Something went wrong. Try again.
atproto Thingiverse but good
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360use super::paths::{CanonicalPath, LookupEntry, PathDiagnostic, RootId, resolve_precedence};use super::verification::{VerificationRecord, VerificationState};use async_trait::async_trait;use jacquard_common::types::string::AtUri;use sqlx::SqlitePool;
#[derive(Clone, Debug, Eq, Hash, PartialEq)]pub struct SourceIdentity { pub resource: AtUri, pub content_hash: Vec<u8>,}
#[derive(Clone, Debug, Eq, Hash, PartialEq)]pub struct TargetIdentity { pub blob_cids: Vec<String>,}
/// The sole cache and route binding key shared across PM-76 and PM-80.////// Public LDraw resources are anonymous. Identity is content-bound to the/// project, selected source, canonical path/root, and ordered target CIDs; it/// never varies by browser principal.#[derive(Clone, Debug, Eq, Hash, PartialEq)]pub struct CacheKey { pub project: AtUri, pub source: SourceIdentity, pub root: RootId, pub path: CanonicalPath, pub target: TargetIdentity,}
#[derive(Clone, Debug, Eq, PartialEq)]pub struct ResourceIdentity { pub uri: AtUri, pub content_hash: Vec<u8>,}
#[derive(Clone, Debug, Eq, PartialEq)]pub struct ByteSource { pub resource_uri: AtUri, pub blob_cids: Vec<String>,}
#[derive(Clone, Debug, Eq, PartialEq)]pub struct ResolvedResource { pub cache_key: CacheKey, pub resource: ResourceIdentity, pub root: RootId, pub path: CanonicalPath, pub target: TargetIdentity, pub mime_type: String, pub byte_length: i64, pub sha256: Vec<u8>, pub source: ByteSource,}
#[derive(Clone, Debug, Eq, PartialEq)]pub enum DiagnosticCode { InvalidManifest,}
#[derive(Clone, Debug, Eq, PartialEq)]pub enum CollisionDiagnostic { FoldedPath,}
#[derive(Clone, Debug, Eq, PartialEq)]pub enum IntegrityDiagnostic { Length, Digest, BlobCid, MissingResourceUri,}
#[derive(Clone, Debug, Eq, PartialEq)]pub enum AvailabilityDiagnostic { SourceUnavailable,}
#[derive(Clone, Debug, Eq, PartialEq)]pub enum ResolveError { NotFound, Unverified, Rejected { diagnostic: DiagnosticCode }, SourceChanged, InvalidPath { diagnostic: PathDiagnostic }, Collision { diagnostic: CollisionDiagnostic }, Integrity { diagnostic: IntegrityDiagnostic }, Unavailable { diagnostic: AvailabilityDiagnostic },}
#[async_trait]pub trait LdrawResourceResolver: Send + Sync { async fn resolve( &self, project: &AtUri, path: &CanonicalPath, ) -> Result<ResolvedResource, ResolveError>;}
#[derive(Clone)]pub struct SqliteResolver { pool: SqlitePool,}
impl SqliteResolver { pub fn new(pool: SqlitePool) -> Self { Self { pool } }
/// Resolve the canonical candidate without requiring verification. This is /// the only lookup path used by the lazy verifier and the verified resolver. pub async fn candidate( &self, project: &AtUri, path: &CanonicalPath, ) -> Result<ResolvedResource, ResolveError> { let rows = sqlx::query!( r#"SELECT r.resource_uri, r.owner_did, r.sha256, r.ordered_blob_cids, m.root, m.canonical_path, r.mime_type, r.byte_length FROM ldraw_resource_memberships m JOIN ldraw_resources r ON r.resource_uri = m.resource_uri WHERE m.project_uri = ?"#, project.as_ref(), ).fetch_all(&self.pool).await.map_err(|_| ResolveError::Unavailable { diagnostic: AvailabilityDiagnostic::SourceUnavailable })?; let mut entries = Vec::with_capacity(rows.len()); let mut by_uri = std::collections::HashMap::new(); for row in rows { let Some(root) = root_id(&row.root) else { continue; }; let candidate_path = CanonicalPath::parse(&row.canonical_path) .map_err(|diagnostic| ResolveError::InvalidPath { diagnostic })?; let Some(uri) = row.resource_uri.clone() else { return Err(ResolveError::Integrity { diagnostic: IntegrityDiagnostic::MissingResourceUri, }); }; entries.push(LookupEntry { root, path: candidate_path, target: uri.clone(), }); by_uri.insert(uri, row); } let mut mpd = Vec::new(); let mut manifest = Vec::new(); let mut uploaded = Vec::new(); let mut official = Vec::new(); for entry in entries { match entry.root { RootId::Mpd => mpd.push(entry), RootId::Manifest => manifest.push(entry), RootId::Models | RootId::Parts | RootId::P | RootId::External => { uploaded.push(entry) } RootId::OfficialParts | RootId::OfficialP => official.push(entry), } } let chosen = resolve_precedence(path, &mpd, &manifest, &uploaded, &official) .ok_or(ResolveError::NotFound)?; let matching = match chosen.root { RootId::Mpd => &mpd, RootId::Manifest => &manifest, RootId::Models | RootId::Parts | RootId::P | RootId::External => &uploaded, RootId::OfficialParts | RootId::OfficialP => &official, }; let matching_count = matching .iter() .filter(|entry| { entry.root == chosen.root && (entry.path == *path || (entry.root.case_insensitive() && entry.path.as_str().eq_ignore_ascii_case(path.as_str()))) }) .count(); if matching_count > 1 { return Err(ResolveError::Collision { diagnostic: CollisionDiagnostic::FoldedPath, }); } let row = by_uri .get(&chosen.target) .ok_or(ResolveError::SourceChanged)?; let resource = AtUri::new_owned(&chosen.target).map_err(|_| ResolveError::SourceChanged)?; let blobs = parse_blob_cids(&row.ordered_blob_cids); if blobs.is_empty() { return Err(ResolveError::Integrity { diagnostic: IntegrityDiagnostic::BlobCid, }); } if row.sha256.len() != 32 || row.byte_length < 0 { return Err(ResolveError::Integrity { diagnostic: if row.byte_length < 0 { IntegrityDiagnostic::Length } else { IntegrityDiagnostic::Digest }, }); } let target = TargetIdentity { blob_cids: blobs.clone(), }; let content_hash = source_hash(&blobs, &row.sha256, row.byte_length); let cache_key = CacheKey { project: project.clone(), source: SourceIdentity { resource: resource.clone(), content_hash: content_hash.clone(), }, root: chosen.root, path: chosen.path.clone(), target: target.clone(), }; Ok(ResolvedResource { cache_key, resource: ResourceIdentity { uri: resource.clone(), content_hash, }, root: chosen.root, path: chosen.path, target, mime_type: row.mime_type.clone(), byte_length: row.byte_length, sha256: row.sha256.clone(), source: ByteSource { resource_uri: resource, blob_cids: blobs, }, }) }}
#[async_trait]impl LdrawResourceResolver for SqliteResolver { async fn resolve( &self, project: &AtUri, path: &CanonicalPath, ) -> Result<ResolvedResource, ResolveError> { let resource = self.candidate(project, path).await?; let verification = sqlx::query!( "SELECT source_identity, state, diagnostic FROM ldraw_verification WHERE resource_uri = ?", resource.resource.uri.as_ref() ) .fetch_optional(&self.pool) .await .map_err(|_| ResolveError::Unavailable { diagnostic: AvailabilityDiagnostic::SourceUnavailable, })? .ok_or(ResolveError::Unverified)?; let state = VerificationState::parse(&verification.state).ok_or(ResolveError::Rejected { diagnostic: DiagnosticCode::InvalidManifest, })?; let expected_source = serialize_source_identity(&resource.cache_key.source); let record = VerificationRecord { state, source_identity: verification.source_identity, diagnostic: verification.diagnostic, }; if record.source_identity != expected_source { let reset = super::verification::source_changed(&record, expected_source); return Err(match reset.state { VerificationState::Unverified => ResolveError::SourceChanged, _ => ResolveError::Rejected { diagnostic: DiagnosticCode::InvalidManifest, }, }); } match record.state { VerificationState::Verified => Ok(resource), VerificationState::Rejected => Err(ResolveError::Rejected { diagnostic: DiagnosticCode::InvalidManifest, }), VerificationState::Unverified => Err(ResolveError::Unverified), } }}
/// Canonical serialization shared by projection, route bindings, and resolver.pub fn serialize_source_identity(source: &SourceIdentity) -> String { format!( "{}|{}", source.resource.as_ref(), hex_bytes(&source.content_hash) )}
/// Build the persisted identity for a resource row from its complete content metadata.pub fn source_identity_for( resource: &AtUri, blob_cids: &[String], sha256: &[u8], byte_length: i64,) -> String { serialize_source_identity(&SourceIdentity { resource: resource.clone(), content_hash: source_hash(blob_cids, sha256, byte_length), })}
fn hex_bytes(bytes: &[u8]) -> String { bytes.iter().map(|byte| format!("{byte:02x}")).collect()}
fn parse_blob_cids(value: &str) -> Vec<String> { serde_json::from_str(value).unwrap_or_default()}
fn source_hash(cids: &[String], sha256: &[u8], size: i64) -> Vec<u8> { let mut value = serde_json::to_vec(cids).unwrap_or_default(); value.extend_from_slice(sha256); value.extend_from_slice(&size.to_be_bytes()); value}
fn root_id(value: &str) -> Option<RootId> { Some(match value { "mpd" => RootId::Mpd, "manifest" => RootId::Manifest, "models" => RootId::Models, "parts" => RootId::Parts, "p" => RootId::P, "external" => RootId::External, "official-parts" => RootId::OfficialParts, "official-p" => RootId::OfficialP, _ => return None, })}
#[cfg(test)]mod tests { use super::*;
#[test] fn cache_identity_changes_for_content_dimensions_not_principal() { let project = AtUri::new_owned("at://did:plc:a/space.polymodel.library.thing/p").unwrap(); let path = CanonicalPath::parse("parts/3001.dat").unwrap(); let base = CacheKey { project: project.clone(), source: SourceIdentity { resource: project.clone(), content_hash: vec![1], }, root: RootId::Parts, path: path.clone(), target: TargetIdentity { blob_cids: vec!["bafk".into()], }, }; let mut changed = base.clone(); changed.path = CanonicalPath::parse("parts/3002.dat").unwrap(); assert_ne!(base, changed); changed = base.clone(); changed.target.blob_cids.push("bafk2".into()); assert_ne!(base, changed); }}