Require payment to submit builds, phase one

Phase two will simply involve removing that temporary if statement after
a notice period.

buildsrht/blueprints/api.py

@@ -5,7 +5,7 @@ from srht.database import db
 from srht.flask import csrf_bypass
 from srht.validation import Validation
 from srht.oauth import oauth, current_token
-from buildsrht.runner import queue_build
+from buildsrht.runner import queue_build, requires_payment
 from buildsrht.types import Artifact, Job, JobStatus, Task, JobGroup
 from buildsrht.types import Trigger, TriggerType, TriggerCondition
 from buildsrht.manifest import Manifest
@@ -28,6 +28,12 @@ def jobs_GET():
 @oauth("jobs:write")
 def jobs_POST():
     valid = Validation(request)
+    if requires_payment(current_token.user):
+        valid.error("Payment is required to submit build jobs. " +
+            "Set up billing at https://meta.sr.ht/billing/initial",
+            status=402)
+        return valid.response
+
     _manifest = valid.require("manifest", cls=str)
     max_len = Job.manifest.prop.columns[0].type.length
     valid.expect(not _manifest or len(_manifest) < max_len,

buildsrht/blueprints/jobs.py

@@ -11,7 +11,7 @@ from srht.validation import Validation
 from buildsrht.types import Job, JobStatus, Task, TaskStatus, User
 from buildsrht.manifest import Manifest
 from buildsrht.rss import generate_feed
-from buildsrht.runner import queue_build
+from buildsrht.runner import queue_build, requires_payment
 from buildsrht.search import apply_search
 from jinja2 import Markup, escape
 import sqlalchemy as sa
@@ -172,7 +172,13 @@ def submit_GET():
     manifest = session.get("manifest")
     if manifest:
         del session["manifest"]
-    return render_template("submit.html", manifest=manifest)
+    status = 200
+    payment_required = requires_payment(current_user)
+    if payment_required:
+        status = 402
+    return render_template("submit.html",
+            manifest=manifest,
+            payment_required=payment_required), status
 
 @jobs.route("/resubmit/<int:job_id>")
 @loginrequired

buildsrht/runner.py

@@ -1,8 +1,12 @@
 import json
 from celery import Celery
+from datetime import datetime
 from srht.config import cfg
 from srht.database import db
 from srht.email import send_email
+from srht.oauth import UserType
+
+allow_free = cfg("builds.sr.ht", "allow-free", default="no") == "yes"
 
 runner = Celery('builds', broker=cfg("builds.sr.ht", "redis"), config_source={
     "CELERY_TASK_SERIALIZER": "json",
@@ -26,6 +30,18 @@ def queue_build(job, manifest):
     else:
         run_build.delay(job.id, manifest.to_dict())
 
+def requires_payment(user):
+    if allow_free:
+        return False
+    # Temporary:
+    if user.created < datetime(year=2021, month=5, day=1):
+        return False
+    return user.user_type not in [
+        UserType.admin,
+        UserType.active_paying,
+        UserType.active_free,
+    ]
+
 @runner.task
 def run_build(job_id, manifest):
     pass # see worker/context.go

buildsrht/templates/submit.html

@@ -11,6 +11,27 @@
 </style>
 {% endblock %}
 {% block content %} 
+{% if payment_required %}
+<section class="row">
+  <div class="col-md-8 offset-md-2">
+    <h3>Payment required</h3>
+    <p>
+    You must have a paid sourcehut account to submit jobs to builds.sr.ht.
+    Financial aid is available for users who need it.
+    <div style="margin-bottom: 1rem">
+      <a
+        href="{{get_origin('meta.sr.ht', external=True)}}/billing/initial"
+        class="btn btn-primary"
+      >Proceed to billing setup {{icon('caret-right')}}</a>
+    </div>
+    <h4>Other payment-related resources</h4>
+    <ul>
+      <li><a href="https://man.sr.ht/billing-faq.md">Billing FAQ</a></li>
+      <li><a href="https://man.sr.ht/ops/builds.sr.ht-migration.md">builds.sr.ht background information</a></li>
+    </ul>
+  </div>
+</section>
+{% else %}
 <section class="row">
   <div class="col-md-4">
     <p>
@@ -60,6 +81,7 @@
     </div>
   </form>
 </section>
+{% endif %}
 {% endblock %}
 {% block scripts %}
 <script src="/static/codemirror.js"></script>

config.example.ini

@@ -97,6 +97,9 @@ oauth-client-secret=
 # /usr/bin/runner-shell for workers.
 # If master and worker are on the same system set to /usr/bin/runner-shell
 shell=/usr/bin/master-shell
+#
+# Set to "yes" to allow nonpaying users to submit builds
+allow-free=yes
 
 #
 # These config options are only necessary for systems running a build runner