OXYGENHUB
◆ v0.5.0 oxygenhub / crates / hub / tests / api.rs
79.3 KiB · Rust · last changed API: a wiki says it takes no proposals, rather than 'no such repository' 25 days ago source blame history raw
b64e2537 Andy McCall ↶ 1 
//! Milestone 0.5 end to end: the JSON API with scoped tokens, webhooks
2 
//! delivered to a local receiver with signatures and retries, checks on a
3 
//! projected state that gate landing, and the proposal event stream.
4
5 
use axum::body::Body;
6 
use axum::http::{header, Request, StatusCode};
7 
use axum::routing::post;
8 
use axum::Router;
9 
use http_body_util::BodyExt;
10 
use oxy_core::repo::Repo;
11 
use oxygenhub::config::Config;
12 
use oxygenhub::Shared;
13 
use std::path::Path;
14 
use std::sync::{Arc, Mutex};
15 
use tower::ServiceExt;
16
17 
fn hermetic() {
18 
    static ONCE: std::sync::Once = std::sync::Once::new();
19 
    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();
20 
    ONCE.call_once(|| {
21 
        let d = tempfile::tempdir().unwrap();
22 
        std::env::set_var("OXY_HOME", d.path());
23 
        DIR.set(d).ok();
24 
    });
25 
}
26
27 
fn write(root: &Path, rel: &str, content: &[u8]) {
28 
    let p = root.join(rel);
29 
    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
30 
    std::fs::write(p, content).unwrap();
31 
}
32
33 
struct Hub {
34 
    app: Shared,
35 
    base: String,
36 
    _dir: tempfile::TempDir,
37 
}
38
39 
async fn hub() -> Hub {
40 
    hermetic();
41 
    let dir = tempfile::tempdir().unwrap();
42 
    let mut config = Config::load(dir.path()).unwrap();
43 
    config.auth.push_tokens = vec!["site".into()];
44 
    config.registration.mode = "open".into();
45 
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
46 
    let port = listener.local_addr().unwrap().port();
47 
    config.server.base_url = format!("http://127.0.0.1:{port}");
48 
    let app = oxygenhub::build(config).await.unwrap();
49 
    let router = oxygenhub::router(app.clone());
50 
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
51 
    Hub { app, base: format!("http://127.0.0.1:{port}"), _dir: dir }
52 
}
53
54 
struct Res {
55 
    status: StatusCode,
56 
    body: String,
57 
    cookie: Option<String>,
58 
}
59
60 
async fn call(
61 
    app: &Shared,
62 
    method: &str,
63 
    path: &str,
64 
    bearer: Option<&str>,
65 
    cookie: Option<&str>,
66 
    json: Option<&str>,
67 
    form: Option<&str>,
68 
) -> Res {
69 
    let mut req = Request::builder().method(method).uri(path);
70 
    if let Some(b) = bearer {
71 
        req = req.header(header::AUTHORIZATION, format!("Bearer {b}"));
72 
    }
73 
    if let Some(c) = cookie {
74 
        req = req.header(header::COOKIE, format!("oxyhub={c}"));
75 
    }
76 
    let body = if let Some(j) = json {
77 
        req = req.header(header::CONTENT_TYPE, "application/json");
78 
        Body::from(j.to_string())
79 
    } else if let Some(f) = form {
80 
        req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");
81 
        Body::from(f.to_string())
82 
    } else {
83 
        Body::empty()
84 
    };
85 
    let res = oxygenhub::router(app.clone()).oneshot(req.body(body).unwrap()).await.unwrap();
86 
    let status = res.status();
87 
    let cookie = res
88 
        .headers()
89 
        .get(header::SET_COOKIE)
90 
        .and_then(|v| v.to_str().ok())
91 
        .and_then(|v| v.split(';').next())
92 
        .and_then(|kv| kv.split_once('='))
93 
        .map(|(_, v)| v.to_string());
94 
    let bytes = res.into_body().collect().await.unwrap().to_bytes();
95 
    Res { status, body: String::from_utf8_lossy(&bytes).into_owned(), cookie }
96 
}
97
98 
async fn api(app: &Shared, method: &str, path: &str, bearer: Option<&str>, json: Option<&str>) -> (StatusCode, serde_json::Value) {
99 
    let r = call(app, method, path, bearer, None, json, None).await;
100 
    let v = serde_json::from_str(&r.body).unwrap_or(serde_json::Value::String(r.body.clone()));
101 
    (r.status, v)
102 
}
103
104 
fn csrf_of(page: &str) -> String {
105 
    let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();
106 
    page[i..].split('"').next().unwrap().to_string()
107 
}
108
109 
/// A webhook receiver that records what it gets and fails the first time.
110 
struct Receiver {
111 
    url: String,
112 
    seen: Arc<Mutex<Vec<(String, String, String)>>>,
113 
    fail_first: Arc<Mutex<bool>>,
114 
}
115
116 
async fn receiver() -> Receiver {
117 
    let seen: Arc<Mutex<Vec<(String, String, String)>>> = Arc::new(Mutex::new(vec![]));
118 
    let fail_first = Arc::new(Mutex::new(true));
119 
    let (s2, f2) = (seen.clone(), fail_first.clone());
120 
    let router = Router::new().route(
121 
        "/hook",
122 
        post(move |headers: header::HeaderMap, body: String| {
123 
            let (s2, f2) = (s2.clone(), f2.clone());
124 
            async move {
125 
                let event = headers.get("x-oxyhub-event").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
126 
                let sig = headers.get("x-oxyhub-signature").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
127 
                let mut f = f2.lock().unwrap();
128 
                if *f {
129 
                    *f = false;
130 
                    return (StatusCode::INTERNAL_SERVER_ERROR, "flaky");
131 
                }
132 
                s2.lock().unwrap().push((event, sig, body));
133 
                (StatusCode::OK, "ok")
134 
            }
135 
        }),
136 
    );
137 
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
138 
    let port = listener.local_addr().unwrap().port();
139 
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
140 
    Receiver { url: format!("http://127.0.0.1:{port}/hook"), seen, fail_first }
141 
}
142
143 
#[tokio::test(flavor = "multi_thread")]
144 
async fn api_webhooks_and_checks() {
145 
    let h = hub().await;
146 
    let app = &h.app;
147 
    // Accounts and tokens through the pages.
148 
    let r =
149 
        call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;
150 
    let andy = r.cookie.unwrap();
151 
    let r =
152 
        call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery")).await;
153 
    let bob = r.cookie.unwrap();
154 
    let mint = |cookie: String, scopes: &'static str| {
155 
        let app = app.clone();
156 
        async move {
157 
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
158 
            let csrf = csrf_of(&page.body);
159 
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
160 
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
161 
        }
162 
    };
163 
    let andy_admin = mint(andy.clone(), "scopes=repo%3Aadmin").await;
164 
    let andy_ro = mint(andy.clone(), "scopes=repo%3Aread").await;
165 
    let bob_rw = mint(bob.clone(), "scopes=repo%3Aread&scopes=repo%3Awrite").await;
166
167 
    // Create a repository through the API; the read-only token cannot.
168 
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_ro), Some(r#"{"owner":"andy","name":"x"}"#)).await;
169 
    assert_eq!(st, StatusCode::FORBIDDEN);
170 
    let (st, v) = api(
171 
        app,
172 
        "POST",
173 
        "/api/v1/repos",
174 
        Some(&andy_admin),
175 
        Some(r#"{"owner":"andy","name":"demo","description":"d","visibility":"public"}"#),
176 
    )
177 
    .await;
178 
    assert_eq!(st, StatusCode::CREATED, "{v}");
179 
    assert_eq!(v["clone_url"], format!("{}/andy/demo", h.base));
180 
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_admin), Some(r#"{"owner":"andy","name":"demo"}"#)).await;
181 
    assert_eq!(st, StatusCode::CONFLICT);
182 
    let (st, _) = api(app, "GET", "/api/v1/user", Some(&andy_ro), None).await;
183 
    assert_eq!(st, StatusCode::FORBIDDEN, "user:read is a scope of its own");
184 
    let (st, v) = api(app, "GET", "/api/v1/users/andy", None, None).await;
185 
    assert_eq!(st, StatusCode::OK);
186 
    assert_eq!(v["username"], "andy");
187
188 
    // A webhook on the repository; push, then see the delivery with a valid signature after a retry.
189 
    let rx = receiver().await;
190 
    let (st, v) = api(
191 
        app,
192 
        "POST",
193 
        "/api/v1/repos/andy/demo/hooks",
194 
        Some(&andy_admin),
195 
        Some(&format!(r#"{{"url":"{}","secret":"s3","events":"push,proposal,check"}}"#, rx.url)),
196 
    )
197 
    .await;
198 
    assert_eq!(st, StatusCode::CREATED, "{v}");
199 
    let work = tempfile::tempdir().unwrap();
200 
    let mut client = Repo::init(work.path()).unwrap();
201 
    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();
202 
    client.config.set("remote.origin.token", "site").unwrap();
203 
    client.save_config().unwrap();
204 
    write(work.path(), "a.txt", b"a\n");
205 
    client.snapshot("t").unwrap();
206 
    let base = client.commit("base", &[]).unwrap();
207 
    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));
208 
    // The worker retries with backoff; drive it directly for the retry.
209 
    tokio::time::sleep(std::time::Duration::from_millis(400)).await;
210 
    assert!(rx.seen.lock().unwrap().is_empty(), "the first attempt failed");
211 
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
212 
    oxygenhub::hooks::deliver_due(app).await;
213 
    let seen = rx.seen.lock().unwrap().clone();
214 
    assert_eq!(seen.len(), 1, "{seen:?}");
215 
    assert_eq!(seen[0].0, "push");
216 
    assert_eq!(seen[0].1, oxygenhub::hooks::signature("s3", seen[0].2.as_bytes()));
217 
    let payload: serde_json::Value = serde_json::from_str(&seen[0].2).unwrap();
218 
    assert_eq!(payload["repository"]["name"], "demo");
219 
    assert_eq!(payload["data"]["updates"][0]["reference"], "main");
220 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/hooks", Some(&andy_admin), None).await;
221 
    assert_eq!(v.as_array().unwrap().len(), 1);
222
223 
    // History, tree, file, blame, bookmarks, trust, pushes through the API.
224 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main", None, None).await;
225 
    assert_eq!(st, StatusCode::OK);
226 
    assert_eq!(v["changes"][0]["hash"], base.to_hex());
f28389bd Andy McCall ↶ 227 
    // A revset in place of the whole history (`?r=`), under a budget; a
228 
    // bad one is the caller's problem.
229 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=%3A%3Amain%20%26%20kind(normal)", None, None).await;
230 
    assert_eq!(st, StatusCode::OK, "{v}");
231 
    assert_eq!(v["total"].as_u64(), Some(1));
232 
    assert_eq!(v["changes"][0]["hash"], base.to_hex());
233 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=none()", None, None).await;
234 
    assert_eq!((st, v["total"].as_u64()), (StatusCode::OK, Some(0)));
235 
    assert_eq!(api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=main%20%26", None, None).await.0, StatusCode::BAD_REQUEST);
236 
    assert_eq!(api(app, "GET", "/api/v1/repos/andy/demo/history/main?r=nosuch()", None, None).await.0, StatusCode::BAD_REQUEST);
b64e2537 Andy McCall ↶ 237 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/tree/main", None, None).await;
238 
    assert_eq!(v[0]["name"], "a.txt");
239 
    let r = call(app, "GET", "/api/v1/repos/andy/demo/file/main/a.txt", None, None, None, None).await;
240 
    assert_eq!(r.body, "a\n");
241 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/blame/main/a.txt", None, None).await;
242 
    assert_eq!(v[0]["change"], base.to_hex());
243 
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{}", base.to_hex()), None, None).await;
244 
    assert_eq!(v["files"][0]["path"], "a.txt");
245 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/trust", None, None).await;
246 
    assert!(v["policy"].is_null());
247 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/pushes", None, None).await;
248 
    assert_eq!(v[0]["reference"], "main");
249
250 
    // Issues through the API: Bob opens one, comments, and closes it.
251 
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_rw), Some(r#"{"title":"Bug","body":"it broke"}"#)).await;
252 
    assert_eq!(st, StatusCode::CREATED, "{v}");
253 
    assert_eq!(v["number"], 1);
254 
    let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1/comments", Some(&bob_rw), Some(r#"{"body":"more"}"#)).await;
255 
    assert_eq!(st, StatusCode::CREATED);
256 
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues/1", Some(&bob_rw), Some(r#"{"state":"closed"}"#)).await;
257 
    assert_eq!(st, StatusCode::OK, "{v}");
258 
    assert_eq!(v["state"], "closed");
259 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
260 
    assert_eq!(v[0]["comments"], 1);
261 
    let (_, v) = api(app, "GET", "/api/v1/search?q=broke", None, None).await;
262 
    assert_eq!(v[0]["number"], 1);
263
264 
    // A proposal through the API, then a required check gates its landing.
265 
    client.bookmark_create("feat", Some(&[base])).unwrap();
266 
    client.bookmark_switch("feat", false).unwrap();
267 
    write(work.path(), "b.txt", b"b\n");
3f02e5ea Andy McCall ↶ 268 
    write(work.path(), "a.txt", b"a\nA\n");
b64e2537 Andy McCall ↶ 269 
    client.snapshot("t").unwrap();
270 
    let feat = client.commit("feat", &[]).unwrap();
271 
    assert!(client.push_bookmark("origin", "feat", false).unwrap().iter().all(|r| r.ok));
272 
    let (st, v) =
273 
        api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(r#"{"title":"Feat","target":"main","source":"feat"}"#))
274 
            .await;
275 
    assert_eq!(st, StatusCode::CREATED, "{v}");
276 
    assert_eq!(v["number"], 2);
277 
    let state = v["projected_state"].as_str().unwrap().to_string();
278 
    assert_eq!(v["landable"], true);
a0dd06b0 Andy McCall ↶ 279 
    // A wiki takes no proposals, and says so rather than "no such
280 
    // repository" (oxygenhub#128); a repository's that does not exist
281 
    // still does not.
282 
    let (st, v) =
283 
        api(app, "POST", "/api/v1/repos/andy/demo.wiki/proposals", Some(&bob_rw), Some(r#"{"title":"W","target":"main","source":"p"}"#))
284 
            .await;
285 
    let detail = v["detail"].as_str().unwrap_or_default();
286 
    assert!(st == StatusCode::NOT_FOUND && detail.contains("is the wiki of andy/demo") && detail.contains("push main"), "{v}");
287 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/nope.wiki/proposals", Some(&bob_rw), None).await;
288 
    assert_eq!(v["detail"], "no such repository");
3f02e5ea Andy McCall ↶ 289 
    // Its files, and each side's bytes, for editors' diff views.
290 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/files", None, None).await;
291 
    assert_eq!(st, StatusCode::OK, "{v}");
292 
    let files: Vec<(String, String)> =
293 
        v.as_array().unwrap().iter().map(|f| (f["path"].as_str().unwrap().to_string(), f["kind"].as_str().unwrap().to_string())).collect();
294 
    assert_eq!(files, vec![("a.txt".into(), "modified".into()), ("b.txt".into(), "added".into())], "{v}");
295 
    assert_eq!(v[0]["added"], 1);
296 
    let side = |s: &str, p: &str| format!("/api/v1/repos/andy/demo/proposals/2/content/{s}/{p}");
297 
    assert_eq!(call(app, "GET", &side("base", "a.txt"), None, None, None, None).await.body, "a\n");
298 
    assert_eq!(call(app, "GET", &side("head", "a.txt"), None, None, None, None).await.body, "a\nA\n");
299 
    assert_eq!(call(app, "GET", &side("head", "b.txt"), None, None, None, None).await.body, "b\n");
300 
    assert_eq!(call(app, "GET", &side("base", "b.txt"), None, None, None, None).await.status, StatusCode::NOT_FOUND, "b.txt is new");
301 
    assert_eq!(call(app, "GET", &side("middle", "a.txt"), None, None, None, None).await.status, StatusCode::BAD_REQUEST);
c0fac31d Andy McCall ↶ 302 
    // An anchored comment comes back with its line in the projected state.
303 
    let (st, v) = api(
304 
        app,
305 
        "POST",
306 
        "/api/v1/repos/andy/demo/proposals/2/comments",
307 
        Some(&bob_rw),
308 
        Some(r#"{"body":"why capital A?","path":"a.txt","line":2}"#),
309 
    )
310 
    .await;
311 
    assert_eq!(st, StatusCode::CREATED, "{v}");
312 
    assert_eq!(v["line"], 2);
313 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/comments", None, None).await;
314 
    assert_eq!(v[0]["path"], "a.txt");
315 
    assert_eq!(v[0]["line"], 2, "{v}");
316 
    assert_eq!(v[0]["anchor"]["change"], feat.to_hex());
b64e2537 Andy McCall ↶ 317 
    // Require the "build" check.
318 
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
319 
    let csrf = csrf_of(&settings.body);
320 
    assert_eq!(
321 
        call(app, "POST", "/andy/demo/settings/checks", None, Some(&andy), None, Some(&format!("_csrf={csrf}&required_checks=build")))
322 
            .await
323 
            .status,
324 
        StatusCode::OK
325 
    );
326 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
327 
    assert_eq!(v["landable"], false);
328 
    assert!(v["blockers"][0].as_str().unwrap().contains("build"), "{v}");
329 
    // A checker reports on the projected state: first running, then passed; the page streams it.
330 
    let (st, v) = api(
331 
        app,
332 
        "POST",
333 
        "/api/v1/repos/andy/demo/checks",
334 
        Some(&andy_ro),
335 
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"running"}}"#)),
336 
    )
337 
    .await;
338 
    assert_eq!(st, StatusCode::FORBIDDEN, "{v}");
339 
    let mut events = app.events.proposals.subscribe();
340 
    let (st, v) = api(
341 
        app,
342 
        "POST",
343 
        "/api/v1/repos/andy/demo/checks",
344 
        Some(&bob_rw),
345 
        Some(&format!(r#"{{"state":"{state}","name":"build","status":"passed","summary":"42 tests","url":"https://ci.example/1"}}"#)),
346 
    )
347 
    .await;
348 
    assert_eq!(st, StatusCode::CREATED, "{v}");
349 
    let (_, ev) = events.recv().await.unwrap();
350 
    assert_eq!(ev.kind, "check");
351 
    assert_eq!(ev.check.unwrap().name, "build");
352 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2/checks", None, None).await;
353 
    assert_eq!(v[0]["status"], "passed");
354 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
355 
    assert_eq!(v["landable"], true, "{v}");
356 
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&andy), None, None).await;
357 
    assert!(page.body.contains("42 tests"), "{}", page.body);
358 
    // The check and the proposal reached the webhook too.
359 
    sqlx::query("UPDATE deliveries SET next_ms = 0").execute(&app.db).await.unwrap();
360 
    oxygenhub::hooks::deliver_due(app).await;
361 
    let kinds: Vec<String> = rx.seen.lock().unwrap().iter().map(|s| s.0.clone()).collect();
362 
    assert!(kinds.contains(&"proposal.opened".to_string()) && kinds.contains(&"check".to_string()), "{kinds:?}");
363 
    let _ = feat;
364 
    let _ = rx.fail_first;
42a0ba4b Andy McCall ↶ 365
366 
    // The inbox through the API: count, list, mark one read, mark all read.
367 
    let bob_user = mint(bob.clone(), "scopes=user%3Aread").await;
368 
    let bob_id = oxygenhub::db::accounts::account_by_name(&app.db, "bob").await.unwrap().unwrap().id;
369 
    oxygenhub::db::notify::mark_read(&app.db, bob_id, None).await.unwrap();
eb0c44a9 Andy McCall ↶ 370 
    oxygenhub::db::notify::add(
371 
        &app.db,
372 
        oxygenhub::db::notify::New {
373 
            account_id: bob_id,
374 
            repo_id: None,
375 
            reason: oxygenhub::db::notify::Reason::Participating,
376 
            kind: "mention",
377 
            title: "andy/demo#1: Bug",
378 
            url: "/andy/demo/issue/1",
379 
            actor: "andy",
380 
        },
381 
    )
382 
    .await
383 
    .unwrap();
384 
    oxygenhub::db::notify::add(
385 
        &app.db,
386 
        oxygenhub::db::notify::New {
387 
            account_id: bob_id,
388 
            repo_id: None,
389 
            reason: oxygenhub::db::notify::Reason::Participating,
390 
            kind: "review",
391 
            title: "andy/demo#2: Feat",
392 
            url: "/andy/demo/proposal/2",
393 
            actor: "andy",
394 
        },
395 
    )
396 
    .await
397 
    .unwrap();
42a0ba4b Andy McCall ↶ 398 
    let (st, v) = api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await;
399 
    assert_eq!(st, StatusCode::OK, "{v}");
400 
    assert_eq!(v["unread"], 2);
401 
    assert_eq!(v["items"][0]["read"], false);
402 
    assert!(v["items"][0]["url"].as_str().unwrap().starts_with(&h.base), "absolute urls: {v}");
403 
    let first = v["items"][0]["id"].as_i64().unwrap();
404 
    let (st, _) = api(app, "POST", &format!("/api/v1/notifications/{first}/read"), Some(&bob_user), None).await;
405 
    assert_eq!(st, StatusCode::NO_CONTENT);
406 
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 1);
407 
    assert_eq!(api(app, "POST", "/api/v1/notifications/read", Some(&bob_user), None).await.0, StatusCode::NO_CONTENT);
408 
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await.1["unread"], 0);
409 
    // Another account's notification is not the caller's to clear, and a token without user:read sees nothing.
410 
    assert_eq!(api(app, "GET", "/api/v1/notifications", Some(&bob_rw), None).await.0, StatusCode::FORBIDDEN);
0b20f1ec Andy McCall ↶ 411
cc1cd197 Andy McCall ↶ 412 
    // Review requests: the author asks andy; andy is told, reviews, and the
413 
    // request is answered; the author hears of the review.
414 
    let andy_user = mint(andy.clone(), "scopes=user%3Aread").await;
415 
    let andy_pw = mint(andy.clone(), "scopes=proposals%3Awrite").await;
416 
    oxygenhub::db::notify::mark_read(&app.db, oxygenhub::db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id, None)
417 
        .await
418 
        .unwrap();
419 
    let path = "/api/v1/repos/andy/demo/proposals/2/reviewers";
420 
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["nobody"]}"#)).await;
421 
    assert_eq!(st, StatusCode::UNPROCESSABLE_ENTITY, "{v}");
422 
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["bob"]}"#)).await;
423 
    assert_eq!(st, StatusCode::UNPROCESSABLE_ENTITY, "the author cannot review: {v}");
424 
    let (st, v) = api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["@andy"]}"#)).await;
425 
    assert_eq!((st, v.clone()), (StatusCode::OK, serde_json::json!(["andy"])));
426 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
427 
    assert_eq!(v["requested_reviewers"], serde_json::json!(["andy"]));
428 
    let (_, v) = api(app, "GET", "/api/v1/notifications", Some(&andy_user), None).await;
429 
    assert!(v["items"].as_array().unwrap().iter().any(|n| n["kind"] == "proposal.review_requested" && n["read"] == false), "{v}");
430 
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&andy), None, None).await;
431 
    assert!(page.body.contains("Reviewers") && page.body.contains("review requested"), "{}", page.body);
432 
    let (st, _) =
433 
        api(app, "POST", "/api/v1/repos/andy/demo/proposals/2/reviews", Some(&andy_pw), Some(r#"{"verdict":"comment","body":"ok"}"#)).await;
434 
    assert_eq!(st, StatusCode::CREATED);
435 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
436 
    assert_eq!(v["requested_reviewers"], serde_json::json!([]), "answered by the review");
437 
    let (_, v) = api(app, "GET", "/api/v1/notifications", Some(&bob_user), None).await;
438 
    assert!(v["items"].as_array().unwrap().iter().any(|n| n["kind"] == "proposal.review" && n["read"] == false), "{v}");
439 
    // Asking again and withdrawing it.
440 
    api(app, "POST", path, Some(&bob_rw), Some(r#"{"reviewers":["andy"]}"#)).await;
441 
    let (st, _) = api(app, "DELETE", &format!("{path}/andy"), Some(&bob_rw), None).await;
442 
    assert_eq!(st, StatusCode::NO_CONTENT);
443 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
444 
    assert_eq!(v["requested_reviewers"], serde_json::json!([]));
8e96499f Andy McCall ↶ 445 
    // oxygenhub#84: the page's menu sets who is asked, all at once.
446 
    let page = call(app, "GET", "/andy/demo/proposal/2", None, Some(&bob), None, None).await;
447 
    assert!(
448 
        page.body.contains("Request reviews") && page.body.contains("name=\"username\" value=\"andy\""),
449 
        "the reviewers menu lists andy"
450 
    );
451 
    let csrf = csrf_of(&page.body);
452 
    let form = |list: &str| format!("_csrf={csrf}&action=set{list}");
453 
    call(app, "POST", "/andy/demo/proposal/2/reviewers", None, Some(&bob), None, Some(&form("&username=andy"))).await;
454 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
455 
    assert_eq!(v["requested_reviewers"], serde_json::json!(["andy"]));
456 
    call(app, "POST", "/andy/demo/proposal/2/reviewers", None, Some(&bob), None, Some(&form(""))).await;
457 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
458 
    assert_eq!(v["requested_reviewers"], serde_json::json!([]), "an empty menu withdraws them");
cc1cd197 Andy McCall ↶ 459
0b20f1ec Andy McCall ↶ 460 
    // A source bookmark with `/` in its name, as a feature/N-name workflow
461 
    // makes them: by name, and as this repository's owner/name:bookmark.
462 
    for (b, file) in [("feature/1-one", "c.txt"), ("feature/2-two", "d.txt")] {
463 
        client.bookmark_create(b, Some(&[base])).unwrap();
464 
        client.bookmark_switch(b, false).unwrap();
465 
        write(work.path(), file, b"c\n");
466 
        client.snapshot("t").unwrap();
467 
        client.commit(b, &[]).unwrap();
468 
        assert!(client.push_bookmark("origin", b, false).unwrap().iter().all(|r| r.ok));
469 
    }
470 
    for source in ["feature/1-one", "andy/demo:feature/2-two"] {
471 
        let body = format!(r#"{{"title":"Slash","target":"main","source":"{source}"}}"#);
472 
        let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(&body)).await;
473 
        assert_eq!(st, StatusCode::CREATED, "{source}: {v}");
474 
        let n = v["number"].as_i64().unwrap();
475 
        let page = call(app, "GET", &format!("/andy/demo/proposal/{n}"), None, None, None, None).await;
476 
        assert_eq!(page.status, StatusCode::OK);
477 
        assert!(page.body.contains("feature/"), "the page names its source");
478 
    }
479 
    let body = r#"{"title":"None","target":"main","source":"feature/3-none"}"#;
480 
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/proposals", Some(&bob_rw), Some(body)).await;
481 
    assert!(st.is_client_error() && v.to_string().contains("no bookmark feature/3-none"), "{st} {v}");
739a763a Andy McCall ↶ 482
483 
    // oxygenhub#76: a proposal's title and description are edited through
484 
    // the API by its author or a maintainer; what is not given stays.
485 
    let edit = |token: &str, number: i64, body: &str| {
486 
        let (app, token, body) = (app.clone(), token.to_string(), body.to_string());
487 
        async move { api(&app, "PATCH", &format!("/api/v1/repos/andy/demo/proposals/{number}"), Some(&token), Some(&body)).await }
488 
    };
489 
    let (st, v) = edit(&bob_rw, 2, r#"{"body":"8 of 8, not 9 of 9"}"#).await;
490 
    assert_eq!(st, StatusCode::OK, "{v}");
491 
    assert_eq!((v["title"].as_str(), v["body"].as_str()), (Some("Feat"), Some("8 of 8, not 9 of 9")), "{v}");
492 
    let (st, v) = edit(&andy_pw, 2, r#"{"title":"Feat, renamed"}"#).await;
493 
    assert_eq!(st, StatusCode::OK, "a maintainer edits another's proposal: {v}");
494 
    assert_eq!((v["title"].as_str(), v["body"].as_str()), (Some("Feat, renamed"), Some("8 of 8, not 9 of 9")));
495 
    assert_eq!(edit(&bob_rw, 2, r#"{"title":"  "}"#).await.0, StatusCode::BAD_REQUEST, "a title is required");
496 
    assert_eq!(edit(&bob_rw, 99, r#"{"body":"x"}"#).await.0, StatusCode::NOT_FOUND);
497 
    // Andy's own proposal: Bob, a writer but not a maintainer, cannot edit it.
498 
    let (st, v) = api(
499 
        app,
500 
        "POST",
501 
        "/api/v1/repos/andy/demo/proposals",
502 
        Some(&andy_pw),
503 
        Some(r#"{"title":"Andy's","target":"main","source":"feature/1-one"}"#),
504 
    )
505 
    .await;
506 
    assert_eq!(st, StatusCode::CREATED, "{v}");
507 
    let n = v["number"].as_i64().unwrap();
508 
    assert_eq!(edit(&bob_rw, n, r#"{"body":"mine now"}"#).await.0, StatusCode::FORBIDDEN);
509 
    assert_eq!(edit(&andy_ro, 2, r#"{"body":"x"}"#).await.0, StatusCode::FORBIDDEN, "a read-only token cannot edit");
2291f8cc Andy McCall ↶ 510
511 
    // oxygenhub#80: labels on a proposal, the whole set by name, checked
512 
    // before anything changes, shown in its JSON.
513 
    for l in ["ui", "flow"] {
514 
        let body = format!(r#"{{"name":"{l}"}}"#);
515 
        assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_admin), Some(&body)).await.0, StatusCode::CREATED);
516 
    }
517 
    assert_eq!(edit(&bob_rw, 2, r#"{"labels":["ui"]}"#).await.0, StatusCode::FORBIDDEN, "labels need triage, not authorship");
518 
    let (st, v) = edit(&andy_pw, 2, r#"{"labels":["ui","flow"]}"#).await;
519 
    assert_eq!(st, StatusCode::OK, "{v}");
520 
    let names = |v: &serde_json::Value| -> Vec<String> {
521 
        v["labels"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap().to_string()).collect()
522 
    };
523 
    assert_eq!(names(&v), ["flow", "ui"]);
524 
    assert_eq!(v["title"], "Feat, renamed", "labels alone leave the text");
525 
    let (st, _) = edit(&andy_pw, 2, r#"{"labels":["ui","nope"]}"#).await;
526 
    assert_eq!(st, StatusCode::BAD_REQUEST, "an unknown label is refused");
527 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/proposals/2", None, None).await;
528 
    assert_eq!(names(&v), ["flow", "ui"], "and nothing changed");
529 
    let (_, v) = edit(&andy_pw, 2, r#"{"labels":["flow"]}"#).await;
530 
    assert_eq!(names(&v), ["flow"]);
531 
    assert_eq!(edit(&andy_ro, 2, r#"{"labels":[]}"#).await.0, StatusCode::FORBIDDEN);
b64e2537 Andy McCall ↶ 532 
}
76f262e1 Andy McCall ↶ 533
534 
#[tokio::test(flavor = "multi_thread")]
535 
async fn api_issue_triage_and_labels() {
536 
    let h = hub().await;
537 
    let app = &h.app;
538 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
539 
        .await
540 
        .cookie
541 
        .unwrap();
542 
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
543 
        .await
544 
        .cookie
545 
        .unwrap();
546 
    let mint = |cookie: String, scopes: &'static str| {
547 
        let app = app.clone();
548 
        async move {
549 
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
550 
            let csrf = csrf_of(&page.body);
551 
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
552 
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
553 
        }
554 
    };
555 
    let andy_t = mint(andy, "scopes=repo%3Aadmin").await;
556 
    let bob_t = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
557 
    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&andy_t), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
558 
    assert_eq!(st, StatusCode::CREATED);
559
560 
    // Labels through the API; bad colours and non-triage callers are refused.
561 
    let (st, v) = api(
562 
        app,
563 
        "POST",
564 
        "/api/v1/repos/andy/demo/labels",
565 
        Some(&andy_t),
566 
        Some(r##"{"name":"bug","colour":"#ff0000","description":"Broken"}"##),
567 
    )
568 
    .await;
569 
    assert_eq!((st, v["name"].as_str()), (StatusCode::CREATED, Some("bug")));
570 
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r#"{"name":"flow"}"#)).await.0, StatusCode::CREATED);
571 
    assert_eq!(
572 
        api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&andy_t), Some(r##"{"name":"x","colour":"red"}"##)).await.0,
573 
        StatusCode::BAD_REQUEST
574 
    );
575 
    assert_eq!(api(app, "POST", "/api/v1/repos/andy/demo/labels", Some(&bob_t), Some(r#"{"name":"mine"}"#)).await.0, StatusCode::FORBIDDEN);
576 
    let (_, labels) = api(app, "GET", "/api/v1/repos/andy/demo/labels", None, None).await;
577 
    assert_eq!(labels.as_array().unwrap().len(), 2);
5ea4872f Andy McCall ↶ 578 
    // oxygenhub#91: milestones over the API, for triage.
579 
    let (st, m) = api(
580 
        app,
581 
        "POST",
582 
        "/api/v1/repos/andy/demo/milestones",
583 
        Some(&andy_t),
584 
        Some(r#"{"title":"v1","description":"First","due":"2027-01-01"}"#),
585 
    )
586 
    .await;
587 
    assert_eq!((st, m["title"].as_str(), m["state"].as_str()), (StatusCode::CREATED, Some("v1"), Some("open")), "{m}");
588 
    assert_eq!(m["due_ms"].as_i64(), Some(1_798_761_600_000));
589 
    assert_eq!(
590 
        api(app, "POST", "/api/v1/repos/andy/demo/milestones", Some(&andy_t), Some(r#"{"title":"v2","due":"soon"}"#)).await.0,
591 
        StatusCode::BAD_REQUEST
592 
    );
593 
    assert_eq!(
594 
        api(app, "POST", "/api/v1/repos/andy/demo/milestones", Some(&bob_t), Some(r#"{"title":"mine"}"#)).await.0,
595 
        StatusCode::FORBIDDEN
596 
    );
597 
    let (st, m) =
598 
        api(app, "PATCH", "/api/v1/repos/andy/demo/milestones/v1", Some(&andy_t), Some(r#"{"title":"v1.0","due":"","state":"closed"}"#))
599 
            .await;
600 
    assert_eq!(
601 
        (st, m["title"].as_str(), m["state"].as_str(), m["due_ms"].is_null()),
602 
        (StatusCode::OK, Some("v1.0"), Some("closed"), true),
603 
        "{m}"
604 
    );
605 
    assert_eq!(m["description"].as_str(), Some("First"), "what is not given stays");
606 
    assert_eq!(
607 
        api(app, "PATCH", "/api/v1/repos/andy/demo/milestones/v1", Some(&andy_t), Some(r#"{"state":"open"}"#)).await.0,
608 
        StatusCode::NOT_FOUND,
609 
        "renamed"
610 
    );
611 
    assert_eq!(
612 
        api(app, "PATCH", "/api/v1/repos/andy/demo/milestones/v1.0", Some(&andy_t), Some(r#"{"state":"done"}"#)).await.0,
613 
        StatusCode::BAD_REQUEST
614 
    );
615 
    let (_, list) = api(app, "GET", "/api/v1/repos/andy/demo/milestones", None, None).await;
616 
    assert_eq!(list.as_array().unwrap().len(), 1);
76f262e1 Andy McCall ↶ 617
618 
    // An issue created with its labels and assignee in one call.
619 
    let (st, v) = api(
620 
        app,
621 
        "POST",
622 
        "/api/v1/repos/andy/demo/issues",
623 
        Some(&andy_t),
624 
        Some(r#"{"title":"Crash","body":"b","labels":["bug"],"assignees":["bob"]}"#),
625 
    )
626 
    .await;
627 
    assert_eq!(st, StatusCode::CREATED, "{v}");
628 
    assert_eq!(v["labels"][0]["name"], "bug");
629 
    assert_eq!(v["assignees"], serde_json::json!(["bob"]));
630 
    let n = v["number"].as_i64().unwrap();
631 
    // Unknown names are refused before anything is created.
632 
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&andy_t), Some(r#"{"title":"X","labels":["nope"]}"#)).await;
633 
    assert_eq!(st, StatusCode::BAD_REQUEST);
634 
    assert!(v["detail"].as_str().unwrap().contains("no label"));
635 
    let (_, list) = api(app, "GET", "/api/v1/repos/andy/demo/issues?state=all", None, None).await;
636 
    assert_eq!(list.as_array().unwrap().len(), 1, "nothing half-made");
637 
    // Without triage, labels cannot be set, but a plain issue can be opened.
638 
    assert_eq!(
639 
        api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"Y","labels":["bug"]}"#)).await.0,
640 
        StatusCode::FORBIDDEN
641 
    );
642 
    let (st, bobs) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&bob_t), Some(r#"{"title":"From Bob"}"#)).await;
643 
    assert_eq!(st, StatusCode::CREATED);
644 
    let bob_n = bobs["number"].as_i64().unwrap();
645
646 
    // PATCH: the whole label set, assignees and milestone, with events.
647 
    let (st, v) =
648 
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"labels":["flow"],"assignees":[]}"#))
649 
            .await;
650 
    assert_eq!(st, StatusCode::OK, "{v}");
651 
    assert_eq!(v["labels"].as_array().unwrap().iter().map(|l| l["name"].as_str().unwrap()).collect::<Vec<_>>(), ["flow"]);
652 
    assert_eq!(v["assignees"], serde_json::json!([]));
653 
    let (st, _) = api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"milestone":"v9"}"#)).await;
654 
    assert_eq!(st, StatusCode::BAD_REQUEST, "no such milestone");
655 
    let issue_page = call(app, "GET", &format!("/andy/demo/issue/{n}"), None, None, None, None).await.body;
656 
    assert!(issue_page.contains("set labels") && issue_page.contains("unassigned"), "timeline events");
657 
    // The author edits their own title; others cannot; nobody but triage sets labels.
658 
    let (st, v) =
659 
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"title":"From Bob, clearer"}"#)).await;
660 
    assert_eq!((st, v["title"].as_str()), (StatusCode::OK, Some("From Bob, clearer")));
661 
    assert_eq!(
662 
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&bob_t), Some(r#"{"title":"mine now"}"#)).await.0,
663 
        StatusCode::FORBIDDEN
664 
    );
665 
    assert_eq!(
666 
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{bob_n}"), Some(&bob_t), Some(r#"{"labels":["bug"]}"#)).await.0,
667 
        StatusCode::FORBIDDEN
668 
    );
669 
    assert_eq!(
670 
        api(app, "PATCH", &format!("/api/v1/repos/andy/demo/issues/{n}"), Some(&andy_t), Some(r#"{"title":"  "}"#)).await.0,
671 
        StatusCode::BAD_REQUEST
672 
    );
673
674 
    // Deleting a label takes it off the issues.
675 
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NO_CONTENT);
676 
    let (_, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/issues/{n}"), None, None).await;
677 
    assert_eq!(v["labels"], serde_json::json!([]));
678 
    assert_eq!(api(app, "DELETE", "/api/v1/repos/andy/demo/labels/flow", Some(&andy_t), None).await.0, StatusCode::NOT_FOUND);
679 
}
9756c67d Andy McCall ↶ 680
681 
#[tokio::test(flavor = "multi_thread")]
682 
async fn webhook_formats_editing_and_web_issue_events() {
683 
    let h = hub().await;
684 
    let app = &h.app;
685 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
686 
        .await
687 
        .cookie
688 
        .unwrap();
689 
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
690 
    let r = call(
691 
        app,
692 
        "POST",
693 
        "/settings/tokens",
694 
        None,
695 
        Some(&andy),
696 
        None,
697 
        Some(&format!("_csrf={}&name=t&scopes=repo%3Aadmin", csrf_of(&page.body))),
698 
    )
699 
    .await;
700 
    let token = r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap();
701 
    assert_eq!(
702 
        api(app, "POST", "/api/v1/repos", Some(&token), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await.0,
703 
        StatusCode::CREATED
704 
    );
705 
    let rx = receiver().await;
706 
    *rx.fail_first.lock().unwrap() = false;
707 
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
708 
    let csrf = csrf_of(&settings);
709 
    let form = |f: String| {
710 
        let andy = andy.clone();
711 
        async move { call(app, "POST", "/andy/demo/settings/hooks", None, Some(&andy), None, Some(&f)).await.body }
712 
    };
713 
    let url = rx.url.replace(':', "%3A").replace('/', "%2F");
714 
    assert!(form(format!("_csrf={csrf}&url={url}&format=discord&events=*")).await.contains("Webhook added"));
715 
    let hook = oxygenhub::db::hooks::hooks_for_repo(&app.db, 1).await.unwrap().remove(0);
716 
    assert_eq!(hook.format, "discord");
717 
    // Ping arrives as a Discord message.
718 
    form(format!("_csrf={csrf}&id={}&action=ping", hook.id)).await;
719 
    let mut got = String::new();
720 
    for _ in 0..100 {
721 
        if let Some((_, _, body)) = rx.seen.lock().unwrap().first() {
722 
            got = body.clone();
723 
        }
724 
        if !got.is_empty() {
725 
            break;
726 
        }
727 
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
728 
    }
729 
    let v: serde_json::Value = serde_json::from_str(&got).unwrap();
730 
    assert_eq!(v["embeds"][0]["title"], "OxygenHub is connected");
731 
    assert_eq!(v["allowed_mentions"]["parse"], serde_json::json!([]));
732 
    let page = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body;
733 
    assert!(page.contains("last delivery <span class=\"sig sig-valid\">✔</span> 200"), "the table shows how it went");
734
735 
    // Editing: a blank URL and secret keep theirs; format, events and active change.
736 
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=&secret=&events=issue&format=oxygenhub&active=1", hook.id))
737 
        .await
738 
        .contains("Webhook saved"));
739 
    let edited = oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap();
740 
    assert_eq!(
741 
        (edited.url.as_str(), edited.events.as_str(), edited.format.as_str(), edited.active),
742 
        (rx.url.as_str(), "issue", "oxygenhub", true)
743 
    );
744 
    assert!(form(format!("_csrf={csrf}&id={}&action=update&url=ftp%3A%2F%2Fx&events=*", hook.id)).await.contains("starts with http"));
745
746 
    // An issue opened on the web now reaches the hook, as the signed envelope.
747 
    let new = call(app, "GET", "/andy/demo/issues/new", None, Some(&andy), None, None).await.body;
748 
    call(
749 
        app,
750 
        "POST",
751 
        "/andy/demo/issues/new",
752 
        None,
753 
        Some(&andy),
754 
        None,
755 
        Some(&format!("_csrf={}&title=From+the+web&body=hello", csrf_of(&new))),
756 
    )
757 
    .await;
758 
    let mut envelope = None;
759 
    for _ in 0..100 {
760 
        envelope = rx.seen.lock().unwrap().iter().find(|(e, _, _)| e == "issue.opened").cloned();
761 
        if envelope.is_some() {
762 
            break;
763 
        }
764 
        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
765 
    }
766 
    let (_, sig, body) = envelope.expect("issue.opened delivered");
767 
    let v: serde_json::Value = serde_json::from_str(&body).unwrap();
768 
    assert_eq!(v["data"]["issue"]["title"], "From the web");
769 
    assert!(sig.starts_with("blake3-keyed="));
770 
    // A disabled hook through the edit form (no active box).
771 
    form(format!("_csrf={csrf}&id={}&action=update&url=&events=*&format=oxygenhub", hook.id)).await;
772 
    assert!(!oxygenhub::db::hooks::hook(&app.db, hook.id).await.unwrap().unwrap().active);
773 
}
ef20fdc1 Andy McCall ↶ 774
775 
#[tokio::test(flavor = "multi_thread")]
776 
async fn api_projects() {
777 
    let h = hub().await;
778 
    let app = &h.app;
779 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
780 
        .await
781 
        .cookie
782 
        .unwrap();
783 
    let bob = call(app, "POST", "/register", None, None, None, Some("username=bob&email=b%40example.com&password=correct-horse-battery"))
784 
        .await
785 
        .cookie
786 
        .unwrap();
787 
    let mint = |cookie: String, scopes: &'static str| {
788 
        let app = app.clone();
789 
        async move {
790 
            let page = call(&app, "GET", "/settings/tokens", None, Some(&cookie), None, None).await;
791 
            let csrf = csrf_of(&page.body);
792 
            let r = call(&app, "POST", "/settings/tokens", None, Some(&cookie), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
793 
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
794 
        }
795 
    };
796 
    let a = mint(andy, "scopes=repo%3Aadmin").await;
797 
    let b = mint(bob, "scopes=repo%3Aread&scopes=repo%3Awrite").await;
798 
    api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
799 
    api(app, "POST", "/api/v1/repos/andy/demo/issues", Some(&a), Some(r#"{"title":"Crash"}"#)).await;
800
801 
    let (st, p) = api(app, "POST", "/api/v1/projects/andy", Some(&a), Some(r#"{"title":"Roadmap","description":"Next"}"#)).await;
802 
    assert_eq!((st, p["number"].as_i64()), (StatusCode::CREATED, Some(1)), "{p}");
803 
    assert!(p["url"].as_str().unwrap().ends_with("/projects/andy/1"));
804 
    assert_eq!(api(app, "POST", "/api/v1/projects/andy", Some(&b), Some(r#"{"title":"Mine"}"#)).await.0, StatusCode::FORBIDDEN);
805 
    assert_eq!(api(app, "POST", "/api/v1/projects/nobody", Some(&a), Some(r#"{"title":"X"}"#)).await.0, StatusCode::NOT_FOUND);
806
807 
    // Cards by reference, into a column by name, and a note into the first column.
808 
    let (st, card) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"doing"}"#)).await;
809 
    assert_eq!(st, StatusCode::CREATED, "{card}");
810 
    assert_eq!(
811 
        (card["kind"].as_str(), card["reference"].as_str(), card["title"].as_str(), card["state"].as_str()),
812 
        (Some("issue"), Some("andy/demo#1"), Some("Crash"), Some("open"))
813 
    );
814 
    let (st, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1"}"#)).await;
815 
    assert_eq!(st, StatusCode::BAD_REQUEST);
816 
    assert!(v["detail"].as_str().unwrap().contains("already on this project"));
efb51b39 Andy McCall ↶ 817 
    // The form the board shows its cards in is taken too (#118); another owner's is refused.
818 
    let (_, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"andy/demo#1"}"#)).await;
819 
    assert!(v["detail"].as_str().unwrap().contains("already on this project"), "{v}");
820 
    let (_, v) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"other/demo#1"}"#)).await;
821 
    assert!(v["detail"].as_str().unwrap().contains("only andy's"), "{v}");
ef20fdc1 Andy McCall ↶ 822 
    assert_eq!(
823 
        api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"reference":"demo#1","column":"nope"}"#)).await.0,
824 
        StatusCode::BAD_REQUEST
825 
    );
826 
    let (st, note) = api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"Write docs"}"#)).await;
827 
    assert_eq!((st, note["kind"].as_str()), (StatusCode::CREATED, Some("note")));
828 
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&b), Some(r#"{"note":"hi"}"#)).await.0, StatusCode::FORBIDDEN);
829
830 
    // Move and read the board.
831 
    let id = card["id"].as_i64().unwrap();
832 
    assert_eq!(
833 
        api(app, "PATCH", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), Some(r#"{"column":"Done"}"#)).await.0,
834 
        StatusCode::NO_CONTENT
835 
    );
836 
    let (_, board) = api(app, "GET", "/api/v1/projects/andy/1", None, None).await;
837 
    let names: Vec<(&str, usize)> =
838 
        board["columns"].as_array().unwrap().iter().map(|c| (c["name"].as_str().unwrap(), c["cards"].as_array().unwrap().len())).collect();
839 
    assert_eq!(names, [("Backlog", 1), ("Doing", 0), ("Done", 1)]);
840 
    assert_eq!(board["columns"][2]["cards"][0]["reference"], "andy/demo#1");
17a3a84b Andy McCall ↶ 841 
    // The cards by column (#115), and a wrong method answers with a body.
842 
    let (st, cols) = api(app, "GET", "/api/v1/projects/andy/1/cards", None, None).await;
843 
    assert_eq!(st, StatusCode::OK);
844 
    assert_eq!(cols, board["columns"]);
845 
    let (st, v) = api(app, "PUT", "/api/v1/projects/andy/1/cards", Some(&a), Some("{}")).await;
846 
    assert_eq!(st, StatusCode::METHOD_NOT_ALLOWED);
847 
    assert!(v["detail"].as_str().unwrap().contains("not for PUT"), "{v}");
ef20fdc1 Andy McCall ↶ 848
849 
    // Private: hidden from others; closed: read-only; then remove a card.
850 
    let (_, edited) = api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"private":true}"#)).await;
851 
    assert_eq!(edited["public"], false);
852 
    assert_eq!(api(app, "GET", "/api/v1/projects/andy/1", Some(&b), None).await.0, StatusCode::NOT_FOUND);
853 
    assert_eq!(api(app, "GET", "/api/v1/projects/andy", None, None).await.1, serde_json::json!([]));
854 
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":true}"#)).await;
855 
    assert_eq!(api(app, "POST", "/api/v1/projects/andy/1/cards", Some(&a), Some(r#"{"note":"late"}"#)).await.0, StatusCode::CONFLICT);
856 
    api(app, "PATCH", "/api/v1/projects/andy/1", Some(&a), Some(r#"{"closed":false}"#)).await;
857 
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NO_CONTENT);
858 
    assert_eq!(api(app, "DELETE", &format!("/api/v1/projects/andy/1/cards/{id}"), Some(&a), None).await.0, StatusCode::NOT_FOUND);
859 
}
961c10be Andy McCall ↶ 860
861 
#[tokio::test(flavor = "multi_thread")]
862 
async fn api_required_checks() {
863 
    let h = hub().await;
864 
    let app = &h.app;
865 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
866 
        .await
867 
        .cookie
868 
        .unwrap();
869 
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
870 
    let csrf = csrf_of(&page.body);
871 
    let mint = |scopes: &'static str| {
872 
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
873 
        async move {
874 
            let r = call(&app, "POST", "/settings/tokens", None, Some(&andy), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
875 
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
876 
        }
877 
    };
878 
    let admin = mint("scopes=repo%3Aadmin").await;
879 
    let write = mint("scopes=repo%3Aread&scopes=repo%3Awrite").await;
880 
    api(app, "POST", "/api/v1/repos", Some(&admin), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
881
882 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await;
883 
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!([])));
884 
    let (st, v) = api(
885 
        app,
886 
        "PUT",
887 
        "/api/v1/repos/andy/demo/checks/required",
888 
        Some(&admin),
889 
        Some(r#"{"names":["flow/test"," flow/fmt ","flow/test",""]}"#),
890 
    )
891 
    .await;
892 
    assert_eq!((st, v["names"].clone()), (StatusCode::OK, serde_json::json!(["flow/fmt", "flow/test"])), "trimmed, sorted, once each");
893 
    assert_eq!(oxygenhub::db::hooks::required_checks(&app.db, 1).await.unwrap(), ["flow/fmt", "flow/test"]);
894 
    assert_eq!(
895 
        api(app, "GET", "/api/v1/repos/andy/demo/checks/required", None, None).await.1["names"],
896 
        serde_json::json!(["flow/fmt", "flow/test"])
897 
    );
898 
    assert_eq!(
899 
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&write), Some(r#"{"names":[]}"#)).await.0,
900 
        StatusCode::FORBIDDEN,
901 
        "repo:admin only"
902 
    );
903 
    assert_eq!(
904 
        api(app, "PUT", "/api/v1/repos/andy/demo/checks/required", Some(&admin), Some(r#"{"names":["a,b"]}"#)).await.0,
905 
        StatusCode::BAD_REQUEST
906 
    );
907 
    // The settings page shows the same list.
908 
    assert!(call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await.body.contains("flow/fmt, flow/test"));
909 
}
9008bf6c Andy McCall ↶ 910
911 
/// OxygenFlow per repository: site administrators turn it on or off in
912 
/// the repository's settings; hub.toml's `[flow] repos` is the default.
913 
#[tokio::test(flavor = "multi_thread")]
914 
async fn flow_is_switched_per_repository_by_site_admins() {
915 
    let h = hub().await;
916 
    let app = &h.app;
917 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
918 
        .await
919 
        .cookie
920 
        .unwrap();
921 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
922 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
923 
    let row = || async { oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap() };
924 
    assert!(!oxygenhub::flow::enabled(app, &row().await), "not in [flow] repos");
925 
    let tab = call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await;
926 
    assert!(tab.body.contains("not enabled") && tab.body.contains("/andy/demo/settings#flow"));
927
928 
    let set = |value: &'static str| {
929 
        let (app, andy) = (app.clone(), andy.clone());
930 
        async move {
931 
            let settings = call(&app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
932 
            call(
933 
                &app,
934 
                "POST",
935 
                "/andy/demo/settings/flow",
936 
                None,
937 
                Some(&andy),
938 
                None,
939 
                Some(&format!("_csrf={}&flow={value}", csrf_of(&settings.body))),
940 
            )
941 
            .await
942 
        }
943 
    };
944 
    // A repository admin who is not a site admin sees the state but cannot change it.
945 
    let id = oxygenhub::db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap().id;
946 
    oxygenhub::db::accounts::set_admin(&app.db, id, false).await.unwrap();
947 
    let settings = call(app, "GET", "/andy/demo/settings", None, Some(&andy), None, None).await;
948 
    assert!(settings.body.contains("do not start runs") && !settings.body.contains("name=\"flow\""));
949 
    let r = set("on").await;
950 
    assert!(r.body.contains("Only site administrators"), "{}", r.body);
951 
    assert_eq!(row().await.flow, "");
952
953 
    oxygenhub::db::accounts::set_admin(&app.db, id, true).await.unwrap();
954 
    let r = set("on").await;
955 
    assert!(r.body.contains("OxygenFlow is on"), "{}", r.body);
956 
    assert_eq!(row().await.flow, "on");
957 
    assert!(oxygenhub::flow::enabled(app, &row().await));
958 
    assert!(!call(app, "GET", "/andy/demo/flow", None, Some(&andy), None, None).await.body.contains("not enabled"));
959 
    set("off").await;
960 
    assert!(!oxygenhub::flow::enabled(app, &row().await));
961 
    set("default").await;
962 
    assert_eq!(row().await.flow, "");
963 
    assert!(set("sometimes").await.body.contains("Pick on, off"));
964 
}
e271a37b Andy McCall ↶ 965
966 
/// Deleting bookmarks (hub spec §6.4): pushed deletions and the delete
967 
/// button, never the repository's default bookmark as the hub sets it.
968 
#[tokio::test(flavor = "multi_thread")]
969 
async fn bookmarks_are_deleted_by_push_and_on_the_web() {
970 
    let h = hub().await;
971 
    let app = &h.app;
972 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
973 
        .await
974 
        .cookie
975 
        .unwrap();
976 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
977 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
978 
    let url = format!("{}/andy/demo", h.base);
979 
    let work = tempfile::tempdir().unwrap();
980 
    let (w, u) = (work.path().to_path_buf(), url.clone());
981 
    let client = tokio::task::spawn_blocking(move || {
982 
        let mut c = Repo::init(&w).unwrap();
983 
        c.config.set("remote.origin.url", &u).unwrap();
984 
        c.config.set("remote.origin.token", "site").unwrap();
985 
        c.save_config().unwrap();
986 
        write(&w, "a.txt", b"a\n");
987 
        c.commit("a", &[]).unwrap();
988 
        assert!(c.push("origin", false).unwrap()[0].ok);
989 
        for b in ["develop", "feature/x", "stray"] {
990 
            c.bookmark_create(b, None).unwrap();
991 
            assert!(c.push_bookmark("origin", b, false).unwrap()[0].ok);
992 
        }
993 
        // A pushed deletion.
994 
        let r = c.push_delete("origin", "feature/x").unwrap();
995 
        assert!(r[0].ok, "{r:?}");
996 
        c
997 
    })
998 
    .await
999 
    .unwrap();
1000 
    let page = call(app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
1001 
    assert!(!page.body.contains(">feature/x<") && page.body.contains(">stray<"), "{}", page.body);
1002 
    assert!(page.body.contains("/andy/demo/bookmarks/delete"), "writers see delete buttons");
1003 
    let anon = call(app, "GET", "/andy/demo/bookmarks", None, None, None, None).await;
1004 
    assert!(!anon.body.contains("/bookmarks/delete"));
1005
1006 
    // The hub's default, not the repository's config, is protected: make
1007 
    // develop the default, then main can go and develop cannot.
1008 
    let row = oxygenhub::db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();
1009 
    oxygenhub::db::repos::set_default_bookmark(&app.db, row.id, "develop").await.unwrap();
1010 
    let client = tokio::task::spawn_blocking(move || {
1011 
        let r = client.push_delete("origin", "develop").unwrap();
1012 
        assert!(!r[0].ok && r[0].reason.contains("default bookmark"), "{r:?}");
1013 
        let r = client.push_delete("origin", "main").unwrap();
1014 
        assert!(r[0].ok, "{r:?}");
1015 
        client
1016 
    })
1017 
    .await
1018 
    .unwrap();
1019 
    drop(client);
1020
1021 
    // On the web: a writer deletes stray; the default is refused.
1022 
    let form = |b: &'static str| {
1023 
        let (app, andy) = (app.clone(), andy.clone());
1024 
        async move {
1025 
            let page = call(&app, "GET", "/andy/demo/bookmarks", None, Some(&andy), None, None).await;
1026 
            call(
1027 
                &app,
1028 
                "POST",
1029 
                "/andy/demo/bookmarks/delete",
1030 
                None,
1031 
                Some(&andy),
1032 
                None,
1033 
                Some(&format!("_csrf={}&bookmark={b}", csrf_of(&page.body))),
1034 
            )
1035 
            .await
1036 
        }
1037 
    };
1038 
    let r = form("stray").await;
1039 
    assert!(r.body.contains("Deleted stray"), "{}", r.body);
1040 
    assert!(!r.body.contains(">stray<"));
1041 
    let r = form("develop").await;
1042 
    assert!(r.body.contains("is the default bookmark"), "{}", r.body);
1043 
    let r = form("nope").await;
1044 
    assert!(r.body.contains("There is no bookmark nope"), "{}", r.body);
1045 
    let pushes = call(app, "GET", "/andy/demo/pushes", None, Some(&andy), None, None).await;
1046 
    assert!(pushes.body.contains("deleted on the web"), "logged like a push");
1047 
    // Anonymous visitors cannot.
1048 
    assert_ne!(
1049 
        call(app, "POST", "/andy/demo/bookmarks/delete", None, None, None, Some("_csrf=x&bookmark=develop")).await.status,
1050 
        StatusCode::OK
1051 
    );
1052 
}
760a7dd3 Andy McCall ↶ 1053
1054 
/// A change signed by a key no account has linked says so, on its page
1055 
/// and in the API (feedback 14).
1056 
#[tokio::test(flavor = "multi_thread")]
1057 
async fn changes_signed_by_unlinked_keys_say_so() {
1058 
    let h = hub().await;
1059 
    let app = &h.app;
1060 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1061 
        .await
1062 
        .cookie
1063 
        .unwrap();
1064 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
1065 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
1066 
    let url = format!("{}/andy/demo", h.base);
1067 
    let work = tempfile::tempdir().unwrap();
1068 
    let (w, u, home) = (work.path().to_path_buf(), url.clone(), work.path().join(".home"));
1069 
    let hash = tokio::task::spawn_blocking(move || {
1070 
        let mut c = Repo::init(&w.join("r")).unwrap().with_home(home);
1071 
        c.config.set("remote.origin.url", &u).unwrap();
1072 
        c.config.set("remote.origin.token", "site").unwrap();
1073 
        c.save_config().unwrap();
1074 
        c.create_identity("Ada", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();
1075 
        write(&w.join("r"), "a.txt", b"a\n");
1076 
        let h = c.commit("signed by Ada", &[]).unwrap();
1077 
        assert!(c.push("origin", false).unwrap()[0].ok);
1078 
        h.to_hex()
1079 
    })
1080 
    .await
1081 
    .unwrap();
1082 
    let (st, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{hash}"), None, None).await;
1083 
    assert_eq!(st, StatusCode::OK, "{v}");
1084 
    assert!(v["change"]["author"]["account"].is_null(), "{v}");
1085 
    assert!(v["change"]["author"]["note"].as_str().unwrap().contains("not linked"), "{v}");
1086 
    let page = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, Some(&andy), None, None).await;
1087 
    assert!(page.body.contains("key not linked") && page.body.contains("/settings/keys"), "a signed-in viewer is pointed at Settings");
1088 
    let anon = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, None, None, None).await;
1089 
    assert!(anon.body.contains("key not linked") && !anon.body.contains("link your key"));
1090 
}
65be9f9c Andy McCall ↶ 1091
1092 
/// Function history (hub spec §6.6): the file page lists a file's
1093 
/// functions, and a function's page lists exactly the changes to its lines.
1094 
#[tokio::test(flavor = "multi_thread")]
1095 
async fn a_function_has_its_own_history() {
1096 
    let h = hub().await;
1097 
    let app = &h.app;
1098 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1099 
        .await
1100 
        .cookie
1101 
        .unwrap();
1102 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
1103 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
1104 
    let url = format!("{}/andy/demo", h.base);
1105 
    let work = tempfile::tempdir().unwrap();
1106 
    let w = work.path().to_path_buf();
1107 
    tokio::task::spawn_blocking(move || {
1108 
        let mut c = Repo::init(&w).unwrap();
1109 
        c.config.set("remote.origin.url", &url).unwrap();
1110 
        c.config.set("remote.origin.token", "site").unwrap();
1111 
        c.save_config().unwrap();
1112 
        let steps = [
1113 
            ("add lib", "use x;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
1114 
            ("change the import", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n    }\n}\n"),
1115 
            ("log twice", "use y;\n\nimpl Repo {\n    fn log(&self) {\n        one();\n        one();\n    }\n}\n"),
1116 
        ];
1117 
        for (msg, text) in steps {
1118 
            write(&w, "src/lib.rs", text.as_bytes());
1119 
            c.commit(msg, &[]).unwrap();
1120 
        }
1121 
        assert!(c.push("origin", false).unwrap()[0].ok);
1122 
    })
1123 
    .await
1124 
    .unwrap();
1125 
    let file = call(app, "GET", "/andy/demo/file/main/src/lib.rs", None, None, None, None).await.body;
1126 
    assert!(file.contains("Functions") && file.contains("/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog"), "{file}");
1127 
    let r = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=7&name=Repo%3A%3Alog", None, None, None, None).await;
1128 
    assert_eq!(r.status, StatusCode::OK, "{}", r.body);
1129 
    assert!(r.body.contains("History of <code>Repo::log</code>") && r.body.contains("2 changes"), "{}", r.body);
1130 
    assert!(r.body.contains("log twice") && r.body.contains("add lib") && !r.body.contains("change the import"));
1131 
    let bad = call(app, "GET", "/andy/demo/function/main/src/lib.rs?start=4&end=99", None, None, None, None).await;
1132 
    assert_ne!(bad.status, StatusCode::OK);
1133 
}
92574625 Andy McCall ↶ 1134
1135 
/// Swimlanes (hub spec §6.7): independent changes in their own lanes,
1136 
/// dependency edges, linked cards.
1137 
#[tokio::test(flavor = "multi_thread")]
1138 
async fn a_bookmark_shows_as_swimlanes() {
1139 
    let h = hub().await;
1140 
    let app = &h.app;
1141 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1142 
        .await
1143 
        .cookie
1144 
        .unwrap();
1145 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
1146 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
1147 
    let url = format!("{}/andy/demo", h.base);
1148 
    let work = tempfile::tempdir().unwrap();
1149 
    let w = work.path().to_path_buf();
1150 
    tokio::task::spawn_blocking(move || {
1151 
        let mut c = Repo::init(&w).unwrap();
1152 
        c.config.set("remote.origin.url", &url).unwrap();
1153 
        c.config.set("remote.origin.token", "site").unwrap();
1154 
        c.save_config().unwrap();
1155 
        // Two files edited independently: two lanes.
1156 
        write(&w, "a.txt", b"a\n");
1157 
        c.commit("add a", &[]).unwrap();
1158 
        write(&w, "b.txt", b"b\n");
1159 
        c.commit("add b", &[]).unwrap();
1160 
        write(&w, "a.txt", b"a\na2\n");
1161 
        c.commit("grow a", &[]).unwrap();
1162 
        assert!(c.push("origin", false).unwrap()[0].ok);
1163 
    })
1164 
    .await
1165 
    .unwrap();
1166 
    let hist = call(app, "GET", "/andy/demo/changes/main", None, None, None, None).await.body;
1167 
    assert!(hist.contains("/andy/demo/lanes/main"), "the history page links the board");
1168 
    let r = call(app, "GET", "/andy/demo/lanes/main", None, None, None, None).await;
1169 
    assert_eq!(r.status, StatusCode::OK, "{}", r.body);
1170 
    assert!(r.body.contains("3 changes in 2 lanes"), "{}", r.body);
1171 
    let start = r.body.find("<div class=\"lanes-board\"").unwrap();
1172 
    let board = &r.body[start..start + r.body[start..].find("</svg>").unwrap()];
1173 
    assert_eq!(board.matches("<rect ").count(), 3);
1174 
    assert_eq!(board.matches("<path d=\"M").count(), 1, "grow a depends on add a only");
1175 
    assert!(r.body.contains("grow a") && r.body.contains("/andy/demo/change/"));
1176 
}
2bfe5ef6 Andy McCall ↶ 1177
1178 
/// Planning rewrites from a proposal's swimlanes (hub spec §6.7): the hub
1179 
/// offers only what makes sense and rewrites nothing itself.
1180 
#[tokio::test(flavor = "multi_thread")]
1181 
async fn a_proposal_board_plans_squashes_and_rebases() {
1182 
    let h = hub().await;
1183 
    let app = &h.app;
1184 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1185 
        .await
1186 
        .cookie
1187 
        .unwrap();
1188 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
1189 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
1190 
    let url = format!("{}/andy/demo", h.base);
1191 
    let work = tempfile::tempdir().unwrap();
1192 
    let w = work.path().to_path_buf();
1193 
    let (base, first, second, apart) = tokio::task::spawn_blocking(move || {
1194 
        let mut c = Repo::init(&w).unwrap();
1195 
        c.config.set("remote.origin.url", &url).unwrap();
1196 
        c.config.set("remote.origin.token", "site").unwrap();
1197 
        c.save_config().unwrap();
1198 
        write(&w, "a.txt", b"a\n");
1199 
        let base = c.commit("base", &[]).unwrap();
1200 
        assert!(c.push("origin", false).unwrap()[0].ok);
1201 
        c.bookmark_create("feature", None).unwrap();
1202 
        c.bookmark_switch("feature", false).unwrap();
1203 
        write(&w, "a.txt", b"a\nfirst\n");
1204 
        let first = c.commit("first", &[]).unwrap();
1205 
        write(&w, "a.txt", b"a\nfirst\nsecond\n");
1206 
        let second = c.commit("second", &[]).unwrap();
1207 
        write(&w, "b.txt", b"apart\n");
1208 
        let apart = c.commit("apart", &[]).unwrap();
1209 
        assert!(c.push_bookmark("origin", "feature", false).unwrap()[0].ok);
1210 
        (base.to_hex(), first.to_hex(), second.to_hex(), apart.to_hex())
1211 
    })
1212 
    .await
1213 
    .unwrap();
1214 
    // No proposal yet: the board is read-only.
1215 
    let board = call(app, "GET", "/andy/demo/lanes/feature", None, Some(&andy), None, None).await.body;
1216 
    assert!(!board.contains("data-plan="));
1217 
    let (st, _) = api(
1218 
        app,
1219 
        "POST",
1220 
        "/api/v1/repos/andy/demo/proposals",
1221 
        Some("site"),
1222 
        Some(r#"{"title":"Feature","target":"main","source":"feature"}"#),
1223 
    )
1224 
    .await;
1225 
    assert!(st.is_success(), "{st}");
1226 
    let board = call(app, "GET", "/andy/demo/lanes/feature", None, Some(&andy), None, None).await.body;
1227 
    assert!(board.contains("data-plan=\"/andy/demo/lanes/feature/plan\""), "{board}");
1228 
    let csrf = csrf_of(&board);
1229 
    let plan = |c: &str, t: &str| {
1230 
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
1231 
        let form = format!("_csrf={csrf}&change={c}&target={t}");
1232 
        async move {
1233 
            let r = call(&app, "POST", "/andy/demo/lanes/feature/plan", None, Some(&andy), None, Some(&form)).await;
1234 
            serde_json::from_str::<serde_json::Value>(&r.body).unwrap()
1235 
        }
1236 
    };
1237 
    let kinds = |v: &serde_json::Value| {
1238 
        v["options"].as_array().map(|a| a.iter().map(|o| o["kind"].as_str().unwrap().to_string()).collect::<Vec<_>>()).unwrap_or_default()
1239 
    };
1240 
    // second already depends on first: squash, no rebase.
1241 
    let v = plan(&second, &first).await;
1242 
    assert_eq!(kinds(&v), ["squash"], "{v}");
1243 
    assert!(v["options"][0]["command"].as_str().unwrap().contains(&format!("oxy squash #{second} --into #{first}")));
c96b3286 Andy McCall ↶ 1244 
    assert!(v["options"][0]["vscode"].as_str().unwrap().starts_with("vscode://oxygenhub.oxygen-vscode/plan?"));
2bfe5ef6 Andy McCall ↶ 1245 
    // apart is independent of second: either.
1246 
    assert_eq!(kinds(&plan(&apart, &second).await), ["squash", "rebase"]);
1247 
    // first under second: nothing (second depends on first).
1248 
    assert!(plan(&first, &second).await["error"].is_string());
1249 
    // What has landed on main is not rearranged.
1250 
    assert!(plan(&second, &base).await["error"].as_str().unwrap().contains("already on main"));
1251 
}
38833ed7 Andy McCall ↶ 1252
1253 
/// Issues and proposals share a number space, so every number says what it
1254 
/// is, and the chain of work shows from both ends (hub spec §8).
1255 
#[tokio::test(flavor = "multi_thread")]
1256 
async fn proposals_and_issues_show_their_chain() {
1257 
    let h = hub().await;
1258 
    let app = &h.app;
1259 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1260 
        .await
1261 
        .cookie
1262 
        .unwrap();
1263 
    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;
1264 
    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;
1265 
    let url = format!("{}/andy/demo", h.base);
1266 
    let work = tempfile::tempdir().unwrap();
1267 
    let w = work.path().to_path_buf();
1268 
    tokio::task::spawn_blocking(move || {
1269 
        let mut c = Repo::init(&w).unwrap();
1270 
        c.config.set("remote.origin.url", &url).unwrap();
1271 
        c.config.set("remote.origin.token", "site").unwrap();
1272 
        c.save_config().unwrap();
1273 
        write(&w, "a.txt", b"a\n");
1274 
        c.commit("base", &[]).unwrap();
1275 
        assert!(c.push("origin", false).unwrap()[0].ok);
1276 
        c.bookmark_create("feature", None).unwrap();
1277 
        c.bookmark_switch("feature", false).unwrap();
1278 
        write(&w, "a.txt", b"a\nfixed\n");
1279 
        c.commit("Fix the crash\n\nfixes #2", &[]).unwrap();
1280 
        assert!(c.push_bookmark("origin", "feature", false).unwrap()[0].ok);
1281 
    })
1282 
    .await
1283 
    .unwrap();
1284 
    for title in ["Slow start", "Crash on save"] {
1285 
        let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/issues", Some("site"), Some(&format!(r#"{{"title":"{title}"}}"#))).await;
1286 
        assert!(st.is_success());
1287 
    }
1288 
    let (st, v) = api(
1289 
        app,
1290 
        "POST",
1291 
        "/api/v1/repos/andy/demo/proposals",
1292 
        Some("site"),
1293 
        Some(r#"{"title":"Faster, safer","body":"Closes #1. See also #2.","target":"main","source":"feature"}"#),
1294 
    )
1295 
    .await;
1296 
    assert!(st.is_success(), "{st} {v}");
1297 
    assert_eq!(v["number"], 3, "one number space: issues 1 and 2, then proposal 3");
1298
1299 
    // The proposal names its kind, links its references by kind, and shows
1300 
    // the chain: the issues it closes (description and changes) → it → main.
1301 
    let p = call(app, "GET", "/andy/demo/proposal/3", None, None, None, None).await.body;
1302 
    assert!(p.contains(">proposal #3</small>"), "header");
1303 
    assert!(p.contains(">issue #1</a>") && p.contains(">issue #2</a>"), "links in the description say what they point at");
1304 
    let chain = &p[p.find("class=\"chain\"").expect("a chain")..];
1305 
    let chain = &chain[..chain.find("</p>").unwrap()];
1306 
    for want in ["issue #1</span> Slow start", "issue #2</span> Crash on save", "proposal #3", ">main<"] {
1307 
        assert!(chain.contains(want), "chain lacks {want:?}: {chain}");
1308 
    }
1309 
    assert!(p.contains("<h3>Closes</h3>"));
1310
1311 
    // The issue shows the proposal that closes it, and names its own kind.
1312 
    let i = call(app, "GET", "/andy/demo/issue/1", None, None, None, None).await.body;
1313 
    assert!(i.contains(">issue #1</small>"));
1314 
    let chain = &i[i.find("class=\"chain\"").expect("a chain on the issue")..];
1315 
    assert!(chain.contains("closed by") && chain.contains("proposal #3</span> Faster, safer"), "{chain}");
a1b98695 Andy McCall ↶ 1316 
    // The conversation is a timeline with avatars; editing sits with the
1317 
    // content, not in the sidebar, and labels and projects are editable.
1318 
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
1319 
    assert!(p.contains("class=\"tl-avatar\" src=\"/avatar/"), "avatars");
1320 
    assert!(p.contains("id=\"edit\"") && !p.contains("<h3>Edit</h3>"), "the editor is inline, not in the sidebar");
1321 
    assert!(p.contains("no labels yet") && p.contains("/andy/demo/labels"), "a way to make labels");
1322 
    let (st, _) = api(app, "POST", "/api/v1/projects/andy", Some("site"), Some(r#"{"title":"Board"}"#)).await;
1323 
    assert!(st.is_success(), "{st}");
1324 
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
9e50caed Andy McCall ↶ 1325 
    assert!(
1326 
        p.contains("name=\"project\" value=\"1\"") && p.contains("Add to a project") && p.contains("Board<small>"),
1327 
        "the owner's projects to add to, in a menu"
1328 
    );
a1b98695 Andy McCall ↶ 1329 
    let csrf = csrf_of(&p);
1330 
    call(app, "POST", "/andy/demo/proposal/3/project", None, Some(&andy), None, Some(&format!("_csrf={csrf}&project=1&action=add"))).await;
1331 
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
1332 
    assert!(p.contains("/projects/andy/1\">Board</a>") && p.contains("value=\"remove\""), "on the project, removable");
1333 
    call(app, "POST", "/andy/demo/proposal/3/project", None, Some(&andy), None, Some(&format!("_csrf={csrf}&project=1&action=remove")))
1334 
        .await;
1335 
    let p = call(app, "GET", "/andy/demo/proposal/3", None, Some(&andy), None, None).await.body;
1336 
    assert!(!p.contains("/projects/andy/1\">Board</a>"), "taken off again");
1337
38833ed7 Andy McCall ↶ 1338 
    // Closed by the proposal's change, not its description: still shown.
1339 
    let two = call(app, "GET", "/andy/demo/issue/2", None, None, None, None).await.body;
1340 
    let chain = &two[two.find("class=\"chain\"").expect("a chain on issue 2")..];
1341 
    assert!(chain.contains("proposal #3"), "{chain}");
1342 
}
e9bfea8e Andy McCall ↶ 1343
1344 
/// What the hub is: its version and build, and the libraries it is built on,
1345 
/// on /about, in the API and in /health (hub spec §15).
1346 
#[tokio::test(flavor = "multi_thread")]
1347 
async fn the_hub_says_what_version_it_is() {
1348 
    let h = hub().await;
1349 
    let app = &h.app;
1350 
    let (st, v) = api(app, "GET", "/api/v1/version", None, None).await;
1351 
    assert_eq!(st, StatusCode::OK);
1352 
    assert_eq!(v["oxygenhub"]["version"], env!("CARGO_PKG_VERSION"));
1353 
    assert!(v["oxygenhub"]["build"].as_str().is_some_and(|b| !b.is_empty()), "{v}");
1354 
    assert!(v["oxy_core"].as_str().is_some() && v["flow_core"].as_str().is_some());
1355 
    let health = call(app, "GET", "/health", None, None, None, None).await.body;
1356 
    assert!(health.contains("\"build\""), "{health}");
b2107275 Andy McCall ↶ 1357 
    let h: serde_json::Value = serde_json::from_str(&health).unwrap();
1358 
    assert!(h["state_cache"]["budget_mb"].as_u64().is_some_and(|b| b > 0) && h["state_cache"]["states"].is_u64(), "{health}");
e9bfea8e Andy McCall ↶ 1359 
    let about = call(app, "GET", "/about", None, None, None, None).await.body;
1360 
    assert!(about.contains(&format!("<strong>{}</strong>", env!("CARGO_PKG_VERSION"))) && about.contains("oxy-core"), "{about}");
1361 
    assert!(about.contains("href=\"/about\""), "the footer links here");
1362 
}
df71c789 Andy McCall ↶ 1363
1364 
#[tokio::test(flavor = "multi_thread")]
1365 
async fn device_sign_in() {
1366 
    let h = hub().await;
1367 
    let app = &h.app;
1368 
    let r =
1369 
        call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery")).await;
1370 
    let andy = r.cookie.unwrap();
1371
1372 
    // An unknown scope is refused.
1373 
    let (st, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"x","scopes":["root"]}"#)).await;
1374 
    assert_eq!((st, v["error"].as_str()), (StatusCode::BAD_REQUEST, Some("invalid_scope")));
1375
1376 
    // The app asks for a code and polls; nobody has approved it yet.
1377 
    let (st, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"Phone app","scopes":["repo:read","user:read"]}"#)).await;
1378 
    assert_eq!(st, StatusCode::OK, "{v}");
1379 
    let device = v["device_code"].as_str().unwrap().to_string();
1380 
    let user = v["user_code"].as_str().unwrap().to_string();
1381 
    assert_eq!(v["verification_uri_complete"], format!("{}/device?code={user}", h.base));
1382 
    let poll = format!(r#"{{"device_code":"{device}"}}"#);
1383 
    let (st, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
1384 
    assert_eq!((st, v["error"].as_str()), (StatusCode::BAD_REQUEST, Some("authorization_pending")));
1385 
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
1386 
    assert_eq!(v["error"], "slow_down", "polled too soon");
1387
1388 
    // The user approves it on the web, allowing less than it asked for.
1389 
    let page = call(app, "GET", &format!("/device?code={}", user.to_lowercase().replace('-', "")), None, Some(&andy), None, None).await;
1390 
    assert!(page.body.contains("Phone app") && page.body.contains("repo:read"), "{}", page.body);
1391 
    let csrf = csrf_of(&page.body);
1392 
    let r =
1393 
        call(app, "POST", "/device", None, Some(&andy), None, Some(&format!("_csrf={csrf}&code={user}&action=approve&scopes=user%3Aread")))
1394 
            .await;
4da8b828 Andy McCall ↶ 1395 
    // oxygenhub#83: the answer page says it is done, with no code form.
1396 
    assert!(r.body.contains("Signed in") && r.body.contains("nothing to copy or enter"), "{}", r.body);
1397 
    assert!(!r.body.contains("The code your app shows"), "no code form after approving");
df71c789 Andy McCall ↶ 1398
1399 
    // The next poll gets a token with what was allowed, once.
1400 
    let (st, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
1401 
    assert_eq!(st, StatusCode::OK, "{v}");
1402 
    assert_eq!((v["scope"].as_str(), v["username"].as_str()), (Some("user:read"), Some("andy")));
1403 
    let token = v["access_token"].as_str().unwrap().to_string();
1404 
    let (st, v) = api(app, "GET", "/api/v1/user", Some(&token), None).await;
1405 
    assert_eq!((st, v["username"].as_str()), (StatusCode::OK, Some("andy")));
1406 
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;
1407 
    assert_eq!(v["error"], "expired_token", "a code gives one token");
1408 
    let tokens = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
1409 
    assert!(tokens.body.contains("device: Phone app"));
60f11b71 Andy McCall ↶ 1410 
    // oxygenhub#70: a device's token expires, and each use renews it.
1411 
    assert!(tokens.body.contains("renewed on use"), "{}", tokens.body);
df71c789 Andy McCall ↶ 1412
60f11b71 Andy McCall ↶ 1413 
    // The token can revoke itself (oxy auth logout), and is then refused.
1414 
    let (st, _) = api(app, "DELETE", "/api/v1/user/token", Some(&token), None).await;
1415 
    assert_eq!(st, StatusCode::NO_CONTENT);
1416 
    let (st, _) = api(app, "GET", "/api/v1/user", Some(&token), None).await;
1417 
    assert_eq!(st, StatusCode::UNAUTHORIZED);
1418 
    let (st, _) = api(app, "DELETE", "/api/v1/user/token", None, None).await;
1419 
    assert_eq!(st, StatusCode::UNAUTHORIZED, "revoking needs a token");
1420
df71c789 Andy McCall ↶ 1421 
    // A denied code says so.
1422 
    let (_, v) = api(app, "POST", "/api/v1/device/code", None, Some(r#"{"client":"Other"}"#)).await;
1423 
    let (device, user) = (v["device_code"].as_str().unwrap().to_string(), v["user_code"].as_str().unwrap().to_string());
1424 
    let page = call(app, "GET", &format!("/device?code={user}"), None, Some(&andy), None, None).await;
1425 
    let csrf = csrf_of(&page.body);
1426 
    call(app, "POST", "/device", None, Some(&andy), None, Some(&format!("_csrf={csrf}&code={user}&action=deny"))).await;
1427 
    let (_, v) = api(app, "POST", "/api/v1/device/token", None, Some(&format!(r#"{{"device_code":"{device}"}}"#))).await;
1428 
    assert_eq!(v["error"], "access_denied");
1429
1430 
    // Signed out, the page asks for a sign-in first.
1431 
    let r = call(app, "GET", "/device", None, None, None, None).await;
1432 
    assert!(r.status.is_redirection(), "{}", r.status);
1433 
}
62ceb2ee Andy McCall ↶ 1434
1435 
#[tokio::test(flavor = "multi_thread")]
1436 
async fn api_assistants_at_each_level() {
1437 
    let h = hub().await;
1438 
    let app = &h.app;
1439 
    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))
1440 
        .await
1441 
        .cookie
1442 
        .unwrap();
1443 
    let page = call(app, "GET", "/settings/tokens", None, Some(&andy), None, None).await;
1444 
    let csrf = csrf_of(&page.body);
1445 
    let mint = |scopes: &'static str| {
1446 
        let (app, andy, csrf) = (app.clone(), andy.clone(), csrf.clone());
1447 
        async move {
1448 
            let r = call(&app, "POST", "/settings/tokens", None, Some(&andy), None, Some(&format!("_csrf={csrf}&name=t&{scopes}"))).await;
1449 
            r.body.split("oxyhub_").nth(1).map(|s| format!("oxyhub_{}", s.split('<').next().unwrap().trim())).unwrap()
1450 
        }
1451 
    };
1452 
    let admin = mint("scopes=repo%3Aadmin").await;
1453 
    let write = mint("scopes=repo%3Aread&scopes=repo%3Awrite").await;
1454 
    api(app, "POST", "/api/v1/repos", Some(&admin), Some(r#"{"owner":"andy","name":"demo","visibility":"public"}"#)).await;
1455 
    // A stand-in endpoint with no model list: any model name is taken.
1456 
    let router = axum::Router::new().route(
1457 
        "/v1/chat/completions",
1458 
        axum::routing::post(|| async { axum::Json(serde_json::json!({ "choices": [{ "message": { "content": "OK" } }] })) }),
1459 
    );
1460 
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
1461 
    let port = listener.local_addr().unwrap().port();
1462 
    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });
1463 
    let ep = format!("http://127.0.0.1:{port}/v1/chat/completions");
1464
1465 
    // The site's, by its administrator; the repository's, by its admin.
1466 
    let body = serde_json::json!({ "preset": "gemini", "endpoint": ep, "model": "gemini-3-pro", "token": "sk-secret" }).to_string();
1467 
    let (st, v) = api(app, "POST", "/api/v1/admin/assistants", Some(&admin), Some(&body)).await;
1468 
    assert_eq!(st, StatusCode::OK, "{v}");
1469 
    assert_eq!(v["ok"], "Gemini added");
1470 
    let body =
1471 
        serde_json::json!({ "name": "Claude", "endpoint": ep, "api": "chat-completions", "model": "m", "token": "sk-2" }).to_string();
1472 
    let (st, _) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&write), Some(&body)).await;
1473 
    assert_eq!(st, StatusCode::FORBIDDEN, "repo:admin is needed");
1474 
    let (st, v) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&admin), Some(&body)).await;
1475 
    assert_eq!(st, StatusCode::OK, "{v}");
1476 
    let (st, v) = api(app, "GET", "/api/v1/repos/andy/demo/assistants", Some(&admin), None).await;
1477 
    assert_eq!(st, StatusCode::OK);
1478 
    let names: Vec<(&str, &str, bool)> = v
1479 
        .as_array()
1480 
        .unwrap()
1481 
        .iter()
1482 
        .map(|a| (a["name"].as_str().unwrap(), a["from"].as_str().unwrap_or(""), a["has_token"].as_bool().unwrap()))
1483 
        .collect();
1484 
    assert_eq!(names, [("Gemini", "the site", true), ("Claude", "", true)]);
1485 
    assert!(!v.to_string().contains("sk-"), "tokens never come back");
1486 
    // Changing it keeps the token when none is given.
1487 
    let body = serde_json::json!({ "name": "Claude", "endpoint": ep, "api": "chat-completions", "model": "m2" }).to_string();
1488 
    let (_, v) = api(app, "POST", "/api/v1/repos/andy/demo/assistants", Some(&admin), Some(&body)).await;
1489 
    assert_eq!(v["ok"], "Claude updated");
1490 
    let (_, v) = api(app, "GET", "/api/v1/repos/andy/demo/assistants", Some(&admin), None).await;
1491 
    assert_eq!((v[1]["model"].as_str(), v[1]["has_token"].as_bool()), (Some("m2"), Some(true)));
1492 
    // Prompts: the site's is inherited by the repository.
1493 
    let (st, _) = api(app, "PUT", "/api/v1/admin/assistants/prompt", Some(&admin), Some(r#"{"prompt":"Be brief."}"#)).await;
1494 
    assert_eq!(st, StatusCode::OK);
1495 
    let (_, v) = api(app, "PUT", "/api/v1/repos/andy/demo/assistants/prompt", Some(&admin), Some(r#"{"prompt":"Rust."}"#)).await;
1496 
    assert_eq!(v["prompt"], "Rust.");
1497 
    assert_eq!(v["inherited"], serde_json::json!([["the site", "Be brief."]]));
1498 
    // Removed.
1499 
    let (st, _) = api(app, "DELETE", "/api/v1/repos/andy/demo/assistants/claude", Some(&admin), None).await;
1500 
    assert_eq!(st, StatusCode::NO_CONTENT);
1501 
    let (st, _) = api(app, "DELETE", "/api/v1/repos/andy/demo/assistants/claude", Some(&admin), None).await;
1502 
    assert_eq!(st, StatusCode::NOT_FOUND);
1503 
}