hanna/fabrica

feat(cli): user admin subcommand to grant/revoke admin

4bbd7b9 · hanna committed on 2026-07-26

`fabrica user admin <name>` grants the site-administrator flag on an
existing account; `--revoke` removes it. Previously admin could only be
set at creation with `user add --admin`. Idempotent: a no-op is
reported rather than re-written.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/cli/src/user_cmd.rs +60 −0

@@ @@ -66,6 +66,14 @@ pub(crate) enum UserCommand { @@
         /// The user to verify.
         name: String,
     },
     /// Grant (or, with `--revoke`, remove) a user's site-administrator flag.
     Admin {
         /// The user to promote or demote.
         name: String,
         /// Revoke admin instead of granting it.
         #[arg(long)]
         revoke: bool,
     },
     /// Delete a user. Refuses if the user still owns repositories unless
     /// `--purge` is given.
     Del {
@@ @@ -106,6 +114,7 @@ pub(crate) fn run( @@
         UserCommand::Disable { name } => block_on(set_disabled(config_path, name, true)),
         UserCommand::Enable { name } => block_on(set_disabled(config_path, name, false)),
         UserCommand::Verify { name } => block_on(verify(config_path, name)),
         UserCommand::Admin { name, revoke } => block_on(set_admin(config_path, name, !*revoke)),
         UserCommand::Del { name, purge, yes } => block_on(del(config_path, name, *purge, *yes)),
+    }
+}
     Ok(ExitCode::SUCCESS)
+}
 /// Grant or revoke a user's site-administrator flag.
 async fn set_admin(
     config_path: Option<&Path>,
     name: &str,
     admin: bool,
 ) -> anyhow::Result<ExitCode> {
     let (_config, store) = open_store(config_path).await?;
     let user = require_user(&store, name).await?;
     if user.is_admin == admin {
         println!(
             "{} is already {}an administrator",
             user.username,
             if admin { "" } else { "not " }
         );
         return Ok(ExitCode::SUCCESS);
+    }
     store.set_admin(&user.id, admin).await?;
     println!(
         "{} admin for {}",
         if admin { "granted" } else { "revoked" },
         user.username
     );
     Ok(ExitCode::SUCCESS)
+}
 async fn del(
     config_path: Option<&Path>,
     name: &str,
@@ @@ -520,6 +554,32 @@ mod tests { @@
+    }
     #[test]
     fn admin_grants_then_revokes_the_flag() {
         let env = env();
         block_on(add(
             env.path(),
             "erin",
             "erin@example.com",
             Some("pw".to_string()),
             false,
             None,
         ))
         .unwrap();
         block_on(set_admin(env.path(), "erin", true)).unwrap();
         let promoted =
             block_on(async { anyhow::Ok(require_user(&env.store().await, "erin").await?) })
                 .unwrap();
         assert!(promoted.is_admin);
         block_on(set_admin(env.path(), "erin", false)).unwrap();
         let demoted =
             block_on(async { anyhow::Ok(require_user(&env.store().await, "erin").await?) })
                 .unwrap();
         assert!(!demoted.is_admin);
+    }
     #[test]
     fn del_refuses_repo_owner_without_purge_then_purges() {
         let env = env();
         block_on(add(