Agent tokens decide approval gates only where the repository allows it 4a68f1064b08

-- Whether an agent's token may approve or reject this repository's

-- approval gates (oxygenhub#258); off, a person decides them.

ALTER TABLE repositories ADD COLUMN agents_decide_gates BOOLEAN NOT NULL DEFAULT FALSE;

-- Whether an agent's token may approve or reject this repository's

-- approval gates (oxygenhub#258); off, a person decides them.

ALTER TABLE repositories ADD COLUMN agents_decide_gates INTEGER NOT NULL DEFAULT 0;

    /// Agents' tokens may approve or reject its approval gates (#258).

    #[sqlx(default)]

    pub agents_decide_gates: bool,

    Ok(())

}

/// Whether agents' tokens may decide the repository's approval gates (#258).

pub async fn set_agents_decide_gates(pool: &Pool, id: i64, on: bool) -> sqlx::Result<()> {

    sqlx::query("UPDATE repositories SET agents_decide_gates = $1 WHERE id = $2").bind(on).bind(id).execute(pool).await?;

    // A gate exists so a person decides (#258): an agent's token decides it

    // only where the repository allows it. A sealed decision is a person's

    // key, whatever carried it.

    if let (Some(agent), None) = (via, seal) {

        if !row.agents_decide_gates {

            return Err(format!(

                "{name} is decided by a person here, not through an agent's token ({agent}): decide it yourself on the run page, or a maintainer can let agents decide approval gates in Settings › OxygenFlow"

            ));

        }

    }

        .route("/{owner}/{name}/settings/agent-gates", post(repo_settings::agent_gates))

pub struct AgentGatesForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    /// `on` when the box is ticked.

    #[serde(default)]

    agents: String,

}

/// `POST /{owner}/{repo}/settings/agent-gates` (oxygenhub#258): whether an

/// agent's token may approve or reject this repository's approval gates;

/// for maintainers, audited.

pub async fn agent_gates(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<AgentGatesForm>,

) -> Result<Page<RepoSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (_, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Maintain).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let on = f.agents == "on";

    db::repos::set_agents_decide_gates(&app.db, row.id, on).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, viewer.account(), "repo.agents_decide_gates", &format!("{owner}/{name}"), if on { "on" } else { "off" })

        .await

        .ok();

    let row = db::repos::get_by_id(&app.db, row.id).await.map_err(|e| Error::from_db(shell.clone(), e))?.unwrap_or(row);

    let notice = if on {

        "Agents' tokens may now approve or reject this repository's approval gates; it says so on each."

    } else {

        "Approval gates here are decided by people: agents' tokens are refused."

    };

    settings_page(&app, shell, row, role, Some(notice.into()), None).await

}

#[derive(Deserialize)]

    // An agent's token decides a gate only where the repository allows it

    // (#258).

    assert_eq!(st, StatusCode::CONFLICT, "{body}");

    assert!(body.contains("decided by a person here") && body.contains("Settings › OxygenFlow"), "{body}");

    let gated = db::repos::get(&h.app.db, "andy", "gated").await.unwrap().unwrap();

    db::repos::set_agents_decide_gates(&h.app.db, gated.id, true).await.unwrap();

    let (st, body) = call(&h.app, "POST", "/api/v1/repos/andy/gated/flow/runs/2/jobs/apply/reject", Some(&secret), Some("{}".into())).await;

<form class="card wide" id="agent-gates" method="post" action="{{ repo.url }}/settings/agent-gates">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Approval gates and agents</h2>

  <p>A gate is there so a person decides. By default an agent's token (an agent-marked token, or a keyless agent's grant) cannot approve or reject one here; a decision signed with a person's key (a sealed approval) always can.</p>

  <label class="check"><input type="checkbox" name="agents"{% if row.agents_decide_gates %} checked{% endif %}> Let agents' tokens approve and reject this repository's approval gates (each decision still says which agent)</label>

  <button type="submit">SAVE</button>

</form>