bvandeusenandClaude Fable 5
1faf8f3ece
CI & Build / Python lint (push) Successful in 4s
CI & Build / Plugin hooks (push) Successful in 8s
CI & Build / TypeScript typecheck (push) Successful in 41s
CI & Build / integration (push) Successful in 37s
CI & Build / Python tests (push) Successful in 1m4s
CI & Build / Build & push image (push) Successful in 40s
A forge token is a user's credential, not an instance's. The single admin-settings config is replaced by per-user keyring rows (one per forge host), and every server-side forge read runs on the PROJECT OWNER's keyring: - forge_connections table + projects.forge_connection_id pin (migration 0078, which also carries the existing admin config into the first admin's row and deletes the old setting keys — no legacy dual-read) - get_forge() replaced by get_forges(owner_id, project_id) -> ForgeSelector; resolve(repo) picks the connection whose host serves the repo. A pinned project uses ONLY its pinned connection; a stale pin (ownership moved) is ignored, never honored across users - env FORGE_* config survives as an implicit entry for admin owners only; a stored row for the same host beats it - consumers threaded: pull-time freshness (owner of the note), coverage (owner of the project), coverage routes' configured flag - routes: /api/settings/forge-connections CRUD + per-connection test (own-rows only, tokens never returned); /api/admin/forge shrinks to /api/admin/forge-webhook (secret only); PUT /api/projects/<id>/forge pins, owner-or-admin asking, owner's connections only - UI: Git Forges card moves to Settings -> Integrations as a connection list; webhook secret stays in the admin Config tab; owner-only forge select on the project coverage card - backups exclude forge_connections (credentials, api_keys precedent) and the pin, so restores fall back to keyring resolution Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
54 lines
2.3 KiB
Python
54 lines
2.3 KiB
Python
import enum
|
|
from sqlalchemy import BigInteger, ForeignKey, Integer, Text
|
|
from sqlalchemy.orm import Mapped, mapped_column
|
|
from scribe.models import Base
|
|
from scribe.models.base import TimestampMixin, SoftDeleteMixin
|
|
|
|
|
|
class ProjectStatus(str, enum.Enum):
|
|
active = "active"
|
|
paused = "paused"
|
|
completed = "completed"
|
|
archived = "archived"
|
|
|
|
|
|
class Project(Base, TimestampMixin, SoftDeleteMixin):
|
|
__tablename__ = "projects"
|
|
id: Mapped[int] = mapped_column(primary_key=True)
|
|
user_id: Mapped[int | None] = mapped_column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=True)
|
|
title: Mapped[str] = mapped_column(Text, default="")
|
|
description: Mapped[str] = mapped_column(Text, default="")
|
|
goal: Mapped[str] = mapped_column(Text, default="")
|
|
status: Mapped[str] = mapped_column(Text, default="active")
|
|
color: Mapped[str | None] = mapped_column(Text, nullable=True) # hex color
|
|
# The design system this project's UI is built from, or NULL. NULL is the
|
|
# ordinary state, not a degraded one — most installs have no design system
|
|
# at all and nothing may assume one exists.
|
|
design_system_id: Mapped[int | None] = mapped_column(
|
|
BigInteger, ForeignKey("design_systems.id", ondelete="SET NULL"), nullable=True
|
|
)
|
|
# The per-project forge pin (#2778). NULL is the ordinary state: forge
|
|
# reads resolve against the owner's keyring by repo host. When set, the
|
|
# project's forge reads use ONLY this connection — an explicit, auditable
|
|
# choice, constrained by the service layer to a connection the project
|
|
# OWNER holds (never a collaborator's token).
|
|
forge_connection_id: Mapped[int | None] = mapped_column(
|
|
BigInteger, ForeignKey("forge_connections.id", ondelete="SET NULL"),
|
|
nullable=True,
|
|
)
|
|
|
|
def to_dict(self) -> dict:
|
|
return {
|
|
"id": self.id,
|
|
"user_id": self.user_id,
|
|
"title": self.title,
|
|
"description": self.description,
|
|
"goal": self.goal,
|
|
"status": self.status,
|
|
"color": self.color,
|
|
"design_system_id": self.design_system_id,
|
|
"forge_connection_id": self.forge_connection_id,
|
|
"created_at": self.created_at.isoformat(),
|
|
"updated_at": self.updated_at.isoformat(),
|
|
}
|