82c0676 · 520140e · 53ce4fe · 32132f1
@@ -0,0 +1,9 @@
# Connecting an origin read-only (#10519)
Tick **Read-only** when you connect an account by token (Settings → Origins, either form), pass `"readOnly": true` to `POST /api/v1/user/origins`, or answer `yes` to the last prompt of `c` in the terminal's Connected origins screen. Reading and syncing go on; nothing is ever written back: no comments, issues, reviews, branches, forks, proposals, pushes or mirror-out.
- **What you see:** the origins list says "read-only: nothing is written back" on the row (the terminal row says `read-only`). A refused write says so in a plain sentence; the REST door answers `409` with `"error": "origin_read_only"`.
- **Merging** on a mirror is never done from here, read-only or not (`mirrored`).
- **Stored:** `origin.read_only`, default 0, so every connection from before stays as it was. The token stays sealed either way.
- **Try it:** connect with Read-only ticked, mirror a repository, comment on it: refused, and the origin saw no write.
- Test: `test/origin-read-only.test.ts`.
@@ -180,6 +180,7 @@
export async function originPush(
  if (!link) return ok(undefined);
  if (link.origin.userId !== actor.id) return err("origin_owner_only");
  if (link.cloneUrl === "") return err("origin_unreachable");
  if (link.origin.readOnly) return err("origin_read_only");
  if (writesPaused(app, link.origin.id) !== undefined)
    return err("origin_paused");
  if (denied(link.origin, link.fullName)) return err("origin_protected");
@@ -75,6 +75,7 @@
export type ForkOriginError =
  | "origin_refused"
  /** The connection is not verified against the operator's rules yet. */
  | "origin_paused"
  | "origin_read_only"
  /** The origin took the request and the fork never appeared in time. */
  | "fork_timeout";
@@ -123,6 +124,7 @@
export async function forkOrigin(
  // Somebody else's connected account does not exist for you (invariant 9).
  const origin = getOriginFor(app.db, user.value.id, originId);
  if (!origin) return err("not_found");
  if (origin.readOnly) return err("origin_read_only");
  if (writesPaused(app, origin.id) !== undefined) return err("origin_paused");
  const provider = providerForOrigin(app, origin);
  if (!provider.ok) return err("origin_unreachable");
@@ -271,6 +273,7 @@
export async function contribute(
  if (!proven.ok) return proven;
  const origin = getOriginFor(app.db, user.value.id, input.originId);
  if (!origin) return err("not_found");
  if (origin.readOnly) return err("origin_read_only");
  if (writesPaused(app, origin.id) !== undefined) return err("origin_paused");
  const branch = input.branch.trim();
  if (!isSafeRef(branch) || branch.startsWith("refs/"))
@@ -167,6 +167,8 @@
export interface ConnectInput {
  /** Set when the user picked a forge explicitly (GitHub Enterprise). */
  kind?: OriginKind;
  token: string;
  /** Connect read-only: every write-through on its mirrors refuses. */
  readOnly?: boolean;
}
/**
@@ -232,6 +234,7 @@
export async function connectOrigin(
    token: input.token.trim(),
    authKind: "pat",
    software: softwareOf(found.value.software),
    ...(input.readOnly === true ? { readOnly: true } : {}),
  });
  if (!stored.ok) return stored;
  if (guard.value.checked) noteGuardPassed(app, stored.value.id);
@@ -362,6 +365,7 @@
function storeOrigin(
    refreshToken?: string;
    expiresAt?: string | null;
    software?: string;
    readOnly?: boolean;
  },
): Result<Origin, "already_connected"> {
  // Connecting an account whose credential died is re-authorizing it: the
@@ -406,6 +410,7 @@
function storeOrigin(
      : { refreshToken: input.refreshToken }),
    ...(input.expiresAt === undefined ? {} : { expiresAt: input.expiresAt }),
    ...(input.software === undefined ? {} : { software: input.software }),
    ...(input.readOnly === true ? { readOnly: true } : {}),
  });
  if (!created.ok) return created;
  // The payload names the host and the login and nothing else: an audit
@@ -0,0 +1,1 @@
75cb52dfd21642bc2a202621e2728eda05856f275a572575ba51f48bcacb913e
@@ -0,0 +1,5 @@
// An origin connected read-only: every write-through on its mirrors refuses
// (`origin_read_only`). Off for every row from before. Additive.
export default `
  ALTER TABLE origin ADD COLUMN read_only INTEGER NOT NULL DEFAULT 0;
  `;
@@ -36,6 +36,7 @@
interface OriginRow {
  expires_at: string | null;
  needs_reauth: number;
  software: string;
  read_only: number;
}
function toOrigin(row: OriginRow): Origin {
@@ -53,6 +54,7 @@
function toOrigin(row: OriginRow): Origin {
    expiresAt: row.expires_at,
    needsReauth: row.needs_reauth === 1,
    software: row.software,
    readOnly: row.read_only === 1,
  };
}
@@ -72,6 +74,8 @@
export interface CreateOriginInput {
  expiresAt?: string | null;
  /** `forge` for another forge; see `Origin.software`. */
  software?: string;
  /** Connect read-only; set once here and never cleared silently. @default false */
  readOnly?: boolean;
}
export type CreateOriginError = "already_connected";
@@ -97,8 +101,8 @@
export function createOrigin(
  const originId = id();
  db.query(
    `INSERT INTO origin (id, user_id, kind, api_url, web_url, login, token_enc,
                         auth_kind, refresh_token_enc, expires_at, software)
     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)`,
                         auth_kind, refresh_token_enc, expires_at, software, read_only)
     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
  ).run(
    originId,
    input.userId,
@@ -113,6 +117,7 @@
export function createOrigin(
      : seal(dataDir, input.refreshToken, originId),
    input.expiresAt ?? null,
    input.software ?? "",
    input.readOnly === true ? 1 : 0,
  );
  return ok(getOriginById(db, originId)!);
}
@@ -680,6 +680,12 @@
export function originAware(error: string, status = 422): Response {
      409,
      "the operator protects this repository at its origin: nothing is pushed to it from here; propose the change from your fork",
    );
  if (error === "origin_read_only")
    return apiError(
      "origin_read_only",
      409,
      "this account was connected read-only, so nothing is written through it; nothing was changed",
    );
  if (error === "origin_paused")
    return apiError(
      "origin_paused",
@@ -269,6 +269,7 @@
export function userRoutes(router: Router<Handler>): void {
        ? { kind }
        : {}),
      token: str(input.token),
      readOnly: input.readOnly === true,
    });
    if (!connected.ok) {
      // A refusal that names its own reason (a missing scope) keeps it;
@@ -72,6 +72,8 @@
export function credentialFor(
    software: origin.software,
    token: () => resolveToken(app, origin.id),
    writable: () => {
      if (origin.readOnly)
        return { ok: false, error: { error: "forbidden", message: READ_ONLY } };
      const paused = writesPaused(app, origin.id);
      return paused === undefined
        ? { ok: true, value: true }
@@ -247,6 +249,10 @@
const GUARD_GIVE_UP_MS = 24 * 60 * 60_000;
/** The sweep's pause between requests: one origin at a time, gently. */
const SWEEP_PAUSE_MS = 500;
/** What a write through a read-only origin is told (`origin_read_only`), everywhere. */
export const READ_ONLY =
  "This account was connected read-only, so nothing is written through it. Reading and syncing go on.";
      
        sentinelcrew
        1d ago
        outdated
      
      Principle 8: lead with a plain sentence, not the error code. The code travels in the error field.
    
/** What a write through a paused origin is told, everywhere. */
export const WRITES_PAUSED =
  "This forge could not verify this connection against the operator's rules, so writes through it are paused. Reads and sync go on. Check it again under Settings → Origins.";
@@ -33,7 +33,7 @@
import type { Repo } from "../core/repos.ts";
import { denied } from "./operator.ts";
import { resolveOid } from "../git/merge.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { writesPaused } from "./credential.ts";
import { READ_ONLY, writesPaused } from "./credential.ts";
import { redact, secretsIn } from "./credentials.ts";
import { pushToOrigin } from "./git-mirror.ts";
import type { Provider, RemoteRepo } from "./types.ts";
@@ -243,6 +243,7 @@
export async function pushToFork(
): Promise<Result<string, string>> {
  // Its callers ask too; this is the push itself asking, so no path that
  // forgets cannot write through an origin whose account is not verified.
  if (origin.readOnly) return err(READ_ONLY);
  const paused = writesPaused(app, origin.id);
  if (paused !== undefined) return err(paused);
  const tip = await resolveOid(dir, `refs/heads/${branch}`);
@@ -37,7 +37,7 @@
import { FORWARDED_GIT_ENV, type RefUpdate } from "../git/hook-protocol.ts";
import { fetchInto, resolveOid, writeRef } from "../git/merge.ts";
import { repoDir } from "../git/repos.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { providerForOrigin, writesPaused } from "./credential.ts";
import { providerForOrigin, READ_ONLY, writesPaused } from "./credential.ts";
import { redact, secretsIn } from "./credentials.ts";
import { pushToOrigin, snapshotRefs } from "./git-mirror.ts";
import { denied } from "./operator.ts";
@@ -199,6 +199,8 @@
async function wayThrough(
      message: "this mirror has no upstream clone URL; re-mirror it",
    });
  if (link.origin.readOnly)
    return err({ message: `${link.origin.webUrl}: ${READ_ONLY}` });
  const paused = writesPaused(app, link.origin.id);
  if (paused !== undefined)
    return err({ message: `${link.origin.webUrl}: ${paused}` });
@@ -258,6 +260,7 @@
export async function pushToMirrorTarget(
  };
  const origin = getOriginById(app.db, target.originId);
  if (!origin) return fail("the origin was disconnected; reconnect it");
  if (origin.readOnly) return fail(READ_ONLY);
  const provider = providerForOrigin(app, origin);
  if (!provider.ok) return fail("the origin needs to be reconnected");
  const authEnv = await provider.value.gitAuthEnv(target.cloneUrl);
@@ -47,6 +47,8 @@
export interface Origin {
   * forge (stored as a Gitea origin, which is the dialect it speaks), else "".
   */
  readonly software: string;
  /** Connected read-only: nothing is ever written through it (`origin_read_only`). */
  readonly readOnly: boolean;
}
/** A repository as the origin describes it — the import picker's rows. */
@@ -24,6 +24,8 @@
export type WriteThroughError =
  | "origin_refused"
  /** The account behind the origin is not verified against the operator's rules yet. */
  | "origin_paused"
  /** The origin was connected read-only: nothing is written through it. */
  | "origin_read_only"
  /** The operator protects the origin repository: propose from a fork. */
  | "origin_protected";
@@ -53,6 +55,7 @@
export function writeThroughFor(
  const link = originForRepo(app.db, repo.id);
  if (!link) return ok(undefined);
  if (link.origin.userId !== actor.id) return err("origin_owner_only");
  if (link.origin.readOnly) return err("origin_read_only");
  if (writesPaused(app, link.origin.id) !== undefined)
    return err("origin_paused");
  const provider = providerForOrigin(app, link.origin);
@@ -982,6 +982,7 @@
const MESSAGES: Record<string, string> = {
  mirrored: "this repo mirrors an origin — do it there",
  origin_owner_only: "only whoever connected this origin can write through it",
  origin_refused: "the origin refused that; nothing changed here",
  origin_read_only: "this account was connected read-only; nothing is written through it",
  origin_paused: "this connection is not verified yet; writes are paused",
  origin_protected: "the operator protects this repository at its origin: nothing is pushed to it from here; propose the change from your fork",
  origin_unreachable: "the origin could not be reached; nothing changed",
@@ -55,7 +55,7 @@
export function connectionsScreen(f: Session, ctx: Ctx): Screen {
          return {
            title: `${host(o.webUrl)} · ${o.login}`,
            ...(o.lastError !== "" || writesPaused(f.app, o.id) !== undefined ? { tone: "danger" as const } : {}),
            secondary: `${o.software === "forge" ? "another forge · " : ""}${k} repositor${k === 1 ? "y" : "ies"} · ${day(o.lastSyncAt)}`,
            secondary: `${o.software === "forge" ? "another forge · " : ""}${o.readOnly ? "read-only · " : ""}${k} repositor${k === 1 ? "y" : "ies"} · ${day(o.lastSyncAt)}`,
            meta: o.lastError !== "" ? o.lastError : writesPaused(f.app, o.id) !== undefined ? "writes paused" : o.authKind === "oauth" ? "OAuth" : "token",
          };
        }),
@@ -81,11 +81,21 @@
export function connectionsScreen(f: Session, ctx: Ctx): Screen {
                  mask: true,
                  onSubmit: (token) => {
                    if (token.trim() === "") return "Paste the token.";
                    ctx.toast(`Connecting ${hostText}…`);
                    return connectOrigin(f.app, user, { host: hostText, token }).then((r) => {
                      ctx.toast(r.ok ? `Connected ${r.value.login} at ${host(r.value.webUrl)}.` : connectRefusal(r.error).message ?? connectWords(connectRefusal(r.error).code), r.ok ? "success" : "danger");
                      ctx.invalidate();
                    });
                    return later(ctx, () =>
                      promptScreen(ctx, screen, {
                        title: "Connect an origin",
                        label: "Read-only? Type yes to never write back to it",
                        hint: "Leave empty to connect the ordinary way.",
                        onSubmit: (answer) => {
                          const readOnly = /^y(es)?$/i.test(answer.trim());
                          ctx.toast(`Connecting ${hostText}…`);
                          return connectOrigin(f.app, user, { host: hostText, token, readOnly }).then((r) => {
                            ctx.toast(r.ok ? `Connected ${r.value.login} at ${host(r.value.webUrl)}${readOnly ? ", read-only" : ""}.` : connectRefusal(r.error).message ?? connectWords(connectRefusal(r.error).code), r.ok ? "success" : "danger");
                            ctx.invalidate();
                          });
                        },
                      }),
                    );
                  },
                }),
              );
@@ -950,6 +950,8 @@
export function forkFailure(error: string): string {
    return "The origin could not be reached. Nothing was created.";
  if (error === "origin_refused")
    return "The origin refused to fork that repository.";
  if (error === "origin_read_only")
    return "This account was connected read-only, so nothing is written through it.";
  if (error === "origin_paused")
    return "This connection is not verified yet, so writes through it are paused. Check it again under Settings → Origins.";
  if (error === "mirror_failed")
@@ -128,6 +128,8 @@
export function editErrorText(error: unknown): string {
      return "The origin refused this change, so nothing landed here either.";
    if (error === "origin_protected")
      return "The operator protects this repository at its origin, so nothing is pushed to it from here. Propose the change from your fork.";
    if (error === "origin_read_only")
      return "This account was connected read-only, so nothing is written through it.";
    if (error === "origin_paused")
      return "This connection is not verified yet, so writes through it are paused. Check it again under Settings → Origins.";
    return "That edit could not be saved.";
@@ -281,6 +281,7 @@
function originCard(origin: Origin, mirrors: number, paused = false): Html {
      origin.webUrl,
    )}`,
    meta: html`${origin.authKind === "oauth" ? "OAuth" : "personal access token"}
      ${when(origin.readOnly, () => html` · read-only: nothing is written back`)}
      ·
      ${origin.lastSyncAt === null
        ? html`never synced`
@@ -591,11 +592,23 @@
function tokenSection(values: ConnectValues): Html {
        autocomplete: "off",
        hint: "It is never displayed after this.",
      })}
      ${readOnlyField()}
      ${tokenNeeds(values.tokenHost)}
      <div class="form-actions">${btn("Connect")}</div>
    </form>`;
}
/** The one Read-only checkbox, on every way to connect by token. */
function readOnlyField(): Html {
  return uiField({
    label: "Read-only",
    name: "readOnly",
    type: "checkbox",
    value: "1",
    hint: "Nothing is ever written back to that account: no comments, pulls, pushes or merges.",
  });
}
const OLDER_FORGE_DOC = "/trevato/forge/blob/main/docs/features/forge-origin-older.md#connecting-from-an-older-forge";
/** The one line for a forge older than 0.7.346 (#9626): it cannot start a connection, this side can. */
@@ -668,6 +681,7 @@
function forgeSection(ctx: Ctx, values: ConnectValues): Html {
        autocomplete: "off",
        hint: "Read is enough to bring an app; private repositories come with it.",
      })}
      ${readOnlyField()}
      <p class="muted small">Make the token there: ${tokens} (Settings → Access tokens).</p>
      <div class="form-actions">
        ${btn("Connect that forge", { variant: "primary", icon: "globe" })}
@@ -972,6 +986,7 @@
export async function originConnectToken(ctx: Ctx): Promise<Response> {
  const connected = await connectOrigin(ctx.app, ctx.auth.user, {
    host,
    token,
    readOnly: field(form, "readOnly") === "1",
  });
  if (!connected.ok) {
    // The host comes back; the token deliberately does not. Re-typing a
@@ -0,0 +1,259 @@
/**
 * An origin connected read-only (#10519): every write-through on a repo
 * mirrored from it answers `origin_read_only` before a request leaves the
 * forge, and a read (sync) still works. The fake remote records every request
 * it receives, so "refused" is proved by "the remote saw no write".
 */
import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { forkOrigin, contribute } from "../src/actions/contribute.ts";
import { createBranch } from "../src/actions/branches.ts";
import { addCommentThrough, openIssueThrough, setIssueLabelsThrough, setIssueStateThrough } from "../src/actions/issues.ts";
import { mergePull, openPull, submitReview } from "../src/actions/pulls.ts";
import { createSession } from "../src/core/sessions.ts";
import { getOriginById, listOrigins } from "../src/core/origins.ts";
import { setMirrorTarget } from "../src/core/migrate_mirror.ts";
import { forgetProviders } from "../src/origins/providers/index.ts";
import { getRepo } from "../src/core/repos.ts";
import { getUserByName } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { pushThrough, pushToMirrorTarget } from "../src/origins/push-through.ts";
import { syncsSettled } from "../src/origins/sync.ts";
import { mirrorAndWait, newFakeState, serveFakeForge, type FakeForge } from "./fake-origin.ts";
import { seedAdmin } from "./helpers/admin.ts";
import { proveAll } from "./helpers/verified.ts";
setDefaultTimeout(60_000);
const LOGIN = "octo";
const TOKEN = "octo-readonly-secret-5d1c";
const PASSWORD = "alice-login-secret";
const basic = (u: string, p: string) => `Basic ${Buffer.from(`${u}:${p}`).toString("base64")}`;
describe("an origin connected read-only", () => {
  const dirs: string[] = [];
  let app: App;
  let servers: Servers;
  let originApp: App;
  let originServers: Servers;
  let fake: FakeForge;
  let originId = "";
  const api = (path: string, init?: RequestInit) => {
    const headers = new Headers(init?.headers);
    headers.set("content-type", "application/json");
    headers.set("authorization", basic("alice", PASSWORD));
    return fetch(`${servers.url}${path}`, { ...init, headers });
  };
  const writes = () => fake.state.requests.filter((r) => r.method !== "GET" && r.method !== "HEAD");
  const alice = () => getUserByName(app.db, "alice")!;
  const repo = () => getRepo(app.db, "alice", "vault")!;
  const ghost = (n = 1): any => ({ repoId: repo().id, number: n });
  beforeAll(async () => {
    for (const p of ["forge-ro-", "forge-ro-up-"]) dirs.push(await mkdtemp(join(tmpdir(), p)));
    originApp = createApp({ dataDir: dirs[1]!, port: 0 });
    originServers = await serve(originApp);
    await seedAdmin(originApp, { username: LOGIN, email: "[email protected]", password: TOKEN });
    const oh = { "content-type": "application/json", authorization: basic(LOGIN, TOKEN) };
    await fetch(`${originServers.url}/api/v1/repos`, {
      method: "POST",
      headers: oh,
      body: JSON.stringify({ name: "vault", visibility: "public" }),
    });
    await fetch(`${originServers.url}/api/v1/repos/octo/vault/contents`, {
      method: "POST",
      headers: oh,
      body: JSON.stringify({ branch: "main", message: "first", files: [{ path: "a.txt", content: "one\n" }] }),
    });
    const state = newFakeState("github", LOGIN, TOKEN);
    state.repos.push({
      id: 9,
      fullName: "octo/vault",
      cloneUrl: `${originServers.url}/octo/vault.git`,
      defaultBranch: "main",
      htmlUrl: `${originServers.url}/octo/vault`,
      push: true,
    });
    fake = serveFakeForge(state);
    app = createApp({ dataDir: dirs[0]!, port: 0 });
    servers = await serve(app);
    const made = await seedAdmin(app, { username: "alice", email: "[email protected]", password: PASSWORD });
    if (!made.ok) throw new Error(made.error);
    const connected = (await (
      await api("/api/v1/user/origins", {
        method: "POST",
        body: JSON.stringify({ host: fake.url, kind: "github", token: TOKEN, readOnly: true }),
      })
    ).json()) as { id: string };
    originId = connected.id;
    await mirrorAndWait(
      await api(`/api/v1/user/origins/${originId}/mirror`, {
        method: "POST",
        body: JSON.stringify({ fullName: "octo/vault" }),
      }),
    );
    proveAll(app);
  });
  afterAll(async () => {
    await syncsSettled();
    fake.stop();
    servers.stop();
    originServers.stop();
    app.close();
    originApp.close();
    for (const d of dirs) await rm(d, { recursive: true, force: true });
  });
  test("the flag is stored, the token is still sealed and never shown", async () => {
    expect(getOriginById(app.db, originId)?.readOnly).toBe(true);
    const row = app.db.query<{ token_enc: string }, [string]>("SELECT token_enc FROM origin WHERE id = ?1").get(originId)!;
    expect(row.token_enc).not.toContain(TOKEN);
    const listed = await (await api("/api/v1/user/origins")).text();
    expect(listed).not.toContain(TOKEN);
  });
  test("a read (sync) still succeeds", async () => {
    const res = await api("/api/v1/repos/alice/vault/sync", { method: "POST" });
    expect(res.status).toBeLessThan(300);
    await syncsSettled();
  });
  test("every write-through refuses and the remote sees no write", async () => {
    const before = writes().length;
    const r = repo();
    const a = alice();
    const refused = (result: { ok: boolean; error?: unknown }) => {
      expect(result.ok).toBe(false);
      expect(result.error).toBe("origin_read_only");
    };
    refused(await openIssueThrough(app, a, r, { title: "hello" }));
    refused(await addCommentThrough(app, a, r, ghost(), "hi"));
    refused(await setIssueStateThrough(app, a, r, ghost(), "closed"));
    refused(await setIssueLabelsThrough(app, a, r, ghost(), ["bug"]));
    refused(await openPull(app, a, r, { title: "t", baseBranch: "main", headBranch: "x" }));
    refused(await submitReview(app, a, r, { ...ghost(), baseBranch: "main", headBranch: "main", crossRepo: false, sealed: false, baseOid: "", headOid: "" } as never, { state: "approved", body: "" }));
    refused(await createBranch(app, a, r, { name: "feature", from: "main" } as never));
    refused(await forkOrigin(app, a, originId, "octo/vault"));
    refused(
      await contribute(app, a, {
        originId,
        fullName: "octo/vault",
        branch: "work",
        files: [{ path: "x.txt", content: "x" }],
      } as never),
    );
    // Merging on a mirror is refused outright, whatever the origin's flag.
    const merged = await mergePull(app, a, r, { ...ghost(), originHeadRepo: null } as never, "merge");
    expect(merged.ok).toBe(false);
    // A push forwarded to the origin.
    const pushed = await pushThrough(app, r, [{ ref: "refs/heads/main", oldOid: "0".repeat(40), newOid: "1".repeat(40) }], {}, a.id);
    expect(pushed.ok).toBe(false);
    if (!pushed.ok) expect(pushed.error.message).toContain("connected read-only");
    // Mirror-out.
    setMirrorTarget(app.db, { repoId: r.id, originId, fullName: "octo/vault", cloneUrl: "http://127.0.0.1:1/x.git", tips: {} });
    const out = await pushToMirrorTarget(app, r);
    expect(out.ok).toBe(false);
    if (!out.ok) expect(out.error.message).toContain("connected read-only");
    expect(writes().length).toBe(before);
  });
      
        sentinelcrew
        1d ago
        outdated
      
      Vacuous: it edits the column and reads it back. Connect a second origin without readOnly and assert a write is not refused with origin_read_only.
    
  test("merging on a mirror is refused outright, with its own plain answer", async () => {
    const merged = await mergePull(app, alice(), repo(), { ...ghost(), originHeadRepo: null } as never, "merge");
    expect(merged.ok).toBe(false);
    if (!merged.ok) expect(merged.error).toBe("mirrored");
  });
  test("the REST door answers 409 origin_read_only", async () => {
    const res = await api("/api/v1/repos/alice/vault/issues", {
      method: "POST",
      body: JSON.stringify({ title: "nope" }),
    });
    expect(res.status).toBe(409);
    const body = (await res.json()) as { error: string; message: string };
    expect(body.error).toBe("origin_read_only");
    expect(body.message).not.toContain("origin_read_only");
  });
  test("an origin connected the ordinary way is not refused as read-only", async () => {
    const state = newFakeState("github", "plain", "plain-secret-77");
    state.repos.push({
      id: 10,
      fullName: "plain/vault2",
      cloneUrl: `${originServers.url}/octo/vault.git`,
      defaultBranch: "main",
      htmlUrl: `${originServers.url}/octo/vault`,
      push: true,
    });
    const plain = serveFakeForge(state);
    try {
      const made = (await (
        await api("/api/v1/user/origins", {
          method: "POST",
          body: JSON.stringify({ host: plain.url, kind: "github", token: "plain-secret-77" }),
        })
      ).json()) as { id: string };
      expect(getOriginById(app.db, made.id)?.readOnly).toBe(false);
      await mirrorAndWait(
        await api(`/api/v1/user/origins/${made.id}/mirror`, {
          method: "POST",
          body: JSON.stringify({ fullName: "plain/vault2" }),
        }),
      );
      proveAll(app);
      const second = getRepo(app.db, "alice", "vault2")!;
      const result = await openIssueThrough(app, alice(), second, { title: "hello" });
      if (!result.ok) expect(result.error).not.toBe("origin_read_only");
      expect(plain.state.requests.some((r) => r.method === "POST")).toBe(true);
    } finally {
      await syncsSettled();
      plain.stop();
    }
  });
  test("a row from before the migration is off: the column defaults to 0", () => {
    const col = app.db
      .query<{ name: string; notnull: number; dflt_value: string }, []>("PRAGMA table_info(origin)")
      .all()
      .find((c) => c.name === "read_only")!;
    expect(col.notnull).toBe(1);
    expect(col.dflt_value).toBe("0");
  });
  test("the web form: readOnly=1 stores the flag, the list shows it, unticked stores none", async () => {
    const cookie = `forge_session=${createSession(app.db, alice().id).token}`;
    const connect = async (login: string, extra: Record<string, string>) => {
      forgetProviders(dirs[0]!);
      const state = newFakeState("forgejo", login, `${login}-tok-123`);
      const f = serveFakeForge(state);
      try {
        const res = await fetch(`${servers.url}/settings/origins/token`, {
          method: "POST",
          headers: { cookie, origin: new URL(servers.url).origin },
          body: new URLSearchParams({ host: f.url, token: `${login}-tok-123`, ...extra }),
          redirect: "manual",
        });
        expect(res.status).toBe(303);
      } finally {
        f.stop();
      }
      return listOrigins(app.db, alice().id).find((o) => o.login === login)!;
    };
    const ticked = await connect("webro", { readOnly: "1" });
    expect(ticked.readOnly).toBe(true);
    const unticked = await connect("webrw", {});
    expect(unticked.readOnly).toBe(false);
    const page = await (await fetch(`${servers.url}/settings/origins`, { headers: { cookie } })).text();
    expect(page).toContain("read-only: nothing is written back");
  });
});
@@ -86,6 +86,8 @@
test("c connects another forge by address and token, and the list says what did
    await type(friendToken);
    expect(app.screen.toText()).not.toContain(friendToken);
    await key("enter");
    expect(app.screen.toText()).toContain("Read-only?");
    await key("enter");
    for (let i = 0; i < 50 && listOrigins(mine.db, getUserByName(mine.db, "alice")!.id).length === 0; i++) await Bun.sleep(100);
    if (listOrigins(mine.db, getUserByName(mine.db, "alice")!.id).length === 0) throw new Error(`never came: still waiting while listOrigins(mine.db, getUserByName(mine.db, "alice")!.id).length === 0`);
    await settleApp(app);
@@ -128,6 +130,7 @@
test("a token the forge refuses connects nothing and says so", async () => {
    await press("enter");
    await type("forge_not_a_token");
    await press("enter");
    await press("enter");
    for (let i = 0; i < 30 && !app.screen.toText().includes("refused"); i++) {
      await Bun.sleep(100);
      await settleApp(app);
@@ -54,6 +54,7 @@
const remoteOf = (src: RepoSource): RepoSource => ({
      authKind: "pat",
      expiresAt: null,
      needsReauth: false,
      readOnly: false,
      software: "",
    },
    fullName: "someone/else",
		@@ -0,0 +1,9 @@
	1	# Connecting an origin read-only (#10519)
	2
	3	Tick Read-only when you connect an account by token (Settings → Origins, either form), pass `"readOnly": true` to `POST /api/v1/user/origins`, or answer `yes` to the last prompt of `c` in the terminal's Connected origins screen. Reading and syncing go on; nothing is ever written back: no comments, issues, reviews, branches, forks, proposals, pushes or mirror-out.
	4
	5	- What you see: the origins list says "read-only: nothing is written back" on the row (the terminal row says `read-only`). A refused write says so in a plain sentence; the REST door answers `409` with `"error": "origin_read_only"`.
	6	- Merging on a mirror is never done from here, read-only or not (`mirrored`).
	7	- Stored: `origin.read_only`, default 0, so every connection from before stays as it was. The token stays sealed either way.
	8	- Try it: connect with Read-only ticked, mirror a repository, comment on it: refused, and the origin saw no write.
	9	- Test: `test/origin-read-only.test.ts`.
		@@ -180,6 +180,7 @@ export async function originPush(
180	180	if (!link) return ok(undefined);
181	181	if (link.origin.userId !== actor.id) return err("origin_owner_only");
182	182	if (link.cloneUrl === "") return err("origin_unreachable");
	183	if (link.origin.readOnly) return err("origin_read_only");
183	184	if (writesPaused(app, link.origin.id) !== undefined)
184	185	return err("origin_paused");
185	186	if (denied(link.origin, link.fullName)) return err("origin_protected");
		@@ -75,6 +75,7 @@ export type ForkOriginError =
75	75	\| "origin_refused"
76	76	/** The connection is not verified against the operator's rules yet. */
77	77	\| "origin_paused"
	78	\| "origin_read_only"
78	79	/** The origin took the request and the fork never appeared in time. */
79	80	\| "fork_timeout";
80	81
		@@ -123,6 +124,7 @@ export async function forkOrigin(
123	124	// Somebody else's connected account does not exist for you (invariant 9).
124	125	const origin = getOriginFor(app.db, user.value.id, originId);
125	126	if (!origin) return err("not_found");
	127	if (origin.readOnly) return err("origin_read_only");
126	128	if (writesPaused(app, origin.id) !== undefined) return err("origin_paused");
127	129	const provider = providerForOrigin(app, origin);
128	130	if (!provider.ok) return err("origin_unreachable");
		@@ -271,6 +273,7 @@ export async function contribute(
271	273	if (!proven.ok) return proven;
272	274	const origin = getOriginFor(app.db, user.value.id, input.originId);
273	275	if (!origin) return err("not_found");
	276	if (origin.readOnly) return err("origin_read_only");
274	277	if (writesPaused(app, origin.id) !== undefined) return err("origin_paused");
275	278	const branch = input.branch.trim();
276	279	if (!isSafeRef(branch) \|\| branch.startsWith("refs/"))
		@@ -167,6 +167,8 @@ export interface ConnectInput {
167	167	/** Set when the user picked a forge explicitly (GitHub Enterprise). */
168	168	kind?: OriginKind;
169	169	token: string;
	170	/** Connect read-only: every write-through on its mirrors refuses. */
	171	readOnly?: boolean;
170	172	}
171	173
172	174	/**
		@@ -232,6 +234,7 @@ export async function connectOrigin(
232	234	token: input.token.trim(),
233	235	authKind: "pat",
234	236	software: softwareOf(found.value.software),
	237	...(input.readOnly === true ? { readOnly: true } : {}),
235	238	});
236	239	if (!stored.ok) return stored;
237	240	if (guard.value.checked) noteGuardPassed(app, stored.value.id);
		@@ -362,6 +365,7 @@ function storeOrigin(
362	365	refreshToken?: string;
363	366	expiresAt?: string \| null;
364	367	software?: string;
	368	readOnly?: boolean;
365	369	},
366	370	): Result<Origin, "already_connected"> {
367	371	// Connecting an account whose credential died is re-authorizing it: the
		@@ -406,6 +410,7 @@ function storeOrigin(
406	410	: { refreshToken: input.refreshToken }),
407	411	...(input.expiresAt === undefined ? {} : { expiresAt: input.expiresAt }),
408	412	...(input.software === undefined ? {} : { software: input.software }),
	413	...(input.readOnly === true ? { readOnly: true } : {}),
409	414	});
410	415	if (!created.ok) return created;
411	416	// The payload names the host and the login and nothing else: an audit
		@@ -0,0 +1,1 @@
	1	75cb52dfd21642bc2a202621e2728eda05856f275a572575ba51f48bcacb913e
		@@ -0,0 +1,5 @@
	1	// An origin connected read-only: every write-through on its mirrors refuses
	2	// (`origin_read_only`). Off for every row from before. Additive.
	3	export default `
	4	ALTER TABLE origin ADD COLUMN read_only INTEGER NOT NULL DEFAULT 0;
	5	`;
		@@ -36,6 +36,7 @@ interface OriginRow {
36	36	expires_at: string \| null;
37	37	needs_reauth: number;
38	38	software: string;
	39	read_only: number;
39	40	}
40	41
41	42	function toOrigin(row: OriginRow): Origin {
		@@ -53,6 +54,7 @@ function toOrigin(row: OriginRow): Origin {
53	54	expiresAt: row.expires_at,
54	55	needsReauth: row.needs_reauth === 1,
55	56	software: row.software,
	57	readOnly: row.read_only === 1,
56	58	};
57	59	}
58	60
		@@ -72,6 +74,8 @@ export interface CreateOriginInput {
72	74	expiresAt?: string \| null;
73	75	/** `forge` for another forge; see `Origin.software`. */
74	76	software?: string;
	77	/** Connect read-only; set once here and never cleared silently. @default false */
	78	readOnly?: boolean;
75	79	}
76	80
77	81	export type CreateOriginError = "already_connected";
		@@ -97,8 +101,8 @@ export function createOrigin(
97	101	const originId = id();
98	102	db.query(
99	103	`INSERT INTO origin (id, user_id, kind, api_url, web_url, login, token_enc,
100		auth_kind, refresh_token_enc, expires_at, software)
101		VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)`,
	104	auth_kind, refresh_token_enc, expires_at, software, read_only)
	105	VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)`,
102	106	).run(
103	107	originId,
104	108	input.userId,
		@@ -113,6 +117,7 @@ export function createOrigin(
113	117	: seal(dataDir, input.refreshToken, originId),
114	118	input.expiresAt ?? null,
115	119	input.software ?? "",
	120	input.readOnly === true ? 1 : 0,
116	121	);
117	122	return ok(getOriginById(db, originId)!);
118	123	}
		@@ -680,6 +680,12 @@ export function originAware(error: string, status = 422): Response {
680	680	409,
681	681	"the operator protects this repository at its origin: nothing is pushed to it from here; propose the change from your fork",
682	682	);
	683	if (error === "origin_read_only")
	684	return apiError(
	685	"origin_read_only",
	686	409,
	687	"this account was connected read-only, so nothing is written through it; nothing was changed",
	688	);
683	689	if (error === "origin_paused")
684	690	return apiError(
685	691	"origin_paused",
		@@ -269,6 +269,7 @@ export function userRoutes(router: Router<Handler>): void {
269	269	? { kind }
270	270	: {}),
271	271	token: str(input.token),
	272	readOnly: input.readOnly === true,
272	273	});
273	274	if (!connected.ok) {
274	275	// A refusal that names its own reason (a missing scope) keeps it;
		@@ -72,6 +72,8 @@ export function credentialFor(
72	72	software: origin.software,
73	73	token: () => resolveToken(app, origin.id),
74	74	writable: () => {
	75	if (origin.readOnly)
	76	return { ok: false, error: { error: "forbidden", message: READ_ONLY } };
75	77	const paused = writesPaused(app, origin.id);
76	78	return paused === undefined
77	79	? { ok: true, value: true }
		@@ -247,6 +249,10 @@ const GUARD_GIVE_UP_MS = 24 * 60 * 60_000;
247	249	/** The sweep's pause between requests: one origin at a time, gently. */
248	250	const SWEEP_PAUSE_MS = 500;
249	251
	252	/** What a write through a read-only origin is told (`origin_read_only`), everywhere. */
	253	export const READ_ONLY =
	254	"This account was connected read-only, so nothing is written through it. Reading and syncing go on.";
		sentinelcrew 1d ago outdated Principle 8: lead with a plain sentence, not the error code. The code travels in the error field.
	255
250	256	/** What a write through a paused origin is told, everywhere. */
251	257	export const WRITES_PAUSED =
252	258	"This forge could not verify this connection against the operator's rules, so writes through it are paused. Reads and sync go on. Check it again under Settings → Origins.";