chadtmiller.com/knotless

Switch repository

Loading…

What happened

I'm an admin who joined grain.social, and on knotless://grain.social/grain I see no Settings tab. The tab shows only when the viewer is the repository's owner (web/src/lib/templates/RepoPage.svelte: owner={viewer?.did === repo.owner.did}), and the settings methods check the same in crates/knotless-serve/src/web/settings.rs. An org's repository is owned by the org's account, so its admins can't:

• protect a branch, or change its merge settings (knotless protect)
• add or remove runners (knotless runners)
• rename, archive, transfer, compact or delete it, or edit its description and topics

They need the org's own login for any of it. That defeats the point of admins: the gateway already lets an admin who joined change members (putOrgMember, removeOrgMember) and make repositories as the org (createOrgRepo), but nothing once a repository exists.

One way

A gateway method, or a few, after createOrgRepo: an admin who joined asks, and the gateway writes the repository record (and branch protection, runners) as the org, one change at a time as it does members. getRepoSettings answers an admin as it does the owner, the pages show the tab when the viewer is an admin of the owning org (the appview knows from org_member), and the CLI's protect, runners, rename, archive and the rest go through the gateway when the caller isn't the owner but an admin of it, as org add --org does.

Deleting and transferring may want to stay with the org itself, or ask again; worth deciding before writing them.

Related: Org admins and runners on the owner's account can't use sealed secrets, the same gap for sealed secrets.

Done, across three pulls. The pages came in a4660185 ("An organization's admins change its repositories' settings on the pages") and secrets in 2a675e88. The command line and MCP came in b9cceeff ("Admins name agents, and a new triager's warning is no longer dropped"). That pull was stacked on An organization's admins change its repositories' settings from the command line and landed it, which is why that pull shows as closed rather than merged, and why its Fixes line never closed this.

An admin now changes an organization's repository settings from the pages, knotless (describe, archive, compact, protect, labels, triagers, share, runners, agents, secret) and MCP. Each goes through the appview's settings methods with a service token. As the issue left open, renaming, deleting and transferring stay with the organization's own login.