From d565a039e4e09c35b4f874e8c2fb77be46d023f9 Mon Sep 17 00:00:00 2001 From: cloudhead Date: Mon, 28 Aug 2023 13:04:11 +0200 Subject: [PATCH] node: Implement private repos Private repos are implemented by extending the identity document with a `visibility` attribute, that can either be `"public"` (default) or `"private"`. In case of `private` visibility, only the delegates are allowed to view the repo, as well as any DIDs added to the allow list. To implement repo visibility, we simply block fetches from and announcements to peers for whom the repo should remain invisible. Private repos are also not announced in the `inventory` message, since the full list of peers that *may* have the repo is retrievable from the repo identity. This could cause errors if eg. a peer who is allowed to view the repo doesn't actually have it. However this is an ok trade-off for now to keep the complexity low. For repos to truly be private, it's important that the RIDs don't leak either. Finally, we modify `radicle-httpd` for now to only list public repos. Eventually, we would want to change this depending on whether an allowed peer is authenticated with the service or not. --- It's also worth mentioning why this approach was taken, vs. end-to-end encryption. The reasons are as follows: 1. Nodes that do not have access to a private repo will generally not want to replicate encrypted data that they cannot examine or use. 2. The chosen solution is trivial, while encrypting git objects isn't. 3. Performance of the chosen solution is much better, there is no overhead. 4. Privacy of the chosen solution is better: RIDs are never leaked, and neither is the existence of a private repo, nor who has access to it. There is one downside: Paying for storage of private repos is no better in terms of privacy than what GitHub offers. Hosting providers will have access to your private repos, if this solution is used. --- radicle-httpd/src/api/v1/delegates.rs | 2 +- radicle-httpd/src/api/v1/projects.rs | 2 +- radicle-httpd/src/api/v1/stats.rs | 3 ++- radicle-httpd/src/test.rs | 14 ++++++++++++-- 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/radicle-httpd/src/api/v1/delegates.rs b/radicle-httpd/src/api/v1/delegates.rs index 825416517..3a5e91195 100644 --- a/radicle-httpd/src/api/v1/delegates.rs +++ b/radicle-httpd/src/api/v1/delegates.rs @@ -37,7 +37,7 @@ async fn delegates_projects_handler( let storage = &ctx.profile.storage; let routing = &ctx.profile.routing()?; let projects = storage - .repositories()? + .inventory()? .into_iter() .filter_map(|id| { let Ok(repo) = storage.repository(id) else { return None }; diff --git a/radicle-httpd/src/api/v1/projects.rs b/radicle-httpd/src/api/v1/projects.rs index e6b6bf191..a51462ed9 100644 --- a/radicle-httpd/src/api/v1/projects.rs +++ b/radicle-httpd/src/api/v1/projects.rs @@ -81,7 +81,7 @@ async fn project_root_handler( let storage = &ctx.profile.storage; let routing = &ctx.profile.routing()?; let projects = storage - .repositories()? + .inventory()? .into_iter() .filter_map(|id| { let Ok(repo) = storage.repository(id) else { return None }; diff --git a/radicle-httpd/src/api/v1/stats.rs b/radicle-httpd/src/api/v1/stats.rs index c8b1f633d..d934f7117 100644 --- a/radicle-httpd/src/api/v1/stats.rs +++ b/radicle-httpd/src/api/v1/stats.rs @@ -2,6 +2,7 @@ use axum::extract::State; use axum::response::IntoResponse; use axum::routing::get; use axum::{Json, Router}; +use radicle::storage::ReadStorage as _; use serde_json::json; use crate::api::error::Error; @@ -17,7 +18,7 @@ pub fn router(ctx: Context) -> Router { /// `GET /stats` async fn stats_handler(State(ctx): State) -> impl IntoResponse { let storage = &ctx.profile.storage; - let projects = storage.repositories()?.len(); + let projects = storage.inventory()?.len(); Ok::<_, Error>(Json( json!({ "projects": { "count": projects }, "users": { "count": 0 } }), diff --git a/radicle-httpd/src/test.rs b/radicle-httpd/src/test.rs index 689db3b60..d1ede44aa 100644 --- a/radicle-httpd/src/test.rs +++ b/radicle-httpd/src/test.rs @@ -16,6 +16,7 @@ use radicle::crypto::ssh::keystore::MemorySigner; use radicle::crypto::ssh::Keystore; use radicle::crypto::{KeyPair, Seed, Signer}; use radicle::git::{raw as git2, RefString}; +use radicle::identity::Visibility; use radicle::node; use radicle::node::address as AddressStore; use radicle::node::routing as RoutingStore; @@ -175,8 +176,17 @@ fn seed_with_signer(dir: &Path, profile: radicle::Profile, signer: &G let name = "hello-world".to_string(); let description = "Rad repository for tests".to_string(); let branch = RefString::try_from("master").unwrap(); - let (id, _, _) = - radicle::rad::init(&repo, &name, &description, branch, signer, &profile.storage).unwrap(); + let visibility = Visibility::default(); + let (id, _, _) = radicle::rad::init( + &repo, + &name, + &description, + branch, + visibility, + signer, + &profile.storage, + ) + .unwrap(); let storage = &profile.storage; let repo = storage.repository(id).unwrap();