mirror of
https://github.com/runbear-io/beardrive.git
synced 2026-08-25 08:08:08 +02:00
Snow Lee
dfef5720df
The hub already abstracted authentication — AuthProvider, with BuiltinAuth as the built-in implementation — and then reached around that seam three times: Accounts() was declared on neither interface, admin.go type-asserted *BuiltinAuth (five handlers silently degraded to 404/empty under any other provider), and organizations were not on the seam at all. That last gap had teeth. A deployment whose identities come from elsewhere had no way to own its orgs, so the code that did own them wrote into the hub's OrgDB from the side — and nothing stopped the hub from inventing an org that the identity system had never heard of. One did: a hub-created org held every project while the mirrored one sat empty, and no sync path could see the difference. Directory (directory.go) is where organizations live now. LocalDirectory wraps today's OrgDB unchanged — same last-owner protection, same normEmail, same "o-"+randHex(4) ids, same file/SQL persistence — so a self-hosted hub behaves exactly as before. A deployment whose orgs are owned elsewhere implements the same interface, returns ErrManagedElsewhere from the write half, and the handlers answer 409 with ManageURL. The hub never learns why a write was refused, only where to send the user. Two rules shape the interface. Reads are on the request path: Role runs on every project request, including the /store/* endpoints a device hits every few seconds with a token that carries no identity claims, so an implementation backed by a remote system answers from its own cache — and that cache is its business, not the hub's. Writes are optional, because "this hub owns its orgs" is a deployment fact, not a code path. - Server.Orgs *OrgDB becomes Server.Dir Directory: 28 call sites, 8 nil-checks, one writeDirErr helper for the 409 translation. - /api/orgs gains manage_url per org — the destination of the account menu's Settings entry. The client follows a link and never branches on which kind of hub it is talking to. - Org administration becomes a real route, /orgs/<id>, retiring one of the two URL-less panels CLAUDE.md grandfathers. When a directory's ManageURL is not hub-local, the SPA fallback redirects there instead — so a hub that cannot administer its orgs cannot paint a console whose every control 409s. - Accounts() moves onto AuthProvider. admin.go's type assertion becomes an optional AccountApprover, and a provider without one now answers 503 rather than an empty approval queue: "no queue here" and "queue is empty" are different answers and only one of them was true. Two reviews drove the rest. The architecture review caught a browser page load that could delete org members (a display read ran the full membership reconcile, and a 200 with an empty user list evicted everyone), one write site that escaped the 409 translation, and a webhook that could wedge an event stream behind an unappliable event. The design review, over eight rounds, caught the org page rendering live controls on a hub that cannot use them, a share link made unrevokable by a long filename, nine keyboard tab stops parked off-screen behind a closed drawer, and — five separate times — a fix of mine that looked right in the source and did nothing in the browser. Conformance tests run both a writable and a read-only implementation against one contract; the seat, prune, and out-of-order regressions each have a test written to fail against the old code.
65 lines
2.9 KiB
Go
65 lines
2.9 KiB
Go
package webapp
|
|
|
|
import (
|
|
"errors"
|
|
"time"
|
|
)
|
|
|
|
// Directory is where a hub's organizations live. The built-in one is this
|
|
// package's OrgDB (LocalDirectory); a deployment whose users, orgs and
|
|
// memberships are owned by an external identity system supplies its own,
|
|
// alongside its AuthProvider.
|
|
//
|
|
// Two rules shape this interface:
|
|
//
|
|
// Reads are on the request path. Role is called for every project request,
|
|
// including the /store/* sync endpoints a device hits every few seconds with
|
|
// a device token that carries no identity claims. An implementation backed by
|
|
// a remote system therefore has to answer Role from a local cache, and that
|
|
// cache is the implementation's business — the hub does not keep one, does not
|
|
// refresh one, and must never be written to from the side. (It used to be:
|
|
// the hub owned the mirror and the auth provider poked at it, which is how a
|
|
// hub-invented org that the identity system had never heard of could exist.)
|
|
//
|
|
// Writes are optional. A directory that does not own its data returns
|
|
// ErrManagedElsewhere and the handler answers 409 with ManageURL, so the hub
|
|
// never needs to know WHY it cannot write — only where the user should go.
|
|
type Directory interface {
|
|
// ---- reads (request path) ----
|
|
Role(orgID, email string) string
|
|
Get(orgID string) (Org, bool)
|
|
OrgsFor(email string) []Org
|
|
ListInvites(orgID string) []OrgInvite
|
|
ValidInvite(token string) bool
|
|
// ManageURL is where this org is administered: a path within this hub
|
|
// when it owns its orgs, an external page when it does not. The client
|
|
// follows it and never has to know which kind of hub it is talking to.
|
|
ManageURL(orgID string) string
|
|
|
|
// ---- writes (ErrManagedElsewhere when the directory is read-only) ----
|
|
Create(name, ownerEmail string) (Org, error)
|
|
Rename(orgID, name string) error
|
|
AddMember(orgID, email, role string) error
|
|
SetRole(orgID, email, role string) error
|
|
RemoveMember(orgID, email string) error
|
|
CreateInvite(orgID, creator string, ttl time.Duration) (OrgInvite, error)
|
|
RevokeInvite(token string) bool
|
|
Redeem(token string) (OrgInvite, bool)
|
|
RecordInviteUse(token string)
|
|
}
|
|
|
|
// ErrManagedElsewhere is returned by a directory that does not own its
|
|
// organizations. Handlers turn it into 409 plus the org's ManageURL — the
|
|
// request was well-formed, it is the state of the world that makes it wrong.
|
|
var ErrManagedElsewhere = errors.New("this organization is managed outside this hub")
|
|
|
|
// LocalDirectory is the built-in directory: organizations owned by this hub,
|
|
// stored in its own metadata store. This is what every self-hosted install
|
|
// runs, and its behavior is exactly OrgDB's — the type exists to add the one
|
|
// thing an org store has no opinion about, which is where to send a browser
|
|
// to administer an org.
|
|
type LocalDirectory struct{ *OrgDB }
|
|
|
|
// ManageURL is the hub's own org page (a route in the frontend).
|
|
func (LocalDirectory) ManageURL(orgID string) string { return "/orgs/" + orgID }
|