timescale.info#262 · Owners duplicate, others fork, once; propose only without write access (#259)
- timeline-app
- pull request
Closes #259. On timescale.info, the owner of `athan/usmc` could **Fork on server** into their own account, then fork that fork, and so on. Their own timeline also offered **Propose changes** with **Submit pull request**. ## Rules | | Before | Now | | --- | --- | --- | | **Duplicate** | anyone who may copy | the timeline's **owner** only (403 for others, who fork) | | **Fork on server** | anyone who may copy, owner included | **someone else's** timeline that is public, private with *Allow invited readers to fork*, or opened by an administrator (403 for the owner) | | **Forking again** | a new copy each time | **one fork per account**: forking again answers the existing fork (200, `existing: true`) and copies nothing | | **Propose changes / Submit pull request** | owners, writers, contributors, public readers | only those who **can't save it**: contributors and signed-in readers of a public timeline | | **Propose saved changes** (from a fork) | always on a fork you can write | only once the fork has **saves of its own** (`forkChanged`) | - Pull request authors keep updating and rebasing their own pull requests with edit access, so a contributor who later becomes a writer isn't locked out of an open one. - Server copies were already limited to 10 a minute per account, and copies count toward storage. The refusal now says "Too many copies" instead of "Too many sign-in attempts", and browser copies get the same message. - `store.access` adds `canDuplicate` and `forkChanged`. The site's fork, duplicate and propose-saved-changes buttons follow them. - The API description (`server/openapi/`) and `docs/collaboration.md` describe the new rules. ## Tests - `test/collaboration.test.mjs`: an owner can't propose or fork but can duplicate; a writer can't propose or duplicate but can fork. - `test/next-postgres.mjs`: - forking again returns the same fork with `existing: true`; - the owner gets 403 forking their own timeline; - a contributor gets 403 duplicating it; - the owner's duplicate has no upstream. - 14 PostgreSQL suites forked their owner's own timelines (sometimes in chains, or the same upstream twice), or had the owner propose to their own timeline. They now fork and propose from other accounts, and no assertions were loosened. - `fork-preparing` copied one source repeatedly with one account. Those repeats are now duplicates by its owner, which go through the same preparation, and one real fork remains. - Results: - `npm test` (304) passes. - `npm run test:platform` and `test:platform:postgres` pass. - Every PostgreSQL suite in CI passes, run one at a time locally; the browser-based ones ran in the Playwright container. Filed separately: #261, an intermittent background "Broken timeline index" log seen in one suite. The suite still passes, and the log isn't tied to these rules.