vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Identify accounts by their registered name
62576fa8157d431dcf2d360f3ebe481de77bda03 · Keenan Nemetz · 14d ago · parent 642e5994
Identify accounts by their registered name Drop the internal account id and display name. Users, keys, passkeys, invites, sessions, ACL entries, approvals, locks and CI records now all use the registered name as the single identity. The roster migrates in place: old id-keyed tables are rebuilt around the name, and access-rule/lock references are rewritten through the same mapping. Display-name editing and whoami --id are removed.
docs/users-and-access.md +11−19
| @@ -10,16 +10,12 @@ do not care which one you used. | |||
| 10 | 10 | ||
| 11 | 11 | ## Accounts and keys | |
| 12 | 12 | ||
| 13 | An account has three names, and they are not interchangeable: | ||
| 14 | |||
| 15 | - the **name**, chosen when the account is created and fixed for good. It is what | ||
| 16 | your contributor branches are named after (`refs/heads/contrib/<name>/`), so a | ||
| 17 | rename would strand every ref and every author field already written. Keep it. | ||
| 18 | - the **display name**, an optional label shown next to your account on requests, | ||
| 19 | issues, approvals and user listings. It can be anything printable and can be | ||
| 20 | changed at any time. Nothing is authorized by it. | ||
| 21 | - the **id**, a ULID Vole assigns internally. Access rules and approval files are | ||
| 22 | keyed by it. | ||
| 13 | An account is identified by its **name**, chosen when the account is created and | ||
| 14 | fixed for good. It is what your contributor branches are named after | ||
| 15 | (`refs/heads/contrib/<name>/`), and it is the key for access rules, approvals, | ||
| 16 | file locks and CI records. There is no second internal identifier and no separate | ||
| 17 | display label, so a rename would strand every ref, approval and author field | ||
| 18 | already written. Keep the name. | ||
| 23 | 19 | ||
| 24 | 20 | Names are never reused: because the account row outlives retirement, retiring | |
| 25 | 21 | someone keeps their name attached to them. An old reference can never silently | |
| @@ -33,11 +29,10 @@ take effect without restarting the server. | |||
| 33 | 29 | ||
| 34 | 30 | ```sh | |
| 35 | 31 | vole admin user create alice --key ~/.ssh/id_ed25519.pub | |
| 36 | vole admin user create bob --display "Bob Smith" --key bob.pub | ||
| 32 | vole admin user create bob --key bob.pub | ||
| 37 | 33 | vole admin user add-key alice --key ~/.ssh/id_ed25519_work.pub | |
| 38 | 34 | vole admin user list | |
| 39 | 35 | vole admin user rm-key alice SHA256:... | |
| 40 | vole admin user display alice "Alice O'Brien" | ||
| 41 | 36 | vole admin user retire alice | |
| 42 | 37 | vole admin user backup backup/users.db | |
| 43 | 38 | ``` | |
| @@ -46,8 +41,7 @@ vole admin user backup backup/users.db | |||
| 46 | 41 | `--key` (and with no key on stdin), it creates a browser-only account and prints a | |
| 47 | 42 | one-time enrollment link. `user invite` issues a fresh link for an existing | |
| 48 | 43 | account. `user add-key` adds another SSH key; use it to rotate credentials | |
| 49 | without changing the account that access rules and approvals refer to. | ||
| 50 | `user display` sets or clears the label (an empty string clears it); there is no | ||
| 44 | without changing the account that access rules and approvals refer to. There is no | ||
| 51 | 45 | command to change the account name. | |
| 52 | 46 | ||
| 53 | 47 | ## Browser sign-in | |
| @@ -99,7 +93,6 @@ To see which account the current remote's key belongs to: | |||
| 99 | 93 | ||
| 100 | 94 | ```sh | |
| 101 | 95 | vole whoami | |
| 102 | vole whoami --id | ||
| 103 | 96 | ``` | |
| 104 | 97 | ||
| 105 | 98 | ## Remote administration | |
| @@ -211,10 +204,9 @@ metadata branch. The pre-receive hook checks the namespace, and rebasing or | |||
| 211 | 204 | deleting a branch inside their own folder is allowed because it is not shared | |
| 212 | 205 | history. | |
| 213 | 206 | ||
| 214 | The namespace is the account name rather than the internal id, so a ref says | ||
| 215 | whose work it is without decoding a ULID. It is also why names are fixed at | ||
| 216 | creation: renaming an account would otherwise orphan every branch under its old | ||
| 217 | folder. A display name is safe to change because no ref is named after it. | ||
| 207 | The namespace is the account name, so a ref says whose work it is without a | ||
| 208 | lookup. It is also why names are fixed at creation: renaming an account would | ||
| 209 | otherwise orphan every branch under its old folder. | ||
| 218 | 210 | ||
| 219 | 211 | The browser's **Open change request** form lists only the branches the account | |
| 220 | 212 | may use as a head. The head commit is resolved from that branch; a contributor | |