WIP: Trusted Publishing

Cargo.toml

@@ -111,6 +111,7 @@ paste = "=1.0.15"
 postgres-native-tls = "=0.5.1"
 prometheus = { version = "=0.14.0", default-features = false }
 rand = "=0.9.1"
+regex = "=1.11.1"
 reqwest = { version = "=0.12.15", features = ["gzip", "json"] }
 rss = { version = "=2.0.12", default-features = false, features = ["atom"] }
 secrecy = "=0.10.3"
@@ -145,11 +146,12 @@ crates_io_index = { path = "crates/crates_io_index", features = ["testing"] }
 crates_io_tarball = { path = "crates/crates_io_tarball", features = ["builder"] }
 crates_io_team_repo = { path = "crates/crates_io_team_repo", features = ["mock"] }
 crates_io_test_db = { path = "crates/crates_io_test_db" }
+crates_io_trustpub = { path = "crates/crates_io_trustpub", features = ["test-helpers"] }
 claims = "=0.8.0"
 diesel = { version = "=2.2.10", features = ["r2d2"] }
 googletest = "=0.14.0"
 insta = { version = "=1.43.1", features = ["glob", "json", "redactions"] }
-regex = "=1.11.1"
+jsonwebtoken = "=9.3.1"
 sentry = { version = "=0.38.1", features = ["test"] }
 tokio = "=1.45.0"
 zip = { version = "=3.0.0", default-features = false, features = ["deflate"] }

crates/crates_io_database/src/models/category.rs

@@ -3,6 +3,7 @@ use crate::schema::*;
 use chrono::{DateTime, Utc};
 use diesel::dsl;
 use diesel::prelude::*;
+use diesel::sql_types::Text;
 use diesel_async::scoped_futures::ScopedFutureExt;
 use diesel_async::{AsyncConnection, AsyncPgConnection, RunQueryDsl};
 use futures_util::FutureExt;
@@ -19,7 +20,7 @@ pub struct Category {
     pub created_at: DateTime<Utc>,
 }
 
-type WithSlug<'a> = dsl::Eq<categories::slug, crates_io_diesel_helpers::lower<&'a str>>;
+type WithSlug<'a> = dsl::Eq<categories::slug, crates_io_diesel_helpers::lower<Text, &'a str>>;
 
 #[derive(Associations, Insertable, Identifiable, Debug, Clone, Copy)]
 #[diesel(

crates/crates_io_database/src/models/trustpub/mod.rs

@@ -1,3 +1,7 @@
 mod github_config;
+mod token;
+mod used_jti;
 
 pub use self::github_config::{GitHubConfig, NewGitHubConfig};
+pub use self::token::NewToken;
+pub use self::used_jti::NewUsedJti;

crates/crates_io_database/src/models/trustpub/token.rs

@@ -0,0 +1,22 @@
+use crate::schema::trustpub_tokens;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = trustpub_tokens, check_for_backend(diesel::pg::Pg))]
+pub struct NewToken<'a> {
+    pub expires_at: DateTime<Utc>,
+    pub hashed_token: &'a [u8],
+    pub crate_ids: &'a [i32],
+}
+
+impl NewToken<'_> {
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<()> {
+        self.insert_into(trustpub_tokens::table)
+            .execute(conn)
+            .await?;
+
+        Ok(())
+    }
+}

crates/crates_io_database/src/models/trustpub/used_jti.rs

@@ -0,0 +1,24 @@
+use crate::schema::trustpub_used_jtis;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = trustpub_used_jtis, check_for_backend(diesel::pg::Pg))]
+pub struct NewUsedJti<'a> {
+    pub jti: &'a str,
+    pub expires_at: DateTime<Utc>,
+}
+
+impl<'a> NewUsedJti<'a> {
+    pub fn new(jti: &'a str, expires_at: DateTime<Utc>) -> Self {
+        Self { jti, expires_at }
+    }
+
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<usize> {
+        diesel::insert_into(trustpub_used_jtis::table)
+            .values(self)
+            .execute(conn)
+            .await
+    }
+}

crates/crates_io_database/src/models/version.rs

@@ -91,7 +91,7 @@ pub struct NewVersion<'a> {
     license: Option<&'a str>,
     #[builder(default, name = "size")]
     crate_size: i32,
-    published_by: i32,
+    published_by: Option<i32>,
     checksum: &'a str,
     links: Option<&'a str>,
     rust_version: Option<&'a str>,
@@ -110,7 +110,7 @@ impl NewVersion<'_> {
     pub async fn save(
         &self,
         conn: &mut AsyncPgConnection,
-        published_by_email: &str,
+        published_by_email: Option<&str>,
     ) -> QueryResult<Version> {
         use diesel::insert_into;
 
@@ -122,13 +122,15 @@ impl NewVersion<'_> {
                     .get_result(conn)
                     .await?;
 
-                insert_into(versions_published_by::table)
-                    .values((
-                        versions_published_by::version_id.eq(version.id),
-                        versions_published_by::email.eq(published_by_email),
-                    ))
-                    .execute(conn)
-                    .await?;
+                if let Some(published_by_email) = published_by_email {
+                    insert_into(versions_published_by::table)
+                        .values((
+                            versions_published_by::version_id.eq(version.id),
+                            versions_published_by::email.eq(published_by_email),
+                        ))
+                        .execute(conn)
+                        .await?;
+                }
 
                 Ok(version)
             }

crates/crates_io_diesel_helpers/src/fns.rs

@@ -4,7 +4,7 @@ use diesel::sql_types::{Date, Double, Integer, Interval, SingleValue, Text, Time
 define_sql_function!(#[aggregate] fn array_agg<T: SingleValue>(x: T) -> Array<T>);
 define_sql_function!(fn canon_crate_name(x: Text) -> Text);
 define_sql_function!(fn to_char(a: Date, b: Text) -> Text);
-define_sql_function!(fn lower(x: Text) -> Text);
+define_sql_function!(fn lower<T: SingleValue>(x: T) -> T);
 define_sql_function!(fn date_part(x: Text, y: Timestamptz) -> Double);
 define_sql_function! {
     #[sql_name = "date_part"]

crates/crates_io_trustpub/Cargo.toml

@@ -7,10 +7,30 @@ edition = "2024"
 [lints]
 workspace = true
 
+[features]
+test-helpers = ["dep:bon", "dep:mockall", "dep:serde_json"]
+
 [dependencies]
+anyhow = "=1.0.98"
+async-trait = "=0.1.88"
+bon = { version = "=3.6.3", optional = true }
+chrono = { version = "=0.4.41", features = ["serde"] }
+jsonwebtoken = "=9.3.1"
+mockall = { version = "=0.13.1", optional = true }
+rand = "=0.9.1"
+reqwest = { version = "=0.12.15", features = ["gzip", "json"] }
 regex = "=1.11.1"
+secrecy = "=0.10.3"
+serde = { version = "=1.0.219", features = ["derive"] }
+serde_json = { version = "=1.0.140", optional = true }
+sha2 = "=0.10.9"
 thiserror = "=2.0.12"
+tokio = { version = "=1.45.0", features = ["sync"] }
 
 [dev-dependencies]
+bon = "=3.6.3"
 claims = "=0.8.0"
-insta = "=1.43.1"
+insta = { version = "=1.43.1", features = ["json", "redactions"] }
+mockito = "=1.7.0"
+serde_json = "=1.0.140"
+tokio = { version = "=1.45.0", features = ["macros", "rt-multi-thread"] }