feat(auth): authenticate automation controller - aka GitHub deploy with JWT

src/declarations/satellite/satellite.did.d.ts

@@ -34,12 +34,27 @@ export interface AssetNoContent {
 export interface AssetsUpgradeOptions {
 	clear_existing_assets: [] | [boolean];
 }
+export type AuthenticateAutomationArgs = {
+	OpenId: OpenIdPrepareAutomationArgs;
+};
+export type AuthenticateAutomationResultResponse =
+	| {
+			Ok: [Principal, AutomationController];
+	  }
+	| { Err: AuthenticationAutomationError };
 export type AuthenticateResultResponse = { Ok: Authentication } | { Err: AuthenticationError };
 export interface Authentication {
 	doc: Doc;
 	delegation: PreparedDelegation;
 }
 export type AuthenticationArgs = { OpenId: OpenIdPrepareDelegationArgs };
+export type AuthenticationAutomationError =
+	| {
+			PrepareAutomation: PrepareAutomationError;
+	  }
+	| { RegisterController: string }
+	| { SaveWorkflowMetadata: string }
+	| { SaveUniqueJtiToken: string };
 export interface AuthenticationConfig {
 	updated_at: [] | [bigint];
 	openid: [] | [AuthenticationConfigOpenId];
@@ -64,6 +79,21 @@ export type AuthenticationError =
 export interface AuthenticationRules {
 	allowed_callers: Array<Principal>;
 }
+export interface AutomationConfig {
+	updated_at: [] | [bigint];
+	openid: [] | [AutomationConfigOpenId];
+	created_at: [] | [bigint];
+	version: [] | [bigint];
+}
+export interface AutomationConfigOpenId {
+	observatory_id: [] | [Principal];
+	providers: Array<[OpenIdAutomationProvider, OpenIdAutomationProviderConfig]>;
+}
+export interface AutomationController {
+	scope: AutomationScope;
+	expires_at: bigint;
+}
+export type AutomationScope = { Write: null } | { Submit: null };
 export type CollectionType = { Db: null } | { Storage: null };
 export interface CommitBatch {
 	batch_id: bigint;
@@ -78,6 +108,7 @@ export interface Config {
 	db: [] | [DbConfig];
 	authentication: [] | [AuthenticationConfig];
 	storage: StorageConfig;
+	automation: [] | [AutomationConfig];
 }
 export interface ConfigMaxMemorySize {
 	stable: [] | [bigint];
@@ -269,13 +300,29 @@ export interface OpenIdAuthProviderDelegationConfig {
 	targets: [] | [Array<Principal>];
 	max_time_to_live: [] | [bigint];
 }
+export type OpenIdAutomationProvider = { GitHub: null };
+export interface OpenIdAutomationProviderConfig {
+	controller: [] | [OpenIdAutomationProviderControllerConfig];
+	repositories: Array<[RepositoryKey, OpenIdAutomationRepositoryConfig]>;
+}
+export interface OpenIdAutomationProviderControllerConfig {
+	scope: [] | [AutomationScope];
+	max_time_to_live: [] | [bigint];
+}
+export interface OpenIdAutomationRepositoryConfig {
+	branches: [] | [Array<string>];
+}
 export type OpenIdDelegationProvider = { GitHub: null } | { Google: null };
 export interface OpenIdGetDelegationArgs {
 	jwt: string;
 	session_key: Uint8Array;
 	salt: Uint8Array;
 	expiration: bigint;
 }
+export interface OpenIdPrepareAutomationArgs {
+	jwt: string;
+	salt: Uint8Array;
+}
 export interface OpenIdPrepareDelegationArgs {
 	jwt: string;
 	session_key: Uint8Array;
@@ -286,6 +333,16 @@ export type Permission =
 	| { Private: null }
 	| { Public: null }
 	| { Managed: null };
+export type PrepareAutomationError =
+	| {
+			JwtFindProvider: JwtFindProviderError;
+	  }
+	| { InvalidController: string }
+	| { GetCachedJwks: null }
+	| { JwtVerify: JwtVerifyError }
+	| { GetOrFetchJwks: GetOrRefreshJwksError }
+	| { ControllerAlreadyExists: null }
+	| { TooManyControllers: string };
 export type PrepareDelegationError =
 	| {
 			JwtFindProvider: JwtFindProviderError;
@@ -325,6 +382,10 @@ export interface RateConfig {
 	max_tokens: bigint;
 	time_per_token_ns: bigint;
 }
+export interface RepositoryKey {
+	owner: string;
+	name: string;
+}
 export interface Rule {
 	max_capacity: [] | [number];
 	memory: [] | [Memory];
@@ -349,6 +410,10 @@ export interface SetAuthenticationConfig {
 	internet_identity: [] | [AuthenticationConfigInternetIdentity];
 	rules: [] | [AuthenticationRules];
 }
+export interface SetAutomationConfig {
+	openid: [] | [AutomationConfigOpenId];
+	version: [] | [bigint];
+}
 export interface SetController {
 	metadata: Array<[string, string]>;
 	kind: [] | [ControllerKind];
@@ -443,6 +508,10 @@ export interface UploadChunkResult {
 }
 export interface _SERVICE {
 	authenticate: ActorMethod<[AuthenticationArgs], AuthenticateResultResponse>;
+	authenticate_automation: ActorMethod<
+		[AuthenticateAutomationArgs],
+		AuthenticateAutomationResultResponse
+	>;
 	commit_asset_upload: ActorMethod<[CommitBatch], undefined>;
 	commit_proposal: ActorMethod<[CommitProposal], null>;
 	commit_proposal_asset_upload: ActorMethod<[CommitBatch], undefined>;
@@ -467,6 +536,7 @@ export interface _SERVICE {
 	deposit_cycles: ActorMethod<[DepositCyclesArgs], undefined>;
 	get_asset: ActorMethod<[string, string], [] | [AssetNoContent]>;
 	get_auth_config: ActorMethod<[], [] | [AuthenticationConfig]>;
+	get_automation_config: ActorMethod<[], [] | [AutomationConfig]>;
 	get_config: ActorMethod<[], Config>;
 	get_db_config: ActorMethod<[], [] | [DbConfig]>;
 	get_delegation: ActorMethod<[GetDelegationArgs], GetDelegationResultResponse>;
@@ -498,6 +568,7 @@ export interface _SERVICE {
 	reject_proposal: ActorMethod<[CommitProposal], null>;
 	set_asset_token: ActorMethod<[string, string, [] | [string]], undefined>;
 	set_auth_config: ActorMethod<[SetAuthenticationConfig], AuthenticationConfig>;
+	set_automation_config: ActorMethod<[SetAutomationConfig], AutomationConfig>;
 	set_controllers: ActorMethod<[SetControllersArgs], Array<[Principal, Controller]>>;
 	set_custom_domain: ActorMethod<[string, [] | [string]], undefined>;
 	set_db_config: ActorMethod<[SetDbConfig], DbConfig>;

src/declarations/satellite/satellite.factory.certified.did.js

@@ -75,6 +75,40 @@ export const idlFactory = ({ IDL }) => {
 		Ok: Authentication,
 		Err: AuthenticationError
 	});
+	const OpenIdPrepareAutomationArgs = IDL.Record({
+		jwt: IDL.Text,
+		salt: IDL.Vec(IDL.Nat8)
+	});
+	const AuthenticateAutomationArgs = IDL.Variant({
+		OpenId: OpenIdPrepareAutomationArgs
+	});
+	const AutomationScope = IDL.Variant({
+		Write: IDL.Null,
+		Submit: IDL.Null
+	});
+	const AutomationController = IDL.Record({
+		scope: AutomationScope,
+		expires_at: IDL.Nat64
+	});
+	const PrepareAutomationError = IDL.Variant({
+		JwtFindProvider: JwtFindProviderError,
+		InvalidController: IDL.Text,
+		GetCachedJwks: IDL.Null,
+		JwtVerify: JwtVerifyError,
+		GetOrFetchJwks: GetOrRefreshJwksError,
+		ControllerAlreadyExists: IDL.Null,
+		TooManyControllers: IDL.Text
+	});
+	const AuthenticationAutomationError = IDL.Variant({
+		PrepareAutomation: PrepareAutomationError,
+		RegisterController: IDL.Text,
+		SaveWorkflowMetadata: IDL.Text,
+		SaveUniqueJtiToken: IDL.Text
+	});
+	const AuthenticateAutomationResultResponse = IDL.Variant({
+		Ok: IDL.Tuple(IDL.Principal, AutomationController),
+		Err: AuthenticationAutomationError
+	});
 	const CommitBatch = IDL.Record({
 		batch_id: IDL.Nat,
 		headers: IDL.Vec(IDL.Tuple(IDL.Text, IDL.Text)),
@@ -194,6 +228,29 @@ export const idlFactory = ({ IDL }) => {
 		internet_identity: IDL.Opt(AuthenticationConfigInternetIdentity),
 		rules: IDL.Opt(AuthenticationRules)
 	});
+	const OpenIdAutomationProvider = IDL.Variant({ GitHub: IDL.Null });
+	const OpenIdAutomationProviderControllerConfig = IDL.Record({
+		scope: IDL.Opt(AutomationScope),
+		max_time_to_live: IDL.Opt(IDL.Nat64)
+	});
+	const RepositoryKey = IDL.Record({ owner: IDL.Text, name: IDL.Text });
+	const OpenIdAutomationRepositoryConfig = IDL.Record({
+		branches: IDL.Opt(IDL.Vec(IDL.Text))
+	});
+	const OpenIdAutomationProviderConfig = IDL.Record({
+		controller: IDL.Opt(OpenIdAutomationProviderControllerConfig),
+		repositories: IDL.Vec(IDL.Tuple(RepositoryKey, OpenIdAutomationRepositoryConfig))
+	});
+	const AutomationConfigOpenId = IDL.Record({
+		observatory_id: IDL.Opt(IDL.Principal),
+		providers: IDL.Vec(IDL.Tuple(OpenIdAutomationProvider, OpenIdAutomationProviderConfig))
+	});
+	const AutomationConfig = IDL.Record({
+		updated_at: IDL.Opt(IDL.Nat64),
+		openid: IDL.Opt(AutomationConfigOpenId),
+		created_at: IDL.Opt(IDL.Nat64),
+		version: IDL.Opt(IDL.Nat64)
+	});
 	const ConfigMaxMemorySize = IDL.Record({
 		stable: IDL.Opt(IDL.Nat64),
 		heap: IDL.Opt(IDL.Nat64)
@@ -231,7 +288,8 @@ export const idlFactory = ({ IDL }) => {
 	const Config = IDL.Record({
 		db: IDL.Opt(DbConfig),
 		authentication: IDL.Opt(AuthenticationConfig),
-		storage: StorageConfig
+		storage: StorageConfig,
+		automation: IDL.Opt(AutomationConfig)
 	});
 	const OpenIdGetDelegationArgs = IDL.Record({
 		jwt: IDL.Text,
@@ -404,6 +462,10 @@ export const idlFactory = ({ IDL }) => {
 		internet_identity: IDL.Opt(AuthenticationConfigInternetIdentity),
 		rules: IDL.Opt(AuthenticationRules)
 	});
+	const SetAutomationConfig = IDL.Record({
+		openid: IDL.Opt(AutomationConfigOpenId),
+		version: IDL.Opt(IDL.Nat64)
+	});
 	const SetController = IDL.Record({
 		metadata: IDL.Vec(IDL.Tuple(IDL.Text, IDL.Text)),
 		kind: IDL.Opt(ControllerKind),
@@ -452,6 +514,11 @@ export const idlFactory = ({ IDL }) => {
 
 	return IDL.Service({
 		authenticate: IDL.Func([AuthenticationArgs], [AuthenticateResultResponse], []),
+		authenticate_automation: IDL.Func(
+			[AuthenticateAutomationArgs],
+			[AuthenticateAutomationResultResponse],
+			[]
+		),
 		commit_asset_upload: IDL.Func([CommitBatch], [], []),
 		commit_proposal: IDL.Func([CommitProposal], [IDL.Null], []),
 		commit_proposal_asset_upload: IDL.Func([CommitBatch], [], []),
@@ -480,6 +547,7 @@ export const idlFactory = ({ IDL }) => {
 		deposit_cycles: IDL.Func([DepositCyclesArgs], [], []),
 		get_asset: IDL.Func([IDL.Text, IDL.Text], [IDL.Opt(AssetNoContent)], []),
 		get_auth_config: IDL.Func([], [IDL.Opt(AuthenticationConfig)], []),
+		get_automation_config: IDL.Func([], [IDL.Opt(AutomationConfig)], []),
 		get_config: IDL.Func([], [Config], []),
 		get_db_config: IDL.Func([], [IDL.Opt(DbConfig)], []),
 		get_delegation: IDL.Func([GetDelegationArgs], [GetDelegationResultResponse], []),
@@ -521,6 +589,7 @@ export const idlFactory = ({ IDL }) => {
 		reject_proposal: IDL.Func([CommitProposal], [IDL.Null], []),
 		set_asset_token: IDL.Func([IDL.Text, IDL.Text, IDL.Opt(IDL.Text)], [], []),
 		set_auth_config: IDL.Func([SetAuthenticationConfig], [AuthenticationConfig], []),
+		set_automation_config: IDL.Func([SetAutomationConfig], [AutomationConfig], []),
 		set_controllers: IDL.Func(
 			[SetControllersArgs],
 			[IDL.Vec(IDL.Tuple(IDL.Principal, Controller))],

src/declarations/satellite/satellite.factory.did.js

@@ -75,6 +75,40 @@ export const idlFactory = ({ IDL }) => {
 		Ok: Authentication,
 		Err: AuthenticationError
 	});
+	const OpenIdPrepareAutomationArgs = IDL.Record({
+		jwt: IDL.Text,
+		salt: IDL.Vec(IDL.Nat8)
+	});
+	const AuthenticateAutomationArgs = IDL.Variant({
+		OpenId: OpenIdPrepareAutomationArgs
+	});
+	const AutomationScope = IDL.Variant({
+		Write: IDL.Null,
+		Submit: IDL.Null
+	});
+	const AutomationController = IDL.Record({
+		scope: AutomationScope,
+		expires_at: IDL.Nat64
+	});
+	const PrepareAutomationError = IDL.Variant({
+		JwtFindProvider: JwtFindProviderError,
+		InvalidController: IDL.Text,
+		GetCachedJwks: IDL.Null,
+		JwtVerify: JwtVerifyError,
+		GetOrFetchJwks: GetOrRefreshJwksError,
+		ControllerAlreadyExists: IDL.Null,
+		TooManyControllers: IDL.Text
+	});
+	const AuthenticationAutomationError = IDL.Variant({
+		PrepareAutomation: PrepareAutomationError,
+		RegisterController: IDL.Text,
+		SaveWorkflowMetadata: IDL.Text,
+		SaveUniqueJtiToken: IDL.Text
+	});
+	const AuthenticateAutomationResultResponse = IDL.Variant({
+		Ok: IDL.Tuple(IDL.Principal, AutomationController),
+		Err: AuthenticationAutomationError
+	});
 	const CommitBatch = IDL.Record({
 		batch_id: IDL.Nat,
 		headers: IDL.Vec(IDL.Tuple(IDL.Text, IDL.Text)),
@@ -194,6 +228,29 @@ export const idlFactory = ({ IDL }) => {
 		internet_identity: IDL.Opt(AuthenticationConfigInternetIdentity),
 		rules: IDL.Opt(AuthenticationRules)
 	});
+	const OpenIdAutomationProvider = IDL.Variant({ GitHub: IDL.Null });
+	const OpenIdAutomationProviderControllerConfig = IDL.Record({
+		scope: IDL.Opt(AutomationScope),
+		max_time_to_live: IDL.Opt(IDL.Nat64)
+	});
+	const RepositoryKey = IDL.Record({ owner: IDL.Text, name: IDL.Text });
+	const OpenIdAutomationRepositoryConfig = IDL.Record({
+		branches: IDL.Opt(IDL.Vec(IDL.Text))
+	});
+	const OpenIdAutomationProviderConfig = IDL.Record({
+		controller: IDL.Opt(OpenIdAutomationProviderControllerConfig),
+		repositories: IDL.Vec(IDL.Tuple(RepositoryKey, OpenIdAutomationRepositoryConfig))
+	});
+	const AutomationConfigOpenId = IDL.Record({
+		observatory_id: IDL.Opt(IDL.Principal),
+		providers: IDL.Vec(IDL.Tuple(OpenIdAutomationProvider, OpenIdAutomationProviderConfig))
+	});
+	const AutomationConfig = IDL.Record({
+		updated_at: IDL.Opt(IDL.Nat64),
+		openid: IDL.Opt(AutomationConfigOpenId),
+		created_at: IDL.Opt(IDL.Nat64),
+		version: IDL.Opt(IDL.Nat64)
+	});
 	const ConfigMaxMemorySize = IDL.Record({
 		stable: IDL.Opt(IDL.Nat64),
 		heap: IDL.Opt(IDL.Nat64)
@@ -231,7 +288,8 @@ export const idlFactory = ({ IDL }) => {
 	const Config = IDL.Record({
 		db: IDL.Opt(DbConfig),
 		authentication: IDL.Opt(AuthenticationConfig),
-		storage: StorageConfig
+		storage: StorageConfig,
+		automation: IDL.Opt(AutomationConfig)
 	});
 	const OpenIdGetDelegationArgs = IDL.Record({
 		jwt: IDL.Text,
@@ -404,6 +462,10 @@ export const idlFactory = ({ IDL }) => {
 		internet_identity: IDL.Opt(AuthenticationConfigInternetIdentity),
 		rules: IDL.Opt(AuthenticationRules)
 	});
+	const SetAutomationConfig = IDL.Record({
+		openid: IDL.Opt(AutomationConfigOpenId),
+		version: IDL.Opt(IDL.Nat64)
+	});
 	const SetController = IDL.Record({
 		metadata: IDL.Vec(IDL.Tuple(IDL.Text, IDL.Text)),
 		kind: IDL.Opt(ControllerKind),
@@ -452,6 +514,11 @@ export const idlFactory = ({ IDL }) => {
 
 	return IDL.Service({
 		authenticate: IDL.Func([AuthenticationArgs], [AuthenticateResultResponse], []),
+		authenticate_automation: IDL.Func(
+			[AuthenticateAutomationArgs],
+			[AuthenticateAutomationResultResponse],
+			[]
+		),
 		commit_asset_upload: IDL.Func([CommitBatch], [], []),
 		commit_proposal: IDL.Func([CommitProposal], [IDL.Null], []),
 		commit_proposal_asset_upload: IDL.Func([CommitBatch], [], []),
@@ -480,6 +547,7 @@ export const idlFactory = ({ IDL }) => {
 		deposit_cycles: IDL.Func([DepositCyclesArgs], [], []),
 		get_asset: IDL.Func([IDL.Text, IDL.Text], [IDL.Opt(AssetNoContent)], ['query']),
 		get_auth_config: IDL.Func([], [IDL.Opt(AuthenticationConfig)], ['query']),
+		get_automation_config: IDL.Func([], [IDL.Opt(AutomationConfig)], ['query']),
 		get_config: IDL.Func([], [Config], []),
 		get_db_config: IDL.Func([], [IDL.Opt(DbConfig)], ['query']),
 		get_delegation: IDL.Func([GetDelegationArgs], [GetDelegationResultResponse], ['query']),
@@ -521,6 +589,7 @@ export const idlFactory = ({ IDL }) => {
 		reject_proposal: IDL.Func([CommitProposal], [IDL.Null], []),
 		set_asset_token: IDL.Func([IDL.Text, IDL.Text, IDL.Opt(IDL.Text)], [], []),
 		set_auth_config: IDL.Func([SetAuthenticationConfig], [AuthenticationConfig], []),
+		set_automation_config: IDL.Func([SetAutomationConfig], [AutomationConfig], []),
 		set_controllers: IDL.Func(
 			[SetControllersArgs],
 			[IDL.Vec(IDL.Tuple(IDL.Principal, Controller))],