OXYGENHUB
# 3f02e5ea4f2d oxygenhub / crates / hub / src / api / mod.rs
43.3 KiB · Rust · last changed API: a proposal's files and each side's bytes 1 month ago source blame history raw
b64e2537 Andy McCall ↶ 1 
//! The JSON API (hub spec §12.1) under `/api/v1`: bearer tokens, RFC 7807
2 
//! problems, the same shapes as `oxy --json` where one exists. Reads need
3 
//! `repo:read` (anonymous for public repositories); writes the scope named
4 
//! on each handler.
d23464c0 Andy McCall ↶ 5
b64e2537 Andy McCall ↶ 6 
use crate::auth::{self, Access, Role};
7 
use crate::db::{self, accounts::Account};
d23464c0 Andy McCall ↶ 8 
use crate::repos::{view, RepoError, RepoName};
b64e2537 Andy McCall ↶ 9 
use crate::Shared;
10 
use axum::extract::{Path, Query, State};
11 
use axum::http::{HeaderMap, StatusCode};
d23464c0 Andy McCall ↶ 12 
use axum::response::{IntoResponse, Response};
b64e2537 Andy McCall ↶ 13 
use axum::routing::{get, post};
d23464c0 Andy McCall ↶ 14 
use axum::{Json, Router};
b64e2537 Andy McCall ↶ 15 
use hub_api::*;
16 
use serde::Deserialize;
d23464c0 Andy McCall ↶ 17
18 
pub fn router() -> Router<Shared> {
19 
    Router::new()
b64e2537 Andy McCall ↶ 20 
        .route("/user", get(me))
21 
        .route("/users/{name}", get(user))
22 
        .route("/orgs/{name}", get(org))
23 
        .route("/search", get(search))
24 
        .route("/repos", get(list_repos).post(create_repo))
d23464c0 Andy McCall ↶ 25 
        .route("/repos/{owner}/{name}", get(get_repo))
26 
        .route("/repos/{owner}/{name}/bookmarks", get(bookmarks))
27 
        .route("/repos/{owner}/{name}/tags", get(tags))
b64e2537 Andy McCall ↶ 28 
        .route("/repos/{owner}/{name}/history/{r}", get(history))
29 
        .route("/repos/{owner}/{name}/changes/{hash}", get(change))
30 
        .route("/repos/{owner}/{name}/tree/{r}", get(tree_root))
31 
        .route("/repos/{owner}/{name}/tree/{r}/{*path}", get(tree))
32 
        .route("/repos/{owner}/{name}/file/{r}/{*path}", get(file))
33 
        .route("/repos/{owner}/{name}/blame/{r}/{*path}", get(blame))
34 
        .route("/repos/{owner}/{name}/conflicts", get(conflicts))
35 
        .route("/repos/{owner}/{name}/trust", get(trust))
36 
        .route("/repos/{owner}/{name}/pushes", get(pushes))
37 
        .route("/repos/{owner}/{name}/proposals", get(proposals).post(create_proposal))
de505df5 Andy McCall ↶ 38 
        .route("/repos/{owner}/{name}/proposals/{number}", get(proposal))
b64e2537 Andy McCall ↶ 39 
        .route("/repos/{owner}/{name}/proposals/{number}/comments", get(proposal_comments).post(proposal_comment))
40 
        .route("/repos/{owner}/{name}/proposals/{number}/reviews", get(proposal_reviews).post(proposal_review))
41 
        .route("/repos/{owner}/{name}/proposals/{number}/checks", get(proposal_checks))
3f02e5ea Andy McCall ↶ 42 
        .route("/repos/{owner}/{name}/proposals/{number}/files", get(proposal_files))
43 
        .route("/repos/{owner}/{name}/proposals/{number}/content/{side}/{*path}", get(proposal_content))
b64e2537 Andy McCall ↶ 44 
        .route("/repos/{owner}/{name}/issues", get(issues).post(create_issue))
45 
        .route("/repos/{owner}/{name}/issues/{number}", get(issue).post(issue_state))
46 
        .route("/repos/{owner}/{name}/issues/{number}/comments", get(issue_comments).post(issue_comment))
47 
        .route("/repos/{owner}/{name}/labels", get(labels))
48 
        .route("/repos/{owner}/{name}/milestones", get(milestones))
49 
        .route("/repos/{owner}/{name}/hooks", get(hooks).post(create_hook))
50 
        .route("/repos/{owner}/{name}/hooks/{id}/delete", post(delete_hook))
51 
        .route("/repos/{owner}/{name}/checks", post(post_check))
52 
        .route("/repos/{owner}/{name}/checks/{state}", get(checks_for_state))
de505df5 Andy McCall ↶ 53 
}
54
b64e2537 Andy McCall ↶ 55 
pub struct ApiError(StatusCode, String);
56
57 
impl IntoResponse for ApiError {
58 
    fn into_response(self) -> Response {
59 
        let body = Problem { status: self.0.as_u16(), title: self.0.canonical_reason().unwrap_or("error").into(), detail: self.1 };
60 
        (self.0, [("content-type", "application/problem+json")], Json(body)).into_response()
de505df5 Andy McCall ↶ 61 
    }
b64e2537 Andy McCall ↶ 62 
}
63
64 
impl From<RepoError> for ApiError {
65 
    fn from(e: RepoError) -> ApiError {
66 
        match e {
67 
            RepoError::NotFound => not_found("no such repository"),
68 
            RepoError::Oxy(oxy_core::repo::RepoError::Msg(m)) => ApiError(StatusCode::NOT_FOUND, m),
69 
            other => ApiError(StatusCode::INTERNAL_SERVER_ERROR, other.to_string()),
70 
        }
71 
    }
72 
}
73
74 
impl From<sqlx::Error> for ApiError {
75 
    fn from(e: sqlx::Error) -> ApiError {
76 
        ApiError(StatusCode::INTERNAL_SERVER_ERROR, e.to_string())
77 
    }
78 
}
79
80 
fn not_found(what: &str) -> ApiError {
81 
    ApiError(StatusCode::NOT_FOUND, what.into())
82 
}
83
84 
fn forbidden(what: &str) -> ApiError {
85 
    ApiError(StatusCode::FORBIDDEN, what.into())
86 
}
87
88 
/// Who calls: the account behind a bearer token, with the token's scopes.
89 
pub struct Caller {
90 
    pub account: Option<Account>,
91 
    pub scopes: Vec<String>,
92 
    pub site: bool,
93 
}
94
95 
impl Caller {
96 
    fn has(&self, scope: &str) -> bool {
97 
        self.site
98 
            || self.scopes.iter().any(|s| {
99 
                s == scope
100 
                    || (scope == "repo:read" && (s == "repo:write" || s == "repo:admin"))
101 
                    || (scope == "repo:write" && s == "repo:admin")
102 
            })
103 
    }
104
105 
    fn require(&self, scope: &str) -> Result<&Account, ApiError> {
106 
        if !self.has(scope) {
107 
            return Err(forbidden(&format!("this token lacks the {scope} scope")));
108 
        }
109 
        self.account.as_ref().ok_or_else(|| ApiError(StatusCode::UNAUTHORIZED, "a personal access token is required".into()))
110 
    }
111 
}
112
113 
pub async fn caller(app: &Shared, headers: &HeaderMap) -> Result<Caller, ApiError> {
114 
    let Some(t) = oxy_server::bearer_token(headers) else { return Ok(Caller { account: None, scopes: vec![], site: false }) };
115 
    if app.config.auth.push_tokens.iter().any(|x| auth::mac_equal(x, t)) {
116 
        let admin = db::accounts::accounts(&app.db).await?.into_iter().find(|a| a.is_admin);
117 
        return Ok(Caller { account: admin, scopes: vec!["repo:admin".into(), "user:read".into(), "checks:write".into()], site: true });
118 
    }
119 
    let token = db::accounts::token_by_hash(&app.db, &auth::token_hash(t)).await?;
de505df5 Andy McCall ↶ 120 
    match token {
b64e2537 Andy McCall ↶ 121 
        Some(tok) if !tok.expired(db::now_ms()) => {
122 
            let account = db::accounts::account_by_id(&app.db, tok.account_id).await?.filter(|a| !a.banned);
123 
            db::accounts::touch_token(&app.db, tok.id).await.ok();
124 
            Ok(Caller { account, scopes: tok.scope_list().iter().map(|s| s.to_string()).collect(), site: false })
125 
        }
de505df5 Andy McCall ↶ 126 
        _ => Err(ApiError(StatusCode::UNAUTHORIZED, "unknown or expired token".into())),
127 
    }
128 
}
129
b64e2537 Andy McCall ↶ 130 
fn repository(app: &Shared, r: &db::repos::RepoRow) -> Repository {
131 
    Repository {
132 
        owner: r.owner.clone(),
133 
        name: r.name.clone(),
134 
        description: r.description.clone(),
135 
        default_bookmark: r.default_bookmark.clone(),
136 
        visibility: r.visibility(),
137 
        created_ms: r.created_ms,
138 
        updated_ms: r.updated_ms,
139 
        clone_url: format!("{}/{}/{}", app.config.base_url(), r.owner, r.name),
140 
    }
141 
}
142
143 
/// A repository the caller may reach with `access`, else 404.
144 
async fn reach(
de505df5 Andy McCall ↶ 145 
    app: &Shared,
b64e2537 Andy McCall ↶ 146 
    c: &Caller,
de505df5 Andy McCall ↶ 147 
    owner: &str,
148 
    name: &str,
b64e2537 Andy McCall ↶ 149 
    access: Access,
150 
) -> Result<(RepoName, db::repos::RepoRow, Role), ApiError> {
151 
    let repo = RepoName::new(owner, name).ok_or_else(|| not_found("no such repository"))?;
152 
    let row = db::repos::get(&app.db, owner, name).await?.ok_or_else(|| not_found("no such repository"))?;
153 
    let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
154 
    if !auth::roles::allows(role, access) {
155 
        return Err(not_found("no such repository"));
156 
    }
157 
    Ok((repo, row, role.unwrap_or(Role::Read)))
158 
}
159
160 
fn summary(c: &view::ChangeView) -> ChangeSummary {
161 
    ChangeSummary {
162 
        hash: c.hash.clone(),
163 
        message: if c.body.is_empty() { c.title.clone() } else { format!("{}\n\n{}", c.title, c.body) },
164 
        author: Author {
165 
            name: c.author.name.clone(),
166 
            email: c.author.email.clone(),
167 
            key: c.author.key.clone(),
168 
            account: c.author.account.clone(),
169 
        },
170 
        when_ms: c.when_ms,
171 
        deps: c.deps.clone(),
172 
        head: c.head,
173 
        signature: match &c.signature {
174 
            view::SigView::Unsigned => Signature::Unsigned,
175 
            view::SigView::Valid { key, sealed, revoked, .. } => Signature::Valid { key: key.clone(), sealed: *sealed, revoked: *revoked },
176 
            view::SigView::Invalid(why) => Signature::Invalid { reason: why.clone() },
177 
        },
178 
    }
179 
}
180
181 
// ---------------------------------------------------------------- accounts
182
183 
async fn me(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<User>, ApiError> {
184 
    let c = caller(&app, &headers).await?;
185 
    let a = c.require("user:read")?;
186 
    Ok(Json(user_of(&app, a).await?))
187 
}
188
189 
async fn user_of(app: &Shared, a: &Account) -> Result<User, ApiError> {
190 
    let keys = db::accounts::identities_of(&app.db, a.id).await?.into_iter().map(|i| i.key).collect();
191 
    Ok(User { username: a.username.clone(), display_name: a.display_name.clone(), is_admin: a.is_admin, keys, created_ms: a.created_ms })
192 
}
193
194 
async fn user(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<User>, ApiError> {
195 
    let a = db::accounts::account_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such account"))?;
196 
    Ok(Json(user_of(&app, &a).await?))
197 
}
198
199 
async fn org(State(app): State<Shared>, Path(name): Path<String>) -> Result<Json<Organisation>, ApiError> {
200 
    let o = db::accounts::org_by_name(&app.db, &name).await?.ok_or_else(|| not_found("no such organisation"))?;
201 
    let members = db::accounts::org_members(&app.db, o.id).await?.into_iter().map(|(a, _)| a.username).collect();
202 
    Ok(Json(Organisation { name: o.name, display_name: o.display_name, description: o.description, members }))
203 
}
204
205 
#[derive(Deserialize)]
206 
struct SearchQuery {
207 
    q: String,
208 
}
209
210 
async fn search(
211 
    State(app): State<Shared>,
212 
    headers: HeaderMap,
213 
    Query(q): Query<SearchQuery>,
214 
) -> Result<Json<Vec<serde_json::Value>>, ApiError> {
215 
    let c = caller(&app, &headers).await?;
216 
    let mut out = Vec::new();
217 
    for h in db::notify::search(&app.db, &q.q, None, 50).await? {
218 
        let Some(row) = db::repos::get_by_id(&app.db, h.repo_id).await? else { continue };
219 
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &row).await?;
220 
        if !auth::roles::allows(role, Access::Read) {
221 
            continue;
222 
        }
223 
        out.push(
224 
            serde_json::json!({ "kind": h.kind, "repository": row.slug(), "number": h.number, "title": h.title, "snippet": h.snippet }),
225 
        );
226 
    }
227 
    Ok(Json(out))
228 
}
229
230 
// ------------------------------------------------------------ repositories
231
232 
async fn list_repos(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<Repository>>, ApiError> {
233 
    let c = caller(&app, &headers).await?;
234 
    let mut out = Vec::new();
235 
    for r in db::repos::list(&app.db).await? {
236 
        let role = auth::roles::role_for(&app.db, c.account.as_ref(), &r).await?;
237 
        if auth::roles::allows(role, Access::Read) {
238 
            out.push(repository(&app, &r));
239 
        }
de505df5 Andy McCall ↶ 240 
    }
b64e2537 Andy McCall ↶ 241 
    Ok(Json(out))
242 
}
243
244 
async fn create_repo(
245 
    State(app): State<Shared>,
246 
    headers: HeaderMap,
247 
    Json(body): Json<NewRepository>,
248 
) -> Result<(StatusCode, Json<Repository>), ApiError> {
249 
    let c = caller(&app, &headers).await?;
250 
    let me = c.require("repo:admin")?;
251 
    let name = RepoName::new(&body.owner, &body.name).ok_or_else(|| ApiError(StatusCode::BAD_REQUEST, "invalid owner or name".into()))?;
252 
    if !auth::roles::may_create_under(&app.db, me, &name.owner).await? {
253 
        return Err(forbidden("you cannot create repositories under that owner"));
254 
    }
255 
    if db::repos::get(&app.db, &name.owner, &name.name).await?.is_some() || app.repos.exists(&name) {
256 
        return Err(ApiError(StatusCode::CONFLICT, "that repository exists".into()));
257 
    }
258 
    app.repos.create(&name, None)?;
259 
    let row = db::repos::create(&app.db, &name.owner, &name.name, &body.description, body.visibility).await?;
260 
    db::accounts::audit(&app.db, Some(me), "repo.created", &name.to_string(), "api").await.ok();
261 
    Ok((StatusCode::CREATED, Json(repository(&app, &row))))
262 
}
263
264 
async fn get_repo(
265 
    State(app): State<Shared>,
266 
    headers: HeaderMap,
267 
    Path((owner, name)): Path<(String, String)>,
268 
) -> Result<Json<Repository>, ApiError> {
269 
    let c = caller(&app, &headers).await?;
270 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
271 
    Ok(Json(repository(&app, &row)))
272 
}
273
274 
async fn bookmarks(
275 
    State(app): State<Shared>,
276 
    headers: HeaderMap,
277 
    Path((owner, name)): Path<(String, String)>,
278 
) -> Result<Json<Vec<Bookmark>>, ApiError> {
279 
    let c = caller(&app, &headers).await?;
280 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
281 
    let default = row.default_bookmark.clone();
282 
    let list = app.repos.read(&repo, move |r, cache| view::bookmarks(r, cache, &default)).await?;
283 
    Ok(Json(list.into_iter().map(|b| Bookmark { name: b.name, heads: b.heads, changes: b.changes, default: b.default }).collect()))
284 
}
285
286 
async fn tags(
287 
    State(app): State<Shared>,
288 
    headers: HeaderMap,
289 
    Path((owner, name)): Path<(String, String)>,
290 
) -> Result<Json<Vec<Tag>>, ApiError> {
291 
    let c = caller(&app, &headers).await?;
292 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
293 
    let list = app.repos.read(&repo, |r, _| view::tags(r)).await?;
294 
    Ok(Json(list.into_iter().map(|t| Tag { name: t.name, heads: t.heads, message: t.message, signer: t.signer }).collect()))
295 
}
296
297 
#[derive(Deserialize)]
298 
struct HistoryQuery {
299 
    path: Option<String>,
300 
    offset: Option<usize>,
301 
    limit: Option<usize>,
302 
}
303
304 
async fn history(
305 
    State(app): State<Shared>,
306 
    headers: HeaderMap,
307 
    Path((owner, name, r)): Path<(String, String, String)>,
308 
    Query(q): Query<HistoryQuery>,
309 
) -> Result<Json<History>, ApiError> {
310 
    let c = caller(&app, &headers).await?;
311 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
312 
    let (offset, limit) = (q.offset.unwrap_or(0), q.limit.unwrap_or(50).min(500));
313 
    let h = app
314 
        .repos
315 
        .read(&repo, move |repo, cache| {
316 
            let target = view::resolve(repo, cache, &r)?;
317 
            view::history(repo, cache, target, q.path.as_deref(), offset, limit)
318 
        })
319 
        .await?;
320 
    let mut entries = h.entries;
321 
    crate::web::attribute(&app, &mut entries.iter_mut().collect::<Vec<_>>()).await;
322 
    Ok(Json(History {
323 
        reference: h.target.label,
324 
        heads: h.target.heads.iter().map(|x| x.to_hex()).collect(),
325 
        total: h.total,
326 
        offset: h.offset,
327 
        changes: entries.iter().map(summary).collect(),
328 
    }))
329 
}
330
331 
async fn change(
332 
    State(app): State<Shared>,
333 
    headers: HeaderMap,
334 
    Path((owner, name, hash)): Path<(String, String, String)>,
335 
) -> Result<Json<ChangeDetail>, ApiError> {
336 
    let c = caller(&app, &headers).await?;
337 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
338 
    let d = app
339 
        .repos
340 
        .read(&repo, move |repo, cache| {
341 
            let h = view::resolve_change(repo, cache, &hash)?;
342 
            view::change(repo, cache, &h)
343 
        })
344 
        .await?;
345 
    let mut v = d.view;
346 
    crate::web::attribute(&app, &mut [&mut v]).await;
347 
    let files = crate::web::history::render_files(&d.files, &d.bases)
348 
        .into_iter()
349 
        .map(|f| FileChange { path: f.path, kind: f.kind, from: f.from, added: f.added, removed: f.removed })
350 
        .collect();
351 
    Ok(Json(ChangeDetail {
352 
        body: v.body.clone(),
353 
        change: summary(&v),
354 
        dependents: d.dependents.iter().map(|x| x.hash.clone()).collect(),
355 
        in_bookmarks: d.in_bookmarks,
356 
        in_tags: d.in_tags,
357 
        files,
358 
    }))
359 
}
360
361 
fn entry(e: &view::Entry) -> TreeEntry {
362 
    TreeEntry {
363 
        name: e.name.clone(),
364 
        path: e.path.clone(),
365 
        kind: match e.kind {
366 
            view::EntryKind::Dir => "dir",
367 
            view::EntryKind::File => "file",
368 
            view::EntryKind::Symlink => "symlink",
369 
            view::EntryKind::Subrepo => "subrepo",
370 
        }
371 
        .into(),
372 
        exec: e.exec,
373 
        size: e.size,
374 
        conflicted: e.conflicted,
375 
    }
376 
}
377
378 
async fn tree_root(
379 
    State(app): State<Shared>,
380 
    headers: HeaderMap,
381 
    Path((owner, name, r)): Path<(String, String, String)>,
382 
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
383 
    tree(State(app), headers, Path((owner, name, r, String::new()))).await
384 
}
385
386 
async fn tree(
387 
    State(app): State<Shared>,
388 
    headers: HeaderMap,
389 
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
390 
) -> Result<Json<Vec<TreeEntry>>, ApiError> {
391 
    let c = caller(&app, &headers).await?;
392 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
393 
    let t = app
394 
        .repos
395 
        .read(&repo, move |repo, cache| {
396 
            let target = view::resolve(repo, cache, &r)?;
397 
            view::tree(repo, cache, target, &path)
398 
        })
399 
        .await?;
400 
    Ok(Json(t.entries.iter().map(entry).collect()))
401 
}
402
403 
async fn file(
404 
    State(app): State<Shared>,
405 
    headers: HeaderMap,
406 
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
407 
) -> Result<Response, ApiError> {
408 
    let c = caller(&app, &headers).await?;
409 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
410 
    let limit = app.config.limits.render_limit.0;
411 
    let f = app
412 
        .repos
413 
        .read(&repo, move |repo, cache| {
414 
            let target = view::resolve(repo, cache, &r)?;
415 
            view::file(repo, cache, target, &path, limit)
416 
        })
417 
        .await?;
418 
    Ok(crate::web::raw(f.bytes, &f.name, false))
419 
}
420
421 
async fn blame(
422 
    State(app): State<Shared>,
423 
    headers: HeaderMap,
424 
    Path((owner, name, r, path)): Path<(String, String, String, String)>,
425 
) -> Result<Json<Vec<BlameLine>>, ApiError> {
426 
    let c = caller(&app, &headers).await?;
427 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
428 
    let limit = app.config.limits.render_limit.0;
429 
    let b = app
430 
        .repos
431 
        .read(&repo, move |repo, cache| {
432 
            let target = view::resolve(repo, cache, &r)?;
433 
            view::blame(repo, cache, target, &path, limit)
434 
        })
435 
        .await?;
436 
    Ok(Json(
437 
        b.lines
438 
            .into_iter()
439 
            .map(|l| BlameLine {
440 
                line: l.line,
441 
                change: l.hash.to_hex(),
442 
                index: l.index,
443 
                author: l.author,
444 
                when_ms: l.when_ms,
445 
                text: String::from_utf8_lossy(&l.text).into_owned(),
446 
            })
447 
            .collect(),
448 
    ))
449 
}
450
451 
async fn conflicts(
452 
    State(app): State<Shared>,
453 
    headers: HeaderMap,
454 
    Path((owner, name)): Path<(String, String)>,
455 
) -> Result<Json<Vec<Conflict>>, ApiError> {
456 
    let c = caller(&app, &headers).await?;
457 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
458 
    let list = app.repos.read(&repo, view::conflicts).await?;
459 
    Ok(Json(
460 
        list.into_iter()
461 
            .map(|c| Conflict {
462 
                bookmark: c.bookmark,
463 
                path: c.path,
464 
                kind: c.kind,
465 
                contributors: c.contributors.iter().map(|x| x.hash.clone()).collect(),
466 
            })
467 
            .collect(),
468 
    ))
469 
}
470
471 
async fn trust(
472 
    State(app): State<Shared>,
473 
    headers: HeaderMap,
474 
    Path((owner, name)): Path<(String, String)>,
475 
) -> Result<Json<Trust>, ApiError> {
476 
    let c = caller(&app, &headers).await?;
477 
    let (repo, _, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
478 
    let key = app.hub_key.key;
479 
    let t = app.repos.read(&repo, move |r, cache| view::trust(r, cache, &key)).await?;
480 
    Ok(Json(Trust {
481 
        policy: t.policy.map(|p| Policy {
482 
            serial: p.serial,
483 
            expires_ms: p.expires_ms,
484 
            roots: p.roots.iter().map(|k| k.key.clone()).collect(),
485 
            root_threshold: p.root_threshold,
486 
            rules: p
487 
                .rules
488 
                .iter()
489 
                .map(|r| Rule {
490 
                    pattern: r.pattern.clone(),
491 
                    keys: r.keys.iter().map(|k| k.key.clone()).collect(),
492 
                    threshold: r.threshold,
493 
                    require: r.require.clone(),
494 
                    allow_conflicts: r.allow_conflicts,
495 
                })
496 
                .collect(),
497 
        }),
498 
        signed: t.verification.signed,
499 
        sealed: t.verification.sealed,
500 
        unsigned: t.verification.unsigned,
501 
        invalid: t.verification.invalid.iter().map(|(h, _)| h.clone()).collect(),
502 
        hub_key: t.hub_key,
503 
    }))
504 
}
505
506 
async fn pushes(
507 
    State(app): State<Shared>,
508 
    headers: HeaderMap,
509 
    Path((owner, name)): Path<(String, String)>,
510 
) -> Result<Json<Vec<Push>>, ApiError> {
511 
    let c = caller(&app, &headers).await?;
512 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
513 
    let rows = db::repos::pushes(&app.db, row.id, 200).await?;
514 
    Ok(Json(
515 
        rows.into_iter()
516 
            .map(|p| Push {
517 
                at_ms: p.at_ms,
518 
                pusher: p.pusher,
519 
                reference: p.reference,
520 
                ok: p.ok,
521 
                reason: p.reason,
522 
                old_state: p.old_state,
523 
                new_state: p.new_state,
524 
                heads: p.heads,
525 
                changes: p.changes,
526 
            })
527 
            .collect(),
528 
    ))
de505df5 Andy McCall ↶ 529 
}
530
b64e2537 Andy McCall ↶ 531 
// --------------------------------------------------------------- proposals
532
de505df5 Andy McCall ↶ 533 
async fn proposals(
534 
    State(app): State<Shared>,
b64e2537 Andy McCall ↶ 535 
    headers: HeaderMap,
de505df5 Andy McCall ↶ 536 
    Path((owner, name)): Path<(String, String)>,
b64e2537 Andy McCall ↶ 537 
) -> Result<Json<Vec<Proposal>>, ApiError> {
538 
    let c = caller(&app, &headers).await?;
539 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
de505df5 Andy McCall ↶ 540 
    let mut out = Vec::new();
541 
    for p in db::proposals::list(&app.db, row.id, &["open", "draft"]).await? {
542 
        let loaded = crate::web::proposals::load(&app, &repo, p).await?;
543 
        let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
544 
        out.push(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await);
545 
    }
546 
    Ok(Json(out))
547 
}
548
549 
async fn proposal(
550 
    State(app): State<Shared>,
b64e2537 Andy McCall ↶ 551 
    headers: HeaderMap,
de505df5 Andy McCall ↶ 552 
    Path((owner, name, number)): Path<(String, String, i64)>,
b64e2537 Andy McCall ↶ 553 
) -> Result<Json<Proposal>, ApiError> {
554 
    let c = caller(&app, &headers).await?;
555 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
556 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
de505df5 Andy McCall ↶ 557 
    let source_url = match p.source_repo_id {
558 
        Some(id) => db::repos::get_by_id(&app.db, id).await?.map(|r| format!("{}/{}", app.config.base_url(), r.slug())),
559 
        None => None,
560 
    };
561 
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
562 
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
563 
    Ok(Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, source_url).await))
d23464c0 Andy McCall ↶ 564 
}
565
3f02e5ea Andy McCall ↶ 566 
/// The files a proposal changes (hub spec §12.1).
567 
async fn proposal_files(
568 
    State(app): State<Shared>,
569 
    headers: HeaderMap,
570 
    Path((owner, name, number)): Path<(String, String, i64)>,
571 
) -> Result<Json<Vec<hub_api::ProposalFile>>, ApiError> {
572 
    let c = caller(&app, &headers).await?;
573 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
574 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
575 
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
576 
    Ok(Json(
577 
        loaded
578 
            .files
579 
            .iter()
580 
            .map(|f| hub_api::ProposalFile {
581 
                path: f.path.clone(),
582 
                from: f.from.clone(),
583 
                kind: f.kind.clone(),
584 
                added: f.added,
585 
                removed: f.removed,
586 
            })
587 
            .collect(),
588 
    ))
589 
}
590
591 
/// One file's bytes on a side of a proposal: `base` is the target's
592 
/// state, `head` the projected state. 404 when the file does not exist
593 
/// on that side.
594 
async fn proposal_content(
595 
    State(app): State<Shared>,
596 
    headers: HeaderMap,
597 
    Path((owner, name, number, side, path)): Path<(String, String, i64, String, String)>,
598 
) -> Result<Response, ApiError> {
599 
    let c = caller(&app, &headers).await?;
600 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
601 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
602 
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
603 
    let heads = match side.as_str() {
604 
        "base" => loaded.target_heads,
605 
        "head" => loaded.heads,
606 
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "the side is base or head".into())),
607 
    };
608 
    let limit = app.config.limits.render_limit.0;
609 
    let target = view::RefTarget { label: side, kind: view::RefKind::Change, heads };
610 
    let f = app.repos.read(&repo, move |repo, cache| view::file(repo, cache, target, &path, limit)).await?;
611 
    Ok(crate::web::raw(f.bytes, &f.name, false))
612 
}
613
b64e2537 Andy McCall ↶ 614 
async fn create_proposal(
615 
    State(app): State<Shared>,
616 
    headers: HeaderMap,
617 
    Path((owner, name)): Path<(String, String)>,
618 
    Json(body): Json<NewProposal>,
619 
) -> Result<(StatusCode, Json<Proposal>), ApiError> {
620 
    let c = caller(&app, &headers).await?;
621 
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
622 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
623 
    let created =
624 
        crate::web::proposals::open_proposal(&app, &repo, &row, &me, &body.title, &body.body, &body.target, &body.source, body.draft)
625 
            .await
626 
            .map_err(|e| ApiError(StatusCode::BAD_REQUEST, e))?;
627 
    let loaded = crate::web::proposals::load(&app, &repo, created).await?;
628 
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
629 
    Ok((StatusCode::CREATED, Json(crate::web::proposals::to_api(&app, &owner, &name, &loaded, &v, None).await)))
630 
}
d23464c0 Andy McCall ↶ 631
b64e2537 Andy McCall ↶ 632 
fn comment_of(c: &db::proposals::CommentRow) -> Comment {
633 
    Comment {
634 
        id: c.id,
635 
        author: c.author.clone(),
636 
        body: c.body.clone(),
637 
        created_ms: c.created_ms,
638 
        path: if c.path.is_empty() { None } else { Some(c.path.clone()) },
639 
        anchor: if c.anchor_change.is_empty() {
640 
            None
641 
        } else {
642 
            Some(Atom { change: c.anchor_change.clone(), index: c.anchor_index as u32 })
643 
        },
644 
        resolved: c.resolved,
d23464c0 Andy McCall ↶ 645 
    }
646 
}
647
b64e2537 Andy McCall ↶ 648 
async fn proposal_comments(
649 
    State(app): State<Shared>,
650 
    headers: HeaderMap,
651 
    Path((owner, name, number)): Path<(String, String, i64)>,
652 
) -> Result<Json<Vec<Comment>>, ApiError> {
653 
    let c = caller(&app, &headers).await?;
654 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
655 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
656 
    Ok(Json(db::proposals::comments(&app.db, p.id).await?.iter().map(comment_of).collect()))
657 
}
658
659 
async fn proposal_comment(
660 
    State(app): State<Shared>,
661 
    headers: HeaderMap,
662 
    Path((owner, name, number)): Path<(String, String, i64)>,
663 
    Json(body): Json<NewComment>,
664 
) -> Result<(StatusCode, Json<Comment>), ApiError> {
665 
    let c = caller(&app, &headers).await?;
666 
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
667 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
668 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
669 
    if body.body.trim().is_empty() {
670 
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
671 
    }
672 
    let row_c = db::proposals::add_comment(&app.db, p.id, Some(me.id), &me.username, body.body.trim(), "", None).await?;
673 
    crate::notify::deliver(
674 
        &app,
675 
        crate::notify::Event {
676 
            kind: "proposal.comment",
677 
            title: format!("{owner}/{name}#{number}: {}", p.title),
678 
            url: format!("/{owner}/{name}/proposal/{number}"),
679 
            actor: &me,
680 
            repo_id: row.id,
681 
            thread: Some(("proposal", p.id)),
682 
            mention_text: &body.body,
683 
            direct: p.author_id.into_iter().collect(),
684 
        },
685 
    )
686 
    .await;
687 
    crate::hooks::emit(
688 
        &app,
689 
        &row,
690 
        "comment.proposal",
691 
        &me.username,
692 
        serde_json::json!({ "number": number, "comment": comment_of(&row_c) }),
693 
    )
694 
    .await;
695 
    Ok((StatusCode::CREATED, Json(comment_of(&row_c))))
696 
}
697
698 
async fn proposal_reviews(
699 
    State(app): State<Shared>,
700 
    headers: HeaderMap,
701 
    Path((owner, name, number)): Path<(String, String, i64)>,
702 
) -> Result<Json<Vec<Review>>, ApiError> {
703 
    let c = caller(&app, &headers).await?;
704 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
705 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
706 
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
707 
    let v = crate::web::proposals::verdict(&app, &loaded, row.id).await?;
708 
    Ok(Json(
709 
        v.reviews
710 
            .into_iter()
711 
            .map(|r| Review {
712 
                id: r.row.id,
713 
                author: r.row.author,
714 
                verdict: r.row.verdict,
715 
                body: r.row.body,
716 
                sealed: r.sealed,
717 
                created_ms: r.row.created_ms,
718 
            })
719 
            .collect(),
720 
    ))
721 
}
722
723 
async fn proposal_review(
724 
    State(app): State<Shared>,
725 
    headers: HeaderMap,
726 
    Path((owner, name, number)): Path<(String, String, i64)>,
727 
    Json(body): Json<NewReview>,
728 
) -> Result<(StatusCode, Json<Review>), ApiError> {
729 
    let c = caller(&app, &headers).await?;
730 
    let me = c.require("proposals:write").or_else(|_| c.require("repo:write"))?.clone();
731 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
732 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
733 
    if !matches!(body.verdict.as_str(), "comment" | "changes" | "approve") {
734 
        return Err(ApiError(StatusCode::BAD_REQUEST, "verdict is comment, changes or approve".into()));
735 
    }
736 
    if body.verdict == "approve" && Some(me.id) == p.author_id {
737 
        return Err(forbidden("you cannot approve your own proposal"));
738 
    }
739 
    let r = db::proposals::add_review(&app.db, p.id, me.id, &me.username, &body.verdict, body.body.trim()).await?;
740 
    db::proposals::add_event(&app.db, p.id, &me.username, &format!("review.{}", body.verdict), "").await.ok();
741 
    crate::hooks::emit(&app, &row, "review", &me.username, serde_json::json!({ "number": number, "verdict": body.verdict })).await;
742 
    Ok((
743 
        StatusCode::CREATED,
744 
        Json(Review { id: r.id, author: r.author, verdict: r.verdict, body: r.body, sealed: false, created_ms: r.created_ms }),
745 
    ))
746 
}
747
748 
async fn proposal_checks(
749 
    State(app): State<Shared>,
750 
    headers: HeaderMap,
751 
    Path((owner, name, number)): Path<(String, String, i64)>,
752 
) -> Result<Json<Vec<Check>>, ApiError> {
753 
    let c = caller(&app, &headers).await?;
754 
    let (repo, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
755 
    let p = db::proposals::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such proposal"))?;
756 
    let loaded = crate::web::proposals::load(&app, &repo, p).await?;
757 
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &loaded.state).await?.iter().map(check_of).collect()))
758 
}
759
760 
// ------------------------------------------------------------------ issues
761
762 
async fn issue_of(app: &Shared, row: &db::repos::RepoRow, i: &db::issues::IssueRow) -> Result<Issue, ApiError> {
763 
    let labels = db::issues::issue_labels(&app.db, i.id)
764 
        .await?
765 
        .into_iter()
766 
        .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
767 
        .collect();
768 
    let assignees = db::issues::assignees(&app.db, i.id).await?;
769 
    let milestone = match i.milestone_id {
770 
        Some(id) => db::issues::milestone(&app.db, id).await?.map(|m| m.title),
771 
        None => None,
772 
    };
773 
    let comments: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM issue_comments WHERE issue_id = ?").bind(i.id).fetch_one(&app.db).await?;
774 
    Ok(Issue {
775 
        number: i.number,
776 
        title: i.title.clone(),
777 
        body: i.body.clone(),
778 
        author: i.author.clone(),
779 
        state: i.state.clone(),
780 
        reason: i.reason.clone(),
781 
        labels,
782 
        assignees,
783 
        milestone,
784 
        comments,
785 
        locked: i.locked,
786 
        pinned: i.pinned,
787 
        created_ms: i.created_ms,
788 
        updated_ms: i.updated_ms,
789 
        closed_ms: i.closed_ms,
790 
        url: format!("{}/{}/issue/{}", app.config.base_url(), row.slug(), i.number),
791 
    })
792 
}
793
794 
#[derive(Deserialize)]
795 
struct IssuesQuery {
796 
    state: Option<String>,
797 
}
798
799 
async fn issues(
800 
    State(app): State<Shared>,
801 
    headers: HeaderMap,
802 
    Path((owner, name)): Path<(String, String)>,
803 
    Query(q): Query<IssuesQuery>,
804 
) -> Result<Json<Vec<Issue>>, ApiError> {
805 
    let c = caller(&app, &headers).await?;
806 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
807 
    let state = q.state.unwrap_or_else(|| "open".into());
808 
    let mut out = Vec::new();
809 
    for i in db::issues::list(&app.db, row.id).await? {
810 
        if state == "all" || i.state == state {
811 
            out.push(issue_of(&app, &row, &i).await?);
d23464c0 Andy McCall ↶ 812 
        }
813 
    }
b64e2537 Andy McCall ↶ 814 
    Ok(Json(out))
d23464c0 Andy McCall ↶ 815 
}
816
b64e2537 Andy McCall ↶ 817 
async fn create_issue(
818 
    State(app): State<Shared>,
819 
    headers: HeaderMap,
820 
    Path((owner, name)): Path<(String, String)>,
821 
    Json(body): Json<NewIssue>,
822 
) -> Result<(StatusCode, Json<Issue>), ApiError> {
823 
    let c = caller(&app, &headers).await?;
824 
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
825 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
826 
    if body.title.trim().is_empty() {
827 
        return Err(ApiError(StatusCode::BAD_REQUEST, "an issue needs a title".into()));
d23464c0 Andy McCall ↶ 828 
    }
b64e2537 Andy McCall ↶ 829 
    let i = db::issues::create(
830 
        &app.db,
831 
        db::issues::NewIssue {
832 
            repo_id: row.id,
833 
            title: body.title.trim(),
834 
            body: body.body.trim(),
835 
            author_id: Some(me.id),
836 
            author: &me.username,
837 
        },
838 
    )
839 
    .await?;
840 
    db::issues::add_event(&app.db, i.id, &me.username, "opened", "").await.ok();
841 
    crate::web::issues::reindex(&app, row.id, &i).await;
842 
    let api = issue_of(&app, &row, &i).await?;
843 
    crate::notify::deliver(
844 
        &app,
845 
        crate::notify::Event {
846 
            kind: "issue.opened",
847 
            title: format!("{owner}/{name}#{}: {}", i.number, i.title),
848 
            url: format!("/{owner}/{name}/issue/{}", i.number),
849 
            actor: &me,
850 
            repo_id: row.id,
851 
            thread: Some(("issue", i.id)),
852 
            mention_text: &body.body,
853 
            direct: vec![],
854 
        },
855 
    )
856 
    .await;
857 
    crate::hooks::emit(&app, &row, "issue.opened", &me.username, serde_json::json!({ "issue": api })).await;
858 
    Ok((StatusCode::CREATED, Json(api)))
859 
}
860
861 
async fn issue(
862 
    State(app): State<Shared>,
863 
    headers: HeaderMap,
864 
    Path((owner, name, number)): Path<(String, String, i64)>,
865 
) -> Result<Json<Issue>, ApiError> {
866 
    let c = caller(&app, &headers).await?;
867 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
868 
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
869 
    Ok(Json(issue_of(&app, &row, &i).await?))
870 
}
871
872 
async fn issue_state(
873 
    State(app): State<Shared>,
874 
    headers: HeaderMap,
875 
    Path((owner, name, number)): Path<(String, String, i64)>,
876 
    Json(body): Json<IssueStateChange>,
877 
) -> Result<Json<Issue>, ApiError> {
878 
    let c = caller(&app, &headers).await?;
879 
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
880 
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
881 
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
882 
    if role < Role::Triage && Some(me.id) != i.author_id {
883 
        return Err(forbidden("only the author or triage may change the state"));
884 
    }
885 
    let (state, reason) = match body.state.as_str() {
886 
        "closed" => ("closed", if body.reason == "not_planned" { "not_planned" } else { "completed" }),
887 
        "open" => ("open", ""),
888 
        _ => return Err(ApiError(StatusCode::BAD_REQUEST, "state is open or closed".into())),
889 
    };
890 
    db::issues::set_state(&app.db, i.id, state, reason).await?;
891 
    db::issues::add_event(&app.db, i.id, &me.username, if state == "closed" { "closed" } else { "reopened" }, "").await.ok();
892 
    let fresh = db::issues::get(&app.db, row.id, number).await?.unwrap_or(i);
893 
    let api = issue_of(&app, &row, &fresh).await?;
894 
    crate::hooks::emit(
895 
        &app,
896 
        &row,
897 
        if state == "closed" { "issue.closed" } else { "issue.reopened" },
898 
        &me.username,
899 
        serde_json::json!({ "issue": api }),
900 
    )
901 
    .await;
902 
    Ok(Json(api))
903 
}
904
905 
async fn issue_comments(
906 
    State(app): State<Shared>,
907 
    headers: HeaderMap,
908 
    Path((owner, name, number)): Path<(String, String, i64)>,
909 
) -> Result<Json<Vec<Comment>>, ApiError> {
910 
    let c = caller(&app, &headers).await?;
911 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
912 
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
913 
    Ok(Json(
914 
        db::issues::comments(&app.db, i.id)
915 
            .await?
916 
            .into_iter()
917 
            .map(|c| Comment {
918 
                id: c.id,
919 
                author: c.author,
920 
                body: c.body,
921 
                created_ms: c.created_ms,
922 
                path: None,
923 
                anchor: None,
924 
                resolved: false,
925 
            })
926 
            .collect(),
927 
    ))
928 
}
929
930 
async fn issue_comment(
931 
    State(app): State<Shared>,
932 
    headers: HeaderMap,
933 
    Path((owner, name, number)): Path<(String, String, i64)>,
934 
    Json(body): Json<NewComment>,
935 
) -> Result<(StatusCode, Json<Comment>), ApiError> {
936 
    let c = caller(&app, &headers).await?;
937 
    let me = c.require("issues:write").or_else(|_| c.require("repo:write"))?.clone();
938 
    let (_, row, role) = reach(&app, &c, &owner, &name, Access::Read).await?;
939 
    let i = db::issues::get(&app.db, row.id, number).await?.ok_or_else(|| not_found("no such issue"))?;
940 
    if i.locked && role < Role::Triage {
941 
        return Err(forbidden("this issue is locked"));
942 
    }
943 
    if body.body.trim().is_empty() {
944 
        return Err(ApiError(StatusCode::BAD_REQUEST, "an empty comment says nothing".into()));
945 
    }
946 
    let cm = db::issues::add_comment(&app.db, i.id, Some(me.id), &me.username, body.body.trim()).await?;
947 
    crate::web::issues::reindex(&app, row.id, &i).await;
948 
    crate::notify::deliver(
949 
        &app,
950 
        crate::notify::Event {
951 
            kind: "issue.comment",
952 
            title: format!("{owner}/{name}#{number}: {}", i.title),
953 
            url: format!("/{owner}/{name}/issue/{number}"),
954 
            actor: &me,
955 
            repo_id: row.id,
956 
            thread: Some(("issue", i.id)),
957 
            mention_text: &body.body,
958 
            direct: i.author_id.into_iter().collect(),
959 
        },
960 
    )
961 
    .await;
962 
    let api = Comment { id: cm.id, author: cm.author, body: cm.body, created_ms: cm.created_ms, path: None, anchor: None, resolved: false };
963 
    crate::hooks::emit(&app, &row, "comment.issue", &me.username, serde_json::json!({ "number": number, "comment": api })).await;
964 
    Ok((StatusCode::CREATED, Json(api)))
d23464c0 Andy McCall ↶ 965 
}
966
b64e2537 Andy McCall ↶ 967 
async fn labels(
968 
    State(app): State<Shared>,
969 
    headers: HeaderMap,
970 
    Path((owner, name)): Path<(String, String)>,
971 
) -> Result<Json<Vec<Label>>, ApiError> {
972 
    let c = caller(&app, &headers).await?;
973 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
974 
    Ok(Json(
975 
        db::issues::labels(&app.db, row.id)
976 
            .await?
977 
            .into_iter()
978 
            .map(|l| Label { name: l.name, colour: l.colour, description: l.description })
979 
            .collect(),
980 
    ))
981 
}
982
983 
async fn milestones(
984 
    State(app): State<Shared>,
985 
    headers: HeaderMap,
986 
    Path((owner, name)): Path<(String, String)>,
987 
) -> Result<Json<Vec<Milestone>>, ApiError> {
988 
    let c = caller(&app, &headers).await?;
989 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
990 
    let mut out = Vec::new();
991 
    for m in db::issues::milestones(&app.db, row.id).await? {
992 
        let (open, closed) = db::issues::milestone_counts(&app.db, m.id).await?;
993 
        out.push(Milestone { title: m.title, description: m.description, due_ms: m.due_ms, state: m.state, open, closed });
d23464c0 Andy McCall ↶ 994 
    }
b64e2537 Andy McCall ↶ 995 
    Ok(Json(out))
996 
}
997
998 
// --------------------------------------------------------- hooks, checks
999
1000 
fn hook_of(h: &db::hooks::Hook) -> Hook {
1001 
    Hook { id: h.id, url: h.url.clone(), events: h.events.clone(), active: h.active, created_ms: h.created_ms }
1002 
}
1003
1004 
async fn hooks(
1005 
    State(app): State<Shared>,
1006 
    headers: HeaderMap,
1007 
    Path((owner, name)): Path<(String, String)>,
1008 
) -> Result<Json<Vec<Hook>>, ApiError> {
1009 
    let c = caller(&app, &headers).await?;
1010 
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
1011 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
1012 
    Ok(Json(db::hooks::hooks_for_repo(&app.db, row.id).await?.iter().map(hook_of).collect()))
d23464c0 Andy McCall ↶ 1013 
}
1014
b64e2537 Andy McCall ↶ 1015 
async fn create_hook(
1016 
    State(app): State<Shared>,
1017 
    headers: HeaderMap,
1018 
    Path((owner, name)): Path<(String, String)>,
1019 
    Json(body): Json<NewHook>,
1020 
) -> Result<(StatusCode, Json<Hook>), ApiError> {
1021 
    let c = caller(&app, &headers).await?;
1022 
    let me = c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?.clone();
1023 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
1024 
    if !(body.url.starts_with("http://") || body.url.starts_with("https://")) {
1025 
        return Err(ApiError(StatusCode::BAD_REQUEST, "the URL must be http or https".into()));
1026 
    }
1027 
    let h = db::hooks::create_hook(&app.db, Some(row.id), None, &body.url, &body.secret, &body.events).await?;
1028 
    db::accounts::audit(&app.db, Some(&me), "hook.created", &row.slug(), &body.url).await.ok();
1029 
    Ok((StatusCode::CREATED, Json(hook_of(&h))))
d23464c0 Andy McCall ↶ 1030 
}
1031
b64e2537 Andy McCall ↶ 1032 
async fn delete_hook(
1033 
    State(app): State<Shared>,
1034 
    headers: HeaderMap,
1035 
    Path((owner, name, id)): Path<(String, String, i64)>,
1036 
) -> Result<StatusCode, ApiError> {
1037 
    let c = caller(&app, &headers).await?;
1038 
    c.require("hooks:admin").or_else(|_| c.require("repo:admin"))?;
1039 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Admin).await?;
1040 
    if db::hooks::hook(&app.db, id).await?.is_some_and(|h| h.repo_id == Some(row.id)) {
1041 
        db::hooks::delete_hook(&app.db, id).await?;
1042 
    }
1043 
    Ok(StatusCode::NO_CONTENT)
d23464c0 Andy McCall ↶ 1044 
}
1045
b64e2537 Andy McCall ↶ 1046 
pub fn check_of(c: &db::hooks::Check) -> Check {
1047 
    Check {
1048 
        state: c.state.clone(),
1049 
        name: c.name.clone(),
1050 
        status: CheckStatus::parse(&c.status).unwrap_or(CheckStatus::Queued),
1051 
        summary: c.summary.clone(),
1052 
        url: c.url.clone(),
1053 
        reporter: c.reporter.clone(),
1054 
        seal: if c.seal.is_empty() { None } else { Some(c.seal.clone()) },
1055 
        started_ms: c.started_ms,
1056 
        finished_ms: c.finished_ms,
1057 
    }
d23464c0 Andy McCall ↶ 1058 
}
1059
b64e2537 Andy McCall ↶ 1060 
/// `POST /repos/{o}/{n}/checks`: any `checks:write` (or write) token may
1061 
/// report; the state hash names what was checked.
1062 
async fn post_check(
1063 
    State(app): State<Shared>,
1064 
    headers: HeaderMap,
1065 
    Path((owner, name)): Path<(String, String)>,
1066 
    Json(body): Json<NewCheck>,
1067 
) -> Result<(StatusCode, Json<Check>), ApiError> {
1068 
    let c = caller(&app, &headers).await?;
1069 
    let me = c.require("checks:write").or_else(|_| c.require("repo:write"))?.clone();
1070 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
1071 
    if body.state.len() != 64 || !body.state.chars().all(|ch| ch.is_ascii_hexdigit()) {
1072 
        return Err(ApiError(StatusCode::BAD_REQUEST, "state is a 64-character hex state hash".into()));
1073 
    }
1074 
    if body.name.trim().is_empty() || body.name.len() > 100 {
1075 
        return Err(ApiError(StatusCode::BAD_REQUEST, "a check has a short name".into()));
1076 
    }
1077 
    let ch = db::hooks::upsert_check(
1078 
        &app.db,
1079 
        row.id,
1080 
        &body.state,
1081 
        body.name.trim(),
1082 
        body.status.as_str(),
1083 
        &body.summary,
1084 
        &body.url,
1085 
        Some((me.id, &me.username)),
1086 
        body.seal.as_deref().unwrap_or(""),
1087 
    )
1088 
    .await?;
1089 
    let api = check_of(&ch);
1090 
    app.events.proposal(row.id, ProposalEvent { number: 0, kind: "check".into(), check: Some(api.clone()) });
1091 
    crate::hooks::emit(&app, &row, "check", &me.username, serde_json::json!({ "check": api })).await;
1092 
    Ok((StatusCode::CREATED, Json(api)))
d23464c0 Andy McCall ↶ 1093 
}
1094
b64e2537 Andy McCall ↶ 1095 
async fn checks_for_state(
1096 
    State(app): State<Shared>,
1097 
    headers: HeaderMap,
1098 
    Path((owner, name, state)): Path<(String, String, String)>,
1099 
) -> Result<Json<Vec<Check>>, ApiError> {
1100 
    let c = caller(&app, &headers).await?;
1101 
    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;
1102 
    Ok(Json(db::hooks::checks_for_state(&app.db, row.id, &state).await?.iter().map(check_of).collect()))
d23464c0 Andy McCall ↶ 1103 
}