Move a board's column at once (closes #289) 456f4197ade3

- **Move a board's column at once (#289):** `oh project card move N --from Doing -c Done` moves every card of a column, `--except 317,#320` leaves some, `--state closed,landed` takes only cards whose issue or proposal is done, and `--dry-run` lists what would move. One call (`POST …/projects/{owner}/{n}/cards/move`), all or none, one audit entry: tidying a board of 115 cards took 115 commands.

/// `POST /projects/{owner}/{n}/cards/move` (#289): every card of column

/// `from` to `column` at once, but those `except` names (card ids, or issue

/// and proposal numbers as `12`, `#12`, `name#12` or `owner/name#12`) and,

/// given `state`, only cards whose issue or proposal is in one of them

/// (`closed`, `landed`…). With `dry_run`, nothing moves.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct CardsMove {

    pub from: String,

    pub column: String,

    #[serde(default)]

    pub except: Vec<String>,

    #[serde(default)]

    pub state: Vec<String>,

    #[serde(default)]

    pub dry_run: bool,

}

/// What a bulk move moved, and what it left in the column.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct CardsMoved {

    pub moved: Vec<ProjectCard>,

    pub kept: Vec<ProjectCard>,

    pub dry_run: bool,

}

        .route("/projects/{owner}/{number}/cards/move", post(projects::move_cards))

use hub_api::{Board, CardMove, CardsMove, CardsMoved, NewCard, NewProject, Project, ProjectCard, ProjectColumn, ProjectEdit};

/// Whether `card` is the one `name` names: its id, or its issue or

/// proposal as `12`, `#12`, `name#12` or `owner/name#12`.

fn names_card(name: &str, card: &ProjectCard) -> bool {

    let name = name.trim();

    if name.is_empty() {

        return false;

    }

    if name.parse::<i64>().is_ok_and(|id| id == card.id) {

        return true;

    }

    let Some((_, number)) = card.reference.rsplit_once('#') else { return false };

    match name.rsplit_once('#') {

        None => name == number,

        Some(("", n)) => n == number,

        Some((repo, n)) => n == number && (card.reference == format!("{repo}#{n}") || card.reference.ends_with(&format!("/{repo}#{n}"))),

    }

}

/// `POST /projects/{owner}/{n}/cards/move` (#289): a column's cards to

/// another at once, with exceptions and a state filter; one audit entry.

pub async fn move_cards(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number)): Path<(String, i64)>,

    Json(body): Json<CardsMove>,

) -> Result<Json<CardsMoved>, ApiError> {

    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;

    let from = column(&app, p.id, Some(&body.from)).await?;

    let to = column(&app, p.id, Some(&body.column)).await?;

    if from.id == to.id {

        return Err(ApiError(StatusCode::BAD_REQUEST, "the cards are in that column already".into()));

    }

    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p).await?;

    let cards: Vec<ProjectCard> =

        columns.iter().filter(|col| col.column.id == from.id).flat_map(|col| col.cards.iter().map(card_of)).collect();

    let states: Vec<String> = body.state.iter().map(|s| s.trim().to_ascii_lowercase()).filter(|s| !s.is_empty()).collect();

    let (moved, kept): (Vec<ProjectCard>, Vec<ProjectCard>) = cards.into_iter().partition(|card| {

        !body.except.iter().any(|e| names_card(e, card)) && (states.is_empty() || states.iter().any(|s| card.state.eq_ignore_ascii_case(s)))

    });

    if !body.dry_run && !moved.is_empty() {

        let ids: Vec<i64> = moved.iter().map(|c| c.id).collect();

        pdb::move_cards(&app.db, p.id, &ids, to.id).await?;

        let detail = format!("{} card(s) from {} to {}", moved.len(), from.name, to.name);

        crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.cards_moved", &format!("{owner}/{number}"), &detail).await.ok();

    }

    Ok(Json(CardsMoved { moved, kept, dry_run: body.dry_run }))

}

/// Move `card_ids`, in that order, to the end of `column_id`, all or none

/// (#289).

pub async fn move_cards(pool: &Pool, project_id: i64, card_ids: &[i64], column_id: i64) -> sqlx::Result<()> {

    let mut tx = pool.begin().await?;

    let pos: i64 = sqlx::query_scalar("SELECT COALESCE(MAX(position), -1) + 1 FROM project_cards WHERE column_id = $1")

        .bind(column_id)

        .fetch_one(&mut *tx)

        .await?;

    for (i, id) in card_ids.iter().enumerate() {

        sqlx::query("UPDATE project_cards SET column_id = $1, position = $2 WHERE id = $3 AND project_id = $4")

            .bind(column_id)

            .bind(pos + i as i64)

            .bind(id)

            .bind(project_id)

            .execute(&mut *tx)

            .await?;

    }

    sqlx::query("UPDATE projects SET updated_ms = $1 WHERE id = $2").bind(now_ms()).bind(project_id).execute(&mut *tx).await?;

    tx.commit().await

}

    // A column's cards at once (#289): with exceptions, a state filter and

    // a dry run; one audit entry.

    for t in ["Second", "Third"] {

        api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&a), Some(&format!(r#"{{"title":"{t}"}}"#))).await;

    }

    for n in [2, 3] {

        let body = format!(r#"{{"reference":"demo#{n}","column":"Doing"}}"#);

        assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(&body)).await.0, StatusCode::CREATED);

    }

    let bulk = |body: &'static str| api(app, "POST", "/api/v1/projects/andy/1/cards/move", Some(&a), Some(body));

    let refs = |v: &serde_json::Value, k: &str| -> Vec<String> {

        v[k].as_array().unwrap().iter().map(|c| c["reference"].as_str().unwrap().to_string()).collect()

    };

    let (st, v) = bulk(r##"{"from":"Doing","column":"Done","except":["#2"],"dry_run":true}"##).await;

    assert_eq!(st, StatusCode::OK, "{v}");

    assert_eq!((refs(&v, "moved"), refs(&v, "kept")), (vec!["andy/demo#3".to_string()], vec!["andy/demo#2".to_string()]));

    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;

    assert_eq!(board["columns"][1]["cards"].as_array().unwrap().len(), 2, "a dry run moves nothing");

    let (_, v) = bulk(r#"{"from":"Doing","column":"Done","state":["closed"]}"#).await;

    assert!(refs(&v, "moved").is_empty(), "both are open: {v}");

    let (_, v) = bulk(r#"{"from":"doing","column":"done","except":["demo#2"]}"#).await;

    assert_eq!(refs(&v, "moved"), ["andy/demo#3"]);

    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;

    let names: Vec<(&str, usize)> =

        board["columns"].as_array().unwrap().iter().map(|c| (c["name"].as_str().unwrap(), c["cards"].as_array().unwrap().len())).collect();

    assert_eq!(names, [("Backlog", 1), ("Doing", 1), ("Done", 2)]);

    let audited: i64 =

        sqlx::query_scalar("SELECT COUNT(*) FROM audit WHERE action = 'project.cards_moved'").fetch_one(&app.db).await.unwrap();

    assert_eq!(audited, 1, "the dry run and the empty move are not audited");

    assert_eq!(bulk(r#"{"from":"Done","column":"Done"}"#).await.0, StatusCode::BAD_REQUEST);

    assert_eq!(

        api(app, "POST", "/api/v1/projects/andy/1/cards/move", Some(&b), Some(r#"{"from":"Doing","column":"Done"}"#)).await.0,

        StatusCode::FORBIDDEN

    );

    /// Move a card to another column (by name or id), or with --from every

    /// card of a column at once

        /// The card (its id); leave it out with --from

        card: Option<i64>,

        /// Move every card of this column (#289)

        #[arg(long, conflicts_with = "card")]

        from: Option<String>,

        /// With --from: leave these where they are (card ids, or 12, #12, name#12, owner/name#12), comma-separated

        #[arg(long, value_delimiter = ',', requires = "from")]

        except: Vec<String>,

        /// With --from: only cards whose issue or proposal is in one of these states (closed, landed…), comma-separated

        #[arg(long, value_delimiter = ',', requires = "from")]

        state: Vec<String>,

        /// With --from: say what would move, and move nothing

        #[arg(long, requires = "from")]

        dry_run: bool,

        ProjectCmd::Card { cmd: CardCmd::Move { number, card, column, from, except, state, dry_run } } => match (card, from) {

            (Some(card), None) => {

                c.send_text("PATCH", &format!("{base}/{number}/cards/{card}"), &hub_api::CardMove { column: column.clone() })?;

                println!("{} card {card} moved to {column}", ui::ok("✔"));

            }

            (None, Some(from)) => {

                let r: hub_api::CardsMoved = c.send(

                    "POST",

                    &format!("{base}/{number}/cards/move"),

                    &hub_api::CardsMove { from: from.clone(), column: column.clone(), except, state, dry_run },

                )?;

                if json {

                    println!("{}", serde_json::to_string(&r)?);

                    return Ok(0);

                }

                let name = |c: &hub_api::ProjectCard| if c.reference.is_empty() { c.title.clone() } else { c.reference.clone() };

                for m in &r.moved {

                    println!("  {} {}  {}", if dry_run { "would move" } else { "moved" }, name(m), ui::dim(&m.title));

                }

                let verb = if dry_run { "would move" } else { "moved" };

                println!("{} {verb} {} card(s) from {from} to {column}; {} left in {from}", ui::ok("✔"), r.moved.len(), r.kept.len());

            }

            _ => bail!("name a card, or --from COLUMN to move every card of a column"),

        },

| `oh project card add N REF [-c COLUMN]`, `oh project card add N --note TEXT`, `oh project card move N CARD -c COLUMN`, `oh project card move N --from COLUMN -c COLUMN [--except 12,#13,name#14,CARD] [--state closed,landed] [--dry-run]`, `oh project card remove N CARD` | Cards: REF is `12` or `#12` here, or `name#12` in another of the owner's repositories; a column by name or id; `--from` moves a whole column at once (#289) |

JSON under `/api/v1`, bearer tokens, `application/json`, RFC 7807 problem responses (an unknown route, or a known one with the wrong method, too), cursor pagination (`?after=`), ETags on cacheable resources, and rate limits per token. Resources mirror the pages: `/repos/{owner}/{name}`, `/bookmarks`, `/changes/{hash}`, `/tree/{ref}/{path}`, `/file/{ref}/{path}`, `/blame`, `/history/{ref}` (`?path=`, `?offset=&limit=`, or `?r=REVSET` for the changes a revset selects, evaluated under a two-second budget and answering 400 when it does not parse or goes past it; Oxygen's docs/revset_query_language.md), `/compare`, `/conflicts`, `/proposals` (`?state=open|draft|landed|closed|all`, open ones and drafts by default; a source bookmark may hold `/`, and `owner/name:bookmark` naming the repository itself is its own bookmark), `/proposals/{n}/comments|reviews|checks|files`, `PATCH /proposals/{n}` (the title and description, for its author or a maintainer, and `labels`, the whole set by name, for triage; what is not given stays), `POST /proposals/{n}/land` (repo:write: what the Land button does, `409` with the blockers when it cannot; a landed proposal keeps the changes it landed and reports `landed` with who, how (`web`, or `api (token NAME)`) and when, which its event, the audit log and the push record also say, adding when nobody approved), `/proposals/{n}/content/{base|head}/{path}` (a changed file's bytes in the target's state or the projected state, for editor diff views), `/issues` (creating an issue can set its labels, assignees and milestone; `PATCH /issues/{n}` edits the title and body for the author or triage, and replaces labels, assignees or the milestone for triage, recording each on the timeline; unknown names are refused before anything changes), `/labels` (`POST` creates or changes one, `DELETE /labels/{name}` removes it; triage), `/milestones` (`POST` creates one or changes the description and due date of the one with that title, `PATCH /milestones/{title}` changes title, description, due date or state; triage), `/releases` (`PATCH /releases/{tag}` changes the title, notes or prerelease flag, repo:write), `/tags` (`POST` creates one, repo:write; `DELETE /tags/{tag}` withdraws one, a maintainer, `409` while a release uses it; §9), `/trust`, `/pushes`, `/hooks`, `/checks`, `/user`, `/notifications` (the caller's inbox and unread count; `/notifications/{id}/read` and `/notifications/read` mark read; scope `user:read`), `/users/{name}`, `/users/{name}/drops` and `/drops` (§4.5), `/orgs/{name}`, `/checks/{state}` (the checks on a state, named by its hash, by its heads joined with `+`, by the one head of a single-head state, or by a bookmark), `/checks/required` (`GET`, and `PUT` of the whole list by a repository admin: the checks a proposal needs, passed, to land), `/projects/{owner}` (list, create) and `/projects/{owner}/{n}` (the board as the caller may see it, `PATCH` for title, description, privacy and closing, and `owner` to transfer it to an owner the caller may make boards under (#125: it takes the next number there, and its old address redirects), `/cards` to list them by column or add a reference or note to a column named by id or name, `/cards/{id}` to move or remove one, `POST /cards/move` (#289: `{"from", "column", "except", "state", "dry_run"}`) to move a column's cards at once, but those `except` names (card ids or issue and proposal references) and, given `state`, only those whose issue or proposal is in one, all or none and audited once, answering what moved and what was kept; `repo:write` and the page's rights to change), `/coverage` and `/tests` (a bookmark's coverage and JUnit test reports from Flow jobs, newest first, `?bookmark=&limit=`), `POST /coverage` (repo:write, #136: `{"bookmark"}` or `{"change"}` and `content`, an LCOV or Cobertura report measured off the hub, kept for that state as uploaded by the caller, shown "uploaded by NAME" wherever a run number would be, and setting no check; `oh coverage upload FILE`), `/coverage/{id}` (a report with its files) and `/tests/{id}` (a report with its cases, `?status=failed` for the failed and errored ones), `/flow/runs` (`GET`: runs newest first, `?before=N&limit=`; `POST {"bookmark"}` or `{"change"}`, repo:write: run a bookmark's current state, the default bookmark when none is named, or one change's state; with `"jobs": [NAME..]` only those jobs and what they depend on, each one a manual run starts, else `409` naming the ones it does (#130); `oh run start --job NAME`), `/flow/runs/{n}` (a run with its jobs), `/flow/runs/{n}/jobs/{job}/log` (`?after=seq&limit=`) and `/flow/runs/{n}/rerun` (repo:write: a finished run again), both answering `201 {"number", "url"}` or `409` with why nothing started, `/flow/runs/{n}/jobs/{job}/rerun` (repo:write, oxygenflow#31: that job of a finished run again, in the same run, with the jobs that depend on it; what it depends on keeps its result, so a flaky test reruns without its build; their logs, artifacts and reports go, their checks return to queued and the run is running again; `{"queued": N}`, or `409` while the run is live or for a job it lacks; RE-RUN THIS JOB on the run page, `oh run rerun N --job NAME`), `/flow/runs/{n}/cancel` (repo:write: a run still going ends as `cancelled`, its running jobs stopped when their runner next reports; `409` when it had already ended; a push to a bookmark cancels the push runs of it still going), `/search`. A change's author carries the account its key is linked to, or `null` and a `note` saying the key is not linked and where its owner links it; `via` names the delegate (an agent) that signed for the author when one did, with the delegation's scope and expiry and whether it has since been revoked, and the pages show the same as an `agent` badge, a `via` row under the author on the change page, and a count under the author in Contributors (the change page shows a "key not linked" tag, with a link to Settings → Keys for signed-in viewers). Shapes reuse `oxy --json` shapes wherever one exists (change, status, blame, diff) so tools written against the CLI work against the hub. `crates/hub-api` holds the types with `serde` derives and is what the runner and the VS Code extension will link.