```

$ rad seed

```

    "alias": "alice",

    "listen": [],

    "peers": {

    },

    "connect": [],

    "externalAddresses": [],

    "network": "main",

    "log": "INFO",

    "relay": "auto",

      }

    },

    "workers": 8,

  }

}

```

        term::success!("Authenticated as {}", term::format::tertiary(profile.id()));

        return Ok(());

    }

    // If our key is encrypted, we try to authenticate with SSH Agent and

    // register it; only if it is running.

use radicle::identity::RepoId;

use radicle::identity::{DocAt, Identity};

use radicle::node::AliasStore as _;

use radicle::storage::git::{Repository, Storage};

use radicle::storage::refs::RefsAt;

            let policies = profile.policies()?;

            let seed = policies.seed_policy(&rid)?;

            match seed.policy {

                    println!(

                        "Repository {} is {} with scope {}",

                        term::format::tertiary(&rid),

                        term::format::positive("being seeded"),

                    );

                }

                    println!(

                        "Repository {} is {}",

                        term::format::tertiary(&rid),

use anyhow::anyhow;

use radicle::node::policy;

use radicle::node::Handle;

use radicle::{prelude::*, storage, Node};

use radicle_term::Element as _;

    ]);

    t.divider();

        let id = rid.to_string();

        let name = storage

            .repository(rid)

            .map_err(storage::RepositoryError::from)

            .and_then(|repo| repo.project().map(|proj| proj.name().to_string()))

            .unwrap_or_default();

        t.push([

            term::format::tertiary(id),

use radicle::test::fixtures;

use radicle_cli_test::TestFormula;

use radicle_node::service::Event;

use radicle_node::test::environment::{Config, Environment, Node};

#[allow(unused_imports)]

fn rad_block() {

    let mut environment = Environment::new();

    let alice = environment.node(Config {

        ..Config::test(Alias::new("alice"))

    });

    let working = tempfile::tempdir().unwrap();

    let mut environment = Environment::new();

    let mut alice = environment

        .node(Config {

            ..Config::test(Alias::new("alice"))

        })

        .spawn();

    let mut environment = Environment::new();

    let mut alice = environment

        .node(Config {

            ..Config::test(Alias::new("alice"))

        })

        .spawn();

    let alice = environment.node(config::relay("alice"));

    let bob = environment.node(config::relay("bob"));

    let seed = environment.node(Config {

        ..config::relay("seed")

    });

    let working = environment.tmp().join("working");

    let mut environment = Environment::new();

    let seed = environment

        .node(Config {

            ..config::seed("seed")

        })

        .spawn();

use radicle::node::policy::store::Read;

use radicle::prelude::RepoId;

#[derive(Clone, Debug)]

pub enum Allowed {

            .seed_policy(&rid)

            .map_err(|err| error::Policy::FailedPolicy { rid, err })?;

        match entry.policy {

                log::error!(target: "fetch", "Attempted to fetch non-seeded repo {rid}");

                Err(error::Policy::BlockedPolicy { rid })

            }

        }

    }

}

use radicle::identity::RepoId;

use radicle::node::routing::Store;

use radicle::Node;

use crate::api::error::Error;

    let policies = ctx.profile.policies()?;

    let mut repos = Vec::new();

        repos.push(json!({

            "id": id,

        }));

    }

                "node": {

                  "alias": "seed",

                  "listen": [],

                  "connect": [],

                  "externalAddresses": [],

                  "network": "main",

                  "log": "INFO",

                  "relay": "auto",

                    }

                  },

                  "workers": 8,

                }

              },

              "home": seed.profile.path()

        let clock = LocalTime::now();

        let timestamp = clock.into();

        let storage = Storage::open(home.storage(), git::UserInfo { alias, key: id })?;

        log::info!(target: "node", "Opening node database..");

        let mut stores: service::Stores<_> = db.clone().into();

        log::info!(target: "node", "Opening policy database..");

        let policies = home.policies_mut()?;

        let notifications = home.notifications_mut()?;

        let cobs_cache = cob::cache::Store::open(home.cobs().join(cob::cache::COBS_DB_FILE))?;

                storage: storage.clone(),

                fetch,

                policy,

                policies_db: home.node().join(node::POLICIES_DB_FILE),

            },

        )?;

use radicle::node::{ConnectOptions, Penalty, Severity};

use radicle::storage::refs::SIGREFS_BRANCH;

use radicle::storage::RepositoryError;

use crate::crypto;

use crate::crypto::{Signer, Verified};

use crate::service::message::{

    Announcement, AnnouncementMessage, Info, NodeAnnouncement, Ping, RefsAnnouncement, RefsStatus,

};

use crate::storage;

use crate::storage::{refs::RefsAt, Namespaces, ReadStorage};

use crate::worker::fetch;

pub const CONNECTION_RETRY_DELTA: LocalDuration = LocalDuration::from_mins(10);

/// How long to wait for a fetch to stall before aborting, default is 3s.

pub const FETCH_TIMEOUT: time::Duration = time::Duration::from_secs(3);

/// Maximum external address limit imposed by message size limits.

pub use message::ADDRESS_LIMIT;

        self.filter = Filter::new(

            self.policies

                .seed_policies()?

        );

        Ok(updated)

    }

        self.filter = Filter::new(

            self.policies

                .seed_policies()?

        );

        // Connect to configured peers.

        let addrs = self.config.connect.clone();

                    .policies

                    .seed_policy(&rid)

                    .expect("Service::dequeue_fetch: error accessing repo seeding configuration");

                // Keep dequeueing if there was nothing to fetch, otherwise break.

                    break;

                }

            } else {

                let repo_entry = self.policies.seed_policy(&message.rid).expect(

                    "Service::handle_announcement: error accessing repo seeding configuration",

                );

                    debug!(

                        target: "service",

                        "Ignoring refs announcement from {announcer}: repository {} isn't seeded (t={timestamp})",

                        message.rid

                    );

                    return Ok(None);

                // Refs can be relayed by peers who don't have the data in storage,

                // therefore we only check whether we are connected to the *announcer*,

                // which is required by the protocol to only announce refs it has.

                    return Ok(relay);

                };

                // Finally, start the fetch.

                return Ok(relay);

            }

            AnnouncementMessage::Node(

    /// Return a new filter object, based on our seeding policy.

    fn filter(&self) -> Filter {

            // TODO: Remove bits for blocked repos.

            Filter::default()

        } else {

        let missing = self

            .policies

            .seed_policies()?

            .filter(|rid| !inventory.contains(rid));

        for rid in missing {

    /// Try to maintain a target number of connections.

    fn maintain_connections(&mut self) {

            return;

        };

        trace!(target: "service", "Maintaining connections..");

        let now = self.clock;

        let outbound = self

            .sessions

use crate::service;

use crate::service::io::Io;

use crate::service::message::*;

use crate::service::*;

use crate::storage::git::transport::remote;

use crate::storage::Inventory;

    pub config: service::Config,

    pub db: Stores<node::Database>,

    pub local_time: LocalTime,

    pub signer: G,

    pub rng: fastrand::Rng,

    pub tmp: tempfile::TempDir,

            config: service::Config::test(Alias::from_str("mocky").unwrap()),

            db,

            local_time: LocalTime::now(),

            signer,

            rng,

            tmp,

        mut config: Config<G>,

    ) -> Self {

        let policies = policy::Store::<policy::store::Write>::memory().unwrap();

        let id = *config.signer.public_key();

        let ip = ip.into();

        let local_addr = net::SocketAddr::new(ip, config.rng.u16(..));

use crate::runtime::{thread, Emitter, Handle};

use crate::service::policy;

use crate::wire::StreamId;

pub use channels::{ChannelEvent, Channels};

    /// Configuration for performing fetched.

    pub fetch: FetchConfig,

    /// Default policy, if a policy for a specific node or repository was not found.

    /// Path to the policies database.

    pub policies_db: PathBuf,

}

        let policy = self.policies.seed_policy(&rid)?.policy;

        let repo = self.storage.repository(rid)?;

        let doc = repo.identity_doc()?;

            Err(UploadError::Unauthorized(remote, rid))

        } else {

            Ok(())

    ) -> Result<Self, policy::Error> {

        let mut pool = Vec::with_capacity(config.capacity);

        for i in 0..config.capacity {

            let worker = Worker {

                nid,

                tasks: tasks.clone(),

use cyphernet::addr::PeerAddr;

use localtime::LocalDuration;

use crate::node;

/// Default number of workers to spawn.

pub const DEFAULT_WORKERS: usize = 8;

pub struct ConnectionLimits {

    /// Max inbound connections.

    pub inbound: usize,

    pub outbound: usize,

}

    /// Static peer set. Connect to the configured peers and maintain the connections.

    Static,

    /// Dynamic peer set.

}

impl Default for PeerConfig {

    fn default() -> Self {

    }

}

    Forward,

}

/// Service configuration.

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]

#[serde(rename_all = "camelCase")]

    /// Specify the node's public addresses

    #[serde(default)]

    pub external_addresses: Vec<Address>,

    /// Global proxy.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub proxy: Option<net::SocketAddr>,

    pub workers: usize,

    /// Default seeding policy.

    #[serde(default)]

}

impl Config {

            listen: vec![],

            connect: HashSet::default(),

            external_addresses: vec![],

            network: Network::default(),

            proxy: None,

            onion: None,

            limits: Limits::default(),

            workers: DEFAULT_WORKERS,

            log: defaults::log(),

        }

    }

pub enum JournalMode {

    /// "WAL" mode. Good for concurrent reads & writes, but keeps some extra files around.

    #[serde(rename = "wal")]

    WriteAheadLog,

    /// Default "rollback" mode. Certain writes may block reads.

    #[serde(alias = "rollback")]

    Rollback,

}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

pub struct SeedPolicy {

    pub rid: RepoId,

}

/// Node following policy.

    pub policy: Policy,

}

/// Resource policy.

#[derive(Default, Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]

#[serde(rename_all = "camelCase")]

use thiserror::Error;

use crate::crypto::PublicKey;

use crate::storage::{Namespaces, ReadRepository as _, ReadStorage, RepositoryError};

pub use crate::node::policy::store;

pub use crate::node::policy::store::Error;

pub use crate::node::policy::store::Store;

#[derive(Debug, Error)]

pub enum NamespacesError {

/// Policies configuration.

pub struct Config<T> {

    /// Default policy, if a policy for a specific node or repository was not found.

    /// Underlying configuration store.

    store: Store<T>,

}

    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {

        f.debug_struct("Config")

            .field("policy", &self.policy)

            .field("store", &self.store)

            .finish()

    }

impl<T> Config<T> {

    /// Create a new policy configuration.

    }

    /// Check if a repository is seeded.

    pub fn is_seeding(&self, rid: &RepoId) -> Result<bool, Error> {

    }

    /// Get a repository's seeding information.

    pub fn seed_policy(&self, rid: &RepoId) -> Result<SeedPolicy, Error> {

        Ok(self.store.seed_policy(rid)?.unwrap_or(SeedPolicy {

            rid: *rid,

            policy: self.policy,

        }))

    }

            .seed_policy(rid)

            .map_err(|err| FailedPolicy { rid: *rid, err })?;

        match entry.policy {

                error!(target: "service", "Attempted to fetch untracked repo {rid}");

                Err(NamespacesError::BlockedPolicy { rid: *rid })

            }

                }

        }

    }

}

use crate::node::{Alias, AliasStore};

use crate::prelude::{NodeId, RepoId};

/// How long to wait for the database lock to be released before failing a read.

const DB_READ_TIMEOUT: time::Duration = time::Duration::from_secs(3);

    pub fn is_seeding(&self, id: &RepoId) -> Result<bool, Error> {

        Ok(matches!(

            self.seed_policy(id)?,

        ))

    }

        stmt.bind((1, id))?;

        if let Some(Ok(row)) = stmt.into_iter().next() {

        }

        Ok(None)

    }

        while let Some(Ok(row)) = stmt.next() {

            let id = row.read("id");

        }

        Ok(Box::new(entries.into_iter()))

    }

        let mut db = Store::open(":memory:").unwrap();

        assert!(db.seed(&id, Scope::All).unwrap());

        assert!(db.seed(&id, Scope::Followed).unwrap());

    }

    #[test]

        let mut db = Store::open(":memory:").unwrap();

        assert!(db.seed(&id, Scope::All).unwrap());

        assert!(db.set_seed_policy(&id, Policy::Block).unwrap());

    }

    #[test]

use std::{fs, io};

use serde::Serialize;

use thiserror::Error;

use crate::crypto::ssh::agent::Agent;

use crate::crypto::{PublicKey, Signer};

use crate::explorer::Explorer;

use crate::node::policy::config::store::Read;

use crate::storage::git::transport;

use crate::storage::git::Storage;

/// Environment variables used by radicle.

pub mod env {

    /// Load a configuration from the given path.

    pub fn load(path: &Path) -> Result<Self, ConfigError> {

            Ok(cfg) => {

            }

        }

    }

    /// Write configuration to disk.

            .create_new(true)

            .write(true)

            .open(path)?;

        self.serialize(&mut serializer)?;

        file.write_all(b"\n")?;

                key: public_key,

            },

        )?;

        transport::local::register(storage.clone());

        Ok(Profile {

    pub fn policies(&self) -> Result<policy::config::Config<Read>, policy::store::Error> {

        let path = self.node().join(node::POLICIES_DB_FILE);

        let config = policy::config::Config::new(

            policy::store::Store::reader(path)?,

        );

        Ok(config)

#[cfg(test)]

#[cfg(not(target_os = "macos"))]

mod test {

    use std::fs;

    // Checks that if we have:

    // '/run/user/1000/.tmpqfK6ih/../.tmpqfK6ih/Radicle/Home'

    //

        assert_eq!(home.path, path);

    }

}