Skip to content
Sign up

flagon-io/g1t

public
0
295 linesCodeBlameRaw
1//! Types and service interfaces shared by every g1t service.
2//!
3//! Each service has a module here holding the data it exchanges and the
4//! arguments of each of its methods. Services and their callers depend on
5//! this crate, never on each other's code.
6
7pub mod about;
8pub mod access;
9pub mod advisories;
10pub mod account_deletion;
11pub mod accounts;
12pub mod actions;
13pub mod agents;
14pub mod audit;
15pub mod backups;
16pub mod billing;
17pub mod checks;
18pub mod codeowners;
19pub mod coding_agents;
20pub mod credentials;
21pub mod datasets;
22pub mod deploy_keys;
23pub mod events;
24pub mod folios;
25pub mod github;
26pub mod guardrails;
27pub mod identity;
28pub mod inbox;
29pub mod live;
30pub mod integrations;
31pub mod members;
32mod ids;
33mod names;
34mod outcome;
35pub mod packages;
36pub mod people;
37pub mod projects;
38pub mod repos;
39pub mod rules;
40pub mod runners;
41pub mod scopes;
42pub mod search;
43pub mod security;
44pub mod teams;
45pub mod security_suite;
46pub mod subscribers;
47pub mod time;
48pub mod tokens;
49pub mod updates;
50pub mod webhooks;
51pub mod work;
52
53pub use ids::{id_floor, new_id};
54pub use names::{
55 Username, aliasable_name, claimable_namespace, is_action_owner_name, is_claimable_name, claimable_username, is_namespace_shaped, is_reserved_name, is_route_name,
56 is_valid_namespace, is_valid_repo_name,
57};
58pub use outcome::{Failure, FailureCode, Outcome};
59
60use serde::{Deserialize, Serialize};
61
62/// What a member may do in a workspace. A member may also hold
63/// [`members::OrgRole`]s, which add to it.
64#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
65#[serde(rename_all = "lowercase")]
66pub enum Role {
67 /// Everything: Admin on every repository, the workspace's members,
68 /// settings, billing and security.
69 Owner,
70 /// The workspace's base permission on each repository, and what its
71 /// member privileges allow (see [`members::MemberPrivileges`]).
72 Member,
73}
74
75pub use members::{MemberPrivileges, OrgRole};
76
77/// One workspace a user belongs to.
78#[derive(Clone, Debug, Serialize, Deserialize)]
79pub struct Membership {
80 /// The workspace's name in URLs: `g1t.sh/<slug>`.
81 pub slug: String,
82 pub role: Role,
83 /// The workspace's display name, for showing it to people. Set when a
84 /// user is resolved from credentials; absent on principals made up by
85 /// a service.
86 #[serde(default, skip_serializing_if = "Option::is_none")]
87 pub name: Option<String>,
88 /// The workspace's uploaded icon: the SHA-256 of its bytes, served at
89 /// `/avatars/<avatar>`. Absent means the generated letter avatar.
90 #[serde(default, skip_serializing_if = "Option::is_none")]
91 pub avatar: Option<String>,
92 /// What a member gets on each of the workspace's repositories: the
93 /// workspace's base permission. Set when a user is resolved from
94 /// credentials; absent means the default, Write. Owners have Admin
95 /// whatever it says. See [`access`].
96 #[serde(default, skip_serializing_if = "Option::is_none")]
97 pub base_permission: Option<access::BasePermission>,
98 /// Who may create the workspace's teams. Set when a user is resolved
99 /// from credentials; absent means the default, any member. See
100 /// [`teams::TeamCreation`].
101 #[serde(default, skip_serializing_if = "Option::is_none")]
102 pub team_creation: Option<teams::TeamCreation>,
103 /// The roles the member holds besides `role`: billing manager,
104 /// security manager. Set when a user is resolved from credentials.
105 #[serde(default, skip_serializing_if = "Vec::is_empty")]
106 pub org_roles: Vec<OrgRole>,
107 /// What the workspace lets members (and repository admins) do. Set
108 /// when a user is resolved from credentials; absent means the
109 /// defaults. See [`members::MemberPrivileges`].
110 #[serde(default, skip_serializing_if = "Option::is_none")]
111 pub privileges: Option<MemberPrivileges>,
112}
113
114impl Membership {
115 /// A plain member of `slug`, as services act inside one workspace.
116 pub fn member(slug: impl Into<String>) -> Self {
117 Membership {
118 slug: slug.into(),
119 role: Role::Member,
120 name: None,
121 avatar: None,
122 base_permission: None,
123 team_creation: None,
124 org_roles: Vec::new(),
125 privileges: None,
126 }
127 }
128
129 /// Whether the member holds `role` besides owner or member.
130 pub fn has(&self, role: OrgRole) -> bool {
131 self.org_roles.contains(&role)
132 }
133}
134
135/// What a set of credentials resolved to.
136#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
137#[serde(rename_all = "lowercase")]
138pub enum PrincipalKind {
139 /// A person's account.
140 #[default]
141 User,
142 /// A workspace, acting through one of its own access tokens. Its `id`
143 /// is the workspace's, its `username` the workspace's slug, and it is a
144 /// member of that workspace and no other.
145 Workspace,
146 /// A run's token: a sandbox g1t started (checks, the merge queue, a
147 /// merge check), acting through a token that lives as long as its run
148 /// and can do only what that token's scope lists, in one repository.
149 /// Its `username` is `g1t`. g1t no longer runs agents of its own; the
150 /// name stays because identity still issues run credentials with it and
151 /// historical rows written by `@g1t`'s agent were recorded as it.
152 Agent,
153 /// g1t itself: the platform acting on its own, as when it opens a
154 /// pull request to upgrade a vulnerable dependency or merges from the
155 /// queue. Never resolved from credentials: only services make one,
156 /// with [`User::system`]. Its `username` is `g1t`, which nobody can
157 /// register.
158 System,
159}
160
161/// g1t's own identity, as [`PrincipalKind::System`] work is recorded.
162pub mod system {
163 /// Its id wherever an author or actor id is stored.
164 pub const ID: &str = "g1t";
165 /// Its name, shown as the author of what it does.
166 pub const USERNAME: &str = "g1t";
167 /// The address on the commits it makes, which no mailbox receives.
168 pub const EMAIL: &str = "g1t@users.noreply.g1t.sh";
169 /// Ids that earlier versions stored for g1t's own actions, such as a
170 /// merge its settings made. Read as g1t too.
171 pub const LEGACY_IDS: [&str; 3] = ["g1t_policy", "svc_runner", "g1t_runner"];
172
173 /// Whether `id` is g1t's own.
174 pub fn is_system_id(id: &str) -> bool {
175 id == ID || LEGACY_IDS.contains(&id)
176 }
177}
178
179#[derive(Clone, Debug, Default, Serialize, Deserialize)]
180pub struct User {
181 pub id: String,
182 /// Lowercased: what the person is found, linked and mentioned by.
183 pub username: String,
184 /// The username as its owner wrote it (`Ana`), when that differs from
185 /// `username`: what pages show. Set on the signed-in person and on
186 /// people looked up by name; absent elsewhere, where `username` is shown.
187 #[serde(default, skip_serializing_if = "Option::is_none")]
188 pub display_username: Option<String>,
189 #[serde(default)]
190 pub kind: PrincipalKind,
191 /// Whether the account's email address has been confirmed. Unverified
192 /// accounts can sign in but cannot create or change anything.
193 #[serde(default)]
194 pub verified: bool,
195 /// The workspaces this user belongs to. Filled in when a user is
196 /// resolved from credentials, so any service can authorize from it.
197 #[serde(default)]
198 pub workspaces: Vec<Membership>,
199 /// The person's uploaded avatar: the SHA-256 of its bytes, served at
200 /// `/avatars/<avatar>`. Absent means the generated letter avatar.
201 #[serde(default, skip_serializing_if = "Option::is_none")]
202 pub avatar: Option<String>,
203 /// Set on an agent resolved from its token: who it acts for, with which
204 /// credential, and what it may do. See [`credentials`].
205 #[serde(default, skip_serializing_if = "Option::is_none")]
206 pub acting: Option<Box<credentials::Acting>>,
207 /// The repositories this user has been given a role on directly,
208 /// whether or not they belong to its workspace. Filled in with
209 /// `workspaces`; see [`access`].
210 #[serde(default, skip_serializing_if = "Vec::is_empty")]
211 pub grants: Vec<access::RepoGrant>,
212 /// Set on a user resolved from an access token: its scopes and the
213 /// workspaces or repositories it is limited to. Absent on a signed-in
214 /// session and on an agent (whose `acting` scope applies instead).
215 /// See [`scopes`].
216 #[serde(default, skip_serializing_if = "Option::is_none")]
217 pub token: Option<Box<scopes::TokenAccess>>,
218 /// The workspaces this person belongs to but cannot use until they
219 /// meet its policy, such as turning on two-factor authentication.
220 /// They are left out of `workspaces` and `grants` meanwhile. Set when
221 /// a person is resolved from a session.
222 #[serde(default, skip_serializing_if = "Vec::is_empty")]
223 pub held: Vec<members::PolicyHold>,
224}
225
226impl User {
227 /// g1t itself, acting in `workspace`: what the platform's own work,
228 /// such as security updates, is done and recorded as.
229 pub fn system(workspace: &str) -> User {
230 User {
231 id: system::ID.to_owned(),
232 username: system::USERNAME.to_owned(),
233 kind: PrincipalKind::System,
234 verified: true,
235 workspaces: vec![Membership::member(workspace.to_lowercase())],
236 ..User::default()
237 }
238 }
239
240 /// Whether this is g1t itself.
241 pub fn is_system(&self) -> bool {
242 self.kind == PrincipalKind::System
243 }
244
245 /// Whether this is a person whose account has not confirmed its email
246 /// address. Such an account can only confirm it (or change it, or sign
247 /// out): the site, the API, MCP and git refuse it everything else
248 /// ([`accounts::confirm_email_first`]).
249 pub fn awaits_confirmation(&self) -> bool {
250 self.kind == PrincipalKind::User && !self.verified
251 }
252
253 pub fn role_in(&self, slug: &str) -> Option<Role> {
254 self.workspaces
255 .iter()
256 .find(|membership| membership.slug == slug)
257 .map(|membership| membership.role)
258 }
259
260 pub fn is_member(&self, slug: &str) -> bool {
261 self.role_in(slug).is_some()
262 }
263
264 /// The membership in `slug`, if any.
265 pub fn membership(&self, slug: &str) -> Option<&Membership> {
266 self.workspaces.iter().find(|membership| membership.slug.eq_ignore_ascii_case(slug))
267 }
268
269 /// Whether this is a person who owns `slug`, or holds `role` in it.
270 pub fn owns_or_has(&self, slug: &str, role: OrgRole) -> bool {
271 self.membership(slug)
272 .is_some_and(|membership| membership.role == Role::Owner || membership.has(role))
273 }
274
275 /// Whether the user may manage `slug`'s billing: an owner or a billing
276 /// manager.
277 pub fn manages_billing(&self, slug: &str) -> bool {
278 self.owns_or_has(slug, OrgRole::BillingManager)
279 }
280
281 /// Whether the user may see and manage security across `slug`: an
282 /// owner or a security manager.
283 pub fn manages_security(&self, slug: &str) -> bool {
284 self.owns_or_has(slug, OrgRole::SecurityManager)
285 }
286
287 /// The workspace's member privileges as this user sees them: the
288 /// defaults when the membership does not say.
289 pub fn privileges_in(&self, slug: &str) -> MemberPrivileges {
290 self.membership(slug).and_then(|membership| membership.privileges).unwrap_or_default()
291 }
292}
293
294/// Who is asking. Every read and write in every service takes one.
295pub type Viewer = Option<User>;