1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase
4
5import (
6 "fmt"
7
8 "bnema.dev/ermite/internal/domain"
9)
10
11// canRead is the access rule for reading a repository, the single place that
12// decides it: root reads everything, anyone reads a public repository, and a
13// stored token reads a private one only with repo:read on it (the scope, and
14// the repository within its list). Callers answer domain.ErrNotFound when it
15// is false, so a private repository never shows itself.
16func canRead(p domain.Principal, repo domain.Repo) bool {
17 return canReadAs(p, repo.Name, repo.Visibility)
18}
19
20// canReadAs is canRead for a repository known by its name and visibility only,
21// such as one that no longer exists.
22func canReadAs(p domain.Principal, name domain.RepoName, vis domain.Visibility) bool {
23 if vis == domain.VisibilityPublic {
24 return true
25 }
26 return p.Allows(domain.ScopeRepoRead, name)
27}
28
29// adminAccess is the access rule for changing or deleting a repository:
30// repo:admin on it, and no branch prefixes. A token limited to some branches
31// may not delete the repository (that deletes every branch, those outside its
32// prefixes included), nor change its default branch, visibility, description,
33// merge modes or failing-checks rule: these decide what happens to branches the
34// token may not write. A caller that may not administer it learns nothing it
35// could not already read: not found when it cannot see the repository,
36// unauthenticated when it is anonymous, forbidden otherwise.
37func adminAccess(p domain.Principal, repo domain.Repo) error {
38 switch {
39 case canAdmin(p, repo.Name) && p.IsBranchLimited():
40 return fmt.Errorf("%w: a token limited to branch prefixes may not administer a repository", domain.ErrForbidden)
41 case canAdmin(p, repo.Name):
42 return nil
43 case !canRead(p, repo):
44 return domain.ErrNotFound
45 case p.IsAnonymous():
46 return domain.ErrUnauthenticated
47 }
48 return domain.ErrForbidden
49}
50
51// canWrite is the access rule for pushing to a repository: repo:write on it.
52func canWrite(p domain.Principal, name domain.RepoName) bool {
53 return p.Allows(domain.ScopeRepoWrite, name)
54}
55
56// canCreateRepo is the access rule for creating a repository, by the API or on
57// first push: repo:write on the name, and no branch prefixes. A token limited
58// to some branches may push to a repository that exists; it never makes one.
59func canCreateRepo(p domain.Principal, name domain.RepoName) bool {
60 return canWrite(p, name) && !p.IsBranchLimited()
61}
62
63// canManageTokens is the access rule for creating, listing and revoking
64// stored tokens: token:admin, which root holds.
65func canManageTokens(p domain.Principal) bool {
66 return p.HasScope(domain.ScopeTokenAdmin)
67}
68
69// canAdmin is the access rule for deleting a repository and changing its
70// visibility, description or default branch: repo:admin on it.
71func canAdmin(p domain.Principal, name domain.RepoName) bool {
72 return p.Allows(domain.ScopeRepoAdmin, name)
73}
74
75// scopeAccess is the access rule for an action that needs a scope on a
76// repository the caller can already read, such as mr:write or mr:merge:
77// unauthenticated for an anonymous caller, forbidden for one without the scope
78// on this repository.
79func scopeAccess(p domain.Principal, repo domain.Repo, scope domain.Scope) error {
80 switch {
81 case p.Allows(scope, repo.Name):
82 return nil
83 case p.IsAnonymous():
84 return domain.ErrUnauthenticated
85 }
86 return fmt.Errorf("%w: this needs the %s scope on %s", domain.ErrForbidden, scope, repo.Name)
87}
88
89// authorOf names who acts, for the author of a merge request or a comment: the
90// label of the token, "root" for the root token, "owner" for the owner signed
91// in on the web and for any other caller without a label.
92func authorOf(p domain.Principal) string {
93 switch {
94 case p.IsOwner():
95 return "owner"
96 case p.IsRoot():
97 return "root"
98 case p.TokenLabel() != "":
99 return p.TokenLabel()
100 }
101 return "owner"
102}