Implement PUT /api/v1/trusted_publishing/tokens API endpoint

Cargo.toml

@@ -143,10 +143,12 @@ crates_io_index = { path = "crates/crates_io_index", features = ["testing"] }
 crates_io_tarball = { path = "crates/crates_io_tarball", features = ["builder"] }
 crates_io_team_repo = { path = "crates/crates_io_team_repo", features = ["mock"] }
 crates_io_test_db = { path = "crates/crates_io_test_db" }
+crates_io_trustpub = { path = "crates/crates_io_trustpub", features = ["test-helpers"] }
 claims = "=0.8.0"
 diesel = { version = "=2.2.10", features = ["r2d2"] }
 googletest = "=0.14.0"
 insta = { version = "=1.43.1", features = ["glob", "json", "redactions"] }
+jsonwebtoken = "=9.3.1"
 regex = "=1.11.1"
 sentry = { version = "=0.37.0", features = ["test"] }
 tokio = "=1.45.0"

crates/crates_io_database/src/models/category.rs

@@ -3,6 +3,7 @@ use crate::schema::*;
 use chrono::{DateTime, Utc};
 use diesel::dsl;
 use diesel::prelude::*;
+use diesel::sql_types::Text;
 use diesel_async::scoped_futures::ScopedFutureExt;
 use diesel_async::{AsyncConnection, AsyncPgConnection, RunQueryDsl};
 use futures_util::future::BoxFuture;
@@ -20,7 +21,7 @@ pub struct Category {
     pub created_at: DateTime<Utc>,
 }
 
-type WithSlug<'a> = dsl::Eq<categories::slug, crates_io_diesel_helpers::lower<&'a str>>;
+type WithSlug<'a> = dsl::Eq<categories::slug, crates_io_diesel_helpers::lower<Text, &'a str>>;
 
 #[derive(Associations, Insertable, Identifiable, Debug, Clone, Copy)]
 #[diesel(

crates/crates_io_database/src/models/trustpub/mod.rs

@@ -1,3 +1,7 @@
 mod github_config;
+mod token;
+mod used_jti;
 
 pub use self::github_config::{GitHubConfig, NewGitHubConfig};
+pub use self::token::NewToken;
+pub use self::used_jti::NewUsedJti;

crates/crates_io_database/src/models/trustpub/token.rs

@@ -0,0 +1,22 @@
+use crate::schema::trustpub_tokens;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = trustpub_tokens, check_for_backend(diesel::pg::Pg))]
+pub struct NewToken<'a> {
+    pub expires_at: DateTime<Utc>,
+    pub hashed_token: &'a [u8],
+    pub crate_ids: &'a [i32],
+}
+
+impl NewToken<'_> {
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<()> {
+        self.insert_into(trustpub_tokens::table)
+            .execute(conn)
+            .await?;
+
+        Ok(())
+    }
+}

crates/crates_io_database/src/models/trustpub/used_jti.rs

@@ -0,0 +1,24 @@
+use crate::schema::trustpub_used_jtis;
+use chrono::{DateTime, Utc};
+use diesel::prelude::*;
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(Debug, Insertable)]
+#[diesel(table_name = trustpub_used_jtis, check_for_backend(diesel::pg::Pg))]
+pub struct NewUsedJti<'a> {
+    pub jti: &'a str,
+    pub expires_at: DateTime<Utc>,
+}
+
+impl<'a> NewUsedJti<'a> {
+    pub fn new(jti: &'a str, expires_at: DateTime<Utc>) -> Self {
+        Self { jti, expires_at }
+    }
+
+    pub async fn insert(&self, conn: &mut AsyncPgConnection) -> QueryResult<usize> {
+        diesel::insert_into(trustpub_used_jtis::table)
+            .values(self)
+            .execute(conn)
+            .await
+    }
+}

crates/crates_io_diesel_helpers/src/fns.rs

@@ -4,7 +4,7 @@ use diesel::sql_types::{Date, Double, Integer, Interval, SingleValue, Text, Time
 define_sql_function!(#[aggregate] fn array_agg<T: SingleValue>(x: T) -> Array<T>);
 define_sql_function!(fn canon_crate_name(x: Text) -> Text);
 define_sql_function!(fn to_char(a: Date, b: Text) -> Text);
-define_sql_function!(fn lower(x: Text) -> Text);
+define_sql_function!(fn lower<T: SingleValue>(x: T) -> T);
 define_sql_function!(fn date_part(x: Text, y: Timestamptz) -> Double);
 define_sql_function! {
     #[sql_name = "date_part"]

crates/crates_io_trustpub/Cargo.toml

@@ -7,10 +7,30 @@ edition = "2024"
 [lints]
 workspace = true
 
+[features]
+test-helpers = ["dep:bon", "dep:mockall", "dep:serde_json"]
+
 [dependencies]
+anyhow = "=1.0.98"
+async-trait = "=0.1.88"
+bon = { version = "=3.6.3", optional = true }
+chrono = { version = "=0.4.41", features = ["serde"] }
+jsonwebtoken = "=9.3.1"
+mockall = { version = "=0.13.1", optional = true }
+rand = "=0.9.1"
+reqwest = { version = "=0.12.15", features = ["gzip", "json"] }
 regex = "=1.11.1"
+secrecy = "=0.10.3"
+serde = { version = "=1.0.219", features = ["derive"] }
+serde_json = { version = "=1.0.140", optional = true }
+sha2 = "=0.10.9"
 thiserror = "=2.0.12"
+tokio = { version = "=1.45.0", features = ["sync"] }
 
 [dev-dependencies]
+bon = "=3.6.3"
 claims = "=0.8.0"
-insta = "=1.43.1"
+insta = { version = "=1.43.1", features = ["json", "redactions"] }
+mockito = "=1.7.0"
+serde_json = "=1.0.140"
+tokio = { version = "=1.45.0", features = ["macros", "rt-multi-thread"] }

crates/crates_io_trustpub/src/access_token.rs

@@ -0,0 +1,110 @@
+use secrecy::{ExposeSecret, SecretString};
+use sha2::digest::Output;
+use sha2::{Digest, Sha256};
+
+/// A temporary access token used to publish crates to crates.io using
+/// the "Trusted Publishing" feature.
+#[derive(Debug)]
+pub struct AccessToken(SecretString);
+
+impl AccessToken {
+    const PREFIX: &str = "cio_tp_";
+
+    /// Generate a new access token.
+    pub fn generate() -> Self {
+        Self::from_u64s(rand::random(), rand::random())
+    }
+
+    /// Create an access token from two u64 values.
+    ///
+    /// This is used internally by the `generate()` fn and is extracted
+    /// to a separate function for testing purposes.
+    fn from_u64s(r1: u64, r2: u64) -> Self {
+        let plaintext = format!("{}{r1:016x}{r2:016x}", Self::PREFIX);
+        Self(SecretString::from(plaintext))
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Option<Self> {
+        let str = String::from_utf8(bytes.into()).ok()?;
+
+        let suffix = str.strip_prefix(Self::PREFIX)?;
+        if suffix.len() != 32 {
+            return None;
+        }
+
+        let is_hexdigit = |c| matches!(c, 'a'..='f') || c.is_ascii_digit();
+        if !suffix.chars().all(is_hexdigit) {
+            return None;
+        }
+
+        Some(Self(SecretString::from(str)))
+    }
+
+    /// Generate a SHA256 hash of the access token.
+    pub fn sha256(&self) -> Output<Sha256> {
+        Sha256::digest(self.0.expose_secret())
+    }
+}
+
+impl ExposeSecret<str> for AccessToken {
+    fn expose_secret(&self) -> &str {
+        self.0.expose_secret()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use claims::{assert_none, assert_some};
+    use insta::assert_snapshot;
+
+    #[test]
+    fn test_generate() {
+        let token = AccessToken::generate();
+        let token_str = token.expose_secret();
+        assert!(token_str.starts_with(AccessToken::PREFIX));
+        assert_eq!(token_str.len(), AccessToken::PREFIX.len() + 32);
+    }
+
+    #[test]
+    fn test_serialization() {
+        let token = AccessToken::from_u64s(0, 0);
+        assert_snapshot!(token.expose_secret(), @"cio_tp_00000000000000000000000000000000");
+
+        let token = AccessToken::from_u64s(u64::MAX, u64::MAX);
+        assert_snapshot!(token.expose_secret(), @"cio_tp_ffffffffffffffffffffffffffffffff");
+
+        let token = AccessToken::from_u64s(0xc0ffee, 0xfa8072);
+        assert_snapshot!(token.expose_secret(), @"cio_tp_0000000000c0ffee0000000000fa8072");
+    }
+
+    #[test]
+    fn test_sha256() {
+        let token = AccessToken::generate();
+        let hash = token.sha256();
+        assert_eq!(hash.len(), 32);
+    }
+
+    #[test]
+    fn test_from_bytes() {
+        let token = AccessToken::generate();
+        let bytes = token.expose_secret().as_bytes();
+        let token2 = assert_some!(AccessToken::from_bytes(bytes));
+        assert_eq!(token.expose_secret(), token2.expose_secret());
+
+        let bytes = b"cio_tp_00000000000000000000000000000000";
+        assert_some!(AccessToken::from_bytes(bytes));
+
+        let invalid_bytes = b"invalid_token";
+        assert_none!(AccessToken::from_bytes(invalid_bytes));
+
+        let invalid_bytes = b"cio_tp_invalid_token";
+        assert_none!(AccessToken::from_bytes(invalid_bytes));
+
+        let invalid_bytes = b"cio_tp_00000000000000000000000000";
+        assert_none!(AccessToken::from_bytes(invalid_bytes));
+
+        let invalid_bytes = b"cio_tp_000000x0000000000000000000000000";
+        assert_none!(AccessToken::from_bytes(invalid_bytes));
+    }
+}