hanna/fabrica

feat(store): group settings, collaborators, and recursive GC

fc737e6 · hanna committed on 2026-07-26

Add a `manual` flag and `visibility` to groups plus a `group_collaborators`
table (migration 0021). Manual groups are created explicitly and never
collected; auto groups created to hold a repo are garbage-collected up the
tree by `delete_repo` once their last repo and child leave.

Group collaborators cascade to every repo in the subtree: `effective_permission`
maxes a repo's direct collaborator row against any ancestor group grant, and
`effective_group_permission` resolves the same for a group itself. `rename_group`
rewrites the materialized paths of the group, its descendant groups, and every
repo beneath it in one transaction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/model/src/entity.rs +5 −0

crates/store/src/groups.rs +397 −32

crates/store/src/repos.rs +7 −1

crates/store/src/tests.rs +224 −0

migrations/postgres/0021_group_settings.sql +14 −0

migrations/sqlite/0021_group_settings.sql +14 −0

@@ @@ -215,6 +215,11 @@ pub struct Group { @@
     pub path: String,
     /// Optional description.
     pub description: Option<String>,
     /// Whether the group was created explicitly (persists) rather than
     /// auto-created to hold a repo (garbage-collected when empty).
     pub manual: bool,
     /// The group's visibility (gates its listing page).
     pub visibility: Visibility,
     /// Creation time.
     pub created_at: Timestamp,
+}

@@ @@ -379,17 +379,23 @@ impl Store { @@
     /// Delete a repository row (cascading to collaborators). The caller is
     /// responsible for the on-disk directory — moving it to trash, or purging it.
     /// Returns `true` if a row was removed.
     /// Returns `true` if a row was removed. Empty auto-created groups the repo
     /// left behind are garbage-collected up the tree.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn delete_repo(&self, repo_id: &str) -> Result<bool, StoreError> {
         // Remember the group before the row disappears, to garbage-collect it.
         let group_id = self.repo_by_id(repo_id).await?.and_then(|r| r.group_id);
         let deleted = sqlx::query("DELETE FROM repos WHERE id = $1")
             .bind(repo_id)
             .execute(&self.pool)
             .await?
             .rows_affected();
         if deleted > 0 {
             self.gc_empty_groups(group_id).await?;
+        }
         Ok(deleted > 0)
+    }

@@ @@ -0,0 +1,14 @@ @@
 -- Groups gain their own settings: a manual flag (manual groups persist; auto
 -- groups are garbage-collected when empty), a visibility, and collaborators
 -- whose access cascades to every repository in the group's subtree.
 ALTER TABLE groups ADD COLUMN manual BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
 CREATE TABLE group_collaborators (
     id         TEXT PRIMARY KEY,
     group_id   TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
     user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     permission TEXT NOT NULL,
     created_at BIGINT NOT NULL
 );
 CREATE UNIQUE INDEX idx_group_collab ON group_collaborators (group_id, user_id);

@@ @@ -0,0 +1,14 @@ @@
 -- Groups gain their own settings: a manual flag (manual groups persist; auto
 -- groups are garbage-collected when empty), a visibility, and collaborators
 -- whose access cascades to every repository in the group's subtree.
 ALTER TABLE groups ADD COLUMN manual INTEGER NOT NULL DEFAULT 0;
 ALTER TABLE groups ADD COLUMN visibility TEXT NOT NULL DEFAULT 'private';
 CREATE TABLE group_collaborators (
     id         TEXT PRIMARY KEY,
     group_id   TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
     user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     permission TEXT NOT NULL,
     created_at BIGINT NOT NULL
 );
 CREATE UNIQUE INDEX idx_group_collab ON group_collaborators (group_id, user_id);

@@ @@ -2,28 +2,39 @@ @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Groups: the nested, user-owned repository hierarchy.
 //! Groups: the nested, user-owned repository hierarchy, with per-group settings
 //! (visibility, collaborators) and recursive garbage collection of the auto-
 //! created groups that once held a now-deleted repository.
 use model::Group;
 use model::{Group, Visibility};
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
 use crate::repos::Collaborator;
 use crate::{Store, StoreError, map_conflict, new_id, now_ms};
 /// The columns of `groups` in a fixed order, shared by every `SELECT`.
 const GROUP_COLUMNS: &str = "id, owner_id, parent_id, name, path, description, created_at";
 const GROUP_COLUMNS: &str =
     "id, owner_id, parent_id, name, path, description, manual, visibility, created_at";
 /// Rank a permission token so the highest across repo + group collaborators wins.
 fn perm_rank(perm: &str) -> i32 {
     match perm {
         "admin" => 3,
         "write" => 2,
         "read" => 1,
         _ => 0,
+    }
+}
 impl Store {
     /// Ensure a group exists at `owner_id`/`path`, creating it and every missing
     /// intermediate group, and return the leaf group. Existing groups along the
     /// path are reused. Each segment name is validated.
     ///
     /// This powers both `fabrica group add` and the `repo add owner group/sub/repo`
     /// convenience that auto-creates the groups a repo is filed under.
     /// intermediate group (all auto), and return the leaf group.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if any segment is an invalid name.
     /// * [`StoreError::GroupTooDeep`] past [`model::MAX_GROUP_DEPTH`].
     /// * [`StoreError::Query`] on a database failure.
     pub async fn ensure_group_path(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
         let segments: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
@@ @@ -59,11 +70,28 @@ impl Store { @@
             parent_id = Some(group.id.clone());
             leaf = Some(group);
+        }
         // `leaf` is always set: `segments` was non-empty.
         leaf.ok_or(StoreError::Name(model::NameError::Empty))
+    }
     /// Insert a single group row.
     /// Create a group explicitly at `path`, marking its leaf as manual so it is
     /// never garbage-collected. Intermediates are created auto.
     ///
     /// # Errors
     ///
     /// See [`Store::ensure_group_path`].
     pub async fn create_group(&self, owner_id: &str, path: &str) -> Result<Group, StoreError> {
         let leaf = self.ensure_group_path(owner_id, path).await?;
         sqlx::query("UPDATE groups SET manual = $1 WHERE id = $2")
             .bind(true)
             .bind(&leaf.id)
             .execute(&self.pool)
             .await?;
         self.group_by_id(&leaf.id)
             .await?
             .ok_or(StoreError::Name(model::NameError::Empty))
+    }
     /// Insert a single (auto) group row.
     async fn insert_group(
         &self,
         owner_id: &str,
@@ @@ -78,10 +106,13 @@ impl Store { @@
             name: name.to_string(),
             path: path.to_string(),
             description: None,
             manual: false,
             visibility: Visibility::Private,
             created_at: now_ms(),
         };
         let sql = "INSERT INTO groups (id, owner_id, parent_id, name, path, description, created_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7)";
         let sql = "INSERT INTO groups \
              (id, owner_id, parent_id, name, path, description, manual, visibility, created_at) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)";
         sqlx::query(sql)
             .bind(group.id.clone())
             .bind(group.owner_id.clone())
@@ @@ -89,6 +120,8 @@ impl Store { @@
             .bind(group.name.clone())
             .bind(group.path.clone())
             .bind(group.description.clone())
             .bind(group.manual)
             .bind(group.visibility.as_str())
             .bind(group.created_at)
             .execute(&self.pool)
             .await
@@ @@ -96,7 +129,7 @@ impl Store { @@
         Ok(group)
+    }
     /// Resolve a group by `(owner_id, path)`, or `None` if absent.
     /// Resolve a group by `(owner_id, path)`, or `None`.
     ///
     /// # Errors
     ///
@@ @@ -112,7 +145,21 @@ impl Store { @@
             .bind(path)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(map_group).transpose()?)
         Ok(row.as_ref().map(|r| self.map_group(r)).transpose()?)
+    }
     /// Fetch a group by id.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn group_by_id(&self, id: &str) -> Result<Option<Group>, StoreError> {
         let sql = format!("SELECT {GROUP_COLUMNS} FROM groups WHERE id = $1");
         let row = sqlx::query(AssertSqlSafe(sql))
             .bind(id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.as_ref().map(|r| self.map_group(r)).transpose()?)
+    }
     /// List every group owned by `owner_id`, ordered by path.
@@ @@ -128,7 +175,7 @@ impl Store { @@
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_group)
             .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
@@ @@ -144,7 +191,7 @@ impl Store { @@
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_group)
             .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
@@ @@ -168,14 +215,168 @@ impl Store { @@
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_group)
             .map(|r| self.map_group(r))
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Delete a group by id. Child groups cascade (`ON DELETE CASCADE`); repos in
     /// the group have their `group_id` set null by the schema, so they survive as
     /// ungrouped repos. Returns `true` if a row was deleted.
     /// Set a group's visibility.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn set_group_visibility(
         &self,
         group_id: &str,
         visibility: Visibility,
     ) -> Result<(), StoreError> {
         sqlx::query("UPDATE groups SET visibility = $1 WHERE id = $2")
             .bind(visibility.as_str())
             .bind(group_id)
             .execute(&self.pool)
             .await?;
         Ok(())
+    }
     /// Rename a group's leaf name, updating the materialized paths of the group,
     /// its descendant groups, and every repository beneath it.
     ///
     /// # Errors
     ///
     /// * [`StoreError::Name`] if `new_name` is invalid.
     /// * [`StoreError::Conflict`] if the new path is already taken.
     /// * [`StoreError::Query`] for any other database failure.
     pub async fn rename_group(&self, group_id: &str, new_name: &str) -> Result<Group, StoreError> {
         model::validate_name(new_name)?;
         let group = self
             .group_by_id(group_id)
             .await?
             .ok_or(StoreError::Name(model::NameError::Empty))?;
         let old_path = group.path.clone();
         let new_path = match old_path.rsplit_once('/') {
             Some((prefix, _)) => format!("{prefix}/{new_name}"),
             None => new_name.to_string(),
         };
         if new_path != old_path
             && (self
                 .group_by_owner_path(&group.owner_id, &new_path)
                 .await?
                 .is_some()
                 || self
                     .repo_by_owner_path(&group.owner_id, &new_path)
                     .await?
                     .is_some())
+        {
             return Err(StoreError::Conflict {
                 entity: "group",
                 field: "path",
             });
+        }
         let old_prefix = format!("{old_path}/%");
         let old_len = i64::try_from(old_path.len()).unwrap_or(i64::MAX);
         let mut tx = self.pool.begin().await?;
         // Descendant groups: replace the shared path prefix.
         sqlx::query(
             "UPDATE groups SET path = $1 || SUBSTR(path, $2) \
              WHERE owner_id = $3 AND path LIKE $4",
+        )
         .bind(&new_path)
         .bind(old_len + 1)
         .bind(&group.owner_id)
         .bind(&old_prefix)
         .execute(&mut *tx)
         .await?;
         // Repositories beneath the group.
         sqlx::query(
             "UPDATE repos SET path = $1 || SUBSTR(path, $2) \
              WHERE owner_id = $3 AND path LIKE $4",
+        )
         .bind(&new_path)
         .bind(old_len + 1)
         .bind(&group.owner_id)
         .bind(&old_prefix)
         .execute(&mut *tx)
         .await?;
         // The group itself.
         sqlx::query("UPDATE groups SET name = $1, path = $2 WHERE id = $3")
             .bind(new_name)
             .bind(&new_path)
             .bind(group_id)
             .execute(&mut *tx)
             .await?;
         tx.commit().await?;
         self.group_by_id(group_id)
             .await?
             .ok_or(StoreError::Name(model::NameError::Empty))
+    }
     /// Whether a group holds any repositories directly.
     async fn group_has_repos(&self, group_id: &str) -> Result<bool, StoreError> {
         let row = sqlx::query("SELECT 1 AS n FROM repos WHERE group_id = $1")
             .bind(group_id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.is_some())
+    }
     /// Whether a group has any child groups.
     async fn group_has_children(&self, group_id: &str) -> Result<bool, StoreError> {
         let row = sqlx::query("SELECT 1 AS n FROM groups WHERE parent_id = $1")
             .bind(group_id)
             .fetch_optional(&self.pool)
             .await?;
         Ok(row.is_some())
+    }
     /// The number of repositories anywhere in a group's subtree.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn group_subtree_repo_count(&self, group: &Group) -> Result<i64, StoreError> {
         let prefix = format!("{}/%", group.path);
         let n: i64 =
             sqlx::query("SELECT COUNT(*) AS n FROM repos WHERE owner_id = $1 AND path LIKE $2")
                 .bind(&group.owner_id)
                 .bind(&prefix)
                 .fetch_one(&self.pool)
                 .await?
                 .try_get("n")?;
         Ok(n)
+    }
     /// Garbage-collect empty auto groups upward from `group_id`: while a group is
     /// auto (not manual) and holds no repos and no child groups, delete it and
     /// continue with its parent. Manual groups (and non-empty ones) stop the walk.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn gc_empty_groups(&self, mut group_id: Option<String>) -> Result<(), StoreError> {
         let mut guard = 0;
         while let Some(gid) = group_id {
             guard += 1;
             if guard > 64 {
                 break;
+            }
             let Some(group) = self.group_by_id(&gid).await? else {
                 break;
             };
             if group.manual
                 || self.group_has_repos(&gid).await?
                 || self.group_has_children(&gid).await?
+            {
                 break;
+            }
             let parent = group.parent_id.clone();
             self.delete_group(&gid).await?;
             group_id = parent;
+        }
         Ok(())
+    }
     /// Delete a group by id. Child groups cascade; repos have their `group_id`
     /// set null by the schema. Returns `true` if a row was deleted.
     ///
     /// # Errors
     ///
@@ @@ -188,17 +389,181 @@ impl Store { @@
             .rows_affected();
         Ok(deleted > 0)
+    }
+}
 /// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
 fn map_group(row: &AnyRow) -> Result<Group, sqlx::Error> {
     Ok(Group {
         id: row.try_get("id")?,
         owner_id: row.try_get("owner_id")?,
         parent_id: row.try_get("parent_id")?,
         name: row.try_get("name")?,
         path: row.try_get("path")?,
         description: row.try_get("description")?,
         created_at: row.try_get("created_at")?,
     })
     // ---- Group collaborators ----
     /// Add or update a group collaborator's permission.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn add_group_collaborator(
         &self,
         group_id: &str,
         user_id: &str,
         permission: &str,
     ) -> Result<(), StoreError> {
         sqlx::query(
             "INSERT INTO group_collaborators (id, group_id, user_id, permission, created_at) \
              VALUES ($1, $2, $3, $4, $5) \
              ON CONFLICT (group_id, user_id) DO UPDATE SET permission = $4",
+        )
         .bind(new_id())
         .bind(group_id)
         .bind(user_id)
         .bind(permission)
         .bind(now_ms())
         .execute(&self.pool)
         .await?;
         Ok(())
+    }
     /// Remove a group collaborator.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn remove_group_collaborator(
         &self,
         group_id: &str,
         user_id: &str,
     ) -> Result<(), StoreError> {
         sqlx::query("DELETE FROM group_collaborators WHERE group_id = $1 AND user_id = $2")
             .bind(group_id)
             .bind(user_id)
             .execute(&self.pool)
             .await?;
         Ok(())
+    }
     /// List a group's collaborators with their usernames resolved.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn list_group_collaborators(
         &self,
         group_id: &str,
     ) -> Result<Vec<Collaborator>, StoreError> {
         let rows = sqlx::query(
             "SELECT gc.user_id, u.username, gc.permission \
              FROM group_collaborators gc JOIN users u ON u.id = gc.user_id \
              WHERE gc.group_id = $1 ORDER BY u.username_lower ASC",
+        )
         .bind(group_id)
         .fetch_all(&self.pool)
         .await?;
         rows.iter()
             .map(|r| {
                 Ok(Collaborator {
                     user_id: r.try_get("user_id")?,
                     username: r.try_get("username")?,
                     permission: r.try_get("permission")?,
                 })
             })
             .collect::<Result<_, sqlx::Error>>()
             .map_err(Into::into)
+    }
     /// A user's collaborator permission on a group, if any.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn group_collaborator_permission(
         &self,
         group_id: &str,
         user_id: &str,
     ) -> Result<Option<String>, StoreError> {
         let row = sqlx::query(
             "SELECT permission FROM group_collaborators WHERE group_id = $1 AND user_id = $2",
+        )
         .bind(group_id)
         .bind(user_id)
         .fetch_optional(&self.pool)
         .await?;
         Ok(row.map(|r| r.try_get("permission")).transpose()?)
+    }
     /// A user's effective collaborator permission on a repo: the strongest of its
     /// direct collaborator row and any group-collaborator row on the repo's group
     /// or an ancestor group.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn effective_permission(
         &self,
         repo_id: &str,
         user_id: &str,
     ) -> Result<Option<String>, StoreError> {
         let mut best: Option<String> = self.collaborator_permission(repo_id, user_id).await?;
         let mut best_rank = best.as_deref().map_or(0, perm_rank);
         let mut group_id = self.repo_by_id(repo_id).await?.and_then(|r| r.group_id);
         let mut guard = 0;
         while let Some(gid) = group_id {
             guard += 1;
             if guard > 64 {
                 break;
+            }
             if let Some(p) = self.group_collaborator_permission(&gid, user_id).await? {
                 let r = perm_rank(&p);
                 if r > best_rank {
                     best_rank = r;
                     best = Some(p);
+                }
+            }
             group_id = self.group_by_id(&gid).await?.and_then(|g| g.parent_id);
+        }
         Ok(best)
+    }
     /// A user's effective collaborator permission on a group: the strongest
     /// group-collaborator row on the group itself or any ancestor group.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn effective_group_permission(
         &self,
         group_id: &str,
         user_id: &str,
     ) -> Result<Option<String>, StoreError> {
         let mut best: Option<String> = None;
         let mut best_rank = 0;
         let mut next = Some(group_id.to_string());
         let mut guard = 0;
         while let Some(gid) = next {
             guard += 1;
             if guard > 64 {
                 break;
+            }
             if let Some(p) = self.group_collaborator_permission(&gid, user_id).await? {
                 let r = perm_rank(&p);
                 if r > best_rank {
                     best_rank = r;
                     best = Some(p);
+                }
+            }
             next = self.group_by_id(&gid).await?.and_then(|g| g.parent_id);
+        }
         Ok(best)
+    }
     /// Map a `groups` row (selected via [`GROUP_COLUMNS`]) to a [`Group`].
     fn map_group(&self, row: &AnyRow) -> Result<Group, sqlx::Error> {
         Ok(Group {
             id: row.try_get("id")?,
             owner_id: row.try_get("owner_id")?,
             parent_id: row.try_get("parent_id")?,
             name: row.try_get("name")?,
             path: row.try_get("path")?,
             description: row.try_get("description")?,
             manual: self.get_bool(row, "manual")?,
             visibility: Visibility::from_token(&row.try_get::<String, _>("visibility")?)
                 .unwrap_or(Visibility::Private),
             created_at: row.try_get("created_at")?,
         })
+    }
+}

@@ @@ -1370,3 +1370,227 @@ async fn postgres_round_trip() { @@
         .await
         .unwrap();
+}
 /// Helper: create a repo at `path`, auto-creating its group chain, and return it.
 async fn repo_in_group(store: &Store, owner_id: &str, path: &str) -> model::Repo {
     let (group, leaf) = match path.rsplit_once('/') {
         Some((g, l)) => (Some(g), l),
         None => (None, path),
     };
     let group_id = match group {
         Some(g) => Some(store.ensure_group_path(owner_id, g).await.unwrap().id),
         None => None,
     };
     store
         .create_repo(NewRepo {
             owner_id: owner_id.to_string(),
             group_id,
             name: leaf.to_string(),
             path: path.to_string(),
             description: None,
             visibility: model::Visibility::Private,
             default_branch: "main".to_string(),
         })
         .await
         .unwrap()
+}
 #[tokio::test]
 async fn deleting_last_repo_gcs_empty_auto_groups() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("gc", "gc@example.com"))
             .await
             .unwrap();
         // what/the/fuck where `fuck` is a repo; siblings keep their branch alive.
         let repo = repo_in_group(&fx.store, &owner.id, "what/the/fuck").await;
         let sibling = repo_in_group(&fx.store, &owner.id, "what/keep").await;
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "what/the")
                 .await
                 .unwrap()
                 .is_some()
         );
         // Deleting `fuck` empties `the` (deleted), but `what` still holds `keep`.
         assert!(fx.store.delete_repo(&repo.id).await.unwrap());
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "what/the")
                 .await
                 .unwrap()
                 .is_none(),
             "empty auto group `what/the` should be collected"
         );
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "what")
                 .await
                 .unwrap()
                 .is_some(),
             "`what` still holds the `keep` repo"
         );
         // Removing the last repo collects the whole chain up to the root.
         assert!(fx.store.delete_repo(&sibling.id).await.unwrap());
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "what")
                 .await
                 .unwrap()
                 .is_none(),
             "the now-empty root auto group is collected too"
         );
+    }
+}
 #[tokio::test]
 async fn manual_groups_survive_gc() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("man", "man@example.com"))
             .await
             .unwrap();
         // Manually create `team`, then a repo under an auto subgroup.
         let team = fx.store.create_group(&owner.id, "team").await.unwrap();
         assert!(team.manual);
         let repo = repo_in_group(&fx.store, &owner.id, "team/auto/proj").await;
         assert!(fx.store.delete_repo(&repo.id).await.unwrap());
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "team/auto")
                 .await
                 .unwrap()
                 .is_none(),
             "auto subgroup collected"
         );
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "team")
                 .await
                 .unwrap()
                 .is_some(),
             "manual group is never collected"
         );
+    }
+}
 #[tokio::test]
 async fn group_collaborator_grants_effective_permission() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("own", "own@example.com"))
             .await
             .unwrap();
         let collab = fx
             .store
             .create_user(sample_user("col", "col@example.com"))
             .await
             .unwrap();
         let repo = repo_in_group(&fx.store, &owner.id, "acme/deep/svc").await;
         // No access before any grant.
         assert!(
             fx.store
                 .effective_permission(&repo.id, &collab.id)
                 .await
                 .unwrap()
                 .is_none()
         );
         // Grant write on the top group; it cascades down to the nested repo.
         let acme = fx
             .store
             .group_by_owner_path(&owner.id, "acme")
             .await
             .unwrap()
             .unwrap();
         fx.store
             .add_group_collaborator(&acme.id, &collab.id, "write")
             .await
             .unwrap();
         assert_eq!(
             fx.store
                 .effective_permission(&repo.id, &collab.id)
                 .await
                 .unwrap()
                 .as_deref(),
             Some("write")
         );
         // A stronger repo-level grant wins over the weaker group grant.
         fx.store
             .set_collaborator(&repo.id, &collab.id, "admin")
             .await
             .unwrap();
         assert_eq!(
             fx.store
                 .effective_permission(&repo.id, &collab.id)
                 .await
                 .unwrap()
                 .as_deref(),
             Some("admin")
         );
         // The group-level effective permission also resolves for the group itself.
         let svc_group = fx
             .store
             .group_by_owner_path(&owner.id, "acme/deep")
             .await
             .unwrap()
             .unwrap();
         assert_eq!(
             fx.store
                 .effective_group_permission(&svc_group.id, &collab.id)
                 .await
                 .unwrap()
                 .as_deref(),
             Some("write"),
             "ancestor group grant is inherited"
         );
+    }
+}
 #[tokio::test]
 async fn rename_group_moves_subtree() {
     for fx in sqlite_fixtures().await {
         let owner = fx
             .store
             .create_user(sample_user("rn", "rn@example.com"))
             .await
             .unwrap();
         let repo = repo_in_group(&fx.store, &owner.id, "old/sub/proj").await;
         let top = fx
             .store
             .group_by_owner_path(&owner.id, "old")
             .await
             .unwrap()
             .unwrap();
         fx.store.rename_group(&top.id, "new").await.unwrap();
         // The repo and descendant group paths are rewritten under the new prefix.
         let moved = fx.store.repo_by_id(&repo.id).await.unwrap().unwrap();
         assert_eq!(moved.path, "new/sub/proj");
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "new/sub")
                 .await
                 .unwrap()
                 .is_some()
         );
         assert!(
             fx.store
                 .group_by_owner_path(&owner.id, "old/sub")
                 .await
                 .unwrap()
                 .is_none()
         );
+    }
+}