Skip to content
Sign up

flagon-io/g1t

public
0
1,083 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

docs.g1t.sh, generated OpenAPI with an interactive reference, full footer1//! The identity service: accounts, sessions, SSH keys and access tokens.
2//!
3//! Reached only through service bindings; see `g1t_contracts::identity` for
4//! the methods and their arguments.
5
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look6mod access;
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)7mod account_deletion;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace8mod admin;
Merge branch 'worktree-agent-a8385d293d42c913a'9mod aliases;
Workspace names and icons, and a component kit for every control10mod avatars;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer11mod crypto;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look12mod deletion;
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca13mod deploy_keys;
Device sign-in replaces registering and minting tokens over the API14mod device;
Search across all of g1t, Explore, and a command palette15mod directory;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer16mod email;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look17mod emails;
18mod github;
19mod invites;
Merge main (membership, two-factor, GitHub repo roles) into tokens20mod members;
OAuth 2.1 sign-in for MCP clients and other applications21mod oauth;
Merge Stripe Tax, the card fee on card payments, and one free workspace per person22mod paid;
Agents and memory, checks and conflicts, profiles, slug renames, custom domains23mod profiles;
24mod rename;
Merge branch 'worktree-agent-a3abfcce648e87dca'25mod job_tokens;
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API26mod run_credentials;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look27mod security;
Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038)28mod shared_invites;
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar29mod teams;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look30mod throttle;
Fine-grained personal tokens, workspace token rules and approvals in identity31mod token_reach;
Agents as a team: lifecycle, merge queue, billing and a new shell32mod tokens;
Merge main (membership, two-factor, GitHub repo roles) into tokens33mod two_factor;
Workspaces own repositories34mod workspaces;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer35
36use g1t_contracts::identity::*;
RFC 3339 timestamps in identity and repos37use g1t_contracts::time::{SQL_NOW, rfc3339, sql_after};
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent38use g1t_contracts::{FailureCode, Outcome, User, Viewer, claimable_namespace, new_id};
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer39use g1t_kit::{args, now_ms, reply, rpc_method};
40use serde::Deserialize;
Agents as a team: lifecycle, merge queue, billing and a new shell41use tokens::TOKEN_PREFIX;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer42use worker::wasm_bindgen::JsValue;
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas43use worker::{Context, D1Database, Env, Request, Response, Result, ScheduleContext, ScheduledEvent, event};
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer44
RFC 3339 timestamps in identity and repos45const SESSION_TTL_SECONDS: u64 = 30 * 24 * 60 * 60;
46const RESET_TTL_SECONDS: u64 = 60 * 60;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer47const MIN_PASSWORD_LENGTH: usize = 10;
48const PASSWORD_TOO_SHORT: &str = "Use a password of at least 10 characters.";
49
50/// A user as selected from the database; `verified` arrives as 0 or 1.
51#[derive(Deserialize)]
52struct Account {
53 id: String,
54 username: String,
55 verified: u8,
Workspace names and icons, and a component kit for every control56 /// Selected only where the person is being shown to themselves.
57 #[serde(default)]
58 avatar: Option<String>,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer59}
60
61impl From<Account> for User {
62 fn from(row: Account) -> Self {
63 User {
64 id: row.id,
65 username: row.username,
66 verified: row.verified != 0,
Workspace names and icons, and a component kit for every control67 avatar: row.avatar,
Agents as a team: lifecycle, merge queue, billing and a new shell68 ..User::default()
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer69 }
70 }
71}
72
73#[derive(Deserialize)]
74struct UserRow {
75 id: String,
76 username: String,
77 password_hash: String,
78 verified: u8,
79}
80
81/// The owner of an emailed token.
82#[derive(Deserialize)]
83struct TokenOwner {
84 id: String,
85 username: String,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look86 /// The address a link was sent to; null on links from before accounts
87 /// had several, which are for the primary.
88 #[serde(default)]
89 email_id: Option<String>,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer90}
91
92#[derive(Deserialize)]
93struct KeyRow {
94 id: String,
95 title: String,
96 fingerprint: String,
RFC 3339 timestamps in identity and repos97 created_at: String,
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca98 #[serde(default)]
99 last_used_at: Option<String>,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer100}
101
102impl From<KeyRow> for SshKey {
103 fn from(row: KeyRow) -> Self {
104 SshKey {
105 id: row.id,
106 title: row.title,
107 fingerprint: row.fingerprint,
RFC 3339 timestamps in identity and repos108 created_at: row.created_at,
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca109 last_used_at: row.last_used_at,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer110 }
111 }
112}
113
114struct Identity {
115 db: D1Database,
116 env: Env,
117}
118
119impl Identity {
Workspaces own repositories120 /// Runs a query that returns at most one user, for showing to others:
121 /// without their workspaces.
122 async fn find_public_user(&self, sql: &str, param: &str) -> Result<Viewer> {
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer123 Ok(self
124 .db
125 .prepare(sql)
126 .bind(&[JsValue::from(param)])?
127 .first::<Account>(None)
128 .await?
129 .map(User::from))
130 }
131
Workspaces own repositories132 /// Attaches the workspaces a user belongs to, so that any service can
133 /// authorize them without asking again.
134 async fn with_workspaces(&self, user: Viewer) -> Result<Viewer> {
135 let Some(mut user) = user else {
136 return Ok(None);
137 };
Merge main (membership, two-factor, GitHub repo roles) into tokens138 let memberships = self.memberships_and_policies(&user.id).await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look139 // Roles on single repositories, under the same policy (access.rs).
140 let grants = self.grants_of(&user.id).await?;
Merge main (membership, two-factor, GitHub repo roles) into tokens141 // Access to a workspace is used only within its policy; see security.rs.
142 let within = self.within_policy(&user.id, memberships, grants).await?;
143 user.workspaces = within.memberships;
144 user.grants = within.grants;
145 user.held = within.held;
Workspaces own repositories146 Ok(Some(user))
147 }
148
149 /// Runs a query that resolves credentials to at most one user.
150 async fn find_user(&self, sql: &str, param: &str) -> Result<Viewer> {
151 let user = self.find_public_user(sql, param).await?;
152 self.with_workspaces(user).await
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer153 }
154
155 /// Consumes a token of `kind`, returning its owner if it was valid.
156 async fn redeem_email_token(&self, token: &str, kind: &str) -> Result<Option<TokenOwner>> {
157 let id = crypto::sha256_hex(token);
158 let owner = self
159 .db
RFC 3339 timestamps in identity and repos160 .prepare(format!(
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look161 "SELECT users.id, users.username, email_tokens.email_id FROM email_tokens
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer162 JOIN users ON users.id = email_tokens.user_id
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)163 WHERE email_tokens.id = ? AND email_tokens.kind = ? AND users.deleted_at IS NULL
RFC 3339 timestamps in identity and repos164 AND email_tokens.expires_at > {SQL_NOW}"
165 ))
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer166 .bind(&[id.as_str().into(), kind.into()])?
167 .first::<TokenOwner>(None)
168 .await?;
169 if let Some(owner) = &owner {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look170 // Every outstanding token of this kind dies with the one used:
171 // every reset link, and every confirmation link for the same
172 // address (another address's links still work).
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer173 self.db
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look174 .prepare(
175 "DELETE FROM email_tokens WHERE user_id = ?1 AND kind = ?2
176 AND (?2 = 'reset' OR email_id IS ?3)",
177 )
178 .bind(&[
179 owner.id.as_str().into(),
180 kind.into(),
181 owner.email_id.as_deref().map_or(JsValue::NULL, Into::into),
182 ])?
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer183 .run()
184 .await?;
185 }
186 Ok(owner)
187 }
188
189 async fn resend_verification(&self, a: UserArgs) -> Result<Outcome<bool>> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look190 if !self.allow(throttle::CONFIRM_ACCOUNT, &a.user.id).await? {
191 return Ok(Outcome::fail(FailureCode::Conflict, "Too many confirmation emails this hour. Check your inbox, or try again later."));
192 }
193 self.resend_primary(&a.user).await
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer194 }
195
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)196 /// The link in a confirmation email, followed: signed in or not. It
197 /// ends the code sent with it (emails.rs).
198 async fn verify_email(&self, a: EmailTokenArgs) -> Result<Outcome<g1t_contracts::accounts::EmailConfirmed>> {
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer199 let Some(owner) = self.redeem_email_token(&a.token, "verify").await? else {
200 return Ok(Outcome::fail(
201 FailureCode::Invalid,
202 "This confirmation link is not valid or has expired.",
203 ));
204 };
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)205 self.confirm_address(&owner.id, owner.email_id.as_deref()).await
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer206 }
207
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look208 /// Any confirmed address of an account can ask for a reset; so can the
209 /// unconfirmed address a new account signed up with. See emails.rs.
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer210 async fn request_password_reset(&self, a: EmailArgs) -> Result<bool> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look211 let allowed = self.allow(throttle::RESET_EMAIL, &a.email).await?
212 && match a.client.as_deref() {
213 Some(client) => self.allow(throttle::RESET_CLIENT, client).await?,
214 None => true,
215 };
216 if allowed && let Some(target) = self.reset_target(&a.email).await? {
Identity: a password reset for a known address that fails to save or send is logged, never answered, so the reply never says an account exists217 // A failure from here on happens only for a real account, so it
218 // is logged, never answered: the reply below stays the same.
219 if let Err(error) = self.send_reset(&target).await {
220 worker::console_error!("password reset for a known address failed: {error}");
221 }
222 }
223 // The same answer either way, so addresses cannot be probed.
224 Ok(true)
225 }
226
227 /// Saves a reset link for `target` and mails it, telling the account's
228 /// other addresses.
229 async fn send_reset(&self, target: &emails::ResetTarget) -> Result<()> {
230 {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look231 let token = crypto::random_hex(32);
232 self.db
233 .prepare(format!(
234 "INSERT INTO email_tokens (id, user_id, kind, expires_at, email_id)
235 VALUES (?, ?, 'reset', {}, ?)",
236 sql_after(RESET_TTL_SECONDS)
237 ))
238 .bind(&[
239 crypto::sha256_hex(&token).into(),
240 target.user_id.as_str().into(),
241 target.email_id.as_str().into(),
242 ])?
243 .run()
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer244 .await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look245 email::send_password_reset(&self.env, &target.display, &target.username, &token).await?;
246 // The primary and the backup hear of it when it went elsewhere.
247 let elsewhere = self.notice_recipients(&target.user_id, false).await?;
248 for address in elsewhere.iter().filter(|address| !address.eq_ignore_ascii_case(&target.display)) {
249 let change = format!("A password reset was asked for through {}", target.display);
250 if let Err(error) = email::send_security_notice(&self.env, address, &target.username, &change).await {
251 worker::console_error!("security notice failed: {error}");
252 }
253 }
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer254 }
Identity: a password reset for a known address that fails to save or send is logged, never answered, so the reply never says an account exists255 Ok(())
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer256 }
257
258 async fn reset_password(&self, a: ResetPasswordArgs) -> Result<Outcome<User>> {
259 if a.password.chars().count() < MIN_PASSWORD_LENGTH {
260 return Ok(Outcome::fail(FailureCode::Invalid, PASSWORD_TOO_SHORT));
261 }
262 let Some(owner) = self.redeem_email_token(&a.token, "reset").await? else {
263 return Ok(Outcome::fail(
264 FailureCode::Invalid,
265 "This reset link is not valid or has expired.",
266 ));
267 };
268 self.db
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look269 .prepare("UPDATE users SET password_hash = ? WHERE id = ?")
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer270 .bind(&[
271 crypto::hash_password(&a.password).into(),
272 owner.id.as_str().into(),
273 ])?
274 .run()
275 .await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look276 // Following an emailed link also proves the address it went to
277 // (unless another account confirmed it first).
278 let _ = self.confirm_address(&owner.id, owner.email_id.as_deref()).await?;
279 // Anyone signed in with the old password is signed out, and nobody
280 // stays locked out by the wrong guesses before it.
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer281 self.db
282 .prepare("DELETE FROM sessions WHERE user_id = ?")
283 .bind(&[owner.id.as_str().into()])?
284 .run()
285 .await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look286 self.clear(&throttle::key(throttle::PASSWORD_ACCOUNT, &owner.id)).await?;
287 self.log_security(&owner.id, "password_changed", None, None).await;
288 self.tell_primary_and_backup(&owner.id, &owner.username, "Your password was changed").await;
289 let verified = self
290 .find_public_user(
291 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE id = ?",
292 &owner.id,
293 )
294 .await?
295 .is_some_and(|user| user.verified);
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer296 Ok(Outcome::Ok(User {
297 id: owner.id,
298 username: owner.username,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look299 verified,
Workspaces own repositories300 ..User::default()
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer301 }))
302 }
303
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look304 /// The account a login names: a username, or any confirmed address.
305 async fn password_row(&self, login: &str) -> Result<Option<UserRow>> {
306 let login = login.trim().to_lowercase();
307 let (column, value) = if login.contains('@') {
308 match self.user_with_verified_email(&login).await? {
309 Some(id) => ("id", id),
310 None => return Ok(None),
311 }
312 } else {
313 ("username", login)
314 };
315 self.db
316 .prepare(format!(
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)317 "SELECT id, username, password_hash, email_verified_at IS NOT NULL AS verified FROM users
318 WHERE {column} = ? AND deleted_at IS NULL"
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look319 ))
320 .bind(&[JsValue::from(value)])?
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer321 .first::<UserRow>(None)
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look322 .await
323 }
324
325 /// Checks a password for a login, throttled (see throttle.rs). The
326 /// refusal is one of two messages, the same for every account.
327 async fn checked_password(
328 &self,
329 login: &str,
330 password: &str,
331 client: Option<&str>,
332 ) -> Result<std::result::Result<User, &'static str>> {
333 let row = self.password_row(login).await?;
334 let subject = row.as_ref().map_or_else(|| login.trim().to_lowercase(), |row| row.id.clone());
335 let (account_key, client_key) = Identity::password_keys(&subject, client);
336 if self.password_locked(&account_key, client_key.as_deref()).await? {
337 return Ok(Err(throttle::THROTTLED));
338 }
339 let owner = row.as_ref().map(|row| (row.id.clone(), row.username.clone()));
340 match row.filter(|row| !row.password_hash.is_empty() && crypto::verify_password(password, &row.password_hash)) {
341 Some(row) => {
342 self.clear(&account_key).await?;
343 Ok(Ok(User {
344 id: row.id,
345 username: row.username,
346 verified: row.verified != 0,
347 ..User::default()
348 }))
349 }
350 None => {
351 let owner = owner.as_ref().map(|(id, name)| (id.as_str(), name.as_str()));
352 self.password_failed(&account_key, client_key.as_deref(), owner).await?;
353 Ok(Err("Incorrect username or password."))
354 }
355 }
356 }
357
Merge main (membership, two-factor, GitHub repo roles) into tokens358 /// Git over HTTPS with the account's password. With two-factor
359 /// authentication on, a password alone is never enough: use an access
360 /// token (two_factor.rs).
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look361 async fn user_for_password(&self, login: &str, password: &str) -> Result<Viewer> {
362 let user = self.checked_password(login, password, None).await?.ok();
Merge main (membership, two-factor, GitHub repo roles) into tokens363 if let Some(user) = &user
364 && self.two_factor_enabled(&user.id).await?
365 {
366 return Ok(None);
367 }
Workspaces own repositories368 self.with_workspaces(user).await
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer369 }
370
371 async fn register(&self, a: RegisterArgs) -> Result<Outcome<SignedIn>> {
372 let username = a.username.trim().to_lowercase();
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent373 let claimable = claimable_namespace(&username).is_some();
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer374 let email = a.email.trim().to_lowercase();
375 let invalid = |message: &str| Ok(Outcome::fail(FailureCode::Invalid, message));
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look376 let invite_code = a.invite_code.as_deref().map(str::trim).filter(|code| !code.is_empty());
377 // The invite first: without one, nothing else on the form matters.
378 if self.invites_required() && invite_code.is_none() {
379 return Ok(Outcome::fail(FailureCode::Forbidden, invites::MISSING));
380 }
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent381 if !claimable {
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer382 return invalid(
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent383 "Usernames use lowercase letters, digits and single hyphens, up to 39 characters, and cannot be a reserved word.",
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer384 );
385 }
386 let well_formed_email = email
387 .split_once('@')
388 .is_some_and(|(local, domain)| !local.is_empty() && domain.contains('.'))
389 && !email.contains(char::is_whitespace);
390 if !well_formed_email {
391 return invalid("Enter a valid email address.");
392 }
393 if a.password.chars().count() < MIN_PASSWORD_LENGTH {
394 return invalid(PASSWORD_TOO_SHORT);
395 }
396 let taken = self
397 .db
Agents as a team: lifecycle, merge queue, billing and a new shell398 // Usernames and workspaces share one namespace, so that a name
399 // means the same thing wherever it appears.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look400 // An address is taken once an account has confirmed it; an
401 // unconfirmed one goes to whoever confirms it first (emails.rs).
Agents as a team: lifecycle, merge queue, billing and a new shell402 .prepare(
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look403 "SELECT username FROM users WHERE username = ?
404 UNION ALL SELECT email FROM user_emails WHERE email = ? AND verified_at IS NOT NULL
Agents as a team: lifecycle, merge queue, billing and a new shell405 UNION ALL SELECT slug FROM workspaces WHERE slug = ?",
406 )
407 .bind(&[
408 username.as_str().into(),
409 email.as_str().into(),
410 username.as_str().into(),
411 ])?
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer412 .first::<serde_json::Value>(None)
413 .await?;
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look414 // A renamed workspace's old slug stays reserved for it a while, and
415 // a deleted workspace's for good.
416 if taken.is_some() || self.slug_held(&username).await? || self.slug_deleted(&username).await? {
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer417 return Ok(Outcome::fail(
418 FailureCode::Conflict,
419 "That username or email is already registered.",
420 ));
421 }
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look422 let password_hash = crypto::hash_password(&a.password);
423 let user = match self
424 .create_account(invites::NewAccount {
425 username: &username,
426 email: &email,
427 password_hash: &password_hash,
428 verified: false,
429 invite_code,
Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm430 email_proof: a.email_proof.as_deref(),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look431 client: a.client.as_deref(),
432 })
433 .await?
434 {
435 Outcome::Ok(user) => user,
436 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer437 };
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)438 // The account exists either way; the email can be sent again from
439 // the confirmation page. It carries a code and a link (emails.rs).
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas440 if !user.verified
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)441 && let Err(error) = self.send_primary_confirmation(&user.id, &user.username).await
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas442 {
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)443 worker::console_error!("confirmation email failed: {error}");
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer444 }
445 self.start_session(user).await
446 }
447
448 async fn sign_in(&self, a: SignInArgs) -> Result<Outcome<SignedIn>> {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look449 let user = match self.checked_password(&a.username, &a.password, a.client.as_deref()).await? {
450 Ok(user) => user,
451 Err(message) => return Ok(Outcome::fail(FailureCode::Unauthenticated, message)),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer452 };
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look453 let user = self.with_workspaces(Some(user)).await?.unwrap_or_default();
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer454 self.start_session(user).await
455 }
456
Merge main (membership, two-factor, GitHub repo roles) into tokens457 /// Starts a session for someone who just proved their password (or
458 /// GitHub account). With two-factor authentication on, it starts none:
459 /// it returns a challenge for `two_factor_sign_in` (two_factor.rs).
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer460 async fn start_session(&self, user: User) -> Result<Outcome<SignedIn>> {
Merge main (membership, two-factor, GitHub repo roles) into tokens461 if self.two_factor_enabled(&user.id).await? {
462 let challenge = self.issue_challenge(&user.id).await?;
463 return Ok(Outcome::Ok(SignedIn {
464 user: User { workspaces: Vec::new(), grants: Vec::new(), held: Vec::new(), ..user },
465 session_token: String::new(),
466 two_factor_challenge: Some(challenge),
467 }));
468 }
469 self.session_for(user).await
470 }
471
472 /// A new session for `user`, who has proved who they are in full.
473 async fn session_for(&self, user: User) -> Result<Outcome<SignedIn>> {
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)474 // Whichever way it was proved, a deleted account starts none
475 // (account_deletion.rs).
476 if !self.account_live(&user.id).await? {
477 return Ok(Outcome::fail(FailureCode::Unauthenticated, "Incorrect username or password."));
478 }
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer479 let session_token = crypto::random_hex(32);
480 self.db
RFC 3339 timestamps in identity and repos481 .prepare(format!(
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look482 // Signing in is proof it is the person: see security.rs.
483 "INSERT INTO sessions (id, user_id, expires_at, authenticated_at) VALUES (?, ?, {}, {SQL_NOW})",
RFC 3339 timestamps in identity and repos484 sql_after(SESSION_TTL_SECONDS)
485 ))
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer486 .bind(&[
487 crypto::sha256_hex(&session_token).into(),
488 user.id.as_str().into(),
489 ])?
490 .run()
491 .await?;
492 Ok(Outcome::Ok(SignedIn {
493 user,
494 session_token,
Merge main (membership, two-factor, GitHub repo roles) into tokens495 two_factor_challenge: None,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer496 }))
497 }
498
499 async fn sign_out(&self, a: SessionArgs) -> Result<()> {
500 self.db
501 .prepare("DELETE FROM sessions WHERE id = ?")
502 .bind(&[crypto::sha256_hex(&a.session_token).into()])?
503 .run()
504 .await?;
505 Ok(())
506 }
507
508 async fn user_for_session(&self, a: SessionArgs) -> Result<Viewer> {
509 self.find_user(
RFC 3339 timestamps in identity and repos510 &format!(
Workspace names and icons, and a component kit for every control511 "SELECT users.id, users.username, users.email_verified_at IS NOT NULL AS verified,
512 users.avatar
RFC 3339 timestamps in identity and repos513 FROM sessions JOIN users ON users.id = sessions.user_id
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)514 WHERE sessions.id = ? AND sessions.expires_at > {SQL_NOW} AND users.deleted_at IS NULL"
RFC 3339 timestamps in identity and repos515 ),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer516 &crypto::sha256_hex(&a.session_token),
517 )
518 .await
519 }
520
521 async fn user_for_git_credentials(&self, a: GitCredentialsArgs) -> Result<Viewer> {
522 // Like GitHub, a token alone identifies its user.
523 if a.secret.starts_with(TOKEN_PREFIX) {
524 self.user_for_access_token(&a.secret).await
525 } else {
526 self.user_for_password(&a.username, &a.secret).await
527 }
528 }
529
530 async fn user_for_ssh_key(&self, a: FingerprintArgs) -> Result<Viewer> {
531 self.find_user(
532 "SELECT users.id, users.username, users.email_verified_at IS NOT NULL AS verified FROM ssh_keys
533 JOIN users ON users.id = ssh_keys.user_id
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)534 WHERE fingerprint = ? AND users.deleted_at IS NULL",
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer535 &a.fingerprint,
536 )
537 .await
538 }
539
540 async fn user_by_username(&self, a: UsernameArgs) -> Result<Viewer> {
Workspaces own repositories541 self.find_public_user(
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)542 // A deleted account is nobody's to find, mention or add.
543 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE username = ? AND deleted_at IS NULL",
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer544 &a.username.to_lowercase(),
545 )
546 .await
547 }
548
Inbox: threads, reasons, subscriptions and watching549 /// `notify_by_email`: an inbox item, emailed to the person it is for,
550 /// only at a confirmed address and only while they can still read the
551 /// repository it is about. Returns whether it was sent.
552 async fn notify_by_email(&self, a: g1t_contracts::inbox::NotifyByEmailArgs) -> Result<bool> {
553 #[derive(Deserialize)]
554 struct Address {
555 email: Option<String>,
556 }
557 let user = self
558 .find_user(
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)559 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE username = ? AND deleted_at IS NULL",
Inbox: threads, reasons, subscriptions and watching560 &a.username.to_lowercase(),
561 )
562 .await?;
563 let Some(user) = user.filter(|user| user.verified) else {
564 return Ok(false);
565 };
566 let readable: Vec<g1t_contracts::repos::Repo> = g1t_kit::call(
567 &self.env.service("REPOS")?,
568 "readable",
569 &g1t_contracts::repos::ReadableArgs {
570 ids: vec![a.repo_id.clone()],
571 viewer: Some(user.clone()),
572 },
573 )
574 .await?;
575 if readable.is_empty() {
576 return Ok(false);
577 }
578 let address = self
579 .db
580 .prepare("SELECT email FROM users WHERE id = ?")
581 .bind(&[user.id.as_str().into()])?
582 .first::<Address>(None)
583 .await?
584 .and_then(|row| row.email)
585 .filter(|email| !email.trim().is_empty());
586 let Some(address) = address else {
587 return Ok(false);
588 };
589 email::send_notification(&self.env, &address, &a).await?;
590 Ok(true)
591 }
592
What happened across an outcome, as a feed beside its graph593 async fn usernames(&self, a: UsernamesArgs) -> Result<std::collections::HashMap<String, String>> {
594 #[derive(serde::Deserialize)]
595 struct Named {
596 id: String,
597 name: String,
598 }
599 let ids: Vec<String> = a.ids.into_iter().take(200).collect();
600 let mut names = std::collections::HashMap::new();
601 if ids.is_empty() {
602 return Ok(names);
603 }
604 let marks = vec!["?"; ids.len()].join(", ");
605 let bind: Vec<worker::wasm_bindgen::JsValue> = ids.iter().map(|id| id.as_str().into()).collect();
606 for sql in [
607 format!("SELECT id, username AS name FROM users WHERE id IN ({marks})"),
608 format!("SELECT id, slug AS name FROM workspaces WHERE id IN ({marks})"),
609 ] {
610 for row in self.db.prepare(sql).bind(&bind)?.all().await?.results::<Named>()? {
611 names.insert(row.id, row.name);
612 }
613 }
614 Ok(names)
615 }
616
Merge the workspace shell: navigation and phone shell, g1t as orchestrator, agents in roles with audience-checked reads, reactions and custom emoji, live notifications and browser push, the homepage tour (agents 0002, chat 0002)617 /// `users_for_audience`: the people behind these ids (at most 50), each
618 /// with their workspaces, roles, base permissions and repository grants,
619 /// under each workspace's policy, as a signed-in viewer would have them.
620 /// For the agents service, which answers only with what every person
621 /// who will read the answer may see (docs/WORKSPACE.md, "What an agent
622 /// can and can't know"). Ids of no live account are left out, so the
623 /// caller can tell someone it could not resolve. Reached only by service
624 /// binding.
625 async fn users_for_audience(&self, a: UsernamesArgs) -> Result<Vec<User>> {
626 let mut found = Vec::new();
627 for id in a.ids.iter().take(50) {
628 let user = self
629 .find_user(
630 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE id = ? AND deleted_at IS NULL",
631 id,
632 )
633 .await?;
634 if let Some(user) = user {
635 found.push(user);
636 }
637 }
638 Ok(found)
639 }
640
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97641 /// `accounts`: the accounts behind these ids (at most 200), each with
642 /// its username and avatar, for lists that keep ids, such as who
643 /// starred a repository. Ids of no account are left out.
644 async fn accounts(&self, a: UsernamesArgs) -> Result<std::collections::HashMap<String, g1t_contracts::accounts::EmailOwner>> {
645 #[derive(serde::Deserialize)]
646 struct Row {
647 id: String,
648 username: String,
649 avatar: Option<String>,
650 }
651 let ids: Vec<String> = a.ids.into_iter().take(200).collect();
652 let mut found = std::collections::HashMap::new();
653 if ids.is_empty() {
654 return Ok(found);
655 }
656 let marks = vec!["?"; ids.len()].join(", ");
657 let bind: Vec<worker::wasm_bindgen::JsValue> = ids.iter().map(|id| id.as_str().into()).collect();
658 let rows = self
659 .db
660 .prepare(format!("SELECT id, username, avatar FROM users WHERE id IN ({marks})"))
661 .bind(&bind)?
662 .all()
663 .await?
664 .results::<Row>()?;
665 for row in rows {
666 found.insert(row.id.clone(), g1t_contracts::accounts::EmailOwner { id: row.id, username: row.username, avatar: row.avatar });
667 }
668 Ok(found)
669 }
670
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer671 async fn list_ssh_keys(&self, a: UserArgs) -> Result<Vec<SshKey>> {
672 let rows = self
673 .db
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca674 .prepare("SELECT id, title, fingerprint, created_at, last_used_at FROM ssh_keys WHERE user_id = ? ORDER BY id")
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer675 .bind(&[a.user.id.into()])?
676 .all()
677 .await?
678 .results::<KeyRow>()?;
679 Ok(rows.into_iter().map(SshKey::from).collect())
680 }
681
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge682 /// The account (user id) that registered each key, by fingerprint
683 /// (`SHA256:…`). At most 100; unknown keys are left out.
684 async fn ssh_key_owners(&self, a: SshKeyOwnersArgs) -> Result<std::collections::HashMap<String, String>> {
685 #[derive(serde::Deserialize)]
686 struct Row {
687 fingerprint: String,
688 user_id: String,
689 }
690 let fingerprints: Vec<&String> = a.fingerprints.iter().take(100).collect();
691 if fingerprints.is_empty() {
692 return Ok(std::collections::HashMap::new());
693 }
694 let marks = vec!["?"; fingerprints.len()].join(", ");
695 let binds: Vec<JsValue> = fingerprints.iter().map(|fingerprint| fingerprint.as_str().into()).collect();
696 Ok(self
697 .db
698 .prepare(format!("SELECT fingerprint, user_id FROM ssh_keys WHERE fingerprint IN ({marks})"))
699 .bind(&binds)?
700 .all()
701 .await?
702 .results::<Row>()?
703 .into_iter()
704 .map(|row| (row.fingerprint, row.user_id))
705 .collect())
706 }
707
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer708 async fn add_ssh_key(&self, a: AddSshKeyArgs) -> Result<Outcome<SshKey>> {
709 let Some(key) = crypto::parse_ssh_key(&a.public_key) else {
710 return Ok(Outcome::fail(
711 FailureCode::Invalid,
712 "That is not a valid OpenSSH public key.",
713 ));
714 };
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca715 // Someone's SSH key, or a repository's deploy key (deploy_keys.rs).
716 if self.key_in_use(&key.fingerprint).await? {
717 return Ok(Outcome::fail(FailureCode::Conflict, g1t_contracts::deploy_keys::KEY_IN_USE));
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer718 }
719 let now = now_ms();
720 let title = [a.title.trim(), key.comment.as_str(), "SSH key"]
721 .into_iter()
722 .find(|candidate| !candidate.is_empty())
723 .unwrap_or_default()
724 .to_owned();
725 let row = KeyRow {
726 id: new_id("key", now),
727 title,
728 fingerprint: key.fingerprint,
RFC 3339 timestamps in identity and repos729 created_at: rfc3339(now),
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca730 last_used_at: None,
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer731 };
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca732 let inserted = self.db
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer733 .prepare(
734 "INSERT INTO ssh_keys (id, user_id, title, public_key, fingerprint, created_at)
735 VALUES (?, ?, ?, ?, ?, ?)",
736 )
737 .bind(&[
738 row.id.as_str().into(),
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca739 a.user.id.as_str().into(),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer740 row.title.as_str().into(),
741 key.public_key.into(),
742 row.fingerprint.as_str().into(),
RFC 3339 timestamps in identity and repos743 row.created_at.as_str().into(),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer744 ])?
745 .run()
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca746 .await;
747 // Added at the same moment elsewhere: the trigger or the unique
748 // index refused it.
749 if let Err(error) = inserted {
750 if self.key_in_use(&row.fingerprint).await? {
751 return Ok(Outcome::fail(FailureCode::Conflict, g1t_contracts::deploy_keys::KEY_IN_USE));
752 }
753 return Err(error);
754 }
Merge main (membership, two-factor, GitHub repo roles) into tokens755 let shown = format!("{} ({})", row.title, row.fingerprint);
756 self.log_security(&a.user.id, "ssh_key_added", Some(&shown), None).await;
757 self.audit_account(&a.user, "ssh_key.added", &format!("Added SSH key {shown}")).await;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer758 Ok(Outcome::Ok(row.into()))
759 }
760
Merge main (membership, two-factor, GitHub repo roles) into tokens761 /// Deletes one of the person's SSH keys.
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca762 async fn remove_ssh_key(&self, a: RemoveArgs) -> Result<()> {
Merge main (membership, two-factor, GitHub repo roles) into tokens763 #[derive(Deserialize)]
764 struct Removed {
765 title: String,
766 fingerprint: String,
767 }
768 let removed = self
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca769 .db
Merge main (membership, two-factor, GitHub repo roles) into tokens770 .prepare("DELETE FROM ssh_keys WHERE id = ? AND user_id = ? RETURNING title, fingerprint")
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca771 .bind(&[a.id.as_str().into(), a.user.id.as_str().into()])?
Merge main (membership, two-factor, GitHub repo roles) into tokens772 .first::<Removed>(None)
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca773 .await?;
Merge main (membership, two-factor, GitHub repo roles) into tokens774 if let Some(removed) = removed {
775 let shown = format!("{} ({})", removed.title, removed.fingerprint);
776 self.log_security(&a.user.id, "ssh_key_removed", Some(&shown), None).await;
777 self.audit_account(&a.user, "ssh_key.removed", &format!("Removed SSH key {shown}")).await;
778 }
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer779 Ok(())
780 }
781}
782
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas783/// Every 15 minutes: staff hear about waitlist requests that arrived while
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member784/// the last summary's window was still open, so none waits on a later one;
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)785/// and deleted workspaces and accounts past their restore window are purged
786/// (deletion.rs, account_deletion.rs).
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas787#[event(scheduled)]
788async fn scheduled(_event: ScheduledEvent, env: Env, _ctx: ScheduleContext) {
789 let Ok(db) = env.d1("DB") else { return };
790 let identity = Identity { db, env };
791 if let Err(error) = identity.notify_staff_of_requests().await {
792 worker::console_error!("waitlist summary: {error}");
793 }
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member794 if let Err(error) = identity.purge_due_workspaces().await {
795 worker::console_error!("workspace purge: {error}");
796 }
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)797 // And deleted accounts past theirs (account_deletion.rs).
798 if let Err(error) = identity.purge_due_accounts().await {
799 worker::console_error!("account purge: {error}");
800 }
Merge main (membership, two-factor, GitHub repo roles) into tokens801 // Once: creators of repositories made before they got Admin (members.rs).
802 if let Err(error) = identity.backfill_creator_grants().await {
803 worker::console_error!("creator grants: {error}");
804 }
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas805}
806
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer807#[event(fetch)]
808async fn fetch(mut request: Request, env: Env, _ctx: Context) -> Result<Response> {
809 let Some(method) = rpc_method(&request) else {
810 return Response::error("Not found", 404);
811 };
Fast pages, required checks on the branch, self-hosted runners, honest incidents812 // A replica near the caller when it asks for one (crates/kit/src/d1.rs).
813 let (db, served) = g1t_kit::d1::open(&env, "DB", &request)?;
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer814 let body: serde_json::Value = request.json().await?;
Fast pages, required checks on the branch, self-hosted runners, honest incidents815 let identity = Identity { db, env };
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer816
Fast pages, required checks on the branch, self-hosted runners, honest incidents817 let answered = match method.as_str() {
Search across all of g1t, Explore, and a command palette818 "register" => {
819 let outcome = identity.register(args(body)?).await?;
820 if let Outcome::Ok(signed_in) = &outcome {
821 identity.announce_user(&signed_in.user.username, Some(&signed_in.user.id)).await;
822 }
823 reply(&outcome)
824 }
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer825 "sign_in" => reply(&identity.sign_in(args(body)?).await?),
Search across all of g1t, Explore, and a command palette826 "create_workspace" => {
827 let outcome = identity.create_workspace(args(body)?).await?;
828 if let Outcome::Ok(workspace) = &outcome {
829 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
830 }
831 reply(&outcome)
832 }
Workspaces own repositories833 "get_workspace" => reply(&identity.get_workspace(args(body)?).await?),
834 "list_members" => reply(&identity.list_members(args(body)?).await?),
835 "add_member" => reply(&identity.add_member(args(body)?).await?),
836 "remove_member" => reply(&identity.remove_member(args(body)?).await?),
Merge main (membership, two-factor, GitHub repo roles) into tokens837 // Owners, roles, leaving and member privileges; see members.rs.
838 "update_member" => reply(&identity.update_member(args(body)?).await?),
839 "transfer_ownership" => reply(&identity.transfer_ownership(args(body)?).await?),
840 "leave_workspace" => reply(&identity.leave_workspace(args(body)?).await?),
841 "set_member_privileges" => reply(&identity.set_member_privileges(args(body)?).await?),
842 "set_two_factor_requirement" => reply(&identity.set_two_factor_requirement(args(body)?).await?),
843 "grant_creator" => reply(&identity.grant_creator(args(body)?).await?),
Search across all of g1t, Explore, and a command palette844 "update_workspace" => {
845 let outcome = identity.update_workspace(args(body)?).await?;
846 if let Outcome::Ok(workspace) = &outcome {
847 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
848 }
849 reply(&outcome)
850 }
Agents and memory, checks and conflicts, profiles, slug renames, custom domains851 "rename_workspace" => reply(&identity.rename_workspace(args(body)?).await?),
852 "check_workspace_rename" => reply(&identity.check_workspace_rename(args(body)?).await?),
853 "resolve_slug" => reply(&identity.resolve_slug(args(body)?).await?),
Merge branch 'worktree-agent-a8385d293d42c913a'854 "resolve_alias" => reply(&identity.resolve_alias(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look855 "check_workspace_deletion" => reply(&identity.check_workspace_deletion(args(body)?).await?),
856 "delete_workspace" => reply(&identity.delete_workspace(args(body)?).await?),
857 "transfer_repo_scopes" => reply(&identity.transfer_repo_scopes(args(body)?).await?),
Search across all of g1t, Explore, and a command palette858 "set_workspace_avatar" => {
859 let outcome = identity.set_workspace_avatar(args(body)?).await?;
860 if let Outcome::Ok(workspace) = &outcome {
861 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
862 }
863 reply(&outcome)
864 }
865 "set_user_avatar" => {
866 let a: SetUserAvatarArgs = args(body)?;
867 let (username, id) = (a.user.username.clone(), a.user.id.clone());
868 let outcome = identity.set_user_avatar(a).await?;
869 if matches!(outcome, Outcome::Ok(_)) {
870 identity.announce_user(&username, Some(&id)).await;
871 }
872 reply(&outcome)
873 }
Agents as a team: lifecycle, merge queue, billing and a new shell874 "list_workspace_tokens" => reply(&identity.list_workspace_tokens(args(body)?).await?),
875 "create_workspace_token" => reply(&identity.create_workspace_token(args(body)?).await?),
876 "remove_workspace_token" => reply(&identity.remove_workspace_token(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look877 // Signing in with GitHub; see github.rs.
878 "github_enabled" => reply(&identity.github_enabled()),
879 "github_start" => reply(&identity.github_start(args(body)?).await?),
880 "github_finish" => reply(&identity.github_finish(args(body)?).await?),
881 "github_pending" => reply(&identity.github_pending(args(body)?).await?),
882 "github_sign_up" => reply(&identity.github_sign_up(args(body)?).await?),
883 "github_claim" => reply(&identity.github_claim(args(body)?).await?),
884 "github_account" => reply(&identity.github_account(args(body)?).await?),
885 "github_unlink" => reply(&identity.github_unlink(args(body)?).await?),
886 "github_user_token" => reply(&identity.github_user_token(args(body)?).await?),
887 "github_revoked" => reply(&identity.github_revoked(args(body)?).await?),
888 "github_usernames" => reply(&identity.github_usernames(args(body)?).await?),
OAuth 2.1 sign-in for MCP clients and other applications889 "oauth_authorize" => reply(&identity.oauth_authorize(args(body)?).await?),
890 "oauth_exchange" => reply(&identity.oauth_exchange(args(body)?).await?),
891 "oauth_refresh" => reply(&identity.oauth_refresh(args(body)?).await?),
892 "list_oauth_grants" => reply(&identity.list_oauth_grants(args(body)?).await?),
893 "revoke_oauth_grant" => reply(&identity.revoke_oauth_grant(args(body)?).await?),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step894 "update_oauth_grant" => reply(&identity.update_oauth_grant(args(body)?).await?),
Device sign-in replaces registering and minting tokens over the API895 "device_start" => reply(&identity.device_start(args(body)?).await?),
896 "device_lookup" => reply(&identity.device_lookup(args(body)?).await?),
897 "device_resolve" => reply(&identity.device_resolve(args(body)?).await?),
898 "device_claim" => reply(&identity.device_claim(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer899 "resend_verification" => reply(&identity.resend_verification(args(body)?).await?),
900 "verify_email" => reply(&identity.verify_email(args(body)?).await?),
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)901 "confirm_email_code" => reply(&identity.confirm_email_code(args(body)?).await?),
902 "change_pending_email" => reply(&identity.change_pending_email(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer903 "request_password_reset" => reply(&identity.request_password_reset(args(body)?).await?),
904 "reset_password" => reply(&identity.reset_password(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look905 // A person's email addresses; see emails.rs and security.rs.
906 "list_emails" => reply(&identity.list_emails(args(body)?).await?),
907 "add_email" => reply(&identity.add_email(args(body)?).await?),
908 "remove_email" => reply(&identity.remove_email(args(body)?).await?),
909 "resend_email_verification" => reply(&identity.resend_email_verification(args(body)?).await?),
910 "update_email_settings" => reply(&identity.update_email_settings(args(body)?).await?),
911 "reauthenticate" => reply(&identity.reauthenticate(args(body)?).await?),
Merge main (membership, two-factor, GitHub repo roles) into tokens912 // Two-factor authentication; see two_factor.rs.
913 "two_factor_status" => reply(&identity.two_factor_status(args(body)?).await?),
914 "two_factor_start" => reply(&identity.two_factor_start(args(body)?).await?),
915 "two_factor_enable" => reply(&identity.two_factor_enable(args(body)?).await?),
916 "two_factor_disable" => reply(&identity.two_factor_disable(args(body)?).await?),
917 "two_factor_recovery_codes" => reply(&identity.two_factor_recovery_codes(args(body)?).await?),
918 "two_factor_sign_in" => reply(&identity.two_factor_sign_in(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look919 "security_log" => reply(&identity.security_log(args(body)?).await?),
920 "email_owners" => reply(&identity.email_owners(args(body)?).await?),
921 "commit_identity" => reply(&identity.commit_identity(args(body)?).await?),
922 "push_email_guard" => reply(&identity.push_email_guard(args(body)?).await?),
923 "admin_user" => reply(&identity.admin_user(args(body)?).await?),
924 "admin_remove_email" => reply(&identity.admin_remove_email(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer925 "sign_out" => reply(&identity.sign_out(args(body)?).await?),
926 "user_for_session" => reply(&identity.user_for_session(args(body)?).await?),
927 "user_for_git_credentials" => reply(&identity.user_for_git_credentials(args(body)?).await?),
928 "user_for_access_token" => {
929 let a: TokenArgs = args(body)?;
930 reply(&identity.user_for_access_token(&a.token).await?)
931 }
932 "user_for_ssh_key" => reply(&identity.user_for_ssh_key(args(body)?).await?),
933 "user_by_username" => reply(&identity.user_by_username(args(body)?).await?),
What happened across an outcome, as a feed beside its graph934 "usernames" => reply(&identity.usernames(args(body)?).await?),
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97935 "accounts" => reply(&identity.accounts(args(body)?).await?),
Merge the workspace shell: navigation and phone shell, g1t as orchestrator, agents in roles with audience-checked reads, reactions and custom emoji, live notifications and browser push, the homepage tour (agents 0002, chat 0002)936 "users_for_audience" => reply(&identity.users_for_audience(args(body)?).await?),
Inbox: threads, reasons, subscriptions and watching937 "notify_by_email" => reply(&identity.notify_by_email(args(body)?).await?),
Agents and memory, checks and conflicts, profiles, slug renames, custom domains938 "profile" => reply(&identity.profile(args(body)?).await?),
Search across all of g1t, Explore, and a command palette939 "update_profile" => {
940 let outcome = identity.update_profile(args(body)?).await?;
941 if let Outcome::Ok(profile) = &outcome {
942 identity.announce_user(&profile.username, None).await;
943 }
944 reply(&outcome)
945 }
946 "directory" => reply(&identity.directory(args(body)?).await?),
Agents and memory, checks and conflicts, profiles, slug renames, custom domains947 "profile_workspaces" => reply(&identity.profile_workspaces(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer948 "list_ssh_keys" => reply(&identity.list_ssh_keys(args(body)?).await?),
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge949 // Services only: who registered each key, for verifying commit
950 // signatures (repos' signatures.rs).
951 "ssh_key_owners" => reply(&identity.ssh_key_owners(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer952 "add_ssh_key" => reply(&identity.add_ssh_key(args(body)?).await?),
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca953 "remove_ssh_key" => reply(&identity.remove_ssh_key(args(body)?).await?),
954 // A repository's deploy keys, and who an SSH key signs in as; see
955 // deploy_keys.rs.
956 "list_deploy_keys" => reply(&identity.list_deploy_keys(args(body)?).await?),
957 "get_deploy_key" => reply(&identity.get_deploy_key(args(body)?).await?),
958 "add_deploy_key" => reply(&identity.add_deploy_key(args(body)?).await?),
959 "remove_deploy_key" => reply(&identity.remove_deploy_key(args(body)?).await?),
960 "principal_for_ssh_key" => reply(&identity.principal_for_ssh_key(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer961 "list_access_tokens" => reply(&identity.list_access_tokens(args(body)?).await?),
962 "create_access_token" => reply(&identity.create_access_token(args(body)?).await?),
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step963 "update_access_token" => reply(&identity.update_access_token(args(body)?).await?),
Fine-grained personal tokens, workspace token rules and approvals in identity964 // Fine-grained tokens and workspaces' rules for tokens; see token_reach.rs.
965 "create_fine_grained_token" => reply(&identity.create_fine_grained_token(args(body)?).await?),
966 "update_fine_grained_token" => reply(&identity.update_fine_grained_token(args(body)?).await?),
967 "get_token_policy" => reply(&identity.get_token_policy(args(body)?).await?),
968 "set_token_policy" => reply(&identity.set_token_policy(args(body)?).await?),
969 "list_member_tokens" => reply(&identity.list_member_tokens(args(body)?).await?),
970 "review_token_request" => reply(&identity.review_token_request(args(body)?).await?),
971 "revoke_member_token" => reply(&identity.revoke_member_token(args(body)?).await?),
Agents as a team: lifecycle, merge queue, billing and a new shell972 "create_agent_token" => reply(&identity.create_agent_token(args(body)?).await?),
973 "agent_scope" => reply(&identity.agent_scope(args(body)?).await?),
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API974 "create_run_credential" => reply(&identity.create_run_credential(args(body)?).await?),
975 "bind_run_credentials" => reply(&identity.bind_run_credentials(args(body)?).await?),
976 "revoke_run_credentials" => reply(&identity.revoke_run_credentials(args(body)?).await?),
Merge branch 'worktree-agent-a3abfcce648e87dca'977 "create_job_token" => reply(&identity.create_job_token(args(body)?).await?),
978 "revoke_job_tokens" => reply(&identity.revoke_job_tokens(args(body)?).await?),
Merge main (membership, two-factor, GitHub repo roles) into tokens979 "remove_access_token" => reply(&identity.remove_access_token(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look980 // Invites and the waitlist; see invites.rs.
981 "registration" => reply(&identity.registration_mode()),
982 "list_invites" => reply(&identity.list_invites(args(body)?).await?),
983 "create_invite" => reply(&identity.create_invite(args(body)?).await?),
984 "revoke_invite" => reply(&identity.revoke_invite(args(body)?).await?),
985 "check_invite" => reply(&identity.check_invite(args(body)?).await?),
986 "accept_invite" => reply(&identity.accept_invite(args(body)?).await?),
987 "invite_member" => reply(&identity.invite_member(args(body)?).await?),
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)988 "list_invitations" => reply(&identity.list_invitations(args(body)?).await?),
989 "accept_invitation" => reply(&identity.accept_invitation(args(body)?).await?),
990 "decline_invitation" => reply(&identity.decline_invitation(args(body)?).await?),
991 "find_people" => reply(&identity.find_people(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look992 "workspace_invites" => reply(&identity.workspace_invites(args(body)?).await?),
993 "revoke_workspace_invite" => reply(&identity.revoke_workspace_invite(args(body)?).await?),
994 "request_access" => reply(&identity.request_access(args(body)?).await?),
995 // Who has access to a repository; see access.rs.
996 "repo_access" => reply(&identity.repo_access(args(body)?).await?),
997 "add_collaborator" => reply(&identity.add_collaborator(args(body)?).await?),
998 "set_collaborator_role" => reply(&identity.set_collaborator_role(args(body)?).await?),
999 "remove_collaborator" => reply(&identity.remove_collaborator(args(body)?).await?),
1000 "collaborator_permission" => reply(&identity.collaborator_permission(args(body)?).await?),
1001 "my_repo_invitations" => reply(&identity.my_repo_invitations(args(body)?).await?),
1002 "respond_repo_invitation" => reply(&identity.respond_repo_invitation(args(body)?).await?),
1003 "revoke_repo_invitation" => reply(&identity.revoke_repo_invitation(args(body)?).await?),
1004 "set_base_permission" => reply(&identity.set_base_permission(args(body)?).await?),
Merge branch 'worktree-agent-a2013627e5ea4ab13'1005 // Where a workspace keeps its repositories' git data (EU residency).
1006 "workspace_residency" => reply(&identity.workspace_residency(args(body)?).await?),
1007 "set_workspace_residency" => reply(&identity.set_workspace_residency(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1008 "outside_collaborators" => reply(&identity.outside_collaborators(args(body)?).await?),
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca1009 "forget_repo_access" => {
1010 let a: g1t_contracts::access::ForgetRepoAccessArgs = args(body)?;
1011 // A purged repository's deploy keys go with its access.
1012 identity.forget_deploy_keys(&a.repo_id).await?;
1013 reply(&identity.forget_repo_access(a).await?)
1014 }
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1015 // Teams (teams.rs).
1016 "list_teams" => reply(&identity.list_teams(args(body)?).await?),
1017 "get_team" => reply(&identity.get_team(args(body)?).await?),
1018 "create_team" => reply(&identity.create_team(args(body)?).await?),
Merge branch 'worktree-agent-ad7c6d88d93adc817'1019 "set_team_creation" => reply(&identity.set_team_creation(args(body)?).await?),
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1020 "update_team" => reply(&identity.update_team(args(body)?).await?),
1021 "delete_team" => reply(&identity.delete_team(args(body)?).await?),
1022 "team_members" => reply(&identity.team_members(args(body)?).await?),
1023 "set_team_member" => reply(&identity.set_team_member(args(body)?).await?),
1024 "remove_team_member" => reply(&identity.remove_team_member(args(body)?).await?),
1025 "child_teams" => reply(&identity.child_teams(args(body)?).await?),
1026 "team_repos" => reply(&identity.team_repos(args(body)?).await?),
1027 "set_team_repo" => reply(&identity.set_team_repo(args(body)?).await?),
1028 "remove_team_repo" => reply(&identity.remove_team_repo(args(body)?).await?),
1029 "user_teams" => reply(&identity.user_teams(args(body)?).await?),
1030 "team_memberships" => reply(&identity.team_memberships(args(body)?).await?),
1031 "resolve_teams" => reply(&identity.resolve_teams(args(body)?).await?),
1032 "resolve_owners" => reply(&identity.resolve_owners(args(body)?).await?),
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace1033 // Staff only: sudo.g1t.sh, over its service binding. See admin.rs.
1034 "notify_owners" => reply(&identity.notify_owners(args(body)?).await?),
1035 "admin_workspaces" => reply(&identity.admin_workspaces(args(body)?).await?),
1036 "admin_workspace" => reply(&identity.admin_workspace(args(body)?).await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1037 "admin_waitlist" => reply(&identity.admin_waitlist(args(body)?).await?),
1038 "admin_decide_waitlist" => reply(&identity.admin_decide_waitlist(args(body)?).await?),
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1039 "admin_waitlist_pending" => reply(&identity.admin_waitlist_pending().await?),
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1040 "admin_invites" => reply(&identity.admin_invites(args(body)?).await?),
1041 "admin_revoke_invite" => reply(&identity.admin_revoke_invite(args(body)?).await?),
1042 "admin_mint_invite" => reply(&identity.admin_mint_invite(args(body)?).await?),
1043 "admin_grant_invites" => reply(&identity.admin_grant_invites(args(body)?).await?),
1044 "admin_invite_tree" => reply(&identity.admin_invite_tree(args(body)?).await?),
1045 "admin_workspace_invites" => reply(&identity.admin_workspace_invites(args(body)?).await?),
Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038)1046 // Shared invite links for a group; see shared_invites.rs.
1047 "admin_shared_invites" => reply(&identity.admin_shared_invites().await?),
1048 "admin_create_shared_invite" => reply(&identity.admin_create_shared_invite(args(body)?).await?),
1049 "admin_revoke_shared_invite" => reply(&identity.admin_revoke_shared_invite(args(body)?).await?),
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1050 // Deleted workspaces, restored or purged by staff; see deletion.rs.
1051 "admin_deleted_workspaces" => reply(&identity.admin_deleted_workspaces().await?),
1052 "admin_restore_workspace" => reply(&identity.admin_restore_workspace(args(body)?).await?),
1053 "admin_purge_workspace" => reply(&identity.admin_purge_workspace(args(body)?).await?),
Merge account deletion: soft delete for 30 days, staff restore and purge, ghost for what remains (identity 0037)1054 // Deleting accounts (account_deletion.rs): the person from the
1055 // site, staff from sudo. There is no API route for it.
1056 "check_account_deletion" => reply(&identity.check_account_deletion(args(body)?).await?),
1057 "delete_account" => reply(&identity.delete_account(args(body)?).await?),
1058 "admin_delete_account" => reply(&identity.admin_delete_account(args(body)?).await?),
1059 "admin_deleted_accounts" => reply(&identity.admin_deleted_accounts().await?),
1060 "admin_restore_account" => reply(&identity.admin_restore_account(args(body)?).await?),
1061 "admin_purge_account" => reply(&identity.admin_purge_account(args(body)?).await?),
Merge branch 'worktree-agent-a8385d293d42c913a'1062 // Workspace aliases, set by staff only; see aliases.rs.
1063 "admin_aliases" => reply(&identity.admin_aliases().await?),
1064 "admin_set_alias" => reply(&identity.admin_set_alias(args(body)?).await?),
1065 "admin_remove_alias" => reply(&identity.admin_remove_alias(args(body)?).await?),
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer1066 _ => Response::error("Unknown method", 404),
Fast pages, required checks on the branch, self-hosted runners, honest incidents1067 };
1068 served.finish(answered)
docs.g1t.sh, generated OpenAPI with an interactive reference, full footer1069}
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent1070
1071#[cfg(test)]
1072mod register_tests {
1073 use super::*;
1074
1075 #[test]
1076 fn nobody_registers_as_g1t() {
1077 // What register checks the username with, whatever its case.
1078 for username in ["g1t", "G1T", "g1t-agent", "G1t-Agent"] {
1079 assert_eq!(claimable_namespace(username), None, "{username}");
1080 }
1081 assert_eq!(claimable_namespace("ana").as_deref(), Some("ana"));
1082 }
1083}

This file's history is long; its oldest lines are credited to the oldest commit read.