alice.pds.demo.boltless.dev
This repository has no description
1package rbac
2
3import (
4 "fmt"
5 "slices"
6 "strings"
7
8 "github.com/bluesky-social/indigo/atproto/syntax"
9 "tangled.org/core/api/tangled"
10)
11
12// SetRepoOwner sets owner to given repo
13func (e *Enforcer) SetRepoOwner(owner syntax.DID, repo syntax.DID) error {
14 return e.setRoleForUser(owner.String(), "repo:owner", repo.String())
15}
16
17// DeleteRepo deletes all role assignments scoped to the repo.
18func (e *Enforcer) DeleteRepo(repo syntax.DID) error {
19 if repo == "" {
20 // casbin treats an empty field value as match-anything. so just in case.
21 return fmt.Errorf("DeleteRepo: empty repo did")
22 }
23 _, err := e.e.RemoveFilteredGroupingPolicy(2, repo.String())
24 return err
25}
26
27// AddRepoCollaborator adds new collaborator to the repo
28func (e *Enforcer) AddRepoCollaborator(user syntax.DID, repo syntax.DID) error {
29 _, err := e.e.AddRoleForUser(user.String(), "repo:collaborator", repo.String())
30 return err
31}
32
33// RemoveRepoCollaborator removes the collaborator from the repo.
34// This won't remove inherited roles like repository owner.
35func (e *Enforcer) RemoveRepoCollaborator(user syntax.DID, repo syntax.DID) error {
36 _, err := e.e.DeleteRoleForUser(user.String(), "repo:collaborator", repo.String())
37 return err
38}
39
40func (e *Enforcer) GetRepoCollaborators(repo syntax.DID) ([]syntax.DID, error) {
41 var collaborators []syntax.DID
42 members, err := e.e.GetImplicitUsersForRole("repo:collaborator", repo.String())
43 if err != nil {
44 return nil, err
45 }
46 for _, m := range members {
47 if !strings.HasPrefix(m, "did:") { // skip non-user subjects like 'repo:owner'
48 continue
49 }
50 collaborators = append(collaborators, syntax.DID(m))
51 }
52
53 slices.Sort(collaborators)
54 return slices.Compact(collaborators), nil
55}
56
57func (e *Enforcer) IsRepoOwner(user syntax.DID, repo syntax.DID) (bool, error) {
58 return e.e.HasRoleForUser(user.String(), "repo:owner", repo.String())
59}
60
61func (e *Enforcer) IsRepoCollaborator(user syntax.DID, repo syntax.DID) (bool, error) {
62 return e.hasImplicitRoleForUser(user.String(), "repo:collaborator", repo.String())
63}
64
65func (e *Enforcer) IsRepoSecretsAllowed(user syntax.DID, repo syntax.DID) (bool, error) {
66 return e.e.Enforce(user.String(), repo.String(), TnglSpindle, tangled.RepoAddSecretNSID)
67}
68
69func (e *Enforcer) IsRepoCiTriggerAllowed(user syntax.DID, repo syntax.DID) (bool, error) {
70 return e.e.Enforce(user.String(), repo.String(), TnglSpindle, tangled.CiTriggerPipelineNSID)
71}