| 1 | //! Types and service interfaces shared by every g1t service. |
| 2 | //! |
| 3 | //! Each service has a module here holding the data it exchanges and the |
| 4 | //! arguments of each of its methods. Services and their callers depend on |
| 5 | //! this crate, never on each other's code. |
| 6 | |
| 7 | pub mod about; |
| 8 | pub mod access; |
| 9 | pub mod advisories; |
| 10 | pub mod attachments; |
| 11 | pub mod agent_sessions; |
| 12 | pub mod ai; |
| 13 | pub mod account_deletion; |
| 14 | pub mod accounts; |
| 15 | pub mod actions; |
| 16 | pub mod agents; |
| 17 | pub mod audit; |
| 18 | pub mod backups; |
| 19 | pub mod billing; |
| 20 | pub mod checks; |
| 21 | pub mod codeowners; |
| 22 | pub mod coding_agents; |
| 23 | pub mod credentials; |
| 24 | pub mod datasets; |
| 25 | pub mod decisions; |
| 26 | pub mod deploy_keys; |
| 27 | pub mod events; |
| 28 | pub mod folios; |
| 29 | pub mod github; |
| 30 | pub mod guardrails; |
| 31 | pub mod identity; |
| 32 | pub mod inbox; |
| 33 | pub mod live; |
| 34 | pub mod integrations; |
| 35 | pub mod members; |
| 36 | mod ids; |
| 37 | mod names; |
| 38 | mod outcome; |
| 39 | pub mod packages; |
| 40 | pub mod people; |
| 41 | pub mod projects; |
| 42 | pub mod repos; |
| 43 | pub mod rules; |
| 44 | pub mod runners; |
| 45 | pub mod scopes; |
| 46 | pub mod search; |
| 47 | pub mod security; |
| 48 | pub mod teams; |
| 49 | pub mod security_suite; |
| 50 | pub mod sso; |
| 51 | pub mod subscribers; |
| 52 | pub mod time; |
| 53 | pub mod tokens; |
| 54 | pub mod updates; |
| 55 | pub mod webhooks; |
| 56 | pub mod work; |
| 57 | |
| 58 | pub use ids::{id_floor, new_id}; |
| 59 | pub use names::{ |
| 60 | Username, aliasable_name, claimable_namespace, is_action_owner_name, is_claimable_name, claimable_username, is_namespace_shaped, is_reserved_name, is_route_name, |
| 61 | is_valid_namespace, is_valid_repo_name, |
| 62 | }; |
| 63 | pub use outcome::{Failure, FailureCode, Outcome}; |
| 64 | |
| 65 | use serde::{Deserialize, Serialize}; |
| 66 | |
| 67 | /// What a member may do in a workspace. A member may also hold |
| 68 | /// [`members::OrgRole`]s, which add to it. |
| 69 | #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] |
| 70 | #[serde(rename_all = "lowercase")] |
| 71 | pub enum Role { |
| 72 | /// Everything: Admin on every repository, the workspace's members, |
| 73 | /// settings, billing and security. |
| 74 | Owner, |
| 75 | /// The workspace's base permission on each repository, and what its |
| 76 | /// member privileges allow (see [`members::MemberPrivileges`]). |
| 77 | Member, |
| 78 | } |
| 79 | |
| 80 | pub use members::{MemberPrivileges, OrgRole}; |
| 81 | |
| 82 | /// One workspace a user belongs to. |
| 83 | #[derive(Clone, Debug, Serialize, Deserialize)] |
| 84 | pub struct Membership { |
| 85 | /// The workspace's name in URLs: `g1t.sh/<slug>`. |
| 86 | pub slug: String, |
| 87 | pub role: Role, |
| 88 | /// The workspace's display name, for showing it to people. Set when a |
| 89 | /// user is resolved from credentials; absent on principals made up by |
| 90 | /// a service. |
| 91 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 92 | pub name: Option<String>, |
| 93 | /// The workspace's uploaded icon: the SHA-256 of its bytes, served at |
| 94 | /// `/avatars/<avatar>`. Absent means the generated letter avatar. |
| 95 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 96 | pub avatar: Option<String>, |
| 97 | /// What a member gets on each of the workspace's repositories: the |
| 98 | /// workspace's base permission. Set when a user is resolved from |
| 99 | /// credentials; absent means the default, Write. Owners have Admin |
| 100 | /// whatever it says. See [`access`]. |
| 101 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 102 | pub base_permission: Option<access::BasePermission>, |
| 103 | /// Who may create the workspace's teams. Set when a user is resolved |
| 104 | /// from credentials; absent means the default, any member. See |
| 105 | /// [`teams::TeamCreation`]. |
| 106 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 107 | pub team_creation: Option<teams::TeamCreation>, |
| 108 | /// The roles the member holds besides `role`: billing manager, |
| 109 | /// security manager. Set when a user is resolved from credentials. |
| 110 | #[serde(default, skip_serializing_if = "Vec::is_empty")] |
| 111 | pub org_roles: Vec<OrgRole>, |
| 112 | /// What the workspace lets members (and repository admins) do. Set |
| 113 | /// when a user is resolved from credentials; absent means the |
| 114 | /// defaults. See [`members::MemberPrivileges`]. |
| 115 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 116 | pub privileges: Option<MemberPrivileges>, |
| 117 | } |
| 118 | |
| 119 | impl Membership { |
| 120 | /// A plain member of `slug`, as services act inside one workspace. |
| 121 | pub fn member(slug: impl Into<String>) -> Self { |
| 122 | Membership { |
| 123 | slug: slug.into(), |
| 124 | role: Role::Member, |
| 125 | name: None, |
| 126 | avatar: None, |
| 127 | base_permission: None, |
| 128 | team_creation: None, |
| 129 | org_roles: Vec::new(), |
| 130 | privileges: None, |
| 131 | } |
| 132 | } |
| 133 | |
| 134 | /// Whether the member holds `role` besides owner or member. |
| 135 | pub fn has(&self, role: OrgRole) -> bool { |
| 136 | self.org_roles.contains(&role) |
| 137 | } |
| 138 | } |
| 139 | |
| 140 | /// What a set of credentials resolved to. |
| 141 | #[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)] |
| 142 | #[serde(rename_all = "lowercase")] |
| 143 | pub enum PrincipalKind { |
| 144 | /// A person's account. |
| 145 | #[default] |
| 146 | User, |
| 147 | /// A workspace, acting through one of its own access tokens. Its `id` |
| 148 | /// is the workspace's, its `username` the workspace's slug, and it is a |
| 149 | /// member of that workspace and no other. |
| 150 | Workspace, |
| 151 | /// A run's token: a sandbox g1t started (checks, the merge queue, a |
| 152 | /// merge check), acting through a token that lives as long as its run |
| 153 | /// and can do only what that token's scope lists, in one repository. |
| 154 | /// Its `username` is `g1t`. g1t no longer runs agents of its own; the |
| 155 | /// name stays because identity still issues run credentials with it and |
| 156 | /// historical rows written by `@g1t`'s agent were recorded as it. |
| 157 | Agent, |
| 158 | /// g1t itself: the platform acting on its own, as when it opens a |
| 159 | /// pull request to upgrade a vulnerable dependency or merges from the |
| 160 | /// queue. Never resolved from credentials: only services make one, |
| 161 | /// with [`User::system`]. Its `username` is `g1t`, which nobody can |
| 162 | /// register. |
| 163 | System, |
| 164 | } |
| 165 | |
| 166 | /// g1t's own identity, as [`PrincipalKind::System`] work is recorded. |
| 167 | pub mod system { |
| 168 | /// Its id wherever an author or actor id is stored. |
| 169 | pub const ID: &str = "g1t"; |
| 170 | /// Its name, shown as the author of what it does. |
| 171 | pub const USERNAME: &str = "g1t"; |
| 172 | /// The address on the commits it makes, which no mailbox receives. |
| 173 | pub const EMAIL: &str = "g1t@users.noreply.g1t.sh"; |
| 174 | /// Ids that earlier versions stored for g1t's own actions, such as a |
| 175 | /// merge its settings made. Read as g1t too. |
| 176 | pub const LEGACY_IDS: [&str; 3] = ["g1t_policy", "svc_runner", "g1t_runner"]; |
| 177 | |
| 178 | /// Whether `id` is g1t's own. |
| 179 | pub fn is_system_id(id: &str) -> bool { |
| 180 | id == ID || LEGACY_IDS.contains(&id) |
| 181 | } |
| 182 | } |
| 183 | |
| 184 | #[derive(Clone, Debug, Default, Serialize, Deserialize)] |
| 185 | pub struct User { |
| 186 | pub id: String, |
| 187 | /// Lowercased: what the person is found, linked and mentioned by. |
| 188 | pub username: String, |
| 189 | /// The username as its owner wrote it (`Ana`), when that differs from |
| 190 | /// `username`: what pages show. Set on the signed-in person and on |
| 191 | /// people looked up by name; absent elsewhere, where `username` is shown. |
| 192 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 193 | pub display_username: Option<String>, |
| 194 | #[serde(default)] |
| 195 | pub kind: PrincipalKind, |
| 196 | /// Whether the account's email address has been confirmed. Unverified |
| 197 | /// accounts can sign in but cannot create or change anything. |
| 198 | #[serde(default)] |
| 199 | pub verified: bool, |
| 200 | /// The workspaces this user belongs to. Filled in when a user is |
| 201 | /// resolved from credentials, so any service can authorize from it. |
| 202 | #[serde(default)] |
| 203 | pub workspaces: Vec<Membership>, |
| 204 | /// The person's uploaded avatar: the SHA-256 of its bytes, served at |
| 205 | /// `/avatars/<avatar>`. Absent means the generated letter avatar. |
| 206 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 207 | pub avatar: Option<String>, |
| 208 | /// Set on an agent resolved from its token: who it acts for, with which |
| 209 | /// credential, and what it may do. See [`credentials`]. |
| 210 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 211 | pub acting: Option<Box<credentials::Acting>>, |
| 212 | /// The repositories this user has been given a role on directly, |
| 213 | /// whether or not they belong to its workspace. Filled in with |
| 214 | /// `workspaces`; see [`access`]. |
| 215 | #[serde(default, skip_serializing_if = "Vec::is_empty")] |
| 216 | pub grants: Vec<access::RepoGrant>, |
| 217 | /// Set on a user resolved from an access token: its scopes and the |
| 218 | /// workspaces or repositories it is limited to. Absent on a signed-in |
| 219 | /// session and on an agent (whose `acting` scope applies instead). |
| 220 | /// See [`scopes`]. |
| 221 | #[serde(default, skip_serializing_if = "Option::is_none")] |
| 222 | pub token: Option<Box<scopes::TokenAccess>>, |
| 223 | /// The workspaces this person belongs to but cannot use until they |
| 224 | /// meet its policy, such as turning on two-factor authentication. |
| 225 | /// They are left out of `workspaces` and `grants` meanwhile. Set when |
| 226 | /// a person is resolved from a session. |
| 227 | #[serde(default, skip_serializing_if = "Vec::is_empty")] |
| 228 | pub held: Vec<members::PolicyHold>, |
| 229 | } |
| 230 | |
| 231 | impl User { |
| 232 | /// g1t itself, acting in `workspace`: what the platform's own work, |
| 233 | /// such as security updates, is done and recorded as. |
| 234 | pub fn system(workspace: &str) -> User { |
| 235 | User { |
| 236 | id: system::ID.to_owned(), |
| 237 | username: system::USERNAME.to_owned(), |
| 238 | kind: PrincipalKind::System, |
| 239 | verified: true, |
| 240 | workspaces: vec![Membership::member(workspace.to_lowercase())], |
| 241 | ..User::default() |
| 242 | } |
| 243 | } |
| 244 | |
| 245 | /// Whether this is g1t itself. |
| 246 | pub fn is_system(&self) -> bool { |
| 247 | self.kind == PrincipalKind::System |
| 248 | } |
| 249 | |
| 250 | /// Whether this is a person whose account has not confirmed its email |
| 251 | /// address. Such an account can only confirm it (or change it, or sign |
| 252 | /// out): the site, the API, MCP and git refuse it everything else |
| 253 | /// ([`accounts::confirm_email_first`]). |
| 254 | pub fn awaits_confirmation(&self) -> bool { |
| 255 | self.kind == PrincipalKind::User && !self.verified |
| 256 | } |
| 257 | |
| 258 | pub fn role_in(&self, slug: &str) -> Option<Role> { |
| 259 | self.workspaces |
| 260 | .iter() |
| 261 | .find(|membership| membership.slug == slug) |
| 262 | .map(|membership| membership.role) |
| 263 | } |
| 264 | |
| 265 | pub fn is_member(&self, slug: &str) -> bool { |
| 266 | self.role_in(slug).is_some() |
| 267 | } |
| 268 | |
| 269 | /// The membership in `slug`, if any. |
| 270 | pub fn membership(&self, slug: &str) -> Option<&Membership> { |
| 271 | self.workspaces.iter().find(|membership| membership.slug.eq_ignore_ascii_case(slug)) |
| 272 | } |
| 273 | |
| 274 | /// Whether this is a person who owns `slug`, or holds `role` in it. |
| 275 | pub fn owns_or_has(&self, slug: &str, role: OrgRole) -> bool { |
| 276 | self.membership(slug) |
| 277 | .is_some_and(|membership| membership.role == Role::Owner || membership.has(role)) |
| 278 | } |
| 279 | |
| 280 | /// Whether the user may manage `slug`'s billing: an owner or a billing |
| 281 | /// manager. |
| 282 | pub fn manages_billing(&self, slug: &str) -> bool { |
| 283 | self.owns_or_has(slug, OrgRole::BillingManager) |
| 284 | } |
| 285 | |
| 286 | /// Whether the user may see and manage security across `slug`: an |
| 287 | /// owner or a security manager. |
| 288 | pub fn manages_security(&self, slug: &str) -> bool { |
| 289 | self.owns_or_has(slug, OrgRole::SecurityManager) |
| 290 | } |
| 291 | |
| 292 | /// The workspace's member privileges as this user sees them: the |
| 293 | /// defaults when the membership does not say. |
| 294 | pub fn privileges_in(&self, slug: &str) -> MemberPrivileges { |
| 295 | self.membership(slug).and_then(|membership| membership.privileges).unwrap_or_default() |
| 296 | } |
| 297 | } |
| 298 | |
| 299 | /// Who is asking. Every read and write in every service takes one. |
| 300 | pub type Viewer = Option<User>; |