feat: private imports

backend/openapi.yaml

@@ -1870,6 +1870,23 @@ paths:
               schema:
                 $ref: "#/components/schemas/Script"
 
+  /w/{workspace}/scripts/raw/p/{path}:
+    get:
+      summary: raw script by path
+      operationId: rawScriptByPath
+      tags:
+        - script
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/ScriptPath"
+      responses:
+        "200":
+          description: script content
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/scripts/exists/p/{path}:
     get:
       summary: exists script by path
@@ -1904,6 +1921,23 @@ paths:
               schema:
                 $ref: "#/components/schemas/Script"
 
+  /w/{workspace}/scripts/raw/h/{path}:
+    get:
+      summary: raw script by hash
+      operationId: rawScriptByHash
+      tags:
+        - script
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/ScriptPath"
+      responses:
+        "200":
+          description: script content
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/scripts/deployment_status/h/{hash}:
     get:
       summary: get script deployment status

backend/src/scripts.rs

@@ -53,10 +53,12 @@ pub fn workspaced_service() -> Router {
         .route("/create", post(create_script))
         .route("/archive/p/*path", post(archive_script_by_path))
         .route("/get/p/*path", get(get_script_by_path))
+        .route("/raw/p/*path", get(raw_script_by_path))
         .route("/exists/p/*path", get(exists_script_by_path))
         .route("/archive/h/:hash", post(archive_script_by_hash))
         .route("/delete/h/:hash", post(delete_script_by_hash))
         .route("/get/h/:hash", get(get_script_by_hash))
+        .route("/raw/h/:hash", get(raw_script_by_hash))
         .route("/deployment_status/h/:hash", get(get_deployment_status))
 }
 
@@ -537,6 +539,29 @@ async fn get_script_by_path(
     Ok(Json(script))
 }
 
+async fn raw_script_by_path(
+    authed: Authed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, path)): Path<(String, StripPath)>,
+) -> Result<String> {
+    let path = path.to_path();
+    let mut tx = user_db.begin(&authed).await?;
+
+    let content_o = sqlx::query_scalar!(
+        "SELECT content FROM script WHERE path = $1 AND (workspace_id = $2 OR workspace_id = 'starter') \
+         AND
+         created_at = (SELECT max(created_at) FROM script WHERE path = $1 AND archived = false AND \
+         (workspace_id = $2 OR workspace_id = 'starter'))",
+         path, w_id
+    )
+    .fetch_optional(&mut tx)
+    .await?;
+    tx.commit().await?;
+
+    let content = crate::utils::not_found_if_none(content_o, "Script", path)?;
+    Ok(content)
+}
+
 async fn exists_script_by_path(
     Extension(db): Extension<DB>,
     Path((w_id, path)): Path<(String, StripPath)>,
@@ -587,6 +612,18 @@ async fn get_script_by_hash(
     Ok(Json(r))
 }
 
+async fn raw_script_by_hash(
+    authed: Authed,
+    Extension(user_db): Extension<UserDB>,
+    Path((w_id, hash)): Path<(String, ScriptHash)>,
+) -> Result<String> {
+    let mut tx = user_db.begin(&authed).await?;
+    let r = get_script_by_hash_internal(&mut tx, &w_id, &hash).await?;
+    tx.commit().await?;
+
+    Ok(r.content)
+}
+
 #[derive(FromRow, Serialize)]
 struct DeploymentStatus {
     lock: Option<String>,

backend/src/worker.rs

@@ -819,7 +819,7 @@ run();
 
             tx.commit().await?;
 
-            let mut reserved_variables = get_reserved_variables(job, token, db).await?;
+            let mut reserved_variables = get_reserved_variables(job, token.clone(), db).await?;
             reserved_variables.insert("RUST_LOG".to_string(), "info".to_string());
 
             if !disable_nsjail {
@@ -840,12 +840,16 @@ run();
                 workspace_id = %job.workspace_id,
                 "started deno code execution"
             );
+            let hostname = base_url.split("://").last().unwrap_or("localhost");
+            let deno_auth_tokens = format!("{token}@{hostname}");
+
             let child = if !disable_nsjail {
                 Command::new(nsjail_path)
                     .current_dir(job_dir)
                     .env_clear()
                     .envs(reserved_variables)
                     .env("PATH", path_env)
+                    .env("DENO_AUTH_TOKENS", deno_auth_tokens)
                     .args(vec![
                         "--config",
                         "run.config.proto",
@@ -866,6 +870,7 @@ run();
                     .env_clear()
                     .envs(reserved_variables)
                     .env("PATH", path_env)
+                    .env("DENO_AUTH_TOKENS", deno_auth_tokens)
                     .args(vec![
                         "run",
                         "--unstable",