hanna/fabrica

feat(web): per-group settings, manual creation, and permission cascade

dea5315 · hanna committed on 2026-07-26

Add a manual group-creation form (`/new/group`) and a per-group settings page
(`/group-settings/{id}`) for renaming, visibility, collaborator management, and
deleting empty manual groups. The group listing enforces group visibility —
a private group 404s for non-members — and shows admin controls (new subgroup,
settings) inline.

Route repo access decisions through `effective_permission` so group
collaborators gain access to repos within the group, across the web UI, the
git-over-HTTP transport, and SSH.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +14 −0

crates/ssh/src/server.rs +2 −2

crates/web/src/git_http.rs +1 −1

crates/web/src/groups.rs +551 −0

crates/web/src/issues.rs +2 −2

crates/web/src/layout.rs +3 −0

crates/web/src/lib.rs +16 −0

crates/web/src/repo.rs +33 −13

crates/web/src/search.rs +1 −1

 .repo-head {
   margin-bottom: 1.25rem;
+}
+/* Group listing header: slug on the left, admin actions on the right. */
+.group-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+  margin-bottom: 1.25rem;
+}
+.group-head-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
 /* "forked from owner/repo" line under the repo slug. */
 .fork-note {
   display: flex;

         let collaborator = self
             .shared
             .store
-            .collaborator_permission(&repo.id, &identity.user_id)
+            .effective_permission(&repo.id, &identity.user_id)
             .await
             .ok()
             .flatten()
         let collaborator = self
             .shared
             .store
-            .collaborator_permission(&repo.id, &identity.user_id)
+            .effective_permission(&repo.id, &identity.user_id)
             .await
             .ok()
             .flatten()

     let collaborator = match &viewer {
         Some(u) => state
             .store
-            .collaborator_permission(&repo.id, &u.id)
+            .effective_permission(&repo.id, &u.id)
             .await
             .ok()
             .flatten()

     let collab = match viewer {
         Some(u) => state
             .store
-            .collaborator_permission(&repo.id, &u.id)
+            .effective_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
         };
         let collab = state
             .store
-            .collaborator_permission(&repo.id, &user.id)
+            .effective_permission(&repo.id, &user.id)
             .await
             .ok()
             .flatten()

@@ -105,6 +105,9 @@ fn create_menu(_chrome: &Chrome) -> Markup {
105	a class="menu-item" role="menuitem" href="/new/migrate" {	105	a class="menu-item" role="menuitem" href="/new/migrate" {
106	(icon(Icon::Download)) span { "New migration" }	106	(icon(Icon::Download)) span { "New migration" }
107	}	107	}
		108	a class="menu-item" role="menuitem" href="/new/group" {
		109	(icon(Icon::Folder)) span { "New group" }
		110	}
108	a class="menu-item" role="menuitem" href="/new/issue" {	111	a class="menu-item" role="menuitem" href="/new/issue" {
109	(icon(Icon::Issue)) span { "New issue" }	112	(icon(Icon::Issue)) span { "New issue" }
110	}	113	}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Groups: manual creation and the per-group settings page (rename, visibility,
+//! collaborators, delete). Auto-created groups are garbage-collected by the store
+//! when their last repository leaves; only manual groups reach the delete control.
+use axum::Form;
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderMap, Uri};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+use maud::{Markup, html};
+use model::{Group, User, Visibility};
+use serde::Deserialize;
+use crate::AppState;
+use crate::error::{AppError, AppResult};
+use crate::icons::{Icon, icon};
+use crate::layout::page;
+use crate::pages::build_chrome;
+use crate::repo::path_crumbs;
+use crate::session::{MaybeUser, RequireUser, verify_csrf};
+/// Resolve the access `viewer` has to `group`, mirroring the repo rules: admin and
+/// owner get [`auth::Access::Admin`]; a group collaborator (on the group or an
+/// ancestor) gets their stored permission; otherwise the group's visibility
+/// decides read access, and everything else is [`auth::Access::None`].
+///
+/// # Errors
+///
+/// Returns [`AppError`] on a store failure.
+pub(crate) async fn group_access(
+    state: &AppState,
+    viewer: Option<&User>,
+    group: &Group,
+) -> AppResult<auth::Access> {
+    if let Some(v) = viewer
+        && (v.is_admin || v.id == group.owner_id)
+    {
+        return Ok(auth::Access::Admin);
+    }
+    if let Some(v) = viewer
+        && let Some(p) = state
+            .store
+            .effective_group_permission(&group.id, &v.id)
+            .await?
+        && let Some(perm) = auth::Permission::parse(&p)
+    {
+        return Ok(perm.into());
+    }
+    let read = match group.visibility {
+        Visibility::Public => viewer.is_some() || state.allow_anonymous(),
+        Visibility::Internal => viewer.is_some(),
+        Visibility::Private => false,
+    };
+    Ok(if read {
+        auth::Access::Read
+    } else {
+        auth::Access::None
+    })
+}
+/// Load a group by id and require the viewer be an admin of it, else 404 (never
+/// leak the group's existence).
+async fn require_admin_group(
+    state: &AppState,
+    viewer: Option<&User>,
+    id: &str,
+) -> AppResult<Group> {
+    let group = state
+        .store
+        .group_by_id(id)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    if group_access(state, viewer, &group).await? == auth::Access::Admin {
+        Ok(group)
+    } else {
+        Err(AppError::NotFound)
+    }
+}
+// ---- Manual creation ----
+/// `GET /new/group` — the manual group-creation form. An optional `?parent=path`
+/// prefills the path so "New subgroup" lands inside an existing group.
+pub async fn new_form(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    uri: Uri,
+    Query(q): Query<NewGroupQuery>,
+) -> Response {
+    let (jar, chrome) = build_chrome(&state, jar, Some(user), uri.path().to_string());
+    let prefill = q
+        .parent
+        .as_deref()
+        .map(|p| format!("{}/", p.trim_matches('/')))
+        .unwrap_or_default();
+    let body = new_group_body(&chrome.csrf, None, &prefill);
+    (jar, page(&chrome, "New group", body)).into_response()
+}
+/// Query for the new-group form.
+#[derive(Debug, Deserialize)]
+pub struct NewGroupQuery {
+    /// Optional parent group path to prefill.
+    parent: Option<String>,
+}
+/// New-group form fields.
+#[derive(Debug, Deserialize)]
+pub struct NewGroupForm {
+    /// The group path (may be nested with `/`).
+    #[serde(default)]
+    path: String,
+    /// Visibility token (`public` | `internal` | `private`).
+    #[serde(default)]
+    visibility: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /new/group` — create a manual group and redirect to it.
+pub async fn new_submit(
+    State(state): State<AppState>,
+    RequireUser(user): RequireUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Form(form): Form<NewGroupForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    match create_group_from_form(&state, &user, &form).await {
+        Ok(path) => Redirect::to(&format!("/{}/{path}", user.username)).into_response(),
+        Err(msg) => {
+            let (jar, chrome) = build_chrome(&state, jar, Some(user), "/new/group".to_string());
+            let body = new_group_body(&chrome.csrf, Some(&msg), form.path.trim());
+            (
+                axum::http::StatusCode::BAD_REQUEST,
+                jar,
+                page(&chrome, "New group", body),
+            )
+                .into_response()
+        }
+    }
+}
+/// Create the group described by `form`, returning its path or a user-facing error.
+async fn create_group_from_form(
+    state: &AppState,
+    user: &User,
+    form: &NewGroupForm,
+) -> Result<String, String> {
+    let path = form.path.trim().trim_matches('/');
+    if path.is_empty() {
+        return Err("Group path is required.".to_string());
+    }
+    // A group may not collide with an existing repository at the same path.
+    if state
+        .store
+        .repo_by_owner_path(&user.id, path)
+        .await
+        .map_err(|e| e.to_string())?
+        .is_some()
+    {
+        return Err("A repository already exists at that path.".to_string());
+    }
+    let group = state
+        .store
+        .create_group(&user.id, path)
+        .await
+        .map_err(|e| match e {
+            store::StoreError::Conflict { .. } => "That group already exists.".to_string(),
+            store::StoreError::Name(_) => {
+                "Invalid name: use letters, digits, '-', '_', and '/' for nesting.".to_string()
+            }
+            other => other.to_string(),
+        })?;
+    if let Some(vis) = Visibility::from_token(&form.visibility) {
+        let _ = state.store.set_group_visibility(&group.id, vis).await;
+    }
+    Ok(group.path)
+}
+/// The new-group form body.
+fn new_group_body(csrf: &str, error: Option<&str>, prefill: &str) -> Markup {
+    let vis_option = |value: Visibility, label: &str| {
+        html! { option value=(value.as_str()) selected[value == Visibility::Private] { (label) } }
+    };
+    html! {
+        h1 { "New group" }
+        @if let Some(msg) = error { p class="form-error" { (msg) } }
+        div class="card" {
+            form method="post" action="/new/group" {
+                input type="hidden" name="_csrf" value=(csrf);
+                label for="path" { "Group path" }
+                input type="text" id="path" name="path" value=(prefill)
+                      placeholder="team (or team/subteam)" autofocus required;
+                p class="muted field-hint" {
+                    "Nest with '/'. Intermediate groups are created automatically."
+                }
+                label for="visibility" { "Visibility" }
+                select id="visibility" name="visibility" {
+                    (vis_option(Visibility::Public, "Public — visible to everyone"))
+                    (vis_option(Visibility::Internal, "Internal — any signed-in user"))
+                    (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                }
+                div class="new-issue-actions" {
+                    button class="btn btn-primary inline-btn" type="submit" { "Create group" }
+                }
+            }
+        }
+    }
+}
+// ---- Settings page ----
+/// `GET /group-settings/{id}` — the per-group settings page (admin only).
+pub async fn settings_view(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+    Path(id): Path<String>,
+) -> Response {
+    let result = async {
+        let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
+        let owner = state
+            .store
+            .user_by_id(&group.owner_id)
+            .await?
+            .map_or_else(|| group.owner_id.clone(), |u| u.username);
+        let collaborators = state.store.list_group_collaborators(&group.id).await?;
+        // A manual group may be deleted only once its subtree holds no repos and no
+        // child groups, so the delete never orphans anything.
+        let subtree_repos = state.store.group_subtree_repo_count(&group).await?;
+        let all_groups = state.store.groups_by_owner(&group.owner_id).await?;
+        let child_prefix = format!("{}/", group.path);
+        let has_children = all_groups.iter().any(|g| g.path.starts_with(&child_prefix));
+        let deletable = group.manual && subtree_repos == 0 && !has_children;
+        let (jar, chrome) = build_chrome(&state, jar, viewer, uri.path().to_string());
+        let gid = &group.id;
+        let vis = group.visibility;
+        let vis_option = |value: Visibility, label: &str| {
+            html! { option value=(value.as_str()) selected[vis == value] { (label) } }
+        };
+        let crumbs = path_crumbs(&owner, &group.path);
+        let body = html! {
+            h1 class="repo-slug group-slug" {
+                (icon(Icon::Folder))
+                a href={ "/" (owner) } { (owner) }
+                @for (name, href) in &crumbs {
+                    span class="slug-sep" { "/" }
+                    a href=(href) { (name) }
+                }
+            }
+            p class="muted" { "Group settings" }
+            section class="listing" {
+                h2 { "General" }
+                div class="card" {
+                    form id="group-general" method="post" action=(format!("/group-settings/{gid}/general")) {
+                        input type="hidden" name="_csrf" value=(chrome.csrf);
+                        label for="name" { "Group name" }
+                        input type="text" id="name" name="name" value=(group.name) required;
+                        label for="visibility" { "Visibility" }
+                        select id="visibility" name="visibility" {
+                            (vis_option(Visibility::Public, "Public — visible to everyone"))
+                            (vis_option(Visibility::Internal, "Internal — any signed-in user"))
+                            (vis_option(Visibility::Private, "Private — only you and collaborators"))
+                        }
+                    }
+                    div class="settings-actions" {
+                        button class="btn btn-primary" type="submit" form="group-general" { "Save changes" }
+                    }
+                }
+            }
+            (group_collaborators_section(gid, &chrome.csrf, &collaborators))
+            section class="listing" {
+                h2 { "Danger zone" }
+                div class="card danger-zone" {
+                    @if deletable {
+                        p { strong { "Delete this group." } " This removes the group; it holds no repositories or subgroups." }
+                        form method="post" action=(format!("/group-settings/{gid}/delete")) {
+                            input type="hidden" name="_csrf" value=(chrome.csrf);
+                            button class="btn btn-danger" type="submit" { "Delete group" }
+                        }
+                    } @else if !group.manual {
+                        p class="muted" { "Automatic groups are removed on their own once empty." }
+                    } @else {
+                        p class="muted" { "Empty the group of all repositories and subgroups before deleting it." }
+                    }
+                }
+            }
+        };
+        let title = format!("{owner}/{}: settings", group.path);
+        Ok::<Response, AppError>((jar, page(&chrome, &title, body)).into_response())
+    }
+    .await;
+    result.unwrap_or_else(IntoResponse::into_response)
+}
+/// The group collaborators section: current members with remove buttons, add form.
+fn group_collaborators_section(
+    id: &str,
+    csrf: &str,
+    collaborators: &[store::Collaborator],
+) -> Markup {
+    let perm_option = |value: &str, label: &str| html! { option value=(value) { (label) } };
+    html! {
+        section class="listing" {
+            h2 { "Collaborators" }
+            p class="muted field-hint" { "Group collaborators gain the same access to every repository within this group." }
+            div class="card" {
+                @if collaborators.is_empty() {
+                    p class="muted" { "No collaborators yet." }
+                } @else {
+                    ul class="entry-list collab-list" {
+                        @for c in collaborators {
+                            li class="entry-row" {
+                                div class="entry-row-body" {
+                                    a class="entry-row-title" href={ "/" (c.username) } { (c.username) }
+                                    div class="entry-row-meta muted" { (c.permission) }
+                                }
+                                div class="entry-row-actions" {
+                                    form method="post" action=(format!("/group-settings/{id}/collaborators/remove")) {
+                                        input type="hidden" name="_csrf" value=(csrf);
+                                        input type="hidden" name="user_id" value=(c.user_id);
+                                        button class="btn btn-danger" type="submit" { "Remove" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                form class="collab-add" method="post" action=(format!("/group-settings/{id}/collaborators")) {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    input type="text" name="username" placeholder="Username" aria-label="Username" required;
+                    select name="permission" aria-label="Permission" {
+                        (perm_option("read", "Read"))
+                        (perm_option("write", "Write"))
+                        (perm_option("admin", "Admin"))
+                    }
+                    button class="btn btn-primary inline-btn" type="submit" { "Add" }
+                }
+            }
+        }
+    }
+}
+/// The group general-settings form (rename + visibility).
+#[derive(Debug, Deserialize)]
+pub struct GroupGeneralForm {
+    /// The new leaf name (the parent prefix is preserved).
+    #[serde(default)]
+    name: String,
+    /// The chosen visibility token.
+    #[serde(default)]
+    visibility: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /group-settings/{id}/general` — rename and set visibility.
+pub async fn settings_general(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<GroupGeneralForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
+        let owner = state
+            .store
+            .user_by_id(&group.owner_id)
+            .await?
+            .map_or_else(|| group.owner_id.clone(), |u| u.username);
+        let new_name = form.name.trim();
+        let renamed = state
+            .store
+            .rename_group(&group.id, new_name)
+            .await
+            .map_err(|e| match e {
+                store::StoreError::Conflict { .. } => {
+                    AppError::BadRequest("That name is already taken.".to_string())
+                }
+                store::StoreError::Name(_) => {
+                    AppError::BadRequest("Invalid group name.".to_string())
+                }
+                other => AppError::from(other),
+            })?;
+        if let Some(vis) = Visibility::from_token(&form.visibility) {
+            state.store.set_group_visibility(&group.id, vis).await?;
+        }
+        let _ = owner;
+        Ok::<String, AppError>(format!("/group-settings/{}", renamed.id))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The add-collaborator form.
+#[derive(Debug, Deserialize)]
+pub struct CollaboratorAddForm {
+    /// The collaborator's username.
+    #[serde(default)]
+    username: String,
+    /// The permission to grant (`read` | `write` | `admin`).
+    #[serde(default)]
+    permission: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /group-settings/{id}/collaborators` — add or update a group collaborator.
+pub async fn settings_collaborator_add(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<CollaboratorAddForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
+        let permission = auth::Permission::parse(&form.permission)
+            .ok_or_else(|| AppError::BadRequest("Invalid permission.".to_string()))?;
+        let target = state
+            .store
+            .user_by_username(form.username.trim())
+            .await?
+            .ok_or_else(|| AppError::BadRequest("No such user.".to_string()))?;
+        // The owner is already an admin; adding them is a no-op.
+        if target.id != group.owner_id {
+            state
+                .store
+                .add_group_collaborator(&group.id, &target.id, permission.as_str())
+                .await?;
+        }
+        Ok::<String, AppError>(format!("/group-settings/{}", group.id))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The remove-collaborator form.
+#[derive(Debug, Deserialize)]
+pub struct CollaboratorRemoveForm {
+    /// The collaborator's user id.
+    #[serde(default)]
+    user_id: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /group-settings/{id}/collaborators/remove` — remove a group collaborator.
+pub async fn settings_collaborator_remove(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<CollaboratorRemoveForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
+        state
+            .store
+            .remove_group_collaborator(&group.id, &form.user_id)
+            .await?;
+        Ok::<String, AppError>(format!("/group-settings/{}", group.id))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}
+/// The group delete form (CSRF only).
+#[derive(Debug, Deserialize)]
+pub struct GroupDeleteForm {
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /group-settings/{id}/delete` — delete an empty manual group.
+pub async fn settings_delete(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<GroupDeleteForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let group = require_admin_group(&state, viewer.as_ref(), &id).await?;
+        let owner = state
+            .store
+            .user_by_id(&group.owner_id)
+            .await?
+            .map_or_else(|| group.owner_id.clone(), |u| u.username);
+        // Guard against orphaning: refuse unless manual and the subtree is empty.
+        let subtree_repos = state.store.group_subtree_repo_count(&group).await?;
+        let all_groups = state.store.groups_by_owner(&group.owner_id).await?;
+        let child_prefix = format!("{}/", group.path);
+        let has_children = all_groups.iter().any(|g| g.path.starts_with(&child_prefix));
+        if !group.manual || subtree_repos != 0 || has_children {
+            return Err(AppError::BadRequest(
+                "This group cannot be deleted while it is not empty.".to_string(),
+            ));
+        }
+        state.store.delete_group(&group.id).await?;
+        // Deleting this manual group may leave its (auto) parent empty.
+        state.store.gc_empty_groups(group.parent_id.clone()).await?;
+        Ok::<String, AppError>(format!("/{owner}"))
+    }
+    .await;
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}

 mod diff;
 mod error;
 mod git_http;
+mod groups;
 mod icons;
 mod issues;
 mod languages;
+        )
         .route("/new/issue", get(pages::new_issue_chooser))
         .route("/new/pull", get(pages::new_pull_chooser))
+        .route("/new/group", get(groups::new_form).post(groups::new_submit))
         .route("/explore", get(pages::explore))
         .route("/explore/users", get(pages::explore_users))
         .route("/login", get(pages::login_form).post(pages::login_submit))
             "/repo-fork/{id}",
             get(repo::fork_confirm).post(repo::fork_create),
+        )
+        .route("/group-settings/{id}", get(groups::settings_view))
+        .route(
+            "/group-settings/{id}/general",
+            post(groups::settings_general),
+        )
+        .route(
+            "/group-settings/{id}/collaborators",
+            post(groups::settings_collaborator_add),
+        )
+        .route(
+            "/group-settings/{id}/collaborators/remove",
+            post(groups::settings_collaborator_remove),
+        )
+        .route("/group-settings/{id}/delete", post(groups::settings_delete))
         .route("/repo-bookmark/{id}", get(repo::bookmark_toggle))
         .route("/user-follow/{username}", get(repo::follow_toggle))
         .route("/notifications", get(notifications::list))