Skip to content
Sign up

flagon-io/g1t

public
0
1,832 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

API and MCP server, Rust identity service, registration, site redesign1//! The identity service: accounts, credentials and sessions.
2//!
3//! Each `*Args` struct is the argument of the method of the same name,
4//! served at `POST /rpc/<method>`.
5
6use serde::{Deserialize, Serialize};
7
8use crate::User;
9
10#[derive(Clone, Debug, Serialize, Deserialize)]
11#[serde(rename_all = "camelCase")]
12pub struct SshKey {
13 pub id: String,
14 pub title: String,
15 pub fingerprint: String,
RFC 3339 timestamps in identity and repos16 /// RFC 3339.
17 pub created_at: String,
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca18 /// When it was last used to sign in over SSH, RFC 3339, to within 5
19 /// minutes; null when it never was.
20 #[serde(default)]
21 pub last_used_at: Option<String>,
API and MCP server, Rust identity service, registration, site redesign22}
23
Fine-grained personal tokens, workspace token rules and approvals in identity24#[derive(Clone, Debug, Default, Serialize, Deserialize)]
API and MCP server, Rust identity service, registration, site redesign25#[serde(rename_all = "camelCase")]
26pub struct AccessToken {
27 pub id: String,
28 pub name: String,
RFC 3339 timestamps in identity and repos29 /// RFC 3339.
30 pub created_at: String,
Agents as a team: lifecycle, merge queue, billing and a new shell31 /// RFC 3339, to within a few minutes. Null until it is first used.
32 pub last_used_at: Option<String>,
33 /// For a workspace's token, the username of the member who made it.
34 /// Null once that account is gone, and on personal tokens.
35 pub created_by: Option<String>,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step36 /// Its scopes, as `resource:level`. Null: full access.
37 #[serde(default)]
38 pub scopes: Option<Vec<String>>,
39 /// Made before tokens had scopes: full access until someone narrows it.
40 #[serde(default)]
41 pub legacy: bool,
42 /// RFC 3339. Null: it does not expire.
43 #[serde(default)]
44 pub expires_at: Option<String>,
Fine-grained personal tokens, workspace token rules and approvals in identity45 /// Classic, fine-grained, or a workspace's own.
46 #[serde(default)]
47 pub kind: crate::tokens::TokenKind,
48 /// What it is for, as its owner wrote it.
49 #[serde(default, skip_serializing_if = "Option::is_none")]
50 pub description: Option<String>,
51 /// A fine-grained token's resource owner, repositories, permissions and
52 /// status.
53 #[serde(default, skip_serializing_if = "Option::is_none")]
54 pub fine_grained: Option<crate::tokens::FineGrainedDetails>,
55 /// A workspace's own token an owner gave Admin when making it.
56 #[serde(default, skip_serializing_if = "std::ops::Not::not")]
57 pub admin: bool,
API and MCP server, Rust identity service, registration, site redesign58}
59
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look60/// `sign_in`: verifies a username, or any confirmed email address of the
61/// account, and its password, for website sign-in. Wrong passwords are
62/// counted against the account and `client`, and past a limit nothing is
63/// checked for a while (see identity's `throttle.rs`).
API and MCP server, Rust identity service, registration, site redesign64/// Returns `Outcome<SignedIn>`.
65#[derive(Debug, Serialize, Deserialize)]
66pub struct SignInArgs {
67 pub username: String,
68 pub password: String,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look69 /// Who is asking, such as the visitor's IP address, for rate limits.
70 #[serde(default)]
71 pub client: Option<String>,
API and MCP server, Rust identity service, registration, site redesign72}
73
74#[derive(Debug, Serialize, Deserialize)]
75#[serde(rename_all = "camelCase")]
76pub struct SignedIn {
77 pub user: User,
Merge main (membership, two-factor, GitHub repo roles) into tokens78 /// Empty while `two_factor_challenge` is set: no session is made until
79 /// the code is given.
API and MCP server, Rust identity service, registration, site redesign80 pub session_token: String,
Merge main (membership, two-factor, GitHub repo roles) into tokens81 /// Set when the account has two-factor authentication on: the token to
82 /// pass to `two_factor_sign_in` with a code. Valid for
83 /// `accounts::TWO_FACTOR_CHALLENGE_SECONDS`.
84 #[serde(default, skip_serializing_if = "Option::is_none")]
85 pub two_factor_challenge: Option<String>,
API and MCP server, Rust identity service, registration, site redesign86}
87
88/// `sign_out` and `user_for_session`.
89#[derive(Debug, Serialize, Deserialize)]
90#[serde(rename_all = "camelCase")]
91pub struct SessionArgs {
92 pub session_token: String,
93}
94
95/// `user_for_git_credentials`: the account password or an access token.
96#[derive(Debug, Serialize, Deserialize)]
97pub struct GitCredentialsArgs {
98 pub username: String,
99 pub secret: String,
100}
101
102/// `user_for_access_token`.
103#[derive(Debug, Serialize, Deserialize)]
104pub struct TokenArgs {
105 pub token: String,
106}
107
Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca108/// `user_for_ssh_key`, and `principal_for_ssh_key` (see [`crate::deploy_keys`]).
API and MCP server, Rust identity service, registration, site redesign109#[derive(Debug, Serialize, Deserialize)]
110pub struct FingerprintArgs {
111 pub fingerprint: String,
112}
113
114/// `user_by_username`.
115#[derive(Debug, Serialize, Deserialize)]
116pub struct UsernameArgs {
117 pub username: String,
118}
119
What happened across an outcome, as a feed beside its graph120/// `usernames`: the names behind account and workspace ids, as events and
121/// other records store them. Returns a map from id to name; ids it does
Merge branch 'main' into worktree-agent-a69aeabc4b0deeb97122/// not know are left out. Also `accounts`: the accounts behind user ids,
123/// each with its username and avatar (`HashMap<String, accounts::EmailOwner>`).
What happened across an outcome, as a feed beside its graph124#[derive(Debug, Serialize, Deserialize)]
125pub struct UsernamesArgs {
126 pub ids: Vec<String>,
127}
128
API and MCP server, Rust identity service, registration, site redesign129/// `list_ssh_keys` and `list_access_tokens`.
130#[derive(Debug, Serialize, Deserialize)]
131pub struct UserArgs {
132 pub user: User,
133}
134
Merge rulesets: branch and tag rules, agent-first, enforced on push and merge135/// `ssh_key_owners`: services only. The account (user id) that registered
136/// each key, by fingerprint (`SHA256:…`, as `ssh-keygen -lf` prints it),
137/// for verifying commits signed with SSH keys. Returns a map of the
138/// fingerprints found to user ids.
139#[derive(Debug, Serialize, Deserialize)]
140pub struct SshKeyOwnersArgs {
141 pub fingerprints: Vec<String>,
142}
143
API and MCP server, Rust identity service, registration, site redesign144/// `add_ssh_key`: `public_key` is one line in OpenSSH format.
145/// Returns `Outcome<SshKey>`.
146#[derive(Debug, Serialize, Deserialize)]
147#[serde(rename_all = "camelCase")]
148pub struct AddSshKeyArgs {
149 pub user: User,
150 pub title: String,
151 pub public_key: String,
152}
153
154/// `remove_ssh_key` and `remove_access_token`.
155#[derive(Debug, Serialize, Deserialize)]
156pub struct RemoveArgs {
157 pub user: User,
158 pub id: String,
159}
160
Agents as a team: lifecycle, merge queue, billing and a new shell161/// `create_access_token`: a token that acts as `user`. For a workspace
162/// acting through a token of its own, the new token belongs to that
163/// workspace too.
API and MCP server, Rust identity service, registration, site redesign164#[derive(Debug, Serialize, Deserialize)]
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)165#[serde(rename_all = "camelCase")]
API and MCP server, Rust identity service, registration, site redesign166pub struct CreateAccessTokenArgs {
167 pub user: User,
168 pub name: String,
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)169 /// When set, the token stops working after this many seconds and is
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step170 /// left out of the user's token list, unless `listed`. Used for hosted
171 /// attempts.
Account dropdown, llms.txt onboarding, hosted agent runner (not yet deployed)172 #[serde(default)]
173 pub ttl_seconds: Option<u64>,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step174 /// Its scopes, as `resource:level`; unknown names are left out. Null:
175 /// full access.
176 #[serde(default)]
177 pub scopes: Option<Vec<String>>,
178 /// Listed with the person's tokens although it expires: one they made
179 /// themselves, with an expiry.
180 #[serde(default)]
181 pub listed: bool,
182}
183
Merge branch 'worktree-agent-a3abfcce648e87dca'184/// `create_job_token`: a workflow job's `G1T_TOKEN`. It acts as the
185/// repository's workspace, reaches that repository only, holds `scopes`
186/// (from the job's `permissions`), and is never listed. The actions service
187/// revokes it when the job ends (`revoke_job_tokens`); `ttl_seconds` is a
188/// backstop. Returns `CreatedAccessToken`.
189#[derive(Debug, Serialize, Deserialize)]
190#[serde(rename_all = "camelCase")]
191pub struct CreateJobTokenArgs {
192 /// The workspace the repository belongs to, as its own principal.
193 pub workspace: User,
194 pub repo: crate::repos::RepoPath,
195 pub run_id: String,
196 pub job_id: String,
197 /// What the token is listed as in logs: `G1T_TOKEN for acme/web run 4`.
198 pub name: String,
199 pub ttl_seconds: u64,
200 /// As `resource:level`; unknown names are left out.
201 pub scopes: Vec<String>,
202 /// Whether it may open and approve pull requests (`JobToken::pull_requests`).
203 #[serde(default)]
204 pub pull_requests: bool,
205}
206
207/// `revoke_job_tokens`: ends a workflow job's tokens at once, when the job
208/// finishes or is cancelled. Only job tokens are touched. Returns `bool`.
209#[derive(Debug, Default, Serialize, Deserialize)]
210#[serde(rename_all = "camelCase")]
211pub struct RevokeJobTokensArgs {
212 pub job_id: String,
213}
214
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step215/// `update_access_token`: changes what one of a person's tokens may do.
216/// The token itself is unchanged. Returns `Outcome<AccessToken>`.
217#[derive(Debug, Serialize, Deserialize)]
218pub struct UpdateAccessTokenArgs {
219 pub user: User,
220 pub id: String,
221 /// Null: full access.
222 #[serde(default)]
223 pub scopes: Option<Vec<String>>,
API and MCP server, Rust identity service, registration, site redesign224}
225
226/// The plaintext token is returned once and never stored.
227#[derive(Debug, Serialize, Deserialize)]
228pub struct CreatedAccessToken {
229 pub token: String,
230 pub info: AccessToken,
231}
232
233/// `register`: creates an account and signs it in.
234/// Returns `Outcome<SignedIn>`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look235///
236/// While registration is invite-only (`REGISTRATION_MODE=invite`), every
237/// new account needs `invite_code`: an unused, unexpired invite, and, when
238/// the invite names an email, that address. See [`CreateInviteArgs`].
API and MCP server, Rust identity service, registration, site redesign239#[derive(Debug, Serialize, Deserialize)]
240pub struct RegisterArgs {
241 pub username: String,
242 pub email: String,
243 pub password: String,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look244 /// An invite code such as `g1t-k7m2-q9xd-4hpw-…`. Ignored while
245 /// registration is open.
246 #[serde(default)]
247 pub invite_code: Option<String>,
Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm248 /// The `proof` from the invite email's link. When it is the invite's
249 /// own and `email` is the address the invite was sent to, the account
250 /// starts with that address confirmed; otherwise it is ignored.
251 #[serde(default)]
252 pub email_proof: Option<String>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look253 /// Who is asking, such as the visitor's IP address, for rate limits.
254 #[serde(default)]
255 pub client: Option<String>,
API and MCP server, Rust identity service, registration, site redesign256}
Email verification, password reset, and Git for AI scale positioning257
258/// `verify_email`: the token from the emailed link. Returns `Outcome<User>`.
259#[derive(Debug, Serialize, Deserialize)]
260pub struct EmailTokenArgs {
261 pub token: String,
262}
263
264/// `request_password_reset`. Always succeeds, so it cannot be used to find
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look265/// out which addresses have accounts. Any confirmed address of an account
266/// works: the link goes to the address given, and the primary (and the
267/// backup) are told a reset was asked for. A few requests an hour per
268/// address and per `client`; past that, nothing is sent.
Email verification, password reset, and Git for AI scale positioning269#[derive(Debug, Serialize, Deserialize)]
270pub struct EmailArgs {
271 pub email: String,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look272 /// Who is asking, such as the visitor's IP address, for rate limits.
273 #[serde(default)]
274 pub client: Option<String>,
Email verification, password reset, and Git for AI scale positioning275}
276
277/// `reset_password`: sets a new password and ends every session.
278/// Returns `Outcome<User>`.
279#[derive(Debug, Serialize, Deserialize)]
280pub struct ResetPasswordArgs {
281 pub token: String,
282 pub password: String,
283}
Device sign-in replaces registering and minting tokens over the API284
285/// `device_start`: begins a device sign-in. Returns `DeviceStart`.
286#[derive(Debug, Serialize, Deserialize)]
287#[serde(rename_all = "camelCase")]
288pub struct DeviceStartArgs {
289 /// What is asking, shown to the person approving, e.g. "Claude Code".
290 pub client_name: String,
291}
292
293#[derive(Debug, Serialize, Deserialize)]
294#[serde(rename_all = "camelCase")]
295pub struct DeviceStart {
296 /// Secret held by the tool and exchanged for a token once approved.
297 pub device_code: String,
298 /// Short code shown to the person, e.g. `WDJB-MJHT`.
299 pub user_code: String,
300 /// Seconds until both codes stop working.
301 pub expires_in: u32,
302 /// Seconds the tool should wait between polls.
303 pub interval: u32,
304}
305
306/// `device_lookup`: what a user code is asking for, or null if it is not
307/// valid. Returns `Option<DeviceRequest>`.
308#[derive(Debug, Serialize, Deserialize)]
309#[serde(rename_all = "camelCase")]
310pub struct DeviceLookupArgs {
311 pub user_code: String,
312}
313
314#[derive(Debug, Serialize, Deserialize)]
315#[serde(rename_all = "camelCase")]
316pub struct DeviceRequest {
317 pub user_code: String,
318 pub client_name: String,
319}
320
321/// `device_resolve`: the signed-in person approves or denies a request.
322/// Returns `Outcome<bool>`.
323#[derive(Debug, Serialize, Deserialize)]
324#[serde(rename_all = "camelCase")]
325pub struct DeviceResolveArgs {
326 pub user_code: String,
327 pub user: User,
328 pub approve: bool,
329}
330
331/// `device_claim`: the tool asks whether its request was approved.
332#[derive(Debug, Serialize, Deserialize)]
333#[serde(rename_all = "camelCase")]
334pub struct DeviceClaimArgs {
335 pub device_code: String,
336}
337
338/// The answer to a `device_claim`.
339#[derive(Debug, Serialize, Deserialize)]
340#[serde(tag = "status", rename_all = "snake_case")]
341pub enum DeviceClaim {
342 /// Nobody has approved or denied it yet; ask again after the interval.
343 Pending,
344 Denied,
345 /// The code was never issued, has expired, or was already used.
346 Expired,
347 /// The access token, returned once.
348 Approved {
349 token: String,
350 user: User,
351 },
352}
Workspaces own repositories353
354/// A workspace: the owner of repositories, and the first segment of their
355/// URLs. A person's own space and a team's are the same thing.
356#[derive(Clone, Debug, Serialize, Deserialize)]
357#[serde(rename_all = "camelCase")]
358pub struct Workspace {
359 pub id: String,
360 pub slug: String,
361 pub name: String,
Agents as a team: lifecycle, merge queue, billing and a new shell362 /// One line saying what the workspace is for.
363 pub description: Option<String>,
Workspaces own repositories364 /// RFC 3339.
365 pub created_at: String,
366 pub member_count: u32,
Workspace names and icons, and a component kit for every control367 /// The workspace's uploaded icon: the SHA-256 of its bytes, served at
368 /// `/avatars/<avatar>`. Null means the generated letter avatar.
369 #[serde(default)]
370 pub avatar: Option<String>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look371 /// What every member gets on each of its repositories; owners have
372 /// Admin. See [`crate::access`].
373 #[serde(default)]
374 pub base_permission: crate::access::BasePermission,
Merge branch 'worktree-agent-ad7c6d88d93adc817'375 /// Who may create its teams. See [`crate::teams::TeamCreation`].
376 #[serde(default)]
377 pub team_creation: crate::teams::TeamCreation,
Merge main (membership, two-factor, GitHub repo roles) into tokens378 /// What members may do, by GitHub's names for each
379 /// (`members_can_create_public_repositories`...), at the top level as
380 /// GitHub's organization has them. See [`crate::MemberPrivileges`].
381 #[serde(flatten)]
382 pub privileges: crate::MemberPrivileges,
383 /// Whether members and outside collaborators need two-factor
384 /// authentication to use it.
385 #[serde(default)]
386 pub two_factor_requirement_enabled: bool,
Workspaces own repositories387}
388
389#[derive(Clone, Debug, Serialize, Deserialize)]
390pub struct Member {
391 pub username: String,
392 pub role: crate::Role,
Merge main (membership, two-factor, GitHub repo roles) into tokens393 /// The roles they hold besides `role`.
394 #[serde(default)]
395 pub org_roles: Vec<crate::OrgRole>,
396 /// Whether they have two-factor authentication on. Shown to owners
397 /// only; null for anyone else.
398 #[serde(default)]
399 pub two_factor: Option<bool>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look400 /// Their display name, when they set one.
401 #[serde(default)]
402 pub name: Option<String>,
403 /// Their uploaded avatar: the SHA-256 of its bytes, served at
404 /// `/avatars/<avatar>`. None means the generated letter avatar.
405 #[serde(default)]
406 pub avatar: Option<String>,
Workspaces own repositories407}
408
Merge branch 'worktree-agent-a2013627e5ea4ab13'409/// Where a workspace keeps its repositories' git data: anywhere g1t
410/// stores it (the default), or in the EU only. It applies to repositories
411/// made after it is set; the repos service reads it when it places a new
412/// one (`storage_options` says whether the EU can be chosen).
413#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
414#[serde(rename_all = "lowercase")]
415pub enum DataResidency {
416 #[default]
417 Anywhere,
418 Eu,
419}
420
421impl DataResidency {
422 pub fn as_str(self) -> &'static str {
423 match self {
424 DataResidency::Anywhere => "anywhere",
425 DataResidency::Eu => "eu",
426 }
427 }
428
429 pub fn parse(text: &str) -> Option<Self> {
430 match text.trim().to_ascii_lowercase().as_str() {
431 "anywhere" => Some(DataResidency::Anywhere),
432 "eu" => Some(DataResidency::Eu),
433 _ => None,
434 }
435 }
436}
437
438/// `workspace_residency` takes [`SlugArgs`] and returns
439/// `Option<DataResidency>` (null when there is no such workspace).
440/// `set_workspace_residency`: owners only. Returns `Outcome<DataResidency>`.
441#[derive(Debug, Serialize, Deserialize)]
442pub struct SetResidencyArgs {
443 pub actor: User,
444 pub slug: String,
445 pub residency: DataResidency,
446}
447
Workspaces own repositories448/// `create_workspace`. Returns `Outcome<Workspace>`.
449#[derive(Debug, Serialize, Deserialize)]
450pub struct CreateWorkspaceArgs {
451 pub user: User,
452 pub slug: String,
453 #[serde(default)]
454 pub name: String,
455}
456
457/// `get_workspace`: public details, or null. Returns `Option<Workspace>`.
458#[derive(Debug, Serialize, Deserialize)]
459pub struct SlugArgs {
460 pub slug: String,
461}
462
Merge main (membership, two-factor, GitHub repo roles) into tokens463/// `list_members`: members only. Owners also see each member's
464/// `two_factor`. Returns `Outcome<Vec<Member>>`.
Workspaces own repositories465#[derive(Debug, Serialize, Deserialize)]
466pub struct ListMembersArgs {
467 pub slug: String,
468 pub viewer: crate::Viewer,
469}
470
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)471/// `add_member` and `remove_member`: owners only. `add_member` never adds a
472/// person at once: it sends them a workspace invitation to accept or
473/// decline, as `invite_member` with a username does. Only g1t's own agent
474/// is added at once. Removing yourself is
Merge main (membership, two-factor, GitHub repo roles) into tokens475/// leaving (`members::LeaveWorkspaceArgs`); removing an owner is refused
476/// when they are the last. Each returns `Outcome<bool>`.
Workspaces own repositories477#[derive(Debug, Serialize, Deserialize)]
478pub struct MemberArgs {
479 pub actor: User,
480 pub slug: String,
481 pub username: String,
Merge main (membership, two-factor, GitHub repo roles) into tokens482 #[serde(default)]
483 pub surface: Option<crate::audit::Surface>,
Workspaces own repositories484}
OAuth 2.1 sign-in for MCP clients and other applications485
Agents as a team: lifecycle, merge queue, billing and a new shell486/// `update_workspace`: owners only. An empty name falls back to the slug;
487/// an empty description clears it. Returns `Outcome<Workspace>`.
488#[derive(Debug, Serialize, Deserialize)]
489pub struct UpdateWorkspaceArgs {
490 pub actor: User,
491 pub slug: String,
492 pub name: String,
493 pub description: String,
494}
495
Agents and memory, checks and conflicts, profiles, slug renames, custom domains496/// `rename_workspace`: owners only. Changes the workspace's slug, the first
497/// segment of its URLs, to `new_slug`; the display name is untouched. The
498/// old slug redirects to the new one, and is held for this workspace, for
499/// [`SLUG_HOLD_DAYS`]. Publishes `workspace.renamed`. Returns
500/// `Outcome<Workspace>`.
501///
502/// `check_workspace_rename` takes the same arguments and answers whether
503/// the rename would be allowed, changing nothing. Returns `Outcome<bool>`.
504#[derive(Debug, Serialize, Deserialize)]
505#[serde(rename_all = "camelCase")]
506pub struct RenameWorkspaceArgs {
507 pub actor: User,
508 pub slug: String,
509 pub new_slug: String,
510}
511
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look512/// `delete_workspace`: owners only, and only a person. `confirm` must be
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member513/// the workspace's slug, typed out. Refused for a protected workspace
514/// ([`protected_names`]), whoever asks, and while billing cannot settle it
515/// (`close_workspace`). Everything in it goes with it at once: nobody can
516/// reach it, its tokens stop working, its pages are not found, and its
517/// repositories, projects and apps are deleted with it. It is kept for
518/// [`WORKSPACE_RESTORE_DAYS`] so g1t's staff can restore it, then purged:
519/// its memberships, access tokens and old-slug redirects go, and billing's
520/// ledger and the audit log keep its history. The slug is never given to
521/// another workspace; the person whose username it is may make a workspace
522/// of that name again once it is purged. Publishes `workspace.deleting`,
523/// and `workspace.deleted` at the purge. Returns `Outcome<bool>`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look524///
525/// `check_workspace_deletion` takes the same arguments (with `confirm`
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member526/// ignored) and says what would go and whether anything stands in the way,
527/// changing nothing. Returns `Outcome<WorkspaceDeletion>`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look528#[derive(Debug, Serialize, Deserialize)]
529pub struct DeleteWorkspaceArgs {
530 pub actor: User,
531 pub slug: String,
532 #[serde(default)]
533 pub confirm: String,
534 /// Where the request came in, for the audit log; g1t.sh when absent.
535 #[serde(default)]
536 pub surface: Option<crate::audit::Surface>,
537}
538
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member539/// What deleting a workspace takes with it, and what stands in the way.
540/// Nothing does when `billing` is null and it is not `protected`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look541#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
542pub struct WorkspaceDeletion {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member543 /// Its live repositories, which are deleted with it.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look544 pub repositories: u32,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member545 /// Its projects, hidden with it.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look546 pub projects: u32,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member547 #[serde(default)]
548 pub members: u32,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look549 /// Why billing cannot close the workspace yet, in words for its owner.
550 pub billing: Option<String>,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member551 /// It can never be deleted, by anyone ([`protected_names`]).
552 #[serde(default)]
553 pub protected: bool,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look554}
555
556impl WorkspaceDeletion {
557 pub fn blocked(&self) -> bool {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member558 self.protected || self.billing.is_some()
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look559 }
560
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member561 /// Why the workspace cannot be deleted, as one sentence, or `None`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look562 pub fn reason(&self, slug: &str) -> Option<String> {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member563 if self.protected {
564 return Some(protected_refusal(slug));
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look565 }
566 self.billing.clone()
567 }
568}
569
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member570/// How long a deleted workspace is kept, for staff to restore, before it is
571/// purged.
572pub const WORKSPACE_RESTORE_DAYS: u64 = 30;
573
574/// Workspaces nobody can delete, whatever identity's `PROTECTED_WORKSPACES`
575/// says: Flagon's, which runs g1t.
576pub const ALWAYS_PROTECTED: &[&str] = &["flagon-io"];
577
578/// The protected workspaces: `configured` (comma-separated slugs or
579/// workspace ids, as identity's `PROTECTED_WORKSPACES` holds them), and
580/// [`ALWAYS_PROTECTED`] whatever it says, so an empty or missing variable
581/// still protects them. Lowercased, without duplicates.
582pub fn protected_names(configured: Option<&str>) -> Vec<String> {
583 let mut names: Vec<String> = Vec::new();
584 let given = configured.unwrap_or_default().split(',');
585 for name in ALWAYS_PROTECTED.iter().copied().chain(given) {
586 let name = name.trim().to_lowercase();
587 if !name.is_empty() && !names.contains(&name) {
588 names.push(name);
589 }
590 }
591 names
592}
593
594/// Why a protected workspace is not deleted, purged or acted on.
595pub fn protected_refusal(slug: &str) -> String {
596 format!("{slug} is protected and can never be deleted.")
597}
598
599/// `admin_deleted_workspaces` takes no arguments (`{}`) and returns
600/// `Vec<DeletedWorkspace>`, newest first. Staff only.
601///
602/// A workspace an owner deleted, kept until `purge_after` for staff to
603/// restore.
604#[derive(Clone, Debug, Serialize, Deserialize)]
605#[serde(rename_all = "camelCase")]
606pub struct DeletedWorkspace {
607 pub workspace_id: String,
608 pub slug: String,
609 pub name: String,
610 /// RFC 3339.
611 pub deleted_at: String,
Merge sudo: delete an account with the workspaces it alone owns, purge each612 /// The username of the owner who deleted it, or the staff member (by
613 /// email) who deleted it with the account that was its only owner.
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member614 pub deleted_by: String,
615 /// RFC 3339: when it is purged unless restored first.
616 pub purge_after: String,
617 /// What went with it, counted when it was deleted.
618 pub went: WorkspaceDeletion,
619 /// Whether staff can still restore it.
620 pub restorable: bool,
621}
622
623/// `admin_restore_workspace` and `admin_purge_workspace`: staff restore a
624/// deleted workspace within [`WORKSPACE_RESTORE_DAYS`], or purge it now.
625/// `staff` is who, for the audit logs. Purging needs `confirm`, the slug
626/// typed out, and is refused for a protected workspace. Restoring publishes
627/// `workspace.restored`; purging, `workspace.deleted`. Both return
628/// `Outcome<bool>`.
629#[derive(Debug, Serialize, Deserialize)]
630#[serde(rename_all = "camelCase")]
631pub struct AdminDeletedWorkspaceArgs {
632 pub workspace_id: String,
633 pub staff: String,
634 #[serde(default)]
635 pub confirm: String,
636}
637
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look638/// `transfer_repo_scopes`: a repository moved from `from` to `to`; the
639/// tokens of agents at work on it are kept pointing at it. For repos'
640/// `transfer`. Returns `bool`.
641#[derive(Debug, Serialize, Deserialize)]
642pub struct TransferRepoScopesArgs {
643 pub from: crate::repos::RepoPath,
644 pub to: crate::repos::RepoPath,
645}
646
Agents and memory, checks and conflicts, profiles, slug renames, custom domains647/// How long a workspace's old slug keeps redirecting to it, and stays
648/// reserved for it, after a rename.
649pub const SLUG_HOLD_DAYS: u64 = 90;
650
651/// How long a workspace must wait between renames.
652pub const RENAME_COOLDOWN_HOURS: u64 = 24;
653
654// `resolve_slug` takes `SlugArgs` and returns `Option<String>`: the
655// workspace's current slug when `slug` is one it was renamed from within
656// the last `SLUG_HOLD_DAYS`, and null otherwise (including for a slug that
Merge branch 'worktree-agent-a8385d293d42c913a'657// is in use), or the workspace's slug when `slug` is one of its aliases.
658
659// `resolve_alias` takes `SlugArgs` and returns `Option<String>`: the slug
660// now of the workspace `slug` is an alias of, and null when it is none.
661// Aliases are set by g1t's staff only: `g1t` is Flagon, Inc.'s `flagon-io`.
662// An alias follows its workspace through renames.
663
664/// `admin_aliases` takes no arguments (`{}`) and returns
665/// `Vec<WorkspaceAlias>`, by alias. Staff only.
666///
667/// A name staff point at a workspace, so that its addresses (pages, git,
668/// the API, packages) lead to the workspace under its own name.
669#[derive(Clone, Debug, Serialize, Deserialize)]
670#[serde(rename_all = "camelCase")]
671pub struct WorkspaceAlias {
672 pub alias: String,
673 pub workspace_id: String,
674 /// The workspace's slug and name now.
675 pub workspace: String,
676 pub workspace_name: String,
677 /// Why it exists, as staff wrote it.
678 pub note: String,
679 /// The staff member who set it, or `migration`.
680 pub created_by: String,
681 /// RFC 3339.
682 pub created_at: String,
683}
684
685/// `admin_set_alias`: points `alias` at the workspace whose slug is
686/// `workspace`. The alias must have a namespace's shape, must not be one of
687/// the site's routes, and must not be anyone's username, a workspace's slug
688/// (deleted, or held after a rename) or another alias. `note` is required:
689/// it is the reason, kept with the alias and in sudo's audit log. Staff
690/// only. Returns `Outcome<WorkspaceAlias>`.
691#[derive(Debug, Serialize, Deserialize)]
692#[serde(rename_all = "camelCase")]
693pub struct AdminSetAliasArgs {
694 pub alias: String,
695 pub workspace: String,
696 pub note: String,
697 pub staff: String,
698}
699
700/// `admin_remove_alias`: the alias stops leading anywhere, and the name is
701/// nobody's again unless it is reserved. `reason` goes in sudo's audit log.
702/// Staff only. Returns `Outcome<bool>`.
703#[derive(Debug, Serialize, Deserialize)]
704#[serde(rename_all = "camelCase")]
705pub struct AdminRemoveAliasArgs {
706 pub alias: String,
707 pub reason: String,
708 pub staff: String,
709}
Agents and memory, checks and conflicts, profiles, slug renames, custom domains710
Workspace names and icons, and a component kit for every control711/// `set_workspace_avatar`: owners only. `image` is the file's bytes in
712/// base64: PNG, JPEG, WebP or GIF, at most `MAX_AVATAR_BYTES`. Null removes
713/// the icon. Returns `Outcome<Workspace>`.
714#[derive(Debug, Serialize, Deserialize)]
715pub struct SetWorkspaceAvatarArgs {
716 pub actor: User,
717 pub slug: String,
718 pub image: Option<String>,
719}
720
721/// `set_user_avatar`: a person's own avatar, as `SetWorkspaceAvatarArgs`.
722/// Returns `Outcome<Option<String>>`: the new avatar, or null once removed.
723#[derive(Debug, Serialize, Deserialize)]
724pub struct SetUserAvatarArgs {
725 pub user: User,
726 pub image: Option<String>,
727}
728
729/// The largest avatar that can be uploaded, in bytes.
730pub const MAX_AVATAR_BYTES: usize = 1024 * 1024;
731
Agents as a team: lifecycle, merge queue, billing and a new shell732/// `list_workspace_tokens`: members only. Returns
733/// `Outcome<Vec<AccessToken>>`.
734#[derive(Debug, Serialize, Deserialize)]
735pub struct WorkspaceTokensArgs {
736 pub slug: String,
737 pub viewer: crate::Viewer,
738}
739
740/// `create_workspace_token`: owners only. The token belongs to the
741/// workspace, acts as it, and keeps working when the member who made it
742/// leaves. Returns `Outcome<CreatedAccessToken>`.
743#[derive(Debug, Serialize, Deserialize)]
744pub struct CreateWorkspaceTokenArgs {
745 pub actor: User,
746 pub slug: String,
747 pub name: String,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step748 /// Its scopes; null for full access.
749 #[serde(default)]
750 pub scopes: Option<Vec<String>>,
751 /// When set, the token stops working after this many seconds. It is
752 /// listed with the workspace's tokens either way. Null: no expiry.
753 #[serde(default)]
754 pub ttl_seconds: Option<u64>,
Fine-grained personal tokens, workspace token rules and approvals in identity755 /// Admin on the workspace's repositories, rather than Write: given by
756 /// the owner on purpose, when making it.
757 #[serde(default)]
758 pub admin: bool,
Agents as a team: lifecycle, merge queue, billing and a new shell759}
760
761/// `remove_workspace_token`: owners only. Returns `Outcome<bool>`.
762#[derive(Debug, Serialize, Deserialize)]
763pub struct RemoveWorkspaceTokenArgs {
764 pub actor: User,
765 pub slug: String,
766 pub id: String,
767}
768
OAuth 2.1 sign-in for MCP clients and other applications769/// `oauth_authorize`: the signed-in person approved an application. The
770/// caller has checked the client and that it may be redirected to
771/// `redirect_uri`. Returns `OAuthCode`.
772#[derive(Debug, Serialize, Deserialize)]
773#[serde(rename_all = "camelCase")]
774pub struct OAuthAuthorizeArgs {
775 pub user: User,
776 pub client_id: String,
777 /// Shown wherever the application's access is listed.
778 pub client_name: String,
779 pub redirect_uri: String,
780 /// PKCE challenge, method S256.
781 pub code_challenge: String,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step782 /// What the person granted, as `resource:level`. Null: full access.
783 #[serde(default)]
784 pub scopes: Option<Vec<String>>,
OAuth 2.1 sign-in for MCP clients and other applications785}
786
787#[derive(Debug, Serialize, Deserialize)]
788pub struct OAuthCode {
789 pub code: String,
790}
791
792/// `oauth_exchange`: redeems an authorization code.
793/// Returns `Outcome<OAuthTokens>`.
794#[derive(Debug, Serialize, Deserialize)]
795#[serde(rename_all = "camelCase")]
796pub struct OAuthExchangeArgs {
797 pub code: String,
798 pub code_verifier: String,
799 pub client_id: String,
800 pub redirect_uri: String,
801}
802
803/// `oauth_refresh`: trades a refresh token for new tokens.
804/// Returns `Outcome<OAuthTokens>`.
805#[derive(Debug, Serialize, Deserialize)]
806#[serde(rename_all = "camelCase")]
807pub struct OAuthRefreshArgs {
808 pub refresh_token: String,
809 pub client_id: String,
810}
811
812#[derive(Debug, Serialize, Deserialize)]
813#[serde(rename_all = "camelCase")]
814pub struct OAuthTokens {
815 pub access_token: String,
816 /// Works once; using it returns the next one.
817 pub refresh_token: String,
818 /// Seconds until the access token stops working.
819 pub expires_in: u64,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step820 /// The scopes granted, space-separated, or `*` for full access.
821 #[serde(default)]
822 pub scope: Option<String>,
OAuth 2.1 sign-in for MCP clients and other applications823}
824
825/// An application a person has signed in to. Listed by `list_oauth_grants`
826/// and ended by `revoke_oauth_grant`.
827#[derive(Debug, Serialize, Deserialize)]
828#[serde(rename_all = "camelCase")]
829pub struct OAuthGrant {
830 pub id: String,
831 pub client_name: String,
832 /// RFC 3339.
833 pub created_at: String,
834 /// RFC 3339.
835 pub last_used_at: String,
Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step836 /// What the person granted. Null: full access.
837 #[serde(default)]
838 pub scopes: Option<Vec<String>>,
839 /// Signed in before applications were given scopes: full access until
840 /// someone narrows it.
841 #[serde(default)]
842 pub legacy: bool,
843}
844
845/// `update_oauth_grant`: changes what an application the person signed in
846/// to may do, at once and when it refreshes. Returns `Outcome<OAuthGrant>`.
847#[derive(Debug, Serialize, Deserialize)]
848pub struct UpdateOAuthGrantArgs {
849 pub user: User,
850 pub id: String,
851 #[serde(default)]
852 pub scopes: Option<Vec<String>>,
OAuth 2.1 sign-in for MCP clients and other applications853}
Agents as a team: lifecycle, merge queue, billing and a new shell854
855
856/// What an agent's token may do: these operations, in this repository.
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API857#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
Agents as a team: lifecycle, merge queue, billing and a new shell858pub struct AgentScope {
859 pub repo: crate::repos::RepoPath,
860 /// API and MCP operation names, such as `create_issue`.
861 pub operations: Vec<String>,
Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API862 /// Set on a run credential: the run it belongs to, and what it may do
863 /// with git. See [`crate::credentials`].
864 #[serde(default, skip_serializing_if = "Option::is_none")]
865 pub run: Option<crate::credentials::RunBinding>,
Agents as a team: lifecycle, merge queue, billing and a new shell866}
867
868/// `create_agent_token`: a token for a g1t agent working on someone's
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent869/// behalf. It acts as `g1t`, a member of the repository's workspace,
Agents as a team: lifecycle, merge queue, billing and a new shell870/// and only for the operations in `scope`. Returns `CreatedAccessToken`.
871#[derive(Debug, Serialize, Deserialize)]
872#[serde(rename_all = "camelCase")]
873pub struct CreateAgentTokenArgs {
874 /// The person the agent works for; the token is recorded as theirs.
875 pub on_behalf_of: User,
876 pub scope: AgentScope,
877 pub ttl_seconds: u64,
878}
879
880// `agent_scope` takes `TokenArgs` and returns `Option<AgentScope>`: what an
881// agent's token may do, or null for any other token.
882
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent883/// The id g1t's agent acts under. Only ever stored, never shown: it keeps
884/// the agent's work apart from g1t's own ([`crate::system::ID`]) where
885/// that matters, such as whether its approval counts.
Agents as a team: lifecycle, merge queue, billing and a new shell886pub const AGENT_ID: &str = "usr_g1t_agent";
g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent887/// The name g1t's agent is shown by: g1t's own, [`crate::system::USERNAME`].
888/// Everything it does, people see g1t do.
889pub const AGENT_NAME: &str = crate::system::USERNAME;
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace890
891// --- Staff ---------------------------------------------------------------
892//
893// Staff-only methods, for sudo.g1t.sh. They take no viewer and check no
894// membership: only sudo calls them, over its service binding, after it has
895// verified a Cloudflare Access sign-in and its staff list. Nothing a
896// customer can reach should ever forward to them.
897
898/// `notify_owners`: emails a short notice, with one link, to each owner of
899/// a workspace with a confirmed address. Called by other services (billing
900/// warns owners near their usage limit), never on a person's behalf.
901/// Returns how many were sent.
902#[derive(Clone, Debug, Serialize, Deserialize)]
903pub struct NotifyOwnersArgs {
904 pub workspace: String,
905 pub subject: String,
906 /// One or two sentences: what happened and what it means.
907 pub intro: String,
908 /// The button's words, such as `Open billing`.
909 pub action: String,
910 /// Where the button goes; must be on g1t.sh.
911 pub link: String,
912 /// Small print: why they got it.
913 pub footer: String,
914}
915
916/// `admin_workspaces`: every workspace, newest first, at most
917/// [`ADMIN_WORKSPACES_LIMIT`], optionally only those whose slug, name or
918/// an owner's username or email contains `query`. Returns
919/// `Vec<AdminWorkspace>`. Staff only.
920#[derive(Debug, Default, Serialize, Deserialize)]
921pub struct AdminWorkspacesArgs {
922 #[serde(default)]
923 pub query: Option<String>,
924}
925
926/// The most workspaces one `admin_workspaces` call returns.
927pub const ADMIN_WORKSPACES_LIMIT: usize = 500;
928
929/// An owner of a workspace, as staff see them.
930#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
931pub struct AdminOwner {
932 pub username: String,
933 pub email: Option<String>,
934}
935
936/// A workspace as staff see it: who owns it and how many belong to it.
937#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
938#[serde(rename_all = "camelCase")]
939pub struct AdminWorkspace {
940 pub slug: String,
941 pub name: String,
942 /// RFC 3339.
943 pub created_at: String,
944 pub owners: Vec<AdminOwner>,
945 pub member_count: u32,
946}
947
948/// `admin_workspace`: one workspace with every member, or null. Takes
949/// `SlugArgs`; returns `Option<AdminWorkspaceDetail>`. Staff only.
950#[derive(Clone, Debug, Serialize, Deserialize)]
951#[serde(rename_all = "camelCase")]
952pub struct AdminWorkspaceDetail {
953 pub slug: String,
954 pub name: String,
955 pub description: Option<String>,
956 /// RFC 3339.
957 pub created_at: String,
958 /// Owners first, then by username.
959 pub members: Vec<AdminMember>,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member960 /// It can never be deleted ([`protected_names`]).
961 #[serde(default)]
962 pub protected: bool,
Billing on Stripe's pages, month-end charges, warnings; sudo by workspace963}
964
965/// A member of a workspace, as staff see them.
966#[derive(Clone, Debug, Serialize, Deserialize)]
967pub struct AdminMember {
968 pub username: String,
969 pub email: Option<String>,
970 pub role: crate::Role,
971 /// When they joined the workspace. RFC 3339.
972 pub joined: String,
973}
Agents and memory, checks and conflicts, profiles, slug renames, custom domains974
975// --- Profiles ------------------------------------------------------------
976//
977// A person's public page at `g1t.sh/u/<username>`. Everything in a
978// `Profile` is shown to anyone, signed in or not; an email address never is.
979
980/// The most characters each profile field takes.
981pub const MAX_PROFILE_NAME: usize = 80;
982pub const MAX_PROFILE_BIO: usize = 160;
983pub const MAX_PROFILE_LOCATION: usize = 80;
984pub const MAX_PROFILE_WEBSITE: usize = 200;
985pub const MAX_PROFILE_PRONOUNS: usize = 40;
Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039)986pub const MAX_PROFILE_TIMEZONE: usize = 64;
Agents and memory, checks and conflicts, profiles, slug renames, custom domains987
988/// What anyone may see about a person.
989#[derive(Clone, Debug, Default, Serialize, Deserialize)]
990#[serde(rename_all = "camelCase")]
991pub struct Profile {
992 pub username: String,
993 /// The name they go by, if they gave one.
994 pub name: Option<String>,
995 /// One or two lines about them, at most [`MAX_PROFILE_BIO`] characters.
996 pub bio: Option<String>,
997 pub location: Option<String>,
998 /// An `https://` address.
999 pub website: Option<String>,
1000 pub pronouns: Option<String>,
Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039)1001 /// The time zone they are in, an IANA name such as `America/Denver`.
1002 #[serde(default)]
1003 pub timezone: Option<String>,
Agents and memory, checks and conflicts, profiles, slug renames, custom domains1004 /// The uploaded avatar's hash, served at `/avatars/<avatar>`.
1005 pub avatar: Option<String>,
1006 /// When the account was made. RFC 3339.
1007 pub created_at: String,
1008}
1009
1010// `profile` takes `UsernameArgs` and returns `Option<Profile>`: null for
1011// an account that does not exist.
1012
1013/// `update_profile`: a person changes their own profile. Every field is
1014/// replaced; an empty one is cleared. Returns `Outcome<Profile>`.
1015#[derive(Debug, Default, Serialize, Deserialize)]
1016#[serde(rename_all = "camelCase")]
1017pub struct UpdateProfileArgs {
1018 pub actor: User,
1019 #[serde(default)]
1020 pub name: String,
1021 #[serde(default)]
1022 pub bio: String,
1023 #[serde(default)]
1024 pub location: String,
1025 #[serde(default)]
1026 pub website: String,
1027 #[serde(default)]
1028 pub pronouns: String,
Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039)1029 /// An IANA time zone name, such as `America/Denver`.
1030 #[serde(default)]
1031 pub timezone: String,
Agents and memory, checks and conflicts, profiles, slug renames, custom domains1032}
1033
1034/// `profile_workspaces`: the workspaces shown on a person's profile, as
1035/// `viewer` may see them. A membership is shown only when it is no secret
1036/// from the viewer: a workspace the viewer belongs to as well, or one of
1037/// `public`, the workspaces the caller found the person has made a public
1038/// project in (whose page shows that already). Returns
1039/// `Vec<ProfileWorkspace>`; empty for an account that does not exist.
1040#[derive(Debug, Serialize, Deserialize)]
1041pub struct ProfileWorkspacesArgs {
1042 pub username: String,
1043 pub viewer: crate::Viewer,
1044 #[serde(default)]
1045 pub public: Vec<String>,
1046}
1047
1048/// A workspace on a person's profile.
1049#[derive(Clone, Debug, Serialize, Deserialize)]
1050pub struct ProfileWorkspace {
1051 pub slug: String,
1052 pub name: String,
1053 pub avatar: Option<String>,
1054}
Search across all of g1t, Explore, and a command palette1055
1056/// `directory`: every account or every workspace, as their public pages
1057/// show them, a page at a time in name order. For services that index
1058/// them, such as search; nothing private is in it. Returns
1059/// `DirectoryPage`.
1060#[derive(Debug, Default, Serialize, Deserialize)]
1061pub struct DirectoryArgs {
1062 /// `user` or `workspace`.
1063 pub kind: String,
1064 /// Names after this one.
1065 #[serde(default)]
1066 pub after: Option<String>,
1067 pub limit: u32,
1068}
1069
1070/// One account or workspace in the directory.
1071#[derive(Clone, Debug, Serialize, Deserialize)]
1072#[serde(rename_all = "camelCase")]
1073pub struct DirectoryEntry {
1074 /// The account's or workspace's id.
1075 pub id: String,
1076 /// A username or a workspace's slug.
1077 pub slug: String,
1078 /// A person's display name or a workspace's name.
1079 pub name: Option<String>,
1080 /// A person's bio or a workspace's description.
1081 pub bio: Option<String>,
1082 pub avatar: Option<String>,
1083 /// RFC 3339.
1084 pub created_at: String,
1085}
1086
1087#[derive(Clone, Debug, Default, Serialize, Deserialize)]
1088pub struct DirectoryPage {
1089 pub entries: Vec<DirectoryEntry>,
1090 /// Where the next page starts; null on the last.
1091 pub next: Option<String>,
1092}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1093
1094// --- Invites ---------------------------------------------------------------
1095//
1096// While registration is invite-only, every new account (with a password or
1097// through GitHub) needs an invite code. Each person may have
1098// `INVITES_PER_USER` invites out at a time; staff grant more to a person or
1099// to a workspace, whose owners share them. Inviting an email with no
1100// account into a workspace makes an invite bound to that address, which
1101// registers and joins in one step. See services/identity/src/invites.rs.
1102
1103/// Whether anyone may make an account, or only someone with an invite. Set
1104/// by identity's `REGISTRATION_MODE` var; anything but `open`, including
1105/// leaving it unset, is `invite`, so a missing setting never opens sign-up.
1106#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
1107#[serde(rename_all = "snake_case")]
1108pub enum RegistrationMode {
1109 #[default]
1110 Invite,
1111 Open,
1112}
1113
1114impl RegistrationMode {
1115 pub fn parse(text: Option<&str>) -> RegistrationMode {
1116 match text.map(|text| text.trim().to_ascii_lowercase()).as_deref() {
1117 Some("open") => RegistrationMode::Open,
1118 _ => RegistrationMode::Invite,
1119 }
1120 }
1121}
1122
1123/// How many invites a person may have out at once, unless identity's
1124/// `INVITES_PER_USER` var says otherwise.
1125pub const INVITES_PER_USER: u32 = 5;
1126
1127/// How long an invite works, unless identity's `INVITE_TTL_DAYS` var says
1128/// otherwise.
1129pub const INVITE_TTL_DAYS: u64 = 30;
1130
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)1131/// Where an invite stands. Only a pending invite can be used. A pending
1132/// invite can be revoked, and so can one awaiting confirmation. An expired
1133/// or revoked invite that was never used gives its inviter the invite back.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1134#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1135#[serde(rename_all = "snake_case")]
1136pub enum InviteStatus {
1137 Pending,
Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036)1138 /// Used to make an account that has not confirmed its email address
1139 /// yet. The code is spent; the workspace (or repository) it gives is
1140 /// joined when the address is confirmed, unless it is revoked first.
1141 AwaitingConfirmation,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1142 /// Used to make an account that has confirmed its address, for a
1143 /// workspace it has not yet joined or declined: the workspace
1144 /// invitation waits for the person's answer (`accept_invitation`).
1145 AwaitingAnswer,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1146 Redeemed,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1147 /// Its person declined the workspace it invited them to.
1148 Declined,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1149 Expired,
1150 Revoked,
1151}
1152
1153/// What using an invite does.
1154#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1155#[serde(rename_all = "snake_case")]
1156pub enum InviteKind {
1157 /// Makes a new account, and joins `workspace` when one is set.
1158 Account,
1159 /// An existing account joins `workspace`. Never makes an account.
1160 Workspace,
1161}
1162
1163/// Whose allowance an invite uses.
1164#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1165#[serde(rename_all = "snake_case")]
1166pub enum InviteCharge {
1167 /// Its inviter's own.
1168 User,
1169 /// The workspace's, granted by staff and shared by its owners.
1170 Workspace,
1171 /// Nobody's: staff minted it, or it invites an existing account.
1172 None,
1173}
1174
1175/// One invite, as the person who made it sees it.
1176#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1177#[serde(rename_all = "camelCase")]
1178pub struct Invite {
1179 pub id: String,
1180 /// The code, such as `g1t-k7m2-q9xd-…`: returned once when the invite
1181 /// is made, and afterwards to whoever made it while it is pending.
1182 /// Null otherwise.
1183 pub code: Option<String>,
1184 /// The code's first group, such as `g1t-k7m2`, to recognise it by.
1185 pub hint: String,
1186 /// Only an account with this address can use it. Null: anyone with
1187 /// the code.
1188 pub email: Option<String>,
1189 pub kind: InviteKind,
1190 /// The workspace it joins, by slug.
1191 pub workspace: Option<String>,
1192 pub status: InviteStatus,
1193 pub charged_to: InviteCharge,
1194 /// Who made it, by username. Null when g1t staff did.
1195 pub invited_by: Option<String>,
1196 /// The account that used it, by username.
1197 pub redeemed_by: Option<String>,
1198 /// RFC 3339.
1199 pub created_at: String,
1200 /// RFC 3339.
1201 pub expires_at: String,
1202 /// RFC 3339.
1203 pub redeemed_at: Option<String>,
1204 /// RFC 3339.
1205 pub revoked_at: Option<String>,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1206 /// The account a workspace invitation is for, by username: someone
1207 /// invited by username, or the account the invite made.
1208 #[serde(default)]
1209 pub invitee: Option<String>,
1210 /// The role `workspace` is joined with. Null when it names none.
1211 #[serde(default)]
1212 pub role: Option<crate::Role>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1213 /// The staff member who minted it. Only in staff views.
1214 #[serde(default, skip_serializing_if = "Option::is_none")]
1215 pub staff: Option<String>,
1216}
1217
1218/// How many invites someone may have out, and how many they have.
1219#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
1220pub struct Allowance {
1221 /// Null: no limit.
1222 pub limit: Option<u32>,
1223 /// Pending and used invites; revoked and expired ones are not counted.
1224 pub used: u32,
1225 /// Null: no limit.
1226 pub remaining: Option<u32>,
1227}
1228
1229impl Allowance {
1230 pub fn new(limit: Option<u32>, used: u32) -> Allowance {
1231 Allowance {
1232 limit,
1233 used,
1234 remaining: limit.map(|limit| limit.saturating_sub(used)),
1235 }
1236 }
1237
1238 pub fn exhausted(&self) -> bool {
1239 self.remaining == Some(0)
1240 }
1241}
1242
1243/// A workspace's shared invites, for one of its owners.
1244#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
1245pub struct WorkspaceAllowance {
1246 pub slug: String,
1247 pub allowance: Allowance,
1248}
1249
1250/// `list_invites` (takes `UserArgs`): a person's invites, newest first,
1251/// and what they have left. Returns `InvitesOverview`.
1252#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1253pub struct InvitesOverview {
1254 pub mode: RegistrationMode,
1255 pub allowance: Allowance,
1256 /// Workspaces the person owns that staff granted invites to.
1257 pub workspaces: Vec<WorkspaceAllowance>,
1258 pub invites: Vec<Invite>,
1259}
1260
1261/// `create_invite`: a person makes an invite, optionally for one email
1262/// address. People only; never an agent or a workspace's token, and not
1263/// before their email is confirmed. Uses one of the person's invites, or,
1264/// with `workspace`, one of the invites staff granted that workspace (its
1265/// owners only). Emails the address when one is given. Returns
1266/// `Outcome<Invite>`, with the code.
1267///
1268/// `revoke_invite` (takes `RemoveArgs`): its maker revokes a pending
1269/// invite; a workspace's owners may revoke one made for the workspace.
1270/// The invite comes back to whoever it was charged to. Returns
1271/// `Outcome<Invite>`.
1272#[derive(Debug, Serialize, Deserialize)]
1273pub struct CreateInviteArgs {
1274 pub user: User,
1275 #[serde(default)]
1276 pub email: Option<String>,
1277 /// Use this workspace's granted invites, by slug.
1278 #[serde(default)]
1279 pub workspace: Option<String>,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1280 /// The workspace the new account is invited to, by slug: one the
1281 /// person owns that can add members (not on the free plan). Once the
1282 /// account is confirmed it gets a workspace invitation to accept, as a
1283 /// member, and no workspace of its own is made for it.
1284 #[serde(default)]
1285 pub join: Option<String>,
Merge two kinds of invite, kept apart: an invite to g1t (Settings, invite-only only, no workspace unless asked) and an invitation to a workspace (its People page)1286 /// The role `join` invites them with; member when absent. Ignored
1287 /// without `join`.
1288 #[serde(default)]
1289 pub join_role: Option<crate::Role>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1290 /// Where the request came in, for the audit log; g1t.sh when absent.
1291 #[serde(default)]
1292 pub surface: Option<crate::audit::Surface>,
1293}
1294
1295/// `check_invite`: what an invite code is for, before using it. Returns
1296/// `Outcome<InvitePreview>`; a code that is unknown, used, revoked or
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1297/// expired gets the same answer, so codes cannot be probed. With
1298/// `any_status`, a real code that can no longer be used is described
1299/// instead (its `status` says why), so the page can say whom to ask for a
1300/// new one; an unknown code still gets the one answer.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1301#[derive(Debug, Serialize, Deserialize)]
1302pub struct InviteCodeArgs {
1303 pub code: String,
1304 /// Who is asking, such as the visitor's IP address, for rate limits.
1305 #[serde(default)]
1306 pub client: Option<String>,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1307 /// Who is looking, if signed in: sets `InvitePreview::for_viewer`.
1308 #[serde(default)]
1309 pub viewer: Option<User>,
1310 #[serde(default)]
1311 pub any_status: bool,
Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm1312 /// The `proof` from the invite email's link, if the page was opened
1313 /// from it: sets `InvitePreview::email_proven`.
1314 #[serde(default)]
1315 pub email_proof: Option<String>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1316}
1317
1318/// Someone shown on an invite.
1319#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1320pub struct InviteFrom {
1321 pub username: String,
1322 pub name: Option<String>,
1323 pub avatar: Option<String>,
1324}
1325
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1326/// A repository an invite code was sent with: using the code accepts the
1327/// invitation to collaborate on it.
1328#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1329pub struct InviteRepository {
1330 /// `workspace/repo`.
1331 pub name: String,
1332 /// The role it gives, such as `write`.
1333 pub role: String,
1334}
1335
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1336/// What a valid invite code is for.
1337#[derive(Clone, Debug, Serialize, Deserialize)]
1338#[serde(rename_all = "camelCase")]
1339pub struct InvitePreview {
1340 pub kind: InviteKind,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1341 /// Pending, unless `any_status` asked about a code that is spent.
1342 pub status: InviteStatus,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1343 /// Null when g1t staff sent it.
1344 pub invited_by: Option<InviteFrom>,
1345 pub workspace: Option<ProfileWorkspace>,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1346 /// The repository it accepts an invitation to, if it was sent with one.
1347 pub repository: Option<InviteRepository>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1348 /// The address it is for, partly hidden, such as `a•••@example.com`.
1349 pub email: Option<String>,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1350 /// The address in full, while it is pending: whoever holds the code
1351 /// was sent it there. Fills in and locks the sign-up form.
1352 pub address: Option<String>,
1353 /// Whether the address it is for has a g1t account already, so the
1354 /// page asks them to sign in rather than sign up.
1355 pub has_account: bool,
1356 /// With a viewer: whether the invite is theirs (it is for one of their
1357 /// confirmed addresses, or they used it). Null without a viewer or,
1358 /// for a pending invite, when it is for anyone with the code.
1359 pub for_viewer: Option<bool>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1360 /// RFC 3339.
1361 pub expires_at: String,
Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038)1362 /// For a shared invite link ([`SharedInvite`]): the group it was made
1363 /// for, such as `Cloudflare judges`. Not secret; the sign-up page shows
1364 /// it. Null for a one-person invite.
1365 #[serde(default)]
1366 pub shared_label: Option<String>,
1367 /// For a shared invite link limited to some email domains: those
1368 /// domains, such as `["cloudflare.com"]`. Empty for any address.
1369 #[serde(default)]
1370 pub shared_domains: Vec<String>,
Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm1371 /// Whether `email_proof` was this pending invite's own, from the email
1372 /// it was sent in: the account made with it starts with `address`
1373 /// confirmed. False without a proof, with a wrong one, and for an
1374 /// invite bound to no address.
1375 #[serde(default)]
1376 pub email_proven: bool,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1377}
1378
1379/// `accept_invite`: a signed-in person uses a workspace invite made for
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1380/// their confirmed address, and joins the workspace, or an invite sent with
1381/// a repository invitation, and accepts it. Returns `Outcome<String>`: the
1382/// workspace's slug, or `workspace/repo`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1383#[derive(Debug, Serialize, Deserialize)]
1384pub struct AcceptInviteArgs {
1385 pub user: User,
1386 pub code: String,
1387}
1388
1389/// `invite_member`: an owner invites an email address into a workspace.
1390/// It always makes an invite bound to that address and emails it, so the
1391/// answer never says whether the address has an account. Without one, the
1392/// invite registers and joins in one step, and uses one of the workspace's
1393/// granted invites or else one of the owner's own. With one, it costs
1394/// nothing. Returns `Outcome<Invite>`, with the code.
1395#[derive(Debug, Serialize, Deserialize)]
1396pub struct InviteMemberArgs {
1397 pub actor: User,
1398 pub slug: String,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1399 /// An email address. Give this or `username`.
1400 #[serde(default)]
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1401 pub email: String,
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1402 /// A g1t username: that account gets a workspace invitation to accept
1403 /// or decline, in its inbox and by email. Nobody joins without saying
1404 /// yes.
1405 #[serde(default)]
1406 pub username: Option<String>,
1407 /// The role they join with; member when absent.
1408 #[serde(default)]
1409 pub role: Option<crate::Role>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1410 /// Where the request came in, for the audit log; g1t.sh when absent.
1411 #[serde(default)]
1412 pub surface: Option<crate::audit::Surface>,
1413}
1414
Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040)1415/// A workspace invitation waiting for its person's answer, as they see it.
1416/// `list_invitations` (takes `UserArgs`) returns `Vec<WorkspaceInvitation>`,
1417/// newest first: pending ones only, never expired, revoked or answered.
1418#[derive(Clone, Debug, Serialize, Deserialize)]
1419#[serde(rename_all = "camelCase")]
1420pub struct WorkspaceInvitation {
1421 pub id: String,
1422 pub workspace: ProfileWorkspace,
1423 /// The role accepting joins with.
1424 pub role: crate::Role,
1425 /// Null when g1t staff sent it.
1426 pub invited_by: Option<InviteFrom>,
1427 /// RFC 3339.
1428 pub created_at: String,
1429 /// RFC 3339.
1430 pub expires_at: String,
1431}
1432
1433/// `accept_invitation`: the person it is for joins the workspace with the
1434/// role it names. Returns `Outcome<String>`, the workspace's slug.
1435///
1436/// `decline_invitation`: they say no; whoever sent it is told in their
1437/// inbox. Returns `Outcome<bool>`.
1438#[derive(Debug, Serialize, Deserialize)]
1439pub struct InvitationArgs {
1440 pub user: User,
1441 pub id: String,
1442 /// Where the request came in, for the audit log; g1t.sh when absent.
1443 #[serde(default)]
1444 pub surface: Option<crate::audit::Surface>,
1445}
1446
1447/// `find_people`: accounts whose username starts with `query`, or whose
1448/// name contains it, for picking someone to invite. Only what a profile
1449/// shows: a username, a name and an avatar, never an email address.
1450/// Returns `Vec<InviteFrom>`, at most `limit` (10 at most, 8 when absent).
1451#[derive(Debug, Serialize, Deserialize)]
1452pub struct FindPeopleArgs {
1453 pub query: String,
1454 #[serde(default)]
1455 pub limit: Option<u32>,
1456}
1457
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1458/// `workspace_invites` (takes `ListMembersArgs`): a workspace's invites,
1459/// newest first. Owners only. Returns `Outcome<Vec<Invite>>`.
1460///
1461/// `revoke_workspace_invite`: owners only. Returns `Outcome<Invite>`.
1462#[derive(Debug, Serialize, Deserialize)]
1463pub struct WorkspaceInviteArgs {
1464 pub actor: User,
1465 pub slug: String,
1466 pub id: String,
1467}
1468
1469/// `request_access`: someone without an invite asks for one. Kept on the
1470/// waitlist, one entry per address. Answers the same way whether or not
1471/// the address is already on it. Returns `Outcome<bool>`.
1472#[derive(Debug, Default, Serialize, Deserialize)]
1473pub struct RequestAccessArgs {
1474 pub email: String,
1475 /// What they will build, if they said.
1476 #[serde(default)]
1477 pub about: String,
1478 /// Who is asking, such as the visitor's IP address, for rate limits.
1479 #[serde(default)]
1480 pub client: Option<String>,
1481}
1482
1483/// The most characters `RequestAccessArgs::about` keeps.
1484pub const MAX_WAITLIST_ABOUT: usize = 1000;
1485
1486// `registration` takes `{}` and returns `RegistrationMode`.
1487
1488// --- Invites, staff only ---
1489
1490#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1491#[serde(rename_all = "snake_case")]
1492pub enum WaitlistStatus {
1493 Waiting,
1494 Invited,
1495 Dismissed,
1496}
1497
1498impl WaitlistStatus {
1499 pub fn as_str(self) -> &'static str {
1500 match self {
1501 WaitlistStatus::Waiting => "waiting",
1502 WaitlistStatus::Invited => "invited",
1503 WaitlistStatus::Dismissed => "dismissed",
1504 }
1505 }
1506}
1507
1508/// Someone who asked for access.
1509#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1510#[serde(rename_all = "camelCase")]
1511pub struct WaitlistEntry {
1512 pub id: String,
1513 pub email: String,
1514 pub about: Option<String>,
1515 pub status: WaitlistStatus,
1516 pub invite_id: Option<String>,
1517 pub decided_by: Option<String>,
1518 /// RFC 3339.
1519 pub decided_at: Option<String>,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1520 /// What staff wrote when approving; it went in the invite email.
1521 #[serde(default)]
1522 pub note: Option<String>,
1523 /// The account made with the invite, once it was used.
1524 #[serde(default)]
1525 pub joined_as: Option<String>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1526 /// When they first asked. RFC 3339.
1527 pub created_at: String,
1528 /// When they last asked. RFC 3339.
1529 pub updated_at: String,
1530}
1531
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1532/// `admin_waitlist`: the waitlist, newest first, at most
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1533/// [`ADMIN_INVITES_LIMIT`]. Returns `Vec<WaitlistEntry>`.
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1534///
1535/// `admin_waitlist_pending` takes `{}` and returns the number of requests
1536/// still waiting, for sudo's navigation.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1537#[derive(Debug, Default, Serialize, Deserialize)]
1538pub struct AdminWaitlistArgs {
1539 /// Part of an email address or of what they said.
1540 #[serde(default)]
1541 pub query: Option<String>,
1542 /// Null: every status.
1543 #[serde(default)]
1544 pub status: Option<WaitlistStatus>,
1545}
1546
1547/// The most rows one staff listing of invites or the waitlist returns.
1548pub const ADMIN_INVITES_LIMIT: usize = 500;
1549
1550/// `admin_decide_waitlist`: approving mints an invite bound to the
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1551/// address, charged to nobody, and emails it, with `note` if given;
1552/// dismissing only marks the entry. Returns `Outcome<WaitlistEntry>`.
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1553#[derive(Debug, Serialize, Deserialize)]
1554pub struct AdminDecideWaitlistArgs {
1555 pub id: String,
1556 pub approve: bool,
1557 /// The staff member, by email.
1558 pub staff: String,
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1559 /// A line for the invite email, up to [`MAX_WAITLIST_NOTE`] characters.
1560 #[serde(default)]
1561 pub note: Option<String>,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1562}
1563
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas1564/// The most characters an approval's note keeps.
1565pub const MAX_WAITLIST_NOTE: usize = 500;
1566
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1567/// `admin_invites`: every invite, newest first, at most
1568/// [`ADMIN_INVITES_LIMIT`], optionally only those whose code starts with
1569/// `query`, or whose email, inviter or redeemer contains it. Returns
1570/// `Vec<Invite>`.
1571#[derive(Debug, Default, Serialize, Deserialize)]
1572pub struct AdminInvitesArgs {
1573 #[serde(default)]
1574 pub query: Option<String>,
1575}
1576
1577/// `admin_revoke_invite`: revokes any pending invite. Returns
1578/// `Outcome<Invite>`.
1579#[derive(Debug, Serialize, Deserialize)]
1580pub struct AdminRevokeInviteArgs {
1581 pub id: String,
1582 pub staff: String,
1583}
1584
1585/// `admin_mint_invite`: staff make an invite that uses nobody's
1586/// allowance, optionally bound to (and emailed to) an address. Returns
1587/// `Outcome<Invite>`, with the code.
1588#[derive(Debug, Serialize, Deserialize)]
1589pub struct AdminMintInviteArgs {
1590 #[serde(default)]
1591 pub email: Option<String>,
1592 pub staff: String,
1593}
1594
1595/// Who staff grant invites to.
1596#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1597#[serde(rename_all = "snake_case")]
1598pub enum GrantTarget {
1599 User,
1600 Workspace,
1601}
1602
1603impl GrantTarget {
1604 pub fn as_str(self) -> &'static str {
1605 match self {
1606 GrantTarget::User => "user",
1607 GrantTarget::Workspace => "workspace",
1608 }
1609 }
1610}
1611
1612/// `admin_grant_invites`: gives a person (by username) or a workspace (by
1613/// slug) `amount` more invites; a negative amount takes some back. Returns
1614/// `Outcome<Allowance>`: theirs afterwards.
1615#[derive(Debug, Serialize, Deserialize)]
1616pub struct AdminGrantInvitesArgs {
1617 pub target: GrantTarget,
1618 pub name: String,
1619 pub amount: i32,
1620 #[serde(default)]
1621 pub note: String,
1622 pub staff: String,
1623}
1624
1625/// The most invites one grant gives or takes back.
1626pub const MAX_INVITE_GRANT: i32 = 1000;
1627
1628/// Invites staff granted.
1629#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1630#[serde(rename_all = "camelCase")]
1631pub struct InviteGrant {
1632 pub amount: i32,
1633 pub note: Option<String>,
1634 pub granted_by: String,
1635 /// RFC 3339.
1636 pub created_at: String,
1637}
1638
1639/// Someone a person invited, and whom they invited in turn.
1640#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1641#[serde(rename_all = "camelCase")]
1642pub struct InviteTreeNode {
1643 pub username: String,
1644 /// When they used the invite. RFC 3339.
1645 pub joined_at: String,
1646 pub invited: Vec<InviteTreeNode>,
1647}
1648
1649/// `admin_invite_tree` (takes `UsernameArgs`): where a person came from
1650/// and whom they brought, for tracing abuse. Returns `Option<InviteTree>`.
1651///
1652/// `admin_workspace_invites` (takes `SlugArgs`): a workspace's granted
1653/// invites, grants and invites. Returns `Option<InviteTree>` with
1654/// `username` the slug and no `invited_by`.
1655#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1656#[serde(rename_all = "camelCase")]
1657pub struct InviteTree {
1658 pub username: String,
1659 /// Who invited them, then who invited that person, and so on. Empty
1660 /// for an account made without an invite.
1661 pub invited_by: Vec<String>,
1662 /// The staff member who minted their invite, when staff did.
1663 pub staff: Option<String>,
1664 pub allowance: Allowance,
1665 pub grants: Vec<InviteGrant>,
1666 /// Their invites, newest first.
1667 pub invites: Vec<Invite>,
1668 /// Whom they invited, three levels down.
1669 pub invited: Vec<InviteTreeNode>,
Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038)1670 /// The shared invite link the account was made with, if it was.
1671 #[serde(default)]
1672 pub shared: Option<SharedInviteSource>,
1673}
1674
1675// --- Shared invite links, staff only ---
1676//
1677// One link for a group (a conference's judges, a post, a community): up
1678// to `max_uses` new accounts, until it expires or staff revoke it,
1679// optionally only for addresses at some domains. Each use makes a new
1680// account, which then makes its own workspace; a shared link never joins
1681// anyone to an existing workspace, and uses nobody's allowance. Its code
1682// looks and is stored like any invite code (only a hash, and a sealed copy
1683// staff can copy again while it is live); the link is
1684// `https://g1t.sh/register?invite=<code>`. See
1685// services/identity/src/shared_invites.rs.
1686
1687/// How long a shared invite link works when staff give no date.
1688pub const SHARED_INVITE_TTL_DAYS: u64 = 14;
1689/// The furthest ahead a shared invite link's last day may be set.
1690pub const SHARED_INVITE_MAX_DAYS: u64 = 365;
1691/// The most accounts one shared invite link makes.
1692pub const MAX_SHARED_INVITE_USES: u32 = 1000;
1693/// The most characters a shared invite link's label keeps.
1694pub const MAX_SHARED_INVITE_LABEL: usize = 80;
1695/// The most email domains one shared invite link may be limited to.
1696pub const MAX_SHARED_INVITE_DOMAINS: usize = 10;
1697
1698/// Where a shared invite link stands. Only a live one makes accounts.
1699#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
1700#[serde(rename_all = "snake_case")]
1701pub enum SharedInviteStatus {
1702 Live,
1703 /// Every use is taken.
1704 UsedUp,
1705 Expired,
1706 Revoked,
1707}
1708
1709/// The shared invite link an account was made with.
1710#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
1711pub struct SharedInviteSource {
1712 pub id: String,
1713 pub label: String,
1714}
1715
1716/// An account made with a shared invite link.
1717#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1718#[serde(rename_all = "camelCase")]
1719pub struct SharedInviteAccount {
1720 /// Null once the account is purged.
1721 pub username: Option<String>,
1722 /// When it was made with the link. RFC 3339.
1723 pub joined_at: String,
1724}
1725
1726/// One shared invite link, as staff see it.
1727#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
1728#[serde(rename_all = "camelCase")]
1729pub struct SharedInvite {
1730 /// `sinv_…`.
1731 pub id: String,
1732 /// Whom it is for, such as `Cloudflare judges`.
1733 pub label: String,
1734 /// The code, while it is live (and IDENTITY_KEY is set).
1735 pub code: Option<String>,
1736 /// The code's first group, such as `g1t-k7m2`.
1737 pub hint: String,
1738 pub max_uses: u32,
1739 /// Accounts made with it so far.
1740 pub uses: u32,
1741 /// Only addresses at these domains may use it; empty for any.
1742 pub domains: Vec<String>,
1743 pub status: SharedInviteStatus,
1744 /// The staff member who made it, by email.
1745 pub staff: String,
1746 /// RFC 3339.
1747 pub created_at: String,
1748 /// RFC 3339.
1749 pub expires_at: String,
1750 pub revoked_at: Option<String>,
1751 pub revoked_by: Option<String>,
1752 /// The accounts made with it, oldest first.
1753 pub accounts: Vec<SharedInviteAccount>,
1754}
1755
1756/// `admin_shared_invites` takes `{}`: shared invite links, newest first,
1757/// at most 200, each with the accounts it made. Returns
1758/// `Vec<SharedInvite>`.
1759///
1760/// `admin_create_shared_invite`: staff make a shared invite link. Recorded
1761/// in sudo's audit log. Returns `Outcome<SharedInvite>`, with the code.
1762#[derive(Debug, Default, Serialize, Deserialize)]
1763pub struct AdminCreateSharedInviteArgs {
1764 /// Required, up to [`MAX_SHARED_INVITE_LABEL`] characters.
1765 pub label: String,
1766 /// 1 to [`MAX_SHARED_INVITE_USES`].
1767 pub max_uses: u32,
1768 /// The last day it works, `YYYY-MM-DD` (UTC; it works until the end of
1769 /// that day), at most [`SHARED_INVITE_MAX_DAYS`] ahead. Null for
1770 /// [`SHARED_INVITE_TTL_DAYS`] from now.
1771 #[serde(default)]
1772 pub expires_on: Option<String>,
1773 /// Email domains it is limited to, such as `cloudflare.com`; empty for
1774 /// any address. Up to [`MAX_SHARED_INVITE_DOMAINS`].
1775 #[serde(default)]
1776 pub domains: Vec<String>,
1777 /// The staff member, by email.
1778 pub staff: String,
1779}
1780
1781/// `admin_revoke_shared_invite`: stops a shared invite link making any
1782/// more accounts. Those it made stay. Recorded in sudo's audit log.
1783/// Returns `Outcome<SharedInvite>`.
1784#[derive(Debug, Serialize, Deserialize)]
1785pub struct AdminRevokeSharedInviteArgs {
1786 pub id: String,
1787 pub staff: String,
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1788}
1789
1790#[cfg(test)]
1791mod deletion_tests {
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1792 use super::{WorkspaceDeletion, protected_names};
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1793
1794 #[test]
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1795 fn only_billing_or_protection_stands_in_the_way() {
1796 let clear = WorkspaceDeletion {
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1797 repositories: 2,
1798 projects: 1,
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1799 members: 3,
1800 ..WorkspaceDeletion::default()
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1801 };
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1802 assert!(!clear.blocked());
1803 assert_eq!(clear.reason("acme"), None);
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1804 let owing = WorkspaceDeletion {
1805 billing: Some("Pay first.".into()),
1806 ..WorkspaceDeletion::default()
1807 };
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1808 assert!(owing.blocked());
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1809 assert_eq!(owing.reason("acme").as_deref(), Some("Pay first."));
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member1810 let protected = WorkspaceDeletion {
1811 billing: Some("Pay first.".into()),
1812 protected: true,
1813 ..WorkspaceDeletion::default()
1814 };
1815 assert!(protected.blocked());
1816 assert_eq!(
1817 protected.reason("flagon-io").as_deref(),
1818 Some("flagon-io is protected and can never be deleted.")
1819 );
1820 }
1821
1822 #[test]
1823 fn flagon_is_protected_whatever_the_variable_says() {
1824 assert_eq!(protected_names(None), ["flagon-io"]);
1825 assert_eq!(protected_names(Some("")), ["flagon-io"]);
1826 assert_eq!(protected_names(Some(" , ")), ["flagon-io"]);
1827 assert_eq!(
1828 protected_names(Some("Flagon-IO, acme ,wsp_1")),
1829 ["flagon-io", "acme", "wsp_1"]
1830 );
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look1831 }
1832}

This file's history is long; its oldest lines are credited to the oldest commit read.