Projects API: list, create, board, edit, and cards by reference or note, moved and removed, with the pages' rules ef20fdc14e8b

//! Projects over the API (hub spec §8.2, §12.1): the same rules as the

//! pages, through the functions they use.

use super::{caller, forbidden, not_found, ApiError, Caller};

use crate::db::projects as pdb;

use crate::web::projects as wp;

use crate::Shared;

use axum::extract::{Path, State};

use axum::http::{HeaderMap, StatusCode};

use axum::Json;

use hub_api::{Board, CardMove, NewCard, NewProject, Project, ProjectCard, ProjectColumn, ProjectEdit};

fn project_of(app: &Shared, p: &pdb::Project) -> Project {

    Project {

        owner: p.owner.clone(),

        number: p.number,

        title: p.title.clone(),

        description: p.description.clone(),

        public: p.public,

        closed: p.closed,

        updated_ms: p.updated_ms,

        url: format!("{}/projects/{}/{}", app.config.base_url().trim_end_matches('/'), p.owner, p.number),

    }

}

fn card_of(v: &wp::CardView) -> ProjectCard {

    ProjectCard { id: v.card.id, kind: v.card.kind.clone(), reference: v.reference.clone(), title: v.title.clone(), state: v.state.clone() }

}

async fn rights(app: &Shared, c: &Caller, owner: &str) -> Result<wp::Rights, ApiError> {

    wp::rights_of(app, c.account.as_ref(), owner).await?.ok_or_else(|| not_found("no such owner"))

}

/// A project the caller may see.

async fn visible(app: &Shared, c: &Caller, owner: &str, number: i64) -> Result<(wp::Rights, pdb::Project), ApiError> {

    let r = rights(app, c, owner).await?;

    let p = pdb::get(&app.db, owner, number).await?.filter(|p| p.public || r.member).ok_or_else(|| not_found("no such project"))?;

    Ok((r, p))

}

/// A project the caller may change: a write token, edit rights, and open unless `closed_ok`.

async fn changeable(

    app: &Shared,

    headers: &HeaderMap,

    owner: &str,

    number: i64,

    closed_ok: bool,

) -> Result<(Caller, pdb::Project), ApiError> {

    let c = caller(app, headers).await?;

    c.require("repo:write")?;

    let (r, p) = visible(app, &c, owner, number).await?;

    if !r.edit {

        return Err(forbidden("only the owner (or the organisation's members) may change this project"));

    }

    if p.closed && !closed_ok {

        return Err(ApiError(StatusCode::CONFLICT, "this project is closed; reopen it to change it".into()));

    }

    Ok((c, p))

}

/// A column by id or by name (case-insensitive); the first when absent.

async fn column(app: &Shared, project_id: i64, spec: Option<&str>) -> Result<pdb::Column, ApiError> {

    let cols = pdb::columns(&app.db, project_id).await?;

    let found = match spec.map(str::trim).filter(|s| !s.is_empty()) {

        None => cols.into_iter().next(),

        Some(s) => cols.into_iter().find(|c| c.id.to_string() == s || c.name.eq_ignore_ascii_case(s)),

    };

    found.ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "no such column".into()))

}

/// `GET /projects/{owner}`.

pub async fn list(State(app): State<Shared>, headers: HeaderMap, Path(owner): Path<String>) -> Result<Json<Vec<Project>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let r = rights(&app, &c, &owner).await?;

    let list = pdb::of_owner(&app.db, &owner).await?;

    Ok(Json(list.iter().filter(|p| p.public || r.member).map(|p| project_of(&app, p)).collect()))

}

/// `POST /projects/{owner}`.

pub async fn create(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path(owner): Path<String>,

    Json(body): Json<NewProject>,

) -> Result<(StatusCode, Json<Project>), ApiError> {

    let c = caller(&app, &headers).await?;

    c.require("repo:write")?;

    if !rights(&app, &c, &owner).await?.edit {

        return Err(forbidden("only the owner (or the organisation's members) may create projects"));

    }

    let title = body.title.trim();

    if title.is_empty() || title.chars().count() > 100 {

        return Err(ApiError(StatusCode::BAD_REQUEST, "a project needs a title of up to 100 characters".into()));

    }

    let p = pdb::create(&app.db, &owner, title, body.description.trim(), !body.private).await?;

    crate::db::accounts::audit(&app.db, c.account.as_ref(), "project.created", &format!("{owner}/{}", p.number), title).await.ok();

    Ok((StatusCode::CREATED, Json(project_of(&app, &p))))

}

/// `GET /projects/{owner}/{n}`.

pub async fn board(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number)): Path<(String, i64)>,

) -> Result<Json<Board>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, p) = visible(&app, &c, &owner, number).await?;

    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p).await?;

    Ok(Json(Board {

        project: project_of(&app, &p),

        columns: columns

            .iter()

            .map(|col| ProjectColumn { id: col.column.id, name: col.column.name.clone(), cards: col.cards.iter().map(card_of).collect() })

            .collect(),

    }))

}

/// `PATCH /projects/{owner}/{n}`.

pub async fn edit(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number)): Path<(String, i64)>,

    Json(body): Json<ProjectEdit>,

) -> Result<Json<Project>, ApiError> {

    let (_, p) = changeable(&app, &headers, &owner, number, true).await?;

    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&p.title).chars().take(100).collect::<String>();

    pdb::set(

        &app.db,

        p.id,

        &title,

        body.description.as_deref().map(str::trim).unwrap_or(&p.description),

        body.private.map(|x| !x).unwrap_or(p.public),

        body.closed.unwrap_or(p.closed),

    )

    .await?;

    let fresh = pdb::get(&app.db, &owner, number).await?.unwrap_or(p);

    Ok(Json(project_of(&app, &fresh)))

}

/// `POST /projects/{owner}/{n}/cards`.

pub async fn add_card(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number)): Path<(String, i64)>,

    Json(body): Json<NewCard>,

) -> Result<(StatusCode, Json<ProjectCard>), ApiError> {

    let (c, p) = changeable(&app, &headers, &owner, number, false).await?;

    let col = column(&app, p.id, body.column.as_deref()).await?;

    let actor = c.account.as_ref().map(|a| a.username.clone()).unwrap_or_default();

    let card = match wp::add_card(&app, c.account.as_ref(), &owner, p.id, col.id, &body.reference, "", &body.note, &actor).await? {

        Ok(card) => card,

        Err(why) => return Err(ApiError(StatusCode::BAD_REQUEST, why)),

    };

    // Answer with the card as the board shows it.

    let (columns, _) = wp::board_columns(&app, c.account.as_ref(), &owner, &p).await?;

    let view = columns

        .iter()

        .flat_map(|col| col.cards.iter())

        .find(|v| v.card.id == card.id)

        .map(card_of)

        .ok_or_else(|| not_found("no such card"))?;

    Ok((StatusCode::CREATED, Json(view)))

}

/// `PATCH /projects/{owner}/{n}/cards/{id}`: move to another column.

pub async fn move_card(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number, id)): Path<(String, i64, i64)>,

    Json(body): Json<CardMove>,

) -> Result<StatusCode, ApiError> {

    let (_, p) = changeable(&app, &headers, &owner, number, false).await?;

    let col = column(&app, p.id, Some(&body.column)).await?;

    if !pdb::cards(&app.db, p.id).await?.iter().any(|c| c.id == id) {

        return Err(not_found("no such card"));

    }

    pdb::move_card(&app.db, p.id, id, col.id).await?;

    Ok(StatusCode::NO_CONTENT)

}

/// `DELETE /projects/{owner}/{n}/cards/{id}`.

pub async fn remove_card(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, number, id)): Path<(String, i64, i64)>,

) -> Result<StatusCode, ApiError> {

    let (_, p) = changeable(&app, &headers, &owner, number, false).await?;

    if !pdb::cards(&app.db, p.id).await?.iter().any(|c| c.id == id) {

        return Err(not_found("no such card"));

    }

    pdb::remove_card(&app.db, p.id, id).await?;

    Ok(StatusCode::NO_CONTENT)

}

/// A project (hub spec §8.2).

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct Project {

    pub owner: String,

    pub number: i64,

    pub title: String,

    pub description: String,

    pub public: bool,

    pub closed: bool,

    pub updated_ms: i64,

    /// The board on the hub, absolute.

    pub url: String,

}

/// A card as the caller may see it.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct ProjectCard {

    pub id: i64,

    /// `issue`, `proposal` or `note`.

    pub kind: String,

    /// `owner/name#N`; empty for a note.

    pub reference: String,

    /// The issue's or proposal's title, or the note.

    pub title: String,

    /// The issue's or proposal's state; empty for a note.

    pub state: String,

}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct ProjectColumn {

    pub id: i64,

    pub name: String,

    pub cards: Vec<ProjectCard>,

}

/// `GET /projects/{owner}/{n}`.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct Board {

    pub project: Project,

    pub columns: Vec<ProjectColumn>,

}

/// `POST /projects/{owner}`.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct NewProject {

    pub title: String,

    #[serde(default)]

    pub description: String,

    #[serde(default)]

    pub private: bool,

}

/// `PATCH /projects/{owner}/{n}`: only the fields given change.

#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct ProjectEdit {

    #[serde(default)]

    pub title: Option<String>,

    #[serde(default)]

    pub description: Option<String>,

    #[serde(default)]

    pub private: Option<bool>,

    #[serde(default)]

    pub closed: Option<bool>,

}

/// `POST /projects/{owner}/{n}/cards`: a reference (`repo#12`) or a note,

/// into the column named (by id or name; the first column when absent).

#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct NewCard {

    #[serde(default)]

    pub column: Option<String>,

    #[serde(default)]

    pub reference: String,

    #[serde(default)]

    pub note: String,

}

/// `PATCH /projects/{owner}/{n}/cards/{id}`: move to a column (id or name).

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct CardMove {

    pub column: String,

}

        ("Project", schemars::schema_for!(Project)),

        ("ProjectCard", schemars::schema_for!(ProjectCard)),

        ("ProjectColumn", schemars::schema_for!(ProjectColumn)),

        ("Board", schemars::schema_for!(Board)),

        ("NewProject", schemars::schema_for!(NewProject)),

        ("ProjectEdit", schemars::schema_for!(ProjectEdit)),

        ("NewCard", schemars::schema_for!(NewCard)),

        ("CardMove", schemars::schema_for!(CardMove)),

export type Project = {

  closed: boolean;

  description: string;

  number: number;

  owner: string;

  public: boolean;

  title: string;

  updated_ms: number;

  url: string;

};

export type ProjectCard = {

  id: number;

  kind: string;

  reference: string;

  state: string;

  title: string;

};

export type ProjectColumn = {

  cards: ProjectCard[];

  id: number;

  name: string;

};

export type Board = {

  columns: ProjectColumn[];

  project: Project;

};

export type NewProject = {

  description?: string;

  private?: boolean;

  title: string;

};

export type ProjectEdit = {

  closed?: boolean | null;

  description?: string | null;

  private?: boolean | null;

  title?: string | null;

};

export type NewCard = {

  column?: string | null;

  note?: string;

  reference?: string;

};

export type CardMove = {

  column: string;

};

mod projects;

        .route("/projects/{owner}", get(projects::list).post(projects::create))

        .route("/projects/{owner}/{number}", get(projects::board).patch(projects::edit))

        .route("/projects/{owner}/{number}/cards", post(projects::add_card))

        .route("/projects/{owner}/{number}/cards/{id}", axum::routing::patch(projects::move_card).delete(projects::remove_card))

pub(crate) fn not_found(what: &str) -> ApiError {

pub(crate) fn forbidden(what: &str) -> ApiError {

pub mod projects;

/// What a caller may do with an owner's projects.

pub struct Rights {

    pub member: bool,

    pub edit: bool,

/// Rights of `account` (anonymous when `None`) over `owner`'s projects;

/// `None` when there is no such person or organisation.

pub async fn rights_of(app: &Shared, account: Option<&db::accounts::Account>, owner: &str) -> sqlx::Result<Option<Rights>> {

    let admin = account.is_some_and(|a| a.is_admin);

    if let Some(a) = db::accounts::account_by_name(&app.db, owner).await? {

        let me = account.is_some_and(|v| v.id == a.id);

        return Ok(Some(Rights { member: me || admin, edit: me || admin }));

    if let Some(o) = db::accounts::org_by_name(&app.db, owner).await? {

        let member = match account {

            Some(v) => db::accounts::org_role(&app.db, o.id, v.id).await?.is_some(),

        return Ok(Some(Rights { member: member || admin, edit: member || admin }));

    Ok(None)

}

async fn rights(app: &Shared, shell: &Shell, viewer: &Viewer, owner: &str) -> Result<Rights, Error> {

    rights_of(app, viewer.account(), owner)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?

        .ok_or_else(|| Error::not_found(shell.clone()))

    let (columns, repos) = board_columns(app, viewer.account(), owner, &project).await.map_err(e)?;

    let can_edit = r.edit && !project.closed;

    Ok(Page(BoardPage { shell, project, columns, repos, can_edit, can_manage: r.edit, notice, error }))

}

/// A project's columns with the cards `account` may see, and the owner's

/// repositories it can read (for adding cards).

pub async fn board_columns(

    app: &Shared,

    account: Option<&db::accounts::Account>,

    owner: &str,

    project: &pdb::Project,

) -> sqlx::Result<(Vec<ColumnView>, Vec<String>)> {

    for row in db::repos::list_by_owner(&app.db, owner).await? {

        let role = roles::role_for(&app.db, account, &row).await?;

    let cards = pdb::cards(&app.db, project.id).await?;

    for column in pdb::columns(&app.db, project.id).await? {

                        match db::issues::get(&app.db, rid, n).await? {

                        match db::proposals::get(&app.db, rid, n).await? {

    Ok((columns, repos))

}

/// Add a note, or the issue or proposal `reference` names (`repo#12`, or

/// `#12` with `repo`), to a column. `Ok(Err(why))` for what the caller

/// should be told: an unknown repository or number, or a card already there.

#[allow(clippy::too_many_arguments)]

pub async fn add_card(

    app: &Shared,

    account: Option<&db::accounts::Account>,

    owner: &str,

    project_id: i64,

    column_id: i64,

    reference: &str,

    repo: &str,

    note: &str,

    actor: &str,

) -> sqlx::Result<Result<pdb::Card, String>> {

    if !note.trim().is_empty() {

        let note: String = note.trim().chars().take(500).collect();

        pdb::add_card(

            &app.db,

            project_id,

            pdb::NewCard { column_id, kind: "note", repo_id: None, number: None, note: &note, added_by: actor },

        )

        .await?;

        return Ok(Ok(newest_card(app, project_id).await?));

    }

    let Some((repo, n)) = parse_reference(reference, repo) else {

        return Ok(Err("Name an issue or proposal as repo#12, or write a note.".into()));

    };

    let Some(row) = db::repos::get(&app.db, owner, &repo).await? else { return Ok(Err(format!("{owner} has no repository {repo}."))) };

    let role = roles::role_for(&app.db, account, &row).await?;

    let (issues, proposals) = db::issues::numbers(&app.db, row.id).await?;

    let kind = if issues.contains(&n) {

        "issue"

    } else if proposals.contains(&n) {

        "proposal"

    } else {

        return Ok(Err(format!("{repo} has no issue or proposal #{n}.")));

    };

    if !roles::allows(role, Access::Read) {

        return Ok(Err(format!("{repo} has no issue or proposal #{n}.")));

    }

    if !pdb::add_card(

        &app.db,

        project_id,

        pdb::NewCard { column_id, kind, repo_id: Some(row.id), number: Some(n), note: "", added_by: actor },

    )

    .await?

    {

        return Ok(Err(format!("{repo}#{n} is already on this project.")));

    }

    Ok(Ok(newest_card(app, project_id).await?))

}

async fn newest_card(app: &Shared, project_id: i64) -> sqlx::Result<pdb::Card> {

    sqlx::query_as("SELECT * FROM project_cards WHERE project_id = ? ORDER BY id DESC LIMIT 1").bind(project_id).fetch_one(&app.db).await

            if let Err(msg) =

                add_card(&app, viewer.account(), &owner, project.id, column_id, &f.reference, &f.repo, &f.note, &actor).await.map_err(e)?

            {

                error = Some(msg);

#[tokio::test(flavor = "multi_thread")]

async fn api_projects() {

    let h = hub().await;

    let app = &h.app;

    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))

        .await

        .cookie

        .unwrap();

    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))

        .await

        .cookie

        .unwrap();

    let mint = |cookie: String, scopes: &'static str| {

        let app = app.clone();

        async move {

            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;

            let csrf = csrf_of(&page.body);

            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;

            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()

        }

    };

    let a = mint(andy, "scopes=repo%3Aadmin").await;

    let b = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;

    api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;

    api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&a), Some(r#"{"title":"Crash"}"#)).await;

    let (st, p) = api(app, "POST", "/api/v1/projects/andy", Some(&a), Some(r#"{"title":"Roadmap","description":"Next"}"#)).await;

    assert_eq!((st, p["number"].as_i64()), (StatusCode::CREATED, Some(1)), "{p}");

    assert!(p["url"].as_str().unwrap().ends_with("/projects/andy/1"));

    assert_eq!(api(app, "POST", "/api/v1/projects/andy", Some(&b), Some(r#"{"title":"Mine"}"#)).await.0, StatusCode::FORBIDDEN);

    assert_eq!(api(app, "POST", "/api/v1/projects/nobody", Some(&a), Some(r#"{"title":"X"}"#)).await.0, StatusCode::NOT_FOUND);

    // Cards by reference, into a column by name, and a note into the first column.

    let (st, card) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"doing"}"#)).await;

    assert_eq!(st, StatusCode::CREATED, "{card}");

    assert_eq!(

        (card["kind"].as_str(), card["reference"].as_str(), card["title"].as_str(), card["state"].as_str()),

        (Some("issue"), Some("andy/demo#1"), Some("Crash"), Some("open"))

    );

    let (st, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1"}"#)).await;

    assert_eq!(st, StatusCode::BAD_REQUEST);

    assert!(v["detail"].as_str().unwrap().contains("already on this project"));

    assert_eq!(

        api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"nope"}"#)).await.0,

        StatusCode::BAD_REQUEST

    );

    let (st, note) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"Write docs"}"#)).await;

    assert_eq!((st, note["kind"].as_str()), (StatusCode::CREATED, Some("note")));

    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&b), Some(r#"{"note":"hi"}"#)).await.0, StatusCode::FORBIDDEN);

    // Move and read the board.

    let id = card["id"].as_i64().unwrap();

    assert_eq!(

        api(app, "PATCH", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), Some(r#"{"column":"Done"}"#)).await.0,

        StatusCode::NO_CONTENT

    );

    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;

    let names: Vec<(&str, usize)> =

        board["columns"].as_array().unwrap().iter().map(|c| (c["name"].as_str().unwrap(), c["cards"].as_array().unwrap().len())).collect();

    assert_eq!(names, [("Backlog", 1), ("Doing", 0), ("Done", 1)]);

    assert_eq!(board["columns"][2]["cards"][0]["reference"], "andy/demo#1");

    // Private: hidden from others; closed: read-only; then remove a card.

    let (_, edited) = api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"private":true}"#)).await;

    assert_eq!(edited["public"], false);

    assert_eq!(api(app, "GET", "/api/v1/projects/andy/1", Some(&b), None).await.0, StatusCode::NOT_FOUND);

    assert_eq!(api(app, "GET", "/api/v1/projects/andy", None, None).await.1, serde_json::json!([]));

    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":true}"#)).await;

    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"late"}"#)).await.0, StatusCode::CONFLICT);

    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":false}"#)).await;

    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NO_CONTENT);

    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NOT_FOUND);

}

JSON under `/api/v1`, bearer tokens, `application/json`, RFC 7807 problem responses, cursor pagination (`?after=`), ETags on cacheable resources, and rate limits per token. Resources mirror the pages: `/repos/{owner}/{name}`, `/bookmarks`, `/changes/{hash}`, `/tree/{ref}/{path}`, `/file/{ref}/{path}`, `/blame`, `/history`, `/compare`, `/conflicts`, `/proposals`, `/proposals/{n}/comments|reviews|checks|files|land`, `/proposals/{n}/content/{base|head}/{path}` (a changed file's bytes in the target's state or the projected state, for editor diff views), `/issues` (creating an issue can set its labels, assignees and milestone; `PATCH /issues/{n}` edits the title and body for the author or triage, and replaces labels, assignees or the milestone for triage, recording each on the timeline; unknown names are refused before anything changes), `/labels` (`POST` creates or changes one, `DELETE /labels/{name}` removes it; triage), `/milestones`, `/releases`, `/tags`, `/trust`, `/pushes`, `/hooks`, `/checks`, `/user`, `/notifications` (the caller's inbox and unread count; `/notifications/{id}/read` and `/notifications/read` mark read; scope `user:read`), `/users/{name}`, `/orgs/{name}`, `/projects/{owner}` (list, create) and `/projects/{owner}/{n}` (the board as the caller may see it, `PATCH` for title, description, privacy and closing, `/cards` to add a reference or note to a column named by id or name, `/cards/{id}` to move or remove one; `repo:write` and the page's rights to change), `/search`. Shapes reuse `oxy --json` shapes wherever one exists (change, status, blame, diff) so tools written against the CLI work against the hub. `crates/hub-api` holds the types with `serde` derives and is what the runner and the VS Code extension will link.