Translate code comments and admin strings to English
This commit is contained in:
@@ -39,29 +39,29 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
|
||||
include_blank: false
|
||||
else
|
||||
f.template.concat(f.template.content_tag(:li,
|
||||
"application_token_owner_class nincs beállítva — token nem hozható létre.",
|
||||
"application_token_owner_class is not configured — tokens cannot be created.",
|
||||
class: "flash flash_error"))
|
||||
end
|
||||
end
|
||||
f.input :name
|
||||
f.input :scopes_string, label: "Scopes (comma separated)",
|
||||
hint: %(A /build/publish (és a legacy /update) végponthoz az "update", a /build/upload-hoz az "upload" scope kell.)
|
||||
f.input :unrestricted, hint: "Belső token: az owner-izoláció (enforce_software_ownership) nem vonatkozik rá."
|
||||
f.input :expires_at, hint: "Üresen hagyva sosem jár le."
|
||||
hint: %(The "update" scope is required for /build/publish, the "upload" scope for /build/upload.)
|
||||
f.input :unrestricted, hint: "Internal token: exempt from owner isolation (enforce_software_ownership)."
|
||||
f.input :expires_at, hint: "Leave empty for a token that never expires."
|
||||
end
|
||||
f.actions
|
||||
end
|
||||
|
||||
show do
|
||||
if (plain = controller.instance_variable_get(:@plain_token))
|
||||
panel "⚠️ Token — csak most látható, másold ki!" do
|
||||
panel "⚠️ Token — shown only once, copy it now!" do
|
||||
pre plain, style: "font-family:monospace;font-size:14px;padding:8px;background:#fff3cd;user-select:all;"
|
||||
end
|
||||
end
|
||||
attributes_table do
|
||||
row :id
|
||||
row :name
|
||||
row("Token") { |t| code "#{t.token_prefix}… (SHA256 digest tárolva)" }
|
||||
row("Token") { |t| code "#{t.token_prefix}… (SHA256 digest stored)" }
|
||||
row("Owner") { |t| "#{t.owner_type} ##{t.owner_id} — #{t.owner.try(:email) || t.owner.try(:name)}" }
|
||||
row("Scopes") { |t| t.scopes_string }
|
||||
row :unrestricted
|
||||
@@ -73,9 +73,9 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
|
||||
end
|
||||
|
||||
controller do
|
||||
# A plain token csak közvetlenül a létrehozás után létezik; a session-ön át
|
||||
# jut el az egyszeri megjelenítésig (a flash nem jó: az AA layout minden
|
||||
# flash kulcsot üzenetsávként renderel).
|
||||
# The plain token only exists right after creation; it travels via the
|
||||
# session to its one-time display (flash is unsuitable: the AA layout
|
||||
# renders every flash key as a message bar).
|
||||
def create
|
||||
create! do |success, _failure|
|
||||
success.html do
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
module WarpEngine
|
||||
# Token-hitelesítés a publikáló (/build/*) endpointokhoz.
|
||||
# A hitelesítési forrás kizárólagos: :database módban a shared secret nem
|
||||
# érvényes, :env módban a DB-tokenek nem.
|
||||
# Token authentication for the publishing (/build/*) endpoints.
|
||||
# The auth source is exclusive: in :database mode the shared secret is not
|
||||
# accepted, in :env mode DB tokens are not.
|
||||
module UpdateAuthentication
|
||||
extend ActiveSupport::Concern
|
||||
|
||||
@@ -9,8 +9,8 @@ module WarpEngine
|
||||
|
||||
attr_reader :current_application_token
|
||||
|
||||
# A token kizárólag az X-Update-Secret headerből jöhet — URL-ben a secret
|
||||
# proxy- és access-logokba szivárogna.
|
||||
# The token is accepted from the X-Update-Secret header only — in the URL
|
||||
# it would leak into proxy and access logs.
|
||||
def update_authorized?(required_scope:)
|
||||
token = request.headers["X-Update-Secret"].presence
|
||||
return false if token.blank?
|
||||
@@ -23,13 +23,13 @@ module WarpEngine
|
||||
|
||||
def env_secret_authorized?(token)
|
||||
expected = WarpEngine.config.update_secret
|
||||
# Konfigurálatlan secret esetén az endpoint zárva marad.
|
||||
# With no secret configured the endpoint stays closed.
|
||||
expected.present? && ActiveSupport::SecurityUtils.secure_compare(token, expected)
|
||||
end
|
||||
|
||||
def database_token_authorized?(token, required_scope)
|
||||
if WarpEngine.config.application_token_owner_class.blank?
|
||||
Rails.logger.error("[#{self.class.name}] application_token_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva")
|
||||
Rails.logger.error("[#{self.class.name}] application_token_source=:database but application_token_owner_class is not set — rejecting every request")
|
||||
return false
|
||||
end
|
||||
|
||||
@@ -41,9 +41,9 @@ module WarpEngine
|
||||
true
|
||||
end
|
||||
|
||||
# Owner-kényszer: csak :database módban (van token) és bekapcsolt
|
||||
# enforce_software_ownership mellett szűr. Owner nélküli software a
|
||||
# backfillig szabad préda — a kényszer bekapcsolása előtt kell backfillelni.
|
||||
# Ownership enforcement applies only in :database mode (there is a token)
|
||||
# with enforce_software_ownership on. An ownerless software is up for grabs
|
||||
# until the backfill — backfill before enabling the enforcement.
|
||||
def software_ownership_authorized?(name)
|
||||
return true unless WarpEngine.config.enforce_software_ownership
|
||||
|
||||
@@ -56,8 +56,8 @@ module WarpEngine
|
||||
software.owner_type == token.owner_type && software.owner_id == token.owner_id
|
||||
end
|
||||
|
||||
# Az először publikált (vagy backfill előtti, gazdátlan) software a beküldő
|
||||
# token ownerét kapja. Unrestricted (belső) token nem foglal ownert.
|
||||
# A first-published (or pre-backfill, ownerless) software gets the
|
||||
# submitting token's owner. Unrestricted (internal) tokens claim nothing.
|
||||
def claim_software_ownership(name)
|
||||
token = current_application_token
|
||||
return if token.nil? || token.unrestricted?
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
module WarpEngine
|
||||
module Build
|
||||
# Woodpecker configuration-extension endpoint: a CI-szerver pipeline-indításkor
|
||||
# POST-olja a repo marker-fájlját, és a platformhoz tartozó teljes pipeline
|
||||
# YAML-t kapja vissza. A GET ugyanazt rendereli previewként.
|
||||
# Woodpecker configuration-extension endpoint: on every pipeline start the
|
||||
# CI server POSTs the repo's marker file and receives the platform's full
|
||||
# pipeline YAML. GET renders the same thing as a preview.
|
||||
class ConfigsController < ApiController
|
||||
resource_description do
|
||||
short "Woodpecker CI pipeline configs"
|
||||
@@ -58,9 +58,9 @@ module WarpEngine
|
||||
)
|
||||
end
|
||||
|
||||
# Az első beküldött config, ami markernek parse-olható (Hash `platform` kulccsal).
|
||||
# A doksi szerint a kulcs "configuration", az example-config-service "configs"-ot
|
||||
# használ — mindkettőt elfogadjuk.
|
||||
# The first submitted config that parses as a marker (Hash with a `platform`
|
||||
# key). The docs call the key "configuration", the example-config-service
|
||||
# uses "configs" — accept both.
|
||||
def find_marker
|
||||
configs = params[:configuration].presence || params[:configs].presence || []
|
||||
configs.each do |config|
|
||||
|
||||
@@ -9,8 +9,8 @@ module WarpEngine
|
||||
short "Build artifact upload"
|
||||
end
|
||||
|
||||
# A release-fájlnevek kötött konvenciója: <name>-<version>.<ext> vagy
|
||||
# <name>-<version>-<target>.zip — az updater is ezeket keresi.
|
||||
# Release file naming convention: <name>-<version>.<ext> or
|
||||
# <name>-<version>-<target>.zip — the updater looks for these too.
|
||||
NAME_FORMAT = /\A[A-Za-z0-9._-]+\z/
|
||||
|
||||
api :POST, "/build/upload", "Upload a build artifact into the artifact directory"
|
||||
|
||||
@@ -7,8 +7,8 @@ module WarpEngine
|
||||
UPDATE_SCOPE = "update".freeze
|
||||
UPLOAD_SCOPE = "upload".freeze
|
||||
|
||||
# A generált token csak létrehozáskor, memóriában érhető el — a DB-ben
|
||||
# kizárólag a SHA256 digest és a nem-titkos prefix tárolódik.
|
||||
# The generated token is only available in memory at creation time — the DB
|
||||
# stores nothing but the SHA256 digest and the non-secret prefix.
|
||||
attr_reader :plain_token
|
||||
|
||||
belongs_to :owner, polymorphic: true
|
||||
@@ -30,7 +30,7 @@ module WarpEngine
|
||||
Digest::SHA256.hexdigest(token)
|
||||
end
|
||||
|
||||
# Az élő (nem törölt, nem lejárt), a kért scope-pal rendelkező token, különben nil.
|
||||
# The live (not deleted, not expired) token carrying the required scope, else nil.
|
||||
def self.authenticate(token, required_scope: nil)
|
||||
return nil if token.blank?
|
||||
|
||||
@@ -45,7 +45,7 @@ module WarpEngine
|
||||
expires_at.present? && expires_at <= Time.current
|
||||
end
|
||||
|
||||
# Visszavonás = soft delete, az audit-nyom megmarad.
|
||||
# Revocation = soft delete, the audit trail stays.
|
||||
def revoke!
|
||||
update_column(:deleted_at, Time.current)
|
||||
end
|
||||
@@ -54,7 +54,7 @@ module WarpEngine
|
||||
update_column(:last_used_at, Time.current)
|
||||
end
|
||||
|
||||
# Admin form: vesszővel elválasztott scope-lista
|
||||
# Admin form: comma separated scope list
|
||||
def scopes_string
|
||||
Array(scopes).join(", ")
|
||||
end
|
||||
@@ -67,7 +67,7 @@ module WarpEngine
|
||||
%w[created_at deleted_at expires_at id last_used_at name owner_id owner_type token_prefix unrestricted updated_at]
|
||||
end
|
||||
|
||||
# A polimorf owner asszociációra a Ransack nem tud szűrni.
|
||||
# Ransack cannot filter on the polymorphic owner association.
|
||||
def self.ransackable_associations(auth_object = nil)
|
||||
[]
|
||||
end
|
||||
|
||||
@@ -2,8 +2,8 @@ module WarpEngine
|
||||
class Software < ApplicationRecord
|
||||
self.table_name = "softwares"
|
||||
|
||||
# A publikáló token ownere (pl. AdminUser) — 3rd party izolációhoz, ld.
|
||||
# enforce_software_ownership. nil = belső / backfill előtti software.
|
||||
# Owner of the publishing token (e.g. AdminUser) — for 3rd-party isolation,
|
||||
# see enforce_software_ownership. nil = internal / pre-backfill software.
|
||||
belongs_to :owner, polymorphic: true, optional: true
|
||||
|
||||
has_many :software_images, foreign_key: :software_id, dependent: :destroy
|
||||
|
||||
@@ -14,7 +14,7 @@ module WarpEngine
|
||||
field(:license) { |sw| sw.license.to_s }
|
||||
field :platform
|
||||
field :status
|
||||
# Publikus owner-azonosító — az /api/software?owner_id= szűrőhöz.
|
||||
# Public owner id — for the /api/software?owner_id= filter.
|
||||
field(:ownerId) { |sw| sw.owner_id }
|
||||
field(:highlighted) { |sw| sw.highlighted ? true : false }
|
||||
field(:externalLinks) { |sw| ExternalLinkSerializer.render_as_hash(sw.external_links) }
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
require "erb"
|
||||
|
||||
module WarpEngine
|
||||
# A /build/config platform-template-jeinek renderelése: a pipeline-logika
|
||||
# a lib/warp_engine/ci_templates/<platform>.yaml.erb fájlokban él, a
|
||||
# platformonkénti builder image-eket a WarpEngine.config.ci_platforms adja.
|
||||
# Renders the /build/config platform templates: the pipeline logic lives in
|
||||
# lib/warp_engine/ci_templates/<platform>.yaml.erb, the per-platform builder
|
||||
# images come from WarpEngine.config.ci_platforms.
|
||||
class CiConfigService
|
||||
PLATFORM_FORMAT = /\A[a-z0-9_-]+\z/
|
||||
|
||||
# A renderelt pipeline YAML, vagy nil, ha a platform nem kiszolgált.
|
||||
# The rendered pipeline YAML, or nil when the platform is not served.
|
||||
def render(platform:, name:, update_server:)
|
||||
platform = platform.to_s
|
||||
return nil unless platform.match?(PLATFORM_FORMAT)
|
||||
|
||||
@@ -3,9 +3,9 @@ require "base64"
|
||||
require "net/http"
|
||||
|
||||
module WarpEngine
|
||||
# A Woodpecker configuration-extension kéréseinek httpsig-ellenőrzése
|
||||
# (draft-cavage http-signatures, ed25519). A szerver az aláírt headerek
|
||||
# listáját a Signature headerben küldi — tipikusan "(request-target) date".
|
||||
# Verifies the httpsig signature of Woodpecker configuration-extension
|
||||
# requests (draft-cavage http-signatures, ed25519). The server sends the
|
||||
# signed header list in the Signature header — typically "(request-target) date".
|
||||
class CiSignatureVerifier
|
||||
SIGNATURE_PARAM = /(\w+)="([^"]*)"/
|
||||
|
||||
@@ -13,7 +13,7 @@ module WarpEngine
|
||||
@key_mutex = Mutex.new
|
||||
|
||||
class << self
|
||||
# A letöltött kulcs process-szinten cache-elt (URL-enként).
|
||||
# The downloaded key is cached process-wide (per URL).
|
||||
def fetch_public_key(url)
|
||||
@key_mutex.synchronize do
|
||||
@key_cache[url] ||= Net::HTTP.get(URI.parse(url))
|
||||
@@ -32,7 +32,7 @@ module WarpEngine
|
||||
def valid?
|
||||
pem = public_key_pem
|
||||
if pem.blank?
|
||||
Rails.logger.error("[CiSignatureVerifier] nincs ci_extension_public_key(_url) konfigurálva — kérés elutasítva")
|
||||
Rails.logger.error("[CiSignatureVerifier] no ci_extension_public_key(_url) configured — rejecting request")
|
||||
return false
|
||||
end
|
||||
|
||||
@@ -58,11 +58,11 @@ module WarpEngine
|
||||
|
||||
self.class.fetch_public_key(config.ci_extension_public_key_url)
|
||||
rescue StandardError => e
|
||||
Rails.logger.error("[CiSignatureVerifier] kulcs-letöltés sikertelen: #{e.class}: #{e.message}")
|
||||
Rails.logger.error("[CiSignatureVerifier] public key fetch failed: #{e.class}: #{e.message}")
|
||||
nil
|
||||
end
|
||||
|
||||
# A Signature header (vagy az "Authorization: Signature ..." forma) paraméterei.
|
||||
# Parameters of the Signature header (or the "Authorization: Signature ..." form).
|
||||
def signature_params
|
||||
header = @request.headers["Signature"].presence
|
||||
if header.nil?
|
||||
|
||||
Reference in New Issue
Block a user