flagon-io/g1t

public

1	//! A repository's lifecycle after it is made: renaming it, archiving it,
2	//! making it public or private, changing or renaming its default branch,
3	//! and deleting it with a window to restore it.
4	//!
5	//! Deleting is soft. The row gets `deleted_at` and `purge_after`
6	//! ([`RESTORE_DAYS`] on), every read in the registry leaves it out, git
7	//! refuses it, and `repo.deleted` tells every service to stop what runs for
8	//! it and hide it. Restoring clears the columns (`repo.restored`). Purging,
9	//! by an owner from the Recently deleted list or by the hourly sweep once
10	//! `purge_after` has passed, removes the git data from the store, then the
11	//! rows (its pull requests' working copies with it) and its redirects, and
12	//! announces `repo.purged`, on which services drop what they keep for it.
13	//! Until then its name stays taken, so a restore always has its path back.
14	//!
15	//! A rename is a path change like a transfer: the old path is kept in
16	//! `repo_redirects`, the git store key never changes, the tokens of agents
17	//! at work on it are moved with identity, and `repo.renamed` is handled by
18	//! services with the same helper as `repo.transferred`
19	//! (`g1t_kit::transfer`).
20
21	use g1t_contracts::audit::{
22	AuditActor, AuditOutcome, AuditTarget, NewAuditEntry, RecordAuditArgs, Surface,
23	};
24	use g1t_contracts::events::{
25	BranchRenamed, NewEvent, RepoArchived, RepoDefaultBranchChanged, RepoDeleted, RepoPurged,
26	RepoRenamed, RepoRestored, RepoUpdated, RepoVisibilityChanged, WorkspaceDeleted,
27	WorkspaceDeleting, WorkspaceRestored,
28	};
29	use g1t_contracts::identity::TransferRepoScopesArgs;
30	use g1t_contracts::repos::{
31	ArchiveArgs, DeleteArgs, DeletedArgs, DeletedRepo, DeletedRepoArgs, PurgeDueArgs,
32	RESTORE_DAYS, RenameArgs, RenameBranchArgs, Repo, RepoPath, RepoStatus, ResolveBranchArgs,
33	SetDefaultBranchArgs, SetVisibilityArgs, StatusByIdArgs, archived_message,
34	is_valid_branch_name,
35	};
36	use g1t_contracts::access::{self, Capability, RepoRole};
37	use g1t_contracts::time::rfc3339;
38	use g1t_contracts::{FailureCode, Outcome, PrincipalKind, Role, User, is_valid_repo_name, new_id};
39	use g1t_kit::now_ms;
40	use serde::Deserialize;
41	use worker::Result;
42	use worker::wasm_bindgen::JsValue;
43
44	use crate::registry::{Registry, remember_store, store_key};
45	use crate::store::{GitRepo, GitStore, Scope};
46	use crate::{Repos, SOURCE, UNVERIFIED, git_ops, land, not_found};
47
48	use crate::land::EMPTY_PACK;
49
50	/// How many pull request working copies follow a change of the default
51	/// branch (newest first). Older ones keep the branch they were made with.
52	const FORKS_FOLLOWING: u32 = 100;
53
54	/// How many deleted repositories one sweep purges.
55	const PURGES_PER_SWEEP: u32 = 25;
56
57	type Refusal = (FailureCode, String);
58
59	/// Who is asking, as far as an owner's or an admin's action cares.
60	#[derive(Clone, Copy, Debug)]
61	pub struct Asker {
62	/// A person, not a workspace's or an agent's token.
63	pub person: bool,
64	pub verified: bool,
65	/// Their role in the repository's workspace.
66	pub role: Option<Role>,
67	/// Their role on the repository itself (see g1t_contracts::access).
68	/// None where only the workspace is known, as for deleted ones.
69	pub repo_role: Option<RepoRole>,
70	/// The workspace's member privileges, as their membership carries them.
71	pub privileges: g1t_contracts::MemberPrivileges,
72	}
73
74	impl Asker {
75	pub fn of(user: &User, namespace: &str) -> Self {
76	Asker {
77	person: user.kind == PrincipalKind::User,
78	verified: user.verified,
79	role: user.role_in(&namespace.to_lowercase()),
80	repo_role: None,
81	privileges: user.privileges_in(&namespace.to_lowercase()),
82	}
83	}
84
85	/// The asker, with their role on `repo`.
86	pub fn on(user: &User, repo: &Repo) -> Self {
87	Asker {
88	repo_role: crate::registry::role(repo, &Some(user.clone())),
89	..Asker::of(user, &repo.namespace)
90	}
91	}
92	}
93
94	/// Whether `asker` may `what` ("rename", "archive"...) a repository of
95	/// `namespace` that takes `capability`: a verified person with the role
96	/// the permission table asks (Admin), and for changing visibility,
97	/// transferring and deleting, an owner of the workspace as well, unless its
98	/// member privileges let its members with Admin do it.
99	pub fn admin_only(asker: Asker, namespace: &str, what: &str, capability: Capability) -> std::result::Result<(), Refusal> {
100	let admins_may = asker.role == Some(Role::Member)
101	&& asker.repo_role == Some(RepoRole::Admin)
102	&& !access::owner_only(capability, &asker.privileges);
103	if access::OWNER_ONLY.contains(&capability) && !admins_may {
104	// Someone who can see the repository is told why, not that it is missing.
105	if asker.role.is_none() && asker.repo_role.is_some() && asker.person {
106	return Err((
107	FailureCode::Forbidden,
108	format!("Only an owner of {namespace} can {what} its repositories."),
109	));
110	}
111	return owner_only(asker, namespace, what);
112	}
113	if asker.role.is_none() && asker.repo_role.is_none() {
114	return Err((FailureCode::NotFound, "Repository not found.".into()));
115	}
116	if !asker.person {
117	return Err((
118	FailureCode::Forbidden,
119	format!("Only a person can {what} a repository. Sign in, or use a personal access token."),
120	));
121	}
122	if !asker.repo_role.is_some_and(\|role\| access::allows(role, capability)) {
123	return Err((
124	FailureCode::Forbidden,
125	format!(
126	"You need the {} role on a repository of {namespace} to {what} it.",
127	access::least_role(capability).label()
128	),
129	));
130	}
131	if !asker.verified {
132	return Err((FailureCode::Forbidden, UNVERIFIED.into()));
133	}
134	Ok(())
135	}
136
137	/// Making a repository public or private is, as far as the workspace's
138	/// member privileges go, creating one of that kind: a member may only make
139	/// it what they may create.
140	pub fn visibility_refusal(actor: &User, repo: &Repo, private: bool) -> Option<String> {
141	if repo.is_private == private {
142	return None;
143	}
144	let role = actor.role_in(&repo.namespace.to_lowercase())?;
145	actor.privileges_in(&repo.namespace.to_lowercase()).creation_refusal(role, private, &repo.namespace)
146	}
147
148	/// Whether `asker` may `what` ("delete", "rename"...) a repository of
149	/// `namespace`: a verified person who owns the workspace.
150	pub fn owner_only(asker: Asker, namespace: &str, what: &str) -> std::result::Result<(), Refusal> {
151	if asker.role.is_none() {
152	return Err((FailureCode::NotFound, "Repository not found.".into()));
153	}
154	if !asker.person {
155	return Err((
156	FailureCode::Forbidden,
157	format!("Only a person can {what} a repository. Sign in, or use a personal access token."),
158	));
159	}
160	if asker.role != Some(Role::Owner) {
161	return Err((
162	FailureCode::Forbidden,
163	format!("Only an owner of {namespace} can {what} its repositories."),
164	));
165	}
166	if !asker.verified {
167	return Err((FailureCode::Forbidden, UNVERIFIED.into()));
168	}
169	Ok(())
170	}
171
172	/// Whether what was typed to confirm names the repository: its full name,
173	/// `namespace/name`, in any case.
174	pub fn confirmed(path: &RepoPath, typed: &str) -> bool {
175	typed.trim().to_lowercase() == format!("{}/{}", path.namespace, path.name).to_lowercase()
176	}
177
178	fn confirm_refusal(path: &RepoPath) -> Refusal {
179	(
180	FailureCode::Invalid,
181	format!("Type {}/{} to confirm.", path.namespace, path.name),
182	)
183	}
184
185	/// When a repository deleted at `now_ms` is purged.
186	pub fn purge_after(now_ms: u64) -> String {
187	rfc3339(now_ms + RESTORE_DAYS * 86_400_000)
188	}
189
190	/// Whether a repository to be purged at `purge_after` can still be
191	/// restored at `now` (both RFC 3339, which compare as text).
192	pub fn restorable(purge_after: &str, now: &str) -> bool {
193	now < purge_after
194	}
195
196	/// Whether a workspace's repositories may go with it: never a protected
197	/// workspace's (`protected` is `g1t_contracts::identity::protected_names`),
198	/// however the event came to be published.
199	pub fn may_go_with_workspace(namespace: &str, protected: &[String]) -> std::result::Result<(), String> {
200	if protected.iter().any(\|name\| name.eq_ignore_ascii_case(namespace)) {
201	return Err(g1t_contracts::identity::protected_refusal(namespace));
202	}
203	Ok(())
204	}
205
206	/// Whether a deleted repository comes back when the workspace
207	/// `workspace_id` is restored: only if it went with that workspace
208	/// (`deleted_with`), not if it was deleted on its own before.
209	pub fn comes_back_with(deleted_with: Option<&str>, workspace_id: &str) -> bool {
210	deleted_with == Some(workspace_id)
211	}
212
213	/// Where a repository is in its life, from its row.
214	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
215	pub enum State {
216	Active,
217	Archived,
218	/// Deleted, and restorable until purged.
219	Deleted,
220	/// Deleted, and due to be purged by the next sweep.
221	Due,
222	}
223
224	pub fn state(archived_at: Option<&str>, deleted: Option<(&str, &str)>, now: &str) -> State {
225	match deleted {
226	Some((_, purge_after)) if !restorable(purge_after, now) => State::Due,
227	Some(_) => State::Deleted,
228	None if archived_at.is_some() => State::Archived,
229	None => State::Active,
230	}
231	}
232
233	/// What holds a name in a workspace.
234	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
235	pub enum Held {
236	Free,
237	ByRepo,
238	/// A repository deleted but not yet purged.
239	ByDeleted,
240	}
241
242	/// The name a repository at `current` can be renamed to, tidied, or why
243	/// not.
244	pub fn new_name(namespace: &str, current: &str, wanted: &str, held: Held) -> std::result::Result<String, Refusal> {
245	let name = wanted.trim().to_lowercase();
246	if !is_valid_repo_name(&name) {
247	return Err((
248	FailureCode::Invalid,
249	"Use letters, digits, dots, hyphens and underscores only.".into(),
250	));
251	}
252	if name == current {
253	return Err((FailureCode::Invalid, format!("It is already called {name}.")));
254	}
255	match held {
256	Held::Free => Ok(name),
257	Held::ByRepo => Err((
258	FailureCode::Conflict,
259	format!("{namespace} already has a repository named {name}."),
260	)),
261	Held::ByDeleted => Err((
262	FailureCode::Conflict,
263	format!(
264	"{namespace}/{name} was deleted recently and can still be restored. Restore it and rename it, or delete it permanently from the workspace's Recently deleted list first."
265	),
266	)),
267	}
268	}
269
270	/// Why a write to `repo` is refused because it is archived, if it is.
271	pub fn archived_refusal(repo: &Repo) -> Option<Refusal> {
272	repo.archived()
273	.then(\|\| (FailureCode::Forbidden, archived_message(&repo.namespace, &repo.name)))
274	}
275
276	/// Why a repository takes no pushes, merges or new work now: archived, or
277	/// a mirror that is not taken over (see `g1t_contracts::mirrors`).
278	/// Settings stay changeable on a mirror; only an archived repository
279	/// refuses those (`archived_refusal`).
280	pub fn read_only_refusal(repo: &Repo) -> Option<Refusal> {
281	repo.read_only_reason().map(\|message\| (FailureCode::Forbidden, message))
282	}
283
284	/// Everything that decides whether a repository may go private or public.
285	#[derive(Debug, Default)]
286	pub struct VisibilityFacts {
287	pub to_private: bool,
288	/// The workspace is on no plan, so its private storage is capped.
289	pub free: bool,
290	/// What its private repositories hold now.
291	pub private_bytes: i64,
292	/// What this repository holds.
293	pub bytes: i64,
294	/// What a free workspace's private repositories may hold.
295	pub free_private_bytes: i64,
296	}
297
298	/// Whether the visibility change `facts` describe may happen.
299	pub fn visibility_check(namespace: &str, facts: &VisibilityFacts) -> std::result::Result<(), Refusal> {
300	if facts.to_private
301	&& facts.free
302	&& git_ops::storage_full(facts.private_bytes + facts.bytes, facts.free_private_bytes)
303	{
304	return Err((
305	FailureCode::PaymentRequired,
306	format!(
307	"{namespace}'s private repositories would hold {:.2} GB, more than the {:.0} GB a free workspace has. Start the g1t plan in {namespace}, or keep the repository public.",
308	(facts.private_bytes + facts.bytes) as f64 / 1e9,
309	facts.free_private_bytes as f64 / 1e9,
310	),
311	));
312	}
313	Ok(())
314	}
315
316	/// Whether `from` can be renamed to `to` in a repository whose branches
317	/// are `branches`. `to` is tidied of surrounding space.
318	pub fn branch_rename(from: &str, to: &str, branches: &[String]) -> std::result::Result<String, Refusal> {
319	let to = to.trim().to_owned();
320	if !branches.iter().any(\|branch\| branch == from) {
321	return Err((FailureCode::NotFound, format!("There is no branch named {from}.")));
322	}
323	if !is_valid_branch_name(&to) {
324	return Err((
325	FailureCode::Invalid,
326	format!("{to:?} cannot be a branch name. Use letters, digits, '/', '-', '_' and '.', and no spaces."),
327	));
328	}
329	if to == from {
330	return Err((FailureCode::Invalid, format!("It is already called {to}.")));
331	}
332	if branches.contains(&to) {
333	return Err((FailureCode::Conflict, format!("There is already a branch named {to}.")));
334	}
335	Ok(to)
336	}
337
338	/// The row of a deleted repository.
339	#[derive(Deserialize)]
340	struct DeletedRow {
341	id: String,
342	namespace: String,
343	name: String,
344	description: Option<String>,
345	is_private: u8,
346	deleted_at: String,
347	#[serde(default)]
348	deleted_by: Option<String>,
349	purge_after: String,
350	#[serde(default)]
351	deleted_with: Option<String>,
352	}
353
354	impl From<DeletedRow> for DeletedRepo {
355	fn from(row: DeletedRow) -> Self {
356	DeletedRepo {
357	id: row.id,
358	namespace: row.namespace,
359	name: row.name,
360	description: row.description,
361	is_private: row.is_private != 0,
362	deleted_at: row.deleted_at,
363	deleted_by: row.deleted_by.unwrap_or_default(),
364	purge_after: row.purge_after,
365	}
366	}
367	}
368
369	const DELETED_COLUMNS: &str =
370	"id, namespace, name, description, is_private, deleted_at, deleted_by, purge_after, deleted_with";
371
372	impl Registry {
373	/// Deletes a repository and its pull requests' working copies, softly.
374	pub async fn soft_delete(&self, id: &str, by: &str, at: &str, purge_after: &str) -> Result<()> {
375	self.db
376	.prepare(
377	"UPDATE repos SET deleted_at = ?1, deleted_by = ?2, purge_after = ?3
378	WHERE (id = ?4 OR fork_of = ?4) AND deleted_at IS NULL",
379	)
380	.bind(&[at.into(), by.into(), purge_after.into(), id.into()])?
381	.run()
382	.await?;
383	Ok(())
384	}
385
386	/// Brings a deleted repository and its working copies back.
387	pub async fn undelete(&self, id: &str) -> Result<()> {
388	self.db
389	.prepare(
390	"UPDATE repos SET deleted_at = NULL, deleted_by = NULL, purge_after = NULL
391	WHERE id = ?1 OR fork_of = ?1",
392	)
393	.bind(&[id.into()])?
394	.run()
395	.await?;
396	Ok(())
397	}
398
399	/// Deletes every live repository of `namespace`, and the working
400	/// copies of its repositories, softly, each marked as gone with the
401	/// workspace `workspace_id`. Those already deleted are left as they
402	/// are. Returns every repository so marked, this time or before, so a
403	/// delivery again tells services again.
404	pub async fn delete_with_workspace(
405	&self,
406	namespace: &str,
407	workspace_id: &str,
408	by: &str,
409	at: &str,
410	purge_after: &str,
411	) -> Result<Vec<DeletedRepo>> {
412	self.db
413	.prepare(
414	"UPDATE repos SET deleted_at = ?1, deleted_by = ?2, purge_after = ?3, deleted_with = ?4
415	WHERE deleted_at IS NULL
416	AND (namespace = ?5 OR fork_of IN (SELECT id FROM repos WHERE namespace = ?5))",
417	)
418	.bind(&[at.into(), by.into(), purge_after.into(), workspace_id.into(), namespace.into()])?
419	.run()
420	.await?;
421	self.deleted_with(workspace_id).await
422	}
423
424	/// The repositories deleted with the workspace `workspace_id`.
425	pub async fn deleted_with(&self, workspace_id: &str) -> Result<Vec<DeletedRepo>> {
426	Ok(self
427	.db
428	.prepare(format!(
429	"SELECT {DELETED_COLUMNS} FROM repos WHERE deleted_with = ? AND fork_of IS NULL"
430	))
431	.bind(&[workspace_id.into()])?
432	.all()
433	.await?
434	.results::<DeletedRow>()?
435	.into_iter()
436	.filter(\|row\| comes_back_with(row.deleted_with.as_deref(), workspace_id))
437	.map(DeletedRepo::from)
438	.collect())
439	}
440
441	/// Brings back the repositories, and their working copies, deleted
442	/// with the workspace `workspace_id`, and only those.
443	pub async fn undelete_with_workspace(&self, workspace_id: &str) -> Result<()> {
444	self.db
445	.prepare(
446	"UPDATE repos SET deleted_at = NULL, deleted_by = NULL, purge_after = NULL, deleted_with = NULL
447	WHERE deleted_with = ?",
448	)
449	.bind(&[workspace_id.into()])?
450	.run()
451	.await?;
452	Ok(())
453	}
454
455	/// A workspace's deleted repositories, newest first.
456	pub async fn deleted_in(&self, namespace: &str) -> Result<Vec<DeletedRepo>> {
457	Ok(self
458	.db
459	.prepare(format!(
460	"SELECT {DELETED_COLUMNS} FROM repos
461	WHERE namespace = ? AND deleted_at IS NOT NULL AND fork_of IS NULL
462	ORDER BY deleted_at DESC LIMIT 200"
463	))
464	.bind(&[namespace.to_lowercase().into()])?
465	.all()
466	.await?
467	.results::<DeletedRow>()?
468	.into_iter()
469	.map(DeletedRepo::from)
470	.collect())
471	}
472
473	/// The deleted repository at `path`, if that is what holds it.
474	pub async fn deleted_at(&self, path: &RepoPath) -> Result<Option<DeletedRepo>> {
475	Ok(self
476	.db
477	.prepare(format!(
478	"SELECT {DELETED_COLUMNS} FROM repos
479	WHERE namespace = ? AND name = ? AND deleted_at IS NOT NULL AND fork_of IS NULL"
480	))
481	.bind(&[
482	path.namespace.to_lowercase().into(),
483	path.name.to_lowercase().into(),
484	])?
485	.first::<DeletedRow>(None)
486	.await?
487	.map(DeletedRepo::from))
488	}
489
490	/// Deleted repositories whose time to be restored has passed.
491	pub async fn due(&self, now: &str, limit: u32) -> Result<Vec<DeletedRepo>> {
492	Ok(self
493	.db
494	.prepare(format!(
495	"SELECT {DELETED_COLUMNS} FROM repos
496	WHERE deleted_at IS NOT NULL AND purge_after <= ? AND fork_of IS NULL
497	ORDER BY purge_after LIMIT ?"
498	))
499	.bind(&[now.into(), limit.into()])?
500	.all()
501	.await?
502	.results::<DeletedRow>()?
503	.into_iter()
504	.map(DeletedRepo::from)
505	.collect())
506	}
507
508	/// Every deleted repository left in a workspace, for when the
509	/// workspace itself is deleted.
510	pub async fn deleted_ids_in(&self, namespace: &str) -> Result<Vec<DeletedRepo>> {
511	self.deleted_in(namespace).await
512	}
513
514	/// The git store keys of a repository and of its working copies.
515	pub async fn store_keys(&self, id: &str) -> Result<Vec<String>> {
516	#[derive(Deserialize)]
517	struct Row {
518	namespace: String,
519	name: String,
520	#[serde(default)]
521	store: Option<String>,
522	}
523	Ok(self
524	.db
525	.prepare("SELECT namespace, name, store FROM repos WHERE id = ?1 OR fork_of = ?1")
526	.bind(&[id.into()])?
527	.all()
528	.await?
529	.results::<Row>()?
530	.into_iter()
531	.map(\|row\| row.store.unwrap_or_else(\|\| format!("{}--{}", row.namespace, row.name)))
532	.collect())
533	}
534
535	/// Forgets a purged repository: its rows, its working copies' rows and
536	/// every redirect to it.
537	pub async fn erase(&self, id: &str) -> Result<()> {
538	self.db
539	.batch(vec![
540	self.db.prepare("DELETE FROM repos WHERE fork_of = ?1").bind(&[id.into()])?,
541	self.db.prepare("DELETE FROM repos WHERE id = ?1").bind(&[id.into()])?,
542	self.db
543	.prepare("DELETE FROM repo_redirects WHERE repo_id = ?1")
544	.bind(&[id.into()])?,
545	self.db
546	.prepare("DELETE FROM branch_redirects WHERE repo_id = ?1")
547	.bind(&[id.into()])?,
548	// Its About, stars and releases (about.rs).
549	self.db.prepare("DELETE FROM repo_stats WHERE repo_id = ?1").bind(&[id.into()])?,
550	self.db.prepare("DELETE FROM repo_stars WHERE repo_id = ?1").bind(&[id.into()])?,
551	self.db.prepare("DELETE FROM releases WHERE repo_id = ?1").bind(&[id.into()])?,
552	])
553	.await?;
554	Ok(())
555	}
556
557	/// Renames a repository, keeping its old path as a redirect. Any
558	/// redirect held by the new path gives way.
559	pub async fn rename(&self, repo: &Repo, name: &str) -> Result<()> {
560	let now = rfc3339(now_ms());
561	self.db
562	.batch(vec![
563	self.db
564	.prepare("UPDATE repos SET name = ? WHERE id = ? AND name = ?")
565	.bind(&[name.into(), repo.id.as_str().into(), repo.name.as_str().into()])?,
566	self.db
567	.prepare("DELETE FROM repo_redirects WHERE namespace = ? AND name = ?")
568	.bind(&[repo.namespace.as_str().into(), name.into()])?,
569	self.db
570	.prepare(
571	"INSERT OR REPLACE INTO repo_redirects (namespace, name, repo_id, created_at)
572	VALUES (?, ?, ?, ?)",
573	)
574	.bind(&[
575	repo.namespace.as_str().into(),
576	repo.name.as_str().into(),
577	repo.id.as_str().into(),
578	now.as_str().into(),
579	])?,
580	])
581	.await?;
582	Ok(())
583	}
584
585	pub async fn set_archived(&self, id: &str, at: Option<&str>) -> Result<()> {
586	self.db
587	.prepare("UPDATE repos SET archived_at = ? WHERE id = ?")
588	.bind(&[at.map_or(JsValue::NULL, JsValue::from), id.into()])?
589	.run()
590	.await?;
591	Ok(())
592	}
593
594	/// A repository's mirror (see `g1t_contracts::mirrors`), or none.
595	pub async fn set_mirror(&self, id: &str, mirror: Option<&g1t_contracts::mirrors::RepoMirror>) -> Result<()> {
596	let mirror = mirror.and_then(\|mirror\| serde_json::to_string(mirror).ok());
597	self.db
598	.prepare("UPDATE repos SET mirror = ? WHERE id = ?")
599	.bind(&[mirror.map_or(JsValue::NULL, JsValue::from), id.into()])?
600	.run()
601	.await?;
602	Ok(())
603	}
604
605	/// Makes a repository and its working copies public or private.
606	pub async fn set_private(&self, id: &str, private: bool) -> Result<()> {
607	self.db
608	.prepare("UPDATE repos SET is_private = ?1 WHERE id = ?2 OR fork_of = ?2")
609	.bind(&[u32::from(private).into(), id.into()])?
610	.run()
611	.await?;
612	Ok(())
613	}
614
615	pub async fn set_default_branch(&self, id: &str, branch: &str) -> Result<()> {
616	self.db
617	.prepare("UPDATE repos SET default_branch = ? WHERE id = ?")
618	.bind(&[branch.into(), id.into()])?
619	.run()
620	.await?;
621	Ok(())
622	}
623
624	/// Working copies of a repository, newest first, at most `limit`.
625	pub async fn forks_of(&self, id: &str, limit: u32) -> Result<Vec<Repo>> {
626	let rows = self
627	.db
628	.prepare(
629	"SELECT * FROM repos WHERE fork_of = ? AND deleted_at IS NULL AND retired_at IS NULL
630	ORDER BY created_at DESC LIMIT ?",
631	)
632	.bind(&[id.into(), limit.into()])?
633	.all()
634	.await?
635	.results::<crate::registry::RepoRow>()?;
636	Ok(rows.into_iter().map(Repo::from).collect())
637	}
638
639	/// Records that `from` is now called `to`. Redirects that pointed at
640	/// `from` point at `to`, and one held by `to` itself ends.
641	pub async fn add_branch_redirect(&self, repo_id: &str, from: &str, to: &str) -> Result<()> {
642	let now = rfc3339(now_ms());
643	self.db
644	.batch(vec![
645	self.db
646	.prepare("DELETE FROM branch_redirects WHERE repo_id = ? AND branch = ?")
647	.bind(&[repo_id.into(), to.into()])?,
648	self.db
649	.prepare("UPDATE branch_redirects SET now = ? WHERE repo_id = ? AND now = ?")
650	.bind(&[to.into(), repo_id.into(), from.into()])?,
651	self.db
652	.prepare(
653	"INSERT OR REPLACE INTO branch_redirects (repo_id, branch, now, created_at)
654	VALUES (?, ?, ?, ?)",
655	)
656	.bind(&[repo_id.into(), from.into(), to.into(), now.as_str().into()])?,
657	])
658	.await?;
659	Ok(())
660	}
661
662	pub async fn branch_redirect(&self, repo_id: &str, branch: &str) -> Result<Option<String>> {
663	#[derive(Deserialize)]
664	struct Row {
665	now: String,
666	}
667	Ok(self
668	.db
669	.prepare("SELECT now FROM branch_redirects WHERE repo_id = ? AND branch = ?")
670	.bind(&[repo_id.into(), branch.into()])?
671	.first::<Row>(None)
672	.await?
673	.map(\|row\| row.now))
674	}
675
676	/// Whether a repository is archived or deleted; unknown is deleted.
677	pub async fn status(&self, id: &str) -> Result<RepoStatus> {
678	#[derive(Deserialize)]
679	struct Row {
680	#[serde(default)]
681	archived_at: Option<String>,
682	#[serde(default)]
683	deleted_at: Option<String>,
684	}
685	Ok(self
686	.db
687	.prepare("SELECT archived_at, deleted_at FROM repos WHERE id = ?")
688	.bind(&[id.into()])?
689	.first::<Row>(None)
690	.await?
691	.map_or(
692	RepoStatus {
693	archived: false,
694	deleted: true,
695	},
696	\|row\| RepoStatus {
697	archived: row.archived_at.is_some(),
698	deleted: row.deleted_at.is_some(),
699	},
700	))
701	}
702	}
703
704	/// An audit entry for something done to a repository.
705	fn entry(actor: AuditActor, action: &str, surface: Option<Surface>, path: &RepoPath, rule: &str, message: String) -> NewAuditEntry {
706	NewAuditEntry {
707	actor,
708	action: action.to_owned(),
709	surface: surface.unwrap_or(Surface::Web),
710	target: AuditTarget {
711	workspace: path.namespace.clone(),
712	repo: Some(format!("{}/{}", path.namespace, path.name)),
713	..AuditTarget::default()
714	},
715	outcome: AuditOutcome::Allowed,
716	rule: rule.to_owned(),
717	result: Some("ok".to_owned()),
718	message: Some(message),
719	request_id: new_id("req", now_ms()),
720	}
721	}
722
723	/// g1t itself, as the actor of what its schedule does.
724	fn g1t_actor() -> AuditActor {
725	AuditActor::system()
726	}
727
728	fn fail<T>((code, message): Refusal) -> Outcome<T> {
729	Outcome::fail(code, message)
730	}
731
732	fn path_of(repo: &Repo) -> RepoPath {
733	RepoPath {
734	namespace: repo.namespace.clone(),
735	name: repo.name.clone(),
736	}
737	}
738
739	impl<S: GitStore> Repos<S> {
740	pub(crate) async fn record(&self, entries: Vec<NewAuditEntry>) {
741	let recorded: Result<u32> =
742	g1t_kit::call(&self.events, "audit_record", &RecordAuditArgs { entries }).await;
743	if let Err(error) = recorded {
744	worker::console_error!("audit entries not recorded: {error}");
745	}
746	}
747
748	/// The repository at `path` an admin is acting on: found, not a
749	/// working copy, and the actor allowed `capability` on it (Admin, and
750	/// for deleting, an owner of its workspace).
751	async fn owned(
752	&self,
753	actor: &User,
754	path: &RepoPath,
755	what: &str,
756	capability: Capability,
757	) -> Result<std::result::Result<Repo, Refusal>> {
758	let viewer = Some(actor.clone());
759	let Some(repo) = self.readable(path, &viewer).await? else {
760	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
761	};
762	if repo.fork_of.is_some() {
763	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
764	}
765	if let Err(refusal) = admin_only(Asker::on(actor, &repo), &repo.namespace, what, capability) {
766	return Ok(Err(refusal));
767	}
768	Ok(Ok(repo))
769	}
770
771	/// `delete`: see `g1t_contracts::repos::DeleteArgs`.
772	pub(crate) async fn delete(&self, a: DeleteArgs) -> Result<Outcome<DeletedRepo>> {
773	let repo = match self.owned(&a.actor, &a.path, "delete", Capability::Delete).await? {
774	Ok(repo) => repo,
775	Err(refusal) => return Ok(fail(refusal)),
776	};
777	let path = path_of(&repo);
778	if !confirmed(&path, &a.confirm) {
779	return Ok(fail(confirm_refusal(&path)));
780	}
781	let now = now_ms();
782	let at = rfc3339(now);
783	let purge = purge_after(now);
784	self.registry
785	.soft_delete(&repo.id, &a.actor.username, &at, &purge)
786	.await?;
787	self.publish(NewEvent {
788	kind: "repo.deleted",
789	source: SOURCE,
790	repo_id: Some(repo.id.clone()),
791	actor: Some(a.actor.id.clone()),
792	data: RepoDeleted {
793	repo_id: repo.id.clone(),
794	namespace: repo.namespace.clone(),
795	name: repo.name.clone(),
796	is_private: repo.is_private,
797	purge_after: purge.clone(),
798	with_workspace: false,
799	},
800	})
801	.await?;
802	self.record(vec![entry(
803	AuditActor::of(&a.actor),
804	"repo.deleted",
805	a.surface,
806	&path,
807	"owner",
808	format!("Deleted; restorable until {purge}"),
809	)])
810	.await;
811	Ok(Outcome::Ok(DeletedRepo {
812	id: repo.id,
813	namespace: repo.namespace,
814	name: repo.name,
815	description: repo.description,
816	is_private: repo.is_private,
817	deleted_at: at,
818	deleted_by: a.actor.username,
819	purge_after: purge,
820	}))
821	}
822
823	/// `deleted`: see `g1t_contracts::repos::DeletedArgs`.
824	pub(crate) async fn deleted(&self, a: DeletedArgs) -> Result<Vec<DeletedRepo>> {
825	let namespace = a.namespace.to_lowercase();
826	let owner = a
827	.viewer
828	.as_ref()
829	.is_some_and(\|user\| user.role_in(&namespace) == Some(Role::Owner));
830	if !owner {
831	return Ok(Vec::new());
832	}
833	self.registry.deleted_in(&namespace).await
834	}
835
836	/// The deleted repository an owner is acting on.
837	async fn owned_deleted(
838	&self,
839	actor: &User,
840	path: &RepoPath,
841	what: &str,
842	) -> Result<std::result::Result<DeletedRepo, Refusal>> {
843	if let Err(refusal) = owner_only(Asker::of(actor, &path.namespace), &path.namespace.to_lowercase(), what) {
844	return Ok(Err(refusal));
845	}
846	Ok(match self.registry.deleted_at(path).await? {
847	Some(deleted) => Ok(deleted),
848	None => Err((
849	FailureCode::NotFound,
850	format!(
851	"{}/{} is not among the workspace's recently deleted repositories.",
852	path.namespace, path.name
853	),
854	)),
855	})
856	}
857
858	/// `restore`: see `g1t_contracts::repos::DeletedRepoArgs`.
859	pub(crate) async fn restore(&self, a: DeletedRepoArgs) -> Result<Outcome<Repo>> {
860	let deleted = match self.owned_deleted(&a.actor, &a.path, "restore").await? {
861	Ok(deleted) => deleted,
862	Err(refusal) => return Ok(fail(refusal)),
863	};
864	let deleted_state = state(
865	None,
866	Some((&deleted.deleted_at, &deleted.purge_after)),
867	&rfc3339(now_ms()),
868	);
869	if deleted_state == State::Due {
870	return Ok(Outcome::fail(
871	FailureCode::Conflict,
872	format!("{}/{} is being purged and can no longer be restored.", deleted.namespace, deleted.name),
873	));
874	}
875	self.registry.undelete(&deleted.id).await?;
876	let Some(repo) = self.registry.by_id(&deleted.id).await? else {
877	return Ok(not_found());
878	};
879	self.publish(NewEvent {
880	kind: "repo.restored",
881	source: SOURCE,
882	repo_id: Some(repo.id.clone()),
883	actor: Some(a.actor.id.clone()),
884	data: RepoRestored {
885	repo_id: repo.id.clone(),
886	namespace: repo.namespace.clone(),
887	name: repo.name.clone(),
888	is_private: repo.is_private,
889	with_workspace: false,
890	},
891	})
892	.await?;
893	self.record(vec![entry(
894	AuditActor::of(&a.actor),
895	"repo.restored",
896	a.surface,
897	&path_of(&repo),
898	"owner",
899	format!("Restored; deleted by {} at {}", deleted.deleted_by, deleted.deleted_at),
900	)])
901	.await;
902	Ok(Outcome::Ok(repo))
903	}
904
905	/// `purge`: see `g1t_contracts::repos::DeletedRepoArgs`.
906	pub(crate) async fn purge(&self, a: DeletedRepoArgs) -> Result<Outcome<bool>> {
907	let deleted = match self.owned_deleted(&a.actor, &a.path, "permanently delete").await? {
908	Ok(deleted) => deleted,
909	Err(refusal) => return Ok(fail(refusal)),
910	};
911	let path = RepoPath {
912	namespace: deleted.namespace.clone(),
913	name: deleted.name.clone(),
914	};
915	if !confirmed(&path, a.confirm.as_deref().unwrap_or_default()) {
916	return Ok(fail(confirm_refusal(&path)));
917	}
918	self.purge_now(&deleted, Some(&a.actor.id)).await?;
919	self.record(vec![entry(
920	AuditActor::of(&a.actor),
921	"repo.purged",
922	a.surface,
923	&path,
924	"owner",
925	"Permanently deleted, with its git data".to_owned(),
926	)])
927	.await;
928	Ok(Outcome::Ok(true))
929	}
930
931	/// Removes a deleted repository for good: git data first, so a failure
932	/// leaves it to the next sweep, then its rows; then says so.
933	async fn purge_now(&self, deleted: &DeletedRepo, actor: Option<&str>) -> Result<()> {
934	for key in self.registry.store_keys(&deleted.id).await? {
935	self.store.delete(&key).await?;
936	}
937	self.registry.erase(&deleted.id).await?;
938	// Who had access to it goes with it.
939	if let Some(identity) = &self.identity {
940	let forgotten: Result<bool> = g1t_kit::call(
941	identity,
942	"forget_repo_access",
943	&g1t_contracts::access::ForgetRepoAccessArgs {
944	repo_id: deleted.id.clone(),
945	},
946	)
947	.await;
948	if let Err(error) = forgotten {
949	worker::console_error!("access to {} not forgotten: {error}", deleted.id);
950	}
951	}
952	self.publish(NewEvent {
953	kind: "repo.purged",
954	source: SOURCE,
955	repo_id: Some(deleted.id.clone()),
956	actor: actor.map(str::to_owned),
957	data: RepoPurged {
958	repo_id: deleted.id.clone(),
959	namespace: deleted.namespace.clone(),
960	name: deleted.name.clone(),
961	},
962	})
963	.await
964	}
965
966	/// `purge_due`: see `g1t_contracts::repos::PurgeDueArgs`.
967	pub(crate) async fn purge_due(&self, a: PurgeDueArgs) -> Result<u32> {
968	let limit = a.limit.unwrap_or(PURGES_PER_SWEEP).clamp(1, 100);
969	let due = self.registry.due(&rfc3339(now_ms()), limit).await?;
970	let mut purged = 0;
971	for deleted in due {
972	match self.purge_now(&deleted, None).await {
973	Ok(()) => {
974	purged += 1;
975	let path = RepoPath {
976	namespace: deleted.namespace.clone(),
977	name: deleted.name.clone(),
978	};
979	self.record(vec![entry(
980	g1t_actor(),
981	"repo.purged",
982	None,
983	&path,
984	"schedule",
985	format!("Purged {RESTORE_DAYS} days after {} deleted it", deleted.deleted_by),
986	)])
987	.await;
988	}
989	Err(error) => worker::console_error!("{} not purged: {error}", deleted.id),
990	}
991	}
992	Ok(purged)
993	}
994
995	/// `workspace.deleting`: every live repository of the workspace is
996	/// deleted with it, marked so its restore brings back exactly these,
997	/// and `repo.deleted` (with `with_workspace`) tells services to stop
998	/// what runs for each and hide it. They are purged with the workspace,
999	/// or by the sweep at the same `purge_after`. Never for a protected
1000	/// workspace, whoever published it.
1001	pub(crate) async fn delete_with_workspace(&self, deleting: &WorkspaceDeleting, protected: &[String]) -> Result<()> {
1002	let namespace = deleting.slug.to_lowercase();
1003	if let Err(why) = may_go_with_workspace(&namespace, protected) {
1004	worker::console_error!("workspace.deleting for {namespace} ignored: {why}");
1005	return Ok(());
1006	}
1007	let marked = self
1008	.registry
1009	.delete_with_workspace(
1010	&namespace,
1011	&deleting.workspace_id,
1012	&deleting.by,
1013	&rfc3339(now_ms()),
1014	&deleting.purge_after,
1015	)
1016	.await?;
1017	for repo in marked {
1018	self.publish(NewEvent {
1019	kind: "repo.deleted",
1020	source: SOURCE,
1021	repo_id: Some(repo.id.clone()),
1022	actor: None,
1023	data: RepoDeleted {
1024	repo_id: repo.id.clone(),
1025	namespace: repo.namespace.clone(),
1026	name: repo.name.clone(),
1027	is_private: repo.is_private,
1028	purge_after: repo.purge_after.clone(),
1029	with_workspace: true,
1030	},
1031	})
1032	.await?;
1033	}
1034	Ok(())
1035	}
1036
1037	/// `workspace.restored`: the repositories deleted with the workspace
1038	/// come back, and `repo.restored` (with `with_workspace`) says so for
1039	/// each. Ones deleted on their own before stay deleted.
1040	pub(crate) async fn restore_with_workspace(&self, restored: &WorkspaceRestored) -> Result<()> {
1041	let marked = self.registry.deleted_with(&restored.workspace_id).await?;
1042	self.registry.undelete_with_workspace(&restored.workspace_id).await?;
1043	for deleted in marked {
1044	let Some(repo) = self.registry.by_id(&deleted.id).await? else {
1045	continue;
1046	};
1047	self.publish(NewEvent {
1048	kind: "repo.restored",
1049	source: SOURCE,
1050	repo_id: Some(repo.id.clone()),
1051	actor: None,
1052	data: RepoRestored {
1053	repo_id: repo.id.clone(),
1054	namespace: repo.namespace.clone(),
1055	name: repo.name.clone(),
1056	is_private: repo.is_private,
1057	with_workspace: true,
1058	},
1059	})
1060	.await?;
1061	}
1062	Ok(())
1063	}
1064
1065	/// `workspace.deleted`: the workspace is purged, and every repository
1066	/// it had goes with it: those deleted with it, those deleted before,
1067	/// and any still live (a `workspace.deleting` that never arrived).
1068	pub(crate) async fn purge_workspace(&self, deleted: &WorkspaceDeleted, protected: &[String]) -> Result<()> {
1069	let namespace = deleted.slug.to_lowercase();
1070	if let Err(why) = may_go_with_workspace(&namespace, protected) {
1071	worker::console_error!("workspace.deleted for {namespace} ignored: {why}");
1072	return Ok(());
1073	}
1074	let now = rfc3339(now_ms());
1075	self.registry
1076	.delete_with_workspace(&namespace, &deleted.workspace_id, "g1t", &now, &now)
1077	.await?;
1078	// A page at a time; one that fails is left to the hourly sweep.
1079	loop {
1080	let page = self.registry.deleted_ids_in(&namespace).await?;
1081	let mut purged = 0;
1082	for repo in &page {
1083	match self.purge_now(repo, None).await {
1084	Ok(()) => purged += 1,
1085	Err(error) => worker::console_error!("{} not purged with its workspace: {error}", repo.id),
1086	}
1087	}
1088	if purged == 0 {
1089	break;
1090	}
1091	}
1092	Ok(())
1093	}
1094
1095	/// `rename`: see `g1t_contracts::repos::RenameArgs`.
1096	pub(crate) async fn rename(&self, a: RenameArgs) -> Result<Outcome<Repo>> {
1097	let repo = match self.owned(&a.actor, &a.path, "rename", Capability::Administer).await? {
1098	Ok(repo) => repo,
1099	Err(refusal) => return Ok(fail(refusal)),
1100	};
1101	let wanted = RepoPath {
1102	namespace: repo.namespace.clone(),
1103	name: a.name.trim().to_lowercase(),
1104	};
1105	let held = match self.registry.by_path_any(&wanted).await? {
1106	None => Held::Free,
1107	Some((_, None)) => Held::ByRepo,
1108	Some((_, Some(_))) => Held::ByDeleted,
1109	};
1110	let name = match new_name(&repo.namespace, &repo.name, &a.name, held) {
1111	Ok(name) => name,
1112	Err(refusal) => return Ok(fail(refusal)),
1113	};
1114	// The git store key stays what it was; the new path must not
1115	// change where it is read from.
1116	let key = store_key(&repo);
1117	self.registry.rename(&repo, &name).await?;
1118	let renamed = Repo {
1119	name: name.clone(),
1120	..repo.clone()
1121	};
1122	remember_store(&renamed, &key);
1123	let from = path_of(&repo);
1124	let to = path_of(&renamed);
1125	if let Some(identity) = &self.identity {
1126	let moved: Result<bool> = g1t_kit::call(
1127	identity,
1128	"transfer_repo_scopes",
1129	&TransferRepoScopesArgs {
1130	from: from.clone(),
1131	to: to.clone(),
1132	},
1133	)
1134	.await;
1135	if let Err(error) = moved {
1136	worker::console_error!("agent scopes for {} not moved: {error}", repo.id);
1137	}
1138	}
1139	self.publish(NewEvent {
1140	kind: "repo.renamed",
1141	source: SOURCE,
1142	repo_id: Some(repo.id.clone()),
1143	actor: Some(a.actor.id.clone()),
1144	data: RepoRenamed {
1145	repo_id: repo.id.clone(),
1146	namespace: repo.namespace.clone(),
1147	from: repo.name.clone(),
1148	to: name.clone(),
1149	},
1150	})
1151	.await?;
1152	self.record(vec![entry(
1153	AuditActor::of(&a.actor),
1154	"repo.renamed",
1155	a.surface,
1156	&to,
1157	"owner",
1158	format!("Renamed from {}/{}", from.namespace, from.name),
1159	)])
1160	.await;
1161	Ok(Outcome::Ok(renamed))
1162	}
1163
1164	/// `archive`: see `g1t_contracts::repos::ArchiveArgs`.
1165	pub(crate) async fn archive(&self, a: ArchiveArgs) -> Result<Outcome<Repo>> {
1166	let what = if a.archived { "archive" } else { "unarchive" };
1167	let repo = match self.owned(&a.actor, &a.path, what, Capability::Administer).await? {
1168	Ok(repo) => repo,
1169	Err(refusal) => return Ok(fail(refusal)),
1170	};
1171	if repo.archived() == a.archived {
1172	return Ok(Outcome::Ok(repo));
1173	}
1174	let at = a.archived.then(\|\| rfc3339(now_ms()));
1175	self.registry.set_archived(&repo.id, at.as_deref()).await?;
1176	let changed = Repo {
1177	archived_at: at,
1178	..repo
1179	};
1180	let kind = if a.archived { "repo.archived" } else { "repo.unarchived" };
1181	self.publish(NewEvent {
1182	kind,
1183	source: SOURCE,
1184	repo_id: Some(changed.id.clone()),
1185	actor: Some(a.actor.id.clone()),
1186	data: RepoArchived {
1187	repo_id: changed.id.clone(),
1188	namespace: changed.namespace.clone(),
1189	name: changed.name.clone(),
1190	archived: a.archived,
1191	},
1192	})
1193	.await?;
1194	self.record(vec![entry(
1195	AuditActor::of(&a.actor),
1196	kind,
1197	a.surface,
1198	&path_of(&changed),
1199	"owner",
1200	if a.archived {
1201	"Archived: read-only".to_owned()
1202	} else {
1203	"Unarchived".to_owned()
1204	},
1205	)])
1206	.await;
1207	Ok(Outcome::Ok(changed))
1208	}
1209
1210	/// `set_visibility`: see `g1t_contracts::repos::SetVisibilityArgs`.
1211	pub(crate) async fn set_visibility(&self, a: SetVisibilityArgs) -> Result<Outcome<Repo>> {
1212	let repo = match self.owned(&a.actor, &a.path, "change the visibility of", Capability::ChangeVisibility).await? {
1213	Ok(repo) => repo,
1214	Err(refusal) => return Ok(fail(refusal)),
1215	};
1216	if !confirmed(&path_of(&repo), &a.confirm) {
1217	return Ok(fail(confirm_refusal(&path_of(&repo))));
1218	}
1219	if let Some(why) = visibility_refusal(&a.actor, &repo, a.is_private) {
1220	return Ok(Outcome::fail(FailureCode::Forbidden, why));
1221	}
1222	self.change_visibility(repo, a.is_private, &a.actor, a.surface).await
1223	}
1224
1225	/// Makes `repo` public or private, if the workspace's storage allows,
1226	/// and says so: `repo.updated` and `repo.visibility_changed`. The
1227	/// caller has checked the actor may.
1228	pub(crate) async fn change_visibility(
1229	&self,
1230	repo: Repo,
1231	private: bool,
1232	actor: &User,
1233	surface: Option<Surface>,
1234	) -> Result<Outcome<Repo>> {
1235	if repo.is_private == private {
1236	return Ok(Outcome::Ok(repo));
1237	}
1238	let facts = if private {
1239	VisibilityFacts {
1240	to_private: true,
1241	free: git_ops::is_free(self.billing.as_ref(), &repo.namespace).await,
1242	private_bytes: self.registry.private_bytes(&repo.namespace).await.unwrap_or(0),
1243	bytes: self.registry.stored_bytes(&repo.id).await?,
1244	free_private_bytes: self.free_private_bytes,
1245	}
1246	} else {
1247	VisibilityFacts::default()
1248	};
1249	if let Err(refusal) = visibility_check(&repo.namespace, &facts) {
1250	return Ok(fail(refusal));
1251	}
1252	self.registry.set_private(&repo.id, private).await?;
1253	let changed = Repo {
1254	is_private: private,
1255	..repo
1256	};
1257	self.publish(NewEvent {
1258	kind: "repo.updated",
1259	source: SOURCE,
1260	repo_id: Some(changed.id.clone()),
1261	actor: Some(actor.id.clone()),
1262	data: RepoUpdated {
1263	repo_id: changed.id.clone(),
1264	namespace: changed.namespace.clone(),
1265	name: changed.name.clone(),
1266	is_private: private,
1267	visibility_changed: true,
1268	},
1269	})
1270	.await?;
1271	self.publish(NewEvent {
1272	kind: "repo.visibility_changed",
1273	source: SOURCE,
1274	repo_id: Some(changed.id.clone()),
1275	actor: Some(actor.id.clone()),
1276	data: RepoVisibilityChanged {
1277	repo_id: changed.id.clone(),
1278	is_private: private,
1279	},
1280	})
1281	.await?;
1282	self.record(vec![entry(
1283	AuditActor::of(actor),
1284	"repo.visibility_changed",
1285	surface,
1286	&path_of(&changed),
1287	"owner",
1288	if private { "Made private".to_owned() } else { "Made public".to_owned() },
1289	)])
1290	.await;
1291	Ok(Outcome::Ok(changed))
1292	}
1293
1294	/// The repository at `path` someone is changing the branches of:
1295	/// found, not a working copy, the actor allowed `capability` on it
1296	/// (Push to rename a branch, Administer to change the default),
1297	/// verified, and not archived.
1298	async fn writable_by(
1299	&self,
1300	actor: &User,
1301	path: &RepoPath,
1302	capability: Capability,
1303	) -> Result<std::result::Result<Repo, Refusal>> {
1304	let viewer = Some(actor.clone());
1305	let Some(repo) = self.readable(path, &viewer).await? else {
1306	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
1307	};
1308	if repo.fork_of.is_some() \|\| !crate::registry::can(&repo, &viewer, capability) {
1309	return Ok(Err((
1310	FailureCode::Forbidden,
1311	access::needs(capability, &format!("{}/{}", repo.namespace, repo.name)),
1312	)));
1313	}
1314	if !actor.verified {
1315	return Ok(Err((FailureCode::Forbidden, UNVERIFIED.into())));
1316	}
1317	if let Some(refusal) = archived_refusal(&repo) {
1318	return Ok(Err(refusal));
1319	}
1320	// Moving between namespaces: wait for it (moves.rs).
1321	self.unpaused(repo).await
1322	}
1323
1324	/// `set_default_branch`: see `g1t_contracts::repos::SetDefaultBranchArgs`.
1325	pub(crate) async fn set_default_branch(&self, a: SetDefaultBranchArgs) -> Result<Outcome<Repo>> {
1326	let repo = match self.writable_by(&a.actor, &a.path, Capability::Administer).await? {
1327	Ok(repo) => repo,
1328	Err(refusal) => return Ok(fail(refusal)),
1329	};
1330	let branch = a.branch.trim().to_owned();
1331	if branch == repo.default_branch {
1332	return Ok(Outcome::Ok(repo));
1333	}
1334	let git = self.store.open(&store_key(&repo)).await?;
1335	if !git.branches().await?.iter().any(\|b\| b.name == branch) {
1336	return Ok(Outcome::fail(
1337	FailureCode::Invalid,
1338	format!("There is no branch named {branch}. Push it first."),
1339	));
1340	}
1341	self.registry.set_default_branch(&repo.id, &branch).await?;
1342	// HEAD in what git is told follows it.
1343	self.refs_moved(&repo.id).await;
1344	let from = repo.default_branch.clone();
1345	let changed = Repo {
1346	default_branch: branch.clone(),
1347	..repo
1348	};
1349	self.forks_follow(&changed, &from, &branch, false).await;
1350	self.publish(NewEvent {
1351	kind: "repo.default_branch_changed",
1352	source: SOURCE,
1353	repo_id: Some(changed.id.clone()),
1354	actor: Some(a.actor.id.clone()),
1355	data: RepoDefaultBranchChanged {
1356	repo_id: changed.id.clone(),
1357	from: from.clone(),
1358	to: branch.clone(),
1359	renamed: false,
1360	},
1361	})
1362	.await?;
1363	self.record(vec![entry(
1364	AuditActor::of(&a.actor),
1365	"repo.default_branch_changed",
1366	a.surface,
1367	&path_of(&changed),
1368	"member",
1369	format!("Default branch changed from {from} to {branch}"),
1370	)])
1371	.await;
1372	Ok(Outcome::Ok(changed))
1373	}
1374
1375	/// `rename_branch`: see `g1t_contracts::repos::RenameBranchArgs`.
1376	pub(crate) async fn rename_branch(&self, a: RenameBranchArgs) -> Result<Outcome<Repo>> {
1377	let repo = match self.writable_by(&a.actor, &a.path, Capability::Push).await? {
1378	Ok(repo) => repo,
1379	Err(refusal) => return Ok(fail(refusal)),
1380	};
1381	let from = a.from.trim().to_owned();
1382	let is_default = from == repo.default_branch;
1383	if is_default
1384	&& let Err(refusal) = admin_only(
1385	Asker::on(&a.actor, &repo),
1386	&repo.namespace,
1387	"rename the default branch of",
1388	Capability::Administer,
1389	)
1390	{
1391	return Ok(fail(refusal));
1392	}
1393	let git = self.store.open(&store_key(&repo)).await?;
1394	let branches = git.branches().await?;
1395	let names: Vec<String> = branches.iter().map(\|b\| b.name.clone()).collect();
1396	let to = match branch_rename(&from, &a.to, &names) {
1397	Ok(to) => to,
1398	Err(refusal) => return Ok(fail(refusal)),
1399	};
1400	let Some(head) = branches.iter().find(\|b\| b.name == from).map(\|b\| b.hash.clone()) else {
1401	return Ok(not_found());
1402	};
1403	// A rename deletes one name and creates another: the rules of both
1404	// hold (rules.rs).
1405	let renamed = vec![
1406	g1t_rules::push::RefChange {
1407	git_ref: format!("refs/heads/{from}"),
1408	old: Some(head.clone()),
1409	new: None,
1410	complete: true,
1411	..Default::default()
1412	},
1413	g1t_rules::push::RefChange {
1414	git_ref: format!("refs/heads/{to}"),
1415	old: None,
1416	new: Some(head.clone()),
1417	complete: true,
1418	..Default::default()
1419	},
1420	];
1421	if let crate::rules::Ruled::Refused { message, .. } =
1422	self.check_changes(&repo, &a.actor, g1t_contracts::rules::Action::RenameRef, renamed).await?
1423	{
1424	return Ok(Outcome::fail(FailureCode::Forbidden, message));
1425	}
1426	let access = git.access(Scope::Write).await?;
1427	let made = land::push_pack(&access, &to, None, &head, EMPTY_PACK.to_vec()).await?;
1428	self.refs_moved(&repo.id).await;
1429	if let Err(reason) = made {
1430	return Ok(Outcome::fail(FailureCode::Conflict, format!("{to} could not be made: {reason}")));
1431	}
1432	// The default moves before the old name goes, so it never names a
1433	// branch that is not there.
1434	if is_default {
1435	self.registry.set_default_branch(&repo.id, &to).await?;
1436	}
1437	let removed = land::delete_ref(&access, &from, &head).await;
1438	self.refs_moved(&repo.id).await;
1439	if let Err(reason) = removed? {
1440	worker::console_error!("{from} not removed after renaming it to {to}: {reason}");
1441	}
1442	self.registry.add_branch_redirect(&repo.id, &from, &to).await?;
1443	let changed = if is_default {
1444	Repo {
1445	default_branch: to.clone(),
1446	..repo
1447	}
1448	} else {
1449	repo
1450	};
1451	if is_default {
1452	self.forks_follow(&changed, &from, &to, true).await;
1453	}
1454	self.publish(NewEvent {
1455	kind: "branch.renamed",
1456	source: SOURCE,
1457	repo_id: Some(changed.id.clone()),
1458	actor: Some(a.actor.id.clone()),
1459	data: BranchRenamed {
1460	repo_id: changed.id.clone(),
1461	from: from.clone(),
1462	to: to.clone(),
1463	default_branch: is_default,
1464	},
1465	})
1466	.await?;
1467	if is_default {
1468	self.publish(NewEvent {
1469	kind: "repo.default_branch_changed",
1470	source: SOURCE,
1471	repo_id: Some(changed.id.clone()),
1472	actor: Some(a.actor.id.clone()),
1473	data: RepoDefaultBranchChanged {
1474	repo_id: changed.id.clone(),
1475	from: from.clone(),
1476	to: to.clone(),
1477	renamed: true,
1478	},
1479	})
1480	.await?;
1481	}
1482	self.record(vec![entry(
1483	AuditActor::of(&a.actor),
1484	"branch.renamed",
1485	a.surface,
1486	&path_of(&changed),
1487	if is_default { "owner" } else { "member" },
1488	format!("Branch {from} renamed to {to}"),
1489	)])
1490	.await;
1491	Ok(Outcome::Ok(changed))
1492	}
1493
1494	/// Pull requests' working copies name their branch after the default
1495	/// branch of the repository they came from. When it changes, the
1496	/// newest of them get a branch of the new name at the same commit (and,
1497	/// for a rename, lose the old one), so agents and merges find it.
1498	/// Best effort: a copy that cannot follow is logged and left.
1499	async fn forks_follow(&self, repo: &Repo, from: &str, to: &str, renamed: bool) {
1500	let forks = match self.registry.forks_of(&repo.id, FORKS_FOLLOWING).await {
1501	Ok(forks) => forks,
1502	Err(error) => {
1503	worker::console_error!("working copies of {} not listed: {error}", repo.id);
1504	return;
1505	}
1506	};
1507	for fork in forks {
1508	let followed: Result<()> = async {
1509	let git = self.store.open(&store_key(&fork)).await?;
1510	let branches = git.branches().await?;
1511	let Some(head) = branches.iter().find(\|b\| b.name == from).map(\|b\| b.hash.clone()) else {
1512	return Ok(());
1513	};
1514	let access = git.access(Scope::Write).await?;
1515	if !branches.iter().any(\|b\| b.name == to) {
1516	let made = land::push_pack(&access, to, None, &head, EMPTY_PACK.to_vec()).await;
1517	self.refs_moved(&fork.id).await;
1518	if let Err(reason) = made? {
1519	worker::console_error!("working copy {} did not get {to}: {reason}", fork.id);
1520	return Ok(());
1521	}
1522	}
1523	self.registry.set_default_branch(&fork.id, to).await?;
1524	if renamed {
1525	let removed = land::delete_ref(&access, from, &head).await;
1526	self.refs_moved(&fork.id).await;
1527	if let Err(reason) = removed? {
1528	worker::console_error!("working copy {} kept {from}: {reason}", fork.id);
1529	}
1530	}
1531	Ok(())
1532	}
1533	.await;
1534	if let Err(error) = followed {
1535	worker::console_error!("working copy {} did not follow {from} → {to}: {error}", fork.id);
1536	}
1537	}
1538	}
1539
1540	/// `resolve_branch`: see `g1t_contracts::repos::ResolveBranchArgs`.
1541	pub(crate) async fn resolve_branch(&self, a: ResolveBranchArgs) -> Result<Option<String>> {
1542	let Some(now) = self.registry.branch_redirect(&a.repo_id, &a.branch).await? else {
1543	return Ok(None);
1544	};
1545	// A branch made again under the old name ends the redirect.
1546	let Some(repo) = self.registry.by_id(&a.repo_id).await? else {
1547	return Ok(None);
1548	};
1549	let git = self.store.open(&store_key(&repo)).await?;
1550	let branches = git.branches().await?;
1551	if branches.iter().any(\|b\| b.name == a.branch) \|\| !branches.iter().any(\|b\| b.name == now) {
1552	return Ok(None);
1553	}
1554	Ok(Some(now))
1555	}
1556
1557	/// `status_by_id`: see `g1t_contracts::repos::StatusByIdArgs`.
1558	pub(crate) async fn status_by_id(&self, a: StatusByIdArgs) -> Result<RepoStatus> {
1559	self.registry.status(&a.id).await
1560	}
1561	}
1562
1563	#[cfg(test)]
1564	mod tests {
1565	use super::*;
1566
1567	fn owner() -> Asker {
1568	Asker {
1569	person: true,
1570	verified: true,
1571	role: Some(Role::Owner),
1572	repo_role: Some(RepoRole::Admin),
1573	privileges: g1t_contracts::MemberPrivileges::default(),
1574	}
1575	}
1576
1577	fn path() -> RepoPath {
1578	RepoPath {
1579	namespace: "acme".into(),
1580	name: "rocket".into(),
1581	}
1582	}
1583
1584	#[test]
1585	fn only_a_verified_person_who_owns_the_workspace_may() {
1586	assert!(owner_only(owner(), "acme", "delete").is_ok());
1587	let member = Asker { role: Some(Role::Member), ..owner() };
1588	let (code, message) = owner_only(member, "acme", "delete").unwrap_err();
1589	assert_eq!(code, FailureCode::Forbidden);
1590	assert_eq!(message, "Only an owner of acme can delete its repositories.");
1591	assert_eq!(owner_only(Asker { person: false, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::Forbidden);
1592	assert_eq!(owner_only(Asker { verified: false, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::Forbidden);
1593	// Outside the workspace, a private repository is not there at all.
1594	assert_eq!(owner_only(Asker { role: None, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::NotFound);
1595	}
1596
1597	/// Renaming, archiving and changing visibility take Admin on the
1598	/// repository, which a direct grant can give; deleting and
1599	/// transferring still take an owner of the workspace.
1600	#[test]
1601	fn admin_on_the_repository_may_administer_but_not_delete() {
1602	let admin = Asker { role: None, repo_role: Some(RepoRole::Admin), ..owner() };
1603	assert!(admin_only(admin, "acme", "rename", Capability::Administer).is_ok());
1604	let (code, message) = admin_only(admin, "acme", "delete", Capability::Delete).unwrap_err();
1605	assert_eq!(code, FailureCode::Forbidden);
1606	assert_eq!(message, "Only an owner of acme can delete its repositories.");
1607	let member_admin = Asker { role: Some(Role::Member), ..admin };
1608	assert_eq!(admin_only(member_admin, "acme", "delete", Capability::Delete).unwrap_err().0, FailureCode::Forbidden);
1609	// Write (the default base permission) cannot rename.
1610	// By default a member with Admin changes visibility but does not
1611	// delete; the workspace's member privileges change both.
1612	assert!(admin_only(member_admin, "acme", "change the visibility of", Capability::ChangeVisibility).is_ok());
1613	let open = Asker {
1614	privileges: g1t_contracts::MemberPrivileges { members_can_delete_repositories: true, ..g1t_contracts::MemberPrivileges::default() },
1615	..member_admin
1616	};
1617	assert!(admin_only(open, "acme", "delete", Capability::Delete).is_ok());
1618	let closed = Asker {
1619	privileges: g1t_contracts::MemberPrivileges { members_can_change_repo_visibility: false, ..g1t_contracts::MemberPrivileges::default() },
1620	..member_admin
1621	};
1622	assert_eq!(
1623	admin_only(closed, "acme", "change the visibility of", Capability::ChangeVisibility).unwrap_err().0,
1624	FailureCode::Forbidden
1625	);
1626	// An outside collaborator with Admin never can.
1627	assert_eq!(admin_only(Asker { privileges: open.privileges, ..admin }, "acme", "delete", Capability::Delete).unwrap_err().0, FailureCode::Forbidden);
1628	let writer = Asker { role: Some(Role::Member), repo_role: Some(RepoRole::Write), ..owner() };
1629	let (code, message) = admin_only(writer, "acme", "rename", Capability::Administer).unwrap_err();
1630	assert_eq!(code, FailureCode::Forbidden);
1631	assert_eq!(message, "You need the Admin role on a repository of acme to rename it.");
1632	// Someone who can read a public repository is refused, not told it is missing.
1633	let reader = Asker { role: None, repo_role: Some(RepoRole::Read), ..owner() };
1634	assert_eq!(admin_only(reader, "acme", "archive", Capability::Administer).unwrap_err().0, FailureCode::Forbidden);
1635	let stranger = Asker { role: None, repo_role: None, ..owner() };
1636	assert_eq!(admin_only(stranger, "acme", "archive", Capability::Administer).unwrap_err().0, FailureCode::NotFound);
1637	assert_eq!(admin_only(Asker { person: false, ..owner() }, "acme", "rename", Capability::Administer).unwrap_err().0, FailureCode::Forbidden);
1638	}
1639
1640	#[test]
1641	fn a_workspace_restore_brings_back_only_what_went_with_it() {
1642	assert!(comes_back_with(Some("wsp_1"), "wsp_1"));
1643	// Deleted on its own before the workspace was.
1644	assert!(!comes_back_with(None, "wsp_1"));
1645	// Went with another workspace (it was transferred since).
1646	assert!(!comes_back_with(Some("wsp_2"), "wsp_1"));
1647	}
1648
1649	#[test]
1650	fn a_protected_workspace_keeps_its_repositories_whatever_is_published() {
1651	let protected = g1t_contracts::identity::protected_names(None);
1652	assert_eq!(
1653	may_go_with_workspace("flagon-io", &protected).unwrap_err(),
1654	"flagon-io is protected and can never be deleted."
1655	);
1656	assert!(may_go_with_workspace("FLAGON-IO", &protected).is_err());
1657	assert!(may_go_with_workspace("acme", &protected).is_ok());
1658	let configured = g1t_contracts::identity::protected_names(Some("acme"));
1659	assert!(may_go_with_workspace("acme", &configured).is_err());
1660	}
1661
1662	#[test]
1663	fn the_full_name_confirms_in_any_case() {
1664	assert!(confirmed(&path(), "acme/rocket"));
1665	assert!(confirmed(&path(), " ACME/Rocket "));
1666	assert!(!confirmed(&path(), "rocket"));
1667	assert!(!confirmed(&path(), ""));
1668	}
1669
1670	#[test]
1671	fn a_deleted_repository_is_restorable_for_thirty_days_then_due() {
1672	let deleted_at = 1_790_000_000_000u64;
1673	let purge = purge_after(deleted_at);
1674	assert_eq!(purge, rfc3339(deleted_at + 30 * 86_400_000));
1675	let day = 86_400_000u64;
1676	let at = \|ms: u64\| rfc3339(ms);
1677	assert_eq!(state(None, None, &at(deleted_at)), State::Active);
1678	assert_eq!(state(Some("2026-10-01T00:00:00.000Z"), None, &at(deleted_at)), State::Archived);
1679	let deleted = Some((at(deleted_at), purge.clone()));
1680	let deleted = deleted.as_ref().map(\|(a, b)\| (a.as_str(), b.as_str()));
1681	assert_eq!(state(None, deleted, &at(deleted_at + day)), State::Deleted);
1682	assert_eq!(state(None, deleted, &at(deleted_at + 30 * day - 1)), State::Deleted);
1683	assert_eq!(state(None, deleted, &at(deleted_at + 30 * day)), State::Due);
1684	// Archived and then deleted: deleted is what counts.
1685	assert_eq!(state(Some("x"), deleted, &at(deleted_at + day)), State::Deleted);
1686	assert!(restorable(&purge, &at(deleted_at + 29 * day)));
1687	assert!(!restorable(&purge, &at(deleted_at + 31 * day)));
1688	}
1689
1690	#[test]
1691	fn a_rename_needs_a_valid_free_name() {
1692	assert_eq!(new_name("acme", "rocket", " Booster ", Held::Free).unwrap(), "booster");
1693	assert_eq!(new_name("acme", "rocket", "rocket", Held::Free).unwrap_err().0, FailureCode::Invalid);
1694	assert_eq!(new_name("acme", "rocket", "no spaces", Held::Free).unwrap_err().0, FailureCode::Invalid);
1695	assert_eq!(new_name("acme", "rocket", "x.git", Held::Free).unwrap_err().0, FailureCode::Invalid);
1696	let (code, message) = new_name("acme", "rocket", "booster", Held::ByRepo).unwrap_err();
1697	assert_eq!(code, FailureCode::Conflict);
1698	assert_eq!(message, "acme already has a repository named booster.");
1699	let (code, message) = new_name("acme", "rocket", "booster", Held::ByDeleted).unwrap_err();
1700	assert_eq!(code, FailureCode::Conflict);
1701	assert!(message.contains("deleted recently"));
1702	}
1703
1704	fn repo(archived: bool) -> Repo {
1705	Repo {
1706	id: "rep_1".into(),
1707	namespace: "acme".into(),
1708	name: "rocket".into(),
1709	description: None,
1710	is_private: false,
1711	owner_id: "usr_1".into(),
1712	default_branch: "main".into(),
1713	fork_of: None,
1714	protected: false,
1715	created_at: String::new(),
1716	topics: Vec::new(),
1717	website: None,
1718	archived_at: archived.then(\|\| "2026-10-05T00:00:00.000Z".to_owned()),
1719	mirror: None,
1720	}
1721	}
1722
1723	#[test]
1724	fn a_mirror_refuses_writes_until_g1t_takes_over() {
1725	use g1t_contracts::mirrors::{MirrorState, RepoMirror};
1726	let mirror = \|state\| Repo {
1727	mirror: Some(RepoMirror { state, remote: "github.com/acme/rocket".into(), ..RepoMirror::default() }),
1728	..repo(false)
1729	};
1730	let (code, message) = read_only_refusal(&mirror(MirrorState::Standby)).unwrap();
1731	assert_eq!(code, FailureCode::Forbidden);
1732	assert!(message.contains("acme/rocket is a mirror of github.com/acme/rocket"));
1733	assert!(message.contains("take over"));
1734	assert!(read_only_refusal(&mirror(MirrorState::Ci)).is_some(), "CI failover runs workflows, not pushes");
1735	assert!(read_only_refusal(&mirror(MirrorState::Takeover)).is_none());
1736	assert!(read_only_refusal(&mirror(MirrorState::HandingBack)).unwrap().1.contains("handing back"));
1737	assert!(archived_refusal(&mirror(MirrorState::Standby)).is_none(), "a mirror's settings stay changeable");
1738	assert!(read_only_refusal(&repo(true)).unwrap().1.contains("archived"));
1739	assert!(read_only_refusal(&repo(false)).is_none());
1740	}
1741
1742	#[test]
1743	fn an_archived_repository_refuses_writes_with_the_reason() {
1744	assert!(archived_refusal(&repo(false)).is_none());
1745	let (code, message) = archived_refusal(&repo(true)).unwrap();
1746	assert_eq!(code, FailureCode::Forbidden);
1747	assert_eq!(message, "acme/rocket is archived, so it is read-only. An owner can unarchive it in its settings.");
1748	}
1749
1750	#[test]
1751	fn going_private_on_a_free_workspace_needs_room() {
1752	let full = VisibilityFacts {
1753	to_private: true,
1754	free: true,
1755	private_bytes: 900_000_000,
1756	bytes: 200_000_000,
1757	free_private_bytes: 1_000_000_000,
1758	};
1759	assert_eq!(visibility_check("acme", &full).unwrap_err().0, FailureCode::PaymentRequired);
1760	assert!(visibility_check("acme", &VisibilityFacts { free: false, ..full }).is_ok());
1761	let full = VisibilityFacts {
1762	to_private: true,
1763	free: true,
1764	private_bytes: 900_000_000,
1765	bytes: 200_000_000,
1766	free_private_bytes: 1_000_000_000,
1767	};
1768	// Going public is never refused.
1769	assert!(visibility_check("acme", &VisibilityFacts { to_private: false, ..full }).is_ok());
1770	let light = VisibilityFacts {
1771	to_private: true,
1772	free: true,
1773	private_bytes: 1_000,
1774	bytes: 1_000,
1775	free_private_bytes: 1_000_000_000,
1776	};
1777	assert!(visibility_check("acme", &light).is_ok());
1778	}
1779
1780	#[test]
1781	fn a_branch_is_renamed_to_a_free_valid_name() {
1782	let branches = vec!["main".to_owned(), "dev".to_owned()];
1783	assert_eq!(branch_rename("main", " trunk ", &branches).unwrap(), "trunk");
1784	assert_eq!(branch_rename("nope", "trunk", &branches).unwrap_err().0, FailureCode::NotFound);
1785	assert_eq!(branch_rename("main", "dev", &branches).unwrap_err().0, FailureCode::Conflict);
1786	assert_eq!(branch_rename("main", "main", &branches).unwrap_err().0, FailureCode::Invalid);
1787	assert_eq!(branch_rename("main", "a b", &branches).unwrap_err().0, FailureCode::Invalid);
1788	assert_eq!(branch_rename("main", "g1t-queue", &branches).unwrap_err().0, FailureCode::Invalid);
1789	}
1790
1791	#[test]
1792	fn the_empty_pack_is_well_formed() {
1793	assert_eq!(EMPTY_PACK.len(), 32);
1794	assert!(EMPTY_PACK.starts_with(b"PACK\0\0\0\x02\0\0\0\0"));
1795	}
1796	}