vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Identify accounts by their registered name
62576fa8157d431dcf2d360f3ebe481de77bda03 · Keenan Nemetz · 14d ago · parent 642e5994
Identify accounts by their registered name Drop the internal account id and display name. Users, keys, passkeys, invites, sessions, ACL entries, approvals, locks and CI records now all use the registered name as the single identity. The roster migrates in place: old id-keyed tables are rebuilt around the name, and access-rule/lock references are rewritten through the same mapping. Display-name editing and whoami --id are removed.
server/hook/records_test.go +9−10
| @@ -58,11 +58,11 @@ func newRecordFixture(t *testing.T) *recordFixture { | |||
| 58 | 58 | {"other", &f.otherID}, | |
| 59 | 59 | } { | |
| 60 | 60 | _, pub := writeKey(t, filepath.Join(dir, u.name)) | |
| 61 | acct, err := ident.Create(u.name, "", pub, "test") | ||
| 61 | acct, err := ident.Create(u.name, pub, "test") | ||
| 62 | 62 | if err != nil { | |
| 63 | 63 | t.Fatal(err) | |
| 64 | 64 | } | |
| 65 | *u.into = acct.ID | ||
| 65 | *u.into = acct.Name | ||
| 66 | 66 | } | |
| 67 | 67 | ||
| 68 | 68 | acls, err := access.Open(usersDB) | |
| @@ -159,7 +159,7 @@ func (f *recordFixture) push(rec runs.Record) string { | |||
| 159 | 159 | } | |
| 160 | 160 | ||
| 161 | 161 | // preReceive runs the gate for a push of the metadata branch by one account. | |
| 162 | func (f *recordFixture) preReceive(actor, actorID, old, new string) (int, string) { | ||
| 162 | func (f *recordFixture) preReceive(actor, old, new string) (int, string) { | ||
| 163 | 163 | f.t.Helper() | |
| 164 | 164 | if old == "" { | |
| 165 | 165 | old = git.ZeroSHA | |
| @@ -168,7 +168,6 @@ func (f *recordFixture) preReceive(actor, actorID, old, new string) (int, string | |||
| 168 | 168 | code := PreReceive(Config{ | |
| 169 | 169 | RepoDir: f.repo.Dir, | |
| 170 | 170 | Actor: actor, | |
| 171 | ActorID: actorID, | ||
| 172 | 171 | UsersDB: f.usersDB, | |
| 173 | 172 | RunsDB: f.runsDB, | |
| 174 | 173 | In: strings.NewReader(old + " " + new + " " + metadata.Ref + "\n"), | |
| @@ -184,7 +183,7 @@ func TestOnlyAnAllowedRunnerMayReportAResult(t *testing.T) { | |||
| 184 | 183 | // The allowed runner reports its attempt: accepted, because it names the account | |
| 185 | 184 | // that pushed it and describes the job it was leased. | |
| 186 | 185 | old := f.push(f.record(1, f.runnerID)) | |
| 187 | if code, out := f.preReceive("runner", f.runnerID, old, f.current); code != 0 { | ||
| 186 | if code, out := f.preReceive(f.runnerID, old, f.current); code != 0 { | ||
| 188 | 187 | t.Fatalf("an allowed runner's record was refused:\n%s", out) | |
| 189 | 188 | } | |
| 190 | 189 | ||
| @@ -192,7 +191,7 @@ func TestOnlyAnAllowedRunnerMayReportAResult(t *testing.T) { | |||
| 192 | 191 | // of its own making: whose build the host believes is the allowlist's question. | |
| 193 | 192 | other := f.record(2, f.otherID) | |
| 194 | 193 | old = f.push(other) | |
| 195 | code, out := f.preReceive("other", f.otherID, old, f.current) | ||
| 194 | code, out := f.preReceive(f.otherID, old, f.current) | ||
| 196 | 195 | if code == 0 { | |
| 197 | 196 | t.Fatalf("a non-runner's record was accepted:\n%s", out) | |
| 198 | 197 | } | |
| @@ -211,7 +210,7 @@ func TestARecordCannotBeAttributedToAnotherAccount(t *testing.T) { | |||
| 211 | 210 | ||
| 212 | 211 | rec := f.record(1, f.otherID) | |
| 213 | 212 | old := f.push(rec) | |
| 214 | code, out := f.preReceive("runner", f.runnerID, old, f.current) | ||
| 213 | code, out := f.preReceive(f.runnerID, old, f.current) | ||
| 215 | 214 | if code == 0 { | |
| 216 | 215 | t.Fatalf("a record naming another account was accepted:\n%s", out) | |
| 217 | 216 | } | |
| @@ -241,7 +240,7 @@ func TestARecordNeedsNoSignature(t *testing.T) { | |||
| 241 | 240 | if err := g.UpdateRef(metadata.Ref, commit); err != nil { | |
| 242 | 241 | t.Fatal(err) | |
| 243 | 242 | } | |
| 244 | if code, out := f.preReceive("runner", f.runnerID, "", commit); code != 0 { | ||
| 243 | if code, out := f.preReceive(f.runnerID, "", commit); code != 0 { | ||
| 245 | 244 | t.Fatalf("an unsigned record was refused:\n%s", out) | |
| 246 | 245 | } | |
| 247 | 246 | } | |
| @@ -270,7 +269,7 @@ func TestARecordIsAppendOnlyAtTheGate(t *testing.T) { | |||
| 270 | 269 | if err != nil { | |
| 271 | 270 | t.Fatal(err) | |
| 272 | 271 | } | |
| 273 | code, out := f.preReceive("runner", f.runnerID, oldTip, edited) | ||
| 272 | code, out := f.preReceive(f.runnerID, oldTip, edited) | ||
| 274 | 273 | if code == 0 { | |
| 275 | 274 | t.Fatalf("an edited record was accepted:\n%s", out) | |
| 276 | 275 | } | |
| @@ -294,7 +293,7 @@ func TestARecordMustDescribeTheLeasedJob(t *testing.T) { | |||
| 294 | 293 | if err := g.UpdateRef(metadata.Ref, commit); err != nil { | |
| 295 | 294 | t.Fatal(err) | |
| 296 | 295 | } | |
| 297 | code, out := f.preReceive("runner", f.runnerID, "", commit) | ||
| 296 | code, out := f.preReceive(f.runnerID, "", commit) | ||
| 298 | 297 | if code == 0 { | |
| 299 | 298 | t.Fatalf("a record for another attempt was accepted:\n%s", out) | |
| 300 | 299 | } | |