roles.rs 90.0%

72 of 80 lines run, 11 of 24 functions · run #536 on main · run missed

//! Roles on repositories and organisations (hub spec §5.2, §5.5). The hub's
//! roles decide who may reach a repository and attempt a push; the
//! repository's trust policy decides which keys may move which references.

use crate::db::{self, accounts::Account, repos::RepoRow, Pool};
use hub_api::Visibility;

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
#[repr(u8)]
pub enum Role {
    Read = 1,
    Triage = 2,
    Write = 3,
    Maintain = 4,
    Admin = 5,
}

impl Role {
    pub fn parse(s: &str) -> Option<Role> {
        Some(match s {
            "read" => Role::Read,
            "triage" => Role::Triage,
            "write" => Role::Write,
            "maintain" => Role::Maintain,
            "admin" => Role::Admin,
            _ => return None,
        })
    }

    pub fn as_str(self) -> &'static str {
        match self {
            Role::Read => "read",
            Role::Triage => "triage",
            Role::Write => "write",
            Role::Maintain => "maintain",
            Role::Admin => "admin",
        }
    }

    pub const ALL: [Role; 5] = [Role::Read, Role::Triage, Role::Write, Role::Maintain, Role::Admin];
}

/// What a request wants to do with a repository.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Access {
    Read,
    Write,
    Maintain,
    Admin,
}

impl Access {
    fn needs(self) -> Role {
        match self {
            Access::Read => Role::Read,
            Access::Write => Role::Write,
            Access::Maintain => Role::Maintain,
            Access::Admin => Role::Admin,
        }
    }
}

/// The role `account` (or nobody) holds on `repo`, from ownership,
/// organisation membership, collaborator entries and visibility.
pub async fn role_for(pool: &Pool, account: Option<&Account>, repo: &RepoRow) -> sqlx::Result<Option<Role>> {
    // A drop (#279): anyone with its address reads it, a secret one too
    // (secret only keeps it off lists); only its owner writes. A site
    // administrator may delete it (`drops::may_delete`), nothing more.
    if repo.is_drop() {
        return Ok(match account {
            Some(a) if !a.blocked() && a.username.eq_ignore_ascii_case(&repo.owner) => Some(Role::Admin),
            Some(a) if a.blocked() => None,
            _ => Some(Role::Read),
        });
    }
    let visibility = repo.visibility();
    let Some(account) = account else {
        return Ok(if visibility == Visibility::Public { Some(Role::Read) } else { None });
    };
    if account.blocked() {
        return Ok(None);
    }
    if account.is_admin || account.username.eq_ignore_ascii_case(&repo.owner) {
        return Ok(Some(Role::Admin));
    }
    let mut best: Option<Role> = None;
    if let Some(org) = db::accounts::org_by_name(pool, &repo.owner).await? {
        match db::accounts::org_role(pool, org.id, account.id).await?.as_deref() {
            Some("owner") => return Ok(Some(Role::Admin)),
            Some(_) => best = Role::parse(&org.default_role),
            None => {}
        }
    }
    if let Some(r) = db::accounts::collaborator_role(pool, repo.id, account.id).await?.as_deref().and_then(Role::parse) {
        best = Some(best.map_or(r, |b| b.max(r)));
    }
    if best.is_none() && visibility != Visibility::Private {
        best = Some(Role::Read);
    }
    Ok(best)
}

/// Whether `role` permits `access`.
pub fn allows(role: Option<Role>, access: Access) -> bool {
    role.is_some_and(|r| r >= access.needs())
}

/// Whether an account may create repositories under `owner`.
pub async fn may_create_under(pool: &Pool, account: &Account, owner: &str) -> sqlx::Result<bool> {
    if account.blocked() {
        return Ok(false);
    }
    if account.username.eq_ignore_ascii_case(owner) || account.is_admin {
        return Ok(true);
    }
    match db::accounts::org_by_name(pool, owner).await? {
        Some(org) => Ok(db::accounts::org_role(pool, org.id, account.id).await?.is_some()),
        None => Ok(false),
    }
}

/// Whether an account administers an organisation.
pub async fn is_org_owner(pool: &Pool, account: &Account, org_id: i64) -> sqlx::Result<bool> {
    if account.is_admin {
        return Ok(true);
    }
    Ok(db::accounts::org_role(pool, org_id, account.id).await?.as_deref() == Some("owner"))
}

1		//! Roles on repositories and organisations (hub spec §5.2, §5.5). The hub's
2		//! roles decide who may reach a repository and attempt a push; the
3		//! repository's trust policy decides which keys may move which references.
4
5		use crate::db::{self, accounts::Account, repos::RepoRow, Pool};
6		use hub_api::Visibility;
7
8		#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
9		#[repr(u8)]
10		pub enum Role {
11		Read = 1,
12		Triage = 2,
13		Write = 3,
14		Maintain = 4,
15		Admin = 5,
16		}
17
18		impl Role {
19	109×	pub fn parse(s: &str) -> Option<Role> {
20	109×	Some(match s {
21	109×	"read" => Role::Read,
22	108×	"triage" => Role::Triage,
23	108×	"write" => Role::Write,
24	64×	"maintain" => Role::Maintain,
25	0×	"admin" => Role::Admin,
26	0×	_ => return None,
27		})
28	109×	}
29
30	15×	pub fn as_str(self) -> &'static str {
31	15×	match self {
32	0×	Role::Read => "read",
33	0×	Role::Triage => "triage",
34	12×	Role::Write => "write",
35	3×	Role::Maintain => "maintain",
36	0×	Role::Admin => "admin",
37		}
38	15×	}
39
40		pub const ALL: [Role; 5] = [Role::Read, Role::Triage, Role::Write, Role::Maintain, Role::Admin];
41		}
42
43		/// What a request wants to do with a repository.
44		#[derive(Clone, Copy, Debug, PartialEq, Eq)]
45		pub enum Access {
46		Read,
47		Write,
48		Maintain,
49		Admin,
50		}
51
52		impl Access {
53	3836×	fn needs(self) -> Role {
54	3836×	match self {
55	2160×	Access::Read => Role::Read,
56	1039×	Access::Write => Role::Write,
57	591×	Access::Maintain => Role::Maintain,
58	46×	Access::Admin => Role::Admin,
59		}
60	3836×	}
61		}
62
63		/// The role `account` (or nobody) holds on `repo`, from ownership,
64		/// organisation membership, collaborator entries and visibility.
65	1636×	pub async fn role_for(pool: &Pool, account: Option<&Account>, repo: &RepoRow) -> sqlx::Result<Option<Role>> {
66		// A drop (#279): anyone with its address reads it, a secret one too
67		// (secret only keeps it off lists); only its owner writes. A site
68		// administrator may delete it (`drops::may_delete`), nothing more.
69	1636×	if repo.is_drop() {
70	24×	return Ok(match account {
71	54×	Some(a) if !a.blocked() && a.username.eq_ignore_ascii_case(&repo.owner) => Some(Role::Admin),
72	24×	Some(a) if a.blocked() => None,
73	52×	_ => Some(Role::Read),
74		});
75	1554×	}
76	1554×	let visibility = repo.visibility();
77	1554×	let Some(account) = account else {
78	480×	return Ok(if visibility == Visibility::Public { Some(Role::Read) } else { None });
79		};
80	1074×	if account.blocked() {
81	0×	return Ok(None);
82	1074×	}
83	1074×	if account.is_admin \|\| account.username.eq_ignore_ascii_case(&repo.owner) {
84	894×	return Ok(Some(Role::Admin));
85	180×	}
86	180×	let mut best: Option<Role> = None;
87	180×	if let Some(org) = db::accounts::org_by_name(pool, &repo.owner).await? {
88	3×	match db::accounts::org_role(pool, org.id, account.id).await?.as_deref() {
89	1×	Some("owner") => return Ok(Some(Role::Admin)),
90	1×	Some(_) => best = Role::parse(&org.default_role),
91	2×	None => {}
92		}
93	177×	}
94	180×	if let Some(r) = db::accounts::collaborator_role(pool, repo.id, account.id).await?.as_deref().and_then(Role::parse) {
95	41×	best = Some(best.map_or(r, \|b\| b.max(r)));
96	139×	}
97	180×	if best.is_none() && visibility != Visibility::Private {
98	132×	best = Some(Role::Read);
99	132×	}
100	180×	Ok(best)
101	1636×	}
102
103		/// Whether `role` permits `access`.
104	3856×	pub fn allows(role: Option<Role>, access: Access) -> bool {
105	3856×	role.is_some_and(\|r\| r >= access.needs())
106	3856×	}
107
108		/// Whether an account may create repositories under `owner`.
109	40×	pub async fn may_create_under(pool: &Pool, account: &Account, owner: &str) -> sqlx::Result<bool> {
110	40×	if account.blocked() {
111	0×	return Ok(false);
112	40×	}
113	40×	if account.username.eq_ignore_ascii_case(owner) \|\| account.is_admin {
114	37×	return Ok(true);
115	3×	}
116	3×	match db::accounts::org_by_name(pool, owner).await? {
117	1×	Some(org) => Ok(db::accounts::org_role(pool, org.id, account.id).await?.is_some()),
118	2×	None => Ok(false),
119		}
120	40×	}
121
122		/// Whether an account administers an organisation.
123	41×	pub async fn is_org_owner(pool: &Pool, account: &Account, org_id: i64) -> sqlx::Result<bool> {
124	41×	if account.is_admin {
125	34×	return Ok(true);
126	7×	}
127	7×	Ok(db::accounts::org_role(pool, org_id, account.id).await?.as_deref() == Some("owner"))
128	41×	}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/auth/roles.rs 90.0%

Keyboard