Advanced settings: transfer, archive, delete, wiki placeholder d0fbea2eb46e

-- Advanced settings (hub spec §6, #108): a repository can be archived

-- (read-only, with a reason) and transferred to another owner; the old

-- name redirects on the web and still resolves for oxy remotes.

ALTER TABLE repositories ADD COLUMN archived INTEGER NOT NULL DEFAULT 0;

ALTER TABLE repositories ADD COLUMN archived_reason TEXT NOT NULL DEFAULT '';

CREATE TABLE repo_redirects (

    old_owner   TEXT NOT NULL,

    old_name    TEXT NOT NULL,

    repo_id     INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    moved_ms    INTEGER NOT NULL,

    PRIMARY KEY (old_owner, old_name)

);

- **Advanced settings: transfer, archive, delete (#108).** A repository's Delete section becomes Advanced: transfer the repository to a user or organisation (the old address redirects and `oxy` remotes keep working), archive it read-only with a reason and bring it back, delete it, and a placeholder for deleting wiki data ahead of wikis.

    /// Read-only, with why (migration 0040, #108).

    #[sqlx(default)]

    pub archived: bool,

    #[sqlx(default)]

    pub archived_reason: String,

}

/// The repository an old name now points at, after a transfer.

pub async fn moved_to(pool: &Pool, owner: &str, name: &str) -> sqlx::Result<Option<RepoRow>> {

    let id: Option<i64> = sqlx::query_scalar("SELECT repo_id FROM repo_redirects WHERE old_owner = ? AND old_name = ?")

        .bind(owner)

        .bind(name)

        .fetch_optional(pool)

        .await?;

    match id {

        Some(id) => get_by_id(pool, id).await,

        None => Ok(None),

    }

}

/// Move a repository to another owner, keeping its name: the row, and a

/// redirect from the old name. A redirect that pointed at the new name

/// goes, so names never loop.

pub async fn transfer(pool: &Pool, id: i64, old_owner: &str, name: &str, new_owner: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE repositories SET owner = ?, updated_ms = ? WHERE id = ?")

        .bind(new_owner)

        .bind(now_ms())

        .bind(id)

        .execute(pool)

        .await?;

    sqlx::query("DELETE FROM repo_redirects WHERE old_owner = ? AND old_name = ?").bind(new_owner).bind(name).execute(pool).await?;

    sqlx::query("INSERT OR REPLACE INTO repo_redirects (old_owner, old_name, repo_id, moved_ms) VALUES (?, ?, ?, ?)")

        .bind(old_owner)

        .bind(name)

        .bind(id)

        .bind(now_ms())

        .execute(pool)

        .await?;

    Ok(())

}

/// Archive (read-only) or bring back a repository.

pub async fn set_archived(pool: &Pool, id: i64, archived: bool, reason: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE repositories SET archived = ?, archived_reason = ?, updated_ms = ? WHERE id = ?")

        .bind(archived)

        .bind(if archived { reason } else { "" })

        .bind(now_ms())

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

            // A transferred repository still answers to its old name (#108).

            Ok(None) => match self.block(db::repos::moved_to(&pool, &name.owner, &name.name)) {

                Ok(Some(r)) => Ok(r),

                Ok(None) => Err(not_found()),

                Err(e) => Err(Failure(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())),

            },

        let parsed = RepoName::parse(name).ok_or_else(not_found)?;

        // The row knows the current name: a transferred repository still

        // answers to its old one (#108).

        let row = self.row(&parsed)?;

        let name = RepoName::new(&row.owner, &row.name).ok_or_else(not_found)?;

                let current = format!("{}/{}", row.owner, row.name);

                (role, needed && (token.covers(&parsed.to_string()) || token.covers(&current)))

                }

                if row.archived {

                    return Err(Failure(StatusCode::FORBIDDEN, "this repository is archived and read-only".into()));

        let Some(parsed) = RepoName::new(&row.owner, &row.name) else { return };

    /// Move a repository to another name (a transfer, #108): the directory,

    /// and the lock the old name held.

    pub fn rename(&self, from: &RepoName, to: &RepoName) -> Result<(), RepoError> {

        let (src, dest) = (self.dir(from), self.dir(to));

        if !src.exists() {

            return Err(RepoError::NotFound);

        }

        if dest.exists() {

            return Err(RepoError::Exists(to.to_string()));

        }

        if let Some(parent) = dest.parent() {

            std::fs::create_dir_all(parent)?;

        }

        std::fs::rename(&src, &dest)?;

        let mut locks = self.locks.lock().unwrap();

        if let Some(l) = locks.remove(&from.to_string()) {

            locks.insert(to.to_string(), l);

        }

        Ok(())

    }

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

        .route("/{owner}/{name}/settings/transfer", post(repo_settings::transfer))

        .route("/{owner}/{name}/settings/archive", post(repo_settings::archive))

    /// Read-only (#108).

    pub archived: bool,

            archived: row.archived,

    let row = match db::repos::get(&app.db, owner, name).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Some(row) => row,

        None => {

            // A transferred repository: the old URL goes to the new one (#108),

            // the rest of the path kept, when the viewer may see it.

            let moved = db::repos::moved_to(&app.db, owner, name).await.map_err(|e| Error::from_db(shell.clone(), e))?;

            let Some(moved) = moved else { return Err(Error::not_found(shell.clone())) };

            let role = auth::roles::role_for(&app.db, viewer.account(), &moved).await.map_err(|e| Error::from_db(shell.clone(), e))?;

            if !auth::roles::allows(role, Access::Read) {

                return Err(Error::not_found(shell.clone()));

            }

            let old = format!("/{owner}/{name}");

            let rest = shell.path.strip_prefix(&old).unwrap_or("");

            return Err(Error::redirect(format!("/{}/{}{rest}", moved.owner, moved.name)));

        }

    };

    if row.archived && matches!(access, Access::Write | Access::Maintain) {

        return Err(archived(shell));

    }

}

/// The error for a write to an archived repository (#108).

pub fn archived(shell: &Shell) -> Error {

    Error::bad(shell.clone(), "This repository is archived and read-only. Its admins can bring it back under Settings › Advanced.")

}

/// Refuse a change to an archived repository, for handlers that open it

/// for reading and then write.

pub fn writable(row: &db::repos::RepoRow, shell: &Shell) -> Result<(), Error> {

    if row.archived {

        Err(archived(shell))

    } else {

        Ok(())

    }

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

    super::writable(&row, &shell)?;

pub struct TransferForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    owner: String,

    confirm: String,

}

/// `POST /{owner}/{name}/settings/transfer`: move the repository to a

/// user or organisation the admin may create repositories under (#108).

/// The old URL redirects and oxy remotes keep working.

pub async fn transfer(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<TransferForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (repo, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Admin).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let me = viewer.account().cloned().ok_or_else(|| Error::not_found(shell.clone()))?;

    let fail = |msg: &str| settings_page(&app, shell.clone(), row.clone(), role, None, Some(msg.into()));

    if f.confirm.trim() != repo.to_string() {

        return Ok(fail("Type the repository's full name to confirm.").await?.into_response());

    }

    let to = f.owner.trim().trim_start_matches('@').to_string();

    let Some(dest) = RepoName::new(&to, &row.name) else {

        return Ok(fail("That is not an owner name.").await?.into_response());

    };

    if dest.owner == row.owner {

        return Ok(fail("The repository is already there.").await?.into_response());

    }

    let e = |e| Error::from_db(shell.clone(), e);

    let known = accounts::account_by_name(&app.db, &dest.owner).await.map_err(e)?.is_some()

        || accounts::org_by_name(&app.db, &dest.owner).await.map_err(e)?.is_some();

    if !known {

        return Ok(fail("There is no user or organisation of that name.").await?.into_response());

    }

    if !roles::may_create_under(&app.db, &me, &dest.owner).await.map_err(e)? {

        return Ok(fail("You cannot create repositories under that owner, so you cannot move one there.").await?.into_response());

    }

    if db::repos::get(&app.db, &dest.owner, &dest.name).await.map_err(e)?.is_some() || app.repos.exists(&dest) {

        return Ok(fail("That owner already has a repository of this name.").await?.into_response());

    }

    {

        let _guard = app.repos.write_guard(&repo).await;

        app.repos.rename(&repo, &dest).map_err(|e| Error::from_repo(shell.clone(), e))?;

        db::repos::transfer(&app.db, row.id, &row.owner, &row.name, &dest.owner).await.map_err(e)?;

        let mirror = crate::mirror::mirror_dir(&app, &repo);

        if mirror.is_dir() {

            let to = crate::mirror::mirror_dir(&app, &dest);

            if let Some(parent) = to.parent() {

                std::fs::create_dir_all(parent).ok();

            }

            std::fs::rename(&mirror, &to).ok();

        }

    }

    accounts::audit(&app.db, Some(&me), "repo.transferred", &repo.to_string(), &dest.to_string()).await.ok();

    let notice = super::settings::urlencode(&format!("Moved from {repo}; the old address redirects here."));

    Ok(Redirect::to(&format!("{}/settings?notice={notice}", dest.url())).into_response())

}

#[derive(Deserialize)]

pub struct ArchiveForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    /// `archive` or `unarchive`.

    action: String,

    #[serde(default)]

    reason: String,

}

/// `POST /{owner}/{name}/settings/archive`: read-only, with a reason, or

/// back again (#108).

pub async fn archive(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<ArchiveForm>,

) -> Result<Page<RepoSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (repo, mut row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Admin).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let archive = match f.action.as_str() {

        "archive" => true,

        "unarchive" => false,

        _ => return settings_page(&app, shell, row, role, None, Some("Unknown action.".into())).await,

    };

    let reason: String = f.reason.trim().chars().take(500).collect();

    db::repos::set_archived(&app.db, row.id, archive, &reason).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, viewer.account(), if archive { "repo.archived" } else { "repo.unarchived" }, &repo.to_string(), &reason)

        .await

        .ok();

    row.archived = archive;

    row.archived_reason = if archive { reason } else { String::new() };

    let notice = if archive {

        "The repository is archived: read-only until it is brought back."

    } else {

        "The repository is back: writes are allowed again."

    };

    settings_page(&app, shell, row, role, Some(notice.into()), None).await

}

#[derive(Deserialize)]

#[tokio::test(flavor = "multi_thread")]

async fn a_repository_is_transferred_and_archived_from_advanced_settings() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.auth.push_tokens = vec!["site".into()];

    config.registration.mode = "open".into();

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    config.server.base_url = format!("http://127.0.0.1:{port}");

    let app = oxygenhub::build(config).await.unwrap();

    let router = oxygenhub::router(app.clone());

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let base = format!("http://127.0.0.1:{port}");

    let app = &app;

    let r = send(app, "POST", "/register", None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;

    let andy = r.cookie.unwrap();

    let andy_id = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;

    db::accounts::create_org(&app.db, "doomsday", "Doomsday One", andy_id).await.unwrap();

    let repo = RepoName::parse("andy/vk").unwrap();

    app.repos.create(&repo, None).unwrap();

    db::repos::create(&app.db, "andy", "vk", "a port", hub_api::Visibility::Public).await.unwrap();

    let work = tempfile::tempdir().unwrap();

    let mut client = Repo::init(work.path()).unwrap();

    client.create_identity("Andy McCall", "[email protected]", IdentityScope::Repo).unwrap();

    client.config.set("core.sign", "change").unwrap();

    client.config.set("remote.origin.url", &format!("{base}/andy/vk")).unwrap();

    client.config.set("remote.origin.token", "site").unwrap();

    client.save_config().unwrap();

    write(work.path(), "a.txt", b"one\n");

    client.snapshot("t").unwrap();

    client.commit("first", &[]).unwrap();

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    // The Advanced section, and a transfer with the wrong confirmation.

    let settings = send(app, "GET", "/andy/vk/settings", Some(&andy), None).await.body;

    assert!(

        settings.contains("Advanced") && settings.contains("Transfer ownership") && settings.contains("Delete wiki data"),

        "{settings}"

    );

    let csrf = csrf_of(&settings);

    let r = send(app, "POST", "/andy/vk/settings/transfer", Some(&andy), Some(&format!("_csrf={csrf}&owner=doomsday&confirm=wrong"))).await;

    assert!(r.body.contains("full name to confirm"), "{}", r.body);

    let r =

        send(app, "POST", "/andy/vk/settings/transfer", Some(&andy), Some(&format!("_csrf={csrf}&owner=nobody&confirm=andy%2Fvk"))).await;

    assert!(r.body.contains("no user or organisation"), "{}", r.body);

    // Moved to the organisation: the new page works, the old URL redirects

    // with the rest of its path, and the client's old remote still pushes.

    let r =

        send(app, "POST", "/andy/vk/settings/transfer", Some(&andy), Some(&format!("_csrf={csrf}&owner=doomsday&confirm=andy%2Fvk"))).await;

    assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

    let page = send(app, "GET", "/doomsday/vk", None, None).await;

    assert_eq!(page.status, StatusCode::OK);

    assert!(page.body.contains("a port"), "{}", page.body);

    let old = send(app, "GET", "/andy/vk/changes/main", None, None).await;

    assert_eq!(old.status, StatusCode::SEE_OTHER, "{}", old.body);

    assert!(app.repos.exists(&RepoName::parse("doomsday/vk").unwrap()) && !app.repos.exists(&repo));

    write(work.path(), "a.txt", b"one\ntwo\n");

    client.snapshot("t").unwrap();

    client.commit("second", &[]).unwrap();

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok), "the old remote address still resolves");

    let audit = db::accounts::audit_rows(&app.db, 10).await.unwrap();

    assert!(audit.iter().any(|a| a.action == "repo.transferred" && a.target == "andy/vk" && a.detail == "doomsday/vk"));

    // Archived: pushes, issues and comments are refused; reading works; back again.

    let settings = send(app, "GET", "/doomsday/vk/settings", Some(&andy), None).await.body;

    let csrf = csrf_of(&settings);

    let r =

        send(app, "POST", "/doomsday/vk/settings/archive", Some(&andy), Some(&format!("_csrf={csrf}&action=archive&reason=Superseded")))

            .await;

    assert!(r.body.contains("is archived") && r.body.contains("Bring this repository back") && r.body.contains("Superseded"), "{}", r.body);

    assert!(send(app, "GET", "/doomsday/vk", None, None).await.body.contains(">archived<"));

    write(work.path(), "a.txt", b"one\ntwo\nthree\n");

    client.snapshot("t").unwrap();

    client.commit("third", &[]).unwrap();

    let pushed = client.push("origin", false);

    assert!(pushed.is_err() || !pushed.unwrap().iter().all(|r| r.ok), "an archived repository takes no pushes");

    let r = send(app, "POST", "/doomsday/vk/issues/new", Some(&andy), Some(&format!("_csrf={csrf}&title=x&body=y"))).await;

    assert!(r.body.contains("archived and read-only"), "{} {}", r.status, r.body);

    let r = send(app, "POST", "/doomsday/vk/settings/archive", Some(&andy), Some(&format!("_csrf={csrf}&action=unarchive"))).await;

    assert!(r.body.contains("The repository is back"), "{}", r.body);

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

}

Deletion moves the directory to `<data>/trash/<owner>/<name>-<timestamp>` and a job removes it after `trash_days` (default 30). **Transfer** (oxygenhub#108, Settings › Advanced, the repository's admins) moves it to a user or organisation the admin may create repositories under, keeping its name: a directory move under the repository's write lock (the Git mirror moves with it), the row's owner, and a `repo_redirects` row so the old address redirects on the web (the rest of the path kept) and still resolves for `oxy` remotes and the API. **Archive** marks it read-only with a reason: pushes are refused by the wire protocol, and the web refuses edits, issues, proposals, comments and reviews, while reading, cloning and the admins' settings go on; the header shows an *archived* badge and the admins bring it back from the same place. Both are audited (`repo.transferred`, `repo.archived`, `repo.unarchived`). The **Advanced** section also holds Delete and, ahead of wikis (oxygenhub#104), a disabled Delete wiki data.

  <a href="#advanced">Advanced</a>{% endif %}

<section class="panel danger-zone" id="advanced">

  <h2>Advanced</h2>

  <p class="small mute">Settings that change what this repository is. Each asks you to confirm; none can be undone from here except archiving.</p>

  <div class="danger-row">

    <div><strong>Transfer ownership</strong><p class="small mute">Move this repository to a user or an organisation you may create repositories under. Its address changes to <code>/OWNER/{{ repo.name }}</code>; the old address redirects, and <code>oxy</code> remotes keep working.</p></div>

    <details class="danger-act"><summary class="danger-btn">Transfer</summary>

      <form class="card" method="post" action="{{ repo.url }}/settings/transfer">

        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

        <label for="towner">New owner</label><input type="text" id="towner" name="owner" placeholder="an organisation or a user" required>

        <label for="tconfirm">Type <code>{{ repo.owner }}/{{ repo.name }}</code> to confirm</label><input type="text" id="tconfirm" name="confirm" required autocomplete="off">

        <button type="submit">TRANSFER</button>

      </form>

    </details>

  </div>

  <div class="danger-row">

    <div><strong>{% if row.archived %}Bring this repository back{% else %}Archive this repository{% endif %}</strong><p class="small mute">{% if row.archived %}It is archived: read-only for everyone, shown with a badge.{% if !row.archived_reason.is_empty() %} Reason: {{ row.archived_reason }}{% endif %}{% else %}Read-only for everyone, including you: no pushes, edits, issues, proposals or comments, until an admin brings it back. Say why, for whoever finds it later.{% endif %}</p></div>

    <details class="danger-act"><summary class="danger-btn">{% if row.archived %}Unarchive{% else %}Archive{% endif %}</summary>

      <form class="card" method="post" action="{{ repo.url }}/settings/archive">

        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

        {% if row.archived %}<input type="hidden" name="action" value="unarchive"><button type="submit">BRING IT BACK</button>{% else %}<input type="hidden" name="action" value="archive">

        <label for="areason">Reason (optional)</label><textarea id="areason" name="reason" rows="2" maxlength="500" placeholder="Superseded by …"></textarea>

        <button type="submit">ARCHIVE</button>{% endif %}

      </form>

    </details>

  </div>

  <div class="danger-row">

    <div><strong>Delete wiki data</strong><p class="small mute">Wikis are not here yet (oxygenhub#104). Once they are, this removes this repository's wiki, which cannot be undone.</p></div>

    <button class="danger-btn" type="button" disabled title="Wikis are not here yet">Delete wiki data</button>

  </div>

  <div class="danger-row">

    <div><strong>Delete this repository</strong><p class="small mute">The repository moves to the trash and is removed after the retention period.</p></div>

    <details class="danger-act"><summary class="danger-btn">Delete</summary>

      <form class="card" method="post" action="{{ repo.url }}/settings/delete">

        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

        <label for="dconfirm">Type <code>{{ repo.owner }}/{{ repo.name }}</code> to confirm</label><input type="text" id="dconfirm" name="confirm" required autocomplete="off">

        <button type="submit">DELETE</button>

      </form>

    </details>

  </div>

</section>

    <span class="crumb"><a href="/{{ repo.owner }}">{{ repo.owner }}</a> / <a href="{{ repo.url }}"><strong>{{ repo.name }}</strong></a>{% if repo.archived %} <span class="tag warn" title="This repository is archived: read-only">archived</span>{% endif %} <span class="vis vis-{{ repo.visibility }}" title="{% if repo.visibility == "public" %}Anyone can see this repository{% else if repo.visibility == "internal" %}Anyone signed in to this hub can see this repository{% else %}Only people given access can see this repository{% endif %}"><span aria-hidden="true">{% if repo.visibility == "public" %}◯{% else if repo.visibility == "internal" %}◐{% else %}●{% endif %}</span> {{ repo.visibility }}</span></span>

.panel.danger-zone { border-color: var(--bad); }

.danger-row { display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; padding: 10px 0; border-top: 1px solid var(--line); }

.danger-row:first-of-type { border-top: 0; }

.danger-row > div { flex: 1; min-width: 0; }

.danger-row p { margin: 2px 0 0; }

.danger-row details.danger-act { flex: 0 0 auto; max-width: 420px; }

.danger-row details.danger-act summary { list-style: none; display: inline-block; cursor: pointer; border: 1px solid var(--bad); color: var(--bad); padding: 6px 12px; font-weight: 600; }

.danger-row details.danger-act summary::-webkit-details-marker { display: none; }

.danger-row details.danger-act[open] { flex: 1; }

.danger-row details.danger-act form.card { margin-top: 8px; }