vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add instance-wide roles and refine access UI

5b814e9958090cfd1fa826efb2d375bf613547c1 · Keenan Nemetz · 14d ago · parent 9579c1f9

Add instance-wide roles and refine access UI

Instance roles now live on accounts, apply to public repositories, and the Admin role is the unified instance-admin permission with access to every repository. Repository ACLs can raise an instance role but not lower it.

Adds role assignment to the users UI and CLI, open-registration role config, a reusable role picker, and separates adding a repository account from saving access rules.

server/web/templates/admin_users.html +15−12

@@ -19,7 +19,7 @@
	19	19	<a href="/users/{{.Account.Name}}">{{.Account.Name}}</a>
	20	20	</td>
	21	21	<td><span class="state {{.Account.Status}}">{{.Account.Status}}</span></td>
	22		<td>{{if .Account.Admin}}<span class="label">instance admin</span>{{else}}<span class="muted">account</span>{{end}}</td>
		22	<td>{{if .Account.Admin}}<span class="label">instance admin</span>{{else}}<span class="muted">{{.Account.Role}}</span>{{end}}</td>
	23	23	<td>{{len .Account.Keys}}</td>
	24	24	<td>{{.Sessions}}</td>
	25	25	<td><a href="/users/{{.Account.Name}}">Manage</a></td>
@@ -36,6 +36,7 @@
	36	36	<label>Account name
	37	37	<input type="text" name="name" required maxlength="63" autocomplete="off" placeholder="lowercase-name">
	38	38	</label>
		39	{{template "role-picker" (rolePicker "role" "none" "Instance role" "Instance roles apply to public repositories; admin applies everywhere." "instance" false)}}
	39	40	</div>
	40	41	<div class="form-actions"><button type="submit">{{icon "user"}}Create invite</button></div>
	41	42	</form>
@@ -49,21 +50,11 @@
	49	50	<h1>{{.Account.Name}}</h1>
	50	51	<p class="page-sub">
	51	52	<span class="state {{.Account.Status}}">{{.Account.Status}}</span>
	52		{{if .Account.Admin}}· instance admin{{end}}
		53	· instance role {{.Account.Role}}
	53	54	· created {{since .Account.Created.Unix}}
	54	55	</p>
	55	56	</div>
	56	57	<div class="page-head-actions">
	57		<form class="inline" method="post" action="/users/{{.Account.Name}}/admin">
	58		<input type="hidden" name="csrf" value="{{.CSRF}}">
	59		{{if .Account.Admin}}
	60		<input type="hidden" name="admin" value="false">
	61		<button type="submit" class="secondary">{{icon "user"}}Revoke instance admin</button>
	62		{{else}}
	63		<input type="hidden" name="admin" value="true">
	64		<button type="submit" class="secondary">{{icon "user"}}Grant instance admin</button>
	65		{{end}}
	66		</form>
	67	58	<form class="inline" method="post" action="/users/{{.Account.Name}}/invite">
	68	59	<input type="hidden" name="csrf" value="{{.CSRF}}">
	69	60	<button type="submit" class="secondary">{{icon "external-link"}}New enrollment link</button>
@@ -73,6 +64,18 @@
	73	64
	74	65	{{if .Error}}<div class="flash bad">{{.Error}}</div>{{end}}
	75	66
		67	<h2>Instance role</h2>
		68	{{$role := .Account.Role.String}}
		69	<form method="post" action="/users/{{.Account.Name}}/role" class="form-block">
		70	<input type="hidden" name="csrf" value="{{.CSRF}}">
		71	<div class="card form-card">
		72	{{template "role-picker" (rolePicker "role" $role (printf "Role for %s" .Account.Name) "Instance roles apply to public repositories. A repository-specific role can grant more on one repository. admin is the exception: it applies to every repository, private ones included." "instance" false)}}
		73	</div>
		74	<div class="form-actions">
		75	<button type="submit">{{icon "check"}}Save role</button>
		76	</div>
		77	</form>
		78
	76	79	<h2>SSH keys</h2>
	77	80	{{if .Account.Keys}}
	78	81	<div class="panel">