Skip to main content

set_admin_read

teamcraft::services::project_policy

Function set_admin_read 

Source 
pub async fn set_admin_read(
    pool: &PgPool,
    actor: &Actor,
    project_id: Uuid,
    mode: AdminRead,
) -> AppResult<PolicyView>
Expand description

Sets how administrators read a restricted group (managers and administrators).

§Invariants

  • Permission: the actor manages the group (403 otherwise; a group the actor may not even know answers “not found”, administrators always know it); the group must be restricted (409).
  • Locks: the group row (FOR UPDATE).
  • Data: with_reason and none need at least one member who is a manager, so somebody can recover the group (409); the same value again changes nothing. Running elevations stay in the history; they have no effect once the mode is implicit or none.
  • Audit: project.policy with the old and the new value.
  • Notifications / webhooks: the other managers get an access alert; no webhooks.
  • Atomic: one transaction.