Repository navigation
Conversation
Private projects can now be shared with members instead of being visible only
to their owner and admins. Access to everything else, from edits to builds,
is decided in one place.
- ProjectAccess centralizes project visibility and permissions; the inline
copies in ProjectResource, BuildResource and BranchResource are gone
- Starting a build requires the global lead or admin role and membership of
the project; admins bypass membership
- Membership is backed by a new projectmembership table with exactly one
OWNER per project (partial unique index); deleting a project cascades and
creating one records the creator as OWNER
- Membership API GET/POST/DELETE /api/projects/{id}/members[/{username}]
resolves usernames through Keycloak (cisys-backend service account);
owners and admins manage members, members and admins list them
- Project membership never grants what the caller's global role forbids;
subjects are never exposed outside the admin API
- Docs and the global-role x visibility x membership test matrix updated
Contributor
|
A project can have multiple leads and multiple members - the |
Author
|
@jesperpedersen
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #15
Problem
Project access relied on global Keycloak roles and
Project.ownerSubject. Private projects could not be shared, any lead could build public projects, and authorization logic was duplicated across resources.Changes
ProjectMembershipwithOWNERandMEMBERroles.OWNER.ProjectAccessto centralize visibility and authorization checks.502.ownerSubjectis retained, but authorization relies on membership.Database
make resetis required. No migration or backfill is provided, as agreed in the issue discussion. Reset deletes local database and Keycloak volumes.Questions
OWNERs, or oneOWNERwith multiple lead-role members?LEAD + membershipas stated in the issue, orLEAD + OWNERas currently implemented?