vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add instance-wide roles and refine access UI

5b814e9958090cfd1fa826efb2d375bf613547c1 · Keenan Nemetz · 14d ago · parent 9579c1f9

Add instance-wide roles and refine access UI

Instance roles now live on accounts, apply to public repositories, and the Admin role is the unified instance-admin permission with access to every repository. Repository ACLs can raise an instance role but not lower it.

Adds role assignment to the users UI and CLI, open-registration role config, a reusable role picker, and separates adding a repository account from saving access rules.

forge/access/store.go +15−1

@@ -25,6 +25,10 @@ type Store struct {
	25	25	// acceptable for tests: an access change is the one administrative act that must
	26	26	// leave a trace, since the old copy was a commit message.
	27	27	AuditPath string
		28	// InstanceRole, when set, resolves an account's instance-wide role. The
		29	// roster owns it; the store attaches it to every ACL it returns so RoleFor
		30	// can apply the global grant without every caller having to pass it in.
		31	InstanceRole func(string) Role
	28	32	}
	29	33
	30	34	// Open opens (and creates) the access table in the instance database. It is the same
@@ -66,7 +70,17 @@ func (s Store) Get(repoID string) (ACL, error) {
	66	70	if err != nil {
	67	71	return nil, fmt.Errorf("access: %s: %w", repoID, err)
	68	72	}
	69		return a, nil
		73	return s.Attach(a), nil
		74	}
		75
		76	// Attach wires the roster's instance-role lookup into an ACL. It is exported for
		77	// the one path that has to build an empty rule set itself: a repository with no
		78	// row still needs the instance-wide rules to apply.
		79	func (s Store) Attach(a ACL) *ACL {
		80	if a != nil && s != nil {
		81	a.instanceRole = s.InstanceRole
		82	}
		83	return a
	70	84	}
	71	85
	72	86	// Set replaces a repository's rules. The row keeps who changed them and when, because