S15: refactor SSH dispatch, HTTP git, repo lookup, pre-receive hook to use policy.Can

Status	File	+	-
M	`cmd/shithubd/hook.go`	26	16
M	`internal/git/protocol/ssh_dispatch.go`	19	14
A	`internal/git/protocol/ssh_dispatch_collab_test.go`	150	0
M	`internal/web/handlers/githttp/handler.go`	25	12
M	`internal/web/handlers/repo/repo.go`	11	1

cmd/shithubd/hook.gomodified

  	"github.com/jackc/pgx/v5/pgxpool"
  	"github.com/spf13/cobra"
++	"github.com/tenseleyFlow/shithub/internal/auth/policy"
  	"github.com/tenseleyFlow/shithub/internal/infra/config"
  	"github.com/tenseleyFlow/shithub/internal/infra/db"
++	reposdb "github.com/tenseleyFlow/shithub/internal/repos/sqlc"
  	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
  	"github.com/tenseleyFlow/shithub/internal/worker"
  	workerdb "github.com/tenseleyFlow/shithub/internal/worker/sqlc"
  func (e errHookGate) Error() string { return "shithub-hook: " + e.kind }
  var (
--	errHookSuspended = errHookGate{"user suspended"}
++	errHookSuspended  = errHookGate{"user suspended"}
--	errHookArchived  = errHookGate{"repo archived"}
++	errHookArchived   = errHookGate{"repo archived"}
--	errHookDeleted   = errHookGate{"repo deleted"}
++	errHookDeleted    = errHookGate{"repo deleted"}
--	errHookMissing   = errHookGate{"missing context"}
++	errHookMissing    = errHookGate{"missing context"}
++	errHookPermDenied = errHookGate{"permission denied"}
+ )
  func friendlyHookErr(err error) string {
  		return "shithub: this repository is archived; pushes are disabled."
  	case errors.Is(err, errHookDeleted):
  		return "shithub: this repository has been deleted."
++	case errors.Is(err, errHookPermDenied):
++		return "shithub: you do not have write access to this repository."
  	case errors.Is(err, errHookMissing):
  		return "shithub: server error: hook context missing. Contact the operator."
  	default:
  	if err != nil {
  		return fmt.Errorf("user lookup: %w", err)
+ 	}
--	if user.SuspendedAt.Valid {
--		return errHookSuspended
--	}
--	row := h.pool.QueryRow(ctx,
++	rq := reposdb.New()
--		`SELECT is_archived, deleted_at FROM repos WHERE id = $1`, h.repoID)
++	repo, err := rq.GetRepoByID(ctx, h.pool, h.repoID)
--	var archived bool
++	if err != nil {
--	var deletedAt pgtype.Timestamptz
--	if err := row.Scan(&archived, &deletedAt); err != nil {
  		return fmt.Errorf("repo lookup: %w", err)
+ 	}
--	if deletedAt.Valid {
++
--		return errHookDeleted
++	actor := policy.UserActor(user.ID, user.Username, user.SuspendedAt.Valid, false)
++	repoRef := policy.NewRepoRefFromRepo(repo)
++	decision := policy.Can(ctx, policy.Deps{Pool: h.pool}, actor, policy.ActionRepoWrite, repoRef)
++	if decision.Allow {
++		return nil
+ 	}
--	if archived {
++	switch decision.Code {
++	case policy.DenyRepoDeleted:
++		return errHookDeleted
++	case policy.DenyActorSuspended:
++		return errHookSuspended
++	case policy.DenyArchived:
  		return errHookArchived
++	default:
++		return errHookPermDenied
+ 	}
--	return nil
+ }
  func postReceiveEnqueue(ctx context.Context, h *hookCtx, refs []refUpdate) error {

internal/git/protocol/ssh_dispatch.gomodified

  	"github.com/jackc/pgx/v5/pgtype"
  	"github.com/jackc/pgx/v5/pgxpool"
++	"github.com/tenseleyFlow/shithub/internal/auth/policy"
  	"github.com/tenseleyFlow/shithub/internal/infra/storage"
  	reposdb "github.com/tenseleyFlow/shithub/internal/repos/sqlc"
  	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
  		return nil, parsed, fmt.Errorf("%w: %v", ErrSSHInternal, err)
+ 	}
--	// Inline authz — same shape as the HTTP handler. Public repos can
++	// Authz via policy.Can. Map the policy decision back to the typed
--	// be pulled by anyone; everything else requires owner identity.
++	// SSH errors so the friendly-message catalogue keeps working.
--	// (S15 lifts this into policy.Can.)
++	repoRef := policy.NewRepoRefFromRepo(repo)
--	if parsed.Service == UploadPack {
++	actor := policy.UserActor(user.ID, user.Username, user.SuspendedAt.Valid, false)
--		if repo.Visibility == reposdb.RepoVisibilityPrivate && user.ID != owner.ID {
++	action := policy.ActionRepoRead
--			return nil, parsed, ErrSSHRepoNotFound
++	if parsed.Service == ReceivePack {
--		}
++		action = policy.ActionRepoWrite
--	} else {
++	}
--		if user.ID != owner.ID {
++	decision := policy.Can(ctx, policy.Deps{Pool: deps.Pool}, actor, action, repoRef)
--			return nil, parsed, ErrSSHPermDenied
++	if !decision.Allow {
--		}
++		switch decision.Code {
--		if repo.IsArchived {
++		case policy.DenyActorSuspended:
++			return nil, parsed, ErrSSHSuspended
++		case policy.DenyArchived:
  			return nil, parsed, ErrSSHArchived
--		}
++		case policy.DenyVisibility, policy.DenyRepoDeleted:
--		if repo.DeletedAt.Valid {
++			// Existence-leak guard: pretend the repo doesn't exist.
  			return nil, parsed, ErrSSHRepoNotFound
++		default:
++			return nil, parsed, ErrSSHPermDenied
+ 		}
+ 	}

internal/git/protocol/ssh_dispatch_collab_test.goadded

++// SPDX-License-Identifier: AGPL-3.0-or-later
++
++package protocol_test
++
++import (
++	"context"
++	"errors"
++	"testing"
++
++	"github.com/tenseleyFlow/shithub/internal/auth/policy"
++	policydb "github.com/tenseleyFlow/shithub/internal/auth/policy/sqlc"
++	"github.com/tenseleyFlow/shithub/internal/git/protocol"
++)
++
++// TestDispatch_CollabWriteCanPushPrivate confirms that adding eve as a
++// 'write' collaborator on alice's private repo lets her push. Before
++// S15 this would have been ErrSSHPermDenied; after S15 the policy
++// package grants based on the role row.
++func TestDispatch_CollabWriteCanPushPrivate(t *testing.T) {
++	t.Parallel()
++	env := setupDispatch(t)
++	pq := policydb.New()
++	if err := pq.UpsertCollabRole(context.Background(), env.pool, policydb.UpsertCollabRoleParams{
++		RepoID: repoIDFor(t, env, "alice", "private"),
++		UserID: env.eve,
++		Role:   policydb.CollabRoleWrite,
++	}); err != nil {
++		t.Fatalf("UpsertCollabRole: %v", err)
++	}
++
++	_, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-receive-pack 'alice/private'",
++		UserID:          env.eve,
++	})
++	if err != nil {
++		t.Fatalf("collab-write push denied: %v", err)
++	}
++}
++
++// TestDispatch_CollabReadCannotPush confirms that a 'read' grant lets
++// eve clone but not push.
++func TestDispatch_CollabReadCannotPush(t *testing.T) {
++	t.Parallel()
++	env := setupDispatch(t)
++	pq := policydb.New()
++	if err := pq.UpsertCollabRole(context.Background(), env.pool, policydb.UpsertCollabRoleParams{
++		RepoID: repoIDFor(t, env, "alice", "private"),
++		UserID: env.eve,
++		Role:   policydb.CollabRoleRead,
++	}); err != nil {
++		t.Fatalf("UpsertCollabRole: %v", err)
++	}
++	// Pull: allowed.
++	if _, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-upload-pack 'alice/private'",
++		UserID:          env.eve,
++	}); err != nil {
++		t.Fatalf("collab-read pull denied: %v", err)
++	}
++	// Push: denied with permission-denied (not 404, eve has read so
++	// existence is no secret).
++	_, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-receive-pack 'alice/private'",
++		UserID:          env.eve,
++	})
++	if !errors.Is(err, protocol.ErrSSHPermDenied) {
++		t.Fatalf("collab-read push: err = %v, want ErrSSHPermDenied", err)
++	}
++}
++
++// TestDispatch_DemotedCollabLosesAccessNextRequest mirrors the spec's
++// definition-of-done bullet: dropping the role takes effect immediately
++// on the next request (no cross-request cache).
++func TestDispatch_DemotedCollabLosesAccessNextRequest(t *testing.T) {
++	t.Parallel()
++	env := setupDispatch(t)
++	pq := policydb.New()
++	repoID := repoIDFor(t, env, "alice", "private")
++	if err := pq.UpsertCollabRole(context.Background(), env.pool, policydb.UpsertCollabRoleParams{
++		RepoID: repoID, UserID: env.eve, Role: policydb.CollabRoleAdmin,
++	}); err != nil {
++		t.Fatalf("UpsertCollabRole admin: %v", err)
++	}
++	// Eve as admin: push allowed.
++	if _, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-receive-pack 'alice/private'",
++		UserID:          env.eve,
++	}); err != nil {
++		t.Fatalf("admin push denied: %v", err)
++	}
++	// Demote to read.
++	if err := pq.UpsertCollabRole(context.Background(), env.pool, policydb.UpsertCollabRoleParams{
++		RepoID: repoID, UserID: env.eve, Role: policydb.CollabRoleRead,
++	}); err != nil {
++		t.Fatalf("UpsertCollabRole read: %v", err)
++	}
++	// Next request: push denied.
++	_, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-receive-pack 'alice/private'",
++		UserID:          env.eve,
++	})
++	if !errors.Is(err, protocol.ErrSSHPermDenied) {
++		t.Fatalf("demoted push: err = %v, want ErrSSHPermDenied", err)
++	}
++}
++
++// TestDispatch_RemovedCollabFallsBack404 confirms that fully removing
++// the row turns eve back into a stranger on a private repo: the
++// rejection is "repo not found" (existence-leak guard).
++func TestDispatch_RemovedCollabFallsBack404(t *testing.T) {
++	t.Parallel()
++	env := setupDispatch(t)
++	pq := policydb.New()
++	repoID := repoIDFor(t, env, "alice", "private")
++	if err := pq.UpsertCollabRole(context.Background(), env.pool, policydb.UpsertCollabRoleParams{
++		RepoID: repoID, UserID: env.eve, Role: policydb.CollabRoleRead,
++	}); err != nil {
++		t.Fatalf("UpsertCollabRole: %v", err)
++	}
++	if err := pq.RemoveCollab(context.Background(), env.pool, policydb.RemoveCollabParams{
++		RepoID: repoID, UserID: env.eve,
++	}); err != nil {
++		t.Fatalf("RemoveCollab: %v", err)
++	}
++	_, _, err := protocol.PrepareDispatch(context.Background(), env.deps, protocol.SSHDispatchInput{
++		OriginalCommand: "git-upload-pack 'alice/private'",
++		UserID:          env.eve,
++	})
++	if !errors.Is(err, protocol.ErrSSHRepoNotFound) {
++		t.Fatalf("removed collab pull: err = %v, want ErrSSHRepoNotFound", err)
++	}
++	// Sanity-check the policy decision separately.
++	_ = policy.ActionRepoRead
++}
++
++// repoIDFor looks up the bigserial id for a repo so the collab insert
++// references a real row. setupDispatch creates "public" and "private";
++// callers ask by name.
++func repoIDFor(t *testing.T, env *dispatchEnv, owner, name string) int64 {
++	t.Helper()
++	var id int64
++	err := env.pool.QueryRow(context.Background(),
++		`SELECT r.id FROM repos r JOIN users u ON u.id = r.owner_user_id
++         WHERE u.username = $1 AND r.name = $2`,
++		owner, name).Scan(&id)
++	if err != nil {
++		t.Fatalf("repoIDFor %s/%s: %v", owner, name, err)
++	}
++	return id
++}

internal/web/handlers/githttp/handler.gomodified

  	"github.com/go-chi/chi/v5"
  	"github.com/jackc/pgx/v5/pgtype"
++	"github.com/tenseleyFlow/shithub/internal/auth/policy"
  	"github.com/tenseleyFlow/shithub/internal/git/protocol"
  	reposdb "github.com/tenseleyFlow/shithub/internal/repos/sqlc"
  	"github.com/tenseleyFlow/shithub/internal/web/middleware"
+ 	}
  	auth, authErr := h.resolveBasicAuth(r.Context(), r.Header.Get("Authorization"))
--	requireAuth := svc == protocol.ReceivePack || row.Visibility == reposdb.RepoVisibilityPrivate
++	repoRef := policy.NewRepoRefFromRepo(row)
++	requireAuth := svc == protocol.ReceivePack || repoRef.IsPrivate()
  	if authErr != nil || (requireAuth && auth.Anonymous) {
  		writeChallenge(w)
  		return reposdb.Repo{}, false
+ 	}
--	// Permission check — inline; S15 replaces this with the policy package.
++	// Build the policy actor and ask Can(). Owner identity, collab role,
--	// V1: only the owner can read a private repo or write to any repo.
++	// archived/deleted gates all live in the policy package now.
--	if !auth.Anonymous && auth.UserID != owner.ID {
++	var actor policy.Actor
--		http.Error(w, "forbidden", http.StatusForbidden)
++	if auth.Anonymous {
--		return reposdb.Repo{}, false
++		actor = policy.AnonymousActor()
++	} else {
++		actor = policy.UserActor(auth.UserID, auth.Username, false, false)
+ 	}
++	action := policy.ActionRepoRead
  	if svc == protocol.ReceivePack {
--		if row.IsArchived {
++		action = policy.ActionRepoWrite
++	}
++	decision := policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, actor, action, repoRef)
++	if !decision.Allow {
++		switch decision.Code {
++		case policy.DenyRepoDeleted:
++			http.Error(w, "gone", http.StatusGone)
++		case policy.DenyArchived:
++			// User sees this directly in their git client.
  			writeGitErrorMessage(w, http.StatusForbidden,
  				"repository is archived; pushes are disabled")
--			return reposdb.Repo{}, false
++		case policy.DenyVisibility:
--		}
++			http.Error(w, "not found", http.StatusNotFound)
--		if row.DeletedAt.Valid {
++		default:
--			http.Error(w, "gone", http.StatusGone)
++			http.Error(w, "forbidden", http.StatusForbidden)
--			return reposdb.Repo{}, false
+ 		}
++		return reposdb.Repo{}, false
+ 	}
  	return row, true
+ }

internal/web/handlers/repo/repo.gomodified

  	"github.com/jackc/pgx/v5/pgxpool"
  	"github.com/tenseleyFlow/shithub/internal/auth/audit"
++	"github.com/tenseleyFlow/shithub/internal/auth/policy"
  	"github.com/tenseleyFlow/shithub/internal/auth/throttle"
  	"github.com/tenseleyFlow/shithub/internal/infra/storage"
  	"github.com/tenseleyFlow/shithub/internal/repos"
  	if err != nil {
  		return reposdb.Repo{}, err
+ 	}
--	if row.Visibility == reposdb.RepoVisibilityPrivate && (viewerID == 0 || viewerID != owner.ID) {
++	// Visibility decision delegated to policy.Can. We use ActionRepoRead;
++	// when the decision denies, return ErrNoRows so the caller can 404.
++	repoRef := policy.NewRepoRefFromRepo(row)
++	var actor policy.Actor
++	if viewerID == 0 {
++		actor = policy.AnonymousActor()
++	} else {
++		actor = policy.UserActor(viewerID, "", false, false)
++	}
++	if !policy.Can(ctx, policy.Deps{Pool: h.d.Pool}, actor, policy.ActionRepoRead, repoRef).Allow {
  		return reposdb.Repo{}, pgx.ErrNoRows
+ 	}
  	return row, nil

tenseleyflow/shithub / `4c2a504`

5 changed files