diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/git/authorization.rs | 74 |
1 files changed, 0 insertions, 74 deletions
diff --git a/src/git/authorization.rs b/src/git/authorization.rs index bf49800..da5ad4b 100644 --- a/src/git/authorization.rs +++ b/src/git/authorization.rs | |||
| @@ -410,31 +410,6 @@ fn get_maintainers_recursive( | |||
| 410 | } | 410 | } |
| 411 | } | 411 | } |
| 412 | 412 | ||
| 413 | /// Collect all authorized maintainers as a flat set from all announcements | ||
| 414 | /// | ||
| 415 | /// This is a convenience function that flattens the per-owner maintainer lists | ||
| 416 | /// into a single set. Use this when you don't need owner-specific authorization. | ||
| 417 | pub fn collect_all_authorized_maintainers( | ||
| 418 | announcements: &[RepositoryAnnouncement], | ||
| 419 | ) -> HashSet<String> { | ||
| 420 | let by_owner = collect_authorized_maintainers(announcements); | ||
| 421 | let mut all_authorized = HashSet::new(); | ||
| 422 | |||
| 423 | for maintainers in by_owner.values() { | ||
| 424 | for maintainer in maintainers { | ||
| 425 | all_authorized.insert(maintainer.clone()); | ||
| 426 | } | ||
| 427 | } | ||
| 428 | |||
| 429 | debug!( | ||
| 430 | "Collected {} total authorized maintainers from {} owners", | ||
| 431 | all_authorized.len(), | ||
| 432 | by_owner.len() | ||
| 433 | ); | ||
| 434 | |||
| 435 | all_authorized | ||
| 436 | } | ||
| 437 | |||
| 438 | /// Find the latest state event authored by an authorized maintainer | 413 | /// Find the latest state event authored by an authorized maintainer |
| 439 | /// | 414 | /// |
| 440 | /// Returns the state with the highest created_at timestamp among those | 415 | /// Returns the state with the highest created_at timestamp among those |
| @@ -497,55 +472,6 @@ pub fn is_latest_state( | |||
| 497 | true | 472 | true |
| 498 | } | 473 | } |
| 499 | 474 | ||
| 500 | /// Get the authorization result for a repository from the database | ||
| 501 | /// | ||
| 502 | /// This is the main entry point for authorization that queries the database directly. | ||
| 503 | /// It: | ||
| 504 | /// 1. Fetches all announcements and states for the identifier with a single query | ||
| 505 | /// 2. Collects all authorized maintainers from announcements | ||
| 506 | /// 3. Finds the latest state event from an authorized maintainer | ||
| 507 | /// | ||
| 508 | /// Returns an `AuthorizationResult` that indicates whether a push is authorized. | ||
| 509 | pub async fn get_authorization_from_db( | ||
| 510 | database: &SharedDatabase, | ||
| 511 | identifier: &str, | ||
| 512 | ) -> Result<AuthorizationResult> { | ||
| 513 | // Fetch all repository data with a single query | ||
| 514 | let repo_data = fetch_repository_data_excluding_purgatory(database, identifier).await?; | ||
| 515 | |||
| 516 | if repo_data.announcements.is_empty() { | ||
| 517 | return Ok(AuthorizationResult::denied( | ||
| 518 | "No repository announcement found", | ||
| 519 | )); | ||
| 520 | } | ||
| 521 | |||
| 522 | // Collect all authorized maintainers (flattened across all owners) | ||
| 523 | let authorized = collect_all_authorized_maintainers(&repo_data.announcements); | ||
| 524 | |||
| 525 | if authorized.is_empty() { | ||
| 526 | return Ok(AuthorizationResult::denied( | ||
| 527 | "No authorized maintainers found", | ||
| 528 | )); | ||
| 529 | } | ||
| 530 | |||
| 531 | debug!( | ||
| 532 | "Found {} authorized maintainers for repository {}", | ||
| 533 | authorized.len(), | ||
| 534 | identifier | ||
| 535 | ); | ||
| 536 | |||
| 537 | // Find the latest authorized state | ||
| 538 | match find_latest_authorized_state(&repo_data.states, &authorized) { | ||
| 539 | Some(state) => Ok(AuthorizationResult::authorized( | ||
| 540 | state.clone(), | ||
| 541 | authorized.into_iter().collect(), | ||
| 542 | )), | ||
| 543 | None => Ok(AuthorizationResult::denied( | ||
| 544 | "No state event found from authorized publishers", | ||
| 545 | )), | ||
| 546 | } | ||
| 547 | } | ||
| 548 | |||
| 549 | /// Get the authorization result for a repository scoped to a specific owner | 475 | /// Get the authorization result for a repository scoped to a specific owner |
| 550 | /// | 476 | /// |
| 551 | /// Push authorization checks ONLY purgatory for state events. The database represents | 477 | /// Push authorization checks ONLY purgatory for state events. The database represents |