OXYGENHUB

Coverage / crates/hub/src/api/mod.rs 85.5%

2509 of 2933 lines run, 376 of 1004 functions · run #482 on proposal/333 · run missed

1
//! The JSON API (hub spec §12.1) under `/api/v1`: bearer tokens, RFC 7807
2
//! problems, the same shapes as `oxy --json` where one exists. Reads need
3
//! `repo:read` (anonymous for public repositories); writes the scope named
4
//! on each handler.
5
6
use crate::auth::{self, Access, Role};
7
use crate::db::{self, accounts::Account};
8
use crate::repos::{view, RepoError, RepoName};
9
use crate::Shared;
10
use axum::extract::{Path, Query, State};
11
use axum::http::{HeaderMap, StatusCode};
12
use axum::response::{IntoResponse, Response};
13
use axum::routing::{get, post};
14
use axum::{Json, Router};
15
use hub_api::*;
16
use serde::Deserialize;
17
18
mod backups;
19
pub mod device;
20
mod drops;
21
mod images;
22
mod projects;
23
mod reports;
24
25
/// Any other path under `/api/v1`: a problem document, not the site's page.
26
/// `GET /api/v1/version`: the hub's version and build, and the Oxygen and
27
/// OxygenFlow library versions it is built on.
281×
async fn version() -> Json<serde_json::Value> {
291×
    Json(crate::web::home::versions())
301×
}
31
321×
async fn no_route() -> ApiError {
331×
    ApiError(StatusCode::NOT_FOUND, "no such API route".into())
341×
}
35
36
/// A known route asked with a method it does not take: a problem body
37
/// rather than axum's empty 405 (oxygenhub#115).
381×
async fn wrong_method(method: axum::http::Method, uri: axum::http::Uri) -> ApiError {
391×
    ApiError(StatusCode::METHOD_NOT_ALLOWED, format!("{} is an API route, but not for {method}", uri.path()))
401×
}
41
42
/// The API, with release assets up to `asset_limit` bytes (the web form's
43
/// limit too; axum's default of 2 MiB refused ordinary builds).
442661×
pub fn router(asset_limit: usize) -> Router<Shared> {
452661×
    Router::new()
462661×
        .fallback(no_route)
472661×
        .route("/keyless/certify", post(crate::keyless::certify))
482661×
        .route("/agents/grants", get(crate::keyless::grants_list).post(crate::keyless::grants_create))
492661×
        .route(
502661×
            "/repos/{owner}/{name}/terraform/state/{state}",
512661×
            axum::routing::any(crate::terraform::state)
522661×
                .layer(axum::extract::DefaultBodyLimit::max(crate::terraform::MAX_STATE_BYTES + 4096)),
53
        )
542661×
        .route("/repos/{owner}/{name}/terraform/state/{state}/versions", axum::routing::get(crate::terraform::versions))
552661×
        .route("/repos/{owner}/{name}/terraform/state/{state}/versions/{id}", axum::routing::get(crate::terraform::version))
562661×
        .route(
572661×
            "/repos/{owner}/{name}/terraform/state/{state}/versions/{id}/restore",
582661×
            axum::routing::post(crate::terraform::restore_version),
59
        )
602661×
        .route("/agents/grants/{id}", axum::routing::delete(crate::keyless::grants_revoke))
612661×
        .route("/flow/claim", post(crate::flow::claim))
622661×
        .route("/flow/runners/register", post(crate::flow::register))
632661×
        .route("/flow/runners/heartbeat", post(crate::flow::heartbeat))
642661×
        .route("/flow/runner/update", get(crate::flow::runner_update).post(crate::flow::report_update))
652661×
        .route("/flow/images/missing", post(images::missing).layer(axum::extract::DefaultBodyLimit::max(images::MAX_ASK_BYTES)))
662661×
        .route("/flow/swarm/announce", post(crate::swarm::announce))
672661×
        .route("/flow/images/chunks/{hash}", axum::routing::put(images::put_chunk).get(images::get_chunk))
682661×
        .route(
692661×
            "/flow/images/{hash}",
702661×
            axum::routing::put(images::put_manifest).get(images::get_manifest).layer(axum::extract::DefaultBodyLimit::max(64 << 20)),
71
        )
722661×
        .route("/flow/jobs/{id}/log", post(crate::flow::log))
732661×
        .route("/flow/jobs/{id}/finish", post(crate::flow::finish))
742661×
        .route("/flow/jobs/{id}/decline", post(crate::flow::decline))
752661×
        .route("/flow/jobs/{id}/release", post(crate::flow::release))
762661×
        .route(
772661×
            "/flow/jobs/{id}/checkpoint",
782661×
            post(crate::flow::save_checkpoint)
792661×
                .get(crate::flow::checkpoint)
802661×
                .layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
81
        )
822661×
        .route(
832661×
            "/flow/jobs/{id}/artifacts/{name}",
842661×
            post(crate::flow::artifact).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
85
        )
862661×
        .route("/flow/jobs/{id}/inputs/{index}", get(crate::flow::input))
872661×
        .route(
882661×
            "/flow/jobs/{id}/reports/{name}/files",
892661×
            post(crate::flow::report_file).layer(axum::extract::DefaultBodyLimit::max(crate::flow::MAX_ARTIFACT_BYTES + (1 << 20))),
90
        )
912661×
        .route("/projects/{owner}", get(projects::list).post(projects::create))
922661×
        .route("/projects/{owner}/{number}", get(projects::board).patch(projects::edit))
932661×
        .route("/projects/{owner}/{number}/cards", get(projects::cards).post(projects::add_card))
942661×
        .route("/projects/{owner}/{number}/cards/move", post(projects::move_cards))
952661×
        .route("/projects/{owner}/{number}/cards/archive", post(projects::archive_cards))
962661×
        .route("/projects/{owner}/{number}/cards/{id}/restore", post(projects::restore_card))
972661×
        .route("/projects/{owner}/{number}/cards/{id}", axum::routing::patch(projects::move_card).delete(projects::remove_card))
982661×
        .route("/device/code", post(device::code).delete(device::cancel))
992661×
        .route("/device/token", post(device::token))
1002661×
        .route("/runners", get(runners))
1012661×
        .route("/runners/queue", get(runner_queue))
1022661×
        .route("/runners/{id}/jobs", get(runner_jobs))
1032661×
        .route("/user", get(me))
1042661×
        .route("/user/repos", get(user_repos))
1052661×
        .route("/user/orgs", get(user_orgs))
1062661×
        .route("/user/proposals", get(user_proposals))
1072661×
        .route("/user/runner-token", post(user_runner_token))
1082661×
        .route("/user/token", axum::routing::delete(revoke_own_token))
1092661×
        .route("/version", get(version))
1102661×
        .route("/notifications", get(notifications))
1112661×
        .route("/notifications/read", post(notifications_read_all))
1122661×
        .route("/notifications/{id}/read", post(notification_read))
1132661×
        .route("/users/{name}", get(user))
1142661×
        .route("/users/{name}/drops", get(drops::of_user))
1152661×
        .route("/drops", get(drops::mine).post(drops::create))
1162661×
        .route("/drops/{id}", get(drops::view).patch(drops::edit).delete(drops::delete))
1172661×
        .route("/orgs/{name}", get(org))
1182661×
        .route("/search", get(search))
1192661×
        .route("/repos", get(list_repos).post(create_repo))
1202661×
        .route("/repos/{owner}/{name}", get(get_repo))
1212661×
        .route("/repos/{owner}/{name}/bookmarks", get(bookmarks))
1222661×
        .route("/repos/{owner}/{name}/tags", get(tags).post(create_tag))
1232661×
        .route("/repos/{owner}/{name}/tags/{tag}", axum::routing::delete(withdraw_tag))
1242661×
        .route("/repos/{owner}/{name}/consumers", get(consumers))
1252661×
        .route("/repos/{owner}/{name}/diffusion", get(diffusion).put(set_diffusion))
1262661×
        .route("/repos/{owner}/{name}/backup", axum::routing::put(set_backup))
1272661×
        .route("/user/backups", get(backups::user_get).put(backups::user_put))
1282661×
        .route("/user/backups/test", post(backups::user_test))
1292661×
        .route("/user/backups/run", post(backups::user_run))
1302661×
        .route("/user/backups/runs", get(backups::user_runs))
1312661×
        .route("/orgs/{name}/backups", get(backups::org_get).put(backups::org_put))
1322661×
        .route("/orgs/{name}/backups/test", post(backups::org_test))
1332661×
        .route("/orgs/{name}/backups/run", post(backups::org_run))
1342661×
        .route("/orgs/{name}/backups/runs", get(backups::org_runs))
1352661×
        .route("/repos/{owner}/{name}/history/{r}", get(history))
1362661×
        .route("/repos/{owner}/{name}/changes/{hash}", get(change))
1372661×
        .route("/repos/{owner}/{name}/tree/{r}", get(tree_root))
1382661×
        .route("/repos/{owner}/{name}/tree/{r}/{*path}", get(tree))
1392661×
        .route("/repos/{owner}/{name}/file/{r}/{*path}", get(file))
1402661×
        .route("/repos/{owner}/{name}/blame/{r}/{*path}", get(blame))
1412661×
        .route("/repos/{owner}/{name}/conflicts", get(conflicts))
1422661×
        .route("/repos/{owner}/{name}/trust", get(trust))
1432661×
        .route("/repos/{owner}/{name}/releases/trust/{*tag}", get(release_trust))
1442661×
        .route("/repos/{owner}/{name}/pushes", get(pushes))
1452661×
        .route("/repos/{owner}/{name}/proposals", get(proposals).post(create_proposal))
1462661×
        .route("/repos/{owner}/{name}/proposals/{number}", get(proposal).patch(edit_proposal))
1472661×
        .route("/repos/{owner}/{name}/proposals/{number}/land", post(land_proposal))
1482661×
        .route("/repos/{owner}/{name}/proposals/{number}/auto-land", post(auto_land_on).delete(auto_land_off))
1492661×
        .route("/repos/{owner}/{name}/proposals/{number}/comments", get(proposal_comments).post(proposal_comment))
1502661×
        .route("/repos/{owner}/{name}/proposals/{number}/reviews", get(proposal_reviews).post(proposal_review))
1512661×
        .route("/repos/{owner}/{name}/proposals/{number}/reviewers", post(request_reviewers))
1522661×
        .route("/repos/{owner}/{name}/proposals/{number}/review-requests", post(request_assistant))
1532661×
        .route("/repos/{owner}/{name}/proposals/{number}/reviewers/{username}", axum::routing::delete(withdraw_reviewer))
1542661×
        .route("/repos/{owner}/{name}/proposals/{number}/checks", get(proposal_checks))
1552661×
        .route("/repos/{owner}/{name}/proposals/{number}/files", get(proposal_files))
1562661×
        .route("/repos/{owner}/{name}/proposals/{number}/content/{side}/{*path}", get(proposal_content))
1572661×
        .route("/repos/{owner}/{name}/issues", get(issues).post(create_issue))
1582661×
        .route("/repos/{owner}/{name}/issues/{number}", get(issue).post(issue_state).patch(issue_edit))
1592661×
        .route("/repos/{owner}/{name}/issues/{number}/comments", get(issue_comments).post(issue_comment))
1602661×
        .route("/repos/{owner}/{name}/labels", get(labels).post(create_label))
1612661×
        .route("/repos/{owner}/{name}/labels/{label}", axum::routing::delete(delete_label))
1622661×
        .route("/repos/{owner}/{name}/milestones", get(milestones).post(create_milestone))
1632661×
        .route(
1642661×
            "/repos/{owner}/{name}/coverage",
1652661×
            get(reports::coverage_list)
1662661×
                .post(reports::coverage_upload)
1672661×
                .layer(axum::extract::DefaultBodyLimit::max(crate::coverage::MAX_REPORT + (1 << 20))),
168
        )
1692661×
        .route("/repos/{owner}/{name}/coverage/{id}", get(reports::coverage_one))
1702661×
        .route("/repos/{owner}/{name}/tests", get(reports::tests_list))
1712661×
        .route("/repos/{owner}/{name}/tests/{id}", get(reports::tests_one))
1722661×
        .route("/repos/{owner}/{name}/milestones/{title}", axum::routing::patch(edit_milestone))
1732661×
        .route("/repos/{owner}/{name}/hooks", get(hooks).post(create_hook))
1742661×
        .route("/repos/{owner}/{name}/assistants", get(repo_assistants).post(repo_assistant_put))
1752661×
        .route("/repos/{owner}/{name}/assistants/prompt", get(repo_prompt).put(repo_prompt_put))
1762661×
        .route("/repos/{owner}/{name}/assistants/{assistant}", axum::routing::delete(repo_assistant_delete))
1772661×
        .route("/orgs/{org}/assistants", get(org_assistants).post(org_assistant_put))
1782661×
        .route("/orgs/{org}/assistants/prompt", get(org_prompt).put(org_prompt_put))
1792661×
        .route("/orgs/{org}/assistants/{assistant}", axum::routing::delete(org_assistant_delete))
1802661×
        .route("/admin/runner-updates", get(runner_updates))
1812661×
        .route("/admin/runner-updates/settings", axum::routing::put(runner_update_setting))
1822661×
        .route("/admin/runner-updates/holds/{version}/lift", post(runner_update_lift))
1832661×
        .route("/admin/assistants", get(site_assistants).post(site_assistant_put))
1842661×
        .route("/admin/assistants/prompt", get(site_prompt).put(site_prompt_put))
1852661×
        .route("/admin/assistants/{assistant}", axum::routing::delete(site_assistant_delete))
1862661×
        .route("/repos/{owner}/{name}/hooks/{id}/delete", post(delete_hook))
1872661×
        .route("/repos/{owner}/{name}/checks", post(post_check))
1882661×
        .route("/repos/{owner}/{name}/flow/runs", get(flow_runs).post(start_flow_run))
1892661×
        .route("/repos/{owner}/{name}/flow/runs/{number}", get(flow_run))
1902661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/log", get(flow_job_log))
1912661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/rerun", post(rerun_flow_run))
1922661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/rerun", post(rerun_flow_job))
1932661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/cancel", post(cancel_flow_run))
1942661×
        .route("/repos/{owner}/{name}/deployments", get(list_deployments))
1952661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approve", post(approve_flow_job))
1962661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/reject", post(reject_flow_job))
1972661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/approval", get(flow_job_statement))
1982661×
        .route("/repos/{owner}/{name}/flow/runs/{number}/jobs/{job}/seal", post(seal_flow_job))
1992661×
        .route("/repos/{owner}/{name}/checks/required", get(required_checks).put(set_required_checks))
2002661×
        .route("/repos/{owner}/{name}/checks/{state}", get(checks_for_state))
2012661×
        .route("/repos/{owner}/{name}/releases", get(releases).post(create_release))
2022661×
        .route("/repos/{owner}/{name}/releases/{tag}", axum::routing::patch(edit_release))
2032661×
        .route(
2042661×
            "/repos/{owner}/{name}/releases/{tag}/assets",
2052661×
            post(upload_asset).layer(axum::extract::DefaultBodyLimit::max(asset_limit + (1 << 20))),
206
        )
207
        // Last: it applies to the routes registered before it.
2082661×
        .method_not_allowed_fallback(wrong_method)
2092661×
}
210
2113×
async fn releases(
2123×
    State(app): State<Shared>,
2133×
    headers: HeaderMap,
2143×
    Path((owner, name)): Path<(String, String)>,
2153×
) -> Result<Json<Vec<Release>>, ApiError> {
2163×
    let c = caller(&app, &headers).await?;
2173×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2183×
    Ok(Json(crate::web::releases::api_views(&app, &repo, &row).await?))
2193×
}
220
2213×
async fn create_release(
2223×
    State(app): State<Shared>,
2233×
    headers: HeaderMap,
2243×
    Path((owner, name)): Path<(String, String)>,
2253×
    Json(body): Json<NewRelease>,
2263×
) -> Result<(StatusCode, Json<Release>), ApiError> {
2273×
    let c = caller(&app, &headers).await?;
2283×
    let me = c.require("repo:write")?.clone();
2293×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2303×
    crate::web::releases::create_release(&app, &repo, &row, &me, &body.tag, &body.title, body.notes, body.prerelease)
2313×
        .await
2323×
        .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
2332×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2342×
        .await?
2352×
        .into_iter()
2362×
        .find(|r| r.tag == body.tag)
2372×
        .ok_or_else(|| not_found("no such release"))?;
2382×
    Ok((StatusCode::CREATED, Json(r)))
2393×
}
240
241
/// `PATCH …/releases/{tag}` (oxygenhub#72): change a release's title,
242
/// notes or prerelease flag, as the release page's Edit does.
2432×
async fn edit_release(
2442×
    State(app): State<Shared>,
2452×
    headers: HeaderMap,
2462×
    Path((owner, name, tag)): Path<(String, String, String)>,
2472×
    Json(body): Json<ReleaseEdit>,
2482×
) -> Result<Json<Release>, ApiError> {
2492×
    let c = caller(&app, &headers).await?;
2502×
    let me = c.require("repo:write")?.clone();
2512×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2522×
    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;
2531×
    let title = body.title.as_deref().map(str::trim).filter(|t| !t.is_empty()).unwrap_or(&r.title);
2541×
    let notes = body.notes.as_deref().map(str::trim).unwrap_or(&r.notes);
2551×
    db::releases::edit(&app.db, r.id, title, notes, body.prerelease.unwrap_or(r.prerelease)).await?;
2561×
    db::accounts::audit(&app.db, Some(&me), "release.edited", &format!("{owner}/{name}@{tag}"), "").await.ok();
2571×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2581×
        .await?
2591×
        .into_iter()
2601×
        .find(|r| r.tag == tag)
2611×
        .ok_or_else(|| not_found("no such release"))?;
2621×
    Ok(Json(r))
2632×
}
264
265
#[derive(Deserialize)]
266
struct AssetQuery {
267
    name: String,
268
}
269
270
/// `POST …/releases/{tag}/assets?name=file.tar.gz` with the file as the body.
2713×
async fn upload_asset(
2723×
    State(app): State<Shared>,
2733×
    headers: HeaderMap,
2743×
    Path((owner, name, tag)): Path<(String, String, String)>,
2753×
    Query(q): Query<AssetQuery>,
2763×
    body: axum::body::Bytes,
2773×
) -> Result<(StatusCode, Json<Release>), ApiError> {
2783×
    let c = caller(&app, &headers).await?;
2793×
    c.require("repo:write")?;
2803×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
2813×
    let r = db::releases::get(&app.db, row.id, &tag).await?.ok_or_else(|| not_found("no such release"))?;
2823×
    let ct = headers.get(axum::http::header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or("application/octet-stream").to_string();
2833×
    crate::web::releases::store_asset(&app, r.id, &q.name, &ct, &body).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
2843×
    let r = crate::web::releases::api_views(&app, &repo, &row)
2853×
        .await?
2863×
        .into_iter()
2873×
        .find(|r| r.tag == tag)
2883×
        .ok_or_else(|| not_found("no such release"))?;
2893×
    Ok((StatusCode::CREATED, Json(r)))
2903×
}
291
292
pub struct ApiError(pub StatusCode, pub String);
293
294
impl IntoResponse for ApiError {
295166×
    fn into_response(self) -> Response {
296166×
        let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };
297166×
        (self.0, [("content-type", "application/problem+json")], Json(body)).into_response()
298166×
    }
299
}
300
301
impl From<RepoError> for ApiError {
3021×
    fn from(e: RepoError) -> ApiError {
3030×
        match e {
3041×
            RepoError::NotFound => not_found("no such repository"),
3050×
            RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => ApiError(StatusCode::NOT_FOUND, m),
3060×
            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),
307
        }
3081×
    }
309
}
310
311
impl From<sqlx::Error> for ApiError {
3120×
    fn from(e: sqlx::Error) -> ApiError {
3130×
        ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())
3140×
    }
315
}
316
31722×
pub(crate) fn not_found(what: &str) -> ApiError {
31822×
    ApiError(StatusCode::NOT_FOUND, what.into())
31922×
}
320
32180×
pub(crate) fn forbidden(what: &str) -> ApiError {
32280×
    ApiError(StatusCode::FORBIDDEN, what.into())
32380×
}
324
325
/// The address a request came from: the client's, as the proxy reports
326
/// it when the hub is behind one (`server.behind_proxy`), else the peer's.
327
/// Only an address's characters are kept, so it is safe to show.
3281117×
pub fn client_addr(app: &Shared, headers: &HeaderMap, extensions: &axum::http::Extensions) -> String {
3291117×
    let from_proxy = || {
33030×
        ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"]
33130×
            .iter()
33260×
            .find_map(|h| headers.get(*h).and_then(|v| v.to_str().ok()).and_then(|v| v.split(',').next()).map(|v| v.trim().to_string()))
33330×
    };
3341117×
    let addr = if app.config.server.behind_proxy {
33530×
        from_proxy()
336
    } else {
3371087×
        extensions.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>().map(|c| c.0.ip().to_string())
338
    };
3391117×
    addr.map(|a| a.chars().filter(|c| c.is_ascii_hexdigit() || matches!(c, '.' | ':')).take(45).collect()).unwrap_or_default()
3401117×
}
341
342
/// `DELETE /api/v1/user/token`: revoke the token this request is made
343
/// with, as `oxy auth logout` does.
3442×
async fn revoke_own_token(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
3452×
    let c = caller(&app, &headers).await?;
3462×
    let (Some(account), Some(id)) = (c.account.as_ref(), c.token_id) else {
3471×
        return Err(ApiError(StatusCode::UNAUTHORIZED, "revoking needs the personal access token to revoke".into()));
348
    };
3491×
    db::accounts::delete_token(&app.db, account.id, id).await?;
3501×
    db::accounts::audit(&app.db, Some(account), "token.revoke", &c.token, "").await.ok();
3511×
    Ok(StatusCode::NO_CONTENT)
3522×
}
353
354
/// Who calls: the account behind a bearer token, with the token's scopes.
355
pub struct Caller {
356
    pub account: Option<Account>,
357
    pub scopes: Vec<String>,
358
    pub site: bool,
359
    /// The token's name, for records of what a call did.
360
    pub token: String,
361
    /// The personal access token's id, when one is used.
362
    pub token_id: Option<i64>,
363
    /// The token is an agent's (oxygenhub#183): what it does says so.
364
    pub agent: bool,
365
}
366
367
impl Caller {
368314×
    fn has(&self, scope: &str) -> bool {
369314×
        self.site
370302×
            || self.scopes.iter().any(|s| {
371302×
                s == scope
372200×
                    || (scope == "repo:read" && (s == "repo:write" || s == "repo:admin"))
373195×
                    || (scope == "repo:write" && s == "repo:admin")
374302×
            })
375314×
    }
376
377324×
    fn require(&self, scope: &str) -> Result<&Account, ApiError> {
378
        // No token is 401, sign in; a token without the scope is 403 (#303).
379324×
        let Some(account) = self.account.as_ref() else {
38010×
            return Err(ApiError(StatusCode::UNAUTHORIZED, "a personal access token is required: sign in (`oh auth login`)".into()));
381
        };
382314×
        if !self.has(scope) {
38367×
            return Err(forbidden(&format!("this token lacks the {scope} scope")));
384247×
        }
385247×
        Ok(account)
386324×
    }
387
}
388
389434×
pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {
390434×
    let Some(t) = oxy_server::bearer_token(headers) else {
39191×
        return Ok(Caller { account: None, scopes: vec![], site: false, token: String::new(), token_id: None, agent: false });
392
    };
393343×
    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {
394150×
        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);
395150×
        return Ok(Caller {
396150×
            account: admin,
397150×
            scopes: vec!["repo:admin".into(), "user:read".into(), "checks:write".into()],
398150×
            site: true,
399150×
            token: "site token".into(),
400150×
            token_id: None,
401150×
            agent: false,
402150×
        });
403193×
    }
404
    // An agent's grant token (keyless agents, #241, #253): an agent's token
405
    // of its owner, reading, and writing when the grant lets its keys move
406
    // references, as it is for the protocol.
407193×
    if t.starts_with(crate::keyless::GRANT_TOKEN_PREFIX) {
4083×
        let grant = db::accounts::agent_grant_by_token(&app.db, &auth::token_hash(t)).await?.filter(|g| g.live(db::now_ms()));
4093×
        let Some(g) = grant else {
4100×
            return Err(ApiError(StatusCode::UNAUTHORIZED, "this agent grant is not valid (revoked, ended or unknown)".into()));
411
        };
4123×
        let account = db::accounts::account_by_id(&app.db, g.account_id).await?.filter(|a| !a.blocked());
4133×
        db::accounts::touch_agent_grant(&app.db, g.id).await.ok();
4143×
        let mut scopes = vec!["repo:read".to_string(), "user:read".to_string()];
4156×
        if g.scope.split(',').any(|s| s.trim() == "refs") {
4163×
            scopes.push("repo:write".into());
4173×
        }
4183×
        return Ok(Caller { account, scopes, site: false, token: g.agent.clone(), token_id: None, agent: true });
419190×
    }
420190×
    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;
421186×
    match token {
422186×
        Some(tok) if !tok.expired(db::now_ms()) => {
423186×
            let account = db::accounts::account_by_id(&app.db, tok.account_id).await?.filter(|a| !a.blocked());
424186×
            db::accounts::touch_token(&app.db, tok.id).await.ok();
425
            Ok(Caller {
426186×
                account,
427244×
                scopes: tok.scope_list().iter().map(|s| s.to_string()).collect(),
428
                site: false,
429186×
                token: tok.name.clone(),
430186×
                token_id: Some(tok.id),
431186×
                agent: tok.agent,
432
            })
433
        }
4344×
        _ => Err(ApiError(StatusCode::UNAUTHORIZED, "unknown or expired token".into())),
435
    }
436434×
}
437
43814×
fn repository(app: &Shared, r: &db::repos::RepoRow) -> Repository {
43914×
    Repository {
44014×
        owner: r.owner.clone(),
44114×
        name: r.name.clone(),
44214×
        description: r.description.clone(),
44314×
        default_bookmark: r.default_bookmark.clone(),
44414×
        visibility: r.visibility(),
44514×
        created_ms: r.created_ms,
44614×
        updated_ms: r.updated_ms,
44714×
        clone_url: format!("{}/{}/{}", app.config.base_url(), r.owner, r.name),
44814×
    }
44914×
}
450
451
/// A repository the caller may reach with `access`, else 404.
452254×
pub(super) async fn reach(
453254×
    app: &Shared,
454254×
    c: &Caller,
455254×
    owner: &str,
456254×
    name: &str,
457254×
    access: Access,
458254×
) -> Result<(RepoName, db::repos::RepoRow, Role), ApiError> {
459
    // A wiki (`NAME.wiki`) has no row of its own, so no proposals, issues
460
    // or runs (oxygenhub#128): say so to those who may read it, rather than
461
    // that it does not exist.
462254×
    if let Some(base) = name.strip_suffix(".wiki") {
4632×
        if let Some(row) = db::repos::get(&app.db, owner, base).await? {
4641×
            let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
4651×
            if auth::roles::allows(role, Access::Read) {
4661×
                return Err(not_found(&format!(
4671×
                    "{owner}/{name} is the wiki of {owner}/{base}: it is cloned and pushed with oxy, and takes no proposals, \
4681×
                     issues or runs; to publish a bookmark, merge it into main (oxy merge BOOKMARK on main) and push main"
4691×
                )));
4700×
            }
4711×
        }
472252×
    }
473253×
    let repo = RepoName::new(owner, name).ok_or_else(|| not_found("no such repository"))?;
474253×
    let row = db::repos::get(&app.db, owner, name).await?.ok_or_else(|| not_found("no such repository"))?;
475
    // A drop is reached through `/drops` only (#279).
476252×
    if row.is_drop() {
4771×
        return Err(not_found("no such repository"));
478251×
    }
479251×
    let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
480251×
    if !auth::roles::allows(role, access) {
4811×
        return Err(not_found("no such repository"));
482250×
    }
483250×
    Ok((repo, row, role.unwrap_or(Role::Read)))
484254×
}
485
4868×
fn summary(c: &view::ChangeView) -> ChangeSummary {
487
    ChangeSummary {
4888×
        hash: c.hash.clone(),
4898×
        message: if c.body.is_empty() { c.title.clone() } else { format!("{}\n\n{}", c.title, c.body) },
4908×
        author: Author {
4918×
            name: c.author.name.clone(),
4928×
            email: c.author.email.clone(),
4938×
            key: c.author.key.clone(),
4948×
            account: c.author.account.clone(),
4958×
            note: Author::note_for(&c.author.key, &c.author.account),
4968×
        },
4978×
        when_ms: c.when_ms,
4988×
        deps: c.deps.clone(),
4998×
        head: c.head,
5008×
        via: c.via.as_ref().map(|v| Via {
5012×
            name: v.name.clone(),
5022×
            key: v.key.clone(),
5032×
            scope: v.scope.clone(),
5042×
            expires_ms: v.expires_ms,
5052×
            revoked: v.revoked,
5062×
        }),
5078×
        signature: match &c.signature {
5084×
            view::SigView::Unsigned => Signature::Unsigned,
5094×
            view::SigView::Valid { key, sealed, revoked, .. } => Signature::Valid { key: key.clone(), sealed: *sealed, revoked: *revoked },
5100×
            view::SigView::Invalid(why) => Signature::Invalid { reason: why.clone() },
511
        },
512
    }
5138×
}
514
515
// ---------------------------------------------------------------- accounts
516
5176×
async fn me(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<User>, ApiError> {
5186×
    let c = caller(&app, &headers).await?;
5195×
    let a = c.require("user:read")?;
5203×
    Ok(Json(user_of(&app, a).await?))
5216×
}
522
523
#[derive(Deserialize)]
524
struct InboxQuery {
525
    #[serde(default)]
526
    limit: Option<i64>,
527
}
528
529
/// The caller's inbox; reading and clearing it needs `user:read`, since
530
/// it touches nothing but the caller's own notifications.
5317×
async fn notifications(
5327×
    State(app): State<Shared>,
5337×
    headers: HeaderMap,
5347×
    Query(q): Query<InboxQuery>,
5357×
) -> Result<Json<hub_api::Inbox>, ApiError> {
5367×
    let c = caller(&app, &headers).await?;
5377×
    let a = c.require("user:read")?;
5385×
    let limit = q.limit.unwrap_or(50).clamp(1, 200);
5395×
    let base = app.config.base_url().trim_end_matches('/').to_string();
5405×
    let rows = db::notify::inbox(&app.db, a.id, limit).await?;
541
    // Repositories by id, each looked up once (#305).
5425×
    let mut repos: std::collections::HashMap<i64, Option<String>> = std::collections::HashMap::new();
54310×
    for id in rows.iter().filter_map(|n| n.repo_id) {
54410×
        if let std::collections::hash_map::Entry::Vacant(e) = repos.entry(id) {
5455×
            e.insert(db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", r.owner, r.name)));
5465×
        }
547
    }
54830×
    let absolute = |u: String| if u.starts_with('/') { format!("{base}{u}") } else { u };
5495×
    let items = rows
5505×
        .into_iter()
5515×
        .map(|n| hub_api::Notification {
55215×
            id: n.id,
55315×
            at_ms: n.at_ms,
55415×
            label: crate::notify::label(&n.kind).map(String::from),
55515×
            kind: n.kind,
55615×
            title: n.title,
55715×
            url: absolute(n.url),
55815×
            actor: n.actor,
55915×
            read: n.read,
56015×
            repository: n.repo_id.and_then(|id| repos.get(&id).cloned().flatten()),
56115×
            reason: n.reason,
56215×
            thread: if n.thread.is_empty() { String::new() } else { absolute(n.thread) },
56315×
        })
5645×
        .collect();
5655×
    Ok(Json(hub_api::Inbox { unread: db::notify::unread(&app.db, a.id).await?, items }))
5667×
}
567
5681×
async fn notification_read(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<i64>) -> Result<StatusCode, ApiError> {
5691×
    let c = caller(&app, &headers).await?;
5701×
    let a = c.require("user:read")?;
5711×
    db::notify::mark_read(&app.db, a.id, Some(id)).await?;
5721×
    Ok(StatusCode::NO_CONTENT)
5731×
}
574
5751×
async fn notifications_read_all(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {
5761×
    let c = caller(&app, &headers).await?;
5771×
    let a = c.require("user:read")?;
5781×
    db::notify::mark_read(&app.db, a.id, None).await?;
5791×
    Ok(StatusCode::NO_CONTENT)
5801×
}
581
5824×
async fn user_of(app: &Shared, a: &Account) -> Result<User, ApiError> {
5834×
    let keys = db::accounts::identities_of(&app.db, a.id).await?.into_iter().map(|i| i.key).collect();
5844×
    Ok(User { username: a.username.clone(), display_name: a.display_name.clone(), is_admin: a.is_admin, keys, created_ms: a.created_ms })
5854×
}
586
5871×
async fn user(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<User>, ApiError> {
5881×
    let a = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such account"))?;
5891×
    Ok(Json(user_of(&app, &a).await?))
5901×
}
591
5920×
async fn org(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<Organisation>, ApiError> {
5930×
    let o = db::accounts::org_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such organisation"))?;
5940×
    let members = db::accounts::org_members(&app.db, o.id).await?.into_iter().map(|(a, _)| a.username).collect();
5950×
    Ok(Json(Organisation { name: o.name, display_name: o.display_name, description: o.description, members }))
5960×
}
597
598
#[derive(Deserialize)]
599
struct SearchQuery {
600
    q: String,
601
}
602
6031×
async fn search(
6041×
    State(app): State<Shared>,
6051×
    headers: HeaderMap,
6061×
    Query(q): Query<SearchQuery>,
6071×
) -> Result<Json<Vec<serde_json::Value>>, ApiError> {
6081×
    let c = caller(&app, &headers).await?;
6091×
    let mut out = Vec::new();
6101×
    for h in db::notify::search(&app.db, &q.q, None, 50).await? {
6111×
        let Some(row) = db::repos::get_by_id(&app.db, h.repo_id).await? else { continue };
6121×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
6131×
        if !auth::roles::allows(role, Access::Read) {
6140×
            continue;
6151×
        }
6161×
        out.push(
6171×
            serde_json::json!({ "kind": h.kind, "repository": row.slug(), "number": h.number, "title": h.title, "snippet": h.snippet }),
618
        );
619
    }
6201×
    Ok(Json(out))
6211×
}
622
623
// ------------------------------------------------------------ repositories
624
6253×
async fn list_repos(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Repository>>, ApiError> {
6263×
    let c = caller(&app, &headers).await?;
6273×
    let mut out = Vec::new();
6283×
    for r in db::repos::list(&app.db).await? {
6291×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &r).await?;
6301×
        if auth::roles::allows(role, Access::Read) {
6311×
            out.push(repository(&app, &r));
6321×
        }
633
    }
6343×
    Ok(Json(out))
6353×
}
636
637
#[derive(Deserialize)]
638
struct UserReposQuery {
639
    /// Which: `owner`, `organization`, `collaborator`, comma-separated (all three by default).
640
    #[serde(default)]
641
    affiliation: Option<String>,
642
    /// The last `owner/name` of the previous page.
643
    #[serde(default)]
644
    after: Option<String>,
645
    #[serde(default)]
646
    limit: Option<usize>,
647
}
648
649
/// `GET /user/repos` (#302): the caller's repositories, their
650
/// organisations' and those they collaborate on, by `owner/name`, a page
651
/// at a time (`?after=owner/name&limit=`, at most 100, default 50).
652
/// `POST /user/runner-token` (repo:write): a one-time registration token
653
/// for a runner that serves the caller's own repositories and no one
654
/// else's, as a phone registers itself (oxygenhub-android#8). Like the
655
/// settings pages' tokens it lasts a day.
6563×
async fn user_runner_token(State(app): State<Shared>, headers: HeaderMap) -> Result<(StatusCode, Json<RunnerToken>), ApiError> {
6573×
    let c = caller(&app, &headers).await?;
6583×
    let me = c.require("repo:write")?.clone();
6591×
    let token = format!("flowreg_{}", crate::auth::random_hex(24));
6601×
    let scope = db::runners::Scope { owner: me.username.clone(), repo_id: None };
6611×
    db::runners::add_registration(&app.db, &blake3::hash(token.as_bytes()).to_hex(), &me.username, &scope).await?;
6621×
    db::accounts::audit(&app.db, Some(&me), "flow.runner.token", &me.username, "registration token for the caller's repositories (API)")
6631×
        .await
6641×
        .ok();
6651×
    Ok((StatusCode::CREATED, Json(RunnerToken { token, owner: me.username })))
6663×
}
667
668
/// `GET /user/proposals` (repo:read): what the dashboard lists, for apps;
669
/// with `?landable=true`, also what the caller can land now (#311).
6706×
async fn user_proposals(
6716×
    State(app): State<Shared>,
6726×
    headers: HeaderMap,
6736×
    Query(q): Query<UserProposalsQuery>,
6746×
) -> Result<Json<UserProposals>, ApiError> {
6756×
    let c = caller(&app, &headers).await?;
6766×
    let me = c.require("repo:read")?.clone();
677
    // As the dashboard: reviews in repositories the caller belongs to, its
678
    // own proposals in any it can still see.
6795×
    let member = db::accounts::visible_repo_ids(&app.db, me.id).await?;
6805×
    let seen: Vec<i64> = db::repos::list(&app.db)
6815×
        .await?
6825×
        .into_iter()
6837×
        .filter(|r| me.is_admin || r.visibility() != Visibility::Private || member.contains(&r.id))
6845×
        .map(|r| r.id)
6855×
        .collect();
6865×
    let base = app.config.base_url().trim_end_matches('/').to_string();
6875×
    let brief = |p: db::activity::ProposalLine| ProposalBrief {
6885×
        url: format!("{base}/{}/{}/proposal/{}", p.owner, p.name, p.number),
6895×
        repository: format!("{}/{}", p.owner, p.name),
6905×
        number: p.number,
6915×
        title: p.title,
6925×
        author: p.author,
6935×
        state: match p.state.as_str() {
6945×
            "draft" => ProposalState::Draft,
6955×
            "landed" => ProposalState::Landed,
6965×
            "closed" => ProposalState::Closed,
6975×
            _ => ProposalState::Open,
698
        },
6995×
        conflicted: p.conflicted,
7005×
        updated_ms: p.updated_ms,
7015×
    };
7025×
    let landable = if q.landable { landable_for(&app, &c, &member, &base).await? } else { Vec::new() };
703
    Ok(Json(UserProposals {
7045×
        review: db::activity::awaiting_review(&app.db, me.id, &member).await?.into_iter().map(brief).collect(),
7055×
        authored: db::activity::authored(&app.db, me.id, &seen).await?.into_iter().map(brief).collect(),
7065×
        landable,
707
    }))
7086×
}
709
710
/// The open proposals the caller could land now (#311): in repositories
711
/// it belongs to and can write to, whose verdict has no blockers. Each
712
/// projected state is worked out four at a time, as `proposals` does
713
/// (#171); one that cannot be is left out rather than failing the list.
7142×
async fn landable_for(app: &Shared, c: &Caller, member: &[i64], base: &str) -> Result<Vec<ProposalBrief>, ApiError> {
715
    use futures::StreamExt;
7162×
    let mut todo = Vec::new();
7172×
    for row in db::repos::list(&app.db).await?.into_iter().filter(|r| member.contains(&r.id) && !r.is_drop()) {
7182×
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
7192×
        if !auth::roles::allows(role, Access::Write) {
7200×
            continue;
7212×
        }
7222×
        let Some(repo) = RepoName::new(&row.owner, &row.name) else { continue };
7232×
        for p in db::proposals::list(&app.db, row.id, &["open"]).await? {
7242×
            todo.push((repo.clone(), row.clone(), p));
7252×
        }
726
    }
7272×
    let found: Vec<Option<ProposalBrief>> = futures::stream::iter(todo)
7282×
        .map(|(repo, row, p)| {
7292×
            let (app, base) = (app.clone(), base.to_string());
7302×
            async move {
7312×
                let (number, title, author, updated_ms) = (p.number, p.title.clone(), p.author.clone(), p.updated_ms);
7322×
                let loaded = crate::web::proposals::load_summary(&app, &repo, p).await.ok()?;
7332×
                let v = crate::web::proposals::verdict(&app, &loaded, row.id).await.ok()?;
7342×
                v.blockers.is_empty().then(|| ProposalBrief {
7351×
                    url: format!("{base}/{}/{}/proposal/{number}", row.owner, row.name),
7361×
                    repository: format!("{}/{}", row.owner, row.name),
7371×
                    number,
7381×
                    title,
7391×
                    author,
7401×
                    state: ProposalState::Open,
7411×
                    conflicted: loaded.conflicted,
7421×
                    updated_ms,
7431×
                })
7442×
            }
7452×
        })
7462×
        .buffered(4)
7472×
        .collect()
7482×
        .await;
7492×
    Ok(found.into_iter().flatten().collect())
7502×
}
751
7526×
async fn user_repos(
7536×
    State(app): State<Shared>,
7546×
    headers: HeaderMap,
7556×
    Query(q): Query<UserReposQuery>,
7566×
) -> Result<Json<Vec<Repository>>, ApiError> {
7576×
    let c = caller(&app, &headers).await?;
7586×
    let me = c.require("repo:read")?.clone();
7595×
    let wanted: Vec<String> = q
7605×
        .affiliation
7615×
        .as_deref()
7625×
        .unwrap_or("owner,organization,collaborator")
7635×
        .split(',')
76413×
        .map(|s| s.trim().to_ascii_lowercase())
76513×
        .filter(|s| !s.is_empty())
7665×
        .collect();
76713×
    if let Some(bad) = wanted.iter().find(|w| !["owner", "organization", "collaborator"].contains(&w.as_str())) {
7681×
        return Err(ApiError(StatusCode::BAD_REQUEST, format!("unknown affiliation {bad:?}: owner, organization or collaborator")));
7694×
    }
7704×
    let orgs: Vec<String> = db::accounts::orgs_of(&app.db, me.id).await?.into_iter().map(|(o, _)| o.name).collect();
7714×
    let limit = q.limit.unwrap_or(50).clamp(1, 100);
7724×
    let mut rows = db::repos::list(&app.db).await?;
7734×
    rows.sort_by(|a, b| (&a.owner, &a.name).cmp(&(&b.owner, &b.name)));
7744×
    let mut out = Vec::new();
7757×
    for r in rows {
7767×
        if let Some(after) = q.after.as_deref() {
7772×
            if format!("{}/{}", r.owner, r.name).as_str() <= after {
7781×
                continue;
7791×
            }
7805×
        }
7816×
        let mine = (wanted.iter().any(|w| w == "owner") && r.owner == me.username)
7824×
            || (wanted.iter().any(|w| w == "organization") && orgs.contains(&r.owner))
7836×
            || (wanted.iter().any(|w| w == "collaborator") && db::accounts::collaborator_role(&app.db, r.id, me.id).await?.is_some());
7846×
        if !mine || !auth::roles::allows(auth::roles::role_for(&app.db, Some(&me), &r).await?, Access::Read) {
7852×
            continue;
7864×
        }
7874×
        out.push(repository(&app, &r));
7884×
        if out.len() == limit {
7891×
            break;
7903×
        }
791
    }
7924×
    Ok(Json(out))
7936×
}
794
795
/// `GET /user/orgs` (#302): the organisations the caller belongs to.
7962×
async fn user_orgs(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::UserOrg>>, ApiError> {
7972×
    let c = caller(&app, &headers).await?;
7982×
    let me = c.require("user:read")?;
7991×
    let orgs = db::accounts::orgs_of(&app.db, me.id).await?;
8001×
    Ok(Json(orgs.into_iter().map(|(o, role)| hub_api::UserOrg { name: o.name, display_name: o.display_name, role }).collect()))
8012×
}
802
8039×
async fn create_repo(
8049×
    State(app): State<Shared>,
8059×
    headers: HeaderMap,
8069×
    Json(body): Json<NewRepository>,
8079×
) -> Result<(StatusCode, Json<Repository>), ApiError> {
8089×
    let c = caller(&app, &headers).await?;
8099×
    let me = c.require("repo:admin")?;
8108×
    let name = RepoName::new(&body.owner, &body.name).ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "invalid owner or name".into()))?;
8118×
    if name.name.ends_with(crate::wiki::SUFFIX) {
8120×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a name cannot end in .wiki: that is the address of a repository's wiki".into()));
8138×
    }
8148×
    if !auth::roles::may_create_under(&app.db, me, &name.owner).await? {
8150×
        return Err(forbidden("you cannot create repositories under that owner"));
8168×
    }
8178×
    if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() || app.repos.exists(&name) {
8181×
        return Err(ApiError(StatusCode::CONFLICT, "that repository exists".into()));
8197×
    }
8207×
    app.repos.create(&name, None)?;
8217×
    let row = db::repos::create(&app.db, &name.owner, &name.name, &body.description, body.visibility).await?;
8227×
    db::accounts::audit(&app.db, Some(me), "repo.created", &name.to_string(), "api").await.ok();
8237×
    Ok((StatusCode::CREATED, Json(repository(&app, &row))))
8249×
}
825
8263×
async fn get_repo(
8273×
    State(app): State<Shared>,
8283×
    headers: HeaderMap,
8293×
    Path((owner, name)): Path<(String, String)>,
8303×
) -> Result<Json<Repository>, ApiError> {
8313×
    let c = caller(&app, &headers).await?;
8323×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
8332×
    Ok(Json(repository(&app, &row)))
8343×
}
835
8363×
async fn bookmarks(
8373×
    State(app): State<Shared>,
8383×
    headers: HeaderMap,
8393×
    Path((owner, name)): Path<(String, String)>,
8403×
) -> Result<Json<Vec<Bookmark>>, ApiError> {
8413×
    let c = caller(&app, &headers).await?;
8423×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
8433×
    let default = row.default_bookmark.clone();
8443×
    let list = app.repos.read(&repo, move |r, cache| view::bookmarks(r, cache, &default)).await?;
8456×
    Ok(Json(list.into_iter().map(|b| Bookmark { name: b.name, heads: b.heads, changes: b.changes, default: b.default }).collect()))
8463×
}
847
848
#[derive(serde::Deserialize)]
849
struct BackupSetting {
850
    /// `owner` (with its owner's), `hourly`, `daily` or `off`.
851
    backup: String,
852
}
853
854
/// `PUT /repos/{owner}/{name}/backup {"backup": ...}`: this repository's
855
/// backup (docs/backups.md §5). Owners and admins.
8560×
async fn set_backup(
8570×
    State(app): State<Shared>,
8580×
    headers: HeaderMap,
8590×
    Path((owner, name)): Path<(String, String)>,
8600×
    Json(b): Json<BackupSetting>,
8610×
) -> Result<Json<serde_json::Value>, ApiError> {
8620×
    let c = caller(&app, &headers).await?;
8630×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
8640×
    let setting = match b.backup.as_str() {
8650×
        "owner" => "",
8660×
        "hourly" | "daily" | "off" => b.backup.as_str(),
8670×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "backup is owner, hourly, daily or off".into())),
868
    };
8690×
    db::repos::set_backup(&app.db, row.id, setting).await?;
8700×
    db::accounts::audit(&app.db, c.account.as_ref(), "repo.backup", &format!("{owner}/{name}"), &b.backup).await.ok();
8710×
    Ok(Json(serde_json::json!({ "backup": b.backup })))
8720×
}
873
874
#[derive(serde::Deserialize)]
875
struct DiffusionSetting {
876
    /// `off`, `green`, `any`, or `default` (the site's).
877
    follow: String,
878
    /// `auto` or `propose`; absent keeps it as it is.
879
    #[serde(default)]
880
    land: Option<String>,
881
}
882
883
/// `PUT /repos/{owner}/{name}/diffusion {"follow": ...}`: whether this
884
/// repository follows the upstreams it pins (#148). Owners and admins.
88510×
async fn set_diffusion(
88610×
    State(app): State<Shared>,
88710×
    headers: HeaderMap,
88810×
    Path((owner, name)): Path<(String, String)>,
88910×
    Json(d): Json<DiffusionSetting>,
89010×
) -> Result<Json<serde_json::Value>, ApiError> {
89110×
    let c = caller(&app, &headers).await?;
89210×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
8939×
    let setting = match d.follow.as_str() {
8949×
        "off" | "green" | "any" => d.follow.as_str(),
8952×
        "default" => "",
8961×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "follow is off, green, any or default".into())),
897
    };
8988×
    let land = match d.land.as_deref() {
8992×
        Some(l @ ("auto" | "propose")) => Some(l),
9006×
        None => None,
9011×
        Some(_) => return Err(ApiError(StatusCode::BAD_REQUEST, "land is auto or propose".into())),
902
    };
9037×
    db::repos::set_diffusion(&app.db, row.id, setting).await?;
9047×
    if let Some(l) = land {
9051×
        db::repos::set_diffusion_land(&app.db, row.id, l).await?;
9066×
    }
9077×
    db::accounts::audit(
9087×
        &app.db,
9097×
        c.account.as_ref(),
9107×
        "repo.diffusion",
9117×
        &format!("{owner}/{name}"),
9127×
        if setting.is_empty() { "default" } else { setting },
913
    )
9147×
    .await
9157×
    .ok();
9167×
    let row = db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row);
9177×
    let rule = crate::diffusion::rule(&app.config.diffusion.follow, &row, None, "");
918
    // Turned on: bumped at once to where its upstreams are (#148).
9197×
    if rule.follow != crate::diffusion::Follow::Off {
9206×
        let (app, row) = (app.clone(), row.clone());
9216×
        tokio::spawn(async move { crate::diffusion::catch_up(&app, &row).await });
9221×
    }
9237×
    if land == Some("auto") {
9241×
        let (app, row) = (app.clone(), row.clone());
9251×
        tokio::spawn(async move { crate::diffusion::land_ready(&app, &row).await });
9266×
    }
927
    Ok(Json(
9287×
        serde_json::json!({ "follow": rule.follow, "from": rule.from, "land": if row.diffusion_land == "auto" { "auto" } else { "propose" } }),
929
    ))
93010×
}
931
932
/// `GET /repos/{owner}/{name}/consumers`: the repositories that pin this
933
/// one as a subrepo and that the caller may read, each with its pin and
934
/// how far behind this repository's default bookmark it is (#148).
9357×
async fn consumers(
9367×
    State(app): State<Shared>,
9377×
    headers: HeaderMap,
9387×
    Path((owner, name)): Path<(String, String)>,
9397×
) -> Result<Json<Vec<crate::diffusion::Consumer>>, ApiError> {
9407×
    let c = caller(&app, &headers).await?;
9417×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9427×
    Ok(Json(crate::diffusion::consumers(&app, &row, c.account.as_ref()).await?))
9437×
}
944
945
/// `GET /repos/{owner}/{name}/diffusion`: what this repository takes from
946
/// and what it diffuses to, as its Diffusion tab shows them (#153).
9472×
async fn diffusion(
9482×
    State(app): State<Shared>,
9492×
    headers: HeaderMap,
9502×
    Path((owner, name)): Path<(String, String)>,
9512×
) -> Result<Json<hub_api::Diffusion>, ApiError> {
9522×
    let c = caller(&app, &headers).await?;
9532×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9542×
    let slug = format!("{owner}/{name}");
9552×
    let takes_from = crate::diffusion::follows(&app, &row, c.account.as_ref())
9562×
        .await
9572×
        .iter()
9582×
        .map(|(up, p)| p.api(&format!("{}/{}", up.owner, up.name)))
9592×
        .collect();
9602×
    let diffuses_to = crate::diffusion::consumers(&app, &row, c.account.as_ref()).await?.iter().map(|p| p.api(&slug)).collect();
9612×
    Ok(Json(hub_api::Diffusion { takes_from, diffuses_to }))
9622×
}
963
9640×
async fn tags(
9650×
    State(app): State<Shared>,
9660×
    headers: HeaderMap,
9670×
    Path((owner, name)): Path<(String, String)>,
9680×
) -> Result<Json<Vec<Tag>>, ApiError> {
9690×
    let c = caller(&app, &headers).await?;
9700×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
9710×
    let list = app.repos.read(&repo, |r, _| view::tags(r)).await?;
9720×
    Ok(Json(list.into_iter().map(|t| Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer }).collect()))
9730×
}
974
975
/// `POST …/tags` (#295): what the Tags page's Create does.
9760×
async fn create_tag(
9770×
    State(app): State<Shared>,
9780×
    headers: HeaderMap,
9790×
    Path((owner, name)): Path<(String, String)>,
9800×
    Json(body): Json<NewTag>,
9810×
) -> Result<(StatusCode, Json<Tag>), ApiError> {
9820×
    let c = caller(&app, &headers).await?;
9830×
    let me = c.require("repo:write")?.clone();
9840×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
9850×
    let made = crate::tags::create(
9860×
        &app,
9870×
        &row,
9880×
        &repo,
9890×
        &me,
9900×
        &body.name,
9910×
        body.target.as_deref().unwrap_or(""),
9920×
        body.message.as_deref().unwrap_or(""),
9930×
    )
9940×
    .await
9950×
    .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
9960×
    let t = app
9970×
        .repos
9980×
        .read(&repo, |r, _| view::tags(r))
9990×
        .await?
10000×
        .into_iter()
10010×
        .find(|t| t.name == made.name)
10020×
        .ok_or_else(|| not_found("no such tag"))?;
10030×
    Ok((StatusCode::CREATED, Json(Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer })))
10040×
}
1005
1006
#[derive(Deserialize)]
1007
struct WithdrawQuery {
1008
    #[serde(default)]
1009
    reason: String,
1010
}
1011
1012
/// `DELETE …/tags/{tag}?reason=…` (#301): what the Tags page's Withdraw
1013
/// does. Maintainers; refused (409) while a release uses the tag.
10140×
async fn withdraw_tag(
10150×
    State(app): State<Shared>,
10160×
    headers: HeaderMap,
10170×
    Path((owner, name, tag)): Path<(String, String, String)>,
10180×
    Query(q): Query<WithdrawQuery>,
10190×
) -> Result<StatusCode, ApiError> {
10200×
    let c = caller(&app, &headers).await?;
10210×
    let me = c.require("repo:write")?.clone();
10220×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Maintain).await?;
10230×
    if db::releases::get(&app.db, row.id, &tag).await?.is_some() {
10240×
        return Err(ApiError(StatusCode::CONFLICT, format!("a release uses {tag}: delete the release first")));
10250×
    }
10260×
    crate::tags::withdraw(&app, &row, &repo, &me, &tag, &q.reason).await.map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;
10270×
    Ok(StatusCode::NO_CONTENT)
10280×
}
1029
1030
#[derive(Deserialize)]
1031
struct HistoryQuery {
1032
    path: Option<String>,
1033
    offset: Option<usize>,
1034
    limit: Option<usize>,
1035
    /// A revset (Oxygen's docs/revset_query_language.md) in place of the
1036
    /// reference's whole history; the reference still gives the labels.
1037
    r: Option<String>,
1038
}
1039
10406×
async fn history(
10416×
    State(app): State<Shared>,
10426×
    headers: HeaderMap,
10436×
    Path((owner, name, r)): Path<(String, String, String)>,
10446×
    Query(q): Query<HistoryQuery>,
10456×
) -> Result<Json<History>, ApiError> {
10466×
    let c = caller(&app, &headers).await?;
10476×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
10486×
    let (offset, limit) = (q.offset.unwrap_or(0), q.limit.unwrap_or(50).min(500));
10496×
    let revset = q.r.clone().filter(|s| !s.trim().is_empty());
10506×
    let by_revset = revset.is_some();
10516×
    let h = app
10526×
        .repos
10536×
        .read(&repo, move |repo, cache| {
10546×
            let target = view::resolve(repo, cache, &r)?;
10556×
            match &revset {
10564×
                Some(rs) => view::history_revset(repo, cache, target, rs, offset, limit),
10572×
                None => view::history(repo, cache, target, q.path.as_deref(), offset, limit),
1058
            }
10596×
        })
10606×
        .await
10616×
        .map_err(|e| {
1062
            // A revset that does not parse, names nothing, or goes past the
1063
            // budget is the caller's to fix.
10642×
            if by_revset {
10652×
                ApiError(StatusCode::BAD_REQUEST, e.to_string())
1066
            } else {
10670×
                e.into()
1068
            }
10692×
        })?;
10704×
    let mut entries = h.entries;
10714×
    crate::web::attribute(&app, &mut entries.iter_mut().collect::<Vec<_>>()).await;
1072
    Ok(Json(History {
10734×
        reference: h.target.label,
10745×
        heads: h.target.heads.iter().map(|x| x.to_hex()).collect(),
10754×
        total: h.total,
10764×
        offset: h.offset,
10774×
        changes: entries.iter().map(summary).collect(),
1078
    }))
10796×
}
1080
10813×
async fn change(
10823×
    State(app): State<Shared>,
10833×
    headers: HeaderMap,
10843×
    Path((owner, name, hash)): Path<(String, String, String)>,
10853×
) -> Result<Json<ChangeDetail>, ApiError> {
10863×
    let c = caller(&app, &headers).await?;
10873×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
10883×
    let d = app
10893×
        .repos
10903×
        .read(&repo, move |repo, cache| {
10913×
            let h = view::resolve_change(repo, cache, &hash)?;
10923×
            view::change(repo, cache, &h)
10933×
        })
10943×
        .await?;
10953×
    let mut v = d.view;
10963×
    crate::web::attribute(&app, &mut [&mut v]).await;
10973×
    let files = crate::web::history::render_files(&d.files, &d.bases).into_iter().map(file_change).collect();
1098
    Ok(Json(ChangeDetail {
10993×
        body: v.body.clone(),
11003×
        change: summary(&v),
11013×
        dependents: d.dependents.iter().map(|x| x.hash.clone()).collect(),
11023×
        in_bookmarks: d.in_bookmarks,
11033×
        in_tags: d.in_tags,
11043×
        files,
1105
    }))
11063×
}
1107
11084×
fn file_change(f: crate::web::history::FileRows) -> FileChange {
1109
    use crate::render::diff::Kind;
11104×
    let truncated = f.lines.len() > hub_api::DIFF_LINES;
11114×
    let lines = f
11124×
        .lines
11134×
        .into_iter()
11144×
        .take(hub_api::DIFF_LINES)
11154×
        .map(|l| DiffLine {
11164×
            kind: match l.kind {
11170×
                Kind::Context => "context",
11182×
                Kind::Add => "add",
11190×
                Kind::Del => "del",
11202×
                Kind::Gap => "gap",
1121
            }
11224×
            .into(),
11234×
            old: l.old_no,
11244×
            new: l.new_no,
11254×
            text: l.text,
11264×
        })
11274×
        .collect();
11284×
    FileChange { path: f.path, kind: f.kind, from: f.from, added: f.added, removed: f.removed, lines, truncated }
11294×
}
1130
11311×
fn entry(e: &view::Entry) -> TreeEntry {
1132
    TreeEntry {
11331×
        name: e.name.clone(),
11341×
        path: e.path.clone(),
11351×
        kind: match e.kind {
11360×
            view::EntryKind::Dir => "dir",
11371×
            view::EntryKind::File => "file",
11380×
            view::EntryKind::Symlink => "symlink",
11390×
            view::EntryKind::Subrepo => "subrepo",
1140
        }
11411×
        .into(),
11421×
        exec: e.exec,
11431×
        size: e.size,
11441×
        conflicted: e.conflicted,
1145
    }
11461×
}
1147
11481×
async fn tree_root(
11491×
    State(app): State<Shared>,
11501×
    headers: HeaderMap,
11511×
    Path((owner, name, r)): Path<(String, String, String)>,
11521×
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
11531×
    tree(State(app), headers, Path((owner, name, r, String::new()))).await
11541×
}
1155
11561×
async fn tree(
11571×
    State(app): State<Shared>,
11581×
    headers: HeaderMap,
11591×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11601×
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
11611×
    let c = caller(&app, &headers).await?;
11621×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11631×
    let t = app
11641×
        .repos
11651×
        .read(&repo, move |repo, cache| {
11661×
            let target = view::resolve(repo, cache, &r)?;
11671×
            view::tree(repo, cache, target, &path)
11681×
        })
11691×
        .await?;
11701×
    Ok(Json(t.entries.iter().map(entry).collect()))
11711×
}
1172
11731×
async fn file(
11741×
    State(app): State<Shared>,
11751×
    headers: HeaderMap,
11761×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11771×
) -> Result<Response, ApiError> {
11781×
    let c = caller(&app, &headers).await?;
11791×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11801×
    let limit = app.config.limits.render_limit.0;
11811×
    let f = app
11821×
        .repos
11831×
        .read(&repo, move |repo, cache| {
11841×
            let target = view::resolve(repo, cache, &r)?;
11851×
            view::file(repo, cache, target, &path, limit)
11861×
        })
11871×
        .await?;
11881×
    Ok(crate::web::raw(f.bytes, &f.name, false))
11891×
}
1190
11911×
async fn blame(
11921×
    State(app): State<Shared>,
11931×
    headers: HeaderMap,
11941×
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
11951×
) -> Result<Json<Vec<BlameLine>>, ApiError> {
11961×
    let c = caller(&app, &headers).await?;
11971×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
11981×
    let limit = app.config.limits.render_limit.0;
11991×
    let b = app
12001×
        .repos
12011×
        .read(&repo, move |repo, cache| {
12021×
            let target = view::resolve(repo, cache, &r)?;
12031×
            view::blame(repo, cache, target, &path, limit)
12041×
        })
12051×
        .await?;
1206
    Ok(Json(
12071×
        b.lines
12081×
            .into_iter()
12091×
            .map(|l| BlameLine {
12101×
                line: l.line,
12111×
                change: l.hash.to_hex(),
12121×
                index: l.index,
12131×
                author: l.author,
12141×
                when_ms: l.when_ms,
12151×
                text: String::from_utf8_lossy(&l.text).into_owned(),
12161×
            })
12171×
            .collect(),
1218
    ))
12191×
}
1220
12210×
async fn conflicts(
12220×
    State(app): State<Shared>,
12230×
    headers: HeaderMap,
12240×
    Path((owner, name)): Path<(String, String)>,
12250×
) -> Result<Json<Vec<Conflict>>, ApiError> {
12260×
    let c = caller(&app, &headers).await?;
12270×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12280×
    let list = app.repos.read(&repo, view::conflicts).await?;
1229
    Ok(Json(
12300×
        list.into_iter()
12310×
            .map(|c| Conflict {
12320×
                bookmark: c.bookmark,
12330×
                path: c.path,
12340×
                kind: c.kind,
12350×
                contributors: c.contributors.iter().map(|x| x.hash.clone()).collect(),
12360×
            })
12370×
            .collect(),
1238
    ))
12390×
}
1240
1241
/// `GET /repos/{o}/{n}/releases/trust/{tag}`: a release's trust report
1242
/// (hub spec §9.1), as the page's JSON export.
12433×
async fn release_trust(
12443×
    State(app): State<Shared>,
12453×
    headers: HeaderMap,
12463×
    Path((owner, name, tag)): Path<(String, String, String)>,
12473×
) -> Result<Json<crate::web::release_trust::ReleaseTrust>, ApiError> {
12483×
    let c = caller(&app, &headers).await?;
12493×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12503×
    match crate::web::release_trust::report(&app, &repo, &row, &tag).await.map_err(|m| ApiError(StatusCode::INTERNAL_SERVER_ERROR, m))? {
12512×
        Some(t) => Ok(Json(t)),
12521×
        None => Err(ApiError(StatusCode::NOT_FOUND, format!("no release {tag}"))),
1253
    }
12543×
}
1255
12561×
async fn trust(
12571×
    State(app): State<Shared>,
12581×
    headers: HeaderMap,
12591×
    Path((owner, name)): Path<(String, String)>,
12601×
) -> Result<Json<Trust>, ApiError> {
12611×
    let c = caller(&app, &headers).await?;
12621×
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12631×
    let key = app.hub_key.key;
12641×
    let t = app.repos.read(&repo, move |r, cache| view::trust(r, cache, &key)).await?;
1265
    Ok(Json(Trust {
12661×
        policy: t.policy.map(|p| Policy {
12670×
            serial: p.serial,
12680×
            expires_ms: p.expires_ms,
12690×
            roots: p.roots.iter().map(|k| k.key.clone()).collect(),
12700×
            root_threshold: p.root_threshold,
12710×
            rules: p
12720×
                .rules
12730×
                .iter()
12740×
                .map(|r| Rule {
12750×
                    pattern: r.pattern.clone(),
12760×
                    keys: r.keys.iter().map(|k| k.key.clone()).collect(),
12770×
                    threshold: r.threshold,
12780×
                    require: r.require.clone(),
12790×
                    allow_conflicts: r.allow_conflicts,
12800×
                })
12810×
                .collect(),
12820×
        }),
12831×
        signed: t.verification.signed,
12841×
        sealed: t.verification.sealed,
12851×
        unsigned: t.verification.unsigned,
12861×
        invalid: t.verification.invalid.iter().map(|(h, _)| h.clone()).collect(),
12871×
        hub_key: t.hub_key,
1288
    }))
12891×
}
1290
12911×
async fn pushes(
12921×
    State(app): State<Shared>,
12931×
    headers: HeaderMap,
12941×
    Path((owner, name)): Path<(String, String)>,
12951×
) -> Result<Json<Vec<Push>>, ApiError> {
12961×
    let c = caller(&app, &headers).await?;
12971×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
12981×
    let rows = db::repos::pushes(&app.db, row.id, 200).await?;
1299
    Ok(Json(
13001×
        rows.into_iter()
13011×
            .map(|p| Push {
13021×
                at_ms: p.at_ms,
13031×
                pusher: p.pusher,
13041×
                reference: p.reference,
13051×
                ok: p.ok,
13061×
                reason: p.reason,
13071×
                old_state: p.old_state,
13081×
                new_state: p.new_state,
13091×
                heads: p.heads,
13101×
                changes: p.changes,
13111×
            })
13121×
            .collect(),
1313
    ))
13141×
}
1315
1316
// --------------------------------------------------------------- proposals
1317
1318
/// `GET /repos/{o}/{n}/proposals?state=open|draft|landed|closed|all`:
1319
/// open ones (drafts too) by default.
13204×
async fn proposals(
13214×
    State(app): State<Shared>,
13224×
    headers: HeaderMap,
13234×
    Path((owner, name)): Path<(String, String)>,
13244×
    Query(q): Query<IssuesQuery>,
13254×
) -> Result<Json<Vec<Proposal>>, ApiError> {
13264×
    let c = caller(&app, &headers).await?;
13274×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
13283×
    let states: &[&str] = match q.state.as_deref().unwrap_or("open") {
13293×
        "open" => &["open", "draft"],
13302×
        "draft" => &["draft"],
13312×
        "landed" => &["landed"],
13321×
        "closed" => &["closed"],
13331×
        "all" => &["open", "draft", "landed", "closed"],
13340×
        other => return Err(ApiError(StatusCode::BAD_REQUEST, format!("state is open, draft, landed, closed or all, not {other:?}"))),
1335
    };
1336
    // Each proposal's projected state is worked out from the store, which
1337
    // for a bucket-backed repository is many slow round trips: four at a
1338
    // time, in order, each under the repository's read lock only. One at
1339
    // a time took 28 s for a repository on GCS (oxygenhub#171).
1340
    use futures::StreamExt;
13413×
    let rows = db::proposals::list(&app.db, row.id, states).await?;
13423×
    let out: Vec<Result<Proposal, ApiError>> = futures::stream::iter(rows)
13433×
        .map(|p| {
13442×
            let (app, repo, owner, name, id) = (app.clone(), repo.clone(), owner.clone(), name.clone(), row.id);
13452×
            async move {
13462×
                let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
13472×
                let v = crate::web::proposals::verdict(&app, &loaded, id).await?;
13482×
                Ok(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await)
13492×
            }
13502×
        })
13513×
        .buffered(4)
13523×
        .collect()
13533×
        .await;
13543×
    Ok(Json(out.into_iter().collect::<Result<Vec<_>, _>>()?))
13554×
}
1356
135715×
async fn proposal(
135815×
    State(app): State<Shared>,
135915×
    headers: HeaderMap,
136015×
    Path((owner, name, number)): Path<(String, String, i64)>,
136115×
) -> Result<Json<Proposal>, ApiError> {
136215×
    let c = caller(&app, &headers).await?;
136315×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
136415×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
136515×
    let source_url = match p.source_repo_id {
13660×
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", app.config.base_url(), r.slug())),
136715×
        None => None,
1368
    };
136915×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
137015×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
137115×
    Ok(Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, source_url).await))
137215×
}
1373
1374
/// `PATCH /repos/{o}/{n}/proposals/{number}`: change the title or body,
1375
/// keeping what is not given; the author or a maintainer, as on the page
1376
/// (oxygenhub#76). The target is changed on the page, which re-projects.
137723×
async fn edit_proposal(
137823×
    State(app): State<Shared>,
137923×
    headers: HeaderMap,
138023×
    Path((owner, name, number)): Path<(String, String, i64)>,
138123×
    Json(body): Json<hub_api::ProposalEdit>,
138223×
) -> Result<Json<Proposal>, ApiError> {
138323×
    let c = caller(&app, &headers).await?;
138423×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
138520×
    let (repo, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
138620×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
138719×
    let text = body.title.is_some() || body.body.is_some();
138819×
    if text && Some(me.id) != p.author_id && role < Role::Maintain {
13891×
        return Err(ApiError(StatusCode::FORBIDDEN, "only the proposal's author or a maintainer can edit it".into()));
139018×
    }
139118×
    if body.labels.is_some() && role < Role::Triage {
13921×
        return Err(forbidden("setting labels needs triage access"));
139317×
    }
1394
    // Every name is checked before anything changes.
139517×
    let labels = resolve_triage(&app, row.id, body.labels.as_deref(), None, None).await?.labels;
139616×
    if text {
13973×
        let title = match body.title.as_deref().map(str::trim) {
13982×
            Some("") => return Err(ApiError(StatusCode::BAD_REQUEST, "a proposal needs a title".into())),
13991×
            Some(t) => t,
14001×
            None => p.title.as_str(),
1401
        };
14022×
        let text = body.body.as_deref().map(str::trim).unwrap_or(&p.body);
14032×
        db::proposals::edit(&app.db, p.id, title, text, &p.target).await?;
14042×
        db::proposals::add_event(&app.db, p.id, &me.username, "edited", "").await.ok();
140513×
    }
140615×
    if let Some(want) = labels {
14072×
        let have = db::issues::proposal_labels(&app.db, p.id).await?;
14082×
        for l in &have {
14092×
            if !want.iter().any(|w| w.id == l.id) {
14101×
                db::issues::set_proposal_label(&app.db, p.id, l.id, false).await?;
14111×
            }
1412
        }
14133×
        for w in &want {
14143×
            if !have.iter().any(|l| l.id == w.id) {
14152×
                db::issues::set_proposal_label(&app.db, p.id, w.id, true).await?;
14161×
            }
1417
        }
14183×
        let names: Vec<&str> = want.iter().map(|l| l.name.as_str()).collect();
14192×
        db::proposals::add_event(&app.db, p.id, &me.username, "set labels", &names.join(", ")).await.ok();
142013×
    }
1421
    // `draft` says the same as `state`, in the words of creation (#313).
142215×
    let want = match (body.state.as_deref(), body.draft) {
14231×
        (Some(s), Some(d)) if (s == "draft") != d => {
14241×
            return Err(ApiError(StatusCode::BAD_REQUEST, format!("state {s:?} and draft {d} disagree")));
1425
        }
14267×
        (Some(s), _) => Some(s),
14272×
        (None, Some(true)) => Some("draft"),
14281×
        (None, Some(false)) => Some("open"),
14294×
        (None, None) => None,
1430
    };
143114×
    if let Some(want) = want {
143210×
        if Some(me.id) != p.author_id && role < Role::Triage {
14330×
            return Err(ApiError(
14340×
                StatusCode::FORBIDDEN,
14350×
                "only the proposal's author or someone with triage access can close, reopen or change whether it is a draft".into(),
14360×
            ));
143710×
        }
1438
        // The page's transitions: a draft is made ready (open), and an open
1439
        // proposal turned back into a draft.
144010×
        let new_state = match (want, p.state.as_str()) {
144110×
            ("closed", "open" | "draft") => "closed",
14427×
            ("open", "closed" | "draft") => "open",
14434×
            ("draft", "open") => "draft",
14443×
            (w, now) if w == now => now,
14452×
            ("closed" | "open" | "draft", now) => {
14461×
                return Err(ApiError(StatusCode::CONFLICT, format!("a proposal that is {now} cannot become {want}")))
1447
            }
14481×
            _ => return Err(ApiError(StatusCode::BAD_REQUEST, "state is closed, open or draft".into())),
1449
        };
14508×
        if new_state != p.state {
14517×
            db::proposals::set_state(&app.db, p.id, new_state, "").await?;
14527×
            db::proposals::add_event(&app.db, p.id, &me.username, new_state, "").await.ok();
14537×
            crate::hooks::emit(&app, &row, &format!("proposal.{new_state}"), &me.username, serde_json::json!({ "number": number })).await;
14541×
        }
14554×
    }
145612×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
145712×
    let source_url = match p.source_repo_id {
14580×
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", app.config.base_url(), r.slug())),
145912×
        None => None,
1460
    };
146112×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
146212×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
146312×
    Ok(Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, source_url).await))
146423×
}
1465
1466
/// `POST /repos/{o}/{n}/proposals/{number}/land` (repo:write): land it as
1467
/// the page's Land button does; `409` with the blockers when it cannot.
1468
/// `{"over_checks": "reason"}` lands over required checks that have not
1469
/// passed, for maintainers (#261).
14705×
async fn land_proposal(
14715×
    State(app): State<Shared>,
14725×
    headers: HeaderMap,
14735×
    Path((owner, name, number)): Path<(String, String, i64)>,
14745×
    body: axum::body::Bytes,
14755×
) -> Result<Json<Proposal>, ApiError> {
14765×
    let c = caller(&app, &headers).await?;
14775×
    let me = c.require("repo:write")?.clone();
14785×
    let over_checks: Option<String> = if body.iter().all(u8::is_ascii_whitespace) {
14790×
        None
1480
    } else {
14815×
        serde_json::from_slice::<serde_json::Value>(&body)
14825×
            .map_err(|_| ApiError(StatusCode::BAD_REQUEST, "the body is JSON: {} or {\"over_checks\": \"reason\"}".into()))?
14835×
            .get("over_checks")
14845×
            .and_then(|v| v.as_str())
14855×
            .map(String::from)
1486
    };
14875×
    let need = if over_checks.is_some() { Access::Maintain } else { Access::Write };
14885×
    let (repo, row, _) = reach(&app, &c, &owner, &name, need).await?;
14895×
    let via = format!("api (token {})", c.token);
14905×
    match crate::web::proposals::land_as(&app, &repo, &row, &me, number, &via, false, over_checks.as_deref()).await {
14914×
        Ok(_) => proposal(State(app), headers, Path((owner, name, number))).await,
14920×
        Err(crate::web::proposals::Landing::NotFound) => Err(not_found("no such proposal")),
14931×
        Err(crate::web::proposals::Landing::Refused(m)) => Err(ApiError(StatusCode::CONFLICT, m)),
1494
    }
14955×
}
1496
1497
/// `POST /repos/{o}/{n}/proposals/{number}/auto-land` (repo:write, #261):
1498
/// land it when its checks pass; at once if they already have.
14990×
async fn auto_land_on(
15000×
    State(app): State<Shared>,
15010×
    headers: HeaderMap,
15020×
    Path((owner, name, number)): Path<(String, String, i64)>,
15030×
) -> Result<Json<Proposal>, ApiError> {
15040×
    auto_land_set(&app, &headers, &owner, &name, number, true).await?;
15050×
    proposal(State(app), headers, Path((owner, name, number))).await
15060×
}
1507
1508
/// `DELETE …/auto-land`: it will not land by itself.
15090×
async fn auto_land_off(
15100×
    State(app): State<Shared>,
15110×
    headers: HeaderMap,
15120×
    Path((owner, name, number)): Path<(String, String, i64)>,
15130×
) -> Result<Json<Proposal>, ApiError> {
15140×
    auto_land_set(&app, &headers, &owner, &name, number, false).await?;
15150×
    proposal(State(app), headers, Path((owner, name, number))).await
15160×
}
1517
15180×
async fn auto_land_set(app: &Shared, headers: &HeaderMap, owner: &str, name: &str, number: i64, on: bool) -> Result<(), ApiError> {
15190×
    let c = caller(app, headers).await?;
15200×
    let me = c.require("repo:write")?.clone();
15210×
    let (_, row, _) = reach(app, &c, owner, name, Access::Write).await?;
15220×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15230×
    if !p.is_open() {
15240×
        return Err(ApiError(StatusCode::CONFLICT, format!("the proposal is {}", p.state)));
15250×
    }
15260×
    crate::autoland::set(app, &row, &p, &me, on).await?;
15270×
    Ok(())
15280×
}
1529
1530
/// The files a proposal changes (hub spec §12.1).
15311×
async fn proposal_files(
15321×
    State(app): State<Shared>,
15331×
    headers: HeaderMap,
15341×
    Path((owner, name, number)): Path<(String, String, i64)>,
15351×
) -> Result<Json<Vec<hub_api::ProposalFile>>, ApiError> {
15361×
    let c = caller(&app, &headers).await?;
15371×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
15381×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15391×
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
1540
    Ok(Json(
15411×
        loaded
15421×
            .files
15431×
            .iter()
15441×
            .map(|f| hub_api::ProposalFile {
15452×
                path: f.path.clone(),
15462×
                from: f.from.clone(),
15472×
                kind: f.kind.clone(),
15482×
                added: f.added,
15492×
                removed: f.removed,
15502×
            })
15511×
            .collect(),
1552
    ))
15531×
}
1554
1555
/// One file's bytes on a side of a proposal: `base` is the target's
1556
/// state, `head` the projected state. 404 when the file does not exist
1557
/// on that side.
15585×
async fn proposal_content(
15595×
    State(app): State<Shared>,
15605×
    headers: HeaderMap,
15615×
    Path((owner, name, number, side, path)): Path<(String, String, i64, String, String)>,
15625×
) -> Result<Response, ApiError> {
15635×
    let c = caller(&app, &headers).await?;
15645×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
15655×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
15665×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
15675×
    let heads = match side.as_str() {
15685×
        "base" => loaded.target_heads,
15693×
        "head" => loaded.heads,
15701×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "the side is base or head".into())),
1571
    };
15724×
    let limit = app.config.limits.render_limit.0;
15734×
    let target = view::RefTarget { label: side, kind: view::RefKind::Change, heads };
15744×
    let f = app.repos.read(&repo, move |repo, cache| view::file(repo, cache, target, &path, limit)).await?;
15753×
    Ok(crate::web::raw(f.bytes, &f.name, false))
15765×
}
1577
157812×
async fn create_proposal(
157912×
    State(app): State<Shared>,
158012×
    headers: HeaderMap,
158112×
    Path((owner, name)): Path<(String, String)>,
158212×
    Json(body): Json<NewProposal>,
158312×
) -> Result<(StatusCode, Json<Proposal>), ApiError> {
158412×
    let c = caller(&app, &headers).await?;
158512×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
158612×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
158710×
    let created =
158811×
        crate::web::proposals::open_proposal(&app, &repo, &row, &me, &body.title, &body.body, &body.target, &body.source, body.draft)
158911×
            .await
159011×
            .map_err(|e| ApiError(StatusCode::BAD_REQUEST, e))?;
159110×
    let loaded = crate::web::proposals::load_summary(&app, &repo, created).await?;
159210×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
159310×
    Ok((StatusCode::CREATED, Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await)))
159412×
}
1595
15965×
fn comment_of(c: &db::proposals::CommentRow) -> Comment {
1597
    Comment {
15985×
        id: c.id,
15995×
        author: c.author.clone(),
16005×
        body: c.body.clone(),
16015×
        created_ms: c.created_ms,
16025×
        path: if c.path.is_empty() { None } else { Some(c.path.clone()) },
16035×
        anchor: if c.anchor_change.is_empty() {
16040×
            None
1605
        } else {
16065×
            Some(Atom { change: c.anchor_change.clone(), index: c.anchor_index as u32 })
1607
        },
16085×
        line: None,
16095×
        resolved: c.resolved,
1610
    }
16115×
}
1612
16131×
async fn proposal_comments(
16141×
    State(app): State<Shared>,
16151×
    headers: HeaderMap,
16161×
    Path((owner, name, number)): Path<(String, String, i64)>,
16171×
) -> Result<Json<Vec<Comment>>, ApiError> {
16181×
    let c = caller(&app, &headers).await?;
16191×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
16201×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
16211×
    let mut out: Vec<Comment> = db::proposals::comments(&app.db, p.id).await?.iter().map(comment_of).collect();
1622
    // Place anchored comments on their line of the projected state.
16231×
    let paths: std::collections::BTreeSet<String> = out.iter().filter(|c| c.anchor.is_some()).filter_map(|c| c.path.clone()).collect();
16241×
    if !paths.is_empty() {
16251×
        let repo = RepoName::new(&owner, &name).ok_or_else(|| not_found("no such repository"))?;
16261×
        let heads = crate::web::proposals::load_summary(&app, &repo, p).await?.heads;
16271×
        let lines = app
16281×
            .repos
16291×
            .read(&repo, move |r, _| {
16301×
                let mut at = std::collections::HashMap::new();
16311×
                for path in paths {
1632
                    // A file the projection removed has no lines to place a comment on.
16332×
                    for l in r.blame_in(&path, &heads).unwrap_or_default() {
16342×
                        at.insert((path.clone(), l.hash.to_hex(), l.index), l.line);
16352×
                    }
1636
                }
16371×
                Ok(at)
16381×
            })
16391×
            .await?;
16401×
        for c in &mut out {
16411×
            if let (Some(path), Some(a)) = (&c.path, &c.anchor) {
16421×
                c.line = lines.get(&(path.clone(), a.change.clone(), a.index)).copied();
16431×
            }
1644
        }
16450×
    }
16461×
    Ok(Json(out))
16471×
}
1648
16493×
async fn proposal_comment(
16503×
    State(app): State<Shared>,
16513×
    headers: HeaderMap,
16523×
    Path((owner, name, number)): Path<(String, String, i64)>,
16533×
    Json(body): Json<NewComment>,
16543×
) -> Result<(StatusCode, Json<Comment>), ApiError> {
16553×
    let c = caller(&app, &headers).await?;
16563×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
16573×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
16583×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
16593×
    if body.body.trim().is_empty() {
16600×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
16613×
    }
16623×
    let (repo, _) = (RepoName::new(&owner, &name).ok_or_else(|| not_found("no such repository"))?, ());
16633×
    let anchor = match (body.path.as_deref().map(|x| x.trim_matches('/')), body.line) {
16643×
        (Some(path), Some(line)) if !path.is_empty() => {
16653×
            let loaded = crate::web::proposals::load(&app, &repo, p.clone()).await?;
16663×
            let (heads, file) = (loaded.heads.clone(), path.to_string());
16673×
            let atom = app
16683×
                .repos
16693×
                .read(&repo, move |r, cache| {
16703×
                    let projected = cache.load(r, &heads)?;
16713×
                    Ok(crate::repos::proposals::atom_at(&projected, &file, line).map(|(h, i)| (h.to_hex(), i)))
16723×
                })
16733×
                .await?
16743×
                .ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, format!("{path}:{line} is not a line of the projected state")))?;
16752×
            Some((path.to_string(), atom))
1676
        }
16770×
        _ => None,
1678
    };
16792×
    let row_c = db::proposals::add_comment(
16802×
        &app.db,
16812×
        p.id,
16822×
        Some(me.id),
16832×
        &me.username,
16842×
        body.body.trim(),
16852×
        anchor.as_ref().map(|(path, _)| path.as_str()).unwrap_or(""),
16862×
        anchor.as_ref().map(|(_, (h, i))| (h.as_str(), *i as i64)),
1687
    )
16882×
    .await?;
16892×
    crate::notify::deliver(
16902×
        &app,
16912×
        crate::notify::Event {
16922×
            kind: "proposal.comment",
16932×
            title: format!("{owner}/{name}#{number}: {}", p.title),
16942×
            url: format!("/{owner}/{name}/proposal/{number}"),
16952×
            actor: &me,
16962×
            repo_id: row.id,
16972×
            thread: Some(("proposal", p.id)),
16982×
            mention_text: &body.body,
16992×
            direct: p.author_id.into_iter().collect(),
17002×
        },
17012×
    )
17022×
    .await;
17032×
    crate::hooks::emit(
17042×
        &app,
17052×
        &row,
17062×
        "comment.proposal",
17072×
        &me.username,
17082×
        serde_json::json!({ "number": number, "comment": comment_of(&row_c) }),
17092×
    )
17102×
    .await;
17112×
    let mut created = comment_of(&row_c);
17122×
    created.line = created.anchor.as_ref().and(body.line);
17132×
    Ok((StatusCode::CREATED, Json(created)))
17143×
}
1715
17161×
async fn proposal_reviews(
17171×
    State(app): State<Shared>,
17181×
    headers: HeaderMap,
17191×
    Path((owner, name, number)): Path<(String, String, i64)>,
17201×
) -> Result<Json<Vec<Review>>, ApiError> {
17211×
    let c = caller(&app, &headers).await?;
17221×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
17231×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17241×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
17251×
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
1726
    Ok(Json(
17271×
        v.reviews
17281×
            .into_iter()
17291×
            .map(|r| Review {
17302×
                id: r.row.id,
17312×
                author: r.row.author,
17322×
                verdict: r.row.verdict,
17332×
                body: r.row.body,
17342×
                sealed: r.sealed,
17352×
                created_ms: r.row.created_ms,
17362×
                via: r.row.via,
17372×
            })
17381×
            .collect(),
1739
    ))
17401×
}
1741
17421×
async fn proposal_review(
17431×
    State(app): State<Shared>,
17441×
    headers: HeaderMap,
17451×
    Path((owner, name, number)): Path<(String, String, i64)>,
17461×
    Json(body): Json<NewReview>,
17471×
) -> Result<(StatusCode, Json<Review>), ApiError> {
17481×
    let c = caller(&app, &headers).await?;
17491×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
17501×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
17511×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17521×
    if !matches!(body.verdict.as_str(), "comment" | "changes" | "approve") {
17530×
        return Err(ApiError(StatusCode::BAD_REQUEST, "verdict is comment, changes or approve".into()));
17541×
    }
17551×
    if body.verdict == "approve" && Some(me.id) == p.author_id {
17560×
        return Err(forbidden("you cannot approve your own proposal"));
17571×
    }
17581×
    let r = db::proposals::add_review(&app.db, p.id, me.id, &me.username, &body.verdict, body.body.trim()).await?;
17591×
    db::proposals::add_event(&app.db, p.id, &me.username, &format!("review.{}", body.verdict), "").await.ok();
17601×
    crate::web::proposals::reviewed(&app, &row, &p, &me, &body.verdict).await;
17611×
    crate::hooks::emit(&app, &row, "review", &me.username, serde_json::json!({ "number": number, "verdict": body.verdict })).await;
17621×
    Ok((
17631×
        StatusCode::CREATED,
17641×
        Json(Review { id: r.id, author: r.author, verdict: r.verdict, body: r.body, sealed: false, created_ms: r.created_ms, via: r.via }),
17651×
    ))
17661×
}
1767
1768
/// `POST .../proposals/{number}/reviewers`: ask accounts to review (the
1769
/// author, or a writer). Answers with everyone asked now.
17704×
async fn request_reviewers(
17714×
    State(app): State<Shared>,
17724×
    headers: HeaderMap,
17734×
    Path((owner, name, number)): Path<(String, String, i64)>,
17744×
    Json(body): Json<ReviewRequest>,
17754×
) -> Result<Json<Vec<String>>, ApiError> {
17764×
    let c = caller(&app, &headers).await?;
17774×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
17784×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
17794×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
17804×
    if Some(me.id) != p.author_id && role < Role::Write {
17810×
        return Err(forbidden("only the author or a writer asks for reviews"));
17824×
    }
17834×
    if !p.is_open() {
17840×
        return Err(ApiError(StatusCode::CONFLICT, "the proposal is not open".into()));
17854×
    }
17864×
    crate::web::proposals::request_reviewers(&app, &row, &p, &me, &body.reviewers)
17874×
        .await
17884×
        .map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
17892×
    Ok(Json(db::proposals::review_requests(&app.db, p.id).await?))
17904×
}
1791
1792
/// `DELETE .../proposals/{number}/reviewers/{username}`: withdraw a request.
17931×
async fn withdraw_reviewer(
17941×
    State(app): State<Shared>,
17951×
    headers: HeaderMap,
17961×
    Path((owner, name, number, username)): Path<(String, String, i64, String)>,
17971×
) -> Result<StatusCode, ApiError> {
17981×
    let c = caller(&app, &headers).await?;
17991×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
18001×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
18011×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
18021×
    if Some(me.id) != p.author_id && role < Role::Write {
18030×
        return Err(forbidden("only the author or a writer withdraws review requests"));
18041×
    }
18051×
    let a = db::accounts::account_by_name(&app.db, &username).await?.ok_or_else(|| not_found("no such account"))?;
18061×
    if db::proposals::unrequest_review(&app.db, p.id, a.id).await? {
18071×
        db::proposals::add_event(&app.db, p.id, &me.username, "review request withdrawn", &a.username).await.ok();
18080×
    }
18091×
    Ok(StatusCode::NO_CONTENT)
18101×
}
1811
18121×
async fn proposal_checks(
18131×
    State(app): State<Shared>,
18141×
    headers: HeaderMap,
18151×
    Path((owner, name, number)): Path<(String, String, i64)>,
18161×
) -> Result<Json<Vec<Check>>, ApiError> {
18171×
    let c = caller(&app, &headers).await?;
18181×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
18191×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
18201×
    let loaded = crate::web::proposals::load_summary(&app, &repo, p).await?;
18211×
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &loaded.state).await?.iter().map(check_of).collect()))
18221×
}
1823
1824
// ------------------------------------------------------------------ issues
1825
182630×
async fn issue_of(app: &Shared, row: &db::repos::RepoRow, i: &db::issues::IssueRow) -> Result<Issue, ApiError> {
182730×
    let labels = db::issues::issue_labels(&app.db, i.id)
182830×
        .await?
182930×
        .into_iter()
183030×
        .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
183130×
        .collect();
183230×
    let assignees = db::issues::assignees(&app.db, i.id).await?;
183330×
    let milestone = match i.milestone_id {
18340×
        Some(id) => db::issues::milestone(&app.db, id).await?.map(|m| m.title),
183530×
        None => None,
1836
    };
183730×
    let comments: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM issue_comments WHERE issue_id = $1").bind(i.id).fetch_one(&app.db).await?;
183830×
    Ok(Issue {
183930×
        number: i.number,
184030×
        title: i.title.clone(),
184130×
        body: i.body.clone(),
184230×
        author: i.author.clone(),
184330×
        state: i.state.clone(),
184430×
        reason: i.reason.clone(),
184530×
        labels,
184630×
        assignees,
184730×
        milestone,
184830×
        comments,
184930×
        locked: i.locked,
185030×
        pinned: i.pinned,
185130×
        created_ms: i.created_ms,
185230×
        updated_ms: i.updated_ms,
185330×
        closed_ms: i.closed_ms,
185430×
        url: format!("{}/{}/issue/{}", app.config.base_url(), row.slug(), i.number),
185530×
    })
185630×
}
1857
1858
#[derive(Deserialize)]
1859
struct IssuesQuery {
1860
    state: Option<String>,
1861
}
1862
18635×
async fn issues(
18645×
    State(app): State<Shared>,
18655×
    headers: HeaderMap,
18665×
    Path((owner, name)): Path<(String, String)>,
18675×
    Query(q): Query<IssuesQuery>,
18685×
) -> Result<Json<Vec<Issue>>, ApiError> {
18695×
    let c = caller(&app, &headers).await?;
18705×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
18715×
    let state = q.state.unwrap_or_else(|| "open".into());
18725×
    let mut out = Vec::new();
18736×
    for i in db::issues::list(&app.db, row.id).await? {
18746×
        if state == "all" || i.state == state {
18755×
            out.push(issue_of(&app, &row, &i).await?);
18761×
        }
1877
    }
18785×
    Ok(Json(out))
18795×
}
1880
188119×
async fn create_issue(
188219×
    State(app): State<Shared>,
188319×
    headers: HeaderMap,
188419×
    Path((owner, name)): Path<(String, String)>,
188519×
    Json(body): Json<NewIssue>,
188619×
) -> Result<(StatusCode, Json<Issue>), ApiError> {
188719×
    let c = caller(&app, &headers).await?;
188818×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
188918×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
189018×
    if body.title.trim().is_empty() {
18910×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an issue needs a title".into()));
189218×
    }
189318×
    let triage = !body.labels.is_empty() || !body.assignees.is_empty() || body.milestone.is_some();
189418×
    if triage && role < Role::Triage {
18951×
        return Err(forbidden("setting labels, assignees or a milestone needs triage access"));
189617×
    }
1897
    // Check the names before anything is created.
189817×
    resolve_triage(&app, row.id, Some(&body.labels), Some(&body.assignees), body.milestone.as_deref()).await?;
189916×
    let i = db::issues::create(
190016×
        &app.db,
190116×
        db::issues::NewIssue {
190216×
            repo_id: row.id,
190316×
            title: body.title.trim(),
190416×
            body: body.body.trim(),
190516×
            author_id: Some(me.id),
190616×
            author: &me.username,
190716×
        },
190816×
    )
190916×
    .await?;
191016×
    db::issues::add_event(&app.db, i.id, &me.username, "opened", "").await.ok();
191116×
    if triage {
19121×
        let t = resolve_triage(&app, row.id, Some(&body.labels), Some(&body.assignees), body.milestone.as_deref()).await?;
19131×
        apply_triage(&app, &i, &me, t).await?;
191415×
    }
191516×
    let i = db::issues::get(&app.db, row.id, i.number).await?.unwrap_or(i);
191616×
    crate::web::issues::reindex(&app, row.id, &i).await;
191716×
    let api = issue_of(&app, &row, &i).await?;
191816×
    crate::notify::deliver(
191916×
        &app,
192016×
        crate::notify::Event {
192116×
            kind: "issue.opened",
192216×
            title: format!("{owner}/{name}#{}: {}", i.number, i.title),
192316×
            url: format!("/{owner}/{name}/issue/{}", i.number),
192416×
            actor: &me,
192516×
            repo_id: row.id,
192616×
            thread: Some(("issue", i.id)),
192716×
            mention_text: &body.body,
192816×
            direct: vec![],
192916×
        },
193016×
    )
193116×
    .await;
193216×
    crate::hooks::emit(&app, &row, "issue.opened", &me.username, serde_json::json!({ "issue": api })).await;
193316×
    Ok((StatusCode::CREATED, Json(api)))
193419×
}
1935
19363×
async fn issue(
19373×
    State(app): State<Shared>,
19383×
    headers: HeaderMap,
19393×
    Path((owner, name, number)): Path<(String, String, i64)>,
19403×
) -> Result<Json<Issue>, ApiError> {
19413×
    let c = caller(&app, &headers).await?;
19423×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
19433×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
19443×
    Ok(Json(issue_of(&app, &row, &i).await?))
19453×
}
1946
19472×
async fn issue_state(
19482×
    State(app): State<Shared>,
19492×
    headers: HeaderMap,
19502×
    Path((owner, name, number)): Path<(String, String, i64)>,
19512×
    Json(body): Json<IssueStateChange>,
19522×
) -> Result<Json<Issue>, ApiError> {
19532×
    let c = caller(&app, &headers).await?;
19542×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
19552×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
19562×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
19572×
    if role < Role::Triage && Some(me.id) != i.author_id {
19580×
        return Err(forbidden("only the author or triage may change the state"));
19592×
    }
19602×
    let (state, reason) = match body.state.as_str() {
19612×
        "closed" => ("closed", if body.reason == "not_planned" { "not_planned" } else { "completed" }),
19620×
        "open" => ("open", ""),
19630×
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "state is open or closed".into())),
1964
    };
19652×
    db::issues::set_state(&app.db, i.id, state, reason).await?;
19662×
    db::issues::add_event(&app.db, i.id, &me.username, if state == "closed" { "closed" } else { "reopened" }, "").await.ok();
19672×
    let fresh = db::issues::get(&app.db, row.id, number).await?.unwrap_or(i);
19682×
    let api = issue_of(&app, &row, &fresh).await?;
19692×
    crate::hooks::emit(
19702×
        &app,
19712×
        &row,
19722×
        if state == "closed" { "issue.closed" } else { "issue.reopened" },
19732×
        &me.username,
19742×
        serde_json::json!({ "issue": api }),
1975
    )
19762×
    .await;
19772×
    Ok(Json(api))
19782×
}
1979
19801×
async fn issue_comments(
19811×
    State(app): State<Shared>,
19821×
    headers: HeaderMap,
19831×
    Path((owner, name, number)): Path<(String, String, i64)>,
19841×
) -> Result<Json<Vec<Comment>>, ApiError> {
19851×
    let c = caller(&app, &headers).await?;
19861×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
19871×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
1988
    Ok(Json(
19891×
        db::issues::comments(&app.db, i.id)
19901×
            .await?
19911×
            .into_iter()
19921×
            .map(|c| Comment {
19932×
                id: c.id,
19942×
                author: c.author,
19952×
                body: c.body,
19962×
                created_ms: c.created_ms,
19972×
                path: None,
19982×
                anchor: None,
19992×
                line: None,
2000
                resolved: false,
20012×
            })
20021×
            .collect(),
2003
    ))
20041×
}
2005
20063×
async fn issue_comment(
20073×
    State(app): State<Shared>,
20083×
    headers: HeaderMap,
20093×
    Path((owner, name, number)): Path<(String, String, i64)>,
20103×
    Json(body): Json<NewComment>,
20113×
) -> Result<(StatusCode, Json<Comment>), ApiError> {
20123×
    let c = caller(&app, &headers).await?;
20133×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
20143×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
20153×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
20163×
    if i.locked && role < Role::Triage {
20170×
        return Err(forbidden("this issue is locked"));
20183×
    }
20193×
    if body.body.trim().is_empty() {
20200×
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
20213×
    }
20223×
    let cm = db::issues::add_comment(&app.db, i.id, Some(me.id), &me.username, body.body.trim()).await?;
20233×
    crate::web::issues::reindex(&app, row.id, &i).await;
20243×
    crate::notify::deliver(
20253×
        &app,
20263×
        crate::notify::Event {
20273×
            kind: "issue.comment",
20283×
            title: format!("{owner}/{name}#{number}: {}", i.title),
20293×
            url: format!("/{owner}/{name}/issue/{number}"),
20303×
            actor: &me,
20313×
            repo_id: row.id,
20323×
            thread: Some(("issue", i.id)),
20333×
            mention_text: &body.body,
20343×
            direct: i.author_id.into_iter().collect(),
20353×
        },
20363×
    )
20373×
    .await;
20383×
    let api = Comment {
20393×
        id: cm.id,
20403×
        author: cm.author,
20413×
        body: cm.body,
20423×
        created_ms: cm.created_ms,
20433×
        path: None,
20443×
        anchor: None,
20453×
        line: None,
20463×
        resolved: false,
20473×
    };
20483×
    crate::hooks::emit(&app, &row, "comment.issue", &me.username, serde_json::json!({ "number": number, "comment": api })).await;
20493×
    Ok((StatusCode::CREATED, Json(api)))
20503×
}
2051
2052
/// Labels, assignees and milestone named in a request, looked up.
2053
struct Triage {
2054
    labels: Option<Vec<db::issues::Label>>,
2055
    assignees: Option<Vec<Account>>,
2056
    /// `Some(None)` clears the milestone.
2057
    milestone: Option<Option<db::issues::Milestone>>,
2058
}
2059
206041×
async fn resolve_triage(
206141×
    app: &Shared,
206241×
    repo_id: i64,
206341×
    labels: Option<&[String]>,
206441×
    assignees: Option<&[String]>,
206541×
    milestone: Option<&str>,
206641×
) -> Result<Triage, ApiError> {
206741×
    let bad = |m: String| ApiError(StatusCode::BAD_REQUEST, m);
206841×
    let labels = match labels {
206924×
        Some(names) => {
207024×
            let mut out = Vec::new();
207124×
            for n in names {
207210×
                out.push(
207310×
                    db::issues::label_by_name(&app.db, repo_id, n.trim())
207410×
                        .await?
207510×
                        .ok_or_else(|| bad(format!("no label {n:?}; create it first")))?,
2076
                );
2077
            }
207822×
            Some(out)
2079
        }
208017×
        None => None,
2081
    };
208239×
    let assignees = match assignees {
208320×
        Some(names) => {
208420×
            let mut out = Vec::new();
208520×
            for n in names {
20863×
                out.push(db::accounts::account_by_name(&app.db, n.trim()).await?.ok_or_else(|| bad(format!("no account {n:?}")))?);
2087
            }
208820×
            Some(out)
2089
        }
209019×
        None => None,
2091
    };
209239×
    let milestone = match milestone.map(str::trim) {
209338×
        None => None,
20941×
        Some("") => Some(None),
20951×
        Some(title) => Some(Some(
20961×
            db::issues::milestones(&app.db, repo_id)
20971×
                .await?
20981×
                .into_iter()
20991×
                .find(|m| m.title == title)
21001×
                .ok_or_else(|| bad(format!("no milestone {title:?}")))?,
2101
        )),
2102
    };
210338×
    Ok(Triage { labels, assignees, milestone })
210441×
}
2105
2106
/// Make an issue's labels, assignees and milestone what `t` says, with
2107
/// timeline events for what changed.
21085×
async fn apply_triage(app: &Shared, i: &db::issues::IssueRow, me: &Account, t: Triage) -> Result<(), ApiError> {
21095×
    if let Some(want) = t.labels {
21104×
        let have = db::issues::issue_labels(&app.db, i.id).await?;
21114×
        for l in &have {
21122×
            if !want.iter().any(|w| w.id == l.id) {
21132×
                db::issues::set_issue_label(&app.db, i.id, l.id, false).await?;
21140×
            }
2115
        }
21164×
        for w in &want {
21173×
            if !have.iter().any(|l| l.id == w.id) {
21183×
                db::issues::set_issue_label(&app.db, i.id, w.id, true).await?;
21190×
            }
2120
        }
21214×
        let names: Vec<&str> = want.iter().map(|l| l.name.as_str()).collect();
21224×
        db::issues::add_event(&app.db, i.id, &me.username, "set labels", &names.join(", ")).await.ok();
21231×
    }
21245×
    if let Some(want) = t.assignees {
21254×
        let have = db::issues::assignees(&app.db, i.id).await?;
21264×
        for name in &have {
21272×
            if !want.iter().any(|a| &a.username == name) {
21282×
                if let Some(a) = db::accounts::account_by_name(&app.db, name).await? {
21292×
                    db::issues::set_assignee(&app.db, i.id, a.id, false).await?;
21302×
                    db::issues::add_event(&app.db, i.id, &me.username, "unassigned", name).await.ok();
21310×
                }
21320×
            }
2133
        }
21344×
        for a in &want {
21352×
            if !have.contains(&a.username) {
21362×
                db::issues::set_assignee(&app.db, i.id, a.id, true).await?;
21372×
                db::issues::add_event(&app.db, i.id, &me.username, "assigned", &a.username).await.ok();
21380×
            }
2139
        }
21401×
    }
21415×
    if let Some(m) = t.milestone {
21420×
        db::issues::set_milestone(&app.db, i.id, m.as_ref().map(|m| m.id)).await?;
21430×
        db::issues::add_event(&app.db, i.id, &me.username, "set milestone", m.as_ref().map(|m| m.title.as_str()).unwrap_or("")).await.ok();
21445×
    }
21455×
    Ok(())
21465×
}
2147
2148
/// `PATCH /repos/{o}/{n}/issues/{number}`.
21498×
async fn issue_edit(
21508×
    State(app): State<Shared>,
21518×
    headers: HeaderMap,
21528×
    Path((owner, name, number)): Path<(String, String, i64)>,
21538×
    Json(body): Json<IssueEdit>,
21548×
) -> Result<Json<Issue>, ApiError> {
21558×
    let c = caller(&app, &headers).await?;
21568×
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
21578×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
21588×
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
21598×
    let text = body.title.is_some() || body.body.is_some();
21608×
    let triage = body.labels.is_some() || body.assignees.is_some() || body.milestone.is_some();
21618×
    if text && role < Role::Triage && Some(me.id) != i.author_id {
21621×
        return Err(forbidden("only the author or triage may edit the title and body"));
21637×
    }
21647×
    if triage && role < Role::Triage {
21651×
        return Err(forbidden("setting labels, assignees or a milestone needs triage access"));
21666×
    }
21676×
    if i.locked && role < Role::Triage {
21680×
        return Err(forbidden("this issue is locked"));
21696×
    }
21706×
    let t = resolve_triage(&app, row.id, body.labels.as_deref(), body.assignees.as_deref(), body.milestone.as_deref()).await?;
21715×
    if text {
21723×
        let title = body.title.as_deref().map(str::trim).unwrap_or(&i.title);
21733×
        if title.is_empty() {
21741×
            return Err(ApiError(StatusCode::BAD_REQUEST, "an issue needs a title".into()));
21752×
        }
21762×
        db::issues::edit(&app.db, i.id, title, body.body.as_deref().unwrap_or(&i.body)).await?;
21772×
        db::issues::add_event(&app.db, i.id, &me.username, "edited", "").await.ok();
21782×
    }
21794×
    apply_triage(&app, &i, &me, t).await?;
21804×
    db::issues::touch(&app.db, i.id).await.ok();
21814×
    let fresh = db::issues::get(&app.db, row.id, number).await?.unwrap_or(i);
21824×
    crate::web::issues::reindex(&app, row.id, &fresh).await;
21834×
    let api = issue_of(&app, &row, &fresh).await?;
21844×
    crate::hooks::emit(&app, &row, "issue.edited", &me.username, serde_json::json!({ "issue": api })).await;
21854×
    Ok(Json(api))
21868×
}
2187
2188
/// `POST /repos/{o}/{n}/labels` (triage).
21896×
async fn create_label(
21906×
    State(app): State<Shared>,
21916×
    headers: HeaderMap,
21926×
    Path((owner, name)): Path<(String, String)>,
21936×
    Json(body): Json<NewLabel>,
21946×
) -> Result<(StatusCode, Json<Label>), ApiError> {
21956×
    let c = caller(&app, &headers).await?;
21966×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
21976×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
21986×
    if role < Role::Triage {
21991×
        return Err(forbidden("labels need triage access"));
22005×
    }
22015×
    let label = body.name.trim();
22025×
    if label.is_empty() || label.len() > 50 {
22030×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a label has a name of 1 to 50 characters".into()));
22045×
    }
22055×
    let colour = match body.colour.as_deref() {
22066×
        Some(c) if c.len() == 7 && c.starts_with('#') && c[1..].chars().all(|x| x.is_ascii_hexdigit()) => c.to_string(),
22071×
        Some(c) => return Err(ApiError(StatusCode::BAD_REQUEST, format!("colour {c:?} is not #rrggbb"))),
22083×
        None => "#5aa8ff".to_string(),
2209
    };
22104×
    let l = db::issues::upsert_label(&app.db, row.id, label, &colour, body.description.trim()).await?;
22114×
    Ok((StatusCode::CREATED, Json(Label { name: l.name, colour: l.colour, description: l.description })))
22126×
}
2213
2214
/// `DELETE /repos/{o}/{n}/labels/{label}` (triage).
22152×
async fn delete_label(
22162×
    State(app): State<Shared>,
22172×
    headers: HeaderMap,
22182×
    Path((owner, name, label)): Path<(String, String, String)>,
22192×
) -> Result<StatusCode, ApiError> {
22202×
    let c = caller(&app, &headers).await?;
22212×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
22222×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
22232×
    if role < Role::Triage {
22240×
        return Err(forbidden("labels need triage access"));
22252×
    }
22262×
    let l = db::issues::label_by_name(&app.db, row.id, &label).await?.ok_or_else(|| not_found("no such label"))?;
22271×
    db::issues::delete_label(&app.db, l.id).await?;
22281×
    Ok(StatusCode::NO_CONTENT)
22292×
}
2230
22312×
async fn labels(
22322×
    State(app): State<Shared>,
22332×
    headers: HeaderMap,
22342×
    Path((owner, name)): Path<(String, String)>,
22352×
) -> Result<Json<Vec<Label>>, ApiError> {
22362×
    let c = caller(&app, &headers).await?;
22372×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2238
    Ok(Json(
22392×
        db::issues::labels(&app.db, row.id)
22402×
            .await?
22412×
            .into_iter()
22423×
            .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
22432×
            .collect(),
2244
    ))
22452×
}
2246
22471×
async fn milestones(
22481×
    State(app): State<Shared>,
22491×
    headers: HeaderMap,
22501×
    Path((owner, name)): Path<(String, String)>,
22511×
) -> Result<Json<Vec<Milestone>>, ApiError> {
22521×
    let c = caller(&app, &headers).await?;
22531×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
22541×
    let mut out = Vec::new();
22551×
    for m in db::issues::milestones(&app.db, row.id).await? {
22561×
        let (open, closed) = db::issues::milestone_counts(&app.db, m.id).await?;
22571×
        out.push(Milestone { title: m.title, description: m.description, due_ms: m.due_ms, state: m.state, open, closed });
2258
    }
22591×
    Ok(Json(out))
22601×
}
2261
22622×
fn milestone_of(m: db::issues::Milestone, open: i64, closed: i64) -> Milestone {
22632×
    Milestone { title: m.title, description: m.description, due_ms: m.due_ms, state: m.state, open, closed }
22642×
}
2265
2266
/// A due date as `YYYY-MM-DD` (UTC midnight), or the empty string for none.
22673×
fn due_ms_of(due: &str) -> Result<Option<i64>, ApiError> {
22683×
    let due = due.trim();
22693×
    if due.is_empty() {
22701×
        return Ok(None);
22712×
    }
22722×
    time::Date::parse(due, &time::macros::format_description!("[year]-[month]-[day]"))
22732×
        .map(|d| Some(d.midnight().assume_utc().unix_timestamp() * 1000))
22742×
        .map_err(|_| ApiError(StatusCode::BAD_REQUEST, format!("due {due:?} is not YYYY-MM-DD")))
22753×
}
2276
22776×
async fn triage_for_milestones(app: &Shared, headers: &HeaderMap, owner: &str, name: &str) -> Result<db::repos::RepoRow, ApiError> {
22786×
    let c = caller(app, headers).await?;
22796×
    c.require("issues:write").or_else(|_| c.require("repo:write"))?;
22806×
    let (_, row, role) = reach(app, &c, owner, name, Access::Read).await?;
22816×
    if role < Role::Triage {
22821×
        return Err(forbidden("milestones need triage access"));
22835×
    }
22845×
    Ok(row)
22856×
}
2286
2287
/// `POST /repos/{o}/{n}/milestones` (triage, oxygenhub#91): create a
2288
/// milestone, or change the description and due date of the one with
2289
/// that title.
22903×
async fn create_milestone(
22913×
    State(app): State<Shared>,
22923×
    headers: HeaderMap,
22933×
    Path((owner, name)): Path<(String, String)>,
22943×
    Json(body): Json<NewMilestone>,
22953×
) -> Result<(StatusCode, Json<Milestone>), ApiError> {
22963×
    let row = triage_for_milestones(&app, &headers, &owner, &name).await?;
22972×
    let title = body.title.trim();
22982×
    if title.is_empty() || title.len() > 100 {
22990×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a milestone has a title of 1 to 100 characters".into()));
23002×
    }
23012×
    let due_ms = due_ms_of(body.due.as_deref().unwrap_or(""))?;
23021×
    let m = db::issues::upsert_milestone(&app.db, row.id, title, body.description.trim(), due_ms).await?;
23031×
    let (open, closed) = db::issues::milestone_counts(&app.db, m.id).await?;
23041×
    Ok((StatusCode::CREATED, Json(milestone_of(m, open, closed))))
23053×
}
2306
2307
/// `PATCH /repos/{o}/{n}/milestones/{title}` (triage): title,
2308
/// description, due date and state; what is not given stays.
23093×
async fn edit_milestone(
23103×
    State(app): State<Shared>,
23113×
    headers: HeaderMap,
23123×
    Path((owner, name, title)): Path<(String, String, String)>,
23133×
    Json(body): Json<MilestoneEdit>,
23143×
) -> Result<Json<Milestone>, ApiError> {
23153×
    let row = triage_for_milestones(&app, &headers, &owner, &name).await?;
23163×
    let m = db::issues::milestones(&app.db, row.id)
23173×
        .await?
23183×
        .into_iter()
23193×
        .find(|m| m.title == title)
23203×
        .ok_or_else(|| not_found("no such milestone"))?;
23212×
    let new_title = body.title.as_deref().map(str::trim).unwrap_or(&m.title);
23222×
    if new_title.is_empty() || new_title.len() > 100 {
23230×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a milestone has a title of 1 to 100 characters".into()));
23242×
    }
23252×
    let due_ms = match body.due.as_deref() {
23261×
        Some(d) => due_ms_of(d)?,
23271×
        None => m.due_ms,
2328
    };
23292×
    let description = body.description.as_deref().map(str::trim).unwrap_or(&m.description);
23302×
    if body.title.is_some() || body.description.is_some() || body.due.is_some() {
23311×
        db::issues::update_milestone(&app.db, m.id, new_title, description, due_ms).await?;
23321×
    }
23332×
    if let Some(state) = body.state.as_deref() {
23342×
        match state {
23352×
            "open" | "closed" => db::issues::set_milestone_state(&app.db, m.id, state).await?,
23361×
            other => return Err(ApiError(StatusCode::BAD_REQUEST, format!("state {other:?} is open or closed"))),
2337
        }
23380×
    }
23391×
    let fresh = db::issues::milestone(&app.db, m.id).await?.ok_or_else(|| not_found("no such milestone"))?;
23401×
    let (open, closed) = db::issues::milestone_counts(&app.db, fresh.id).await?;
23411×
    Ok(Json(milestone_of(fresh, open, closed)))
23423×
}
2343
2344
// --------------------------------------------------------- hooks, checks
2345
23462×
fn hook_of(h: &db::hooks::Hook) -> Hook {
23472×
    Hook { id: h.id, url: h.url.clone(), events: h.events.clone(), active: h.active, created_ms: h.created_ms }
23482×
}
2349
23501×
async fn hooks(
23511×
    State(app): State<Shared>,
23521×
    headers: HeaderMap,
23531×
    Path((owner, name)): Path<(String, String)>,
23541×
) -> Result<Json<Vec<Hook>>, ApiError> {
23551×
    let c = caller(&app, &headers).await?;
23561×
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
23571×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23581×
    Ok(Json(db::hooks::hooks_for_repo(&app.db, row.id).await?.iter().map(hook_of).collect()))
23591×
}
2360
23611×
async fn create_hook(
23621×
    State(app): State<Shared>,
23631×
    headers: HeaderMap,
23641×
    Path((owner, name)): Path<(String, String)>,
23651×
    Json(body): Json<NewHook>,
23661×
) -> Result<(StatusCode, Json<Hook>), ApiError> {
23671×
    let c = caller(&app, &headers).await?;
23681×
    let me = c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?.clone();
23691×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23701×
    if !(body.url.starts_with("http://") || body.url.starts_with("https://")) {
23710×
        return Err(ApiError(StatusCode::BAD_REQUEST, "the URL must be http or https".into()));
23721×
    }
23731×
    let h = db::hooks::create_hook(&app.db, Some(row.id), None, &body.url, &body.secret, &body.events).await?;
23741×
    db::accounts::audit(&app.db, Some(&me), "hook.created", &row.slug(), &body.url).await.ok();
23751×
    Ok((StatusCode::CREATED, Json(hook_of(&h))))
23761×
}
2377
23780×
async fn delete_hook(
23790×
    State(app): State<Shared>,
23800×
    headers: HeaderMap,
23810×
    Path((owner, name, id)): Path<(String, String, i64)>,
23820×
) -> Result<StatusCode, ApiError> {
23830×
    let c = caller(&app, &headers).await?;
23840×
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
23850×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
23860×
    if db::hooks::hook(&app.db, id).await?.is_some_and(|h| h.repo_id == Some(row.id)) {
23870×
        db::hooks::delete_hook(&app.db, id).await?;
23880×
    }
23890×
    Ok(StatusCode::NO_CONTENT)
23900×
}
2391
2392711×
pub fn check_of(c: &db::hooks::Check) -> Check {
2393
    Check {
2394711×
        state: c.state.clone(),
2395711×
        name: c.name.clone(),
2396711×
        status: CheckStatus::parse(&c.status).unwrap_or(CheckStatus::Queued),
2397711×
        summary: c.summary.clone(),
2398711×
        url: c.url.clone(),
2399711×
        reporter: c.reporter.clone(),
2400711×
        seal: if c.seal.is_empty() { None } else { Some(c.seal.clone()) },
2401711×
        started_ms: c.started_ms,
2402711×
        finished_ms: c.finished_ms,
2403
    }
2404711×
}
2405
2406
/// `GET /repos/{o}/{n}/checks/required`.
24072×
async fn required_checks(
24082×
    State(app): State<Shared>,
24092×
    headers: HeaderMap,
24102×
    Path((owner, name)): Path<(String, String)>,
24112×
) -> Result<Json<RequiredChecks>, ApiError> {
24122×
    let c = caller(&app, &headers).await?;
24132×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
24142×
    Ok(Json(RequiredChecks { names: db::hooks::required_checks(&app.db, row.id).await? }))
24152×
}
2416
2417
/// `PUT /repos/{o}/{n}/checks/required` (repository admin): the whole list.
24183×
async fn set_required_checks(
24193×
    State(app): State<Shared>,
24203×
    headers: HeaderMap,
24213×
    Path((owner, name)): Path<(String, String)>,
24223×
    Json(body): Json<RequiredChecks>,
24233×
) -> Result<Json<RequiredChecks>, ApiError> {
24243×
    let c = caller(&app, &headers).await?;
24253×
    c.require("repo:admin")?;
24262×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
24275×
    let mut names: Vec<String> = body.names.iter().map(|n| n.trim().to_string()).filter(|n| !n.is_empty()).collect();
24282×
    names.sort();
24292×
    names.dedup();
24303×
    if names.len() > 32 || names.iter().any(|n| n.len() > 100 || n.contains(',')) {
24311×
        return Err(ApiError(StatusCode::BAD_REQUEST, "at most 32 check names, each under 100 characters and without commas".into()));
24321×
    }
24331×
    db::hooks::set_required_checks(&app.db, row.id, &names).await?;
24341×
    db::accounts::audit(&app.db, c.account.as_ref(), "repo.required_checks", &format!("{owner}/{name}"), &names.join(", ")).await.ok();
24351×
    Ok(Json(RequiredChecks { names }))
24363×
}
2437
243810×
fn flow_run_of(
243910×
    app: &Shared,
244010×
    row: &db::repos::RepoRow,
244110×
    r: &db::flow::Run,
244210×
    jobs: Vec<db::flow::Job>,
244310×
    queue: &[db::flow::QueueEntry],
244410×
) -> FlowRun {
2445
    FlowRun {
244610×
        queue_position: crate::flow::queue_info(queue, row.id, r.id).position.map(|p| p as i64),
244710×
        number: r.number,
244810×
        bookmark: r.bookmark.clone(),
244910×
        state: r.state.clone(),
245010×
        heads: r.head_list().into_iter().map(String::from).collect(),
245110×
        status: r.status.clone(),
245210×
        trigger: r.trigger_label(),
245310×
        actor: r.actor.clone(),
245410×
        pipeline_hash: r.pipeline_hash.clone(),
245510×
        error: r.error.clone(),
245610×
        created_ms: r.created_ms,
245710×
        finished_ms: r.finished_ms,
245810×
        url: format!("{}/{}/{}/flow/{}", app.config.base_url(), row.owner, row.name, r.number),
245910×
        jobs: jobs
246010×
            .into_iter()
246110×
            .map(|j| FlowJob {
246213×
                depends_on: j.depends_on(),
246313×
                name: j.name,
246413×
                status: j.status,
246513×
                runner: j.runner,
246613×
                exit_code: j.exit_code,
246713×
                error: j.error,
246813×
                started_ms: j.started_ms,
246913×
                finished_ms: j.finished_ms,
247013×
                log_lines: j.log_count,
247113×
                waiting: j.waiting,
247213×
                placed: j.placed,
247313×
            })
247410×
            .collect(),
2475
    }
247610×
}
2477
2478
#[derive(Deserialize)]
2479
struct RunsPage {
2480
    /// Runs numbered below this one (the next page).
2481
    before: Option<i64>,
2482
    limit: Option<i64>,
2483
}
2484
2485
/// `GET /repos/{o}/{n}/flow/runs`: newest first, `?before=N&limit=` (max 100).
24862×
async fn flow_runs(
24872×
    State(app): State<Shared>,
24882×
    headers: HeaderMap,
24892×
    Path((owner, name)): Path<(String, String)>,
24902×
    Query(q): Query<RunsPage>,
24912×
) -> Result<Json<Vec<FlowRun>>, ApiError> {
24922×
    let c = caller(&app, &headers).await?;
24932×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
24942×
    let limit = q.limit.unwrap_or(30).clamp(1, 100);
24952×
    let runs = db::flow::runs_by_number(&app.db, row.id, limit, q.before).await?;
24962×
    let queue = if runs.iter().any(|r| r.live()) { db::flow::queue(&app.db).await? } else { vec![] };
24973×
    Ok(Json(runs.iter().map(|r| flow_run_of(&app, &row, r, vec![], &queue)).collect()))
24982×
}
2499
2500
/// `GET /repos/{o}/{n}/flow/runs/{number}`: a run with its jobs.
25018×
async fn flow_run(
25028×
    State(app): State<Shared>,
25038×
    headers: HeaderMap,
25048×
    Path((owner, name, number)): Path<(String, String, i64)>,
25058×
) -> Result<Json<FlowRun>, ApiError> {
25068×
    let c = caller(&app, &headers).await?;
25078×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
25088×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
25097×
    let jobs = db::flow::jobs(&app.db, run.id).await?;
25107×
    let queue = if run.live() { db::flow::queue(&app.db).await? } else { vec![] };
25117×
    Ok(Json(flow_run_of(&app, &row, &run, jobs, &queue)))
25128×
}
2513
2514
#[derive(Deserialize)]
2515
struct LogPage {
2516
    /// Lines after this `seq`.
2517
    #[serde(default)]
2518
    after: i64,
2519
    limit: Option<i64>,
2520
}
2521
2522
/// `GET /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/log`: `?after=seq&limit=` (max 5000).
25233×
async fn flow_job_log(
25243×
    State(app): State<Shared>,
25253×
    headers: HeaderMap,
25263×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
25273×
    Query(q): Query<LogPage>,
25283×
) -> Result<Json<Vec<FlowLogLine>>, ApiError> {
25293×
    let c = caller(&app, &headers).await?;
25303×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
25313×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
25323×
    let j = db::flow::jobs(&app.db, run.id)
25333×
        .await?
25343×
        .into_iter()
25355×
        .find(|j| j.name == job)
25363×
        .ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such job".into()))?;
25372×
    let lines = db::flow::log(&app.db, j.id, q.after, q.limit.unwrap_or(1000).clamp(1, 5000)).await?;
25382×
    Ok(Json(lines.into_iter().map(|l| FlowLogLine { seq: l.seq, t: l.t, stream: l.stream, text: l.text }).collect()))
25393×
}
2540
2541
#[derive(Deserialize)]
2542
struct StartRun {
2543
    /// Default: the repository's default bookmark.
2544
    #[serde(default)]
2545
    bookmark: Option<String>,
2546
    /// A change's full hash: run the state whose only head it is, instead
2547
    /// of a bookmark's.
2548
    #[serde(default)]
2549
    change: Option<String>,
2550
    /// Only these jobs, with what they depend on (oxygenhub#130); default:
2551
    /// every job a manual run starts.
2552
    #[serde(default)]
2553
    jobs: Vec<String>,
2554
}
2555
255610×
fn started(app: &Shared, row: &db::repos::RepoRow, number: i64) -> (StatusCode, Json<serde_json::Value>) {
255710×
    let url = format!("{}/{}/{}/flow/{number}", app.config.base_url(), row.owner, row.name);
255810×
    (StatusCode::CREATED, Json(serde_json::json!({ "number": number, "url": url })))
255910×
}
2560
2561
/// `POST /repos/{o}/{n}/flow/runs` (repo:write): run a bookmark's current
2562
/// state, or one change's, without moving anything (hub spec §13.2).
256314×
async fn start_flow_run(
256414×
    State(app): State<Shared>,
256514×
    headers: HeaderMap,
256614×
    Path((owner, name)): Path<(String, String)>,
256714×
    Json(body): Json<StartRun>,
256814×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
256914×
    let c = caller(&app, &headers).await?;
257014×
    let me = c.require("repo:write")?.clone();
257113×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
257213×
    let (n, what) = match body.change.clone().filter(|c| !c.trim().is_empty()) {
25732×
        Some(change) => {
25742×
            let n = crate::flow::run_change(&app, &row, &change, &me.username, &body.jobs)
25752×
                .await
25762×
                .map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
25771×
            (n, format!("change {}", change.trim()))
2578
        }
2579
        None => {
258011×
            let bookmark = body.bookmark.unwrap_or_else(|| row.default_bookmark.clone());
2581
            (
258211×
                crate::flow::run_bookmark(&app, &row, &bookmark, &me.username, &body.jobs)
258311×
                    .await
258411×
                    .map_err(|m| ApiError(StatusCode::CONFLICT, m))?,
25858×
                bookmark,
2586
            )
2587
        }
2588
    };
25899×
    db::accounts::audit(&app.db, Some(&me), "flow.run", &format!("{owner}/{name}"), &format!("#{n} {what}")).await.ok();
25909×
    Ok(started(&app, &row, n))
259114×
}
2592
2593
/// `POST /repos/{o}/{n}/flow/runs/{number}/rerun` (repo:write).
25943×
async fn rerun_flow_run(
25953×
    State(app): State<Shared>,
25963×
    headers: HeaderMap,
25973×
    Path((owner, name, number)): Path<(String, String, i64)>,
25983×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
25993×
    let c = caller(&app, &headers).await?;
26003×
    let me = c.require("repo:write")?.clone();
26013×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
26023×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26032×
    let n = crate::flow::rerun(&app, &row, &run, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26041×
    db::accounts::audit(&app.db, Some(&me), "flow.rerun", &format!("{owner}/{name}"), &format!("#{n} of #{number}")).await.ok();
26051×
    Ok(started(&app, &row, n))
26063×
}
2607
2608
/// `POST /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/rerun` (repo:write,
2609
/// oxygenflow#31): that job again, with the jobs that depend on it, in the
2610
/// same run. Answers with how many jobs were queued.
26114×
async fn rerun_flow_job(
26124×
    State(app): State<Shared>,
26134×
    headers: HeaderMap,
26144×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26154×
) -> Result<Json<serde_json::Value>, ApiError> {
26164×
    let c = caller(&app, &headers).await?;
26174×
    let me = c.require("repo:write")?.clone();
26184×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
26194×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26204×
    let n = crate::flow::rerun_job(&app, &row, &run, &job, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26212×
    db::accounts::audit(&app.db, Some(&me), "flow.rerun", &format!("{owner}/{name}"), &format!("{job} of #{number}")).await.ok();
26222×
    Ok(Json(serde_json::json!({ "run": number, "job": job, "queued": n })))
26234×
}
2624
2625
/// `POST /repos/{o}/{n}/flow/runs/{number}/cancel` (repo:write): answers
2626
/// with the run as it now stands.
26273×
async fn cancel_flow_run(
26283×
    State(app): State<Shared>,
26293×
    headers: HeaderMap,
26303×
    Path((owner, name, number)): Path<(String, String, i64)>,
26313×
) -> Result<Json<serde_json::Value>, ApiError> {
26323×
    let c = caller(&app, &headers).await?;
26333×
    let me = c.require("repo:write")?.clone();
26342×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Write).await?;
26352×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26362×
    crate::flow::cancel(&app, &row, &run, &me.username).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26371×
    db::accounts::audit(&app.db, Some(&me), "flow.cancel", &format!("{owner}/{name}"), &format!("#{number}")).await.ok();
26381×
    Ok(Json(serde_json::json!({ "number": number, "status": "cancelled" })))
26393×
}
2640
2641
/// `GET /repos/{o}/{n}/deployments`: deployments, newest first
2642
/// (oxygenflow#59).
26431×
async fn list_deployments(
26441×
    State(app): State<Shared>,
26451×
    headers: HeaderMap,
26461×
    Path((owner, name)): Path<(String, String)>,
26471×
) -> Result<Json<Vec<serde_json::Value>>, ApiError> {
26481×
    let c = caller(&app, &headers).await?;
26491×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
26501×
    let list = db::flow::deployments(&app.db, row.id, 100).await?;
2651
    Ok(Json(
26521×
        list.into_iter()
26531×
            .map(|d| {
26541×
                serde_json::json!({ "environment": d.environment, "job": d.job, "run": d.run_number, "state": d.state,
26551×
                    "bookmark": d.bookmark, "actor": d.actor, "approved_by": d.approved_by, "finished_ms": d.finished_ms })
26561×
            })
26571×
            .collect(),
2658
    ))
26591×
}
2660
2661
/// `POST /repos/{o}/{n}/flow/runs/{number}/jobs/{job}/approve` and
2662
/// `.../reject` (oxygenflow#57): the job's approval rules decide who may.
26630×
async fn approve_flow_job(
26640×
    State(app): State<Shared>,
26650×
    headers: HeaderMap,
26660×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26670×
) -> Result<Json<serde_json::Value>, ApiError> {
26680×
    decide_flow_job(&app, &headers, &owner, &name, number, &job, true).await
26690×
}
2670
26712×
async fn reject_flow_job(
26722×
    State(app): State<Shared>,
26732×
    headers: HeaderMap,
26742×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26752×
) -> Result<Json<serde_json::Value>, ApiError> {
26762×
    decide_flow_job(&app, &headers, &owner, &name, number, &job, false).await
26772×
}
2678
2679
/// `GET .../flow/runs/{n}/jobs/{job}/approval`: what approving the job
2680
/// means, for `oxy seal --flow` to sign (oxygenhub#235).
26811×
async fn flow_job_statement(
26821×
    State(app): State<Shared>,
26831×
    headers: HeaderMap,
26841×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
26851×
) -> Result<Json<serde_json::Value>, ApiError> {
26861×
    let c = caller(&app, &headers).await?;
26871×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
26881×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
26891×
    let (s, j) = crate::flow::approval_statement(&app, &row, &run, &job).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
26901×
    Ok(Json(serde_json::json!({
26911×
        "repo": hex::encode(s.repo),
26921×
        "run": s.run,
26931×
        "job": s.job,
26941×
        "job_hash": s.job_hash.to_hex(),
26951×
        "state": s.state.to_hex(),
26961×
        "inputs": s.inputs.iter().map(|i| i.to_hex()).collect::<Vec<_>>(),
26971×
        "environment": s.environment,
26981×
        "waiting": j.approval == "waiting" && j.status == "queued",
2699
    })))
27001×
}
2701
2702
#[derive(Deserialize)]
2703
struct SealBody {
2704
    signed: String,
2705
}
2706
2707
/// `POST .../flow/runs/{n}/jobs/{job}/seal` `{"signed": hex}`: approve or
2708
/// reject with a signed approval (oxygenhub#235). The signature, not the
2709
/// caller, says who decided; the caller must be signed in.
27104×
async fn seal_flow_job(
27114×
    State(app): State<Shared>,
27124×
    headers: HeaderMap,
27134×
    Path((owner, name, number, job)): Path<(String, String, i64, String)>,
27144×
    Json(body): Json<SealBody>,
27154×
) -> Result<Json<serde_json::Value>, ApiError> {
27164×
    let c = caller(&app, &headers).await?;
27174×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
27184×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
27194×
    let said = crate::flow::decide_sealed(&app, &row, &run, &job, &body.signed).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
27201×
    Ok(Json(serde_json::json!({ "number": number, "job": job, "said": said })))
27214×
}
2722
27232×
async fn decide_flow_job(
27242×
    app: &Shared,
27252×
    headers: &HeaderMap,
27262×
    owner: &str,
27272×
    name: &str,
27282×
    number: i64,
27292×
    job: &str,
27302×
    approve: bool,
27312×
) -> Result<Json<serde_json::Value>, ApiError> {
27322×
    let c = caller(app, headers).await?;
27332×
    let me = c.require("repo:write")?.clone();
27342×
    let (_, row, _) = reach(app, &c, owner, name, Access::Read).await?;
27352×
    let run = db::flow::run(&app.db, row.id, number).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, "no such run".into()))?;
27362×
    let via = c.agent.then_some(c.token.as_str());
27372×
    let said = crate::flow::decide(app, &row, &run, job, &me, approve, via).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;
27381×
    Ok(Json(serde_json::json!({ "number": number, "job": job, "decision": if approve { "approved" } else { "rejected" }, "said": said })))
27392×
}
2740
2741
/// `POST /repos/{o}/{n}/checks`: any `checks:write` (or write) token may
2742
/// report; the state hash names what was checked.
27433×
async fn post_check(
27443×
    State(app): State<Shared>,
27453×
    headers: HeaderMap,
27463×
    Path((owner, name)): Path<(String, String)>,
27473×
    Json(body): Json<NewCheck>,
27483×
) -> Result<(StatusCode, Json<Check>), ApiError> {
27493×
    let c = caller(&app, &headers).await?;
27503×
    let me = c.require("checks:write").or_else(|_| c.require("repo:write"))?.clone();
27512×
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
2752128×
    if body.state.len() != 64 || !body.state.chars().all(|ch| ch.is_ascii_hexdigit()) {
27530×
        return Err(ApiError(StatusCode::BAD_REQUEST, "state is a 64-character hex state hash".into()));
27542×
    }
27552×
    if body.name.trim().is_empty() || body.name.len() > 100 {
27560×
        return Err(ApiError(StatusCode::BAD_REQUEST, "a check has a short name".into()));
27572×
    }
27582×
    let ch = db::hooks::upsert_check(
27592×
        &app.db,
27602×
        row.id,
27612×
        db::hooks::CheckReport {
27622×
            state: &body.state,
27632×
            name: body.name.trim(),
27642×
            status: body.status.as_str(),
27652×
            summary: &body.summary,
27662×
            url: &body.url,
27672×
            reporter: Some((me.id, &me.username)),
27682×
            seal: body.seal.as_deref().unwrap_or(""),
27692×
        },
27702×
    )
27712×
    .await?;
27722×
    let api = check_of(&ch);
27732×
    app.bus.proposal(row.id, ProposalEvent { number: 0, kind: "check".into(), check: Some(api.clone()) });
27742×
    crate::hooks::emit(&app, &row, "check", &me.username, serde_json::json!({ "check": api })).await;
27752×
    Ok((StatusCode::CREATED, Json(api)))
27763×
}
2777
27784×
async fn checks_for_state(
27794×
    State(app): State<Shared>,
27804×
    headers: HeaderMap,
27814×
    Path((owner, name, state)): Path<(String, String, String)>,
27824×
) -> Result<Json<Vec<Check>>, ApiError> {
27834×
    let c = caller(&app, &headers).await?;
27844×
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
27854×
    let state = state_key(&app, &repo, &state).await?;
27863×
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &state).await?.iter().map(check_of).collect()))
27874×
}
2788
2789
/// The state hash checks are keyed by, from what a client has: a state
2790
/// hash, its heads (full change hashes joined with `+`, or the one head of
2791
/// a single-head state, which is what `oxy log` shows), or a bookmark.
27924×
async fn state_key(app: &Shared, repo: &RepoName, s: &str) -> Result<String, ApiError> {
2793
    use oxy_core::hash::{hash_object, ChangeHash, ObjectType};
27944×
    let hexes: Vec<&str> = s.split('+').collect();
2795128×
    let all_hashes = hexes.iter().all(|h| h.len() == 64 && h.bytes().all(|b| b.is_ascii_hexdigit()));
27964×
    if all_hashes {
27972×
        let row = db::repos::get(&app.db, &repo.owner, &repo.name).await?.ok_or_else(|| not_found("no such repository"))?;
27982×
        if hexes.len() == 1 && !db::hooks::checks_for_state(&app.db, row.id, s).await?.is_empty() {
27991×
            return Ok(s.to_string());
28001×
        }
28011×
        let heads: Vec<ChangeHash> = hexes.iter().filter_map(|h| ChangeHash::from_hex(h)).collect();
28021×
        return Ok(hash_object(ObjectType::State, &oxy_core::objects::StateObject::new(heads).encode()).to_hex());
28032×
    }
28042×
    let b = s.to_string();
28052×
    let found = app.repos.read(repo, move |r, _| Ok(r.view()?.bookmarks.get(&b).copied())).await?;
28062×
    found.map(|st| st.to_hex()).ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("{s:?} is not a state hash, heads or a bookmark")))
28074×
}
2808
2809
// ----------------------------------------------------------------- runners
2810
2811
/// Site administrators only, with any token of theirs (hub spec §13.2).
281213×
fn require_site_admin(c: &Caller) -> Result<&Account, ApiError> {
281313×
    match c.account.as_ref() {
281412×
        Some(a) if a.is_admin => Ok(a),
28151×
        _ => Err(not_found("no such API route")),
2816
    }
281713×
}
2818
2819
/// `GET /api/v1/admin/runner-updates` (oxygenhub#322, #326).
28203×
async fn runner_updates(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<RunnerUpdates>, ApiError> {
28213×
    let c = caller(&app, &headers).await?;
28222×
    require_site_admin(&c)?;
2823
    use crate::web::runner_updates::{views, Reach};
28242×
    let v = views(&app, &Reach::Site).await?;
28252×
    let setting = |p: &crate::web::runner_updates::PolicyView| UpdateSetting {
28268×
        scope: p.scope.clone(),
28278×
        key: p.key.clone(),
28288×
        updates: match p.updates {
28298×
            "on" => Some(true),
28304×
            "off" => Some(false),
28312×
            _ => None,
2832
        },
28338×
        channel: Some(p.channel.clone()).filter(|c| !c.is_empty()),
28348×
        window: Some(p.window.clone()).filter(|w| !w.is_empty()),
28358×
        dry_run: match p.dry_run {
28368×
            "on" => Some(true),
28375×
            "off" => Some(false),
28385×
            _ => None,
2839
        },
28408×
    };
28412×
    let mut settings = vec![setting(&v.site)];
28422×
    settings.extend(v.owners.iter().map(setting));
28432×
    settings.extend(v.groups.iter().map(|g| setting(&g.policy)));
28444×
    settings.extend(v.runners.iter().map(|r| setting(&r.policy)));
28458×
    settings.retain(|s| s.scope == "site" || s.updates.is_some() || s.channel.is_some() || s.window.is_some() || s.dry_run.is_some());
2846
    Ok(Json(RunnerUpdates {
28472×
        repo: db::accounts::setting(&app.db, crate::runner_updates::SETTING_REPO).await?.unwrap_or_default(),
28482×
        settings,
28492×
        groups: v
28502×
            .groups
28512×
            .iter()
28522×
            .map(|g| RunnerGroup {
28532×
                id: g.g.id,
28542×
                owner: g.g.owner.clone(),
28552×
                name: g.g.name.clone(),
28562×
                percent: g.g.percent,
28572×
                members: g.members.clone(),
28582×
            })
28592×
            .collect(),
28602×
        runners: v
28612×
            .runners
28622×
            .iter()
28632×
            .map(|r| RunnerUpdate {
28644×
                id: r.r.id,
28654×
                name: r.r.name.clone(),
28664×
                owner: r.r.scope_owner.clone(),
28674×
                version: r.r.version.clone(),
28684×
                groups: r.groups.clone(),
28694×
                updates: r.effective.updates,
28704×
                channel: r.effective.channel.clone(),
28714×
                window: r.effective.window.map(|(a, b)| format!("{a:02}-{b:02}")),
28724×
                dry_run: r.effective.dry_run,
28734×
                from: r.effective.from.clone(),
28744×
                now: r.offer.clone(),
28754×
                said: r.r.update_note.clone(),
28764×
            })
28772×
            .collect(),
28782×
        holds: db::runner_updates::holds(&app.db)
28792×
            .await?
28802×
            .into_iter()
28812×
            .map(|h| HeldBuild { version: h.version, runner: h.runner, why: h.why, at_ms: h.at_ms })
28822×
            .collect(),
2883
    }))
28843×
}
2885
2886
/// `PUT /api/v1/admin/runner-updates/settings`: one level's settings; what
2887
/// it set, in words, or 422 saying what is wrong.
28882×
async fn runner_update_setting(
28892×
    State(app): State<Shared>,
28902×
    headers: HeaderMap,
28912×
    Json(u): Json<UpdateSetting>,
28922×
) -> Result<Json<serde_json::Value>, ApiError> {
28932×
    let c = caller(&app, &headers).await?;
28942×
    let me = require_site_admin(&c)?.clone();
2895
    use crate::web::runner_updates::{apply_policy, PolicyForm, Reach};
28962×
    match apply_policy(&app, &me, &Reach::Site, &PolicyForm::of(&u)).await? {
28971×
        Ok(notice) => Ok(Json(serde_json::json!({ "notice": notice }))),
28981×
        Err(why) => Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, why)),
2899
    }
29002×
}
2901
2902
/// `POST /api/v1/admin/runner-updates/holds/{version}/lift` (#326).
29031×
async fn runner_update_lift(State(app): State<Shared>, headers: HeaderMap, Path(version): Path<String>) -> Result<StatusCode, ApiError> {
29041×
    let c = caller(&app, &headers).await?;
29051×
    let me = require_site_admin(&c)?.clone();
29061×
    if !db::runner_updates::lift(&app.db, &version).await? {
29071×
        return Err(not_found("that build is not held"));
29080×
    }
29090×
    db::accounts::audit(&app.db, Some(&me), "runner.update.lifted", &version, "offered again").await.ok();
29100×
    Ok(StatusCode::NO_CONTENT)
29111×
}
2912
29135×
async fn runner_of(app: &Shared, r: db::runners::Runner, running: i64) -> hub_api::Runner {
29145×
    let serves = match r.scope_repo_id {
29150×
        Some(id) => db::repos::get_by_id(&app.db, id).await.ok().flatten().map(|p| p.slug()).unwrap_or_default(),
29165×
        None => r.scope_owner.clone(),
2917
    };
29185×
    hub_api::Runner {
29195×
        id: r.id,
29205×
        status: r.status().to_string(),
29215×
        serves,
29225×
        labels: r.label_list().into_iter().map(String::from).collect(),
29235×
        name: r.name,
29245×
        arch: r.arch,
29255×
        os: r.os,
29265×
        version: r.version,
29275×
        max_jobs: r.max_jobs,
29285×
        memory_mib: r.memory_mib,
29295×
        cpus: r.cpus,
29305×
        key: r.key,
29315×
        source: r.source,
29325×
        last_seen_ms: r.last_seen_ms,
29335×
        running,
29345×
        free_disk_mib: r.free_disk_mib,
29355×
        load_x100: r.load_x100,
29365×
        speed: r.speed,
29375×
        speed_class: r.speed_class,
29385×
        kernel: r.kernel,
29395×
    }
29405×
}
2941
2942
/// `GET /api/v1/runners`.
29434×
async fn runners(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::Runner>>, ApiError> {
29444×
    let c = caller(&app, &headers).await?;
29454×
    require_site_admin(&c)?;
29463×
    let running: std::collections::HashMap<i64, i64> = db::runners::running(&app.db).await?.into_iter().collect();
29473×
    let mut out = Vec::new();
29485×
    for r in db::runners::list(&app.db).await? {
29495×
        let n = running.get(&r.id).copied().unwrap_or(0);
29505×
        out.push(runner_of(&app, r, n).await);
2951
    }
29523×
    Ok(Json(out))
29534×
}
2954
2955
#[derive(Deserialize)]
2956
struct BeforeQuery {
2957
    #[serde(default)]
2958
    before: Option<i64>,
2959
    #[serde(default)]
2960
    limit: Option<i64>,
2961
}
2962
2963
/// `GET /api/v1/runners/{id}/jobs?before=MS&limit=N`: newest first.
29641×
async fn runner_jobs(
29651×
    State(app): State<Shared>,
29661×
    headers: HeaderMap,
29671×
    Path(id): Path<i64>,
29681×
    Query(q): Query<BeforeQuery>,
29691×
) -> Result<Json<Vec<hub_api::RunnerJob>>, ApiError> {
29701×
    let c = caller(&app, &headers).await?;
29711×
    require_site_admin(&c)?;
29721×
    db::runners::get(&app.db, id).await?.ok_or_else(|| not_found("no such runner"))?;
29731×
    let jobs = db::runners::history(&app.db, id, q.limit.unwrap_or(50).clamp(1, 200), q.before).await?;
2974
    Ok(Json(
29751×
        jobs.into_iter()
29761×
            .map(|j| hub_api::RunnerJob {
29771×
                repo: format!("{}/{}", j.owner, j.repo),
29781×
                run: j.run_number,
29791×
                job: j.job,
29801×
                status: j.status,
29811×
                started_ms: j.started_ms,
29821×
                finished_ms: j.finished_ms,
29831×
            })
29841×
            .collect(),
2985
    ))
29861×
}
2987
2988
/// `GET /api/v1/runners/queue`: running jobs, then queued ones in claim order.
29891×
async fn runner_queue(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<hub_api::QueueItem>>, ApiError> {
29901×
    let c = caller(&app, &headers).await?;
29911×
    require_site_admin(&c)?;
2992
    Ok(Json(
29931×
        db::flow::queue(&app.db)
29941×
            .await?
29951×
            .into_iter()
29961×
            .map(|e| hub_api::QueueItem {
29973×
                repo: format!("{}/{}", e.owner, e.name),
29983×
                run: e.run_number,
29993×
                job: e.job,
30003×
                status: e.status,
30013×
                runner: e.runner,
30023×
            })
30031×
            .collect(),
3004
    ))
30051×
}
3006
3007
/// `POST .../proposals/{number}/review-requests`: ask an AI assistant the
3008
/// repository may use to review (hub spec §13.4). Accepted at once; the
3009
/// answer arrives as a `comment` review via the assistant.
30100×
async fn request_assistant(
30110×
    State(app): State<Shared>,
30120×
    headers: HeaderMap,
30130×
    Path((owner, name, number)): Path<(String, String, i64)>,
30140×
    Json(body): Json<hub_api::AssistantRequest>,
30150×
) -> Result<(StatusCode, Json<hub_api::AssistantRequest>), ApiError> {
30160×
    let c = caller(&app, &headers).await?;
30170×
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
30180×
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
30190×
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
30200×
    if Some(me.id) != p.author_id && role < Role::Write {
30210×
        return Err(forbidden("only the author or a writer asks for reviews"));
30220×
    }
30230×
    if !p.is_open() {
30240×
        return Err(ApiError(StatusCode::CONFLICT, "the proposal is not open".into()));
30250×
    }
30260×
    let a = crate::assistants::enabled_for_repo(&app.db, &row)
30270×
        .await?
30280×
        .into_iter()
30290×
        .find(|a| a.name.eq_ignore_ascii_case(body.assistant.trim()))
30300×
        .ok_or_else(|| ApiError(StatusCode::UNPROCESSABLE_ENTITY, format!("no assistant called {} here", body.assistant.trim())))?;
30310×
    let asked = hub_api::AssistantRequest { assistant: a.name.clone() };
30320×
    crate::assistants::request_review(&app, &row, &p, &me, a).await.map_err(|e| ApiError(StatusCode::CONFLICT, e))?;
30330×
    Ok((StatusCode::ACCEPTED, Json(asked)))
30340×
}
3035
3036
// -------------------------------------------------------- assistants (§13.4)
3037
3038
use crate::levels::At;
3039
use crate::web::assistants as aa;
3040
3041
/// The level a repository's assistants live at, for its admins (repo:admin).
30428×
async fn repo_level(app: &Shared, c: &Caller, owner: &str, name: &str) -> Result<(Account, At), ApiError> {
30438×
    let me = c.require("repo:admin")?.clone();
30447×
    let (_, row, _) = reach(app, c, owner, name, Access::Admin).await?;
30457×
    Ok((me, At::repo(&row)))
30468×
}
3047
3048
/// An organisation's level, for its owners (repo:admin).
30490×
async fn org_level(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {
30500×
    let me = c.require("repo:admin")?.clone();
30510×
    let o = db::accounts::org_by_name(&app.db, org).await?.ok_or_else(|| not_found("no such organisation"))?;
30520×
    if !auth::roles::is_org_owner(&app.db, &me, o.id).await? {
30530×
        return Err(not_found("no such organisation"));
30540×
    }
30550×
    Ok((me, At::org(&o)))
30560×
}
3057
3058
/// The site's level, for its administrators.
30592×
fn site_level(c: &Caller) -> Result<(Account, At), ApiError> {
30602×
    Ok((require_site_admin(c)?.clone(), At::site()))
30612×
}
3062
30633×
fn put_outcome(r: Result<String, String>) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
30643×
    match r {
30653×
        Ok(msg) => Ok((StatusCode::OK, Json(serde_json::json!({ "ok": msg })))),
30660×
        Err(e) => Err(ApiError(StatusCode::UNPROCESSABLE_ENTITY, e)),
3067
    }
30683×
}
3069
3070
macro_rules! assistant_routes {
3071
    ($list:ident, $put:ident, $del:ident, $prompt:ident, $prompt_put:ident, ($($p:ident: $t:ty),*), $level:expr) => {
30722×
        async fn $list(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<Vec<Assistant>>, ApiError> {
30732×
            let c = caller(&app, &headers).await?;
30742×
            let (_, at) = $level(&app, &c, $(&$p),*).await?;
30752×
            Ok(Json(aa::api_list(&app, &at).await?))
30762×
        }
30773×
        async fn $put(
30783×
            State(app): State<Shared>,
30793×
            headers: HeaderMap,
30803×
            Path(($($p),*)): Path<($($t),*)>,
30813×
            Json(body): Json<NewAssistant>,
30823×
        ) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
30833×
            let c = caller(&app, &headers).await?;
30843×
            let (me, at) = $level(&app, &c, $(&$p),*).await?;
30852×
            put_outcome(aa::api_put(&app, &me, &at, body).await?)
30863×
        }
30870×
        async fn $prompt(State(app): State<Shared>, headers: HeaderMap, Path(($($p),*)): Path<($($t),*)>) -> Result<Json<AssistantPrompt>, ApiError> {
30880×
            let c = caller(&app, &headers).await?;
30890×
            let (_, at) = $level(&app, &c, $(&$p),*).await?;
30900×
            Ok(Json(aa::api_prompt(&app, &at).await?))
30910×
        }
30921×
        async fn $prompt_put(
30931×
            State(app): State<Shared>,
30941×
            headers: HeaderMap,
30951×
            Path(($($p),*)): Path<($($t),*)>,
30961×
            Json(body): Json<AssistantPrompt>,
30971×
        ) -> Result<Json<AssistantPrompt>, ApiError> {
30981×
            let c = caller(&app, &headers).await?;
30991×
            let (me, at) = $level(&app, &c, $(&$p),*).await?;
31001×
            aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
31011×
            Ok(Json(aa::api_prompt(&app, &at).await?))
31021×
        }
3103
    };
3104
}
3105
3106
assistant_routes!(repo_assistants, repo_assistant_put, _rd, repo_prompt, repo_prompt_put, (owner: String, name: String), repo_level);
3107
31082×
async fn repo_assistant_delete(
31092×
    State(app): State<Shared>,
31102×
    headers: HeaderMap,
31112×
    Path((owner, name, assistant)): Path<(String, String, String)>,
31122×
) -> Result<StatusCode, ApiError> {
31132×
    let c = caller(&app, &headers).await?;
31142×
    let (me, at) = repo_level(&app, &c, &owner, &name).await?;
31152×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
31161×
        Ok(StatusCode::NO_CONTENT)
3117
    } else {
31181×
        Err(not_found("no such assistant at this level"))
3119
    }
31202×
}
3121
31220×
async fn org_level_one(app: &Shared, c: &Caller, org: &str) -> Result<(Account, At), ApiError> {
31230×
    org_level(app, c, org).await
31240×
}
3125
31260×
async fn org_assistants(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<Vec<Assistant>>, ApiError> {
31270×
    let c = caller(&app, &headers).await?;
31280×
    let (_, at) = org_level_one(&app, &c, &org).await?;
31290×
    Ok(Json(aa::api_list(&app, &at).await?))
31300×
}
3131
31320×
async fn org_assistant_put(
31330×
    State(app): State<Shared>,
31340×
    headers: HeaderMap,
31350×
    Path(org): Path<String>,
31360×
    Json(body): Json<NewAssistant>,
31370×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
31380×
    let c = caller(&app, &headers).await?;
31390×
    let (me, at) = org_level_one(&app, &c, &org).await?;
31400×
    put_outcome(aa::api_put(&app, &me, &at, body).await?)
31410×
}
3142
31430×
async fn org_assistant_delete(
31440×
    State(app): State<Shared>,
31450×
    headers: HeaderMap,
31460×
    Path((org, assistant)): Path<(String, String)>,
31470×
) -> Result<StatusCode, ApiError> {
31480×
    let c = caller(&app, &headers).await?;
31490×
    let (me, at) = org_level_one(&app, &c, &org).await?;
31500×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
31510×
        Ok(StatusCode::NO_CONTENT)
3152
    } else {
31530×
        Err(not_found("no such assistant at this level"))
3154
    }
31550×
}
3156
31570×
async fn org_prompt(State(app): State<Shared>, headers: HeaderMap, Path(org): Path<String>) -> Result<Json<AssistantPrompt>, ApiError> {
31580×
    let c = caller(&app, &headers).await?;
31590×
    let (_, at) = org_level_one(&app, &c, &org).await?;
31600×
    Ok(Json(aa::api_prompt(&app, &at).await?))
31610×
}
3162
31630×
async fn org_prompt_put(
31640×
    State(app): State<Shared>,
31650×
    headers: HeaderMap,
31660×
    Path(org): Path<String>,
31670×
    Json(body): Json<AssistantPrompt>,
31680×
) -> Result<Json<AssistantPrompt>, ApiError> {
31690×
    let c = caller(&app, &headers).await?;
31700×
    let (me, at) = org_level_one(&app, &c, &org).await?;
31710×
    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
31720×
    Ok(Json(aa::api_prompt(&app, &at).await?))
31730×
}
3174
31750×
async fn site_assistants(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Assistant>>, ApiError> {
31760×
    let c = caller(&app, &headers).await?;
31770×
    let (_, at) = site_level(&c)?;
31780×
    Ok(Json(aa::api_list(&app, &at).await?))
31790×
}
3180
31811×
async fn site_assistant_put(
31821×
    State(app): State<Shared>,
31831×
    headers: HeaderMap,
31841×
    Json(body): Json<NewAssistant>,
31851×
) -> Result<(StatusCode, Json<serde_json::Value>), ApiError> {
31861×
    let c = caller(&app, &headers).await?;
31871×
    let (me, at) = site_level(&c)?;
31881×
    put_outcome(aa::api_put(&app, &me, &at, body).await?)
31891×
}
3190
31910×
async fn site_assistant_delete(
31920×
    State(app): State<Shared>,
31930×
    headers: HeaderMap,
31940×
    Path(assistant): Path<String>,
31950×
) -> Result<StatusCode, ApiError> {
31960×
    let c = caller(&app, &headers).await?;
31970×
    let (me, at) = site_level(&c)?;
31980×
    if aa::api_delete(&app, &me, &at, &assistant).await? {
31990×
        Ok(StatusCode::NO_CONTENT)
3200
    } else {
32010×
        Err(not_found("no such assistant at this level"))
3202
    }
32030×
}
3204
32050×
async fn site_prompt(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<AssistantPrompt>, ApiError> {
32060×
    let c = caller(&app, &headers).await?;
32070×
    let (_, at) = site_level(&c)?;
32080×
    Ok(Json(aa::api_prompt(&app, &at).await?))
32090×
}
3210
32111×
async fn site_prompt_put(
32121×
    State(app): State<Shared>,
32131×
    headers: HeaderMap,
32141×
    Json(body): Json<AssistantPrompt>,
32151×
) -> Result<Json<AssistantPrompt>, ApiError> {
32161×
    let c = caller(&app, &headers).await?;
32171×
    let (me, at) = site_level(&c)?;
32181×
    aa::api_set_prompt(&app, &me, &at, &body.prompt).await?.map_err(|e| ApiError(StatusCode::UNPROCESSABLE_ENTITY, e))?;
32191×
    Ok(Json(aa::api_prompt(&app, &at).await?))
32201×
}