`0da6e59`

S26: policy.ActionWatchSet + permissions.md table entry

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 5 days ago

Status	File	+	-
M	`docs/internal/permissions.md`	1	0
M	`internal/auth/policy/actions.go`	8	0
M	`internal/auth/policy/policy.go`	15	4
M	`internal/auth/policy/policy_test.go`	3	2

docs/internal/permissions.mdmodified

  | `pull:close`                          | `write`          |
  | `star:create`                         | logged in        |
  | `fork:create`                         | logged in        |
 +| `watch:set`                           | logged in        |
  Read actions on **public** repos are short-circuited to allow before the
  role check — anyone (anonymous or otherwise) can read a public repo.

internal/auth/policy/actions.gomodified

  const (
  	ActionStarCreate Action = "star:create"
  	ActionForkCreate Action = "fork:create"
++
 +	// S26 social actions. WatchSet covers both setting an explicit
 +	// level and unsetting (deleting the row). Both require a logged-in
 +	// user with read access to the repo — the policy.Can engine
 +	// enforces visibility before reaching the role check, so a
 +	// non-collab on a private repo deny-leaks as 404.
 +	ActionWatchSet Action = "watch:set"
+ )
  // AllActions is the canonical list. The matrix test iterates this so a
  	ActionIssueRead, ActionIssueCreate, ActionIssueComment, ActionIssueClose, ActionIssueLabel, ActionIssueAssign,
  	ActionPullRead, ActionPullCreate, ActionPullMerge, ActionPullReview, ActionPullClose,
  	ActionStarCreate, ActionForkCreate,
 +	ActionWatchSet,
+ }
  // isWriteAction returns true when the action mutates state. Used by the

internal/auth/policy/policy.gomodified

  		return deny(DenyRoleTooLow, "role too low")
+ 	}
 -	// 9. Login-required actions: star/fork need any logged-in user.
 -	if (action == ActionStarCreate || action == ActionForkCreate) && actor.IsAnonymous {
 -		return deny(DenyAnonymous, "anonymous cannot star/fork")
 +	// 9. Login-required actions: star/fork/watch-set need any
 +	//    logged-in user. Anonymous reaches here only on a public repo
 +	//    (see step 4); we deny with the anonymous code so the handler
 +	//    can render a friendly "log in to star" prompt.
 +	if (action == ActionStarCreate || action == ActionForkCreate || action == ActionWatchSet) &&
 +		actor.IsAnonymous {
 +		return deny(DenyAnonymous, "anonymous cannot star/fork/watch")
+ 	}
  	return allow("granted")
  		return RoleAdmin
  	// Login-required but no role required (any logged-in user).
 -	case ActionStarCreate, ActionForkCreate:
 +	// Star/fork: any logged-in user can star or fork any repo they
 +	// can read — the visibility short-circuit above already gates
 +	// private-repo access, and the role check below short-circuits
 +	// to allow when minRole is RoleNone.
 +	// WatchSet: same shape — any logged-in user with read access
 +	// can choose their watch level. The downstream notifications
 +	// fan-out (S29) is what enforces level-based delivery.
 +	case ActionStarCreate, ActionForkCreate, ActionWatchSet:
  		return RoleNone
  	default:

internal/auth/policy/policy_test.gomodified

+ 	}
  	// Login-only social actions.
 -	if action == policy.ActionStarCreate || action == policy.ActionForkCreate {
 +	if action == policy.ActionStarCreate || action == policy.ActionForkCreate ||
 +		action == policy.ActionWatchSet {
  		return have != policy.RoleNone || (actor != actorAnonymous)
+ 	}
  		policy.ActionRepoArchive, policy.ActionRepoDelete, policy.ActionRepoTransfer, policy.ActionRepoVisibility,
  		policy.ActionPullMerge:
  		return policy.RoleAdmin
 -	case policy.ActionStarCreate, policy.ActionForkCreate:
 +	case policy.ActionStarCreate, policy.ActionForkCreate, policy.ActionWatchSet:
  		return policy.RoleNone
+ 	}
  	return policy.RoleAdmin