Skip to content
Sign up

flagon-io/g1t

public
0
296 linesCodeBlameRaw
1//! Types and service interfaces shared by every g1t service.
2//!
3//! Each service has a module here holding the data it exchanges and the
4//! arguments of each of its methods. Services and their callers depend on
5//! this crate, never on each other's code.
6
7pub mod about;
8pub mod access;
9pub mod advisories;
10pub mod account_deletion;
11pub mod accounts;
12pub mod actions;
13pub mod agents;
14pub mod audit;
15pub mod backups;
16pub mod billing;
17pub mod checks;
18pub mod codeowners;
19pub mod coding_agents;
20pub mod credentials;
21pub mod datasets;
22pub mod decisions;
23pub mod deploy_keys;
24pub mod events;
25pub mod folios;
26pub mod github;
27pub mod guardrails;
28pub mod identity;
29pub mod inbox;
30pub mod live;
31pub mod integrations;
32pub mod members;
33mod ids;
34mod names;
35mod outcome;
36pub mod packages;
37pub mod people;
38pub mod projects;
39pub mod repos;
40pub mod rules;
41pub mod runners;
42pub mod scopes;
43pub mod search;
44pub mod security;
45pub mod teams;
46pub mod security_suite;
47pub mod subscribers;
48pub mod time;
49pub mod tokens;
50pub mod updates;
51pub mod webhooks;
52pub mod work;
53
54pub use ids::{id_floor, new_id};
55pub use names::{
56 Username, aliasable_name, claimable_namespace, is_action_owner_name, is_claimable_name, claimable_username, is_namespace_shaped, is_reserved_name, is_route_name,
57 is_valid_namespace, is_valid_repo_name,
58};
59pub use outcome::{Failure, FailureCode, Outcome};
60
61use serde::{Deserialize, Serialize};
62
63/// What a member may do in a workspace. A member may also hold
64/// [`members::OrgRole`]s, which add to it.
65#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
66#[serde(rename_all = "lowercase")]
67pub enum Role {
68 /// Everything: Admin on every repository, the workspace's members,
69 /// settings, billing and security.
70 Owner,
71 /// The workspace's base permission on each repository, and what its
72 /// member privileges allow (see [`members::MemberPrivileges`]).
73 Member,
74}
75
76pub use members::{MemberPrivileges, OrgRole};
77
78/// One workspace a user belongs to.
79#[derive(Clone, Debug, Serialize, Deserialize)]
80pub struct Membership {
81 /// The workspace's name in URLs: `g1t.sh/<slug>`.
82 pub slug: String,
83 pub role: Role,
84 /// The workspace's display name, for showing it to people. Set when a
85 /// user is resolved from credentials; absent on principals made up by
86 /// a service.
87 #[serde(default, skip_serializing_if = "Option::is_none")]
88 pub name: Option<String>,
89 /// The workspace's uploaded icon: the SHA-256 of its bytes, served at
90 /// `/avatars/<avatar>`. Absent means the generated letter avatar.
91 #[serde(default, skip_serializing_if = "Option::is_none")]
92 pub avatar: Option<String>,
93 /// What a member gets on each of the workspace's repositories: the
94 /// workspace's base permission. Set when a user is resolved from
95 /// credentials; absent means the default, Write. Owners have Admin
96 /// whatever it says. See [`access`].
97 #[serde(default, skip_serializing_if = "Option::is_none")]
98 pub base_permission: Option<access::BasePermission>,
99 /// Who may create the workspace's teams. Set when a user is resolved
100 /// from credentials; absent means the default, any member. See
101 /// [`teams::TeamCreation`].
102 #[serde(default, skip_serializing_if = "Option::is_none")]
103 pub team_creation: Option<teams::TeamCreation>,
104 /// The roles the member holds besides `role`: billing manager,
105 /// security manager. Set when a user is resolved from credentials.
106 #[serde(default, skip_serializing_if = "Vec::is_empty")]
107 pub org_roles: Vec<OrgRole>,
108 /// What the workspace lets members (and repository admins) do. Set
109 /// when a user is resolved from credentials; absent means the
110 /// defaults. See [`members::MemberPrivileges`].
111 #[serde(default, skip_serializing_if = "Option::is_none")]
112 pub privileges: Option<MemberPrivileges>,
113}
114
115impl Membership {
116 /// A plain member of `slug`, as services act inside one workspace.
117 pub fn member(slug: impl Into<String>) -> Self {
118 Membership {
119 slug: slug.into(),
120 role: Role::Member,
121 name: None,
122 avatar: None,
123 base_permission: None,
124 team_creation: None,
125 org_roles: Vec::new(),
126 privileges: None,
127 }
128 }
129
130 /// Whether the member holds `role` besides owner or member.
131 pub fn has(&self, role: OrgRole) -> bool {
132 self.org_roles.contains(&role)
133 }
134}
135
136/// What a set of credentials resolved to.
137#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
138#[serde(rename_all = "lowercase")]
139pub enum PrincipalKind {
140 /// A person's account.
141 #[default]
142 User,
143 /// A workspace, acting through one of its own access tokens. Its `id`
144 /// is the workspace's, its `username` the workspace's slug, and it is a
145 /// member of that workspace and no other.
146 Workspace,
147 /// A run's token: a sandbox g1t started (checks, the merge queue, a
148 /// merge check), acting through a token that lives as long as its run
149 /// and can do only what that token's scope lists, in one repository.
150 /// Its `username` is `g1t`. g1t no longer runs agents of its own; the
151 /// name stays because identity still issues run credentials with it and
152 /// historical rows written by `@g1t`'s agent were recorded as it.
153 Agent,
154 /// g1t itself: the platform acting on its own, as when it opens a
155 /// pull request to upgrade a vulnerable dependency or merges from the
156 /// queue. Never resolved from credentials: only services make one,
157 /// with [`User::system`]. Its `username` is `g1t`, which nobody can
158 /// register.
159 System,
160}
161
162/// g1t's own identity, as [`PrincipalKind::System`] work is recorded.
163pub mod system {
164 /// Its id wherever an author or actor id is stored.
165 pub const ID: &str = "g1t";
166 /// Its name, shown as the author of what it does.
167 pub const USERNAME: &str = "g1t";
168 /// The address on the commits it makes, which no mailbox receives.
169 pub const EMAIL: &str = "g1t@users.noreply.g1t.sh";
170 /// Ids that earlier versions stored for g1t's own actions, such as a
171 /// merge its settings made. Read as g1t too.
172 pub const LEGACY_IDS: [&str; 3] = ["g1t_policy", "svc_runner", "g1t_runner"];
173
174 /// Whether `id` is g1t's own.
175 pub fn is_system_id(id: &str) -> bool {
176 id == ID || LEGACY_IDS.contains(&id)
177 }
178}
179
180#[derive(Clone, Debug, Default, Serialize, Deserialize)]
181pub struct User {
182 pub id: String,
183 /// Lowercased: what the person is found, linked and mentioned by.
184 pub username: String,
185 /// The username as its owner wrote it (`Ana`), when that differs from
186 /// `username`: what pages show. Set on the signed-in person and on
187 /// people looked up by name; absent elsewhere, where `username` is shown.
188 #[serde(default, skip_serializing_if = "Option::is_none")]
189 pub display_username: Option<String>,
190 #[serde(default)]
191 pub kind: PrincipalKind,
192 /// Whether the account's email address has been confirmed. Unverified
193 /// accounts can sign in but cannot create or change anything.
194 #[serde(default)]
195 pub verified: bool,
196 /// The workspaces this user belongs to. Filled in when a user is
197 /// resolved from credentials, so any service can authorize from it.
198 #[serde(default)]
199 pub workspaces: Vec<Membership>,
200 /// The person's uploaded avatar: the SHA-256 of its bytes, served at
201 /// `/avatars/<avatar>`. Absent means the generated letter avatar.
202 #[serde(default, skip_serializing_if = "Option::is_none")]
203 pub avatar: Option<String>,
204 /// Set on an agent resolved from its token: who it acts for, with which
205 /// credential, and what it may do. See [`credentials`].
206 #[serde(default, skip_serializing_if = "Option::is_none")]
207 pub acting: Option<Box<credentials::Acting>>,
208 /// The repositories this user has been given a role on directly,
209 /// whether or not they belong to its workspace. Filled in with
210 /// `workspaces`; see [`access`].
211 #[serde(default, skip_serializing_if = "Vec::is_empty")]
212 pub grants: Vec<access::RepoGrant>,
213 /// Set on a user resolved from an access token: its scopes and the
214 /// workspaces or repositories it is limited to. Absent on a signed-in
215 /// session and on an agent (whose `acting` scope applies instead).
216 /// See [`scopes`].
217 #[serde(default, skip_serializing_if = "Option::is_none")]
218 pub token: Option<Box<scopes::TokenAccess>>,
219 /// The workspaces this person belongs to but cannot use until they
220 /// meet its policy, such as turning on two-factor authentication.
221 /// They are left out of `workspaces` and `grants` meanwhile. Set when
222 /// a person is resolved from a session.
223 #[serde(default, skip_serializing_if = "Vec::is_empty")]
224 pub held: Vec<members::PolicyHold>,
225}
226
227impl User {
228 /// g1t itself, acting in `workspace`: what the platform's own work,
229 /// such as security updates, is done and recorded as.
230 pub fn system(workspace: &str) -> User {
231 User {
232 id: system::ID.to_owned(),
233 username: system::USERNAME.to_owned(),
234 kind: PrincipalKind::System,
235 verified: true,
236 workspaces: vec![Membership::member(workspace.to_lowercase())],
237 ..User::default()
238 }
239 }
240
241 /// Whether this is g1t itself.
242 pub fn is_system(&self) -> bool {
243 self.kind == PrincipalKind::System
244 }
245
246 /// Whether this is a person whose account has not confirmed its email
247 /// address. Such an account can only confirm it (or change it, or sign
248 /// out): the site, the API, MCP and git refuse it everything else
249 /// ([`accounts::confirm_email_first`]).
250 pub fn awaits_confirmation(&self) -> bool {
251 self.kind == PrincipalKind::User && !self.verified
252 }
253
254 pub fn role_in(&self, slug: &str) -> Option<Role> {
255 self.workspaces
256 .iter()
257 .find(|membership| membership.slug == slug)
258 .map(|membership| membership.role)
259 }
260
261 pub fn is_member(&self, slug: &str) -> bool {
262 self.role_in(slug).is_some()
263 }
264
265 /// The membership in `slug`, if any.
266 pub fn membership(&self, slug: &str) -> Option<&Membership> {
267 self.workspaces.iter().find(|membership| membership.slug.eq_ignore_ascii_case(slug))
268 }
269
270 /// Whether this is a person who owns `slug`, or holds `role` in it.
271 pub fn owns_or_has(&self, slug: &str, role: OrgRole) -> bool {
272 self.membership(slug)
273 .is_some_and(|membership| membership.role == Role::Owner || membership.has(role))
274 }
275
276 /// Whether the user may manage `slug`'s billing: an owner or a billing
277 /// manager.
278 pub fn manages_billing(&self, slug: &str) -> bool {
279 self.owns_or_has(slug, OrgRole::BillingManager)
280 }
281
282 /// Whether the user may see and manage security across `slug`: an
283 /// owner or a security manager.
284 pub fn manages_security(&self, slug: &str) -> bool {
285 self.owns_or_has(slug, OrgRole::SecurityManager)
286 }
287
288 /// The workspace's member privileges as this user sees them: the
289 /// defaults when the membership does not say.
290 pub fn privileges_in(&self, slug: &str) -> MemberPrivileges {
291 self.membership(slug).and_then(|membership| membership.privileges).unwrap_or_default()
292 }
293}
294
295/// Who is asking. Every read and write in every service takes one.
296pub type Viewer = Option<User>;