bvandeusenandClaude Opus 5.5
0f5ef0be63
CI & Build / Python lint (push) Successful in 3s
CI & Build / Plugin hooks (push) Successful in 12s
CI & Build / TypeScript typecheck (push) Successful in 56s
CI & Build / integration (push) Successful in 1m4s
CI & Build / Python tests (push) Successful in 1m55s
CI & Build / Build & push image (push) Successful in 44s
Step 2 of the Scribe -> Grimoire rename. - src/scribe -> src/grimoire, and every import, patch target, module path, hypercorn entry point and `python -m grimoire.restore` with it; pyproject, uv.lock and the frontend package are named grimoire. - Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service runs as grimoire / grimoire_test. - Compose files default the DB user, database and (prod) volume to grimoire, each overridable from .env, so an install created as Scribe keeps its data by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME. - Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar. Archives named scribe-* with the scribe-backup-tar manifest still restore and are still counted at the destination (folder and S3), with tests. - Exports, the MCP auth realm, the ASGI scope key and the persistent logger carry the new name. Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1", because every stored secret was derived under it. Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is step 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
2.3 KiB
Python
55 lines
2.3 KiB
Python
"""Which rules a caller may be shown — a rule's HOME, stated once.
|
|
|
|
A rule lives in a rulebook topic — GLOBAL, it applies wherever its owner
|
|
works — or on one project, where it applies to that project and nowhere else.
|
|
Every read that hands rules to a session answers the same question about that
|
|
home, so it is answered here and nowhere else:
|
|
|
|
- `project_id` unset: global rules only. A caller that does not say gets the
|
|
safe failure, which is surfacing less rather than another project's rules.
|
|
- `project_id=N`: global rules plus project N's own, and N's only when the
|
|
caller can read that project (access.can_read_project, so a shared project's
|
|
rules reach its collaborators too).
|
|
- `everywhere=True`: every rule the caller owns, in any home — the explicit
|
|
whole-rulebook question.
|
|
|
|
Rule search and the moment lookup both need this answer. Two copies of a
|
|
scope clause is how one of them starts surfacing another project's rules.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from sqlalchemy import or_
|
|
|
|
from grimoire.services.access import can_read_project
|
|
|
|
|
|
async def rule_home(user_id: int, project_id: int | None = None, *, everywhere: bool = False):
|
|
"""The WHERE clause for the rules this caller may be shown here.
|
|
|
|
Needs the statement joined through `joined_to_homes`, which outer-joins
|
|
the three tables the clause reads. A rule is in a topic XOR on a project
|
|
(migration 0059), so it matches exactly one arm of whichever clause
|
|
applies.
|
|
"""
|
|
from grimoire.models.project import Project
|
|
from grimoire.models.rulebook import Rule, Rulebook
|
|
|
|
global_rule = Rulebook.owner_user_id == user_id
|
|
if everywhere:
|
|
return or_(global_rule, Project.user_id == user_id)
|
|
if project_id and await can_read_project(user_id, project_id):
|
|
return or_(global_rule, Rule.project_id == project_id)
|
|
return global_rule
|
|
|
|
|
|
def joined_to_homes(stmt):
|
|
"""Outer-join a statement over `Rule` to the tables `rule_home` reads."""
|
|
from grimoire.models.project import Project
|
|
from grimoire.models.rulebook import Rule, Rulebook, RulebookTopic
|
|
|
|
return (
|
|
stmt.outerjoin(RulebookTopic, Rule.topic_id == RulebookTopic.id)
|
|
.outerjoin(Rulebook, RulebookTopic.rulebook_id == Rulebook.id)
|
|
.outerjoin(Project, Rule.project_id == Project.id)
|
|
)
|