update policy due to scenario

ceres/src/protocol/mod.rs

@@ -146,7 +146,7 @@ impl SmartProtocol {
 
     pub async fn pack_handler(&self) -> Result<Arc<dyn PackHandler>, ProtocolError> {
         let import_dir = self.context.config.monorepo.import_dir.clone();
-        if self.path.starts_with(import_dir.clone()) && self.path != import_dir {
+        if self.path.starts_with(import_dir.clone()) {
             let storage = self.context.services.git_db_storage.clone();
             let path_str = self.path.to_str().unwrap();
             let model = storage.find_git_repo_exact_match(path_str).await.unwrap();

saturn/Cargo.toml

@@ -5,7 +5,6 @@ edition = "2021"
 
 [dependencies]
 common = { workspace = true }
-tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tracing = { workspace = true }

saturn/mega.cedarschema

@@ -5,16 +5,15 @@ entity Repository = {
     "is_private": Bool,
     "admins": UserGroup,
     "maintainers": UserGroup,
+    "readers": UserGroup,
 };
 
 entity MergeRequest = {
     "repo": Repository,
-    "owner": User,
 };
 
 entity Issue = {
     "repo": Repository,
-    "owner": User,
 };
 
 action "deleteRepo", "viewRepo", "forkRepo", "pullRepo", "pushRepo" appliesTo {
@@ -24,12 +23,12 @@ action "deleteRepo", "viewRepo", "forkRepo", "pullRepo", "pushRepo" appliesTo {
 
 action "createMergeRequest", "editMergeRequest", "deleteMergeRequest", "approveMergeRequest" appliesTo {
     principal: [User],
-    resource: [MergeRequest],
+    resource: [Repository],
 };
 
 action "openIssue", "assignIssue", "deleteIssue", "editIssue" appliesTo {
     principal: [User],
-    resource: [Issue],
+    resource: [Repository],
 };
 
 action "addMaintainer", "addAdmin" appliesTo {

saturn/mega_policies.cedar

@@ -5,55 +5,53 @@ permit (
         [Action::"viewRepo",
          Action::"pullRepo",
          Action::"forkRepo",
-         Action::"pushRepo"],
+         Action::"pushRepo",
+         Action::"openIssue",
+         Action::"createMergeRequest"],
     resource
 )
 unless { resource.is_private };
 
+//Actions for readers
 permit (
     principal,
-    action in [Action::"openIssue", Action::"createMergeRequest"],
+    action in
+        [Action::"viewRepo",
+         Action::"pullRepo",
+         Action::"forkRepo",
+         Action::"pushRepo",
+         Action::"openIssue",
+         Action::"createMergeRequest"],
     resource
 )
-unless { resource.repo.is_private };
+when { principal in resource.readers };
 
 //Actions for maintainers
 permit (
     principal,
-    action in [Action::"editIssue", Action::"editMergeRequest"],
-    resource
-)
-when { principal in resource.repo.maintainers || principal == resource.owner };
-
-permit (
-    principal,
-    action in [Action::"assignIssue", Action::"approveMergeRequest"],
+    action in
+        [Action::"editIssue",
+         Action::"editMergeRequest",
+         Action::"assignIssue",
+         Action::"approveMergeRequest"],
     resource
 )
-when { principal in resource.repo.maintainers };
+when { principal in resource.maintainers };
 
 //Actions for admins
 permit (
     principal,
     action in
-        [Action::"viewRepo",
-         Action::"pullRepo",
-         Action::"forkRepo",
-         Action::"pushRepo",
-         Action::"addMaintainer",
+        [Action::"addMaintainer",
          Action::"addAdmin",
-         Action::"deleteRepo"],
-    resource
-)
-when { principal in resource.admins };
-
-permit (
-    principal,
-    action in
-        [Action::"openIssue",
-         Action::"createMergeRequest",
+         Action::"deleteRepo",
          Action::"deleteIssue",
          Action::"deleteMergeRequest"],
     resource
 )
-when { principal in resource.repo.admins };
+when { principal in resource.admins };
+
+
+// root admin can do anything
+permit (principal, action, resource)
+when { principal == User::"genedna" };

saturn/src/context.rs

@@ -10,7 +10,7 @@ use crate::{entitystore::EntityStore, util::EntityUid};
 
 #[allow(dead_code)]
 pub struct AppContext {
-    entities: EntityStore,
+    pub entities: EntityStore,
     authorizer: Authorizer,
     policies: PolicySet,
     schema: Schema,
@@ -44,7 +44,7 @@ pub enum Error {
 
 impl AppContext {
     pub fn new(
-        entities_path: impl Into<PathBuf>,
+        entities: EntityStore,
         schema_path: impl Into<PathBuf>,
         policies_path: impl Into<PathBuf>,
     ) -> Result<Self, ContextError> {
@@ -53,8 +53,6 @@ impl AppContext {
 
         let schema_file = std::fs::File::open(schema_path)?;
         let (schema, _) = Schema::from_file_natural(schema_file).unwrap();
-        let entities_file = std::fs::File::open(entities_path.into())?;
-        let entities = serde_json::from_reader(entities_file)?;
         let policy_src = std::fs::read_to_string(policies_path)?;
         let policies = policy_src.parse()?;
         let validator = Validator::new(schema.clone());

saturn/src/entitystore.rs

@@ -31,4 +31,12 @@ impl EntityStore {
             .chain(issues);
         Entities::from_entities(all, Some(schema)).unwrap()
     }
+
+    pub fn merge(&mut self, other: EntityStore) {
+        self.users.extend(other.users);
+        self.repos.extend(other.repos);
+        self.merge_requests.extend(other.merge_requests);
+        self.issues.extend(other.issues);
+        self.user_groups.extend(other.user_groups);
+    }
 }