Skip to content

feat: support publishing packages from GitHub organizations (completes #138) - #140

Merged
JalonSolov merged 9 commits into
vlang:masterfrom
nepinhum:feat/organization-support-fixed
Aug 20, 2026
Merged

feat: support publishing packages from GitHub organizations (completes #138)#140
JalonSolov merged 9 commits into
vlang:masterfrom
nepinhum:feat/organization-support-fixed

Conversation

@nepinhum

@nepinhum nepinhum commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

This picks up #138 (@meiseayoung), which implemented organization based package publishing but went unanswered after Codex requested changes and the pr sat without follow up. All findings from that review are addressed here. The original feature and its intent are unchanged.

Summary (original, by @meiseayoung)

VPM only allowed publishing packages from a user's personal GitHub account. This adds support for publishing from GitHub organizations a user is a member of.

Solution

  • Fetch the user's organization memberships during GitHub OAuth login (/user/orgs)
  • Store memberships in a new UserOrganization table
  • Validate package URLs against both the user's account and their organizations
  • Use the organization as the package prefix when the URL belongs to one (e.g. v-hono.hono instead of meiseayoung.hono)

What changed since #138

  • OAuth scope + pagination: login_link() now requests read:org (without it /user/orgs returns 403 and no orgs are ever stored). Org fetching is paginated (per_page=100, follows pages) instead of only reading GitHub's default first-30.
  • Fixed an authorization bypass: the org/account check used starts_with() on a formatted URL prefix, so membership in acme would incorrectly authorize acme-inc/some-repo. Replaced with exact, case insensitive comparison of the URL's actual owner segment.
  • Fixed editing organization packages: the edit path still called the old check_vcs()/username-only prefix logic, so updating even just the description of an org package would fail (or, if bypassed, silently move it back into the user's personal namespace). Creation and editing now share one resolve_owner_prefix() resolver and OrganizationsRepo is injected into UseCase instead of being wired up ad hoc per call site.
  • Error handling: save_user_organizations() no longer swallows delete/insert failures; a failed org refresh during login now fails closed.

Test plan

  • v test repo/ usecase/package/ - all passing, including new regression tests for the prefix bypass fix (acme vs acme-inc, both org and personal account sides) and the shared prefix resolver.
  • v . - full project builds clean.

qinqiuxia and others added 6 commits January 12, 2026 21:16
@qinqiuxia
feat: add support for publishing packages from GitHub organizations
31dc549 
- Add UserOrganization entity to store user's org memberships
- Fetch user's organizations during OAuth login via GitHub API
- Modify check_vcs() to accept URLs from user's organizations
- Automatically use organization name as package prefix when publishing from org repos

This allows users who are members of GitHub organizations to publish
packages from organization repositories. The package name will use
the organization name as prefix (e.g., 'v-hono.hono' instead of
'meiseayoung.hono' when publishing from v-hono organization).

Closes #XXX
@qinqiuxia
test: add unit tests for organization support feature
b2529cc 
- Add tests for extract_owner_from_url function
- Add tests for check_vcs backward compatibility
- Add tests for check_vcs_with_orgs new functionality
- Add tests for is_valid_mod_name validation
- Add tests for UserOrganization entity and membership logic

All 2 test files pass with 20+ test cases covering:
- Own account publishing (existing behavior)
- Organization member publishing (new feature)
- Non-member organization rejection
- Admin bypass
- Edge cases and error handling
@qinqiuxia
style: fix code formatting to pass v fmt -verify
2206205
@meiseayoung
fix: add missing import and migration for organizations
7a74287
@medvednikov
Merge master into feat/organization-support
c749c1a
@nepinhum
fix: address org support review findings
20e8aab
@medvednikov

medvednikov commented Jul 14, 2026

Copy link
Copy Markdown
Member

@codex review

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 14, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20e8aab2e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread auth.v Outdated
@medvednikov

medvednikov commented Jul 14, 2026

Copy link
Copy Markdown
Member

@codex review

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 14, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9750f30362

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread usecase/package/packages.v Outdated
@nepinhum

nepinhum commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

@medvednikov Is the hardcoded medvednikov bypass still intentionally used for publishing packages from repositories you don't own or is it just legacy behavior? (ty, you answered in discord)

@nepinhum

nepinhum commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

could someone review the latest changes?

meiseayoung
meiseayoung approved these changes Jul 24, 2026
View reviewed changes

@meiseayoung meiseayoung left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pass

@hunterjsb hunterjsb mentioned this pull request Aug 9, 2026
Closed
@JalonSolov
JalonSolov merged commit 0462d53 into vlang:master Aug 20, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
+2 more reviewers
@meiseayoung meiseayoung meiseayoung approved these changes
@xRookieFight xRookieFight xRookieFight approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@nepinhum @medvednikov @meiseayoung @xRookieFight @JalonSolov @qinqiuxia