193336a8a6
§7 of the groups/project-tool design. A group node is now authoritatively managed by exactly one project-root; `pic apply --dir` claims, conflicts, takes over, and (with --prune) structurally reaps owned nodes. - Migration 0052: `projects(id, key UNIQUE)` + promote the inert `groups.owner_project` (0047) to a real FK (ON DELETE SET NULL) + index. - CLI mints a stable, gitignored project key in `.picloud/project.json` (`pic init`, or lazily on first tree plan/apply) and presents it on every tree request; `pic apply --dir --takeover` flag. - Server: prepare_tree resolves ownership read-only (plan surfaces conflicts + prune candidates; token folds each group's owner key). apply_tree upserts the project in-tx, claims created groups on insert, reconciles existing-group ownership under the per-node advisory lock (first-commit-wins), and prunes owned-but-undeclared groups leaf-first (delete=RESTRICT, never another repo's or a UI-owned node). - Authz (§7.4, ownership ⟂ RBAC): takeover requires GroupAdmin per contested node — enforced in authz_tree (pre-tx) AND re-verified in-tx at the ownership decision, so --force (which waives the staleness token) can't open a takeover-without-admin window. The attacker-supplied project key is length/charset-validated server-side. - Tests: tests/ownership.rs (claim → conflict → takeover → flip; non-admin takeover → 403; prune-owned-only); format_conflicts unit test; schema golden reblessed. tree_shape M2 journey updated to reparent in-place (a fresh dir is now a distinct project and would correctly conflict). Closes the M3 milestone; reviewed (4 findings: 1 authz-bypass via --force + key validation + 2 LOW, all fixed). M4 (trigger/route templates) remains. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
1.5 KiB
TOML
51 lines
1.5 KiB
TOML
[package]
|
|
name = "picloud-cli"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
authors.workspace = true
|
|
description = "PiCloud command-line client"
|
|
# Each top-level `tests/*.rs` would otherwise auto-discover as its own
|
|
# test binary, respawning picloud once per file. We want one binary
|
|
# with module sub-files (auth.rs, apps.rs, …) so the LazyLock fixture
|
|
# is genuinely shared.
|
|
autotests = false
|
|
|
|
[[bin]]
|
|
name = "pic"
|
|
path = "src/main.rs"
|
|
|
|
[[test]]
|
|
name = "cli"
|
|
path = "tests/cli.rs"
|
|
|
|
[dependencies]
|
|
picloud-shared.workspace = true
|
|
reqwest = { workspace = true, features = ["json"] }
|
|
percent-encoding.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
|
|
chrono = { workspace = true }
|
|
clap = { version = "4", features = ["derive"] }
|
|
toml = "0.8"
|
|
directories = "5"
|
|
rpassword = "7"
|
|
anyhow = "1"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = "2"
|
|
predicates = "3"
|
|
tempfile = "3"
|
|
reqwest = { workspace = true, features = ["json", "blocking"] }
|
|
libc = "0.2"
|
|
# Synchronous Postgres driver used by the dead-letters integration test
|
|
# to inject a row the replay path can act on. Smaller compile cost than
|
|
# pulling sqlx into the CLI tree, and the existing tests are
|
|
# blocking-style anyway.
|
|
postgres = { version = "0.19", features = ["with-uuid-1", "with-serde_json-1"] }
|
|
uuid = { version = "1", features = ["v4"] }
|