.GetString(flagName)

- if v == "" {

- return nil

- }

- ref := &apipb.OrgRef{Ref: &apipb.OrgRef_Slug{Slug: v}}

- m.Set(fd, protoreflect.ValueOfMessage(ref.ProtoReflect()))

- return nil

- }

-

- case "mirum.api.PageRequest":

- return nil

-

- case "mirum.api.Locale":

- langFlag := flagName + "-language"

- dfFlag := flagName + "-date-format"

- flags.String(langFlag, "", "locale language (e.g. en)")

- flags.String(dfFlag, "", "date format (DMY, MDY, YMD)")

- return func(fs *pflag.FlagSet, m protoreflect.Message) error {

- lang, _ := fs.GetString(langFlag)

- dfStr, _ := fs.GetString(dfFlag)

- if lang == "" && dfStr == "" {

- return nil

- }

- loc := &apipb.Locale{}

- if lang != "" {

- loc.Language = &lang

- }

- if dfStr != "" {

- want := strings.ToUpper(dfStr)

- enumVals := loc.ProtoReflect().Descriptor().Fields().ByName("date_format").Enum().Values()

- var n protoreflect.EnumNumber

- var found bool

- for i := 0; i < enumVals.Len(); i++ {

- ev := enumVals.Get(i)

- name := string(ev.Name())

- if idx := strings.LastIndexByte(name, '_'); idx >= 0 && strings.ToUpper(name[idx+1:]) == want {

- n = ev.Number()

- found = true

- break

- }

- }

- if !found {

- return fmt.Errorf("--%s: unknown value %q (valid: DMY, MDY, YMD)", dfFlag, dfStr)

- }

- df := apipb.DateFormat(n)

- loc.DateFormat = &df

- }

- m.Set(fd, protoreflect.ValueOfMessage(loc.ProtoReflect()))

- return nil

- }

- }

-

- if required {

- panic(fmt.Sprintf("consolecli: unhandled required message field %s (type=%s)", fd.FullName(), fd.Message().FullName()))

- }

- return nil

-}

-

-// Console schema uses bytes only for UUIDs (id / *_id) and ed25519 PKIX keys.

-func parseBytesFlag(fieldName, v string) ([]byte, error) {

- switch {

- case fieldName == "id" || strings.HasSuffix(fieldName, "_id"):

- id, err := ParseAnyID(v)

- if err != nil {

- return nil, fmt.Errorf("invalid id: %w", err)

- }

- return id[:], nil

- case strings.Contains(fieldName, "key"):

- der, err := base64.StdEncoding.DecodeString(v)

- if err != nil {

- return nil, fmt.Errorf("invalid base64: %w", err)

- }

- pub, err := x509.ParsePKIXPublicKey(der)

- if err != nil {

- return nil, fmt.Errorf("invalid public key: %w", err)

- }

- ed, ok := pub.(ed25519.PublicKey)

- if !ok {

- return nil, fmt.Errorf("not an ed25519 key")

- }

- return ed, nil

- }

- return nil, fmt.Errorf("unsupported bytes field %q", fieldName)

-}

-

-// Accepts both short ("admin") and full ("ROLE_ADMIN") forms.

-func parseEnumFlag(ed protoreflect.EnumDescriptor, v string) (protoreflect.EnumNumber, error) {

- want := strings.ToUpper(v)

- values := ed.Values()

- if ev := values.ByName(protoreflect.Name(want)); ev != nil {

- return ev.Number(), nil

- }

- prefix := strings.ToUpper(string(ed.Name())) + "_"

- if ev := values.ByName(protoreflect.Name(prefix + want)); ev != nil {

- return ev.Number(), nil

- }

- return 0, fmt.Errorf("unknown %s value %q", ed.Name(), v)

-}

-

-func buildRequest(desc protoreflect.MessageDescriptor, flags *pflag.FlagSet, setters []fieldSetter) (proto.Message, error) {

- mt, err := protoregistry.GlobalTypes.FindMessageByName(desc.FullName())

- if err != nil {

- return nil, fmt.Errorf("find message %s: %w", desc.FullName(), err)

- }

- m := mt.New()

- for _, set := range setters {

- if err := set(flags, m); err != nil {

- return nil, err

- }

- }

- return m.Interface(), nil

-}

-

-// reflect.New on *connect.Request[T] is equivalent to connect.NewRequest(req):

-// Msg is the only public field, the rest are initialised lazily at send time.

-func dispatchConsole(client apipbconnect.ConsoleClient, name string, req proto.Message) (proto.Message, error) {

- cv := reflect.ValueOf(client)

- method := cv.MethodByName(name)

- if !method.IsValid() {

- return nil, fmt.Errorf("unknown console method %q", name)

- }

- // method signature:

- // func(context.Context, *connect.Request[T]) (*connect.Response[U], error)

- reqPtrType := method.Type().In(1) // *connect.Request[T]

- reqWrap := reflect.New(reqPtrType.Elem())

- reqWrap.Elem().FieldByName("Msg").Set(reflect.ValueOf(req))

-

- out := method.Call([]reflect.Value{

- reflect.ValueOf(context.Background()),

- reqWrap,

- })

- if errV := out[1]; !errV.IsNil() {

- return nil, errV.Interface().(error)

- }

- return out[0].Elem().FieldByName("Msg").Interface().(proto.Message), nil

-}

-

-// Shape-driven printer: empty → "ok", single bytes id → UUID, single message

-// → TSV of scalars, repeated → one TSV line per element, anything else → TSV

-// of top-level scalars. PageResponse metadata is ignored.

-func printResponse(resp proto.Message) {

- m := resp.ProtoReflect()

- fields := m.Descriptor().Fields()

-

- var meaningful []protoreflect.FieldDescriptor

- for i := 0; i < fields.Len(); i++ {

- f := fields.Get(i)

- if f.Kind() == protoreflect.MessageKind && f.Message().FullName() == "mirum.api.PageResponse" {

- continue

- }

- meaningful = append(meaningful, f)

- }

-

- if len(meaningful) == 0 {

- fmt.Println("ok")

- return

- }

- if len(meaningful) == 1 {

- f := meaningful[0]

- v := m.Get(f)

- switch {

- case f.IsList():

- list := v.List()

- for j := 0; j < list.Len(); j++ {

- item := list.Get(j)

- if f.Kind() == protoreflect.MessageKind {

- fmt.Println(formatMessageTSV(item.Message()))

- } else {

- fmt.Println(formatScalar(f, item))

- }

- }

- case f.Kind() == protoreflect.MessageKind:

- fmt.Println(formatMessageTSV(v.Message()))

- default:

- fmt.Println(formatScalar(f, v))

- }

- return

- }

- fmt.Println(formatMessageTSV(m))

-}

-

-func formatMessageTSV(m protoreflect.Message) string {

- var parts []string

- fields := m.Descriptor().Fields()

- for i := 0; i < fields.Len(); i++ {

- f := fields.Get(i)

- if f.IsList() || f.IsMap() {

- continue

- }

- if f.HasOptionalKeyword() && !m.Has(f) {

- continue

- }

- if f.Kind() == protoreflect.MessageKind {

- if f.Message().FullName() == "google.protobuf.Timestamp" {

- ts := m.Get(f).Message().Interface().(*timestamppb.Timestamp)

- parts = append(parts, ts.AsTime().Format("2006-01-02"))

- continue

- }

- nested := m.Get(f).Message()

- if nested.IsValid() {

- parts = append(parts, formatMessageTSV(nested))

- }

- continue

- }

- parts = append(parts, formatScalar(f, m.Get(f)))

- }

- return strings.Join(parts, "\t")

-}

-

-func formatScalar(fd protoreflect.FieldDescriptor, v protoreflect.Value) string {

- switch fd.Kind() {

- case protoreflect.StringKind:

- return v.String()

- case protoreflect.BoolKind:

- if v.Bool() {

- return "true"

- }

- return "false"

- case protoreflect.BytesKind:

- return formatBytes(v.Bytes())

- case protoreflect.EnumKind:

- ev := fd.Enum().Values().ByNumber(v.Enum())

- if ev == nil {

- return fmt.Sprintf("%d", v.Enum())

- }

- name := string(ev.Name())

- if idx := strings.IndexByte(name, '_'); idx >= 0 {

- name = name[idx+1:]

- }

- return strings.ToLower(name)

- }

- return v.String()

-}

-

-func formatBytes(b []byte) string {

- if len(b) == 16 {

- return FormatAnyID(b)

- }

- return base64.StdEncoding.EncodeToString(b)

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "crypto/tls"

- "log/slog"

- "os"

- "sync"

- "time"

-)

-

-// certReloader serves a TLS cert/key pair and reloads it when either file

-// changes on disk (e.g. after a letsencrypt renewal).

-type certReloader struct {

- certFile string

- keyFile string

-

- mu sync.Mutex

- cert *tls.Certificate

- certMod time.Time

- keyMod time.Time

-}

-

-func newCertReloader(certFile, keyFile string) *certReloader {

- r := &certReloader{certFile: certFile, keyFile: keyFile}

- if _, err := r.GetCertificate(nil); err != nil {

- slog.Warn("initial cert load failed", "cert", certFile, "err", err)

- }

- return r

-}

-

-// GetCertificate plugs into tls.Config.GetCertificate. On a transient

-// reload error it returns the last good pair so a mid-renewal race

-// (cert swapped but key still being written) doesn't break handshakes.

-func (r *certReloader) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error) {

- cs, cerr := os.Stat(r.certFile)

- ks, kerr := os.Stat(r.keyFile)

-

- r.mu.Lock()

- defer r.mu.Unlock()

-

- if cerr == nil && kerr == nil && r.cert != nil &&

- cs.ModTime().Equal(r.certMod) && ks.ModTime().Equal(r.keyMod) {

- return r.cert, nil

- }

-

- cert, err := tls.LoadX509KeyPair(r.certFile, r.keyFile)

- if err != nil {

- if r.cert != nil {

- slog.Warn("cert reload failed, serving cached", "cert", r.certFile, "err", err)

- return r.cert, nil

- }

- return nil, err

- }

-

- r.cert = &cert

- if cerr == nil {

- r.certMod = cs.ModTime()

- }

- if kerr == nil {

- r.keyMod = ks.ModTime()

- }

- slog.Info("cert loaded", "cert", r.certFile)

- return r.cert, nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "crypto/ed25519"

- "crypto/rand"

- "crypto/x509"

- "encoding/pem"

- "math/big"

- "os"

- "path/filepath"

- "testing"

- "time"

-)

-

-func writeTestPair(t *testing.T, certPath, keyPath string) {

- t.Helper()

-

- pub, priv, err := ed25519.GenerateKey(rand.Reader)

- if err != nil {

- t.Fatal(err)

- }

-

- serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))

- if err != nil {

- t.Fatal(err)

- }

-

- der, err := x509.CreateCertificate(rand.Reader, &x509.Certificate{

- SerialNumber: serial,

- NotBefore: time.Now(),

- NotAfter: time.Now().Add(time.Hour),

- }, &x509.Certificate{SerialNumber: serial}, pub, priv)

- if err != nil {

- t.Fatal(err)

- }

-

- if err := os.WriteFile(certPath,

- pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}),

- 0o644); err != nil {

- t.Fatal(err)

- }

-

- keyDER, err := x509.MarshalPKCS8PrivateKey(priv)

- if err != nil {

- t.Fatal(err)

- }

- if err := os.WriteFile(keyPath,

- pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}),

- 0o600); err != nil {

- t.Fatal(err)

- }

-}

-

-func TestCertReloader_Cached(t *testing.T) {

- dir := t.TempDir()

- certPath := filepath.Join(dir, "cert.pem")

- keyPath := filepath.Join(dir, "key.pem")

- writeTestPair(t, certPath, keyPath)

-

- r := newCertReloader(certPath, keyPath)

-

- first, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatal(err)

- }

- second, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatal(err)

- }

- if first != second {

- t.Fatal("expected same pointer on cache hit")

- }

-}

-

-func TestCertReloader_ReloadsOnMtimeChange(t *testing.T) {

- dir := t.TempDir()

- certPath := filepath.Join(dir, "cert.pem")

- keyPath := filepath.Join(dir, "key.pem")

- writeTestPair(t, certPath, keyPath)

-

- r := newCertReloader(certPath, keyPath)

- first, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatal(err)

- }

-

- writeTestPair(t, certPath, keyPath)

- future := time.Now().Add(time.Second)

- if err := os.Chtimes(certPath, future, future); err != nil {

- t.Fatal(err)

- }

- if err := os.Chtimes(keyPath, future, future); err != nil {

- t.Fatal(err)

- }

-

- second, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatal(err)

- }

- if first == second {

- t.Fatal("expected new pointer after mtime change")

- }

-}

-

-func TestCertReloader_FallbackOnReloadError(t *testing.T) {

- dir := t.TempDir()

- certPath := filepath.Join(dir, "cert.pem")

- keyPath := filepath.Join(dir, "key.pem")

- writeTestPair(t, certPath, keyPath)

-

- r := newCertReloader(certPath, keyPath)

- good, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatal(err)

- }

-

- if err := os.WriteFile(certPath, []byte("garbage"), 0o644); err != nil {

- t.Fatal(err)

- }

- future := time.Now().Add(time.Second)

- if err := os.Chtimes(certPath, future, future); err != nil {

- t.Fatal(err)

- }

-

- fallback, err := r.GetCertificate(nil)

- if err != nil {

- t.Fatalf("expected last-good fallback, got error: %v", err)

- }

- if fallback != good {

- t.Fatal("expected cached cert on corrupted file")

- }

-}

-

-func TestCertReloader_ErrorOnFirstLoad(t *testing.T) {

- r := newCertReloader("/nonexistent/cert.pem", "/nonexistent/key.pem")

- if _, err := r.GetCertificate(nil); err == nil {

- t.Fatal("expected error on missing files")

- }

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "fmt"

- "os"

-

- "gopkg.in/yaml.v3"

-)

-

-type tlsConfig struct {

- Cert string `yaml:"cert"`

- Key string `yaml:"key"`

-}

-

-type appConfig struct {

- WebAddr string `yaml:"web_addr"`

- GrpcAddr string `yaml:"grpc_addr"`

- AdminSocket string `yaml:"admin_socket"`

- DatabaseUri string `yaml:"database_uri"`

- Pepper string `yaml:"pepper"`

-

- GrpcTls tlsConfig `yaml:"grpc_tls"`

- WebTls *tlsConfig `yaml:"web_tls"` // optional

-

- TrustedProxies []string `yaml:"trusted_proxies"` // CIDR list, empty = trust RemoteAddr only

-

- GitHubToken string `yaml:"token"`

- WebhookSecret string `yaml:"webhook_secret"`

-}

-

-func getConfig(filename string) (*appConfig, error) {

- cfg := &appConfig{

- GrpcAddr: ":2026",

- WebAddr: ":3000",

- AdminSocket: "/run/mirum-server/admin.sock",

- }

-

- data, err := os.ReadFile(filename)

- if err != nil {

- return nil, err

- }

-

- if err := yaml.Unmarshal(data, &cfg); err != nil {

- return nil, err

- }

-

- if cfg.DatabaseUri == "" {

- return nil, fmt.Errorf("error: database_uri is required")

- }

- if cfg.WebhookSecret == "" {

- return nil, fmt.Errorf("error: webhook_secret is required")

- }

- if cfg.Pepper == "" {

- return nil, fmt.Errorf("error: pepper is required")

- }

- if cfg.GrpcTls.Cert == "" || cfg.GrpcTls.Key == "" {

- return nil, fmt.Errorf("error: grpc_tls.cert and grpc_tls.key are required")

- }

-

- return cfg, nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "crypto/hmac"

- "crypto/rand"

- "crypto/sha256"

- "crypto/subtle"

- "encoding/base64"

- "encoding/hex"

- "errors"

- "fmt"

- "log/slog"

- "net/mail"

- "regexp"

- "strings"

- "time"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb"

- "dimidiumlabs/mirum/internal/config"

-

- sb "github.com/huandu/go-sqlbuilder"

- "github.com/jackc/pgerrcode"

- "github.com/jackc/pgx/v5"

- "github.com/jackc/pgx/v5/pgconn"

- "github.com/jackc/pgx/v5/pgxpool"

- "github.com/jackc/tern/v2/migrate"

- "golang.org/x/crypto/argon2"

-)

-

-var (

- ErrAcquire = errors.New("database: failed to acquire connection")

- ErrAlreadyMember = errors.New("database: already a member")

- ErrEmailTaken = errors.New("database: email already taken")

- ErrInvalidCreds = errors.New("database: invalid credentials")

- ErrInvalidEmail = errors.New("database: invalid email")

- ErrInvalidRole = errors.New("database: invalid role")

- ErrInvalidSlug = errors.New("database: invalid slug")

- ErrInvalidDateFormat = errors.New("database: invalid date format")

- ErrInvalidTimezone = errors.New("database: invalid timezone")

- ErrLastOwner = errors.New("database: last owner")

- ErrMigrate = errors.New("database: failed to create migrator")

- ErrNotImplemented = errors.New("database: filter not implemented")

- ErrNotMember = errors.New("database: not a member")

- ErrOpen = errors.New("database: failed to open")

- ErrOrgNotFound = errors.New("database: organization not found")

- ErrPing = errors.New("database: failed to ping")

- ErrReservedEmail = errors.New("database: email uses a reserved domain")

- ErrSlugTaken = errors.New("database: slug already taken")

- ErrSoleOwner = errors.New("database: sole owner of an organization")

- ErrUserNotFound = errors.New("database: user not found")

- ErrWorkerNotFound = errors.New("database: worker not found")

-)

-

-// reservedEmailSuffix is the domain carved out for synthetic actors

-// (system/operator/anon). Real users cannot register with this suffix.

-const reservedEmailSuffix = "@mirum.local"

-

-const (

- saltLen = 16

-

- argonTime = 3

- argonMemory = 64 * 1024 // 64 MB

- argonKeyLen = 32

- argonThreads = 2

-)

-

-var slugRe = regexp.MustCompile(`^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$`)

-

-// UserRef identifies a user by ID or email.

-type UserRef struct {

- id UserID

- email string

-}

-

-func UserByID(id UserID) UserRef { return UserRef{id: id} }

-

-func UserByEmail(email string) UserRef { return UserRef{email: email} }

-

-func (r UserRef) where() (string, any) {

- if !r.id.IsZero() {

- return "id", r.id

- }

- return "email", r.email

-}

-

-// OrgRef identifies an organization by ID or slug.

-type OrgRef struct {

- id OrgID

- slug string

-}

-

-func OrgByID(id OrgID) OrgRef { return OrgRef{id: id} }

-

-func OrgBySlug(slug string) OrgRef { return OrgRef{slug: slug} }

-

-func (r OrgRef) IsZero() bool { return r.id.IsZero() && r.slug == "" }

-

-func (r OrgRef) where() (string, any) {

- if !r.id.IsZero() {

- return "id", r.id

- }

- return "slug", r.slug

-}

-

-// DB wraps a pgx connection pool.

-type DB struct {

- Pool *pgxpool.Pool

-}

-

-type DateFormat int

-

-const (

- DateFormatDMY DateFormat = 1

- DateFormatMDY DateFormat = 2

- DateFormatYMD DateFormat = 3

-)

-

-type Locale struct {

- Language *string

- DateFormat *DateFormat

-}

-

-// User holds info about a user.

-type User struct {

- ID UserID

- Email string

- CreatedAt time.Time

- Locale *Locale

- Timezone *string

-}

-

-// Organization holds info about an organization.

-type Organization struct {

- ID OrgID

- Name string

- Slug string

- Public bool

- CreatedAt time.Time

-}

-

-// OrgMember pairs a user with their role in an organization.

-type OrgMember struct {

- User User

- Role string

- JoinedAt time.Time

-}

-

-// Worker holds info about a registered worker.

-type Worker struct {

- ID WorkerID

- OrgID *OrgID

- PublicKey []byte

- CreatedAt time.Time

-}

-

-// DatabaseOpen connects to PostgreSQL and returns a DB.

-func DatabaseOpen(ctx context.Context, dsn string) (*DB, error) {

- pool, err := pgxpool.New(ctx, dsn)

- if err != nil {

- return nil, errors.Join(ErrOpen, err)

- }

-

- if err := pool.Ping(ctx); err != nil {

- pool.Close()

- return nil, errors.Join(ErrPing, err)

- }

-

- return &DB{Pool: pool}, nil

-}

-

-// Close closes the connection pool.

-func (db *DB) Close() {

- db.Pool.Close()

-}

-

-// apicall starts a transaction and sets the RLS actor. Both app.user_id

-// and app.actor_kind are populated: app_issuper() checks actor_kind for

-// System/Operator principals, and app.user_id for real user superusers.

-func (db *DB) apicall(ctx context.Context, actor Actor, access, validate, doit func(pgx.Tx) error) error {

- tx, err := db.Pool.Begin(ctx)

- if err != nil {

- return err

- }

- defer func() {

- if err := tx.Rollback(ctx); err != nil && !errors.Is(err, pgx.ErrTxClosed) {

- slog.Error("rollback failed", "err", err)

- }

- }()

-

- if _, err := tx.Exec(ctx,

- `SELECT set_config('app.user_id', $1, true),

- set_config('app.actor_kind', $2, true)`,

- actor.dbID().String(), actor.kindString(),

- ); err != nil {

- return err

- }

-

- if err := access(tx); err != nil {

- slog.Debug("access denied", "err", err)

- return err

- }

- if validate != nil {

- if err := validate(tx); err != nil {

- slog.Debug("validation failed", "err", err)

- return err

- }

- }

- if err := doit(tx); err != nil {

- slog.Debug("exec failed", "err", err)

- return err

- }

-

- return tx.Commit(ctx)

-}

-

-// Migrate applies all pending migrations.

-func (db *DB) Migrate(ctx context.Context) error {

- conn, err := db.Pool.Acquire(ctx)

- if err != nil {

- return errors.Join(ErrAcquire, err)

- }

- defer conn.Release()

-

- migrator, err := migrate.NewMigrator(ctx, conn.Conn(), "schema_version")

- if err != nil {

- return errors.Join(ErrMigrate, err)

- }

-

- migrator.AppendMigration("create_users", `

- CREATE TYPE locale_settings AS (

- language TEXT,

- date_format INTEGER

- );

-

- CREATE TABLE users (

- id UUID PRIMARY KEY DEFAULT uuidv7(),

- email TEXT NOT NULL UNIQUE,

- password TEXT NOT NULL,

- superuser BOOLEAN NOT NULL DEFAULT false,

- created_at TIMESTAMPTZ NOT NULL DEFAULT now(),

- deleted_at TIMESTAMPTZ,

-

- locale locale_settings,

- timezone TEXT

- );

-

- CREATE FUNCTION app_user_id() RETURNS uuid STABLE AS $$

- SELECT current_setting('app.user_id', true)::uuid;

- $$ LANGUAGE sql;

-

- -- app_issuper has two independent branches:

- -- (a) runtime setting app.actor_kind is 'system' or 'operator' —

- -- set only by apicall from Go for synthetic principals and by

- -- DML migrations; cannot be injected via login since there is

- -- no matching users row to authenticate against.

- -- (b) the current app.user_id resolves to a users row with

- -- superuser = true — real support-agent style superusers.

- CREATE FUNCTION app_issuper() RETURNS boolean STABLE AS $$

- SELECT

- current_setting('app.actor_kind', true) IN ('system', 'operator')

- OR EXISTS (

- SELECT 1 FROM users

- WHERE id = current_setting('app.user_id', true)::uuid

- AND superuser = true

- );

- $$ LANGUAGE sql;

- `, `

- DROP TYPE locale_settings;

- DROP TYPE date_format_t;

- DROP FUNCTION app_issuper;

- DROP FUNCTION app_user_id;

- DROP TABLE users;

- `)

-

- migrator.AppendMigration("create_sessions", `

- CREATE TABLE sessions (

- token TEXT PRIMARY KEY,

- user_id UUID NOT NULL REFERENCES users(id),

- created_at TIMESTAMPTZ NOT NULL DEFAULT now(),

- expires_at TIMESTAMPTZ NOT NULL

- );

- CREATE INDEX sessions_expires_at ON sessions (expires_at);

- `, `

- DROP TABLE sessions;

- `)

-

- migrator.AppendMigration("create_organizations", `

- CREATE TABLE organizations (

- id UUID PRIMARY KEY DEFAULT uuidv7(),

- name TEXT NOT NULL,

- slug TEXT NOT NULL UNIQUE,

- public BOOLEAN NOT NULL DEFAULT false,

- created_at TIMESTAMPTZ NOT NULL DEFAULT now(),

- deleted_at TIMESTAMPTZ

- );

- `, `

- DROP TABLE organizations;

- `)

-

- migrator.AppendMigration("create_org_members", `

- CREATE TABLE org_members (

- org_id UUID NOT NULL REFERENCES organizations(id),

- user_id UUID NOT NULL REFERENCES users(id),

- role TEXT NOT NULL DEFAULT 'member' CHECK (role IN ('owner', 'admin', 'member')),

- created_at TIMESTAMPTZ NOT NULL DEFAULT now(),

- PRIMARY KEY (org_id, user_id)

- );

- CREATE INDEX org_members_user_id ON org_members (user_id);

-

- CREATE FUNCTION is_member(org uuid) RETURNS boolean STABLE AS $$

- SELECT EXISTS (

- SELECT 1 FROM org_members

- WHERE org_id = org AND user_id = app_user_id()

- );

- $$ LANGUAGE sql;

-

- CREATE FUNCTION is_authenticated() RETURNS boolean STABLE AS $$

- SELECT current_setting('app.actor_kind', true) NOT IN ('', 'anon');

- $$ LANGUAGE sql;

- `, `

- DROP FUNCTION is_authenticated;

- DROP FUNCTION is_member;

- DROP TABLE org_members;

- `)

-

- migrator.AppendMigration("create_workers", `

- CREATE TABLE workers (

- id UUID PRIMARY KEY DEFAULT uuidv7(),

- org_id UUID REFERENCES organizations(id),

- public_key BYTEA NOT NULL UNIQUE,

- created_at TIMESTAMPTZ NOT NULL DEFAULT now(),

- revoked_at TIMESTAMPTZ

- );

- `, `

- DROP TABLE workers

- `)

-

- migrator.AppendMigration("rls_users", `

- ALTER TABLE users ENABLE ROW LEVEL SECURITY;

- ALTER TABLE users FORCE ROW LEVEL SECURITY;

-

- CREATE POLICY superuser ON users FOR ALL USING (app_issuper());

- CREATE POLICY self ON users FOR ALL USING (id = app_user_id());

- CREATE POLICY shared_org ON users FOR SELECT USING (EXISTS (

- SELECT 1 FROM org_members target

- JOIN org_members mine ON mine.org_id = target.org_id

- WHERE target.user_id = users.id

- AND mine.user_id = app_user_id()

- ));

- CREATE POLICY write_auth ON users AS RESTRICTIVE FOR INSERT WITH CHECK (is_authenticated());

- CREATE POLICY update_auth ON users AS RESTRICTIVE FOR UPDATE USING (is_authenticated());

- CREATE POLICY delete_auth ON users AS RESTRICTIVE FOR DELETE USING (is_authenticated());

- `, `

- DROP POLICY write_auth ON users;

- DROP POLICY update_auth ON users;

- DROP POLICY delete_auth ON users;

- DROP POLICY superuser ON users;

- DROP POLICY self ON users;

- DROP POLICY shared_org ON users;

-

- ALTER TABLE users DISABLE ROW LEVEL SECURITY;

- `)

-

- migrator.AppendMigration("rls_sessions", `

- ALTER TABLE sessions ENABLE ROW LEVEL SECURITY;

- ALTER TABLE sessions FORCE ROW LEVEL SECURITY;

-

- CREATE POLICY superuser ON sessions FOR ALL USING (app_issuper());

- CREATE POLICY own_sessions ON sessions FOR ALL USING (user_id = app_user_id());

- CREATE POLICY write_auth ON sessions AS RESTRICTIVE FOR INSERT WITH CHECK (is_authenticated());

- CREATE POLICY update_auth ON sessions AS RESTRICTIVE FOR UPDATE USING (is_authenticated());

- CREATE POLICY delete_auth ON sessions AS RESTRICTIVE FOR DELETE USING (is_authenticated());

- `, `

- DROP POLICY write_auth ON sessions;

- DROP POLICY update_auth ON sessions;

- DROP POLICY delete_auth ON sessions;

- DROP POLICY superuser ON sessions;

- DROP POLICY own_sessions ON sessions;

-

- ALTER TABLE sessions DISABLE ROW LEVEL SECURITY;

- `)

-

- migrator.AppendMigration("rls_organizations", `

- ALTER TABLE organizations ENABLE ROW LEVEL SECURITY;

- ALTER TABLE organizations FORCE ROW LEVEL SECURITY;

-

- CREATE POLICY superuser ON organizations FOR ALL USING (app_issuper());

- CREATE POLICY public_org ON organizations FOR ALL USING (public);

- CREATE POLICY member_org ON organizations FOR ALL USING (is_member(id));

- CREATE POLICY write_auth ON organizations AS RESTRICTIVE FOR INSERT WITH CHECK (is_authenticated());

- CREATE POLICY update_auth ON organizations AS RESTRICTIVE FOR UPDATE USING (is_authenticated());

- CREATE POLICY delete_auth ON organizations AS RESTRICTIVE FOR DELETE USING (is_authenticated());

- `, `

- DROP POLICY write_auth ON organizations;

- DROP POLICY update_auth ON organizations;

- DROP POLICY delete_auth ON organizations;

- DROP POLICY superuser ON organizations;

- DROP POLICY public_org ON organizations;

- DROP POLICY member_org ON organizations;

-

- ALTER TABLE organizations DISABLE ROW LEVEL SECURITY;

- `)

-

- migrator.AppendMigration("rls_org_members", `

- ALTER TABLE org_members ENABLE ROW LEVEL SECURITY;

- ALTER TABLE org_members FORCE ROW LEVEL SECURITY;

-

- CREATE POLICY superuser ON org_members FOR ALL USING (app_issuper());

-

- -- Self path (own membership rows) uses a pure column predicate

- -- so is_member's inner query can resolve without recursion.

- CREATE POLICY self_member ON org_members FOR ALL USING (user_id = app_user_id());

- CREATE POLICY org_member ON org_members FOR ALL USING (is_member(org_id));

- CREATE POLICY write_auth ON org_members AS RESTRICTIVE FOR INSERT WITH CHECK (is_authenticated());

- CREATE POLICY update_auth ON org_members AS RESTRICTIVE FOR UPDATE USING (is_authenticated());

- CREATE POLICY delete_auth ON org_members AS RESTRICTIVE FOR DELETE USING (is_authenticated());

- `, `

- DROP POLICY write_auth ON org_members;

- DROP POLICY update_auth ON org_members;

- DROP POLICY delete_auth ON org_members;

- DROP POLICY superuser ON org_members;

- DROP POLICY self_member ON org_members;

- DROP POLICY org_member ON org_members;

-

- ALTER TABLE org_members DISABLE ROW LEVEL SECURITY;

- `)

-

- migrator.AppendMigration("rls_workers", `

- ALTER TABLE workers ENABLE ROW LEVEL SECURITY;

- ALTER TABLE workers FORCE ROW LEVEL SECURITY;

-

- CREATE POLICY superuser ON workers FOR ALL USING (app_issuper());

- CREATE POLICY org_worker ON workers FOR ALL USING (

- org_id IS NOT NULL AND is_member(org_id)

- );

- CREATE POLICY write_auth ON workers AS RESTRICTIVE FOR INSERT WITH CHECK (is_authenticated());

- CREATE POLICY update_auth ON workers AS RESTRICTIVE FOR UPDATE USING (is_authenticated());

- CREATE POLICY delete_auth ON workers AS RESTRICTIVE FOR DELETE USING (is_authenticated());

- `, `

- DROP POLICY write_auth ON workers;

- DROP POLICY update_auth ON workers;

- DROP POLICY delete_auth ON workers;

- DROP POLICY superuser ON workers;

- DROP POLICY org_worker ON workers;

-

- ALTER TABLE workers DISABLE ROW LEVEL SECURITY;

- `)

-

- return migrator.Migrate(ctx)

-}

-

-// UserCreate hashes the password with argon2id and inserts a new user.

-// The pepper is a server-side secret not stored in the database.

-func (db *DB) UserCreate(ctx context.Context, actor Actor, email, password string, pepper []byte) (UserID, error) {

- var id UserID

- err := db.apicall(

- ctx, actor,

- func(tx pgx.Tx) error {

- if !actor.IsSuperuser() {

- return ErrPermissionDenied

- }

-

- return nil

- },

- func(tx pgx.Tx) error {

- if strings.HasSuffix(strings.ToLower(email), reservedEmailSuffix) {

- return ErrReservedEmail

- }

-

- return nil

- },

- func(tx pgx.Tx) error {

- hash, err := hashPassword(password, pepper)

- if err != nil {

- return err

- }

-

- if err := tx.QueryRow(ctx,

- `INSERT INTO users (email, password) VALUES ($1, $2) RETURNING id`,

- email, hash,

- ).Scan(&id); err != nil {

- var pgErr *pgconn.PgError

- if errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation {

- return ErrEmailTaken

- }

-

- return err

- }

- return nil

- },

- )

- return id, err

-}

-

-// UserGet returns a user by ref (ID or email).

-func (db *DB) UserGet(ctx context.Context, actor Actor, ref UserRef) (*User, error) {

- var u User

- err := db.apicall(

- ctx, actor,

- func(tx pgx.Tx) error { return checkGlobal(actor, apipb.Perm_PERM_USER_READ) },

- nil,

- func(tx pgx.Tx) error {

- col, val := ref.where()

-

- q := sb.PostgreSQL.NewSelectBuilder()

- sql, args := q.Select("id", "email", "created_at",

- "(locale).language", "(locale).date_format", "timezone").

- From("users").

- Where(q.Equal(col, val), q.IsNull("deleted_at")).

- Build()

-

- u.Locale = &Locale{}

- if err := tx.QueryRow(ctx, sql, args...).Scan(

- &u.ID, &u.Email, &u.CreatedAt, &u.Locale.Language, &u.Locale.DateFormat, &u.Timezone,

- ); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrUserNotFound

- }

- return err

- }

-

- return nil

- },

- )

- return &u, err

-}

-

-// UserList returns a page of users and the total count.

-func (db *DB) UserList(ctx context.Context, actor Actor, cursor UserID, limit int, filter string) ([]User, int, error) {

- var users []User

- var total int

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkGlobal(actor, apipb.Perm_PERM_USER_READ) },

- func(tx pgx.Tx) error {

- if filter != "" {

- return ErrNotImplemented

- }

- return nil

- },

- func(tx pgx.Tx) error {

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM users WHERE deleted_at IS NULL`,

- ).Scan(&total); err != nil {

- return err

- }

-

- q := sb.PostgreSQL.NewSelectBuilder()

- q.Select("id", "email", "created_at",

- "(locale).language", "(locale).date_format", "timezone").

- From("users").

- Where(q.IsNull("deleted_at")).

- OrderBy("id").

- Limit(limit)

- if !cursor.IsZero() {

- q.Where(q.GreaterThan("id", cursor))

- }

-

- sql, args := q.Build()

- rows, err := tx.Query(ctx, sql, args...)

- if err != nil {

- return err

- }

- defer rows.Close()

-

- for rows.Next() {

- var u User

- u.Locale = &Locale{}

- if err := rows.Scan(&u.ID, &u.Email, &u.CreatedAt, &u.Locale.Language, &u.Locale.DateFormat, &u.Timezone); err != nil {

- return err

- }

- users = append(users, u)

- }

- return rows.Err()

- },

- )

- return users, total, err

-}

-

-type UserUpdateParams struct {

- Email *string

- Password *string

- Locale *Locale

- Timezone *string

-}

-

-// UserUpdate updates a user's email and/or password.

-// Invalidates all sessions when password changes.

-func (db *DB) UserUpdate(ctx context.Context, actor Actor, ref UserRef, p UserUpdateParams, pepper []byte) error {

- var id UserID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- id, err = resolveUser(ctx, tx, ref)

- if err != nil {

- return err

- }

- return checkSelf(actor, id)

- },

- func(tx pgx.Tx) error {

- if p.Email != nil && strings.HasSuffix(strings.ToLower(*p.Email), reservedEmailSuffix) {

- return ErrReservedEmail

- }

- if p.Timezone != nil {

- if _, err := time.LoadLocation(*p.Timezone); err != nil {

- return ErrInvalidTimezone

- }

- }

- return nil

- },

- func(tx pgx.Tx) error {

- ub := sb.PostgreSQL.NewUpdateBuilder()

- ub.Update("users")

-

- var hasSet bool

- if p.Email != nil {

- ub.SetMore(ub.Assign("email", *p.Email))

- hasSet = true

- }

- if p.Password != nil {

- hash, err := hashPassword(*p.Password, pepper)

- if err != nil {

- return err

- }

- ub.SetMore(ub.Assign("password", hash))

- hasSet = true

- }

- if p.Locale != nil {

- ub.SetMore(fmt.Sprintf(

- "locale = ROW(COALESCE(%s, (locale).language), COALESCE(%s, (locale).date_format))::locale_settings",

- ub.Var(p.Locale.Language), ub.Var(p.Locale.DateFormat),

- ))

- hasSet = true

- }

- if p.Timezone != nil {

- ub.SetMore(ub.Assign("timezone", *p.Timezone))

- hasSet = true

- }

- if !hasSet {

- return nil

- }

- ub.Where(ub.Equal("id", id))

-

- sql, args := ub.Build()

- if _, err := tx.Exec(ctx, sql, args...); err != nil {

- var pgErr *pgconn.PgError

- if errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation {

- return ErrEmailTaken

- }

- return err

- }

-

- if p.Password != nil {

- if _, err := tx.Exec(ctx, `DELETE FROM sessions WHERE user_id = $1`, id); err != nil {

- return err

- }

- }

- return nil

- },

- )

-}

-

-// UserDelete soft-deletes a user.

-// Fails if the user is the sole owner of any organization.

-func (db *DB) UserDelete(ctx context.Context, actor Actor, ref UserRef) error {

- var id UserID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- id, err = resolveUser(ctx, tx, ref)

- if err != nil {

- return err

- }

- return checkSelf(actor, id)

- },

- func(tx pgx.Tx) error {

- return checkNotSoleOwner(ctx, tx, id)

- },

- func(tx pgx.Tx) error {

- if _, err := tx.Exec(ctx, `DELETE FROM sessions WHERE user_id = $1`, id); err != nil {

- return err

- }

- if _, err := tx.Exec(ctx, `DELETE FROM org_members WHERE user_id = $1`, id); err != nil {

- return err

- }

- if _, err := tx.Exec(ctx,

- `UPDATE users SET email = id::text, password = '', deleted_at = now() WHERE id = $1`, id,

- ); err != nil {

- return err

- }

- return nil

- },

- )

-}

-

-// UserVerifyPassword checks credentials and returns the user ID.

-func (db *DB) UserVerifyPassword(ctx context.Context, actor Actor, email, password string, pepper []byte) (UserID, error) {

- var id UserID

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkSystem(actor) },

- nil,

- func(tx pgx.Tx) error {

- var hash string

- if err := tx.QueryRow(ctx,

- `SELECT id, password FROM users WHERE email = $1 AND deleted_at IS NULL`,

- email,

- ).Scan(&id, &hash); err != nil {

- return ErrInvalidCreds

- }

- if !verifyHash(password, hash, pepper) {

- return ErrInvalidCreds

- }

- return nil

- },

- )

- return id, err

-}

-

-// UserSessionGet resolves a session token into the Actor it authenticates.

-// Returns an invalid zero Actor on any error; callers must check err.

-func (db *DB) UserSessionGet(ctx context.Context, actor Actor, token string) (Actor, error) {

- var (

- userID UserID

- email string

- superuser bool

- )

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkSystem(actor) },

- nil,

- func(tx pgx.Tx) error {

- var expiresAt time.Time

- h := hashToken(token)

-

- if err := tx.QueryRow(ctx,

- `SELECT s.user_id, u.email, u.superuser, s.expires_at

- FROM sessions s JOIN users u ON u.id = s.user_id

- WHERE s.token = $1 AND s.expires_at > now() AND u.deleted_at IS NULL`,

- h,

- ).Scan(&userID, &email, &superuser, &expiresAt); err != nil {

- return err

- }

-

- if time.Until(expiresAt) < config.SessionTTL/2 {

- if _, err := tx.Exec(ctx,

- `UPDATE sessions SET expires_at = now() + $2 WHERE token = $1`,

- h, config.SessionTTL,

- ); err != nil {

- return err

- }

- }

- return nil

- },

- )

- if err != nil {

- return Actor{}, err

- }

- return UserActor(userID, email, superuser), nil

-}

-

-// UserSessionCreate generates a random token, stores its hash, and returns the token.

-func (db *DB) UserSessionCreate(ctx context.Context, actor Actor, userID UserID) (string, error) {

- var token string

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkSystem(actor) },

- nil,

- func(tx pgx.Tx) error {

- buf := make([]byte, 32)

- if _, err := rand.Read(buf); err != nil {

- return err

- }

- token = base64.RawURLEncoding.EncodeToString(buf)

-

- if _, err := tx.Exec(ctx,

- `INSERT INTO sessions (token, user_id, expires_at) VALUES ($1, $2, now() + $3)`,

- hashToken(token), userID, config.SessionTTL,

- ); err != nil {

- return err

- }

- return nil

- },

- )

- return token, err

-}

-

-// UserSessionDelete removes a session (logout).

-func (db *DB) UserSessionDelete(ctx context.Context, actor Actor, token string) error {

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkSystem(actor) },

- nil,

- func(tx pgx.Tx) error {

- _, err := tx.Exec(ctx, `DELETE FROM sessions WHERE token = $1`, hashToken(token))

- return err

- },

- )

-}

-

-// UserSessionPurgeExpired deletes all expired sessions. Runs as SystemActor.

-func (db *DB) UserSessionPurgeExpired(ctx context.Context) error {

- return db.apicall(ctx, SystemActor(),

- func(tx pgx.Tx) error { return checkSystem(SystemActor()) },

- nil,

- func(tx pgx.Tx) error {

- _, err := tx.Exec(ctx, `DELETE FROM sessions WHERE expires_at < now()`)

- return err

- },

- )

-}

-

-// OrgGet returns an org by ref (ID or slug).

-func (db *DB) OrgGet(ctx context.Context, actor Actor, ref OrgRef) (*Organization, error) {

- var o Organization

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkGlobal(actor, apipb.Perm_PERM_ORG_READ) },

- nil,

- func(tx pgx.Tx) error {

- col, val := ref.where()

- q := sb.PostgreSQL.NewSelectBuilder()

-

- sql, args := q.Select("id", "name", "slug", "public", "created_at").

- From("organizations").

- Where(q.Equal(col, val), q.IsNull("deleted_at")).

- Build()

-

- if err := tx.QueryRow(ctx, sql, args...).Scan(&o.ID, &o.Name, &o.Slug, &o.Public, &o.CreatedAt); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrOrgNotFound

- }

- return err

- }

- return nil

- },

- )

- return &o, err

-}

-

-// OrgCreate creates an org and adds the owner as the first member.

-func (db *DB) OrgCreate(ctx context.Context, actor Actor, name, slug string, public bool, owner UserRef) (OrgID, error) {

- var orgID OrgID

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkGlobal(actor, apipb.Perm_PERM_ORG_WRITE) },

- nil,

- func(tx pgx.Tx) error {

- userID, err := resolveUser(ctx, tx, owner)

- if err != nil {

- return err

- }

-

- if err := tx.QueryRow(ctx,

- `INSERT INTO organizations (name, slug, public) VALUES ($1, $2, $3) RETURNING id`,

- name, slug, public,

- ).Scan(&orgID); err != nil {

- var pgErr *pgconn.PgError

- if errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation {

- return ErrSlugTaken

- }

- return err

- }

-

- _, err = tx.Exec(ctx,

- `INSERT INTO org_members (org_id, user_id, role) VALUES ($1, $2, 'owner')`,

- orgID, userID,

- )

- return err

- },

- )

- return orgID, err

-}

-

-// OrgUpdate updates an org's name, slug, and/or public flag.

-func (db *DB) OrgUpdate(ctx context.Context, actor Actor, ref OrgRef, name *string, slug *string, public *bool) error {

- if name == nil && slug == nil && public == nil {

- return nil

- }

-

- var id OrgID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- id, err = resolveOrg(ctx, tx, ref)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, id, apipb.Perm_PERM_ORG_WRITE)

- },

- nil,

- func(tx pgx.Tx) error {

- ub := sb.PostgreSQL.NewUpdateBuilder()

- ub.Update("organizations")

- if name != nil {

- ub.SetMore(ub.Assign("name", *name))

- }

- if slug != nil {

- ub.SetMore(ub.Assign("slug", *slug))

- }

- if public != nil {

- ub.SetMore(ub.Assign("public", *public))

- }

- ub.Where(ub.Equal("id", id))

-

- sql, args := ub.Build()

- tag, err := tx.Exec(ctx, sql, args...)

- if err != nil {

- var pgErr *pgconn.PgError

- if errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation {

- return ErrSlugTaken

- }

- return err

- }

- if tag.RowsAffected() == 0 {

- return ErrOrgNotFound

- }

- return nil

- },

- )

-}

-

-// OrgDelete soft-deletes an org and removes all members.

-func (db *DB) OrgDelete(ctx context.Context, actor Actor, ref OrgRef) error {

- var id OrgID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- id, err = resolveOrg(ctx, tx, ref)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, id, apipb.Perm_PERM_ORG_DELETE)

- },

- nil,

- func(tx pgx.Tx) error {

- if _, err := tx.Exec(ctx, `DELETE FROM org_members WHERE org_id = $1`, id); err != nil {

- return err

- }

- tag, err := tx.Exec(ctx,

- `UPDATE organizations SET slug = id::text, deleted_at = now() WHERE id = $1`, id,

- )

- if err != nil {

- return err

- }

- if tag.RowsAffected() == 0 {

- return ErrOrgNotFound

- }

- return nil

- },

- )

-}

-

-// OrgList returns a page of orgs and the total count.

-func (db *DB) OrgList(ctx context.Context, actor Actor, cursor OrgID, limit int, filter string) ([]Organization, int, error) {

- var orgs []Organization

- var total int

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkGlobal(actor, apipb.Perm_PERM_ORG_READ) },

- func(tx pgx.Tx) error {

- if filter != "" {

- return ErrNotImplemented

- }

- return nil

- },

- func(tx pgx.Tx) error {

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM organizations WHERE deleted_at IS NULL`,

- ).Scan(&total); err != nil {

- return err

- }

-

- q := sb.PostgreSQL.NewSelectBuilder()

- q.Select("id", "name", "slug", "public", "created_at").

- From("organizations").

- Where(q.IsNull("deleted_at")).

- OrderBy("id").

- Limit(limit)

- if !cursor.IsZero() {

- q.Where(q.GreaterThan("id", cursor))

- }

-

- sql, args := q.Build()

- rows, err := tx.Query(ctx, sql, args...)

- if err != nil {

- return err

- }

- defer rows.Close()

-

- for rows.Next() {

- var o Organization

- if err := rows.Scan(&o.ID, &o.Name, &o.Slug, &o.Public, &o.CreatedAt); err != nil {

- return err

- }

- orgs = append(orgs, o)

- }

- return rows.Err()

- },

- )

- return orgs, total, err

-}

-

-// OrgMemberGet returns a single member's info.

-func (db *DB) OrgMemberGet(ctx context.Context, actor Actor, org OrgRef, user UserRef) (*OrgMember, error) {

- var m OrgMember

- var orgID OrgID

- var userID UserID

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- orgID, err = resolveOrg(ctx, tx, org)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, orgID, apipb.Perm_PERM_ORG_MEMBER_READ)

- },

- nil,

- func(tx pgx.Tx) error {

- var err error

- userID, err = resolveUser(ctx, tx, user)

- if err != nil {

- return err

- }

-

- if err := tx.QueryRow(ctx,

- `SELECT u.id, u.email, u.created_at, om.role, om.created_at

- FROM org_members om

- JOIN users u ON u.id = om.user_id

- WHERE om.org_id = $1 AND om.user_id = $2`, orgID, userID,

- ).Scan(&m.User.ID, &m.User.Email, &m.User.CreatedAt, &m.Role, &m.JoinedAt); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrNotMember

- }

- return err

- }

- return nil

- },

- )

- return &m, err

-}

-

-// OrgMembersList returns a page of members for an org.

-func (db *DB) OrgMembersList(ctx context.Context, actor Actor, org OrgRef, cursor UserID, limit int, filter string) ([]OrgMember, int, error) {

- var members []OrgMember

- var total int

- var orgID OrgID

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- orgID, err = resolveOrg(ctx, tx, org)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, orgID, apipb.Perm_PERM_ORG_MEMBER_READ)

- },

- func(tx pgx.Tx) error {

- if filter != "" {

- return ErrNotImplemented

- }

- return nil

- },

- func(tx pgx.Tx) error {

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM org_members WHERE org_id = $1`, orgID,

- ).Scan(&total); err != nil {

- return err

- }

-

- q := sb.PostgreSQL.NewSelectBuilder()

- q.Select("u.id", "u.email", "u.created_at", "m.role", "m.created_at").

- From("org_members m").

- Join("users u", "u.id = m.user_id").

- Where(q.Equal("m.org_id", orgID), q.IsNull("u.deleted_at")).

- OrderBy("u.id").

- Limit(limit)

- if !cursor.IsZero() {

- q.Where(q.GreaterThan("u.id", cursor))

- }

-

- sql, args := q.Build()

- rows, err := tx.Query(ctx, sql, args...)

- if err != nil {

- return err

- }

- defer rows.Close()

-

- for rows.Next() {

- var m OrgMember

- if err := rows.Scan(&m.User.ID, &m.User.Email, &m.User.CreatedAt, &m.Role, &m.JoinedAt); err != nil {

- return err

- }

- members = append(members, m)

- }

- return rows.Err()

- },

- )

- return members, total, err

-}

-

-// OrgMemberAdd adds a user to an org with the given role.

-func (db *DB) OrgMemberAdd(ctx context.Context, actor Actor, org OrgRef, user UserRef, role string) error {

- var orgID OrgID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- orgID, err = resolveOrg(ctx, tx, org)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, orgID, apipb.Perm_PERM_ORG_MEMBER_WRITE)

- },

- nil,

- func(tx pgx.Tx) error {

- userID, err := resolveUser(ctx, tx, user)

- if err != nil {

- return err

- }

- if _, err := tx.Exec(ctx,

- `INSERT INTO org_members (org_id, user_id, role) VALUES ($1, $2, $3)`,

- orgID, userID, role,

- ); err != nil {

- var pgErr *pgconn.PgError

- if errors.As(err, &pgErr) && pgErr.Code == pgerrcode.UniqueViolation {

- return ErrAlreadyMember

- }

- return err

- }

- return nil

- },

- )

-}

-

-// OrgMemberUpdateRole changes a member's role. Fails if demoting the last owner.

-func (db *DB) OrgMemberUpdateRole(ctx context.Context, actor Actor, org OrgRef, user UserRef, newRole string) error {

- var orgID OrgID

- var userID UserID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- orgID, err = resolveOrg(ctx, tx, org)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, orgID, apipb.Perm_PERM_ORG_MEMBER_WRITE)

- },

- nil,

- func(tx pgx.Tx) error {

- var err error

- userID, err = resolveUser(ctx, tx, user)

- if err != nil {

- return err

- }

-

- var currentRole string

- if err := tx.QueryRow(ctx,

- `SELECT role FROM org_members WHERE org_id = $1 AND user_id = $2 FOR UPDATE`,

- orgID, userID,

- ).Scan(&currentRole); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrNotMember

- }

- return err

- }

-

- if currentRole == "owner" && newRole != "owner" {

- var ownerCount int

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM org_members WHERE org_id = $1 AND role = 'owner'`,

- orgID,

- ).Scan(&ownerCount); err != nil {

- return err

- }

- if ownerCount <= 1 {

- return ErrLastOwner

- }

- }

-

- _, err = tx.Exec(ctx,

- `UPDATE org_members SET role = $1 WHERE org_id = $2 AND user_id = $3`,

- newRole, orgID, userID,

- )

- return err

- },

- )

-}

-

-// OrgMemberRemove removes a user from an org. Fails if they are the last owner.

-func (db *DB) OrgMemberRemove(ctx context.Context, actor Actor, org OrgRef, user UserRef) error {

- var orgID OrgID

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var err error

- orgID, err = resolveOrg(ctx, tx, org)

- if err != nil {

- return err

- }

- return checkPerm(ctx, tx, actor, orgID, apipb.Perm_PERM_ORG_MEMBER_WRITE)

- },

- nil,

- func(tx pgx.Tx) error {

- userID, err := resolveUser(ctx, tx, user)

- if err != nil {

- return err

- }

-

- var role string

- if err := tx.QueryRow(ctx,

- `SELECT role FROM org_members WHERE org_id = $1 AND user_id = $2 FOR UPDATE`,

- orgID, userID,

- ).Scan(&role); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrNotMember

- }

- return err

- }

-

- if role == "owner" {

- var ownerCount int

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM org_members WHERE org_id = $1 AND role = 'owner'`,

- orgID,

- ).Scan(&ownerCount); err != nil {

- return err

- }

- if ownerCount <= 1 {

- return ErrLastOwner

- }

- }

-

- _, err = tx.Exec(ctx,

- `DELETE FROM org_members WHERE org_id = $1 AND user_id = $2`,

- orgID, userID,

- )

- return err

- },

- )

-}

-

-// WorkerGet returns a worker by ID.

-func (db *DB) WorkerGet(ctx context.Context, actor Actor, id WorkerID) (*Worker, error) {

- var w Worker

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var orgID *OrgID

- if err := tx.QueryRow(ctx,

- `SELECT org_id FROM workers WHERE id = $1 AND revoked_at IS NULL`, id,

- ).Scan(&orgID); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrWorkerNotFound

- }

- return err

- }

- if orgID != nil {

- return checkPerm(ctx, tx, actor, *orgID, apipb.Perm_PERM_WORKER_READ)

- }

- if !actor.IsSuperuser() {

- return ErrPermissionDenied

- }

- return nil

- },

- nil,

- func(tx pgx.Tx) error {

- return tx.QueryRow(ctx,

- `SELECT id, public_key, org_id, created_at FROM workers WHERE id = $1 AND revoked_at IS NULL`, id,

- ).Scan(&w.ID, &w.PublicKey, &w.OrgID, &w.CreatedAt)

- },

- )

- return &w, err

-}

-

-// WorkerCreate registers a new worker with the given public key and optional org.

-func (db *DB) WorkerCreate(ctx context.Context, actor Actor, publicKey []byte, org *OrgRef) (WorkerID, error) {

- var workerID WorkerID

- var orgID *OrgID

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- if org != nil {

- id, err := resolveOrg(ctx, tx, *org)

- if err != nil {

- return err

- }

- orgID = &id

- return checkPerm(ctx, tx, actor, id, apipb.Perm_PERM_WORKER_WRITE)

- }

- if !actor.IsSuperuser() {

- return ErrPermissionDenied

- }

- return nil

- },

- nil,

- func(tx pgx.Tx) error {

- return tx.QueryRow(ctx,

- `INSERT INTO workers (public_key, org_id) VALUES ($1, $2) RETURNING id`,

- publicKey, orgID,

- ).Scan(&workerID)

- },

- )

- return workerID, err

-}

-

-// WorkerDelete soft-deletes a worker by ID.

-func (db *DB) WorkerDelete(ctx context.Context, actor Actor, id WorkerID) error {

- return db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- var orgID *OrgID

- if err := tx.QueryRow(ctx,

- `SELECT org_id FROM workers WHERE id = $1 AND revoked_at IS NULL`, id,

- ).Scan(&orgID); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrWorkerNotFound

- }

- return err

- }

- if orgID != nil {

- return checkPerm(ctx, tx, actor, *orgID, apipb.Perm_PERM_WORKER_WRITE)

- }

- if !actor.IsSuperuser() {

- return ErrPermissionDenied

- }

- return nil

- },

- nil,

- func(tx pgx.Tx) error {

- tag, err := tx.Exec(ctx,

- `UPDATE workers SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`, id,

- )

- if err != nil {

- return err

- }

- if tag.RowsAffected() == 0 {

- return ErrWorkerNotFound

- }

- return nil

- },

- )

-}

-

-// WorkerList returns a page of workers and the total count.

-func (db *DB) WorkerList(ctx context.Context, actor Actor, cursor WorkerID, limit int, filter string) ([]Worker, int, error) {

- var workers []Worker

- var total int

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error {

- if actor.kind == actorAnon {

- return ErrUnauthenticated

- }

- return nil

- },

- func(tx pgx.Tx) error {

- if filter != "" {

- return ErrNotImplemented

- }

- return nil

- },

- func(tx pgx.Tx) error {

- if err := tx.QueryRow(ctx,

- `SELECT count(*) FROM workers WHERE revoked_at IS NULL`,

- ).Scan(&total); err != nil {

- return err

- }

-

- q := sb.PostgreSQL.NewSelectBuilder()

- q.Select("id", "public_key", "org_id", "created_at").

- From("workers").

- Where(q.IsNull("revoked_at")).

- OrderBy("id").

- Limit(limit)

- if !cursor.IsZero() {

- q.Where(q.GreaterThan("id", cursor))

- }

-

- sql, args := q.Build()

- rows, err := tx.Query(ctx, sql, args...)

- if err != nil {

- return err

- }

- defer rows.Close()

-

- for rows.Next() {

- var w Worker

- if err := rows.Scan(&w.ID, &w.PublicKey, &w.OrgID, &w.CreatedAt); err != nil {

- return err

- }

- workers = append(workers, w)

- }

- return rows.Err()

- },

- )

- return workers, total, err

-}

-

-// WorkerLookup finds an active worker by its ed25519 public key.

-func (db *DB) WorkerLookup(ctx context.Context, actor Actor, publicKey []byte) (*Worker, error) {

- var w Worker

- err := db.apicall(ctx, actor,

- func(tx pgx.Tx) error { return checkSystem(actor) },

- nil,

- func(tx pgx.Tx) error {

- if err := tx.QueryRow(ctx,

- `SELECT id, public_key, org_id, created_at FROM workers WHERE public_key = $1 AND revoked_at IS NULL`,

- publicKey,

- ).Scan(&w.ID, &w.PublicKey, &w.OrgID, &w.CreatedAt); err != nil {

- if errors.Is(err, pgx.ErrNoRows) {

- return ErrWorkerNotFound

- }

- return err

- }

- return nil

- },

- )

- return &w, err

-}

-

-// hashToken returns the hex-encoded SHA-256 of a session token.

-func hashToken(token string) string {

- h := sha256.Sum256([]byte(token))

- return hex.EncodeToString(h[:])

-}

-

-// verifyHash parses a PHC-format argon2id string and compares.

-// Format: $argon2id$v=19$m=65536,t=3,p=2$<salt>$<key>

-func verifyHash(password, encoded string, pepper []byte) bool {

- // $argon2id$v=19$m=65536,t=3,p=2$salt$key → 6 parts

- parts := strings.Split(encoded, "$")

- if len(parts) != 6 || parts[1] != "argon2id" {

- return false

- }

-

- var memory, time uint32

- var threads uint8

- if _, err := fmt.Sscanf(parts[3], "m=%d,t=%d,p=%d", &memory, &time, &threads); err != nil {

- return false

- }

-

- salt, err := base64.RawStdEncoding.DecodeString(parts[4])

- if err != nil {

- return false

- }

- expectedKey, err := base64.RawStdEncoding.DecodeString(parts[5])

- if err != nil {

- return false

- }

-

- mac := hmac.New(sha256.New, pepper)

- mac.Write([]byte(password))

- peppered := mac.Sum(nil)

-

- key := argon2.IDKey(peppered, salt, time, memory, threads, uint32(len(expectedKey)))

-

- return subtle.ConstantTimeCompare(key, expectedKey) == 1

-}

-

-// hashPassword produces a PHC-format string:

-// $argon2id$v=19$m=65536,t=3,p=2$<salt>$<hash>

-func hashPassword(password string, pepper []byte) (string, error) {

- salt := make([]byte, saltLen)

- if _, err := rand.Read(salt); err != nil {

- return "", err

- }

-

- // Apply pepper: HMAC-SHA256(pepper, password)

- mac := hmac.New(sha256.New, pepper)

- mac.Write([]byte(password))

- peppered := mac.Sum(nil)

-

- key := argon2.IDKey(peppered, salt, argonTime, argonMemory, argonThreads, argonKeyLen)

-

- return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",

- argon2.Version,

- argonMemory, argonTime, argonThreads,

- base64.RawStdEncoding.EncodeToString(salt),

- base64.RawStdEncoding.EncodeToString(key),

- ), nil

-}

-

-// checkNotSoleOwner returns ErrSoleOwner if the user is the only owner of any org.

-func checkNotSoleOwner(ctx context.Context, tx pgx.Tx, userID UserID) error {

- var slug string

- err := tx.QueryRow(ctx,

- `SELECT o.slug FROM org_members m

- JOIN organizations o ON o.id = m.org_id

- WHERE m.role = 'owner' AND o.deleted_at IS NULL

- GROUP BY o.id, o.slug

- HAVING count(*) = 1 AND bool_or(m.user_id = $1)

- LIMIT 1`, userID,

- ).Scan(&slug)

- if err == nil {

- return ErrSoleOwner

- }

- if errors.Is(err, pgx.ErrNoRows) {

- return nil

- }

- return err

-}

-

-// resolveUser locks and returns the user ID within a transaction.

-func resolveUser(ctx context.Context, tx pgx.Tx, ref UserRef) (UserID, error) {

- col, val := ref.where()

- q := sb.PostgreSQL.NewSelectBuilder()

-

- sql, args := q.Select("id").From("users").

- Where(q.Equal(col, val), q.IsNull("deleted_at")).

- ForUpdate().

- Build()

-

- var id UserID

- if err := tx.QueryRow(ctx, sql, args...).Scan(&id); err != nil {

- var zero UserID

- if errors.Is(err, pgx.ErrNoRows) {

- return zero, ErrUserNotFound

- }

-

- return zero, err

- }

-

- return id, nil

-}

-

-// resolveOrg locks and returns the org ID within a transaction.

-func resolveOrg(ctx context.Context, tx pgx.Tx, ref OrgRef) (OrgID, error) {

- col, val := ref.where()

- q := sb.PostgreSQL.NewSelectBuilder()

-

- sql, args := q.Select("id").From("organizations").

- Where(q.Equal(col, val), q.IsNull("deleted_at")).

- ForUpdate().

- Build()

-

- var id OrgID

- if err := tx.QueryRow(ctx, sql, args...).Scan(&id); err != nil {

- var zero OrgID

- if errors.Is(err, pgx.ErrNoRows) {

- return zero, ErrOrgNotFound

- }

-

- return zero, err

- }

-

- return id, nil

-}

-

-// ValidateEmail checks that the value is a valid email address.

-func ValidateEmail(value string) error {

- if _, err := mail.ParseAddress(value); err != nil {

- return ErrInvalidEmail

- }

- return nil

-}

-

-// ValidateSlug checks format and returns the normalized (lowercased) slug.

-func ValidateSlug(value string) (string, error) {

- if len(value) < 2 || len(value) > 64 || !slugRe.MatchString(value) {

- return "", ErrInvalidSlug

- }

- return strings.ToLower(value), nil

-}

-

-// ValidateRole checks that the value is a valid role string.

-// Derives valid roles from rolePermissions — single source of truth.

-func ValidateRole(value string) error {

- if _, ok := rolePermissions[value]; !ok {

- return ErrInvalidRole

- }

- return nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "database/sql/driver"

- "encoding/hex"

- "errors"

- "fmt"

- "log/slog"

- "strings"

-

- "github.com/google/uuid"

-)

-

-var (

- ErrBadID = errors.New("database: bad id")

- ErrBadIDPrefix = errors.New("database: wrong id prefix")

-)

-

-type (

- OrgID = ID[OrgKind]

- UserID = ID[UserKind]

- WorkerID = ID[WorkerKind]

-)

-

-// IDKind is a phantom-type tag that distinguishes otherwise-identical

-// 16-byte IDs at the Go type level. Each tag is a zero-sized struct

-// that carries only its 3-letter prefix.

-type IDKind interface {

- UserKind | OrgKind | WorkerKind

- Prefix() string

-}

-

-type (

- UserKind struct{}

- OrgKind struct{}

- WorkerKind struct{}

-)

-

-func (OrgKind) Prefix() string { return "org" }

-func (UserKind) Prefix() string { return "usr" }

-func (WorkerKind) Prefix() string { return "wrk" }

-

-// ID[K] is a typed UUIDv7. Instantiations with different K are distinct

-// types, so passing a UserID where an OrgID is expected is a compile

-// error. Cross-kind conversion requires an explicit cast, visible in

-// review.

-type ID[K IDKind] uuid.UUID

-

-func NewID[K IDKind]() ID[K] {

- return ID[K](uuid.Must(uuid.NewV7()))

-}

-

-func IDFromBytes[K IDKind](b []byte) (ID[K], error) {

- var zero ID[K]

- if len(b) != 16 {

- return zero, fmt.Errorf("%w: got %d bytes", ErrBadID, len(b))

- }

- u := uuid.UUID(b)

- if err := validateV7(u); err != nil {

- return zero, err

- }

- return ID[K](u), nil

-}

-

-func validateV7(u uuid.UUID) error {

- if v := u.Variant(); v != uuid.RFC4122 {

- return fmt.Errorf("%w: variant %s", ErrBadID, v)

- }

- if v := u.Version(); v != 7 {

- return fmt.Errorf("%w: version %d, want 7", ErrBadID, v)

- }

- return nil

-}

-

-func (id ID[K]) UUID() uuid.UUID { return uuid.UUID(id) }

-func (id ID[K]) Bytes() []byte { return id[:] }

-

-func (id ID[K]) IsZero() bool {

- var zero ID[K]

- return id == zero

-}

-

-// String returns the prefixed form for logs, JSON, errors and anywhere

-// the entity type isn't obvious from context. For URL path segments

-// where the route already names the type, use Bare().

-func (id ID[K]) String() string {

- var k K

- return k.Prefix() + "_" + encodeBase58(uuid.UUID(id))

-}

-

-// Bare returns the base58 form without a type prefix — ≤ 22 chars.

-// Use this for URL path segments where the route already identifies

-// the entity ("/org/:id"); use String() everywhere else.

-func (id ID[K]) Bare() string {

- return encodeBase58(uuid.UUID(id))

-}

-

-func (id ID[K]) LogValue() slog.Value {

- return slog.StringValue(id.String())

-}

-

-func (id ID[K]) MarshalText() ([]byte, error) {

- return []byte(id.String()), nil

-}

-

-func (id *ID[K]) UnmarshalText(b []byte) error {

- parsed, err := ParseID[K](string(b))

- if err != nil {

- return err

- }

- *id = parsed

- return nil

-}

-

-func (id *ID[K]) Scan(src any) error {

- var u uuid.UUID

- if err := u.Scan(src); err != nil {

- return err

- }

- *id = ID[K](u)

- return nil

-}

-

-func (id ID[K]) Value() (driver.Value, error) {

- return uuid.UUID(id).Value()

-}

-

-// ParseID accepts the prefixed base58 ("<prefix>_<b58>"), bare base58

-// (≤ 22 chars, as returned by Bare()), or a canonical UUID string.

-// Bare forms stay supported so existing CLI flags, manual SQL lookups

-// and URL path parameters keep working without a flag day.

-func ParseID[K IDKind](s string) (ID[K], error) {

- var k K

- u, err := parseID(k.Prefix(), s)

- return ID[K](u), err

-}

-

-func MustParseID[K IDKind](s string) ID[K] {

- id, err := ParseID[K](s)

- if err != nil {

- panic(err)

- }

- return id

-}

-

-// ParseAnyID parses a prefixed, bare base58, or canonical UUID string

-// into raw 16 bytes. Unlike ParseID[K], it does not require a known

-// entity kind — any 3-letter prefix is stripped silently. Intended for

-// CLI boundary code that dispatches on proto field names.

-func ParseAnyID(s string) ([16]byte, error) {

- if s == "" {

- return [16]byte{}, fmt.Errorf("%w: empty", ErrBadID)

- }

- // Strip any typed prefix.

- if len(s) > 4 && s[3] == '_' {

- s = s[4:]

- }

- if len(s) <= 22 {

- return decodeBase58(s)

- }

- u, err := uuid.Parse(s)

- if err != nil {

- return [16]byte{}, fmt.Errorf("%w: %w", ErrBadID, err)

- }

- return u, nil

-}

-

-// FormatAnyID formats raw 16-byte ID as bare base58. Returns base64 for

-// non-16-byte inputs as a fallback.

-func FormatAnyID(b []byte) string {

- if len(b) == 16 {

- return encodeBase58(uuid.UUID(b))

- }

- return hex.EncodeToString(b)

-}

-

-func parseID(prefix, s string) (uuid.UUID, error) {

- if s == "" {

- return uuid.Nil, fmt.Errorf("%w: empty", ErrBadID)

- }

-

- if rest, ok := strings.CutPrefix(s, prefix+"_"); ok {

- return decodeBase58(rest)

- }

-

- // Typed prefix with the wrong value — reject so a cross-type paste

- // doesn't silently fall through to the bare path.

- if len(s) > 4 && s[3] == '_' {

- return uuid.Nil, fmt.Errorf("%w: want %q, got %q", ErrBadIDPrefix, prefix, s[:3])

- }

-

- // Bare form: base58 (≤ 22 chars, from Bare()) or canonical UUID

- // (32–36 chars, from manual SQL / legacy CLI).

- if len(s) <= 22 {

- return decodeBase58(s)

- }

-

- u, err := uuid.Parse(s)

- if err != nil {

- return uuid.Nil, fmt.Errorf("%w: %w", ErrBadID, err)

- }

-

- return u, nil

-}

-

-// --- base58 (Bitcoin alphabet) ---

-//

-// 16 bytes fit in ≤ 22 base58 chars: log₅₈(2¹²⁸) ≈ 21.86.

-// UUIDv7 values in the post-1970 range always have a non-zero

-// leading byte, so encoded length is effectively a constant 21-22.

-

-const b58Alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

-

-var b58Index [256]byte

-

-func init() {

- for i := range b58Index {

- b58Index[i] = 0xff

- }

- for i := 0; i < len(b58Alphabet); i++ {

- b58Index[b58Alphabet[i]] = byte(i)

- }

-}

-

-func encodeBase58(src uuid.UUID) string {

- zeros := 0

- for zeros < 16 && src[zeros] == 0 {

- zeros++

- }

-

- buf := src // array copy; long-division is in place

- start := zeros

- out := make([]byte, 0, 22)

-

- for start < 16 {

- rem := 0

- for i := start; i < 16; i++ {

- v := rem*256 + int(buf[i])

- buf[i] = byte(v / 58)

- rem = v % 58

- }

- out = append(out, b58Alphabet[rem])

- for start < 16 && buf[start] == 0 {

- start++

- }

- }

-

- for i := 0; i < zeros; i++ {

- out = append(out, b58Alphabet[0])

- }

-

- // Reverse into big-endian order.

- for i, j := 0, len(out)-1; i < j; i, j = i+1, j-1 {

- out[i], out[j] = out[j], out[i]

- }

-

- return string(out)

-}

-

-// decodeBase58 is strict about length — any input that round-trips to a

-// value of a different byte length is rejected; we never want a

-// 15-byte or 17-byte payload masquerading as a UUID.

-func decodeBase58(s string) (uuid.UUID, error) {

- if s == "" {

- return uuid.Nil, fmt.Errorf("%w: empty", ErrBadID)

- }

- zeros := 0

- for zeros < len(s) && s[zeros] == b58Alphabet[0] {

- zeros++

- }

-

- var out uuid.UUID

- for i := zeros; i < len(s); i++ {

- v := b58Index[s[i]]

- if v == 0xff {

- return uuid.Nil, fmt.Errorf("%w: bad base58 char %q", ErrBadID, s[i])

- }

- carry := int(v)

- for j := 15; j >= 0; j-- {

- acc := int(out[j])*58 + carry

- out[j] = byte(acc)

- carry = acc >> 8

- }

- if carry != 0 {

- return uuid.Nil, fmt.Errorf("%w: overflow", ErrBadID)

- }

- }

-

- // The '1' prefix count in the string must equal the leading-zero

- // byte count in the result — any mismatch means the input decoded

- // to a different byte length than a UUID.

- actualZeros := 0

- for actualZeros < 16 && out[actualZeros] == 0 {

- actualZeros++

- }

- if actualZeros != zeros {

- return uuid.Nil, fmt.Errorf("%w: length mismatch", ErrBadID)

- }

- return out, nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "testing"

-

- "github.com/google/uuid"

-)

-

-func TestIDRoundTrip(t *testing.T) {

- for range 50 {

- id := NewID[UserKind]()

- got, err := ParseID[UserKind](id.String())

- if err != nil {

- t.Fatalf("parse prefixed: %v", err)

- }

- if got != id {

- t.Fatalf("prefixed: got %v, want %v", got, id)

- }

- got, err = ParseID[UserKind](id.Bare())

- if err != nil {

- t.Fatalf("parse bare: %v", err)

- }

- if got != id {

- t.Fatalf("bare: got %v, want %v", got, id)

- }

- }

-}

-

-func TestIDRoundTripCanonicalUUID(t *testing.T) {

- id := NewID[OrgKind]()

- got, err := ParseID[OrgKind](id.UUID().String())

- if err != nil {

- t.Fatalf("parse canonical: %v", err)

- }

- if got != id {

- t.Fatalf("canonical: got %v, want %v", got, id)

- }

-}

-

-func TestIDCrossPrefixRejected(t *testing.T) {

- id := NewID[UserKind]()

- _, err := ParseID[OrgKind](id.String())

- if err == nil {

- t.Fatal("expected error parsing usr_ as org")

- }

-}

-

-func TestBase58EdgeCases(t *testing.T) {

- cases := [][16]byte{

- {}, // all zeros

- {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}, // minimal

- {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,

- 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, // max

- }

- for _, raw := range cases {

- enc := encodeBase58(uuid.UUID(raw))

- dec, err := decodeBase58(enc)

- if err != nil {

- t.Fatalf("decode(%q): %v", enc, err)

- }

- if dec != uuid.UUID(raw) {

- t.Fatalf("roundtrip: got %x, want %x", dec, raw)

- }

- }

-}

-

-func TestIDFromBytesRejectsV4(t *testing.T) {

- v4 := uuid.Must(uuid.NewRandom()) // v4

- _, err := IDFromBytes[UserKind](v4[:])

- if err == nil {

- t.Fatal("expected v4 rejection")

- }

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "encoding/json"

- "net/http"

- "strings"

-

- mirum "dimidiumlabs/mirum"

-)

-

-// primarySPDX is the SPDX identifier of mirum itself.

-const primarySPDX = "AGPL-3.0-or-later"

-

-// licensesPageData mirrors tools/licensegen's Manifest with a primary

-// license header prepended. The frontend consumes it verbatim.

-type licensesPageData struct {

- Primary struct {

- Name string `json:"name"`

- SPDX string `json:"spdx"`

- Text string `json:"text"`

- } `json:"primary"`

- Manifest json.RawMessage `json:"manifest"`

-}

-

-var licensesData = mustLoadLicenses()

-

-func mustLoadLicenses() *licensesPageData {

- if !json.Valid(mirum.Licenses) {

- panic("embedded licenses.json is not valid JSON")

- }

- d := &licensesPageData{Manifest: mirum.Licenses}

- d.Primary.Name = "mirum"

- d.Primary.SPDX = primarySPDX

- d.Primary.Text = strings.TrimSpace(mirum.License) + "\n"

- return d

-}

-

-// licenses serves /about/licenses. Public: no auth, no CSRF.

-func (h *webHandler) licenses(w http.ResponseWriter, _ *http.Request) {

- h.assets.renderPage(w, "licenses", http.StatusOK, licensesData)

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "errors"

- "fmt"

- "log/slog"

- "net"

- "net/http"

- "os"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb/apipbconnect"

- "dimidiumlabs/mirum/internal/config"

- "dimidiumlabs/mirum/internal/forges"

- "dimidiumlabs/mirum/internal/protocol/wirepb"

- "dimidiumlabs/mirum/internal/supervisor"

-

- "github.com/spf13/cobra"

-)

-

-func hardenServer(s *http.Server) *http.Server {

- s.IdleTimeout = config.HTTPIdleTimeout

- s.MaxHeaderBytes = config.HTTPMaxHeaderBytes

- s.ReadHeaderTimeout = config.HTTPReadHeaderTimeout

- return s

-}

-

-func main() {

- var socketPath string

-

- root := &cobra.Command{Use: "mirum-server", Short: "Mirum CI server"}

- root.PersistentFlags().StringVar(&socketPath, "socket", "", "admin socket path (default from config or /run/mirum-server/admin.sock)")

- root.AddGroup(&cobra.Group{ID: "main", Title: "Commands:"})

-

- daemonCmd := &cobra.Command{

- Use: "daemon",

- Short: "Start the server",

- GroupID: "main",

- SilenceUsage: true,

- SilenceErrors: true,

- RunE: func(cmd *cobra.Command, args []string) error {

- configFile, _ := cmd.Flags().GetString("config")

- return daemon(configFile, socketPath)

- },

- }

- daemonCmd.Flags().String("config", "", "path to config file")

- _ = daemonCmd.MarkFlagRequired("config")

- root.AddCommand(daemonCmd)

-

- // Console subcommands are generated from api.proto via reflection.

- buildConsoleCLI(root, func() apipbconnect.ConsoleClient { return consoleClient(socketPath) })

- for _, c := range root.Commands() {

- if c.GroupID == "" {

- c.GroupID = "main"

- }

- }

-

- if err := root.Execute(); err != nil {

- os.Exit(1)

- }

-}

-

-func daemon(configFile, socketFlag string) error {

- cfg, err := getConfig(configFile)

- if err != nil {

- slog.Error("config parsing failed", "err", err)

- return err

- }

-

- if socketFlag != "" {

- cfg.AdminSocket = socketFlag

- }

-

- slog.Info("config loaded", "configfile", configFile)

-

- sup := supervisor.Detect()

- ctx, cancel := context.WithCancel(sup.WaitForStop(context.Background()))

- defer cancel()

-

- db, err := DatabaseOpen(ctx, cfg.DatabaseUri)

- if err != nil {

- slog.Error("couldn't open database", "err", err)

- return err

- }

-

- srv := &server{

- db: db,

- cfg: cfg,

- forge: &forges.GitHub{Secret: cfg.WebhookSecret, Token: cfg.GitHubToken},

- queue: make(chan *wirepb.Task, config.TaskQueueCapacity),

- }

- defer srv.Close()

-

- if err := db.Migrate(ctx); err != nil {

- slog.Error("migration failed", "err", err)

- return err

- }

-

- slog.Info("database ready")

-

- go srv.PurgeSessions(ctx)

-

- consolePath, consoleHandler := NewConsoleHandler(srv)

-

- webSrv := hardenServer(NewWebServer(ctx, srv, consolePath, consoleHandler))

- grpcSrv := hardenServer(NewGrpcServer(ctx, srv))

-

- adminMux := http.NewServeMux()

- adminMux.Handle(consolePath, consoleHandler)

- adminSrv := hardenServer(&http.Server{

- Handler: adminMux,

- ConnContext: func(ctx context.Context, _ net.Conn) context.Context {

- return context.WithValue(ctx, actorKey{}, OperatorActor())

- },

- BaseContext: func(_ net.Listener) context.Context {

- return ctx

- },

- })

-

- grpcLn, webLn, adminLn, err := listeners(cfg, sup)

- if err != nil {

- slog.Error("listeners failed", "err", err)

- return err

- }

-

- slog.Info("listening", "grpc", grpcLn.Addr(), "web", webLn.Addr(), "admin", cfg.AdminSocket)

-

- errs := make(chan error, 3)

- serve := func(name string, fn func() error) {

- go func() {

- err := fn()

- if errors.Is(err, http.ErrServerClosed) {

- err = nil

- }

- if err != nil {

- err = fmt.Errorf("%s server: %w", name, err)

- }

- errs <- err

- }()

- }

- serve("web", func() error {

- if webSrv.TLSConfig != nil {

- return webSrv.ServeTLS(webLn, "", "")

- }

- return webSrv.Serve(webLn)

- })

- serve("grpc", func() error { return grpcSrv.ServeTLS(grpcLn, "", "") })

- serve("admin", func() error { return adminSrv.Serve(adminLn) })

-

- sup.Ready()

- go sup.StartWatchdog(ctx)

-

- var runErr error

- select {

- case <-ctx.Done():

- slog.Info("shutting down")

- case err := <-errs:

- runErr = err

- // Propagate the crash to all handler contexts so Poll and

- // other long-lived RPCs exit via ctx.Done(); Shutdown below

- // then completes without waiting on them.

- cancel()

- if err != nil {

- slog.Error("server exited, shutting down peers", "err", err)

- } else {

- slog.Warn("server exited unexpectedly, shutting down peers")

- }

- }

-

- sup.Stopping()

-

- shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), config.HTTPShutdownTimeout)

- defer shutdownCancel()

-

- shutdown := func(name string, s *http.Server) {

- if err := s.Shutdown(shutdownCtx); err != nil {

- slog.Error("server shutdown", "name", name, "err", err)

- }

- }

-

- shutdown("web", webSrv)

- shutdown("grpc", grpcSrv)

- shutdown("admin", adminSrv)

-

- return runErr

-}

-

-// listeners returns gRPC, web, and admin listeners.

-// With systemd socket activation it expects two named fds: "grpc" and "web".

-// Without socket activation it falls back to configured addresses.

-func listeners(cfg *appConfig, sup supervisor.Supervisor) (grpcLn, webLn, adminLn net.Listener, err error) {

- named, err := sup.ActivationListeners()

- if err != nil {

- return nil, nil, nil, fmt.Errorf("socket activation: %w", err)

- }

-

- if lns := named["grpc"]; len(lns) > 0 {

- grpcLn = lns[0]

- } else if grpcLn, err = net.Listen("tcp", cfg.GrpcAddr); err != nil {

- return nil, nil, nil, err

- }

- defer func() {

- if err != nil && grpcLn != nil {

- _ = grpcLn.Close()

- }

- }()

-

- if lns := named["web"]; len(lns) > 0 {

- webLn = lns[0]

- } else if webLn, err = net.Listen("tcp", cfg.WebAddr); err != nil {

- return nil, nil, nil, err

- }

- defer func() {

- if err != nil && webLn != nil {

- _ = webLn.Close()

- }

- }()

-

- _ = os.Remove(cfg.AdminSocket)

- if adminLn, err = net.Listen("unix", cfg.AdminSocket); err != nil {

- return nil, nil, nil, err

- }

- defer func() {

- if err != nil && adminLn != nil {

- _ = adminLn.Close()

- }

- }()

-

- if err = os.Chmod(cfg.AdminSocket, 0o660); err != nil {

- return nil, nil, nil, fmt.Errorf("chmod admin socket: %w", err)

- }

-

- return grpcLn, webLn, adminLn, nil

-}

-

-func consoleClient(socketPath string) apipbconnect.ConsoleClient {

- if socketPath == "" {

- socketPath = "/run/mirum-server/admin.sock"

- }

- return apipbconnect.NewConsoleClient(

- &http.Client{

- Transport: &http.Transport{

- DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {

- return net.Dial("unix", socketPath)

- },

- },

- },

- "http://localhost.unix",

- )

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-syntax = "proto3";

-

-package mirum.api;

-

-import "buf/validate/validate.proto";

-import "google/protobuf/timestamp.proto";

-

-option go_package = "dimidiumlabs/mirum/cmd/mirum-server/apipb";

-

-service Console {

- rpc UserCreate(UserCreateRequest) returns (UserCreateResponse);

- rpc UserGet(UserGetRequest) returns (UserGetResponse);

- rpc UserList(UserListRequest) returns (UserListResponse);

- rpc UserUpdate(UserUpdateRequest) returns (UserUpdateResponse);

- rpc UserDelete(UserDeleteRequest) returns (UserDeleteResponse);

-

- rpc OrgCreate(OrgCreateRequest) returns (OrgCreateResponse);

- rpc OrgGet(OrgGetRequest) returns (OrgGetResponse);

- rpc OrgList(OrgListRequest) returns (OrgListResponse);

- rpc OrgUpdate(OrgUpdateRequest) returns (OrgUpdateResponse);

- rpc OrgDelete(OrgDeleteRequest) returns (OrgDeleteResponse);

-

- rpc OrgMemberAdd(OrgMemberAddRequest) returns (OrgMemberAddResponse);

- rpc OrgMemberGet(OrgMemberGetRequest) returns (OrgMemberGetResponse);

- rpc OrgMemberList(OrgMemberListRequest) returns (OrgMemberListResponse);

- rpc OrgMemberUpdate(OrgMemberUpdateRequest) returns (OrgMemberUpdateResponse);

- rpc OrgMemberRemove(OrgMemberRemoveRequest) returns (OrgMemberRemoveResponse);

-

- rpc WorkerCreate(WorkerCreateRequest) returns (WorkerCreateResponse);

- rpc WorkerGet(WorkerGetRequest) returns (WorkerGetResponse);

- rpc WorkerList(WorkerListRequest) returns (WorkerListResponse);

- rpc WorkerDelete(WorkerDeleteRequest) returns (WorkerDeleteResponse);

-}

-

-// Common types

-

-enum Role {

- ROLE_NONE = 0;

- ROLE_OWNER = 1;

- ROLE_ADMIN = 2;

- ROLE_MEMBER = 3;

-}

-

-enum Perm {

- PERM_NONE = 0;

-

- PERM_USER_READ = 1;

- PERM_USER_WRITE = 2;

- PERM_USER_DELETE = 3;

-

- PERM_ORG_READ = 4;

- PERM_ORG_WRITE = 5;

- PERM_ORG_DELETE = 6;

- PERM_ORG_MEMBER_READ = 7;

- PERM_ORG_MEMBER_WRITE = 8;

-

- PERM_WORKER_READ = 9;

- PERM_WORKER_WRITE = 10;

-}

-

-// ErrorInfo is attached as a ConnectError detail on every error.

-// The ConnectError message field is always empty — the server never sends

-// human-readable text. Clients switch on reason to select user-facing copy.

-message ErrorInfo {

- ErrorReason reason = 1;

-

- // Short stable identifiers for UI targeting (e.g. {"field": "slug"}).

- // Never human-readable text.

- map<string, string> metadata = 2;

-}

-

-enum ErrorReason {

- ERROR_REASON_UNSPECIFIED = 0;

- ERROR_REASON_INTERNAL = 1;

-

- // Lookup failures

- ERROR_REASON_USER_NOT_FOUND = 10;

- ERROR_REASON_ORG_NOT_FOUND = 11;

- ERROR_REASON_WORKER_NOT_FOUND = 12;

- ERROR_REASON_MEMBER_NOT_FOUND = 13;

-

- // Conflicts

- ERROR_REASON_EMAIL_TAKEN = 20;

- ERROR_REASON_SLUG_TAKEN = 21;

- ERROR_REASON_ALREADY_MEMBER = 22;

-

- // State preconditions

- ERROR_REASON_LAST_OWNER = 30;

- ERROR_REASON_SOLE_OWNER = 31;

-

- // Validation

- ERROR_REASON_INVALID_SLUG = 40;

- ERROR_REASON_INVALID_ROLE = 41;

- ERROR_REASON_RESERVED_EMAIL = 42;

- ERROR_REASON_INVALID_LOCALE = 43;

- ERROR_REASON_INVALID_DATE_FORMAT = 44;

- ERROR_REASON_INVALID_TIMEZONE = 45;

-

- // Auth

- ERROR_REASON_UNAUTHENTICATED = 50;

- ERROR_REASON_PERMISSION_DENIED = 51;

- ERROR_REASON_INVALID_CREDENTIALS = 52;

- ERROR_REASON_INVALID_CSRF = 53;

-

- // Infrastructure

- ERROR_REASON_RATE_LIMITED = 60;

- ERROR_REASON_UNAVAILABLE = 61;

- ERROR_REASON_UNIMPLEMENTED = 62;

-}

-

-message UserRef {

- oneof ref {

- option (buf.validate.oneof).required = true;

- bytes id = 1 [(buf.validate.field).bytes = {

- min_len: 16

- max_len: 16

- }];

- string email = 2 [(buf.validate.field).string.email = true];

- }

-}

-

-message OrgRef {

- oneof ref {

- option (buf.validate.oneof).required = true;

- bytes id = 1 [(buf.validate.field).bytes = {

- min_len: 16

- max_len: 16

- }];

- string slug = 2 [(buf.validate.field).string = {

- min_len: 2

- max_len: 64

- }];

- }

-}

-

-message PageRequest {

- bytes cursor = 1;

- int32 page_size = 2;

-}

-message PageResponse {

- bytes next_cursor = 1;

- int32 total_count = 2;

-}

-

-// User management

-

-message Locale {

- optional string language = 1;

- optional DateFormat date_format = 2;

-}

-

-enum DateFormat {

- DATE_FORMAT_UNSPECIFIED = 0;

- DATE_FORMAT_DMY = 1;

- DATE_FORMAT_MDY = 2;

- DATE_FORMAT_YMD = 3;

-}

-

-message User {

- bytes id = 1;

- string email = 2;

- google.protobuf.Timestamp created_at = 3;

- Locale locale = 4;

- optional string timezone = 5;

-}

-

-message UserCreateRequest {

- string email = 1 [(buf.validate.field).string.email = true];

- string password = 2 [(buf.validate.field).string.min_len = 1];

-}

-message UserCreateResponse {

- bytes id = 1;

-}

-

-message UserGetRequest {

- UserRef user = 1 [(buf.validate.field).required = true];

-}

-message UserGetResponse {

- User user = 1;

-}

-

-message UserListRequest {

- optional PageRequest page = 1;

- optional string filter = 2;

-}

-message UserListResponse {

- PageResponse page = 1;

- repeated User users = 2;

-}

-

-message UserUpdateRequest {

- UserRef user = 1 [(buf.validate.field).required = true];

- optional string email = 2 [(buf.validate.field).string.email = true];

- optional string password = 3 [(buf.validate.field).string.min_len = 1];

- optional Locale locale = 4;

- optional string timezone = 5;

-}

-message UserUpdateResponse {}

-

-message UserDeleteRequest {

- UserRef user = 1 [(buf.validate.field).required = true];

-}

-message UserDeleteResponse {}

-

-// Organization management

-

-message Org {

- bytes id = 1;

- string name = 2;

- string slug = 3;

- bool public = 4;

- google.protobuf.Timestamp created_at = 5;

-}

-

-message OrgCreateRequest {

- string name = 1 [(buf.validate.field).string.min_len = 1];

- string slug = 2 [(buf.validate.field).string = {

- min_len: 2

- max_len: 64

- }];

- UserRef owner = 3 [(buf.validate.field).required = true];

- bool public = 4;

-}

-message OrgCreateResponse {

- bytes id = 1;

-}

-

-message OrgGetRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

-}

-message OrgGetResponse {

- Org org = 1;

-}

-

-message OrgListRequest {

- optional PageRequest page = 1;

- optional string filter = 2;

-}

-message OrgListResponse {

- PageResponse page = 1;

- repeated Org organizations = 2;

-}

-

-message OrgUpdateRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

- optional string name = 2 [(buf.validate.field).string.min_len = 1];

- optional string slug = 3 [(buf.validate.field).string = {

- min_len: 2

- max_len: 64

- }];

- optional bool public = 4;

-}

-message OrgUpdateResponse {}

-

-message OrgDeleteRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

-}

-message OrgDeleteResponse {}

-

-// Organization members

-

-message OrgMemberInfo {

- User user = 1;

- Role role = 2;

- google.protobuf.Timestamp joined_at = 3;

-}

-

-message OrgMemberGetRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

- UserRef user = 2 [(buf.validate.field).required = true];

-}

-message OrgMemberGetResponse {

- OrgMemberInfo member = 1;

-}

-

-message OrgMemberAddRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

- UserRef user = 2 [(buf.validate.field).required = true];

- Role role = 3 [(buf.validate.field).enum = {

- defined_only: true

- not_in: [0]

- }];

-}

-message OrgMemberAddResponse {}

-

-message OrgMemberListRequest {

- optional PageRequest page = 1;

- OrgRef org = 2 [(buf.validate.field).required = true];

- optional string filter = 3;

-}

-message OrgMemberListResponse {

- PageResponse page = 1;

- repeated OrgMemberInfo members = 2;

-}

-

-message OrgMemberUpdateRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

- UserRef user = 2 [(buf.validate.field).required = true];

- Role role = 3 [(buf.validate.field).enum = {

- defined_only: true

- not_in: [0]

- }];

-}

-message OrgMemberUpdateResponse {}

-

-message OrgMemberRemoveRequest {

- OrgRef org = 1 [(buf.validate.field).required = true];

- UserRef user = 2 [(buf.validate.field).required = true];

-}

-message OrgMemberRemoveResponse {}

-

-// Worker management

-

-message Worker {

- bytes id = 1;

- bytes public_key = 2;

- optional bytes org_id = 3;

- google.protobuf.Timestamp created_at = 4;

-}

-

-message WorkerCreateRequest {

- bytes public_key = 1 [(buf.validate.field).bytes = {

- min_len: 32

- max_len: 32

- }];

- optional OrgRef org = 2;

-}

-message WorkerCreateResponse {

- bytes id = 1;

-}

-

-message WorkerGetRequest {

- bytes id = 1 [(buf.validate.field).bytes = {

- min_len: 16

- max_len: 16

- }];

-}

-message WorkerGetResponse {

- Worker worker = 1;

-}

-

-message WorkerListRequest {

- optional PageRequest page = 1;

- optional string filter = 2;

-}

-message WorkerListResponse {

- PageResponse page = 1;

- repeated Worker workers = 2;

-}

-

-message WorkerDeleteRequest {

- bytes id = 1 [(buf.validate.field).bytes = {

- min_len: 16

- max_len: 16

- }];

-}

-message WorkerDeleteResponse {}

-# SPDX-FileCopyrightText: 2026 Nikolay Govorov

-# SPDX-License-Identifier: AGPL-3.0-or-later

-

-version: v2

-plugins:

- - local: ["go", "tool", "google.golang.org/protobuf/cmd/protoc-gen-go"]

- out: ../apipb

- opt: paths=source_relative

- - local: ["go", "tool", "connectrpc.com/connect/cmd/protoc-gen-connect-go"]

- out: ../apipb

- opt: paths=source_relative

- - local: ["../web/node_modules/.bin/protoc-gen-es"]

- out: ../web/gen

- opt:

- - target=ts

- - import_extension=js

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "fmt"

- "log/slog"

- "sync"

- "sync/atomic"

- "time"

-

- "dimidiumlabs/mirum/internal/config"

- "dimidiumlabs/mirum/internal/forges"

- "dimidiumlabs/mirum/internal/protocol/wirepb"

-)

-

-// server holds the shared application state.

-type server struct {

- cfg *appConfig

- db *DB

- forge forges.Forge

-

- queue chan *wirepb.Task

- tasks sync.Map // task_id → *forges.PushEvent

- taskCounter atomic.Int64

-}

-

-// Close releases resources owned by the server. Call exactly once, after

-// all HTTP servers have finished Shutdown.

-func (s *server) Close() {

- s.db.Close()

-}

-

-// PurgeSessions periodically deletes expired sessions until ctx is cancelled.

-func (s *server) PurgeSessions(ctx context.Context) {

- ticker := time.NewTicker(config.SessionPurgeInterval)

- defer ticker.Stop()

-

- for {

- select {

- case <-ticker.C:

- if err := s.db.UserSessionPurgeExpired(ctx); err != nil {

- slog.Error("purge sessions", "err", err)

- }

- case <-ctx.Done():

- return

- }

- }

-}

-

-func (s *server) enqueue(ctx context.Context, ev *forges.PushEvent) (string, error) {

- id := fmt.Sprintf("task-%d", s.taskCounter.Add(1))

-

- slog.Info("push", "repo", ev.Owner+"/"+ev.Repo, "branch", ev.Branch, "sha", ev.SHA[:8], "task", id)

-

- s.tasks.Store(id, ev)

- _ = s.forge.SetStatus(ctx, ev, forges.StatusPending, "Queued")

-

- select {

- case s.queue <- &wirepb.Task{

- Id: id,

- CloneUrl: s.forge.AuthURL(ev.CloneURL),

- Branch: ev.Branch,

- Sha: ev.SHA,

- RepoFullName: ev.Owner + "/" + ev.Repo,

- }:

- return id, nil

- case <-ctx.Done():

- s.tasks.Delete(id)

- return "", ctx.Err()

- }

-}

-

-func (s *server) complete(ctx context.Context, taskID string, success bool, errMsg string) error {

- val, ok := s.tasks.LoadAndDelete(taskID)

- if !ok {

- return fmt.Errorf("unknown task: %s", taskID)

- }

- ev := val.(*forges.PushEvent)

-

- st := forges.StatusSuccess

- desc := "Build passed"

- if !success {

- st = forges.StatusFailure

- desc = "Build failed"

- if errMsg != "" {

- desc = errMsg

- }

- }

-

- if err := s.forge.SetStatus(ctx, ev, st, desc); err != nil {

- slog.Error("set status", "task", taskID, "err", err)

- }

-

- slog.Info("task complete", "id", taskID, "success", success)

- return nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "errors"

- "log/slog"

- "net/http"

-

- "connectrpc.com/connect"

- "connectrpc.com/validate"

- "google.golang.org/protobuf/types/known/timestamppb"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb"

- "dimidiumlabs/mirum/cmd/mirum-server/apipb/apipbconnect"

-)

-

-// NewConsoleHandler creates the ConnectRPC handler with validation.

-// Authorization is handled inside DB methods, not by an interceptor.

-func NewConsoleHandler(srv *server) (string, http.Handler) {

- as := &consoleService{srv: srv}

- return apipbconnect.NewConsoleHandler(as,

- connect.WithInterceptors(validate.NewInterceptor()),

- )

-}

-

-type consoleService struct {

- apipbconnect.UnimplementedConsoleHandler

- srv *server

-}

-

-// --- Error mapping ---

-

-// newAPIError builds a ConnectError with an empty message string and attaches

-// an ErrorInfo detail carrying the domain reason. Clients switch on reason to

-// pick user-facing text; the wire never carries human-readable strings.

-func newAPIError(code connect.Code, reason apipb.ErrorReason, metadata map[string]string) error {

- e := connect.NewError(code, nil)

- if d, err := connect.NewErrorDetail(&apipb.ErrorInfo{Reason: reason, Metadata: metadata}); err == nil {

- e.AddDetail(d)

- }

- return e

-}

-

-var errSpecs = []struct {

- err error

- code connect.Code

- reason apipb.ErrorReason

-}{

- {ErrUserNotFound, connect.CodeNotFound, apipb.ErrorReason_ERROR_REASON_USER_NOT_FOUND},

- {ErrOrgNotFound, connect.CodeNotFound, apipb.ErrorReason_ERROR_REASON_ORG_NOT_FOUND},

- {ErrWorkerNotFound, connect.CodeNotFound, apipb.ErrorReason_ERROR_REASON_WORKER_NOT_FOUND},

- {ErrNotMember, connect.CodeNotFound, apipb.ErrorReason_ERROR_REASON_MEMBER_NOT_FOUND},

- {ErrEmailTaken, connect.CodeAlreadyExists, apipb.ErrorReason_ERROR_REASON_EMAIL_TAKEN},

- {ErrSlugTaken, connect.CodeAlreadyExists, apipb.ErrorReason_ERROR_REASON_SLUG_TAKEN},

- {ErrAlreadyMember, connect.CodeAlreadyExists, apipb.ErrorReason_ERROR_REASON_ALREADY_MEMBER},

- {ErrLastOwner, connect.CodeFailedPrecondition, apipb.ErrorReason_ERROR_REASON_LAST_OWNER},

- {ErrSoleOwner, connect.CodeFailedPrecondition, apipb.ErrorReason_ERROR_REASON_SOLE_OWNER},

- {ErrInvalidSlug, connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_SLUG},

- {ErrInvalidRole, connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_ROLE},

- {ErrInvalidDateFormat, connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_DATE_FORMAT},

- {ErrInvalidTimezone, connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_TIMEZONE},

- {ErrReservedEmail, connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_RESERVED_EMAIL},

- {ErrPermissionDenied, connect.CodePermissionDenied, apipb.ErrorReason_ERROR_REASON_PERMISSION_DENIED},

- {ErrUnauthenticated, connect.CodeUnauthenticated, apipb.ErrorReason_ERROR_REASON_UNAUTHENTICATED},

- {ErrNotImplemented, connect.CodeUnimplemented, apipb.ErrorReason_ERROR_REASON_UNIMPLEMENTED},

-}

-

-func mapErr(err error) error {

- if err == nil {

- return nil

- }

- for _, s := range errSpecs {

- if errors.Is(err, s.err) {

- return newAPIError(s.code, s.reason, nil)

- }

- }

- slog.Error("unmapped handler error", "err", err)

- return newAPIError(connect.CodeInternal, apipb.ErrorReason_ERROR_REASON_INTERNAL, nil)

-}

-

-// --- Ref converters ---

-

-func userRef(r *apipb.UserRef) (UserRef, error) {

- switch v := r.GetRef().(type) {

- case *apipb.UserRef_Id:

- id, err := IDFromBytes[UserKind](v.Id)

- if err != nil {

- return UserRef{}, err

- }

- return UserByID(id), nil

- case *apipb.UserRef_Email:

- return UserByEmail(v.Email), nil

- default:

- return UserRef{}, nil

- }

-}

-

-func orgRef(r *apipb.OrgRef) (OrgRef, error) {

- switch v := r.GetRef().(type) {

- case *apipb.OrgRef_Id:

- id, err := IDFromBytes[OrgKind](v.Id)

- if err != nil {

- return OrgRef{}, err

- }

- return OrgByID(id), nil

- case *apipb.OrgRef_Slug:

- return OrgBySlug(v.Slug), nil

- default:

- return OrgRef{}, nil

- }

-}

-

-// --- Role converters ---

-

-var roleToString = map[apipb.Role]string{

- apipb.Role_ROLE_OWNER: "owner",

- apipb.Role_ROLE_ADMIN: "admin",

- apipb.Role_ROLE_MEMBER: "member",

-}

-

-var roleToProto = map[string]apipb.Role{

- "owner": apipb.Role_ROLE_OWNER,

- "admin": apipb.Role_ROLE_ADMIN,

- "member": apipb.Role_ROLE_MEMBER,

-}

-

-// --- Page helpers ---

-

-const (

- defaultPageSize = 50

- maxPageSize = 200

-)

-

-func pageParams[K IDKind](p *apipb.PageRequest) (cursor ID[K], limit int, err error) {

- limit = defaultPageSize

- if p != nil {

- if p.PageSize > 0 && int(p.PageSize) < maxPageSize {

- limit = int(p.PageSize)

- } else if int(p.PageSize) >= maxPageSize {

- limit = maxPageSize

- }

- if len(p.Cursor) == 16 {

- cursor, err = IDFromBytes[K](p.Cursor)

- if err != nil {

- return

- }

- }

- }

- return

-}

-

-func pageResponse[K IDKind](items int, limit int, lastID ID[K], total int) *apipb.PageResponse {

- resp := &apipb.PageResponse{TotalCount: int32(total)}

- if items == limit {

- resp.NextCursor = lastID.Bytes()

- }

- return resp

-}

-

-// --- Proto converters ---

-

-func userToProto(u User) *apipb.User {

- pb := &apipb.User{

- Id: u.ID.Bytes(), Email: u.Email, CreatedAt: timestamppb.New(u.CreatedAt),

- Timezone: u.Timezone,

- }

- pb.Locale = &apipb.Locale{Language: u.Locale.Language}

- if u.Locale.DateFormat != nil {

- df := apipb.DateFormat(*u.Locale.DateFormat)

- pb.Locale.DateFormat = &df

- }

- return pb

-}

-

-func orgToProto(o Organization) *apipb.Org {

- return &apipb.Org{

- Id: o.ID.Bytes(), Name: o.Name, Slug: o.Slug,

- Public: o.Public, CreatedAt: timestamppb.New(o.CreatedAt),

- }

-}

-

-func memberToProto(m OrgMember) *apipb.OrgMemberInfo {

- return &apipb.OrgMemberInfo{

- User: userToProto(m.User), Role: roleToProto[m.Role],

- JoinedAt: timestamppb.New(m.JoinedAt),

- }

-}

-

-func workerToProto(w Worker) *apipb.Worker {

- pw := &apipb.Worker{

- Id: w.ID.Bytes(), PublicKey: w.PublicKey, CreatedAt: timestamppb.New(w.CreatedAt),

- }

- if w.OrgID != nil {

- pw.OrgId = w.OrgID.Bytes()

- }

- return pw

-}

-

-// --- User handlers ---

-

-func (a *consoleService) UserCreate(ctx context.Context, req *connect.Request[apipb.UserCreateRequest]) (*connect.Response[apipb.UserCreateResponse], error) {

- id, err := a.srv.db.UserCreate(ctx, ActorFromContext(ctx), req.Msg.Email, req.Msg.Password, []byte(a.srv.cfg.Pepper))

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.UserCreateResponse{Id: id.Bytes()}), nil

-}

-

-func (a *consoleService) UserGet(ctx context.Context, req *connect.Request[apipb.UserGetRequest]) (*connect.Response[apipb.UserGetResponse], error) {

- ref, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- u, err := a.srv.db.UserGet(ctx, ActorFromContext(ctx), ref)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.UserGetResponse{User: userToProto(*u)}), nil

-}

-

-func (a *consoleService) UserList(ctx context.Context, req *connect.Request[apipb.UserListRequest]) (*connect.Response[apipb.UserListResponse], error) {

- cursor, limit, err := pageParams[UserKind](req.Msg.Page)

- if err != nil {

- return nil, mapErr(err)

- }

- filter := ""

- if req.Msg.Filter != nil {

- filter = *req.Msg.Filter

- }

-

- users, total, err := a.srv.db.UserList(ctx, ActorFromContext(ctx), cursor, limit, filter)

- if err != nil {

- return nil, mapErr(err)

- }

-

- out := make([]*apipb.User, len(users))

- for i := range users {

- out[i] = userToProto(users[i])

- }

-

- var lastID UserID

- if len(users) > 0 {

- lastID = users[len(users)-1].ID

- }

-

- return connect.NewResponse(&apipb.UserListResponse{

- Page: pageResponse(len(users), limit, lastID, total),

- Users: out,

- }), nil

-}

-

-func (a *consoleService) UserUpdate(ctx context.Context, req *connect.Request[apipb.UserUpdateRequest]) (*connect.Response[apipb.UserUpdateResponse], error) {

- ref, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- p := UserUpdateParams{

- Email: req.Msg.Email,

- Password: req.Msg.Password,

- Timezone: req.Msg.Timezone,

- }

- if req.Msg.Locale != nil {

- p.Locale = &Locale{Language: req.Msg.Locale.Language}

- if req.Msg.Locale.DateFormat != nil {

- df := DateFormat(*req.Msg.Locale.DateFormat)

- p.Locale.DateFormat = &df

- }

- }

- if err := a.srv.db.UserUpdate(ctx, ActorFromContext(ctx), ref, p, []byte(a.srv.cfg.Pepper)); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.UserUpdateResponse{}), nil

-}

-

-func (a *consoleService) UserDelete(ctx context.Context, req *connect.Request[apipb.UserDeleteRequest]) (*connect.Response[apipb.UserDeleteResponse], error) {

- ref, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.UserDelete(ctx, ActorFromContext(ctx), ref); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.UserDeleteResponse{}), nil

-}

-

-// --- Org handlers ---

-

-func (a *consoleService) OrgCreate(ctx context.Context, req *connect.Request[apipb.OrgCreateRequest]) (*connect.Response[apipb.OrgCreateResponse], error) {

- slug, err := ValidateSlug(req.Msg.Slug)

- if err != nil {

- return nil, mapErr(err)

- }

- owner, err := userRef(req.Msg.Owner)

- if err != nil {

- return nil, mapErr(err)

- }

- id, err := a.srv.db.OrgCreate(ctx, ActorFromContext(ctx), req.Msg.Name, slug, req.Msg.Public, owner)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgCreateResponse{Id: id.Bytes()}), nil

-}

-

-func (a *consoleService) OrgGet(ctx context.Context, req *connect.Request[apipb.OrgGetRequest]) (*connect.Response[apipb.OrgGetResponse], error) {

- ref, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- o, err := a.srv.db.OrgGet(ctx, ActorFromContext(ctx), ref)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgGetResponse{Org: orgToProto(*o)}), nil

-}

-

-func (a *consoleService) OrgList(ctx context.Context, req *connect.Request[apipb.OrgListRequest]) (*connect.Response[apipb.OrgListResponse], error) {

- cursor, limit, err := pageParams[OrgKind](req.Msg.Page)

- if err != nil {

- return nil, mapErr(err)

- }

- filter := ""

- if req.Msg.Filter != nil {

- filter = *req.Msg.Filter

- }

-

- orgs, total, err := a.srv.db.OrgList(ctx, ActorFromContext(ctx), cursor, limit, filter)

- if err != nil {

- return nil, mapErr(err)

- }

-

- out := make([]*apipb.Org, len(orgs))

- for i := range orgs {

- out[i] = orgToProto(orgs[i])

- }

-

- var lastID OrgID

- if len(orgs) > 0 {

- lastID = orgs[len(orgs)-1].ID

- }

-

- return connect.NewResponse(&apipb.OrgListResponse{

- Page: pageResponse(len(orgs), limit, lastID, total),

- Organizations: out,

- }), nil

-}

-

-func (a *consoleService) OrgUpdate(ctx context.Context, req *connect.Request[apipb.OrgUpdateRequest]) (*connect.Response[apipb.OrgUpdateResponse], error) {

- var slug *string

- if req.Msg.Slug != nil {

- s, err := ValidateSlug(*req.Msg.Slug)

- if err != nil {

- return nil, mapErr(err)

- }

- slug = &s

- }

- ref, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.OrgUpdate(ctx, ActorFromContext(ctx), ref, req.Msg.Name, slug, req.Msg.Public); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgUpdateResponse{}), nil

-}

-

-func (a *consoleService) OrgDelete(ctx context.Context, req *connect.Request[apipb.OrgDeleteRequest]) (*connect.Response[apipb.OrgDeleteResponse], error) {

- ref, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.OrgDelete(ctx, ActorFromContext(ctx), ref); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgDeleteResponse{}), nil

-}

-

-// --- OrgMember handlers ---

-

-func (a *consoleService) OrgMemberAdd(ctx context.Context, req *connect.Request[apipb.OrgMemberAddRequest]) (*connect.Response[apipb.OrgMemberAddResponse], error) {

- role, ok := roleToString[req.Msg.Role]

- if !ok {

- return nil, newAPIError(connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_ROLE, nil)

- }

- org, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- user, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.OrgMemberAdd(ctx, ActorFromContext(ctx), org, user, role); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgMemberAddResponse{}), nil

-}

-

-func (a *consoleService) OrgMemberGet(ctx context.Context, req *connect.Request[apipb.OrgMemberGetRequest]) (*connect.Response[apipb.OrgMemberGetResponse], error) {

- org, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- user, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- m, err := a.srv.db.OrgMemberGet(ctx, ActorFromContext(ctx), org, user)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgMemberGetResponse{Member: memberToProto(*m)}), nil

-}

-

-func (a *consoleService) OrgMemberList(ctx context.Context, req *connect.Request[apipb.OrgMemberListRequest]) (*connect.Response[apipb.OrgMemberListResponse], error) {

- cursor, limit, err := pageParams[UserKind](req.Msg.Page)

- if err != nil {

- return nil, mapErr(err)

- }

- filter := ""

- if req.Msg.Filter != nil {

- filter = *req.Msg.Filter

- }

- org, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

-

- members, total, err := a.srv.db.OrgMembersList(ctx, ActorFromContext(ctx), org, cursor, limit, filter)

- if err != nil {

- return nil, mapErr(err)

- }

-

- out := make([]*apipb.OrgMemberInfo, len(members))

- for i := range members {

- out[i] = memberToProto(members[i])

- }

-

- var lastID UserID

- if len(members) > 0 {

- lastID = members[len(members)-1].User.ID

- }

-

- return connect.NewResponse(&apipb.OrgMemberListResponse{

- Page: pageResponse(len(members), limit, lastID, total),

- Members: out,

- }), nil

-}

-

-func (a *consoleService) OrgMemberUpdate(ctx context.Context, req *connect.Request[apipb.OrgMemberUpdateRequest]) (*connect.Response[apipb.OrgMemberUpdateResponse], error) {

- role, ok := roleToString[req.Msg.Role]

- if !ok {

- return nil, newAPIError(connect.CodeInvalidArgument, apipb.ErrorReason_ERROR_REASON_INVALID_ROLE, nil)

- }

- org, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- user, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.OrgMemberUpdateRole(ctx, ActorFromContext(ctx), org, user, role); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgMemberUpdateResponse{}), nil

-}

-

-func (a *consoleService) OrgMemberRemove(ctx context.Context, req *connect.Request[apipb.OrgMemberRemoveRequest]) (*connect.Response[apipb.OrgMemberRemoveResponse], error) {

- org, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- user, err := userRef(req.Msg.User)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.OrgMemberRemove(ctx, ActorFromContext(ctx), org, user); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.OrgMemberRemoveResponse{}), nil

-}

-

-// --- Worker handlers ---

-

-func (a *consoleService) WorkerCreate(ctx context.Context, req *connect.Request[apipb.WorkerCreateRequest]) (*connect.Response[apipb.WorkerCreateResponse], error) {

- var org *OrgRef

- if req.Msg.Org != nil {

- r, err := orgRef(req.Msg.Org)

- if err != nil {

- return nil, mapErr(err)

- }

- org = &r

- }

- id, err := a.srv.db.WorkerCreate(ctx, ActorFromContext(ctx), req.Msg.PublicKey, org)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.WorkerCreateResponse{Id: id.Bytes()}), nil

-}

-

-func (a *consoleService) WorkerGet(ctx context.Context, req *connect.Request[apipb.WorkerGetRequest]) (*connect.Response[apipb.WorkerGetResponse], error) {

- wid, err := IDFromBytes[WorkerKind](req.Msg.Id)

- if err != nil {

- return nil, mapErr(err)

- }

- w, err := a.srv.db.WorkerGet(ctx, ActorFromContext(ctx), wid)

- if err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.WorkerGetResponse{Worker: workerToProto(*w)}), nil

-}

-

-func (a *consoleService) WorkerList(ctx context.Context, req *connect.Request[apipb.WorkerListRequest]) (*connect.Response[apipb.WorkerListResponse], error) {

- cursor, limit, err := pageParams[WorkerKind](req.Msg.Page)

- if err != nil {

- return nil, mapErr(err)

- }

- filter := ""

- if req.Msg.Filter != nil {

- filter = *req.Msg.Filter

- }

-

- workers, total, err := a.srv.db.WorkerList(ctx, ActorFromContext(ctx), cursor, limit, filter)

- if err != nil {

- return nil, mapErr(err)

- }

-

- out := make([]*apipb.Worker, len(workers))

- for i := range workers {

- out[i] = workerToProto(workers[i])

- }

-

- var lastID WorkerID

- if len(workers) > 0 {

- lastID = workers[len(workers)-1].ID

- }

-

- return connect.NewResponse(&apipb.WorkerListResponse{

- Page: pageResponse(len(workers), limit, lastID, total),

- Workers: out,

- }), nil

-}

-

-func (a *consoleService) WorkerDelete(ctx context.Context, req *connect.Request[apipb.WorkerDeleteRequest]) (*connect.Response[apipb.WorkerDeleteResponse], error) {

- wid, err := IDFromBytes[WorkerKind](req.Msg.Id)

- if err != nil {

- return nil, mapErr(err)

- }

- if err := a.srv.db.WorkerDelete(ctx, ActorFromContext(ctx), wid); err != nil {

- return nil, mapErr(err)

- }

- return connect.NewResponse(&apipb.WorkerDeleteResponse{}), nil

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "crypto/ed25519"

- "crypto/tls"

- "crypto/x509"

- "errors"

- "fmt"

- "log/slog"

- "net"

- "net/http"

- "time"

-

- "connectrpc.com/connect"

- "connectrpc.com/validate"

-

- "dimidiumlabs/mirum/internal/config"

- "dimidiumlabs/mirum/internal/protocol"

- "dimidiumlabs/mirum/internal/protocol/wirepb"

- "dimidiumlabs/mirum/internal/protocol/wirepb/wirepbconnect"

-)

-

-func NewGrpcServer(ctx context.Context, srv *server) *http.Server {

- gsrv := &grpcService{srv: srv}

-

- path, handler := wirepbconnect.NewWorkerHandler(gsrv,

- connect.WithInterceptors(validate.NewInterceptor()),

- )

-

- mux := http.NewServeMux()

- mux.Handle(path, workerLog(handler))

-

- certs := newCertReloader(srv.cfg.GrpcTls.Cert, srv.cfg.GrpcTls.Key)

-

- return &http.Server{

- Handler: mux,

- BaseContext: func(_ net.Listener) context.Context {

- return ctx

- },

- TLSConfig: &tls.Config{

- NextProtos: []string{"h2"},

- MinVersion: tls.VersionTLS13,

- ClientAuth: tls.RequireAnyClientCert,

- GetCertificate: certs.GetCertificate,

- VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {

- if len(rawCerts) == 0 {

- return errors.New("client certificate required")

- }

-

- c, err := x509.ParseCertificate(rawCerts[0])

- if err != nil {

- return fmt.Errorf("parse client cert: %w", err)

- }

-

- pubKey, ok := c.PublicKey.(ed25519.PublicKey)

- if !ok {

- return errors.New("ed25519 certificate required")

- }

-

- if _, err := srv.db.WorkerLookup(context.Background(), SystemActor(), pubKey); err != nil {

- return fmt.Errorf("unknown worker: %w", err)

- }

-

- // Clock skew: NotBefore is set to time.Now() when the cert was generated.

- // Checked here (once per TLS handshake), not in the interceptor,

- // because HTTP/2 reuses the connection and NotBefore would go stale.

- if skew := time.Since(c.NotBefore).Abs(); skew > config.WorkerClockSkewLimit {

- return fmt.Errorf("%w: %s", protocol.ErrClockSkew, skew.Truncate(time.Second))

- }

-

- return nil

- },

- },

- }

-}

-

-// grpcService is the ConnectRPC transport adapter over server.

-type grpcService struct {

- wirepbconnect.UnimplementedWorkerHandler

- srv *server

-}

-

-func (g *grpcService) Poll(ctx context.Context, req *connect.Request[wirepb.PollRequest]) (*connect.Response[wirepb.Task], error) {

- select {

- case task, ok := <-g.srv.queue:

- if !ok {

- return nil, connect.NewError(connect.CodeUnavailable, fmt.Errorf("server is shutting down"))

- }

- slog.Info("task dispatched", "id", task.Id, "repo", task.RepoFullName)

- return connect.NewResponse(task), nil

- case <-ctx.Done():

- return nil, ctx.Err()

- }

-}

-

-func (g *grpcService) Complete(ctx context.Context, req *connect.Request[wirepb.TaskResult]) (*connect.Response[wirepb.CompleteResponse], error) {

- if err := g.srv.complete(ctx, req.Msg.TaskId, req.Msg.Success, req.Msg.Error); err != nil {

- return nil, err

- }

- return connect.NewResponse(&wirepb.CompleteResponse{}), nil

-}

-

-// workerLog logs worker metadata from the mTLS client certificate

-// and sets the server version response header.

-func workerLog(next http.Handler) http.Handler {

- return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

- if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {

- if meta := protocol.ParseWorkerMeta(r.TLS.PeerCertificates[0]); meta != nil {

- slog.Info("worker request",

- "name", meta.Name,

- "version", meta.Version,

- "path", r.URL.Path,

- )

- }

- }

- w.Header().Set("X-Server-Version", protocol.VersionString())

- next.ServeHTTP(w, r)

- })

-}

-// SPDX-FileCopyrightText: 2026 Nikolay Govorov

-// SPDX-License-Identifier: AGPL-3.0-or-later

-

-package main

-

-import (

- "context"

- "crypto/rand"

- "crypto/subtle"

- "crypto/tls"

- "encoding/base64"

- "errors"

- "io"

- "log/slog"

- "net"

- "net/http"

- "runtime/debug"

- "strings"

-

- "github.com/go-chi/chi/v5"

- "github.com/go-chi/chi/v5/middleware"

- "github.com/go-chi/httprate"

-

- "dimidiumlabs/mirum/cmd/mirum-server/apipb"

- "dimidiumlabs/mirum/internal/config"

- "dimidiumlabs/mirum/internal/forges"

-)

-

-// __Host- prefixed cookies can only be set with Secure, Path=/, and no

-// Domain attribute. Browsers silently reject violations, so subdomain and

-// network attackers cannot forge them.

-const (

- sessionCookie = "__Host-session"

- csrfCookie = "__Host-csrf"

-)

-

-func NewWebServer(ctx context.Context, srv *server, consolePath string, consoleHandler http.Handler) *http.Server {

- h := &webHandler{

- srv: srv,

- assets: newAssetResolver(),

- }

-

- r := chi.NewRouter()

-

- r.Use(middleware.CleanPath)

- r.Use(middleware.StripSlashes)

- r.Use(middleware.RequestID)

- r.Use(middleware.Logger)

- r.Use(h.recoverer)

- r.Use(middleware.Compress(5))

- r.Use(middleware.Heartbeat("/ping"))

- r.Use(middleware.Timeout(config.WebRequestTimeout))

- r.Use(middleware.RequestSize(config.WebMaxBodyBytes))

- r.Use(trustedProxyMiddleware(srv.cfg.TrustedProxies))

-

- r.Use(func(next http.Handler) http.Handler {

- return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

- w.Header().Set("Content-Security-Policy", csp)

- w.Header().Set("X-Content-Type-Options", "nosniff")

- w.Header().Set("Referrer-Policy", "no-referrer")

- w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")

- w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")

- w.Header().Set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()")

-

- if srv.cfg.WebTls != nil {

- w.Header().Set("Strict-Transport-Security", "max-age=63072000; includeSubDomains; preload")

- }

-

- next.ServeHTTP(w, r)

- })

- })

-

- // The authorization session sets the user to ctx

- r.Use(h.SessionMiddleware)

-

- r.With(middleware.SetHeader("Cache-Control", "public, max-age=31536000, immutable")).

- Mount("/assets", assetsHandler())

-

- r.Get("/", authonly(h.index))

- r.Get("/about/licenses", h.licenses)

- r.Post("/webhook", h.webhook)

-

- r.Route("/auth", func(r chi.Router) {

- r.Use(middleware.NoCache)

- r.Use(httprate.LimitByIP(config.AuthRateLimit, config.AuthRateWindow))

- r.Use(middleware.RequestSize(config.AuthMaxBodyBytes))

-

- r.Get("/login", h.loginPage)

- r.Post("/login", h.login)

- r.Post("/logout", h.logout)

- })

-

- r.With(middleware.NoCache, httprate.LimitByIP(config.APIRateLimit, config.APIRateWindow)).

- Mount("/api/v1", http.StripPrefix("/api/v1", consoleHandler))

-

- r.NotFound(func(w http.ResponseWriter, r *http.Request) {

- h.renderError(w, r, http.StatusNotFound)

- })

- r.MethodNotAllowed(func(w http.ResponseWriter, r *http.Request) {

- h.renderError(w, r, http.StatusMethodNotAllowed)

- })

-

- var tlsCfg *tls.Config

- if srv.cfg.WebTls != nil {

- certs := newCertReloader(srv.cfg.WebTls.Cert, srv.cfg.WebTls.Key)

- tlsCfg = &tls.Config{

- MinVersion: tls.VersionTLS13,

- GetCertificate: certs.GetCertificate,

- }

- }

-

- return &http.Server{

- Handler: r,

- TLSConfig: tlsCfg,

- BaseContext: func(_ net.Listener) context.Context {

- return ctx

- },

- }

-}