mab122
/
radicle-heartwood-lfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

radicle: Authorize certain changes if no-op 

For backwards compatibility, if a change is a no-op, we allow it even if
it's normall not authorized.
This commit is contained in:
cloudhead 2024-02-23 18:29:07 +01:00
parent 0726754b0e
commit 09f2befa58
No known key found for this signature in database
2 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
radicle/src/cob/issue.rs
View File

@ -329,7 +329,14 @@ impl Issue {
let author: ActorId = *self.author().id().as_key();
let outcome = match action {
// Only delegate can assign someone to an issue.
Action::Assign { .. } => Authorization::Deny,
Action::Assign { assignees } => {
if assignees == &self.assignees {
// No-op is allowed for backwards compatibility.
Authorization::Allow
} else {
Authorization::Deny
}
}
// Issue authors can edit their own issues.
Action::Edit { .. } => Authorization::from(*actor == author),
// Issue authors can close or re-open their own issue.
@ -338,7 +345,14 @@ impl Issue {
State::Open => *actor == author,
}),
// Only delegate can label an issue.
Action::Label { .. } => Authorization::Deny,
Action::Label { labels } => {
if labels == &self.labels {
// No-op is allowed for backwards compatibility.
Authorization::Allow
} else {
Authorization::Deny
}
}
// All roles can comment on an issues
Action::Comment { .. } => Authorization::Allow,
// All roles can edit or redact their own comments.

9
radicle/src/cob/patch.rs
View File

@ -632,7 +632,14 @@ impl Patch {
Lifecycle::Archived { .. } => actor == author,
}),
// Only delegates can carry out these actions.
Action::Label { .. } => Authorization::Deny,
Action::Label { labels } => {
if labels == &self.labels {
// No-op is allowed for backwards compatibility.
Authorization::Allow
} else {
Authorization::Deny
}
}
Action::Assign { .. } => Authorization::Deny,
Action::Merge { .. } => match self.target() {
MergeTarget::Delegates => Authorization::Deny,