haveapi 0.32.0 → 0.32.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 543db42b7a86f64548fb4b06cc9b7aec1fedaad147de9814a43860f4a2333e14
-  data.tar.gz: 4cdf30eb588b0ab495391fe5bc93f630e272b5f3a1f73187c16a293030e5de00
+  metadata.gz: fef6937fc8c3a3f3ae382a0c6032ae6fcc7900ad9fb6480aed9a9f3c43556c7d
+  data.tar.gz: 4339642a36b69c79396e92fcba4acdd3cb13292a63a0afac90b9dfe22c0d4920
 SHA512:
-  metadata.gz: 835dda07aaea82261a29912c7d03270811053dcb16113b2d80b388b8a4c24b848438a9cd7c7ac6866867940501e5bfe35abf62f39eb34f6a66a47fc14c4376a2
-  data.tar.gz: 359f066b2dae8e27c3a2918606cd7aafe5b671e9098d379ee98fb8761df069a49335cd0966cfad715d4a94267e6c01b300e5e213e20f297fd2bcb22735926096
+  metadata.gz: 632a7cb540320f32451ff939e1d6044dd75a8382cd7d32ac0858a1a82533509c1e3935b73904d44f30b3226b4bec337b729d4a870aa4691adcbbfc0ab1c2da9a
+  data.tar.gz: ed900045161d35036c3dd5002f395f0ca05e2db1a7d12327c74be483c2adafd2b554cc49313fd3a5ea089c29a9a16069f2d41d009dc3130b7784be4b9c588b42

data/doc/documentation-oauth.md

@@ -41,10 +41,35 @@ token expiry. No refresh token is stored or used.
 
 `switch_user` defaults to `false` and accepts only `true` or `false`. Enable it
 only after verifying that a fresh authorization for this dedicated client lets
-the reader enter different credentials. For vpsAdmin, this requires a dedicated
-nondefault client with `allow_single_sign_on=false`. This option asserts that
-the operator has checked that behavior; it does not discover account-selection
-support or send `prompt` or `select_account` parameters.
+the reader enter different credentials. This option asserts that the operator
+has checked that behavior; it does not discover account-selection support or
+send `prompt` or `select_account` parameters.
+
+`switch_user_revoke_params` defaults to `{}` and accepts a static hash of string
+keys and string values. These fields are added to the revoke POST only for a
+validated Switch user request. They are never sent during ordinary Sign out,
+authorization or token exchange. The required `client_id`, `client_secret`,
+`token` and `token_type_hint` fields cannot be configured through this option.
+The server copies and freezes the hash and its strings at startup; browser
+fields and later changes to the original hash cannot change the revoke payload.
+The option has no effect when `switch_user` is `false`.
+
+For example, a dedicated nondefault vpsAdmin client can allow SSO and use the
+provider's `close_sso` revoke parameter when switching:
+
+```ruby
+api.documentation_oauth(
+  # Include the client, callback, session and scope options shown above.
+  switch_user: true,
+  switch_user_revoke_params: { 'close_sso' => '1' }
+)
+```
+
+Verify that the provider accepts these parameters and that the next authorization
+allows different credentials. Revoking the documentation token alone can leave
+SSO available when another active authorization shares it. Provider-specific
+SSO closure need not revoke that other authorization's access token. A dedicated
+client with SSO disabled is another way to permit account switching.
 
 The callback must be an absolute HTTPS URL with the exact mounted callback path,
 without credentials, query or fragment. The server takes authorize, token and
@@ -145,13 +170,19 @@ state and PKCE values; the old pending attempt and session are cleared. No retur
 URL or scope supplied by the switch request changes that destination. Cancelling
 the new authorization leaves the old documentation session signed out. A revoke
 failure retains the 502 response described above and does not continue to login.
-Switching does not sign out of the provider's whole-account SSO session.
+Switching can request provider-specific SSO behavior through the configured
+revoke parameters; HaveAPI does not interpret them or guarantee whole-account
+sign-out. Ordinary Sign out still revokes only the documentation token without
+those parameters.
 
 To disable this feature, remove its optional configuration before starting older
-documentation code. Existing API data needs no migration or rollback. Cookies
-expire or are ignored. Disable or revoke the dedicated OAuth client through
-normal provider administration when needed; documentation rollback does not
-delete clients automatically. Without this configuration, documentation remains
+documentation code. In particular, remove `switch_user_revoke_params` before
+rolling back to a HaveAPI version that does not support it; the unknown option
+would prevent startup. Upgrade HaveAPI before enabling the option, including on
+each worker that loads the configuration. Existing API data needs no migration
+or rollback. Cookies expire or are ignored. Disable or revoke the dedicated
+OAuth client through normal provider administration when needed; documentation
+rollback does not delete clients automatically. Without this configuration, documentation remains
 anonymous and offers no authentication controls; ordinary API authentication is
 unchanged. Older documentation code may use API credentials and legacy browser
 sign-in routes again. Rolling back requires no cookie or database migration.

data/doc/performance.md

@@ -312,8 +312,15 @@ Missing event/source evidence fails even when no relevant path can be establishe
 The immutable accepted reference is
 `b85ec364057f536940d689b09e612512ffffaf82`. Required ancestry is checked. The
 reference and budgets never move automatically. Deleted branches, malformed or
-missing commits, unavailable new-branch fallback, partial manual pairs and equal
-endpoints fail. PRs use the head commit, never the synthetic merge commit. An
+missing commits, unavailable new-branch fallback and partial manual pairs fail.
+Equal endpoints also fail, except for a validated quick branch push with a zero
+`before` whose merge-base with the captured default equals the candidate. This
+includes branches created at the default head or an older commit already
+contained in it. The resolver retains the exact candidate, baseline and
+captured-default SHAs, an explanatory reason and empty changed paths, and sets
+`relevant: false`. The workflow records `no-work` without running benchmarks or
+reporting a measured performance result. The campaign runner still requires
+distinct sources. PRs use the head commit, never the synthetic merge commit. An
 existing branch push uses `before`, never `HEAD^` or a guessed fallback. A quick
 push can compare a nonancestor before/after pair after a force push; its exact
 event pair is carried through all ancestry guards. Direct CLI use of that

data/haveapi.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= #{File.read('../../.ruby-version').strip}"
 
   s.add_dependency 'activesupport', '>= 7.1'
-  s.add_dependency 'haveapi-client', '~> 0.32.0'
+  s.add_dependency 'haveapi-client', '~> 0.32.1'
   s.add_dependency 'i18n', '>= 1.6', '< 2'
   s.add_dependency 'json'
   s.add_dependency 'mail'

data/lib/haveapi/documentation_oauth.rb

@@ -19,7 +19,8 @@ module HaveAPI
     COOKIE_LIMIT = 3800
     RESPONSE_LIMIT = 16_384
     PENDING_LIFETIME = 600
-    FIELDS = %i[client_id client_secret redirect_uri session_secret scope session_lifetime switch_user].freeze
+    FIELDS = %i[client_id client_secret redirect_uri session_secret scope session_lifetime
+                switch_user switch_user_revoke_params].freeze
 
     class Transport
       def post(uri, parameters)
@@ -93,6 +94,15 @@ module HaveAPI
         raise Invalid, 'Invalid documentation OAuth switch-user capability'
       end
 
+      revoke_params = options.fetch(:switch_user_revoke_params, {})
+      unless revoke_params.is_a?(Hash) && revoke_params.all? do |name, value|
+               name.is_a?(String) && value.is_a?(String) && !%w[client_id client_secret token token_type_hint].include?(name)
+             end
+        raise Invalid, 'Invalid documentation OAuth switch-user revoke parameters'
+      end
+
+      @switch_user_revoke_params = revoke_params.to_h { |name, value| [name.dup.freeze, value.dup.freeze] }.freeze
+
       @origin = "#{@redirect_uri.scheme}://#{@redirect_uri.host}"
       @origin += ":#{@redirect_uri.port}" unless @redirect_uri.port == 443
       key = ActiveSupport::KeyGenerator.new(secret, iterations: 65_536)
@@ -222,8 +232,10 @@ module HaveAPI
       end
       clear_cookie(handler, 'session')
       clear_cookie(handler, 'pending')
+      parameters = credentials.merge('token' => session.fetch('token'), 'token_type_hint' => 'access_token')
+      parameters.merge!(@switch_user_revoke_params) if switch_user
       begin
-        @transport.post(@endpoints.fetch(:revoke), credentials.merge('token' => session.fetch('token'), 'token_type_hint' => 'access_token'))
+        @transport.post(@endpoints.fetch(:revoke), parameters)
       rescue Failure
         handler.halt(502, { 'content-type' => 'text/html; charset=utf-8' },
                      '<p>Local sign-out succeeded, but the server session may remain until it expires.</p>' \

data/lib/haveapi/version.rb

@@ -1,4 +1,4 @@
 module HaveAPI
   PROTOCOL_VERSION = '2.0'.freeze
-  VERSION = '0.32.0'.freeze
+  VERSION = '0.32.1'.freeze
 end

data/spec/documentation/oauth_spec.rb

@@ -31,6 +31,27 @@ module DocumentationOAuthSpec
       User.new('basic-reader') if username == 'basic-reader' && password == 'basic-password'
     end
   end
+
+  class SharedSSOProvider
+    def initialize
+      @authorizations = %w[PRIVATE_ACCESS_TOKEN OTHER_ACCESS_TOKEN]
+      @sso_active = true
+    end
+
+    def revoke(parameters)
+      @authorizations.delete(parameters.fetch('token'))
+      @sso_active = false if @authorizations.empty? || parameters['end_shared_session'] == '1'
+      ''
+    end
+
+    def valid_token?(token)
+      @authorizations.include?(token)
+    end
+
+    def fresh_authorization_identity
+      'admin' if @sso_active
+    end
+  end
 end
 
 describe HaveAPI::DocumentationOAuth do
@@ -243,7 +264,7 @@ describe HaveAPI::DocumentationOAuth do
   end
 
   context 'with valid session CSRF and a switch-capable client' do
-    let(:oauth_options) { super().merge(switch_user: true) }
+    let(:oauth_options) { super().merge(switch_user: true, switch_user_revoke_params: { 'end_shared_session' => '1' }) }
 
     [nil, 'null', 'https://foreign.example', 'http://docs.example', 'https://docs.example:444'].each do |origin|
       [false, true].each do |switch_user|
@@ -269,7 +290,10 @@ describe HaveAPI::DocumentationOAuth do
       expect(last_response.headers).to include('Cache-Control' => 'private, no-store', 'Referrer-Policy' => 'no-referrer')
       expect(last_response.location).to eq('https://docs.example/api/_documentation/oauth/login?version=1')
       expect(cookie_headers).to include('_session=', '_pending=', 'max-age=0')
-      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'), hash_including('token' => 'PRIVATE_ACCESS_TOKEN'))
+      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'),
+                                                     'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                                                     'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token',
+                                                     'end_shared_session' => '1')
     end
   end
 
@@ -668,8 +692,122 @@ describe HaveAPI::DocumentationOAuth do
     expect { described_class.new(**oauth_options, switch_user: false) }.not_to raise_error
   end
 
+  it 'requires static string keys and values for switch-user revoke parameters' do
+    [nil, [], 'PRIVATE_VALUE', { end_shared_session: 'PRIVATE_VALUE' }, { 'extra' => nil },
+     { 'extra' => true }, { 'extra' => 1 }, { 'extra' => [] }, { 'extra' => { 'nested' => 'PRIVATE_VALUE' } }].each do |value|
+      expect { described_class.new(**oauth_options, switch_user_revoke_params: value) }
+        .to raise_error(described_class::Invalid, 'Invalid documentation OAuth switch-user revoke parameters')
+    end
+  end
+
+  %w[client_id client_secret token token_type_hint].each do |field|
+    it "rejects overriding required revoke field #{field} in configuration" do
+      expect { described_class.new(**oauth_options, switch_user_revoke_params: { field => 'PRIVATE_VALUE' }) }
+        .to raise_error(described_class::Invalid, 'Invalid documentation OAuth switch-user revoke parameters')
+    end
+  end
+
+  it 'keeps configured switch-user revoke parameters inert when switching is disabled' do
+    oauth_options[:switch_user_revoke_params] = { 'end_shared_session' => '1' }
+    sign_in
+    controls = capture_controls
+    csrf = session_csrf
+    expect(controls.last).not_to have_key(:switch_user)
+    cookie = rack_mock_session.cookie_jar.to_hash.find { |name, _| name.end_with?('_session') }
+    expect_switch_refused(cookie, '', URI.encode_www_form(csrf:, switch_user: '1'))
+    post 'https://docs.example/api/_documentation/oauth/logout', { csrf: }, 'HTTP_ORIGIN' => 'https://docs.example'
+    expect(last_response.status).to eq(303)
+    expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'),
+                                                   'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                                                   'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token')
+  end
+
+  [false, true].each do |configured|
+    context "with shared SSO and #{configured ? 'configured' : 'default'} switch-user revoke parameters" do
+      let(:oauth_options) do
+        super().merge(switch_user: true).tap do |options|
+          options[:switch_user_revoke_params] = { 'end_shared_session' => '1' } if configured
+        end
+      end
+
+      it 'revokes only the documentation token and lets the provider decide whether fresh authorization reuses SSO' do
+        provider = DocumentationOAuthSpec::SharedSSOProvider.new
+        allow(transport).to receive(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'), anything) do |_, parameters|
+          provider.revoke(parameters)
+        end
+        sign_in
+        csrf = session_csrf
+        post 'https://docs.example/api/_documentation/oauth/logout', { csrf:, switch_user: '1' }, 'HTTP_ORIGIN' => 'https://docs.example'
+        expect(last_response.status).to eq(303)
+        fields = { 'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                   'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token' }
+        fields['end_shared_session'] = '1' if configured
+        expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'), fields)
+        expect(provider.valid_token?('PRIVATE_ACCESS_TOKEN')).to be(false)
+        expect(provider.valid_token?('OTHER_ACCESS_TOKEN')).to be(true)
+        get last_response.location
+        expect(last_response.status).to eq(302)
+        expect(provider.fresh_authorization_identity).to eq(configured ? nil : 'admin')
+      end
+    end
+  end
+
   context 'with user switching enabled' do
-    let(:oauth_options) { super().merge(switch_user: true) }
+    let(:oauth_options) { super().merge(switch_user: true, switch_user_revoke_params: { 'end_shared_session' => '1' }) }
+
+    it 'requires an authenticated documentation session before switching' do
+      post 'https://docs.example/api/_documentation/oauth/logout', { csrf: 'x' * 43, switch_user: '1' },
+           'HTTP_ORIGIN' => 'https://docs.example'
+      expect(last_response.status).to eq(403)
+      expect(cookie_headers).to be_empty
+      expect(transport).not_to have_received(:post)
+    end
+
+    it 'requires the configured HTTPS origin before switching' do
+      sign_in
+      csrf = session_csrf
+      name, value = rack_mock_session.cookie_jar.to_hash.find { |key, _| key.end_with?('_session') }
+      %w[http://docs.example https://foreign.example].each do |origin|
+        post "#{origin}/api/_documentation/oauth/logout", { csrf:, switch_user: '1' },
+             'HTTP_ORIGIN' => 'https://docs.example', 'HTTP_COOKIE' => "#{name}=#{Rack::Utils.escape(value)}"
+        expect(last_response.status).to eq(400)
+        expect(cookie_headers).to be_empty
+      end
+      expect(transport).to have_received(:post).once
+    end
+
+    it 'copies configured revoke fields before the caller mutates its hash, keys or values' do
+      key = +'end_shared_session'
+      value = +'1'
+      parameters = {}.compare_by_identity
+      parameters[key] = value
+      oauth_options[:switch_user_revoke_params] = parameters
+      app
+      key.replace('changed')
+      value.replace('changed')
+      parameters.clear
+      parameters['token'] = 'BROWSER_TOKEN'
+      sign_in
+      csrf = session_csrf
+      post 'https://docs.example/api/_documentation/oauth/logout', { csrf:, switch_user: '1' }, 'HTTP_ORIGIN' => 'https://docs.example'
+      expect(last_response.status).to eq(303)
+      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'),
+                                                     'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                                                     'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token',
+                                                     'end_shared_session' => '1')
+    end
+
+    it 'sends the original revoke form on ordinary sign-out even if the browser supplies extra fields' do
+      sign_in
+      csrf = session_csrf
+      post 'https://docs.example/api/_documentation/oauth/logout', { csrf:, end_shared_session: '1', token: 'BROWSER_TOKEN' },
+           'HTTP_ORIGIN' => 'https://docs.example'
+      expect(last_response.status).to eq(303)
+      expect(last_response.location).to eq('https://docs.example/api/v1/')
+      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'),
+                                                     'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                                                     'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token')
+    end
 
     it 'offers switching only after validated documentation-cookie authentication' do
       controls = capture_controls
@@ -688,21 +826,29 @@ describe HaveAPI::DocumentationOAuth do
 
     it 'revokes and clears the old session before starting fresh state and PKCE at the fixed login' do
       original = sign_in
+      expect(original).not_to have_key('end_shared_session')
+      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/token'),
+                                                     hash_excluding('end_shared_session'))
       csrf = session_csrf
       post 'https://docs.example/api/_documentation/oauth/logout',
-           { csrf:, switch_user: '1', version: '2', return: 'https://foreign.example/', scope: 'other' },
+           { csrf:, switch_user: '1', version: '2', return: 'https://foreign.example/', scope: 'other',
+             client_id: 'BROWSER_CLIENT', client_secret: 'BROWSER_SECRET', token: 'BROWSER_TOKEN',
+             token_type_hint: 'refresh_token', end_shared_session: '0', unexpected: 'BROWSER_EXTRA' },
            'HTTP_ORIGIN' => 'https://docs.example'
       expect(last_response.status).to eq(303)
       expect(last_response.location).to eq('https://docs.example/api/_documentation/oauth/login?version=1')
       expect(cookie_headers).to include('_session=', '_pending=', 'max-age=0')
-      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'), hash_including('token' => 'PRIVATE_ACCESS_TOKEN'))
+      expect(transport).to have_received(:post).with(have_attributes(path: '/api/_auth/oauth2/revoke'),
+                                                     'client_id' => 'docs-client', 'client_secret' => oauth_options[:client_secret],
+                                                     'token' => 'PRIVATE_ACCESS_TOKEN', 'token_type_hint' => 'access_token',
+                                                     'end_shared_session' => '1')
       get last_response.location
       expect(last_response.status).to eq(302)
       fresh = URI.decode_www_form(URI(last_response.location).query).to_h
       expect(fresh).to include('scope' => 'all', 'code_challenge_method' => 'S256')
       expect(fresh['state']).not_to eq(original['state'])
       expect(fresh['code_challenge']).not_to eq(original['code_challenge'])
-      expect(fresh.keys & %w[prompt select_account]).to be_empty
+      expect(fresh.keys & %w[prompt select_account end_shared_session]).to be_empty
       get 'https://docs.example/api/_documentation/oauth/callback', error: 'access_denied', state: fresh.fetch('state')
       expect(last_response.status).to eq(400)
       DocumentationOAuthSpec::Config.lookups.clear

data/spec/performance/event_baseline_spec.rb

@@ -81,6 +81,22 @@ RSpec.describe HaveAPI::PerformanceCI do
       expect(result[:push_pair]).to be_nil
       expect(repository).to have_received(:paths).with(base, candidate)
     end
+
+    it "selects no work for an equal new-branch merge-base with created=#{created}" do
+      event.merge!('ref' => 'refs/heads/feature', 'after' => candidate,
+                   'before' => '0' * 40, 'created' => created)
+      allow(repository).to receive(:merge_base).with(candidate, default).and_return(candidate)
+      allow(repository).to receive(:paths).with(candidate, candidate).and_return([])
+
+      expect(resolve('push', event)).to include(schema_version: 1, event_name: 'push', profile: 'quick',
+                                                baseline_sha: candidate, candidate_sha: candidate, captured_default_sha: default,
+                                                relevant: false, changed_paths: [], push_pair: nil,
+                                                reason: /candidate already contained in captured default, no source changes/)
+      expect(repository).to have_received(:commit!).with(default)
+      expect(repository).to have_received(:commit!).with(candidate)
+      expect(repository).to have_received(:release_lineage).with(candidate).at_least(:once)
+      expect(repository).to have_received(:ancestor?).with(candidate, candidate)
+    end
   end
 
   it 'does not guess a fallback when the captured default commit is unavailable' do
@@ -89,10 +105,58 @@ RSpec.describe HaveAPI::PerformanceCI do
     expect { resolve('push', event, default_sha: default) }.to raise_error(described_class::Error, /unavailable default/)
   end
 
-  it 'rejects a new branch whose captured-default merge-base equals its head' do
-    event.merge!('ref' => 'refs/heads/master', 'after' => candidate, 'before' => '0' * 40)
+  it 'resolves default and ancestral branch creation without work using real Git history' do
+    Dir.mktmpdir('haveapi-new-branch-history-') do |directory|
+      git = lambda do |*arguments, input: ''|
+        env = { 'GIT_AUTHOR_NAME' => 'Fixture', 'GIT_AUTHOR_EMAIL' => 'fixture@example.test',
+                'GIT_COMMITTER_NAME' => 'Fixture', 'GIT_COMMITTER_EMAIL' => 'fixture@example.test' }
+        output, error, status = Open3.capture3(env, 'git', '-C', directory, *arguments, stdin_data: input)
+        raise error unless status.success?
+
+        output.strip
+      end
+      git.call('init', '--quiet', '--initial-branch=master')
+      commit = lambda do |body, parent = nil|
+        blob = git.call('hash-object', '-w', '--stdin', input: body)
+        tree = git.call('mktree', input: "100644 blob #{blob}\tGemfile\n")
+        git.call('commit-tree', tree, *[('-p' if parent), parent].compact, input: "fixture\n")
+      end
+      older = commit.call('older')
+      captured = commit.call('default', older)
+      changed = commit.call('changed', captured)
+      git.call('update-ref', 'refs/remotes/origin/master', captured)
+      stub_const('HaveAPI::Performance::REFERENCE', older)
+      real_resolver = described_class::Resolver.new(described_class::Repository.new(directory))
+      event.merge!('ref' => 'refs/heads/haveapi-0.32', 'before' => '0' * 40, 'created' => true)
+
+      [captured, older, changed].each do |head|
+        result = real_resolver.resolve(event_name: 'push', event: event.merge('after' => head), event_sha: head)
+        expect(result).to include(candidate_sha: head, captured_default_sha: captured, release_lineage: nil, push_pair: nil,
+                                  baseline_sha: head == changed ? captured : head,
+                                  relevant: head == changed, changed_paths: head == changed ? ['Gemfile'] : [])
+      end
+    end
+  end
+
+  it 'retains lineage and ancestry rejection for an equal new-branch merge-base' do
+    event.merge!('ref' => 'refs/heads/haveapi-0.30', 'after' => candidate, 'before' => '0' * 40)
+    allow(repository).to receive(:merge_base).with(candidate, default).and_return(candidate)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /Unproven/)
+    event['ref'] = 'refs/heads/feature'
+    allow(repository).to receive(:ancestor?).with(candidate, candidate).and_return(false)
+    expect { resolve('push', event) }.to raise_error(described_class::Error, /ancestor/)
+  end
+
+  it 'rejects equal endpoints for PRs and fixed-reference profiles' do
+    event['pull_request'] = { 'head' => { 'sha' => candidate }, 'base' => { 'sha' => default } }
     allow(repository).to receive(:merge_base).with(candidate, default).and_return(candidate)
+    expect { resolve('pull_request', event) }.to raise_error(described_class::Error, /differ/)
+    event.merge!('ref' => 'refs/heads/feature', 'after' => described_class::REFERENCE, 'before' => '0' * 40,
+                 'inputs' => { 'profile' => 'weekly' })
+    allow(repository).to receive(:merge_base).with(described_class::REFERENCE, default).and_return(described_class::REFERENCE)
     expect { resolve('push', event) }.to raise_error(described_class::Error, /differ/)
+    expect { resolver.resolve(event_name: 'schedule', event:, event_sha: described_class::REFERENCE) }
+      .to raise_error(described_class::Error, /differ/)
   end
 
   it 'does not replace an unavailable new-branch merge-base with another commit' do
@@ -323,6 +387,37 @@ RSpec.describe HaveAPI::PerformanceCI do
     end
   end
 
+  it 'records no-work without requiring benchmark artifacts or the client contract' do
+    path = File.expand_path('../../../../.github/workflows/servers-ruby-performance.yml', __dir__)
+    steps = YAML.load_file(path).fetch('jobs').fetch('performance').fetch('steps')
+    comparison = steps.find { |step| step['name'] == 'Run the selected pair outside Bundler' }
+    expect(comparison.fetch('if')).to eq("steps.resolve.outputs.relevant == 'true'")
+    completion = steps.find { |step| step['id'] == 'completion' }
+    Dir.mktmpdir('haveapi-no-work-gate-') do |directory|
+      File.write(File.join(directory, 'selection.json'), JSON.generate(relevant: false))
+      output = File.join(directory, 'output')
+      environment = { 'RELEVANT' => 'false', 'CLIENT_CONTRACT' => '',
+                      'PERFORMANCE_EVIDENCE' => directory, 'GITHUB_OUTPUT' => output }
+      _output, _error, status = Open3.capture3(environment, 'bash', '-euo', 'pipefail', '-c', completion.fetch('run'))
+      expect(status.success?).to be(true)
+      expect(File.read(output)).to eq("outcome=no-work\n")
+      File.unlink(File.join(directory, 'selection.json'))
+      _output, _error, status = Open3.capture3(environment, 'bash', '-euo', 'pipefail', '-c', completion.fetch('run'))
+      expect(status.success?).to be(false)
+    end
+  end
+
+  it 'keeps equal endpoints out of the campaign even if marked relevant' do
+    Dir.mktmpdir('haveapi-no-work-campaign-') do |directory|
+      selection = { 'schema_version' => 1, 'relevant' => true, 'profile' => 'quick', 'event_name' => 'push',
+                    'candidate_sha' => candidate, 'baseline_sha' => candidate, 'push_pair' => nil }
+      campaign = described_class::Campaign.new(repository:, selection:,
+                                               evidence: File.join(directory, 'evidence'), sources: File.join(directory, 'sources'))
+      expect { campaign.run }.to raise_error(described_class::Error, /ancestry/)
+      expect(File).not_to exist(File.join(directory, 'sources'))
+    end
+  end
+
   it 'fails aggregate shell execution for missing outcomes and cancelled or skipped work' do
     path = File.expand_path('../../../../.github/workflows/servers-ruby-performance.yml', __dir__)
     script = YAML.load_file(path).fetch('jobs').fetch('gate').fetch('steps').first.fetch('run')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: haveapi
 version: !ruby/object:Gem::Version
-  version: 0.32.0
+  version: 0.32.1
 platform: ruby
 authors:
 - Jakub Skokan
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.32.0
+        version: 0.32.1
 - !ruby/object:Gem::Dependency
   name: i18n
   requirement: !ruby/object:Gem::Requirement