| 1 | //! Authorization rules for repositories. |
| 2 | //! |
| 3 | //! The model is deliberately simple, matching a personal / small-team forge: |
| 4 | //! a repo is owned by one user; private repos are visible only to their owner; |
| 5 | //! writes (push) and settings changes are owner-only. Admins may do anything. |
| 6 | |
| 7 | use crate::models::{ |
| 8 | Repository, |
| 9 | User, |
| 10 | }; |
| 11 | |
| 12 | /// Whether `viewer` may read (browse / clone) `repo`. |
| 13 | pub fn can_read(repo: &Repository, viewer: Option<&User>) -> bool { |
| 14 | !repo.is_private || can_write(repo, viewer) |
| 15 | } |
| 16 | |
| 17 | /// Whether `viewer` may write (push) to / administer `repo`. |
| 18 | pub fn can_write(repo: &Repository, viewer: Option<&User>) -> bool { |
| 19 | match viewer { |
| 20 | Some(user) => user.id == repo.owner_id || user.is_admin, |
| 21 | None => false, |
| 22 | } |
| 23 | } |