OXYGENHUB

Coverage / crates/hub/src/api/mod.rs 85.2%

2419 of 2840 lines run, 360 of 972 functions · run #469 on main · run missed

1
//! The JSON API (hub spec §12.1) under `/api/v1`: bearer tokens, RFC 7807
2
//! problems, the same shapes as `oxy --json` where one exists. Reads need
3
//! `repo:read` (anonymous for public repositories); writes the scope named
4
//! on each handler.
5
6
use crate::auth::{self, Access, Role};
7
use crate::db::{self, accounts::Account};
8
use crate::repos::{view, RepoError, RepoName};
9
use crate::Shared;
10
use axum::extract::{Path, Query, State};
11
use axum::http::{HeaderMap, StatusCode};
12
use axum::response::{IntoResponse, Response};
13
use axum::routing::{get, post};
14
use axum::{Json, Router};
15
use hub_api::*;
16
use serde::Deserialize;
17
18
mod backups;
19
pub mod device;
20
mod drops;
21
mod images;
22
mod projects;
23
mod reports;
24
25
/// Any other path under `/api/v1`: a problem document, not the site's page.
26
/// `GET /api/v1/version`: the hub's version and build, and the Oxygen and
27
/// OxygenFlow library versions it is built on.
281×
async fn version() -> Json<serde_json::Value> {
291×
    Json(crate::web::home::versions())
301×
}
31
321×
async fn no_route() -> ApiError {
331×
    ApiError(StatusCode::NOT_FOUND, "no such API route".into())
341×
}
35
36
/// A known route asked with a method it does not take: a problem body
37
/// rather than axum's empty 405 (oxygenhub#115).
381×
async fn wrong_method(method: axum::http::Method, uri: axum::http::Uri) -> ApiError {
391×
    ApiError(StatusCode::METHOD_NOT_ALLOWED, format!("{} is an API route, but not for {method}", uri.path()))
401×
}
41
42
/// The API, with release assets up to `asset_limit` bytes (the web form's
43
/// limit too; axum's default of 2 MiB refused ordinary builds).
442605×
pub fn router(asset_limit: usize) -> Router<Shared> {
452605×
    Router::new()
462605×
        .fallback(no_route)
472605×
        .route("/keyless/certify", post(crate::keyless::certify))
482605×
        .route("/agents/grants", get(crate::keyless::grants_list).post(crate::keyless::grants_create))
492605×
        .route(
502605×
            "/repos/{owner}/{name}/terraform/state/{state}",
512605×
            axum::routing::any(crate::terraform::state)
522605×
                .layer(axum::extract::DefaultBodyLimit::max(crate::terraform::MAX_STATE_BYTES + 4096)),
53
        )
542605×
        .route("/repos/{owner}/{name}/terraform/state/{state}/versions", axum::routing::get(crate::terraform::versions))
552605×
        .route("/repos/{owner}/{name}/terraform/state/{state}/versions/{id}", axum::routing::get(crate::terraform::version))
562605×
        .route(
572605×
            "/repos/{owner}/{name}/terraform/state/{state}/versions/{id}/restore",
582605×
            axum::routing::post(crate::terraform::restore_version),
59
        )
602605×
        .route("/agents/grants/{id}", axum::routing::delete(crate::keyless::grants_revoke))
612605×
        .route("/flow/claim", post(crate::flow::claim))
622605×
        .route("/flow/runners/register", post(crate::flow::register))
632605×
        .route("/flow/runners/heartbeat", post(crate::flow::heartbeat))
642605×
        .route("/flow/runner/update", get(crate::flow::runner_update).post(crate::flow::report_update))
652605×
        .route("/flow/images/missing", post(images::missing).layer(axum::extract::DefaultBodyLimit::max(images::MAX_ASK_BYTES)))
662605×
        .route("/flow/swarm/announce", post(crate::swarm::announce))
672605×
        .route("/flow/images/chunks/{hash}", axum::routing::put(images::put_chunk).get(images::get_chunk))
682605×
        .route(
692605×
            "/flow/images/{hash}",
702605×
            axum::routing::put(images::put_manifest).get(images::get_manifest).layer(axum::extract::DefaultBodyLimit::max(64 << 20)),
71
        )
722605×
        .route("/flow/jobs/{id}/log", post(crate::flow::log))
732605×
        .route("/flow/jobs/{id}/finish", post(crate::flow::finish))
742605×
        .route("/flow/jobs/{id}/decline", post(crate::flow::decline))
752605×
        .route("/flow/jobs/{id}/release", post(crate::flow::release))
762605×
        .route(
772605×
            "/flow/jobs/{id}/checkpoint",
782605×
            post(crate::flow::save_checkpoint)
792605×
                .get(crate::flow::checkpoint)
802605×
                .layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
81
        )
822605×
        .route(
832605×
            "/flow/jobs/{id}/artifacts/{name}",
842605×
            post(crate::flow::artifact).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
85
        )
862605×
        .route("/flow/jobs/{id}/inputs/{index}", get(crate::flow::input))
872605×
        .route(
882605×
            "/flow/jobs/{id}/reports/{name}/files",
892605×
            post(crate::flow::report_file).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
90
        )
912605×
        .route("/projects/{owner}", get(projects::list).post(projects::create))
922605×
        .route("/projects/{owner}/{number}", get(projects::board).patch(projects::edit))
932605×
        .route("/projects/{owner}/{number}/cards", get(projects::cards).post(projects::add_card))
942605×
        .route("/projects/{owner}/{number}/cards/move", post(projects::move_cards))
952605×
        .route("/projects/{owner}/{number}/cards/archive", post(projects::archive_cards))
962605×
        .route("/projects/{owner}/{number}/cards/{id}/restore", post(projects::restore_card))
972605×
        .route("/projects/{owner}/{number}/cards/{id}", axum::routing::patch(projects::move_card).delete(projects::remove_card))
982605×
        .route("/device/code", post(device::code).delete(device::cancel))
992605×
        .route("/device/token", post(device::token))
1002605×
        .route("/runners", get(runners))
1012605×
        .route("/runners/queue", get(runner_queue))
1022605×
        .route("/runners/{id}/jobs", get(runner_jobs))
1032605×
        .route("/user", get(me))
1042605×
        .route("/user/repos", get(user_repos))
1052605×
        .route("/user/orgs", get(user_orgs))
1062605×
        .route("/user/proposals", get(user_proposals))
1072605×
        .route("/user/runner-token", post(user_runner_token))
1082605×
        .route("/user/token", axum::routing::delete(revoke_own_token))
1092605×
        .route("/version", get(version))
1102605×
        .route("/notifications", get(notifications))
1112605×
        .route("/notifications/read", post(notifications_read_all))
1122605×
        .route("/notifications/{id}/read", post(notification_read))
1132605×
        .route("/users/{name}", get(user))
1142605×
        .route("/users/{name}/drops", get(drops::of_user))
1152605×
        .route("/drops", get(drops::mine).post(drops::create))
1162605×
        .route("/drops/{id}", get(drops::view).patch(drops::edit).delete(drops::delete))
1172605×
        .route("/orgs/{name}", get(org))
1182605×
        .route("/search", get(search))
1192605×
        .route("/repos", get(list_repos).post(create_repo))
1202605×
        .route("/repos/{owner}/{name}", get(get_repo))
1212605×
        .route("/repos/{owner}/{name}/bookmarks", get(bookmarks))
1222605×
        .route("/repos/{owner}/{name}/tags", get(tags).post(create_tag))
1232605×
        .route("/repos/{owner}/{name}/tags/{tag}", axum::routing::delete(withdraw_tag))
1242605×
        .route("/repos/{owner}/{name}/consumers", get(consumers))
1252605×
        .route("/repos/{owner}/{name}/diffusion", get(diffusion).put(set_diffusion))
1262605×
        .route("/repos/{owner}/{name}/backup", axum::routing::put(set_backup))
1272605×
        .route("/user/backups", get(backups::user_get).put(backups::user_put))
1282605×
        .route("/user/backups/test", post(backups::user_test))
1292605×
        .route("/user/backups/run", post(backups::user_run))
1302605×
        .route("/user/backups/runs", get(backups::user_runs))
1312605×
        .route("/orgs/{name}/backups", get(backups::org_get).put(backups::org_put))
1322605×
        .route("/orgs/{name}/backups/test", post(backups::org_test))
1332605×
        .route("/orgs/{name}/backups/run", post(backups::org_run))
1342605×
        .route("/orgs/{name}/backups/runs", get(backups::org_runs))
1352605×
        .route("/repos/{owner}/{name}/history/{r}", get(history))
1362605×
        .route("/repos/{owner}/{name}/changes/{hash}", get(change))
1372605×
        .route("/repos/{owner}/{name}/tree/{r}", get(tree_root))
1382605×
        .route("/repos/{owner}/{name}/tree/{r}/{*path}", get(tree))
1392605×
        .route("/repos/{owner}/{name}/file/{r}/{*path}", get(file))
1402605×
        .route("/repos/{owner}/{name}/blame/{r}/{*path}", get(blame))
1412605×
        .route("/repos/{owner}/{name}/conflicts", get(conflicts))
1422605×
        .route("/repos/{owner}/{name}/trust", get(trust))
1432605×
        .route("/repos/{owner}/{name}/releases/trust/{*tag}", get(release_trust))
1442605×
        .route("/repos/{owner}/{name}/pushes", get(pushes))
1452605×
        .route("/repos/{owner}/{name}/proposals", get(proposals).post(create_proposal))
1462605×
        .route("/repos/{owner}/{name}/proposals/{number}", get(proposal).patch(edit_proposal))
1472605×
        .route("/repos/{owner}/{name}/proposals/{number}/land", post(land_proposal))
1482605×
        .route("/repos/{owner}/{name}/proposals/{number}/auto-land", post(auto_land_on).delete(auto_land_off))
1492605×
        .route("/repos/{owner}/{name}/proposals/{number}/comments", get(proposal_comments).post(proposal_comment))
1502605×
        .route("/repos/{owner}/{name}/proposals/{number}/reviews", get(proposal_reviews).post(proposal_review))
1512605×
        .route("/repos/{owner}/{name}/proposals/{number}/reviewers", post(request_reviewers))
1522605×
        .route("/repos/{owner}/{name}/proposals/{number}/review-requests", post(request_assistant))
1532605×
        .route("/repos/{owner}/{name}/proposals/{number}/reviewers/{username}", axum::routing::delete(withdraw_reviewer))
1542605×
        .route("/repos/{owner}/{name}/proposals/{number}/checks", get(proposal_checks))
1552605×
        .route("/repos/{owner}/{name}/proposals/{number}/files", get(proposal_files))
1562605×
        .route("/repos/{owner}/{name}/proposals/{number}/content/{side}/{*path}", get(proposal_content))
1572605×
        .route("/repos/{owner}/{name}/issues", get(issues).post(create_issue))
1582605×
        .route("/repos/{owner}/{name}/issues/{number}", get(issue).post(issue_state).patch(issue_edit))
1592605×
        .route("/repos/{owner}/{name}/issues/{number}/comments", get(issue_comments).post(issue_comment))
1602605×
        .route("/repos/{owner}/{name}/labels", get(labels).post(create_label))
1612605×
        .route("/repos/{owner}/{name}/labels/{label}", axum::routing::delete(delete_label))
1622605×
        .route("/repos/{owner}/{name}/milestones", get(milestones).post(create_milestone))
1632605×
        .route(
1642605×
            "/repos/{owner}/{name}/coverage",
1652605×
            get(reports::coverage_list)
1662605×
                .post(reports::coverage_upload)
1672605×
                .layer(axum::extract::DefaultBodyLimit::max(crate::coverage::MAX_REPORT + (1 << 20))),
168
        )
1692605×
        .route("/repos/{owner}/{name}/coverage/{id}", get(reports::coverage_one))
1702605×
        .route("/repos/{owner}/{name}/tests", get(reports::tests_list))
1712605×
        .route("/repos/{owner}/{name}/tests/{id}", get(reports::tests_one))
1722605×
        .route("/repos/{owner}/{name}/milestones/{title}", axum::routing::patch(edit_milestone))
1732605×
        .route("/repos/{owner}/{name}/hooks", get(hooks).post(create_hook))
1742605×
        .route("/repos/{owner}/{name}/assistants", get(repo_assistants).post(repo_assistant_put))
1752605×
        .route("/repos/{owner}/{name}/assistants/prompt", get(repo_prompt).put(repo_prompt_put))
1762605×
        .route("/repos/{owner}/{name}/assistants/{assistant}", axum::routing::delete(repo_assistant_delete))
1772605×
        .route("/orgs/{org}/assistants", get(org_assistants).post(org_assistant_put))
1782605×
        .route("/orgs/{org}/assistants/prompt", get(org_prompt).put(org_prompt_put))
1792605×
        .route("/orgs/{org}/assistants/{assistant}", axum::routing::delete(org_assistant_delete))
1802605×
        .route("/admin/assistants", get(site_assistants).post(site_assistant_put))
1812605×
        .route("/admin/assistants/prompt", get(site_prompt).put(site_prompt_put))
1822605×
        .route("/admin/assistants/{assistant}", axum::routing::delete(site_assistant_delete))
1832605×
        .route("/repos/{owner}/{name}/hooks/{id}/delete", post(delete_hook))
1842605×
        .route("/repos/{owner}/{name}/checks", post(post_check))
1852605×
        .route("/repos/{owner}/{name}/flow/runs", get(flow_runs).post(start_flow_run))
1862605×
        .route("/repos/{owner}/{name}/flow/runs/{number}", get(flow_run))
1872605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/log", get(flow_job_log))
1882605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/rerun", post(rerun_flow_run))
1892605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/rerun", post(rerun_flow_job))
1902605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/cancel", post(cancel_flow_run))
1912605×
        .route("/repos/{owner}/{name}/deployments", get(list_deployments))
1922605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approve", post(approve_flow_job))
1932605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/reject", post(reject_flow_job))
1942605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approval", get(flow_job_statement))
1952605×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/seal", post(seal_flow_job))
1962605×
        .route("/repos/{owner}/{name}/checks/required", get(required_checks).put(set_required_checks))
1972605×
        .route("/repos/{owner}/{name}/checks/{state}", get(checks_for_state))
1982605×
        .route("/repos/{owner}/{name}/releases", get(releases).post(create_release))
1992605×
        .route("/repos/{owner}/{name}/releases/{tag}", axum::routing::patch(edit_release))
2002605×
        .route(
2012605×
            "/repos/{owner}/{name}/releases/{tag}/assets",
2022605×
            post(upload_asset).layer(axum::extract::DefaultBodyLimit::max(asset_limit + (1 << 20))),
203
        )
204
        // Last: it applies to the routes registered before it.
2052605×
        .method_not_allowed_fallback(wrong_method)
2062605×
}
207
2083×
async fn releases(
2093×
    State(app): State<Shared>,
2103×
    headers: HeaderMap,
2113×
    Path((owner, name)): Path<(String, String)>,
2123×
) -> Result<Json<Vec<Release>>, ApiError> {
2133×
    let c = caller(&app, &headers).await?;
2143×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2153×
    Ok(Json(crate::web::releases::api_views(&app, &repo, &row).await?))
2163×
}
217
2183×
async fn create_release(
2193×
    State(app): State<Shared>,
2203×
    headers: HeaderMap,
2213×
    Path((owner, name)): Path<(String, String)>,
2223×
    Json(body): Json<NewRelease>,
2233×
) -> Result<(StatusCode, Json<Release>), ApiError> {
2243×
    let c = caller(&app, &headers).await?;
2253×
    let me = c.require("repo:write")?.clone();
2263×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2273×
    crate::web::releases::create_release(&app, &repo, &row, &me, &body.tag, &body.title, body.notes, body.prerelease)
2283×
        .await
2293×
        .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
2302×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2312×
        .await?
2322×
        .into_iter()
2332×
        .find(|r| r.tag == body.tag)
2342×
        .ok_or_else(|| not_found("no such release"))?;
2352×
    Ok((StatusCode::CREATED, Json(r)))
2363×
}
237
238
/// `PATCH …/releases/{tag}` (oxygenhub#72): change a release's title,
239
/// notes or prerelease flag, as the release page's Edit does.
2402×
async fn edit_release(
2412×
    State(app): State<Shared>,
2422×
    headers: HeaderMap,
2432×
    Path((owner, name, tag)): Path<(String, String, String)>,
2442×
    Json(body): Json<ReleaseEdit>,
2452×
) -> Result<Json<Release>, ApiError> {
2462×
    let c = caller(&app, &headers).await?;
2472×
    let me = c.require("repo:write")?.clone();
2482×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2492×
    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;
2501×
    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&r.title);
2511×
    let notes = body.notes.as_deref().map(str::trim).unwrap_or(&r.notes);
2521×
    db::releases::edit(&app.db, r.id, title, notes, body.prerelease.unwrap_or(r.prerelease)).await?;
2531×
    db::accounts::audit(&app.db, Some(&me), "release.edited", &format!("{owner}/{name}@{tag}"), "").await.ok();
2541×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2551×
        .await?
2561×
        .into_iter()
2571×
        .find(|r| r.tag == tag)
2581×
        .ok_or_else(|| not_found("no such release"))?;
2591×
    Ok(Json(r))
2602×
}
261
262
#[derive(Deserialize)]
263
struct AssetQuery {
264
    name: String,
265
}
266
267
/// `POST …/releases/{tag}/assets?name=file.tar.gz` with the file as the body.
2683×
async fn upload_asset(
2693×
    State(app): State<Shared>,
2703×
    headers: HeaderMap,
2713×
    Path((owner, name, tag)): Path<(String, String, String)>,
2723×
    Query(q): Query<AssetQuery>,
2733×
    body: axum::body::Bytes,
2743×
) -> Result<(StatusCode, Json<Release>), ApiError> {
2753×
    let c = caller(&app, &headers).await?;
2763×
    c.require("repo:write")?;
2773×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2783×
    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;
2793×
    let ct = headers.get(axum::http::header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or("application/octet-stream").to_string();
2803×
    crate::web::releases::store_asset(&app, r.id, &q.name, &ct, &body).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
2813×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2823×
        .await?
2833×
        .into_iter()
2843×
        .find(|r| r.tag == tag)
2853×
        .ok_or_else(|| not_found("no such release"))?;
2863×
    Ok((StatusCode::CREATED, Json(r)))
2873×
}
288
289
pub struct ApiError(pub StatusCode, pub String);
290
291
impl IntoResponse for ApiError {
292163×
    fn into_response(self) -> Response {
293163×
        let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };
294163×
        (self.0, [("content-type", "application/problem+json")], Json(body)).into_response()
295163×
    }
296
}
297
298
impl From<RepoError> for ApiError {
2991×
    fn from(e: RepoError) -> ApiError {
3000×
        match e {
3011×
            RepoError::NotFound => not_found("no such repository"),
3020×
            RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => ApiError(StatusCode::NOT_FOUND, m),
3030×
            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),
304
        }
3051×
    }
306
}
307
308
impl From<sqlx::Error> for ApiError {
3090×
    fn from(e: sqlx::Error) -> ApiError {
3100×
        ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())
3110×
    }
312
}
313
31421×
pub(crate) fn not_found(what: &str) -> ApiError {
31521×
    ApiError(StatusCode::NOT_FOUND, what.into())
31621×
}
317
31880×
pub(crate) fn forbidden(what: &str) -> ApiError {
31980×
    ApiError(StatusCode::FORBIDDEN, what.into())
32080×
}
321
322
/// The address a request came from: the client's, as the proxy reports
323
/// it when the hub is behind one (`server.behind_proxy`), else the peer's.
324
/// Only an address's characters are kept, so it is safe to show.
3251079×
pub fn client_addr(app: &Shared, headers: &HeaderMap, extensions: &axum::http::Extensions) -> String {
3261079×
    let from_proxy = || {
32730×
        ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"]
32830×
            .iter()
32960×
            .find_map(|h| headers.get(*h).and_then(|v| v.to_str().ok()).and_then(|v| v.split(',').next()).map(|v| v.trim().to_string()))
33030×
    };
3311079×
    let addr = if app.config.server.behind_proxy {
33230×
        from_proxy()
333
    } else {
3341049×
        extensions.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>().map(|c| c.0.ip().to_string())
335
    };
3361079×
    addr.map(|a| a.chars().filter(|c| c.is_ascii_hexdigit() || matches!(c, '.' | ':')).take(45).collect()).unwrap_or_default()
3371079×
}
338
339
/// `DELETE /api/v1/user/token`: revoke the token this request is made
340
/// with, as `oxy auth logout` does.
3412×
async fn revoke_own_token(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
3422×
    let c = caller(&app, &headers).await?;
3432×
    let (Some(account), Some(id)) = (c.account.as_ref(), c.token_id) else {
3441×
        return Err(ApiError(StatusCode::UNAUTHORIZED, "revoking needs the personal access token to revoke".into()));
345
    };
3461×
    db::accounts::delete_token(&app.db, account.id, id).await?;
3471×
    db::accounts::audit(&app.db, Some(account), "token.revoke", &c.token, "").await.ok();
3481×
    Ok(StatusCode::NO_CONTENT)
3492×
}
350
351
/// Who calls: the account behind a bearer token, with the token's scopes.
352
pub struct Caller {
353
    pub account: Option<Account>,
354
    pub scopes: Vec<String>,
355
    pub site: bool,
356
    /// The token's name, for records of what a call did.
357
    pub token: String,
358
    /// The personal access token's id, when one is used.
359
    pub token_id: Option<i64>,
360
    /// The token is an agent's (oxygenhub#183): what it does says so.
361
    pub agent: bool,
362
}
363
364
impl Caller {
365315×
    fn has(&self, scope: &str) -> bool {
366315×
        self.site
367303×
            || self.scopes.iter().any(|s| {
368303×
                s == scope
369200×
                    || (scope == "repo:read" && (s == "repo:write" || s == "repo:admin"))
370195×
                    || (scope == "repo:write" && s == "repo:admin")
371303×
            })
372315×
    }
373
374325×
    fn require(&self, scope: &str) -> Result<&Account, ApiError> {
375
        // No token is 401, sign in; a token without the scope is 403 (#303).
376325×
        let Some(account) = self.account.as_ref() else {
37710×
            return Err(ApiError(StatusCode::UNAUTHORIZED, "a personal access token is required: sign in (`oh auth login`)".into()));
378
        };
379315×
        if !self.has(scope) {
38067×
            return Err(forbidden(&format!("this token lacks the {scope} scope")));
381248×
        }
382248×
        Ok(account)
383325×
    }
384
}
385
386430×
pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {
387430×
    let Some(t) = oxy_server::bearer_token(headers) else {
38891×
        return Ok(Caller { account: None, scopes: vec![], site: false, token: String::new(), token_id: None, agent: false });
389
    };
390339×
    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {
391151×
        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);
392151×
        return Ok(Caller {
393151×
            account: admin,
394151×
            scopes: vec!["repo:admin".into(), "user:read".into(), "checks:write".into()],
395151×
            site: true,
396151×
            token: "site token".into(),
397151×
            token_id: None,
398151×
            agent: false,
399151×
        });
400188×
    }
401
    // An agent's grant token (keyless agents, #241, #253): an agent's token
402
    // of its owner, reading, and writing when the grant lets its keys move
403
    // references, as it is for the protocol.
404188×
    if t.starts_with(crate::keyless::GRANT_TOKEN_PREFIX) {
4053×
        let grant = db::accounts::agent_grant_by_token(&app.db, &auth::token_hash(t)).await?.filter(|g| g.live(db::now_ms()));
4063×
        let Some(g) = grant else {
4070×
            return Err(ApiError(StatusCode::UNAUTHORIZED, "this agent grant is not valid (revoked, ended or unknown)".into()));
408
        };
4093×
        let account = db::accounts::account_by_id(&app.db, g.account_id).await?.filter(|a| !a.blocked());
4103×
        db::accounts::touch_agent_grant(&app.db, g.id).await.ok();
4113×
        let mut scopes = vec!["repo:read".to_string(), "user:read".to_string()];
4126×
        if g.scope.split(',').any(|s| s.trim() == "refs") {
4133×
            scopes.push("repo:write".into());
4143×
        }
4153×
        return Ok(Caller { account, scopes, site: false, token: g.agent.clone(), token_id: None, agent: true });
416185×
    }
417185×
    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;
418182×
    match token {
419182×
        Some(tok) if !tok.expired(db::now_ms()) => {
420182×
            let account = db::accounts::account_by_id(&app.db, tok.account_id).await?.filter(|a| !a.blocked());
421182×
            db::accounts::touch_token(&app.db, tok.id).await.ok();
422
            Ok(Caller {
423182×
                account,
424240×
                scopes: tok.scope_list().iter().map(|s| s.to_string()).collect(),
425
                site: false,
426182×
                token: tok.name.clone(),
427182×
                token_id: Some(tok.id),
428182×
                agent: tok.agent,
429
            })
430
        }
4313×
        _ => Err(ApiError(StatusCode::UNAUTHORIZED, "unknown or expired token".into())),
432
    }
433430×
}
434
43514×
fn repository(app: &Shared, r: &db::repos::RepoRow) -> Repository {
43614×
    Repository {
43714×
        owner: r.owner.clone(),
43814×
        name: r.name.clone(),
43914×
        description: r.description.clone(),
44014×
        default_bookmark: r.default_bookmark.clone(),
44114×
        visibility: r.visibility(),
44214×
        created_ms: r.created_ms,
44314×
        updated_ms: r.updated_ms,
44414×
        clone_url: format!("{}/{}/{}", app.config.base_url(), r.owner, r.name),
44514×
    }
44614×
}
447
448
/// A repository the caller may reach with `access`, else 404.
449255×
pub(super) async fn reach(
450255×
    app: &Shared,
451255×
    c: &Caller,
452255×
    owner: &str,
453255×
    name: &str,
454255×
    access: Access,
455255×
) -> Result<(RepoName, db::repos::RepoRow, Role), ApiError> {
456
    // A wiki (`NAME.wiki`) has no row of its own, so no proposals, issues
457
    // or runs (oxygenhub#128): say so to those who may read it, rather than
458
    // that it does not exist.
459255×
    if let Some(base) = name.strip_suffix(".wiki") {
4602×
        if let Some(row) = db::repos::get(&app.db, owner, base).await? {
4611×
            let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
4621×
            if auth::roles::allows(role, Access::Read) {
4631×
                return Err(not_found(&format!(
4641×
                    "{owner}/{name} is the wiki of {owner}/{base}: it is cloned and pushed with oxy, and takes no proposals, \
4651×
                     issues or runs; to publish a bookmark, merge it into main (oxy merge BOOKMARK on main) and push main"
4661×
                )));
4670×
            }
4681×
        }
469253×
    }
470254×
    let repo = RepoName::new(owner, name).ok_or_else(|| not_found("no such repository"))?;
471254×
    let row = db::repos::get(&app.db, owner, name).await?.ok_or_else(|| not_found("no such repository"))?;
472
    // A drop is reached through `/drops` only (#279).
473253×
    if row.is_drop() {
4741×
        return Err(not_found("no such repository"));
475252×
    }
476252×
    let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
477252×
    if !auth::roles::allows(role, access) {
4781×
        return Err(not_found("no such repository"));
479251×
    }
480251×
    Ok((repo, row, role.unwrap_or(Role::Read)))
481255×
}
482
4838×
fn summary(c: &view::ChangeView) -> ChangeSummary {
484
    ChangeSummary {
4858×
        hash: c.hash.clone(),
4868×
        message: if c.body.is_empty() { c.title.clone() } else { format!("{}\n\n{}", c.title, c.body) },
4878×
        author: Author {
4888×
            name: c.author.name.clone(),
4898×
            email: c.author.email.clone(),
4908×
            key: c.author.key.clone(),
4918×
            account: c.author.account.clone(),
4928×
            note: Author::note_for(&c.author.key, &c.author.account),
4938×
        },
4948×
        when_ms: c.when_ms,
4958×
        deps: c.deps.clone(),
4968×
        head: c.head,
4978×
        via: c.via.as_ref().map(|v| Via {
4982×
            name: v.name.clone(),
4992×
            key: v.key.clone(),
5002×
            scope: v.scope.clone(),
5012×
            expires_ms: v.expires_ms,
5022×
            revoked: v.revoked,
5032×
        }),
5048×
        signature: match &c.signature {
5054×
            view::SigView::Unsigned => Signature::Unsigned,
5064×
            view::SigView::Valid { key, sealed, revoked, .. } => Signature::Valid { key: key.clone(), sealed: *sealed, revoked: *revoked },
5070×
            view::SigView::Invalid(why) => Signature::Invalid { reason: why.clone() },
508
        },
509
    }
5108×
}
511
512
// ---------------------------------------------------------------- accounts
513
5146×
async fn me(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<User>, ApiError> {
5156×
    let c = caller(&app, &headers).await?;
5165×
    let a = c.require("user:read")?;
5173×
    Ok(Json(user_of(&app, a).await?))
5186×
}
519
520
#[derive(Deserialize)]
521
struct InboxQuery {
522
    #[serde(default)]
523
    limit: Option<i64>,
524
}
525
526
/// The caller's inbox; reading and clearing it needs `user:read`, since
527
/// it touches nothing but the caller's own notifications.
5287×
async fn notifications(
5297×
    State(app): State<Shared>,
5307×
    headers: HeaderMap,
5317×
    Query(q): Query<InboxQuery>,
5327×
) -> Result<Json<hub_api::Inbox>, ApiError> {
5337×
    let c = caller(&app, &headers).await?;
5347×
    let a = c.require("user:read")?;
5355×
    let limit = q.limit.unwrap_or(50).clamp(1, 200);
5365×
    let base = app.config.base_url().trim_end_matches('/').to_string();
5375×
    let rows = db::notify::inbox(&app.db, a.id, limit).await?;
538
    // Repositories by id, each looked up once (#305).
5395×
    let mut repos: std::collections::HashMap<i64, Option<String>> = std::collections::HashMap::new();
54010×
    for id in rows.iter().filter_map(|n| n.repo_id) {
54110×
        if let std::collections::hash_map::Entry::Vacant(e) = repos.entry(id) {
5425×
            e.insert(db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", r.owner, r.name)));
5435×
        }
544
    }
54530×
    let absolute = |u: String| if u.starts_with('/') { format!("{base}{u}") } else { u };
5465×
    let items = rows
5475×
        .into_iter()
5485×
        .map(|n| hub_api::Notification {
54915×
            id: n.id,
55015×
            at_ms: n.at_ms,
55115×
            label: crate::notify::label(&n.kind).map(String::from),
55215×
            kind: n.kind,
55315×
            title: n.title,
55415×
            url: absolute(n.url),
55515×
            actor: n.actor,
55615×
            read: n.read,
55715×
            repository: n.repo_id.and_then(|id| repos.get(&id).cloned().flatten()),
55815×
            reason: n.reason,
55915×
            thread: if n.thread.is_empty() { String::new() } else { absolute(n.thread) },
56015×
        })
5615×
        .collect();
5625×
    Ok(Json(hub_api::Inbox { unread: db::notify::unread(&app.db, a.id).await?, items }))
5637×
}
564
5651×
async fn notification_read(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<i64>) -> Result<StatusCode, ApiError> {
5661×
    let c = caller(&app, &headers).await?;
5671×
    let a = c.require("user:read")?;
5681×
    db::notify::mark_read(&app.db, a.id, Some(id)).await?;
5691×
    Ok(StatusCode::NO_CONTENT)
5701×
}
571
5721×
async fn notifications_read_all(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
5731×
    let c = caller(&app, &headers).await?;
5741×
    let a = c.require("user:read")?;
5751×
    db::notify::mark_read(&app.db, a.id, None).await?;
5761×
    Ok(StatusCode::NO_CONTENT)
5771×
}
578
5794×
async fn user_of(app: &Shared, a: &Account) -> Result<User, ApiError> {
5804×
    let keys = db::accounts::identities_of(&app.db, a.id).await?.into_iter().map(|i| i.key).collect();
5814×
    Ok(User { username: a.username.clone(), display_name: a.display_name.clone(), is_admin: a.is_admin, keys, created_ms: a.created_ms })
5824×
}
583
5841×
async fn user(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<User>, ApiError> {
5851×
    let a = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such account"))?;
5861×
    Ok(Json(user_of(&app, &a).await?))
5871×
}
588
5890×
async fn org(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<Organisation>, ApiError> {
5900×
    let o = db::accounts::org_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such organisation"))?;
5910×
    let members = db::accounts::org_members(&app.db, o.id).await?.into_iter().map(|(a, _)| a.username).collect();
5920×
    Ok(Json(Organisation { name: o.name, display_name: o.display_name, description: o.description, members }))
5930×
}
594
595
#[derive(Deserialize)]
596
struct SearchQuery {
597
    q: String,
598
}
599
6001×
async fn search(
6011×
    State(app): State<Shared>,
6021×
    headers: HeaderMap,
6031×
    Query(q): Query<SearchQuery>,
6041×
) -> Result<Json<Vec<serde_json::Value>>, ApiError> {
6051×
    let c = caller(&app, &headers).await?;
6061×
    let mut out = Vec::new();
6071×
    for h in db::notify::search(&app.db, &q.q, None, 50).await? {
6081×
        let Some(row) = db::repos::get_by_id(&app.db, h.repo_id).await? else { continue };
6091×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
6101×
        if !auth::roles::allows(role, Access::Read) {
6110×
            continue;
6121×
        }
6131×
        out.push(
6141×
            serde_json::json!({ "kind": h.kind, "repository": row.slug(), "number": h.number, "title": h.title, "snippet": h.snippet }),
615
        );
616
    }
6171×
    Ok(Json(out))
6181×
}
619
620
// ------------------------------------------------------------ repositories
621
6223×
async fn list_repos(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Repository>>, ApiError> {
6233×
    let c = caller(&app, &headers).await?;
6243×
    let mut out = Vec::new();
6253×
    for r in db::repos::list(&app.db).await? {
6261×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &r).await?;
6271×
        if auth::roles::allows(role, Access::Read) {
6281×
            out.push(repository(&app, &r));
6291×
        }
630
    }
6313×
    Ok(Json(out))
6323×
}
633
634
#[derive(Deserialize)]
635
struct UserReposQuery {
636
    /// Which: `owner`, `organization`, `collaborator`, comma-separated (all three by default).
637
    #[serde(default)]
638
    affiliation: Option<String>,
639
    /// The last `owner/name` of the previous page.
640
    #[serde(default)]
641
    after: Option<String>,
642
    #[serde(default)]
643
    limit: Option<usize>,
644
}
645
646
/// `GET /user/repos` (#302): the caller's repositories, their
647
/// organisations' and those they collaborate on, by `owner/name`, a page
648
/// at a time (`?after=owner/name&limit=`, at most 100, default 50).
649
/// `POST /user/runner-token` (repo:write): a one-time registration token
650
/// for a runner that serves the caller's own repositories and no one
651
/// else's, as a phone registers itself (oxygenhub-android#8). Like the
652
/// settings pages' tokens it lasts a day.
6533×
async fn user_runner_token(State(app): State<Shared>, headers: HeaderMap) -> Result<(StatusCode, Json<RunnerToken>), ApiError> {
6543×
    let c = caller(&app, &headers).await?;
6553×
    let me = c.require("repo:write")?.clone();
6561×
    let token = format!("flowreg_{}", crate::auth::random_hex(24));
6571×
    let scope = db::runners::Scope { owner: me.username.clone(), repo_id: None };
6581×
    db::runners::add_registration(&app.db, &blake3::hash(token.as_bytes()).to_hex(), &me.username, &scope).await?;
6591×
    db::accounts::audit(&app.db, Some(&me), "flow.runner.token", &me.username, "registration token for the caller's repositories (API)")
6601×
        .await
6611×
        .ok();
6621×
    Ok((StatusCode::CREATED, Json(RunnerToken { token, owner: me.username })))
6633×
}
664
665
/// `GET /user/proposals` (repo:read): what the dashboard lists, for apps;
666
/// with `?landable=true`, also what the caller can land now (#311).
6676×
async fn user_proposals(
6686×
    State(app): State<Shared>,
6696×
    headers: HeaderMap,
6706×
    Query(q): Query<UserProposalsQuery>,
6716×
) -> Result<Json<UserProposals>, ApiError> {
6726×
    let c = caller(&app, &headers).await?;
6736×
    let me = c.require("repo:read")?.clone();
674
    // As the dashboard: reviews in repositories the caller belongs to, its
675
    // own proposals in any it can still see.
6765×
    let member = db::accounts::visible_repo_ids(&app.db, me.id).await?;
6775×
    let seen: Vec<i64> = db::repos::list(&app.db)
6785×
        .await?
6795×
        .into_iter()
6807×
        .filter(|r| me.is_admin || r.visibility() != Visibility::Private || member.contains(&r.id))
6815×
        .map(|r| r.id)
6825×
        .collect();
6835×
    let base = app.config.base_url().trim_end_matches('/').to_string();
6845×
    let brief = |p: db::activity::ProposalLine| ProposalBrief {
6855×
        url: format!("{base}/{}/{}/proposal/{}", p.owner, p.name, p.number),
6865×
        repository: format!("{}/{}", p.owner, p.name),
6875×
        number: p.number,
6885×
        title: p.title,
6895×
        author: p.author,
6905×
        state: match p.state.as_str() {
6915×
            "draft" => ProposalState::Draft,
6925×
            "landed" => ProposalState::Landed,
6935×
            "closed" => ProposalState::Closed,
6945×
            _ => ProposalState::Open,
695
        },
6965×
        conflicted: p.conflicted,
6975×
        updated_ms: p.updated_ms,
6985×
    };
6995×
    let landable = if q.landable { landable_for(&app, &c, &member, &base).await? } else { Vec::new() };
700
    Ok(Json(UserProposals {
7015×
        review: db::activity::awaiting_review(&app.db, me.id, &member).await?.into_iter().map(brief).collect(),
7025×
        authored: db::activity::authored(&app.db, me.id, &seen).await?.into_iter().map(brief).collect(),
7035×
        landable,
704
    }))
7056×
}
706
707
/// The open proposals the caller could land now (#311): in repositories
708
/// it belongs to and can write to, whose verdict has no blockers. Each
709
/// projected state is worked out four at a time, as `proposals` does
710
/// (#171); one that cannot be is left out rather than failing the list.
7112×
async fn landable_for(app: &Shared, c: &Caller, member: &[i64], base: &str) -> Result<Vec<ProposalBrief>, ApiError> {
712
    use futures::StreamExt;
7132×
    let mut todo = Vec::new();
7142×
    for row in db::repos::list(&app.db).await?.into_iter().filter(|r| member.contains(&r.id) && !r.is_drop()) {
7152×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
7162×
        if !auth::roles::allows(role, Access::Write) {
7170×
            continue;
7182×
        }
7192×
        let Some(repo) = RepoName::new(&row.owner, &row.name) else { continue };
7202×
        for p in db::proposals::list(&app.db, row.id, &["open"]).await? {
7212×
            todo.push((repo.clone(), row.clone(), p));
7222×
        }
723
    }
7242×
    let found: Vec<Option<ProposalBrief>> = futures::stream::iter(todo)
7252×
        .map(|(repo, row, p)| {
7262×
            let (app, base) = (app.clone(), base.to_string());
7272×
            async move {
7282×
                let (number, title, author, updated_ms) = (p.number, p.title.clone(), p.author.clone(), p.updated_ms);
7292×
                let loaded = crate::web::proposals::load_summary(&app, &repo, p).await.ok()?;
7302×
                let v = crate::web::proposals::verdict(&app, &loaded, row.id).await.ok()?;
7312×
                v.blockers.is_empty().then(|| ProposalBrief {
7321×
                    url: format!("{base}/{}/{}/proposal/{number}", row.owner, row.name),
7331×
                    repository: format!("{}/{}", row.owner, row.name),
7341×
                    number,
7351×
                    title,
7361×
                    author,
7371×
                    state: ProposalState::Open,
7381×
                    conflicted: loaded.conflicted,
7391×
                    updated_ms,
7401×
                })
7412×
            }
7422×
        })
7432×
        .buffered(4)
7442×
        .collect()
7452×
        .await;
7462×
    Ok(found.into_iter().flatten().collect())
7472×
}
748
7496×
async fn user_repos(
7506×
    State(app): State<Shared>,
7516×
    headers: HeaderMap,
7526×
    Query(q): Query<UserReposQuery>,
7536×
) -> Result<Json<Vec<Repository>>, ApiError> {
7546×
    let c = caller(&app, &headers).await?;
7556×
    let me = c.require("repo:read")?.clone();
7565×
    let wanted: Vec<String> = q
7575×
        .affiliation
7585×
        .as_deref()
7595×
        .unwrap_or("owner,organization,collaborator")
7605×
        .split(',')
76113×
        .map(|s| s.trim().to_ascii_lowercase())
76213×
        .filter(|s| !s.is_empty())
7635×
        .collect();
76413×
    if let Some(bad) = wanted.iter().find(|w| !["owner", "organization", "collaborator"].contains(&w.as_str())) {
7651×
        return Err(ApiError(StatusCode::BAD_REQUEST, format!("unknown affiliation {bad:?}: owner, organization or collaborator")));
7664×
    }
7674×
    let orgs: Vec<String> = db::accounts::orgs_of(&app.db, me.id).await?.into_iter().map(|(o, _)| o.name).collect();
7684×
    let limit = q.limit.unwrap_or(50).clamp(1, 100);
7694×
    let mut rows = db::repos::list(&app.db).await?;
7704×
    rows.sort_by(|a, b| (&a.owner, &a.name).cmp(&(&b.owner, &b.name)));
7714×
    let mut out = Vec::new();
7727×
    for r in rows {
7737×
        if let Some(after) = q.after.as_deref() {
7742×
            if format!("{}/{}", r.owner, r.name).as_str() <= after {
7751×
                continue;
7761×
            }
7775×
        }
7786×
        let mine = (wanted.iter().any(|w| w == "owner") && r.owner == me.username)
7794×
            || (wanted.iter().any(|w| w == "organization") && orgs.contains(&r.owner))
7806×
            || (wanted.iter().any(|w| w == "collaborator") && db::accounts::collaborator_role(&app.db, r.id, me.id).await?.is_some());
7816×
        if !mine || !auth::roles::allows(auth::roles::role_for(&app.db, Some(&me), &r).await?, Access::Read) {
7822×
            continue;
7834×
        }
7844×
        out.push(repository(&app, &r));
7854×
        if out.len() == limit {
7861×
            break;
7873×
        }
788
    }
7894×
    Ok(Json(out))
7906×
}
791
792
/// `GET /user/orgs` (#302): the organisations the caller belongs to.
7932×
async fn user_orgs(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::UserOrg>>, ApiError> {
7942×
    let c = caller(&app, &headers).await?;
7952×
    let me = c.require("user:read")?;
7961×
    let orgs = db::accounts::orgs_of(&app.db, me.id).await?;
7971×
    Ok(Json(orgs.into_iter().map(|(o, role)| hub_api::UserOrg { name: o.name, display_name: o.display_name, role }).collect()))
7982×
}
799
8009×
async fn create_repo(
8019×
    State(app): State<Shared>,
8029×
    headers: HeaderMap,
8039×
    Json(body): Json<NewRepository>,
8049×
) -> Result<(StatusCode, Json<Repository>), ApiError> {
8059×
    let c = caller(&app, &headers).await?;
8069×
    let me = c.require("repo:admin")?;
8078×
    let name = RepoName::new(&body.owner, &body.name).ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "invalid owner or name".into()))?;
8088×
    if name.name.ends_with(crate::wiki::SUFFIX) {
8090×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a name cannot end in .wiki: that is the address of a repository's wiki".into()));
8108×
    }
8118×
    if !auth::roles::may_create_under(&app.db, me, &name.owner).await? {
8120×
        return Err(forbidden("you cannot create repositories under that owner"));
8138×
    }
8148×
    if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() || app.repos.exists(&name) {
8151×
        return Err(ApiError(StatusCode::CONFLICT, "that repository exists".into()));
8167×
    }
8177×
    app.repos.create(&name, None)?;
8187×
    let row = db::repos::create(&app.db, &name.owner, &name.name, &body.description, body.visibility).await?;
8197×
    db::accounts::audit(&app.db, Some(me), "repo.created", &name.to_string(), "api").await.ok();
8207×
    Ok((StatusCode::CREATED, Json(repository(&app, &row))))
8219×
}
822
8233×
async fn get_repo(
8243×
    State(app): State<Shared>,
8253×
    headers: HeaderMap,
8263×
    Path((owner, name)): Path<(String, String)>,
8273×
) -> Result<Json<Repository>, ApiError> {
8283×
    let c = caller(&app, &headers).await?;
8293×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
8302×
    Ok(Json(repository(&app, &row)))
8313×
}
832
8333×
async fn bookmarks(
8343×
    State(app): State<Shared>,
8353×
    headers: HeaderMap,
8363×
    Path((owner, name)): Path<(String, String)>,
8373×
) -> Result<Json<Vec<Bookmark>>, ApiError> {
8383×
    let c = caller(&app, &headers).await?;
8393×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
8403×
    let default = row.default_bookmark.clone();
8413×
    let list = app.repos.read(&repo, move |r, cache| view::bookmarks(r, cache, &default)).await?;
8426×
    Ok(Json(list.into_iter().map(|b| Bookmark { name: b.name, heads: b.heads, changes: b.changes, default: b.default }).collect()))
8433×
}
844
845
#[derive(serde::Deserialize)]
846
struct BackupSetting {
847
    /// `owner` (with its owner's), `hourly`, `daily` or `off`.
848
    backup: String,
849
}
850
851
/// `PUT /repos/{owner}/{name}/backup {"backup": ...}`: this repository's
852
/// backup (docs/backups.md §5). Owners and admins.
8530×
async fn set_backup(
8540×
    State(app): State<Shared>,
8550×
    headers: HeaderMap,
8560×
    Path((owner, name)): Path<(String, String)>,
8570×
    Json(b): Json<BackupSetting>,
8580×
) -> Result<Json<serde_json::Value>, ApiError> {
8590×
    let c = caller(&app, &headers).await?;
8600×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
8610×
    let setting = match b.backup.as_str() {
8620×
        "owner" => "",
8630×
        "hourly" | "daily" | "off" => b.backup.as_str(),
8640×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "backup is owner, hourly, daily or off".into())),
865
    };
8660×
    db::repos::set_backup(&app.db, row.id, setting).await?;
8670×
    db::accounts::audit(&app.db, c.account.as_ref(), "repo.backup", &format!("{owner}/{name}"), &b.backup).await.ok();
8680×
    Ok(Json(serde_json::json!({ "backup": b.backup })))
8690×
}
870
871
#[derive(serde::Deserialize)]
872
struct DiffusionSetting {
873
    /// `off`, `green`, `any`, or `default` (the site's).
874
    follow: String,
875
    /// `auto` or `propose`; absent keeps it as it is.
876
    #[serde(default)]
877
    land: Option<String>,
878
}
879
880
/// `PUT /repos/{owner}/{name}/diffusion {"follow": ...}`: whether this
881
/// repository follows the upstreams it pins (#148). Owners and admins.
88210×
async fn set_diffusion(
88310×
    State(app): State<Shared>,
88410×
    headers: HeaderMap,
88510×
    Path((owner, name)): Path<(String, String)>,
88610×
    Json(d): Json<DiffusionSetting>,
88710×
) -> Result<Json<serde_json::Value>, ApiError> {
88810×
    let c = caller(&app, &headers).await?;
88910×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
8909×
    let setting = match d.follow.as_str() {
8919×
        "off" | "green" | "any" => d.follow.as_str(),
8922×
        "default" => "",
8931×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "follow is off, green, any or default".into())),
894
    };
8958×
    let land = match d.land.as_deref() {
8962×
        Some(l @ ("auto" | "propose")) => Some(l),
8976×
        None => None,
8981×
        Some(_) => return Err(ApiError(StatusCode::BAD_REQUEST, "land is auto or propose".into())),
899
    };
9007×
    db::repos::set_diffusion(&app.db, row.id, setting).await?;
9017×
    if let Some(l) = land {
9021×
        db::repos::set_diffusion_land(&app.db, row.id, l).await?;
9036×
    }
9047×
    db::accounts::audit(
9057×
        &app.db,
9067×
        c.account.as_ref(),
9077×
        "repo.diffusion",
9087×
        &format!("{owner}/{name}"),
9097×
        if setting.is_empty() { "default" } else { setting },
910
    )
9117×
    .await
9127×
    .ok();
9137×
    let row = db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row);
9147×
    let rule = crate::diffusion::rule(&app.config.diffusion.follow, &row, None, "");
915
    // Turned on: bumped at once to where its upstreams are (#148).
9167×
    if rule.follow != crate::diffusion::Follow::Off {
9176×
        let (app, row) = (app.clone(), row.clone());
9186×
        tokio::spawn(async move { crate::diffusion::catch_up(&app, &row).await });
9191×
    }
9207×
    if land == Some("auto") {
9211×
        let (app, row) = (app.clone(), row.clone());
9221×
        tokio::spawn(async move { crate::diffusion::land_ready(&app, &row).await });
9236×
    }
924
    Ok(Json(
9257×
        serde_json::json!({ "follow": rule.follow, "from": rule.from, "land": if row.diffusion_land == "auto" { "auto" } else { "propose" } }),
926
    ))
92710×
}
928
929
/// `GET /repos/{owner}/{name}/consumers`: the repositories that pin this
930
/// one as a subrepo and that the caller may read, each with its pin and
931
/// how far behind this repository's default bookmark it is (#148).
9328×
async fn consumers(
9338×
    State(app): State<Shared>,
9348×
    headers: HeaderMap,
9358×
    Path((owner, name)): Path<(String, String)>,
9368×
) -> Result<Json<Vec<crate::diffusion::Consumer>>, ApiError> {
9378×
    let c = caller(&app, &headers).await?;
9388×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9398×
    Ok(Json(crate::diffusion::consumers(&app, &row, c.account.as_ref()).await?))
9408×
}
941
942
/// `GET /repos/{owner}/{name}/diffusion`: what this repository takes from
943
/// and what it diffuses to, as its Diffusion tab shows them (#153).
9442×
async fn diffusion(
9452×
    State(app): State<Shared>,
9462×
    headers: HeaderMap,
9472×
    Path((owner, name)): Path<(String, String)>,
9482×
) -> Result<Json<hub_api::Diffusion>, ApiError> {
9492×
    let c = caller(&app, &headers).await?;
9502×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9512×
    let slug = format!("{owner}/{name}");
9522×
    let takes_from = crate::diffusion::follows(&app, &row, c.account.as_ref())
9532×
        .await
9542×
        .iter()
9552×
        .map(|(up, p)| p.api(&format!("{}/{}", up.owner, up.name)))
9562×
        .collect();
9572×
    let diffuses_to = crate::diffusion::consumers(&app, &row, c.account.as_ref()).await?.iter().map(|p| p.api(&slug)).collect();
9582×
    Ok(Json(hub_api::Diffusion { takes_from, diffuses_to }))
9592×
}
960
9610×
async fn tags(
9620×
    State(app): State<Shared>,
9630×
    headers: HeaderMap,
9640×
    Path((owner, name)): Path<(String, String)>,
9650×
) -> Result<Json<Vec<Tag>>, ApiError> {
9660×
    let c = caller(&app, &headers).await?;
9670×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9680×
    let list = app.repos.read(&repo, |r, _| view::tags(r)).await?;
9690×
    Ok(Json(list.into_iter().map(|t| Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer }).collect()))
9700×
}
971
972
/// `POST …/tags` (#295): what the Tags page's Create does.
9730×
async fn create_tag(
9740×
    State(app): State<Shared>,
9750×
    headers: HeaderMap,
9760×
    Path((owner, name)): Path<(String, String)>,
9770×
    Json(body): Json<NewTag>,
9780×
) -> Result<(StatusCode, Json<Tag>), ApiError> {
9790×
    let c = caller(&app, &headers).await?;
9800×
    let me = c.require("repo:write")?.clone();
9810×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
9820×
    let made = crate::tags::create(
9830×
        &app,
9840×
        &row,
9850×
        &repo,
9860×
        &me,
9870×
        &body.name,
9880×
        body.target.as_deref().unwrap_or(""),
9890×
        body.message.as_deref().unwrap_or(""),
9900×
    )
9910×
    .await
9920×
    .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
9930×
    let t = app
9940×
        .repos
9950×
        .read(&repo, |r, _| view::tags(r))
9960×
        .await?
9970×
        .into_iter()
9980×
        .find(|t| t.name == made.name)
9990×
        .ok_or_else(|| not_found("no such tag"))?;
10000×
    Ok((StatusCode::CREATED, Json(Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer })))
10010×
}
1002
1003
#[derive(Deserialize)]
1004
struct WithdrawQuery {
1005
    #[serde(default)]
1006
    reason: String,
1007
}
1008
1009
/// `DELETE …/tags/{tag}?reason=…` (#301): what the Tags page's Withdraw
1010
/// does. Maintainers; refused (409) while a release uses the tag.
10110×
async fn withdraw_tag(
10120×
    State(app): State<Shared>,
10130×
    headers: HeaderMap,
10140×
    Path((owner, name, tag)): Path<(String, String, String)>,
10150×
    Query(q): Query<WithdrawQuery>,
10160×
) -> Result<StatusCode, ApiError> {
10170×
    let c = caller(&app, &headers).await?;
10180×
    let me = c.require("repo:write")?.clone();
10190×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
10200×
    if db::releases::get(&app.db, row.id, &tag).await?.is_some() {
10210×
        return Err(ApiError(StatusCode::CONFLICT, format!("a release uses {tag}: delete the release first")));
10220×
    }
10230×
    crate::tags::withdraw(&app, &row, &repo, &me, &tag, &q.reason).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
10240×
    Ok(StatusCode::NO_CONTENT)
10250×
}
1026
1027
#[derive(Deserialize)]
1028
struct HistoryQuery {
1029
    path: Option<String>,
1030
    offset: Option<usize>,
1031
    limit: Option<usize>,
1032
    /// A revset (Oxygen's docs/revset_query_language.md) in place of the
1033
    /// reference's whole history; the reference still gives the labels.
1034
    r: Option<String>,
1035
}
1036
10376×
async fn history(
10386×
    State(app): State<Shared>,
10396×
    headers: HeaderMap,
10406×
    Path((owner, name, r)): Path<(String, String, String)>,
10416×
    Query(q): Query<HistoryQuery>,
10426×
) -> Result<Json<History>, ApiError> {
10436×
    let c = caller(&app, &headers).await?;
10446×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
10456×
    let (offset, limit) = (q.offset.unwrap_or(0), q.limit.unwrap_or(50).min(500));
10466×
    let revset = q.r.clone().filter(|s| !s.trim().is_empty());
10476×
    let by_revset = revset.is_some();
10486×
    let h = app
10496×
        .repos
10506×
        .read(&repo, move |repo, cache| {
10516×
            let target = view::resolve(repo, cache, &r)?;
10526×
            match &revset {
10534×
                Some(rs) => view::history_revset(repo, cache, target, rs, offset, limit),
10542×
                None => view::history(repo, cache, target, q.path.as_deref(), offset, limit),
1055
            }
10566×
        })
10576×
        .await
10586×
        .map_err(|e| {
1059
            // A revset that does not parse, names nothing, or goes past the
1060
            // budget is the caller's to fix.
10612×
            if by_revset {
10622×
                ApiError(StatusCode::BAD_REQUEST, e.to_string())
1063
            } else {
10640×
                e.into()
1065
            }
10662×
        })?;
10674×
    let mut entries = h.entries;
10684×
    crate::web::attribute(&app, &mut entries.iter_mut().collect::<Vec<_>>()).await;
1069
    Ok(Json(History {
10704×
        reference: h.target.label,
10715×
        heads: h.target.heads.iter().map(|x| x.to_hex()).collect(),
10724×
        total: h.total,
10734×
        offset: h.offset,
10744×
        changes: entries.iter().map(summary).collect(),
1075
    }))
10766×
}
1077
10783×
async fn change(
10793×
    State(app): State<Shared>,
10803×
    headers: HeaderMap,
10813×
    Path((owner, name, hash)): Path<(String, String, String)>,
10823×
) -> Result<Json<ChangeDetail>, ApiError> {
10833×
    let c = caller(&app, &headers).await?;
10843×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
10853×
    let d = app
10863×
        .repos
10873×
        .read(&repo, move |repo, cache| {
10883×
            let h = view::resolve_change(repo, cache, &hash)?;
10893×
            view::change(repo, cache, &h)
10903×
        })
10913×
        .await?;
10923×
    let mut v = d.view;
10933×
    crate::web::attribute(&app, &mut [&mut v]).await;
10943×
    let files = crate::web::history::render_files(&d.files, &d.bases).into_iter().map(file_change).collect();
1095
    Ok(Json(ChangeDetail {
10963×
        body: v.body.clone(),
10973×
        change: summary(&v),
10983×
        dependents: d.dependents.iter().map(|x| x.hash.clone()).collect(),
10993×
        in_bookmarks: d.in_bookmarks,
11003×
        in_tags: d.in_tags,
11013×
        files,
1102
    }))
11033×
}
1104
11054×
fn file_change(f: crate::web::history::FileRows) -> FileChange {
1106
    use crate::render::diff::Kind;
11074×
    let truncated = f.lines.len() > hub_api::DIFF_LINES;
11084×
    let lines = f
11094×
        .lines
11104×
        .into_iter()
11114×
        .take(hub_api::DIFF_LINES)
11124×
        .map(|l| DiffLine {
11134×
            kind: match l.kind {
11140×
                Kind::Context => "context",
11152×
                Kind::Add => "add",
11160×
                Kind::Del => "del",
11172×
                Kind::Gap => "gap",
1118
            }
11194×
            .into(),
11204×
            old: l.old_no,
11214×
            new: l.new_no,
11224×
            text: l.text,
11234×
        })
11244×
        .collect();
11254×
    FileChange { path: f.path, kind: f.kind, from: f.from, added: f.added, removed: f.removed, lines, truncated }
11264×
}
1127
11281×
fn entry(e: &view::Entry) -> TreeEntry {
1129
    TreeEntry {
11301×
        name: e.name.clone(),
11311×
        path: e.path.clone(),
11321×
        kind: match e.kind {
11330×
            view::EntryKind::Dir => "dir",
11341×
            view::EntryKind::File => "file",
11350×
            view::EntryKind::Symlink => "symlink",
11360×
            view::EntryKind::Subrepo => "subrepo",
1137
        }
11381×
        .into(),
11391×
        exec: e.exec,
11401×
        size: e.size,
11411×
        conflicted: e.conflicted,
1142
    }
11431×
}
1144
11451×
async fn tree_root(
11461×
    State(app): State<Shared>,
11471×
    headers: HeaderMap,
11481×
    Path((owner, name, r)): Path<(String, String, String)>,
11491×
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
11501×
    tree(State(app), headers, Path((owner, name, r, String::new()))).await
11511×
}
1152
11531×
async fn tree(
11541×
    State(app): State<Shared>,
11551×
    headers: HeaderMap,
11561×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11571×
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
11581×
    let c = caller(&app, &headers).await?;
11591×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11601×
    let t = app
11611×
        .repos
11621×
        .read(&repo, move |repo, cache| {
11631×
            let target = view::resolve(repo, cache, &r)?;
11641×
            view::tree(repo, cache, target, &path)
11651×
        })
11661×
        .await?;
11671×
    Ok(Json(t.entries.iter().map(entry).collect()))
11681×
}
1169
11701×
async fn file(
11711×
    State(app): State<Shared>,
11721×
    headers: HeaderMap,
11731×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11741×
) -> Result<Response, ApiError> {
11751×
    let c = caller(&app, &headers).await?;
11761×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11771×
    let limit = app.config.limits.render_limit.0;
11781×
    let f = app
11791×
        .repos
11801×
        .read(&repo, move |repo, cache| {
11811×
            let target = view::resolve(repo, cache, &r)?;
11821×
            view::file(repo, cache, target, &path, limit)
11831×
        })
11841×
        .await?;
11851×
    Ok(crate::web::raw(f.bytes, &f.name, false))
11861×
}
1187
11881×
async fn blame(
11891×
    State(app): State<Shared>,
11901×
    headers: HeaderMap,
11911×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11921×
) -> Result<Json<Vec<BlameLine>>, ApiError> {
11931×
    let c = caller(&app, &headers).await?;
11941×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11951×
    let limit = app.config.limits.render_limit.0;
11961×
    let b = app
11971×
        .repos
11981×
        .read(&repo, move |repo, cache| {
11991×
            let target = view::resolve(repo, cache, &r)?;
12001×
            view::blame(repo, cache, target, &path, limit)
12011×
        })
12021×
        .await?;
1203
    Ok(Json(
12041×
        b.lines
12051×
            .into_iter()
12061×
            .map(|l| BlameLine {
12071×
                line: l.line,
12081×
                change: l.hash.to_hex(),
12091×
                index: l.index,
12101×
                author: l.author,
12111×
                when_ms: l.when_ms,
12121×
                text: String::from_utf8_lossy(&l.text).into_owned(),
12131×
            })
12141×
            .collect(),
1215
    ))
12161×
}
1217
12180×
async fn conflicts(
12190×
    State(app): State<Shared>,
12200×
    headers: HeaderMap,
12210×
    Path((owner, name)): Path<(String, String)>,
12220×
) -> Result<Json<Vec<Conflict>>, ApiError> {
12230×
    let c = caller(&app, &headers).await?;
12240×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12250×
    let list = app.repos.read(&repo, view::conflicts).await?;
1226
    Ok(Json(
12270×
        list.into_iter()
12280×
            .map(|c| Conflict {
12290×
                bookmark: c.bookmark,
12300×
                path: c.path,
12310×
                kind: c.kind,
12320×
                contributors: c.contributors.iter().map(|x| x.hash.clone()).collect(),
12330×
            })
12340×
            .collect(),
1235
    ))
12360×
}
1237
1238
/// `GET /repos/{o}/{n}/releases/trust/{tag}`: a release's trust report
1239
/// (hub spec §9.1), as the page's JSON export.
12403×
async fn release_trust(
12413×
    State(app): State<Shared>,
12423×
    headers: HeaderMap,
12433×
    Path((owner, name, tag)): Path<(String, String, String)>,
12443×
) -> Result<Json<crate::web::release_trust::ReleaseTrust>, ApiError> {
12453×
    let c = caller(&app, &headers).await?;
12463×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12473×
    match crate::web::release_trust::report(&app, &repo, &row, &tag).await.map_err(|m| ApiError(StatusCode::INTERNAL_SERVER_ERROR, m))? {
12482×
        Some(t) => Ok(Json(t)),
12491×
        None => Err(ApiError(StatusCode::NOT_FOUND, format!("no release {tag}"))),
1250
    }
12513×
}
1252
12531×
async fn trust(
12541×
    State(app): State<Shared>,
12551×
    headers: HeaderMap,
12561×
    Path((owner, name)): Path<(String, String)>,
12571×
) -> Result<Json<Trust>, ApiError> {
12581×
    let c = caller(&app, &headers).await?;
12591×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12601×
    let key = app.hub_key.key;
12611×
    let t = app.repos.read(&repo, move |r, cache| view::trust(r, cache, &key)).await?;
1262
    Ok(Json(Trust {
12631×
        policy: t.policy.map(|p| Policy {
12640×
            serial: p.serial,
12650×
            expires_ms: p.expires_ms,
12660×
            roots: p.roots.iter().map(|k| k.key.clone()).collect(),
12670×
            root_threshold: p.root_threshold,
12680×
            rules: p
12690×
                .rules
12700×
                .iter()
12710×
                .map(|r| Rule {
12720×
                    pattern: r.pattern.clone(),
12730×
                    keys: r.keys.iter().map(|k| k.key.clone()).collect(),
12740×
                    threshold: r.threshold,
12750×
                    require: r.require.clone(),
12760×
                    allow_conflicts: r.allow_conflicts,
12770×
                })
12780×
                .collect(),
12790×
        }),
12801×
        signed: t.verification.signed,
12811×
        sealed: t.verification.sealed,
12821×
        unsigned: t.verification.unsigned,
12831×
        invalid: t.verification.invalid.iter().map(|(h, _)| h.clone()).collect(),
12841×
        hub_key: t.hub_key,
1285
    }))
12861×
}
1287
12881×
async fn pushes(
12891×
    State(app): State<Shared>,
12901×
    headers: HeaderMap,
12911×
    Path((owner, name)): Path<(String, String)>,
12921×
) -> Result<Json<Vec<Push>>, ApiError> {
12931×
    let c = caller(&app, &headers).await?;
12941×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12951×
    let rows = db::repos::pushes(&app.db, row.id, 200).await?;
1296
    Ok(Json(
12971×
        rows.into_iter()
12981×
            .map(|p| Push {
12991×
                at_ms: p.at_ms,
13001×
                pusher: p.pusher,
13011×
                reference: p.reference,
13021×
                ok: p.ok,
13031×
                reason: p.reason,
13041×
                old_state: p.old_state,
13051×
                new_state: p.new_state,
13061×
                heads: p.heads,
13071×
                changes: p.changes,
13081×
            })
13091×
            .collect(),
1310
    ))
13111×
}
1312
1313
// --------------------------------------------------------------- proposals
1314
1315
/// `GET /repos/{o}/{n}/proposals?state=open|draft|landed|closed|all`:
1316
/// open ones (drafts too) by default.
13174×
async fn proposals(
13184×
    State(app): State<Shared>,
13194×
    headers: HeaderMap,
13204×
    Path((owner, name)): Path<(String, String)>,
13214×
    Query(q): Query<IssuesQuery>,
13224×
) -> Result<Json<Vec<Proposal>>, ApiError> {
13234×
    let c = caller(&app, &headers).await?;
13244×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
13253×
    let states: &[&str] = match q.state.as_deref().unwrap_or("open") {
13263×
        "open" => &["open", "draft"],
13272×
        "draft" => &["draft"],
13282×
        "landed" => &["landed"],
13291×
        "closed" => &["closed"],
13301×
        "all" => &["open", "draft", "landed", "closed"],
13310×
        other => return Err(ApiError(StatusCode::BAD_REQUEST, format!("state is open, draft, landed, closed or all, not {other:?}"))),
1332
    };
1333
    // Each proposal's projected state is worked out from the store, which
1334
    // for a bucket-backed repository is many slow round trips: four at a
1335
    // time, in order, each under the repository's read lock only. One at
1336
    // a time took 28 s for a repository on GCS (oxygenhub#171).
1337
    use futures::StreamExt;
13383×
    let rows = db::proposals::list(&app.db, row.id, states).await?;
13393×
    let out: Vec<Result<Proposal, ApiError>> = futures::stream::iter(rows)
13403×
        .map(|p| {
13412×
            let (app, repo, owner, name, id) = (app.clone(), repo.clone(), owner.clone(), name.clone(), row.id);
13422×
            async move {
13432×
                let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
13442×
                let v = crate::web::proposals::verdict(&app, &loaded, id).await?;
13452×
                Ok(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await)
13462×
            }
13472×
        })
13483×
        .buffered(4)
13493×
        .collect()
13503×
        .await;
13513×
    Ok(Json(out.into_iter().collect::<Result<Vec<_>, _>>()?))
13524×
}
1353
135415×
async fn proposal(
135515×
    State(app): State<Shared>,
135615×
    headers: HeaderMap,
135715×
    Path((owner, name, number)): Path<(String, String, i64)>,
135815×
) -> Result<Json<Proposal>, ApiError> {
135915×
    let c = caller(&app, &headers).await?;
136015×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
136115×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
136215×
    let source_url = match p.source_repo_id {
13630×
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", app.config.base_url(), r.slug())),
136415×
        None => None,
1365
    };
136615×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
136715×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
136815×
    Ok(Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, source_url).await))
136915×
}
1370
1371
/// `PATCH /repos/{o}/{n}/proposals/{number}`: change the title or body,
1372
/// keeping what is not given; the author or a maintainer, as on the page
1373
/// (oxygenhub#76). The target is changed on the page, which re-projects.
137423×
async fn edit_proposal(
137523×
    State(app): State<Shared>,
137623×
    headers: HeaderMap,
137723×
    Path((owner, name, number)): Path<(String, String, i64)>,
137823×
    Json(body): Json<hub_api::ProposalEdit>,
137923×
) -> Result<Json<Proposal>, ApiError> {
138023×
    let c = caller(&app, &headers).await?;
138123×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
138220×
    let (repo, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
138320×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
138419×
    let text = body.title.is_some() || body.body.is_some();
138519×
    if text && Some(me.id) != p.author_id && role < Role::Maintain {
13861×
        return Err(ApiError(StatusCode::FORBIDDEN, "only the proposal's author or a maintainer can edit it".into()));
138718×
    }
138818×
    if body.labels.is_some() && role < Role::Triage {
13891×
        return Err(forbidden("setting labels needs triage access"));
139017×
    }
1391
    // Every name is checked before anything changes.
139217×
    let labels = resolve_triage(&app, row.id, body.labels.as_deref(), None, None).await?.labels;
139316×
    if text {
13943×
        let title = match body.title.as_deref().map(str::trim) {
13952×
            Some("") => return Err(ApiError(StatusCode::BAD_REQUEST, "a proposal needs a title".into())),
13961×
            Some(t) => t,
13971×
            None => p.title.as_str(),
1398
        };
13992×
        let text = body.body.as_deref().map(str::trim).unwrap_or(&p.body);
14002×
        db::proposals::edit(&app.db, p.id, title, text, &p.target).await?;
14012×
        db::proposals::add_event(&app.db, p.id, &me.username, "edited", "").await.ok();
140213×
    }
140315×
    if let Some(want) = labels {
14042×
        let have = db::issues::proposal_labels(&app.db, p.id).await?;
14052×
        for l in &have {
14062×
            if !want.iter().any(|w| w.id == l.id) {
14071×
                db::issues::set_proposal_label(&app.db, p.id, l.id, false).await?;
14081×
            }
1409
        }
14103×
        for w in &want {
14113×
            if !have.iter().any(|l| l.id == w.id) {
14122×
                db::issues::set_proposal_label(&app.db, p.id, w.id, true).await?;
14131×
            }
1414
        }
14153×
        let names: Vec<&str> = want.iter().map(|l| l.name.as_str()).collect();
14162×
        db::proposals::add_event(&app.db, p.id, &me.username, "set labels", &names.join(", ")).await.ok();
141713×
    }
1418
    // `draft` says the same as `state`, in the words of creation (#313).
141915×
    let want = match (body.state.as_deref(), body.draft) {
14201×
        (Some(s), Some(d)) if (s == "draft") != d => {
14211×
            return Err(ApiError(StatusCode::BAD_REQUEST, format!("state {s:?} and draft {d} disagree")));
1422
        }
14237×
        (Some(s), _) => Some(s),
14242×
        (None, Some(true)) => Some("draft"),
14251×
        (None, Some(false)) => Some("open"),
14264×
        (None, None) => None,
1427
    };
142814×
    if let Some(want) = want {
142910×
        if Some(me.id) != p.author_id && role < Role::Triage {
14300×
            return Err(ApiError(
14310×
                StatusCode::FORBIDDEN,
14320×
                "only the proposal's author or someone with triage access can close, reopen or change whether it is a draft".into(),
14330×
            ));
143410×
        }
1435
        // The page's transitions: a draft is made ready (open), and an open
1436
        // proposal turned back into a draft.
143710×
        let new_state = match (want, p.state.as_str()) {
143810×
            ("closed", "open" | "draft") => "closed",
14397×
            ("open", "closed" | "draft") => "open",
14404×
            ("draft", "open") => "draft",
14413×
            (w, now) if w == now => now,
14422×
            ("closed" | "open" | "draft", now) => {
14431×
                return Err(ApiError(StatusCode::CONFLICT, format!("a proposal that is {now} cannot become {want}")))
1444
            }
14451×
            _ => return Err(ApiError(StatusCode::BAD_REQUEST, "state is closed, open or draft".into())),
1446
        };
14478×
        if new_state != p.state {
14487×
            db::proposals::set_state(&app.db, p.id, new_state, "").await?;
14497×
            db::proposals::add_event(&app.db, p.id, &me.username, new_state, "").await.ok();
14507×
            crate::hooks::emit(&app, &row, &format!("proposal.{new_state}"), &me.username, serde_json::json!({ "number": number })).await;
14511×
        }
14524×
    }
145312×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
145412×
    let source_url = match p.source_repo_id {
14550×
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", app.config.base_url(), r.slug())),
145612×
        None => None,
1457
    };
145812×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
145912×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
146012×
    Ok(Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, source_url).await))
146123×
}
1462
1463
/// `POST /repos/{o}/{n}/proposals/{number}/land` (repo:write): land it as
1464
/// the page's Land button does; `409` with the blockers when it cannot.
1465
/// `{"over_checks": "reason"}` lands over required checks that have not
1466
/// passed, for maintainers (#261).
14675×
async fn land_proposal(
14685×
    State(app): State<Shared>,
14695×
    headers: HeaderMap,
14705×
    Path((owner, name, number)): Path<(String, String, i64)>,
14715×
    body: axum::body::Bytes,
14725×
) -> Result<Json<Proposal>, ApiError> {
14735×
    let c = caller(&app, &headers).await?;
14745×
    let me = c.require("repo:write")?.clone();
14755×
    let over_checks: Option<String> = if body.iter().all(u8::is_ascii_whitespace) {
14760×
        None
1477
    } else {
14785×
        serde_json::from_slice::<serde_json::Value>(&body)
14795×
            .map_err(|_| ApiError(StatusCode::BAD_REQUEST, "the body is JSON: {} or {\"over_checks\": \"reason\"}".into()))?
14805×
            .get("over_checks")
14815×
            .and_then(|v| v.as_str())
14825×
            .map(String::from)
1483
    };
14845×
    let need = if over_checks.is_some() { Access::Maintain } else { Access::Write };
14855×
    let (repo, row, _) = reach(&app, &c, &owner, &name, need).await?;
14865×
    let via = format!("api (token {})", c.token);
14875×
    match crate::web::proposals::land_as(&app, &repo, &row, &me, number, &via, false, over_checks.as_deref()).await {
14884×
        Ok(_) => proposal(State(app), headers, Path((owner, name, number))).await,
14890×
        Err(crate::web::proposals::Landing::NotFound) => Err(not_found("no such proposal")),
14901×
        Err(crate::web::proposals::Landing::Refused(m)) => Err(ApiError(StatusCode::CONFLICT, m)),
1491
    }
14925×
}
1493
1494
/// `POST /repos/{o}/{n}/proposals/{number}/auto-land` (repo:write, #261):
1495
/// land it when its checks pass; at once if they already have.
14960×
async fn auto_land_on(
14970×
    State(app): State<Shared>,
14980×
    headers: HeaderMap,
14990×
    Path((owner, name, number)): Path<(String, String, i64)>,
15000×
) -> Result<Json<Proposal>, ApiError> {
15010×
    auto_land_set(&app, &headers, &owner, &name, number, true).await?;
15020×
    proposal(State(app), headers, Path((owner, name, number))).await
15030×
}
1504
1505
/// `DELETE …/auto-land`: it will not land by itself.
15060×
async fn auto_land_off(
15070×
    State(app): State<Shared>,
15080×
    headers: HeaderMap,
15090×
    Path((owner, name, number)): Path<(String, String, i64)>,
15100×
) -> Result<Json<Proposal>, ApiError> {
15110×
    auto_land_set(&app, &headers, &owner, &name, number, false).await?;
15120×
    proposal(State(app), headers, Path((owner, name, number))).await
15130×
}
1514
15150×
async fn auto_land_set(app: &Shared, headers: &HeaderMap, owner: &str, name: &str, number: i64, on: bool) -> Result<(), ApiError> {
15160×
    let c = caller(app, headers).await?;
15170×
    let me = c.require("repo:write")?.clone();
15180×
    let (_, row, _) = reach(app, &c, owner, name, Access::Write).await?;
15190×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15200×
    if !p.is_open() {
15210×
        return Err(ApiError(StatusCode::CONFLICT, format!("the proposal is {}", p.state)));
15220×
    }
15230×
    crate::autoland::set(app, &row, &p, &me, on).await?;
15240×
    Ok(())
15250×
}
1526
1527
/// The files a proposal changes (hub spec §12.1).
15281×
async fn proposal_files(
15291×
    State(app): State<Shared>,
15301×
    headers: HeaderMap,
15311×
    Path((owner, name, number)): Path<(String, String, i64)>,
15321×
) -> Result<Json<Vec<hub_api::ProposalFile>>, ApiError> {
15331×
    let c = caller(&app, &headers).await?;
15341×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
15351×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15361×
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
1537
    Ok(Json(
15381×
        loaded
15391×
            .files
15401×
            .iter()
15411×
            .map(|f| hub_api::ProposalFile {
15422×
                path: f.path.clone(),
15432×
                from: f.from.clone(),
15442×
                kind: f.kind.clone(),
15452×
                added: f.added,
15462×
                removed: f.removed,
15472×
            })
15481×
            .collect(),
1549
    ))
15501×
}
1551
1552
/// One file's bytes on a side of a proposal: `base` is the target's
1553
/// state, `head` the projected state. 404 when the file does not exist
1554
/// on that side.
15555×
async fn proposal_content(
15565×
    State(app): State<Shared>,
15575×
    headers: HeaderMap,
15585×
    Path((owner, name, number, side, path)): Path<(String, String, i64, String, String)>,
15595×
) -> Result<Response, ApiError> {
15605×
    let c = caller(&app, &headers).await?;
15615×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
15625×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15635×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
15645×
    let heads = match side.as_str() {
15655×
        "base" => loaded.target_heads,
15663×
        "head" => loaded.heads,
15671×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "the side is base or head".into())),
1568
    };
15694×
    let limit = app.config.limits.render_limit.0;
15704×
    let target = view::RefTarget { label: side, kind: view::RefKind::Change, heads };
15714×
    let f = app.repos.read(&repo, move |repo, cache| view::file(repo, cache, target, &path, limit)).await?;
15723×
    Ok(crate::web::raw(f.bytes, &f.name, false))
15735×
}
1574
157512×
async fn create_proposal(
157612×
    State(app): State<Shared>,
157712×
    headers: HeaderMap,
157812×
    Path((owner, name)): Path<(String, String)>,
157912×
    Json(body): Json<NewProposal>,
158012×
) -> Result<(StatusCode, Json<Proposal>), ApiError> {
158112×
    let c = caller(&app, &headers).await?;
158212×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
158312×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
158410×
    let created =
158511×
        crate::web::proposals::open_proposal(&app, &repo, &row, &me, &body.title, &body.body, &body.target, &body.source, body.draft)
158611×
            .await
158711×
            .map_err(|e| ApiError(StatusCode::BAD_REQUEST, e))?;
158810×
    let loaded = crate::web::proposals::load_summary(&app, &repo, created).await?;
158910×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
159010×
    Ok((StatusCode::CREATED, Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await)))
159112×
}
1592
15935×
fn comment_of(c: &db::proposals::CommentRow) -> Comment {
1594
    Comment {
15955×
        id: c.id,
15965×
        author: c.author.clone(),
15975×
        body: c.body.clone(),
15985×
        created_ms: c.created_ms,
15995×
        path: if c.path.is_empty() { None } else { Some(c.path.clone()) },
16005×
        anchor: if c.anchor_change.is_empty() {
16010×
            None
1602
        } else {
16035×
            Some(Atom { change: c.anchor_change.clone(), index: c.anchor_index as u32 })
1604
        },
16055×
        line: None,
16065×
        resolved: c.resolved,
1607
    }
16085×
}
1609
16101×
async fn proposal_comments(
16111×
    State(app): State<Shared>,
16121×
    headers: HeaderMap,
16131×
    Path((owner, name, number)): Path<(String, String, i64)>,
16141×
) -> Result<Json<Vec<Comment>>, ApiError> {
16151×
    let c = caller(&app, &headers).await?;
16161×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
16171×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
16181×
    let mut out: Vec<Comment> = db::proposals::comments(&app.db, p.id).await?.iter().map(comment_of).collect();
1619
    // Place anchored comments on their line of the projected state.
16201×
    let paths: std::collections::BTreeSet<String> = out.iter().filter(|c| c.anchor.is_some()).filter_map(|c| c.path.clone()).collect();
16211×
    if !paths.is_empty() {
16221×
        let repo = RepoName::new(&owner, &name).ok_or_else(|| not_found("no such repository"))?;
16231×
        let heads = crate::web::proposals::load_summary(&app, &repo, p).await?.heads;
16241×
        let lines = app
16251×
            .repos
16261×
            .read(&repo, move |r, _| {
16271×
                let mut at = std::collections::HashMap::new();
16281×
                for path in paths {
1629
                    // A file the projection removed has no lines to place a comment on.
16302×
                    for l in r.blame_in(&path, &heads).unwrap_or_default() {
16312×
                        at.insert((path.clone(), l.hash.to_hex(), l.index), l.line);
16322×
                    }
1633
                }
16341×
                Ok(at)
16351×
            })
16361×
            .await?;
16371×
        for c in &mut out {
16381×
            if let (Some(path), Some(a)) = (&c.path, &c.anchor) {
16391×
                c.line = lines.get(&(path.clone(), a.change.clone(), a.index)).copied();
16401×
            }
1641
        }
16420×
    }
16431×
    Ok(Json(out))
16441×
}
1645
16463×
async fn proposal_comment(
16473×
    State(app): State<Shared>,
16483×
    headers: HeaderMap,
16493×
    Path((owner, name, number)): Path<(String, String, i64)>,
16503×
    Json(body): Json<NewComment>,
16513×
) -> Result<(StatusCode, Json<Comment>), ApiError> {
16523×
    let c = caller(&app, &headers).await?;
16533×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
16543×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
16553×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
16563×
    if body.body.trim().is_empty() {
16570×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
16583×
    }
16593×
    let (repo, _) = (RepoName::new(&owner, &name).ok_or_else(|| not_found("no such repository"))?, ());
16603×
    let anchor = match (body.path.as_deref().map(|x| x.trim_matches('/')), body.line) {
16613×
        (Some(path), Some(line)) if !path.is_empty() => {
16623×
            let loaded = crate::web::proposals::load(&app, &repo, p.clone()).await?;
16633×
            let (heads, file) = (loaded.heads.clone(), path.to_string());
16643×
            let atom = app
16653×
                .repos
16663×
                .read(&repo, move |r, cache| {
16673×
                    let projected = cache.load(r, &heads)?;
16683×
                    Ok(crate::repos::proposals::atom_at(&projected, &file, line).map(|(h, i)| (h.to_hex(), i)))
16693×
                })
16703×
                .await?
16713×
                .ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, format!("{path}:{line} is not a line of the projected state")))?;
16722×
            Some((path.to_string(), atom))
1673
        }
16740×
        _ => None,
1675
    };
16762×
    let row_c = db::proposals::add_comment(
16772×
        &app.db,
16782×
        p.id,
16792×
        Some(me.id),
16802×
        &me.username,
16812×
        body.body.trim(),
16822×
        anchor.as_ref().map(|(path, _)| path.as_str()).unwrap_or(""),
16832×
        anchor.as_ref().map(|(_, (h, i))| (h.as_str(), *i as i64)),
1684
    )
16852×
    .await?;
16862×
    crate::notify::deliver(
16872×
        &app,
16882×
        crate::notify::Event {
16892×
            kind: "proposal.comment",
16902×
            title: format!("{owner}/{name}#{number}: {}", p.title),
16912×
            url: format!("/{owner}/{name}/proposal/{number}"),
16922×
            actor: &me,
16932×
            repo_id: row.id,
16942×
            thread: Some(("proposal", p.id)),
16952×
            mention_text: &body.body,
16962×
            direct: p.author_id.into_iter().collect(),
16972×
        },
16982×
    )
16992×
    .await;
17002×
    crate::hooks::emit(
17012×
        &app,
17022×
        &row,
17032×
        "comment.proposal",
17042×
        &me.username,
17052×
        serde_json::json!({ "number": number, "comment": comment_of(&row_c) }),
17062×
    )
17072×
    .await;
17082×
    let mut created = comment_of(&row_c);
17092×
    created.line = created.anchor.as_ref().and(body.line);
17102×
    Ok((StatusCode::CREATED, Json(created)))
17113×
}
1712
17131×
async fn proposal_reviews(
17141×
    State(app): State<Shared>,
17151×
    headers: HeaderMap,
17161×
    Path((owner, name, number)): Path<(String, String, i64)>,
17171×
) -> Result<Json<Vec<Review>>, ApiError> {
17181×
    let c = caller(&app, &headers).await?;
17191×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
17201×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17211×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
17221×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
1723
    Ok(Json(
17241×
        v.reviews
17251×
            .into_iter()
17261×
            .map(|r| Review {
17272×
                id: r.row.id,
17282×
                author: r.row.author,
17292×
                verdict: r.row.verdict,
17302×
                body: r.row.body,
17312×
                sealed: r.sealed,
17322×
                created_ms: r.row.created_ms,
17332×
                via: r.row.via,
17342×
            })
17351×
            .collect(),
1736
    ))
17371×
}
1738
17391×
async fn proposal_review(
17401×
    State(app): State<Shared>,
17411×
    headers: HeaderMap,
17421×
    Path((owner, name, number)): Path<(String, String, i64)>,
17431×
    Json(body): Json<NewReview>,
17441×
) -> Result<(StatusCode, Json<Review>), ApiError> {
17451×
    let c = caller(&app, &headers).await?;
17461×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
17471×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
17481×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17491×
    if !matches!(body.verdict.as_str(), "comment" | "changes" | "approve") {
17500×
        return Err(ApiError(StatusCode::BAD_REQUEST, "verdict is comment, changes or approve".into()));
17511×
    }
17521×
    if body.verdict == "approve" && Some(me.id) == p.author_id {
17530×
        return Err(forbidden("you cannot approve your own proposal"));
17541×
    }
17551×
    let r = db::proposals::add_review(&app.db, p.id, me.id, &me.username, &body.verdict, body.body.trim()).await?;
17561×
    db::proposals::add_event(&app.db, p.id, &me.username, &format!("review.{}", body.verdict), "").await.ok();
17571×
    crate::web::proposals::reviewed(&app, &row, &p, &me, &body.verdict).await;
17581×
    crate::hooks::emit(&app, &row, "review", &me.username, serde_json::json!({ "number": number, "verdict": body.verdict })).await;
17591×
    Ok((
17601×
        StatusCode::CREATED,
17611×
        Json(Review { id: r.id, author: r.author, verdict: r.verdict, body: r.body, sealed: false, created_ms: r.created_ms, via: r.via }),
17621×
    ))
17631×
}
1764
1765
/// `POST .../proposals/{number}/reviewers`: ask accounts to review (the
1766
/// author, or a writer). Answers with everyone asked now.
17674×
async fn request_reviewers(
17684×
    State(app): State<Shared>,
17694×
    headers: HeaderMap,
17704×
    Path((owner, name, number)): Path<(String, String, i64)>,
17714×
    Json(body): Json<ReviewRequest>,
17724×
) -> Result<Json<Vec<String>>, ApiError> {
17734×
    let c = caller(&app, &headers).await?;
17744×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
17754×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
17764×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17774×
    if Some(me.id) != p.author_id && role < Role::Write {
17780×
        return Err(forbidden("only the author or a writer asks for reviews"));
17794×
    }
17804×
    if !p.is_open() {
17810×
        return Err(ApiError(StatusCode::CONFLICT, "the proposal is not open".into()));
17824×
    }
17834×
    crate::web::proposals::request_reviewers(&app, &row, &p, &me, &body.reviewers)
17844×
        .await
17854×
        .map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
17862×
    Ok(Json(db::proposals::review_requests(&app.db, p.id).await?))
17874×
}
1788
1789
/// `DELETE .../proposals/{number}/reviewers/{username}`: withdraw a request.
17901×
async fn withdraw_reviewer(
17911×
    State(app): State<Shared>,
17921×
    headers: HeaderMap,
17931×
    Path((owner, name, number, username)): Path<(String, String, i64, String)>,
17941×
) -> Result<StatusCode, ApiError> {
17951×
    let c = caller(&app, &headers).await?;
17961×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
17971×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
17981×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17991×
    if Some(me.id) != p.author_id && role < Role::Write {
18000×
        return Err(forbidden("only the author or a writer withdraws review requests"));
18011×
    }
18021×
    let a = db::accounts::account_by_name(&app.db, &username).await?.ok_or_else(|| not_found("no such account"))?;
18031×
    if db::proposals::unrequest_review(&app.db, p.id, a.id).await? {
18041×
        db::proposals::add_event(&app.db, p.id, &me.username, "review request withdrawn", &a.username).await.ok();
18050×
    }
18061×
    Ok(StatusCode::NO_CONTENT)
18071×
}
1808
18091×
async fn proposal_checks(
18101×
    State(app): State<Shared>,
18111×
    headers: HeaderMap,
18121×
    Path((owner, name, number)): Path<(String, String, i64)>,
18131×
) -> Result<Json<Vec<Check>>, ApiError> {
18141×
    let c = caller(&app, &headers).await?;
18151×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
18161×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
18171×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
18181×
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &loaded.state).await?.iter().map(check_of).collect()))
18191×
}
1820
1821
// ------------------------------------------------------------------ issues
1822
182330×
async fn issue_of(app: &Shared, row: &db::repos::RepoRow, i: &db::issues::IssueRow) -> Result<Issue, ApiError> {
182430×
    let labels = db::issues::issue_labels(&app.db, i.id)
182530×
        .await?
182630×
        .into_iter()
182730×
        .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
182830×
        .collect();
182930×
    let assignees = db::issues::assignees(&app.db, i.id).await?;
183030×
    let milestone = match i.milestone_id {
18310×
        Some(id) => db::issues::milestone(&app.db, id).await?.map(|m| m.title),
183230×
        None => None,
1833
    };
183430×
    let comments: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM issue_comments WHERE issue_id = $1").bind(i.id).fetch_one(&app.db).await?;
183530×
    Ok(Issue {
183630×
        number: i.number,
183730×
        title: i.title.clone(),
183830×
        body: i.body.clone(),
183930×
        author: i.author.clone(),
184030×
        state: i.state.clone(),
184130×
        reason: i.reason.clone(),
184230×
        labels,
184330×
        assignees,
184430×
        milestone,
184530×
        comments,
184630×
        locked: i.locked,
184730×
        pinned: i.pinned,
184830×
        created_ms: i.created_ms,
184930×
        updated_ms: i.updated_ms,
185030×
        closed_ms: i.closed_ms,
185130×
        url: format!("{}/{}/issue/{}", app.config.base_url(), row.slug(), i.number),
185230×
    })
185330×
}
1854
1855
#[derive(Deserialize)]
1856
struct IssuesQuery {
1857
    state: Option<String>,
1858
}
1859
18605×
async fn issues(
18615×
    State(app): State<Shared>,
18625×
    headers: HeaderMap,
18635×
    Path((owner, name)): Path<(String, String)>,
18645×
    Query(q): Query<IssuesQuery>,
18655×
) -> Result<Json<Vec<Issue>>, ApiError> {
18665×
    let c = caller(&app, &headers).await?;
18675×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
18685×
    let state = q.state.unwrap_or_else(|| "open".into());
18695×
    let mut out = Vec::new();
18706×
    for i in db::issues::list(&app.db, row.id).await? {
18716×
        if state == "all" || i.state == state {
18725×
            out.push(issue_of(&app, &row, &i).await?);
18731×
        }
1874
    }
18755×
    Ok(Json(out))
18765×
}
1877
187819×
async fn create_issue(
187919×
    State(app): State<Shared>,
188019×
    headers: HeaderMap,
188119×
    Path((owner, name)): Path<(String, String)>,
188219×
    Json(body): Json<NewIssue>,
188319×
) -> Result<(StatusCode, Json<Issue>), ApiError> {
188419×
    let c = caller(&app, &headers).await?;
188518×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
188618×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
188718×
    if body.title.trim().is_empty() {
18880×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an issue needs a title".into()));
188918×
    }
189018×
    let triage = !body.labels.is_empty() || !body.assignees.is_empty() || body.milestone.is_some();
189118×
    if triage && role < Role::Triage {
18921×
        return Err(forbidden("setting labels, assignees or a milestone needs triage access"));
189317×
    }
1894
    // Check the names before anything is created.
189517×
    resolve_triage(&app, row.id, Some(&body.labels), Some(&body.assignees), body.milestone.as_deref()).await?;
189616×
    let i = db::issues::create(
189716×
        &app.db,
189816×
        db::issues::NewIssue {
189916×
            repo_id: row.id,
190016×
            title: body.title.trim(),
190116×
            body: body.body.trim(),
190216×
            author_id: Some(me.id),
190316×
            author: &me.username,
190416×
        },
190516×
    )
190616×
    .await?;
190716×
    db::issues::add_event(&app.db, i.id, &me.username, "opened", "").await.ok();
190816×
    if triage {
19091×
        let t = resolve_triage(&app, row.id, Some(&body.labels), Some(&body.assignees), body.milestone.as_deref()).await?;
19101×
        apply_triage(&app, &i, &me, t).await?;
191115×
    }
191216×
    let i = db::issues::get(&app.db, row.id, i.number).await?.unwrap_or(i);
191316×
    crate::web::issues::reindex(&app, row.id, &i).await;
191416×
    let api = issue_of(&app, &row, &i).await?;
191516×
    crate::notify::deliver(
191616×
        &app,
191716×
        crate::notify::Event {
191816×
            kind: "issue.opened",
191916×
            title: format!("{owner}/{name}#{}: {}", i.number, i.title),
192016×
            url: format!("/{owner}/{name}/issue/{}", i.number),
192116×
            actor: &me,
192216×
            repo_id: row.id,
192316×
            thread: Some(("issue", i.id)),
192416×
            mention_text: &body.body,
192516×
            direct: vec![],
192616×
        },
192716×
    )
192816×
    .await;
192916×
    crate::hooks::emit(&app, &row, "issue.opened", &me.username, serde_json::json!({ "issue": api })).await;
193016×
    Ok((StatusCode::CREATED, Json(api)))
193119×
}
1932
19333×
async fn issue(
19343×
    State(app): State<Shared>,
19353×
    headers: HeaderMap,
19363×
    Path((owner, name, number)): Path<(String, String, i64)>,
19373×
) -> Result<Json<Issue>, ApiError> {
19383×
    let c = caller(&app, &headers).await?;
19393×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
19403×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
19413×
    Ok(Json(issue_of(&app, &row, &i).await?))
19423×
}
1943
19442×
async fn issue_state(
19452×
    State(app): State<Shared>,
19462×
    headers: HeaderMap,
19472×
    Path((owner, name, number)): Path<(String, String, i64)>,
19482×
    Json(body): Json<IssueStateChange>,
19492×
) -> Result<Json<Issue>, ApiError> {
19502×
    let c = caller(&app, &headers).await?;
19512×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
19522×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
19532×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
19542×
    if role < Role::Triage && Some(me.id) != i.author_id {
19550×
        return Err(forbidden("only the author or triage may change the state"));
19562×
    }
19572×
    let (state, reason) = match body.state.as_str() {
19582×
        "closed" => ("closed", if body.reason == "not_planned" { "not_planned" } else { "completed" }),
19590×
        "open" => ("open", ""),
19600×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "state is open or closed".into())),
1961
    };
19622×
    db::issues::set_state(&app.db, i.id, state, reason).await?;
19632×
    db::issues::add_event(&app.db, i.id, &me.username, if state == "closed" { "closed" } else { "reopened" }, "").await.ok();
19642×
    let fresh = db::issues::get(&app.db, row.id, number).await?.unwrap_or(i);
19652×
    let api = issue_of(&app, &row, &fresh).await?;
19662×
    crate::hooks::emit(
19672×
        &app,
19682×
        &row,
19692×
        if state == "closed" { "issue.closed" } else { "issue.reopened" },
19702×
        &me.username,
19712×
        serde_json::json!({ "issue": api }),
1972
    )
19732×
    .await;
19742×
    Ok(Json(api))
19752×
}
1976
19771×
async fn issue_comments(
19781×
    State(app): State<Shared>,
19791×
    headers: HeaderMap,
19801×
    Path((owner, name, number)): Path<(String, String, i64)>,
19811×
) -> Result<Json<Vec<Comment>>, ApiError> {
19821×
    let c = caller(&app, &headers).await?;
19831×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
19841×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
1985
    Ok(Json(
19861×
        db::issues::comments(&app.db, i.id)
19871×
            .await?
19881×
            .into_iter()
19891×
            .map(|c| Comment {
19902×
                id: c.id,
19912×
                author: c.author,
19922×
                body: c.body,
19932×
                created_ms: c.created_ms,
19942×
                path: None,
19952×
                anchor: None,
19962×
                line: None,
1997
                resolved: false,
19982×
            })
19991×
            .collect(),
2000
    ))
20011×
}
2002
20033×
async fn issue_comment(
20043×
    State(app): State<Shared>,
20053×
    headers: HeaderMap,
20063×
    Path((owner, name, number)): Path<(String, String, i64)>,
20073×
    Json(body): Json<NewComment>,
20083×
) -> Result<(StatusCode, Json<Comment>), ApiError> {
20093×
    let c = caller(&app, &headers).await?;
20103×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
20113×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
20123×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
20133×
    if i.locked && role < Role::Triage {
20140×
        return Err(forbidden("this issue is locked"));
20153×
    }
20163×
    if body.body.trim().is_empty() {
20170×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
20183×
    }
20193×
    let cm = db::issues::add_comment(&app.db, i.id, Some(me.id), &me.username, body.body.trim()).await?;
20203×
    crate::web::issues::reindex(&app, row.id, &i).await;
20213×
    crate::notify::deliver(
20223×
        &app,
20233×
        crate::notify::Event {
20243×
            kind: "issue.comment",
20253×
            title: format!("{owner}/{name}#{number}: {}", i.title),
20263×
            url: format!("/{owner}/{name}/issue/{number}"),
20273×
            actor: &me,
20283×
            repo_id: row.id,
20293×
            thread: Some(("issue", i.id)),
20303×
            mention_text: &body.body,
20313×
            direct: i.author_id.into_iter().collect(),
20323×
        },
20333×
    )
20343×
    .await;
20353×
    let api = Comment {
20363×
        id: cm.id,
20373×
        author: cm.author,
20383×
        body: cm.body,
20393×
        created_ms: cm.created_ms,
20403×
        path: None,
20413×
        anchor: None,
20423×
        line: None,
20433×
        resolved: false,
20443×
    };
20453×
    crate::hooks::emit(&app, &row, "comment.issue", &me.username, serde_json::json!({ "number": number, "comment": api })).await;
20463×
    Ok((StatusCode::CREATED, Json(api)))
20473×
}
2048
2049
/// Labels, assignees and milestone named in a request, looked up.
2050
struct Triage {
2051
    labels: Option<Vec<db::issues::Label>>,
2052
    assignees: Option<Vec<Account>>,
2053
    /// `Some(None)` clears the milestone.
2054
    milestone: Option<Option<db::issues::Milestone>>,
2055
}
2056
205741×
async fn resolve_triage(
205841×
    app: &Shared,
205941×
    repo_id: i64,
206041×
    labels: Option<&[String]>,
206141×
    assignees: Option<&[String]>,
206241×
    milestone: Option<&str>,
206341×
) -> Result<Triage, ApiError> {
206441×
    let bad = |m: String| ApiError(StatusCode::BAD_REQUEST, m);
206541×
    let labels = match labels {
206624×
        Some(names) => {
206724×
            let mut out = Vec::new();
206824×
            for n in names {
206910×
                out.push(
207010×
                    db::issues::label_by_name(&app.db, repo_id, n.trim())
207110×
                        .await?
207210×
                        .ok_or_else(|| bad(format!("no label {n:?}; create it first")))?,
2073
                );
2074
            }
207522×
            Some(out)
2076
        }
207717×
        None => None,
2078
    };
207939×
    let assignees = match assignees {
208020×
        Some(names) => {
208120×
            let mut out = Vec::new();
208220×
            for n in names {
20833×
                out.push(db::accounts::account_by_name(&app.db, n.trim()).await?.ok_or_else(|| bad(format!("no account {n:?}")))?);
2084
            }
208520×
            Some(out)
2086
        }
208719×
        None => None,
2088
    };
208939×
    let milestone = match milestone.map(str::trim) {
209038×
        None => None,
20911×
        Some("") => Some(None),
20921×
        Some(title) => Some(Some(
20931×
            db::issues::milestones(&app.db, repo_id)
20941×
                .await?
20951×
                .into_iter()
20961×
                .find(|m| m.title == title)
20971×
                .ok_or_else(|| bad(format!("no milestone {title:?}")))?,
2098
        )),
2099
    };
210038×
    Ok(Triage { labels, assignees, milestone })
210141×
}
2102
2103
/// Make an issue's labels, assignees and milestone what `t` says, with
2104
/// timeline events for what changed.
21055×
async fn apply_triage(app: &Shared, i: &db::issues::IssueRow, me: &Account, t: Triage) -> Result<(), ApiError> {
21065×
    if let Some(want) = t.labels {
21074×
        let have = db::issues::issue_labels(&app.db, i.id).await?;
21084×
        for l in &have {
21092×
            if !want.iter().any(|w| w.id == l.id) {
21102×
                db::issues::set_issue_label(&app.db, i.id, l.id, false).await?;
21110×
            }
2112
        }
21134×
        for w in &want {
21143×
            if !have.iter().any(|l| l.id == w.id) {
21153×
                db::issues::set_issue_label(&app.db, i.id, w.id, true).await?;
21160×
            }
2117
        }
21184×
        let names: Vec<&str> = want.iter().map(|l| l.name.as_str()).collect();
21194×
        db::issues::add_event(&app.db, i.id, &me.username, "set labels", &names.join(", ")).await.ok();
21201×
    }
21215×
    if let Some(want) = t.assignees {
21224×
        let have = db::issues::assignees(&app.db, i.id).await?;
21234×
        for name in &have {
21242×
            if !want.iter().any(|a| &a.username == name) {
21252×
                if let Some(a) = db::accounts::account_by_name(&app.db, name).await? {
21262×
                    db::issues::set_assignee(&app.db, i.id, a.id, false).await?;
21272×
                    db::issues::add_event(&app.db, i.id, &me.username, "unassigned", name).await.ok();
21280×
                }
21290×
            }
2130
        }
21314×
        for a in &want {
21322×
            if !have.contains(&a.username) {
21332×
                db::issues::set_assignee(&app.db, i.id, a.id, true).await?;
21342×
                db::issues::add_event(&app.db, i.id, &me.username, "assigned", &a.username).await.ok();
21350×
            }
2136
        }
21371×
    }
21385×
    if let Some(m) = t.milestone {
21390×
        db::issues::set_milestone(&app.db, i.id, m.as_ref().map(|m| m.id)).await?;
21400×
        db::issues::add_event(&app.db, i.id, &me.username, "set milestone", m.as_ref().map(|m| m.title.as_str()).unwrap_or("")).await.ok();
21415×
    }
21425×
    Ok(())
21435×
}
2144
2145
/// `PATCH /repos/{o}/{n}/issues/{number}`.
21468×
async fn issue_edit(
21478×
    State(app): State<Shared>,
21488×
    headers: HeaderMap,
21498×
    Path((owner, name, number)): Path<(String, String, i64)>,
21508×
    Json(body): Json<IssueEdit>,
21518×
) -> Result<Json<Issue>, ApiError> {
21528×
    let c = caller(&app, &headers).await?;
21538×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
21548×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
21558×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
21568×
    let text = body.title.is_some() || body.body.is_some();
21578×
    let triage = body.labels.is_some() || body.assignees.is_some() || body.milestone.is_some();
21588×
    if text && role < Role::Triage && Some(me.id) != i.author_id {
21591×
        return Err(forbidden("only the author or triage may edit the title and body"));
21607×
    }
21617×
    if triage && role < Role::Triage {
21621×
        return Err(forbidden("setting labels, assignees or a milestone needs triage access"));
21636×
    }
21646×
    if i.locked && role < Role::Triage {
21650×
        return Err(forbidden("this issue is locked"));
21666×
    }
21676×
    let t = resolve_triage(&app, row.id, body.labels.as_deref(), body.assignees.as_deref(), body.milestone.as_deref()).await?;
21685×
    if text {
21693×
        let title = body.title.as_deref().map(str::trim).unwrap_or(&i.title);
21703×
        if title.is_empty() {
21711×
            return Err(ApiError(StatusCode::BAD_REQUEST, "an issue needs a title".into()));
21722×
        }
21732×
        db::issues::edit(&app.db, i.id, title, body.body.as_deref().unwrap_or(&i.body)).await?;
21742×
        db::issues::add_event(&app.db, i.id, &me.username, "edited", "").await.ok();
21752×
    }
21764×
    apply_triage(&app, &i, &me, t).await?;
21774×
    db::issues::touch(&app.db, i.id).await.ok();
21784×
    let fresh = db::issues::get(&app.db, row.id, number).await?.unwrap_or(i);
21794×
    crate::web::issues::reindex(&app, row.id, &fresh).await;
21804×
    let api = issue_of(&app, &row, &fresh).await?;
21814×
    crate::hooks::emit(&app, &row, "issue.edited", &me.username, serde_json::json!({ "issue": api })).await;
21824×
    Ok(Json(api))
21838×
}
2184
2185
/// `POST /repos/{o}/{n}/labels` (triage).
21866×
async fn create_label(
21876×
    State(app): State<Shared>,
21886×
    headers: HeaderMap,
21896×
    Path((owner, name)): Path<(String, String)>,
21906×
    Json(body): Json<NewLabel>,
21916×
) -> Result<(StatusCode, Json<Label>), ApiError> {
21926×
    let c = caller(&app, &headers).await?;
21936×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
21946×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
21956×
    if role < Role::Triage {
21961×
        return Err(forbidden("labels need triage access"));
21975×
    }
21985×
    let label = body.name.trim();
21995×
    if label.is_empty() || label.len() > 50 {
22000×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a label has a name of 1 to 50 characters".into()));
22015×
    }
22025×
    let colour = match body.colour.as_deref() {
22036×
        Some(c) if c.len() == 7 && c.starts_with('#') && c[1..].chars().all(|x| x.is_ascii_hexdigit()) => c.to_string(),
22041×
        Some(c) => return Err(ApiError(StatusCode::BAD_REQUEST, format!("colour {c:?} is not #rrggbb"))),
22053×
        None => "#5aa8ff".to_string(),
2206
    };
22074×
    let l = db::issues::upsert_label(&app.db, row.id, label, &colour, body.description.trim()).await?;
22084×
    Ok((StatusCode::CREATED, Json(Label { name: l.name, colour: l.colour, description: l.description })))
22096×
}
2210
2211
/// `DELETE /repos/{o}/{n}/labels/{label}` (triage).
22122×
async fn delete_label(
22132×
    State(app): State<Shared>,
22142×
    headers: HeaderMap,
22152×
    Path((owner, name, label)): Path<(String, String, String)>,
22162×
) -> Result<StatusCode, ApiError> {
22172×
    let c = caller(&app, &headers).await?;
22182×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
22192×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
22202×
    if role < Role::Triage {
22210×
        return Err(forbidden("labels need triage access"));
22222×
    }
22232×
    let l = db::issues::label_by_name(&app.db, row.id, &label).await?.ok_or_else(|| not_found("no such label"))?;
22241×
    db::issues::delete_label(&app.db, l.id).await?;
22251×
    Ok(StatusCode::NO_CONTENT)
22262×
}
2227
22282×
async fn labels(
22292×
    State(app): State<Shared>,
22302×
    headers: HeaderMap,
22312×
    Path((owner, name)): Path<(String, String)>,
22322×
) -> Result<Json<Vec<Label>>, ApiError> {
22332×
    let c = caller(&app, &headers).await?;
22342×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2235
    Ok(Json(
22362×
        db::issues::labels(&app.db, row.id)
22372×
            .await?
22382×
            .into_iter()
22393×
            .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
22402×
            .collect(),
2241
    ))
22422×
}
2243
22441×
async fn milestones(
22451×
    State(app): State<Shared>,
22461×
    headers: HeaderMap,
22471×
    Path((owner, name)): Path<(String, String)>,
22481×
) -> Result<Json<Vec<Milestone>>, ApiError> {
22491×
    let c = caller(&app, &headers).await?;
22501×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
22511×
    let mut out = Vec::new();
22521×
    for m in db::issues::milestones(&app.db, row.id).await? {
22531×
        let (open, closed) = db::issues::milestone_counts(&app.db, m.id).await?;
22541×
        out.push(Milestone { title: m.title, description: m.description, due_ms: m.due_ms, state: m.state, open, closed });
2255
    }
22561×
    Ok(Json(out))
22571×
}
2258
22592×
fn milestone_of(m: db::issues::Milestone, open: i64, closed: i64) -> Milestone {
22602×
    Milestone { title: m.title, description: m.description, due_ms: m.due_ms, state: m.state, open, closed }
22612×
}
2262
2263
/// A due date as `YYYY-MM-DD` (UTC midnight), or the empty string for none.
22643×
fn due_ms_of(due: &str) -> Result<Option<i64>, ApiError> {
22653×
    let due = due.trim();
22663×
    if due.is_empty() {
22671×
        return Ok(None);
22682×
    }
22692×
    time::Date::parse(due, &time::macros::format_description!("[year]-[month]-[day]"))
22702×
        .map(|d| Some(d.midnight().assume_utc().unix_timestamp() * 1000))
22712×
        .map_err(|_| ApiError(StatusCode::BAD_REQUEST, format!("due {due:?} is not YYYY-MM-DD")))
22723×
}
2273
22746×
async fn triage_for_milestones(app: &Shared, headers: &HeaderMap, owner: &str, name: &str) -> Result<db::repos::RepoRow, ApiError> {
22756×
    let c = caller(app, headers).await?;
22766×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
22776×
    let (_, row, role) = reach(app, &c, owner, name, Access::Read).await?;
22786×
    if role < Role::Triage {
22791×
        return Err(forbidden("milestones need triage access"));
22805×
    }
22815×
    Ok(row)
22826×
}
2283
2284
/// `POST /repos/{o}/{n}/milestones` (triage, oxygenhub#91): create a
2285
/// milestone, or change the description and due date of the one with
2286
/// that title.
22873×
async fn create_milestone(
22883×
    State(app): State<Shared>,
22893×
    headers: HeaderMap,
22903×
    Path((owner, name)): Path<(String, String)>,
22913×
    Json(body): Json<NewMilestone>,
22923×
) -> Result<(StatusCode, Json<Milestone>), ApiError> {
22933×
    let row = triage_for_milestones(&app, &headers, &owner, &name).await?;
22942×
    let title = body.title.trim();
22952×
    if title.is_empty() || title.len() > 100 {
22960×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a milestone has a title of 1 to 100 characters".into()));
22972×
    }
22982×
    let due_ms = due_ms_of(body.due.as_deref().unwrap_or(""))?;
22991×
    let m = db::issues::upsert_milestone(&app.db, row.id, title, body.description.trim(), due_ms).await?;
23001×
    let (open, closed) = db::issues::milestone_counts(&app.db, m.id).await?;
23011×
    Ok((StatusCode::CREATED, Json(milestone_of(m, open, closed))))
23023×
}
2303
2304
/// `PATCH /repos/{o}/{n}/milestones/{title}` (triage): title,
2305
/// description, due date and state; what is not given stays.
23063×
async fn edit_milestone(
23073×
    State(app): State<Shared>,
23083×
    headers: HeaderMap,
23093×
    Path((owner, name, title)): Path<(String, String, String)>,
23103×
    Json(body): Json<MilestoneEdit>,
23113×
) -> Result<Json<Milestone>, ApiError> {
23123×
    let row = triage_for_milestones(&app, &headers, &owner, &name).await?;
23133×
    let m = db::issues::milestones(&app.db, row.id)
23143×
        .await?
23153×
        .into_iter()
23163×
        .find(|m| m.title == title)
23173×
        .ok_or_else(|| not_found("no such milestone"))?;
23182×
    let new_title = body.title.as_deref().map(str::trim).unwrap_or(&m.title);
23192×
    if new_title.is_empty() || new_title.len() > 100 {
23200×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a milestone has a title of 1 to 100 characters".into()));
23212×
    }
23222×
    let due_ms = match body.due.as_deref() {
23231×
        Some(d) => due_ms_of(d)?,
23241×
        None => m.due_ms,
2325
    };
23262×
    let description = body.description.as_deref().map(str::trim).unwrap_or(&m.description);
23272×
    if body.title.is_some() || body.description.is_some() || body.due.is_some() {
23281×
        db::issues::update_milestone(&app.db, m.id, new_title, description, due_ms).await?;
23291×
    }
23302×
    if let Some(state) = body.state.as_deref() {
23312×
        match state {
23322×
            "open" | "closed" => db::issues::set_milestone_state(&app.db, m.id, state).await?,
23331×
            other => return Err(ApiError(StatusCode::BAD_REQUEST, format!("state {other:?} is open or closed"))),
2334
        }
23350×
    }
23361×
    let fresh = db::issues::milestone(&app.db, m.id).await?.ok_or_else(|| not_found("no such milestone"))?;
23371×
    let (open, closed) = db::issues::milestone_counts(&app.db, fresh.id).await?;
23381×
    Ok(Json(milestone_of(fresh, open, closed)))
23393×
}
2340
2341
// --------------------------------------------------------- hooks, checks
2342
23432×
fn hook_of(h: &db::hooks::Hook) -> Hook {
23442×
    Hook { id: h.id, url: h.url.clone(), events: h.events.clone(), active: h.active, created_ms: h.created_ms }
23452×
}
2346
23471×
async fn hooks(
23481×
    State(app): State<Shared>,
23491×
    headers: HeaderMap,
23501×
    Path((owner, name)): Path<(String, String)>,
23511×
) -> Result<Json<Vec<Hook>>, ApiError> {
23521×
    let c = caller(&app, &headers).await?;
23531×
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
23541×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23551×
    Ok(Json(db::hooks::hooks_for_repo(&app.db, row.id).await?.iter().map(hook_of).collect()))
23561×
}
2357
23581×
async fn create_hook(
23591×
    State(app): State<Shared>,
23601×
    headers: HeaderMap,
23611×
    Path((owner, name)): Path<(String, String)>,
23621×
    Json(body): Json<NewHook>,
23631×
) -> Result<(StatusCode, Json<Hook>), ApiError> {
23641×
    let c = caller(&app, &headers).await?;
23651×
    let me = c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?.clone();
23661×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23671×
    if !(body.url.starts_with("http://") || body.url.starts_with("https://")) {
23680×
        return Err(ApiError(StatusCode::BAD_REQUEST, "the URL must be http or https".into()));
23691×
    }
23701×
    let h = db::hooks::create_hook(&app.db, Some(row.id), None, &body.url, &body.secret, &body.events).await?;
23711×
    db::accounts::audit(&app.db, Some(&me), "hook.created", &row.slug(), &body.url).await.ok();
23721×
    Ok((StatusCode::CREATED, Json(hook_of(&h))))
23731×
}
2374
23750×
async fn delete_hook(
23760×
    State(app): State<Shared>,
23770×
    headers: HeaderMap,
23780×
    Path((owner, name, id)): Path<(String, String, i64)>,
23790×
) -> Result<StatusCode, ApiError> {
23800×
    let c = caller(&app, &headers).await?;
23810×
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
23820×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23830×
    if db::hooks::hook(&app.db, id).await?.is_some_and(|h| h.repo_id == Some(row.id)) {
23840×
        db::hooks::delete_hook(&app.db, id).await?;
23850×
    }
23860×
    Ok(StatusCode::NO_CONTENT)
23870×
}
2388
2389707×
pub fn check_of(c: &db::hooks::Check) -> Check {
2390
    Check {
2391707×
        state: c.state.clone(),
2392707×
        name: c.name.clone(),
2393707×
        status: CheckStatus::parse(&c.status).unwrap_or(CheckStatus::Queued),
2394707×
        summary: c.summary.clone(),
2395707×
        url: c.url.clone(),
2396707×
        reporter: c.reporter.clone(),
2397707×
        seal: if c.seal.is_empty() { None } else { Some(c.seal.clone()) },
2398707×
        started_ms: c.started_ms,
2399707×
        finished_ms: c.finished_ms,
2400
    }
2401707×
}
2402
2403
/// `GET /repos/{o}/{n}/checks/required`.
24042×
async fn required_checks(
24052×
    State(app): State<Shared>,
24062×
    headers: HeaderMap,
24072×
    Path((owner, name)): Path<(String, String)>,
24082×
) -> Result<Json<RequiredChecks>, ApiError> {
24092×
    let c = caller(&app, &headers).await?;
24102×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
24112×
    Ok(Json(RequiredChecks { names: db::hooks::required_checks(&app.db, row.id).await? }))
24122×
}
2413
2414
/// `PUT /repos/{o}/{n}/checks/required` (repository admin): the whole list.
24153×
async fn set_required_checks(
24163×
    State(app): State<Shared>,
24173×
    headers: HeaderMap,
24183×
    Path((owner, name)): Path<(String, String)>,
24193×
    Json(body): Json<RequiredChecks>,
24203×
) -> Result<Json<RequiredChecks>, ApiError> {
24213×
    let c = caller(&app, &headers).await?;
24223×
    c.require("repo:admin")?;
24232×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
24245×
    let mut names: Vec<String> = body.names.iter().map(|n| n.trim().to_string()).filter(|n| !n.is_empty()).collect();
24252×
    names.sort();
24262×
    names.dedup();
24273×
    if names.len() > 32 || names.iter().any(|n| n.len() > 100 || n.contains(',')) {
24281×
        return Err(ApiError(StatusCode::BAD_REQUEST, "at most 32 check names, each under 100 characters and without commas".into()));
24291×
    }
24301×
    db::hooks::set_required_checks(&app.db, row.id, &names).await?;
24311×
    db::accounts::audit(&app.db, c.account.as_ref(), "repo.required_checks", &format!("{owner}/{name}"), &names.join(", ")).await.ok();
24321×
    Ok(Json(RequiredChecks { names }))
24333×
}
2434
243510×
fn flow_run_of(
243610×
    app: &Shared,
243710×
    row: &db::repos::RepoRow,
243810×
    r: &db::flow::Run,
243910×
    jobs: Vec<db::flow::Job>,
244010×
    queue: &[db::flow::QueueEntry],
244110×
) -> FlowRun {
2442
    FlowRun {
244310×
        queue_position: crate::flow::queue_info(queue, row.id, r.id).position.map(|p| p as i64),
244410×
        number: r.number,
244510×
        bookmark: r.bookmark.clone(),
244610×
        state: r.state.clone(),
244710×
        heads: r.head_list().into_iter().map(String::from).collect(),
244810×
        status: r.status.clone(),
244910×
        trigger: r.trigger_label(),
245010×
        actor: r.actor.clone(),
245110×
        pipeline_hash: r.pipeline_hash.clone(),
245210×
        error: r.error.clone(),
245310×
        created_ms: r.created_ms,
245410×
        finished_ms: r.finished_ms,
245510×
        url: format!("{}/{}/{}/flow/{}", app.config.base_url(), row.owner, row.name, r.number),
245610×
        jobs: jobs
245710×
            .into_iter()
245810×
            .map(|j| FlowJob {
245913×
                depends_on: j.depends_on(),
246013×
                name: j.name,
246113×
                status: j.status,
246213×
                runner: j.runner,
246313×
                exit_code: j.exit_code,
246413×
                error: j.error,
246513×
                started_ms: j.started_ms,
246613×
                finished_ms: j.finished_ms,
246713×
                log_lines: j.log_count,
246813×
                waiting: j.waiting,
246913×
                placed: j.placed,
247013×
            })
247110×
            .collect(),
2472
    }
247310×
}
2474
2475
#[derive(Deserialize)]
2476
struct RunsPage {
2477
    /// Runs numbered below this one (the next page).
2478
    before: Option<i64>,
2479
    limit: Option<i64>,
2480
}
2481
2482
/// `GET /repos/{o}/{n}/flow/runs`: newest first, `?before=N&limit=` (max 100).
24832×
async fn flow_runs(
24842×
    State(app): State<Shared>,
24852×
    headers: HeaderMap,
24862×
    Path((owner, name)): Path<(String, String)>,
24872×
    Query(q): Query<RunsPage>,
24882×
) -> Result<Json<Vec<FlowRun>>, ApiError> {
24892×
    let c = caller(&app, &headers).await?;
24902×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
24912×
    let limit = q.limit.unwrap_or(30).clamp(1, 100);
24922×
    let runs = db::flow::runs_by_number(&app.db, row.id, limit, q.before).await?;
24932×
    let queue = if runs.iter().any(|r| r.live()) { db::flow::queue(&app.db).await? } else { vec![] };
24943×
    Ok(Json(runs.iter().map(|r| flow_run_of(&app, &row, r, vec![], &queue)).collect()))
24952×
}
2496
2497
/// `GET /repos/{o}/{n}/flow/runs/{number}`: a run with its jobs.
24988×
async fn flow_run(
24998×
    State(app): State<Shared>,
25008×
    headers: HeaderMap,
25018×
    Path((owner, name, number)): Path<(String, String, i64)>,
25028×
) -> Result<Json<FlowRun>, ApiError> {
25038×
    let c = caller(&app, &headers).await?;
25048×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
25058×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
25067×
    let jobs = db::flow::jobs(&app.db, run.id).await?;
25077×
    let queue = if run.live() { db::flow::queue(&app.db).await? } else { vec![] };
25087×
    Ok(Json(flow_run_of(&app, &row, &run, jobs, &queue)))
25098×
}
2510
2511
#[derive(Deserialize)]
2512
struct LogPage {
2513
    /// Lines after this `seq`.
2514
    #[serde(default)]
2515
    after: i64,
2516
    limit: Option<i64>,
2517
}
2518
2519
/// `GET /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/log`: `?after=seq&limit=` (max 5000).
25203×
async fn flow_job_log(
25213×
    State(app): State<Shared>,
25223×
    headers: HeaderMap,
25233×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
25243×
    Query(q): Query<LogPage>,
25253×
) -> Result<Json<Vec<FlowLogLine>>, ApiError> {
25263×
    let c = caller(&app, &headers).await?;
25273×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
25283×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
25293×
    let j = db::flow::jobs(&app.db, run.id)
25303×
        .await?
25313×
        .into_iter()
25325×
        .find(|j| j.name == job)
25333×
        .ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such job".into()))?;
25342×
    let lines = db::flow::log(&app.db, j.id, q.after, q.limit.unwrap_or(1000).clamp(1, 5000)).await?;
25352×
    Ok(Json(lines.into_iter().map(|l| FlowLogLine { seq: l.seq, t: l.t, stream: l.stream, text: l.text }).collect()))
25363×
}
2537
2538
#[derive(Deserialize)]
2539
struct StartRun {
2540
    /// Default: the repository's default bookmark.
2541
    #[serde(default)]
2542
    bookmark: Option<String>,
2543
    /// A change's full hash: run the state whose only head it is, instead
2544
    /// of a bookmark's.
2545
    #[serde(default)]
2546
    change: Option<String>,
2547
    /// Only these jobs, with what they depend on (oxygenhub#130); default:
2548
    /// every job a manual run starts.
2549
    #[serde(default)]
2550
    jobs: Vec<String>,
2551
}
2552
255310×
fn started(app: &Shared, row: &db::repos::RepoRow, number: i64) -> (StatusCode, Json<serde_json::Value>) {
255410×
    let url = format!("{}/{}/{}/flow/{number}", app.config.base_url(), row.owner, row.name);
255510×
    (StatusCode::CREATED, Json(serde_json::json!({ "number": number, "url": url })))
255610×
}
2557
2558
/// `POST /repos/{o}/{n}/flow/runs` (repo:write): run a bookmark's current
2559
/// state, or one change's, without moving anything (hub spec §13.2).
256014×
async fn start_flow_run(
256114×
    State(app): State<Shared>,
256214×
    headers: HeaderMap,
256314×
    Path((owner, name)): Path<(String, String)>,
256414×
    Json(body): Json<StartRun>,
256514×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
256614×
    let c = caller(&app, &headers).await?;
256714×
    let me = c.require("repo:write")?.clone();
256813×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
256913×
    let (n, what) = match body.change.clone().filter(|c| !c.trim().is_empty()) {
25702×
        Some(change) => {
25712×
            let n = crate::flow::run_change(&app, &row, &change, &me.username, &body.jobs)
25722×
                .await
25732×
                .map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
25741×
            (n, format!("change {}", change.trim()))
2575
        }
2576
        None => {
257711×
            let bookmark = body.bookmark.unwrap_or_else(|| row.default_bookmark.clone());
2578
            (
257911×
                crate::flow::run_bookmark(&app, &row, &bookmark, &me.username, &body.jobs)
258011×
                    .await
258111×
                    .map_err(|m| ApiError(StatusCode::CONFLICT, m))?,
25828×
                bookmark,
2583
            )
2584
        }
2585
    };
25869×
    db::accounts::audit(&app.db, Some(&me), "flow.run", &format!("{owner}/{name}"), &format!("#{n} {what}")).await.ok();
25879×
    Ok(started(&app, &row, n))
258814×
}
2589
2590
/// `POST /repos/{o}/{n}/flow/runs/{number}/rerun` (repo:write).
25913×
async fn rerun_flow_run(
25923×
    State(app): State<Shared>,
25933×
    headers: HeaderMap,
25943×
    Path((owner, name, number)): Path<(String, String, i64)>,
25953×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
25963×
    let c = caller(&app, &headers).await?;
25973×
    let me = c.require("repo:write")?.clone();
25983×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
25993×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26002×
    let n = crate::flow::rerun(&app, &row, &run, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26011×
    db::accounts::audit(&app.db, Some(&me), "flow.rerun", &format!("{owner}/{name}"), &format!("#{n} of #{number}")).await.ok();
26021×
    Ok(started(&app, &row, n))
26033×
}
2604
2605
/// `POST /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/rerun` (repo:write,
2606
/// oxygenflow#31): that job again, with the jobs that depend on it, in the
2607
/// same run. Answers with how many jobs were queued.
26084×
async fn rerun_flow_job(
26094×
    State(app): State<Shared>,
26104×
    headers: HeaderMap,
26114×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26124×
) -> Result<Json<serde_json::Value>, ApiError> {
26134×
    let c = caller(&app, &headers).await?;
26144×
    let me = c.require("repo:write")?.clone();
26154×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
26164×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26174×
    let n = crate::flow::rerun_job(&app, &row, &run, &job, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26182×
    db::accounts::audit(&app.db, Some(&me), "flow.rerun", &format!("{owner}/{name}"), &format!("{job} of #{number}")).await.ok();
26192×
    Ok(Json(serde_json::json!({ "run": number, "job": job, "queued": n })))
26204×
}
2621
2622
/// `POST /repos/{o}/{n}/flow/runs/{number}/cancel` (repo:write): answers
2623
/// with the run as it now stands.
26243×
async fn cancel_flow_run(
26253×
    State(app): State<Shared>,
26263×
    headers: HeaderMap,
26273×
    Path((owner, name, number)): Path<(String, String, i64)>,
26283×
) -> Result<Json<serde_json::Value>, ApiError> {
26293×
    let c = caller(&app, &headers).await?;
26303×
    let me = c.require("repo:write")?.clone();
26312×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
26322×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26332×
    crate::flow::cancel(&app, &row, &run, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26341×
    db::accounts::audit(&app.db, Some(&me), "flow.cancel", &format!("{owner}/{name}"), &format!("#{number}")).await.ok();
26351×
    Ok(Json(serde_json::json!({ "number": number, "status": "cancelled" })))
26363×
}
2637
2638
/// `GET /repos/{o}/{n}/deployments`: deployments, newest first
2639
/// (oxygenflow#59).
26401×
async fn list_deployments(
26411×
    State(app): State<Shared>,
26421×
    headers: HeaderMap,
26431×
    Path((owner, name)): Path<(String, String)>,
26441×
) -> Result<Json<Vec<serde_json::Value>>, ApiError> {
26451×
    let c = caller(&app, &headers).await?;
26461×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
26471×
    let list = db::flow::deployments(&app.db, row.id, 100).await?;
2648
    Ok(Json(
26491×
        list.into_iter()
26501×
            .map(|d| {
26511×
                serde_json::json!({ "environment": d.environment, "job": d.job, "run": d.run_number, "state": d.state,
26521×
                    "bookmark": d.bookmark, "actor": d.actor, "approved_by": d.approved_by, "finished_ms": d.finished_ms })
26531×
            })
26541×
            .collect(),
2655
    ))
26561×
}
2657
2658
/// `POST /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/approve` and
2659
/// `.../reject` (oxygenflow#57): the job's approval rules decide who may.
26600×
async fn approve_flow_job(
26610×
    State(app): State<Shared>,
26620×
    headers: HeaderMap,
26630×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26640×
) -> Result<Json<serde_json::Value>, ApiError> {
26650×
    decide_flow_job(&app, &headers, &owner, &name, number, &job, true).await
26660×
}
2667
26682×
async fn reject_flow_job(
26692×
    State(app): State<Shared>,
26702×
    headers: HeaderMap,
26712×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26722×
) -> Result<Json<serde_json::Value>, ApiError> {
26732×
    decide_flow_job(&app, &headers, &owner, &name, number, &job, false).await
26742×
}
2675
2676
/// `GET .../flow/runs/{n}/jobs/{job}/approval`: what approving the job
2677
/// means, for `oxy seal --flow` to sign (oxygenhub#235).
26781×
async fn flow_job_statement(
26791×
    State(app): State<Shared>,
26801×
    headers: HeaderMap,
26811×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26821×
) -> Result<Json<serde_json::Value>, ApiError> {
26831×
    let c = caller(&app, &headers).await?;
26841×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
26851×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26861×
    let (s, j) = crate::flow::approval_statement(&app, &row, &run, &job).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26871×
    Ok(Json(serde_json::json!({
26881×
        "repo": hex::encode(s.repo),
26891×
        "run": s.run,
26901×
        "job": s.job,
26911×
        "job_hash": s.job_hash.to_hex(),
26921×
        "state": s.state.to_hex(),
26931×
        "inputs": s.inputs.iter().map(|i| i.to_hex()).collect::<Vec<_>>(),
26941×
        "environment": s.environment,
26951×
        "waiting": j.approval == "waiting" && j.status == "queued",
2696
    })))
26971×
}
2698
2699
#[derive(Deserialize)]
2700
struct SealBody {
2701
    signed: String,
2702
}
2703
2704
/// `POST .../flow/runs/{n}/jobs/{job}/seal` `{"signed": hex}`: approve or
2705
/// reject with a signed approval (oxygenhub#235). The signature, not the
2706
/// caller, says who decided; the caller must be signed in.
27074×
async fn seal_flow_job(
27084×
    State(app): State<Shared>,
27094×
    headers: HeaderMap,
27104×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
27114×
    Json(body): Json<SealBody>,
27124×
) -> Result<Json<serde_json::Value>, ApiError> {
27134×
    let c = caller(&app, &headers).await?;
27144×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
27154×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
27164×
    let said = crate::flow::decide_sealed(&app, &row, &run, &job, &body.signed).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
27171×
    Ok(Json(serde_json::json!({ "number": number, "job": job, "said": said })))
27184×
}
2719
27202×
async fn decide_flow_job(
27212×
    app: &Shared,
27222×
    headers: &HeaderMap,
27232×
    owner: &str,
27242×
    name: &str,
27252×
    number: i64,
27262×
    job: &str,
27272×
    approve: bool,
27282×
) -> Result<Json<serde_json::Value>, ApiError> {
27292×
    let c = caller(app, headers).await?;
27302×
    let me = c.require("repo:write")?.clone();
27312×
    let (_, row, _) = reach(app, &c, owner, name, Access::Read).await?;
27322×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
27332×
    let via = c.agent.then_some(c.token.as_str());
27342×
    let said = crate::flow::decide(app, &row, &run, job, &me, approve, via).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
27351×
    Ok(Json(serde_json::json!({ "number": number, "job": job, "decision": if approve { "approved" } else { "rejected" }, "said": said })))
27362×
}
2737
2738
/// `POST /repos/{o}/{n}/checks`: any `checks:write` (or write) token may
2739
/// report; the state hash names what was checked.
27403×
async fn post_check(
27413×
    State(app): State<Shared>,
27423×
    headers: HeaderMap,
27433×
    Path((owner, name)): Path<(String, String)>,
27443×
    Json(body): Json<NewCheck>,
27453×
) -> Result<(StatusCode, Json<Check>), ApiError> {
27463×
    let c = caller(&app, &headers).await?;
27473×
    let me = c.require("checks:write").or_else(|_| c.require("repo:write"))?.clone();
27482×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2749128×
    if body.state.len() != 64 || !body.state.chars().all(|ch| ch.is_ascii_hexdigit()) {
27500×
        return Err(ApiError(StatusCode::BAD_REQUEST, "state is a 64-character hex state hash".into()));
27512×
    }
27522×
    if body.name.trim().is_empty() || body.name.len() > 100 {
27530×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a check has a short name".into()));
27542×
    }
27552×
    let ch = db::hooks::upsert_check(
27562×
        &app.db,
27572×
        row.id,
27582×
        db::hooks::CheckReport {
27592×
            state: &body.state,
27602×
            name: body.name.trim(),
27612×
            status: body.status.as_str(),
27622×
            summary: &body.summary,
27632×
            url: &body.url,
27642×
            reporter: Some((me.id, &me.username)),
27652×
            seal: body.seal.as_deref().unwrap_or(""),
27662×
        },
27672×
    )
27682×
    .await?;
27692×
    let api = check_of(&ch);
27702×
    app.bus.proposal(row.id, ProposalEvent { number: 0, kind: "check".into(), check: Some(api.clone()) });
27712×
    crate::hooks::emit(&app, &row, "check", &me.username, serde_json::json!({ "check": api })).await;
27722×
    Ok((StatusCode::CREATED, Json(api)))
27733×
}
2774
27754×
async fn checks_for_state(
27764×
    State(app): State<Shared>,
27774×
    headers: HeaderMap,
27784×
    Path((owner, name, state)): Path<(String, String, String)>,
27794×
) -> Result<Json<Vec<Check>>, ApiError> {
27804×
    let c = caller(&app, &headers).await?;
27814×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
27824×
    let state = state_key(&app, &repo, &state).await?;
27833×
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &state).await?.iter().map(check_of).collect()))
27844×
}
2785
2786
/// The state hash checks are keyed by, from what a client has: a state
2787
/// hash, its heads (full change hashes joined with `+`, or the one head of
2788
/// a single-head state, which is what `oxy log` shows), or a bookmark.
27894×
async fn state_key(app: &Shared, repo: &RepoName, s: &str) -> Result<String, ApiError> {
2790
    use oxy_core::hash::{hash_object, ChangeHash, ObjectType};
27914×
    let hexes: Vec<&str> = s.split('+').collect();
2792128×
    let all_hashes = hexes.iter().all(|h| h.len() == 64 && h.bytes().all(|b| b.is_ascii_hexdigit()));
27934×
    if all_hashes {
27942×
        let row = db::repos::get(&app.db, &repo.owner, &repo.name).await?.ok_or_else(|| not_found("no such repository"))?;
27952×
        if hexes.len() == 1 && !db::hooks::checks_for_state(&app.db, row.id, s).await?.is_empty() {
27961×
            return Ok(s.to_string());
27971×
        }
27981×
        let heads: Vec<ChangeHash> = hexes.iter().filter_map(|h| ChangeHash::from_hex(h)).collect();
27991×
        return Ok(hash_object(ObjectType::State, &oxy_core::objects::StateObject::new(heads).encode()).to_hex());
28002×
    }
28012×
    let b = s.to_string();
28022×
    let found = app.repos.read(repo, move |r, _| Ok(r.view()?.bookmarks.get(&b).copied())).await?;
28032×
    found.map(|st| st.to_hex()).ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("{s:?} is not a state hash, heads or a bookmark")))
28044×
}
2805
2806
// ----------------------------------------------------------------- runners
2807
2808
/// Site administrators only, with any token of theirs (hub spec §13.2).
28098×
fn require_site_admin(c: &Caller) -> Result<&Account, ApiError> {
28108×
    match c.account.as_ref() {
28117×
        Some(a) if a.is_admin => Ok(a),
28121×
        _ => Err(not_found("no such API route")),
2813
    }
28148×
}
2815
28165×
async fn runner_of(app: &Shared, r: db::runners::Runner, running: i64) -> hub_api::Runner {
28175×
    let serves = match r.scope_repo_id {
28180×
        Some(id) => db::repos::get_by_id(&app.db, id).await.ok().flatten().map(|p| p.slug()).unwrap_or_default(),
28195×
        None => r.scope_owner.clone(),
2820
    };
28215×
    hub_api::Runner {
28225×
        id: r.id,
28235×
        status: r.status().to_string(),
28245×
        serves,
28255×
        labels: r.label_list().into_iter().map(String::from).collect(),
28265×
        name: r.name,
28275×
        arch: r.arch,
28285×
        os: r.os,
28295×
        version: r.version,
28305×
        max_jobs: r.max_jobs,
28315×
        memory_mib: r.memory_mib,
28325×
        cpus: r.cpus,
28335×
        key: r.key,
28345×
        source: r.source,
28355×
        last_seen_ms: r.last_seen_ms,
28365×
        running,
28375×
        free_disk_mib: r.free_disk_mib,
28385×
        load_x100: r.load_x100,
28395×
        speed: r.speed,
28405×
        speed_class: r.speed_class,
28415×
        kernel: r.kernel,
28425×
    }
28435×
}
2844
2845
/// `GET /api/v1/runners`.
28464×
async fn runners(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::Runner>>, ApiError> {
28474×
    let c = caller(&app, &headers).await?;
28484×
    require_site_admin(&c)?;
28493×
    let running: std::collections::HashMap<i64, i64> = db::runners::running(&app.db).await?.into_iter().collect();
28503×
    let mut out = Vec::new();
28515×
    for r in db::runners::list(&app.db).await? {
28525×
        let n = running.get(&r.id).copied().unwrap_or(0);
28535×
        out.push(runner_of(&app, r, n).await);
2854
    }
28553×
    Ok(Json(out))
28564×
}
2857
2858
#[derive(Deserialize)]
2859
struct BeforeQuery {
2860
    #[serde(default)]
2861
    before: Option<i64>,
2862
    #[serde(default)]
2863
    limit: Option<i64>,
2864
}
2865
2866
/// `GET /api/v1/runners/{id}/jobs?before=MS&limit=N`: newest first.
28671×
async fn runner_jobs(
28681×
    State(app): State<Shared>,
28691×
    headers: HeaderMap,
28701×
    Path(id): Path<i64>,
28711×
    Query(q): Query<BeforeQuery>,
28721×
) -> Result<Json<Vec<hub_api::RunnerJob>>, ApiError> {
28731×
    let c = caller(&app, &headers).await?;
28741×
    require_site_admin(&c)?;
28751×
    db::runners::get(&app.db, id).await?.ok_or_else(|| not_found("no such runner"))?;
28761×
    let jobs = db::runners::history(&app.db, id, q.limit.unwrap_or(50).clamp(1, 200), q.before).await?;
2877
    Ok(Json(
28781×
        jobs.into_iter()
28791×
            .map(|j| hub_api::RunnerJob {
28801×
                repo: format!("{}/{}", j.owner, j.repo),
28811×
                run: j.run_number,
28821×
                job: j.job,
28831×
                status: j.status,
28841×
                started_ms: j.started_ms,
28851×
                finished_ms: j.finished_ms,
28861×
            })
28871×
            .collect(),
2888
    ))
28891×
}
2890
2891
/// `GET /api/v1/runners/queue`: running jobs, then queued ones in claim order.
28921×
async fn runner_queue(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::QueueItem>>, ApiError> {
28931×
    let c = caller(&app, &headers).await?;
28941×
    require_site_admin(&c)?;
2895
    Ok(Json(
28961×
        db::flow::queue(&app.db)
28971×
            .await?
28981×
            .into_iter()
28991×
            .map(|e| hub_api::QueueItem {
29003×
                repo: format!("{}/{}", e.owner, e.name),
29013×
                run: e.run_number,
29023×
                job: e.job,
29033×
                status: e.status,
29043×
                runner: e.runner,
29053×
            })
29061×
            .collect(),
2907
    ))
29081×
}
2909
2910
/// `POST .../proposals/{number}/review-requests`: ask an AI assistant the
2911
/// repository may use to review (hub spec §13.4). Accepted at once; the
2912
/// answer arrives as a `comment` review via the assistant.
29130×
async fn request_assistant(
29140×
    State(app): State<Shared>,
29150×
    headers: HeaderMap,
29160×
    Path((owner, name, number)): Path<(String, String, i64)>,
29170×
    Json(body): Json<hub_api::AssistantRequest>,
29180×
) -> Result<(StatusCode, Json<hub_api::AssistantRequest>), ApiError> {
29190×
    let c = caller(&app, &headers).await?;
29200×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
29210×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
29220×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
29230×
    if Some(me.id) != p.author_id && role < Role::Write {
29240×
        return Err(forbidden("only the author or a writer asks for reviews"));
29250×
    }
29260×
    if !p.is_open() {
29270×
        return Err(ApiError(StatusCode::CONFLICT, "the proposal is not open".into()));
29280×
    }
29290×
    let a = crate::assistants::enabled_for_repo(&app.db, &row)
29300×
        .await?
29310×
        .into_iter()
29320×
        .find(|a| a.name.eq_ignore_ascii_case(body.assistant.trim()))
29330×
        .ok_or_else(|| ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("no assistant called {} here", body.assistant.trim())))?;
29340×
    let asked = hub_api::AssistantRequest { assistant: a.name.clone() };
29350×
    crate::assistants::request_review(&app, &row, &p, &me, a).await.map_err(|e| ApiError(StatusCode::CONFLICT, e))?;
29360×
    Ok((StatusCode::ACCEPTED, Json(asked)))
29370×
}
2938
2939
// -------------------------------------------------------- assistants (§13.4)
2940
2941
use crate::levels::At;
2942
use crate::web::assistants as aa;
2943
2944
/// The level a repository's assistants live at, for its admins (repo:admin).
29458×
async fn repo_level(app: &Shared, c: &Caller, owner: &str, name: &str) -> Result<(Account, At), ApiError> {
29468×
    let me = c.require("repo:admin")?.clone();
29477×
    let (_, row, _) = reach(app, c, owner, name, Access::Admin).await?;
29487×
    Ok((me, At::repo(&row)))
29498×
}
2950
2951
/// An organisation's level, for its owners (repo:admin).
29520×
async fn org_level(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {
29530×
    let me = c.require("repo:admin")?.clone();
29540×
    let o = db::accounts::org_by_name(&app.db, org).await?.ok_or_else(|| not_found("no such organisation"))?;
29550×
    if !auth::roles::is_org_owner(&app.db, &me, o.id).await? {
29560×
        return Err(not_found("no such organisation"));
29570×
    }
29580×
    Ok((me, At::org(&o)))
29590×
}
2960
2961
/// The site's level, for its administrators.
29622×
fn site_level(c: &Caller) -> Result<(Account, At), ApiError> {
29632×
    Ok((require_site_admin(c)?.clone(), At::site()))
29642×
}
2965
29663×
fn put_outcome(r: Result<String, String>) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
29673×
    match r {
29683×
        Ok(msg) => Ok((StatusCode::OK, Json(serde_json::json!({ "ok": msg })))),
29690×
        Err(e) => Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, e)),
2970
    }
29713×
}
2972
2973
macro_rules! assistant_routes {
2974
    ($list:ident, $put:ident, $del:ident, $prompt:ident, $prompt_put:ident, ($($p:ident: $t:ty),*), $level:expr) => {
29752×
        async fn $list(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<Vec<Assistant>>, ApiError> {
29762×
            let c = caller(&app, &headers).await?;
29772×
            let (_, at) = $level(&app, &c, $(&$p),*).await?;
29782×
            Ok(Json(aa::api_list(&app, &at).await?))
29792×
        }
29803×
        async fn $put(
29813×
            State(app): State<Shared>,
29823×
            headers: HeaderMap,
29833×
            Path(($($p),*)): Path<($($t),*)>,
29843×
            Json(body): Json<NewAssistant>,
29853×
        ) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
29863×
            let c = caller(&app, &headers).await?;
29873×
            let (me, at) = $level(&app, &c, $(&$p),*).await?;
29882×
            put_outcome(aa::api_put(&app, &me, &at, body).await?)
29893×
        }
29900×
        async fn $prompt(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<AssistantPrompt>, ApiError> {
29910×
            let c = caller(&app, &headers).await?;
29920×
            let (_, at) = $level(&app, &c, $(&$p),*).await?;
29930×
            Ok(Json(aa::api_prompt(&app, &at).await?))
29940×
        }
29951×
        async fn $prompt_put(
29961×
            State(app): State<Shared>,
29971×
            headers: HeaderMap,
29981×
            Path(($($p),*)): Path<($($t),*)>,
29991×
            Json(body): Json<AssistantPrompt>,
30001×
        ) -> Result<Json<AssistantPrompt>, ApiError> {
30011×
            let c = caller(&app, &headers).await?;
30021×
            let (me, at) = $level(&app, &c, $(&$p),*).await?;
30031×
            aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
30041×
            Ok(Json(aa::api_prompt(&app, &at).await?))
30051×
        }
3006
    };
3007
}
3008
3009
assistant_routes!(repo_assistants, repo_assistant_put, _rd, repo_prompt, repo_prompt_put, (owner: String, name: String), repo_level);
3010
30112×
async fn repo_assistant_delete(
30122×
    State(app): State<Shared>,
30132×
    headers: HeaderMap,
30142×
    Path((owner, name, assistant)): Path<(String, String, String)>,
30152×
) -> Result<StatusCode, ApiError> {
30162×
    let c = caller(&app, &headers).await?;
30172×
    let (me, at) = repo_level(&app, &c, &owner, &name).await?;
30182×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
30191×
        Ok(StatusCode::NO_CONTENT)
3020
    } else {
30211×
        Err(not_found("no such assistant at this level"))
3022
    }
30232×
}
3024
30250×
async fn org_level_one(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {
30260×
    org_level(app, c, org).await
30270×
}
3028
30290×
async fn org_assistants(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<Vec<Assistant>>, ApiError> {
30300×
    let c = caller(&app, &headers).await?;
30310×
    let (_, at) = org_level_one(&app, &c, &org).await?;
30320×
    Ok(Json(aa::api_list(&app, &at).await?))
30330×
}
3034
30350×
async fn org_assistant_put(
30360×
    State(app): State<Shared>,
30370×
    headers: HeaderMap,
30380×
    Path(org): Path<String>,
30390×
    Json(body): Json<NewAssistant>,
30400×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
30410×
    let c = caller(&app, &headers).await?;
30420×
    let (me, at) = org_level_one(&app, &c, &org).await?;
30430×
    put_outcome(aa::api_put(&app, &me, &at, body).await?)
30440×
}
3045
30460×
async fn org_assistant_delete(
30470×
    State(app): State<Shared>,
30480×
    headers: HeaderMap,
30490×
    Path((org, assistant)): Path<(String, String)>,
30500×
) -> Result<StatusCode, ApiError> {
30510×
    let c = caller(&app, &headers).await?;
30520×
    let (me, at) = org_level_one(&app, &c, &org).await?;
30530×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
30540×
        Ok(StatusCode::NO_CONTENT)
3055
    } else {
30560×
        Err(not_found("no such assistant at this level"))
3057
    }
30580×
}
3059
30600×
async fn org_prompt(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<AssistantPrompt>, ApiError> {
30610×
    let c = caller(&app, &headers).await?;
30620×
    let (_, at) = org_level_one(&app, &c, &org).await?;
30630×
    Ok(Json(aa::api_prompt(&app, &at).await?))
30640×
}
3065
30660×
async fn org_prompt_put(
30670×
    State(app): State<Shared>,
30680×
    headers: HeaderMap,
30690×
    Path(org): Path<String>,
30700×
    Json(body): Json<AssistantPrompt>,
30710×
) -> Result<Json<AssistantPrompt>, ApiError> {
30720×
    let c = caller(&app, &headers).await?;
30730×
    let (me, at) = org_level_one(&app, &c, &org).await?;
30740×
    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
30750×
    Ok(Json(aa::api_prompt(&app, &at).await?))
30760×
}
3077
30780×
async fn site_assistants(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Assistant>>, ApiError> {
30790×
    let c = caller(&app, &headers).await?;
30800×
    let (_, at) = site_level(&c)?;
30810×
    Ok(Json(aa::api_list(&app, &at).await?))
30820×
}
3083
30841×
async fn site_assistant_put(
30851×
    State(app): State<Shared>,
30861×
    headers: HeaderMap,
30871×
    Json(body): Json<NewAssistant>,
30881×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
30891×
    let c = caller(&app, &headers).await?;
30901×
    let (me, at) = site_level(&c)?;
30911×
    put_outcome(aa::api_put(&app, &me, &at, body).await?)
30921×
}
3093
30940×
async fn site_assistant_delete(
30950×
    State(app): State<Shared>,
30960×
    headers: HeaderMap,
30970×
    Path(assistant): Path<String>,
30980×
) -> Result<StatusCode, ApiError> {
30990×
    let c = caller(&app, &headers).await?;
31000×
    let (me, at) = site_level(&c)?;
31010×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
31020×
        Ok(StatusCode::NO_CONTENT)
3103
    } else {
31040×
        Err(not_found("no such assistant at this level"))
3105
    }
31060×
}
3107
31080×
async fn site_prompt(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<AssistantPrompt>, ApiError> {
31090×
    let c = caller(&app, &headers).await?;
31100×
    let (_, at) = site_level(&c)?;
31110×
    Ok(Json(aa::api_prompt(&app, &at).await?))
31120×
}
3113
31141×
async fn site_prompt_put(
31151×
    State(app): State<Shared>,
31161×
    headers: HeaderMap,
31171×
    Json(body): Json<AssistantPrompt>,
31181×
) -> Result<Json<AssistantPrompt>, ApiError> {
31191×
    let c = caller(&app, &headers).await?;
31201×
    let (me, at) = site_level(&c)?;
31211×
    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
31221×
    Ok(Json(aa::api_prompt(&app, &at).await?))
31231×
}