Commit `d2860af98a`

d2860af98aa72c64374b7ef3b50f29aa0f9288ab

parent: 4ba5e2812c

Unsigned

cmc <hello@cleberg.net> · 2026-09-08 03:13 UTC

Access section shows where access comes from (!88)

repo access list reports effective access since v1.16.0 (krz/gitbay#200) with a source per row: owner, direct, org admin, org member, or team. The row shows a source chip for anything but a direct grant, and only a direct grant offers revoke. An older server's rows decode with no source and stay revocable.

Layout: unified · split

gitbay/Repos/RepoSettings.swift +6 −1

     var branches: [String] { protectedBranches ?? [] }
 }
-/// One row of `repo access list`: a user granted read, write or admin.
+/// One row of `repo access list`: an account and its effective role.
+/// Since v1.16.0 the row says where the access comes from — owner,
+/// direct, org admin, org member, or team; only a direct grant can be
+/// revoked here. An older server lists direct grants and says nothing.
 nonisolated struct AccessGrant: Decodable, Sendable, Hashable, Identifiable {
     let user: String
     let role: String
+    let source: String?
     var id: String { user }
+    var isDirect: Bool { source == nil || source == "direct" }
 }

gitbay/Views/Repos/RepoSettingsView.swift +8 −3

                             .font(.gbSans(.subheadline))
                     }
                     Spacer()
+                    if let source = grant.source, source != "direct" {
+                        GBChip(source, .secondary)
+                    }
                     Menu {
                         ForEach(["read", "write", "admin"], id: \.self) { role in
                             Button(role) { Task { await model.grant(user: grant.user, role: role) } }
                     .disabled(model.working)
                 }
                 .swipeActions {
-                    Button("Revoke", role: .destructive) {
+                    if grant.isDirect {
-                        revokingGrant = grant
+                        Button("Revoke", role: .destructive) {
+                            revokingGrant = grant
+                        }
                     }
                 }
             }
         } header: {
             Text("Access")
         } footer: {
-            Text("Direct grants only. Ownership and org membership carry their own access.")
+            Text("Everyone who can reach this repository and how. Only a direct grant can be revoked here; a role change grants directly.")
         }
     }

gitbayTests/RepoManagementTests.swift +11 −3

     @Test func accessGrantsLoadSeparately() async throws {
         let (model, stub) = try await loadedModel()
         stub.enqueue(.init(status: 200, json: """
-            {"protocol_version":1,"data":[{"user":"alice","role":"write"},\
+            {"protocol_version":1,"data":[{"user":"alice","role":"write","source":"direct"},\
-            {"user":"bob","role":"read"}],"exit_code":0}
+            {"user":"bob","role":"read","source":"team"},{"user":"cmc","role":"admin"}],"exit_code":0}
             """, match: "argv=access"))
         await model.loadGrants()
-        #expect(model.grants?.map(\.user) == ["alice", "bob"])
+        #expect(model.grants?.map(\.user) == ["alice", "bob", "cmc"])
         #expect(model.grants?.first?.role == "write")
+        // v1.16.0 says where the access comes from; only a direct grant
+        // can be revoked here. An older server says nothing.
+        #expect(model.grants?[0].source == "direct")
+        #expect(model.grants?[0].isDirect == true)
+        #expect(model.grants?[1].source == "team")
+        #expect(model.grants?[1].isDirect == false)
+        #expect(model.grants?[2].source == nil)
+        #expect(model.grants?[2].isDirect == true)
         #expect(model.grantsError == nil)
         let read = try #require(stub.seen.last)
         #expect(read.url.query() == "argv=repo&argv=access&argv=list&argv=krz/gitbay")

Commit d2860af98a

Commit `d2860af98a`