feat: add admin picker when editing .mega_cedar.json (#2147)

* feat: upgrade SeaORM 2.0 dense entities and related deps

Migrate callisto to dense codegen, keep polymorphic joins in entity_ext,
bump russh and remove lazy_static/ed25519-dalek, and normalize webhook
event enum labels to underscores with Enum rs_type call-site fixes.

* feat: add admin picker when editing .mega_cedar.json

Let Cedar admins select org members in BlobEditor and regenerate
entity-store JSON via POST /api/v1/admin/cedar/generate before commit.

Author: benjamin-747

Cargo.lock

@@ -44,30 +44,30 @@ libvault-core = "0.1.0"
 #====
 anyhow = "1.0.103"
 serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+serde_json = "1.0.151"
 serde_urlencoded = "0.7"
 tracing = "0.1.44"
 tracing-subscriber = "0.3.23"
 tracing-appender = "0.2.5"
-thiserror = "2.0.18"
-clap = "4.6.1"
+thiserror = "2.0.19"
+clap = "4.6.4"
 
 #====
-tokio = "1.52.3"
+tokio = "1.53.1"
 tokio-stream = "0.1.18"
-tokio-util = "0.7.18"
+tokio-util = "0.7.19"
 async-trait = "0.1.89"
 async-stream = "0.3.6"
 async-recursion = "1.1.1"
 futures = "0.3.32"
 futures-util = "0.3.32"
 axum = { version = "0.8.9", features = ["macros", "json"] }
 axum-extra = "0.12.6"
-russh = "0.61.2"
+russh = "0.62.3"
 tower-http = "0.7.0"
 tower = "0.5.3"
 tower-sessions = { version = "0.15", features = ["memory-store"] }
-time = { version = "0.3.51", features = ["serde"] }
+time = { version = "0.3.54", features = ["serde"] }
 lettre = { version = "0.11", default-features = false, features = [
   "builder",
   "smtp-transport",
@@ -77,8 +77,8 @@ lettre = { version = "0.11", default-features = false, features = [
   "rustls-platform-verifier",
 ] }
 #====
-sea-orm = "1.1.20"
-sea-orm-migration = "1.1.20"
+sea-orm = "2.0.0"
+sea-orm-migration = "2.0.0"
 
 #====
 rand = "0.10.2"
@@ -94,10 +94,8 @@ hmac = "0.13"
 idgenerator = "2.0.0"
 config = "0.15.25"
 reqwest = "0.13.4"
-lazy_static = "1.5.0"
 uuid = "1.23.5"
 regex = "1.13.0"
-ed25519-dalek = "2.2.0"
 ctrlc = "3.5.2"
 cedar-policy = "4.11.2"
 secp256k1 = "0.31.1"

Cargo.toml

@@ -1,4 +1,4 @@
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 
 #[derive(Serialize, ToSchema)]
@@ -10,3 +10,15 @@ pub struct IsAdminResponse {
 pub struct AdminListResponse {
     pub admins: Vec<String>,
 }
+
+/// Request body for generating `.mega_cedar.json` content from admin usernames.
+#[derive(Debug, Deserialize, ToSchema)]
+pub struct GenerateCedarRequest {
+    pub admins: Vec<String>,
+}
+
+/// Response containing generated `.mega_cedar.json` content.
+#[derive(Serialize, ToSchema)]
+pub struct GenerateCedarResponse {
+    pub content: String,
+}

ceres/src/model/admin.rs

@@ -7,7 +7,7 @@ use utoipa::ToSchema;
 pub struct CreateWebhookRequest {
     pub target_url: String,
     pub secret: String,
-    /// Event types: "cl.created", "cl.updated", "cl.merged", "cl.closed", "cl.reopened", "cl.comment.created", "*"
+    /// Event types: "cl_created", "cl_updated", "cl_merged", "cl_closed", "cl_reopened", "cl_comment_created", "all"
     pub event_types: Vec<String>,
     pub path_filter: Option<String>,
     pub active: Option<bool>,
@@ -39,7 +39,7 @@ impl From<WebhookWithEventTypes> for WebhookResponse {
             event_types: value
                 .event_types
                 .into_iter()
-                .map(|e| e.to_value())
+                .map(|e| e.to_value().value.into_owned())
                 .collect(),
             path_filter: m.path_filter,
             active: m.active,
@@ -52,7 +52,8 @@ impl From<WebhookWithEventTypes> for WebhookResponse {
 pub fn parse_webhook_event_types(raw: Vec<String>) -> Result<Vec<WebhookEventTypeEnum>, String> {
     raw.into_iter()
         .map(|s| {
-            WebhookEventTypeEnum::try_from_value(&s).map_err(|_| format!("invalid event type: {s}"))
+            WebhookEventTypeEnum::try_from(s.as_str())
+                .map_err(|_| format!("invalid event type: {s}"))
         })
         .collect()
 }
@@ -66,7 +67,7 @@ mod tests {
 
     #[test]
     fn parse_webhook_event_types_accepts_known_values() {
-        let parsed = parse_webhook_event_types(vec!["cl.created".to_string(), "all".to_string()])
+        let parsed = parse_webhook_event_types(vec!["cl_created".to_string(), "all".to_string()])
             .expect("valid event types");
         assert_eq!(parsed.len(), 2);
         assert_eq!(parsed[0], WebhookEventTypeEnum::ClCreated);
@@ -75,7 +76,7 @@ mod tests {
 
     #[test]
     fn parse_webhook_event_types_rejects_unknown_values() {
-        let err = parse_webhook_event_types(vec!["not.a.real.event".to_string()])
+        let err = parse_webhook_event_types(vec!["not_a_real_event".to_string()])
             .expect_err("invalid event type");
         assert!(err.contains("invalid event type"));
     }
@@ -104,7 +105,7 @@ mod tests {
         let response = WebhookResponse::from(value);
         assert_eq!(response.id, 42);
         assert_eq!(response.target_url, "https://example.com/hook");
-        assert_eq!(response.event_types, vec!["cl.created".to_string()]);
+        assert_eq!(response.event_types, vec!["cl_created".to_string()]);
         assert_eq!(response.path_filter.as_deref(), Some("/project"));
         assert!(response.active);
     }

ceres/src/model/webhook.rs

@@ -25,11 +25,30 @@ After schema changes, regenerate callisto entities (adjust connection URL for yo
 sea-orm-cli generate entity \
   -u postgres://postgres:postgres@localhost:5432/mono \
   -o jupiter/callisto/src \
-  --with-serde both
+  --with-serde both \
+  --entity-format dense
 ```
 
 Review generated diffs in `jupiter/callisto/src/` before committing.
 
+**Do not edit CLI-generated entity files** for polymorphic/link joins or `Model::new` helpers — those live only in `entity_ext/`. Regenerating must overwrite table models cleanly.
+
+**After every regen:**
+
+1. Re-add `pub mod entity_ext;` to `jupiter/callisto/src/mod.rs` (codegen overwrites this file).
+2. Keep `sea_orm_active_enums.rs` webhook variant names readable (`ClCreated`, not CLI-mangled names). `rs_type = "Enum"` is correct for SeaORM 2.0 — call sites that need a string use `to_value().value` or `TryFrom<&str>`.
+3. Leave `entity_ext/` alone — it owns:
+   - `Model::new` helpers and ID utilities
+   - Polymorphic / link-based `Relation` + `Related` (no DB FKs), including:
+     - `item_labels` / `item_assignees`: dual `belongs_to` on `item_id` → `mega_cl` and `mega_issue`
+     - `mega_cl` / `mega_issue`: `has_many` labels (via), assignees, conversations
+     - `mega_conversation`: link joins to CL/Issue; `has_many` reactions
+     - `reactions`: `belongs_to` conversation
+     - `mega_code_review_thread`: `belongs_to` `mega_cl` on `link`
+     - `label`: `has_many` `item_labels`
+
+Join call sites that need those relations use `callisto::entity_ext::<table>::Relation`, not the generated entity `Relation`.
+
 ## Library API
 
 ```rust

jupiter-migrate/README.md

@@ -56,6 +56,7 @@ impl MigrationTrait for Migration {
             DatabaseBackend::Sqlite | DatabaseBackend::MySql => {
                 // Do not create enum in sqlite
             }
+            _ => {}
         }
 
         manager

jupiter-migrate/src/migration/m20250314_025943_init.rs

@@ -54,6 +54,7 @@ impl MigrationTrait for Migration {
             }
 
             DatabaseBackend::Sqlite => {}
+            _ => {}
         }
 
         Ok(())

jupiter-migrate/src/migration/m20250613_033821_alter_user_id.rs

@@ -20,6 +20,7 @@ impl MigrationTrait for Migration {
                     .await?;
             }
             DatabaseBackend::Sqlite | DatabaseBackend::MySql => {}
+            _ => {}
         }
 
         manager

jupiter-migrate/src/migration/m20250618_065050_add_label.rs

@@ -19,6 +19,7 @@ impl MigrationTrait for Migration {
                     .await?;
             }
             DatabaseBackend::Sqlite | DatabaseBackend::MySql => {}
+            _ => {}
         }
 
         manager

jupiter-migrate/src/migration/m20250702_072055_add_item_assignees.rs

@@ -21,6 +21,7 @@ impl MigrationTrait for Migration {
                     .await?;
             }
             DatabaseBackend::Sqlite | DatabaseBackend::MySql => {}
+            _ => {}
         }
 
         Ok(())
@@ -43,6 +44,7 @@ impl MigrationTrait for Migration {
                     .await?;
             }
             DatabaseBackend::Sqlite | DatabaseBackend::MySql => {}
+            _ => {}
         }
 
         Ok(())