vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Add browser auth, contributor access, and gated CI
6c84d387e5f608360e30484a1a5b1cff41076850 · Keenan Nemetz · 16d ago · parent c36d5073
Add browser auth, contributor access, and gated CI Browser sign-in now uses passkeys. Enrollment links are one-time, sessions are hashed in users.db, and issue/comment/approval writes use the session account. HTTPS public_url is required for WebAuthn. Add the contributor role between read and maintain. Contributors can discuss and open change requests, and may push only refs/heads/contrib/<account-id>/. Contributor CI is held per commit until a maintainer allows the exact tip from the repository page. Rename the write role to maintain. write remains accepted as the historical spelling, and access.Write remains as a Go alias so existing callers and ACL rows keep working. Update the web, CLI, queue schema, and guides for the new flows, and cover the role, namespace, auth, and CI-gating paths in tests.
docs/cli.md +11−4
| @@ -50,7 +50,12 @@ See [Users and access](users-and-access.md#remote-administration). | |||
| 50 | 50 | ### Users | |
| 51 | 51 | ||
| 52 | 52 | ```sh | |
| 53 | vole admin user create --key <file|-> <name> | ||
| 53 | vole admin user create [--key <file|->] <name> | ||
| 54 | vole admin user invite <name|id> | ||
| 55 | vole admin user credentials <name|id> | ||
| 56 | vole admin user rm-credential <name|id> <credential-id> | ||
| 57 | vole admin user sessions <name|id> | ||
| 58 | vole admin user revoke-sessions [--all | <name|id>] | ||
| 54 | 59 | vole admin user add-key --key <file|-> <name|id> | |
| 55 | 60 | vole admin user rm-key <name|id> <fingerprint> | |
| 56 | 61 | vole admin user rename <name|id> <new-name> | |
| @@ -63,7 +68,9 @@ vole admin user backup <path> | |||
| 63 | 68 | vole whoami [--id] [--remote <name>] | |
| 64 | 69 | ``` | |
| 65 | 70 | ||
| 66 | `user backup` writes a file on the host, so it is local-only. | ||
| 71 | Omitting `--key` creates a browser-only account and prints a one-time enrollment | ||
| 72 | link. `user invite` issues a fresh link for an existing account. `user backup` | ||
| 73 | writes a file on the host, so it is local-only. | ||
| 67 | 74 | ||
| 68 | 75 | ### Repositories | |
| 69 | 76 | ||
| @@ -81,8 +88,8 @@ New repositories are private. The owner becomes the first admin. | |||
| 81 | 88 | ||
| 82 | 89 | ```sh | |
| 83 | 90 | vole admin acl show <repo> | |
| 84 | vole admin acl set <repo> <user> <none|read|write|admin> | ||
| 85 | vole admin acl default <repo> <none|read|write|admin> | ||
| 91 | vole admin acl set <repo> <user> <none|read|contributor|maintain|admin> | ||
| 92 | vole admin acl default <repo> <none|read|contributor|maintain|admin> | ||
| 86 | 93 | vole admin acl protect <repo> <ref-pattern>... | |
| 87 | 94 | vole admin acl approvals <repo> <n> | |
| 88 | 95 | vole admin acl checks <repo> <on|off> | |