hanna/fabrica

feat: repository collaborators, plus settings/profile UI polish

0a5cbfd · hanna committed on 2026-07-25

Add collaborator management: store add/list/remove (portable upsert), a
Collaborators section on the repo Settings page (add by username with a
read/write/admin permission, remove), and a `repo collaborator add/rm/list`
CLI. Also tidy the avatar upload row (file input + Upload aligned) and move
the profile "Add" link button beside the last empty slot.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +63 −4

assets/fabrica.js +13 −5

crates/cli/src/repo_cmd.rs +137 −0

crates/store/src/lib.rs +1 −1

crates/store/src/repos.rs +79 −0

crates/store/src/tests.rs +75 −0

crates/web/src/lib.rs +8 −0

crates/web/src/pages.rs +7 −5

crates/web/src/repo.rs +143 −0

   margin-top: 0;
+}
+/* Collaborators: a bordered list inside the card, then an add row. */
+.collab-list {
+  margin-bottom: 1rem;
+}
+.collab-list .entry-row {
+  padding-left: 0;
+  padding-right: 0;
+}
+.collab-list .entry-row-actions .btn {
+  padding: 0.25rem 0.6rem;
+  font-size: 0.85em;
+}
+.collab-add {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  align-items: center;
+}
+.collab-add input[type="text"] {
+  flex: 1;
+  min-width: 12rem;
+}
+.collab-add select {
+  width: auto;
+}
+.collab-add button {
+  flex: none;
+}
 label {
   display: block;
   margin: 0.75rem 0 0.25rem;
   margin: 0.25rem 0 0.5rem;
   font-size: 0.85em;
+}
+/* Link slots stack full-width; the Add button sits beside the last one. */
+.link-fields {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.5rem;
+}
 .link-slot {
-  margin-bottom: 0.5rem;
+  flex: 1 1 100%;
+}
+.link-slot.last-visible {
+  flex: 1 1 auto;
+}
 .link-add {
-  margin-top: 0.25rem;
+  flex: 0 0 auto;
+}
-/* Without JS every slot shows; the enhancement hides empties behind Add link. */
+/* Without JS every slot shows; the enhancement hides empties behind Add. */
 [hidden] {
   display: none !important;
+}
   gap: 1.25rem;
   flex-wrap: wrap;
+}
-.avatar-settings form {
+.avatar-form {
   flex: 1;
   min-width: 15rem;
+}
+.avatar-upload-row {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin-top: 0.6rem;
+}
+.avatar-form input[type="file"] {
+  flex: 1;
+  min-width: 12rem;
+  padding: 0.4rem;
+  background: var(--fb-bg-inset);
+  border: 1px solid var(--fb-border);
+  border-radius: var(--fb-radius);
+  color: var(--fb-fg);
+}
+.avatar-upload-row button[type="submit"] {
+  margin-top: 0;
+  flex: none;
+}
 /* ---- Search hits ---- */
 .search-hit {

   document.querySelectorAll("[data-link-fields]").forEach(function (wrap) {
     var slots = Array.prototype.slice.call(wrap.querySelectorAll(".link-slot"));
     var addBtn = wrap.querySelector("[data-link-add]");
-    var firstEmptyShown;
+    // Initial layout: show every filled slot plus one empty one, hide the rest.
+    var firstEmptyShown = false;
     slots.forEach(function (s) {
       if (s.value.trim()) {
         s.hidden = false;
         s.hidden = true;
+      }
     });
-    function anyHidden() {
+    // Keep the Add button beside the last visible slot; hide it once all show.
-      return slots.some(function (s) { return s.hidden; });
+    function mark() {
+      var lastVisible = null;
+      slots.forEach(function (s) {
+        s.classList.remove("last-visible");
+        if (!s.hidden) lastVisible = s;
+      });
+      if (lastVisible) lastVisible.classList.add("last-visible");
+      if (addBtn) addBtn.hidden = !slots.some(function (s) { return s.hidden; });
+    }
     if (addBtn) {
-      addBtn.hidden = !anyHidden();
       addBtn.addEventListener("click", function () {
         var next = slots.filter(function (s) { return s.hidden; })[0];
         if (next) {
           next.hidden = false;
           next.focus();
+        }
-        addBtn.hidden = !anyHidden();
+        mark();
       });
+    }
+    mark();
   });
   // ---- Clipboard buttons ----

         #[arg(long)]
         public: bool,
     },
+    /// Manage a repository's collaborators.
+    Collaborator {
+        /// The collaborator action.
+        #[command(subcommand)]
+        command: CollaboratorCommand,
+    },
     /// Print the resolved on-disk directory of a repository.
     Path {
         /// The owning user.
     },
+}
+/// Actions under `fabrica repo collaborator`.
+#[derive(Debug, Subcommand)]
+pub(crate) enum CollaboratorCommand {
+    /// Add or update a collaborator's permission.
+    Add {
+        /// The owning user.
+        user: String,
+        /// The repo name (group path included).
+        name: String,
+        /// The collaborator's username.
+        collaborator: String,
+        /// Permission to grant: read | write | admin.
+        #[arg(long, default_value = "write")]
+        permission: String,
+    },
+    /// Remove a collaborator.
+    Rm {
+        /// The owning user.
+        user: String,
+        /// The repo name (group path included).
+        name: String,
+        /// The collaborator's username.
+        collaborator: String,
+    },
+    /// List a repository's collaborators.
+    List {
+        /// The owning user.
+        user: String,
+        /// The repo name (group path included).
+        name: String,
+    },
+}
 /// Dispatch a `repo` subcommand.
 pub(crate) fn run(
     command: &RepoCommand,
             name,
             (*private, *internal, *public),
         )),
+        RepoCommand::Collaborator { command } => match command {
+            CollaboratorCommand::Add {
+                user,
+                name,
+                collaborator,
+                permission,
+            } => block_on(collab_add(
+                config_path,
+                user,
+                name,
+                collaborator,
+                permission,
+            )),
+            CollaboratorCommand::Rm {
+                user,
+                name,
+                collaborator,
+            } => block_on(collab_rm(config_path, user, name, collaborator)),
+            CollaboratorCommand::List { user, name } => {
+                block_on(collab_list(config_path, user, name, json))
+            }
+        },
         RepoCommand::Path { user, name } => block_on(path(config_path, user, name)),
+    }
+}
     Ok(ExitCode::SUCCESS)
+}
+async fn collab_add(
+    config_path: Option<&Path>,
+    user: &str,
+    name: &str,
+    collaborator: &str,
+    permission: &str,
+) -> anyhow::Result<ExitCode> {
+    if !matches!(permission, "read" | "write" | "admin") {
+        anyhow::bail!("permission must be read, write, or admin");
+    }
+    let (_config, store) = open_store(config_path).await?;
+    let owner_id = require_user_id(&store, user).await?;
+    let repo = require_repo(&store, &owner_id, name, user).await?;
+    let target_id = require_user_id(&store, collaborator).await?;
+    if target_id == owner_id {
+        anyhow::bail!("the owner already has full access; not adding them as a collaborator");
+    }
+    store
+        .set_collaborator(&repo.id, &target_id, permission)
+        .await?;
+    println!(
+        "{collaborator} is now a {permission} collaborator on {user}/{}",
+        repo.path
+    );
+    Ok(ExitCode::SUCCESS)
+}
+async fn collab_rm(
+    config_path: Option<&Path>,
+    user: &str,
+    name: &str,
+    collaborator: &str,
+) -> anyhow::Result<ExitCode> {
+    let (_config, store) = open_store(config_path).await?;
+    let owner_id = require_user_id(&store, user).await?;
+    let repo = require_repo(&store, &owner_id, name, user).await?;
+    let target_id = require_user_id(&store, collaborator).await?;
+    if store.remove_collaborator(&repo.id, &target_id).await? {
+        println!("removed {collaborator} from {user}/{}", repo.path);
+    } else {
+        println!(
+            "{collaborator} was not a collaborator on {user}/{}",
+            repo.path
+        );
+    }
+    Ok(ExitCode::SUCCESS)
+}
+async fn collab_list(
+    config_path: Option<&Path>,
+    user: &str,
+    name: &str,
+    json: bool,
+) -> anyhow::Result<ExitCode> {
+    let (_config, store) = open_store(config_path).await?;
+    let owner_id = require_user_id(&store, user).await?;
+    let repo = require_repo(&store, &owner_id, name, user).await?;
+    let collaborators = store.list_collaborators(&repo.id).await?;
+    if json {
+        let view: Vec<_> = collaborators
+            .iter()
+            .map(|c| serde_json::json!({ "username": c.username, "permission": c.permission }))
+            .collect();
+        println!("{}", serde_json::to_string_pretty(&view)?);
+        return Ok(ExitCode::SUCCESS);
+    }
+    if collaborators.is_empty() {
+        println!("no collaborators");
+        return Ok(ExitCode::SUCCESS);
+    }
+    for c in &collaborators {
+        println!("{}  [{}]", c.username, c.permission);
+    }
+    Ok(ExitCode::SUCCESS)
+}
 async fn path(config_path: Option<&Path>, user: &str, name: &str) -> anyhow::Result<ExitCode> {
     let (config, store) = open_store(config_path).await?;
     let owner_id = require_user_id(&store, user).await?;

 pub use crate::invites::NewInvite;
 pub use crate::keys::NewKey;
-pub use crate::repos::NewRepo;
+pub use crate::repos::{Collaborator, NewRepo};
 pub use crate::sessions::NewSession;
 pub use crate::tokens::NewToken;
 pub use crate::users::{NewUser, ProfileUpdate};

     pub default_branch: String,
+}
+/// A repo collaborator with their username resolved, for listings.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Collaborator {
+    /// The collaborator's user id.
+    pub user_id: String,
+    /// Their username.
+    pub username: String,
+    /// Their permission (`read` | `write` | `admin`).
+    pub permission: String,
+}
 impl Store {
     /// Create a repository, returning the persisted row.
     ///
         Ok(row.as_ref().map(|r| r.try_get("permission")).transpose()?)
+    }
+    /// List a repo's explicit collaborators, alphabetical by username.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_collaborators(&self, repo_id: &str) -> Result<Vec<Collaborator>, StoreError> {
+        let sql = "SELECT c.user_id, u.username, c.permission \
+             FROM repo_collaborators c JOIN users u ON u.id = c.user_id \
+             WHERE c.repo_id = $1 ORDER BY u.username_lower ASC";
+        let rows = sqlx::query(sql).bind(repo_id).fetch_all(&self.pool).await?;
+        rows.iter()
+            .map(|r| {
+                Ok(Collaborator {
+                    user_id: r.try_get("user_id")?,
+                    username: r.try_get("username")?,
+                    permission: r.try_get("permission")?,
+                })
+            })
+            .collect::<Result<_, sqlx::Error>>()
+            .map_err(Into::into)
+    }
+    /// Add or update a collaborator's permission on a repo (`read`|`write`|
+    /// `admin`). The caller validates the permission token.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_collaborator(
+        &self,
+        repo_id: &str,
+        user_id: &str,
+        permission: &str,
+    ) -> Result<(), StoreError> {
+        // Portable upsert: both dialects support ON CONFLICT DO UPDATE.
+        let sql = "INSERT INTO repo_collaborators (repo_id, user_id, permission, created_at) \
+             VALUES ($1, $2, $3, $4) \
+             ON CONFLICT (repo_id, user_id) DO UPDATE SET permission = $3";
+        sqlx::query(sql)
+            .bind(repo_id)
+            .bind(user_id)
+            .bind(permission)
+            .bind(now_ms())
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    /// Remove a collaborator from a repo. Returns `true` if a row was removed.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn remove_collaborator(
+        &self,
+        repo_id: &str,
+        user_id: &str,
+    ) -> Result<bool, StoreError> {
+        let deleted =
+            sqlx::query("DELETE FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2")
+                .bind(repo_id)
+                .bind(user_id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        Ok(deleted > 0)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     // A method (not an associated fn) for symmetry with the other row mappers,
     // even though the visibility mapping no longer needs `self`.

+}
 #[tokio::test]
+async fn collaborators_add_update_list_remove() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("owner", "owner@example.com"))
+            .await
+            .unwrap();
+        let friend = fx
+            .store
+            .create_user(sample_user("friend", "friend@example.com"))
+            .await
+            .unwrap();
+        let repo = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: owner.id.clone(),
+                group_id: None,
+                name: "proj".to_string(),
+                path: "proj".to_string(),
+                description: None,
+                visibility: model::Visibility::Private,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap();
+        fx.store
+            .set_collaborator(&repo.id, &friend.id, "read")
+            .await
+            .unwrap();
+        let list = fx.store.list_collaborators(&repo.id).await.unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0].username, "friend");
+        assert_eq!(list[0].permission, "read");
+        // Upsert changes the permission in place.
+        fx.store
+            .set_collaborator(&repo.id, &friend.id, "write")
+            .await
+            .unwrap();
+        let list = fx.store.list_collaborators(&repo.id).await.unwrap();
+        assert_eq!(list.len(), 1, "upsert, not a second row");
+        assert_eq!(list[0].permission, "write");
+        assert_eq!(
+            fx.store
+                .collaborator_permission(&repo.id, &friend.id)
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("write")
+        );
+        assert!(
+            fx.store
+                .remove_collaborator(&repo.id, &friend.id)
+                .await
+                .unwrap()
+        );
+        assert!(
+            fx.store
+                .list_collaborators(&repo.id)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+        assert!(
+            !fx.store
+                .remove_collaborator(&repo.id, &friend.id)
+                .await
+                .unwrap()
+        );
+    }
+}
+#[tokio::test]
 async fn duplicate_username_conflicts_case_insensitively() {
     for fx in sqlite_fixtures().await {
         fx.store

         // fixed prefix so it never collides with the `/{owner}/{*rest}` catch-all.
         .route("/repo-settings/{id}/general", post(repo::settings_general))
         .route("/repo-settings/{id}/delete", post(repo::settings_delete))
+        .route(
+            "/repo-settings/{id}/collaborators",
+            post(repo::settings_collaborator_add),
+        )
+        .route(
+            "/repo-settings/{id}/collaborators/remove",
+            post(repo::settings_collaborator_remove),
+        )
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

@@ -608,11 +608,13 @@ fn settings_body(user: &User, csrf: &str, notice: Option<&str>) -> Markup {
608	h2 { "Avatar" }	608	h2 { "Avatar" }
609	div class="card avatar-settings" {	609	div class="card avatar-settings" {
610	img class="avatar avatar-lg" src={ "/avatar/" (user.username) } alt="Your avatar";	610	img class="avatar avatar-lg" src={ "/avatar/" (user.username) } alt="Your avatar";
611	form method="post" action="/settings/avatar" enctype="multipart/form-data" {	611	form class="avatar-form" method="post" action="/settings/avatar" enctype="multipart/form-data" {
612	input type="hidden" name="_csrf" value=(csrf);	612	input type="hidden" name="_csrf" value=(csrf);
613	p class="muted" { "PNG, JPEG, GIF, or WebP up to 1 MiB. Leave blank for a generated identicon." }	613	p class="muted field-hint" { "PNG, JPEG, GIF, or WebP up to 1 MiB. Leave blank for a generated identicon." }
614	input type="file" name="avatar" accept="image/png,image/jpeg,image/gif,image/webp";	614	div class="avatar-upload-row" {
615	button class="btn" type="submit" { (icon(Icon::Upload)) span { "Upload" } }	615	input type="file" name="avatar" accept="image/png,image/jpeg,image/gif,image/webp";
		616	button class="btn" type="submit" { (icon(Icon::Upload)) span { "Upload" } }
		617	}
616	}	618	}
617	}	619	}
618	}	620	}
@@ -639,7 +641,7 @@ fn settings_body(user: &User, csrf: &str, notice: Option<&str>) -> Markup {
639	class="link-slot" value=(user.links.get(i).map_or("", String::as_str))	641	class="link-slot" value=(user.links.get(i).map_or("", String::as_str))
640	placeholder="https://example.com";	642	placeholder="https://example.com";
641	}	643	}
642	button class="btn link-add" type="button" data-link-add { "Add link" }	644	button class="btn link-add" type="button" data-link-add { "Add" }
643	}	645	}
644	button class="btn btn-primary" type="submit" { "Save profile" }	646	button class="btn btn-primary" type="submit" { "Save profile" }
645	}	647	}

         return Err(AppError::NotFound);
+    }
     let branches = branch_names(state, &ctx.repo.id).await;
+    let collaborators = state.store.list_collaborators(&ctx.repo.id).await?;
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let id = &ctx.repo.id;
             option value=(value.as_str()) selected[vis == value] { (label) }
+        }
     };
+    let perm_option = |value: &str, label: &str| {
+        html! { option value=(value) { (label) } }
+    };
     let body = html! {
         (repo_header(state, &ctx, Tab::Settings, &ctx.repo.default_branch, &branches))
         section class="listing" {
+            }
+        }
         section class="listing" {
+            h2 { "Collaborators" }
+            div class="card" {
+                @if collaborators.is_empty() {
+                    p class="muted" { "No collaborators yet." }
+                } @else {
+                    ul class="entry-list collab-list" {
+                        @for c in &collaborators {
+                            li class="entry-row" {
+                                div class="entry-row-body" {
+                                    a class="entry-row-title" href={ "/" (c.username) } { (c.username) }
+                                    div class="entry-row-meta muted" { (c.permission) }
+                                }
+                                div class="entry-row-actions" {
+                                    form method="post"
+                                         action=(format!("/repo-settings/{id}/collaborators/remove")) {
+                                        input type="hidden" name="_csrf" value=(chrome.csrf);
+                                        input type="hidden" name="user_id" value=(c.user_id);
+                                        button class="btn btn-danger" type="submit" { "Remove" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                form class="collab-add" method="post"
+                     action=(format!("/repo-settings/{id}/collaborators")) {
+                    input type="hidden" name="_csrf" value=(chrome.csrf);
+                    input type="text" name="username" placeholder="Username" aria-label="Username" required;
+                    select name="permission" aria-label="Permission" {
+                        (perm_option("read", "Read"))
+                        (perm_option("write", "Write"))
+                        (perm_option("admin", "Admin"))
+                    }
+                    button class="btn btn-primary" type="submit" { "Add" }
+                }
+            }
+        }
+        section class="listing" {
             h2 { "Danger zone" }
             div class="card danger-zone" {
                 p { strong { "Delete this repository." } " This permanently removes it from fabrica; the on-disk copy is moved to trash." }
+    }
+}
+/// The `/-/settings` URL for a repo, resolving the owner username.
+async fn repo_settings_url(state: &AppState, repo: &Repo) -> String {
+    let owner = state
+        .store
+        .user_by_id(&repo.owner_id)
+        .await
+        .ok()
+        .flatten()
+        .map_or_else(|| repo.owner_id.clone(), |u| u.username);
+    format!("/{owner}/{}/-/settings", repo.path)
+}
+/// The add-collaborator form.
+#[derive(Debug, Deserialize)]
+pub struct CollaboratorAddForm {
+    /// The collaborator's username.
+    #[serde(default)]
+    username: String,
+    /// The permission to grant (`read` | `write` | `admin`).
+    #[serde(default)]
+    permission: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /repo-settings/{id}/collaborators` — add or update a collaborator.
+pub async fn settings_collaborator_add(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<CollaboratorAddForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
+        let permission = auth::Permission::parse(&form.permission)
+            .ok_or_else(|| AppError::BadRequest("Invalid permission.".to_string()))?;
+        let target = state
+            .store
+            .user_by_username(form.username.trim())
+            .await?
+            .ok_or_else(|| AppError::BadRequest("No such user.".to_string()))?;
+        // The owner is already an admin; adding them as a collaborator is a no-op.
+        if target.id != repo.owner_id {
+            state
+                .store
+                .set_collaborator(&repo.id, &target.id, permission.as_str())
+                .await?;
+        }
+        Ok::<String, AppError>(repo_settings_url(&state, &repo).await)
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The remove-collaborator form.
+#[derive(Debug, Deserialize)]
+pub struct CollaboratorRemoveForm {
+    /// The collaborator's user id.
+    #[serde(default)]
+    user_id: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /repo-settings/{id}/collaborators/remove` — remove a collaborator.
+pub async fn settings_collaborator_remove(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<CollaboratorRemoveForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
+        state
+            .store
+            .remove_collaborator(&repo.id, &form.user_id)
+            .await?;
+        Ok::<String, AppError>(repo_settings_url(&state, &repo).await)
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
 // ---- Commit list ----
 async fn commits_view(