Reports: the Reports tab, each report's page, its frame, and checks from thresholds c8df33a6829f

//! Reports pages (oxygenhub#127, docs/reports.md): the Reports tab, a

//! report's page with its metrics across runs and its own page in a

//! sandboxed frame, and the files that frame reads.

use super::{filters, lookup, Error, Page, RepoShell, Shell};

use crate::auth::Viewer;

use crate::reports::{self, Metric, Report};

use crate::Shared;

use askama::Template;

use axum::extract::{Path, Query, State};

use axum::http::{header, HeaderValue, StatusCode};

use axum::response::{IntoResponse, Response};

use serde::Deserialize;

/// Runs a report's page reads for its sparklines and run list.

const HISTORY: i64 = 60;

#[derive(Deserialize, Default)]

pub struct ReportsQuery {

    /// Only this bookmark's reports.

    bookmark: Option<String>,

    /// One report, by id.

    id: Option<i64>,

}

/// A metric as shown: its value, and its change against the run before.

pub struct MetricView {

    pub key: String,

    pub value: String,

    pub unit: String,

    /// `+0.4`, empty when there is no run before or no change.

    pub delta: String,

    /// `better`, `worse` or `same`, by the metric's `better`.

    pub trend: &'static str,

    /// Its threshold, as words, when it has one.

    pub threshold: String,

    /// Whether it crosses its threshold.

    pub failing: bool,

    /// An inline SVG of its values across runs, oldest first.

    pub spark: String,

}

/// A report on the Reports tab.

pub struct Item {

    pub report: Report,

    pub metrics: Vec<MetricView>,

}

#[derive(Template)]

#[template(path = "reports.html")]

pub struct ReportsPage {

    shell: Shell,

    repo: RepoShell,

    bookmark: String,

    items: Vec<Item>,

    coverage: bool,

    tests: bool,

}

#[derive(Template)]

#[template(path = "report.html")]

pub struct ReportPage {

    shell: Shell,

    repo: RepoShell,

    report: Report,

    bookmarks: Vec<String>,

    metrics: Vec<MetricView>,

    context: Vec<(String, String)>,

    /// Newest first, the one shown among them.

    runs: Vec<Report>,

    /// Where the frame loads the report's page from, when it has one.

    frame: Option<String>,

    files_base: String,

}

/// A number as a person would write it: no trailing zeros.

fn num(v: f64) -> String {

    if v.fract() == 0.0 && v.abs() < 1e15 {

        format!("{v:.0}")

    } else {

        let s = format!("{v:.3}");

        s.trim_end_matches('0').trim_end_matches('.').to_string()

    }

}

fn spark(values: &[f64]) -> String {

    if values.len() < 2 {

        return String::new();

    }

    let (w, h) = (120.0, 28.0);

    let lo = values.iter().cloned().fold(f64::INFINITY, f64::min);

    let hi = values.iter().cloned().fold(f64::NEG_INFINITY, f64::max);

    let span = if hi > lo { hi - lo } else { 1.0 };

    let n = values.len();

    let pts: Vec<String> = values

        .iter()

        .enumerate()

        .map(|(i, v)| format!("{:.1},{:.1}", w * i as f64 / (n - 1) as f64, 2.0 + (h - 4.0) * (hi - v) / span))

        .collect();

    let last = pts.last().cloned().unwrap_or_default();

    let (lx, ly) = last.split_once(',').unwrap_or(("0", "0"));

    format!(

        r#"<svg class="rep-spark" viewBox="0 0 {w} {h}" width="{w}" height="{h}" aria-hidden="true"><polyline points="{}"/><circle cx="{lx}" cy="{ly}" r="2.5"/></svg>"#,

        pts.join(" ")

    )

}

/// The metrics of `now` against `before`, with each one's values across

/// `series` (oldest first) for a sparkline.

fn views(now: &[Metric], before: &[Metric], series: &[Vec<Metric>]) -> Vec<MetricView> {

    now.iter()

        .map(|m| {

            let prev = before.iter().find(|b| b.key == m.key).map(|b| b.value);

            let (delta, trend) = match prev {

                Some(p) if (m.value - p).abs() > f64::EPSILON => {

                    let up = m.value > p;

                    let trend = match m.better.as_str() {

                        "higher" if up => "better",

                        "higher" => "worse",

                        "lower" if up => "worse",

                        "lower" => "better",

                        _ => "same",

                    };

                    (format!("{}{}", if up { "+" } else { "" }, num(m.value - p)), trend)

                }

                _ => (String::new(), "same"),

            };

            let mut threshold = Vec::new();

            if let Some(a) = m.fail_above {

                threshold.push(format!("fails above {}", num(a)));

            }

            if let Some(b) = m.fail_below {

                threshold.push(format!("fails below {}", num(b)));

            }

            let failing = m.fail_above.is_some_and(|a| m.value > a) || m.fail_below.is_some_and(|b| m.value < b);

            let values: Vec<f64> = series.iter().filter_map(|ms| ms.iter().find(|x| x.key == m.key).map(|x| x.value)).collect();

            MetricView {

                key: m.key.clone(),

                value: num(m.value),

                unit: m.unit.clone(),

                delta,

                trend,

                threshold: threshold.join(", "),

                failing,

                spark: spark(&values),

            }

        })

        .collect()

}

/// `GET /{owner}/{name}/reports`: the newest of each report, with its

/// metrics against the run before on its bookmark.

pub async fn overview(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Query(q): Query<ReportsQuery>,

) -> Result<Page<ReportsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/reports"), &viewer);

    let (_, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let e = |e| Error::from_db(shell.clone(), e);

    let bookmark = q.bookmark.clone().filter(|b| !b.is_empty());

    let latest = reports::latest(&app.db, row.id, bookmark.as_deref()).await.map_err(e)?;

    let mut items = Vec::new();

    for r in latest {

        let history = reports::history(&app.db, row.id, &r.name, &r.bookmark, 2).await.map_err(e)?;

        let now = reports::metrics(&app.db, r.id).await.map_err(e)?;

        let before = match history.get(1) {

            Some(p) => reports::metrics(&app.db, p.id).await.map_err(e)?,

            None => vec![],

        };

        items.push(Item { metrics: views(&now, &before, &[]), report: r });

    }

    let repo = RepoShell::new(&app, &row, "reports").with_role(role);

    Ok(Page(ReportsPage { shell, coverage: repo.coverage, tests: repo.tests, repo, bookmark: bookmark.unwrap_or_default(), items }))

}

/// `GET /{owner}/{name}/reports/{report}`: one report, the newest on its

/// bookmark unless `?id=` names a run, with its metrics across runs and

/// its page in a sandboxed frame.

pub async fn show(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name, rname)): Path<(String, String, String)>,

    Query(q): Query<ReportsQuery>,

) -> Result<Page<ReportPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/reports/{rname}"), &viewer);

    let (_, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let e = |e| Error::from_db(shell.clone(), e);

    let report = match q.id {

        Some(id) => reports::get(&app.db, row.id, id).await.map_err(e)?.filter(|r| r.name == rname),

        None => {

            let bookmarks = reports::bookmarks_of(&app.db, row.id, &rname).await.map_err(e)?;

            let bookmark = q

                .bookmark

                .clone()

                .or_else(|| bookmarks.iter().find(|b| **b == row.default_bookmark).cloned())

                .or_else(|| bookmarks.first().cloned());

            match bookmark {

                Some(b) => reports::history(&app.db, row.id, &rname, &b, 1).await.map_err(e)?.into_iter().next(),

                None => None,

            }

        }

    };

    let report = report.ok_or_else(|| Error::not_found(shell.clone()))?;

    let bookmarks = reports::bookmarks_of(&app.db, row.id, &rname).await.map_err(e)?;

    let runs = reports::history(&app.db, row.id, &rname, &report.bookmark, HISTORY).await.map_err(e)?;

    let now = reports::metrics(&app.db, report.id).await.map_err(e)?;

    // The run before the one shown, and every run up to it for the lines.

    let at = runs.iter().position(|r| r.id == report.id).unwrap_or(0);

    let before = match runs.get(at + 1) {

        Some(p) => reports::metrics(&app.db, p.id).await.map_err(e)?,

        None => vec![],

    };

    let mut series = Vec::new();

    for r in runs.iter().skip(at).rev() {

        series.push(reports::metrics(&app.db, r.id).await.map_err(e)?);

    }

    let files_base = format!("/{owner}/{name}/reports/files/{}/{}", report.id, reports::file_mac(&app, report.id));

    let frame = reports::file(&app.db, report.id, "index.html").await.map_err(e)?.map(|_| format!("{files_base}/index.html"));

    let repo = RepoShell::new(&app, &row, "reports").with_role(role);

    Ok(Page(ReportPage {

        shell,

        repo,

        context: report.context_rows(),

        metrics: views(&now, &before, &series),

        bookmarks,

        runs,

        frame,

        files_base,

        report,

    }))

}

/// A file's type, by its extension.

fn content_type(path: &str) -> &'static str {

    match path.rsplit('.').next().unwrap_or("").to_ascii_lowercase().as_str() {

        "html" | "htm" => "text/html; charset=utf-8",

        "js" | "mjs" => "text/javascript; charset=utf-8",

        "css" => "text/css; charset=utf-8",

        "json" => "application/json",

        "csv" => "text/csv; charset=utf-8",

        "svg" => "image/svg+xml",

        "png" => "image/png",

        "jpg" | "jpeg" => "image/jpeg",

        "gif" => "image/gif",

        "webp" => "image/webp",

        "woff2" => "font/woff2",

        "woff" => "font/woff",

        "txt" | "toml" | "md" | "info" | "xml" => "text/plain; charset=utf-8",

        _ => "application/octet-stream",

    }

}

/// `GET /{owner}/{name}/reports/files/{id}/{mac}/{*path}`: a report's file,

/// for its frame. The frame is sandboxed (scripts, no same origin), so it

/// carries no session: the MAC in the link is what lets it in. Every file

/// is served sandboxed too, with nothing beyond this hub to load or call,

/// and readable across origins, since the frame's own origin is opaque.

pub async fn file(State(app): State<Shared>, Path((owner, name, id, mac, path)): Path<(String, String, i64, String, String)>) -> Response {

    let not_found = || (StatusCode::NOT_FOUND, "no such report file").into_response();

    if !crate::auth::mac_equal(&mac, &reports::file_mac(&app, id)) {

        return not_found();

    }

    let Ok(Some(row)) = crate::db::repos::get(&app.db, &owner, &name).await else { return not_found() };

    let Ok(Some(_)) = reports::get(&app.db, row.id, id).await else { return not_found() };

    let Ok(Some((blob, _))) = reports::file(&app.db, id, &path).await else { return not_found() };

    let (Some(repo), Some(oref)) = (crate::repos::RepoName::new(&row.owner, &row.name), oxy_core::hash::ObjectRef::from_hex(&blob)) else {

        return not_found();

    };

    let bytes = match app.repos.read(&repo, move |r, _| Ok(r.read_blob(&oref)?)).await {

        Ok(b) => b,

        Err(_) => return not_found(),

    };

    let origin = app.config.base_url().trim_end_matches('/').to_string();

    let csp = format!(

        "sandbox allow-scripts; default-src 'none'; script-src 'self' {origin} 'unsafe-inline' 'unsafe-eval'; \

         style-src 'self' {origin} 'unsafe-inline'; img-src 'self' {origin} data: blob:; font-src 'self' {origin} data:; \

         connect-src 'self' {origin}; frame-ancestors 'self' {origin}; base-uri 'none'; form-action 'none'"

    );

    let mut res = (StatusCode::OK, bytes).into_response();

    let h = res.headers_mut();

    h.insert(header::CONTENT_TYPE, HeaderValue::from_static(content_type(&path)));

    if let Ok(v) = HeaderValue::from_str(&csp) {

        h.insert(header::CONTENT_SECURITY_POLICY, v);

    }

    h.insert(header::ACCESS_CONTROL_ALLOW_ORIGIN, HeaderValue::from_static("*"));

    h.insert(header::X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));

    h.insert(header::REFERRER_POLICY, HeaderValue::from_static("no-referrer"));

    h.insert(header::CACHE_CONTROL, HeaderValue::from_static("private, max-age=3600, immutable"));

    res

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn metrics_say_which_way_they_moved() {

        let m = |v: f64, better: &str, above: Option<f64>| Metric {

            key: "frame".into(),

            value: v,

            unit: "ms".into(),

            better: better.into(),

            fail_above: above,

            fail_below: None,

        };

        let v = &views(&[m(18.0, "lower", Some(20.0))], &[m(16.5, "lower", Some(20.0))], &[])[0];

        assert_eq!((v.value.as_str(), v.delta.as_str(), v.trend, v.failing), ("18", "+1.5", "worse", false));

        assert_eq!(v.threshold, "fails above 20");

        let v = &views(&[m(21.0, "lower", Some(20.0))], &[], &[])[0];

        assert!(v.failing && v.delta.is_empty());

        assert_eq!(num(16.40), "16.4");

        assert!(spark(&[1.0, 3.0, 2.0]).contains("polyline"));

        assert!(spark(&[1.0]).is_empty());

    }

}

{% extends "base.html" %}

{% import "repo_tabs.html" as m %}

{% block title %}{{ report.title }} · Reports · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block tabs %}{% call m::tabs(repo, "reports") %}{% endblock %}

{% block content %}

<section class="cov-hero">

  <div class="cov-hero-head">

    <div>

      <div class="small"><a href="{{ repo.url }}/reports">Reports</a> /</div>

      <h1>{{ report.title }} <span class="tag rep-kind rep-{{ report.kind }}">{{ report.kind }}</span></h1>

      <div class="cov-sub">{% if bookmarks.len() > 1 %}<form class="inline" method="get" action="{{ repo.url }}/reports/{{ report.name }}"><label for="rep-bm" class="mute">bookmark</label> <select id="rep-bm" name="bookmark" onchange="this.form.submit()">{% for b in bookmarks %}<option value="{{ b }}"{% if b.as_str() == report.bookmark.as_str() %} selected{% endif %}>{{ b }}</option>{% endfor %}</select> <noscript><button>Show</button></noscript></form>{% else %}<span class="mute">on</span> <strong>{{ report.bookmark }}</strong>{% endif %}

        {% if let Some(n) = report.run_number %}· <a href="{{ repo.url }}/flow/{{ n }}">run #{{ n }}</a>{% endif %} · job {{ report.job }} · <time title="{{ report.created_ms|when_i }}">{{ report.created_ms|ago_i }}</time> · {{ report.files }} files, {{ report.bytes|bytes }} · <a href="{{ files_base }}/report.toml" target="_blank" rel="noopener">report.toml</a></div>

      {% if !report.summary.is_empty() %}<p class="rep-summary">{{ report.summary }}</p>{% endif %}

    </div>

  </div>

</section>

{% if !metrics.is_empty() %}

<section class="panel">

  <table class="rep-table">

    <thead><tr><th>Metric</th><th class="num">Value</th><th class="num">Change</th><th>Across runs</th><th>Threshold</th></tr></thead>

    <tbody>

    {% for v in metrics %}

      <tr class="{% if v.failing %}rep-failing{% endif %}">

        <td><code>{{ v.key }}</code></td>

        <td class="num"><strong>{{ v.value }}</strong>{% if !v.unit.is_empty() %} <small class="mute">{{ v.unit }}</small>{% endif %}</td>

        <td class="num">{% if !v.delta.is_empty() %}<span class="rep-delta {{ v.trend }}">{{ v.delta }}</span>{% else %}<span class="mute">–</span>{% endif %}</td>

        <td>{{ v.spark|safe }}</td>

        <td class="small">{% if v.failing %}<span class="error">{{ v.threshold }}: failing</span>{% else %}<span class="mute">{{ v.threshold }}</span>{% endif %}</td>

      </tr>

    {% endfor %}

    </tbody>

  </table>

</section>

{% endif %}

{% if let Some(src) = frame %}

<section class="rep-frame-wrap">

  <iframe class="rep-frame" src="{{ src }}" sandbox="allow-scripts" referrerpolicy="no-referrer" loading="lazy" title="{{ report.title }}"></iframe>

  <p class="small mute">The report's own page, in a sandbox: its scripts run with no access to your session or this hub. <a href="{{ src }}" target="_blank" rel="noopener">Open it alone</a>.</p>

</section>

{% endif %}

<div class="cov-grid">

  {% if !context.is_empty() %}

  <section class="panel cov-card">

    <h2>Context</h2>

    <dl class="rep-context">{% for (k, v) in context %}<dt>{{ k }}</dt><dd>{{ v }}</dd>{% endfor %}</dl>

  </section>

  {% endif %}

  <section class="panel cov-card">

    <h2>Runs on {{ report.bookmark }}</h2>

    <ul class="rep-runs">

    {% for r in runs.iter().take(15) %}

      <li{% if r.id == report.id %} class="on"{% endif %}><a href="{{ repo.url }}/reports/{{ report.name }}?id={{ r.id }}">{% if let Some(n) = r.run_number %}run #{{ n }}{% else %}upload{% endif %}</a> <span class="mute small"><time title="{{ r.created_ms|when_i }}">{{ r.created_ms|ago_i }}</time>{% if !r.summary.is_empty() %} · {{ r.summary }}{% endif %}</span></li>

    {% endfor %}

    </ul>

  </section>

</div>

{% endblock %}

{% extends "base.html" %}

{% import "repo_tabs.html" as m %}

{% block title %}Reports · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block tabs %}{% call m::tabs(repo, "reports") %}{% endblock %}

{% block content %}

<h1>Reports</h1>

<p class="mute small">What this repository's Flow jobs measure, newest run first{% if !bookmark.is_empty() %}, on <strong>{{ bookmark }}</strong> (<a href="{{ repo.url }}/reports">all bookmarks</a>){% endif %}. Each metric shows its change against the run before on the same bookmark.</p>

<div class="rep-list">

{% for i in items %}

  <a class="panel rep-card" href="{{ repo.url }}/reports/{{ i.report.name }}?id={{ i.report.id }}">

    <div class="rep-head">

      <span class="tag rep-kind rep-{{ i.report.kind }}">{{ i.report.kind }}</span>

      <strong class="rep-title">{{ i.report.title }}</strong>

    </div>

    {% if !i.report.summary.is_empty() %}<p class="rep-summary">{{ i.report.summary }}</p>{% endif %}

    {% if !i.metrics.is_empty() %}<ul class="rep-metrics">{% for v in i.metrics %}<li class="{% if v.failing %}rep-failing{% endif %}"><span class="k">{{ v.key }}</span> <span class="v">{{ v.value }}{% if !v.unit.is_empty() %} <small>{{ v.unit }}</small>{% endif %}</span>{% if !v.delta.is_empty() %} <span class="rep-delta {{ v.trend }}">{{ v.delta }}</span>{% endif %}</li>{% endfor %}</ul>{% endif %}

    <div class="small mute">{% if !i.report.bookmark.is_empty() %}on {{ i.report.bookmark }} · {% endif %}{% if let Some(n) = i.report.run_number %}run #{{ n }} · {% endif %}job {{ i.report.job }} · <time title="{{ i.report.created_ms|when_i }}">{{ i.report.created_ms|ago_i }}</time></div>

  </a>

{% endfor %}

{% if coverage %}

  <a class="panel rep-card" href="{{ repo.url }}/coverage">

    <div class="rep-head"><span class="tag rep-kind rep-coverage">coverage</span> <strong class="rep-title">Coverage</strong></div>

    <p class="rep-summary">Line coverage from the jobs' <code>coverage</code> artifacts, by file and across runs.</p>

  </a>

{% endif %}

{% if tests %}

  <a class="panel rep-card" href="{{ repo.url }}/tests">

    <div class="rep-head"><span class="tag rep-kind rep-tests">tests</span> <strong class="rep-title">Tests</strong></div>

    <p class="rep-summary">Test results from the jobs' <code>junit</code> artifacts, each case and its history.</p>

  </a>

{% endif %}

</div>

{% if items.is_empty() && !coverage && !tests %}<p class="empty">No reports yet. A Flow job keeps one with <code>report "NAME" { path "/src/out/report" }</code> in its output; see the OxygenFlow wiki's Reports page.</p>{% endif %}

{% endblock %}

- **Reports (#127).** A Flow job's `report "NAME" { path … }` output is kept file by file with every run, and a repository with reports gets one **Reports** tab in place of Coverage and Tests: each report's latest run with its kind, summary and metrics, and how each moved against the run before. A report's page shows its metrics with sparklines across runs, its thresholds, its `[context]`, its runs, and its own page (`index.html`) in a sandboxed frame that carries no session. Each metric with `fail_above` or `fail_below` sets a check named `report/NAME/METRIC` on the change.

                Ok(id) => {

                    report_threshold_checks(&app, &row, &run, &a.name, id, &d.metrics).await;

/// A check per metric with a threshold (#127, docs/reports.md §5), named

/// `report/NAME/METRIC` on the run's state: failed when the value crosses

/// `fail_above` or `fail_below`, which a proposal may require.

async fn report_threshold_checks(

    app: &Shared,

    row: &db::repos::RepoRow,

    run: &fdb::Run,

    name: &str,

    id: i64,

    metrics: &[crate::reports::Metric],

) {

    let url = format!("{}/{}/{}/reports/{name}?id={id}", app.config.base_url(), row.owner, row.name);

    for m in metrics.iter().filter(|m| m.fail_above.is_some() || m.fail_below.is_some()) {

        let unit = if m.unit.is_empty() { String::new() } else { format!(" {}", m.unit) };

        let above = m.fail_above.filter(|a| m.value > *a);

        let below = m.fail_below.filter(|b| m.value < *b);

        let (status, summary) = match (above, below) {

            (Some(a), _) => ("failed", format!("{}{unit}, above {a}", m.value)),

            (_, Some(b)) => ("failed", format!("{}{unit}, below {b}", m.value)),

            _ => {

                let limits: Vec<String> = [m.fail_above.map(|a| format!("at most {a}")), m.fail_below.map(|b| format!("at least {b}"))]

                    .into_iter()

                    .flatten()

                    .collect();

                ("passed", format!("{}{unit} ({})", m.value, limits.join(", ")))

            }

        };

        let check = format!("report/{name}/{}", m.key);

        if let Ok(c) = db::hooks::upsert_check(

            &app.db,

            row.id,

            db::hooks::CheckReport { state: &run.state, name: &check, status, summary: &summary, url: &url, reporter: None, seal: "" },

        )

        .await

        {

            let api = crate::api::check_of(&c);

            app.events.proposal(row.id, hub_api::ProposalEvent { number: 0, kind: "check".into(), check: Some(api.clone()) });

            crate::hooks::emit(app, row, "check", "flow", serde_json::json!({ "check": api })).await;

        }

    }

}

    reports::load(&app).await?;

    mark(app, o.repo_id);

static HAS: std::sync::Mutex<Option<std::collections::HashSet<String>>> = std::sync::Mutex::new(None);

/// Per hub (tests run several in one process) and repository.

fn key(app: &Shared, repo_id: i64) -> String {

    format!("{}#{repo_id}", app.repos.root().display())

}

/// Whether a repository has reports, for the Reports tab.

pub fn has_reports(app: &Shared, repo_id: i64) -> bool {

    HAS.lock().unwrap_or_else(|p| p.into_inner()).as_ref().is_some_and(|s| s.contains(&key(app, repo_id)))

}

fn mark(app: &Shared, repo_id: i64) {

    HAS.lock().unwrap_or_else(|p| p.into_inner()).get_or_insert_with(Default::default).insert(key(app, repo_id));

}

/// At start: which repositories have reports.

pub async fn load(app: &Shared) -> sqlx::Result<()> {

    let ids: Vec<i64> = sqlx::query_scalar("SELECT DISTINCT repo_id FROM reports").fetch_all(&app.db).await?;

    for id in ids {

        mark(app, id);

    }

    Ok(())

}

/// A kept report (one job's, or one upload's).

#[derive(Clone, Debug, sqlx::FromRow)]

pub struct Report {

    pub id: i64,

    pub repo_id: i64,

    pub name: String,

    pub kind: String,

    pub title: String,

    pub summary: String,

    /// The `[context]` table as JSON.

    pub context: String,

    pub run_id: Option<i64>,

    pub job_id: Option<i64>,

    pub run_number: Option<i64>,

    pub job: String,

    pub bookmark: String,

    pub state: String,

    pub manifest: Option<String>,

    pub files: i64,

    pub bytes: i64,

    pub created_ms: i64,

}

impl Report {

    /// The `[context]` table's entries, as text, in order.

    pub fn context_rows(&self) -> Vec<(String, String)> {

        let v: serde_json::Value = serde_json::from_str(&self.context).unwrap_or_default();

        v.as_object()

            .map(|m| m.iter().map(|(k, v)| (k.clone(), v.as_str().map(String::from).unwrap_or_else(|| v.to_string()))).collect())

            .unwrap_or_default()

    }

}

/// The newest report of each name in a repository, on `bookmark` when

/// given (else on any), newest first.

pub async fn latest(pool: &Pool, repo_id: i64, bookmark: Option<&str>) -> sqlx::Result<Vec<Report>> {

    sqlx::query_as(

        "SELECT * FROM reports r WHERE repo_id = ? AND (? IS NULL OR bookmark = ?) \

         AND id = (SELECT id FROM reports s WHERE s.repo_id = r.repo_id AND s.name = r.name AND (? IS NULL OR s.bookmark = ?) \

                   ORDER BY created_ms DESC, id DESC LIMIT 1) \

         ORDER BY created_ms DESC",

    )

    .bind(repo_id)

    .bind(bookmark)

    .bind(bookmark)

    .bind(bookmark)

    .bind(bookmark)

    .fetch_all(pool)

    .await

}

/// Report `name`'s history on `bookmark`, newest first.

pub async fn history(pool: &Pool, repo_id: i64, name: &str, bookmark: &str, limit: i64) -> sqlx::Result<Vec<Report>> {

    sqlx::query_as("SELECT * FROM reports WHERE repo_id = ? AND name = ? AND bookmark = ? ORDER BY created_ms DESC, id DESC LIMIT ?")

        .bind(repo_id)

        .bind(name)

        .bind(bookmark)

        .bind(limit)

        .fetch_all(pool)

        .await

}

/// The bookmarks report `name` has runs on, most recent first.

pub async fn bookmarks_of(pool: &Pool, repo_id: i64, name: &str) -> sqlx::Result<Vec<String>> {

    sqlx::query_scalar("SELECT bookmark FROM reports WHERE repo_id = ? AND name = ? GROUP BY bookmark ORDER BY MAX(created_ms) DESC")

        .bind(repo_id)

        .bind(name)

        .fetch_all(pool)

        .await

}

/// One report of a repository.

pub async fn get(pool: &Pool, repo_id: i64, id: i64) -> sqlx::Result<Option<Report>> {

    sqlx::query_as("SELECT * FROM reports WHERE repo_id = ? AND id = ?").bind(repo_id).bind(id).fetch_optional(pool).await

}

/// A file of report `id`: its blob and size.

pub async fn file(pool: &Pool, id: i64, path: &str) -> sqlx::Result<Option<(String, i64)>> {

    sqlx::query_as("SELECT blob, size FROM report_files WHERE report_id = ? AND path = ?").bind(id).bind(path).fetch_optional(pool).await

}

/// The capability a report's files are served under: they are read from a

/// sandboxed frame, which carries no session, so the link itself is what

/// lets it in, and only readers of the repository are given it.

pub fn file_mac(app: &Shared, id: i64) -> String {

    app.cookie_key.mac(format!("report-files:{id}").as_bytes())[..32].to_string()

}

pub mod reports;

        .route("/{owner}/{name}/reports", get(reports::overview))

        .route("/{owner}/{name}/reports/files/{id}/{mac}/{*path}", get(reports::file))

        .route("/{owner}/{name}/reports/{report}", get(reports::show))

    /// Whether it has reports of its own (#127); with coverage or tests,

    /// the Reports tab.

    pub reports: bool,

            reports: crate::reports::has_reports(app, row.id),

    let (page_bytes, data_bytes) = (page.clone(), data.clone());

    // The threshold is a check on the run's state, passing at 16.4.

    let checks = db::hooks::checks_for_state(&h.app.db, run.repo_id, &run.state).await.unwrap();

    let c = checks.iter().find(|c| c.name == "report/frame-timing/median_ms").expect("a check per threshold");

    assert_eq!(c.status, "passed", "{c:?}");

    assert!(c.summary.contains("16.4 ms") && c.url.contains("/reports/frame-timing?id="), "{c:?}");

    // The Reports tab, the report's page, and its own page in a sandbox.

    let (_, page) = call(&h.app, "GET", "/andy/demo", None, None).await;

    assert!(page.contains(">Reports</a>"), "the tab");

    let (st, page) = call(&h.app, "GET", "/andy/demo/reports", None, None).await;

    assert!(st == StatusCode::OK && page.contains("Frame timing") && page.contains("median_ms"), "{st}");

    let (st, page) = call(&h.app, "GET", "/andy/demo/reports/frame-timing", None, None).await;

    assert!(st == StatusCode::OK && page.contains("fails above 20") && page.contains("sandbox=\"allow-scripts\""), "{st}");

    let src = page.split("class=\"rep-frame\" src=\"").nth(1).unwrap().split('"').next().unwrap().to_string();

    assert!(src.ends_with("/index.html"), "{src}");

    let res = oxygenhub::router(h.app.clone()).oneshot(Request::get(&src).body(Body::empty()).unwrap()).await.unwrap();

    assert_eq!(res.status(), StatusCode::OK);

    let csp = res.headers()[header::CONTENT_SECURITY_POLICY].to_str().unwrap().to_string();

    assert!(csp.starts_with("sandbox allow-scripts;") && csp.contains("default-src 'none'"), "{csp}");

    assert_eq!(res.headers()[header::ACCESS_CONTROL_ALLOW_ORIGIN], "*");

    assert_eq!(res.into_body().collect().await.unwrap().to_bytes().as_ref(), page_bytes.as_slice());

    let data = src.replace("/index.html", "/data/frames.csv");

    assert_eq!(get_bytes(&h.app, &data).await, (StatusCode::OK, data_bytes.clone()));

    // A link with another report's MAC, or a file it lacks, finds nothing.

    let forged = src.replacen("/files/", "/files/9", 1);

    assert_eq!(get_bytes(&h.app, &forged).await.0, StatusCode::NOT_FOUND);

    assert_eq!(get_bytes(&h.app, &src.replace("/index.html", "/secret.txt")).await.0, StatusCode::NOT_FOUND);

    assert!(!call(&h.app, "GET", "/andy/cov", None, None).await.1.contains(">Reports</a>"), "no tab before a report");

        page.contains(">Reports</a>")

    assert!(!call(&h.app, "GET", "/andy/t", None, None).await.1.contains(">Reports</a>"));

    assert!(page.contains(">Reports</a>"), "the tab");

*Status, 2026-10-11:* storage and index (1) are deployed; the Reports tab,

each report's page with its metrics, changes and sparklines, its own page

in a sandboxed frame, and checks from thresholds (2) are built, Coverage

and Tests listed on the tab while their own pages stay. The frame is

sandboxed (`allow-scripts` only) rather than on a second origin: it

carries no session, so its files are served under a per-report MAC in the

link, with `Content-Security-Policy: sandbox allow-scripts` and nothing

beyond this hub to load. Retention (§3.3), the timeline (3) and `oh

report` (4) follow.

    {% if repo.reports || repo.tests || repo.coverage %}<a href="{{ repo.url }}/reports"{% if tab == "reports" || tab == "tests" || tab == "coverage" %} class="on" aria-current="page"{% endif %}>Reports</a>{% endif %}

/* Reports (oxygenhub#127) */

.rep-list { display: grid; grid-template-columns: repeat(auto-fill, minmax(22em, 1fr)); gap: 1em; margin-top: 1em; }

.rep-card { display: flex; flex-direction: column; gap: .5em; color: var(--ink); text-decoration: none; padding: 1em; }

.rep-card:hover { border-color: var(--acc); }

.rep-head { display: flex; align-items: center; gap: .5em; }

.rep-title { font-size: 1.05em; }

.rep-kind { text-transform: lowercase; }

.rep-performance { color: var(--acc); } .rep-coverage { color: var(--ok); } .rep-tests { color: var(--warn); } .rep-custom { color: var(--mute); }

.rep-summary { margin: .2em 0; }

.rep-metrics { list-style: none; padding: 0; margin: 0; display: flex; flex-wrap: wrap; gap: .4em 1.2em; }

.rep-metrics .k { color: var(--mute); font-size: .85em; }

.rep-metrics .v { font-weight: 600; font-variant-numeric: tabular-nums; }

.rep-delta { font-size: .85em; font-weight: 600; font-variant-numeric: tabular-nums; }

.rep-delta.better { color: var(--ok); } .rep-delta.worse { color: var(--bad); } .rep-delta.same { color: var(--mute); }

.rep-failing .v, .rep-failing strong { color: var(--bad); }

.rep-table { width: 100%; border-collapse: collapse; }

.rep-table th, .rep-table td { padding: .45em .6em; border-bottom: 1px solid var(--line); text-align: left; vertical-align: middle; }

.rep-table .num { text-align: right; font-variant-numeric: tabular-nums; }

.rep-spark polyline { fill: none; stroke: var(--acc); stroke-width: 1.5; }

.rep-spark circle { fill: var(--acc); }

.rep-frame-wrap { margin: 1em 0; }

.rep-frame { width: 100%; height: 80vh; border: 1px solid var(--line); border-radius: 8px; background: #fff; }

.rep-context { display: grid; grid-template-columns: max-content 1fr; gap: .3em 1em; margin: 0; }

.rep-context dt { color: var(--mute); }

.rep-context dd { margin: 0; font-variant-numeric: tabular-nums; }

.rep-runs { list-style: none; padding: 0; margin: 0; }

.rep-runs li { padding: .25em 0; }

.rep-runs li.on a { font-weight: 700; }