tenseleyflow/shithub / e4425c9

Browse files

S15: repo_collaborators table + policydb sqlc bucket

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
e4425c9ec63acddcbbbeab9b553259b12753d623
Parents
4f709dd
Tree
bff7f75

11 changed files

StatusFile+-
A internal/auth/policy/queries/repo_collaborators.sql 31 0
A internal/auth/policy/sqlc/db.go 25 0
C internal/auth/policy/sqlc/models.go 0 0
A internal/auth/policy/sqlc/querier.go 27 0
A internal/auth/policy/sqlc/repo_collaborators.sql.go 123 0
M internal/meta/sqlc/models.go 53 0
A internal/migrationsfs/migrations/0019_repo_collaborators.sql 37 0
M internal/repos/sqlc/models.go 53 0
M internal/users/sqlc/models.go 53 0
M internal/worker/sqlc/models.go 53 0
M sqlc.yaml 16 0
internal/auth/policy/queries/repo_collaborators.sqladded
@@ -0,0 +1,31 @@
1
+-- SPDX-License-Identifier: AGPL-3.0-or-later
2
+--
3
+-- Query surface for the policy package. The policy code reads roles to
4
+-- decide; admin/settings UIs (S32) write through these as well.
5
+
6
+-- name: GetCollabRole :one
7
+-- Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows
8
+-- when the user is not a collaborator on this repo.
9
+SELECT role FROM repo_collaborators
10
+WHERE repo_id = $1 AND user_id = $2;
11
+
12
+-- name: UpsertCollabRole :exec
13
+-- Insert or upgrade a collaborator's role. added_by_user_id records who
14
+-- granted the role for the audit trail.
15
+INSERT INTO repo_collaborators (repo_id, user_id, role, added_by_user_id)
16
+VALUES ($1, $2, $3, sqlc.narg(added_by_user_id)::bigint)
17
+ON CONFLICT (repo_id, user_id)
18
+DO UPDATE SET role = EXCLUDED.role,
19
+              added_by_user_id = EXCLUDED.added_by_user_id;
20
+
21
+-- name: RemoveCollab :exec
22
+DELETE FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2;
23
+
24
+-- name: ListCollabs :many
25
+-- Used by the repo settings page (S32) and tests.
26
+SELECT rc.repo_id, rc.user_id, rc.role, rc.added_at,
27
+       u.username AS username, u.display_name AS display_name
28
+FROM repo_collaborators rc
29
+JOIN users u ON u.id = rc.user_id
30
+WHERE rc.repo_id = $1
31
+ORDER BY rc.added_at DESC;
internal/auth/policy/sqlc/db.goadded
@@ -0,0 +1,25 @@
1
+// Code generated by sqlc. DO NOT EDIT.
2
+// versions:
3
+//   sqlc v1.31.1
4
+
5
+package policydb
6
+
7
+import (
8
+	"context"
9
+
10
+	"github.com/jackc/pgx/v5"
11
+	"github.com/jackc/pgx/v5/pgconn"
12
+)
13
+
14
+type DBTX interface {
15
+	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
16
+	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
17
+	QueryRow(context.Context, string, ...interface{}) pgx.Row
18
+}
19
+
20
+func New() *Queries {
21
+	return &Queries{}
22
+}
23
+
24
+type Queries struct {
25
+}
internal/meta/sqlc/models.go → internal/auth/policy/sqlc/models.gocopied (82% similarity)
@@ -2,7 +2,7 @@
22
 // versions:
33
 //   sqlc v1.31.1
44
5
-package metadb
5
+package policydb
66
77
 import (
88
 	"database/sql/driver"
@@ -12,6 +12,51 @@ import (
1212
 	"github.com/jackc/pgx/v5/pgtype"
1313
 )
1414
15
+type CollabRole string
16
+
17
+const (
18
+	CollabRoleRead     CollabRole = "read"
19
+	CollabRoleTriage   CollabRole = "triage"
20
+	CollabRoleWrite    CollabRole = "write"
21
+	CollabRoleMaintain CollabRole = "maintain"
22
+	CollabRoleAdmin    CollabRole = "admin"
23
+)
24
+
25
+func (e *CollabRole) Scan(src interface{}) error {
26
+	switch s := src.(type) {
27
+	case []byte:
28
+		*e = CollabRole(s)
29
+	case string:
30
+		*e = CollabRole(s)
31
+	default:
32
+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)
33
+	}
34
+	return nil
35
+}
36
+
37
+type NullCollabRole struct {
38
+	CollabRole CollabRole
39
+	Valid      bool // Valid is true if CollabRole is not NULL
40
+}
41
+
42
+// Scan implements the Scanner interface.
43
+func (ns *NullCollabRole) Scan(value interface{}) error {
44
+	if value == nil {
45
+		ns.CollabRole, ns.Valid = "", false
46
+		return nil
47
+	}
48
+	ns.Valid = true
49
+	return ns.CollabRole.Scan(value)
50
+}
51
+
52
+// Value implements the driver Valuer interface.
53
+func (ns NullCollabRole) Value() (driver.Value, error) {
54
+	if !ns.Valid {
55
+		return nil, nil
56
+	}
57
+	return string(ns.CollabRole), nil
58
+}
59
+
1560
 type RepoVisibility string
1661
1762
 const (
@@ -146,6 +191,14 @@ type Repo struct {
146191
 	DefaultBranchOid pgtype.Text
147192
 }
148193
194
+type RepoCollaborator struct {
195
+	RepoID        int64
196
+	UserID        int64
197
+	Role          CollabRole
198
+	AddedAt       pgtype.Timestamptz
199
+	AddedByUserID pgtype.Int8
200
+}
201
+
149202
 type User struct {
150203
 	ID                int64
151204
 	Username          string
internal/auth/policy/sqlc/querier.goadded
@@ -0,0 +1,27 @@
1
+// Code generated by sqlc. DO NOT EDIT.
2
+// versions:
3
+//   sqlc v1.31.1
4
+
5
+package policydb
6
+
7
+import (
8
+	"context"
9
+)
10
+
11
+type Querier interface {
12
+	// SPDX-License-Identifier: AGPL-3.0-or-later
13
+	//
14
+	// Query surface for the policy package. The policy code reads roles to
15
+	// decide; admin/settings UIs (S32) write through these as well.
16
+	// Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows
17
+	// when the user is not a collaborator on this repo.
18
+	GetCollabRole(ctx context.Context, db DBTX, arg GetCollabRoleParams) (CollabRole, error)
19
+	// Used by the repo settings page (S32) and tests.
20
+	ListCollabs(ctx context.Context, db DBTX, repoID int64) ([]ListCollabsRow, error)
21
+	RemoveCollab(ctx context.Context, db DBTX, arg RemoveCollabParams) error
22
+	// Insert or upgrade a collaborator's role. added_by_user_id records who
23
+	// granted the role for the audit trail.
24
+	UpsertCollabRole(ctx context.Context, db DBTX, arg UpsertCollabRoleParams) error
25
+}
26
+
27
+var _ Querier = (*Queries)(nil)
internal/auth/policy/sqlc/repo_collaborators.sql.goadded
@@ -0,0 +1,123 @@
1
+// Code generated by sqlc. DO NOT EDIT.
2
+// versions:
3
+//   sqlc v1.31.1
4
+// source: repo_collaborators.sql
5
+
6
+package policydb
7
+
8
+import (
9
+	"context"
10
+
11
+	"github.com/jackc/pgx/v5/pgtype"
12
+)
13
+
14
+const getCollabRole = `-- name: GetCollabRole :one
15
+
16
+SELECT role FROM repo_collaborators
17
+WHERE repo_id = $1 AND user_id = $2
18
+`
19
+
20
+type GetCollabRoleParams struct {
21
+	RepoID int64
22
+	UserID int64
23
+}
24
+
25
+// SPDX-License-Identifier: AGPL-3.0-or-later
26
+//
27
+// Query surface for the policy package. The policy code reads roles to
28
+// decide; admin/settings UIs (S32) write through these as well.
29
+// Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows
30
+// when the user is not a collaborator on this repo.
31
+func (q *Queries) GetCollabRole(ctx context.Context, db DBTX, arg GetCollabRoleParams) (CollabRole, error) {
32
+	row := db.QueryRow(ctx, getCollabRole, arg.RepoID, arg.UserID)
33
+	var role CollabRole
34
+	err := row.Scan(&role)
35
+	return role, err
36
+}
37
+
38
+const listCollabs = `-- name: ListCollabs :many
39
+SELECT rc.repo_id, rc.user_id, rc.role, rc.added_at,
40
+       u.username AS username, u.display_name AS display_name
41
+FROM repo_collaborators rc
42
+JOIN users u ON u.id = rc.user_id
43
+WHERE rc.repo_id = $1
44
+ORDER BY rc.added_at DESC
45
+`
46
+
47
+type ListCollabsRow struct {
48
+	RepoID      int64
49
+	UserID      int64
50
+	Role        CollabRole
51
+	AddedAt     pgtype.Timestamptz
52
+	Username    string
53
+	DisplayName string
54
+}
55
+
56
+// Used by the repo settings page (S32) and tests.
57
+func (q *Queries) ListCollabs(ctx context.Context, db DBTX, repoID int64) ([]ListCollabsRow, error) {
58
+	rows, err := db.Query(ctx, listCollabs, repoID)
59
+	if err != nil {
60
+		return nil, err
61
+	}
62
+	defer rows.Close()
63
+	items := []ListCollabsRow{}
64
+	for rows.Next() {
65
+		var i ListCollabsRow
66
+		if err := rows.Scan(
67
+			&i.RepoID,
68
+			&i.UserID,
69
+			&i.Role,
70
+			&i.AddedAt,
71
+			&i.Username,
72
+			&i.DisplayName,
73
+		); err != nil {
74
+			return nil, err
75
+		}
76
+		items = append(items, i)
77
+	}
78
+	if err := rows.Err(); err != nil {
79
+		return nil, err
80
+	}
81
+	return items, nil
82
+}
83
+
84
+const removeCollab = `-- name: RemoveCollab :exec
85
+DELETE FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2
86
+`
87
+
88
+type RemoveCollabParams struct {
89
+	RepoID int64
90
+	UserID int64
91
+}
92
+
93
+func (q *Queries) RemoveCollab(ctx context.Context, db DBTX, arg RemoveCollabParams) error {
94
+	_, err := db.Exec(ctx, removeCollab, arg.RepoID, arg.UserID)
95
+	return err
96
+}
97
+
98
+const upsertCollabRole = `-- name: UpsertCollabRole :exec
99
+INSERT INTO repo_collaborators (repo_id, user_id, role, added_by_user_id)
100
+VALUES ($1, $2, $3, $4::bigint)
101
+ON CONFLICT (repo_id, user_id)
102
+DO UPDATE SET role = EXCLUDED.role,
103
+              added_by_user_id = EXCLUDED.added_by_user_id
104
+`
105
+
106
+type UpsertCollabRoleParams struct {
107
+	RepoID        int64
108
+	UserID        int64
109
+	Role          CollabRole
110
+	AddedByUserID pgtype.Int8
111
+}
112
+
113
+// Insert or upgrade a collaborator's role. added_by_user_id records who
114
+// granted the role for the audit trail.
115
+func (q *Queries) UpsertCollabRole(ctx context.Context, db DBTX, arg UpsertCollabRoleParams) error {
116
+	_, err := db.Exec(ctx, upsertCollabRole,
117
+		arg.RepoID,
118
+		arg.UserID,
119
+		arg.Role,
120
+		arg.AddedByUserID,
121
+	)
122
+	return err
123
+}
internal/meta/sqlc/models.gomodified
@@ -12,6 +12,51 @@ import (
1212
 	"github.com/jackc/pgx/v5/pgtype"
1313
 )
1414
15
+type CollabRole string
16
+
17
+const (
18
+	CollabRoleRead     CollabRole = "read"
19
+	CollabRoleTriage   CollabRole = "triage"
20
+	CollabRoleWrite    CollabRole = "write"
21
+	CollabRoleMaintain CollabRole = "maintain"
22
+	CollabRoleAdmin    CollabRole = "admin"
23
+)
24
+
25
+func (e *CollabRole) Scan(src interface{}) error {
26
+	switch s := src.(type) {
27
+	case []byte:
28
+		*e = CollabRole(s)
29
+	case string:
30
+		*e = CollabRole(s)
31
+	default:
32
+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)
33
+	}
34
+	return nil
35
+}
36
+
37
+type NullCollabRole struct {
38
+	CollabRole CollabRole
39
+	Valid      bool // Valid is true if CollabRole is not NULL
40
+}
41
+
42
+// Scan implements the Scanner interface.
43
+func (ns *NullCollabRole) Scan(value interface{}) error {
44
+	if value == nil {
45
+		ns.CollabRole, ns.Valid = "", false
46
+		return nil
47
+	}
48
+	ns.Valid = true
49
+	return ns.CollabRole.Scan(value)
50
+}
51
+
52
+// Value implements the driver Valuer interface.
53
+func (ns NullCollabRole) Value() (driver.Value, error) {
54
+	if !ns.Valid {
55
+		return nil, nil
56
+	}
57
+	return string(ns.CollabRole), nil
58
+}
59
+
1560
 type RepoVisibility string
1661
1762
 const (
@@ -146,6 +191,14 @@ type Repo struct {
146191
 	DefaultBranchOid pgtype.Text
147192
 }
148193
194
+type RepoCollaborator struct {
195
+	RepoID        int64
196
+	UserID        int64
197
+	Role          CollabRole
198
+	AddedAt       pgtype.Timestamptz
199
+	AddedByUserID pgtype.Int8
200
+}
201
+
149202
 type User struct {
150203
 	ID                int64
151204
 	Username          string
internal/migrationsfs/migrations/0019_repo_collaborators.sqladded
@@ -0,0 +1,37 @@
1
+-- SPDX-License-Identifier: AGPL-3.0-or-later
2
+--
3
+-- repo_collaborators stores per-(repo, user) role grants beyond the
4
+-- owner. The five roles mirror GitHub's:
5
+--
6
+--   read     — clone/fetch a private repo, view issues/pulls
7
+--   triage   — read + manage issue state (close, label, assign)
8
+--   write    — triage + push, branch create, PR create
9
+--   maintain — write + most settings except dangerous ones
10
+--   admin    — maintain + delete/transfer/visibility
11
+--
12
+-- The owner is implicit (effectively `admin` for the purposes of policy)
13
+-- and is not stored here; the owner column on `repos` is the source of
14
+-- truth. A row in this table for the owner would be redundant.
15
+--
16
+-- Org-team grants live in a separate table (S31). The policy package
17
+-- merges both sources when evaluating an action.
18
+
19
+-- +goose Up
20
+CREATE TYPE collab_role AS ENUM ('read', 'triage', 'write', 'maintain', 'admin');
21
+
22
+CREATE TABLE repo_collaborators (
23
+    repo_id           bigint      NOT NULL REFERENCES repos(id) ON DELETE CASCADE,
24
+    user_id           bigint      NOT NULL REFERENCES users(id) ON DELETE CASCADE,
25
+    role              collab_role NOT NULL,
26
+    added_at          timestamptz NOT NULL DEFAULT now(),
27
+    added_by_user_id  bigint      REFERENCES users(id) ON DELETE SET NULL,
28
+
29
+    PRIMARY KEY (repo_id, user_id)
30
+);
31
+
32
+CREATE INDEX repo_collaborators_user_id_idx ON repo_collaborators (user_id);
33
+CREATE INDEX repo_collaborators_repo_id_idx ON repo_collaborators (repo_id);
34
+
35
+-- +goose Down
36
+DROP TABLE IF EXISTS repo_collaborators;
37
+DROP TYPE IF EXISTS collab_role;
internal/repos/sqlc/models.gomodified
@@ -12,6 +12,51 @@ import (
1212
 	"github.com/jackc/pgx/v5/pgtype"
1313
 )
1414
15
+type CollabRole string
16
+
17
+const (
18
+	CollabRoleRead     CollabRole = "read"
19
+	CollabRoleTriage   CollabRole = "triage"
20
+	CollabRoleWrite    CollabRole = "write"
21
+	CollabRoleMaintain CollabRole = "maintain"
22
+	CollabRoleAdmin    CollabRole = "admin"
23
+)
24
+
25
+func (e *CollabRole) Scan(src interface{}) error {
26
+	switch s := src.(type) {
27
+	case []byte:
28
+		*e = CollabRole(s)
29
+	case string:
30
+		*e = CollabRole(s)
31
+	default:
32
+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)
33
+	}
34
+	return nil
35
+}
36
+
37
+type NullCollabRole struct {
38
+	CollabRole CollabRole
39
+	Valid      bool // Valid is true if CollabRole is not NULL
40
+}
41
+
42
+// Scan implements the Scanner interface.
43
+func (ns *NullCollabRole) Scan(value interface{}) error {
44
+	if value == nil {
45
+		ns.CollabRole, ns.Valid = "", false
46
+		return nil
47
+	}
48
+	ns.Valid = true
49
+	return ns.CollabRole.Scan(value)
50
+}
51
+
52
+// Value implements the driver Valuer interface.
53
+func (ns NullCollabRole) Value() (driver.Value, error) {
54
+	if !ns.Valid {
55
+		return nil, nil
56
+	}
57
+	return string(ns.CollabRole), nil
58
+}
59
+
1560
 type RepoVisibility string
1661
1762
 const (
@@ -146,6 +191,14 @@ type Repo struct {
146191
 	DefaultBranchOid pgtype.Text
147192
 }
148193
194
+type RepoCollaborator struct {
195
+	RepoID        int64
196
+	UserID        int64
197
+	Role          CollabRole
198
+	AddedAt       pgtype.Timestamptz
199
+	AddedByUserID pgtype.Int8
200
+}
201
+
149202
 type User struct {
150203
 	ID                int64
151204
 	Username          string
internal/users/sqlc/models.gomodified
@@ -12,6 +12,51 @@ import (
1212
 	"github.com/jackc/pgx/v5/pgtype"
1313
 )
1414
15
+type CollabRole string
16
+
17
+const (
18
+	CollabRoleRead     CollabRole = "read"
19
+	CollabRoleTriage   CollabRole = "triage"
20
+	CollabRoleWrite    CollabRole = "write"
21
+	CollabRoleMaintain CollabRole = "maintain"
22
+	CollabRoleAdmin    CollabRole = "admin"
23
+)
24
+
25
+func (e *CollabRole) Scan(src interface{}) error {
26
+	switch s := src.(type) {
27
+	case []byte:
28
+		*e = CollabRole(s)
29
+	case string:
30
+		*e = CollabRole(s)
31
+	default:
32
+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)
33
+	}
34
+	return nil
35
+}
36
+
37
+type NullCollabRole struct {
38
+	CollabRole CollabRole
39
+	Valid      bool // Valid is true if CollabRole is not NULL
40
+}
41
+
42
+// Scan implements the Scanner interface.
43
+func (ns *NullCollabRole) Scan(value interface{}) error {
44
+	if value == nil {
45
+		ns.CollabRole, ns.Valid = "", false
46
+		return nil
47
+	}
48
+	ns.Valid = true
49
+	return ns.CollabRole.Scan(value)
50
+}
51
+
52
+// Value implements the driver Valuer interface.
53
+func (ns NullCollabRole) Value() (driver.Value, error) {
54
+	if !ns.Valid {
55
+		return nil, nil
56
+	}
57
+	return string(ns.CollabRole), nil
58
+}
59
+
1560
 type RepoVisibility string
1661
1762
 const (
@@ -146,6 +191,14 @@ type Repo struct {
146191
 	DefaultBranchOid pgtype.Text
147192
 }
148193
194
+type RepoCollaborator struct {
195
+	RepoID        int64
196
+	UserID        int64
197
+	Role          CollabRole
198
+	AddedAt       pgtype.Timestamptz
199
+	AddedByUserID pgtype.Int8
200
+}
201
+
149202
 type User struct {
150203
 	ID                int64
151204
 	Username          string
internal/worker/sqlc/models.gomodified
@@ -12,6 +12,51 @@ import (
1212
 	"github.com/jackc/pgx/v5/pgtype"
1313
 )
1414
15
+type CollabRole string
16
+
17
+const (
18
+	CollabRoleRead     CollabRole = "read"
19
+	CollabRoleTriage   CollabRole = "triage"
20
+	CollabRoleWrite    CollabRole = "write"
21
+	CollabRoleMaintain CollabRole = "maintain"
22
+	CollabRoleAdmin    CollabRole = "admin"
23
+)
24
+
25
+func (e *CollabRole) Scan(src interface{}) error {
26
+	switch s := src.(type) {
27
+	case []byte:
28
+		*e = CollabRole(s)
29
+	case string:
30
+		*e = CollabRole(s)
31
+	default:
32
+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)
33
+	}
34
+	return nil
35
+}
36
+
37
+type NullCollabRole struct {
38
+	CollabRole CollabRole
39
+	Valid      bool // Valid is true if CollabRole is not NULL
40
+}
41
+
42
+// Scan implements the Scanner interface.
43
+func (ns *NullCollabRole) Scan(value interface{}) error {
44
+	if value == nil {
45
+		ns.CollabRole, ns.Valid = "", false
46
+		return nil
47
+	}
48
+	ns.Valid = true
49
+	return ns.CollabRole.Scan(value)
50
+}
51
+
52
+// Value implements the driver Valuer interface.
53
+func (ns NullCollabRole) Value() (driver.Value, error) {
54
+	if !ns.Valid {
55
+		return nil, nil
56
+	}
57
+	return string(ns.CollabRole), nil
58
+}
59
+
1560
 type RepoVisibility string
1661
1762
 const (
@@ -146,6 +191,14 @@ type Repo struct {
146191
 	DefaultBranchOid pgtype.Text
147192
 }
148193
194
+type RepoCollaborator struct {
195
+	RepoID        int64
196
+	UserID        int64
197
+	Role          CollabRole
198
+	AddedAt       pgtype.Timestamptz
199
+	AddedByUserID pgtype.Int8
200
+}
201
+
149202
 type User struct {
150203
 	ID                int64
151204
 	Username          string
sqlc.yamlmodified
@@ -50,6 +50,22 @@ sql:
5050
         emit_empty_slices: true
5151
         emit_methods_with_db_argument: true
5252
53
+  - engine: postgresql
54
+    schema: internal/migrationsfs/migrations
55
+    queries: internal/auth/policy/queries
56
+    gen:
57
+      go:
58
+        package: policydb
59
+        out: internal/auth/policy/sqlc
60
+        sql_package: pgx/v5
61
+        emit_json_tags: false
62
+        emit_pointers_for_null_types: false
63
+        emit_prepared_queries: false
64
+        emit_interface: true
65
+        emit_exact_table_names: false
66
+        emit_empty_slices: true
67
+        emit_methods_with_db_argument: true
68
+
5369
   - engine: postgresql
5470
     schema: internal/migrationsfs/migrations
5571
     queries: internal/worker/queries