ace-git-forgejo 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf55e32720105f61ee776ab2e828cc52eff70422d40169c3ec473faa8918852e
-  data.tar.gz: d53c30cfdd65d9efd401846871c8572a48442c68d280a0615e7d9b04c8792b45
+  metadata.gz: b31bdebd863b7bee391783037e9aef4dab2a1ac4bede0b2b897e8442ac297b7f
+  data.tar.gz: db3a546c09effeda3781370316a691cb893af860cb0212ef982320a521ab9cc0
 SHA512:
-  metadata.gz: c3d888812cbbec6e223ddfca72514bbee53f3281374825b4147c4f1ebc3fd415528f4fc5c08eafadb6cfed35df6acac4220955f629e15b90dc593d91ceee963c
-  data.tar.gz: 9dd8b2e6fed777a0c038b111e448c536c0a960c7a7ff53e6d0d9ca1e200bd083e591cb35bf6d7943ec552e206b006021a7314b9bb615e93a9df1a34e179c1f98
+  metadata.gz: b4323793a3d0b8b0f217bf7acca41d31d89dc9316b14c51509352edc903760d6811e7412497d1189bf9339cd774154ac6fbc70b506d4c0587a017a3bc8dce2f9
+  data.tar.gz: e501d7e7d7ddf48e3194eb6a110c29df8984ba5f873295c0d6bbbbaa621987dcd814f50ede1fb594eb7f18c605dd1b8bc98edb2ca95a3cb6837db8f7a829d305

data/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.1] - 2026-10-04
+
+### Fixed
+- Prove Forgejo's source repository selector before PR creation and bind accepted receipts to source/base repository IDs, refs, SHA and draft state. Incomplete accepted responses and failed verification remain unknown outcomes without replay.
+
 ## [0.6.0] - 2026-10-04
 
 ### Added
@@ -19,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 - The fj-era refusals for fork creation, draft-to-ready, and expected-head merging; the conservative `fj pr merge`/`pr edit` paths are replaced by the API lifecycle.
+- The unused `expected_head` plumbing on the review-comment reconciliation helpers (internal refactor; no behavior change).
 
 ## [0.5.0] - 2026-10-03
 

data/README.md

@@ -96,3 +96,5 @@ Forgejo-specific conventions the provider translates:
 
 Identical lifecycle assertions run against every provider through the
 shared `Ace::TestSupport::PullRequestLifecycleContract` parity suite.
+
+Create preflight verifies the repository that Forgejo's `owner:branch` selector resolves, including direct forks and a fork's parent. Sharing an owner, branch or SHA does not establish source identity. An accepted create returns a receipt only when the response and authoritative read agree with the requested repository IDs, refs, SHA and draft state. A failed or contradictory verification stays `unknown_outcome`; reconcile by reading the exact identity before authorizing another mutation.

data/lib/ace/git/forgejo/http_client.rb

@@ -101,6 +101,8 @@ module Ace
         def exchange_path(suffix)
           return suffix if suffix.to_s.start_with?("/api/v1/")
 
+          return "/api/v1/repos/#{@target.repo}" if suffix.to_s.empty?
+
           "/api/v1/repos/#{@target.repo}/#{suffix}"
         end
 

data/lib/ace/git/forgejo/provider.rb

@@ -496,7 +496,17 @@ module Ace
           head_arg = api_head_argument!(head_repository_url, head_ref)
           send_title = draft_title!(title, draft)
           pr_api.ensure_version_supported!
-          outcome = send_lifecycle_mutation(identity_text(head_repository_url, head_ref, base_ref)) do
+          requested_head = head_repository_url.to_s.empty? ? server.url : head_repository_url
+          owner = Ace::Git::Atoms::ServerUrl.normalize(requested_head).split("/")[1]
+          base_identity, head_identity = pr_api.create_repository_identity(owner: owner)
+          unless Ace::Git::Atoms::ServerUrl.match?("#{server_host_root}/#{base_identity["full_name"]}", server.url) &&
+              Ace::Git::Atoms::ServerUrl.match?("#{server_host_root}/#{head_identity["full_name"]}", requested_head)
+            raise Ace::Git::ProviderIdentityMismatchError,
+              "Forgejo head selector does not select #{requested_head}; refusing create"
+          end
+          identity = "#{identity_text(requested_head, head_ref, base_ref)}, " \
+            "expected head #{expected_head}, draft #{draft.inspect}"
+          outcome = send_lifecycle_mutation(identity) do
             pr_api.create_pull_request(head: head_arg, base: base_ref, title: send_title, body: body)
           end
 
@@ -506,13 +516,31 @@ module Ace
             return reconcile_raced_create(head_repository_url: head_repository_url, head_ref: head_ref,
               base_ref: base_ref, expected_head: expected_head, draft: draft)
           end
-          unless outcome.status == 201 && outcome.payload.is_a?(Hash) && outcome.payload["number"].is_a?(Integer)
+          unless (200..299).cover?(outcome.status)
             classify_create_refusal(outcome, head_repository_url, head_ref, base_ref)
           end
 
-          created = verify_expected_head!(pull_request(number: outcome.payload["number"]), expected_head)
-          ensure_draft_outcome!(created, draft)
-          receipt(:create, created, :created)
+          begin
+            payload = outcome.payload
+            unless outcome.status == 201 && payload.is_a?(Hash) &&
+                payload["number"].is_a?(Integer) && payload["number"].positive?
+              raise Ace::Git::ProviderMalformedOutputError, "Accepted create lacks pull request identity"
+            end
+            accepted = pr_api.creation_evidence(payload)
+            verify_created_identity!(accepted, requested_head, head_ref, base_ref, expected_head,
+              draft, base_identity, head_identity)
+            after = pr_api.pull_request(payload["number"])
+            created = verify_created_identity!(after, requested_head, head_ref, base_ref, expected_head,
+              draft, base_identity, head_identity)
+            receipt(:create, created, :created)
+          rescue Ace::Git::Error => e
+            known_number = outcome.payload.is_a?(Hash) && outcome.payload["number"]
+            known_number = "unknown" unless known_number.is_a?(Integer) && known_number.positive?
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Forgejo accepted create but verification failed (#{e.class.name.split("::").last}); " \
+              "reconcile by exact identity before repeating: #{identity_text(requested_head, head_ref, base_ref)}, " \
+              "expected head #{expected_head}, draft #{draft.inspect}, PR #{known_number}"
+          end
         end
 
         # Edit title/body after exact-head verification through the same
@@ -650,6 +678,19 @@ module Ace
             "#{e.message}; reconcile by exact identity before repeating: #{identity}"
         end
 
+        def verify_created_identity!(payload, head_url, head_ref, base_ref, expected_head,
+          draft, base_identity, head_identity)
+          created = verify_expected_head!(normalize_api_pr(payload), expected_head)
+          unless created.state == :open && created.head_ref == head_ref && created.base_ref == base_ref &&
+              Ace::Git::Atoms::ServerUrl.match?(created.head_repository_url, head_url) &&
+              payload.dig("head", "repo", "id") == head_identity["id"] &&
+              payload.dig("base", "repo", "id") == base_identity["id"]
+            raise Ace::Git::ProviderIdentityMismatchError, "Created pull request provenance does not match request"
+          end
+          ensure_draft_outcome!(created, draft)
+          created
+        end
+
         # Server-derived draft state must agree with the request for an
         # existing exact match to be reusable.
         def ensure_draft_agreement!(existing, draft)
@@ -709,6 +750,9 @@ module Ace
         # an owner path; cross-host sources are refused before any
         # mutation (the exact-match lookup may read first).
         def api_head_argument!(head_repository_url, head_ref)
+          if head_ref.to_s.empty? || head_ref.include?(":")
+            raise Ace::Git::ProviderIdentityMismatchError, "Head ref cannot encode a repository selector"
+          end
           return head_ref if head_repository_url.nil? ||
             Ace::Git::Atoms::ServerUrl.match?(head_repository_url, server.url)
           unless same_server_authority?(head_repository_url)
@@ -717,7 +761,8 @@ module Ace
               "selected server #{server.url}; only canonical and same-server fork sources are supported"
           end
 
-          owner = URI.parse(head_repository_url.to_s).path.to_s.split("/").reject(&:empty?).first
+          segments = Ace::Git::Atoms::ServerUrl.normalize(head_repository_url).split("/")[1..]
+          owner = segments.first if segments.length == 2 && segments.none?(&:empty?)
           unless owner
             raise Ace::Git::ProviderIdentityMismatchError,
               "Head repository #{head_repository_url.inspect} has no owner path; " \
@@ -740,7 +785,11 @@ module Ace
         # a deleted fork repository reports none, and that absence stays
         # honest instead of being relabelled.
         def api_head_repository_url(payload)
-          full_name = payload.dig("head", "repo", "full_name")
+          repo = payload.dig("head", "repo")
+          unless repo.nil? || repo.is_a?(Hash)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo source repository evidence"
+          end
+          full_name = repo && repo["full_name"]
           return nil if !full_name.is_a?(String) || full_name.empty?
 
           "#{server_host_root}/#{full_name}"
@@ -750,7 +799,11 @@ module Ace
         # repository must be the selected one: a misrouted payload is never
         # relabelled.
         def normalize_api_pr(payload)
-          base_full_name = payload.dig("base", "repo", "full_name").to_s
+          base_repo = payload.dig("base", "repo")
+          unless base_repo.nil? || base_repo.is_a?(Hash)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo destination repository evidence"
+          end
+          base_full_name = base_repo.is_a?(Hash) ? base_repo["full_name"].to_s : ""
           unless !base_full_name.empty? && base_full_name.casecmp(repository_target.repo).zero?
             raise Ace::Git::ProviderIdentityMismatchError,
               "Forgejo returned pull request ##{payload["number"]} with base repository " \

data/lib/ace/git/forgejo/pull_request_api.rb

@@ -97,6 +97,29 @@ module Ace
           @http.paginate("pulls?state=open").map { |payload| validate_pr_payload!(payload, payload["number"]) }
         end
 
+        # Prove the repository selected by Forgejo's owner:branch resolver.
+        # Forgejo uses the selected repository for its own owner, otherwise
+        # a direct fork owned by that user (the supported Forgejo 8 resolver).
+        def create_repository_identity(owner:)
+          base = repository_identity!(@http.request(:get, ""))
+          return [base, base] if base.dig("owner", "login").casecmp?(owner)
+
+          forks = @http.paginate("forks").map { |entry| repository_identity!(entry) }
+          matches = forks.select { |entry| entry.dig("owner", "login").casecmp?(owner) }
+          if matches.length > 1
+            raise Ace::Git::ProviderConflictingMatchesError, "Forgejo fork selector is ambiguous for #{owner}"
+          end
+          head = matches.first
+          unless head
+            raise Ace::Git::ProviderIdentityMismatchError, "Forgejo cannot prove fork selector for #{owner}"
+          end
+          [base, head]
+        end
+
+        def creation_evidence(payload)
+          validate_pr_payload!(payload, payload.is_a?(Hash) ? payload["number"] : nil)
+        end
+
         # Send the create mutation. The head argument must already be in the
         # documented API form (plain branch, or "owner:branch" for a
         # same-server fork).
@@ -154,6 +177,17 @@ module Ace
           raise error, "Forgejo #{operation} returned HTTP #{status}; reconcile before repeating"
         end
 
+        def repository_identity!(payload)
+          unless payload.is_a?(Hash) && payload["id"].is_a?(Integer) && payload["id"].positive? &&
+              payload["full_name"].is_a?(String) && payload["full_name"].match?(%r{\A[^/:\s?#]+/[^/:\s?#]+\z}) &&
+              payload["owner"].is_a?(Hash) && payload.dig("owner", "id").is_a?(Integer) && payload.dig("owner", "id").positive? &&
+              payload.dig("owner", "login").is_a?(String) && !payload.dig("owner", "login").empty? &&
+              payload["full_name"].split("/").first.casecmp?(payload.dig("owner", "login"))
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo repository selector evidence"
+          end
+          payload
+        end
+
         def validate_pr_payload!(payload, requested_number)
           unless payload.is_a?(Hash)
             raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo pull request evidence"

data/lib/ace/git/forgejo/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Git
     module Forgejo
-      VERSION = "0.6.0"
+      VERSION = "0.6.1"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ace-git-forgejo
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Michal Czyz