hanna/fabrica

feat(web): per-group settings, manual creation, and permission cascade

dea5315 · hanna committed on 2026-07-26

Add a manual group-creation form (`/new/group`) and a per-group settings page
(`/group-settings/{id}`) for renaming, visibility, collaborator management, and
deleting empty manual groups. The group listing enforces group visibility —
a private group 404s for non-members — and shows admin controls (new subgroup,
settings) inline.

Route repo access decisions through `effective_permission` so group
collaborators gain access to repos within the group, across the web UI, the
git-over-HTTP transport, and SSH.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +14 −0

crates/ssh/src/server.rs +2 −2

crates/web/src/git_http.rs +1 −1

crates/web/src/groups.rs +551 −0

crates/web/src/issues.rs +2 −2

crates/web/src/layout.rs +3 −0

crates/web/src/lib.rs +16 −0

crates/web/src/repo.rs +33 −13

crates/web/src/search.rs +1 −1

@@ @@ -2069,6 +2069,20 @@ pre.code { @@
 .repo-head {
   margin-bottom: 1.25rem;
+}
 /* Group listing header: slug on the left, admin actions on the right. */
 .group-head {
   display: flex;
   align-items: center;
   justify-content: space-between;
   gap: 1rem;
   flex-wrap: wrap;
   margin-bottom: 1.25rem;
+}
 .group-head-actions {
   display: flex;
   align-items: center;
   gap: 0.5rem;
+}
 /* "forked from owner/repo" line under the repo slug. */
 .fork-note {
   display: flex;

@@ @@ -295,7 +295,7 @@ impl GitHandler { @@
         let collaborator = self
             .shared
             .store
             .collaborator_permission(&repo.id, &identity.user_id)
             .effective_permission(&repo.id, &identity.user_id)
             .await
             .ok()
             .flatten()
@@ @@ -405,7 +405,7 @@ impl GitHandler { @@
         let collaborator = self
             .shared
             .store
             .collaborator_permission(&repo.id, &identity.user_id)
             .effective_permission(&repo.id, &identity.user_id)
             .await
             .ok()
             .flatten()

@@ @@ -237,7 +237,7 @@ pub(crate) async fn authorize( @@
     let collaborator = match &viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .effective_permission(&repo.id, &u.id)
             .await
             .ok()
             .flatten()

@@ @@ -658,7 +658,7 @@ pub(crate) async fn access_for( @@
     let collab = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .effective_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
@@ @@ -770,7 +770,7 @@ pub(crate) async fn notify_mentions( @@
         };
         let collab = state
             .store
             .collaborator_permission(&repo.id, &user.id)
             .effective_permission(&repo.id, &user.id)
             .await
             .ok()
             .flatten()


			@@ -105,6 +105,9 @@ fn create_menu(_chrome: &Chrome) -> Markup {
105	105		a class="menu-item" role="menuitem" href="/new/migrate" {
106	106		(icon(Icon::Download)) span { "New migration" }
107	107		}
	108	+	a class="menu-item" role="menuitem" href="/new/group" {
	109	+	(icon(Icon::Folder)) span { "New group" }
	110	+	}
108	111		a class="menu-item" role="menuitem" href="/new/issue" {
109	112		(icon(Icon::Issue)) span { "New issue" }
110	113		}

@@ @@ -0,0 +1,551 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Groups: manual creation and the per-group settings page (rename, visibility,
 //! collaborators, delete). Auto-created groups are garbage-collected by the store
 //! when their last repository leaves; only manual groups reach the delete control.
 use axum::Form;
 use axum::extract::{Path, Query, State};
 use axum::http::{HeaderMap, Uri};
 use axum::response::{IntoResponse, Redirect, Response};
 use axum_extra::extract::cookie::CookieJar;
 use maud::{Markup, html};
 use model::{Group, User, Visibility};
 use serde::Deserialize;
 use crate::AppState;
 use crate::error::{AppError, AppResult};
 use crate::icons::{Icon, icon};
 use crate::layout::page;
 use crate::pages::build_chrome;
 use crate::repo::path_crumbs;
 use crate::session::{MaybeUser, RequireUser, verify_csrf};
 /// Resolve the access `viewer` has to `group`, mirroring the repo rules: admin and
 /// owner get [`auth::Access::Admin`]; a group collaborator (on the group or an
 /// ancestor) gets their stored permission; otherwise the group's visibility
 /// decides read access, and everything else is [`auth::Access::None`].
 ///
 /// # Errors
 ///
 /// Returns [`AppError`] on a store failure.
 pub(crate) async fn group_access(
     state: &AppState,
     viewer: Option<&User>,
     group: &Group,
 ) -> AppResult<auth::Access> {
     if let Some(v) = viewer
         && (v.is_admin || v.id == group.owner_id)
+    {
         return Ok(auth::Access::Admin);
+    }
     if let Some(v) = viewer
         && let Some(p) = state
             .store
             .effective_group_permission(&group.id, &v.id)
             .await?
         && let Some(perm) = auth::Permission::parse(&p)
+    {
         return Ok(perm.into());
+    }
     let read = match group.visibility {
         Visibility::Public => viewer.is_some() || state.allow_anonymous(),
         Visibility::Internal => viewer.is_some(),
         Visibility::Private => false,
     };
     Ok(if read {
         auth::Access::Read
     } else {
         auth::Access::None
     })
+}
 /// Load a group by id and require the viewer be an admin of it, else 404 (never
 /// leak the group's existence).
 async fn require_admin_group(
     state: &AppState,
     viewer: Option<&User>,
     id: &str,
 ) -> AppResult<Group> {
     let group = state
         .store
         .group_by_id(id)
         .await?
         .ok_or(AppError::NotFound)?;
     if group_access(state, viewer, &group).await? == auth::Access::Admin {
         Ok(group)
     } else {
         Err(AppError::NotFound)
+    }
+}
 // ---- Manual creation ----
 /// `GET /new/group` — the manual group-creation form. An optional `?parent=path`
 /// prefills the path so "New subgroup" lands inside an existing group.
 pub async fn new_form(
     State(state): State<AppState>,
     RequireUser(user): RequireUser,
     jar: CookieJar,
     uri: Uri,
     Query(q): Query<NewGroupQuery>,
 ) -> Response {
     let (jar, chrome) = build_chrome(&state, jar, Some(user), uri.path().to_string());
     let prefill = q
         .parent
         .as_deref()
         .map(|p| format!("{}/", p.trim_matches('/')))
         .unwrap_or_default();
     let body = new_group_body(&chrome.csrf, None, &prefill);
     (jar, page(&chrome, "New group", body)).into_response()
+}
 /// Query for the new-group form.
 #[derive(Debug, Deserialize)]
 pub struct NewGroupQuery {
     /// Optional parent group path to prefill.
     parent: Option<String>,
+}
 /// New-group form fields.
 #[derive(Debug, Deserialize)]
 pub struct NewGroupForm {
     /// The group path (may be nested with `/`).
     #[serde(default)]
     path: String,
     /// Visibility token (`public` | `internal` | `private`).
     #[serde(default)]
     visibility: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /new/group` — create a manual group and redirect to it.
 pub async fn new_submit(
     State(state): State<AppState>,
     RequireUser(user): RequireUser,
     jar: CookieJar,
     headers: HeaderMap,
     Form(form): Form<NewGroupForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     match create_group_from_form(&state, &user, &form).await {
         Ok(path) => Redirect::to(&format!("/{}/{path}", user.username)).into_response(),
         Err(msg) => {
             let (jar, chrome) = build_chrome(&state, jar, Some(user), "/new/group".to_string());
             let body = new_group_body(&chrome.csrf, Some(&msg), form.path.trim());
+            (
                 axum::http::StatusCode::BAD_REQUEST,
                 jar,
                 page(&chrome, "New group", body),
+            )
                 .into_response()
+        }
+    }
+}
 /// Create the group described by `form`, returning its path or a user-facing error.
 async fn create_group_from_form(
     state: &AppState,
     user: &User,
     form: &NewGroupForm,
 ) -> Result<String, String> {
     let path = form.path.trim().trim_matches('/');
     if path.is_empty() {
         return Err("Group path is required.".to_string());
+    }
     // A group may not collide with an existing repository at the same path.
     if state
         .store
         .repo_by_owner_path(&user.id, path)
         .await
         .map_err(|e| e.to_string())?
         .is_some()
+    {
         return Err("A repository already exists at that path.".to_string());
+    }
     let group = state
         .store
         .create_group(&user.id, path)
         .await
         .map_err(|e| match e {
             store::StoreError::Conflict { .. } => "That group already exists.".to_string(),
             store::StoreError::Name(_) => {
                 "Invalid name: use letters, digits, '-', '_', and '/' for nesting.".to_string()
+            }
             other => other.to_string(),
         })?;
     if let Some(vis) = Visibility::from_token(&form.visibility) {
         let _ = state.store.set_group_visibility(&group.id, vis).await;
+    }
     Ok(group.path)
+}
 /// The new-group form body.
 fn new_group_body(csrf: &str, error: Option<&str>, prefill: &str) -> Markup {
     let vis_option = |value: Visibility, label: &str| {
         html! { option value=(value.as_str()) selected[value == Visibility::Private] { (label) } }
     };
     html! {
         h1 { "New group" }
         @if let Some(msg) = error { p class="form-error" { (msg) } }
         div class="card" {
             form method="post" action="/new/group" {
                 input type="hidden" name="_csrf" value=(csrf);
                 label for="path" { "Group path" }
                 input type="text" id="path" name="path" value=(prefill)
                       placeholder="team (or team/subteam)" autofocus required;
                 p class="muted field-hint" {
                     "Nest with '/'. Intermediate groups are created automatically."
+                }
                 label for="visibility" { "Visibility" }
                 select id="visibility" name="visibility" {
                     (vis_option(Visibility::Public, "Public — visible to everyone"))
                     (vis_option(Visibility::Internal, "Internal — any signed-in user"))
                     (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                }
                 div class="new-issue-actions" {
                     button class="btn btn-primary inline-btn" type="submit" { "Create group" }
+                }
+            }
+        }
+    }
+}
 // ---- Settings page ----
 /// `GET /group-settings/{id}` — the per-group settings page (admin only).
 pub async fn settings_view(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     uri: Uri,
     Path(id): Path<String>,
 ) -> Response {
     let result = async {
         let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
         let owner = state
             .store
             .user_by_id(&group.owner_id)
             .await?
             .map_or_else(|| group.owner_id.clone(), |u| u.username);
         let collaborators = state.store.list_group_collaborators(&group.id).await?;
         // A manual group may be deleted only once its subtree holds no repos and no
         // child groups, so the delete never orphans anything.
         let subtree_repos = state.store.group_subtree_repo_count(&group).await?;
         let all_groups = state.store.groups_by_owner(&group.owner_id).await?;
         let child_prefix = format!("{}/", group.path);
         let has_children = all_groups.iter().any(|g| g.path.starts_with(&child_prefix));
         let deletable = group.manual && subtree_repos == 0 && !has_children;
         let (jar, chrome) = build_chrome(&state, jar, viewer, uri.path().to_string());
         let gid = &group.id;
         let vis = group.visibility;
         let vis_option = |value: Visibility, label: &str| {
             html! { option value=(value.as_str()) selected[vis == value] { (label) } }
         };
         let crumbs = path_crumbs(&owner, &group.path);
         let body = html! {
             h1 class="repo-slug group-slug" {
                 (icon(Icon::Folder))
                 a href={ "/" (owner) } { (owner) }
                 @for (name, href) in &crumbs {
                     span class="slug-sep" { "/" }
                     a href=(href) { (name) }
+                }
+            }
             p class="muted" { "Group settings" }
             section class="listing" {
                 h2 { "General" }
                 div class="card" {
                     form id="group-general" method="post" action=(format!("/group-settings/{gid}/general")) {
                         input type="hidden" name="_csrf" value=(chrome.csrf);
                         label for="name" { "Group name" }
                         input type="text" id="name" name="name" value=(group.name) required;
                         label for="visibility" { "Visibility" }
                         select id="visibility" name="visibility" {
                             (vis_option(Visibility::Public, "Public — visible to everyone"))
                             (vis_option(Visibility::Internal, "Internal — any signed-in user"))
                             (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                        }
+                    }
                     div class="settings-actions" {
                         button class="btn btn-primary" type="submit" form="group-general" { "Save changes" }
+                    }
+                }
+            }
             (group_collaborators_section(gid, &chrome.csrf, &collaborators))
             section class="listing" {
                 h2 { "Danger zone" }
                 div class="card danger-zone" {
                     @if deletable {
                         p { strong { "Delete this group." } " This removes the group; it holds no repositories or subgroups." }
                         form method="post" action=(format!("/group-settings/{gid}/delete")) {
                             input type="hidden" name="_csrf" value=(chrome.csrf);
                             button class="btn btn-danger" type="submit" { "Delete group" }
+                        }
                     } @else if !group.manual {
                         p class="muted" { "Automatic groups are removed on their own once empty." }
                     } @else {
                         p class="muted" { "Empty the group of all repositories and subgroups before deleting it." }
+                    }
+                }
+            }
         };
         let title = format!("{owner}/{}: settings", group.path);
         Ok::<Response, AppError>((jar, page(&chrome, &title, body)).into_response())
+    }
     .await;
     result.unwrap_or_else(IntoResponse::into_response)
+}
 /// The group collaborators section: current members with remove buttons, add form.
 fn group_collaborators_section(
     id: &str,
     csrf: &str,
     collaborators: &[store::Collaborator],
 ) -> Markup {
     let perm_option = |value: &str, label: &str| html! { option value=(value) { (label) } };
     html! {
         section class="listing" {
             h2 { "Collaborators" }
             p class="muted field-hint" { "Group collaborators gain the same access to every repository within this group." }
             div class="card" {
                 @if collaborators.is_empty() {
                     p class="muted" { "No collaborators yet." }
                 } @else {
                     ul class="entry-list collab-list" {
                         @for c in collaborators {
                             li class="entry-row" {
                                 div class="entry-row-body" {
                                     a class="entry-row-title" href={ "/" (c.username) } { (c.username) }
                                     div class="entry-row-meta muted" { (c.permission) }
+                                }
                                 div class="entry-row-actions" {
                                     form method="post" action=(format!("/group-settings/{id}/collaborators/remove")) {
                                         input type="hidden" name="_csrf" value=(csrf);
                                         input type="hidden" name="user_id" value=(c.user_id);
                                         button class="btn btn-danger" type="submit" { "Remove" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
                 form class="collab-add" method="post" action=(format!("/group-settings/{id}/collaborators")) {
                     input type="hidden" name="_csrf" value=(csrf);
                     input type="text" name="username" placeholder="Username" aria-label="Username" required;
                     select name="permission" aria-label="Permission" {
                         (perm_option("read", "Read"))
                         (perm_option("write", "Write"))
                         (perm_option("admin", "Admin"))
+                    }
                     button class="btn btn-primary inline-btn" type="submit" { "Add" }
+                }
+            }
+        }
+    }
+}
 /// The group general-settings form (rename + visibility).
 #[derive(Debug, Deserialize)]
 pub struct GroupGeneralForm {
     /// The new leaf name (the parent prefix is preserved).
     #[serde(default)]
     name: String,
     /// The chosen visibility token.
     #[serde(default)]
     visibility: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /group-settings/{id}/general` — rename and set visibility.
 pub async fn settings_general(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<GroupGeneralForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
         let owner = state
             .store
             .user_by_id(&group.owner_id)
             .await?
             .map_or_else(|| group.owner_id.clone(), |u| u.username);
         let new_name = form.name.trim();
         let renamed = state
             .store
             .rename_group(&group.id, new_name)
             .await
             .map_err(|e| match e {
                 store::StoreError::Conflict { .. } => {
                     AppError::BadRequest("That name is already taken.".to_string())
+                }
                 store::StoreError::Name(_) => {
                     AppError::BadRequest("Invalid group name.".to_string())
+                }
                 other => AppError::from(other),
             })?;
         if let Some(vis) = Visibility::from_token(&form.visibility) {
             state.store.set_group_visibility(&group.id, vis).await?;
+        }
         let _ = owner;
         Ok::<String, AppError>(format!("/group-settings/{}", renamed.id))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}
 /// The add-collaborator form.
 #[derive(Debug, Deserialize)]
 pub struct CollaboratorAddForm {
     /// The collaborator's username.
     #[serde(default)]
     username: String,
     /// The permission to grant (`read` | `write` | `admin`).
     #[serde(default)]
     permission: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /group-settings/{id}/collaborators` — add or update a group collaborator.
 pub async fn settings_collaborator_add(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<CollaboratorAddForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
         let permission = auth::Permission::parse(&form.permission)
             .ok_or_else(|| AppError::BadRequest("Invalid permission.".to_string()))?;
         let target = state
             .store
             .user_by_username(form.username.trim())
             .await?
             .ok_or_else(|| AppError::BadRequest("No such user.".to_string()))?;
         // The owner is already an admin; adding them is a no-op.
         if target.id != group.owner_id {
             state
                 .store
                 .add_group_collaborator(&group.id, &target.id, permission.as_str())
                 .await?;
+        }
         Ok::<String, AppError>(format!("/group-settings/{}", group.id))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}
 /// The remove-collaborator form.
 #[derive(Debug, Deserialize)]
 pub struct CollaboratorRemoveForm {
     /// The collaborator's user id.
     #[serde(default)]
     user_id: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /group-settings/{id}/collaborators/remove` — remove a group collaborator.
 pub async fn settings_collaborator_remove(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<CollaboratorRemoveForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
         state
             .store
             .remove_group_collaborator(&group.id, &form.user_id)
             .await?;
         Ok::<String, AppError>(format!("/group-settings/{}", group.id))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}
 /// The group delete form (CSRF only).
 #[derive(Debug, Deserialize)]
 pub struct GroupDeleteForm {
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
+}
 /// `POST /group-settings/{id}/delete` — delete an empty manual group.
 pub async fn settings_delete(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     Path(id): Path<String>,
     Form(form): Form<GroupDeleteForm>,
 ) -> Response {
     if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
         return AppError::Forbidden.into_response();
+    }
     let result = async {
         let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
         let owner = state
             .store
             .user_by_id(&group.owner_id)
             .await?
             .map_or_else(|| group.owner_id.clone(), |u| u.username);
         // Guard against orphaning: refuse unless manual and the subtree is empty.
         let subtree_repos = state.store.group_subtree_repo_count(&group).await?;
         let all_groups = state.store.groups_by_owner(&group.owner_id).await?;
         let child_prefix = format!("{}/", group.path);
         let has_children = all_groups.iter().any(|g| g.path.starts_with(&child_prefix));
         if !group.manual || subtree_repos != 0 || has_children {
             return Err(AppError::BadRequest(
                 "This group cannot be deleted while it is not empty.".to_string(),
             ));
+        }
         state.store.delete_group(&group.id).await?;
         // Deleting this manual group may leave its (auto) parent empty.
         state.store.gc_empty_groups(group.parent_id.clone()).await?;
         Ok::<String, AppError>(format!("/{owner}"))
+    }
     .await;
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),
+    }
+}

@@ @@ -17,6 +17,7 @@ mod avatar; @@
 mod diff;
 mod error;
 mod git_http;
 mod groups;
 mod icons;
 mod issues;
 mod languages;
@@ @@ -221,6 +222,7 @@ pub fn build_router(state: AppState) -> Router { @@
+        )
         .route("/new/issue", get(pages::new_issue_chooser))
         .route("/new/pull", get(pages::new_pull_chooser))
         .route("/new/group", get(groups::new_form).post(groups::new_submit))
         .route("/explore", get(pages::explore))
         .route("/explore/users", get(pages::explore_users))
         .route("/login", get(pages::login_form).post(pages::login_submit))
@@ @@ -321,6 +323,20 @@ pub fn build_router(state: AppState) -> Router { @@
             "/repo-fork/{id}",
             get(repo::fork_confirm).post(repo::fork_create),
+        )
         .route("/group-settings/{id}", get(groups::settings_view))
         .route(
             "/group-settings/{id}/general",
             post(groups::settings_general),
+        )
         .route(
             "/group-settings/{id}/collaborators",
             post(groups::settings_collaborator_add),
+        )
         .route(
             "/group-settings/{id}/collaborators/remove",
             post(groups::settings_collaborator_remove),
+        )
         .route("/group-settings/{id}/delete", post(groups::settings_delete))
         .route("/repo-bookmark/{id}", get(repo::bookmark_toggle))
         .route("/user-follow/{username}", get(repo::follow_toggle))
         .route("/notifications", get(notifications::list))

@@ @@ -137,7 +137,7 @@ pub(crate) async fn resolve( @@
     let collaborator = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .effective_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
@@ @@ -551,7 +551,7 @@ async fn filter_readable( @@
         let collab = match viewer {
             Some(v) => state
                 .store
                 .collaborator_permission(&repo.id, &v.id)
                 .effective_permission(&repo.id, &v.id)
                 .await?
                 .and_then(|p| auth::Permission::parse(&p)),
             None => None,
@@ @@ -1852,7 +1852,7 @@ pub(crate) async fn require_readable_repo( @@
     let collaborator = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .effective_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
@@ @@ -2083,7 +2083,7 @@ async fn require_admin_repo( @@
     let collab = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .effective_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
@@ @@ -2793,6 +2793,13 @@ async fn group_listing( @@
         return Err(AppError::NotFound);
     };
     // A private group is invisible to non-members (404, never 403).
     let access = crate::groups::group_access(state, viewer.as_ref(), &group).await?;
     if access == auth::Access::None {
         return Err(AppError::NotFound);
+    }
     let is_admin = access == auth::Access::Admin;
     let all_groups = state.store.groups_by_owner(&owner.id).await?;
     let prefix = format!("{group_path}/");
     let subgroups: Vec<_> = all_groups
@@ @@ -2807,12 +2814,25 @@ async fn group_listing( @@
     let crumbs = path_crumbs(&owner.username, &group.path);
     let body = html! {
         h1 class="repo-slug group-slug" {
             (icon(Icon::Folder))
             a href={ "/" (owner.username) } { (owner.username) }
             @for (name, href) in &crumbs {
                 span class="slug-sep" { "/" }
                 a href=(href) { (name) }
         div class="group-head" {
             h1 class="repo-slug group-slug" {
                 (icon(Icon::Folder))
                 a href={ "/" (owner.username) } { (owner.username) }
                 @for (name, href) in &crumbs {
                     span class="slug-sep" { "/" }
                     a href=(href) { (name) }
+                }
+            }
             @if is_admin {
                 div class="group-head-actions" {
                     a class="btn inline-btn" href=(format!("/new/group?parent={}", group.path)) {
                         (icon(Icon::Plus)) span { "New subgroup" }
+                    }
                     a class="btn inline-btn" href=(format!("/group-settings/{}", group.id))
                       title="Group settings" aria-label="Group settings" {
                         (icon(Icon::Settings))
+                    }
+                }
+            }
+        }
         @if !subgroups.is_empty() {
@@ @@ -2860,7 +2880,7 @@ async fn visible_repos( @@
         let collab = match viewer {
             Some(v) => state
                 .store
                 .collaborator_permission(&repo.id, &v.id)
                 .effective_permission(&repo.id, &v.id)
                 .await?
                 .and_then(|p| auth::Permission::parse(&p)),
             None => None,
+}
 /// Render an owner's repositories as a listing card.
 fn owned_repo_card(owner: &str, repos: &[Repo]) -> Markup {
 pub(crate) fn owned_repo_card(owner: &str, repos: &[Repo]) -> Markup {
     let entries: Vec<RepoEntry> = repos.iter().map(|r| RepoEntry::owned(owner, r)).collect();
     repo_card("Repositories", "No repositories.", &entries)
+}
@@ @@ -3116,7 +3136,7 @@ fn link_icon(url: &str) -> Icon { @@
 /// Build breadcrumb `(segment, href)` pairs for each segment of a repo `path`
 /// under `owner`. Group segments link to their group listing; the last is the
 /// repo itself.
 fn path_crumbs(owner: &str, path: &str) -> Vec<(String, String)> {
 pub(crate) fn path_crumbs(owner: &str, path: &str) -> Vec<(String, String)> {
     let mut out = Vec::new();
     let mut cumulative = String::new();
     for seg in path.split('/') {