Native organizations and external projects (reports from outside Forgejo) #26

New issue

Closed

opened 2026-10-28 15:12:48 +00:00 by Gilles · 0 comments

Gilles commented

2026-10-28 15:12:48 +00:00

Owner

Part of the monitoring plan (phase 1.1): let Argus hold reports that don't come from a Forgejo repo (servers, uptime checks, metrics collectors).

Scope

Organization.kind: forgejo (today's behaviour, default) or native (an Argus-only namespace with no Forgejo owner behind it).
Project.kind: forgejo (default) or external (no Forgejo repo behind it). forgejo_owner/forgejo_repo stay the identifiers (slugs), so /:owner/:repo URLs, badges and tokens keep working unchanged.
Creation:
- a native organization can only be created by an Argus admin (Django superuser for now; extended to the argus-admins Authentik group by the group-access issue);
- an external project needs admin level on its organization (Forgejo org level for a Forgejo org, Argus admin for a native org);
- a Forgejo project can't be created inside a native organization.
Access resolution moves into one module (apps.accounts.access), used by every view, the event serializers and the delivery code, instead of has_at_least calls spread around. An external project in a Forgejo org uses the org-level Forgejo permission; in a native org, only Argus admins (until group grants land).
Forgejo-only features skip external projects: closed-PR sweep, Forgejo webhook, source-file view, project discovery, PR comments. Uploads with ref_kind=pr are rejected for external projects.

Out of scope

Group-based access, source refs and JSON uploads (separate issues).

Part of the monitoring plan (phase 1.1): let Argus hold reports that don't come from a Forgejo repo (servers, uptime checks, metrics collectors). ## Scope - `Organization.kind`: `forgejo` (today's behaviour, default) or `native` (an Argus-only namespace with no Forgejo owner behind it). - `Project.kind`: `forgejo` (default) or `external` (no Forgejo repo behind it). `forgejo_owner`/`forgejo_repo` stay the identifiers (slugs), so `/:owner/:repo` URLs, badges and tokens keep working unchanged. - Creation: - a native organization can only be created by an Argus admin (Django superuser for now; extended to the `argus-admins` Authentik group by the group-access issue); - an external project needs admin level on its organization (Forgejo org level for a Forgejo org, Argus admin for a native org); - a Forgejo project can't be created inside a native organization. - Access resolution moves into one module (`apps.accounts.access`), used by every view, the event serializers and the delivery code, instead of `has_at_least` calls spread around. An external project in a Forgejo org uses the org-level Forgejo permission; in a native org, only Argus admins (until group grants land). - Forgejo-only features skip external projects: closed-PR sweep, Forgejo webhook, source-file view, project discovery, PR comments. Uploads with `ref_kind=pr` are rejected for external projects. ## Out of scope Group-based access, `source` refs and JSON uploads (separate issues).

Gilles added the

feature

label

2026-10-28 15:12:48 +00:00

Gilles referenced this issue from argus/frontend

2026-10-28 15:12:49 +00:00

Create native organizations and external projects #15

Gilles referenced this issue from a commit

2026-10-28 15:18:11 +00:00

feature: native organizations and external projects

Gilles referenced this issue from a pull request that will close it,

2026-10-28 15:18:21 +00:00