fix(quota): fail-closed default group for group-less owners (#120) #152

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/120-default-quota-group in i main

2026-07-19 20:26:28 +00:00

supernaut kommenterad

2026-07-19 19:54:13 +00:00

Ägare

#120 — fail-closed default quota group

Closes the fail-open window: a group-less owner (a new JIT account before the first reconcile, or any owner if the reconciler is dead) currently falls to [quota.default] = -1 = unlimited. [quota.default] = 0 can't fix this on v16 (it applies to everyone and blocked group members — the 2026-07-17 incident).

Change

[quota].DEFAULT_GROUPS = participant (new var forgejo_quota_default_groups, default participant, "" to disable). Groups in DEFAULT_GROUPS apply to every owner automatically; the reconciler's tier groups win via the most-permissive merge, so tier users are unaffected while a group-less owner inherits the zero-quota participant group — browse/issues yes, uploads no, until the reconciler assigns their real tier.

⚠️ Risk + apply order — read before applying

Quota-default changes have broken all users before, so:

Apply PR-A (#150) and PR-B (#151) FIRST. PR-B puts the gitborg org in org-unlimited; without it, this change would catch the platform's own org in the zero-quota default and block pushes to every project repo.
Pre-checks: the participant group exists (reconciler ensures it every run) and bitborg → org-unlimited (confirm in the reconciler log after PR-B applies).
Apply --tags forgejo (re-renders app.ini + restarts Forgejo — note the always-present benign app.ini diff).
Validate immediately:
- an existing tier user can create a repo + push (tier rules win over the default) — I'll test with an admin/known account;
- pushes to a bitborg/* repo still work (org-unlimited overrides the default);
- a group-less owner resolves to participant (blocked) — verify via the quota API / a throwaway account.
Rollback (fast): set forgejo_quota_default_groups: "" + --tags forgejo → reverts to [quota.default] behaviour.

Validation (pre-merge)

ansible-lint (production) · --syntax-check · --check --diff renders DEFAULT_GROUPS = participant (0 failed).

Closes #120.

## #120 — fail-closed default quota group Closes the fail-**open** window: a group-less owner (a new JIT account before the first reconcile, or *any* owner if the reconciler is dead) currently falls to `[quota.default] = -1` = unlimited. `[quota.default] = 0` can't fix this on v16 (it applies to *everyone* and blocked group members — the 2026-07-17 incident). ## Change `[quota].DEFAULT_GROUPS = participant` (new var `forgejo_quota_default_groups`, default `participant`, `""` to disable). Groups in `DEFAULT_GROUPS` apply to every owner automatically; the reconciler's tier groups win via the most-permissive merge, so **tier users are unaffected** while a group-less owner inherits the zero-quota `participant` group — browse/issues yes, uploads no, until the reconciler assigns their real tier. ## ⚠️ Risk + apply order — read before applying Quota-default changes have broken all users before, so: 1. **Apply PR-A (#150) and PR-B (#151) FIRST.** PR-B puts the `gitborg` org in `org-unlimited`; without it, this change would catch the platform's own org in the zero-quota default and block pushes to every project repo. 2. **Pre-checks:** the `participant` group exists (reconciler ensures it every run) and `bitborg → org-unlimited` (confirm in the reconciler log after PR-B applies). 3. **Apply** `--tags forgejo` (re-renders app.ini + restarts Forgejo — note the always-present benign app.ini diff). 4. **Validate immediately:** - an existing tier user can create a repo + push (tier rules win over the default) — I'll test with an admin/known account; - pushes to a `bitborg/*` repo still work (org-unlimited overrides the default); - a group-less owner resolves to `participant` (blocked) — verify via the quota API / a throwaway account. 5. **Rollback (fast):** set `forgejo_quota_default_groups: ""` + `--tags forgejo` → reverts to `[quota.default]` behaviour. ## Validation (pre-merge) ansible-lint (production) · `--syntax-check` · `--check --diff` renders `DEFAULT_GROUPS = participant` (0 failed). Closes #120.

supernaut tvångsskickade fix/120-default-quota-group från 1d48a37981

ci / ci (pull_request) Successful in 2m27s

Detaljer

till 112c7078ab

ci / ci (pull_request) Successful in 2m37s

Detaljer

2026-07-19 20:22:45 +00:00

Jämför

supernaut sammanfogade incheckning dd38bc2d8f till main

2026-07-19 20:26:28 +00:00

supernaut tog bort grenen fix/120-default-quota-group

2026-07-19 20:26:28 +00:00