neiam /gitgud

Git Gud

Job-token access page: repo admins only

d423d5a · Gabriel Morell · 2026-10-22 16:25

10 files +21 -29

Message

{commit_body(@commit)}

modified lib/git_gud_web/live/job_token_live/index.ex

+13 −7

@@ -16,13 +16,19 @@ defmodule GitGudWeb.JobTokenLive.Index do

16	16	Repositories.get_repository_by_path!(owner, name)
17	17	\|> GitGud.Repo.preload([:owner, :organization])
18	18
19		− {:ok,
20		− socket
21		− \|> assign(:repo, repo)
22		− \|> assign(:handle, Storage.repo_handle(repo))
23		− \|> GitGudWeb.RepoLive.Header.assign_chrome(repo)
24		− \|> load()
25		− \|> assign(:page_title, "Job token access — #{owner}/#{name}")}
	19	+ # Repo admins only, like registry tokens: the list says which other
	20	+ # repositories can read this one's packages or start its workflows.
	21	+ if GitGudWeb.RepoAdmin.admin?(socket.assigns.current_scope.user, repo) do
	22	+ {:ok,
	23	+ socket
	24	+ \|> assign(:repo, repo)
	25	+ \|> assign(:handle, Storage.repo_handle(repo))
	26	+ \|> GitGudWeb.RepoLive.Header.assign_chrome(repo)
	27	+ \|> load()
	28	+ \|> assign(:page_title, "Job token access — #{owner}/#{name}")}
	29	+ else
	30	+ {:ok, GitGudWeb.RepoAdmin.deny(socket, repo)}
	31	+ end
26	32	end
27	33
28	34	# Which repository or organization the grant lets in, as the page

modified test/git_gud_web/live/job_token_live_test.exs

+8 −4

@@ -60,12 +60,16 @@ defmodule GitGudWeb.JobTokenLiveTest do

60	60	assert JobTokenGrants.list(repo) == []
61	61	end
62	62
63		− test "someone who can't administer the repository gets no form", %{conn: conn} do
	63	+ test "someone who can't administer the repository doesn't see the grants", %{conn: conn} do
64	64	{_owner, repo} = repository_fixture(%{visibility: "public"})
	65	+ {_, source} = repository_fixture()
	66	+ {:ok, _} = JobTokenGrants.create(repo, path_of(source), %{read: true})
65	67
66		− {:ok, _view, html} =
67		− conn \|> log_in_user(user_fixture()) \|> live("/r/#{path_of(repo)}/settings/job-tokens")
	68	+ assert {:error, {:redirect, %{to: to}}} =
	69	+ conn
	70	+ \|> log_in_user(user_fixture())
	71	+ \|> live("/r/#{path_of(repo)}/settings/job-tokens")
68	72
69		− refute html =~ ~s(phx-submit="create_grant")
	73	+ assert to == "/r/#{path_of(repo)}"
70	74	end
71	75	end

modified test/git_gud_web/live/repo_controls_audit_test.exs

+0 −18

@@ -9,7 +9,6 @@ defmodule GitGudWeb.RepoControlsAuditTest do

9	9
10	10	import Ecto.Query
11	11	import Phoenix.LiveViewTest
12		− import GitGud.AccountsFixtures
13	12	import GitGud.ForgeFixtures
14	13
15	14	alias GitGud.Audit.Entry

@@ -155,21 +154,4 @@ defmodule GitGudWeb.RepoControlsAuditTest do

155	154	assert created.metadata == %{"read" => true, "dispatch" => false}
156	155	assert {deleted.action, deleted.target_label} == {"job_token_grant.deleted", label}
157	156	end
158		−
159		− test "someone who isn't an admin changes nothing and leaves nothing", %{owner: owner} do
160		− {:ok, repo} =
161		− GitGud.Repositories.create_repository(owner, %{"name" => "open", "visibility" => "public"})
162		−
163		− {source_owner, source} = repository_fixture()
164		− conn = log_in_user(build_conn(), user_fixture())
165		− {:ok, lv, _} = live(conn, "/r/#{owner.handle}/open/settings/job-tokens")
166		−
167		− render_submit(lv, "create_grant", %{
168		− "source" => "#{Storage.owner_handle(source_owner)}/#{source.name}",
169		− "read" => "true"
170		− })
171		−
172		− assert GitGud.Workflows.JobTokenGrants.list(repo) == []
173		− assert entries(repo) == []
174		− end
175	157	end

Parents: 99ed362