hanna/fabrica

feat: GitLab-style repo visibility (public / internal / private)

65b6581 · hanna committed on 2026-07-25

Replace the two-state is_private flag with a three-state Visibility across
the stack: model enum, migration 0004 (backfilled from is_private), store
column and set_visibility, and auth::access (public = anyone incl. anon when
allowed; internal = any signed-in user; private = owner/collaborators). The
exhaustive access matrix test now enumerates all three visibilities. Add
instance.default_visibility to config, a `repo visibility` CLI command with
--private/--internal/--public, and surface the label in listings and badges.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/api/src/handlers.rs +7 −2

crates/auth/src/access.rs +69 −57

crates/cli/src/repo_cmd.rs +108 −22

crates/cli/src/user_cmd.rs +1 −1

crates/config/src/lib.rs +2 −2

crates/config/src/types.rs +29 −0

crates/model/src/entity.rs +50 −2

crates/model/src/lib.rs +1 −1

crates/store/src/repos.rs +34 −8

crates/store/src/tests.rs +9 −9

crates/web/src/pages.rs +4 −1

crates/web/src/repo.rs +31 −14

crates/web/src/tests.rs +2 −2

fabrica.example.toml +1 −0

migrations/postgres/0004_repo_visibility.sql +5 −0

migrations/sqlite/0004_repo_visibility.sql +5 −0

             name: leaf,
             path: body.name.clone(),
             description: body.description,
-            is_private: body.private.unwrap_or(true),
+            visibility: if body.private.unwrap_or(true) {
+                model::Visibility::Private
+            } else {
+                model::Visibility::Public
+            },
             default_branch: branch.clone(),
         })
         .await?;
         "owner": owner,
         "name": repo.name,
         "path": repo.path,
-        "private": repo.is_private,
+        "private": repo.visibility.is_private(),
+        "visibility": repo.visibility.as_str(),
         "default_branch": repo.default_branch,
         "description": repo.description,
         "archived": repo.archived_at.is_some(),

                     name: "proj".to_string(),
                     path: "proj".to_string(),
                     description: None,
-                    is_private: true,
+                    visibility: model::Visibility::Private,
                     default_branch: "main".to_string(),
                 })
                 .await?;

 pub use crate::secret::{REDACTED, Secret};
 pub use crate::types::{
-    Auth, Config, Database, Git, Instance, Log, LogFormat, LogLevel, Mail, MailBackend,
+    Auth, Config, Database, DefaultVisibility, Git, Instance, Log, LogFormat, LogLevel, Mail,
-    MailEncryption, Search, Server, Ssh, Storage, Ui,
+    MailBackend, MailEncryption, Search, Server, Ssh, Storage, Ui,
 };
 /// System-wide configuration path, the lowest-priority file source.

+    }
+}
+/// Default visibility for newly created repositories, GitLab-style.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum DefaultVisibility {
+    /// Visible to everyone (anonymous included, when allowed).
+    Public,
+    /// Visible to any signed-in user.
+    Internal,
+    /// Visible only to the owner and collaborators.
+    #[default]
+    Private,
+}
+impl DefaultVisibility {
+    /// The lowercase token, matching `model::Visibility::from_token`.
+    #[must_use]
+    pub fn as_token(self) -> &'static str {
+        match self {
+            Self::Public => "public",
+            Self::Internal => "internal",
+            Self::Private => "private",
+        }
+    }
+}
 /// `[instance]` — identity and global policy.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
     pub default_branch: String,
     /// Allow anonymous browse and clone of public repositories.
     pub allow_anonymous: bool,
+    /// Default visibility for newly created repositories.
+    #[serde(default)]
+    pub default_visibility: DefaultVisibility,
+}
 impl Default for Instance {
             description: String::new(),
             default_branch: "main".to_string(),
             allow_anonymous: true,
+            default_visibility: DefaultVisibility::Private,
+        }
+    }
+}

+    }
+}
+/// A repository's visibility, GitLab-style. Stored as the `repos.visibility`
+/// text token.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Visibility {
+    /// Visible to everyone, anonymous included (subject to `allow_anonymous`).
+    Public,
+    /// Visible to any signed-in user, but not to anonymous visitors.
+    Internal,
+    /// Visible only to the owner, collaborators, and site admins.
+    #[default]
+    Private,
+}
+impl Visibility {
+    /// The lowercase database/wire token.
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Public => "public",
+            Self::Internal => "internal",
+            Self::Private => "private",
+        }
+    }
+    /// Parse from the token, case-insensitively.
+    #[must_use]
+    pub fn from_token(s: &str) -> Option<Self> {
+        match s.to_ascii_lowercase().as_str() {
+            "public" => Some(Self::Public),
+            "internal" => Some(Self::Internal),
+            "private" => Some(Self::Private),
+            _ => None,
+        }
+    }
+    /// Whether the repository is private (only owner/collaborators/admins).
+    #[must_use]
+    pub fn is_private(self) -> bool {
+        matches!(self, Self::Private)
+    }
+}
+impl std::fmt::Display for Visibility {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
 /// A registered account.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct User {
     pub path: String,
     /// Optional one-line description.
     pub description: Option<String>,
-    /// Private repositories are invisible to non-collaborators.
+    /// Who may see the repository (public / internal / private).
-    pub is_private: bool,
+    pub visibility: Visibility,
     /// The branch shown by default and used for HEAD.
     pub default_branch: String,
     /// When the repo was archived (read-only), if it is.

 //! [`Access::None`] on a private repo renders `404`, never `403`, so existence
 //! does not leak — belong to the web and API layers.
-use model::Repo;
+use model::{Repo, Visibility};
 /// The access level a viewer has to a repository, in increasing order of power.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 /// 1. a site admin gets [`Access::Admin`];
 /// 2. the repo's owner gets [`Access::Admin`];
 /// 3. an explicit collaborator gets exactly their stored permission;
-/// 4. a public repo, when the instance allows anonymous access, grants
+/// 4. otherwise the repo's [`Visibility`] decides:
-///    [`Access::Read`] to anyone;
+///    - **public**: [`Access::Read`] for any signed-in viewer, and for anonymous
-/// 5. otherwise [`Access::None`].
+///      viewers when the instance allows anonymous access;
+///    - **internal**: [`Access::Read`] for any signed-in viewer, never anonymous;
+///    - **private**: [`Access::None`].
 ///
 /// `collaborator` is the viewer's row in `repo_collaborators` for this repo, if
-/// any; the caller looks it up. `allow_anonymous` is `instance.allow_anonymous`.
+/// any; the caller looks it up. `allow_anonymous` is `instance.allow_anonymous`
-/// Note rule 4 is gated on that flag for *every* viewer, so disabling anonymous
+/// and now gates only anonymous access to *public* repos.
-/// access closes public repos to non-collaborators as well — matching the spec's
-/// private-by-default posture.
 #[must_use]
 pub fn access(
     viewer: Option<&Viewer>,
             return permission.into();
+        }
+    }
-    if !repo.is_private && allow_anonymous {
+    match repo.visibility {
-        return Access::Read;
+        Visibility::Public if viewer.is_some() || allow_anonymous => Access::Read,
+        Visibility::Internal if viewer.is_some() => Access::Read,
+        _ => Access::None,
+    }
-    Access::None
+}
 #[cfg(test)]
     /// A repo owned by `owner`, with the given visibility. Only the fields
     /// `access` reads are meaningful; the rest are filler.
-    fn repo(owner: &str, is_private: bool) -> Repo {
+    fn repo(owner: &str, visibility: Visibility) -> Repo {
         Repo {
             id: "01reporeporeporeporeporepo".to_string(),
             owner_id: owner.to_string(),
             name: "r".to_string(),
             path: "r".to_string(),
             description: None,
-            is_private,
+            visibility,
             default_branch: "main".to_string(),
             archived_at: None,
             size_bytes: 0,
+        }
+    }
+    /// Every visibility, for exhaustive iteration.
+    const ALL_VIS: [Visibility; 3] = [
+        Visibility::Public,
+        Visibility::Internal,
+        Visibility::Private,
+    ];
     fn viewer(id: &str, is_admin: bool) -> Viewer {
         Viewer {
             id: id.to_string(),
     struct Case {
         viewer: Option<Viewer>,
         collaborator: Option<Permission>,
-        is_private: bool,
+        visibility: Visibility,
         allow_anonymous: bool,
         expect: Access,
+    }
         let mut cases = Vec::new();
         let mut push = |viewer: Option<&Viewer>,
                         collaborator: Option<Permission>,
-                        is_private: bool,
+                        visibility: Visibility,
                         allow_anonymous: bool,
                         expect: Access| {
             cases.push(Case {
                 viewer: viewer.cloned(),
                 collaborator,
-                is_private,
+                visibility,
                 allow_anonymous,
                 expect,
             });
         };
-        // Rule 1: a site admin is Admin everywhere, regardless of every other
+        for &vis in &ALL_VIS {
-        // dimension.
-        for &private in &[true, false] {
             for &anon in &[true, false] {
+                // Rule 1: a site admin is Admin everywhere, regardless of every
+                // other dimension.
                 for collab in [None, Some(Permission::Read)] {
-                    push(Some(&admin), collab, private, anon, Access::Admin);
+                    push(Some(&admin), collab, vis, anon, Access::Admin);
+                }
-            }
+                // Rule 2: the owner is Admin everywhere, even with a lesser
-        }
+                // collaborator row present and anonymous access off.
-        // Rule 2: the owner is Admin everywhere, even with a lesser collaborator
-        // row somehow present, and even when anonymous access is off.
-        for &private in &[true, false] {
-            for &anon in &[true, false] {
                 for collab in [None, Some(Permission::Read), Some(Permission::Write)] {
-                    push(Some(&owner), collab, private, anon, Access::Admin);
+                    push(Some(&owner), collab, vis, anon, Access::Admin);
+                }
-            }
+                // Rule 3: an explicit collaborator gets exactly their permission,
-        }
+                // beating visibility and the anonymous flag.
-        // Rule 3: an explicit collaborator gets exactly their permission — this
-        // beats rule 4, so it holds even on a public repo, and is unaffected by
-        // the anonymous flag or visibility.
-        for &private in &[true, false] {
-            for &anon in &[true, false] {
                 push(
                     Some(&other),
                     Some(Permission::Read),
-                    private,
+                    vis,
                     anon,
                     Access::Read,
                 );
                 push(
                     Some(&other),
                     Some(Permission::Write),
-                    private,
+                    vis,
                     anon,
                     Access::Write,
                 );
                 push(
                     Some(&other),
                     Some(Permission::Admin),
-                    private,
+                    vis,
                     anon,
                     Access::Admin,
                 );
+            }
+        }
-        // Rule 4 / 5: a non-collaborator (authenticated stranger or anonymous)
+        // Rule 4: a non-collaborator, by visibility.
-        // reads a public repo only when anonymous access is allowed; a private
+        // Signed-in stranger: reads public and internal always; never private.
-        // repo is always None; and anon-off closes public repos too.
+        for &anon in &[true, false] {
-        for viewer in [Some(&other), None] {
+            push(Some(&other), None, Visibility::Public, anon, Access::Read);
-            // Public repo, anonymous allowed -> Read.
+            push(Some(&other), None, Visibility::Internal, anon, Access::Read);
-            push(viewer, None, false, true, Access::Read);
+            push(Some(&other), None, Visibility::Private, anon, Access::None);
-            // Public repo, anonymous disallowed -> None.
-            push(viewer, None, false, false, Access::None);
-            // Private repo -> None regardless of the flag.
-            push(viewer, None, true, true, Access::None);
-            push(viewer, None, true, false, Access::None);
+        }
+        // Anonymous: reads public only when allowed; never internal or private.
+        push(None, None, Visibility::Public, true, Access::Read);
+        push(None, None, Visibility::Public, false, Access::None);
+        push(None, None, Visibility::Internal, true, Access::None);
+        push(None, None, Visibility::Internal, false, Access::None);
+        push(None, None, Visibility::Private, true, Access::None);
+        push(None, None, Visibility::Private, false, Access::None);
         for case in &cases {
-            let repo = repo("owner", case.is_private);
+            let repo = repo("owner", case.visibility);
             let got = access(
                 case.viewer.as_ref(),
                 &repo,
             );
             assert_eq!(
                 got, case.expect,
-                "viewer={:?} collab={:?} private={} anon={}",
+                "viewer={:?} collab={:?} vis={} anon={}",
-                case.viewer, case.collaborator, case.is_private, case.allow_anonymous
+                case.viewer, case.collaborator, case.visibility, case.allow_anonymous
             );
+        }
+    }
     #[test]
     fn private_repo_never_leaks_to_a_stranger() {
-        // The security-critical invariant, called out on its own: no combination
+        // The security-critical invariant: no combination of a non-privileged
-        // of a non-privileged stranger on a private repo yields anything but None.
+        // stranger on a private repo yields anything but None. Internal repos also
+        // never leak to anonymous visitors.
         let stranger = viewer("stranger", false);
         for &anon in &[true, false] {
             assert_eq!(
-                access(Some(&stranger), &repo("owner", true), None, anon),
+                access(
+                    Some(&stranger),
+                    &repo("owner", Visibility::Private),
+                    None,
+                    anon
+                ),
+                Access::None
+            );
+            assert_eq!(
+                access(None, &repo("owner", Visibility::Private), None, anon),
+                Access::None
+            );
+            assert_eq!(
+                access(None, &repo("owner", Visibility::Internal), None, anon),
                 Access::None
             );
-            assert_eq!(access(None, &repo("owner", true), None, anon), Access::None);
+        }
+    }
+}

         user: String,
         /// The repo name, optionally prefixed with a group path.
         name: String,
-        /// Make the repo private (the default).
+        /// Make the repo private (owner and collaborators only).
-        #[arg(long, conflicts_with = "public")]
+        #[arg(long, conflicts_with_all = ["public", "internal"])]
         private: bool,
-        /// Make the repo public.
+        /// Make the repo internal (any signed-in user).
+        #[arg(long, conflicts_with = "public")]
+        internal: bool,
+        /// Make the repo public (everyone).
         #[arg(long)]
         public: bool,
         /// A one-line description.
         /// The new leaf name (the group path is preserved).
         new_name: String,
     },
+    /// Change a repository's visibility (private / internal / public).
+    Visibility {
+        /// The owning user.
+        user: String,
+        /// The repo name (group path included).
+        name: String,
+        /// Make the repo private (owner and collaborators only).
+        #[arg(long, conflicts_with_all = ["public", "internal"])]
+        private: bool,
+        /// Make the repo internal (any signed-in user).
+        #[arg(long, conflicts_with = "public")]
+        internal: bool,
+        /// Make the repo public (everyone).
+        #[arg(long)]
+        public: bool,
+    },
     /// Print the resolved on-disk directory of a repository.
     Path {
         /// The owning user.
         RepoCommand::Add {
             user,
             name,
-            private: _private,
+            private,
+            internal,
             public,
             description,
             default_branch,
             config_path,
             user,
             name,
-            // Private is the default; `--private` is the explicit form of it, and
+            (*private, *internal, *public),
-            // conflicts with `--public`, so visibility is simply "not public".
-            !*public,
             description.clone(),
             default_branch.clone(),
         )),
             name,
             new_name,
         } => block_on(rename(config_path, user, name, new_name)),
+        RepoCommand::Visibility {
+            user,
+            name,
+            private,
+            internal,
+            public,
+        } => block_on(visibility(
+            config_path,
+            user,
+            name,
+            (*private, *internal, *public),
+        )),
         RepoCommand::Path { user, name } => block_on(path(config_path, user, name)),
+    }
+}
+    }
+}
+/// Resolve the visibility from the `(private, internal, public)` flags, falling
+/// back to the instance default when none is given. clap guarantees at most one
+/// flag is set.
+fn resolve_visibility(
+    flags: (bool, bool, bool),
+    default: config::DefaultVisibility,
+) -> model::Visibility {
+    let (private, internal, public) = flags;
+    if private {
+        model::Visibility::Private
+    } else if internal {
+        model::Visibility::Internal
+    } else if public {
+        model::Visibility::Public
+    } else {
+        model::Visibility::from_token(default.as_token()).unwrap_or(model::Visibility::Private)
+    }
+}
 async fn add(
     config_path: Option<&Path>,
     user: &str,
     name: &str,
-    is_private: bool,
+    flags: (bool, bool, bool),
     description: Option<String>,
     default_branch: Option<String>,
 ) -> anyhow::Result<ExitCode> {
         None => None,
     };
     let branch = default_branch.unwrap_or_else(|| config.instance.default_branch.clone());
+    let visibility = resolve_visibility(flags, config.instance.default_visibility);
     let repo = store
         .create_repo(NewRepo {
             name: split_group_path(name).1.to_string(),
             path: name.to_string(),
             description,
-            is_private,
+            visibility,
             default_branch: branch.clone(),
         })
         .await?;
         return Err(err.into());
+    }
-    println!(
+    println!("created {visibility} repository {user}/{}", repo.path);
-        "created {} repository {user}/{}",
-        if is_private { "private" } else { "public" },
-        repo.path
-    );
     Ok(ExitCode::SUCCESS)
+}
     for repo in &repos {
         println!(
             "{}/{}  [{}]",
-            owners[&repo.owner_id],
+            owners[&repo.owner_id], repo.path, repo.visibility
-            repo.path,
-            if repo.is_private { "private" } else { "public" }
         );
+    }
     Ok(ExitCode::SUCCESS)
     Ok(ExitCode::SUCCESS)
+}
+async fn visibility(
+    config_path: Option<&Path>,
+    user: &str,
+    name: &str,
+    flags: (bool, bool, bool),
+) -> anyhow::Result<ExitCode> {
+    if flags == (false, false, false) {
+        anyhow::bail!("specify --private, --internal, or --public");
+    }
+    let (_config, store) = open_store(config_path).await?;
+    // A concrete flag is set, so the default is never consulted here.
+    let visibility = resolve_visibility(flags, config::DefaultVisibility::Private);
+    let owner_id = require_user_id(&store, user).await?;
+    let repo = require_repo(&store, &owner_id, name, user).await?;
+    store.set_visibility(&repo.id, visibility).await?;
+    println!("{user}/{} is now {visibility}", repo.path);
+    Ok(ExitCode::SUCCESS)
+}
 async fn path(config_path: Option<&Path>, user: &str, name: &str) -> anyhow::Result<ExitCode> {
     let (config, store) = open_store(config_path).await?;
     let owner_id = require_user_id(&store, user).await?;
         "name": repo.name,
         "path": repo.path,
         "description": repo.description,
-        "private": repo.is_private,
+        "visibility": repo.visibility.as_str(),
         "default_branch": repo.default_branch,
         "created_at": repo.created_at,
     })
         block_on(async { anyhow::Ok(env.make_user("ada").await) }).unwrap();
         // A grouped repo auto-creates the intermediate group and a bare repo dir.
-        block_on(add(env.path(), "ada", "backend/svc", true, None, None)).unwrap();
+        block_on(add(
+            env.path(),
+            "ada",
+            "backend/svc",
+            (true, false, false),
+            None,
+            None,
+        ))
+        .unwrap();
         let (repo, dir) = block_on(async {
             let store = env.store().await;
         })
         .unwrap();
         assert_eq!(repo.path, "backend/svc");
-        assert!(repo.is_private);
+        assert_eq!(repo.visibility, model::Visibility::Private);
         assert!(dir.join("HEAD").exists(), "a bare repo was created on disk");
         // Rename preserves the group prefix.
     fn add_rolls_back_the_row_if_the_disk_repo_cannot_be_created() {
         let env = env();
         block_on(async { anyhow::Ok(env.make_user("eve").await) }).unwrap();
-        block_on(add(env.path(), "eve", "proj", true, None, None)).unwrap();
+        block_on(add(
+            env.path(),
+            "eve",
+            "proj",
+            (true, false, false),
+            None,
+            None,
+        ))
+        .unwrap();
         // A second create at the same id path is impossible, but a duplicate
         // logical repo must conflict at the store layer and leave nothing behind.
-        let dup = block_on(add(env.path(), "eve", "proj", true, None, None));
+        let dup = block_on(add(
+            env.path(),
+            "eve",
+            "proj",
+            (true, false, false),
+            None,
+            None,
+        ));
         assert!(dup.is_err());
+    }
+}

 pub mod entity;
 pub mod name;
-pub use entity::{ApiToken, Group, Invite, Key, KeyKind, Repo, Timestamp, User};
+pub use entity::{ApiToken, Group, Invite, Key, KeyKind, Repo, Timestamp, User, Visibility};
 pub use name::{MAX_NAME_LEN, NameError, RESERVED_NAMES, validate_name};

 //! Repositories: creation and path lookup.
-use model::Repo;
+use model::{Repo, Visibility};
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `repos` in a fixed order, shared by every `SELECT`.
-const REPO_COLUMNS: &str = "id, owner_id, group_id, name, path, description, is_private, \
+const REPO_COLUMNS: &str = "id, owner_id, group_id, name, path, description, visibility, \
      default_branch, archived_at, size_bytes, pushed_at, created_at, updated_at";
 /// Fields needed to create a repository. The server fills in the id, timestamps,
     pub path: String,
     /// Optional one-line description.
     pub description: Option<String>,
-    /// Whether the repo is private (invisible to non-collaborators).
+    /// The repo's visibility (public / internal / private).
-    pub is_private: bool,
+    pub visibility: Visibility,
     /// The repo's default branch.
     pub default_branch: String,
+}
             name: new.name,
             path: new.path,
             description: new.description,
-            is_private: new.is_private,
+            visibility: new.visibility,
             default_branch: new.default_branch,
             archived_at: None,
             size_bytes: 0,
         };
         let sql = "INSERT INTO repos \
-             (id, owner_id, group_id, name, path, description, is_private, default_branch, \
+             (id, owner_id, group_id, name, path, description, visibility, default_branch, \
               archived_at, size_bytes, pushed_at, created_at, updated_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)";
         sqlx::query(sql)
             .bind(repo.name.clone())
             .bind(repo.path.clone())
             .bind(repo.description.clone())
-            .bind(repo.is_private)
+            .bind(repo.visibility.as_str())
             .bind(repo.default_branch.clone())
             .bind(repo.archived_at)
             .bind(repo.size_bytes)
         Ok(updated > 0)
+    }
+    /// Set a repository's visibility (private vs public). Returns `true` if the
+    /// row existed and was updated.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_visibility(
+        &self,
+        repo_id: &str,
+        visibility: Visibility,
+    ) -> Result<bool, StoreError> {
+        let updated =
+            sqlx::query("UPDATE repos SET visibility = $1, updated_at = $2 WHERE id = $3")
+                .bind(visibility.as_str())
+                .bind(now_ms())
+                .bind(repo_id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        Ok(updated > 0)
+    }
     /// Record that a repository was just pushed to: stamp `pushed_at` and refresh
     /// `size_bytes`. Called by `fabrica hook post-receive`.
     ///
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
+    // A method (not an associated fn) for symmetry with the other row mappers,
+    // even though the visibility mapping no longer needs `self`.
+    #[allow(clippy::unused_self)]
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {
             id: row.try_get("id")?,
             name: row.try_get("name")?,
             path: row.try_get("path")?,
             description: row.try_get("description")?,
-            is_private: self.get_bool(row, "is_private")?,
+            visibility: Visibility::from_token(&row.try_get::<String, _>("visibility")?)
+                .unwrap_or(Visibility::Private),
             default_branch: row.try_get("default_branch")?,
             archived_at: row.try_get("archived_at")?,
             size_bytes: row.try_get("size_bytes")?,

 async fn explore_repos_body(state: &AppState, q: &str) -> AppResult<Markup> {
     let needle = q.trim().to_lowercase();
     let all = state.store.list_repos().await?;
-    let public: Vec<_> = all.into_iter().filter(|r| !r.is_private).collect();
+    let public: Vec<_> = all
+        .into_iter()
+        .filter(|r| r.visibility == model::Visibility::Public)
+        .collect();
     // Resolve owner names once for the cross-owner labels/links and search.
     let mut owners: HashMap<String, String> = HashMap::new();
     for repo in &public {

     if is_owner_or_admin {
         return Ok(repos);
+    }
-    // Non-owners: public repos plus any where they are a collaborator.
+    // Non-owners: whatever the access function grants read to (visibility +
+    // collaborator rows), so internal repos surface for signed-in viewers.
+    let viewer_id = viewer.map(|v| auth::Viewer {
+        id: v.id.clone(),
+        is_admin: v.is_admin,
+    });
     let mut out = Vec::new();
     for repo in repos {
-        let allowed = !repo.is_private && state.config.instance.allow_anonymous;
         let collab = match viewer {
             Some(v) => state
                 .store
                 .collaborator_permission(&repo.id, &v.id)
                 .await?
-                .is_some(),
+                .and_then(|p| auth::Permission::parse(&p)),
-            None => false,
+            None => None,
         };
-        if allowed || collab {
+        let access = auth::access(
+            viewer_id.as_ref(),
+            &repo,
+            collab,
+            state.config.instance.allow_anonymous,
+        );
+        if access >= auth::Access::Read {
             out.push(repo);
+        }
+    }
     pub(crate) href: String,
     /// Display label (a bare repo path, or `owner/path` in cross-owner listings).
     pub(crate) label: String,
-    /// Whether the repo is private (drives the badge and visibility subtitle).
+    /// The repo's visibility (drives the badge and subtitle).
-    pub(crate) private: bool,
+    pub(crate) visibility: model::Visibility,
     /// The default branch, shown in the subtitle.
     pub(crate) default_branch: String,
     /// Optional one-line description, shown under the name when present.
         Self {
             href: format!("/{owner}/{}", repo.path),
             label: repo.path.clone(),
-            private: repo.is_private,
+            visibility: repo.visibility,
             default_branch: repo.default_branch.clone(),
             description: repo.description.clone(),
+        }
         Self {
             href: format!("/{owner}/{}", repo.path),
             label: format!("{owner}/{}", repo.path),
-            private: repo.is_private,
+            visibility: repo.visibility,
             default_branch: repo.default_branch.clone(),
             description: repo.description.clone(),
+        }
+    }
+}
+/// The visibility badge shown next to a repo name (nothing for public).
+fn visibility_badge(visibility: model::Visibility) -> Markup {
+    html! {
+        @if visibility != model::Visibility::Public {
+            span class="badge badge-private" { (visibility.as_str()) }
+        }
+    }
+}
 /// Render a titled card of repository rows in the reference listing style: a
 /// card headed by `title`, one bordered row per repo with a bold name and a
 /// muted `visibility · default: branch` subtitle.
                             a class="repo-row" href=(e.href) {
                                 span class="repo-row-name" {
                                     (icon(Icon::Box)) span { (e.label) }
-                                    @if e.private {
+                                    (visibility_badge(e.visibility))
-                                        span class="badge badge-private" { "private" }
-                                    }
+                                }
                                 @if let Some(desc) = &e.description {
                                     span class="repo-row-desc muted" { (desc) }
+                                }
                                 span class="repo-row-meta muted" {
-                                    (if e.private { "private" } else { "public" })
+                                    (e.visibility.as_str())
                                     " · " (icon(Icon::GitBranch)) " " (e.default_branch)
+                                }
+                            }
                 a href={ "/" (ctx.owner.username) } { (ctx.owner.username) }
                 span class="slug-sep" { "/" }
                 a href=(base) { (ctx.repo.name) }
-                @if ctx.repo.is_private { span class="badge badge-private" { "private" } }
+                (visibility_badge(ctx.repo.visibility))
+            }
             @if let Some(desc) = &ctx.repo.description { p class="muted" { (desc) } }
             div class="repo-nav" {

 description     = "A small, private forge." # one line, shown on the landing page
 default_branch  = "main"                    # default branch for new repositories
 allow_anonymous = true                      # anonymous browse + clone of public repos
+default_visibility = "private"              # new repos: public | internal | private
 [server]
 address                = "0.0.0.0"

+-- Replace the two-state is_private flag with a three-state visibility token
+-- (public / internal / private), GitLab-style. The is_private column is left in
+-- place but is no longer read or written.
+ALTER TABLE repos ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
+UPDATE repos SET visibility = CASE WHEN is_private THEN 'private' ELSE 'public' END;