Implement "insecure" mode.

The HOOKSHOT_INSECURE environment flag makes it so hookshot skips the
signature verification phase.

Also this includes a bunch of refactoring because I'm a bad programmer.

Author: brianloveswords

src/cli.rs

@@ -10,6 +10,7 @@ use router::Router;
 use server_config::{ServerConfig, Error, Environment};
 use signature::Signature;
 use std::env;
+use std::fmt::Display;
 use std::fs::File;
 use std::io::{Read, Write};
 use std::path::Path;
@@ -18,10 +19,27 @@ use task_manager::TaskManager;
 use uuid::Uuid;
 
 const ENV_CONFIG_KEY: &'static str = "HOOKSHOT_CONFIG";
+const ENV_INSECURE_KEY: &'static str = "HOOKSHOT_INSECURE";
 
 header! { (XHubSignature, "X-Hub-Signature") => [String] }
 header! { (XSignature, "X-Signature") => [String] }
 
+struct TaskStatusPrinter {
+    task_id: Uuid
+}
+impl TaskStatusPrinter {
+    fn print<T: AsRef<str> + Display>(&self, msg: T) {
+        println!("[{}]: {}", self.task_id, msg);
+    }
+}
+
+fn skip_signature_check() -> bool{
+    match ENV_INSECURE_KEY {
+        "true" | "t" | "1" => true,
+        _ => false,
+    }
+}
+
 fn print_usage(program: &str, opts: Options) {
     let brief = format!("Usage: {} [options]", program);
     print!("{}", opts.usage(&brief));
@@ -38,15 +56,12 @@ pub fn main() {
     let matches = match opts.parse(&args[1..]) {
         Ok(m) => m,
         Err(f) => {
-            println!("[error]: {}", f.to_string());
-            print_usage(&program, opts);
-            return;
+            println!("[error]: {}", f);
+            return print_usage(&program, opts);
         }
     };
     if matches.opt_present("h") {
-        println!("printing out usage");
-        print_usage(&program, opts);
-        return;
+        return print_usage(&program, opts);
     }
     let config_file = match matches.opt_str("c") {
         Some(file) => file,
@@ -55,10 +70,9 @@ pub fn main() {
             match env::var(ENV_CONFIG_KEY) {
                 Ok(file) => file,
                 Err(_) => {
-                    println!("[error]: Could not load config from environment or command \
-                              line.\n\nPass --config <FILE> option or set the HOOKSHOT_CONFIG \
-                              environment variable");
-                    return;
+                    return println!("[error]: Could not load config from environment or command \
+                                     line.\n\nPass --config <FILE> option or set the HOOKSHOT_CONFIG \
+                                     environment variable");
                 }
             }
         }
@@ -68,18 +82,15 @@ pub fn main() {
         Ok(config) => start_server(config),
         Err(e) => match e {
             Error::FileOpenError | Error::FileReadError => {
-                println!("[error]: Error opening or reading config file {}",
-                         config_file);
-                return;
+                return println!("[error]: Error opening or reading config file {}",
+                                config_file);
             }
             Error::ParseError => {
-                println!("[error]: Could not parse {}, make sure it is valid TOML",
-                         config_file);
-                return;
+                return println!("[error]: Could not parse {}, make sure it is valid TOML",
+                                config_file);
             }
             _ => {
-                println!("[error]: Could not validate file: {}", e);
-                return;
+                return println!("[error]: Could not validate file: {}", e);
             }
         },
     }
@@ -102,6 +113,8 @@ fn start_server(config: ServerConfig) {
         Ok(Response::with((Header(Connection::close()), status::Ok, "okay")))
     });
 
+    // Show the status of a specific task by UUID. If there is no log file by
+    // that name or if the log file can't be read for any reason return a 404.
     let config_clone = config.clone();
     router.get("/tasks/:uuid", move |req: &mut Request| {
         let file_not_found = Ok(Response::with((Header(Connection::close()),
@@ -116,19 +129,14 @@ fn start_server(config: ServerConfig) {
         let logfile_path = Path::new(&config_clone.log_root.to_string())
             .join(format!("{}.log", uuid.to_string()));
 
-        let mut file = {
-            match File::open(&logfile_path) {
-                Ok(file) => file,
-                Err(_) => return file_not_found,
-            }
+        let mut file = match File::open(&logfile_path) {
+            Ok(file) => file,
+            Err(_) => return file_not_found,
         };
 
-        let content = {
-            let mut content = String::new();
-            match file.read_to_string(&mut content) {
-                Ok(_) => content,
-                Err(_) => return file_not_found,
-            }
+        let mut content = String::new();
+        if let Err(_) = file.read_to_string(&mut content) {
+            return file_not_found;
         };
 
         Ok(Response::with((Header(Connection::close()), status::Ok, content)))
@@ -139,75 +147,83 @@ fn start_server(config: ServerConfig) {
     let checkout_root = config.checkout_root.to_string();
     let config_clone = config.clone();
 
-    router.post("/hookshot", move |req: &mut Request| {
+    router.post("/tasks", move |req: &mut Request| {
         let task_id = Uuid::new_v4();
+        let task_status = TaskStatusPrinter { task_id: task_id };
         let log_root = &config_clone.log_root.to_string();
-        println!("[{}]: request received, processing", task_id);
-
-        // Get the signature from the header. We support both `X-Hub-Signature` and
-        // `X-Signature` but they both represent the same type underneath, a
-        // string. It might eventually be better to put this functionality on the
-        // Signature type itself.
-        println!("[{}]: looking up signature", task_id);
-        let signature = {
-            let possible_headers = (req.headers.get::<XSignature>(),
-                                    req.headers.get::<XHubSignature>());
-
-            let signature_string = match possible_headers {
-                (Some(h), None) => h.to_string(),
-                (None, Some(h)) => h.to_string(),
-                (None, None) => {
-                    println!("[{}]: missing signature", task_id);
-                    return Ok(Response::with((Header(Connection::close()),
-                                              status::Unauthorized,
-                                              "missing signature")));
-                }
-                (Some(_), Some(_)) => {
-                    println!("[{}]: too many signatures", task_id);
-                    return Ok(Response::with((Header(Connection::close()),
-                                              status::Unauthorized,
-                                              "too many signatures")));
-                }
-            };
 
-            match Signature::from_str(&signature_string) {
-                Some(signature) => signature,
-                None => {
-                    println!("[{}]: could not parse signature", task_id);
-                    return Ok(Response::with((Header(Connection::close()),
-                                              status::Unauthorized,
-                                              "could not parse signature")));
+        task_status.print("request received, processing");
+
+        let mut signature = None;
+        if !skip_signature_check() {
+            task_status.print("looking up signature");
+
+            // Get the signature from the header. We support both `X-Hub-Signature` and
+            // `X-Signature` but they both represent the same type underneath, a
+            // string. It might eventually be better to put this functionality on the
+            // Signature type itself.
+            signature = {
+                let possible_headers = (req.headers.get::<XSignature>(),
+                                        req.headers.get::<XHubSignature>());
+
+                let signature_string = match possible_headers {
+                    (Some(h), None) => h.to_string(),
+                    (None, Some(h)) => h.to_string(),
+                    (None, None) => {
+                        task_status.print("missing signature");
+                        return Ok(Response::with((Header(Connection::close()),
+                                                  status::Unauthorized,
+                                                  "missing signature")));
+                    }
+                    (Some(_), Some(_)) => {
+                        task_status.print("too many signatures");
+                        return Ok(Response::with((Header(Connection::close()),
+                                                  status::Unauthorized,
+                                                  "too many signatures")));
+                    }
+                };
+
+                match Signature::from_str(&signature_string) {
+                    Some(signature) => Some(signature),
+                    None => {
+                        task_status.print("could not parse signature");
+                        return Ok(Response::with((Header(Connection::close()),
+                                                  status::Unauthorized,
+                                                  "could not parse signature")));
+                    }
                 }
-            }
-        };
+            };
+        }
 
-        println!("[{}]: loading body into string", task_id);
+        task_status.print("loading body into string");
         let mut payload = String::new();
         if req.body.read_to_string(&mut payload).is_err() {
-            println!("[{}]: could not read body into string", task_id);
+            task_status.print("could not read body into string");
             return Ok(Response::with((Header(Connection::close()), status::InternalServerError)));
         }
 
-        // Bail out if the signature doesn't match what we're expecting.
-        println!("[{}]: signature found, verifying", task_id);
-        if signature.verify(&payload, &config_clone.secret) == false {
-            println!("[{}]: signature mismatch", task_id);
-            return Ok(Response::with((Header(Connection::close()),
-                                      status::Unauthorized,
-                                      "signature doesn't match")));
+        if !skip_signature_check() {
+            // Bail out if the signature doesn't match what we're expecting.
+            task_status.print("signature found, verifying");
+            if signature.unwrap().verify(&payload, &config_clone.secret) == false {
+                task_status.print("signature mismatch");
+                return Ok(Response::with((Header(Connection::close()),
+                                          status::Unauthorized,
+                                          "signature doesn't match")));
+            }
         }
 
         // Try to parse the message.
         // TODO: we can be smarter about this. If we see the XHubSignature
         // above, we should try to parse as a github message, otherwise go
         // simple message.
-        println!("[{}]: attempting to parse message from payload", task_id);
+        task_status.print("attempting to parse message from payload");
         let repo = match SimpleMessage::from_str(&payload) {
             Ok(message) => GitRepo::from(message, &checkout_root),
             Err(_) => match GitHubMessage::from_str(&payload) {
                 Ok(message) => GitRepo::from(message, &checkout_root),
                 Err(_) => {
-                    println!("[{}]: could not parse message", task_id);
+                    task_status.print("could not parse message");
                     return Ok(Response::with((Header(Connection::close()),
                                               status::BadRequest,
                                               "could not parse message")));
@@ -220,9 +236,8 @@ fn start_server(config: ServerConfig) {
                                                              &repo.refstring) {
             Ok(environment) => environment,
             Err(_) => {
-                println!("[{}]: warning: error loading environment for {}, definition flawed",
-                         task_id,
-                         repo.fully_qualified_branch());
+                task_status.print(format!("warning: error loading environment for {}, definition flawed",
+                                          repo.fully_qualified_branch()));
                 Environment::new()
             }
         };
@@ -234,7 +249,7 @@ fn start_server(config: ServerConfig) {
         let mut logfile = match File::create(&logfile_path) {
             Ok(file) => file,
             Err(e) => {
-                println!("[{}]: could not open logfile for writing: {}", task_id, e);
+                task_status.print(format!("could not open logfile for writing: {}", e));
                 return Ok(Response::with((Header(Connection::close()),
                                           status::InternalServerError)));
             }
@@ -249,26 +264,28 @@ fn start_server(config: ServerConfig) {
             secret: config_clone.secret.clone(),
         };
 
-        println!("[{}]: acquiring task manager lock", task_id);
+        task_status.print("acquiring task manager lock");
         {
             let mut task_manager = shared_manager.lock().unwrap();
             let key = task_manager.ensure_queue(task.repo.fully_qualified_branch());
 
-            println!("[{}]: attempting to schedule", task_id);
+            task_status.print("attempting to schedule");
             match task_manager.add_task(&key, task) {
-                Ok(_) => println!("[{}]: scheduled", task_id),
+                Ok(_) => task_status.print("scheduled"),
                 Err(_) => {
-                    println!("[{}]: could not add task to queue", task_id);
+                    task_status.print("could not add task to queue");
                     return Ok(Response::with((Header(Connection::close()),
                                               status::ServiceUnavailable)));
                 }
             }
         }
-        println!("[{}]: releasing task manager lock", task_id);
-        println!("[{}]: request complete", task_id);
+        task_status.print("releasing task manager lock");
+        task_status.print("request complete");
 
         logfile.write_all(b"task pending");
 
+        // TODO: probably shouldn't hardcode http://, someone might want to run
+        // this behind HTTPS someday.
         let location = format!("http://{}:{}/tasks/{}",
                                config_clone.hostname,
                                config_clone.port,