hanna/fabrica

feat(web): repo settings tab (rename, visibility, delete)

dc5c1a3 · hanna committed on 2026-07-25

Add an owner/admin-only Settings tab to repositories with a General section
(rename + public/internal/private visibility) and a danger zone that deletes
the repo (row removed, on-disk copy moved to trash). Mutations post to a
fixed /repo-settings/{id}/... prefix that never collides with the repo
catch-all, verify CSRF, and re-check Admin access — a non-admin gets a 404,
never confirmation the repo exists.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +13 −0

crates/web/src/lib.rs +4 −0

crates/web/src/repo.rs +217 −7

crates/web/src/tests.rs +43 −0


			@@ -265,6 +265,19 @@ body.drawer-open .drawer-backdrop {
265	265		border-color: var(--fb-danger);
266	266		color: var(--fb-danger);
267	267		}
	268	+	.btn-danger:hover {
	269	+	background: var(--fb-danger);
	270	+	color: var(--fb-accent-fg, #fff);
	271	+	border-color: var(--fb-danger);
	272	+	}
	273	+
	274	+	/* Repo settings danger zone. */
	275	+	.danger-zone {
	276	+	border-color: var(--fb-danger);
	277	+	}
	278	+	.danger-zone p {
	279	+	margin-top: 0;
	280	+	}
268	281
269	282		label {
270	283		display: block;

@@ @@ -145,6 +145,10 @@ pub fn build_router(state: AppState) -> Router { @@
         .route("/settings/avatar", post(avatar::upload))
         .route("/settings/theme", get(pages::set_theme))
         .route("/avatar/{username}", get(avatar::show))
         // Repo administration (owner/admin only; enforced in the handlers). A
         // fixed prefix so it never collides with the `/{owner}/{*rest}` catch-all.
         .route("/repo-settings/{id}/general", post(repo::settings_general))
         .route("/repo-settings/{id}/delete", post(repo::settings_delete))
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

+}
 #[tokio::test]
 async fn repo_settings_are_owner_only() {
     let (state, app) = app().await;
     let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
     let repo = state
         .store
         .create_repo(NewRepo {
             owner_id: ada.id,
             group_id: None,
             name: "proj".to_string(),
             path: "proj".to_string(),
             description: None,
             visibility: model::Visibility::Private,
             default_branch: "main".to_string(),
         })
         .await
         .unwrap();
     // Anonymous visitor: a private repo's settings are a 404, not a 403.
     let res = app
         .clone()
         .oneshot(get("/ada/proj/-/settings"))
         .await
         .unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
     // The owner sees the settings page with the delete form.
     let cookie = login(&app).await;
     let req = Request::builder()
         .uri("/ada/proj/-/settings")
         .header(header::COOKIE, cookie)
         .body(Body::empty())
         .unwrap();
     let res = app.oneshot(req).await.unwrap();
     assert_eq!(res.status(), StatusCode::OK);
     let html = body_string(res).await;
     assert!(html.contains("Danger zone"), "danger zone shown");
     assert!(
         html.contains(&format!("/repo-settings/{}/delete", repo.id)),
         "delete action targets the repo id"
     );
+}
 #[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;
     let res = app.oneshot(get("/settings")).await.unwrap();

@@ @@ -14,12 +14,13 @@ @@
 use std::collections::HashMap;
 use std::path::Path as FsPath;
 use axum::Form;
 use axum::extract::{Path, Query, State};
 use axum::http::{HeaderMap, Uri, header};
 use axum::response::{Html, IntoResponse, Response};
 use axum::response::{Html, IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
 use maud::{Markup, html};
 use model::{Repo, User};
 use model::{Repo, User, Visibility};
 use serde::Deserialize;
 use crate::AppState;
@@ @@ -29,7 +30,7 @@ use crate::icons::{Icon, icon}; @@
 use crate::layout::page;
 use crate::markdown;
 use crate::pages::build_chrome;
 use crate::session::MaybeUser;
 use crate::session::{MaybeUser, verify_csrf};
 /// The diff-view preference cookie (`unified` | `split`).
 const DIFF_COOKIE: &str = "fabrica_diffview";
@@ @@ -63,15 +64,15 @@ enum Tab { @@
     Branches,
     Tags,
     Search,
     Settings,
+}
 /// A resolved repository plus the viewer's access to it.
 pub(crate) struct RepoCtx {
     pub(crate) owner: User,
     pub(crate) repo: Repo,
     /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
     /// in later phases; every browse view here requires only `Read`.
     #[allow(dead_code)]
     /// The viewer's access level, used to gate the Settings tab and its actions.
     /// Every browse view requires only `Read`.
     pub(crate) access: auth::Access,
+}
@@ @@ -288,7 +289,8 @@ async fn dispatch_view( @@
             let raw_query = dq.q.clone().unwrap_or_default();
             crate::search::in_repo(state, viewer, jar, uri, &ctx, &raw_query, header).await
+        }
         // Reserved `runs`/`settings` slots return 404 until built.
         "settings" => repo_settings_view(state, viewer, jar, uri, ctx).await,
         // Reserved `runs` slot returns 404 until built.
         _ => Err(AppError::NotFound),
+    }
+}
@@ @@ -707,6 +709,211 @@ async fn tags_view( @@
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Settings (owner/admin only) ----
 /// `GET …/-/settings` — the repo admin page: rename, visibility, and delete.
 /// Returns `404` for anyone without `Admin` access (existence never leaks).
 async fn repo_settings_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     if ctx.access != auth::Access::Admin {
         return Err(AppError::NotFound);
+    }
     let branches = branch_names(state, &ctx.repo.id).await;
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let id = &ctx.repo.id;
     let vis = ctx.repo.visibility;
     let vis_option = |value: Visibility, label: &str| {
         html! {
             option value=(value.as_str()) selected[vis == value] { (label) }
+        }
     };
     let body = html! {
         (repo_header(state, &ctx, Tab::Settings, &ctx.repo.default_branch, &branches))
         section class="listing" {
             h2 { "General" }
             div class="card" {
                 form method="post" action=(format!("/repo-settings/{id}/general")) {
                     input type="hidden" name="_csrf" value=(chrome.csrf);
                     label for="name" { "Repository name" }
                     input type="text" id="name" name="name" value=(ctx.repo.name) required;
                     label for="visibility" { "Visibility" }
                     select id="visibility" name="visibility" {
                         (vis_option(Visibility::Public, "Public — visible to everyone"))
                         (vis_option(Visibility::Internal, "Internal — any signed-in user"))
                         (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                    }
                     button class="btn btn-primary" type="submit" { "Save changes" }
+                }
+            }
+        }
         section class="listing" {
             h2 { "Danger zone" }
             div class="card danger-zone" {
                 p { strong { "Delete this repository." } " This permanently removes it from fabrica; the on-disk copy is moved to trash." }
                 form method="post" action=(format!("/repo-settings/{id}/delete")) {
                     input type="hidden" name="_csrf" value=(chrome.csrf);
                     button class="btn btn-danger" type="submit" { "Delete repository" }
+                }
+            }
+        }
     };
     let title = format!("{}/{}: settings", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 /// Resolve a repo by id and require the viewer to have `Admin` access, else a
 /// `404` (so a non-admin cannot even confirm the repo exists).
 async fn require_admin_repo(
     state: &AppState,
     viewer: Option<&User>,
     repo_id: &str,
 ) -> AppResult<Repo> {
     let repo = state
         .store
         .repo_by_id(repo_id)
         .await?
         .ok_or(AppError::NotFound)?;
     let viewer_id = viewer.map(|u| auth::Viewer {
         id: u.id.clone(),
         is_admin: u.is_admin,
     });
     let collab = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
     };
     let access = auth::access(
         viewer_id.as_ref(),
         &repo,
         collab,
         state.config.instance.allow_anonymous,
     );
     if access == auth::Access::Admin {
         Ok(repo)
     } else {
         Err(AppError::NotFound)
+    }
+}
 /// The repo general-settings form (rename + visibility).
 #[derive(Debug, Deserialize)]
 pub struct RepoGeneralForm {
     /// The new leaf name (the group prefix is preserved).
     #[serde(default)]
     name: String,
     /// The chosen visibility token.
     #[serde(default)]
     visibility: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /repo-settings/{id}/general` — rename and set visibility.
 pub async fn settings_general(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<RepoGeneralForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
         // Preserve any group prefix; only the leaf changes.
         let new_name = form.name.trim();
         let new_path = match repo.path.rsplit_once('/') {
             Some((group, _)) => format!("{group}/{new_name}"),
             None => new_name.to_string(),
         };
         state
             .store
             .rename_repo(&repo.id, new_name, &new_path)
             .await?;
         if let Some(vis) = Visibility::from_token(&form.visibility) {
             state.store.set_visibility(&repo.id, vis).await?;
+        }
         let owner = state
             .store
             .user_by_id(&repo.owner_id)
             .await?
             .map_or_else(|| repo.owner_id.clone(), |u| u.username);
         Ok::<String, AppError>(format!("/{owner}/{new_path}/-/settings"))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}
 /// The repo delete form (CSRF only).
 #[derive(Debug, Deserialize)]
 pub struct RepoDeleteForm {
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /repo-settings/{id}/delete` — delete the repo row and move its on-disk
 /// directory to trash.
 pub async fn settings_delete(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<RepoDeleteForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let repo = require_admin_repo(&state, viewer.as_ref(), &id).await?;
         let owner = state
             .store
             .user_by_id(&repo.owner_id)
             .await?
             .map_or_else(|| repo.owner_id.clone(), |u| u.username);
         state.store.delete_repo(&repo.id).await?;
         // Best-effort: move the on-disk directory to trash. A failure here does
         // not fail the request — the repo is already unreachable through fabrica.
         if let Ok(dir) = git::repo_path(&state.config.storage.repo_dir, &repo.id)
             && dir.exists()
+        {
             let trash = state.config.storage.data_dir.join("trash").join(format!(
                 "{}-{}.git",
                 repo.id,
                 crate::now_ms()
             ));
             if let Some(parent) = trash.parent() {
                 let _ = std::fs::create_dir_all(parent);
+            }
             if let Err(err) = std::fs::rename(&dir, &trash) {
                 tracing::warn!(repo = %repo.id, %err, "could not move deleted repo to trash");
+            }
+        }
         Ok::<String, AppError>(format!("/{owner}"))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}
 // ---- Commit list ----
 async fn commits_view(
@@ @@ -1348,6 +1555,9 @@ fn repo_header( @@
                     (tab(Tab::Commits, "Commits", Icon::History, format!("{base}/-/commits/{rev}")))
                     (tab(Tab::Branches, "Branches", Icon::GitBranch, format!("{base}/-/branches")))
                     (tab(Tab::Tags, "Tags", Icon::Box, format!("{base}/-/tags")))
                     @if ctx.access == auth::Access::Admin {
                         (tab(Tab::Settings, "Settings", Icon::Settings, format!("{base}/-/settings")))
+                    }
+                }
                 div class="repo-actions" {
                     (branch_menu(&base, rev, branches))