Commit `83d1ba3b20`

83d1ba3b2086bd28958403ede0fa292eb8291266

parent: 0215292cee

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-12 06:00 UTC

control: every refusal says what to do instead

Ref #183

internal/control/audit.go +1 −1

		@@ -20,7 +20,7 @@ func init() {
20	20
21	21	func runAudit(c *Ctx, args []string) int {
22	22	if !c.User.IsAdmin {
23		return c.fail(protocol.ExitDenied, "the audit log is for instance admins")
	23	return c.fail(protocol.ExitDenied, "the audit log is for instance admins; ask one")
24	24	}
25	25	f := store.AuditFilter{Limit: 100}
26	26	fl, err := parseFlags(args, flagSpec{Values: []string{"--limit", "--actor", "--action", "--since"}, MaxPos: 0, Usage: c.Cmd.Usage})

internal/control/build.go +4 −4

		@@ -376,7 +376,7 @@ func runRunnerNext(c *Ctx, args []string) int {
376	376	return c.fail(protocol.ExitFailure, "%v", err)
377	377	}
378	378	if !ok {
379		return c.fail(protocol.ExitDenied, "this key is not attached to %s", repo.Path())
	379	return c.fail(protocol.ExitDenied, "this key is not attached to %s; a repository admin attaches it with repo runner add", repo.Path())
380	380	}
381	381	repoIDs = append(repoIDs, repo.ID)
382	382	}
		@@ -475,7 +475,7 @@ func runRunnerLog(c *Ctx, args []string) int {
475	475	} else if ok, err := runnerMayBuild(c, key, b.RepoID); err != nil {
476	476	return c.fail(protocol.ExitFailure, "%v", err)
477	477	} else if !ok {
478		return c.fail(protocol.ExitDenied, "this key is not attached to the build's repository")
	478	return c.fail(protocol.ExitDenied, "this key is not attached to the build's repository; a repository admin attaches it with repo runner add")
479	479	}
480	480	// Stream stdin into the log in chunks so long builds appear live. An
481	481	// append that fails drops its chunk and the loop keeps draining: ending
		@@ -555,7 +555,7 @@ func runRunnerDone(c *Ctx, args []string) int {
555	555	if ok, err := runnerMayBuild(c, key, b.RepoID); err != nil {
556	556	return c.fail(protocol.ExitFailure, "%v", err)
557	557	} else if !ok {
558		return c.fail(protocol.ExitDenied, "this key is not attached to the build's repository")
	558	return c.fail(protocol.ExitDenied, "this key is not attached to the build's repository; a repository admin attaches it with repo runner add")
559	559	}
560	560	// Cancelled underneath the runner: its report is late, not wrong.
561	561	// The row, the status and the log were settled by the cancel.
		@@ -829,7 +829,7 @@ func runBuildCancel(c *Ctx, args []string) int {
829	829	return c.fail(protocol.ExitFailure, "%v", err)
830	830	}
831	831	if !policy.CanWrite(c.User, repo, grant) {
832		return c.fail(protocol.ExitDenied, "cancelling a build needs write access to %s", repo.Path())
	832	return c.fail(protocol.ExitDenied, "cancelling a build needs write access to %s; ask its owner", repo.Path())
833	833	}
834	834	if b.Status != "pending" && b.Status != "running" {
835	835	return c.fail(protocol.ExitUsage, "build %d is %s; only a queued or running build can be cancelled", b.Number, b.Status)

internal/control/commitfile.go +1 −1

		@@ -56,7 +56,7 @@ func runCommitFile(c *Ctx, args []string) int {
56	56	return c.fail(protocol.ExitUsage, "path must stay inside the repository")
57	57	}
58	58	if repo.Settings.RequireMR && slices.Contains(repo.Settings.ProtectedBranches, ref) {
59		return c.fail(protocol.ExitDenied, "branch %s accepts changes through merge requests only", ref)
	59	return c.fail(protocol.ExitDenied, "branch %s accepts changes through merge requests only; push another branch and open one", ref)
60	60	}
61	61	// The server authors this commit, so it cannot sign it.
62	62	if repo.Settings.RequireSignedCommits {

internal/control/org.go +1 −1

		@@ -53,7 +53,7 @@ func orgAdmin(c *Ctx, name string) (store.Org, int) {
53	53	return org, c.fail(protocol.ExitFailure, "%v", err)
54	54	}
55	55	if role != "admin" {
56		return org, c.fail(protocol.ExitDenied, "only admins of %s can do that", name)
	56	return org, c.fail(protocol.ExitDenied, "only admins of %s can do that; ask one", name)
57	57	}
58	58	return org, -1
59	59	}

internal/control/orglabel.go +1 −1

		@@ -56,7 +56,7 @@ func orgReader(c *Ctx, name string) (store.Org, []int64, int) {
56	56	return org, nil, c.fail(protocol.ExitFailure, "%v", err)
57	57	}
58	58	if role == "" && len(readable) == 0 {
59		return org, nil, c.fail(protocol.ExitDenied, "labels and milestones of %s are visible to its members", name)
	59	return org, nil, c.fail(protocol.ExitDenied, "labels and milestones of %s are visible to its members; ask an admin to add you", name)
60	60	}
61	61	return org, readable, -1
62	62	}

internal/control/snippet.go +1 −1

		@@ -93,7 +93,7 @@ func snippetRef(c *Ctx, id string, write bool) (store.Snippet, int) {
93	93	return sn, c.fail(protocol.ExitNotFound, "no snippet %q", id)
94	94	}
95	95	if write && !policy.CanWriteSnippet(c.User, sn) {
96		return sn, c.fail(protocol.ExitDenied, "snippet %s belongs to %s", id, sn.OwnerName)
	96	return sn, c.fail(protocol.ExitDenied, "snippet %s belongs to %s; only they can change it", id, sn.OwnerName)
97	97	}
98	98	return sn, -1
99	99	}

internal/control/teams.go +2 −2

		@@ -53,7 +53,7 @@ func orgAdminRef(c *Ctx, name string) (store.Org, int) {
53	53	return org, c.fail(protocol.ExitFailure, "%v", err)
54	54	}
55	55	if role != "admin" {
56		return org, c.fail(protocol.ExitDenied, "only admins of %s can manage teams", name)
	56	return org, c.fail(protocol.ExitDenied, "only admins of %s can manage teams; ask one to add you", name)
57	57	}
58	58	return org, -1
59	59	}
		@@ -71,7 +71,7 @@ func orgMemberRef(c *Ctx, name string) (store.Org, int) {
71	71	return org, c.fail(protocol.ExitFailure, "%v", err)
72	72	}
73	73	if role == "" {
74		return org, c.fail(protocol.ExitDenied, "teams of %s are visible to its members", name)
	74	return org, c.fail(protocol.ExitDenied, "teams of %s are visible to its members; ask an admin to add you", name)
75	75	}
76	76	return org, -1
77	77	}

Commit 83d1ba3b20

Commit `83d1ba3b20`