tenseleyflow/shithub / e4425c9

+-- SPDX-License-Identifier: AGPL-3.0-or-later

+--

+-- Query surface for the policy package. The policy code reads roles to

+-- decide; admin/settings UIs (S32) write through these as well.

+

+-- name: GetCollabRole :one

+-- Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows

+-- when the user is not a collaborator on this repo.

+SELECT role FROM repo_collaborators

+WHERE repo_id = $1 AND user_id = $2;

+

+-- name: UpsertCollabRole :exec

+-- Insert or upgrade a collaborator's role. added_by_user_id records who

+-- granted the role for the audit trail.

+INSERT INTO repo_collaborators (repo_id, user_id, role, added_by_user_id)

+VALUES ($1, $2, $3, sqlc.narg(added_by_user_id)::bigint)

+ON CONFLICT (repo_id, user_id)

+DO UPDATE SET role = EXCLUDED.role,

+              added_by_user_id = EXCLUDED.added_by_user_id;

+

+-- name: RemoveCollab :exec

+DELETE FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2;

+

+-- name: ListCollabs :many

+-- Used by the repo settings page (S32) and tests.

+SELECT rc.repo_id, rc.user_id, rc.role, rc.added_at,

+       u.username AS username, u.display_name AS display_name

+FROM repo_collaborators rc

+JOIN users u ON u.id = rc.user_id

+WHERE rc.repo_id = $1

+ORDER BY rc.added_at DESC;

+// Code generated by sqlc. DO NOT EDIT.

+// versions:

+//   sqlc v1.31.1

+

+package policydb

+

+import (

+	"context"

+

+	"github.com/jackc/pgx/v5"

+	"github.com/jackc/pgx/v5/pgconn"

+)

+

+type DBTX interface {

+	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)

+	Query(context.Context, string, ...interface{}) (pgx.Rows, error)

+	QueryRow(context.Context, string, ...interface{}) pgx.Row

+}

+

+func New() *Queries {

+	return &Queries{}

+}

+

+type Queries struct {

+}

+package policydb

+type CollabRole string

+

+const (

+	CollabRoleRead     CollabRole = "read"

+	CollabRoleTriage   CollabRole = "triage"

+	CollabRoleWrite    CollabRole = "write"

+	CollabRoleMaintain CollabRole = "maintain"

+	CollabRoleAdmin    CollabRole = "admin"

+)

+

+func (e *CollabRole) Scan(src interface{}) error {

+	switch s := src.(type) {

+	case []byte:

+		*e = CollabRole(s)

+	case string:

+		*e = CollabRole(s)

+	default:

+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)

+	}

+	return nil

+}

+

+type NullCollabRole struct {

+	CollabRole CollabRole

+	Valid      bool // Valid is true if CollabRole is not NULL

+}

+

+// Scan implements the Scanner interface.

+func (ns *NullCollabRole) Scan(value interface{}) error {

+	if value == nil {

+		ns.CollabRole, ns.Valid = "", false

+		return nil

+	}

+	ns.Valid = true

+	return ns.CollabRole.Scan(value)

+}

+

+// Value implements the driver Valuer interface.

+func (ns NullCollabRole) Value() (driver.Value, error) {

+	if !ns.Valid {

+		return nil, nil

+	}

+	return string(ns.CollabRole), nil

+}

+

+type RepoCollaborator struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedAt       pgtype.Timestamptz

+	AddedByUserID pgtype.Int8

+}

+

+// Code generated by sqlc. DO NOT EDIT.

+// versions:

+//   sqlc v1.31.1

+

+package policydb

+

+import (

+	"context"

+)

+

+type Querier interface {

+	// SPDX-License-Identifier: AGPL-3.0-or-later

+	//

+	// Query surface for the policy package. The policy code reads roles to

+	// decide; admin/settings UIs (S32) write through these as well.

+	// Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows

+	// when the user is not a collaborator on this repo.

+	GetCollabRole(ctx context.Context, db DBTX, arg GetCollabRoleParams) (CollabRole, error)

+	// Used by the repo settings page (S32) and tests.

+	ListCollabs(ctx context.Context, db DBTX, repoID int64) ([]ListCollabsRow, error)

+	RemoveCollab(ctx context.Context, db DBTX, arg RemoveCollabParams) error

+	// Insert or upgrade a collaborator's role. added_by_user_id records who

+	// granted the role for the audit trail.

+	UpsertCollabRole(ctx context.Context, db DBTX, arg UpsertCollabRoleParams) error

+}

+

+var _ Querier = (*Queries)(nil)

+// Code generated by sqlc. DO NOT EDIT.

+// versions:

+//   sqlc v1.31.1

+// source: repo_collaborators.sql

+

+package policydb

+

+import (

+	"context"

+

+	"github.com/jackc/pgx/v5/pgtype"

+)

+

+const getCollabRole = `-- name: GetCollabRole :one

+

+SELECT role FROM repo_collaborators

+WHERE repo_id = $1 AND user_id = $2

+`

+

+type GetCollabRoleParams struct {

+	RepoID int64

+	UserID int64

+}

+

+// SPDX-License-Identifier: AGPL-3.0-or-later

+//

+// Query surface for the policy package. The policy code reads roles to

+// decide; admin/settings UIs (S32) write through these as well.

+// Returns the collaborator role for (repo_id, user_id), or pgx.ErrNoRows

+// when the user is not a collaborator on this repo.

+func (q *Queries) GetCollabRole(ctx context.Context, db DBTX, arg GetCollabRoleParams) (CollabRole, error) {

+	row := db.QueryRow(ctx, getCollabRole, arg.RepoID, arg.UserID)

+	var role CollabRole

+	err := row.Scan(&role)

+	return role, err

+}

+

+const listCollabs = `-- name: ListCollabs :many

+SELECT rc.repo_id, rc.user_id, rc.role, rc.added_at,

+       u.username AS username, u.display_name AS display_name

+FROM repo_collaborators rc

+JOIN users u ON u.id = rc.user_id

+WHERE rc.repo_id = $1

+ORDER BY rc.added_at DESC

+`

+

+type ListCollabsRow struct {

+	RepoID      int64

+	UserID      int64

+	Role        CollabRole

+	AddedAt     pgtype.Timestamptz

+	Username    string

+	DisplayName string

+}

+

+// Used by the repo settings page (S32) and tests.

+func (q *Queries) ListCollabs(ctx context.Context, db DBTX, repoID int64) ([]ListCollabsRow, error) {

+	rows, err := db.Query(ctx, listCollabs, repoID)

+	if err != nil {

+		return nil, err

+	}

+	defer rows.Close()

+	items := []ListCollabsRow{}

+	for rows.Next() {

+		var i ListCollabsRow

+		if err := rows.Scan(

+			&i.RepoID,

+			&i.UserID,

+			&i.Role,

+			&i.AddedAt,

+			&i.Username,

+			&i.DisplayName,

+		); err != nil {

+			return nil, err

+		}

+		items = append(items, i)

+	}

+	if err := rows.Err(); err != nil {

+		return nil, err

+	}

+	return items, nil

+}

+

+const removeCollab = `-- name: RemoveCollab :exec

+DELETE FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2

+`

+

+type RemoveCollabParams struct {

+	RepoID int64

+	UserID int64

+}

+

+func (q *Queries) RemoveCollab(ctx context.Context, db DBTX, arg RemoveCollabParams) error {

+	_, err := db.Exec(ctx, removeCollab, arg.RepoID, arg.UserID)

+	return err

+}

+

+const upsertCollabRole = `-- name: UpsertCollabRole :exec

+INSERT INTO repo_collaborators (repo_id, user_id, role, added_by_user_id)

+VALUES ($1, $2, $3, $4::bigint)

+ON CONFLICT (repo_id, user_id)

+DO UPDATE SET role = EXCLUDED.role,

+              added_by_user_id = EXCLUDED.added_by_user_id

+`

+

+type UpsertCollabRoleParams struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedByUserID pgtype.Int8

+}

+

+// Insert or upgrade a collaborator's role. added_by_user_id records who

+// granted the role for the audit trail.

+func (q *Queries) UpsertCollabRole(ctx context.Context, db DBTX, arg UpsertCollabRoleParams) error {

+	_, err := db.Exec(ctx, upsertCollabRole,

+		arg.RepoID,

+		arg.UserID,

+		arg.Role,

+		arg.AddedByUserID,

+	)

+	return err

+}

+type CollabRole string

+

+const (

+	CollabRoleRead     CollabRole = "read"

+	CollabRoleTriage   CollabRole = "triage"

+	CollabRoleWrite    CollabRole = "write"

+	CollabRoleMaintain CollabRole = "maintain"

+	CollabRoleAdmin    CollabRole = "admin"

+)

+

+func (e *CollabRole) Scan(src interface{}) error {

+	switch s := src.(type) {

+	case []byte:

+		*e = CollabRole(s)

+	case string:

+		*e = CollabRole(s)

+	default:

+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)

+	}

+	return nil

+}

+

+type NullCollabRole struct {

+	CollabRole CollabRole

+	Valid      bool // Valid is true if CollabRole is not NULL

+}

+

+// Scan implements the Scanner interface.

+func (ns *NullCollabRole) Scan(value interface{}) error {

+	if value == nil {

+		ns.CollabRole, ns.Valid = "", false

+		return nil

+	}

+	ns.Valid = true

+	return ns.CollabRole.Scan(value)

+}

+

+// Value implements the driver Valuer interface.

+func (ns NullCollabRole) Value() (driver.Value, error) {

+	if !ns.Valid {

+		return nil, nil

+	}

+	return string(ns.CollabRole), nil

+}

+

+type RepoCollaborator struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedAt       pgtype.Timestamptz

+	AddedByUserID pgtype.Int8

+}

+

+-- SPDX-License-Identifier: AGPL-3.0-or-later

+--

+-- repo_collaborators stores per-(repo, user) role grants beyond the

+-- owner. The five roles mirror GitHub's:

+--

+--   read     — clone/fetch a private repo, view issues/pulls

+--   triage   — read + manage issue state (close, label, assign)

+--   write    — triage + push, branch create, PR create

+--   maintain — write + most settings except dangerous ones

+--   admin    — maintain + delete/transfer/visibility

+--

+-- The owner is implicit (effectively `admin` for the purposes of policy)

+-- and is not stored here; the owner column on `repos` is the source of

+-- truth. A row in this table for the owner would be redundant.

+--

+-- Org-team grants live in a separate table (S31). The policy package

+-- merges both sources when evaluating an action.

+

+-- +goose Up

+CREATE TYPE collab_role AS ENUM ('read', 'triage', 'write', 'maintain', 'admin');

+

+CREATE TABLE repo_collaborators (

+    repo_id           bigint      NOT NULL REFERENCES repos(id) ON DELETE CASCADE,

+    user_id           bigint      NOT NULL REFERENCES users(id) ON DELETE CASCADE,

+    role              collab_role NOT NULL,

+    added_at          timestamptz NOT NULL DEFAULT now(),

+    added_by_user_id  bigint      REFERENCES users(id) ON DELETE SET NULL,

+

+    PRIMARY KEY (repo_id, user_id)

+);

+

+CREATE INDEX repo_collaborators_user_id_idx ON repo_collaborators (user_id);

+CREATE INDEX repo_collaborators_repo_id_idx ON repo_collaborators (repo_id);

+

+-- +goose Down

+DROP TABLE IF EXISTS repo_collaborators;

+DROP TYPE IF EXISTS collab_role;

+type CollabRole string

+

+const (

+	CollabRoleRead     CollabRole = "read"

+	CollabRoleTriage   CollabRole = "triage"

+	CollabRoleWrite    CollabRole = "write"

+	CollabRoleMaintain CollabRole = "maintain"

+	CollabRoleAdmin    CollabRole = "admin"

+)

+

+func (e *CollabRole) Scan(src interface{}) error {

+	switch s := src.(type) {

+	case []byte:

+		*e = CollabRole(s)

+	case string:

+		*e = CollabRole(s)

+	default:

+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)

+	}

+	return nil

+}

+

+type NullCollabRole struct {

+	CollabRole CollabRole

+	Valid      bool // Valid is true if CollabRole is not NULL

+}

+

+// Scan implements the Scanner interface.

+func (ns *NullCollabRole) Scan(value interface{}) error {

+	if value == nil {

+		ns.CollabRole, ns.Valid = "", false

+		return nil

+	}

+	ns.Valid = true

+	return ns.CollabRole.Scan(value)

+}

+

+// Value implements the driver Valuer interface.

+func (ns NullCollabRole) Value() (driver.Value, error) {

+	if !ns.Valid {

+		return nil, nil

+	}

+	return string(ns.CollabRole), nil

+}

+

+type RepoCollaborator struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedAt       pgtype.Timestamptz

+	AddedByUserID pgtype.Int8

+}

+

+type CollabRole string

+

+const (

+	CollabRoleRead     CollabRole = "read"

+	CollabRoleTriage   CollabRole = "triage"

+	CollabRoleWrite    CollabRole = "write"

+	CollabRoleMaintain CollabRole = "maintain"

+	CollabRoleAdmin    CollabRole = "admin"

+)

+

+func (e *CollabRole) Scan(src interface{}) error {

+	switch s := src.(type) {

+	case []byte:

+		*e = CollabRole(s)

+	case string:

+		*e = CollabRole(s)

+	default:

+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)

+	}

+	return nil

+}

+

+type NullCollabRole struct {

+	CollabRole CollabRole

+	Valid      bool // Valid is true if CollabRole is not NULL

+}

+

+// Scan implements the Scanner interface.

+func (ns *NullCollabRole) Scan(value interface{}) error {

+	if value == nil {

+		ns.CollabRole, ns.Valid = "", false

+		return nil

+	}

+	ns.Valid = true

+	return ns.CollabRole.Scan(value)

+}

+

+// Value implements the driver Valuer interface.

+func (ns NullCollabRole) Value() (driver.Value, error) {

+	if !ns.Valid {

+		return nil, nil

+	}

+	return string(ns.CollabRole), nil

+}

+

+type RepoCollaborator struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedAt       pgtype.Timestamptz

+	AddedByUserID pgtype.Int8

+}

+

+type CollabRole string

+

+const (

+	CollabRoleRead     CollabRole = "read"

+	CollabRoleTriage   CollabRole = "triage"

+	CollabRoleWrite    CollabRole = "write"

+	CollabRoleMaintain CollabRole = "maintain"

+	CollabRoleAdmin    CollabRole = "admin"

+)

+

+func (e *CollabRole) Scan(src interface{}) error {

+	switch s := src.(type) {

+	case []byte:

+		*e = CollabRole(s)

+	case string:

+		*e = CollabRole(s)

+	default:

+		return fmt.Errorf("unsupported scan type for CollabRole: %T", src)

+	}

+	return nil

+}

+

+type NullCollabRole struct {

+	CollabRole CollabRole

+	Valid      bool // Valid is true if CollabRole is not NULL

+}

+

+// Scan implements the Scanner interface.

+func (ns *NullCollabRole) Scan(value interface{}) error {

+	if value == nil {

+		ns.CollabRole, ns.Valid = "", false

+		return nil

+	}

+	ns.Valid = true

+	return ns.CollabRole.Scan(value)

+}

+

+// Value implements the driver Valuer interface.

+func (ns NullCollabRole) Value() (driver.Value, error) {

+	if !ns.Valid {

+		return nil, nil

+	}

+	return string(ns.CollabRole), nil

+}

+

+type RepoCollaborator struct {

+	RepoID        int64

+	UserID        int64

+	Role          CollabRole

+	AddedAt       pgtype.Timestamptz

+	AddedByUserID pgtype.Int8

+}

+

+  - engine: postgresql

+    schema: internal/migrationsfs/migrations

+    queries: internal/auth/policy/queries

+    gen:

+      go:

+        package: policydb

+        out: internal/auth/policy/sqlc

+        sql_package: pgx/v5

+        emit_json_tags: false

+        emit_pointers_for_null_types: false

+        emit_prepared_queries: false

+        emit_interface: true

+        emit_exact_table_names: false

+        emit_empty_slices: true

+        emit_methods_with_db_argument: true

+