cb06060
use uuid::Uuid;
use crate::context::facade::GitContext;
use crate::service::GitService;
use crate::share::errors::GitError;
/// Per-repo authorization — the central ACL that was previously only on
/// the SSH path (`ssh/handler/command.rs::authorize_repo`) and missing
/// from every HTTP/LFS path. Centralized so HTTP, SSH, and the LFS router
/// enforce identical membership rules.
///
/// Rules:
/// - space owner of the repo's owning space: always allowed
/// - read on public repo: allowed
/// - read on private repo: requires `repo_collaborations` row
/// - write: requires `repo_collaborations.mode ∈ {Write, Admin}`
/// - admin: requires `repo_collaborations.mode == Admin`
pub async fn authorize_repo_access(
svc: &GitService,
uid: i64,
ctx: &GitContext,
want_write: bool,
require_admin: bool,
) -> Result<(), GitError> {
let owner = find_space_for_repo(svc, &ctx.model).await?;
let capability = if require_admin {
space::Capability::RepositoryAdmin {
repository: ctx.model.id,
}
} else if want_write {
space::Capability::RepositoryWrite {
repository: ctx.model.id,
}
} else {
space::Capability::RepositoryRead {
repository: ctx.model.id,
private: ctx.model.is_private,
}
};
Ok(space::require(&owner, uid, capability).await?)
}
async fn find_space_for_repo(
service: &GitService,
repo: &models::repo::repos::Model,
) -> Result<space::Space, GitError> {
space_for_dir(&service.access, repo.dir_id)
.await?
.ok_or_else(|| GitError::Internal(format!("space for repo {} not found", repo.id)))
}
pub async fn space_for_dir(
access: &space::Access,
dir_id: Uuid,
) -> Result<Option<space::Space>, GitError> {
Ok(access.for_dir(dir_id).await?)
}