Milestone 0.1: browse d23464c0ac60

One binary (axum, askama, sqlx on SQLite) linking oxy-core and embedding
oxy-server. Repositories are bare and unbound until the first push; pages
show trees, files with highlighting and blame, Markdown, history with the
dependency graph, changes with diffs, compare, bookmarks, tags, conflicts,
the trust policy and verification, and the push log. RetroPlay theme with
vendored fonts. JSON API for repositories, bookmarks and tags. End-to-end
test with a real oxy-core client.

Author: Andy McCall @andymccall <[email protected]>
When: 1 month ago · 2026-09-27 17:28 UTC
Signature: ✔ signed by Andy McCall
Hash: d23464c0ac60f60775ae362f92fa08a4b1413e8b1d89e146c1699944bc109c19
Depends on: 93be9ce4653e
Depended on by: 1062a0f8e985 fb8f35d025ab 40a43921ef42 f2d2776b2a14 0bc95135954d 64e5964e9f13 306aec1839aa e4f1f52f2929 8297a33b9a4c a22e4aec2e28 47932fa8d6f3 8f1d76f4169a 1c52d940b4a0 b7e1be264c0a 75491d35c258 42c77f6515c2 041a945f55f8 04f9c984439e 27322cd2755a 93f445fa50d8 c26267b3aba6 fac6853c4e46 3d086bc3d69b 8306eca4e4a3 851a26a2a6d1 1ec29691b67a 4dfa4599b3f7 b1860d6090ec 70c3d02998a2 a9088323c390 aeed63c00ad7 217814c239f0 351cf57e5608 046e3352cdfd 7c572789349b 84f09ad45851 12325e1b1020 5d66f27cebe2 0468394734e9 c4bffee5b0d4 951aed50c2f5 5caa65fd51e7 668b2ad7495c 15d3f6f7871b d7e2c2754807 84e3c09656b2 5a9a6e9a15bc b951c58734e8 dd0788b756f2 d061ac87618c 8eae2f0e255c 9bbca80f777a faf5246c900e dc5c64296b0a 1000b40a2629 8501fd5815b9 c2efc0b4674d d2263e299da7 e4203e141e90 a3ba7cc10673 8bb7baeb4557 c43e4f631d99 8f0efa0729b0 234921ea0834 ab4df6aae179 09ffa7b600a9 73c01b3448ee 5d818ec7d5fc 03bfb945f5c1 de4467cb1eca 5714347a6233 b7d2b0b30b4a f4e138301198 439ecd8708a1 6a306cd03fc1 69e4f27c5633 ecac6e8d9b41 657e7d5c9da9 4f8404093d30 456f4197ade3 ba0a55bb5b3c 8ad8e656a3a6 8ac2aa4ca6d1 ca0c443c30cf c419455a82dd ab2d8b40f9f4 adbc38e7ea09 dd327d76062d 5588bb3631d2 737de0fac722 b349e15a3eab 8597fb5ca16c 367f34b8e590 8bf3010760d7 858eca0d03c4 787632570bf9 a549ddd5941f d366306dae7d a0a1601eb5a5 166f6e9bf4f1 c7067c7bda56 cb7b3cd45dc0 3571c519ada6 9c04c779f032 33d98147511b e57765dee61a 0ee5c3fb32eb b9eb70fb9509 a9f1c0bf403a 13b27cb2200c 4a68f1064b08 86a69b53aff0 2a8b621676b4 7c06f5b28ade 0843f23ec51c e97500b70f9a 4866be1c9040 67523e06ed86 16ee5d19d220 85ec74fd82d8 d4a0043fded4 205d8f863e5c b9b74d997cec a10446c68043 8a48dd830178 8dcaeeb848c6 a7aa76ac52d7 05f1a85a2842 4f40eed0588f e5b97ac399e7 965b950f9b96 559c39204234 8aa5ef384ef1 3eb491e9489b 026a76d251ce 53a0fb2e4ac6 119fd17d213f 4cc40ccc6034 d2c1d6a7d12e 97fc47fee9cf f157bcea0e32 529c703db24d a268d4df52bf 76f93eaefe45 19c71c828f86 076c7a7c86b1 ed3a36b6414c 107eaba52c9d e9b9619cd857 dc71378db1dc c92a99490cba c8684d44d549 4e2cad00a484 3b1bc27fe805 d1bf2d698777 5d90e0e045e2 47e374020b59 a2ef53c5db26 2cbf6f348595 b5a0a69b3622 67be8ac00c24 b644e1757711 417184c73f4e cd437c4f5f8d 7b17d570d7ee 62cdf34daec1 0e04dfc20211 0024ccb1b050 3dd6582de060 d74ce22fa80e aa0bfbd11f02 9a777fec4ed9 9a8e3b4419e0 7ebb7052bc7f c0095389312b a2fbad481dd7 2a0c09c09716 11a2e09d6a69 810896d41be7 addec2bd6423 32d97df55ab7 ffb67a81188c 00ef7b83b340 bff9106edcba cd46e56b1709 2e9188ca4f98 d9b3b84605a4 4a4400c5812d e8fa53694f68 7b9f4570daf5 d3b048b27277 1e8a6e8bb91b f4d6ef418a96 93501da2a162 da8f7826a645 46b5e2c59c6b 35fea4237cc9 6ae3fa0af4f6 d7d182467382 6246d1e51f4f 26d0d091deb7 0a3b244b748f 61ecbd299f22 7f283f8e8b97 33bd0bd45f8a df5c69cbd047 17ca6cddc534 f8cf54e99879 1656dc14c2ac 08e221b77658 eb2a3502601d c9aacc0e7dc1 acc85ac0f70b 58f915792b85 73ef9f767132 757195ad7a5d 71e65fcf95ab 3776b70d9b17 a7e6e8e6094c e71583501b1d f677d6270298 750579ecc721 6ca0b971ff07 39442b000e6b a46d15e72101 19355e2283ab 16626c0d69c0 ac713df7b38b 20b8fe85888b 95b525b0b977 501d8b268dd4 44a3d2ebaddd 2fb70d019851 59338826539c 40dd3f86379a 92a797b20912 f3e5e2bc78e9 c8df33a6829f a0dd06b0094e 0650d94ede82 a36bab6b9ffc b1e92a6233ee 8aafd2023dec 7b26e6118bc0 4bae285c6ed8 8a2dbcb56246 a024e800af4e b210727578e8 2e640ffa6c93 3d5c825aebba 617c2840446c 36e5a9c15a84 0b203bbf7cc3 17a3a84b00d1 7edaff01d506 c987c86513df 554ccacfc123 6e7dfa0a42b9 8475176972e8 8ddebaa7e856 1f78655a0466 4d2e44d79b03 62ceb2eec18c 155cab142b63 ed89fae5180b e1dc108bd814 3ea0b8af2d46 206c1fc1b06a ad01845c4bf8 efd29a0033e8 83940d53664f 66fd9d6b1452 d0fbea2eb46e 89e89836cae7 d1727c573f30 4ac01a732552 2a83f5303458 7d2eb590051f e71846aa07b9 3556d08e17f9 7f5f6c056d8f 991b55638aaf a6c241e8eba0 8933faff2043 f28389bd6aab 5ea4872f23e8 b43a9ab0498f b5229b56f49b 8a3334b7a364 745d225de344 967ef74f6fd9 348f8c4baccf c889911bec12 0a56c5313bc0 5dead1f4f26d d7ce41acf22c 9e50caedf4db 4f37afcc3583 a7c05940ebc4 ea85398a51bc 8e96499f2705 4da8b828a822 cb71e18eb6f9 6a1780558353 6ff755541a62 2291f8cc9c96 20c36ed92b6b bf5101d394c0 34f40eb4b205 739a763a558c ced6d3afc5cf 070a7b64b368 d98a93c10a0d 8e820b4ae875 ae138eea7a71 f6346d875ee5 749d9a5fcd9f d305b3b0afdc 60f11b71a740 7974adb0be66 b66e70b7b6c7 6978fd76a066 cc1cd197df1d 74be97962ed8 df71c7892d27 c96b32865000 5533e91a2aa4 99ca93d60bca 129c23effb73 d3e75fb41e61 ff6569530173 046bd71a180f 462f88d161ce a4f01d51c2a7 0b20f1ec4007 67b24adbf35a d91780ee20de df15b74774ca bf1ab3458db1 e9bfea8e26db a1b9869565aa 38833ed78707 9198231cee96 b6b7e4cf6b24 1f1eb06a9009 5c6e92fd8d71 df940d75cd3d 4f6925337848 10708ab8f54d a3c8288b0141 cc19697f8871 2bfe5ef66b0c 92574625ee9a 65be9f9c3074 5e6d6484c28e 9e5ef6c23006 fd958fbc06fb c5f3bde466d1 bf3d07541368 760a7dd30d6f 90326c9601f9 eae4a97475f1 1edac4b68c6d e271a37b629a a0d4bbfbedd1 9008bf6c2b8c 941abdd6bb4c 961c10bee174 25091e5c3bba 380996db84e5 fd3db644df22 6ad368c5958e 83d5052bf76c ef20fdc14e8b 9756c67d3aec decb6304ba97 e1ec9fbf538e 78001759604c 76f262e1a666 b19606f28101 75d611ab99d1 f5c443378333 8fb35df7d66e 883c77eaf2c9 756fe44a0f4d a160b98fb922 eb0c44a9ad37 34beb1a7e376 43e8ca33bc5d 3d1e74cdac76 736f6813543d af9c6ca11c49 42fa95540468 8d2caf122517 6ae41081ccd3 64caed18236a 1ac84c62ba53 1553bfc9ae53 07b1a5bbf481 9df855f29948 101740454617 42a0ba4bac4e c40c2d3edb51 c0fac31d36fd 3f02e5ea4f2d 4edcf24025cf 25ab8c73514a b45384c909c1 3f4b0ea6eabf 145306044896 db72849cd22e b64e2537d702 18e381ea88c2 de505df5cf8d 19bb31ff1f5c e1078e99c560 9ff27da517fe 62d6e969f180 abb98fa9964e 5c6eb1feaa71 baebdd18aaa2 8f3d2ccfe6fc
In bookmarks: api-unknown-fields cancel-landed-runs clear-waiting close-proposal-140 diffusion-pin-bookmark draft-ready image-check job-waits main oh-comment-body-file proposal-list-fast run-one-job wiki-says-so
In tags: v0.1.0 v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.4.1 v0.4.2 v0.5.0 v0.5.1 v0.5.2 v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
Edits: 62 atoms, 77 tree operations, 62 files

Browse the tree at this change

hide whitespace changes

added Cargo.lock +3922 −0

added Cargo.toml +44 −0

added Makefile +23 −0

added README.md +50 −0

added assets/fonts/Barlow-300.woff2 +0 −0

No line changes.

added assets/fonts/Barlow-400.woff2 +0 −0

No line changes.

added assets/fonts/Barlow-500.woff2 +0 −0

No line changes.

added assets/fonts/Barlow-600.woff2 +0 −0

No line changes.

added assets/fonts/PressStart2P-400.woff2 +0 −0

No line changes.

added assets/hub.js +77 −0

added assets/icons/oxygenhub.svg +1 −0

added crates/hub-api/Cargo.toml +10 −0

added crates/hub-api/src/lib.rs +123 −0

added crates/hub/Cargo.toml +46 −0

added crates/hub/askama.toml +2 −0

added crates/hub/migrations/0001_repositories.sql +25 −0

added crates/hub/src/api/mod.rs +85 −0

added crates/hub/src/config.rs +277 −0

added crates/hub/src/db/mod.rs +29 −0

added crates/hub/src/db/repos.rs +111 −0

added crates/hub/src/keys.rs +100 −0

added crates/hub/src/lib.rs +76 −0

added crates/hub/src/main.rs +213 −0

added crates/hub/src/protocol.rs +115 −0

added crates/hub/src/render/diff.rs +235 −0

added crates/hub/src/render/graph.rs +118 −0

added crates/hub/src/render/highlight.rs +102 −0

added crates/hub/src/render/markdown.rs +62 −0

added crates/hub/src/render/mod.rs +54 −0

added crates/hub/src/render/time.rs +65 −0

added crates/hub/src/repos/mod.rs +149 −0

added crates/hub/src/repos/names.rs +95 −0

added crates/hub/src/repos/view.rs +885 −0

added crates/hub/src/web/filters.rs +56 −0

added crates/hub/src/web/history.rs +148 −0

added crates/hub/src/web/home.rs +63 −0

added crates/hub/src/web/mod.rs +220 −0

added crates/hub/src/web/refs.rs +84 −0

added crates/hub/src/web/repo.rs +221 −0

added crates/hub/src/web/statics.rs +46 −0

added crates/hub/tests/browse.rs +221 −0

added docs/plan.md +30 −0

added rustfmt.toml +2 −0

added templates/base.html +47 −0

added templates/bookmarks.html +20 −0

added templates/change.html +26 −0

added templates/compare.html +12 −0

added templates/conflicts.html +19 −0

added templates/error.html +7 −0

added templates/file.html +50 −0

added templates/history.html +30 −0

added templates/home.html +24 −0

added templates/overview.html +40 −0

added templates/pushes.html +16 −0

added templates/repo_tabs.html +58 −0

added templates/style.css +225 −0

added templates/tags.html +21 −0

added templates/tree.html +15 −0

added templates/tree_rows.html +22 −0

added templates/tree_table.html +2 −0

added templates/trust.html +40 −0

modified .oxyignore +2 −0

1	+	[workspace]
2	+	members = ["crates/hub", "crates/hub-api"]
3	+	resolver = "2"
4	+
5	+	[workspace.package]
6	+	version = "0.1.0"
7	+	edition = "2021"
8	+	license = "MIT OR Apache-2.0"
9	+	authors = ["Andy McCall <[email protected]>"]
10	+	repository = "https://earth.andymccall.xyz:7343/andymccall/oxygenhub"
11	+
12	+	[workspace.dependencies]
13	+	oxy-core = { path = "../oxygen/crates/oxy-core" }
14	+	oxy-server = { path = "../oxygen/crates/oxy-server" }
15	+	hub-api = { path = "crates/hub-api" }
16	+
17	+	anyhow = "1"
18	+	thiserror = "2"
19	+	serde = { version = "1", features = ["derive"] }
20	+	serde_json = "1"
21	+	tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "sync", "time", "signal", "fs"] }
22	+	axum = { version = "0.8", features = ["macros", "form", "query"] }
23	+	axum-server = { version = "0.8", default-features = false, features = ["tls-rustls-no-provider"] }
24	+	rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
25	+	tower-http = { version = "0.6", features = ["trace", "compression-gzip", "set-header", "limit"] }
26	+	askama = "0.14"
27	+	sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "migrate", "macros"] }
28	+	tracing = "0.1"
29	+	tracing-subscriber = { version = "0.3", features = ["env-filter"] }
30	+	clap = { version = "4", features = ["derive", "env"] }
31	+	toml = "0.8"
32	+	time = { version = "0.3", features = ["formatting", "macros"] }
33	+	pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
34	+	ammonia = "4"
35	+	syntect = { version = "5", default-features = false, features = ["default-fancy"] }
36	+	rcgen = "0.14"
37	+	hex = "0.4"
38	+	rand = "0.8"
39	+	similar = "2"
40	+	tempfile = "3"
41	+	reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }
42	+
43	+	[profile.release]
44	+	debug = 1

1	+	.PHONY: build check test fmt clippy run deploy
2	+
3	+	build:
4	+	cargo build --release
5	+
6	+	check: fmt clippy test
7	+
8	+	fmt:
9	+	cargo fmt --all -- --check
10	+
11	+	clippy:
12	+	cargo clippy --workspace --all-targets -- -D warnings
13	+
14	+	test:
15	+	cargo test --workspace
16	+
17	+	run:
18	+	cargo run -- --data data serve
19	+
20	+	# Developer edition on Earth (docs/deploy.md).
21	+	deploy:
22	+	rsync -a --delete --exclude target --exclude node_modules --exclude .oxy/objects/loose ../oxygen ../oxygenhub claude@earth:src/
23	+	ssh claude@earth 'source ~/.cargo/env && cd src/oxygenhub && cargo build --release && sudo install -m 0755 target/release/oxygenhub /usr/local/bin/oxygenhub && sudo systemctl restart oxygenhub && systemctl is-active oxygenhub'

1	+	[package]
2	+	name = "hub-api"
3	+	description = "Types of the Oxygenhub JSON API, shared by the server and its clients"
4	+	version.workspace = true
5	+	edition.workspace = true
6	+	license.workspace = true
7	+	authors.workspace = true
8	+
9	+	[dependencies]
10	+	serde.workspace = true

1	+	//! Types of the Oxygenhub JSON API (hub spec §12.1). Everything here is
2	+	//! `serde` data with no behaviour, so clients in other languages can be
3	+	//! generated from it and the server can never drift from them.
4	+	//!
5	+	//! Shapes reuse `oxy --json`'s where one exists (hashes as lowercase hex,
6	+	//! times as milliseconds since the epoch), so tools written against the
7	+	//! command line work against the hub.
8	+
9	+	use serde::{Deserialize, Serialize};
10	+
11	+	/// A repository as the API lists it.
12	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
13	+	pub struct Repository {
14	+	pub owner: String,
15	+	pub name: String,
16	+	pub description: String,
17	+	pub default_bookmark: String,
18	+	pub visibility: Visibility,
19	+	/// Milliseconds since the epoch.
20	+	pub created_ms: i64,
21	+	pub updated_ms: i64,
22	+	/// `https://…/{owner}/{name}`, what `oxy clone` takes.
23	+	pub clone_url: String,
24	+	}
25	+
26	+	#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
27	+	#[serde(rename_all = "lowercase")]
28	+	pub enum Visibility {
29	+	Public,
30	+	Internal,
31	+	Private,
32	+	}
33	+
34	+	impl Visibility {
35	+	pub fn as_str(self) -> &'static str {
36	+	match self {
37	+	Visibility::Public => "public",
38	+	Visibility::Internal => "internal",
39	+	Visibility::Private => "private",
40	+	}
41	+	}
42	+
43	+	pub fn parse(s: &str) -> Option<Visibility> {
44	+	Some(match s {
45	+	"public" => Visibility::Public,
46	+	"internal" => Visibility::Internal,
47	+	"private" => Visibility::Private,
48	+	_ => return None,
49	+	})
50	+	}
51	+	}
52	+
53	+	/// A bookmark: a name for a set of heads (spec §10.1).
54	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
55	+	pub struct Bookmark {
56	+	pub name: String,
57	+	pub heads: Vec<String>,
58	+	/// Number of changes in the bookmark's state.
59	+	pub changes: usize,
60	+	pub default: bool,
61	+	}
62	+
63	+	/// A tag: a name for one state, with its attestation when signed.
64	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
65	+	pub struct Tag {
66	+	pub name: String,
67	+	pub heads: Vec<String>,
68	+	pub message: String,
69	+	pub signer: Option<String>,
70	+	}
71	+
72	+	/// One change in a history listing.
73	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
74	+	pub struct ChangeSummary {
75	+	pub hash: String,
76	+	pub message: String,
77	+	pub author: Author,
78	+	pub when_ms: u64,
79	+	pub deps: Vec<String>,
80	+	pub head: bool,
81	+	pub signature: Signature,
82	+	}
83	+
84	+	/// Who wrote a change: the linked account when the signing key is linked,
85	+	/// else the key alone.
86	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
87	+	pub struct Author {
88	+	pub name: String,
89	+	pub email: String,
90	+	pub key: String,
91	+	/// The hub account this key is linked to, when any.
92	+	pub account: Option<String>,
93	+	}
94	+
95	+	/// Signature status of a change as `oxy verify` reports it.
96	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
97	+	#[serde(tag = "status", rename_all = "lowercase")]
98	+	pub enum Signature {
99	+	Unsigned,
100	+	Valid { key: String, sealed: bool, revoked: bool },
101	+	Invalid { reason: String },
102	+	}
103	+
104	+	/// An RFC 7807 problem response.
105	+	#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
106	+	pub struct Problem {
107	+	pub status: u16,
108	+	pub title: String,
109	+	pub detail: String,
110	+	}
111	+
112	+	#[cfg(test)]
113	+	mod tests {
114	+	use super::*;
115	+
116	+	#[test]
117	+	fn visibility_round_trips() {
118	+	for v in [Visibility::Public, Visibility::Internal, Visibility::Private] {
119	+	assert_eq!(Visibility::parse(v.as_str()), Some(v));
120	+	}
121	+	assert_eq!(Visibility::parse("secret"), None);
122	+	}
123	+	}

1	+	[package]
2	+	name = "oxygenhub"
3	+	description = "A forge for Oxygen repositories: hosting, browsing, review, issues and releases"
4	+	version.workspace = true
5	+	edition.workspace = true
6	+	license.workspace = true
7	+	authors.workspace = true
8	+	default-run = "oxygenhub"
9	+
10	+	[[bin]]
11	+	name = "oxygenhub"
12	+	path = "src/main.rs"
13	+
14	+	[dependencies]
15	+	oxy-core.workspace = true
16	+	oxy-server.workspace = true
17	+	hub-api.workspace = true
18	+	anyhow.workspace = true
19	+	thiserror.workspace = true
20	+	serde.workspace = true
21	+	serde_json.workspace = true
22	+	tokio.workspace = true
23	+	axum.workspace = true
24	+	axum-server.workspace = true
25	+	rustls.workspace = true
26	+	tower-http.workspace = true
27	+	askama.workspace = true
28	+	sqlx.workspace = true
29	+	tracing.workspace = true
30	+	tracing-subscriber.workspace = true
31	+	clap.workspace = true
32	+	toml.workspace = true
33	+	time.workspace = true
34	+	pulldown-cmark.workspace = true
35	+	ammonia.workspace = true
36	+	syntect.workspace = true
37	+	rcgen.workspace = true
38	+	hex.workspace = true
39	+	rand.workspace = true
40	+	similar.workspace = true
41	+
42	+	[dev-dependencies]
43	+	tempfile.workspace = true
44	+	reqwest.workspace = true
45	+	tower = { version = "0.5", features = ["util"] }
46	+	http-body-util = "0.1"

1	+	# Oxygenhub
2	+
3	+	A forge for [Oxygen](../oxygen) repositories: hosting, browsing, review,
4	+	issues and releases, in one Rust binary with one data directory. It works
5	+	like GitHub where GitHub is right and differs where Oxygen's commutative
6	+	model makes something better possible. The specification is
7	+	[docs/spec.md](docs/spec.md); deployment notes are in
8	+	[docs/deploy.md](docs/deploy.md).
9	+
10	+	## Status
11	+
12	+	Milestone 0.1 (browse): repositories are created by an administrator and
13	+	filled by `oxy push`; the pages show trees, files, blame, history with the
14	+	dependency graph, changes with diffs, comparisons, bookmarks, tags,
15	+	conflicts, the trust policy and the push log. Accounts, proposals, issues
16	+	and the rest follow the milestones in the specification.
17	+
18	+	## Running
19	+
20	+	```
21	+	cargo build --release
22	+	target/release/oxygenhub --data /srv/oxygenhub init --base-url https://hub.example:7343 --self-signed
23	+	target/release/oxygenhub --data /srv/oxygenhub admin repo create andy/oxygen --description "The VCS"
24	+	target/release/oxygenhub --data /srv/oxygenhub serve
25	+	```
26	+
27	+	Then from any checkout: `oxy remote add hub https://hub.example:7343/andy/oxygen`
28	+	and `oxy push hub`. With a self-signed certificate, hand clients the CA with
29	+	`OXY_CA=<path>` or `oxy config remote.hub.ca <path>`.
30	+
31	+	Configuration lives in `<data>/hub.toml` (spec §17.1) and every key can be
32	+	overridden with `OXYHUB_<SECTION>_<KEY>`.
33	+
34	+	## Layout
35	+
36	+	```
37	+	crates/hub the binary: config, db (sqlx + migrations), repos (registry, locks, views),
38	+	protocol (embedded oxy-server), web (pages), api (JSON), render (markdown,
39	+	highlighting, diffs, graph)
40	+	crates/hub-api the JSON API's types, shared with clients
41	+	templates/ askama templates and the stylesheet
42	+	assets/ vendored fonts, icons, the small progressive-enhancement script
43	+	migrations/ under crates/hub; applied at start
44	+	```
45	+
46	+	## Developing
47	+
48	+	`make check` runs formatting, clippy with warnings as errors, and the tests.
49	+	The tests use a real `oxy-core` client against a hub on a loopback port and
50	+	never touch your own Oxygen configuration.

1	+	/* Progressive enhancement only: every page works without this file. */
2	+	(function () {
3	+	"use strict";
4	+	/* The band's active tab: the longest link that prefixes the path. */
5	+	var p = location.pathname, best = null;
6	+	document.querySelectorAll(".band a").forEach(function (a) {
7	+	var h = a.getAttribute("href");
8	+	if (h !== "/" && (p === h \|\| p.indexOf(h + "/") === 0) && (!best \|\| h.length > best.getAttribute("href").length)) best = a;
9	+	});
10	+	if (best) best.classList.add("on");
11	+
12	+	/* Copy buttons. */
13	+	document.querySelectorAll("[data-copy]").forEach(function (b) {
14	+	b.addEventListener("click", function () {
15	+	navigator.clipboard.writeText(b.getAttribute("data-copy")).then(function () {
16	+	var t = b.textContent; b.textContent = "copied"; setTimeout(function () { b.textContent = t; }, 1200);
17	+	});
18	+	});
19	+	});
20	+
21	+	/* Tree rows: the last change per entry, fetched after the page paints. */
22	+	var tree = document.querySelector("table.tree[data-last]");
23	+	if (tree) {
24	+	var paths = [].map.call(tree.querySelectorAll("tr[data-path]"), function (r) { return r.getAttribute("data-path"); });
25	+	if (paths.length) {
26	+	fetch(tree.getAttribute("data-last") + "?paths=" + encodeURIComponent(paths.join(",")), { credentials: "same-origin" })
27	+	.then(function (r) { return r.json(); })
28	+	.then(function (rows) {
29	+	rows.forEach(function (c) {
30	+	var tr = tree.querySelector('tr[data-path="' + CSS.escape(c.path) + '"]');
31	+	if (!tr) return;
32	+	var a = tr.querySelector("td.last a"), t = tr.querySelector("td.age");
33	+	if (a) { a.textContent = c.title; a.href = tree.getAttribute("data-change") + c.hash; }
34	+	if (t) { t.textContent = c.ago; t.title = c.when; }
35	+	});
36	+	}).catch(function () {});
37	+	}
38	+	}
39	+
40	+	/* Line anchors: #L12 or #L12-L20 highlight a range and clicking a number selects. */
41	+	function mark() {
42	+	var m = location.hash.match(/^#L(\d+)(?:-L(\d+))?$/);
43	+	document.querySelectorAll("tr.hl").forEach(function (r) { r.classList.remove("hl"); });
44	+	if (!m) return;
45	+	var a = +m[1], b = +(m[2] \|\| m[1]);
46	+	for (var i = Math.min(a, b); i <= Math.max(a, b); i++) {
47	+	var row = document.getElementById("L" + i);
48	+	if (row) row.classList.add("hl");
49	+	}
50	+	var first = document.getElementById("L" + Math.min(a, b));
51	+	if (first && !mark.done) { first.scrollIntoView({ block: "center" }); mark.done = true; }
52	+	}
53	+	window.addEventListener("hashchange", mark);
54	+	mark();
55	+	document.querySelectorAll("table.code td.n").forEach(function (td) {
56	+	td.addEventListener("click", function (e) {
57	+	var n = td.parentNode.id;
58	+	if (e.shiftKey && location.hash.match(/^#L(\d+)/)) location.hash = location.hash.replace(/^#(L\d+).*/, "$1-" + n);
59	+	else location.hash = n;
60	+	});
61	+	});
62	+
63	+	/* Keyboard: / focuses search; g c / g p / g i jump; ? shows the sheet. */
64	+	var pending = null;
65	+	document.addEventListener("keydown", function (e) {
66	+	if (e.target && /^(INPUT\|TEXTAREA\|SELECT)$/.test(e.target.tagName)) return;
67	+	if (e.key === "/") { var s = document.querySelector("input[name=q]"); if (s) { e.preventDefault(); s.focus(); } return; }
68	+	if (e.key === "?") { var k = document.getElementById("keys"); if (k) k.hidden = !k.hidden; return; }
69	+	var repo = document.body.getAttribute("data-repo");
70	+	if (pending === "g" && repo) {
71	+	var to = { c: "", p: "/proposals", i: "/issues", h: "/changes/" + (document.body.getAttribute("data-ref") \|\| "main"), b: "/bookmarks", t: "/trust" }[e.key];
72	+	if (to !== undefined) location.href = repo + to;
73	+	pending = null; return;
74	+	}
75	+	pending = e.key === "g" ? "g" : null;
76	+	});
77	+	})();

1	+	-- Hub state that Oxygen has no object for (hub spec §1.4). History,
2	+	-- references, signatures and policy live in each repository's own store.
3	+
4	+	CREATE TABLE repositories (
5	+	id INTEGER PRIMARY KEY,
6	+	owner TEXT NOT NULL,
7	+	name TEXT NOT NULL,
8	+	description TEXT NOT NULL DEFAULT '',
9	+	default_bookmark TEXT NOT NULL DEFAULT 'main',
10	+	visibility TEXT NOT NULL DEFAULT 'public' CHECK (visibility IN ('public', 'internal', 'private')),
11	+	created_ms INTEGER NOT NULL,
12	+	updated_ms INTEGER NOT NULL,
13	+	UNIQUE (owner, name)
14	+	);
15	+
16	+	-- Every reference update the protocol server accepted or refused (§6.12).
17	+	CREATE TABLE pushes (
18	+	id INTEGER PRIMARY KEY,
19	+	repo_id INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
20	+	at_ms INTEGER NOT NULL,
21	+	reference TEXT NOT NULL,
22	+	ok INTEGER NOT NULL,
23	+	reason TEXT NOT NULL DEFAULT ''
24	+	);
25	+	CREATE INDEX pushes_by_repo ON pushes (repo_id, at_ms DESC);

1	+	//! The JSON API (hub spec §12.1) under `/api/v1`. Milestone 0.1 exposes
2	+	//! repositories, bookmarks and tags; the rest follows the pages.
3	+
4	+	use crate::repos::{view, RepoError, RepoName};
5	+	use crate::{db, Shared};
6	+	use axum::extract::{Path, State};
7	+	use axum::http::StatusCode;
8	+	use axum::response::{IntoResponse, Response};
9	+	use axum::routing::get;
10	+	use axum::{Json, Router};
11	+	use hub_api::{Bookmark, Problem, Repository, Tag};
12	+
13	+	pub fn router() -> Router<Shared> {
14	+	Router::new()
15	+	.route("/repos", get(list_repos))
16	+	.route("/repos/{owner}/{name}", get(get_repo))
17	+	.route("/repos/{owner}/{name}/bookmarks", get(bookmarks))
18	+	.route("/repos/{owner}/{name}/tags", get(tags))
19	+	}
20	+
21	+	pub struct ApiError(StatusCode, String);
22	+
23	+	impl IntoResponse for ApiError {
24	+	fn into_response(self) -> Response {
25	+	let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };
26	+	(self.0, [("content-type", "application/problem+json")], Json(body)).into_response()
27	+	}
28	+	}
29	+
30	+	impl From<RepoError> for ApiError {
31	+	fn from(e: RepoError) -> ApiError {
32	+	match e {
33	+	RepoError::NotFound => ApiError(StatusCode::NOT_FOUND, "no such repository".into()),
34	+	other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),
35	+	}
36	+	}
37	+	}
38	+
39	+	impl From<sqlx::Error> for ApiError {
40	+	fn from(e: sqlx::Error) -> ApiError {
41	+	ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())
42	+	}
43	+	}
44	+
45	+	fn repository(app: &Shared, r: &db::repos::RepoRow) -> Repository {
46	+	Repository {
47	+	owner: r.owner.clone(),
48	+	name: r.name.clone(),
49	+	description: r.description.clone(),
50	+	default_bookmark: r.default_bookmark.clone(),
51	+	visibility: r.visibility(),
52	+	created_ms: r.created_ms,
53	+	updated_ms: r.updated_ms,
54	+	clone_url: format!("{}/{}/{}", app.config.base_url(), r.owner, r.name),
55	+	}
56	+	}
57	+
58	+	async fn public_row(app: &Shared, owner: &str, name: &str) -> Result<(RepoName, db::repos::RepoRow), ApiError> {
59	+	let repo = RepoName::new(owner, name).ok_or(ApiError(StatusCode::NOT_FOUND, "no such repository".into()))?;
60	+	let row = db::repos::get(&app.db, owner, name).await?.filter(\|r\| r.visibility() == hub_api::Visibility::Public);
61	+	Ok((repo, row.ok_or(ApiError(StatusCode::NOT_FOUND, "no such repository".into()))?))
62	+	}
63	+
64	+	async fn list_repos(State(app): State<Shared>) -> Result<Json<Vec<Repository>>, ApiError> {
65	+	let rows = db::repos::list(&app.db).await?;
66	+	Ok(Json(rows.iter().filter(\|r\| r.visibility() == hub_api::Visibility::Public).map(\|r\| repository(&app, r)).collect()))
67	+	}
68	+
69	+	async fn get_repo(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Json<Repository>, ApiError> {
70	+	let (_, row) = public_row(&app, &owner, &name).await?;
71	+	Ok(Json(repository(&app, &row)))
72	+	}
73	+
74	+	async fn bookmarks(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Json<Vec<Bookmark>>, ApiError> {
75	+	let (repo, row) = public_row(&app, &owner, &name).await?;
76	+	let default = row.default_bookmark.clone();
77	+	let list = app.repos.read(&repo, move \|r\| view::bookmarks(r, &default)).await?;
78	+	Ok(Json(list.into_iter().map(\|b\| Bookmark { name: b.name, heads: b.heads, changes: b.changes, default: b.default }).collect()))
79	+	}
80	+
81	+	async fn tags(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Json<Vec<Tag>>, ApiError> {
82	+	let (repo, _) = public_row(&app, &owner, &name).await?;
83	+	let list = app.repos.read(&repo, view::tags).await?;
84	+	Ok(Json(list.into_iter().map(\|t\| Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer }).collect()))
85	+	}

1	+	//! Configuration (hub spec §17.1): `hub.toml` in the data directory, every
2	+	//! key overridable by `OXYHUB_<SECTION>_<KEY>`.
3	+
4	+	use serde::Deserialize;
5	+	use std::net::SocketAddr;
6	+	use std::path::{Path, PathBuf};
7	+
8	+	#[derive(Clone, Debug, Deserialize)]
9	+	#[serde(default, deny_unknown_fields)]
10	+	pub struct Config {
11	+	/// Set from the command line, never from the file.
12	+	#[serde(skip)]
13	+	pub data: PathBuf,
14	+	pub site: Site,
15	+	pub server: Server,
16	+	pub tls: Tls,
17	+	pub auth: Auth,
18	+	pub limits: Limits,
19	+	pub retention: Retention,
20	+	}
21	+
22	+	#[derive(Clone, Debug, Deserialize)]
23	+	#[serde(default, deny_unknown_fields)]
24	+	pub struct Site {
25	+	pub name: String,
26	+	pub description: String,
27	+	}
28	+
29	+	#[derive(Clone, Debug, Deserialize)]
30	+	#[serde(default, deny_unknown_fields)]
31	+	pub struct Server {
32	+	/// Plain HTTP; empty disables it.
33	+	pub bind: String,
34	+	/// HTTPS; empty disables it. Needs `tls`.
35	+	pub tls_bind: String,
36	+	/// What links and clone URLs start with.
37	+	pub base_url: String,
38	+	/// Trust `X-Forwarded-*` from a terminating proxy.
39	+	pub behind_proxy: bool,
40	+	}
41	+
42	+	#[derive(Clone, Debug, Deserialize)]
43	+	#[serde(default, deny_unknown_fields)]
44	+	pub struct Tls {
45	+	/// Generate a certificate at `init` (developer edition).
46	+	pub self_signed: bool,
47	+	/// PEM files; relative paths are under the data directory.
48	+	pub cert: String,
49	+	pub key: String,
50	+	}
51	+
52	+	#[derive(Clone, Debug, Default, Deserialize)]
53	+	#[serde(default, deny_unknown_fields)]
54	+	pub struct Auth {
55	+	/// Bearer tokens allowed to push until accounts exist (hub 0.2). Empty
56	+	/// means every push is accepted, as `oxy serve` does.
57	+	pub push_tokens: Vec<String>,
58	+	}
59	+
60	+	#[derive(Clone, Debug, Deserialize)]
61	+	#[serde(default, deny_unknown_fields)]
62	+	pub struct Limits {
63	+	/// Largest file rendered in the browser, e.g. `2MiB`.
64	+	pub render_limit: ByteSize,
65	+	pub asset_limit: ByteSize,
66	+	pub push_body_limit: ByteSize,
67	+	}
68	+
69	+	#[derive(Clone, Debug, Deserialize)]
70	+	#[serde(default, deny_unknown_fields)]
71	+	pub struct Retention {
72	+	pub trash_days: u32,
73	+	pub webhook_log_days: u32,
74	+	}
75	+
76	+	/// A byte count written as `512`, `2MiB`, `4GiB`, `100kB`.
77	+	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
78	+	pub struct ByteSize(pub u64);
79	+
80	+	impl ByteSize {
81	+	pub fn parse(s: &str) -> Option<ByteSize> {
82	+	let s = s.trim();
83	+	let digits: String = s.chars().take_while(\|c\| c.is_ascii_digit()).collect();
84	+	let unit = s[digits.len()..].trim();
85	+	let n: u64 = digits.parse().ok()?;
86	+	let mult = match unit {
87	+	"" \| "B" => 1,
88	+	"k" \| "kB" \| "KB" => 1000,
89	+	"KiB" \| "K" => 1 << 10,
90	+	"M" \| "MB" => 1_000_000,
91	+	"MiB" => 1 << 20,
92	+	"G" \| "GB" => 1_000_000_000,
93	+	"GiB" => 1 << 30,
94	+	_ => return None,
95	+	};
96	+	Some(ByteSize(n.checked_mul(mult)?))
97	+	}
98	+	}
99	+
100	+	impl<'de> Deserialize<'de> for ByteSize {
101	+	fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<ByteSize, D::Error> {
102	+	#[derive(Deserialize)]
103	+	#[serde(untagged)]
104	+	enum Raw {
105	+	Number(u64),
106	+	Text(String),
107	+	}
108	+	match Raw::deserialize(d)? {
109	+	Raw::Number(n) => Ok(ByteSize(n)),
110	+	Raw::Text(t) => ByteSize::parse(&t).ok_or_else(\|\| serde::de::Error::custom(format!("not a byte size: {t:?}"))),
111	+	}
112	+	}
113	+	}
114	+
115	+	impl Default for Site {
116	+	fn default() -> Self {
117	+	Site { name: "Oxygenhub".into(), description: "Repositories, proposals and issues for Oxygen".into() }
118	+	}
119	+	}
120	+
121	+	impl Default for Server {
122	+	fn default() -> Self {
123	+	Server { bind: "127.0.0.1:7300".into(), tls_bind: String::new(), base_url: "http://127.0.0.1:7300".into(), behind_proxy: false }
124	+	}
125	+	}
126	+
127	+	impl Default for Tls {
128	+	fn default() -> Self {
129	+	Tls { self_signed: false, cert: "keys/tls.crt".into(), key: "keys/tls.key".into() }
130	+	}
131	+	}
132	+
133	+	impl Default for Limits {
134	+	fn default() -> Self {
135	+	Limits { render_limit: ByteSize(2 << 20), asset_limit: ByteSize(512 << 20), push_body_limit: ByteSize(4 << 30) }
136	+	}
137	+	}
138	+
139	+	impl Default for Retention {
140	+	fn default() -> Self {
141	+	Retention { trash_days: 30, webhook_log_days: 30 }
142	+	}
143	+	}
144	+
145	+	impl Default for Config {
146	+	fn default() -> Self {
147	+	Config {
148	+	data: PathBuf::from("data"),
149	+	site: Site::default(),
150	+	server: Server::default(),
151	+	tls: Tls::default(),
152	+	auth: Auth::default(),
153	+	limits: Limits::default(),
154	+	retention: Retention::default(),
155	+	}
156	+	}
157	+	}
158	+
159	+	impl Config {
160	+	/// Read `<data>/hub.toml` if present, then apply environment overrides.
161	+	pub fn load(data: &Path) -> anyhow::Result<Config> {
162	+	let path = data.join("hub.toml");
163	+	let mut cfg = match std::fs::read_to_string(&path) {
164	+	Ok(text) => Config::parse(&text)?,
165	+	Err(e) if e.kind() == std::io::ErrorKind::NotFound => Config::default(),
166	+	Err(e) => return Err(anyhow::anyhow!("reading {}: {e}", path.display())),
167	+	};
168	+	cfg.data = data.to_path_buf();
169	+	cfg.apply_env(\|k\| std::env::var(k).ok());
170	+	Ok(cfg)
171	+	}
172	+
173	+	pub fn parse(text: &str) -> anyhow::Result<Config> {
174	+	Ok(toml::from_str(text)?)
175	+	}
176	+
177	+	/// `OXYHUB_SERVER_BIND`, `OXYHUB_SITE_NAME`, … override the file.
178	+	pub fn apply_env(&mut self, get: impl Fn(&str) -> Option<String>) {
179	+	if let Some(v) = get("OXYHUB_SITE_NAME") {
180	+	self.site.name = v;
181	+	}
182	+	if let Some(v) = get("OXYHUB_SITE_DESCRIPTION") {
183	+	self.site.description = v;
184	+	}
185	+	if let Some(v) = get("OXYHUB_SERVER_BIND") {
186	+	self.server.bind = v;
187	+	}
188	+	if let Some(v) = get("OXYHUB_SERVER_TLS_BIND") {
189	+	self.server.tls_bind = v;
190	+	}
191	+	if let Some(v) = get("OXYHUB_SERVER_BASE_URL") {
192	+	self.server.base_url = v;
193	+	}
194	+	if let Some(v) = get("OXYHUB_SERVER_BEHIND_PROXY") {
195	+	self.server.behind_proxy = matches!(v.as_str(), "1" \| "true" \| "yes");
196	+	}
197	+	if let Some(v) = get("OXYHUB_TLS_SELF_SIGNED") {
198	+	self.tls.self_signed = matches!(v.as_str(), "1" \| "true" \| "yes");
199	+	}
200	+	if let Some(v) = get("OXYHUB_AUTH_PUSH_TOKENS") {
201	+	self.auth.push_tokens = v.split(',').map(str::trim).filter(\|s\| !s.is_empty()).map(String::from).collect();
202	+	}
203	+	if let Some(v) = get("OXYHUB_LIMITS_RENDER_LIMIT").and_then(\|v\| ByteSize::parse(&v)) {
204	+	self.limits.render_limit = v;
205	+	}
206	+	}
207	+
208	+	pub fn bind_addr(&self) -> anyhow::Result<Option<SocketAddr>> {
209	+	parse_addr(&self.server.bind)
210	+	}
211	+
212	+	pub fn tls_bind_addr(&self) -> anyhow::Result<Option<SocketAddr>> {
213	+	parse_addr(&self.server.tls_bind)
214	+	}
215	+
216	+	pub fn tls_cert(&self) -> PathBuf {
217	+	self.data.join(&self.tls.cert)
218	+	}
219	+
220	+	pub fn tls_key(&self) -> PathBuf {
221	+	self.data.join(&self.tls.key)
222	+	}
223	+
224	+	pub fn repos_dir(&self) -> PathBuf {
225	+	self.data.join("repos")
226	+	}
227	+
228	+	pub fn keys_dir(&self) -> PathBuf {
229	+	self.data.join("keys")
230	+	}
231	+
232	+	pub fn db_path(&self) -> PathBuf {
233	+	self.data.join("hub.db")
234	+	}
235	+
236	+	/// The base URL without a trailing slash.
237	+	pub fn base_url(&self) -> &str {
238	+	self.server.base_url.trim_end_matches('/')
239	+	}
240	+	}
241	+
242	+	fn parse_addr(s: &str) -> anyhow::Result<Option<SocketAddr>> {
243	+	if s.trim().is_empty() {
244	+	return Ok(None);
245	+	}
246	+	Ok(Some(s.parse().map_err(\|e\| anyhow::anyhow!("bind address {s:?}: {e}"))?))
247	+	}
248	+
249	+	#[cfg(test)]
250	+	mod tests {
251	+	use super::*;
252	+
253	+	#[test]
254	+	fn byte_sizes() {
255	+	assert_eq!(ByteSize::parse("2MiB"), Some(ByteSize(2 << 20)));
256	+	assert_eq!(ByteSize::parse("512"), Some(ByteSize(512)));
257	+	assert_eq!(ByteSize::parse("4 GiB"), Some(ByteSize(4 << 30)));
258	+	assert_eq!(ByteSize::parse("100kB"), Some(ByteSize(100_000)));
259	+	assert_eq!(ByteSize::parse("lots"), None);
260	+	}
261	+
262	+	#[test]
263	+	fn file_then_environment() {
264	+	let mut cfg = Config::parse("[server]\nbind = \"0.0.0.0:7300\"\n[limits]\nrender_limit = \"1MiB\"\n").unwrap();
265	+	assert_eq!(cfg.server.bind, "0.0.0.0:7300");
266	+	assert_eq!(cfg.limits.render_limit, ByteSize(1 << 20));
267	+	assert_eq!(cfg.site.name, "Oxygenhub");
268	+	cfg.apply_env(\|k\| match k {
269	+	"OXYHUB_SITE_NAME" => Some("Earth".into()),
270	+	"OXYHUB_AUTH_PUSH_TOKENS" => Some("a, b".into()),
271	+	_ => None,
272	+	});
273	+	assert_eq!(cfg.site.name, "Earth");
274	+	assert_eq!(cfg.auth.push_tokens, ["a", "b"]);
275	+	assert!(Config::parse("[nope]\nx = 1\n").is_err(), "unknown sections are errors, not silence");
276	+	}
277	+	}

1	+	//! SQLite through `sqlx` (hub spec §3.1, §17.2): WAL, foreign keys on,
2	+	//! migrations embedded and applied at start. One module per table group.
3	+
4	+	pub mod repos;
5	+
6	+	use sqlx::sqlite::{SqliteConnectOptions, SqliteJournalMode, SqlitePoolOptions, SqliteSynchronous};
7	+	use sqlx::SqlitePool;
8	+	use std::path::Path;
9	+
10	+	pub type Pool = SqlitePool;
11	+
12	+	/// Open (creating if needed) and migrate the database at `path`.
13	+	pub async fn open(path: &Path) -> anyhow::Result<Pool> {
14	+	let options = SqliteConnectOptions::new()
15	+	.filename(path)
16	+	.create_if_missing(true)
17	+	.journal_mode(SqliteJournalMode::Wal)
18	+	.synchronous(SqliteSynchronous::Normal)
19	+	.foreign_keys(true)
20	+	.busy_timeout(std::time::Duration::from_secs(5));
21	+	let pool = SqlitePoolOptions::new().max_connections(8).connect_with(options).await?;
22	+	sqlx::migrate!("./migrations").run(&pool).await?;
23	+	Ok(pool)
24	+	}
25	+
26	+	/// Milliseconds since the epoch, the hub's timestamp unit (as `oxy`'s).
27	+	pub fn now_ms() -> i64 {
28	+	std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(\|d\| d.as_millis() as i64).unwrap_or(0)
29	+	}

1	+	//! The `repositories` and `pushes` tables.
2	+
3	+	use super::{now_ms, Pool};
4	+	use hub_api::Visibility;
5	+	use sqlx::FromRow;
6	+
7	+	#[derive(Clone, Debug, FromRow)]
8	+	pub struct RepoRow {
9	+	pub id: i64,
10	+	pub owner: String,
11	+	pub name: String,
12	+	pub description: String,
13	+	pub default_bookmark: String,
14	+	pub visibility: String,
15	+	pub created_ms: i64,
16	+	pub updated_ms: i64,
17	+	}
18	+
19	+	impl RepoRow {
20	+	pub fn visibility(&self) -> Visibility {
21	+	Visibility::parse(&self.visibility).unwrap_or(Visibility::Private)
22	+	}
23	+
24	+	pub fn slug(&self) -> String {
25	+	format!("{}/{}", self.owner, self.name)
26	+	}
27	+	}
28	+
29	+	#[derive(Clone, Debug, FromRow)]
30	+	pub struct PushRow {
31	+	pub id: i64,
32	+	pub at_ms: i64,
33	+	pub reference: String,
34	+	pub ok: bool,
35	+	pub reason: String,
36	+	}
37	+
38	+	pub async fn list(pool: &Pool) -> sqlx::Result<Vec<RepoRow>> {
39	+	sqlx::query_as("SELECT * FROM repositories ORDER BY updated_ms DESC, owner, name").fetch_all(pool).await
40	+	}
41	+
42	+	pub async fn list_by_owner(pool: &Pool, owner: &str) -> sqlx::Result<Vec<RepoRow>> {
43	+	sqlx::query_as("SELECT * FROM repositories WHERE owner = ? ORDER BY updated_ms DESC, name").bind(owner).fetch_all(pool).await
44	+	}
45	+
46	+	pub async fn get(pool: &Pool, owner: &str, name: &str) -> sqlx::Result<Option<RepoRow>> {
47	+	sqlx::query_as("SELECT * FROM repositories WHERE owner = ? AND name = ?").bind(owner).bind(name).fetch_optional(pool).await
48	+	}
49	+
50	+	pub async fn create(pool: &Pool, owner: &str, name: &str, description: &str, visibility: Visibility) -> sqlx::Result<RepoRow> {
51	+	let now = now_ms();
52	+	sqlx::query_as(
53	+	"INSERT INTO repositories (owner, name, description, visibility, created_ms, updated_ms) VALUES (?, ?, ?, ?, ?, ?) RETURNING *",
54	+	)
55	+	.bind(owner)
56	+	.bind(name)
57	+	.bind(description)
58	+	.bind(visibility.as_str())
59	+	.bind(now)
60	+	.bind(now)
61	+	.fetch_one(pool)
62	+	.await
63	+	}
64	+
65	+	pub async fn delete(pool: &Pool, id: i64) -> sqlx::Result<()> {
66	+	sqlx::query("DELETE FROM repositories WHERE id = ?").bind(id).execute(pool).await?;
67	+	Ok(())
68	+	}
69	+
70	+	pub async fn set_description(pool: &Pool, id: i64, description: &str) -> sqlx::Result<()> {
71	+	sqlx::query("UPDATE repositories SET description = ? WHERE id = ?").bind(description).bind(id).execute(pool).await?;
72	+	Ok(())
73	+	}
74	+
75	+	pub async fn set_default_bookmark(pool: &Pool, id: i64, bookmark: &str) -> sqlx::Result<()> {
76	+	sqlx::query("UPDATE repositories SET default_bookmark = ? WHERE id = ?").bind(bookmark).bind(id).execute(pool).await?;
77	+	Ok(())
78	+	}
79	+
80	+	pub async fn set_visibility(pool: &Pool, id: i64, visibility: Visibility) -> sqlx::Result<()> {
81	+	sqlx::query("UPDATE repositories SET visibility = ? WHERE id = ?").bind(visibility.as_str()).bind(id).execute(pool).await?;
82	+	Ok(())
83	+	}
84	+
85	+	/// Record a push's per-reference results and bump the repository's activity.
86	+	pub async fn record_push(pool: &Pool, id: i64, results: &[(String, bool, String)]) -> sqlx::Result<()> {
87	+	let now = now_ms();
88	+	let mut tx = pool.begin().await?;
89	+	for (reference, ok, reason) in results {
90	+	sqlx::query("INSERT INTO pushes (repo_id, at_ms, reference, ok, reason) VALUES (?, ?, ?, ?, ?)")
91	+	.bind(id)
92	+	.bind(now)
93	+	.bind(reference)
94	+	.bind(ok)
95	+	.bind(reason)
96	+	.execute(&mut *tx)
97	+	.await?;
98	+	}
99	+	if results.iter().any(\|(_, ok, _)\| *ok) {
100	+	sqlx::query("UPDATE repositories SET updated_ms = ? WHERE id = ?").bind(now).bind(id).execute(&mut *tx).await?;
101	+	}
102	+	tx.commit().await
103	+	}
104	+
105	+	pub async fn pushes(pool: &Pool, id: i64, limit: i64) -> sqlx::Result<Vec<PushRow>> {
106	+	sqlx::query_as("SELECT id, at_ms, reference, ok, reason FROM pushes WHERE repo_id = ? ORDER BY at_ms DESC, id DESC LIMIT ?")
107	+	.bind(id)
108	+	.bind(limit)
109	+	.fetch_all(pool)
110	+	.await
111	+	}

1	+	//! The hub's own material under `<data>/keys/` (hub spec §15.5): its
2	+	//! delegate identity, published at `/.well-known/oxyhub-key`, and the
3	+	//! developer edition's self-signed TLS certificate.
4	+
5	+	use oxy_core::hash::KeyId;
6	+	use oxy_core::identity::{Identity, SecretKey};
7	+	use std::fs;
8	+	use std::path::Path;
9	+
10	+	const IDENTITY_FILE: &str = "hub.identity";
11	+	const SECRET_FILE: &str = "hub.secret";
12	+
13	+	/// The hub identity: public object and key id; the secret stays on disk
14	+	/// until something needs to sign (hub 0.6).
15	+	#[derive(Clone, Debug)]
16	+	pub struct HubKey {
17	+	pub key: KeyId,
18	+	pub identity: Identity,
19	+	pub bytes: Vec<u8>,
20	+	}
21	+
22	+	/// Create the identity if absent, and return it.
23	+	pub fn ensure_identity(keys: &Path, site_name: &str, base_url: &str) -> anyhow::Result<HubKey> {
24	+	fs::create_dir_all(keys)?;
25	+	let id_path = keys.join(IDENTITY_FILE);
26	+	if id_path.exists() {
27	+	return load_identity(keys);
28	+	}
29	+	let secret = SecretKey::generate();
30	+	let created = crate::db::now_ms() as u64;
31	+	let host = base_url.split("://").nth(1).unwrap_or(base_url).split('/').next().unwrap_or("hub");
32	+	let identity = secret.identity(&format!("{site_name} (hub delegate)"), &format!("hub@{host}"), created);
33	+	let key = identity.hash();
34	+	write_private(&keys.join(SECRET_FILE), &secret.encode(&key))?;
35	+	write_private(&id_path, &identity.encode())?;
36	+	Ok(HubKey { key, bytes: identity.encode(), identity })
37	+	}
38	+
39	+	pub fn load_identity(keys: &Path) -> anyhow::Result<HubKey> {
40	+	let bytes = fs::read(keys.join(IDENTITY_FILE))?;
41	+	let identity = Identity::decode(&bytes)?;
42	+	Ok(HubKey { key: identity.hash(), identity, bytes })
43	+	}
44	+
45	+	/// Generate a self-signed certificate for the base URL's host (and
46	+	/// localhost) if none exists. Returns whether one was written.
47	+	pub fn ensure_self_signed(cert: &Path, key: &Path, base_url: &str) -> anyhow::Result<bool> {
48	+	if cert.exists() && key.exists() {
49	+	return Ok(false);
50	+	}
51	+	let host = base_url.split("://").nth(1).unwrap_or(base_url).split(['/', ':']).next().unwrap_or("localhost").to_string();
52	+	let mut names = vec![host.clone(), "localhost".to_string()];
53	+	if let Some(short) = host.split('.').next() {
54	+	if short != host {
55	+	names.push(short.to_string());
56	+	}
57	+	}
58	+	let ck = rcgen::generate_simple_self_signed(names)?;
59	+	if let Some(dir) = cert.parent() {
60	+	fs::create_dir_all(dir)?;
61	+	}
62	+	fs::write(cert, ck.cert.pem())?;
63	+	write_private(key, ck.signing_key.serialize_pem().as_bytes())?;
64	+	Ok(true)
65	+	}
66	+
67	+	fn write_private(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
68	+	fs::write(path, bytes)?;
69	+	#[cfg(unix)]
70	+	{
71	+	use std::os::unix::fs::PermissionsExt;
72	+	fs::set_permissions(path, fs::Permissions::from_mode(0o600))?;
73	+	}
74	+	Ok(())
75	+	}
76	+
77	+	#[cfg(test)]
78	+	mod tests {
79	+	use super::*;
80	+
81	+	#[test]
82	+	fn identity_is_created_once_and_reloaded() {
83	+	let dir = tempfile::tempdir().unwrap();
84	+	let a = ensure_identity(dir.path(), "Test", "https://hub.example:7343").unwrap();
85	+	let b = ensure_identity(dir.path(), "Other", "https://elsewhere").unwrap();
86	+	assert_eq!(a.key, b.key);
87	+	assert_eq!(a.identity.email, "[email protected]:7343");
88	+	assert!(dir.path().join(SECRET_FILE).exists());
89	+	}
90	+
91	+	#[test]
92	+	fn self_signed_certificate() {
93	+	let dir = tempfile::tempdir().unwrap();
94	+	let cert = dir.path().join("keys/tls.crt");
95	+	let key = dir.path().join("keys/tls.key");
96	+	assert!(ensure_self_signed(&cert, &key, "https://earth.andymccall.xyz:7343").unwrap());
97	+	assert!(!ensure_self_signed(&cert, &key, "https://earth.andymccall.xyz:7343").unwrap());
98	+	assert!(fs::read_to_string(&cert).unwrap().contains("BEGIN CERTIFICATE"));
99	+	}
100	+	}

1	+	//! Oxygenhub: a forge for Oxygen repositories (`docs/spec.md`).
2	+	//!
3	+	//! One process: an axum router serving pages, the JSON API and the wire
4	+	//! protocol; SQLite for hub state; repositories as bare Oxygen stores.
5	+
6	+	pub mod api;
7	+	pub mod config;
8	+	pub mod db;
9	+	pub mod keys;
10	+	pub mod protocol;
11	+	pub mod render;
12	+	pub mod repos;
13	+	pub mod web;
14	+
15	+	use crate::config::Config;
16	+	use crate::repos::Repos;
17	+	use std::sync::Arc;
18	+
19	+	/// Everything a request handler can reach.
20	+	pub struct App {
21	+	pub config: Config,
22	+	pub db: db::Pool,
23	+	pub repos: Arc<Repos>,
24	+	pub server: Arc<oxy_server::Server>,
25	+	pub hub_key: keys::HubKey,
26	+	pub started: std::time::Instant,
27	+	}
28	+
29	+	pub type Shared = Arc<App>;
30	+
31	+	/// Open the data directory and build the application state. `init` must
32	+	/// have run once; `serve` and the tests call this.
33	+	pub async fn build(config: Config) -> anyhow::Result<Shared> {
34	+	std::fs::create_dir_all(config.repos_dir())?;
35	+	let db = db::open(&config.db_path()).await?;
36	+	let repos = Arc::new(Repos::new(config.repos_dir()));
37	+	let hub_key = keys::ensure_identity(&config.keys_dir(), &config.site.name, config.base_url())?;
38	+	let backend = protocol::HubBackend::new(repos.clone(), db.clone(), config.auth.push_tokens.clone(), tokio::runtime::Handle::current());
39	+	let server = oxy_server::Server::new(backend);
40	+	Ok(Arc::new(App { config, db, repos, server, hub_key, started: std::time::Instant::now() }))
41	+	}
42	+
43	+	/// The full router: pages, API, protocol and static assets.
44	+	pub fn router(app: Shared) -> axum::Router {
45	+	web::router(app)
46	+	}
47	+
48	+	/// Serve on the configured addresses until the process is told to stop.
49	+	pub async fn serve(app: Shared) -> anyhow::Result<()> {
50	+	let router = router(app.clone());
51	+	let http = app.config.bind_addr()?;
52	+	let https = app.config.tls_bind_addr()?;
53	+	if http.is_none() && https.is_none() {
54	+	anyhow::bail!("nothing to bind: set server.bind or server.tls_bind");
55	+	}
56	+	let mut tasks = tokio::task::JoinSet::new();
57	+	if let Some(addr) = http {
58	+	let listener = tokio::net::TcpListener::bind(addr).await?;
59	+	tracing::info!("http on {addr}");
60	+	let r = router.clone();
61	+	tasks.spawn(async move { axum::serve(listener, r).await.map_err(anyhow::Error::from) });
62	+	}
63	+	if let Some(addr) = https {
64	+	let _ = rustls::crypto::ring::default_provider().install_default();
65	+	let tls = axum_server::tls_rustls::RustlsConfig::from_pem_file(app.config.tls_cert(), app.config.tls_key())
66	+	.await
67	+	.map_err(\|e\| anyhow::anyhow!("loading TLS files: {e}"))?;
68	+	tracing::info!("https on {addr}");
69	+	let r = router.clone();
70	+	tasks.spawn(async move { axum_server::bind_rustls(addr, tls).serve(r.into_make_service()).await.map_err(anyhow::Error::from) });
71	+	}
72	+	tokio::select! {
73	+	r = tasks.join_next() => { r.transpose()?.transpose()?; Ok(()) }
74	+	_ = tokio::signal::ctrl_c() => { tracing::info!("stopping"); Ok(()) }
75	+	}
76	+	}

1	+	//! `oxygenhub`: `init`, `serve`, `admin`, `check` (hub spec §17.3).
2	+
3	+	use clap::{Parser, Subcommand};
4	+	use hub_api::Visibility;
5	+	use oxygenhub::config::Config;
6	+	use oxygenhub::repos::RepoName;
7	+	use oxygenhub::{db, keys};
8	+	use std::path::PathBuf;
9	+
10	+	#[derive(Parser)]
11	+	#[command(name = "oxygenhub", version, about = "A forge for Oxygen repositories")]
12	+	struct Cli {
13	+	/// The data directory (hub spec §3.2)
14	+	#[arg(long, global = true, env = "OXYHUB_DATA", default_value = "data")]
15	+	data: PathBuf,
16	+	#[command(subcommand)]
17	+	cmd: Cmd,
18	+	}
19	+
20	+	#[derive(Subcommand)]
21	+	enum Cmd {
22	+	/// Create the data directory, keys, database and a default hub.toml
23	+	Init {
24	+	/// What links and clone URLs start with
25	+	#[arg(long)]
26	+	base_url: Option<String>,
27	+	/// Generate a self-signed TLS certificate (developer edition)
28	+	#[arg(long)]
29	+	self_signed: bool,
30	+	},
31	+	/// Run the hub
32	+	Serve,
33	+	/// Offline administration
34	+	Admin {
35	+	#[command(subcommand)]
36	+	cmd: AdminCmd,
37	+	},
38	+	/// Verify every repository's objects and signatures
39	+	Check,
40	+	}
41	+
42	+	#[derive(Subcommand)]
43	+	enum AdminCmd {
44	+	/// Repositories
45	+	Repo {
46	+	#[command(subcommand)]
47	+	cmd: RepoCmd,
48	+	},
49	+	}
50	+
51	+	#[derive(Subcommand)]
52	+	enum RepoCmd {
53	+	/// Create an empty repository OWNER/NAME
54	+	Create {
55	+	slug: String,
56	+	#[arg(long, default_value = "")]
57	+	description: String,
58	+	#[arg(long, default_value = "public")]
59	+	visibility: String,
60	+	/// Bind to this repository id now (32 hex characters, from `.oxy/id`);
61	+	/// otherwise the first push binds it
62	+	#[arg(long)]
63	+	id: Option<String>,
64	+	},
65	+	/// List repositories
66	+	List,
67	+	/// Move a repository to the trash
68	+	Delete { slug: String },
69	+	/// Change the description, default bookmark or visibility
70	+	Set {
71	+	slug: String,
72	+	#[arg(long)]
73	+	description: Option<String>,
74	+	#[arg(long)]
75	+	default_bookmark: Option<String>,
76	+	#[arg(long)]
77	+	visibility: Option<String>,
78	+	},
79	+	}
80	+
81	+	#[tokio::main]
82	+	async fn main() -> anyhow::Result<()> {
83	+	tracing_subscriber::fmt()
84	+	.with_env_filter(tracing_subscriber::EnvFilter::from_default_env().add_directive("oxygenhub=info".parse()?))
85	+	.init();
86	+	let cli = Cli::parse();
87	+	match cli.cmd {
88	+	Cmd::Init { base_url, self_signed } => init(&cli.data, base_url, self_signed).await,
89	+	Cmd::Serve => {
90	+	let config = Config::load(&cli.data)?;
91	+	let app = oxygenhub::build(config).await?;
92	+	oxygenhub::serve(app).await
93	+	}
94	+	Cmd::Admin { cmd: AdminCmd::Repo { cmd } } => {
95	+	let config = Config::load(&cli.data)?;
96	+	let app = oxygenhub::build(config).await?;
97	+	repo_admin(&app, cmd).await
98	+	}
99	+	Cmd::Check => {
100	+	let config = Config::load(&cli.data)?;
101	+	let app = oxygenhub::build(config).await?;
102	+	check(&app).await
103	+	}
104	+	}
105	+	}
106	+
107	+	async fn init(data: &PathBuf, base_url: Option<String>, self_signed: bool) -> anyhow::Result<()> {
108	+	std::fs::create_dir_all(data)?;
109	+	let toml_path = data.join("hub.toml");
110	+	if !toml_path.exists() {
111	+	let base = base_url.clone().unwrap_or_else(\|\| "http://127.0.0.1:7300".into());
112	+	let mut text = String::from("# Oxygenhub configuration (docs/spec.md section 17.1)\n\n[site]\nname = \"Oxygenhub\"\n\n[server]\nbind = \"127.0.0.1:7300\"\n");
113	+	if self_signed {
114	+	text.push_str("tls_bind = \"0.0.0.0:7343\"\n");
115	+	}
116	+	text.push_str(&format!("base_url = \"{base}\"\n\n[tls]\nself_signed = {self_signed}\n\n[auth]\n# Bearer tokens allowed to push until accounts exist.\npush_tokens = []\n"));
117	+	std::fs::write(&toml_path, text)?;
118	+	println!("wrote {}", toml_path.display());
119	+	}
120	+	let mut config = Config::load(data)?;
121	+	if let Some(b) = base_url {
122	+	config.server.base_url = b;
123	+	}
124	+	let app = oxygenhub::build(config).await?;
125	+	println!("hub key {}", app.hub_key.key.to_hex());
126	+	if (self_signed \|\| app.config.tls.self_signed)
127	+	&& keys::ensure_self_signed(&app.config.tls_cert(), &app.config.tls_key(), app.config.base_url())?
128	+	{
129	+	println!("wrote self-signed certificate {}", app.config.tls_cert().display());
130	+	}
131	+	println!("data directory {} is ready", data.display());
132	+	Ok(())
133	+	}
134	+
135	+	async fn repo_admin(app: &oxygenhub::Shared, cmd: RepoCmd) -> anyhow::Result<()> {
136	+	match cmd {
137	+	RepoCmd::Create { slug, description, visibility, id } => {
138	+	let name = RepoName::parse(&slug).ok_or_else(\|\| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
139	+	let visibility = Visibility::parse(&visibility).ok_or_else(\|\| anyhow::anyhow!("visibility is public, internal or private"))?;
140	+	let id = match id {
141	+	Some(h) => {
142	+	let bytes = hex::decode(h.trim()).ok().and_then(\|v\| <[u8; 16]>::try_from(v).ok());
143	+	Some(bytes.ok_or_else(\|\| anyhow::anyhow!("--id takes 32 hex characters"))?)
144	+	}
145	+	None => None,
146	+	};
147	+	if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() {
148	+	anyhow::bail!("{name} already exists");
149	+	}
150	+	app.repos.create(&name, id)?;
151	+	db::repos::create(&app.db, &name.owner, &name.name, &description, visibility).await?;
152	+	println!("created {name}: oxy clone {}/{name}", app.config.base_url());
153	+	}
154	+	RepoCmd::List => {
155	+	for r in db::repos::list(&app.db).await? {
156	+	println!("{:<40} {:<8} {}", r.slug(), r.visibility, r.description);
157	+	}
158	+	}
159	+	RepoCmd::Delete { slug } => {
160	+	let name = RepoName::parse(&slug).ok_or_else(\|\| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
161	+	let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(\|\| anyhow::anyhow!("{name} does not exist"))?;
162	+	let dest = app.repos.trash(&name)?;
163	+	db::repos::delete(&app.db, row.id).await?;
164	+	println!("moved {name} to {}", dest.display());
165	+	}
166	+	RepoCmd::Set { slug, description, default_bookmark, visibility } => {
167	+	let name = RepoName::parse(&slug).ok_or_else(\|\| anyhow::anyhow!("{slug:?} is not a valid owner/name"))?;
168	+	let row = db::repos::get(&app.db, &name.owner, &name.name).await?.ok_or_else(\|\| anyhow::anyhow!("{name} does not exist"))?;
169	+	if let Some(d) = description {
170	+	db::repos::set_description(&app.db, row.id, &d).await?;
171	+	}
172	+	if let Some(b) = default_bookmark {
173	+	db::repos::set_default_bookmark(&app.db, row.id, &b).await?;
174	+	}
175	+	if let Some(v) = visibility {
176	+	let v = Visibility::parse(&v).ok_or_else(\|\| anyhow::anyhow!("visibility is public, internal or private"))?;
177	+	db::repos::set_visibility(&app.db, row.id, v).await?;
178	+	}
179	+	println!("updated {name}");
180	+	}
181	+	}
182	+	Ok(())
183	+	}
184	+
185	+	async fn check(app: &oxygenhub::Shared) -> anyhow::Result<()> {
186	+	let mut problems = 0;
187	+	for r in db::repos::list(&app.db).await? {
188	+	let name = RepoName::new(&r.owner, &r.name).unwrap();
189	+	let report = app.repos.read(&name, oxygenhub::repos::view::verification).await;
190	+	match report {
191	+	Ok(v) => {
192	+	println!(
193	+	"{:<40} {} changes, {} signed, {} sealed, {} unsigned, {} invalid",
194	+	name,
195	+	v.total,
196	+	v.signed,
197	+	v.sealed,
198	+	v.unsigned,
199	+	v.invalid.len()
200	+	);
201	+	problems += v.invalid.len();
202	+	}
203	+	Err(e) => {
204	+	println!("{name:<40} ERROR {e}");
205	+	problems += 1;
206	+	}
207	+	}
208	+	}
209	+	if problems > 0 {
210	+	anyhow::bail!("{problems} problem(s)");
211	+	}
212	+	Ok(())
213	+	}

1	+	# This file is automatically @generated by Cargo.
2	+	# It is not intended for manual editing.
3	+	version = 4
4	+
5	+	[[package]]
6	+	name = "adler2"
7	+	version = "2.0.1"
8	+	source = "registry+https://github.com/rust-lang/crates.io-index"
9	+	checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
10	+
11	+	[[package]]
12	+	name = "aho-corasick"
13	+	version = "1.1.5"
14	+	source = "registry+https://github.com/rust-lang/crates.io-index"
15	+	checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
16	+	dependencies = [
17	+	"memchr",
18	+	]
19	+
20	+	[[package]]
21	+	name = "allocator-api2"
22	+	version = "0.2.21"
23	+	source = "registry+https://github.com/rust-lang/crates.io-index"
24	+	checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
25	+
26	+	[[package]]
27	+	name = "ammonia"
28	+	version = "4.2.0"
29	+	source = "registry+https://github.com/rust-lang/crates.io-index"
30	+	checksum = "3f7ed3ac4252be4d3e36fb589ed5659356842587b21a31596a9dc89d3b2f5e2a"
31	+	dependencies = [
32	+	"cssparser",
33	+	"html5ever",
34	+	"maplit",
35	+	"url",
36	+	]
37	+
38	+	[[package]]
39	+	name = "anstream"
40	+	version = "1.0.0"

	1	+	[general]
	2	+	dirs = ["../../templates"]

1	+	//! The wire protocol, embedded (hub spec §3.3, §5.4): `oxy-server`'s
2	+	//! `Server` over a backend that resolves `owner/name`, applies visibility
3	+	//! and push tokens, and records pushes.
4	+
5	+	use crate::repos::{RepoName, Repos};
6	+	use crate::{db, Shared};
7	+	use axum::body::Bytes;
8	+	use axum::extract::{Path, State};
9	+	use axum::http::{HeaderMap, Method, StatusCode};
10	+	use axum::response::{IntoResponse, Response};
11	+	use hub_api::Visibility;
12	+	use oxy_core::protocol::RefResult;
13	+	use oxy_core::repo::Repo;
14	+	use oxy_server::{Access, Backend, Endpoint, Failure};
15	+	use std::sync::Arc;
16	+
17	+	pub struct HubBackend {
18	+	repos: Arc<Repos>,
19	+	pool: db::Pool,
20	+	push_tokens: Vec<String>,
21	+	runtime: tokio::runtime::Handle,
22	+	}
23	+
24	+	impl HubBackend {
25	+	pub fn new(repos: Arc<Repos>, pool: db::Pool, push_tokens: Vec<String>, runtime: tokio::runtime::Handle) -> HubBackend {
26	+	HubBackend { repos, pool, push_tokens, runtime }
27	+	}
28	+
29	+	fn row(&self, name: &RepoName) -> Result<db::repos::RepoRow, Failure> {
30	+	let pool = self.pool.clone();
31	+	let (owner, repo) = (name.owner.clone(), name.name.clone());
32	+	let row = tokio::task::block_in_place(\|\| self.runtime.block_on(db::repos::get(&pool, &owner, &repo)));
33	+	match row {
34	+	Ok(Some(r)) => Ok(r),
35	+	Ok(None) => Err(not_found()),
36	+	Err(e) => Err(Failure(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())),
37	+	}
38	+	}
39	+
40	+	fn has_push_token(&self, headers: &HeaderMap) -> bool {

1	+	//! Diff rendering: `oxy`'s per-file hunks become unified rows with
2	+	//! context, and two snapshots become per-file hunks.
3	+
4	+	use oxy_core::repo::{DiffHunk, FileDiff};
5	+	use oxy_core::state::{FileContent, Snapshot};
6	+	use similar::{Algorithm, DiffOp};
7	+	use std::collections::BTreeMap;
8	+
9	+	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
10	+	pub enum Kind {
11	+	Context,
12	+	Add,
13	+	Del,
14	+	/// Elided lines between hunks.
15	+	Gap,
16	+	}
17	+
18	+	#[derive(Clone, Debug, PartialEq, Eq)]
19	+	pub struct Line {
20	+	pub kind: Kind,
21	+	pub old_no: Option<u32>,
22	+	pub new_no: Option<u32>,
23	+	/// Raw text, not escaped.
24	+	pub text: String,
25	+	}
26	+
27	+	impl Kind {
28	+	pub fn class(self) -> &'static str {
29	+	match self {
30	+	Kind::Context => "ctx",
31	+	Kind::Add => "add",
32	+	Kind::Del => "del",
33	+	Kind::Gap => "gap",
34	+	}
35	+	}
36	+
37	+	pub fn sign(self) -> &'static str {
38	+	match self {
39	+	Kind::Context => " ",
40	+	Kind::Add => "+",

1	+	//! Lane layout for the history graph (hub spec §6.7): each change takes a
2	+	//! lane, its first dependency continues that lane, other dependencies
3	+	//! take free lanes, so edges flow downward from a change to what it
4	+	//! depends on. Ported from the VS Code extension's webview.
5	+
6	+	use std::collections::HashMap;
7	+
8	+	/// A row of the graph: the change's lane and the edges to the rows below.
9	+	#[derive(Clone, Debug, PartialEq, Eq)]
10	+	pub struct Row {
11	+	pub lane: usize,
12	+	/// `(from_lane, to_lane)` for each dependency drawn from this row.
13	+	pub edges: Vec<(usize, usize)>,
14	+	/// Lanes that pass through this row without touching it.
15	+	pub through: Vec<usize>,
16	+	}
17	+
18	+	/// `changes` newest first as `(hash, deps)`. Dependencies outside the list
19	+	/// end their lane at the bottom.
20	+	pub fn layout(changes: &[(String, Vec<String>)]) -> Vec<Row> {
21	+	let mut active: Vec<Option<String>> = Vec::new();
22	+	let mut rows = Vec::with_capacity(changes.len());
23	+	let known: std::collections::HashSet<&str> = changes.iter().map(\|(h, _)\| h.as_str()).collect();
24	+	let mut lanes: HashMap<String, usize> = HashMap::new();
25	+	for (hash, deps) in changes {
26	+	let lane = match active.iter().position(\|a\| a.as_deref() == Some(hash)) {
27	+	Some(l) => l,
28	+	None => match active.iter().position(\|a\| a.is_none()) {
29	+	Some(l) => {
30	+	active[l] = Some(hash.clone());
31	+	l
32	+	}
33	+	None => {
34	+	active.push(Some(hash.clone()));
35	+	active.len() - 1
36	+	}
37	+	},
38	+	};
39	+	lanes.insert(hash.clone(), lane);
40	+	let mut edges = Vec::new();
41	+	let deps: Vec<&String> = deps.iter().filter(\|d\| known.contains(d.as_str())).collect();
42	+	active[lane] = None;
43	+	for (i, d) in deps.iter().enumerate() {
44	+	let target = match active.iter().position(\|a\| a.as_deref() == Some(d.as_str())) {
45	+	Some(l) => l,
46	+	None => {
47	+	let l = if i == 0 && active[lane].is_none() {
48	+	lane
49	+	} else {
50	+	match active.iter().position(\|a\| a.is_none()) {
51	+	Some(l) => l,
52	+	None => {
53	+	active.push(None);
54	+	active.len() - 1
55	+	}
56	+	}
57	+	};
58	+	active[l] = Some((*d).clone());
59	+	l
60	+	}
61	+	};
62	+	edges.push((lane, target));
63	+	}
64	+	let through: Vec<usize> = active
65	+	.iter()
66	+	.enumerate()
67	+	.filter(\|(l, a)\| a.is_some() && l != lane && !edges.iter().any(\|e\| e.1 == l))
68	+	.map(\|(l, _)\| l)
69	+	.collect();
70	+	rows.push(Row { lane, edges, through });
71	+	// Trim trailing free lanes so the graph stays narrow.
72	+	while active.last().is_some_and(\|a\| a.is_none()) {
73	+	active.pop();
74	+	}
75	+	}
76	+	rows
77	+	}
78	+
79	+	pub fn width(rows: &[Row]) -> usize {
80	+	rows.iter()
81	+	.map(\|r\| r.lane.max(r.edges.iter().map(\|e\| e.1).max().unwrap_or(0)).max(r.through.iter().copied().max().unwrap_or(0)))
82	+	.max()
83	+	.map(\|m\| m + 1)
84	+	.unwrap_or(1)
85	+	}
86	+
87	+	#[cfg(test)]
88	+	mod tests {
89	+	use super::*;
90	+
91	+	fn c(h: &str, deps: &[&str]) -> (String, Vec<String>) {
92	+	(h.into(), deps.iter().map(\|d\| d.to_string()).collect())
93	+	}
94	+
95	+	#[test]
96	+	fn linear_history_is_one_lane() {
97	+	let rows = layout(&[c("c", &["b"]), c("b", &["a"]), c("a", &[])]);
98	+	assert!(rows.iter().all(\|r\| r.lane == 0), "{rows:?}");
99	+	assert_eq!(rows[0].edges, vec![(0, 0)]);
100	+	assert_eq!(width(&rows), 1);
101	+	}
102	+
103	+	#[test]
104	+	fn independent_changes_take_lanes_and_rejoin() {
105	+	// d depends on b and c, which both depend on a: a diamond.
106	+	let rows = layout(&[c("d", &["b", "c"]), c("b", &["a"]), c("c", &["a"]), c("a", &[])]);
107	+	assert_eq!(rows[0].lane, 0);
108	+	assert_eq!(rows[0].edges, vec![(0, 0), (0, 1)]);
109	+	assert_eq!(rows[1].lane, 0);
110	+	assert_eq!(rows[2].lane, 1);
111	+	assert_eq!(rows[2].edges, vec![(1, 0)], "c joins a's lane");
112	+	assert_eq!(rows[3].lane, 0);
113	+	assert_eq!(width(&rows), 2);
114	+	// Two heads with no common change: two lanes throughout.
115	+	let rows = layout(&[c("x", &[]), c("y", &[])]);
116	+	assert_eq!((rows[0].lane, rows[1].lane), (0, 0), "a lane is reused once its change is drawn");
117	+	}
118	+	}

1	+	//! Syntax highlighting with syntect, emitted as classed spans so the
2	+	//! stylesheet colours them in both themes (`templates/style.css`).
3	+
4	+	use std::sync::OnceLock;
5	+	use syntect::html::{ClassStyle, ClassedHTMLGenerator};
6	+	use syntect::parsing::SyntaxSet;
7	+	use syntect::util::LinesWithEndings;
8	+
9	+	fn syntaxes() -> &'static SyntaxSet {
10	+	static SET: OnceLock<SyntaxSet> = OnceLock::new();
11	+	SET.get_or_init(SyntaxSet::load_defaults_newlines)
12	+	}
13	+
14	+	/// The language name shown for a file, if syntect knows the extension.
15	+	pub fn language(path: &str) -> Option<&'static str> {
16	+	let ext = path.rsplit('.').next().unwrap_or("");
17	+	let name = path.rsplit('/').next().unwrap_or(path);
18	+	let set = syntaxes();
19	+	set.find_syntax_by_extension(ext)
20	+	.or_else(\|\| set.find_syntax_by_extension(name))
21	+	.or_else(\|\| match name {
22	+	"Makefile" \| "GNUmakefile" => set.find_syntax_by_name("Makefile"),
23	+	"Dockerfile" => set.find_syntax_by_name("Dockerfile"),
24	+	_ => None,
25	+	})
26	+	.map(\|s\| s.name.as_str())
27	+	}
28	+
29	+	/// Highlight `text`, returning one HTML fragment per line (no trailing
30	+	/// newline); plain escaped lines when the language is unknown.
31	+	pub fn lines(path: &str, text: &str) -> Vec<String> {
32	+	let set = syntaxes();
33	+	let ext = path.rsplit('.').next().unwrap_or("");
34	+	let name = path.rsplit('/').next().unwrap_or(path);
35	+	let syntax = set.find_syntax_by_extension(ext).or_else(\|\| set.find_syntax_by_extension(name)).or_else(\|\| match name {
36	+	"Makefile" \| "GNUmakefile" => set.find_syntax_by_name("Makefile"),
37	+	_ => None,
38	+	});
39	+	let Some(syntax) = syntax else {
40	+	return text.lines().map(super::escape).collect();
41	+	};
42	+	let mut generator = ClassedHTMLGenerator::new_with_class_style(syntax, set, ClassStyle::Spaced);
43	+	let mut out = Vec::new();
44	+	for line in LinesWithEndings::from(text) {
45	+	if generator.parse_html_for_line_which_includes_newline(line).is_err() {
46	+	return text.lines().map(super::escape).collect();
47	+	}
48	+	}
49	+	let html = generator.finalize();
50	+	// syntect emits the whole file with spans that may span lines; split
51	+	// on newlines and keep spans balanced per line.
52	+	let mut open: Vec<String> = Vec::new();
53	+	let mut raw_lines: Vec<&str> = html.split('\n').collect();
54	+	// syntect closes the outermost spans after the final newline; that
55	+	// segment holds no text and every span is balanced per line below.
56	+	if raw_lines.last().is_some_and(\|l\| l.replace("</span>", "").trim().is_empty()) {
57	+	raw_lines.pop();
58	+	}
59	+	for raw in raw_lines {
60	+	let mut line = String::new();
61	+	for tag in &open {
62	+	line.push_str(tag);
63	+	}
64	+	line.push_str(raw);
65	+	// Track spans opened and closed on this line.
66	+	let mut i = 0;
67	+	while let Some(p) = raw[i..].find('<') {
68	+	let start = i + p;
69	+	let Some(end_rel) = raw[start..].find('>') else { break };
70	+	let tag = &raw[start..start + end_rel + 1];
71	+	if tag.starts_with("</") {
72	+	open.pop();
73	+	} else if tag.starts_with("<span") {
74	+	open.push(tag.to_string());
75	+	}
76	+	i = start + end_rel + 1;
77	+	}
78	+	for _ in &open {
79	+	line.push_str("</span>");
80	+	}
81	+	out.push(line);
82	+	}
83	+	out
84	+	}
85	+
86	+	#[cfg(test)]
87	+	mod tests {
88	+	use super::*;
89	+
90	+	#[test]
91	+	fn highlights_rust_and_falls_back() {
92	+	let l = lines("main.rs", "fn main() {\n let x = 1;\n}\n");
93	+	assert_eq!(l.len(), 3);
94	+	assert!(l[0].contains("<span class=\"source rust\">"), "{}", l[0]);
95	+	assert!(l[0].contains("storage type function"), "{}", l[0]);
96	+	assert!(l[1].ends_with("</span>"), "spans are balanced per line: {}", l[1]);
97	+	assert_eq!(lines("x.unknownext", "a<b\nc"), vec!["a<b", "c"]);
98	+	assert_eq!(language("a/b/lib.rs"), Some("Rust"));
99	+	assert_eq!(language("Makefile"), Some("Makefile"));
100	+	assert_eq!(language("blob.bin"), None);
101	+	}
102	+	}

1	+	//! Markdown to sanitised HTML: pulldown-cmark, then ammonia with an
2	+	//! allow-list (hub spec §15.2). Relative links and images are rebased on
3	+	//! `base`, so a README's `docs/x.md` opens in the hub.
4	+
5	+	use pulldown_cmark::{html, Event, Options, Parser, Tag};
6	+
7	+	/// `base_file` and `base_raw` are URL prefixes (ending in `/`) for links to
8	+	/// files and for images.
9	+	pub fn render(text: &str, base_file: &str, base_raw: &str) -> String {
10	+	let mut opts = Options::empty();
11	+	opts.insert(Options::ENABLE_TABLES);
12	+	opts.insert(Options::ENABLE_STRIKETHROUGH);
13	+	opts.insert(Options::ENABLE_TASKLISTS);
14	+	opts.insert(Options::ENABLE_FOOTNOTES);
15	+	opts.insert(Options::ENABLE_HEADING_ATTRIBUTES);
16	+	let parser = Parser::new_ext(text, opts).map(\|ev\| match ev {
17	+	Event::Start(Tag::Link { link_type, dest_url, title, id }) => {
18	+	Event::Start(Tag::Link { link_type, dest_url: rebase(&dest_url, base_file).into(), title, id })
19	+	}
20	+	Event::Start(Tag::Image { link_type, dest_url, title, id }) => {
21	+	Event::Start(Tag::Image { link_type, dest_url: rebase(&dest_url, base_raw).into(), title, id })
22	+	}
23	+	other => other,
24	+	});
25	+	let mut out = String::with_capacity(text.len() * 2);
26	+	html::push_html(&mut out, parser);
27	+	let mut builder = ammonia::Builder::default();
28	+	builder.add_generic_attributes(["id", "class"]);
29	+	builder.add_tag_attributes("input", ["type", "checked", "disabled"]);
30	+	builder.add_tags(["input"]);
31	+	builder.link_rel(Some("noopener noreferrer"));
32	+	builder.clean(&out).to_string()
33	+	}
34	+
35	+	/// Leave absolute URLs, fragments and mail links alone; rebase the rest.
36	+	fn rebase(url: &str, base: &str) -> String {
37	+	if url.starts_with('#') \|\| url.contains("://") \|\| url.starts_with("mailto:") \|\| url.starts_with('/') \|\| url.starts_with("data:") {
38	+	return url.to_string();
39	+	}
40	+	let url = url.strip_prefix("./").unwrap_or(url);
41	+	format!("{base}{url}")
42	+	}
43	+
44	+	#[cfg(test)]
45	+	mod tests {
46	+	use super::*;
47	+
48	+	#[test]
49	+	fn renders_and_sanitises() {
50	+	let html = render(
51	+	"# Hi\n\nSee [docs](docs/x.md) and ![i](img.png) <script>alert(1)</script>\n\n- [ ] task\n",
52	+	"/a/b/file/main/",
53	+	"/a/b/file/main/",
54	+	);
55	+	assert!(html.contains("<h1>Hi</h1>"));
56	+	assert!(html.contains("href=\"/a/b/file/main/docs/x.md\""));
57	+	assert!(html.contains("src=\"/a/b/file/main/img.png\""));
58	+	assert!(!html.contains("<script"));
59	+	assert!(html.contains("type=\"checkbox\""));
60	+	assert!(render("[x](https://e.com) [y](#frag)", "/p/", "/p/").contains("href=\"https://e.com\""));
61	+	}
62	+	}

1	+	//! Rendering helpers with no knowledge of routes: Markdown, syntax
2	+	//! highlighting, diffs, the history graph, and human times. Each is pure
3	+	//! and unit tested.
4	+
5	+	pub mod diff;
6	+	pub mod graph;
7	+	pub mod highlight;
8	+	pub mod markdown;
9	+	pub mod time;
10	+
11	+	/// HTML-escape text for insertion into element content or attributes.
12	+	pub fn escape(s: &str) -> String {
13	+	let mut out = String::with_capacity(s.len());
14	+	for c in s.chars() {
15	+	match c {
16	+	'&' => out.push_str("&"),
17	+	'<' => out.push_str("<"),
18	+	'>' => out.push_str(">"),
19	+	'"' => out.push_str("""),
20	+	'\'' => out.push_str("'"),
21	+	_ => out.push(c),
22	+	}
23	+	}
24	+	out
25	+	}
26	+
27	+	/// `1.2 KiB`, `3.4 MiB`, `512 B`.
28	+	pub fn bytes(n: u64) -> String {
29	+	const UNITS: [&str; 5] = ["B", "KiB", "MiB", "GiB", "TiB"];
30	+	let mut v = n as f64;
31	+	let mut i = 0;
32	+	while v >= 1024.0 && i < UNITS.len() - 1 {
33	+	v /= 1024.0;
34	+	i += 1;
35	+	}
36	+	if i == 0 {
37	+	format!("{n} B")
38	+	} else {
39	+	format!("{v:.1} {}", UNITS[i])
40	+	}
41	+	}
42	+
43	+	#[cfg(test)]
44	+	mod tests {
45	+	use super::*;
46	+
47	+	#[test]
48	+	fn escaping_and_sizes() {
49	+	assert_eq!(escape("<a href=\"x\">&'"), "<a href="x">&'");
50	+	assert_eq!(bytes(512), "512 B");
51	+	assert_eq!(bytes(1536), "1.5 KiB");
52	+	assert_eq!(bytes(5 << 20), "5.0 MiB");
53	+	}
54	+	}

1	+	//! Times as people read them: relative ("3 hours ago") with the absolute
2	+	//! form for a tooltip.
3	+
4	+	use time::format_description::well_known::Rfc3339;
5	+	use time::OffsetDateTime;
6	+
7	+	/// `just now`, `5 minutes ago`, `3 days ago`, `2 years ago`.
8	+	pub fn ago(when_ms: u64, now_ms: u64) -> String {
9	+	if when_ms == 0 {
10	+	return "unknown".into();
11	+	}
12	+	if when_ms > now_ms {
13	+	return "in the future".into();
14	+	}
15	+	let s = (now_ms - when_ms) / 1000;
16	+	let (n, unit) = if s < 45 {
17	+	return "just now".into();
18	+	} else if s < 90 {
19	+	(1, "minute")
20	+	} else if s < 3600 {
21	+	(s / 60, "minute")
22	+	} else if s < 86_400 {
23	+	(s / 3600, "hour")
24	+	} else if s < 86_400 * 30 {
25	+	(s / 86_400, "day")
26	+	} else if s < 86_400 * 365 {
27	+	(s / (86_400 * 30), "month")
28	+	} else {
29	+	(s / (86_400 * 365), "year")
30	+	};
31	+	format!("{n} {unit}{} ago", if n == 1 { "" } else { "s" })
32	+	}
33	+
34	+	/// `2026-09-27 17:02 UTC`.
35	+	pub fn absolute(when_ms: u64) -> String {
36	+	match OffsetDateTime::from_unix_timestamp((when_ms / 1000) as i64) {
37	+	Ok(t) => {
38	+	let f = time::macros::format_description!("[year]-[month]-[day] [hour]:[minute] UTC");
39	+	t.format(&f).unwrap_or_default()
40	+	}
41	+	Err(_) => String::new(),
42	+	}
43	+	}
44	+
45	+	pub fn rfc3339(when_ms: u64) -> String {
46	+	OffsetDateTime::from_unix_timestamp((when_ms / 1000) as i64).ok().and_then(\|t\| t.format(&Rfc3339).ok()).unwrap_or_default()
47	+	}
48	+
49	+	#[cfg(test)]
50	+	mod tests {
51	+	use super::*;
52	+
53	+	#[test]
54	+	fn relative() {
55	+	let now = 1_800_000_000_000;
56	+	assert_eq!(ago(now - 10_000, now), "just now");
57	+	assert_eq!(ago(now - 60_000, now), "1 minute ago");
58	+	assert_eq!(ago(now - 5 * 60_000, now), "5 minutes ago");
59	+	assert_eq!(ago(now - 3 * 3_600_000, now), "3 hours ago");
60	+	assert_eq!(ago(now - 2 * 86_400_000, now), "2 days ago");
61	+	assert_eq!(ago(now - 400 * 86_400_000, now), "1 year ago");
62	+	assert_eq!(ago(0, now), "unknown");
63	+	assert_eq!(absolute(1_758_990_120_000), "2025-09-27 16:22 UTC");
64	+	}
65	+	}

1	+	//! Repositories on disk (hub spec §4): naming, the registry of open
2	+	//! handles and their locks, and the page-ready views built from `oxy-core`.
3	+	//!
4	+	//! Every `oxy-core` call is synchronous and runs on the blocking pool under
5	+	//! the repository's lock (§16.2): pushes and other writes take the write
6	+	//! half, page reads the read half.
7	+
8	+	pub mod names;
9	+	pub mod view;
10	+
11	+	pub use names::RepoName;
12	+
13	+	use oxy_core::repo::Repo;
14	+	use std::collections::HashMap;
15	+	use std::path::{Path, PathBuf};
16	+	use std::sync::{Arc, Mutex};
17	+	use tokio::sync::RwLock;
18	+
19	+	/// Where repositories live and how their access is serialised.
20	+	pub struct Repos {
21	+	root: PathBuf,
22	+	locks: Mutex<HashMap<String, Arc<RwLock<()>>>>,
23	+	}
24	+
25	+	#[derive(Debug, thiserror::Error)]
26	+	pub enum RepoError {
27	+	#[error("no such repository")]
28	+	NotFound,
29	+	#[error("{0} already exists")]
30	+	Exists(String),
31	+	#[error("{0}")]
32	+	Oxy(#[from] oxy_core::repo::RepoError),
33	+	#[error("{0}")]
34	+	Store(#[from] oxy_core::store::StoreError),
35	+	#[error("{0}")]
36	+	Io(#[from] std::io::Error),
37	+	}
38	+
39	+	impl Repos {
40	+	pub fn new(root: PathBuf) -> Repos {
41	+	Repos { root, locks: Mutex::new(HashMap::new()) }
42	+	}
43	+
44	+	pub fn root(&self) -> &Path {
45	+	&self.root
46	+	}
47	+
48	+	/// `<root>/<owner>/<name>`, holding `.oxy/` and nothing else.
49	+	pub fn dir(&self, name: &RepoName) -> PathBuf {
50	+	self.root.join(&name.owner).join(&name.name)
51	+	}
52	+
53	+	pub fn exists(&self, name: &RepoName) -> bool {
54	+	self.dir(name).join(oxy_core::repo::OXY_DIR).is_dir()
55	+	}
56	+
57	+	/// Open a hosted repository; it is always bare.
58	+	pub fn open(&self, name: &RepoName) -> Result<Repo, RepoError> {
59	+	if !self.exists(name) {
60	+	return Err(RepoError::NotFound);
61	+	}
62	+	Ok(Repo::open(&self.dir(name))?)
63	+	}
64	+
65	+	/// Create an empty bare repository. With no `id` it is unbound: the
66	+	/// first push binds it to the pusher's repository id, so an existing
67	+	/// repository keeps its identity when it moves here (hub spec §4.1).
68	+	pub fn create(&self, name: &RepoName, id: Option<[u8; 16]>) -> Result<Repo, RepoError> {
69	+	let dir = self.dir(name);
70	+	if dir.exists() {
71	+	return Err(RepoError::Exists(name.to_string()));
72	+	}
73	+	Ok(match id {
74	+	Some(id) => Repo::init_bare_with_id(&dir, id)?,
75	+	None => Repo::init_bare_unbound(&dir)?,
76	+	})
77	+	}
78	+
79	+	/// Move a repository to the trash (hub spec §4.1); a job empties it later.
80	+	pub fn trash(&self, name: &RepoName) -> Result<PathBuf, RepoError> {
81	+	let dir = self.dir(name);
82	+	if !dir.exists() {
83	+	return Err(RepoError::NotFound);
84	+	}
85	+	let trash = self.root.parent().unwrap_or(&self.root).join("trash").join(&name.owner);
86	+	std::fs::create_dir_all(&trash)?;
87	+	let dest = trash.join(format!("{}-{}", name.name, crate::db::now_ms()));
88	+	std::fs::rename(&dir, &dest)?;
89	+	Ok(dest)
90	+	}
91	+
92	+	fn lock(&self, name: &RepoName) -> Arc<RwLock<()>> {
93	+	self.locks.lock().unwrap().entry(name.to_string()).or_default().clone()
94	+	}
95	+
96	+	/// Hold the read lock while `f` runs on the blocking pool.
97	+	pub async fn read<T: Send + 'static>(
98	+	&self,
99	+	name: &RepoName,
100	+	f: impl FnOnce(&Repo) -> Result<T, RepoError> + Send + 'static,
101	+	) -> Result<T, RepoError> {
102	+	let lock = self.lock(name);
103	+	let guard = lock.read_owned().await;
104	+	let dir = self.dir(name);
105	+	let exists = self.exists(name);
106	+	tokio::task::spawn_blocking(move \|\| {
107	+	let _guard = guard;
108	+	if !exists {
109	+	return Err(RepoError::NotFound);
110	+	}
111	+	let repo = Repo::open(&dir)?;
112	+	f(&repo)
113	+	})
114	+	.await
115	+	.map_err(\|e\| RepoError::Io(std::io::Error::other(e)))?
116	+	}
117	+
118	+	/// Hold the write lock while `f` runs on the blocking pool.
119	+	pub async fn write<T: Send + 'static>(
120	+	&self,
121	+	name: &RepoName,
122	+	f: impl FnOnce(&Repo) -> Result<T, RepoError> + Send + 'static,
123	+	) -> Result<T, RepoError> {
124	+	let lock = self.lock(name);
125	+	let guard = lock.write_owned().await;
126	+	let dir = self.dir(name);
127	+	let exists = self.exists(name);
128	+	tokio::task::spawn_blocking(move \|\| {
129	+	let _guard = guard;
130	+	if !exists {
131	+	return Err(RepoError::NotFound);
132	+	}
133	+	let repo = Repo::open(&dir)?;
134	+	f(&repo)
135	+	})
136	+	.await
137	+	.map_err(\|e\| RepoError::Io(std::io::Error::other(e)))?
138	+	}
139	+
140	+	/// The write lock alone, for the protocol server, whose handler opens
141	+	/// the repository itself.
142	+	pub async fn write_guard(&self, name: &RepoName) -> tokio::sync::OwnedRwLockWriteGuard<()> {
143	+	self.lock(name).write_owned().await
144	+	}
145	+
146	+	pub async fn read_guard(&self, name: &RepoName) -> tokio::sync::OwnedRwLockReadGuard<()> {
147	+	self.lock(name).read_owned().await
148	+	}
149	+	}

1	+	//! Owner and repository names (hub spec §3.2) and the top-level path
2	+	//! segments no owner may take.
3	+
4	+	use std::fmt;
5	+
6	+	/// `owner/name`, both validated.
7	+	#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
8	+	pub struct RepoName {
9	+	pub owner: String,
10	+	pub name: String,
11	+	}
12	+
13	+	/// Top-level path segments reserved for the hub itself.
14	+	pub const RESERVED: &[&str] = &[
15	+	"api",
16	+	"static",
17	+	"login",
18	+	"logout",
19	+	"register",
20	+	"settings",
21	+	"explore",
22	+	"search",
23	+	"notifications",
24	+	"new",
25	+	"orgs",
26	+	"admin",
27	+	"style.css",
28	+	"favicon.ico",
29	+	"favicon.svg",
30	+	"health",
31	+	"assets",
32	+	".well-known",
33	+	];
34	+
35	+	/// `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`, not `.`/`..`, not ending in `.git`.
36	+	pub fn valid_segment(s: &str) -> bool {
37	+	let mut chars = s.chars();
38	+	let Some(first) = chars.next() else { return false };
39	+	if !first.is_ascii_alphanumeric() \|\| s.len() > 64 {
40	+	return false;
41	+	}
42	+	if !chars.all(\|c\| c.is_ascii_alphanumeric() \|\| matches!(c, '.' \| '_' \| '-')) {
43	+	return false;
44	+	}
45	+	s != "." && s != ".." && !s.ends_with(".git")
46	+	}
47	+
48	+	pub fn valid_owner(s: &str) -> bool {
49	+	valid_segment(s) && !RESERVED.contains(&s)
50	+	}
51	+
52	+	impl RepoName {
53	+	pub fn new(owner: &str, name: &str) -> Option<RepoName> {
54	+	if valid_owner(owner) && valid_segment(name) {
55	+	Some(RepoName { owner: owner.into(), name: name.into() })
56	+	} else {
57	+	None
58	+	}
59	+	}
60	+
61	+	/// `owner/name`.
62	+	pub fn parse(slug: &str) -> Option<RepoName> {
63	+	let (owner, name) = slug.split_once('/')?;
64	+	RepoName::new(owner, name)
65	+	}
66	+
67	+	pub fn url(&self) -> String {
68	+	format!("/{}/{}", self.owner, self.name)
69	+	}
70	+	}
71	+
72	+	impl fmt::Display for RepoName {
73	+	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
74	+	write!(f, "{}/{}", self.owner, self.name)
75	+	}
76	+	}
77	+
78	+	#[cfg(test)]
79	+	mod tests {
80	+	use super::*;
81	+
82	+	#[test]
83	+	fn names() {
84	+	assert!(RepoName::parse("andy/oxygen").is_some());
85	+	assert!(RepoName::parse("andy/oxy.gen-2_x").is_some());
86	+	assert!(RepoName::parse("api/x").is_none(), "reserved owner");
87	+	assert!(RepoName::parse("andy/x.git").is_none(), "mirror URL");
88	+	assert!(RepoName::parse("andy/..").is_none());
89	+	assert!(RepoName::parse(".andy/x").is_none());
90	+	assert!(RepoName::parse("andy/a b").is_none());
91	+	assert!(RepoName::parse("andy").is_none());
92	+	assert!(RepoName::parse(&format!("andy/{}", "a".repeat(65))).is_none());
93	+	assert_eq!(RepoName::parse("andy/oxygen").unwrap().url(), "/andy/oxygen");
94	+	}
95	+	}

1	+	//! Askama filters used by the templates. Numeric filters accept values or
2	+	//! references, since a template passes fields by reference and method
3	+	//! results by value.
4	+
5	+	use crate::render;
6	+
7	+	/// A number a template hands to a filter, by value or by reference.
8	+	pub trait Num: Copy {
9	+	fn as_u64(self) -> u64;
10	+	}
11	+
12	+	macro_rules! num {
13	+	($($t:ty),*) => {$(
14	+	impl Num for $t {
15	+	fn as_u64(self) -> u64 { if (self as i128) < 0 { 0 } else { self as u64 } }
16	+	}
17	+	impl Num for &$t {
18	+	fn as_u64(self) -> u64 { (*self).as_u64() }
19	+	}
20	+	)*};
21	+	}
22	+	num!(u64, i64, u32, i32, usize);
23	+
24	+	pub fn ago(ms: impl Num, _: &dyn askama::Values) -> askama::Result<String> {
25	+	Ok(render::time::ago(ms.as_u64(), crate::db::now_ms() as u64))
26	+	}
27	+
28	+	pub fn ago_i(ms: impl Num, v: &dyn askama::Values) -> askama::Result<String> {
29	+	ago(ms, v)
30	+	}
31	+
32	+	pub fn when(ms: impl Num, _: &dyn askama::Values) -> askama::Result<String> {
33	+	Ok(render::time::absolute(ms.as_u64()))
34	+	}
35	+
36	+	pub fn when_i(ms: impl Num, v: &dyn askama::Values) -> askama::Result<String> {
37	+	when(ms, v)
38	+	}
39	+
40	+	pub fn bytes(n: impl Num, _: &dyn askama::Values) -> askama::Result<String> {
41	+	Ok(render::bytes(n.as_u64()))
42	+	}
43	+
44	+	pub fn short(hash: &str, _: &dyn askama::Values) -> askama::Result<String> {
45	+	Ok(hash.chars().take(12).collect())
46	+	}
47	+
48	+	/// Markdown to HTML (already sanitised), marked safe for the template.
49	+	pub fn markdown(text: &str, _: &dyn askama::Values, base_file: &str, base_raw: &str) -> askama::Result<askama::filters::Safe<String>> {
50	+	Ok(askama::filters::Safe(render::markdown::render(text, base_file, base_raw)))
51	+	}
52	+
53	+	pub fn plural(n: impl Num, _: &dyn askama::Values, one: &str, many: &str) -> askama::Result<String> {
54	+	let n = n.as_u64();
55	+	Ok(format!("{n} {}", if n == 1 { one } else { many }))
56	+	}

1	+	//! History, change and compare pages.
2	+
3	+	use super::{filters, lookup, Error, Page, RepoShell, Shell};
4	+	use crate::render::{self, diff, graph};
5	+	use crate::repos::view;
6	+	use crate::Shared;
7	+	use askama::Template;
8	+	use axum::extract::{Path, Query, State};
9	+	use oxy_core::repo::FileDiff;
10	+	use serde::Deserialize;
11	+	use std::collections::BTreeMap;
12	+
13	+	const PAGE: usize = 50;
14	+
15	+	#[derive(Deserialize)]
16	+	pub struct HistoryQuery {
17	+	path: Option<String>,
18	+	offset: Option<usize>,
19	+	}
20	+
21	+	#[derive(Template)]
22	+	#[template(path = "history.html")]
23	+	pub struct HistoryPage {
24	+	shell: Shell,
25	+	repo: RepoShell,
26	+	h: view::History,
27	+	rows: Vec<graph::Row>,
28	+	lanes: usize,
29	+	}
30	+
31	+	pub async fn history(
32	+	State(app): State<Shared>,
33	+	Path((owner, name, r)): Path<(String, String, String)>,
34	+	Query(q): Query<HistoryQuery>,
35	+	) -> Result<Page<HistoryPage>, Error> {
36	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/changes/{r}"));
37	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
38	+	let spec = r.clone();
39	+	let path = q.path.clone().filter(\|p\| !p.is_empty());
40	+	let offset = q.offset.unwrap_or(0);
41	+	let h = app
42	+	.repos
43	+	.read(&repo, move \|repo\| {
44	+	let target = view::resolve(repo, &spec)?;
45	+	view::history(repo, target, path.as_deref(), offset, PAGE)
46	+	})
47	+	.await
48	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
49	+	let graph_input: Vec<(String, Vec<String>)> = h.entries.iter().map(\|c\| (c.hash.clone(), c.deps.clone())).collect();
50	+	let rows = graph::layout(&graph_input);
51	+	let lanes = graph::width(&rows);
52	+	Ok(Page(HistoryPage { shell, repo: RepoShell::new(&app, &row, "changes"), h, rows, lanes }))
53	+	}
54	+
55	+	/// A file's diff, rendered.
56	+	pub struct FileRows {
57	+	pub path: String,
58	+	pub from: Option<String>,
59	+	pub kind: String,
60	+	pub lines: Vec<diff::Line>,
61	+	pub added: usize,
62	+	pub removed: usize,
63	+	pub anchor: String,
64	+	}
65	+
66	+	pub fn render_files(files: &[FileDiff], bases: &BTreeMap<String, Vec<u8>>) -> Vec<FileRows> {
67	+	files
68	+	.iter()
69	+	.enumerate()
70	+	.map(\|(i, f)\| {
71	+	let base = bases.get(&f.path).map(Vec::as_slice).unwrap_or(b"");
72	+	let lines = diff::unified(base, &f.hunks, 3);
73	+	FileRows {
74	+	path: f.path.clone(),
75	+	from: f.from.clone(),
76	+	kind: f.kind.clone(),
77	+	added: lines.iter().filter(\|l\| l.kind == diff::Kind::Add).count(),
78	+	removed: lines.iter().filter(\|l\| l.kind == diff::Kind::Del).count(),
79	+	lines,
80	+	anchor: format!("diff-{i}"),
81	+	}
82	+	})
83	+	.collect()
84	+	}
85	+
86	+	#[derive(Template)]
87	+	#[template(path = "change.html")]
88	+	pub struct ChangePage {
89	+	shell: Shell,
90	+	repo: RepoShell,
91	+	c: view::ChangeDetail,
92	+	files: Vec<FileRows>,
93	+	body_html: String,
94	+	}
95	+
96	+	pub async fn change(
97	+	State(app): State<Shared>,
98	+	Path((owner, name, hash)): Path<(String, String, String)>,
99	+	) -> Result<Page<ChangePage>, Error> {
100	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/change/{hash}"));
101	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
102	+	let spec = hash.clone();
103	+	let c = app
104	+	.repos
105	+	.read(&repo, move \|repo\| {
106	+	let h = view::resolve_change(repo, &spec)?;
107	+	view::change(repo, &h)
108	+	})
109	+	.await
110	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
111	+	let files = render_files(&c.files, &c.bases);
112	+	let body_html =
113	+	if c.view.body.is_empty() { String::new() } else { format!("<pre class=\"msg\">{}</pre>", render::escape(&c.view.body)) };
114	+	Ok(Page(ChangePage { shell, repo: RepoShell::new(&app, &row, "changes"), c, files, body_html }))
115	+	}
116	+
117	+	#[derive(Template)]
118	+	#[template(path = "compare.html")]
119	+	pub struct ComparePage {
120	+	shell: Shell,
121	+	repo: RepoShell,
122	+	cmp: view::Compare,
123	+	files: Vec<FileRows>,
124	+	}
125	+
126	+	/// `/compare/{base}...{head}`.
127	+	pub async fn compare(
128	+	State(app): State<Shared>,
129	+	Path((owner, name, spec)): Path<(String, String, String)>,
130	+	) -> Result<Page<ComparePage>, Error> {
131	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/compare/{spec}"));
132	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
133	+	let Some((a, b)) = spec.split_once("...") else {
134	+	return Err(Error::bad(shell, "compare takes base...head"));
135	+	};
136	+	let (a, b) = (a.to_string(), b.to_string());
137	+	let cmp = app
138	+	.repos
139	+	.read(&repo, move \|repo\| {
140	+	let base = view::resolve(repo, &a)?;
141	+	let head = view::resolve(repo, &b)?;
142	+	view::compare(repo, base, head)
143	+	})
144	+	.await
145	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
146	+	let files = render_files(&cmp.files, &cmp.bases);
147	+	Ok(Page(ComparePage { shell, repo: RepoShell::new(&app, &row, "changes"), cmp, files }))
148	+	}

1	+	//! The front page, explore, owner pages and small endpoints.
2	+
3	+	use super::{filters, Error, Page, Shell};
4	+	use crate::{db, Shared};
5	+	use askama::Template;
6	+	use axum::extract::{Path, State};
7	+	use axum::http::header;
8	+	use axum::response::{IntoResponse, Response};
9	+	use hub_api::Visibility;
10	+
11	+	#[derive(Template)]
12	+	#[template(path = "home.html")]
13	+	pub struct HomePage {
14	+	shell: Shell,
15	+	description: String,
16	+	repos: Vec<db::repos::RepoRow>,
17	+	owner: Option<String>,
18	+	}
19	+
20	+	pub async fn index(State(app): State<Shared>) -> Result<Page<HomePage>, Error> {
21	+	let shell = Shell::new(&app, "/");
22	+	let repos = db::repos::list(&app.db).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
23	+	let repos = repos.into_iter().filter(\|r\| r.visibility() == Visibility::Public).collect();
24	+	Ok(Page(HomePage { description: app.config.site.description.clone(), shell, repos, owner: None }))
25	+	}
26	+
27	+	pub async fn explore(State(app): State<Shared>) -> Result<Page<HomePage>, Error> {
28	+	let mut page = index(State(app.clone())).await?;
29	+	page.0.shell = Shell::new(&app, "/explore");
30	+	Ok(page)
31	+	}
32	+
33	+	pub async fn owner(State(app): State<Shared>, Path(owner): Path<String>) -> Result<Page<HomePage>, Error> {
34	+	let shell = Shell::new(&app, &format!("/{owner}"));
35	+	if !crate::repos::names::valid_owner(&owner) {
36	+	return Err(Error::not_found(shell));
37	+	}
38	+	let repos = db::repos::list_by_owner(&app.db, &owner).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
39	+	let repos: Vec<_> = repos.into_iter().filter(\|r\| r.visibility() == Visibility::Public).collect();
40	+	if repos.is_empty() {
41	+	return Err(Error::not_found(shell));
42	+	}
43	+	Ok(Page(HomePage { description: String::new(), shell, repos, owner: Some(owner) }))
44	+	}
45	+
46	+	pub async fn health(State(app): State<Shared>) -> Response {
47	+	let body = serde_json::json!({
48	+	"ok": true,
49	+	"version": env!("CARGO_PKG_VERSION"),
50	+	"uptime_s": app.started.elapsed().as_secs(),
51	+	});
52	+	axum::Json(body).into_response()
53	+	}
54	+
55	+	/// The hub delegate identity object (hub spec §15.5), as `oxy identity
56	+	/// export` writes one, so policy holders can admit it.
57	+	pub async fn hub_key(State(app): State<Shared>) -> Response {
58	+	(
59	+	[(header::CONTENT_TYPE, "application/oxy-identity"), (header::CONTENT_DISPOSITION, "attachment; filename=\"hub.identity\"")],
60	+	app.hub_key.bytes.clone(),
61	+	)
62	+	.into_response()
63	+	}

Milestone 0.1: browse d23464c0ac60

Keyboard

1	+	//! Pages (hub spec §6): the router, the shell every template extends, the
2	+	//! error page, and askama filters. Handlers are thin: they resolve names,
3	+	//! call the view layer under the repository lock, and render.
4	+
5	+	pub mod filters;
6	+	mod history;
7	+	mod home;
8	+	mod refs;
9	+	mod repo;
10	+	mod statics;
11	+
12	+	use crate::repos::RepoError;
13	+	use crate::{db, Shared};
14	+	use askama::Template;
15	+	use axum::extract::DefaultBodyLimit;
16	+	use axum::http::{header, StatusCode};
17	+	use axum::response::{Html, IntoResponse, Response};
18	+	use axum::routing::{any, get};
19	+	use axum::Router;
20	+	use tower_http::compression::CompressionLayer;
21	+	use tower_http::trace::TraceLayer;
22	+
23	+	pub fn router(app: Shared) -> Router {
24	+	let push_limit = app.config.limits.push_body_limit.0 as usize;
25	+	Router::new()
26	+	.route("/", get(home::index))
27	+	.route("/explore", get(home::explore))
28	+	.route("/health", get(home::health))
29	+	.route("/.well-known/oxyhub-key", get(home::hub_key))
30	+	.route("/style.css", get(statics::style))
31	+	.route("/favicon.svg", get(statics::favicon))
32	+	.route("/favicon.ico", get(statics::favicon))
33	+	.route("/static/{*path}", get(statics::asset))
34	+	.nest("/api/v1", crate::api::router())
35	+	.route("/{owner}", get(home::owner))
36	+	.route("/{owner}/{name}", get(repo::overview))
37	+	.route("/{owner}/{name}/tree/{r}", get(repo::tree_root))
38	+	.route("/{owner}/{name}/tree/{r}/{*path}", get(repo::tree))
39	+	.route("/{owner}/{name}/file/{r}/{*path}", get(repo::file))
40	+	.route("/{owner}/{name}/last/{r}", get(repo::last_changes))
41	+	.route("/{owner}/{name}/changes/{r}", get(history::history))
42	+	.route("/{owner}/{name}/change/{hash}", get(history::change))
43	+	.route("/{owner}/{name}/compare/{spec}", get(history::compare))
44	+	.route("/{owner}/{name}/bookmarks", get(refs::bookmarks))
45	+	.route("/{owner}/{name}/tags", get(refs::tags))
46	+	.route("/{owner}/{name}/conflicts", get(refs::conflicts))
47	+	.route("/{owner}/{name}/trust", get(refs::trust))
48	+	.route("/{owner}/{name}/pushes", get(refs::pushes))
49	+	.route("/{owner}/{name}/oxy/v1/{endpoint}", any(crate::protocol::dispatch).layer(DefaultBodyLimit::max(push_limit)))
50	+	.fallback(not_found)
51	+	.layer(CompressionLayer::new())
52	+	.layer(TraceLayer::new_for_http())
53	+	.with_state(app)
54	+	}
55	+
56	+	/// What every page's chrome needs.
57	+	#[derive(Clone, Debug)]
58	+	pub struct Shell {
59	+	pub site: String,
60	+	pub base_url: String,
61	+	pub path: String,
62	+	pub version: &'static str,
63	+	}
64	+
65	+	impl Shell {
66	+	pub fn new(app: &Shared, path: &str) -> Shell {
67	+	Shell {
68	+	site: app.config.site.name.clone(),
69	+	base_url: app.config.base_url().to_string(),
70	+	path: path.to_string(),
71	+	version: env!("CARGO_PKG_VERSION"),
72	+	}
73	+	}
74	+	}
75	+
76	+	/// The repository chrome: tabs and counts.
77	+	#[derive(Clone, Debug)]
78	+	pub struct RepoShell {
79	+	pub owner: String,
80	+	pub name: String,
81	+	pub url: String,
82	+	pub description: String,
83	+	pub default_bookmark: String,
84	+	pub visibility: String,
85	+	pub tab: &'static str,
86	+	pub clone_url: String,
87	+	}
88	+
89	+	impl RepoShell {
90	+	pub fn new(app: &Shared, row: &db::repos::RepoRow, tab: &'static str) -> RepoShell {
91	+	RepoShell {
92	+	owner: row.owner.clone(),
93	+	name: row.name.clone(),
94	+	url: format!("/{}/{}", row.owner, row.name),
95	+	description: row.description.clone(),
96	+	default_bookmark: row.default_bookmark.clone(),
97	+	visibility: row.visibility.clone(),
98	+	tab,
99	+	clone_url: format!("{}/{}/{}", app.config.base_url(), row.owner, row.name),
100	+	}
101	+	}
102	+	}
103	+
104	+	/// Render a template as an HTML response.
105	+	pub struct Page<T: Template>(pub T);
106	+
107	+	impl<T: Template> IntoResponse for Page<T> {
108	+	fn into_response(self) -> Response {
109	+	match self.0.render() {
110	+	Ok(s) => Html(s).into_response(),
111	+	Err(e) => {
112	+	tracing::error!("template: {e}");
113	+	(StatusCode::INTERNAL_SERVER_ERROR, "template error").into_response()
114	+	}
115	+	}
116	+	}
117	+	}
118	+
119	+	#[derive(Template)]
120	+	#[template(path = "error.html")]
121	+	struct ErrorPage {
122	+	shell: Shell,
123	+	status: u16,
124	+	title: String,
125	+	detail: String,
126	+	}
127	+
128	+	/// A page-level failure, rendered inside the shell.
129	+	#[derive(Debug)]
130	+	pub struct Error {
131	+	pub status: StatusCode,
132	+	pub detail: String,
133	+	shell: Option<Shell>,
134	+	}
135	+
136	+	impl Error {
137	+	pub fn not_found(shell: Shell) -> Error {
138	+	Error { status: StatusCode::NOT_FOUND, detail: "There is nothing at this address.".into(), shell: Some(shell) }
139	+	}
140	+
141	+	pub fn bad(shell: Shell, detail: impl Into<String>) -> Error {
142	+	Error { status: StatusCode::BAD_REQUEST, detail: detail.into(), shell: Some(shell) }
143	+	}
144	+
145	+	pub fn from_repo(shell: Shell, e: RepoError) -> Error {
146	+	match e {
147	+	RepoError::NotFound => Error::not_found(shell),
148	+	RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => Error { status: StatusCode::NOT_FOUND, detail: m, shell: Some(shell) },
149	+	other => Error { status: StatusCode::INTERNAL_SERVER_ERROR, detail: other.to_string(), shell: Some(shell) },
150	+	}
151	+	}
152	+
153	+	pub fn from_db(shell: Shell, e: sqlx::Error) -> Error {
154	+	Error { status: StatusCode::INTERNAL_SERVER_ERROR, detail: e.to_string(), shell: Some(shell) }
155	+	}
156	+	}
157	+
158	+	impl IntoResponse for Error {
159	+	fn into_response(self) -> Response {
160	+	let title = match self.status {
161	+	StatusCode::NOT_FOUND => "Not found",
162	+	StatusCode::BAD_REQUEST => "Bad request",
163	+	_ => "Something went wrong",
164	+	};
165	+	if self.status.is_server_error() {
166	+	tracing::error!("{}", self.detail);
167	+	}
168	+	let shell = self.shell.unwrap_or(Shell { site: "Oxygenhub".into(), base_url: String::new(), path: String::new(), version: "" });
169	+	let page = ErrorPage { shell, status: self.status.as_u16(), title: title.into(), detail: self.detail };
170	+	match page.render() {
171	+	Ok(s) => (self.status, Html(s)).into_response(),
172	+	Err(_) => (self.status, title).into_response(),
173	+	}
174	+	}
175	+	}
176	+
177	+	async fn not_found(axum::extract::State(app): axum::extract::State<Shared>, uri: axum::http::Uri) -> Response {
178	+	Error::not_found(Shell::new(&app, uri.path())).into_response()
179	+	}
180	+
181	+	/// A raw file response with a safe content type (hub spec §15.2).
182	+	pub fn raw(bytes: Vec<u8>, name: &str, inline_image: bool) -> Response {
183	+	let mime = mime_of(name);
184	+	let disposition = if inline_image && mime.starts_with("image/") { "inline" } else { "attachment" };
185	+	(
186	+	[
187	+	(header::CONTENT_TYPE, mime.to_string()),
188	+	(header::CONTENT_DISPOSITION, format!("{disposition}; filename=\"{}\"", name.replace('"', ""))),
189	+	(header::X_CONTENT_TYPE_OPTIONS, "nosniff".to_string()),
190	+	],
191	+	bytes,
192	+	)
193	+	.into_response()
194	+	}
195	+
196	+	pub fn mime_of(name: &str) -> &'static str {
197	+	match name.rsplit('.').next().map(\|e\| e.to_ascii_lowercase()).as_deref() {
198	+	Some("png") => "image/png",
199	+	Some("jpg" \| "jpeg") => "image/jpeg",
200	+	Some("gif") => "image/gif",
201	+	Some("webp") => "image/webp",
202	+	Some("svg") => "image/svg+xml",
203	+	Some("pdf") => "application/pdf",
204	+	Some(
205	+	"txt" \| "md" \| "rs" \| "toml" \| "json" \| "yml" \| "yaml" \| "c" \| "h" \| "cpp" \| "hpp" \| "py" \| "js" \| "ts" \| "html" \| "css" \| "sh",
206	+	) => "text/plain; charset=utf-8",
207	+	_ => "application/octet-stream",
208	+	}
209	+	}
210	+
211	+	/// Resolve `{owner}/{name}` to its row, or 404. Private repositories are
212	+	/// invisible until accounts exist (hub 0.2).
213	+	pub async fn lookup(app: &Shared, shell: &Shell, owner: &str, name: &str) -> Result<(crate::repos::RepoName, db::repos::RepoRow), Error> {
214	+	let repo = crate::repos::RepoName::new(owner, name).ok_or_else(\|\| Error::not_found(shell.clone()))?;
215	+	let row = db::repos::get(&app.db, owner, name).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
216	+	match row {
217	+	Some(r) if r.visibility() == hub_api::Visibility::Public => Ok((repo, r)),
218	+	_ => Err(Error::not_found(shell.clone())),
219	+	}
220	+	}

1	+	//! Bookmarks, tags, conflicts, trust and pushes pages.
2	+
3	+	use super::{filters, lookup, Error, Page, RepoShell, Shell};
4	+	use crate::repos::view;
5	+	use crate::{db, Shared};
6	+	use askama::Template;
7	+	use axum::extract::{Path, State};
8	+
9	+	#[derive(Template)]
10	+	#[template(path = "bookmarks.html")]
11	+	pub struct BookmarksPage {
12	+	shell: Shell,
13	+	repo: RepoShell,
14	+	bookmarks: Vec<view::BookmarkView>,
15	+	}
16	+
17	+	pub async fn bookmarks(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<BookmarksPage>, Error> {
18	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/bookmarks"));
19	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
20	+	let default = row.default_bookmark.clone();
21	+	let bookmarks = app.repos.read(&repo, move \|r\| view::bookmarks(r, &default)).await.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
22	+	Ok(Page(BookmarksPage { shell, repo: RepoShell::new(&app, &row, "bookmarks"), bookmarks }))
23	+	}
24	+
25	+	#[derive(Template)]
26	+	#[template(path = "tags.html")]
27	+	pub struct TagsPage {
28	+	shell: Shell,
29	+	repo: RepoShell,
30	+	tags: Vec<view::TagView>,
31	+	}
32	+
33	+	pub async fn tags(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<TagsPage>, Error> {
34	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/tags"));
35	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
36	+	let tags = app.repos.read(&repo, view::tags).await.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
37	+	Ok(Page(TagsPage { shell, repo: RepoShell::new(&app, &row, "tags"), tags }))
38	+	}
39	+
40	+	#[derive(Template)]
41	+	#[template(path = "conflicts.html")]
42	+	pub struct ConflictsPage {
43	+	shell: Shell,
44	+	repo: RepoShell,
45	+	conflicts: Vec<view::ConflictView>,
46	+	}
47	+
48	+	pub async fn conflicts(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<ConflictsPage>, Error> {
49	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/conflicts"));
50	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
51	+	let conflicts = app.repos.read(&repo, view::conflicts).await.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
52	+	Ok(Page(ConflictsPage { shell, repo: RepoShell::new(&app, &row, "conflicts"), conflicts }))
53	+	}
54	+
55	+	#[derive(Template)]
56	+	#[template(path = "trust.html")]
57	+	pub struct TrustPage {
58	+	shell: Shell,
59	+	repo: RepoShell,
60	+	t: view::Trust,
61	+	}
62	+
63	+	pub async fn trust(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<TrustPage>, Error> {
64	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/trust"));
65	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
66	+	let key = app.hub_key.key;
67	+	let t = app.repos.read(&repo, move \|r\| view::trust(r, &key)).await.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
68	+	Ok(Page(TrustPage { shell, repo: RepoShell::new(&app, &row, "trust"), t }))
69	+	}
70	+
71	+	#[derive(Template)]
72	+	#[template(path = "pushes.html")]
73	+	pub struct PushesPage {
74	+	shell: Shell,
75	+	repo: RepoShell,
76	+	pushes: Vec<db::repos::PushRow>,
77	+	}
78	+
79	+	pub async fn pushes(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<PushesPage>, Error> {
80	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/pushes"));
81	+	let (_, row) = lookup(&app, &shell, &owner, &name).await?;
82	+	let pushes = db::repos::pushes(&app.db, row.id, 200).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
83	+	Ok(Page(PushesPage { shell, repo: RepoShell::new(&app, &row, "pushes"), pushes }))
84	+	}

1	+	//! Repository overview, tree, file, raw and blame pages.
2	+
3	+	use super::{filters, lookup, Error, Page, RepoShell, Shell};
4	+	use crate::render::{self, highlight};
5	+	use crate::repos::view::{self, EntryKind, FileBody};
6	+	use crate::Shared;
7	+	use askama::Template;
8	+	use axum::extract::{Path, Query, State};
9	+	use axum::response::{IntoResponse, Response};
10	+	use serde::Deserialize;
11	+
12	+	#[derive(Template)]
13	+	#[template(path = "overview.html")]
14	+	pub struct OverviewPage {
15	+	shell: Shell,
16	+	repo: RepoShell,
17	+	o: view::Overview,
18	+	readme_html: Option<String>,
19	+	}
20	+
21	+	pub async fn overview(State(app): State<Shared>, Path((owner, name)): Path<(String, String)>) -> Result<Page<OverviewPage>, Error> {
22	+	let shell = Shell::new(&app, &format!("/{owner}/{name}"));
23	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
24	+	let default = row.default_bookmark.clone();
25	+	let o = app.repos.read(&repo, move \|r\| view::overview(r, &default)).await.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
26	+	let rs = RepoShell::new(&app, &row, "code");
27	+	let readme_html = o.readme_html(&rs, &o.tree.target.label);
28	+	Ok(Page(OverviewPage { shell, repo: rs, o, readme_html }))
29	+	}
30	+
31	+	impl view::Overview {
32	+	fn readme_html(&self, rs: &RepoShell, r: &str) -> Option<String> {
33	+	self.tree.readme.as_ref().map(\|md\| {
34	+	let dir = md.path.rsplit_once('/').map(\|(d, _)\| format!("{d}/")).unwrap_or_default();
35	+	render::markdown::render(&md.text, &format!("{}/file/{r}/{dir}", rs.url), &format!("{}/file/{r}/{dir}", rs.url))
36	+	})
37	+	}
38	+	}
39	+
40	+	#[derive(Template)]
41	+	#[template(path = "tree.html")]
42	+	pub struct TreePage {
43	+	shell: Shell,
44	+	repo: RepoShell,
45	+	t: view::Tree,
46	+	readme_html: Option<String>,
47	+	}
48	+
49	+	pub async fn tree_root(State(app): State<Shared>, Path((owner, name, r)): Path<(String, String, String)>) -> Result<Page<TreePage>, Error> {
50	+	tree(State(app), Path((owner, name, r, String::new()))).await
51	+	}
52	+
53	+	pub async fn tree(
54	+	State(app): State<Shared>,
55	+	Path((owner, name, r, path)): Path<(String, String, String, String)>,
56	+	) -> Result<Page<TreePage>, Error> {
57	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/tree/{r}/{path}"));
58	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
59	+	let (spec, dir) = (r.clone(), path.clone());
60	+	let t = app
61	+	.repos
62	+	.read(&repo, move \|repo\| {
63	+	let target = view::resolve(repo, &spec)?;
64	+	view::tree(repo, target, &dir)
65	+	})
66	+	.await
67	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
68	+	let rs = RepoShell::new(&app, &row, "code");
69	+	let readme_html = t.readme.as_ref().map(\|md\| {
70	+	let dir = md.path.rsplit_once('/').map(\|(d, _)\| format!("{d}/")).unwrap_or_default();
71	+	render::markdown::render(&md.text, &format!("{}/file/{r}/{dir}", rs.url), &format!("{}/file/{r}/{dir}", rs.url))
72	+	});
73	+	Ok(Page(TreePage { shell, repo: rs, t, readme_html }))
74	+	}
75	+
76	+	#[derive(Deserialize)]
77	+	pub struct FileQuery {
78	+	plain: Option<String>,
79	+	blame: Option<String>,
80	+	/// `source` shows a Markdown file's text instead of rendering it.
81	+	view: Option<String>,
82	+	}
83	+
84	+	#[derive(Template)]
85	+	#[template(path = "file.html")]
86	+	pub struct FilePage {
87	+	shell: Shell,
88	+	repo: RepoShell,
89	+	f: view::FileView,
90	+	/// Highlighted lines when text.
91	+	lines: Vec<String>,
92	+	language: Option<&'static str>,
93	+	markdown_html: Option<String>,
94	+	is_image: bool,
95	+	is_markdown: bool,
96	+	blame: Option<Vec<BlameRow>>,
97	+	}
98	+
99	+	/// A blame gutter entry: shown only on the first line of a run.
100	+	pub struct BlameRow {
101	+	pub first: bool,
102	+	pub hash: String,
103	+	pub short: String,
104	+	pub author: String,
105	+	pub when_ms: u64,
106	+	pub run: usize,
107	+	}
108	+
109	+	pub async fn file(
110	+	State(app): State<Shared>,
111	+	Path((owner, name, r, path)): Path<(String, String, String, String)>,
112	+	Query(q): Query<FileQuery>,
113	+	) -> Result<Response, Error> {
114	+	let shell = Shell::new(&app, &format!("/{owner}/{name}/file/{r}/{path}"));
115	+	let (repo, row) = lookup(&app, &shell, &owner, &name).await?;
116	+	let limit = app.config.limits.render_limit.0;
117	+	let want_blame = q.blame.is_some();
118	+	let (spec, p) = (r.clone(), path.clone());
119	+	let (f, blame) = app
120	+	.repos
121	+	.read(&repo, move \|repo\| {
122	+	let target = view::resolve(repo, &spec)?;
123	+	if want_blame {
124	+	let b = view::blame(repo, target, &p, limit)?;
125	+	Ok((b.file, Some(b.lines)))
126	+	} else {
127	+	Ok((view::file(repo, target, &p, limit)?, None))
128	+	}
129	+	})
130	+	.await
131	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
132	+	if q.plain.is_some() {
133	+	return Ok(super::raw(f.bytes, &f.name, true));
134	+	}
135	+	let rs = RepoShell::new(&app, &row, "code");
136	+	let is_image = super::mime_of(&f.name).starts_with("image/");
137	+	let is_markdown = f.name.to_lowercase().ends_with(".md") \|\| f.name.to_lowercase() == "readme";
138	+	let want_source = q.view.as_deref() == Some("source") \|\| blame.is_some();
139	+	let (lines, language, markdown_html) = match &f.body {
140	+	FileBody::Text(text) if !is_image => {
141	+	if is_markdown && !want_source {
142	+	let dir = f.path.rsplit_once('/').map(\|(d, _)\| format!("{d}/")).unwrap_or_default();
143	+	let base = format!("{}/file/{r}/{dir}", rs.url);
144	+	(vec![], highlight::language(&f.path), Some(render::markdown::render(text, &base, &base)))
145	+	} else {
146	+	(highlight::lines(&f.path, text), highlight::language(&f.path), None)
147	+	}
148	+	}
149	+	_ => (vec![], None, None),
150	+	};
151	+	let blame = blame.map(\|lines\| {
152	+	let mut rows: Vec<BlameRow> = Vec::with_capacity(lines.len());
153	+	let mut i = 0;
154	+	while i < lines.len() {
155	+	let mut run = 1;
156	+	while i + run < lines.len() && lines[i + run].hash == lines[i].hash {
157	+	run += 1;
158	+	}
159	+	for k in 0..run {
160	+	let l = &lines[i + k];
161	+	rows.push(BlameRow {
162	+	first: k == 0,
163	+	hash: l.hash.to_hex(),
164	+	short: l.hash.short(8),
165	+	author: l.author.clone(),
166	+	when_ms: l.when_ms,
167	+	run,
168	+	});
169	+	}
170	+	i += run;
171	+	}
172	+	rows
173	+	});
174	+	Ok(Page(FilePage { shell, repo: rs, f, lines, language, markdown_html, is_image, is_markdown, blame }).into_response())
175	+	}
176	+
177	+	#[derive(Deserialize)]
178	+	pub struct LastQuery {
179	+	/// Comma-separated paths.
180	+	paths: String,
181	+	}
182	+
183	+	/// `GET /{owner}/{name}/last/{ref}?paths=a,b` → JSON of last change per
184	+	/// path, fetched by the tree page after it paints (hub spec §6.5).
185	+	pub async fn last_changes(
186	+	State(app): State<Shared>,
187	+	Path((owner, name, r)): Path<(String, String, String)>,
188	+	Query(q): Query<LastQuery>,
189	+	) -> Result<Response, Error> {
190	+	let shell = Shell::new(&app, "");
191	+	let (repo, _) = lookup(&app, &shell, &owner, &name).await?;
192	+	let paths: Vec<String> = q.paths.split(',').filter(\|p\| !p.is_empty()).take(500).map(String::from).collect();
193	+	let spec = r.clone();
194	+	let found = app
195	+	.repos
196	+	.read(&repo, move \|repo\| {
197	+	let target = view::resolve(repo, &spec)?;
198	+	view::last_changes(repo, &target.heads, &paths)
199	+	})
200	+	.await
201	+	.map_err(\|e\| Error::from_repo(shell.clone(), e))?;
202	+	let now = crate::db::now_ms() as u64;
203	+	let body: Vec<serde_json::Value> = found
204	+	.into_iter()
205	+	.map(\|(p, c)\| {
206	+	serde_json::json!({ "path": p, "hash": c.hash, "short": c.short, "title": c.title, "ago": render::time::ago(c.when_ms, now), "when": render::time::absolute(c.when_ms) })
207	+	})
208	+	.collect();
209	+	Ok(axum::Json(body).into_response())
210	+	}
211	+
212	+	impl EntryKind {
213	+	pub fn glyph(&self) -> &'static str {
214	+	match self {
215	+	EntryKind::Dir => "▸",
216	+	EntryKind::File => "·",
217	+	EntryKind::Symlink => "↪",
218	+	EntryKind::Subrepo => "◫",
219	+	}
220	+	}
221	+	}

1	+	//! Compiled-in static assets: the stylesheet, fonts and icons.
2	+
3	+	use axum::extract::Path;
4	+	use axum::http::{header, StatusCode};
5	+	use axum::response::{IntoResponse, Response};
6	+
7	+	const CSS: &str = include_str!("../../../../templates/style.css");
8	+	const FAVICON: &str = include_str!("../../../../assets/icons/oxygenhub.svg");
9	+
10	+	struct Asset {
11	+	path: &'static str,
12	+	mime: &'static str,
13	+	bytes: &'static [u8],
14	+	}
15	+
16	+	const ASSETS: &[Asset] = &[
17	+	Asset { path: "fonts/Barlow-300.woff2", mime: "font/woff2", bytes: include_bytes!("../../../../assets/fonts/Barlow-300.woff2") },
18	+	Asset { path: "fonts/Barlow-400.woff2", mime: "font/woff2", bytes: include_bytes!("../../../../assets/fonts/Barlow-400.woff2") },
19	+	Asset { path: "fonts/Barlow-500.woff2", mime: "font/woff2", bytes: include_bytes!("../../../../assets/fonts/Barlow-500.woff2") },
20	+	Asset { path: "fonts/Barlow-600.woff2", mime: "font/woff2", bytes: include_bytes!("../../../../assets/fonts/Barlow-600.woff2") },
21	+	Asset {
22	+	path: "fonts/PressStart2P-400.woff2",
23	+	mime: "font/woff2",
24	+	bytes: include_bytes!("../../../../assets/fonts/PressStart2P-400.woff2"),
25	+	},
26	+	Asset { path: "hub.js", mime: "text/javascript; charset=utf-8", bytes: include_bytes!("../../../../assets/hub.js") },
27	+	];
28	+
29	+	const CACHE: &str = "public, max-age=86400";
30	+
31	+	pub async fn style() -> Response {
32	+	([(header::CONTENT_TYPE, "text/css; charset=utf-8"), (header::CACHE_CONTROL, CACHE)], CSS).into_response()
33	+	}
34	+
35	+	pub async fn favicon() -> Response {
36	+	([(header::CONTENT_TYPE, "image/svg+xml"), (header::CACHE_CONTROL, CACHE)], FAVICON).into_response()
37	+	}
38	+
39	+	pub async fn asset(Path(path): Path<String>) -> Response {
40	+	match ASSETS.iter().find(\|a\| a.path == path) {
41	+	Some(a) => {
42	+	([(header::CONTENT_TYPE, a.mime), (header::CACHE_CONTROL, "public, max-age=31536000, immutable")], a.bytes).into_response()
43	+	}
44	+	None => StatusCode::NOT_FOUND.into_response(),
45	+	}
46	+	}

1	+	//! End to end: a hub in a temporary data directory, a real `oxy` client
2	+	//! pushing over the wire protocol, and every milestone 0.1 page fetched.
3	+
4	+	use axum::body::Body;
5	+	use axum::http::{Request, StatusCode};
6	+	use http_body_util::BodyExt;
7	+	use oxy_core::repo::Repo;
8	+	use oxygenhub::config::Config;
9	+	use oxygenhub::repos::RepoName;
10	+	use oxygenhub::{db, Shared};
11	+	use std::path::Path;
12	+	use tower::ServiceExt;
13	+
14	+	/// Point `$OXY_HOME` at a throwaway directory so the client's identity and
15	+	/// configuration never touch the developer's.
16	+	fn hermetic() {
17	+	static ONCE: std::sync::Once = std::sync::Once::new();
18	+	static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
19	+	ONCE.call_once(\|\| {
20	+	let d = tempfile::tempdir().unwrap();
21	+	std::env::set_var("OXY_HOME", d.path());
22	+	DIR.set(d).ok();
23	+	});
24	+	}
25	+
26	+	fn write(root: &Path, rel: &str, content: &[u8]) {
27	+	let p = root.join(rel);
28	+	std::fs::create_dir_all(p.parent().unwrap()).unwrap();
29	+	std::fs::write(p, content).unwrap();
30	+	}
31	+
32	+	struct Hub {
33	+	app: Shared,
34	+	base: String,
35	+	_dir: tempfile::TempDir,
36	+	}
37	+
38	+	async fn hub(push_tokens: Vec<String>) -> Hub {
39	+	hermetic();
40	+	let dir = tempfile::tempdir().unwrap();
41	+	let mut config = Config::load(dir.path()).unwrap();
42	+	config.auth.push_tokens = push_tokens;
43	+	let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
44	+	let port = listener.local_addr().unwrap().port();
45	+	config.server.base_url = format!("http://127.0.0.1:{port}");
46	+	let app = oxygenhub::build(config).await.unwrap();
47	+	let router = oxygenhub::router(app.clone());
48	+	tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
49	+	Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
50	+	}
51	+
52	+	async fn get(app: &Shared, path: &str) -> (StatusCode, String) {
53	+	let res = oxygenhub::router(app.clone()).oneshot(Request::get(path).body(Body::empty()).unwrap()).await.unwrap();
54	+	let status = res.status();
55	+	let bytes = res.into_body().collect().await.unwrap().to_bytes();
56	+	(status, String::from_utf8_lossy(&bytes).into_owned())
57	+	}
58	+
59	+	async fn page(app: &Shared, path: &str) -> String {
60	+	let (status, body) = get(app, path).await;
61	+	assert_eq!(status, StatusCode::OK, "{path}: {}", body.lines().find(\|l\| l.contains("lead")).unwrap_or(""));
62	+	body
63	+	}
64	+
65	+	/// Push a small history from a client: two changes on main, a second
66	+	/// bookmark, a tag.
67	+	fn populate(url: &str, work: &Path) -> (Repo, String, String) {
68	+	// The hosted repository is unbound until the first push, so it cannot
69	+	// be cloned yet: start locally and push, as moving an existing
70	+	// repository to the hub does.
71	+	assert!(Repo::clone(url, &work.join("early")).err().unwrap().to_string().contains("unbound"));
72	+	let mut client = Repo::init(work).unwrap();
73	+	// A signing identity, so changes and the tag travel signed.
74	+	client.create_identity("Test Author", "[email protected]", oxy_core::repo::IdentityScope::User).unwrap();
75	+	client.config.set("remote.origin.url", url).unwrap();
76	+	client.config.set("core.sign", "change").unwrap();
77	+	client.save_config().unwrap();
78	+	write(work, "README.md", b"# Demo\n\nSee [docs](docs/guide.md).\n");
79	+	write(work, "src/main.rs", b"fn main() {\n println!(\"hi\");\n}\n");
80	+	write(work, "docs/guide.md", b"# Guide\n");
81	+	client.snapshot("test").unwrap();
82	+	let c1 = client.commit("Initial import", &[]).unwrap();
83	+	write(work, "src/main.rs", b"fn main() {\n println!(\"hello\");\n}\n\nfn two() {}\n");
84	+	client.snapshot("test").unwrap();
85	+	let c2 = client.commit("Greet properly\n\nAlso adds two().", &[]).unwrap();
86	+	client.tag_create("v0.1", &[c2], "First tag").unwrap();
87	+	client.bookmark_create("feature", Some(&[c1])).unwrap();
88	+	let results = client.push("origin", false).unwrap();
89	+	assert!(results.iter().all(\|r\| r.ok), "{results:?}");
90	+	let results = client.push_bookmark("origin", "feature", false).unwrap();
91	+	assert!(results.iter().all(\|r\| r.ok), "{results:?}");
92	+	// Bound now: a clone shares the id.
93	+	let clone = Repo::clone(url, &work.join("clone")).unwrap();
94	+	assert_eq!(clone.id().unwrap(), client.id().unwrap());
95	+	(client, c1.to_hex(), c2.to_hex())
96	+	}
97	+
98	+	#[tokio::test(flavor = "multi_thread")]
99	+	async fn create_push_and_browse() {
100	+	let h = hub(vec![]).await;
101	+	let name = RepoName::parse("andy/demo").unwrap();
102	+	h.app.repos.create(&name, None).unwrap();
103	+	db::repos::create(&h.app.db, "andy", "demo", "A demo", hub_api::Visibility::Public).await.unwrap();
104	+	let work = tempfile::tempdir().unwrap();
105	+	let (_client, c1, c2) = populate(&format!("{}/andy/demo", h.base), work.path());
106	+
107	+	// Front page and owner page list it.
108	+	let home = page(&h.app, "/").await;
109	+	assert!(home.contains("/andy/demo"), "{home}");
110	+	assert!(page(&h.app, "/andy").await.contains("demo"));
111	+	assert_eq!(get(&h.app, "/nobody").await.0, StatusCode::NOT_FOUND);
112	+
113	+	// Overview: tree, README rendered with rebased links, clone URL, counts.
114	+	let o = page(&h.app, "/andy/demo").await;
115	+	assert!(o.contains("src"), "tree entries");
116	+	assert!(o.contains("href=\"/andy/demo/file/main/docs/guide.md\""), "README link rebased: {o}");
117	+	assert!(o.contains(&format!("oxy clone {}/andy/demo", h.base)));
118	+	assert!(o.contains("2 changes"));
119	+	assert!(o.contains("v0.1"));
120	+	assert!(o.contains("feature"));
121	+
122	+	// Tree at a bookmark, a tag and a change; file with highlighting; raw; blame.
123	+	let t = page(&h.app, "/andy/demo/tree/main/src").await;
124	+	assert!(t.contains("main.rs"));
125	+	assert!(page(&h.app, "/andy/demo/tree/v0.1").await.contains("README.md"));
126	+	assert!(page(&h.app, &format!("/andy/demo/tree/{}", &c1[..10])).await.contains("README.md"));
127	+	assert_eq!(get(&h.app, "/andy/demo/tree/main/nope").await.0, StatusCode::NOT_FOUND);
128	+	let f = page(&h.app, "/andy/demo/file/main/src/main.rs").await;
129	+	assert!(f.contains("storage type function"), "highlighted: {f}");
130	+	assert!(f.contains("id=\"L5\""));
131	+	assert!(f.contains("Rust"));
132	+	let (status, raw) = get(&h.app, "/andy/demo/file/main/src/main.rs?plain=1").await;
133	+	assert_eq!(status, StatusCode::OK);
134	+	assert_eq!(raw, "fn main() {\n println!(\"hello\");\n}\n\nfn two() {}\n");
135	+	let b = page(&h.app, "/andy/demo/file/main/src/main.rs?blame=1").await;
136	+	assert!(b.contains(&c1[..8]) && b.contains(&c2[..8]), "both changes blamed: {b}");
137	+	let md = page(&h.app, "/andy/demo/file/main/README.md").await;
138	+	assert!(md.contains("<h1>Demo</h1>"), "markdown rendered");
139	+	// Last-change JSON for tree rows.
140	+	let (status, json) = get(&h.app, "/andy/demo/last/main?paths=README.md,src").await;
141	+	assert_eq!(status, StatusCode::OK);
142	+	assert!(json.contains("Initial import") && json.contains("Greet properly"), "{json}");
143	+
144	+	// History with graph rows, filtered by path; change page with diff; compare.
145	+	let hist = page(&h.app, "/andy/demo/changes/main").await;
146	+	assert!(hist.contains("Greet properly") && hist.contains("Initial import"));
147	+	assert!(hist.contains("<circle"), "graph drawn");
148	+	assert!(hist.contains("lbl-tag") && hist.contains("v0.1"), "tag label on its head");
149	+	let by_path = page(&h.app, "/andy/demo/changes/main?path=README.md").await;
150	+	assert!(by_path.contains("Initial import") && !by_path.contains("Greet properly"));
151	+	let c = page(&h.app, &format!("/andy/demo/change/{c2}")).await;
152	+	assert!(c.contains("Also adds two()"), "body shown");
153	+	assert!(c.contains("+fn two() {}") \|\| c.contains("fn two() {}"), "diff shown: {c}");
154	+	assert!(c.contains("class=\"add\"") && c.contains("class=\"del\""));
155	+	assert!(c.contains(&c1[..12]), "dependency listed");
156	+	assert!(page(&h.app, &format!("/andy/demo/change/{}", &c2[..8])).await.contains("Greet properly"));
157	+	let cmp = page(&h.app, "/andy/demo/compare/feature...main").await;
158	+	assert!(cmp.contains("1 change") && cmp.contains("Greet properly"));
159	+	assert_eq!(get(&h.app, "/andy/demo/compare/feature").await.0, StatusCode::BAD_REQUEST);
160	+
161	+	// Bookmarks, tags, conflicts (none), trust (no policy), pushes.
162	+	let bm = page(&h.app, "/andy/demo/bookmarks").await;
163	+	assert!(bm.contains("feature") && bm.contains("default"));
164	+	let tags = page(&h.app, "/andy/demo/tags").await;
165	+	assert!(tags.contains("v0.1") && tags.contains("First tag"));
166	+	assert!(page(&h.app, "/andy/demo/conflicts").await.contains("No bookmark carries a conflict"));
167	+	let trust = page(&h.app, "/andy/demo/trust").await;
168	+	assert!(trust.contains("No trust policy") && trust.contains(&h.app.hub_key.key.to_hex()));
169	+	assert!(trust.contains("2 signed"), "signed changes verified on the host: {trust}");
170	+	assert!(c.contains("signed by Test Author"), "change page shows the signer");
171	+	let pushes = page(&h.app, "/andy/demo/pushes").await;
172	+	assert!(pushes.contains("accepted") && pushes.contains("main"), "{pushes}");
173	+
174	+	// API and small endpoints.
175	+	let (_, repos) = get(&h.app, "/api/v1/repos").await;
176	+	assert!(repos.contains("\"name\":\"demo\""));
177	+	let (_, bms) = get(&h.app, "/api/v1/repos/andy/demo/bookmarks").await;
178	+	assert!(bms.contains("\"default\":true"));
179	+	let (status, key) = get(&h.app, "/.well-known/oxyhub-key").await;
180	+	assert_eq!(status, StatusCode::OK);
181	+	assert!(!key.is_empty());
182	+	assert!(get(&h.app, "/health").await.1.contains("\"ok\":true"));
183	+	assert_eq!(get(&h.app, "/style.css").await.0, StatusCode::OK);
184	+	assert_eq!(get(&h.app, "/static/fonts/Barlow-400.woff2").await.0, StatusCode::OK);
185	+	assert_eq!(get(&h.app, "/andy/demo/oxy/v1/nothing").await.0, StatusCode::NOT_FOUND);
186	+	}
187	+
188	+	#[tokio::test(flavor = "multi_thread")]
189	+	async fn private_repositories_and_push_tokens() {
190	+	let h = hub(vec!["s3cret".into()]).await;
191	+	for (name, vis) in [("pub", hub_api::Visibility::Public), ("priv", hub_api::Visibility::Private)] {
192	+	// `priv` is created bound so it can be cloned while still empty.
193	+	let id = if name == "priv" { Some([7u8; 16]) } else { None };
194	+	h.app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), id).unwrap();
195	+	db::repos::create(&h.app.db, "andy", name, "", vis).await.unwrap();
196	+	}
197	+	// The private one is invisible on pages and to anonymous clients.
198	+	assert_eq!(get(&h.app, "/andy/priv").await.0, StatusCode::NOT_FOUND);
199	+	assert!(!page(&h.app, "/").await.contains("priv"));
200	+	assert!(Repo::clone(&format!("{}/andy/priv", h.base), &tempfile::tempdir().unwrap().path().join("x")).is_err());
201	+	// Anonymous push to the public one is refused; with the token it lands.
202	+	let work = tempfile::tempdir().unwrap();
203	+	let mut client = Repo::init(work.path()).unwrap();
204	+	client.config.set("remote.origin.url", &format!("{}/andy/pub", h.base)).unwrap();
205	+	write(work.path(), "a.txt", b"a\n");
206	+	client.snapshot("test").unwrap();
207	+	client.commit("a", &[]).unwrap();
208	+	assert!(client.push("origin", false).is_err());
209	+	client.config.set("remote.origin.token", "s3cret").unwrap();
210	+	assert!(client.push("origin", false).unwrap().iter().all(\|r\| r.ok));
211	+	// With the token, the private repository can be cloned too.
212	+	let priv_dir = tempfile::tempdir().unwrap();
213	+	std::env::set_var("OXY_TOKEN", "s3cret");
214	+	let ok = Repo::clone(&format!("{}/andy/priv", h.base), &priv_dir.path().join("p")).is_ok();
215	+	std::env::remove_var("OXY_TOKEN");
216	+	assert!(ok, "a token reads a private repository until accounts exist");
217	+	// The pushes log shows the accepted update; the front page shows activity.
218	+	tokio::time::sleep(std::time::Duration::from_millis(100)).await;
219	+	assert!(page(&h.app, "/andy/pub/pushes").await.contains("accepted"));
220	+	assert!(page(&h.app, "/andy/pub").await.contains("1 change"));
221	+	}

1	+	# Oxygenhub plan
2	+
3	+	Milestones from `docs/spec.md` §19. Each item is checked when its tests
4	+	pass, clippy is clean, and the change is committed with `oxy`.
5	+
6	+	## 0.1 Browse (2026-09-27)
7	+
8	+	- [x] Workspace: `crates/hub` (binary), `crates/hub-api` (API types), askama templates, vendored fonts, one stylesheet from the RetroPlay theme.
9	+	- [x] Configuration (`hub.toml` + `OXYHUB_*`), SQLite with embedded migrations (`repositories`, `pushes`).
10	+	- [x] Repository registry: bare, unbound-by-default repositories under `<data>/repos/<owner>/<name>`, per-repository read/write locks, trash on delete.
11	+	- [x] Embedded wire protocol with visibility and push-token authorisation and a push log.
12	+	- [x] Pages: home, owner, overview (tree, README, clone, bookmarks, tags, trust badge, heads and conflict strips), tree, file (highlighting, Markdown, images, raw, blame), history with the dependency graph and path filter, change with diff and dependencies, compare, bookmarks, tags, conflicts, trust, pushes.
13	+	- [x] JSON API: repositories, bookmarks, tags; `/health`; `/.well-known/oxyhub-key`.
14	+	- [x] CLI: `init` (keys, self-signed TLS), `serve` (HTTP and HTTPS), `admin repo create\|list\|delete\|set`, `check`.
15	+	- [x] Tests: unit tests per module and an end-to-end test that pushes with a real `oxy-core` client and fetches every page.
16	+	- [x] Oxygen changes it needed (in the Oxygen plan, phase 4): bare repositories, embeddable server, unbound repositories, adoption of anonymous changes by seals, `oxy seal`.
17	+	- [ ] Developer edition running on Earth with `oxygen`, `oxygen-vscode` and `oxygenhub` hosted (docs/deploy.md).
18	+
19	+	## 0.2 Accounts and access
20	+
21	+	- [ ] Registration, sessions, TOTP, profile, organisations, teams, roles, visibility enforcement by viewer, personal access tokens with scopes, linked identities with challenge signing (`oxy identity sign-challenge`), audit log, settings pages, pushes attributed to keys.
22	+
23	+	## Later
24	+
25	+	- 0.3 proposals and review · 0.4 issues and notifications · 0.5 API, webhooks, checks · 0.6 web edits, releases, mirror · 0.7 runner · 1.0 hardening.
26	+
27	+	## Notes
28	+
29	+	- State caching (spec §16.3) is not started: pages load the state they need per request; the overview loads it once and reuses it. Measured on the `oxygen` repository (88 changes): overview ~0.5 s, tree ~0.14 s, history ~0.13 s, a 2 000-line file ~0.7 s. A per-heads cache is the first performance item for 0.2.
30	+	- `State` holds `Rc` values, so a cross-thread cache needs a `Send` snapshot type in `oxy-core` first.

1	+	<!doctype html>
2	+	<html lang="en">
3	+	<head>
4	+	<meta charset="utf-8">
5	+	<meta name="viewport" content="width=device-width, initial-scale=1">
6	+	<title>{% block title %}{{ shell.site }}{% endblock %} · {{ shell.site }}</title>
7	+	<link rel="stylesheet" href="/style.css">
8	+	<link rel="icon" href="/favicon.svg" type="image/svg+xml">
9	+	<script>(function(){var m=document.cookie.match(/(?:^\|; )theme=(light\|dark\|auto)/);if(m&&m[1]!=="auto")document.documentElement.dataset.theme=m[1];})();</script>
10	+	</head>
11	+	<body{% block bodyattrs %}{% endblock %}>
12	+	<header>
13	+	<a class="brand px" href="/">OXY<span>◆</span>GEN</a>
14	+	<form class="find" action="/search" method="get" role="search"><input type="search" name="q" placeholder="Search…" aria-label="Search" autocomplete="off"></form>
15	+	<nav>
16	+	<a class="go" href="/explore">EXPLORE</a>
17	+	</nav>
18	+	</header>
19	+	<div class="band">
20	+	<a href="/">Repositories</a>
21	+	<a href="/explore">Explore</a>
22	+	<span class="grow"></span>
23	+	<a class="dim" href="/{{ shell.version }}" title="Oxygenhub {{ shell.version }}" tabindex="-1">v{{ shell.version }}</a>
24	+	</div>
25	+	{% block tabs %}{% endblock %}
26	+	<main{% block mainclass %}{% endblock %}>
27	+	{% block content %}{% endblock %}
28	+	</main>
29	+	<footer>
30	+	<div class="foot">
31	+	<div>
32	+	<a class="brand px" href="/">OXY<span>◆</span>GEN</a>
33	+	<p class="small">{{ shell.site }} · a forge for Oxygen repositories. Nothing here is inferred: what a page says, the object store says.</p>
34	+	</div>
35	+	<div class="cols">
36	+	<div><h3>Use</h3><a href="/explore">Explore</a><a href="/api/v1/repos">API</a><a href="/.well-known/oxyhub-key">Hub key</a></div>
37	+	<div><h3>Keys</h3><span class="small"><kbd>/</kbd> search · <kbd>g</kbd><kbd>c</kbd> code · <kbd>g</kbd><kbd>h</kbd> history · <kbd>?</kbd> help</span></div>
38	+	</div>
39	+	</div>
40	+	</footer>
41	+	<div id="keys" class="sheet" hidden>
42	+	<h2>Keyboard</h2>
43	+	<table><tr><td><kbd>/</kbd></td><td>Search</td></tr><tr><td><kbd>g</kbd> <kbd>c</kbd></td><td>Code</td></tr><tr><td><kbd>g</kbd> <kbd>h</kbd></td><td>History</td></tr><tr><td><kbd>g</kbd> <kbd>b</kbd></td><td>Bookmarks</td></tr><tr><td><kbd>g</kbd> <kbd>t</kbd></td><td>Trust</td></tr><tr><td><kbd>?</kbd></td><td>This sheet</td></tr></table>
44	+	</div>
45	+	<script src="/static/hub.js" defer></script>
46	+	</body>
47	+	</html>

1	+	{% extends "base.html" %}
2	+	{% import "repo_tabs.html" as m %}
3	+	{% block title %}Bookmarks · {{ repo.owner }}/{{ repo.name }}{% endblock %}
4	+	{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}
5	+	{% block tabs %}{% call m::tabs(repo, "bookmarks") %}{% endblock %}
6	+	{% block content %}
7	+	<div class="head"><h1>Bookmarks <small>{{ bookmarks.len() }}</small></h1></div>
8	+	<div class="table"><table>
9	+	<tr><th>Bookmark</th><th>Heads</th><th>Changes</th><th>Latest</th><th></th></tr>
10	+	{% for b in bookmarks %}
11	+	<tr>
12	+	<td class="px"><a href="{{ repo.url }}/tree/{{ b.name }}">{{ b.name }}</a>{% if b.default %} <span class="tag">default</span>{% endif %}{% if b.conflicted %} <span class="tag bad">conflicts</span>{% endif %}</td>
13	+	<td>{% for h in b.heads %}<a class="chip" href="{{ repo.url }}/change/{{ h }}">{{ h\|short }}</a> {% endfor %}{% if b.heads.len() > 1 %}<span class="tag warn">{{ b.heads.len() }} heads</span>{% endif %}</td>
14	+	<td>{{ b.changes }}</td>
15	+	<td><time title="{{ b.latest_ms\|when }}">{{ b.latest_ms\|ago }}</time></td>
16	+	<td class="small"><a href="{{ repo.url }}/changes/{{ b.name }}">history</a>{% if !b.default %} · <a href="{{ repo.url }}/compare/{{ repo.default_bookmark }}...{{ b.name }}">compare with {{ repo.default_bookmark }}</a>{% endif %}</td>
17	+	</tr>
18	+	{% endfor %}
19	+	</table></div>
20	+	{% endblock %}

1	+	{% extends "base.html" %}
2	+	{% import "repo_tabs.html" as m %}
3	+	{% block title %}{{ c.view.title }} · {{ c.view.short }} · {{ repo.owner }}/{{ repo.name }}{% endblock %}
4	+	{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}
5	+	{% block tabs %}{% call m::tabs(repo, "changes") %}{% endblock %}
6	+	{% block mainclass %} class="wide"{% endblock %}
7	+	{% block content %}
8	+	<article class="change">
9	+	<div class="head"><h1>{{ c.view.title }} <small class="px">{{ c.view.short }}</small></h1></div>
10	+	{{ body_html\|safe }}
11	+	<dl class="facts">
12	+	<dt>Author</dt><dd>{{ c.view.author.name }}{% if !c.view.author.email.is_empty() %} <span class="mute"><{{ c.view.author.email }}></span>{% endif %}{% if c.view.author.unknown && !c.view.author.key.is_empty() %} <span class="tag">unlinked key</span>{% endif %}</dd>
13	+	<dt>When</dt><dd><time title="{{ c.view.when_ms\|when }}">{{ c.view.when_ms\|ago }}</time> · {{ c.view.when_ms\|when }}</dd>
14	+	<dt>Signature</dt><dd>{% call m::sig(c.view.signature) %} {{ c.view.signature.title() }}</dd>
15	+	<dt>Hash</dt><dd><code class="full">{{ c.view.hash }}</code> <button class="small" data-copy="{{ c.view.hash }}">copy</button></dd>
16	+	<dt>Depends on</dt><dd>{% if c.deps.is_empty() %}<span class="mute">nothing: a root change</span>{% else %}{% for d in c.deps %}<a class="chip" href="{{ repo.url }}/change/{{ d.hash }}" title="{{ d.title }}">{{ d.short }}</a> {% endfor %}{% endif %}</dd>
17	+	<dt>Depended on by</dt><dd>{% if c.dependents.is_empty() %}<span class="mute">nothing yet</span>{% else %}{% for d in c.dependents %}<a class="chip" href="{{ repo.url }}/change/{{ d.hash }}" title="{{ d.title }}">{{ d.short }}</a> {% endfor %}{% endif %}</dd>
18	+	<dt>In bookmarks</dt><dd>{% for b in c.in_bookmarks %}<a class="lbl lbl-bm" href="{{ repo.url }}/tree/{{ b }}">{{ b }}</a> {% endfor %}{% if c.in_bookmarks.is_empty() %}<span class="mute">none</span>{% endif %}</dd>
19	+	{% if !c.in_tags.is_empty() %}<dt>In tags</dt><dd>{% for t in c.in_tags %}<a class="lbl lbl-tag" href="{{ repo.url }}/tree/{{ t }}">{{ t }}</a> {% endfor %}</dd>{% endif %}
20	+	<dt>Edits</dt><dd>{{ c.atoms\|plural("atom", "atoms") }}, {{ c.tree_ops\|plural("tree operation", "tree operations") }}, {{ files.len()\|plural("file", "files") }}</dd>
21	+	</dl>
22	+	<p class="small"><a href="{{ repo.url }}/tree/{{ c.view.hash }}">Browse the tree at this change</a></p>
23	+	<nav class="files small">{% for f in files %}<a href="#{{ f.anchor }}">{{ f.path }}</a>{% endfor %}</nav>
24	+	{% call m::diff(files) %}
25	+	</article>
26	+	{% endblock %}

1	+	{% extends "base.html" %}
2	+	{% import "repo_tabs.html" as m %}
3	+	{% block title %}Compare {{ cmp.base.label\|short }}...{{ cmp.head.label\|short }} · {{ repo.owner }}/{{ repo.name }}{% endblock %}
4	+	{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}
5	+	{% block tabs %}{% call m::tabs(repo, "changes") %}{% endblock %}
6	+	{% block mainclass %} class="wide"{% endblock %}
7	+	{% block content %}
8	+	<div class="head"><h1>Compare <small>{{ cmp.base.label }} … {{ cmp.head.label }}</small></h1></div>
9	+	<p class="lead">{{ cmp.added.len()\|plural("change", "changes") }} in <strong>{{ cmp.head.label }}</strong> not in <strong>{{ cmp.base.label }}</strong>{% if cmp.missing > 0 %}; {{ cmp.missing }} the other way{% endif %}. {{ files.len()\|plural("file", "files") }} differ between the two states.</p>
10	+	{% for c in cmp.added %}{% call m::change_row(repo, c) %}{% endfor %}
11	+	{% call m::diff(files) %}
12	+	{% endblock %}