194c44c
use std::collections::HashSet;
use std::sync::{OnceLock, RwLock};
static SYSTEM_UID: OnceLock<i64> = OnceLock::new();
static SPACE_BOTS: OnceLock<RwLock<HashSet<i64>>> = OnceLock::new();
/// Register the platform system actor (AI bot) that MCP internal keys act as.
/// Once set, every authorization check treats this uid as the owner of every
/// space and repository. The account is a bot with login prohibited, so it can
/// only ever be reached through the internal MCP key path.
pub fn set_system_uid(uid: i64) {
let _ = SYSTEM_UID.set(uid);
}
/// Register a per-space bot that just signed a scoped top-level credential.
/// Like [`set_system_uid`], registered bots pass every owner-level check; the
/// credential layer is responsible for binding them to a single space (MCP
/// tool dispatch and the Git HTTP auth entry points both enforce the bind).
/// Space bots have no password, no sessions and no access keys, so this uid
/// can only be reached with the token that registered it.
pub fn register_space_bot(uid: i64) {
let bots = SPACE_BOTS.get_or_init(|| RwLock::new(HashSet::new()));
if let Ok(mut bots) = bots.write() {
bots.insert(uid);
}
}
pub fn system_uid() -> Option<i64> {
SYSTEM_UID.get().copied()
}
pub fn is_system_uid(uid: i64) -> bool {
if SYSTEM_UID.get().is_some_and(|value| *value == uid) {
return true;
}
SPACE_BOTS
.get()
.and_then(|bots| bots.read().ok().map(|bots| bots.contains(&uid)))
.unwrap_or(false)
}