hanna/fabrica

feat(ssh): push-to-create a private repo on first push

8a86690 · hanna committed on 2026-07-25

A push (receive-pack) to a non-existent repo owned by the authenticated
user — or by an admin — now auto-creates it at the instance default
visibility: any missing group prefix, the database row, and the bare repo on
disk (rolled back if the on-disk step fails). Any other case stays a 404 so a
stranger cannot probe for repositories. Also log this session's visibility,
settings, and push-to-create decisions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/ssh/src/server.rs +72 −3

docs/decisions.md +32 −0

             .ok()
             .flatten()
             .ok_or_else(not_found)?;
-        let repo = self
+        let existing = self
             .shared
             .store
             .repo_by_owner_path(&owner_user.id, repo_path)
             .await
             .ok()
-            .flatten()
+            .flatten();
-            .ok_or_else(not_found)?;
+        // Push-to-create: a push (receive-pack) to a non-existent repo owned by
+        // the pushing user (or by an admin) auto-creates it, at the instance
+        // default visibility. Any other case is a 404 so a stranger cannot probe
+        // for repositories.
+        let repo = if let Some(repo) = existing {
+            repo
+        } else if matches!(service, git::pack::Service::ReceivePack)
+            && (identity.user_id == owner_user.id || identity.is_admin)
+        {
+            self.create_on_push(&owner_user, repo_path).await?
+        } else {
+            return Err(not_found());
+        };
         let collaborator = self
             .shared
             Err(not_found())
+        }
+    }
+    /// Create a repository on first push: any missing group prefix, the database
+    /// row (visibility = instance default), and the bare repo on disk. Rolls the
+    /// row back if the on-disk creation fails.
+    async fn create_on_push(
+        &self,
+        owner: &model::User,
+        repo_path: &str,
+    ) -> Result<model::Repo, String> {
+        let (group_path, leaf) = match repo_path.rsplit_once('/') {
+            Some((group, leaf)) => (Some(group), leaf),
+            None => (None, repo_path),
+        };
+        let group_id = match group_path {
+            Some(gp) => Some(
+                self.shared
+                    .store
+                    .ensure_group_path(&owner.id, gp)
+                    .await
+                    .map_err(|e| e.to_string())?
+                    .id,
+            ),
+            None => None,
+        };
+        let branch = self.shared.config.instance.default_branch.clone();
+        let visibility = model::Visibility::from_token(
+            self.shared.config.instance.default_visibility.as_token(),
+        )
+        .unwrap_or(model::Visibility::Private);
+        let repo = self
+            .shared
+            .store
+            .create_repo(store::NewRepo {
+                owner_id: owner.id.clone(),
+                group_id,
+                name: leaf.to_string(),
+                path: repo_path.to_string(),
+                description: None,
+                visibility,
+                default_branch: branch.clone(),
+            })
+            .await
+            .map_err(|e| e.to_string())?;
+        let hook = std::env::current_exe().unwrap_or_else(|_| std::path::PathBuf::from("fabrica"));
+        if let Err(err) = git::create_bare(
+            &self.shared.config.storage.repo_dir,
+            &repo.id,
+            &branch,
+            &hook,
+        ) {
+            let _ = self.shared.store.delete_repo(&repo.id).await;
+            return Err(format!("Could not create repository: {err}"));
+        }
+        tracing::info!(owner = %owner.username, path = %repo_path, "push-to-create: repository created");
+        Ok(repo)
+    }
+}
 /// Run the SSH server until the process exits. A no-op when `ssh.enabled` is false.

 is refused so no user-supplied markup is ever served, while our own identicons are
 SVG. Both mutating routes (`POST /settings`, `POST /settings/avatar`) verify the
 double-submit CSRF token; `/settings` redirects anonymous visitors to `/login`.
+## 2026-07-25 — Three-level visibility, repo settings, and SSH push-to-create
+**Decision:** Repositories carry a GitLab-style **visibility** — `public`
+(everyone, anonymous gated by `allow_anonymous`), `internal` (any signed-in
+user), or `private` (owner/collaborators/admins) — replacing the old two-state
+`is_private` flag. `auth::access` decides read on visibility after the
+admin/owner/collaborator rules; `instance.default_visibility` (default `private`)
+sets the default for new repos. Owners/admins get a **Settings** repo tab
+(rename, visibility, delete) whose mutations post to a fixed `/repo-settings/{id}`
+prefix (never colliding with the `/{owner}/{*rest}` catch-all) and re-check Admin
+access, returning `404` — never `403` — to non-admins. An SSH **push to a
+non-existent repo** owned by the pushing user (or an admin) **auto-creates** it at
+the default visibility (row + bare repo on disk, rolled back on disk failure).
+**Migration:** `0004_repo_visibility` adds a `visibility TEXT NOT NULL DEFAULT
+'private'` column backfilled from `is_private`; the `is_private` column is left in
+place (SQLite cannot drop columns) but no longer read or written.
+**Alternatives:** keeping the boolean and bolting "internal" on as a second flag
+(two booleans encode four states, one nonsensical); a dedicated POST route per
+repo path (impossible — repo paths are variable-length under groups); refusing
+push-to-create (an extra round-trip to the CLes/UI for every new repo).
+**Rationale:** three named states model real instances (internal is the common
+"logged-in only" tier) and keep `access` a single exhaustively-tested function —
+its matrix test now enumerates all three visibilities × viewer kinds × the anon
+flag. `allow_anonymous` now gates only anonymous access to *public* repos, which
+is what it always meant. The fixed `/repo-settings/{id}` prefix sidesteps the
+catch-all cleanly and keys on the id (rename-safe). Push-to-create matches the
+muscle memory of every other forge and stays safe: only the authenticated owner
+(or an admin) can trigger it, and only on receive-pack.