Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

#168

P2: The CLI and the browser offer the same account the same actions

closed · opened by keenan 6d ago

keenan opened this 6d ago

Why

A contributor can file an issue, comment, manage the item it wrote, and open a change from its own branch — but only through the browser. The CLI writes the same files by pushing refs/heads/vole, and pre-receive refused that branch to anything below maintain, so the same account had different abilities depending on the transport.

That was a shortcut, not a rule: the hook had no per-path authorization for the issues branch, so “writing it needs maintain” stood in for one. #167 built the per-path authorization for run credentials, using the ACL’s own capabilities, which means the rules were expressible all along. Applied to every session, the shortcut can go.

Scope

  • Every push to the issues branch is authorized path by path, against the ACL’s capabilities (CanDiscuss, CanOpenRequest, CanTriage, CanApprove) — the same questions the browser’s forms ask.
  • A contribute account may push the issues branch: file an issue, comment, manage the item it wrote, open a change from a branch it may push.
  • It may not triage somebody else’s item, approve, write a release, or remove an issue. Creating the issues branch still needs a maintainer, as it does from the browser.
  • A non-maintainer’s new file must name that account as its author: the browser fills the author in from the session, and a push has to put the same name there. A maintainer keeps writing an imported issue under its original author, which is a trust decision, not a feature gap.
  • A maintainer’s key session is unchanged, except that the self-approval rule now applies to it too — which ValidateRequests already enforced, so this is one less way to be refused.
  • Docs stop saying contributors use the web because the CLI needs maintain, and say instead that both transports ask the same capabilities.

Acceptance criteria

  • The same account, through either transport, is offered the same actions in a repository, and the message it gets for the rest names the rule.
  • A contributor can run vole issue new, vole issue comment, vole issue edit on its own issue, and vole change new from its own branch.
  • A contributor cannot approve, triage another account’s issue, or write a release, and the refusal explains which capability was missing.
  • Changing a comment, an issue, or a change still requires being its author (or an admin, audited), exactly as before.

Related

  • #167 built the per-path authorization this generalises.
  • #165, where the role-inheritance decision was recorded.

Comments (1)

keenan 6d ago

Resolved by #169 (01M6FPCRK84W6FTW0EKSDQN4VB), merged into main as 7e0b595. That request said “Part of #168” and carried no closes: link, so landing it did not close this issue.

The push boundary now asks the ACL the same questions the browser’s forms ask, for every session rather than only for run credentials:

  • CanDiscuss files an issue or adds a comment.
  • CanTriage manages somebody else’s item.
  • CanOpenRequest opens a change from the account’s own branch.
  • CanApprove writes an approval, and still not for the approver’s own change.

A contributor’s new file must name that account as its author, creating the issues branch still needs a maintainer, and changing or removing an item is still its author’s (or an admin’s, audited). CONTRIBUTING and the guides no longer send contributors to the browser; both transports are one authorization model.

All acceptance criteria are covered by server/hook/scope_test.go (contributor key commenting, filing, managing its own issue, opening its own change; refused on another account’s issue, another branch, an approval, and a first push that would create the branch).