[jaspermayone]

Summary

Krater now reads its roles from Weave's patches claim as well as from its old app roles. Weave moves Krater's app roles reviewer and admin into the Ganymede patch roles krater:reviewer and krater:admin (patchworklabsorg/weave#288). During the move, Krater gives each person the union of both, so nobody gains or loses access.

• Sign-in: Krater asks for the patches scope too. krater.weave.roles maps patches.ganymede keys krater:reviewer to ganymede:reviewer and krater:admin to ganymede:admin. Other patches and other keys (lead, quilt:viewer, a bare reviewer) give nothing. A malformed value gives no patch roles, and the app roles still count.
• Re-checks: the directory lookups (authorize, Slack clicks) read the same patches field.
• Lists: reviewer and admin lists are the union of ?role=<app key> and the new ?patch=ganymede&patch_role=<key> filter, deduplicated by sub. Slack reviewer invites and admin box access include patch-only holders. Until Weave is set up, a 403 or 404 from the patch filter falls back to the app-role list with one warning. Other failures fail closed, as before.
• Settings: KRATER_WEAVE_PATCH (ganymede), KRATER_WEAVE_PATCH_ROLE_REVIEWER (krater:reviewer), KRATER_WEAVE_PATCH_ROLE_ADMIN (krater:admin).

flowchart LR
  W[Weave] -- "roles: reviewer, admin" --> M[krater.weave.roles]
  W -- "patches.ganymede: krater:reviewer, krater:admin" --> M
  M -- union --> K["ganymede:reviewer / ganymede:admin (+ ganymede:member)"]

Loading

Deploy order

The full order is in patchworklabsorg/weave#288. For Krater:

1. Weave #288 is deployed.
2. A Weave superadmin links the Krater app to the ganymede patch and adds patches to its scopes.
3. The Weave import runs: bin/rails patches:import_app_roles APP=<krater> PATCH=ganymede PREFIX=krater ACTOR=<superadmin email>, dry, then with APPLY=1.
4. Deploy this PR. If it goes before step 2, Weave refuses the sign-in request with invalid_scope.

Follow-up: a later PR removes the app roles, the fallback groups and the ?role= call. While the union holds, removing someone's access needs both the app role and the patch role removed.

Checks

• uv run pytest: 1808 passed, 1 skipped, 10 deselected (the live Weave tests, which need a real Weave).
• uv run ruff check . and uv run ruff format --check .: clean.
• CLI tests: 161 passed, 1 skipped.

Related: patchworklabsorg/weave#288, patchworklabsorg/quilt#63, patchworklabsorg/internal-docs#11, patchworklabsorg/infra#98.