and `OpenAgentsWeb.RepositoryAccess` (a narrower file-level allowlist

  layered above row admission it takes from `get_visible_by_path!/3`).

Amended 2026-08-24 (issue #182): the `:machine` principal the Git transport

admits is now reachable.

`repository_machine_grants` was a complete, enforced authorization input with

no writer. `OpenAgentsWeb.Plugs.ForgeGitAuth` accepted a paired computer's

`smct_` token and assigned `%{kind: :machine, id: machine.id}`,

`OpenAgents.Forge.GitHTTP` routed that principal to

`OpenAgents.Repositories.machine_access?/3` for both read and write, and that

predicate required a `repository_machine_grants` row that no controller,

LiveView, route, or API could create. So every Git request a paired computer

made answered `404 unknown repository`, indistinguishable from an unauthorized

one, and the tests passed because they inserted the row themselves.

The mechanism is kept and given its surface rather than removed. IDENTITY-010's

assignment credential is repository-and-branch scoped and lives as long as one

assignment; a computer that clones or fetches outside an assignment has no

other path, and narrowing the principal set would have taken that away.

`OpenAgents.Repositories.grant_machine_access/4` and

`revoke_machine_access/3` are the write and the withdrawal, and

`OpenAgentsWeb.ComputersLive` is the surface, on the `/computers` page the

owner already uses to approve and revoke a computer. No route is added: the

authority is in the handler, which is where a route table cannot see it, so

neither identifier the event carries selects anything on its own. The computer

resolves through `OpenAgents.Machines.get_machine/2` against the acting

account, and the repository through that account's own `owner` or `maintainer`

membership, so a foreign computer, a repository this account does not

administer, and an identifier that names nothing are one refusal (IDENTITY-002).

`grant_machine/4` is private behind that entry point, so there is no way to

reach the write without passing an acting account for both halves. The

LiveView reaches no `OpenAgents.Repo`.

The grant is standing authority, so it owes a withdrawal, and there was none:

`revoke_machine_access/3` deletes the row and audits it as

`repository.machine_grant.revoked` beside the existing

`repository.machine_grant.updated`. The audit carries the account that created

the grant, which is otherwise lost with the row. Revoking the computer itself

still ends every grant's effect without deleting any — `machine_access?/3`

joins the computer's status and token expiry — and that remains the all-or-

nothing path.

Evidence for this clause: `OpenAgents.Repositories.grant_machine_access/4`,

`OpenAgents.Repositories.revoke_machine_access/3`,

`OpenAgentsWeb.ComputersLive`,

`test/openagents_web/live/computers_repository_access_test.exs`, and

`OpenAgents.Forge.GitHTTPTest`, which obtains its grant through that entry

point and then clones and pushes with the computer's own credential over real

HTTP.

Three restatements were removed rather than declared, and two were wrong.

`OpenAgents.Issues.get_issue_by_path!/3` and

`OpenAgents.Projects.get_project_by_path!/3` each carried a copy of the public

| STATUS-001 | `test/openagents/network_status_test.exs`, `test/openagents_web/live/network_status_live_test.exs` |

| CAPACITY-001 | `test/openagents/capacity_test.exs` |

| TRANSPARENCY-001 | `test/openagents/forge/visibility_test.exs`, `test/openagents/forge/browse_test.exs`, `test/openagents_web/live/code_live_test.exs`, `test/openagents_web/transparency_surface_test.exs` |

| REPOSITORY-001 | `test/openagents/repositories/visibility_join_test.exs`, `test/openagents/repository_lifecycle_test.exs`, `test/openagents/repositories/provisioner_test.exs`, `test/openagents_web/controllers/repository_controller_test.exs`, `test/openagents/issues_workspace_test.exs`, `test/openagents_web/live/issue_workspace_live_test.exs`, `test/openagents_web/live/project_workspace_live_test.exs`, `test/openagents/forge/git_http_test.exs` |

| REPOSITORY-001 | `test/openagents/repositories/visibility_join_test.exs`, `test/openagents_web/live/computers_repository_access_test.exs`, `test/openagents/repository_lifecycle_test.exs`, `test/openagents/repositories/provisioner_test.exs`, `test/openagents_web/controllers/repository_controller_test.exs`, `test/openagents/issues_workspace_test.exs`, `test/openagents_web/live/issue_workspace_live_test.exs`, `test/openagents_web/live/project_workspace_live_test.exs`, `test/openagents/forge/git_http_test.exs` |

| API-001 | `test/openagents_web/controllers/api_extension_governance_test.exs`, `test/openagents/issue_progress_test.exs` |

| CONTRIBUTION-001 | `test/openagents_web/contribution_contract_test.exs` |

| REPOSITORY-002 | `ops/ci/push-remote-check.sh`, `ops/dev/install-push-guard.sh`, `test/openagents/push_remote_contract_test.exs` |

    margin: 0;

  }

  .computer-card__repositories {

    display: grid;

    gap: 10px;

    padding: 12px;

    border: 1px solid var(--line-faint);

    border-radius: var(--radius-sm);

    background: var(--wash-hover);

  }

  .computer-card__repositories h4 {

    margin: 0;

    color: var(--text-dim);

    font-family: var(--font-mono);

    font-size: 0.625rem;

    letter-spacing: 0.14em;

    text-transform: uppercase;

  }

  .computer-card__repositories p {

    margin: 0;

    color: var(--text-muted);

    font-size: 0.75rem;

  }

  .computer-card__grants {

    display: grid;

    gap: 6px;

    margin: 0;

    padding: 0;

    list-style: none;

  }

  .computer-card__grants li {

    display: flex;

    align-items: center;

    flex-wrap: wrap;

    gap: 8px;

  }

  .computer-card__grant-name {

    flex: 1 1 auto;

    min-width: 0;

    overflow: hidden;

    color: var(--text-primary);

    font-family: var(--font-mono);

    font-size: 0.75rem;

    text-overflow: ellipsis;

    white-space: nowrap;

  }

  .computer-card__grant-form {

    display: grid;

    grid-template-columns: minmax(0, 1.4fr) minmax(0, 1fr) auto;

    align-items: end;

    gap: 10px;

  }

  @media (max-width: 720px) {

    .computer-card__grant-form {

      grid-template-columns: minmax(0, 1fr);

    }

  }

  .computer-card__facts > div {

    display: grid;

    min-width: 0;

  @writable_roles ~w(owner maintainer contributor)

  @all_roles ~w(owner maintainer contributor viewer)

  # A computer grant hands a long-lived `smct_` token standing access to a

  # repository, so it takes the two roles that already administer one.

  @machine_grant_roles ~w(owner maintainer)

  @repository_namespace_limit 100

  # GitHub's default label set. Every created or imported repository starts

    )

  end

  def grant_machine(%Repository{} = repository, %User{} = actor, %Machine{} = machine, operations)

      when is_list(operations) do

  @doc """

  Repositories this account administers, and can therefore hand to one of its

  computers.

  This is a membership question, not a visibility one: it starts from the

  actor's own `repository_memberships` rows in the two roles that may

  administer a repository, so it neither composes nor restates

  `readable_by/2` (REPOSITORY-001).

  """

  @spec list_grantable_repositories(User.t() | nil) :: [Repository.t()]

  def list_grantable_repositories(%User{id: user_id}) do

    Repo.all(

      from repository in Repository,

        join: membership in Membership,

        on: membership.repository_id == repository.id,

        where: membership.user_id == ^user_id and membership.role in @machine_grant_roles,

        order_by: [asc: repository.owner, asc: repository.name]

    )

  end

  def list_grantable_repositories(_actor), do: []

  @doc """

  The repository grants one of this account's computers holds.

  A computer this account does not own is indistinguishable from one that holds

  nothing.

  """

  @spec list_machine_grants(User.t(), String.t()) :: [MachineGrant.t()]

  def list_machine_grants(%User{} = actor, machine_id) when is_binary(machine_id) do

    case owned_machine(actor, machine_id) do

      {:ok, machine} ->

        Repo.all(

          from grant in MachineGrant,

            join: repository in Repository,

            on: repository.id == grant.repository_id,

            where: grant.machine_id == ^machine.id,

            order_by: [asc: repository.owner, asc: repository.name],

            preload: [repository: repository]

        )

      {:error, _reason} ->

        []

    end

  end

  def list_machine_grants(_actor, _machine_id), do: []

  @doc """

  Grant one of this account's computers access to one repository it

  administers.

  This is the entry point the `/computers` surface calls, and the only one:

  `grant_machine/4` below is private, so a caller cannot reach the write

  without passing an acting account for both halves. The grant was previously

  unreachable — the table was read by `OpenAgents.Forge.GitHTTP` on every

  request a paired computer made and written by nothing outside tests, so every

  such request answered `404 unknown repository`.

  Both halves are resolved from the acting account rather than from the

  caller's identifiers: a computer another account owns, a repository this

  account does not administer, and an identifier that names nothing are all the

  same refusal.

  """

  @spec grant_machine_access(User.t(), String.t(), String.t(), [String.t()]) ::

          {:ok, MachineGrant.t()} | {:error, atom() | Ecto.Changeset.t()}

  def grant_machine_access(%User{} = actor, machine_id, repository_id, operations)

      when is_binary(machine_id) and is_binary(repository_id) and is_list(operations) do

    with {:ok, machine} <- owned_machine(actor, machine_id),

         {:ok, repository} <- administered_repository(actor, repository_id) do

      grant_machine(repository, actor, machine, operations)

    end

  end

  def grant_machine_access(_actor, _machine_id, _repository_id, _operations),

    do: {:error, :machine_not_owned}

  @doc """

  Withdraw a computer's access to one repository.

  A grant outlives the delegation that needed it, so the surface that creates

  one owes a way to take it back. Revoking the computer itself already ends the

  grant's effect — `machine_access?/3` joins the computer's status and token

  expiry — but that is all or nothing, and this is not.

  The audit record carries the account that created the grant, which is the

  only place that survives the row.

  """

  @spec revoke_machine_access(User.t(), String.t(), String.t()) ::

          {:ok, MachineGrant.t()} | {:error, atom()}

  def revoke_machine_access(%User{} = actor, machine_id, repository_id)

      when is_binary(machine_id) and is_binary(repository_id) do

    with {:ok, machine} <- owned_machine(actor, machine_id),

         {:ok, repository} <- administered_repository(actor, repository_id),

         %MachineGrant{} = grant <-

           Repo.get_by(MachineGrant, repository_id: repository.id, machine_id: machine.id) do

      Repo.transaction(fn ->

        Repo.delete!(grant)

        Audit.record!(

          "repository.machine_grant.revoked",

          {:user, actor.id},

          "machine_grant",

          grant.id,

          repository_id: repository.id,

          metadata: %{

            "machine_id" => machine.id,

            "operations" => grant.operations,

            "granted_by_user_id" => grant.created_by_user_id

          }

        )

        grant

      end)

    else

      nil -> {:error, :grant_not_found}

      {:error, reason} -> {:error, reason}

    end

  end

  def revoke_machine_access(_actor, _machine_id, _repository_id),

    do: {:error, :machine_not_owned}

  defp owned_machine(%User{id: user_id}, machine_id) do

    case OpenAgents.Machines.get_machine(user_id, machine_id) do

      {:ok, machine} -> {:ok, machine}

      {:error, _reason} -> {:error, :machine_not_owned}

    end

  end

  defp administered_repository(%User{} = actor, repository_id) do

    with {:ok, id} <- Ecto.UUID.cast(repository_id),

         %Repository{} = repository <- Repo.get(Repository, id),

         role when role in @machine_grant_roles <- membership_role(repository, actor) do

      {:ok, repository}

    else

      _absent_or_foreign -> {:error, :repository_not_allowed}

    end

  end

  defp grant_machine(

         %Repository{} = repository,

         %User{} = actor,

         %Machine{} = machine,

         operations

       )

       when is_list(operations) do

    with true <- machine.user_id == actor.id or {:error, :machine_not_owned},

         role when role in ~w(owner maintainer) <- membership_role(repository, actor) do

         role when role in @machine_grant_roles <- membership_role(repository, actor) do

      Repo.transaction(fn ->

        grant =

          %MachineGrant{}

  alias OpenAgents.Computer

  alias OpenAgents.Machines

  alias OpenAgents.Machines.Machine

  alias OpenAgents.Repositories

  @presence_refresh_ms 15_000

      |> assign(:subscribed_computer_ids, MapSet.new())

      |> assign(:presence, %{})

      |> assign(:computer_count, 0)

      |> assign(:grant_form, to_form(%{}, as: :grant))

      |> assign(:grantable_repositories, [])

      |> assign(:repository_grants, %{})

      |> load_computers()

    if connected?(socket), do: schedule_presence_refresh()

    end

  end

  # Repository access for a computer. `repository_machine_grants` is the only

  # thing `OpenAgents.Forge.GitHTTP` consults for a `{:machine, id}` principal,

  # and until this event existed nothing wrote a row, so every Git request a

  # paired computer made answered `404 unknown repository` (#182).

  #

  # Neither identifier selects anything on its own: `OpenAgents.Repositories`

  # resolves the computer through the acting account and the repository through

  # that account's administering membership, so a foreign computer, a

  # repository this account does not administer, and an identifier that names

  # nothing are one refusal (IDENTITY-002).

  def handle_event(

        "grant_repository_access",

        %{"grant" => %{"machine_id" => machine_id, "repository_id" => repository_id} = params},

        socket

      ) do

    operations = if params["operations"] == "write", do: ~w(read write), else: ~w(read)

    case Repositories.grant_machine_access(

           socket.assigns.current_user,

           machine_id,

           repository_id,

           operations

         ) do

      {:ok, grant} ->

        {:noreply,

         socket

         |> assign(:pairing_error, nil)

         |> assign(:operation_success, %{

           id: "repository-grant-success",

           label: "REPOSITORY GRANTED",

           message:

             "The computer can now #{Enum.join(grant.operations, " and ")} that repository over Git."

         })

         |> load_computers()}

      {:error, reason} ->

        {:noreply,

         socket

         |> assign(:operation_success, nil)

         |> assign(:pairing_error, grant_error(reason))}

    end

  end

  def handle_event(

        "revoke_repository_access",

        %{"id" => machine_id, "repository-id" => repository_id},

        socket

      ) do

    case Repositories.revoke_machine_access(

           socket.assigns.current_user,

           machine_id,

           repository_id

         ) do

      {:ok, _grant} ->

        {:noreply,

         socket

         |> assign(:pairing_error, nil)

         |> assign(:operation_success, %{

           id: "repository-grant-revoked",

           label: "REPOSITORY WITHDRAWN",

           message: "That computer can no longer reach the repository over Git."

         })

         |> load_computers()}

      {:error, reason} ->

        {:noreply,

         socket

         |> assign(:operation_success, nil)

         |> assign(:pairing_error, grant_error(reason))}

    end

  end

  def handle_event("revoke_computer", %{"id" => machine_id}, socket) do

    case Machines.revoke_machine(socket.assigns.current_user, machine_id) do

      {:ok, machine} ->

  def handle_info(_message, socket), do: {:noreply, socket}

  defp load_computers(socket) do

    machines = Machines.list_machines(socket.assigns.current_user.id)

    user = socket.assigns.current_user

    machines = Machines.list_machines(user.id)

    socket = subscribe_to_computers(socket, machines)

    presence =

        {machine.id, machine.status == "active" and Computer.online?(machine.id)}

      end)

    # The grants render inside the stream, so they are reloaded and the stream

    # is reset together — an assign that changes streamed content and is not

    # re-streamed with it goes stale on the client.

    grants = Map.new(machines, &{&1.id, Repositories.list_machine_grants(user, &1.id)})

    socket

    |> assign(:presence, presence)

    |> assign(:computer_count, length(machines))

    |> assign(:grantable_repositories, Repositories.list_grantable_repositories(user))

    |> assign(:repository_grants, grants)

    |> stream(:computers, machines, reset: true)

  end

  defp pairing_error(:too_many_machines), do: "Computer limit reached. Revoke one to free a slot."

  defp pairing_error(_reason), do: "Pairing failed."

  defp grant_error(:machine_not_owned), do: "Computer not found."

  defp grant_error(:repository_not_allowed), do: "You do not administer that repository."

  defp grant_error(:grant_not_found), do: "That computer has no access to that repository."

  defp grant_error(_reason), do: "Repository access could not be changed."

  defp grants_for(grants, machine), do: Map.get(grants, machine.id, [])

  defp operations_label(operations) do

    if "write" in operations, do: "Read and write", else: "Read only"

  end

  defp online?(machine, presence) do

    machine.status == "active" and Map.get(presence, machine.id, false)

  end

                    </div>

                  </dl>

                  <section

                    :if={machine.status == "active"}

                    id={"repository-access-#{machine.id}"}

                    class="computer-card__repositories"

                    aria-label={"Repository access for #{machine.name}"}

                  >

                    <h4>Repository access</h4>

                    <p>

                      A computer reaches the forge over Git with its own credential. It can read

                      or write only the repositories granted here.

                    </p>

                    <ul

                      :if={grants_for(@repository_grants, machine) != []}

                      class="computer-card__grants"

                    >

                      <li

                        :for={grant <- grants_for(@repository_grants, machine)}

                        id={"grant-#{machine.id}-#{grant.repository_id}"}

                      >

                        <span class="computer-card__grant-name">

                          {grant.repository.owner}/{grant.repository.name}

                        </span>

                        <.badge variant={:dim}>{operations_label(grant.operations)}</.badge>

                        <.text_button

                          id={"revoke-grant-#{machine.id}-#{grant.repository_id}"}

                          tone={:danger}

                          phx-click="revoke_repository_access"

                          phx-value-id={machine.id}

                          phx-value-repository-id={grant.repository_id}

                          phx-disable-with="Withdrawing…"

                        >

                          Withdraw

                        </.text_button>

                      </li>

                    </ul>

                    <p

                      :if={grants_for(@repository_grants, machine) == []}

                      class="computer-card__grants-empty"

                    >

                      No repositories granted. Git requests from this computer are refused.

                    </p>

                    <.form

                      :if={@grantable_repositories != []}

                      for={@grant_form}

                      id={"repository-grant-form-#{machine.id}"}

                      class="computer-card__grant-form"

                      phx-submit="grant_repository_access"

                    >

                      <input type="hidden" name="grant[machine_id]" value={machine.id} />

                      <.input

                        id={"grant-repository-#{machine.id}"}

                        name="grant[repository_id]"

                        value=""

                        type="select"

                        label="Repository"

                        prompt="Choose a repository"

                        options={

                          Enum.map(

                            @grantable_repositories,

                            &{"#{&1.owner}/#{&1.name}", &1.id}

                          )

                        }

                        required

                      />

                      <.input

                        id={"grant-operations-#{machine.id}"}

                        name="grant[operations]"

                        value="read"

                        type="select"

                        label="Access"

                        options={[{"Read only", "read"}, {"Read and write", "write"}]}

                      />

                      <.button

                        id={"grant-repository-submit-#{machine.id}"}

                        type="submit"

                        phx-disable-with="Granting…"

                      >

                        Grant access

                      </.button>

                    </.form>

                  </section>

                  <footer :if={machine.status == "active"} class="computer-card__actions">

                    <p>Revoking closes its connection and can stop work currently running there.</p>

                    <.text_button

    assert ungranted_status != 0

    assert ungranted_output =~ "404" or ungranted_output =~ "not found"

    assert {:ok, _grant} = Repositories.grant_machine(repository, user, machine, ["read"])

    # Through the surface the owner actually has, not through the context

    # function that used to have no caller in `lib/` (#182).

    assert {:ok, _grant} =

             Repositories.grant_machine_access(user, machine.id, repository.id, ["read"])

    machine_clone = seed_clone!(base, machine_url)

    File.write!(Path.join(machine_clone, "machine.txt"), "machine\n")

    sh!(machine_clone, "git", ["add", "machine.txt"])

    assert read_only_status != 0

    assert {:ok, _grant} =

             Repositories.grant_machine(repository, user, machine, ["read", "write"])

             Repositories.grant_machine_access(user, machine.id, repository.id, ["read", "write"])

    sh!(machine_clone, "git", ["push", "origin", "HEAD:main"])

  end

defmodule OpenAgentsWeb.ComputersRepositoryAccessTest do

  @moduledoc """

  REPOSITORY-001's computer principal, from the surface that grants it.

  `repository_machine_grants` was a complete, enforced authorization input with

  no writer outside tests: `OpenAgentsWeb.Plugs.ForgeGitAuth` accepted an

  `smct_` token, `OpenAgents.Forge.GitHTTP` routed it to

  `OpenAgents.Repositories.machine_access?/3`, and that predicate needed a row

  no route could create. So every Git request a paired computer made answered

  `404 unknown repository`, indistinguishable from an unauthorized one, and the

  tests passed because they inserted the row themselves.

  These prove the grant is reachable and scoped. The enforcement itself — a

  real `git clone` and `git push` over HTTP with the computer's own credential,

  admitted only for the operations granted — is

  `OpenAgents.Forge.GitHTTPTest`, which now obtains its grant through this same

  entry point rather than through a context function nothing called.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Ecto.Query

  import Phoenix.LiveViewTest

  alias OpenAgents.Machines

  alias OpenAgents.Repositories

  defp owner(login), do: repository_user_fixture(login)

  defp repository!(user, name) do

    {:ok, repository, :created} =

      Repositories.create_user_repository(user, %{name: name}, "grant-#{name}-#{user.id}")

    repository

    |> Ecto.Changeset.change(lifecycle_state: "ready", ready_at: DateTime.utc_now())

    |> OpenAgents.Repo.update!()

  end

  defp computer!(user, name) do

    {:ok, pairing} =

      Machines.start_pairing(%{

        "name" => name,

        "tier" => "curated",

        "platform" => "linux-x64",

        "agent_version" => "0.4.0",

        "roots" => ["/home/test/work"]

      })

    {:ok, machine} = Machines.approve_pairing(user, pairing.code)

    machine

  end

  defp session(conn, user), do: Plug.Test.init_test_session(conn, %{"user_id" => user.id})

  test "the owner grants and withdraws a computer's repository access", %{conn: conn} do

    user = owner("grant-owner")

    repository = repository!(user, "granted")

    machine = computer!(user, "grant-box")

    refute Repositories.machine_access?(repository, machine.id, "read")

    {:ok, view, _html} = live(session(conn, user), ~p"/computers")

    assert has_element?(view, "#repository-access-#{machine.id}", "No repositories granted")

    view

    |> form("#repository-grant-form-#{machine.id}",

      grant: %{machine_id: machine.id, repository_id: repository.id, operations: "read"}

    )

    |> render_submit()

    assert has_element?(view, "#repository-grant-success", "read")

    assert has_element?(

             view,

             "#grant-#{machine.id}-#{repository.id}",

             "#{repository.owner}/granted"

           )

    # The predicate `OpenAgents.Forge.GitHTTP` calls for a `{:machine, id}`

    # principal, which nothing could satisfy before.

    assert Repositories.machine_access?(repository, machine.id, "read")

    refute Repositories.machine_access?(repository, machine.id, "write")

    view

    |> form("#repository-grant-form-#{machine.id}",

      grant: %{machine_id: machine.id, repository_id: repository.id, operations: "write"}

    )

    |> render_submit()

    assert Repositories.machine_access?(repository, machine.id, "write")

    view |> element("#revoke-grant-#{machine.id}-#{repository.id}") |> render_click()

    assert has_element?(view, "#repository-grant-revoked")

    refute Repositories.machine_access?(repository, machine.id, "read")

    refute has_element?(view, "#grant-#{machine.id}-#{repository.id}")

  end

  test "the withdrawal is audited with the account that created the grant", %{conn: conn} do

    user = owner("grant-audit")

    repository = repository!(user, "audited")

    machine = computer!(user, "audit-box")

    {:ok, view, _html} = live(session(conn, user), ~p"/computers")

    view

    |> form("#repository-grant-form-#{machine.id}",

      grant: %{machine_id: machine.id, repository_id: repository.id, operations: "read"}

    )

    |> render_submit()

    view |> element("#revoke-grant-#{machine.id}-#{repository.id}") |> render_click()

    events =

      OpenAgents.Repo.all(

        from event in OpenAgents.AuditEvent,

          where: event.repository_id == ^repository.id,

          order_by: [asc: event.inserted_at]

      )

    types = Enum.map(events, & &1.event_type)

    assert "repository.machine_grant.updated" in types

    assert "repository.machine_grant.revoked" in types

    revoked = Enum.find(events, &(&1.event_type == "repository.machine_grant.revoked"))

    assert revoked.metadata["machine_id"] == machine.id

    assert revoked.metadata["granted_by_user_id"] == user.id

  end

  test "a computer another account owns is not selectable and not grantable", %{conn: conn} do

    user = owner("grant-scope-owner")

    stranger = owner("grant-scope-stranger")

    repository = repository!(user, "scoped")

    foreign = computer!(stranger, "foreign-box")

    own = computer!(user, "own-box")

    {:ok, view, _html} = live(session(conn, user), ~p"/computers")

    refute has_element?(view, "#repository-access-#{foreign.id}")

    # A LiveView event carries whatever the client sends. The computer is

    # resolved through the acting account, so a foreign identifier refuses

    # exactly as an absent one does (IDENTITY-002).

    render_submit(view, "grant_repository_access", %{

      "grant" => %{

        "machine_id" => foreign.id,

        "repository_id" => repository.id,

        "operations" => "write"

      }

    })

    assert has_element?(view, "#pairing-error", "Computer not found")

    refute Repositories.machine_access?(repository, foreign.id, "read")

    refute Repositories.machine_access?(repository, own.id, "read")

  end

  test "a repository this account does not administer refuses the same way", %{conn: conn} do

    user = owner("grant-repo-scope")

    stranger = owner("grant-repo-stranger")

    foreign_repository = repository!(stranger, "not-mine")

    machine = computer!(user, "scoped-box")

    {:ok, repository, :created} =

      Repositories.create_user_repository(user, %{name: "mine"}, "grant-mine-#{user.id}")

    {:ok, view, _html} = live(session(conn, user), ~p"/computers")

    # The picker offers only repositories this account administers.

    assert has_element?(view, "#grant-repository-#{machine.id} option[value='#{repository.id}']")

    refute has_element?(

             view,

             "#grant-repository-#{machine.id} option[value='#{foreign_repository.id}']"

           )

    render_submit(view, "grant_repository_access", %{

      "grant" => %{

        "machine_id" => machine.id,

        "repository_id" => foreign_repository.id,

        "operations" => "write"

      }

    })

    assert has_element?(view, "#pairing-error", "do not administer")

    refute Repositories.machine_access?(foreign_repository, machine.id, "read")

  end

  test "a viewer membership cannot hand a repository to a computer", %{conn: conn} do

    holder = owner("grant-role-owner")

    viewer = owner("grant-role-viewer")

    repository = repository!(holder, "role-scoped")

    {:ok, _membership} = Repositories.add_member(repository, viewer, "viewer")

    machine = computer!(viewer, "viewer-box")

    assert {:error, :repository_not_allowed} =

             Repositories.grant_machine_access(viewer, machine.id, repository.id, ["read"])

    {:ok, view, _html} = live(session(conn, viewer), ~p"/computers")

    refute has_element?(view, "#grant-repository-#{machine.id} option[value='#{repository.id}']")

    refute Repositories.machine_access?(repository, machine.id, "read")

  end

  test "reading and withdrawing a grant are scoped to the account that owns the computer" do

    holder = owner("grant-cross-holder")

    admin = owner("grant-cross-admin")

    # One repository both accounts administer, and a computer only `holder`

    # owns. The repository membership is not authority over someone else's

    # computer, in either direction.

    repository = repository!(holder, "shared-admin")

    {:ok, _membership} = Repositories.add_member(repository, admin, "maintainer")

    machine = computer!(holder, "cross-box")

    assert {:ok, _grant} =

             Repositories.grant_machine_access(holder, machine.id, repository.id, ["read"])

    assert [_one] = Repositories.list_machine_grants(holder, machine.id)

    assert Repositories.list_machine_grants(admin, machine.id) == []

    assert {:error, :machine_not_owned} =

             Repositories.revoke_machine_access(admin, machine.id, repository.id)

    assert Repositories.machine_access?(repository, machine.id, "read")

    assert {:ok, _revoked} =

             Repositories.revoke_machine_access(holder, machine.id, repository.id)

    refute Repositories.machine_access?(repository, machine.id, "read")

  end

  test "revoking the computer ends every grant it holds without deleting them", %{conn: conn} do

    user = owner("grant-revoked-computer")

    repository = repository!(user, "still-granted")

    machine = computer!(user, "revoked-grant-box")

    {:ok, view, _html} = live(session(conn, user), ~p"/computers")

    view

    |> form("#repository-grant-form-#{machine.id}",

      grant: %{machine_id: machine.id, repository_id: repository.id, operations: "write"}

    )

    |> render_submit()

    assert Repositories.machine_access?(repository, machine.id, "write")

    view |> element("#revoke-#{machine.id}") |> render_click()

    refute Repositories.machine_access?(repository, machine.id, "read")

    assert [_grant] = Repositories.list_machine_grants(user, machine.id)

  end

end