Limit repos a user has access to

[andypols]

We’re adding a growing number of repositories, including private joint-venture repos. To reduce noise and avoid exposing unrelated/private projects, we would like to limit what each user can see.

We would like to make it so that a user should only be able to see the repositories where they are explicitly assigned as either a reviewer or a contributor

[kriswest]

That seems a reasonable facility to have - but I'd suggest that it should be a config setting. Git proxy is often open to everyone in an org without even a login, helping to demonstrate what others are contributing to - which is something we'd probably like to keep. In fact you'd have to force logins first to do this (or else you don't know who the user is).

I'd probably suggest a 'your projects' view which is available when logged in and then config settings that control access to an 'all projects' view in some way (open to everyone/open to authenticated user/no one), which would then achieve the setup (I think) you are asking for.

[kriswest]

I believe @robmoffat is going to suggest that we look at ways that an org's open source policy controls can start off in Git Proxy by allowing you to request that you be able to contribute to a particular project. For that, you'd probably want users to be able to check if the project (or any personal forks of it!) are already in the list of all configured projects?

[grovesy]

@andypols I am with @kriswest here, i.e. philosophically what GP is about in terms of it being not only the route to open source from within an organizations fortified walls, but also a way of letting people know what people are working on

that said...

• Yes I can see the use case for perhaps having some repos 'hidden' to only the approves/contributors. A use case might be 'we are working with organization on a private repo, and it might be sensitive. To this, the big policy engine idea would be great, but there might be a far simple fix which is 'restrict visibility to contributors/approvers only'
• We absolutely need a filter for 'just show my stuff' (things I'm an assigned approver and/or contributor' for)
• We absolutely need quality of life improvements, i.e. being able to tag repos with organizationally defined tags... This I think would absolutely help with helping to communicate to an organization the kinds of things their engineers are contributing to.
  ** Auto tagging could also be here, scanning the repo itself for anything useful to tag it with

[andypols]

Thanks @kriswest and @grovesy.

There are two reasons we started thinking about this:

1. We use git-proxy for both open source and commercially sensitive joint ventures, so private projects need proper access controls to keep commits visible only to admins and approved collaborators.
2. We now have so many projects that the UI is becoming clumsy and starting to get in the way.

“Limiting the UI to assigned projects” addresses the first issue, but it feels like a blunt instrument for solving the second.

I think two features would help here:

1. the ability to mark a project as private
2. @grovesy’s “just show my stuff” filter, which feels like the better solution overall

I agree with the sentiment of being loud and proud about open source, but I do not think the current UI is the right vehicle for it. We have found that our open-source Slack channel, supported by an agentic bot that can query git-proxy, is a much better platform for discussing and exploring open source.

I also like the idea of organisational tagging. That would be really useful.