vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Allow opt-in open registration

f920a9f12c4ff12e4f47497a084f0201d8914181 · Keenan Nemetz · 16d ago · parent 6c84d387

Allow opt-in open registration

Add open_registration, off by default and effective only with an HTTPS public_url. /register creates an account and its first passkey without an administrator; the account row is written only after the WebAuthn ceremony succeeds, so an abandoned registration reserves no name.

New accounts start with no repository-specific ACL entries. Add self-service SSH key management on the Account page so a registered contributor can add the key needed to push to their contributor namespace.

Cover registration enablement, name validation, deferred account creation, and self-service key add/remove in tests, and document the policy.

docs/users-and-access.md +18−4

@@ -47,18 +47,32 @@ key). It requires `public_url` to be an `https://` URL; Vole refuses to start a
	47	47	WebAuthn ceremony without a canonical secure origin.
	48	48
	49	49	1. An administrator creates the account and gives the person its one-time
	50		enrollment link.
	51		2. The person opens the link and registers a passkey.
		50	enrollment link, or the server has `open_registration = true` and the person
		51	creates the account at `/register`.
		52	2. The person registers a passkey.
	52	53	3. The passkey creates a browser session. The session cookie is HttpOnly and
	53	54	Secure; Vole stores only its hash.
	54		4. From Account, the person can register another passkey or review their
	55		sessions.
		55	4. From Account, the person can register another passkey, add or remove SSH
		56	keys, or review their sessions.
	56	57
	57	58	A link is single-use and expires. Issuing a new link invalidates the previous
	58	59	one. If the person loses every passkey, an administrator issues a new link; there
	59	60	is no password reset to phish. Retiring an account deletes its sessions
	60	61	immediately, and removing a passkey deletes the sessions that passkey created.
	61	62
		63	With `open_registration = true`, `/register` creates a new account and its first
		64	passkey without an administrator. New accounts have no repository-specific ACL
		65	entry; the repository's default role applies. For an open-source project, the
		66	usual setup is a public repository whose default role is `contributor`:
		67
		68	```sh
		69	vole admin acl default demo contributor
		70	```
		71
		72	A registered account can add its own SSH key from Account, which is what lets
		73	it push to `refs/heads/contrib/<account-id>/`. Open registration has no email
		74	verification, so leave it off on a private instance unless you want that policy.
		75
	62	76	Admins can inspect and revoke sessions:
	63	77
	64	78	```sh