a432091191
Server-side foundation for Phase-2 groups (no group-owned resources yet):
Shared types:
- GroupId, Group; App gains group_id; AppRole::{precedence,max} for
folding the highest effective role across the membership chain.
Repos:
- group_repo: tree CRUD with reparent (ancestor-walk cycle guard under a
coarse instance-wide structural advisory lock; slug frozen; bumps
structure_version) and delete=RESTRICT (refuses non-empty groups).
- group_members_repo: per-(user, group) role grants, mirroring app_members.
Hierarchy-aware authz (§5.3):
- AuthzRepo gains effective_app_role / effective_group_role (default to
direct membership / none, so the ~18 existing test stubs are untouched);
the Postgres impl resolves each via one depth-bounded recursive CTE that
MAXes the app's own row with every ancestor group_members row.
- can(): the Member path now folds inherited group roles, so a group_admin
on any ancestor is implicitly app_admin beneath it. New Capability
variants InstanceCreateGroup / Group{Read,Write,Admin}; group caps carry
no app_id (bound API keys can't manage groups). 8 new unit tests.
Admin API:
- groups_api: group CRUD + reparent (admin at both source and destination
parent, §5.6) + per-group members, all capability-gated.
- apps: POST /apps takes an optional parent group (default root); app
responses carry group_id; my_role now reflects the effective role.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
1.2 KiB
Rust
32 lines
1.2 KiB
Rust
//! Groups: a GitLab-like, single-parent org tree ABOVE apps (Phase 2).
|
|
//!
|
|
//! Groups are a pure org / RBAC / UI container — they own no resources
|
|
//! (scripts/secrets stay app-owned). A `group_admin` on any ancestor is
|
|
//! implicitly app_admin on every app/subgroup beneath it; resolution
|
|
//! takes the highest effective role across the app's own membership and
|
|
//! all ancestor group memberships.
|
|
//!
|
|
//! See docs/design/groups-and-project-tool.md §5.
|
|
|
|
use chrono::{DateTime, Utc};
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
use crate::GroupId;
|
|
|
|
#[derive(Debug, Clone, Serialize, Deserialize)]
|
|
pub struct Group {
|
|
pub id: GroupId,
|
|
/// `None` for a root node. Single-parent keeps the tree acyclic.
|
|
pub parent_id: Option<GroupId>,
|
|
/// Instance-global identifier, frozen at creation (a rename/reparent
|
|
/// never rewrites it — the deployment key stays stable).
|
|
pub slug: String,
|
|
pub name: String,
|
|
pub description: Option<String>,
|
|
/// Per-subtree structure version, bumped on every structural mutation
|
|
/// (reparent/rename/delete). Not an authz input.
|
|
pub structure_version: i64,
|
|
pub created_at: DateTime<Utc>,
|
|
pub updated_at: DateTime<Utc>,
|
|
}
|