internalauth: take both ends of the internal protocol from ecore The guard on /internal/repos and the header cmd/dolt-git-hook minted for it were two hand-written halves of one protocol in two packages that shared no type, no constant and no test. Both are now sr-ht-ecore/internalauth: Guard on the receiving end, AuthorizationAs on the calling one, over one Auth struct. The guard also pins the caller, which the old copy did not: core-go only asks that a token name some client and node, and on an endpoint that provisions a database for an arbitrary user that means any holder of the network key will do. The pinned pair lives in core so the mint and the pin cannot drift apart. The hook test now runs internalauth.Identify — the real receiving end — over the header the hook produced, so the two ends are checked against each other rather than against a third copy of the decode.
test: build the fixture config and the keyset with ecoretest The hand-built ini in web_test.go, the random fernet key in authn's TestMain and the same seeding copied into the git-hook test are one call to ecoretest now. The keys are fixed rather than generated on purpose: they secure nothing inside a test process, and a constant keyset is what lets two packages of this service initialise without the second rotating what the first sealed with. The synthetic instance runs in production mode, so the environment banner is off in tests unless one asks for it.
feat: auto-provision companion Dolt DBs from git.sr.ht pushes Add a service-to-service path so pushing a git.sr.ht repo creates a matching Dolt database at ~owner/name, ready before the user's first `dolt push`. - web: POST /internal/repos, guarded by internal-IP + network-key `Internal` auth (not the browser cookie/CSRF). Resolves/mirrors the owner via auth.LookupUser, then CreateRepo + InitStore, rolling back the row if the store init fails. Idempotent: an existing companion returns 200, a fresh one 201 — safe to call on every push. - cmd/dolt-git-hook: the git.sr.ht post-update-script. Delegates every hook stage to the stock /usr/bin/git.sr.ht-update-hook unchanged (argv[0], stdin, env, exit code preserved; fail-closed if the delegate is missing), then on post-update POSTs the companion create and prints a one-time clone notice. Best-effort: never fails a push, degrades to a warning on any misconfig. Tests cover the endpoint (provision/idempotent/rollback/bad-input) and the hook (signed request round-trips through the guard's decryption, notice only on 201).