Delete bookmarks: a button for writers, pushed deletions checked e271a37b629a

    fn default_bookmark(&self, name: &str) -> Option<String> {

        let parsed = RepoName::parse(name)?;

        self.row(&parsed).ok().map(|r| r.default_bookmark)

    }

        .route("/{owner}/{name}/bookmarks/delete", post(refs::delete_bookmark))

use super::settings::{csrf, require};

use super::{filters, lookup, lookup_role, Error, Page, RepoShell, Shell};

use crate::auth::{Access, Role, Viewer};

use axum::extract::{Form, Path, State};

use serde::Deserialize;

    /// Whether the viewer may delete bookmarks (write access).

    can_delete: bool,

    notice: Option<String>,

    error: Option<String>,

async fn bookmarks_page(

    app: &Shared,

    shell: Shell,

    repo: crate::repos::RepoName,

    row: db::repos::RepoRow,

    role: Role,

    notice: Option<String>,

    error: Option<String>,

) -> Result<Page<BookmarksPage>, Error> {

    let default = row.default_bookmark.clone();

    let bookmarks =

        app.repos.read(&repo, move |r, cache| view::bookmarks(r, cache, &default)).await.map_err(|e| Error::from_repo(shell.clone(), e))?;

    let can_delete = shell.user.is_some() && role >= Role::Write;

    Ok(Page(BookmarksPage { shell, repo: RepoShell::new(app, &row, "bookmarks").with_role(role), bookmarks, can_delete, notice, error }))

}

    bookmarks_page(&app, shell, repo, row, role, None, None).await

}

#[derive(Deserialize)]

pub struct DeleteBookmarkForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    bookmark: String,

}

/// Delete a bookmark from the web (hub spec §6.4): what `oxy push --delete`

/// does, through the same checks. Never the default bookmark; refused under

/// a trust policy, which needs a signed attestation only a client can make.

pub async fn delete_bookmark(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<DeleteBookmarkForm>,

) -> Result<Page<BookmarksPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/bookmarks"), &viewer);

    let me = require(&viewer, &shell)?;

    let (repo, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Write).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let bookmark = f.bookmark.trim().to_string();

    if bookmark == row.default_bookmark {

        let msg = format!("{bookmark} is the default bookmark; choose another default in Settings first.");

        return bookmarks_page(&app, shell, repo, row, role, None, Some(msg)).await;

    }

    let target = bookmark.clone();

    let outcome = app

        .repos

        .write(&repo, move |r, _| {

            let Some(state) = r.view()?.bookmarks.get(&target).copied() else {

                return Ok(Err(format!("There is no bookmark {target}.")));

            };

            let update = oxy_core::protocol::RefUpdate {

                name: target.clone(),

                old_state: state,

                new_state: oxy_core::hash::ObjectRef::ZERO,

                force: true,

                attestation: None,

            };

            let report = r.receive_push_report(Default::default(), vec![update], None, vec![])?;

            Ok(match report.results.first() {

                Some(res) if res.ok => Ok(state.to_hex()),

                Some(res) => Err(res.reason.clone()),

                None => Err("nothing happened".into()),

            })

        })

        .await

        .map_err(|e| Error::from_repo(shell.clone(), e))?;

    let old_state = match outcome {

        Ok(s) => s,

        Err(msg) => return bookmarks_page(&app, shell, repo, row, role, None, Some(format!("Could not delete {bookmark}: {msg}"))).await,

    };

    let result = db::repos::PushOutcome {

        reference: bookmark.clone(),

        ok: true,

        reason: "deleted on the web".into(),

        old_state: old_state.clone(),

        new_state: oxy_core::hash::ObjectRef::ZERO.to_hex(),

        heads: 0,

        changes: 0,

    };

    db::repos::record_push(&app.db, row.id, Some((me.account.id, &me.account.username)), &[result]).await.ok();

    crate::hooks::emit(

        &app,

        &row,

        "push",

        &me.account.username,

        serde_json::json!({ "updates": [{ "reference": bookmark, "old_state": old_state, "new_state": oxy_core::hash::ObjectRef::ZERO.to_hex(), "heads": 0, "changes": 0, "deleted": true }], "via": "web" }),

    )

    .await;

    db::accounts::audit(&app.db, Some(&me.account), "bookmark.deleted", &format!("{owner}/{name}"), &bookmark).await.ok();

    bookmarks_page(

        &app,

        shell,

        repo,

        row,

        role,

        Some(format!("Deleted {bookmark}. Its changes stay while anything else reaches them.")),

        None,

    )

    .await

/// Deleting bookmarks (hub spec §6.4): pushed deletions and the delete

/// button, never the repository's default bookmark as the hub sets it.

#[tokio::test(flavor = "multi_thread")]

async fn bookmarks_are_deleted_by_push_and_on_the_web() {

    let h = hub().await;

    let app = &h.app;

    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))

        .await

        .cookie

        .unwrap();

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let (w, u) = (work.path().to_path_buf(), url.clone());

    let client = tokio::task::spawn_blocking(move || {

        let mut c = Repo::init(&w).unwrap();

        c.config.set("remote.origin.url", &u).unwrap();

        c.config.set("remote.origin.token", "site").unwrap();

        c.save_config().unwrap();

        write(&w, "a.txt", b"a\n");

        c.commit("a", &[]).unwrap();

        assert!(c.push("origin", false).unwrap()[0].ok);

        for b in ["develop", "feature/x", "stray"] {

            c.bookmark_create(b, None).unwrap();

            assert!(c.push_bookmark("origin", b, false).unwrap()[0].ok);

        }

        // A pushed deletion.

        let r = c.push_delete("origin", "feature/x").unwrap();

        assert!(r[0].ok, "{r:?}");

        c

    })

    .await

    .unwrap();

    let page = call(app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;

    assert!(!page.body.contains(">feature/x<") && page.body.contains(">stray<"), "{}", page.body);

    assert!(page.body.contains("/andy/demo/bookmarks/delete"), "writers see delete buttons");

    let anon = call(app, "GET", "/andy/demo/bookmarks", None, None, None, None).await;

    assert!(!anon.body.contains("/bookmarks/delete"));

    // The hub's default, not the repository's config, is protected: make

    // develop the default, then main can go and develop cannot.

    let row = oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();

    oxygenhub::db::repos::set_default_bookmark(&app.db, row.id, "develop").await.unwrap();

    let client = tokio::task::spawn_blocking(move || {

        let r = client.push_delete("origin", "develop").unwrap();

        assert!(!r[0].ok && r[0].reason.contains("default bookmark"), "{r:?}");

        let r = client.push_delete("origin", "main").unwrap();

        assert!(r[0].ok, "{r:?}");

        client

    })

    .await

    .unwrap();

    drop(client);

    // On the web: a writer deletes stray; the default is refused.

    let form = |b: &'static str| {

        let (app, andy) = (app.clone(), andy.clone());

        async move {

            let page = call(&app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;

            call(

                &app,

                "POST",

                "/andy/demo/bookmarks/delete",

                None,

                Some(&andy),

                None,

                Some(&format!("_csrf={}&bookmark={b}", csrf_of(&page.body))),

            )

            .await

        }

    };

    let r = form("stray").await;

    assert!(r.body.contains("Deleted stray"), "{}", r.body);

    assert!(!r.body.contains(">stray<"));

    let r = form("develop").await;

    assert!(r.body.contains("is the default bookmark"), "{}", r.body);

    let r = form("nope").await;

    assert!(r.body.contains("There is no bookmark nope"), "{}", r.body);

    let pushes = call(app, "GET", "/andy/demo/pushes", None, Some(&andy), None, None).await;

    assert!(pushes.body.contains("deleted on the web"), "logged like a push");

    // Anonymous visitors cannot.

    assert_ne!(

        call(app, "POST", "/andy/demo/bookmarks/delete", None, None, None, Some("_csrf=x&bookmark=develop")).await.status,

        StatusCode::OK

    );

}

| `/{owner}/{name}/bookmarks` | Bookmarks with heads, ahead/behind the default, last update, attestation status. Writers delete any bookmark but the default one: what `oxy push --delete` does, through the same checks (refused under a trust policy, which needs a signed attestation only a client can make), logged on the pushes page and sent to webhooks as a push. A pushed deletion of the default bookmark (the hub's setting, not the repository's config) is refused |

{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

  <td class="small"><a href="{{ repo.url }}/changes/{{ b.name }}">history</a>{% if !b.default %} · <a href="{{ repo.url }}/compare/{{ repo.default_bookmark }}...{{ b.name }}">compare with {{ repo.default_bookmark }}</a>{% if can_delete %}

    <form class="inline" method="post" action="{{ repo.url }}/bookmarks/delete"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="bookmark" value="{{ b.name }}"><button type="submit" class="small danger-btn" onclick="return confirm('Delete the bookmark {{ b.name }}? Its changes stay while anything else reaches them.')">DELETE</button></form>{% endif %}{% endif %}</td>