hanna/fabrica

feat(groups): cap repo visibility at the group's visibility ceiling

84b193c · hanna committed on 2026-07-26

A repository may not be more visible than its group: an internal group holds
only internal/private repos, a private group only private repos, and a public
group imposes nothing. The ceiling walks the whole ancestor chain, so nested
groups compose.

Auto/intermediate groups now default to public (migration 0021) so they stay
transparent to the ceiling — only a deliberately-restricted group locks the
repos beneath it. Enforced at repo creation, repo settings, and group settings;
lowering a group's visibility cascades down, clamping every descendant group and
repository via `clamp_subtree_visibility`. The repo settings form hides options
above the ceiling and notes the cap, and the group listing hides subgroups the
viewer may not see.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/store/src/groups.rs +62 −1

crates/store/src/tests.rs +63 −0

crates/web/src/groups.rs +20 −3

crates/web/src/pages.rs +13 −1

crates/web/src/repo.rs +34 −5

migrations/postgres/0021_group_settings.sql +3 −1

migrations/sqlite/0021_group_settings.sql +3 −1

             path: path.to_string(),
             description: None,
             manual: false,
-            visibility: Visibility::Private,
+            // Auto groups are transparent to the visibility ceiling (see migration
+            // 0021); only a deliberately-set group restricts the repos beneath it.
+            visibility: Visibility::Public,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO groups \
         Ok(best)
+    }
+    /// The most-restrictive visibility across a group and its ancestors — the
+    /// ceiling a repository in the group (or a descendant group) may not exceed.
+    /// Auto groups default to public, so they leave the ceiling untouched.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn group_visibility_ceiling(&self, group_id: &str) -> Result<Visibility, StoreError> {
+        let mut ceiling = Visibility::Public;
+        let mut next = Some(group_id.to_string());
+        let mut guard = 0;
+        while let Some(gid) = next {
+            guard += 1;
+            if guard > 64 {
+                break;
+            }
+            let Some(g) = self.group_by_id(&gid).await? else {
+                break;
+            };
+            if g.visibility.rank() < ceiling.rank() {
+                ceiling = g.visibility;
+            }
+            next = g.parent_id;
+        }
+        Ok(ceiling)
+    }
+    /// Clamp every descendant group and repository so none is more visible than
+    /// its group ceiling. Call after lowering a group's visibility.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn clamp_subtree_visibility(&self, group: &Group) -> Result<(), StoreError> {
+        let child_prefix = format!("{}/", group.path);
+        // Descendant groups first, top-down (path ASC) so each parent's ceiling is
+        // settled before its children are measured against it.
+        let groups = self.groups_by_owner(&group.owner_id).await?;
+        for g in groups.iter().filter(|g| g.path.starts_with(&child_prefix)) {
+            if let Some(parent_id) = &g.parent_id {
+                let ceiling = self.group_visibility_ceiling(parent_id).await?;
+                if g.visibility.rank() > ceiling.rank() {
+                    self.set_group_visibility(&g.id, ceiling).await?;
+                }
+            }
+        }
+        // Then every repository anywhere in the subtree.
+        let repos = self.repos_by_owner(&group.owner_id).await?;
+        for r in repos.iter().filter(|r| r.path.starts_with(&child_prefix)) {
+            if let Some(gid) = &r.group_id {
+                let ceiling = self.group_visibility_ceiling(gid).await?;
+                if r.visibility.rank() > ceiling.rank() {
+                    self.set_visibility(&r.id, ceiling).await?;
+                }
+            }
+        }
+        Ok(())
+    }
     /// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
     fn map_group(&self, row: &AnyRow) -> Result<Group, sqlx::Error> {
         Ok(Group {

         );
+    }
+}
+#[tokio::test]
+async fn group_visibility_ceiling_clamps_subtree() {
+    use model::Visibility;
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("vis", "vis@example.com"))
+            .await
+            .unwrap();
+        let org = fx.store.create_group(&owner.id, "org").await.unwrap();
+        let repo = repo_in_group(&fx.store, &owner.id, "org/team/app").await;
+        // Start everything fully public.
+        fx.store
+            .set_visibility(&repo.id, Visibility::Public)
+            .await
+            .unwrap();
+        let team = fx
+            .store
+            .group_by_owner_path(&owner.id, "org/team")
+            .await
+            .unwrap()
+            .unwrap();
+        fx.store
+            .set_group_visibility(&team.id, Visibility::Public)
+            .await
+            .unwrap();
+        assert_eq!(
+            fx.store.group_visibility_ceiling(&team.id).await.unwrap(),
+            Visibility::Public
+        );
+        // Lower the top group to internal and cascade the ceiling downward.
+        fx.store
+            .set_group_visibility(&org.id, Visibility::Internal)
+            .await
+            .unwrap();
+        let org = fx.store.group_by_id(&org.id).await.unwrap().unwrap();
+        fx.store.clamp_subtree_visibility(&org).await.unwrap();
+        let team = fx
+            .store
+            .group_by_owner_path(&owner.id, "org/team")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            team.visibility,
+            Visibility::Internal,
+            "subgroup clamped to the new ceiling"
+        );
+        let repo = fx.store.repo_by_id(&repo.id).await.unwrap().unwrap();
+        assert_eq!(
+            repo.visibility,
+            Visibility::Internal,
+            "repo clamped to the new ceiling"
+        );
+        assert_eq!(
+            fx.store.group_visibility_ceiling(&team.id).await.unwrap(),
+            Visibility::Internal
+        );
+    }
+}

+            }
             other => other.to_string(),
         })?;
-    if let Some(vis) = Visibility::from_token(&form.visibility) {
+    if let Some(mut vis) = Visibility::from_token(&form.visibility) {
+        // A subgroup may not be more visible than its parent's ceiling.
+        if let Some(parent_id) = &group.parent_id {
+            if let Ok(ceiling) = state.store.group_visibility_ceiling(parent_id).await
+                && vis.rank() > ceiling.rank()
+            {
+                vis = ceiling;
+            }
+        }
         let _ = state.store.set_group_visibility(&group.id, vis).await;
+    }
     Ok(group.path)
+                }
                 other => AppError::from(other),
             })?;
-        if let Some(vis) = Visibility::from_token(&form.visibility) {
+        if let Some(mut vis) = Visibility::from_token(&form.visibility) {
-            state.store.set_group_visibility(&group.id, vis).await?;
+            // A subgroup may not be more visible than its parent's ceiling.
+            if let Some(parent_id) = &renamed.parent_id {
+                let ceiling = state.store.group_visibility_ceiling(parent_id).await?;
+                if vis.rank() > ceiling.rank() {
+                    vis = ceiling;
+                }
+            }
+            state.store.set_group_visibility(&renamed.id, vis).await?;
+            // Cascade the (possibly lowered) ceiling down to repos and subgroups.
+            state.store.clamp_subtree_visibility(&renamed).await?;
+        }
         let _ = owner;
         Ok::<String, AppError>(format!("/group-settings/{}", renamed.id))

             b.to_string()
+        }
     };
-    let visibility = model::Visibility::from_token(&form.visibility).unwrap_or_else(|| {
+    let mut visibility = model::Visibility::from_token(&form.visibility).unwrap_or_else(|| {
         model::Visibility::from_token(&state.default_visibility_token())
             .unwrap_or(model::Visibility::Private)
     });
+    // A repo may never be more visible than its group (the ceiling walks the
+    // whole ancestor chain; auto groups are public and impose nothing).
+    if let Some(gid) = &group_id {
+        let ceiling = state
+            .store
+            .group_visibility_ceiling(gid)
+            .await
+            .map_err(|e| e.to_string())?;
+        if visibility.rank() > ceiling.rank() {
+            visibility = ceiling;
+        }
+    }
     let description = {
         let d = form.description.trim();
         (!d.is_empty()).then(|| d.to_string())

     let id = &ctx.repo.id;
     let vis = ctx.repo.visibility;
-    let vis_option = |value: Visibility, label: &str| {
+    // The group ceiling: a repo may not be set more visible than its group.
-        html! {
+    let vis_ceiling = match &ctx.repo.group_id {
-            option value=(value.as_str()) selected[vis == value] { (label) }
+        Some(gid) => state.store.group_visibility_ceiling(gid).await?,
+        None => Visibility::Public,
+    };
+    let vis_option = |value: Visibility, label: &str| -> Markup {
+        // Hide options above the ceiling, but always keep the current value so the
+        // form round-trips even if the ceiling later tightened.
+        if value.rank() <= vis_ceiling.rank() || value == vis {
+            html! { option value=(value.as_str()) selected[vis == value] { (label) } }
+        } else {
+            html! {}
+        }
     };
     let body = html! {
                         (vis_option(Visibility::Internal, "Internal — any signed-in user"))
                         (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                    }
+                    @if vis_ceiling.rank() < Visibility::Public.rank() {
+                        p class="muted field-hint" {
+                            "Capped by this repository's group, which is "
+                            (vis_ceiling.as_str()) "."
+                        }
+                    }
                     label for="object_format" { "Object format" }
                     select id="object_format" disabled title="Fixed at creation" {
                         option { (ctx.repo.object_format.to_uppercase()) }
+            {
                 vis = parent.visibility;
+            }
+            // Nor more visible than its group ceiling.
+            if let Some(gid) = &repo.group_id {
+                let ceiling = state.store.group_visibility_ceiling(gid).await?;
+                if vis.rank() > ceiling.rank() {
+                    vis = ceiling;
+                }
+            }
             state.store.set_visibility(&repo.id, vis).await?;
+        }
         state
     let all_groups = state.store.groups_by_owner(&owner.id).await?;
     let prefix = format!("{group_path}/");
-    let subgroups: Vec<_> = all_groups
+    // Direct child groups the viewer may see (a private subgroup is hidden, not
+    // just 404 on visit — its very name would otherwise leak here).
+    let mut subgroups: Vec<&model::Group> = Vec::new();
+    for g in all_groups
         .iter()
         .filter(|g| g.path.starts_with(&prefix) && !g.path[prefix.len()..].contains('/'))
-        .collect();
+    {
+        if crate::groups::group_access(state, viewer.as_ref(), g).await? != auth::Access::None {
+            subgroups.push(g);
+        }
+    }
     let repos: Vec<Repo> = visible_repos(state, &owner, viewer.as_ref())
         .await?
         .into_iter()

 -- groups are garbage-collected when empty), a visibility, and collaborators
 -- whose access cascades to every repository in the group's subtree.
 ALTER TABLE groups ADD COLUMN manual BOOLEAN NOT NULL DEFAULT FALSE;
-ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
+-- Auto/intermediate groups default to 'public' so they impose no visibility
+-- ceiling; only a deliberately-restricted group locks the repos beneath it.
+ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'public';
 CREATE TABLE group_collaborators (
     id         TEXT PRIMARY KEY,