hanna/fabrica

feat(ssh): push-to-create a private repo on first push

8a86690 · hanna committed on 2026-07-25

A push (receive-pack) to a non-existent repo owned by the authenticated
user — or by an admin — now auto-creates it at the instance default
visibility: any missing group prefix, the database row, and the bare repo on
disk (rolled back if the on-disk step fails). Any other case stays a 404 so a
stranger cannot probe for repositories. Also log this session's visibility,
settings, and push-to-create decisions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/ssh/src/server.rs +72 −3

docs/decisions.md +32 −0

@@ @@ -269,14 +269,26 @@ impl GitHandler { @@
             .ok()
             .flatten()
             .ok_or_else(not_found)?;
         let repo = self
         let existing = self
             .shared
             .store
             .repo_by_owner_path(&owner_user.id, repo_path)
             .await
             .ok()
             .flatten()
             .ok_or_else(not_found)?;
             .flatten();
         // Push-to-create: a push (receive-pack) to a non-existent repo owned by
         // the pushing user (or by an admin) auto-creates it, at the instance
         // default visibility. Any other case is a 404 so a stranger cannot probe
         // for repositories.
         let repo = if let Some(repo) = existing {
             repo
         } else if matches!(service, git::pack::Service::ReceivePack)
             && (identity.user_id == owner_user.id || identity.is_admin)
+        {
             self.create_on_push(&owner_user, repo_path).await?
         } else {
             return Err(not_found());
         };
         let collaborator = self
             .shared
@@ @@ -310,6 +322,63 @@ impl GitHandler { @@
             Err(not_found())
+        }
+    }
     /// Create a repository on first push: any missing group prefix, the database
     /// row (visibility = instance default), and the bare repo on disk. Rolls the
     /// row back if the on-disk creation fails.
     async fn create_on_push(
         &self,
         owner: &model::User,
         repo_path: &str,
     ) -> Result<model::Repo, String> {
         let (group_path, leaf) = match repo_path.rsplit_once('/') {
             Some((group, leaf)) => (Some(group), leaf),
             None => (None, repo_path),
         };
         let group_id = match group_path {
             Some(gp) => Some(
                 self.shared
                     .store
                     .ensure_group_path(&owner.id, gp)
                     .await
                     .map_err(|e| e.to_string())?
                     .id,
             ),
             None => None,
         };
         let branch = self.shared.config.instance.default_branch.clone();
         let visibility = model::Visibility::from_token(
             self.shared.config.instance.default_visibility.as_token(),
+        )
         .unwrap_or(model::Visibility::Private);
         let repo = self
             .shared
             .store
             .create_repo(store::NewRepo {
                 owner_id: owner.id.clone(),
                 group_id,
                 name: leaf.to_string(),
                 path: repo_path.to_string(),
                 description: None,
                 visibility,
                 default_branch: branch.clone(),
             })
             .await
             .map_err(|e| e.to_string())?;
         let hook = std::env::current_exe().unwrap_or_else(|_| std::path::PathBuf::from("fabrica"));
         if let Err(err) = git::create_bare(
             &self.shared.config.storage.repo_dir,
             &repo.id,
             &branch,
             &hook,
         ) {
             let _ = self.shared.store.delete_repo(&repo.id).await;
             return Err(format!("Could not create repository: {err}"));
+        }
         tracing::info!(owner = %owner.username, path = %repo_path, "push-to-create: repository created");
         Ok(repo)
+    }
+}
 /// Run the SSH server until the process exits. A no-op when `ssh.enabled` is false.

 is refused so no user-supplied markup is ever served, while our own identicons are
 SVG. Both mutating routes (`POST /settings`, `POST /settings/avatar`) verify the
 double-submit CSRF token; `/settings` redirects anonymous visitors to `/login`.
 ## 2026-07-25 — Three-level visibility, repo settings, and SSH push-to-create
 **Decision:** Repositories carry a GitLab-style **visibility** — `public`
 (everyone, anonymous gated by `allow_anonymous`), `internal` (any signed-in
 user), or `private` (owner/collaborators/admins) — replacing the old two-state
 `is_private` flag. `auth::access` decides read on visibility after the
 admin/owner/collaborator rules; `instance.default_visibility` (default `private`)
 sets the default for new repos. Owners/admins get a **Settings** repo tab
 (rename, visibility, delete) whose mutations post to a fixed `/repo-settings/{id}`
 prefix (never colliding with the `/{owner}/{*rest}` catch-all) and re-check Admin
 access, returning `404` — never `403` — to non-admins. An SSH **push to a
 non-existent repo** owned by the pushing user (or an admin) **auto-creates** it at
 the default visibility (row + bare repo on disk, rolled back on disk failure).
 **Migration:** `0004_repo_visibility` adds a `visibility TEXT NOT NULL DEFAULT
 'private'` column backfilled from `is_private`; the `is_private` column is left in
 place (SQLite cannot drop columns) but no longer read or written.
 **Alternatives:** keeping the boolean and bolting "internal" on as a second flag
 (two booleans encode four states, one nonsensical); a dedicated POST route per
 repo path (impossible — repo paths are variable-length under groups); refusing
 push-to-create (an extra round-trip to the CLes/UI for every new repo).
 **Rationale:** three named states model real instances (internal is the common
 "logged-in only" tier) and keep `access` a single exhaustively-tested function —
 its matrix test now enumerates all three visibilities × viewer kinds × the anon
 flag. `allow_anonymous` now gates only anonymous access to *public* repos, which
 is what it always meant. The fixed `/repo-settings/{id}` prefix sidesteps the
 catch-all cleanly and keys on the id (rename-safe). Push-to-create matches the
 muscle memory of every other forge and stays safe: only the authenticated owner
 (or an admin) can trigger it, and only on receive-pack.