vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Add instance-wide roles and refine access UI
5b814e9958090cfd1fa826efb2d375bf613547c1 · Keenan Nemetz · 14d ago · parent 9579c1f9
Add instance-wide roles and refine access UI Instance roles now live on accounts, apply to public repositories, and the Admin role is the unified instance-admin permission with access to every repository. Repository ACLs can raise an instance role but not lower it. Adds role assignment to the users UI and CLI, open-registration role config, a reusable role picker, and separates adding a repository account from saving access rules.
docs/cli.md +10−4
| @@ -54,7 +54,7 @@ The pre-admin spellings `vole user`, `vole repo`, `vole acl`, `vole index` and | |||
| 54 | 54 | ### Users | |
| 55 | 55 | ||
| 56 | 56 | ```sh | |
| 57 | vole admin user create [--key <file|->] <name> | ||
| 57 | vole admin user create [--key <file|->] [--role <role>] <name> | ||
| 58 | 58 | vole admin user invite <name> | |
| 59 | 59 | vole admin user credentials <name> | |
| 60 | 60 | vole admin user rm-credential <name> <credential-id> | |
| @@ -63,6 +63,7 @@ vole admin user revoke-sessions [--all | <name>] | |||
| 63 | 63 | vole admin user add-key --key <file|-> <name> | |
| 64 | 64 | vole admin user rm-key <name> <fingerprint> | |
| 65 | 65 | vole admin user retire <name> | |
| 66 | vole admin user role <name> <none|read|contribute|maintain|admin> | ||
| 66 | 67 | vole admin user grant-admin <name> | |
| 67 | 68 | vole admin user revoke-admin <name> | |
| 68 | 69 | vole admin user show <name> | |
| @@ -72,7 +73,9 @@ vole whoami [--remote <name>] | |||
| 72 | 73 | ``` | |
| 73 | 74 | ||
| 74 | 75 | Omitting `--key` creates a browser-only account and prints a one-time enrollment | |
| 75 | link. `user invite` issues a fresh link for an existing account. `user backup` | ||
| 76 | link. `--role` sets the account's instance-wide role; it applies to public | ||
| 77 | repositories, while `admin` applies to every repository. `user role` changes it | ||
| 78 | later. `user invite` issues a fresh link for an existing account. `user backup` | ||
| 76 | 79 | writes a file on the host, so it is local-only. | |
| 77 | 80 | ||
| 78 | 81 | The account name is the only identifier an account has. It cannot be changed: it | |
| @@ -93,10 +96,13 @@ New repositories are private. The owner becomes the first admin. | |||
| 93 | 96 | ||
| 94 | 97 | ### Access | |
| 95 | 98 | ||
| 99 | Instance-wide roles are account standing; repository rules are set with `acl`: | ||
| 100 | |||
| 96 | 101 | ```sh | |
| 102 | vole admin user role <name> <none|read|contribute|maintain|admin> | ||
| 97 | 103 | vole admin acl show <repo> | |
| 98 | vole admin acl set <repo> <user> <none|read|contributor|maintain|admin> | ||
| 99 | vole admin acl default <repo> <none|read|contributor|maintain|admin> | ||
| 104 | vole admin acl set <repo> <user> <none|read|contribute|maintain|admin> | ||
| 105 | vole admin acl default <repo> <none|read|contribute|maintain|admin> | ||
| 100 | 106 | vole admin acl protect <repo> <ref-pattern>... | |
| 101 | 107 | vole admin acl approvals <repo> <n> | |
| 102 | 108 | vole admin acl checks <repo> <on|off> | |