upleb.uk

Public git repos — served from a NIP-34 GRASP relay at git.upleb.uk

summaryrefslogtreecommitdiff
path: root/src/git
diff options
context:
space:
mode:
Diffstat (limited to 'src/git')
-rw-r--r--src/git/authorization.rs74
1 files changed, 0 insertions, 74 deletions
diff --git a/src/git/authorization.rs b/src/git/authorization.rs
index bf49800..da5ad4b 100644
--- a/src/git/authorization.rs
+++ b/src/git/authorization.rs
@@ -410,31 +410,6 @@ fn get_maintainers_recursive(
410 } 410 }
411} 411}
412 412
413/// Collect all authorized maintainers as a flat set from all announcements
414///
415/// This is a convenience function that flattens the per-owner maintainer lists
416/// into a single set. Use this when you don't need owner-specific authorization.
417pub fn collect_all_authorized_maintainers(
418 announcements: &[RepositoryAnnouncement],
419) -> HashSet<String> {
420 let by_owner = collect_authorized_maintainers(announcements);
421 let mut all_authorized = HashSet::new();
422
423 for maintainers in by_owner.values() {
424 for maintainer in maintainers {
425 all_authorized.insert(maintainer.clone());
426 }
427 }
428
429 debug!(
430 "Collected {} total authorized maintainers from {} owners",
431 all_authorized.len(),
432 by_owner.len()
433 );
434
435 all_authorized
436}
437
438/// Find the latest state event authored by an authorized maintainer 413/// Find the latest state event authored by an authorized maintainer
439/// 414///
440/// Returns the state with the highest created_at timestamp among those 415/// Returns the state with the highest created_at timestamp among those
@@ -497,55 +472,6 @@ pub fn is_latest_state(
497 true 472 true
498} 473}
499 474
500/// Get the authorization result for a repository from the database
501///
502/// This is the main entry point for authorization that queries the database directly.
503/// It:
504/// 1. Fetches all announcements and states for the identifier with a single query
505/// 2. Collects all authorized maintainers from announcements
506/// 3. Finds the latest state event from an authorized maintainer
507///
508/// Returns an `AuthorizationResult` that indicates whether a push is authorized.
509pub async fn get_authorization_from_db(
510 database: &SharedDatabase,
511 identifier: &str,
512) -> Result<AuthorizationResult> {
513 // Fetch all repository data with a single query
514 let repo_data = fetch_repository_data_excluding_purgatory(database, identifier).await?;
515
516 if repo_data.announcements.is_empty() {
517 return Ok(AuthorizationResult::denied(
518 "No repository announcement found",
519 ));
520 }
521
522 // Collect all authorized maintainers (flattened across all owners)
523 let authorized = collect_all_authorized_maintainers(&repo_data.announcements);
524
525 if authorized.is_empty() {
526 return Ok(AuthorizationResult::denied(
527 "No authorized maintainers found",
528 ));
529 }
530
531 debug!(
532 "Found {} authorized maintainers for repository {}",
533 authorized.len(),
534 identifier
535 );
536
537 // Find the latest authorized state
538 match find_latest_authorized_state(&repo_data.states, &authorized) {
539 Some(state) => Ok(AuthorizationResult::authorized(
540 state.clone(),
541 authorized.into_iter().collect(),
542 )),
543 None => Ok(AuthorizationResult::denied(
544 "No state event found from authorized publishers",
545 )),
546 }
547}
548
549/// Get the authorization result for a repository scoped to a specific owner 475/// Get the authorization result for a repository scoped to a specific owner
550/// 476///
551/// Push authorization checks ONLY purgatory for state events. The database represents 477/// Push authorization checks ONLY purgatory for state events. The database represents