Skip to main content

authorize

alkgit

Function authorize 

Source 
pub fn authorize(
    record: &RepoRecord,
    identity: Option<&Identity>,
    action: AccessAction,
) -> bool
Expand description

The per-repo policy function (ADR-011 §3 as amended by ADR-015 §2).

  • read on a Public repo → allowed for anyone, including None (anonymous-first-class — ADR-007’s operative clause).
  • read on a Private repo → identity required with a read grant.
  • write → identity required and a write-or-manage grant, on every repo (push is always authenticated).
  • manage → identity required plus a manage grant — no anonymous path and no owner-bypass path.

Grant monotonicity is evaluated here; stored grant sets need not be closed under it (backend.md §RepoRecord): a stored manage grant satisfies manage, write, and read checks; a stored write satisfies write and read; a stored read satisfies read.