hanna/fabrica

feat(web): repo settings tab (rename, visibility, delete)

dc5c1a3 · hanna committed on 2026-07-25

Add an owner/admin-only Settings tab to repositories with a General section
(rename + public/internal/private visibility) and a danger zone that deletes
the repo (row removed, on-disk copy moved to trash). Mutations post to a
fixed /repo-settings/{id}/... prefix that never collides with the repo
catch-all, verify CSRF, and re-check Admin access — a non-admin gets a 404,
never confirmation the repo exists.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +13 −0

crates/web/src/lib.rs +4 −0

crates/web/src/repo.rs +217 −7

crates/web/src/tests.rs +43 −0

   border-color: var(--fb-danger);
   color: var(--fb-danger);
+}
+.btn-danger:hover {
+  background: var(--fb-danger);
+  color: var(--fb-accent-fg, #fff);
+  border-color: var(--fb-danger);
+}
+/* Repo settings danger zone. */
+.danger-zone {
+  border-color: var(--fb-danger);
+}
+.danger-zone p {
+  margin-top: 0;
+}
 label {
   display: block;

         .route("/settings/avatar", post(avatar::upload))
         .route("/settings/theme", get(pages::set_theme))
         .route("/avatar/{username}", get(avatar::show))
+        // Repo administration (owner/admin only; enforced in the handlers). A
+        // fixed prefix so it never collides with the `/{owner}/{*rest}` catch-all.
+        .route("/repo-settings/{id}/general", post(repo::settings_general))
+        .route("/repo-settings/{id}/delete", post(repo::settings_delete))
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

+}
 #[tokio::test]
+async fn repo_settings_are_owner_only() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Private,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    // Anonymous visitor: a private repo's settings are a 404, not a 403.
+    let res = app
+        .clone()
+        .oneshot(get("/ada/proj/-/settings"))
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+    // The owner sees the settings page with the delete form.
+    let cookie = login(&app).await;
+    let req = Request::builder()
+        .uri("/ada/proj/-/settings")
+        .header(header::COOKIE, cookie)
+        .body(Body::empty())
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("Danger zone"), "danger zone shown");
+    assert!(
+        html.contains(&format!("/repo-settings/{}/delete", repo.id)),
+        "delete action targets the repo id"
+    );
+}
+#[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;
     let res = app.oneshot(get("/settings")).await.unwrap();

 use std::collections::HashMap;
 use std::path::Path as FsPath;
+use axum::Form;
 use axum::extract::{Path, Query, State};
 use axum::http::{HeaderMap, Uri, header};
-use axum::response::{Html, IntoResponse, Response};
+use axum::response::{Html, IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
 use maud::{Markup, html};
-use model::{Repo, User};
+use model::{Repo, User, Visibility};
 use serde::Deserialize;
 use crate::AppState;
 use crate::layout::page;
 use crate::markdown;
 use crate::pages::build_chrome;
-use crate::session::MaybeUser;
+use crate::session::{MaybeUser, verify_csrf};
 /// The diff-view preference cookie (`unified` | `split`).
 const DIFF_COOKIE: &str = "fabrica_diffview";
     Branches,
     Tags,
     Search,
+    Settings,
+}
 /// A resolved repository plus the viewer's access to it.
 pub(crate) struct RepoCtx {
     pub(crate) owner: User,
     pub(crate) repo: Repo,
-    /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
+    /// The viewer's access level, used to gate the Settings tab and its actions.
-    /// in later phases; every browse view here requires only `Read`.
+    /// Every browse view requires only `Read`.
-    #[allow(dead_code)]
     pub(crate) access: auth::Access,
+}
             let raw_query = dq.q.clone().unwrap_or_default();
             crate::search::in_repo(state, viewer, jar, uri, &ctx, &raw_query, header).await
+        }
-        // Reserved `runs`/`settings` slots return 404 until built.
+        "settings" => repo_settings_view(state, viewer, jar, uri, ctx).await,
+        // Reserved `runs` slot returns 404 until built.
         _ => Err(AppError::NotFound),
+    }
+}
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Settings (owner/admin only) ----
+/// `GET …/-/settings` — the repo admin page: rename, visibility, and delete.
+/// Returns `404` for anyone without `Admin` access (existence never leaks).
+async fn repo_settings_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+) -> AppResult<Response> {
+    if ctx.access != auth::Access::Admin {
+        return Err(AppError::NotFound);
+    }
+    let branches = branch_names(state, &ctx.repo.id).await;
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let id = &ctx.repo.id;
+    let vis = ctx.repo.visibility;
+    let vis_option = |value: Visibility, label: &str| {
+        html! {
+            option value=(value.as_str()) selected[vis == value] { (label) }
+        }
+    };
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Settings, &ctx.repo.default_branch, &branches))
+        section class="listing" {
+            h2 { "General" }
+            div class="card" {
+                form method="post" action=(format!("/repo-settings/{id}/general")) {
+                    input type="hidden" name="_csrf" value=(chrome.csrf);
+                    label for="name" { "Repository name" }
+                    input type="text" id="name" name="name" value=(ctx.repo.name) required;
+                    label for="visibility" { "Visibility" }
+                    select id="visibility" name="visibility" {
+                        (vis_option(Visibility::Public, "Public — visible to everyone"))
+                        (vis_option(Visibility::Internal, "Internal — any signed-in user"))
+                        (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                    }
+                    button class="btn btn-primary" type="submit" { "Save changes" }
+                }
+            }
+        }
+        section class="listing" {
+            h2 { "Danger zone" }
+            div class="card danger-zone" {
+                p { strong { "Delete this repository." } " This permanently removes it from fabrica; the on-disk copy is moved to trash." }
+                form method="post" action=(format!("/repo-settings/{id}/delete")) {
+                    input type="hidden" name="_csrf" value=(chrome.csrf);
+                    button class="btn btn-danger" type="submit" { "Delete repository" }
+                }
+            }
+        }
+    };
+    let title = format!("{}/{}: settings", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// Resolve a repo by id and require the viewer to have `Admin` access, else a
+/// `404` (so a non-admin cannot even confirm the repo exists).
+async fn require_admin_repo(
+    state: &AppState,
+    viewer: Option<&User>,
+    repo_id: &str,
+) -> AppResult<Repo> {
+    let repo = state
+        .store
+        .repo_by_id(repo_id)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    let viewer_id = viewer.map(|u| auth::Viewer {
+        id: u.id.clone(),
+        is_admin: u.is_admin,
+    });
+    let collab = match viewer {
+        Some(u) => state
+            .store
+            .collaborator_permission(&repo.id, &u.id)
+            .await?
+            .and_then(|p| auth::Permission::parse(&p)),
+        None => None,
+    };
+    let access = auth::access(
+        viewer_id.as_ref(),
+        &repo,
+        collab,
+        state.config.instance.allow_anonymous,
+    );
+    if access == auth::Access::Admin {
+        Ok(repo)
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+/// The repo general-settings form (rename + visibility).
+#[derive(Debug, Deserialize)]
+pub struct RepoGeneralForm {
+    /// The new leaf name (the group prefix is preserved).
+    #[serde(default)]
+    name: String,
+    /// The chosen visibility token.
+    #[serde(default)]
+    visibility: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /repo-settings/{id}/general` — rename and set visibility.
+pub async fn settings_general(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<RepoGeneralForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
+        // Preserve any group prefix; only the leaf changes.
+        let new_name = form.name.trim();
+        let new_path = match repo.path.rsplit_once('/') {
+            Some((group, _)) => format!("{group}/{new_name}"),
+            None => new_name.to_string(),
+        };
+        state
+            .store
+            .rename_repo(&repo.id, new_name, &new_path)
+            .await?;
+        if let Some(vis) = Visibility::from_token(&form.visibility) {
+            state.store.set_visibility(&repo.id, vis).await?;
+        }
+        let owner = state
+            .store
+            .user_by_id(&repo.owner_id)
+            .await?
+            .map_or_else(|| repo.owner_id.clone(), |u| u.username);
+        Ok::<String, AppError>(format!("/{owner}/{new_path}/-/settings"))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The repo delete form (CSRF only).
+#[derive(Debug, Deserialize)]
+pub struct RepoDeleteForm {
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /repo-settings/{id}/delete` — delete the repo row and move its on-disk
+/// directory to trash.
+pub async fn settings_delete(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<RepoDeleteForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
+        let owner = state
+            .store
+            .user_by_id(&repo.owner_id)
+            .await?
+            .map_or_else(|| repo.owner_id.clone(), |u| u.username);
+        state.store.delete_repo(&repo.id).await?;
+        // Best-effort: move the on-disk directory to trash. A failure here does
+        // not fail the request — the repo is already unreachable through fabrica.
+        if let Ok(dir) = git::repo_path(&state.config.storage.repo_dir, &repo.id)
+            && dir.exists()
+        {
+            let trash = state.config.storage.data_dir.join("trash").join(format!(
+                "{}-{}.git",
+                repo.id,
+                crate::now_ms()
+            ));
+            if let Some(parent) = trash.parent() {
+                let _ = std::fs::create_dir_all(parent);
+            }
+            if let Err(err) = std::fs::rename(&dir, &trash) {
+                tracing::warn!(repo = %repo.id, %err, "could not move deleted repo to trash");
+            }
+        }
+        Ok::<String, AppError>(format!("/{owner}"))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
 // ---- Commit list ----
 async fn commits_view(
                     (tab(Tab::Commits, "Commits", Icon::History, format!("{base}/-/commits/{rev}")))
                     (tab(Tab::Branches, "Branches", Icon::GitBranch, format!("{base}/-/branches")))
                     (tab(Tab::Tags, "Tags", Icon::Box, format!("{base}/-/tags")))
+                    @if ctx.access == auth::Access::Admin {
+                        (tab(Tab::Settings, "Settings", Icon::Settings, format!("{base}/-/settings")))
+                    }
+                }
                 div class="repo-actions" {
                     (branch_menu(&base, rev, branches))