Maxfield Luke
af6077b9c3
Fresh repository history for elektrine/tarakan hosted at https://git.elektrine.com/elektrine/tarakan.
918 lines
35 KiB
Elixir
918 lines
35 KiB
Elixir
defmodule TarakanWeb.AccountLive.Settings do
|
|
use TarakanWeb, :live_view
|
|
|
|
on_mount {TarakanWeb.AccountAuth, :require_sudo_mode}
|
|
|
|
alias Tarakan.Accounts
|
|
alias Tarakan.Accounts.{ApiCredential, ApiCredentials, SshKeys}
|
|
alias Tarakan.ModelAnalytics
|
|
alias Tarakan.Repositories
|
|
alias TarakanWeb.AccountAuth
|
|
|
|
# One long scroll made every panel equally prominent, so the two people
|
|
# actually use daily - email and credentials - sat next to the API reference.
|
|
# Each panel is now its own URL behind a rail, and the rail carries the
|
|
# counts so nothing has to be opened to be seen.
|
|
@sections [
|
|
%{id: :account, slug: nil, label: "Account", icon: "hero-user-circle"},
|
|
%{id: :credentials, slug: "credentials", label: "Credentials", icon: "hero-key"},
|
|
%{id: :ssh, slug: "ssh-keys", label: "SSH keys", icon: "hero-command-line"},
|
|
%{id: :agents, slug: "agents", label: "Agents", icon: "hero-cpu-chip"}
|
|
]
|
|
|
|
@impl true
|
|
def render(assigns) do
|
|
~H"""
|
|
<Layouts.app flash={@flash} current_scope={@current_scope} current_path={assigns[:current_path]}>
|
|
<Layouts.page width={:wide}>
|
|
<div class="mx-auto w-full max-w-5xl">
|
|
<header class="border-b-2 border-strong pb-5">
|
|
<h1 class="font-display text-2xl font-medium uppercase leading-9 tracking-[0.02em] text-ink">
|
|
Account settings
|
|
</h1>
|
|
<p class="mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 font-mono text-xs">
|
|
<span class="text-ink-muted">@{@current_scope.account.handle}</span>
|
|
<span class="text-ink-faint">{@current_scope.account.email}</span>
|
|
<span class={if @email_confirmed?, do: "text-phosphor", else: "text-signal"}>
|
|
{if @email_confirmed?, do: "confirmed", else: "unconfirmed"}
|
|
</span>
|
|
</p>
|
|
</header>
|
|
|
|
<div class="mt-6 grid gap-6 lg:grid-cols-[13rem_minmax(0,1fr)] lg:gap-8">
|
|
<nav
|
|
id="settings-navigation"
|
|
aria-label="Account settings"
|
|
class="flex overflow-x-auto overscroll-x-contain border-b-2 border-rule text-sm [-ms-overflow-style:none] [scrollbar-width:none] lg:sticky lg:top-20 lg:block lg:self-start lg:overflow-visible lg:border-b-0 lg:border-l-2 [&::-webkit-scrollbar]:hidden"
|
|
>
|
|
<.settings_tab
|
|
:for={section <- sections()}
|
|
id={"settings-tab-#{section.id}"}
|
|
active={@section == section.id}
|
|
patch={settings_path(section.slug)}
|
|
icon={section.icon}
|
|
label={section.label}
|
|
badge={section_badge(section.id, assigns)}
|
|
badge_class={section_badge_class(section.id, assigns)}
|
|
/>
|
|
</nav>
|
|
|
|
<div class="min-w-0">
|
|
<.account_section
|
|
:if={@section == :account}
|
|
email_form={@email_form}
|
|
password_form={@password_form}
|
|
trigger_submit={@trigger_submit}
|
|
email_confirmed?={@email_confirmed?}
|
|
identity_providers={@identity_providers}
|
|
/>
|
|
<.credentials_section
|
|
:if={@section == :credentials}
|
|
api_token={@api_token}
|
|
api_credentials={@api_credentials}
|
|
api_base_url={@api_base_url}
|
|
credential_form={@credential_form}
|
|
email_confirmed?={@email_confirmed?}
|
|
/>
|
|
<.ssh_section
|
|
:if={@section == :ssh}
|
|
handle={@current_scope.account.handle}
|
|
ssh_keys={@ssh_keys}
|
|
ssh_key_form={@ssh_key_form}
|
|
email_confirmed?={@email_confirmed?}
|
|
/>
|
|
<.agents_section :if={@section == :agents} model_scoreboard={@model_scoreboard} />
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</Layouts.page>
|
|
</Layouts.app>
|
|
"""
|
|
end
|
|
|
|
# The active entry stays a link so it is focusable and re-clickable;
|
|
# aria-current carries "you are here". Horizontal rail on narrow screens,
|
|
# vertical rail from lg up - the same element either way.
|
|
attr :id, :string, required: true
|
|
attr :active, :boolean, required: true
|
|
attr :patch, :string, required: true
|
|
attr :icon, :string, required: true
|
|
attr :label, :string, required: true
|
|
attr :badge, :string, default: nil
|
|
attr :badge_class, :string, default: nil
|
|
|
|
defp settings_tab(assigns) do
|
|
~H"""
|
|
<.link
|
|
id={@id}
|
|
patch={@patch}
|
|
aria-current={@active && "page"}
|
|
class={[
|
|
"-mb-0.5 flex shrink-0 items-center gap-2 whitespace-nowrap border-b-2 px-3 py-3 transition",
|
|
"lg:-ml-0.5 lg:mb-0 lg:w-full lg:border-b-0 lg:border-l-2 lg:px-4 lg:py-2.5",
|
|
@active && "border-signal font-semibold text-ink lg:bg-panel",
|
|
!@active && "border-transparent text-ink-muted hover:border-rule hover:text-ink"
|
|
]}
|
|
>
|
|
<.icon name={@icon} class="size-4 shrink-0" />
|
|
<span>{@label}</span>
|
|
<span :if={@badge} class={["font-mono text-[11px] tabular-nums lg:ml-auto", @badge_class]}>
|
|
{@badge}
|
|
</span>
|
|
</.link>
|
|
"""
|
|
end
|
|
|
|
defp account_section(assigns) do
|
|
~H"""
|
|
<div class="space-y-5">
|
|
<.form
|
|
for={@email_form}
|
|
id="email_form"
|
|
phx-submit="update_email"
|
|
phx-change="validate_email"
|
|
class="space-y-3 border-2 border-strong bg-panel p-6"
|
|
>
|
|
<h2 class="text-sm font-semibold text-ink">Email address</h2>
|
|
<.input
|
|
field={@email_form[:email]}
|
|
type="email"
|
|
label="Email"
|
|
autocomplete="username"
|
|
spellcheck="false"
|
|
required
|
|
/>
|
|
<.button variant="primary" phx-disable-with="Changing...">Save email</.button>
|
|
</.form>
|
|
|
|
<section
|
|
:if={not @email_confirmed?}
|
|
id="email-confirmation-required"
|
|
class="border-2 border-strong bg-panel p-6"
|
|
>
|
|
<h2 class="text-sm font-semibold text-ink">Confirm your email to unlock credentials</h2>
|
|
<p class="mt-1 text-xs leading-5 text-ink-faint">
|
|
Setting a password, adding SSH keys, and creating client credentials require a
|
|
confirmed email address. Sign in with the login link we emailed you - or request a
|
|
new one from the
|
|
<.link navigate={~p"/accounts/log-in"} class="text-signal hover:underline">login page</.link>
|
|
- to confirm it.
|
|
</p>
|
|
</section>
|
|
|
|
<.form
|
|
:if={@email_confirmed?}
|
|
for={@password_form}
|
|
id="password_form"
|
|
action={~p"/accounts/update-password"}
|
|
method="post"
|
|
phx-change="validate_password"
|
|
phx-submit="update_password"
|
|
phx-trigger-action={@trigger_submit}
|
|
class="space-y-3 border-2 border-strong bg-panel p-6"
|
|
>
|
|
<h2 class="text-sm font-semibold text-ink">Password</h2>
|
|
<p class="text-xs leading-5 text-ink-faint">
|
|
At least 15 characters.
|
|
</p>
|
|
<.input
|
|
field={@password_form[:password]}
|
|
type="password"
|
|
label="New password"
|
|
autocomplete="new-password"
|
|
spellcheck="false"
|
|
required
|
|
/>
|
|
<.input
|
|
field={@password_form[:password_confirmation]}
|
|
type="password"
|
|
label="Confirm new password"
|
|
autocomplete="new-password"
|
|
spellcheck="false"
|
|
/>
|
|
<.button variant="primary" phx-disable-with="Saving...">
|
|
Save password
|
|
</.button>
|
|
</.form>
|
|
|
|
<section class="border-2 border-strong bg-panel p-6">
|
|
<h2 class="text-sm font-semibold text-ink">Connected code hosts</h2>
|
|
<div class="mt-4 grid gap-3 sm:grid-cols-2">
|
|
<.link
|
|
id="settings-github-identity"
|
|
href={~p"/auth/github?#{[return_to: ~p"/accounts/settings"]}"}
|
|
class="flex items-center justify-between border-2 border-rule px-4 py-3 text-sm text-ink-muted transition hover:bg-panel"
|
|
>
|
|
<span>GitHub</span>
|
|
<span class={
|
|
if MapSet.member?(@identity_providers, "github"),
|
|
do: "text-signal",
|
|
else: "text-ink-faint"
|
|
}>
|
|
{if MapSet.member?(@identity_providers, "github"), do: "Connected", else: "Connect"}
|
|
</span>
|
|
</.link>
|
|
<.link
|
|
id="settings-gitlab-identity"
|
|
href={~p"/auth/gitlab?#{[return_to: ~p"/accounts/settings"]}"}
|
|
class="flex items-center justify-between border-2 border-rule px-4 py-3 text-sm text-ink-muted transition hover:bg-panel"
|
|
>
|
|
<span>GitLab</span>
|
|
<span class={
|
|
if MapSet.member?(@identity_providers, "gitlab"),
|
|
do: "text-signal",
|
|
else: "text-ink-faint"
|
|
}>
|
|
{if MapSet.member?(@identity_providers, "gitlab"), do: "Connected", else: "Connect"}
|
|
</span>
|
|
</.link>
|
|
</div>
|
|
</section>
|
|
</div>
|
|
"""
|
|
end
|
|
|
|
defp credentials_section(assigns) do
|
|
~H"""
|
|
<section id="api-token" class="border-2 border-strong bg-panel p-6">
|
|
<h2 class="text-sm font-semibold text-ink">Client credentials</h2>
|
|
<p class="mt-1 text-xs leading-5 text-ink-faint">
|
|
<span class="font-mono">TARAKAN_API_TOKEN</span>, sent as <span class="font-mono">Authorization: Bearer <token></span>. Defaults expire after {ApiCredentials.default_validity_days()} days (max {ApiCredentials.maximum_validity_days()}).
|
|
</p>
|
|
<div :if={@api_token} class="mt-4">
|
|
<p class="font-mono text-[11px] text-ink-faint">
|
|
Shown only once.
|
|
</p>
|
|
<p
|
|
id="api-token-value"
|
|
class="mt-1 break-all border-2 border-rule px-3 py-2 font-mono text-xs text-ink"
|
|
>
|
|
{@api_token}
|
|
</p>
|
|
</div>
|
|
<div
|
|
:if={@api_credentials != []}
|
|
id="api-credentials"
|
|
class="mt-4 divide-y-2 divide-rule border-y-2 border-rule"
|
|
>
|
|
<div
|
|
:for={credential <- @api_credentials}
|
|
id={"api-credential-#{credential.id}"}
|
|
class="flex items-center justify-between gap-4 py-3"
|
|
>
|
|
<div class="min-w-0">
|
|
<p class="truncate text-xs font-semibold text-ink">{credential.name}</p>
|
|
<p class="mt-1 font-mono text-[11px] text-ink-faint">
|
|
{credential.token_prefix}… · {credential_status(credential)}
|
|
</p>
|
|
<p class="mt-1 font-mono text-[11px] text-ink-faint">
|
|
{Enum.join(credential.scopes, " · ")}
|
|
<span :if={credential.repository}>
|
|
· {credential.repository.owner}/{credential.repository.name}
|
|
</span>
|
|
</p>
|
|
</div>
|
|
<.button
|
|
:if={ApiCredential.active?(credential)}
|
|
variant="danger"
|
|
size="sm"
|
|
id={"revoke-api-credential-#{credential.id}"}
|
|
phx-click="revoke_api_credential"
|
|
phx-value-id={credential.id}
|
|
data-confirm="Revoke this credential? Clients using it will immediately lose access."
|
|
>
|
|
Revoke
|
|
</.button>
|
|
</div>
|
|
</div>
|
|
<.form
|
|
:if={@email_confirmed?}
|
|
for={@credential_form}
|
|
id="api-credential-form"
|
|
phx-submit="generate_api_token"
|
|
class="mt-5 space-y-4 border-t-2 border-rule pt-5"
|
|
>
|
|
<.input
|
|
field={@credential_form[:name]}
|
|
type="text"
|
|
label="Credential name"
|
|
maxlength="80"
|
|
required
|
|
/>
|
|
<fieldset>
|
|
<legend class="text-xs font-semibold text-ink">Permissions</legend>
|
|
<div class="mt-2 grid gap-2 sm:grid-cols-2">
|
|
<label
|
|
:for={scope <- ApiCredential.scopes()}
|
|
class="flex items-start gap-2 border-2 border-rule px-3 py-2 text-xs text-ink-muted"
|
|
>
|
|
<input
|
|
type="checkbox"
|
|
name="credential[scopes][]"
|
|
value={scope}
|
|
checked={scope in @credential_form.params["scopes"]}
|
|
class="mt-0.5 border-rule text-signal focus:ring-phosphor"
|
|
/>
|
|
<span>
|
|
<span class="block font-mono text-ink">{scope}</span>
|
|
<span class="mt-0.5 block text-ink-faint">{credential_scope_label(scope)}</span>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
</fieldset>
|
|
<.input
|
|
field={@credential_form[:repository]}
|
|
type="text"
|
|
label="Limit to one repository (optional)"
|
|
placeholder="owner/repository"
|
|
autocomplete="off"
|
|
spellcheck="false"
|
|
/>
|
|
<.button id="generate-api-token-button" variant="primary">
|
|
Generate client credential
|
|
</.button>
|
|
</.form>
|
|
|
|
<details id="api-reference" class="group mt-5 border-t-2 border-rule pt-5">
|
|
<summary class="flex cursor-pointer list-none items-center justify-between gap-4 text-sm font-semibold text-ink marker:hidden">
|
|
<span>API reference</span>
|
|
<span class="font-mono text-[11px] font-normal uppercase tracking-[0.12em] text-ink-faint group-open:hidden">
|
|
Open
|
|
</span>
|
|
<span class="hidden font-mono text-[11px] font-normal uppercase tracking-[0.12em] text-ink-faint group-open:inline">
|
|
Close
|
|
</span>
|
|
</summary>
|
|
|
|
<div class="mt-4 space-y-5 text-xs leading-5 text-ink-muted">
|
|
<div>
|
|
<p class="font-semibold text-ink">Authentication</p>
|
|
<p class="mt-1">
|
|
Base URL:
|
|
<code id="api-reference-base-url" class="font-mono text-ink">{@api_base_url}</code>
|
|
</p>
|
|
<p>
|
|
Send <code class="font-mono text-ink">Authorization: Bearer <token></code>
|
|
and <code class="font-mono text-ink">Accept: application/json</code>.
|
|
</p>
|
|
<pre class="mt-2 overflow-x-auto border-2 border-rule bg-ground p-3 font-mono text-[11px] leading-5 text-ink"><code>curl "{@api_base_url}/jobs" \
|
|
-H "Authorization: Bearer $TARAKAN_API_TOKEN" \
|
|
-H "Accept: application/json"</code></pre>
|
|
</div>
|
|
|
|
<div>
|
|
<p class="font-semibold text-ink">Client authorization</p>
|
|
<dl class="mt-2 grid gap-x-3 gap-y-1 font-mono text-[11px] sm:grid-cols-[4rem_1fr]">
|
|
<dt class="text-ink">POST</dt><dd>/client-auth/start</dd>
|
|
<dt class="text-ink">POST</dt><dd>/client-auth/exchange</dd>
|
|
<dt class="text-ink">DELETE</dt><dd>/client-auth/session</dd>
|
|
</dl>
|
|
<p class="mt-2">
|
|
Start with <code class="font-mono text-ink">{"client_name":"Tarakan Client"}</code>,
|
|
open the returned verification URL, then poll exchange with
|
|
<code class="font-mono text-ink">{"device_code":"..."}</code>
|
|
at the returned interval. Session revocation requires the issued bearer token.
|
|
</p>
|
|
</div>
|
|
|
|
<div>
|
|
<p class="font-semibold text-ink">Repository discovery</p>
|
|
<dl class="mt-2 grid gap-x-3 gap-y-1 font-mono text-[11px] sm:grid-cols-[4rem_1fr]">
|
|
<dt class="text-ink">GET</dt><dd>/repositories</dd>
|
|
<dt class="text-ink">POST</dt><dd>/repositories</dd>
|
|
</dl>
|
|
<p class="mt-2">
|
|
List with <code class="font-mono text-ink">status=unscanned</code>
|
|
and <code class="font-mono text-ink">limit=100</code>.
|
|
Register with
|
|
<code class="font-mono text-ink">{"url":"owner/name"}</code>
|
|
(scopes: findings:submit or reviews:submit).
|
|
</p>
|
|
</div>
|
|
|
|
<div>
|
|
<p class="font-semibold text-ink">Jobs</p>
|
|
<dl class="mt-2 grid gap-x-3 gap-y-1 font-mono text-[11px] sm:grid-cols-[4rem_1fr]">
|
|
<dt class="text-ink">GET</dt><dd>/jobs</dd>
|
|
<dt class="text-ink">GET</dt><dd>/:host/:owner/:name/jobs</dd>
|
|
<dt class="text-ink">GET</dt><dd>/jobs/:id</dd>
|
|
<dt class="text-ink">POST</dt><dd>/jobs/:id/claim</dd>
|
|
<dt class="text-ink">POST</dt><dd>/jobs/:id/claim/renew</dd>
|
|
<dt class="text-ink">DELETE</dt><dd>/jobs/:id/claim</dd>
|
|
<dt class="text-ink">POST</dt><dd>/jobs/:id/complete</dd>
|
|
</dl>
|
|
<p class="mt-2">
|
|
Scopes: <code class="font-mono text-ink">tasks:read</code>, <code class="font-mono text-ink">tasks:claim</code>, and <code class="font-mono text-ink">contributions:write</code>.
|
|
</p>
|
|
</div>
|
|
|
|
<div>
|
|
<p class="font-semibold text-ink">Reports and Checks</p>
|
|
<dl class="mt-2 grid gap-x-3 gap-y-1 font-mono text-[11px] sm:grid-cols-[4rem_1fr]">
|
|
<dt class="text-ink">GET</dt><dd>/:host/:owner/:name/reports</dd>
|
|
<dt class="text-ink">POST</dt><dd>/:host/:owner/:name/reports</dd>
|
|
<dt class="text-ink">GET</dt><dd>/:host/:owner/:name/memory</dd>
|
|
<dt class="text-ink">POST</dt><dd>/:host/:owner/:name/reports/:id/check</dd>
|
|
<dt class="text-ink">POST</dt><dd>
|
|
/:host/:owner/:name/findings/:public_id/check
|
|
</dd>
|
|
</dl>
|
|
<p class="mt-2">
|
|
Use <code class="font-mono text-ink">reviews:submit</code>
|
|
to publish, <code class="font-mono text-ink">reviews:read</code>
|
|
for restricted evidence,
|
|
and <code class="font-mono text-ink">reviews:verify</code>
|
|
to check findings.
|
|
Checks also require qualified reviewer standing.
|
|
</p>
|
|
</div>
|
|
|
|
<div class="border-l-2 border-rule pl-3">
|
|
<p class="font-semibold text-ink">Repository host</p>
|
|
<p class="mt-1">
|
|
Use <code class="font-mono text-ink">github.com</code>
|
|
or <code class="font-mono text-ink">tarakan.lol</code>
|
|
for <code class="font-mono text-ink">:host</code>. JSON bodies only;
|
|
validation failures return field errors with a non-2xx status.
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</details>
|
|
</section>
|
|
"""
|
|
end
|
|
|
|
defp ssh_section(assigns) do
|
|
~H"""
|
|
<section id="ssh-keys" class="border-2 border-strong bg-panel p-6">
|
|
<h2 class="text-sm font-semibold text-ink">SSH keys</h2>
|
|
<p class="mt-1 font-mono text-xs leading-5 text-ink-faint">
|
|
git clone ssh://git@<host>/{@handle}/<name>.git
|
|
</p>
|
|
<div
|
|
:if={@ssh_keys != []}
|
|
id="ssh-key-list"
|
|
class="mt-4 divide-y-2 divide-rule border-y-2 border-rule"
|
|
>
|
|
<div
|
|
:for={key <- @ssh_keys}
|
|
id={"ssh-key-#{key.id}"}
|
|
class="flex items-center justify-between gap-4 py-3"
|
|
>
|
|
<div class="min-w-0">
|
|
<p class="truncate text-xs font-semibold text-ink">{key.name}</p>
|
|
<p class="mt-1 break-all font-mono text-[11px] text-ink-faint">
|
|
{key.fingerprint_sha256}
|
|
</p>
|
|
<p class="mt-1 font-mono text-[11px] text-ink-faint">
|
|
{key.key_type} · {ssh_key_last_used(key)}
|
|
</p>
|
|
</div>
|
|
<.button
|
|
variant="danger"
|
|
size="sm"
|
|
id={"delete-ssh-key-#{key.id}"}
|
|
phx-click="delete_ssh_key"
|
|
phx-value-id={key.id}
|
|
data-confirm="Remove this key? Clients using it will immediately lose SSH access."
|
|
>
|
|
Remove
|
|
</.button>
|
|
</div>
|
|
</div>
|
|
<.form
|
|
:if={@email_confirmed?}
|
|
for={@ssh_key_form}
|
|
id="ssh-key-form"
|
|
phx-submit="add_ssh_key"
|
|
class="mt-5 space-y-4 border-t-2 border-rule pt-5"
|
|
>
|
|
<.input
|
|
field={@ssh_key_form[:name]}
|
|
type="text"
|
|
label="Key name"
|
|
placeholder="work laptop"
|
|
maxlength="100"
|
|
required
|
|
/>
|
|
<.input
|
|
field={@ssh_key_form[:public_key]}
|
|
type="textarea"
|
|
label="Public key"
|
|
placeholder="ssh-ed25519 AAAA…"
|
|
rows="3"
|
|
spellcheck="false"
|
|
required
|
|
/>
|
|
<p class="text-xs leading-5 text-ink-faint">
|
|
ed25519, ECDSA, and RSA (3072-bit or larger) keys are accepted.
|
|
</p>
|
|
<.button id="add-ssh-key-button" variant="primary">Add SSH key</.button>
|
|
</.form>
|
|
</section>
|
|
"""
|
|
end
|
|
|
|
# Which of the agents this contributor pays for actually finds real bugs,
|
|
# measured against their own submissions rather than the corpus average.
|
|
defp agents_section(assigns) do
|
|
~H"""
|
|
<section id="settings-model-scoreboard" class="border-2 border-strong bg-panel p-6">
|
|
<div class="flex flex-wrap items-baseline justify-between gap-x-4 gap-y-1">
|
|
<h2 class="text-sm font-semibold text-ink">Your agents</h2>
|
|
<.link navigate={~p"/models"} class="font-mono text-[11px] text-signal hover:underline">
|
|
All models →
|
|
</.link>
|
|
</div>
|
|
|
|
<p :if={@model_scoreboard == []} class="mt-4 font-mono text-xs text-ink-faint">
|
|
None yet.
|
|
</p>
|
|
|
|
<div
|
|
:if={@model_scoreboard != []}
|
|
class="mt-4 overflow-x-auto border-2 border-rule bg-ground"
|
|
>
|
|
<table class="w-full min-w-[28rem] border-collapse text-left">
|
|
<thead>
|
|
<tr class="border-b border-rule font-mono text-[10px] uppercase tracking-[0.12em] text-ink-faint">
|
|
<th class="px-3 py-2 font-normal">Model</th>
|
|
<th class="w-20 px-2 py-2 text-right font-normal">Findings</th>
|
|
<th class="w-24 px-2 py-2 text-right font-normal">Confirmed</th>
|
|
<th class="w-24 px-2 py-2 text-right font-normal">Disputed</th>
|
|
<th class="w-24 px-3 py-2 text-right font-normal">Precision</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody class="divide-y divide-rule">
|
|
<tr :for={row <- @model_scoreboard} id={"settings-model-#{row.model}"}>
|
|
<td class="min-w-0 px-3 py-2.5">
|
|
<span class="block truncate font-mono text-xs font-semibold text-ink">
|
|
{row.model}
|
|
</span>
|
|
</td>
|
|
<td class="px-2 py-2.5 text-right font-mono text-xs tabular-nums text-ink">
|
|
{row.findings}
|
|
</td>
|
|
<td class="px-2 py-2.5 text-right font-mono text-xs tabular-nums text-phosphor">
|
|
{row.confirmed}
|
|
</td>
|
|
<td class="px-2 py-2.5 text-right font-mono text-xs tabular-nums text-ink-muted">
|
|
{row.disputed}
|
|
</td>
|
|
<td class="px-3 py-2.5 text-right font-mono text-xs tabular-nums text-ink">
|
|
{if row.precision, do: "#{row.precision}%", else: "-"}
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</section>
|
|
"""
|
|
end
|
|
|
|
@impl true
|
|
def mount(%{"token" => token}, _session, socket) do
|
|
socket =
|
|
case Accounts.update_account_email(socket.assigns.current_scope.account, token) do
|
|
{:ok, _account} ->
|
|
put_flash(socket, :info, "Email changed successfully.")
|
|
|
|
{:error, _} ->
|
|
put_flash(socket, :error, "Email change link is invalid or it has expired.")
|
|
end
|
|
|
|
{:ok, push_navigate(socket, to: ~p"/accounts/settings")}
|
|
end
|
|
|
|
def mount(_params, _session, socket) do
|
|
account = socket.assigns.current_scope.account
|
|
email_changeset = Accounts.change_account_email(account, %{}, validate_unique: false)
|
|
password_changeset = Accounts.change_account_password(account, %{}, hash_password: false)
|
|
|
|
identity_providers =
|
|
account
|
|
|> Accounts.list_external_identities()
|
|
|> MapSet.new(& &1.provider)
|
|
|
|
socket =
|
|
socket
|
|
|> assign(:email_form, to_form(email_changeset))
|
|
|> assign(:password_form, to_form(password_changeset))
|
|
|> assign(:identity_providers, identity_providers)
|
|
|> assign(:trigger_submit, false)
|
|
|> assign(:email_confirmed?, not is_nil(account.confirmed_at))
|
|
|> assign(:api_token, nil)
|
|
|> assign(:api_credentials, ApiCredentials.list(account))
|
|
|> assign(:api_base_url, TarakanWeb.Endpoint.url() <> "/api")
|
|
|> assign(:credential_form, credential_form())
|
|
|> assign(:ssh_keys, SshKeys.list_for_account(account))
|
|
|> assign(:ssh_key_form, ssh_key_form())
|
|
|> assign(:model_scoreboard, ModelAnalytics.account_model_scoreboard(account.id))
|
|
|> assign(:section, :account)
|
|
|
|
{:ok, socket}
|
|
end
|
|
|
|
@impl true
|
|
def handle_params(params, _uri, socket) do
|
|
{:noreply, assign(socket, :section, section_from_params(params))}
|
|
end
|
|
|
|
@impl true
|
|
def handle_event("validate_email", params, socket) do
|
|
%{"account" => account_params} = params
|
|
|
|
email_form =
|
|
socket.assigns.current_scope.account
|
|
|> Accounts.change_account_email(account_params, validate_unique: false)
|
|
|> Map.put(:action, :validate)
|
|
|> to_form()
|
|
|
|
{:noreply, assign(socket, email_form: email_form)}
|
|
end
|
|
|
|
def handle_event("update_email", params, socket) do
|
|
%{"account" => account_params} = params
|
|
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account do
|
|
case Accounts.change_account_email(account, account_params) do
|
|
%{valid?: true} = changeset ->
|
|
Accounts.deliver_account_update_email_instructions(
|
|
Ecto.Changeset.apply_action!(changeset, :insert),
|
|
account.email,
|
|
&url(~p"/accounts/settings/confirm-email/#{&1}")
|
|
)
|
|
|
|
info = "A link to confirm your email change has been sent to the new address."
|
|
{:noreply, socket |> put_flash(:info, info)}
|
|
|
|
changeset ->
|
|
{:noreply, assign(socket, :email_form, to_form(changeset, action: :insert))}
|
|
end
|
|
else
|
|
{:error, :sudo_required} -> reauth_settings(socket)
|
|
end
|
|
end
|
|
|
|
def handle_event("validate_password", params, socket) do
|
|
%{"account" => account_params} = params
|
|
|
|
password_form =
|
|
socket.assigns.current_scope.account
|
|
|> Accounts.change_account_password(account_params, hash_password: false)
|
|
|> Map.put(:action, :validate)
|
|
|> to_form()
|
|
|
|
{:noreply, assign(socket, password_form: password_form)}
|
|
end
|
|
|
|
def handle_event("generate_api_token", %{"credential" => params}, socket) do
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account,
|
|
{:ok, repository_id} <- credential_repository_id(socket, params["repository"]),
|
|
attrs <- %{
|
|
"name" => params["name"],
|
|
"scopes" => List.wrap(params["scopes"]),
|
|
"repository_id" => repository_id
|
|
},
|
|
{:ok, token, _credential} <- ApiCredentials.create(account, attrs) do
|
|
{:noreply,
|
|
assign(socket,
|
|
api_token: token,
|
|
api_credentials: ApiCredentials.list(account),
|
|
credential_form: credential_form()
|
|
)}
|
|
else
|
|
{:error, :sudo_required} ->
|
|
reauth_settings(socket)
|
|
|
|
{:error, :repository_not_found} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:credential_form, credential_form(params))
|
|
|> put_flash(:error, "Choose a registered repository you are allowed to view.")}
|
|
|
|
{:error, :credential_limit} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:credential_form, credential_form(params))
|
|
|> put_flash(:error, "Revoke an active credential before creating another one.")}
|
|
|
|
{:error, %Ecto.Changeset{}} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:credential_form, credential_form(params))
|
|
|> put_flash(:error, "Choose a name and at least one valid permission.")}
|
|
|
|
{:error, :unconfirmed_email} ->
|
|
{:noreply,
|
|
put_flash(socket, :error, "Confirm your email address before creating credentials.")}
|
|
|
|
{:error, _reason} ->
|
|
{:noreply, put_flash(socket, :error, "The credential could not be created.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("generate_api_token", _params, socket) do
|
|
handle_event(
|
|
"generate_api_token",
|
|
%{"credential" => socket.assigns.credential_form.params},
|
|
socket
|
|
)
|
|
end
|
|
|
|
def handle_event("revoke_api_credential", %{"id" => credential_id}, socket) do
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account,
|
|
{:ok, _credential} <- ApiCredentials.revoke(account, credential_id) do
|
|
{:noreply,
|
|
socket
|
|
|> assign(:api_credentials, ApiCredentials.list(account))
|
|
|> put_flash(:info, "Client credential revoked.")}
|
|
else
|
|
{:error, :sudo_required} ->
|
|
reauth_settings(socket)
|
|
|
|
{:error, :not_found} ->
|
|
{:noreply, put_flash(socket, :error, "Client credential not found.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("add_ssh_key", %{"ssh_key" => params}, socket) do
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account do
|
|
case SshKeys.add_key(account, params) do
|
|
{:ok, _key} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:ssh_keys, SshKeys.list_for_account(account))
|
|
|> assign(:ssh_key_form, ssh_key_form())
|
|
|> put_flash(:info, "SSH key added.")}
|
|
|
|
{:error, :key_limit} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:ssh_key_form, ssh_key_form(params))
|
|
|> put_flash(:error, "Remove an existing key before adding another one.")}
|
|
|
|
{:error, :unconfirmed_email} ->
|
|
{:noreply,
|
|
put_flash(socket, :error, "Confirm your email address before adding SSH keys.")}
|
|
|
|
{:error, %Ecto.Changeset{} = changeset} ->
|
|
{:noreply, assign(socket, :ssh_key_form, to_form(changeset, as: :ssh_key))}
|
|
end
|
|
else
|
|
{:error, :sudo_required} -> reauth_settings(socket)
|
|
end
|
|
end
|
|
|
|
def handle_event("delete_ssh_key", %{"id" => key_id}, socket) do
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account,
|
|
{:ok, _key} <- SshKeys.delete_key(account, key_id) do
|
|
{:noreply,
|
|
socket
|
|
|> assign(:ssh_keys, SshKeys.list_for_account(account))
|
|
|> put_flash(:info, "SSH key removed.")}
|
|
else
|
|
{:error, :sudo_required} -> reauth_settings(socket)
|
|
{:error, :not_found} -> {:noreply, put_flash(socket, :error, "SSH key not found.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("update_password", params, socket) do
|
|
%{"account" => account_params} = params
|
|
|
|
with :ok <- ensure_sudo(socket),
|
|
account <- socket.assigns.current_scope.account do
|
|
case Accounts.change_account_password(account, account_params) do
|
|
%{valid?: true} = changeset ->
|
|
{:noreply, assign(socket, trigger_submit: true, password_form: to_form(changeset))}
|
|
|
|
changeset ->
|
|
{:noreply, assign(socket, password_form: to_form(changeset, action: :insert))}
|
|
end
|
|
else
|
|
{:error, :sudo_required} -> reauth_settings(socket)
|
|
end
|
|
end
|
|
|
|
defp sections, do: @sections
|
|
|
|
defp settings_path(nil), do: ~p"/accounts/settings"
|
|
defp settings_path(slug), do: ~p"/accounts/settings/#{slug}"
|
|
|
|
# An unknown slug falls back to the first panel rather than 404ing: the URL
|
|
# is a convenience for deep links, not a resource.
|
|
defp section_from_params(%{"section" => slug}) do
|
|
case Enum.find(@sections, &(&1.slug == slug)) do
|
|
%{id: id} -> id
|
|
nil -> :account
|
|
end
|
|
end
|
|
|
|
defp section_from_params(_params), do: :account
|
|
|
|
defp section_slug(id) do
|
|
case Enum.find(@sections, &(&1.id == id)) do
|
|
%{slug: slug} -> slug
|
|
nil -> nil
|
|
end
|
|
end
|
|
|
|
defp section_badge(:account, %{email_confirmed?: false}), do: "unconfirmed"
|
|
defp section_badge(:account, _assigns), do: nil
|
|
|
|
defp section_badge(:credentials, %{api_credentials: credentials}),
|
|
do: credentials |> Enum.count(&ApiCredential.active?/1) |> Integer.to_string()
|
|
|
|
defp section_badge(:ssh, %{ssh_keys: keys}), do: keys |> length() |> Integer.to_string()
|
|
|
|
defp section_badge(:agents, %{model_scoreboard: scoreboard}),
|
|
do: scoreboard |> length() |> Integer.to_string()
|
|
|
|
defp section_badge_class(:account, %{email_confirmed?: false}), do: "text-signal"
|
|
defp section_badge_class(_section, _assigns), do: "text-ink-faint"
|
|
|
|
defp ensure_sudo(socket) do
|
|
if Accounts.sudo_mode?(socket.assigns.current_scope.account),
|
|
do: :ok,
|
|
else: {:error, :sudo_required}
|
|
end
|
|
|
|
# Come back to the panel the action was attempted from, not to the first one.
|
|
defp reauth_settings(socket) do
|
|
return_to = socket.assigns.section |> section_slug() |> settings_path()
|
|
|
|
{:noreply,
|
|
socket
|
|
|> put_flash(
|
|
:error,
|
|
"Confirm it's you with a magic link before changing sensitive settings."
|
|
)
|
|
|> redirect(to: AccountAuth.reauth_path(return_to))}
|
|
end
|
|
|
|
defp credential_status(%ApiCredential{revoked_at: %DateTime{}}), do: "revoked"
|
|
|
|
defp credential_status(%ApiCredential{expires_at: expires_at}) do
|
|
if ApiCredential.active?(%ApiCredential{expires_at: expires_at}) do
|
|
"expires " <> Calendar.strftime(expires_at, "%Y-%m-%d")
|
|
else
|
|
"expired"
|
|
end
|
|
end
|
|
|
|
defp credential_form(params \\ %{}) do
|
|
defaults = %{
|
|
"name" => "Tarakan Client",
|
|
"repository" => "",
|
|
"scopes" => ApiCredentials.default_scopes()
|
|
}
|
|
|
|
to_form(Map.merge(defaults, params), as: :credential)
|
|
end
|
|
|
|
defp credential_repository_id(_socket, repository)
|
|
when repository in [nil, ""],
|
|
do: {:ok, nil}
|
|
|
|
defp credential_repository_id(socket, reference) when is_binary(reference) do
|
|
with {:ok, %{owner: owner, name: name}} <- Repositories.parse_github_repository(reference),
|
|
%{} = repository <-
|
|
Repositories.get_visible_github_repository(
|
|
owner,
|
|
name,
|
|
socket.assigns.current_scope
|
|
) do
|
|
{:ok, repository.id}
|
|
else
|
|
_invalid -> {:error, :repository_not_found}
|
|
end
|
|
end
|
|
|
|
defp credential_scope_label("tasks:read"), do: "Read visible jobs"
|
|
defp credential_scope_label("tasks:claim"), do: "Claim and release jobs"
|
|
defp credential_scope_label("contributions:write"), do: "Submit task evidence"
|
|
defp credential_scope_label("findings:submit"), do: "Submit quarantined scan results"
|
|
defp credential_scope_label("reports:write"), do: "Report abuse and view your reports"
|
|
|
|
defp credential_scope_label("reviews:read"),
|
|
do: "Read restricted review findings (reviewer tier)"
|
|
|
|
defp credential_scope_label("reviews:verify"), do: "Record checks on reports (reviewer tier)"
|
|
defp credential_scope_label("repo:read"), do: "Clone your visible hosted repositories"
|
|
defp credential_scope_label("repo:write"), do: "Push to hosted repositories you steward"
|
|
defp credential_scope_label(scope), do: scope
|
|
|
|
defp ssh_key_form(params \\ %{}) do
|
|
to_form(Map.merge(%{"name" => "", "public_key" => ""}, params), as: :ssh_key)
|
|
end
|
|
|
|
defp ssh_key_last_used(%{last_used_at: nil}), do: "never used"
|
|
|
|
defp ssh_key_last_used(%{last_used_at: last_used_at}),
|
|
do: "last used " <> Calendar.strftime(last_used_at, "%Y-%m-%d")
|
|
end
|