Jeffrey Smith
23dddae0c5
All checks were successful
CI/CD / detect-changes (pull_request) Successful in 4s
CI/CD / test-runners (pull_request) Has been skipped
CI/CD / e2e-smoke (pull_request) Has been skipped
CI/CD / test-frontend (pull_request) Successful in 5s
CI/CD / test-go-pg (pull_request) Successful in 2m49s
CI/CD / test-sqlite (pull_request) Successful in 2m57s
CI/CD / build-and-deploy (pull_request) Successful in 1m19s
Promote team roles to a kernel primitive with many-to-many support. Users can now hold multiple roles within a team simultaneously. - Migration 016: team_user_roles table (both dialects) - 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles, GetMemberRoles, HasRole, RemoveAllUserRoles) - RequireRole() middleware with OR semantics and system admin bypass - 3 new handler endpoints for member role CRUD - Manifest requires_roles field (advisory for v0.9.3) - Starlark teams module: get_member_roles(), has_role() - Team-admin UI: role badge chips + assignment dropdown - Fixed pre-existing SDK auto-unwrap bug in loadRoles - 10 new tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
// Package sandbox — teams_module.go
|
|
//
|
|
// Read-only module for querying team role membership from Starlark scripts.
|
|
// No sandbox permission required — extensions can check roles without special grants.
|
|
//
|
|
// Starlark API:
|
|
// teams.get_member_roles(team_id, user_id) → ["admin", "reviewer", ...]
|
|
// teams.has_role(team_id, user_id, role) → True/False
|
|
package sandbox
|
|
|
|
import (
|
|
"context"
|
|
|
|
"go.starlark.net/starlark"
|
|
"go.starlark.net/starlarkstruct"
|
|
|
|
"armature/store"
|
|
)
|
|
|
|
// BuildTeamsModule creates the "teams" module.
|
|
// Always available to all extensions (no permission gate).
|
|
func BuildTeamsModule(ctx context.Context, stores store.Stores) *starlarkstruct.Module {
|
|
return MakeModule("teams", starlark.StringDict{
|
|
|
|
"get_member_roles": starlark.NewBuiltin("teams.get_member_roles", func(
|
|
thread *starlark.Thread, b *starlark.Builtin,
|
|
args starlark.Tuple, kwargs []starlark.Tuple,
|
|
) (starlark.Value, error) {
|
|
var teamID, userID string
|
|
if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &teamID, &userID); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
roles, err := stores.Teams.GetMemberRoles(ctx, teamID, userID)
|
|
if err != nil {
|
|
return starlark.NewList(nil), nil
|
|
}
|
|
|
|
elems := make([]starlark.Value, len(roles))
|
|
for i, r := range roles {
|
|
elems[i] = starlark.String(r)
|
|
}
|
|
return starlark.NewList(elems), nil
|
|
}),
|
|
|
|
"has_role": starlark.NewBuiltin("teams.has_role", func(
|
|
thread *starlark.Thread, b *starlark.Builtin,
|
|
args starlark.Tuple, kwargs []starlark.Tuple,
|
|
) (starlark.Value, error) {
|
|
var teamID, userID, role string
|
|
if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 3, &teamID, &userID, &role); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
has, err := stores.Teams.HasRole(ctx, teamID, userID, role)
|
|
if err != nil || !has {
|
|
return starlark.False, nil
|
|
}
|
|
return starlark.True, nil
|
|
}),
|
|
})
|
|
}
|