vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Identify accounts by their registered name
62576fa8157d431dcf2d360f3ebe481de77bda03 · Keenan Nemetz · 14d ago · parent 642e5994
Identify accounts by their registered name Drop the internal account id and display name. Users, keys, passkeys, invites, sessions, ACL entries, approvals, locks and CI records now all use the registered name as the single identity. The roster migrates in place: old id-keyed tables are rebuilt around the name, and access-rule/lock references are rewritten through the same mapping. Display-name editing and whoami --id are removed.
server/web/admin.go +17−19
| @@ -27,8 +27,6 @@ type adminRepoView struct { | |||
| 27 | 27 | } | |
| 28 | 28 | ||
| 29 | 29 | type aclRow struct { | |
| 30 | ID string | ||
| 31 | Label string | ||
| 32 | 30 | Name string | |
| 33 | 31 | Status string | |
| 34 | 32 | Role string | |
| @@ -57,7 +55,7 @@ func (w *Web) requireInstanceAdmin(rw http.ResponseWriter, r *http.Request) (*pr | |||
| 57 | 55 | if !ok { | |
| 58 | 56 | return nil, false | |
| 59 | 57 | } | |
| 60 | if w.Ident == nil || !w.Ident.IsAdmin(pr.account.ID) { | ||
| 58 | if w.Ident == nil || !w.Ident.IsAdmin(pr.account.Name) { | ||
| 61 | 59 | w.notFound(rw, r) | |
| 62 | 60 | return nil, false | |
| 63 | 61 | } | |
| @@ -130,16 +128,16 @@ func (w *Web) aclRows(a *access.ACL) []aclRow { | |||
| 130 | 128 | ||
| 131 | 129 | seen := map[string]bool{} | |
| 132 | 130 | var rows []aclRow | |
| 133 | add := func(id, label, name, status string) { | ||
| 134 | seen[id] = true | ||
| 131 | add := func(name, status string) { | ||
| 132 | seen[name] = true | ||
| 135 | 133 | rows = append(rows, aclRow{ | |
| 136 | ID: id, Label: label, Name: name, Status: status, | ||
| 137 | Role: role(id), Runner: isRunner(id), | ||
| 134 | Name: name, Status: status, | ||
| 135 | Role: role(name), Runner: isRunner(name), | ||
| 138 | 136 | }) | |
| 139 | 137 | } | |
| 140 | 138 | if w.Ident != nil { | |
| 141 | 139 | for _, acct := range w.Ident.All() { | |
| 142 | add(acct.ID, acct.Label(), acct.Name, acct.Status) | ||
| 140 | add(acct.Name, acct.Status) | ||
| 143 | 141 | } | |
| 144 | 142 | } | |
| 145 | 143 | var extra []string | |
| @@ -154,8 +152,8 @@ func (w *Web) aclRows(a *access.ACL) []aclRow { | |||
| 154 | 152 | } | |
| 155 | 153 | } | |
| 156 | 154 | sort.Strings(extra) | |
| 157 | for _, id := range extra { | ||
| 158 | add(id, id, "", "missing") | ||
| 155 | for _, name := range extra { | ||
| 156 | add(name, "missing") | ||
| 159 | 157 | } | |
| 160 | 158 | return rows | |
| 161 | 159 | } | |
| @@ -224,25 +222,25 @@ func (w *Web) SaveAdminAccess(rw http.ResponseWriter, r *http.Request) { | |||
| 224 | 222 | for _, row := range w.aclRows(acl) { | |
| 225 | 223 | // A field the form did not submit keeps whatever the ACL already had, | |
| 226 | 224 | // so a race with a newly added entry cannot silently delete it. | |
| 227 | if raw, present := r.PostForm["role:"+row.ID]; present { | ||
| 225 | if raw, present := r.PostForm["role:"+row.Name]; present { | ||
| 228 | 226 | role, err := access.ParseRole(raw[0]) | |
| 229 | 227 | if err != nil { | |
| 230 | http.Error(rw, "account "+row.Label+": "+err.Error(), http.StatusBadRequest) | ||
| 228 | http.Error(rw, "account "+row.Name+": "+err.Error(), http.StatusBadRequest) | ||
| 231 | 229 | return | |
| 232 | 230 | } | |
| 233 | 231 | if role != access.None { | |
| 234 | updated.Entries[row.ID] = role.String() | ||
| 232 | updated.Entries[row.Name] = role.String() | ||
| 235 | 233 | } | |
| 236 | } else if existing, ok := acl.Entries[row.ID]; ok { | ||
| 237 | updated.Entries[row.ID] = existing | ||
| 234 | } else if existing, ok := acl.Entries[row.Name]; ok { | ||
| 235 | updated.Entries[row.Name] = existing | ||
| 238 | 236 | } | |
| 239 | if r.PostFormValue("runner:"+row.ID) != "" { | ||
| 240 | runners = append(runners, row.ID) | ||
| 237 | if r.PostFormValue("runner:"+row.Name) != "" { | ||
| 238 | runners = append(runners, row.Name) | ||
| 241 | 239 | } | |
| 242 | 240 | } | |
| 243 | 241 | updated.Runners = nil | |
| 244 | 242 | updated.SetRunners(runners) | |
| 245 | if err := m.SetACL(&updated, pr.account.ID); err != nil { | ||
| 243 | if err := m.SetACL(&updated, pr.account.Name); err != nil { | ||
| 246 | 244 | w.serverError(rw, r, "cannot save access rules: "+err.Error()) | |
| 247 | 245 | return | |
| 248 | 246 | } | |
| @@ -252,7 +250,7 @@ func (w *Web) SaveAdminAccess(rw http.ResponseWriter, r *http.Request) { | |||
| 252 | 250 | return | |
| 253 | 251 | } | |
| 254 | 252 | } | |
| 255 | w.audit("web.admin.acl", pr.account.ID, m.Name) | ||
| 253 | w.audit("web.admin.acl", pr.account.Name, m.Name) | ||
| 256 | 254 | http.Redirect(rw, r, "/admin/repos/"+m.Name+"/access?saved=1", http.StatusSeeOther) | |
| 257 | 255 | } | |
| 258 | 256 | ||