feat(store): HTTPSource — install from the hosted registry (#275 client)

[bobakemamian]

The missing registry client. HTTPSource satisfies the existing Source interface, so buttons install now works against the hosted Worker (desk.buttons.sh) — not just a local --source.

• Index() → GET /v1/index; Fetch() → GET /v1/buttons/<@desk/name>/<ver>/download, verifies the tarball against x-content-sha256, extracts into a Bundle (file-content hash stamped as content_hash, consistent with LocalSource).
• Hardened untar: size/file-count caps, traversal rejected, wrapping-folder flattened, macOS ._*/.DS_Store junk skipped.
• cmd/install.go: LocalSource (--source/$BUTTONS_SOURCE) else HTTPSource ($BUTTONS_REGISTRY_URL + REGISTRY_KEY battery).

Validated live: buttons install @autono/hello against desk.buttons.sh → fetch → hash-verify → install → stamp. 4 new tests; full suite green (19 pkgs).

Summary by CodeRabbit

• New Features

  • Install now supports selecting button sources from either a local path or a hosted registry, with clearer resolution rules.
  • Hosted downloads now work over secure authenticated requests and can automatically use the latest available version.

• Bug Fixes

  • Improved error messages for invalid source setup and registry access issues.
  • Added integrity checks and safer extraction for downloaded bundles, reducing the risk of corrupted or unsafe files.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c2b0fe69-00a4-40cd-b6d9-463f88fd206e

📥 Commits

Reviewing files that changed from the base of the PR and between a519989 and 060ba42.

📒 Files selected for processing (3)

• cmd/install.go
• internal/store/http_source.go
• internal/store/http_source_test.go

---

📝 Walkthrough

Walkthrough

Adds HTTPSource in internal/store/http_source.go implementing bearer-authenticated registry access: listing buttons via /v1/index, downloading tarballs with sha256 integrity verification, and safe tar extraction. The install command's source selection is extracted into resolveInstallSource() and registryKey(), with updated help text.

HTTPSource and install source resolution

Layer / File(s)	Summary
HTTPSource: struct, index, fetch, and tar extraction internal/store/http_source.go	Defines HTTPSource with BaseURL, Key, and optional Client; implements /v1/index fetching, version resolution, tarball download with compressed-size limits, sha256 integrity verification against X-Content-Sha256, and untarGz with path-safety, size-cap, and file-count guards; includes sha256hex helper.
HTTPSource tests internal/store/http_source_test.go	Mock registry server with bearer auth; tests cover successful index+fetch with version auto-resolution, file path flattening, Bundle.SHA256 derivation from extracted contents, hash mismatch rejection, auth failure, and macOS junk file skipping (._button.json, .DS_Store).
install command source resolution cmd/install.go	Extracts resolveInstallSource() to prefer local --source/$BUTTONS_SOURCE over $BUTTONS_REGISTRY_URL; adds registryKey() falling back from $BUTTONS_BAT_REGISTRY_KEY to newBatteryService(); updates RunE error handling and help text.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• autonoco/buttons#190: Established the Source abstraction and InstallSpec-driven install flow that this PR's HTTPSource and resolveInstallSource() build directly upon.

Poem

🐇 Hoppity-hop through the registry gate,
A bearer key tucked in my coat so great,
I fetch the tarballs, I check every hash,
No .DS_Store shall sneak in my stash,
The source is resolved — local or far,
Buttons installed, wherever you are! 🌟

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/http-source

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}