fix(moon): clear ESLint errors blocking test-web-ui

Satisfy padding-line-between-statements in MergedItem and drop unused catch bindings flagged on PR CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: benjamin-747

Cargo.lock

@@ -105,7 +105,7 @@ impl AdminApplicationService {
         })
     }
 
-    /// Ensure mega-init bot + fresh push token (for unauthenticated bootstrap-init).
+    /// Ensure mega-init bot + fresh push token (for secret-gated bootstrap-init).
     pub async fn ensure_init_bot_token(
         &self,
     ) -> Result<crate::model::bots::BootstrapInitBotResponse, MegaError> {
@@ -156,12 +156,16 @@ impl AdminApplicationService {
             .await
     }
 
-    /// Check whether a bot has sufficient permission on a given resource.
+    /// Check whether a bot has sufficient permission on a given resource path.
+    ///
+    /// `resource_id` is treated as a repository path (same as receive-pack).
+    /// Requires an Enabled installation covering that path and a permission
+    /// scope that satisfies `required_permission`.
     pub async fn check_bot_permission(
         &self,
         bot_id: i64,
         _resource_type: callisto::sea_orm_active_enums::ResourceTypeEnum,
-        _resource_id: &str,
+        resource_id: &str,
         required_permission: PermissionEnum,
     ) -> Result<bool, MegaError> {
         let bots_storage = self.ctx.storage().bots_storage();
@@ -175,19 +179,23 @@ impl AdminApplicationService {
             return Ok(false);
         }
 
-        let installations = bots_storage.get_installed_bot_by_id(bot_id).await?;
-        let has_enabled_installation = installations
-            .iter()
-            .any(|inst| inst.status == InstallationBotStatusEnum::Enabled);
-
-        if !has_enabled_installation {
+        if !scope_satisfies_permission(&bot.permission_scope, &required_permission) {
             return Ok(false);
         }
 
-        Ok(scope_satisfies_permission(
-            &bot.permission_scope,
-            &required_permission,
-        ))
+        // Push-level checks also enforce installation coverage on the path.
+        if matches!(
+            required_permission,
+            PermissionEnum::Write | PermissionEnum::Admin
+        ) {
+            return bots_storage.bot_may_push_to_path(&bot, resource_id).await;
+        }
+
+        // Read: any Enabled installation is enough (scope already checked).
+        let installations = bots_storage.get_installed_bot_by_id(bot_id).await?;
+        Ok(installations
+            .iter()
+            .any(|inst| inst.status == InstallationBotStatusEnum::Enabled))
     }
 }
 

ceres/src/application/api_service/mono/admin/bot.rs

@@ -126,8 +126,9 @@ pub struct CreateBotTokenResponse {
     pub token_plain: String,
 }
 
-/// Response for unauthenticated mega-init bot bootstrap.
+/// Response for mega-init bot bootstrap (`POST /bots/bootstrap-init`).
 ///
+/// Requires header `X-Mega-Init-Secret` matching `MEGA_INIT_BOOTSTRAP_SECRET`.
 /// `token` is a `bot_` push token returned once; use as Bearer (or Basic password).
 #[derive(Serialize, ToSchema)]
 pub struct BootstrapInitBotResponse {

ceres/src/model/bots.rs

@@ -2,7 +2,7 @@ use std::{collections::HashSet, ops::Deref};
 
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use callisto::{
-    bot_installations, bot_keys, bot_tokens, bots,
+    bot_installations, bot_keys, bot_tokens, bots, git_repo,
     sea_orm_active_enums::{
         BotStatusEnum, InstallationBotStatusEnum, InstallationTargetTypeEnum, PermissionScopeEnum,
     },
@@ -32,6 +32,8 @@ use crate::{
 const BOT_TOKEN_PREFIX: &str = "bot_";
 const BOT_TOKEN_RANDOM_LEN: usize = 32;
 const BOT_TOKEN_HMAC_KEY_ENV: &str = "MEGA_BOT_TOKEN_HMAC_SECRET";
+/// Organization installation target_id for system bots (`organization_id` is null).
+const SYSTEM_ORG_INSTALL_TARGET_ID: i64 = 0;
 
 #[derive(Clone)]
 pub struct BotsStorage {
@@ -281,8 +283,10 @@ impl BotsStorage {
 
     /// Ensure the fixed mega-init bot exists and return a fresh push token.
     ///
-    /// Creates bot `mega-init` if missing, revokes any existing `mega-init-push`
-    /// tokens, then issues a new token (plaintext returned once).
+    /// Creates bot `mega-init` if missing, ensures a system Organization
+    /// installation (so receive-pack accepts its Write token), revokes any
+    /// existing `mega-init-push` tokens, then issues a new token (plaintext
+    /// returned once).
     pub async fn ensure_init_bot_token(&self) -> Result<(bots::Model, String), MegaError> {
         const INIT_BOT_NAME: &str = "mega-init";
         const INIT_TOKEN_NAME: &str = "mega-init-push";
@@ -303,6 +307,8 @@ impl BotsStorage {
             )));
         }
 
+        self.ensure_system_org_installation(bot.id).await?;
+
         self.revoke_bot_tokens_by_name(bot.id, INIT_TOKEN_NAME)
             .await?;
         let (_model, token_plain) = self
@@ -311,6 +317,110 @@ impl BotsStorage {
         Ok((bot, token_plain))
     }
 
+    /// Ensure an Enabled Organization installation for a system bot (target_id 0).
+    pub async fn ensure_system_org_installation(&self, bot_id: i64) -> Result<(), MegaError> {
+        let existing = bot_installations::Entity::find()
+            .filter(bot_installations::Column::BotId.eq(bot_id))
+            .filter(
+                bot_installations::Column::TargetType.eq(InstallationTargetTypeEnum::Organization),
+            )
+            .filter(bot_installations::Column::TargetId.eq(SYSTEM_ORG_INSTALL_TARGET_ID))
+            .one(self.get_connection())
+            .await?;
+
+        if let Some(inst) = existing {
+            if inst.status != InstallationBotStatusEnum::Enabled {
+                let mut active: bot_installations::ActiveModel = inst.into_active_model();
+                active.status = Set(InstallationBotStatusEnum::Enabled);
+                active.update(self.get_connection()).await?;
+            }
+            return Ok(());
+        }
+
+        self.install_bot(
+            bot_id,
+            InstallationTargetTypeEnum::Organization,
+            SYSTEM_ORG_INSTALL_TARGET_ID,
+            0,
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// Whether `permission_scope` is sufficient for git receive-pack (push).
+    pub fn scope_allows_push(scope: &PermissionScopeEnum) -> bool {
+        matches!(
+            scope,
+            PermissionScopeEnum::Write | PermissionScopeEnum::Admin
+        )
+    }
+
+    /// Resolve an import `git_repo.id` for `repo_path`, if registered.
+    pub async fn find_repo_id_by_path(&self, repo_path: &str) -> Result<Option<i64>, MegaError> {
+        let path = repo_path.trim_end_matches('/');
+        let path = if path.is_empty() { "/" } else { path };
+
+        if let Some(repo) = git_repo::Entity::find()
+            .filter(git_repo::Column::RepoPath.eq(path))
+            .one(self.get_connection())
+            .await?
+        {
+            return Ok(Some(repo.id));
+        }
+
+        // Longest registered prefix (same idea as find_git_repo_like_path).
+        let like = git_repo::Entity::find()
+            .filter(Expr::cust(format!("'{path}' LIKE repo_path || '%'")))
+            .order_by_desc(Expr::cust("LENGTH(repo_path)"))
+            .one(self.get_connection())
+            .await?;
+        Ok(like.map(|r| r.id))
+    }
+
+    /// True if the bot may authenticate a receive-pack push to `repo_path`.
+    ///
+    /// Requires Write/Admin scope and an Enabled installation covering the
+    /// target: Repository install for the resolved git_repo, and/or an
+    /// Organization install for the bot's org (or system target_id 0).
+    pub async fn bot_may_push_to_path(
+        &self,
+        bot: &bots::Model,
+        repo_path: &str,
+    ) -> Result<bool, MegaError> {
+        if bot.status != BotStatusEnum::Enabled {
+            return Ok(false);
+        }
+        if !Self::scope_allows_push(&bot.permission_scope) {
+            return Ok(false);
+        }
+
+        let installations = self.get_installed_bot_by_id(bot.id).await?;
+        let enabled: Vec<_> = installations
+            .into_iter()
+            .filter(|i| i.status == InstallationBotStatusEnum::Enabled)
+            .collect();
+        if enabled.is_empty() {
+            return Ok(false);
+        }
+
+        let org_target_id = bot.organization_id.unwrap_or(SYSTEM_ORG_INSTALL_TARGET_ID);
+        let has_org_install = enabled.iter().any(|i| {
+            i.target_type == InstallationTargetTypeEnum::Organization
+                && i.target_id == org_target_id
+        });
+
+        let repo_id = self.find_repo_id_by_path(repo_path).await?;
+        if let Some(repo_id) = repo_id {
+            let has_repo_install = enabled.iter().any(|i| {
+                i.target_type == InstallationTargetTypeEnum::Repository && i.target_id == repo_id
+            });
+            return Ok(has_repo_install || has_org_install);
+        }
+
+        // Monorepo / unregistered path: Organization install only.
+        Ok(has_org_install)
+    }
+
     /// Generate a new bot token, persist its HMAC-SHA256 hash and return the model with plaintext.
     pub async fn generate_bot_token(
         &self,

jupiter/src/storage/bots_storage.rs

@@ -85,5 +85,5 @@ mimalloc = { workspace = true }
 tempfile = { workspace = true }
 jupiter-migrate = { workspace = true }
 
-# [target.'cfg(target_os = "linux")'.dev-dependencies]
-# qlean = "0.3.0"
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+qlean = { git = "https://github.com/benjamin-747/qlean.git", rev = "c3bf91e0f4020b580fd5bfe5d3d7d22bc3754651" }

mono/Cargo.toml

@@ -3,6 +3,7 @@ use api_model::common::CommonResult;
 use axum::{
     Json,
     extract::{Path, State},
+    http::{HeaderMap, StatusCode},
 };
 use ceres::model::bots::{
     BootstrapInitBotResponse, BotRes, ChangeInstallationStatus, CreateBotTokenRequest,
@@ -22,6 +23,68 @@ const MAX_EXPIRES_IN_SECS: i64 = 365 * 24 * 3600 * 10;
 /// Minimum allowed expires_in in seconds.
 const MIN_EXPIRES_IN_SECS: i64 = 1;
 
+/// Env var holding the shared secret that gates `POST /bots/bootstrap-init`.
+const INIT_BOOTSTRAP_SECRET_ENV: &str = "MEGA_INIT_BOOTSTRAP_SECRET";
+/// Header the mega-init Job / script must send.
+const INIT_BOOTSTRAP_SECRET_HEADER: &str = "x-mega-init-secret";
+const INIT_BOOTSTRAP_SECRET_MIN_LEN: usize = 32;
+
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+/// Fail closed unless `MEGA_INIT_BOOTSTRAP_SECRET` is set and matches the request header.
+fn ensure_init_bootstrap_secret(headers: &HeaderMap) -> Result<(), ApiError> {
+    let expected = match std::env::var(INIT_BOOTSTRAP_SECRET_ENV) {
+        Ok(v) => {
+            let trimmed = v.trim().to_owned();
+            if trimmed.len() < INIT_BOOTSTRAP_SECRET_MIN_LEN {
+                tracing::error!(
+                    env = INIT_BOOTSTRAP_SECRET_ENV,
+                    min_len = INIT_BOOTSTRAP_SECRET_MIN_LEN,
+                    "init bootstrap secret is too short; refusing bootstrap-init"
+                );
+                return Err(ApiError::with_status(
+                    StatusCode::UNAUTHORIZED,
+                    anyhow!("bootstrap-init is not configured"),
+                ));
+            }
+            trimmed
+        }
+        Err(_) => {
+            tracing::error!(
+                env = INIT_BOOTSTRAP_SECRET_ENV,
+                "init bootstrap secret is unset; refusing bootstrap-init"
+            );
+            return Err(ApiError::with_status(
+                StatusCode::UNAUTHORIZED,
+                anyhow!("bootstrap-init is not configured"),
+            ));
+        }
+    };
+
+    let provided = headers
+        .get(INIT_BOOTSTRAP_SECRET_HEADER)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("");
+
+    if !constant_time_eq(expected.as_bytes(), provided.as_bytes()) {
+        tracing::warn!("bootstrap-init rejected: missing or invalid X-Mega-Init-Secret");
+        return Err(ApiError::with_status(
+            StatusCode::UNAUTHORIZED,
+            anyhow!("Unauthorized"),
+        ));
+    }
+    Ok(())
+}
+
 async fn ensure_bot_exists(state: &MonoApiServiceState, bot_id: i64) -> Result<(), ApiError> {
     let bot = state.services().admin().get_bot_by_id(bot_id).await?;
     if bot.is_none() {
@@ -46,21 +109,29 @@ pub fn routers() -> OpenApiRouter<MonoApiServiceState> {
     )
 }
 
-/// Bootstrap mega-init bot + push token (no auth; same class as merge-no-auth).
+/// Bootstrap mega-init bot + push token.
 ///
+/// Gated by shared secret `MEGA_INIT_BOOTSTRAP_SECRET` via header
+/// `X-Mega-Init-Secret` (not LoginUser — for the onprem mega-init Job / CronJob).
 /// Creates the `mega-init` bot if needed and returns a fresh `bot_` token for
-/// git HTTP push. Intended for onprem mega-init Job / CronJob.
+/// git HTTP push.
 #[utoipa::path(
     post,
     path = "/bootstrap-init",
+    params(
+        ("X-Mega-Init-Secret" = String, Header, description = "Must match MEGA_INIT_BOOTSTRAP_SECRET on mono-engine")
+    ),
     responses(
-        (status = 200, body = CommonResult<BootstrapInitBotResponse>, content_type = "application/json")
+        (status = 200, body = CommonResult<BootstrapInitBotResponse>, content_type = "application/json"),
+        (status = 401, description = "Missing/invalid X-Mega-Init-Secret or secret not configured"),
     ),
     tag = BOT_TAG
 )]
 async fn bootstrap_init_bot(
     State(state): State<MonoApiServiceState>,
+    headers: HeaderMap,
 ) -> Result<Json<CommonResult<BootstrapInitBotResponse>>, ApiError> {
+    ensure_init_bootstrap_secret(&headers)?;
     let resp = state.services().admin().ensure_init_bot_token().await?;
     Ok(Json(CommonResult::success(Some(resp))))
 }

mono/src/api/router/bot_router.rs

@@ -77,6 +77,8 @@ fn basic_auth_password_from_authorization_value(value: &str) -> Option<String> {
 
 /// Uses [`crate::api::oauth::login_user_from_mono_access_token`] for user access tokens,
 /// or bot tokens (`bot_` prefix) via [`jupiter::storage::bots_storage::BotsStorage::find_bot_by_token`].
+/// Bot tokens additionally require Write/Admin scope and an Enabled installation
+/// covering the receive-pack target path.
 /// Supports both Bearer tokens and Basic Auth (with token as password).
 async fn git_receive_pack_auth(
     state: &TransportRuntime,
@@ -99,15 +101,31 @@ async fn git_receive_pack_auth(
 
     // Bot tokens are prefixed with `bot_`.
     if token.starts_with("bot_") {
-        let found = state
-            .storage
-            .bots_storage()
+        let bots = state.storage.bots_storage();
+        let found = bots
             .find_bot_by_token(&token)
             .await
             .map_err(mega_to_protocol_error)?;
         let Some((bot, _)) = found else {
             return Ok(false);
         };
+
+        let repo_path = pack_protocol.repo_path.to_string_lossy();
+        let may_push = bots
+            .bot_may_push_to_path(&bot, repo_path.as_ref())
+            .await
+            .map_err(mega_to_protocol_error)?;
+        if !may_push {
+            tracing::warn!(
+                bot_id = bot.id,
+                bot_name = %bot.name,
+                repo_path = %repo_path,
+                permission_scope = ?bot.permission_scope,
+                "bot token rejected for receive-pack: insufficient scope or no enabled installation"
+            );
+            return Ok(false);
+        }
+
         let username = bot.name;
         pack_protocol.auth.username = Some(username.clone());
         pack_protocol.auth.authenticated_user = Some(PushUserInfo { username });