Drops: per-user gists, each a small hidden Oxygen repository (#279) 166f6e9bf4f1

-- Drops (oxygenhub#279): a drop is a small repository of its own, named

-- `drops/ID` under its owner, that no repository list shows; `kind` tells

-- it from a repository and `title` is its name on the Drops page (the

-- description column holds its description). A secret drop is private to

-- every list and readable by anyone with its address.

ALTER TABLE repositories ADD COLUMN kind TEXT NOT NULL DEFAULT 'repo';

ALTER TABLE repositories ADD COLUMN title TEXT NOT NULL DEFAULT '';

CREATE INDEX repositories_kind_owner ON repositories(kind, owner);

-- Drops (oxygenhub#279): a drop is a small repository of its own, named

-- `drops/ID` under its owner, that no repository list shows; `kind` tells

-- it from a repository and `title` is its name on the Drops page (the

-- description column holds its description). A secret drop is private to

-- every list and readable by anyone with its address.

ALTER TABLE repositories ADD COLUMN kind TEXT NOT NULL DEFAULT 'repo';

ALTER TABLE repositories ADD COLUMN title TEXT NOT NULL DEFAULT '';

CREATE INDEX repositories_kind_owner ON repositories(kind, owner);

//! Drops in the API (oxygenhub#279): `GET`/`POST /drops` (yours; making

//! one), `GET /users/{name}/drops` (someone's public ones),

//! `GET`/`PATCH`/`DELETE /drops/{id}`. Reading a drop needs nothing but

//! its id; changing one needs `repo:write` and to be its owner (or a site

//! administrator, who may also delete it).

use super::{caller, not_found, ApiError};

use crate::db;

use crate::drops::{self, DropError, DropFile, NewFile};

use crate::Shared;

use axum::extract::{Path, State};

use axum::http::{HeaderMap, StatusCode};

use axum::Json;

use hub_api::{Drop, DropEdit, NewDrop};

impl From<DropError> for ApiError {

    fn from(e: DropError) -> ApiError {

        match e {

            DropError::Bad(m) => ApiError(StatusCode::UNPROCESSABLE_ENTITY, m),

            DropError::Repo(e) => e.into(),

            DropError::Db(e) => e.into(),

        }

    }

}

/// The API's shape of a drop, with its files' content when `content`.

fn shape(app: &Shared, row: &db::repos::RepoRow, files: &[DropFile], content: bool) -> Drop {

    let base = app.config.base_url();

    let url = drops::url_of(row);

    Drop {

        id: drops::id_of(row).to_string(),

        owner: row.owner.clone(),

        title: row.title.clone(),

        description: row.description.clone(),

        visibility: drops::visibility_label(row).to_string(),

        url: format!("{base}{url}"),

        clone_url: format!("{base}{url}"),

        created_ms: row.created_ms,

        updated_ms: row.updated_ms,

        files: files

            .iter()

            .map(|f| hub_api::DropFile {

                name: f.path.clone(),

                size: f.size,

                content: if content { f.text.clone() } else { None },

                raw_url: format!("{base}{url}/raw/{}/{}", row.default_bookmark, f.path),

            })

            .collect(),

    }

}

async fn listed(app: &Shared, rows: Vec<db::repos::RepoRow>) -> Result<Vec<Drop>, ApiError> {

    let mut out = Vec::with_capacity(rows.len());

    for row in rows {

        let files = drops::files(app, &row, "").await.map(|(_, f)| f).unwrap_or_default();

        out.push(shape(app, &row, &files, false));

    }

    Ok(out)

}

/// `GET /drops`: the caller's drops, secret ones too.

pub(super) async fn mine(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Drop>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:read")?.clone();

    let rows = db::repos::drops_of(&app.db, &me.username).await?;

    Ok(Json(listed(&app, rows).await?))

}

/// `GET /users/{name}/drops`: someone's public drops (all of them to

/// themselves and to site administrators).

pub(super) async fn of_user(State(app): State<Shared>, headers: HeaderMap, Path(name): Path<String>) -> Result<Json<Vec<Drop>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let account = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such user"))?;

    let rows: Vec<_> =

        db::repos::drops_of(&app.db, &account.username).await?.into_iter().filter(|r| drops::listed_to(c.account.as_ref(), r)).collect();

    Ok(Json(listed(&app, rows).await?))

}

/// `POST /drops`.

pub(super) async fn create(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(body): Json<NewDrop>,

) -> Result<(StatusCode, Json<Drop>), ApiError> {

    let c = caller(&app, &headers).await?;

    let me = c.require("repo:write")?.clone();

    let files: Vec<NewFile> = body.files.into_iter().map(|f| NewFile { name: f.name, content: f.content }).collect();

    let row = drops::create(&app, &me, &body.title, &body.description, body.secret, &files).await?;

    let (_, files) = drops::files(&app, &row, "").await?;

    Ok((StatusCode::CREATED, Json(shape(&app, &row, &files, true))))

}

async fn row_of(app: &Shared, id: &str) -> Result<db::repos::RepoRow, ApiError> {

    if !crate::repos::names::valid_drop_id(id) {

        return Err(not_found("no such drop"));

    }

    db::repos::drop_by_id(&app.db, id).await?.ok_or_else(|| not_found("no such drop"))

}

/// `GET /drops/{id}`: anyone with the id, its files' content included.

pub(super) async fn view(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<Json<Drop>, ApiError> {

    let c = caller(&app, &headers).await?;

    let row = row_of(&app, &id).await?;

    if c.account.as_ref().is_some_and(|a| a.blocked()) {

        return Err(not_found("no such drop"));

    }

    let (_, files) = drops::files(&app, &row, "").await?;

    Ok(Json(shape(&app, &row, &files, true)))

}

/// The drop, when the caller may change it (its owner) or, `deleting`,

/// delete it (its owner or a site administrator); else 403.

async fn writable(

    app: &Shared,

    headers: &HeaderMap,

    id: &str,

    deleting: bool,

) -> Result<(db::accounts::Account, db::repos::RepoRow), ApiError> {

    let c = caller(app, headers).await?;

    let me = c.require("repo:write")?.clone();

    let row = row_of(app, id).await?;

    let may = if deleting { drops::may_delete(Some(&me), &row) } else { drops::may_edit(Some(&me), &row) };

    if !may {

        return Err(super::forbidden(if deleting {

            "only the drop's owner or a site administrator may delete it"

        } else {

            "only the drop's owner may change it"

        }));

    }

    Ok((me, row))

}

/// `PATCH /drops/{id}`.

pub(super) async fn edit(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(id): Path<String>,

    Json(body): Json<DropEdit>,

) -> Result<Json<Drop>, ApiError> {

    let (me, row) = writable(&app, &headers, &id, false).await?;

    let mut seen = Vec::new();

    let mut files = Vec::with_capacity(body.files.len());

    for f in body.files {

        let name = drops::check_name(&f.name).map_err(|m| ApiError(StatusCode::UNPROCESSABLE_ENTITY, m))?;

        if seen.contains(&name) {

            return Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("{name} is named twice.")));

        }

        seen.push(name.clone());

        files.push(oxy_core::repo::FileEdit { path: name, content: f.content.map(|c| c.replace("\r\n", "\n").into_bytes()) });

    }

    let update = drops::Update {

        title: body.title.unwrap_or_else(|| row.title.clone()),

        description: body.description.unwrap_or_else(|| row.description.clone()),

        secret: body.secret.unwrap_or(row.visibility() != hub_api::Visibility::Public),

        files,

        message: body.message.unwrap_or_default(),

    };

    drops::update(&app, &me, &row, update).await?;

    let row = db::repos::get_by_id(&app.db, row.id).await?.ok_or_else(|| not_found("no such drop"))?;

    let (_, files) = drops::files(&app, &row, "").await?;

    Ok(Json(shape(&app, &row, &files, true)))

}

/// `DELETE /drops/{id}`.

pub(super) async fn delete(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<String>) -> Result<StatusCode, ApiError> {

    let (me, row) = writable(&app, &headers, &id, true).await?;

    drops::delete(&app, &me, &row).await?;

    Ok(StatusCode::NO_CONTENT)

}

//! Drops (oxygenhub#279): small snippets of one or more files, as gists

//! are, each its own Oxygen repository.

//!

//! A drop is a repository named `drops/ID` under its owner, with

//! `repositories.kind = 'drop'`: stored, locked, cloned and pushed as any

//! repository is (`oxy clone https://HUB/OWNER/drops/ID`), but never

//! listed among repositories. Its id is 24 random hex digits, so a secret

//! drop's address cannot be guessed; a secret drop is `private` to every

//! list and readable by anyone who has the address (`auth::roles`). The

//! hub makes its changes as the owner's delegate, as web edits are made,

//! after the same push protection scan a push gets.

use crate::db::{self, accounts::Account, repos::RepoRow};

use crate::repos::edits::{self, Signer};

use crate::repos::{RepoError, RepoName};

use crate::Shared;

use hub_api::Visibility;

use oxy_core::objects::NodeKind;

use oxy_core::repo::FileEdit;

use oxy_core::state::FileContent;

/// Most files a drop takes from the web or the API in one go.

pub const MAX_FILES: usize = 50;

/// Largest file the web or the API takes, in bytes.

pub const MAX_FILE_BYTES: usize = 1 << 20;

/// Longest title and description.

pub const MAX_TITLE: usize = 200;

pub const MAX_DESCRIPTION: usize = 2000;

/// Most text a drop page shows of one file; past it, the raw link.

const SHOWN_BYTES: u64 = 512 * 1024;

/// Why a drop was not made or changed.

#[derive(Debug)]

pub enum DropError {

    /// What the person can fix, said to them.

    Bad(String),

    Repo(RepoError),

    Db(sqlx::Error),

}

impl std::fmt::Display for DropError {

    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

        match self {

            DropError::Bad(m) => f.write_str(m),

            DropError::Repo(e) => write!(f, "{e}"),

            DropError::Db(e) => write!(f, "{e}"),

        }

    }

}

impl From<sqlx::Error> for DropError {

    fn from(e: sqlx::Error) -> DropError {

        DropError::Db(e)

    }

}

impl From<RepoError> for DropError {

    fn from(e: RepoError) -> DropError {

        DropError::Repo(e)

    }

}

fn bad(msg: impl Into<String>) -> DropError {

    DropError::Bad(msg.into())

}

/// `public` or `secret`, as people and the API say it.

pub fn visibility_label(row: &RepoRow) -> &'static str {

    if row.visibility() == Visibility::Public {

        "public"

    } else {

        "secret"

    }

}

fn visibility(secret: bool) -> Visibility {

    if secret {

        Visibility::Private

    } else {

        Visibility::Public

    }

}

/// The drop's id, from its row.

pub fn id_of(row: &RepoRow) -> &str {

    row.name.split_once('/').map(|(_, id)| id).unwrap_or(&row.name)

}

/// `/{owner}/drops/{id}`.

pub fn url_of(row: &RepoRow) -> String {

    format!("/{}/{}", row.owner, row.name)

}

/// The title a page shows: its own, else its first file's name, else its id.

pub fn shown_title(row: &RepoRow, files: &[DropFile]) -> String {

    if !row.title.is_empty() {

        row.title.clone()

    } else if let Some(f) = files.first() {

        f.path.clone()

    } else {

        id_of(row).to_string()

    }

}

/// One of a drop's files.

#[derive(Clone, Debug)]

pub struct DropFile {

    pub path: String,

    pub size: u64,

    /// The text, when the file is text and not too large to show.

    pub text: Option<String>,

}

/// A file as given from the web or the API: a name and its content.

#[derive(Clone, Debug)]

pub struct NewFile {

    pub name: String,

    pub content: String,

}

/// A file name: a path of plain parts, at most 255 bytes.

pub fn check_name(name: &str) -> Result<String, String> {

    let name = name.trim().trim_matches('/');

    if name.is_empty() {

        return Err("Every file needs a name.".into());

    }

    if name.len() > 255 {

        return Err(format!("{name:.40}…: a file name is at most 255 bytes."));

    }

    if name.chars().any(|c| c.is_control() || c == '\\')

        || name.split('/').any(|p| p.is_empty() || p == "." || p == ".." || p == oxy_core::repo::OXY_DIR || p.trim() != p)

    {

        return Err(format!("{name:?} is not a file name: use letters, digits and punctuation, with / between folders."));

    }

    Ok(name.to_string())

}

/// Files from the web or the API, checked: named, not too many or too

/// large, no name twice, and nothing push protection refuses.

pub fn check_files(files: &[NewFile], allow_empty: bool) -> Result<Vec<NewFile>, String> {

    if files.is_empty() && !allow_empty {

        return Err("A drop needs at least one file.".into());

    }

    if files.len() > MAX_FILES {

        return Err(format!("A drop takes at most {MAX_FILES} files at a time."));

    }

    let mut out: Vec<NewFile> = Vec::with_capacity(files.len());

    for f in files {

        let name = check_name(&f.name)?;

        if f.content.len() > MAX_FILE_BYTES {

            return Err(format!("{name} is larger than {} KiB; push larger files with oxy.", MAX_FILE_BYTES / 1024));

        }

        if out.iter().any(|o| o.name == name) {

            return Err(format!("{name} is named twice."));

        }

        // Line endings as the browser's editor shows them.

        out.push(NewFile { name, content: f.content.replace("\r\n", "\n") });

    }

    scan(&out)?;

    Ok(out)

}

/// Push protection (#268) over what the hub is asked to commit: the same

/// rules a push gets, so a drop made on the web cannot carry what a push

/// would be refused for.

pub fn scan(files: &[NewFile]) -> Result<(), String> {

    let rules = crate::push_protection::rules();

    let mut found = Vec::new();

    for f in files {

        for h in crate::push_protection::scan_text(rules, f.content.as_bytes()) {

            let rule = &rules.rules[h.rule];

            found.push(format!("{}:{}: {} (fingerprint {})", f.name, h.line, rule.description, h.fingerprint));

        }

    }

    if found.is_empty() {

        return Ok(());

    }

    Err(format!(

        "Push protection refused this: {} like {}, and nothing was saved. {} Take {} out (read credentials from the environment or a secret store), and if {} real, revoke or rotate {}.",

        if found.len() == 1 { "a value looks".to_string() } else { format!("{} values look", found.len()) },

        if found.len() == 1 { "a secret" } else { "secrets" },

        found.join("; "),

        if found.len() == 1 { "it" } else { "them" },

        if found.len() == 1 { "it is" } else { "one is" },

        if found.len() == 1 { "it" } else { "it as well" },

    ))

}

fn check_text(title: &str, description: &str) -> Result<(), String> {

    if title.chars().count() > MAX_TITLE {

        return Err(format!("A title is at most {MAX_TITLE} characters."));

    }

    if description.chars().count() > MAX_DESCRIPTION {

        return Err(format!("A description is at most {MAX_DESCRIPTION} characters."));

    }

    Ok(())

}

/// The owner's signer: their identity that delegates to the hub's key.

async fn signer(app: &Shared, account: &Account) -> Result<Signer, DropError> {

    crate::web::edit::signer_for(app, account.id).await.map_err(DropError::Bad)

}

/// Make a drop for `account`: a new repository with the files as its first

/// change on `main`, authored by the account's identity and signed by the

/// hub as its delegate. Nothing is left behind when that fails.

pub async fn create(

    app: &Shared,

    account: &Account,

    title: &str,

    description: &str,

    secret: bool,

    files: &[NewFile],

) -> Result<RepoRow, DropError> {

    if account.blocked() {

        return Err(bad("This account cannot make drops."));

    }

    let (title, description) = (title.trim(), description.trim());

    check_text(title, description).map_err(DropError::Bad)?;

    let files = check_files(files, false).map_err(DropError::Bad)?;

    let signer = signer(app, account).await?;

    // Ids are unique across the hub, so `oh drop view ID` needs no owner.

    let mut found = None;

    for _ in 0..8 {

        let id = crate::auth::random_hex(12);

        let Some(name) = RepoName::drop(&account.username, &id) else { break };

        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {

            found = Some(name);

            break;

        }

    }

    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };

    let mut repo_id = [0u8; 16];

    rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut repo_id);

    app.repos.create(&name, Some(repo_id))?;

    let id = name.drop_id().unwrap_or_default().to_string();

    let row = match db::repos::create_drop(&app.db, &account.username, &id, title, description, visibility(secret)).await {

        Ok(row) => row,

        Err(e) => {

            let _ = std::fs::remove_dir_all(app.repos.dir(&name));

            return Err(e.into());

        }

    };

    let edits: Vec<FileEdit> =

        files.iter().map(|f| FileEdit { path: f.name.clone(), content: Some(f.content.clone().into_bytes()) }).collect();

    let message = if title.is_empty() { "Create the drop".to_string() } else { format!("Create {title}") };

    let b = row.default_bookmark.clone();

    match edits::commit(&app.repos, &name, b.clone(), b, edits, message, signer).await {

        Ok(done) => {

            recorded(app, account, &row, &done, "drop.created", visibility_label(&row)).await;

            Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))

        }

        Err(e) => {

            db::repos::delete(&app.db, row.id).await.ok();

            let _ = std::fs::remove_dir_all(app.repos.dir(&name));

            Err(DropError::Bad(format!("The drop was not made: {e}")))

        }

    }

}

/// What a change to a drop's text or files is.

pub struct Update {

    pub title: String,

    pub description: String,

    pub secret: bool,

    /// Files to write or (content `None`) remove; others are kept.

    pub files: Vec<FileEdit>,

    pub message: String,

}

/// Change a drop: its files in one change made as the owner's delegate,

/// when any changed, and its title, description and visibility.

pub async fn update(app: &Shared, account: &Account, row: &RepoRow, u: Update) -> Result<(), DropError> {

    let (title, description) = (u.title.trim(), u.description.trim());

    check_text(title, description).map_err(DropError::Bad)?;

    if !u.files.is_empty() {

        if u.files.len() > MAX_FILES {

            return Err(bad(format!("A drop takes at most {MAX_FILES} files at a time.")));

        }

        let written: Vec<NewFile> = u

            .files

            .iter()

            .filter_map(|e| e.content.as_ref().map(|c| NewFile { name: e.path.clone(), content: String::from_utf8_lossy(c).into_owned() }))

            .collect();

        for f in &written {

            check_name(&f.name).map_err(DropError::Bad)?;

            if f.content.len() > MAX_FILE_BYTES {

                return Err(bad(format!("{} is larger than {} KiB; push larger files with oxy.", f.name, MAX_FILE_BYTES / 1024)));

            }

        }

        scan(&written).map_err(DropError::Bad)?;

        let signer = signer(app, account).await?;

        let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;

        let message = if u.message.trim().is_empty() {

            format!("Edit {}", if title.is_empty() { id_of(row) } else { title })

        } else {

            u.message.trim().to_string()

        };

        // Removing every file would leave an empty drop: delete it instead.

        if u.files.iter().any(|e| e.content.is_none()) {

            let (_, current) = files(app, row, "").await?;

            let left = current.iter().filter(|c| !u.files.iter().any(|e| e.path == c.path && e.content.is_none())).count();

            if left == 0 && written.is_empty() {

                return Err(bad("A drop keeps at least one file; delete the drop instead."));

            }

        }

        let b = row.default_bookmark.clone();

        let done = edits::commit(&app.repos, &name, b.clone(), b, u.files, message, signer)

            .await

            .map_err(|e| DropError::Bad(format!("The drop was not changed: {e}")))?;

        recorded(app, account, row, &done, "drop.edited", "").await;

    }

    db::repos::set_drop(&app.db, row.id, title, description, visibility(u.secret)).await?;

    if visibility(u.secret) != row.visibility() {

        db::accounts::audit(&app.db, Some(account), "drop.visibility", &row.slug(), if u.secret { "secret" } else { "public" }).await.ok();

    }

    Ok(())

}

/// The push log and the audit log for a change the hub made to a drop.

async fn recorded(app: &Shared, account: &Account, row: &RepoRow, done: &edits::Committed, action: &str, detail: &str) {

    let outcome = db::repos::PushOutcome {

        reference: done.bookmark.clone(),

        ok: true,

        reason: "web edit".into(),

        old_state: done.old_state.clone(),

        new_state: done.new_state.clone(),

        heads: done.heads.len() as i64,

        changes: 1,

    };

    db::repos::record_push(&app.db, row.id, Some((account.id, &account.username)), &[outcome]).await.ok();

    let detail = if detail.is_empty() { done.change.short(12) } else { format!("{detail} {}", done.change.short(12)) };

    db::accounts::audit(&app.db, Some(account), action, &row.slug(), &detail).await.ok();

}

/// Delete a drop: its directory to the trash and its row, once nothing

/// reads or writes it (#249), audited.

pub async fn delete(app: &Shared, actor: &Account, row: &RepoRow) -> Result<(), DropError> {

    let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;

    let _guard = app.repos.exclusive_guard(&name).await;

    match app.repos.trash(&name) {

        Ok(_) | Err(RepoError::NotFound) => {}

        Err(e) => return Err(e.into()),

    }

    db::repos::delete(&app.db, row.id).await?;

    db::accounts::audit(&app.db, Some(actor), "drop.deleted", &row.slug(), "moved to trash").await.ok();

    Ok(())

}

/// The drop's files at `spec` (its default bookmark when empty): every

/// file, with its text when it is text and small enough to show.

pub async fn files(app: &Shared, row: &RepoRow, spec: &str) -> Result<(crate::repos::view::RefTarget, Vec<DropFile>), RepoError> {

    let name = RepoName::new(&row.owner, &row.name).ok_or(RepoError::NotFound)?;

    let spec = if spec.is_empty() { row.default_bookmark.clone() } else { spec.to_string() };

    app.repos

        .read(&name, move |repo, cache| {

            let target = crate::repos::view::resolve(repo, cache, &spec)?;

            let loaded = cache.load(repo, &target.heads)?;

            let mut out = Vec::new();

            for (path, f) in &loaded.snapshot.files {

                let bytes = match (&f.kind, &f.content) {

                    (NodeKind::Dir, _) | (_, FileContent::Dir) => continue,

                    (_, FileContent::Text { bytes, .. }) => bytes.clone(),

                    (_, FileContent::Opaque { blobs }) => match blobs.first() {

                        Some(b) => repo.read_blob(b)?,

                        None => Vec::new(),

                    },

                };

                let size = bytes.len() as u64;

                let text = if size <= SHOWN_BYTES && !crate::repos::view::is_binary(&bytes) { String::from_utf8(bytes).ok() } else { None };

                out.push(DropFile { path: path.clone(), size, text });

            }

            Ok((target, out))

        })

        .await

}

/// The drop `id` of `owner`, or none.

pub async fn find(app: &Shared, owner: &str, id: &str) -> sqlx::Result<Option<RepoRow>> {

    let Some(name) = RepoName::drop(owner, id) else { return Ok(None) };

    Ok(db::repos::get(&app.db, &name.owner, &name.name).await?.filter(|r| r.is_drop()))

}

/// Whether `account` may change the drop: its owner alone.

pub fn may_edit(account: Option<&Account>, row: &RepoRow) -> bool {

    account.is_some_and(|a| !a.blocked() && a.username.eq_ignore_ascii_case(&row.owner))

}

/// Whether `account` may delete the drop: its owner, or a site

/// administrator.

pub fn may_delete(account: Option<&Account>, row: &RepoRow) -> bool {

    may_edit(account, row) || account.is_some_and(|a| !a.blocked() && a.is_admin)

}

/// Whether the drop is listed to `account`: public ones to everyone, secret

/// ones to their owner and site administrators only.

pub fn listed_to(account: Option<&Account>, row: &RepoRow) -> bool {

    row.visibility() == Visibility::Public || may_delete(account, row)

}

/// The edits that turn `current` text files into `wanted`: files gone are

/// removed, new or changed ones written. Files that are not text (pushed

/// with oxy) are left alone.

pub fn edits_between(current: &[DropFile], wanted: &[NewFile]) -> Vec<FileEdit> {

    let mut out = Vec::new();

    for c in current.iter().filter(|c| c.text.is_some()) {

        if !wanted.iter().any(|w| w.name == c.path) {

            out.push(FileEdit { path: c.path.clone(), content: None });

        }

    }

    for w in wanted {

        let same = current.iter().any(|c| c.path == w.name && c.text.as_deref() == Some(w.content.as_str()));

        if !same {

            out.push(FileEdit { path: w.name.clone(), content: Some(w.content.clone().into_bytes()) });

        }

    }

    out

}

//! Drops' pages (oxygenhub#279): `/{owner}/drops` lists a person's drops

//! (all of them to themselves, the public ones to everyone else), `/drops`

//! goes to your own, `/drops/new` makes one, and `/{owner}/drops/{id}`

//! shows one with its files rendered, with Edit and Delete for its owner.

//! A drop's history, changes and raw files are the repository pages under

//! `/{owner}/drops/{id}/…`, with the drop's bar in place of the tabs.

use super::settings::{csrf, require};

use super::{filters, Error, Page, RepoShell, Shell};

use crate::auth::{Access, Viewer};

use crate::db;

use crate::drops::{self, DropFile, NewFile};

use crate::render::{highlight, markdown};

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Path, Query, State};

use axum::response::{IntoResponse, Redirect, Response};

use serde::Deserialize;

/// One drop on a Drops page.

pub struct DropLine {

    pub url: String,

    pub title: String,

    pub description: String,

    pub secret: bool,

    pub files: Vec<String>,

    pub updated_ms: i64,

}

#[derive(Template)]

#[template(path = "drops.html")]

pub struct DropsPage {

    shell: Shell,

    owner: String,

    is_me: bool,

    drops: Vec<DropLine>,

    notice: Option<String>,

}

/// One file as the drop page shows it.

pub struct ShownFile {

    pub path: String,

    pub anchor: String,

    pub size: u64,

    pub language: Option<&'static str>,

    /// Highlighted lines, as markup.

    pub lines: Vec<String>,

    pub markdown: Option<String>,

    /// Why the file is not shown (binary, too large).

    pub note: Option<String>,

}

#[derive(Template)]

#[template(path = "drop.html")]

pub struct DropPage {

    shell: Shell,

    repo: RepoShell,

    title: String,

    description: String,

    secret: bool,

    files: Vec<ShownFile>,

    can_edit: bool,

    can_delete: bool,

    clone_url: String,

    /// What the files are shown at, and whether that is the default bookmark.

    target: String,

    at_default: bool,

    created_ms: i64,

    updated_ms: i64,

}

#[derive(Template)]

#[template(path = "drop_form.html")]

pub struct DropForm {

    shell: Shell,

    editing: bool,

    action: String,

    cancel: String,

    title: String,

    description: String,

    secret: bool,

    files: Vec<(String, String)>,

    /// Files the form does not edit: not text, or too large.

    kept: Vec<String>,

    message: String,

    delegation: Option<String>,

    error: Option<String>,

}

/// `GET /drops`: your own Drops page.

pub async fn mine(State(app): State<Shared>, viewer: Viewer) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/drops", &viewer);

    let me = require(&viewer, &shell)?;

    Ok(Redirect::to(&format!("/{}/drops", me.account.username)).into_response())

}

#[derive(Deserialize, Default)]

pub struct ListQuery {

    #[serde(default)]

    deleted: Option<String>,

}

/// `GET /{owner}/drops`.

pub async fn list(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(owner): Path<String>,

    Query(q): Query<ListQuery>,

) -> Result<Page<DropsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops"), &viewer);

    let db_err = |e| Error::from_db(shell.clone(), e);

    let Some(account) = db::accounts::account_by_name(&app.db, &owner).await.map_err(db_err)? else {

        return Err(Error::not_found(shell));

    };

    let rows = db::repos::drops_of(&app.db, &account.username).await.map_err(db_err)?;

    let mut lines = Vec::new();

    for row in rows.into_iter().filter(|r| drops::listed_to(viewer.account(), r)) {

        let files = drops::files(&app, &row, "").await.map(|(_, f)| f).unwrap_or_default();

        lines.push(DropLine {

            url: drops::url_of(&row),

            title: drops::shown_title(&row, &files),

            description: row.description.clone(),

            secret: row.visibility() != hub_api::Visibility::Public,

            files: files.into_iter().map(|f| f.path).collect(),

            updated_ms: row.updated_ms,

        });

    }

    let is_me = viewer.account().is_some_and(|a| a.id == account.id);

    let notice = q.deleted.map(|_| "The drop was deleted.".to_string());

    Ok(Page(DropsPage { shell, owner: account.username, is_me, drops: lines, notice }))

}

/// The drop `{owner}/drops/{id}` for the viewer, or 404.

async fn lookup(app: &Shared, shell: &Shell, viewer: &Viewer, owner: &str, id: &str) -> Result<db::repos::RepoRow, Error> {

    let row = drops::find(app, owner, id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let row = row.ok_or_else(|| Error::not_found(shell.clone()))?;

    let role = crate::auth::roles::role_for(&app.db, viewer.account(), &row).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    if !crate::auth::roles::allows(role, Access::Read) {

        return Err(Error::not_found(shell.clone()));

    }

    Ok(row)

}

/// A file's anchor on the drop page: `file-` and its path, plain.

fn anchor_of(path: &str) -> String {

    format!("file-{}", path.trim_matches('/').replace(|c: char| !c.is_ascii_alphanumeric() && c != '.' && c != '_', "-"))

}

fn shown(files: Vec<DropFile>, base_file: &str, base_raw: &str) -> Vec<ShownFile> {

    files

        .into_iter()

        .map(|f| {

            let language = highlight::language(&f.path);

            let anchor = anchor_of(&f.path);

            let lower = f.path.to_lowercase();

            let (lines, md, note) = match &f.text {

                Some(text) if lower.ends_with(".md") || lower.ends_with(".markdown") => {

                    (vec![], Some(markdown::render(text, base_file, base_raw)), None)

                }

                Some(text) => (highlight::lines(&f.path, text), None, None),

                None if crate::web::mime_of(&f.path).starts_with("image/") => (vec![], None, Some("An image.".to_string())),

                None => (vec![], None, Some("Not shown: a binary file, or too large to show here.".to_string())),

            };

            ShownFile { path: f.path, anchor, size: f.size, language, lines, markdown: md, note }

        })

        .collect()

}

async fn page(app: &Shared, viewer: &Viewer, owner: &str, id: &str, r: &str) -> Result<Page<DropPage>, Error> {

    let path = if r.is_empty() { format!("/{owner}/drops/{id}") } else { format!("/{owner}/drops/{id}/tree/{r}") };

    let shell = Shell::new(app, &path, viewer);

    let row = lookup(app, &shell, viewer, owner, id).await?;

    let (target, files) = drops::files(app, &row, r).await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let url = drops::url_of(&row);

    let title = drops::shown_title(&row, &files);

    let label = target.label.clone();

    let files = shown(files, &format!("{url}/file/{label}/"), &format!("{url}/raw/{label}/"));

    let (can_edit, can_delete) = (drops::may_edit(viewer.account(), &row), drops::may_delete(viewer.account(), &row));

    let role = if can_edit { crate::auth::Role::Admin } else { crate::auth::Role::Read };

    Ok(Page(DropPage {

        repo: RepoShell::new(app, &row, "code").with_role(role),

        title,

        description: row.description.clone(),

        secret: row.visibility() != hub_api::Visibility::Public,

        files,

        can_edit,

        can_delete,

        clone_url: format!("{}{url}", app.config.base_url()),

        at_default: label == row.default_bookmark,

        target: label,

        created_ms: row.created_ms,

        updated_ms: row.updated_ms,

        shell,

    }))

}

/// `GET /{owner}/drops/{id}`.

pub async fn show(State(app): State<Shared>, viewer: Viewer, Path((owner, id)): Path<(String, String)>) -> Result<Page<DropPage>, Error> {

    page(&app, &viewer, &owner, &id, "").await

}

/// `GET /{owner}/drops/{id}/tree/{r}`: the files at a bookmark, tag or

/// change (where a change page's links go).

pub async fn show_at(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, r)): Path<(String, String, String)>,

) -> Result<Page<DropPage>, Error> {

    page(&app, &viewer, &owner, &id, &r).await

}

/// The form's fields: repeated `name` and `content` pairs, in order.

struct Submitted {

    csrf: String,

    title: String,

    description: String,

    secret: bool,

    message: String,

    files: Vec<NewFile>,

}

fn submitted(pairs: Vec<(String, String)>) -> Submitted {

    let mut s = Submitted {

        csrf: String::new(),

        title: String::new(),

        description: String::new(),

        secret: false,

        message: String::new(),

        files: vec![],

    };

    for (k, v) in pairs {

        match k.as_str() {

            "_csrf" => s.csrf = v,

            "title" => s.title = v,

            "description" => s.description = v,

            "visibility" => s.secret = v == "secret",

            "message" => s.message = v,

            "name" => s.files.push(NewFile { name: v, content: String::new() }),

            "content" => match s.files.last_mut() {

                Some(f) if f.content.is_empty() => f.content = v,

                _ => s.files.push(NewFile { name: String::new(), content: v }),

            },

            _ => {}

        }

    }

    // A row left empty is no file.

    s.files.retain(|f| !f.name.trim().is_empty() || !f.content.trim().is_empty());

    s

}

fn form_files(files: &[NewFile]) -> Vec<(String, String)> {

    let mut out: Vec<(String, String)> = files.iter().map(|f| (f.name.clone(), f.content.clone())).collect();

    out.push((String::new(), String::new()));

    out

}

/// `GET /drops/new`.

pub async fn new_form(State(app): State<Shared>, viewer: Viewer) -> Result<Page<DropForm>, Error> {

    let shell = Shell::new(&app, "/drops/new", &viewer);

    let me = require(&viewer, &shell)?;

    let delegation = crate::web::edit::signer_for(&app, me.account.id).await.err();

    Ok(Page(DropForm {

        cancel: format!("/{}/drops", me.account.username),

        shell,

        editing: false,

        action: "/drops/new".into(),

        title: String::new(),

        description: String::new(),

        secret: false,

        files: form_files(&[]),

        kept: vec![],

        message: String::new(),

        delegation,

        error: None,

    }))

}

/// `POST /drops/new`.

pub async fn create(State(app): State<Shared>, viewer: Viewer, Form(pairs): Form<Vec<(String, String)>>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/drops/new", &viewer);

    let me = require(&viewer, &shell)?;

    let f = submitted(pairs);

    csrf(&viewer, &f.csrf, &shell)?;

    match drops::create(&app, &me.account, &f.title, &f.description, f.secret, &f.files).await {

        Ok(row) => Ok(Redirect::to(&drops::url_of(&row)).into_response()),

        Err(drops::DropError::Bad(msg)) => {

            let delegation = crate::web::edit::signer_for(&app, me.account.id).await.err();

            Ok(Page(DropForm {

                cancel: format!("/{}/drops", me.account.username),

                shell,

                editing: false,

                action: "/drops/new".into(),

                title: f.title,

                description: f.description,

                secret: f.secret,

                files: form_files(&f.files),

                kept: vec![],

                message: String::new(),

                delegation,

                error: Some(msg),

            })

            .into_response())

        }

        Err(e) => Err(Error { status: axum::http::StatusCode::INTERNAL_SERVER_ERROR, ..Error::bad(shell, e.to_string()) }),

    }

}

/// The drop, when the viewer may change it (its owner) or, `deleting`,

/// delete it (its owner or a site administrator).

async fn writable(

    app: &Shared,

    shell: &Shell,

    viewer: &Viewer,

    owner: &str,

    id: &str,

    deleting: bool,

) -> Result<db::repos::RepoRow, Error> {

    let row = lookup(app, shell, viewer, owner, id).await?;

    let may = if deleting { drops::may_delete(viewer.account(), &row) } else { drops::may_edit(viewer.account(), &row) };

    if !may {

        return Err(Error::not_found(shell.clone()));

    }

    Ok(row)

}

async fn edit_page(

    app: &Shared,

    shell: Shell,

    viewer: &Viewer,

    row: &db::repos::RepoRow,

    wanted: Option<&Submitted>,

    error: Option<String>,

) -> Result<Page<DropForm>, Error> {

    let me = require(viewer, &shell)?;

    let (_, current) = drops::files(app, row, "").await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let kept: Vec<String> = current.iter().filter(|f| f.text.is_none()).map(|f| f.path.clone()).collect();

    let files = match wanted {

        Some(w) => form_files(&w.files),

        None => form_files(

            &current

                .iter()

                .filter_map(|f| f.text.as_ref().map(|t| NewFile { name: f.path.clone(), content: t.clone() }))

                .collect::<Vec<_>>(),

        ),

    };

    let delegation = crate::web::edit::signer_for(app, me.account.id).await.err();

    let url = drops::url_of(row);

    Ok(Page(DropForm {

        shell,

        editing: true,

        action: format!("{url}/edit"),

        cancel: url,

        title: wanted.map(|w| w.title.clone()).unwrap_or_else(|| row.title.clone()),

        description: wanted.map(|w| w.description.clone()).unwrap_or_else(|| row.description.clone()),

        secret: wanted.map(|w| w.secret).unwrap_or(row.visibility() != hub_api::Visibility::Public),

        files,

        kept,

        message: wanted.map(|w| w.message.clone()).unwrap_or_default(),

        delegation,

        error,

    }))

}

/// `GET /{owner}/drops/{id}/edit`.

pub async fn edit_form(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

) -> Result<Page<DropForm>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}/edit"), &viewer);

    require(&viewer, &shell)?;

    let row = writable(&app, &shell, &viewer, &owner, &id, false).await?;

    edit_page(&app, shell, &viewer, &row, None, None).await

}

/// `POST /{owner}/drops/{id}/edit`: the files as the form has them, as

/// one change (only what differs), and the title, description and

/// visibility.

pub async fn save(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

    Form(pairs): Form<Vec<(String, String)>>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}/edit"), &viewer);

    let me = require(&viewer, &shell)?;

    let f = submitted(pairs);

    csrf(&viewer, &f.csrf, &shell)?;

    let row = writable(&app, &shell, &viewer, &owner, &id, false).await?;

    let wanted = match drops::check_files(&f.files, false) {

        Ok(w) => w,

        Err(msg) => return Ok(edit_page(&app, shell, &viewer, &row, Some(&f), Some(msg)).await?.into_response()),

    };

    let (_, current) = drops::files(&app, &row, "").await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let update = drops::Update {

        title: f.title.clone(),

        description: f.description.clone(),

        secret: f.secret,

        files: drops::edits_between(&current, &wanted),

        message: f.message.clone(),

    };

    match drops::update(&app, &me.account, &row, update).await {

        Ok(()) => Ok(Redirect::to(&drops::url_of(&row)).into_response()),

        Err(drops::DropError::Bad(msg)) => Ok(edit_page(&app, shell, &viewer, &row, Some(&f), Some(msg)).await?.into_response()),

        Err(e) => Err(Error { status: axum::http::StatusCode::INTERNAL_SERVER_ERROR, ..Error::bad(shell, e.to_string()) }),

    }

}

#[derive(Deserialize)]

pub struct DeleteForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

}

/// `POST /{owner}/drops/{id}/delete`: its owner or a site administrator.

pub async fn delete(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

    Form(f): Form<DeleteForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}"), &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let row = writable(&app, &shell, &viewer, &owner, &id, true).await?;

    drops::delete(&app, &me.account, &row).await.map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    Ok(Redirect::to(&format!("/{}/drops?deleted=1", row.owner)).into_response())

}

/// The drop's repository name, `drops/ID`, for the repository pages; a

/// name that is not a drop's finds nothing there.

fn repo_name(id: &str) -> String {

    format!("{}/{id}", crate::repos::names::DROPS)

}

/// `GET /{owner}/drops/{id}/changes/{r}`: the history page.

pub async fn changes(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, r)): Path<(String, String, String)>,

    q: Query<super::history::HistoryQuery>,

) -> Result<Response, Error> {

    let row = drop_or_404(&app, &viewer, &owner, &id).await?;

    super::history::history(State(app), viewer, Path((row.owner, repo_name(&id), r)), q).await.map(IntoResponse::into_response)

}

/// `GET /{owner}/drops/{id}/change/{hash}`: a change with its diff.

pub async fn change(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, hash)): Path<(String, String, String)>,

    q: Query<super::history::DiffQuery>,

) -> Result<Response, Error> {

    let row = drop_or_404(&app, &viewer, &owner, &id).await?;

    super::history::change(State(app), viewer, Path((row.owner, repo_name(&id), hash)), q).await.map(IntoResponse::into_response)

}

/// `GET /{owner}/drops/{id}/raw/{r}/{*path}`: a file's bytes.

pub async fn raw(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, r, path)): Path<(String, String, String, String)>,

) -> Result<Response, Error> {

    let row = drop_or_404(&app, &viewer, &owner, &id).await?;

    super::repo::raw_file(State(app), viewer, Path((row.owner, repo_name(&id), r, path))).await

}

/// `GET /{owner}/drops/{id}/file/{r}/{*path}`: the drop's page at `r`,

/// at that file (where rendered Markdown's relative links go).

pub async fn file(Path((owner, id, r, path)): Path<(String, String, String, String)>) -> Response {

    Redirect::to(&format!("/{owner}/drops/{id}/tree/{r}#{}", anchor_of(&path))).into_response()

}

async fn drop_or_404(app: &Shared, viewer: &Viewer, owner: &str, id: &str) -> Result<db::repos::RepoRow, Error> {

    let shell = Shell::new(app, &format!("/{owner}/drops/{id}"), viewer);

    lookup(app, &shell, viewer, owner, id).await

}

//! Drops (oxygenhub#279): small snippets, each its own Oxygen repository

//! named `OWNER/drops/ID`. Made and edited in the browser and through the

//! API as signed changes by the hub as the owner's delegate; their files

//! rendered and raw; cloned and pushed with oxy; secret ones readable by

//! anyone with the address and listed nowhere; never among repositories;

//! changed and deleted only by their owner (or, deleting, a site admin);

//! push protection on their pushes and on what the hub commits for them.

//!

//! The fake credential is put together at run time, so this file is not

//! itself a finding.

use axum::body::Body;

use axum::http::{header, Request, StatusCode};

use http_body_util::BodyExt;

use oxy_core::repo::{IdentityScope, Repo};

use oxygenhub::auth::random_hex;

use oxygenhub::config::Config;

use oxygenhub::db;

use oxygenhub::repos::RepoName;

use oxygenhub::Shared;

use std::path::Path;

use tower::ServiceExt;

fn hermetic() {

    static ONCE: std::sync::Once = std::sync::Once::new();

    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

    ONCE.call_once(|| {

        let d = tempfile::tempdir().unwrap();

        std::env::set_var("OXY_HOME", d.path());

        DIR.set(d).ok();

    });

}

fn write(root: &Path, rel: &str, content: &[u8]) {

    let p = root.join(rel);

    std::fs::create_dir_all(p.parent().unwrap()).unwrap();

    std::fs::write(p, content).unwrap();

}

struct Hub {

    app: Shared,

    base: String,

    _dir: tempfile::TempDir,

}

async fn hub() -> Hub {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.registration.setup_code = "test-setup".into();

    config.registration.mode = "open".into();

    // Flow on for everything of andy's: a drop still never runs it.

    config.flow.repos = vec!["andy/*".into()];

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }

}

struct Res {

    status: StatusCode,

    body: String,

    cookie: Option<String>,

    location: Option<String>,

}

async fn send(app: &Shared, method: &str, path: &str, cookie: Option<&str>, token: Option<&str>, body: Option<(&str, String)>) -> Res {

    let mut req = Request::builder().method(method).uri(path);

    if let Some(c) = cookie {

        req = req.header(header::COOKIE, format!("oxyhub={c}"));

    }

    if let Some(t) = token {

        req = req.header(header::AUTHORIZATION, format!("Bearer {t}"));

    }

    let body = match body {

        Some((ct, b)) => {

            req = req.header(header::CONTENT_TYPE, ct);

            Body::from(b)

        }

        None => Body::empty(),

    };

    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();

    let status = res.status();

    let cookie = res

        .headers()

        .get(header::SET_COOKIE)

        .and_then(|v| v.to_str().ok())

        .and_then(|v| v.split(';').next())

        .and_then(|kv| kv.split_once('='))

        .map(|(_, v)| v.to_string());

    let location = res.headers().get(header::LOCATION).and_then(|v| v.to_str().ok()).map(String::from);

    let bytes = res.into_body().collect().await.unwrap().to_bytes();

    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie, location }

}

async fn get(app: &Shared, path: &str, cookie: Option<&str>) -> Res {

    send(app, "GET", path, cookie, None, None).await

}

async fn post(app: &Shared, path: &str, cookie: Option<&str>, form: &str) -> Res {

    send(app, "POST", path, cookie, None, Some(("application/x-www-form-urlencoded", form.to_string()))).await

}

async fn api(app: &Shared, method: &str, path: &str, token: Option<&str>, json: Option<serde_json::Value>) -> Res {

    send(app, method, &format!("/api/v1{path}"), None, token, json.map(|j| ("application/json", j.to_string()))).await

}

async fn register(app: &Shared, user: &str) -> String {

    let r = post(

        app,

        "/register",

        None,

        &format!("username={user}&email={user}%40example.com&password=correct-horse-battery&setup=test-setup"),

    )

    .await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    r.cookie.unwrap()

}

async fn token(app: &Shared, user: &str) -> String {

    let me = db::accounts::account_by_name(&app.db, user).await.unwrap().unwrap();

    let (secret, hash) = oxygenhub::auth::new_token();

    db::accounts::create_token(&app.db, me.id, "laptop", &hash, "repo:read,repo:write", "", None).await.unwrap();

    secret

}

/// `user`'s identity, delegating to the hub's key and linked to the

/// account, as web edits need; the client checkout that holds it.

async fn delegate(app: &Shared, user: &str, work: &Path) -> Repo {

    let id = db::accounts::account_by_name(&app.db, user).await.unwrap().unwrap().id;

    let mut client = Repo::init(work).unwrap();

    client.create_identity(user, &format!("{user}@example.com"), IdentityScope::Repo).unwrap();

    client.delegate_add(app.hub_key.identity.clone(), oxy_core::identity::Scope::CHANGES | oxy_core::identity::Scope::REFS, None).unwrap();

    let key = client.config.author_key.unwrap();

    let ident = client.identity(&key).unwrap();

    db::accounts::link_identity(&app.db, id, &key.to_hex(), &ident.name, &ident.email, &ident.encode()).await.unwrap();

    client

}

fn csrf_of(page: &str) -> String {

    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();

    page[i..].split('"').next().unwrap().to_string()

}

fn enc(s: &str) -> String {

    let mut out = String::new();

    for b in s.bytes() {

        match b {

            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => out.push(b as char),

            _ => out.push_str(&format!("%{b:02X}")),

        }

    }

    out

}

fn drop_id(location: &str) -> String {

    location.rsplit('/').next().unwrap().to_string()

}

const README: &str = "# Hello drops\n\nA *small* snippet.\n";

const MAIN_RS: &str = "fn main() {\n    println!(\"hi\");\n}\n";

#[tokio::test(flavor = "multi_thread")]

async fn drops_in_the_browser_the_api_and_oxy() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy").await;

    let bob = register(app, "bob").await;

    let andy_tok = token(app, "andy").await;

    let bob_tok = token(app, "bob").await;

    let work = tempfile::tempdir().unwrap();

    // `/drops` is your own Drops page; signed out, it asks you to sign in.

    let r = get(app, "/drops", Some(&andy)).await;

    assert_eq!(r.location.as_deref(), Some("/andy/drops"));

    assert!(get(app, "/drops", None).await.location.unwrap().starts_with("/login"));

    let page = get(app, "/andy/drops", Some(&andy)).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("No drops yet") && page.body.contains("/drops/new"), "{}", page.body);

    // Before delegating to the hub's key, the form says so and nothing is made.

    let form = get(app, "/drops/new", Some(&andy)).await;

    assert!(form.body.contains("not delegated"), "{}", form.body);

    assert!(form.body.contains("data-drop-add") && form.body.contains("data-drop-files"));

    let csrf = csrf_of(&form.body);

    let fields = format!(

        "_csrf={csrf}&title=Hello&description={}&visibility=public&name=README.md&content={}&name=main.rs&content={}&name=&content=",

        enc("Two files"),

        enc(README),

        enc(MAIN_RS)

    );

    let r = post(app, "/drops/new", Some(&andy), &fields).await;

    assert_eq!(r.status, StatusCode::OK);

    assert!(r.body.contains("not delegated"), "{}", r.body);

    assert!(db::repos::drops_of(&app.db, "andy").await.unwrap().is_empty());

    // Created in the browser: a repository of its own, the files its first

    // change, authored by andy and signed by the hub as his delegate.

    let mut client = delegate(app, "andy", work.path()).await;

    let r = post(app, "/drops/new", Some(&andy), &fields).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let url = r.location.unwrap();

    let id = drop_id(&url);

    assert!(url.starts_with("/andy/drops/") && id.len() == 24 && id.bytes().all(|b| b.is_ascii_hexdigit()), "{url}");

    let row = db::repos::drop_by_id(&app.db, &id).await.unwrap().unwrap();

    assert!(row.is_drop() && row.title == "Hello" && row.description == "Two files" && row.visibility == "public");

    let name = RepoName::drop("andy", &id).unwrap();

    assert!(app.repos.exists(&name));

    // Its page renders the files: Markdown as a document, code highlighted.

    let page = get(app, &url, None).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("<h1>Hello drops</h1>") || page.body.contains(">Hello drops</h1>"), "{}", page.body);

    assert!(page.body.contains("main.rs") && page.body.contains("println"), "{}", page.body);

    assert!(page.body.contains(&format!("oxy clone {}{url}", h.base)));

    assert!(!page.body.contains(">EDIT<"), "no edit for the signed out");