feat: org/team/grant management backend (Etap 5, część 1)

day01 commented

2026-08-20 12:36:12 +00:00

Owner

Backend for Etap 5, część 1 (org/team/permissions): bootstraps organization-admin grants for each org's Owners team, storage + GraphQL for listing/creating/deleting teams, managing membership, and granting/revoking repository access — all gated by a new require_capability GraphQL guard mirroring the existing gRPC check_capability. Includes GraphQL-level integration tests (tests/org_graphql.rs).

day01 added 3 commits 2026-08-20 12:36:13 +00:00

feat: org/team/grant management backend (Etap 5, część 1)

		Bootstraps organization-admin grants for each org's Owners team (Faza 1
only ever seeded repo-level grants), and adds storage + GraphQL
plumbing for teams and grants: list/create/delete teams, add/remove
members, grant and revoke repository access, all authorized via a new
require_capability GraphQL guard mirroring the gRPC bridge's existing
check_capability.

feat: expose a team's active grants through GraphQL

		Team.grants (id, resource, capabilities) lists what the frontend needs
to render and revoke existing grants — without it, revokeGrant had no
way to discover a grant id to act on.

test: GraphQL-level coverage for org/team/grant mutations

		Exercises the actual HTTP GraphQL endpoint (cookie session, real
resolvers) rather than just storage — covers the FORBIDDEN path for a
non-admin, a full team/member/grant round trip, and the cross-org
security check on revokeGrant (an org-B admin can't revoke an org-A
grant by guessing its id).

day01 merged commit 4510df18ca into %!s()

2026-08-20 12:40:26 +00:00

day01 deleted branch etap5/org-team-permissions

2026-08-20 12:40:28 +00:00

feat: org/team/grant management backend (Etap 5, część 1) #7