diff --git a/server/src/routes/git.rs b/server/src/routes/git.rs index da02c7e..108916d 100644 --- a/server/src/routes/git.rs +++ b/server/src/routes/git.rs @@ -105,49 +105,65 @@ fn forbidden() -> Response { /// Resolves an app name/id and checks whether the user may push to it. /// Returns the app_id on success. async fn check_push_access(s: &AppState, user_id: &str, app: &str) -> Option { - let app_id: Option = - sqlx::query_scalar::<_, String>("SELECT id FROM apps WHERE id = ? OR name = ?") - .bind(app) - .bind(app) - .fetch_optional(&s.db) - .await - .unwrap_or(None); - - let app_id = match app_id { - Some(id) => id, - None => { + let app_id = match sqlx::query_scalar::<_, String>( + "SELECT id FROM apps WHERE id = ? OR name = ?", + ) + .bind(app) + .bind(app) + .fetch_optional(&s.db) + .await + { + Ok(Some(id)) => id, + Ok(None) => { tracing::debug!("check_push_access: no app found for {:?}", app); return None; } + Err(e) => { + tracing::error!("check_push_access: app lookup error: {e}"); + return None; + } }; - let is_admin: i64 = sqlx::query_scalar::<_, i64>("SELECT is_admin FROM users WHERE id = ?") - .bind(user_id) - .fetch_optional(&s.db) - .await - .unwrap_or(None) - .unwrap_or(0); + let is_admin: i64 = match sqlx::query_scalar::<_, i64>( + "SELECT is_admin FROM users WHERE id = ?", + ) + .bind(user_id) + .fetch_optional(&s.db) + .await + { + Ok(v) => v.unwrap_or(0), + Err(e) => { + tracing::error!("check_push_access: is_admin lookup error: {e}"); + 0 + } + }; if is_admin != 0 { tracing::debug!("check_push_access: user {} is admin, access granted", user_id); return Some(app_id); } - let granted: Option = - sqlx::query_scalar::<_, i64>("SELECT 1 FROM user_apps WHERE user_id = ? AND app_id = ?") - .bind(user_id) - .bind(&app_id) - .fetch_optional(&s.db) - .await - .unwrap_or(None); - - if granted.is_none() { - tracing::debug!( - "check_push_access: user {} has no grant for app {}", - user_id, app_id - ); + match sqlx::query_scalar::<_, i64>( + "SELECT 1 FROM user_apps WHERE user_id = ? AND app_id = ?", + ) + .bind(user_id) + .bind(&app_id) + .fetch_optional(&s.db) + .await + { + Ok(Some(_)) => Some(app_id), + Ok(None) => { + tracing::debug!( + "check_push_access: user {} has no grant for app {}", + user_id, app_id + ); + None + } + Err(e) => { + tracing::error!("check_push_access: user_apps lookup error: {e}"); + None + } } - granted.map(|_| app_id) } // ─────────────────────────────────────────────────────────────────────────────