Fork a drop (refs #280) adbc38e7ea09

- **Fork a drop (#280):** a signed-in visitor's FORK makes a drop of their own from someone else's, with its files, history, title and secrecy; the fork's page says which drop it came from.

/// Fork `source` for `account` (#280): a new drop of theirs whose history

/// starts from it (its objects linked, its bookmarks copied), with its

/// title, description and secrecy, noting where it came from.

pub async fn fork(app: &Shared, account: &Account, source: &RepoRow) -> Result<RepoRow, DropError> {

    if account.blocked() {

        return Err(bad("This account cannot make drops."));

    }

    let Some(from) = RepoName::new(&source.owner, &source.name) else { return Err(bad("That is not a drop.")) };

    let mut found = None;

    for _ in 0..8 {

        let id = crate::auth::random_hex(12);

        let Some(name) = RepoName::drop(&account.username, &id) else { break };

        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {

            found = Some(name);

            break;

        }

    }

    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };

    app.repos.fork(&from, &name).await?;

    let id = name.drop_id().unwrap_or_default().to_string();

    let row = match db::repos::create_drop(&app.db, &account.username, &id, &source.title, &source.description, source.visibility()).await {

        Ok(row) => row,

        Err(e) => {

            let _ = std::fs::remove_dir_all(app.repos.dir(&name));

            return Err(e.into());

        }

    };

    db::repos::set_forked_from(&app.db, row.id, source.id).await?;

    db::accounts::audit(&app.db, Some(account), "drop.forked", &url_of(&row), &url_of(source)).await.ok();

    Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))

}

    /// Signed in and not its owner: may fork it (#280).

    can_fork: bool,

    /// The drop it was forked from, if it still exists: its address.

    forked_from: Option<String>,

    let can_fork = viewer.account().is_some_and(|a| a.username != row.owner && !a.blocked());

    let forked_from = match row.forked_from {

        Some(id) => db::repos::get_by_id(&app.db, id).await.ok().flatten().filter(|r| r.is_drop()).map(|r| drops::url_of(&r)),

        None => None,

    };

        can_fork,

        forked_from,

}

/// `POST /{owner}/drops/{id}/fork` (#280): a copy of the drop, history and

/// all, as a drop of the viewer's.

pub async fn fork(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

    Form(f): Form<DeleteForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}"), &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let row = lookup(&app, &shell, &viewer, &owner, &id).await?;

    let made = drops::fork(&app, &me.account, &row).await.map_err(|e| Error::bad(shell.clone(), e.to_string()))?;

    Ok(Redirect::to(&drops::url_of(&made)).into_response())

        .route("/{owner}/drops/{id}/fork", post(drops::fork))

/// oxygenhub#280: someone else forks a drop: a drop of theirs with the

/// same files, history and secrecy, which says where it came from.

async fn a_drop_is_forked_with_its_history() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy").await;

    let carol = register(app, "carol").await;

    let work = tempfile::tempdir().unwrap();

    delegate(app, "carol", work.path()).await;

    let csrf = csrf_of(&get(app, "/drops/new", Some(&carol)).await.body);

    let r = post(app, "/drops/new", Some(&carol), &format!("_csrf={csrf}&title=Notes&visibility=secret&name=a.txt&content=a")).await;

    let source = r.location.unwrap();

    assert!(!get(app, &source, Some(&carol)).await.body.contains(">FORK<"), "not one's own");

    assert!(!get(app, &source, None).await.body.contains(">FORK<"), "not signed out");

    let page = get(app, &source, Some(&andy)).await.body;

    assert!(page.contains(">FORK<"), "{page}");

    let r = post(app, &format!("{source}/fork"), Some(&andy), &format!("_csrf={}", csrf_of(&page))).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let fork = r.location.unwrap();

    assert!(fork.starts_with("/andy/drops/") && fork != source, "{fork}");

    let (from, made) = (

        db::repos::drop_by_id(&app.db, &drop_id(&source)).await.unwrap().unwrap(),

        db::repos::drop_by_id(&app.db, &drop_id(&fork)).await.unwrap().unwrap(),

    );

    assert!(made.is_drop() && made.owner == "andy" && made.title == "Notes" && made.visibility == "private", "{made:?}");

    assert_eq!(made.forked_from, Some(from.id));

    let shown = get(app, &fork, Some(&andy)).await.body;

    assert!(shown.contains(&format!("forked from <a href=\"{source}\">")), "{shown}");

    assert_eq!(get(app, &format!("{fork}/raw/main/a.txt"), None).await.body, "a");

    let history = get(app, &format!("{fork}/changes/main"), Some(&andy)).await.body;

    assert!(history.contains("Create Notes"), "the source's change: {history}");

}

#[tokio::test(flavor = "multi_thread")]

- **Forks** (#280): a signed-in visitor who is not the owner may fork a drop they can read (`POST /{owner}/drops/{id}/fork`, the page's FORK): a new drop of theirs whose store is a fork of the source (objects linked, bookmarks copied, as a repository fork), with its title, description and secrecy, `forked_from` naming the source; its page says "forked from" with the source's address while it exists. Audited as `drop.forked`.

    <p class="small mute">A drop by <a href="/{{ repo.owner }}">{{ repo.owner }}</a> · {{ files.len() }} file{% if files.len() != 1 %}s{% endif %} · created <time title="{{ created_ms|when_i }}">{{ created_ms|ago_i }}</time> · updated <time title="{{ updated_ms|when_i }}">{{ updated_ms|ago_i }}</time> · <a href="{{ repo.url }}/changes/{{ repo.default_bookmark }}">history</a>{% if let Some(f) = forked_from %} · forked from <a href="{{ f }}">{{ f }}</a>{% endif %}</p>

  {% if can_edit || can_delete || can_fork %}<div class="drop-actions">{% if can_fork %}<form class="inline" method="post" action="{{ repo.url }}/fork"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit" title="A copy of this drop, history and all, as a drop of yours">FORK</button></form>{% endif %}{% if can_edit %}<a class="go" href="{{ repo.url }}/edit">EDIT</a>{% endif %}{% if can_delete %}<form class="inline" method="post" action="{{ repo.url }}/delete" data-confirm="Delete this drop and its history? Its address stops working."><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit" class="danger-btn">DELETE</button></form>{% endif %}</div>{% endif %}