@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/dist/modules/workflow/workflow.service.js

@@ -28,9 +28,10 @@ const mergeLog = logger('merge');
 import { promises as fs } from 'node:fs';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { isProtectedBranch, DEFAULT_BRANCH, isFolderPlaceholder, folderPlaceholderPath, isPlatformRestoreShape, } from '@bevel-software/platform-shared';
-import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
+import { isFolderPlaceholder, folderPlaceholderPath, isPlatformRestoreShape, } from '@bevel-software/platform-shared';
+import { and, desc, eq, inArray, isNotNull, isNull, lt, ne, or } from 'drizzle-orm';
 import { changeRequests } from '../database/schema.js';
+import { redactSecret } from '../../shared/redact-secret.js';
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { canonicalFileIdentity } from '../../shared/canonical-file-identity.js';
 import { sanitizeError } from './sanitize-error.js';
@@ -92,10 +93,13 @@ export function syncConflictMessage(branch, conflictedPaths) {
 }
 /** How many conflicted files the sync-conflict sentence names before "and N more". */
 const SYNC_CONFLICT_FILES_NAMED = 3;
-/** Redact the shared GitHub token from any error string before surfacing it. */
-function redactTokens(msg) {
-    const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter((t) => !!t && t.length > 0);
-    return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before surfacing it: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg, token) {
+    return redactSecret(msg, [token]);
 }
 /**
  * Cap on how many changed paths the `## Affected owners` CR-body block lists
@@ -183,7 +187,7 @@ export class WorkflowService {
     accessControl;
     fileLocks;
     pendingCommits;
-    kbDirName;
+    kb;
     changeGate;
     events;
     fileChanges;
@@ -207,6 +211,9 @@ export class WorkflowService {
      * implementation detail of the workflow auto-merge story; nothing outside
      * the facade should call it directly.
      */
+    get kbDirName() {
+        return this.kb.kbDirName;
+    }
     constructor(db, git, prs, reviewWorkflow, workspaceService, accessControl, fileLocks, 
     /**
      * Background commit queue. `releaseLock` enqueues a row instead of
@@ -215,7 +222,7 @@ export class WorkflowService {
      * failure modes entirely off the user-facing lock release path.
      * See `lock-decoupling-plan.md` for the full design.
      */
-    pendingCommits, kbDirName, 
+    pendingCommits, kb, 
     /**
      * The read-before-write gate `acquireLock` asks on every branch (see
      * `access-model/change-gate.ts`). Required, and checked at construction:
@@ -255,7 +262,7 @@ export class WorkflowService {
         this.accessControl = accessControl;
         this.fileLocks = fileLocks;
         this.pendingCommits = pendingCommits;
-        this.kbDirName = kbDirName;
+        this.kb = kb;
         this.changeGate = changeGate;
         this.events = events;
         this.fileChanges = fileChanges;
@@ -340,7 +347,7 @@ export class WorkflowService {
      */
     runOnBranchPair(source, target, fn) {
         const keys = [`branch:${source}`];
-        if (!isProtectedBranch(target))
+        if (!this.kb.isProtectedBranch(target))
             keys.push(`branch:${target}`);
         return this.branchLifecycle.runAll(keys, fn);
     }
@@ -463,10 +470,11 @@ export class WorkflowService {
      * and nothing else. The pull itself reports the change, since it is the
      * only code that can observe it under the workspace mutex.
      */
-    async pullWorkspace(workspaceId) {
-        const { treeChanged } = await this.git.pull(workspaceId);
-        if (treeChanged && branchForWorkspaceId(workspaceId) === DEFAULT_BRANCH) {
-            this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: DEFAULT_BRANCH });
+    async pullWorkspace(workspaceId, opts = {}) {
+        const { treeChanged } = await this.git.pull(workspaceId, opts);
+        const defaultBranch = this.kb.defaultBranch;
+        if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
+            this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
             return true;
         }
         return false;
@@ -799,7 +807,7 @@ export class WorkflowService {
         // as its own rescue. The source is part of the claim precisely so no
         // future caller can make that claim by passing a flag.
         if (typeof platformRestore?.source === 'string' &&
-            isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative) &&
+            isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative, this.kb.layout) &&
             (await this.accessControl.canRestorePlatformFile(workspaceId, userEmail, repoRelative))) {
             return 'restore';
         }
@@ -861,7 +869,7 @@ export class WorkflowService {
         // coordination hold as write possession (see those methods).
         if (!opts?.coordination) {
             let via = 'granted';
-            if (isProtectedBranch(branch)) {
+            if (this.kb.isProtectedBranch(branch)) {
                 // `assertCanWriteAtPath` throws AccessDeniedError on denial, with the
                 // eligible-writers payload so the frontend can render a useful refusal.
                 via = await this.assertCanWriteAtPath(workspaceId, branch, user.email, targetPath, opts?.platformRestore);
@@ -1089,13 +1097,15 @@ export class WorkflowService {
      * retry, hand off to the recovery agent, or escalate. Emits
      * `file-changed` on success so frontends see the new sha.
      */
-    async runPendingCommit(workspaceId, branch, targetPath, user, opts) {
+    async runPendingCommit(workspaceId, branch, targetPath, user, 
+    /** `summary` overrides the path-derived commit subject; see `commitFile`. */
+    opts) {
         // `skipValidation` is the worker telling us this commit is not the last of
         // a burst. The validator is advisory — it parses the whole KB to produce a
         // report nothing reads but the log — so running it once on the burst's
         // final state says the same thing as running it per file, for a fraction
         // of the work. Nothing downstream depends on it having run.
-        const change = await this.git.commitFile(workspaceId, user, targetPath, undefined, opts?.skipValidation);
+        const change = await this.git.commitFile(workspaceId, user, targetPath, opts?.summary, opts?.skipValidation);
         if (!change) {
             // No-op commit — the path was already clean. Usually a double-enqueue
             // or a save of bytes identical to HEAD, BUT a clean tree does NOT
@@ -1417,6 +1427,30 @@ export class WorkflowService {
     getChangeRequest(number) {
         return this.prs.getPr(number);
     }
+    /**
+     * The newest non-open change request from `sourceBranch` by `authorEmail`.
+     *
+     * Read straight off `change_requests` rather than through the PR listing,
+     * which serves OPEN requests only: the whole point here is the closed ones.
+     * `author_email` is stored lowercased at insert, so the needle is too.
+     * Ordered by `closed_at` with `created_at` as the tiebreak, because a row
+     * closed before the column existed (or by a path that forgot to stamp it)
+     * still has a creation time and must not sort as the oldest.
+     */
+    async latestClosedChangeRequest(authorEmail, sourceBranch) {
+        const email = authorEmail.trim().toLowerCase();
+        if (!email || !sourceBranch)
+            return null;
+        const [row] = await this.db
+            .select({ number: changeRequests.number, state: changeRequests.state })
+            .from(changeRequests)
+            .where(and(eq(changeRequests.authorEmail, email), eq(changeRequests.sourceBranch, sourceBranch), ne(changeRequests.state, 'open')))
+            .orderBy(desc(changeRequests.closedAt), desc(changeRequests.createdAt))
+            .limit(1);
+        if (!row)
+            return null;
+        return { number: row.number, state: row.state };
+    }
     getChangeRequestDetail(number, opts) {
         return this.prs.getPrDetail(number, opts);
     }
@@ -1449,7 +1483,7 @@ export class WorkflowService {
         }
         if (!input.title?.trim())
             throw new WorkflowValidationError('title is required');
-        if (isProtectedBranch(input.sourceBranch)) {
+        if (this.kb.isProtectedBranch(input.sourceBranch)) {
             throw new WorkflowValidationError(`Cannot open a change request *from* a protected branch ("${input.sourceBranch}").`, { kind: 'source-is-protected', sourceBranch: input.sourceBranch });
         }
         // The whole open sequence — uniqueness check through row insert — runs
@@ -1541,7 +1575,7 @@ export class WorkflowService {
                 // openChangeRequest finds no duplicate, re-runs the (idempotent, already
                 // up-to-date) auto-merge, and inserts the row.
                 const rawMsg = err instanceof Error ? err.message : String(err);
-                throw new WorkflowValidationError(`Failed to open change request: ${redactTokens(rawMsg)}`, { kind: 'open-change-request-failed' });
+                throw new WorkflowValidationError(`Failed to open change request: ${redactTokens(rawMsg, this.git.credentials?.token())}`, { kind: 'open-change-request-failed' });
             }
             this.prs.invalidateDetailCache(prNumber);
             const detail = await this.prs.getPrDetail(prNumber, {
@@ -1584,9 +1618,25 @@ export class WorkflowService {
      * the enforcement read one predicate. A conflicting merge is aborted
      * inside `mergeFromOrigin`: nothing is committed or pushed, and the branch
      * is exactly what it was.
+     *
+     * ONE detail read after the merge. The read before it exists only to
+     * decide authority and to name the two branches, so it asks for no patches
+     * — that is one git subprocess per changed file it does not spend. The
+     * approvals carry-forward runs BEFORE the final read rather than after it,
+     * against a head resolved with `resolvePrShas` (two rev-parses) instead of
+     * a whole second detail, so the detail that goes back already describes the
+     * approvals it carried. What used to be three detail reads is now one.
      */
     async updateFromTarget(workspaceId, user, number) {
-        const detail = await this.prs.getPrDetail(number, { fresh: true, workspaceId, viewerEmail: user.email });
+        // No patches: all this read decides is authority, state and the two
+        // branch names. Asking for patch text here would diff every changed file
+        // in a request that is about to be merged and read in full anyway.
+        const detail = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+            patches: false,
+        });
         if (!detail) {
             throw new WorkflowValidationError(`Change request #${number} not found.`, { kind: 'change-request-not-found', number });
         }
@@ -1605,8 +1655,15 @@ export class WorkflowService {
         // merge commit that then cannot push, stranding it in the workspace. A
         // rebase conflict hands the stranded saves to recovery, as every other
         // pull does, before the refusal reaches the caller.
+        //
+        // `preserveMerges`: this is the one pull whose unpushed commit may be a
+        // MERGE — the update that ran before this one and could not push. A plain
+        // rebase replays it as cherry-picks of the target's commits, which drops
+        // the target as a parent, so the branch never contains the target's head
+        // however many times the update runs. Replayed with `--rebase-merges` it
+        // stays a merge and the next push ends the loop.
         try {
-            await this.pullWorkspace(workspaceId);
+            await this.pullWorkspace(workspaceId, { preserveMerges: true });
         }
         catch (err) {
             if (err instanceof PullRebaseConflictError) {
@@ -1638,21 +1695,47 @@ export class WorkflowService {
         if (outcome.kind === 'conflicts') {
             throw new ChangeRequestConflictsError(detail.branch, detail.base, outcome.paths);
         }
-        // If a new merge commit landed, push so the CR picks it up. When
-        // already up to date there's nothing to share — short-circuit the push.
-        if (!outcome.alreadyUpToDate) {
+        // Push whenever the CLONE holds a commit origin has not seen — not when
+        // THIS merge authored one. The two differ in exactly the case that keeps
+        // a request behind for good: an earlier update merged, its push failed,
+        // and the merge is sitting in the workspace. That merge already contains
+        // the target, so this call's `mergeFromOrigin` reports
+        // `alreadyUpToDate` and the old gate skipped the push — leaving the
+        // request behind on the remote, and the next open with the same work to
+        // do. Asking git what is unpushed retries it instead.
+        //
+        // A failed probe falls back to the old gate rather than to "push
+        // anyway": `trackedPush` on a clone with nothing to push is a wasted
+        // round trip on every single update.
+        const hasUnpushed = await this.git
+            .hasUnpushedCommits(workspaceId)
+            .catch((err) => {
+            log.warn(`could not tell whether change request #${number} has unpushed commits; falling back to whether this merge authored one`, { err });
+            return !outcome.alreadyUpToDate;
+        });
+        if (hasUnpushed) {
             await this.trackedPush(workspaceId, user);
-            // The source head moved: the refusal described a revision that is gone.
-            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
-        this.prs.invalidateDetailCache(number);
-        const refreshed = await this.prs.getPrDetail(number, {
-            fresh: true,
-            workspaceId,
-            viewerEmail: user.email,
-        });
-        if (!refreshed) {
-            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        // Where the branch ended up, as PUBLISHED — two rev-parses, not a second
+        // detail read. Everything below needs only the sha, and the detail that
+        // goes back to the caller is read once, at the end, after the approvals
+        // it should describe have been carried.
+        let headAfterMerge = headBeforeMerge;
+        try {
+            const at = await this.git.resolvePrShas(workspaceId, detail.base, detail.branch);
+            headAfterMerge = at.headSha;
+        }
+        catch (err) {
+            log.warn(`could not resolve the published head of change request #${number} after updating it from target`, { err });
+        }
+        const headMoved = Boolean(headBeforeMerge) && headAfterMerge !== headBeforeMerge;
+        // The source head moved: the refusal described a revision that is gone.
+        // `hasUnpushed` counts as well as the sha comparison, and deliberately —
+        // a push that just landed moved the published head by definition, and
+        // reading the sha to confirm it is a call that can fail. A refusal left
+        // standing over a revision nobody can apply any more is the worse error.
+        if (headMoved || hasUnpushed) {
+            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
         // The merge is a commit the APPROVERS did not make. Re-pin their
         // approvals onto the new head for every file whose bytes it left alone —
@@ -1661,35 +1744,48 @@ export class WorkflowService {
         // than the bookkeeping, so a failure here is logged and the fresh detail
         // still goes back.
         //
-        // `alreadyUpToDate` is the real gate: no merge commit, no head to compare,
-        // nothing moved under anyone. The other two conditions are belt-and-braces
-        // over a sha that is not a sha — a resolve that failed onto a detail with
-        // no head, or two heads that somehow read equal — both of which
-        // `pathsChangedBetween` and `carryApprovalsForward` would refuse anyway.
-        // A merge that authored a commit cannot leave the head where it was.
-        if (!outcome.alreadyUpToDate && headBeforeMerge && refreshed.headSha !== headBeforeMerge) {
+        // The head moving is the real gate: nothing moved, nothing moved under
+        // anyone. It also covers the sha that is not a sha — a resolve that
+        // failed onto a detail with no head — which `pathsChangedBetween` and
+        // `carryApprovalsForward` would refuse anyway.
+        //
+        // This runs BEFORE the detail read, not after it. The rows it writes are
+        // what the caller's `approvals` must describe, so doing it first means
+        // the one read at the end is already correct — where carrying afterwards
+        // needed a THIRD read to correct a detail assembled before the rows
+        // existed.
+        //
+        // The same list answers the caller's `updatedPaths`: "which files did
+        // this merge change" is one question, and the two answers must not be
+        // allowed to differ — a file whose approval was carried (so: untouched)
+        // that the dialog then re-read would be the dialog discarding content the
+        // server just called unchanged.
+        let updatedPaths = [];
+        if (headMoved) {
             try {
-                const changedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, refreshed.headSha);
-                const carried = await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, refreshed.headSha, changedPaths);
-                // The detail above was assembled before those rows existed, so its
-                // `approvals` (and the merge gate derived from them) still describe
-                // the pre-merge head. Only re-read when something actually carried.
-                if (carried > 0) {
-                    this.prs.invalidateDetailCache(number);
-                    const withApprovals = await this.prs.getPrDetail(number, {
-                        fresh: true,
-                        workspaceId,
-                        viewerEmail: user.email,
-                    });
-                    if (withApprovals)
-                        return withApprovals;
-                }
+                updatedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, headAfterMerge);
+                await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, headAfterMerge, updatedPaths);
             }
             catch (err) {
                 log.warn(`could not carry approvals forward on change request #${number} after updating from target`, { err });
+                // The diff is what failed, so which files moved is unknown. Say so as
+                // "every file this request had", which is every file a caller can
+                // already be showing: slow beats a dialog that goes on presenting
+                // pre-merge text as current. Anything the merge ADDED is not on the
+                // list and does not need to be — no caller has read it yet.
+                updatedPaths = (detail.files ?? []).map((f) => f.path);
             }
         }
-        return refreshed;
+        this.prs.invalidateDetailCache(number);
+        const refreshed = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+        });
+        if (!refreshed) {
+            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        }
+        return { ...refreshed, updatedPaths };
     }
     listComments(number) {
         return this.reviewWorkflow.listComments(number);
@@ -2116,11 +2212,16 @@ export class WorkflowService {
     /**
      * DELETE a change request outright: close it (whatever its diff says) and
      * retire its source branch — the request, its proposal, and the branch that
-     * carried it are gone in one verb. Admin-only, resolved the same way every
-     * other admin check here is (write on `roles.yaml` at `origin/<base>`,
-     * never a local ref): this is the moderation verb for a shared deployment,
-     * stronger than reject (which the author or the files' owners can do, and
-     * which leaves the branch for a second round).
+     * carried it are gone in one verb. The request's AUTHOR or an admin, and
+     * nobody else: it is the author's own proposal and their own branch to throw
+     * away, and it is the moderation verb for a shared deployment. Admin rights
+     * resolve the same way every other admin check here does (write on
+     * `roles.yaml` at `origin/<base>`, never a local ref); authorship is the
+     * STORED `authorId` hash, never anything the caller sends.
+     *
+     * Stronger than reject, which the changed files' owners may also do and which
+     * leaves the branch for a second round. They keep reject and do not get this:
+     * an owner must not be able to destroy someone else's text and branch.
      */
     async deleteChangeRequest(number, user) {
         const summary = await this.prs.getPr(number);
@@ -2170,8 +2271,17 @@ export class WorkflowService {
             this.kickDeletedBranchSweep();
             throw new WorkflowDomainError(`The base branch "${summary.base}" could not be resolved — it may have been deleted, or origin was unreachable. A background check is running; retry in a moment.`, 409);
         }
-        if (isAdmin !== true) {
-            throw new WorkflowDomainError('Only an admin can delete a change request.', 403);
+        // Authorship is decided from the STORED author hash, never from anything
+        // the caller sends. Note what is deliberately NOT short-circuited for an
+        // author: the strict fetch and the `null` check above still run. An
+        // author's grant needs no `roles.yaml` read, so skipping them would look
+        // free — but it would let a delete close the request while the branch
+        // removal silently failed against an unreachable origin, and "the shared
+        // repository was down, so nothing changed" is the one refusal that has to
+        // stay honest.
+        const callerIsAuthor = !!(summary.authorId && summary.authorId === hashEmail(user.email));
+        if (!callerIsAuthor && isAdmin !== true) {
+            throw new WorkflowDomainError("Only the request's author or an admin can delete it.", 403);
         }
         // Close first (idempotent: an already-closed request just skips to the
         // branch retirement). Guarded on `open` so a concurrent merge wins.
@@ -2316,7 +2426,7 @@ export class WorkflowService {
             return 0;
         let live;
         try {
-            const branches = await this.git.listBranches(workspaceIdForBranch(DEFAULT_BRANCH), {
+            const branches = await this.git.listBranches(this.kb.defaultWorkspaceId(), {
                 freshFetch: true,
                 // The list is used to PROVE absence, and the listing's normal
                 // degrade-to-stale behaviour would report every branch created since
@@ -2586,8 +2696,8 @@ export class WorkflowService {
         // outright if it disagrees with the request's own base.) The failure the
         // pull reports is about OTHER people's commits not arriving, which leaves
         // the catalogs no staler than they were.
-        if (!announced && targetWorkspaceId && targetBranch === DEFAULT_BRANCH) {
-            this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: DEFAULT_BRANCH });
+        if (!announced && targetWorkspaceId && targetBranch === this.kb.defaultBranch) {
+            this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: targetBranch });
         }
     }
     async mergeBranch(user, sourceBranch, targetBranch) {
@@ -2639,7 +2749,7 @@ export class WorkflowService {
                 // change request's merge, nothing strips it here — so its presence
                 // is what the hook refuses on) and both sides of a rename, since the
                 // old name is a file this merge deletes.
-                authorize: isProtectedBranch(targetBranch)
+                authorize: this.kb.isProtectedBranch(targetBranch)
                     ? async ({ sha, changedPaths }) => {
                         if (changedPaths.length === 0)
                             return;
@@ -2814,7 +2924,7 @@ export class WorkflowService {
                 .where(eq(changeRequests.number, number))
                 .limit(1);
             const sourceBranch = rows[0]?.sourceBranch;
-            if (!sourceBranch || isProtectedBranch(sourceBranch))
+            if (!sourceBranch || this.kb.isProtectedBranch(sourceBranch))
                 return;
             // The open-check and the deletion hold the branch's lifecycle lock
             // TOGETHER — `openChangeRequest` holds the same lock across its own
@@ -2965,7 +3075,7 @@ export class WorkflowService {
         }
         catch (err) {
             log.warn('listChangedPathsBetweenBranches failed:', {
-                detail: redactTokens(err instanceof Error ? err.message : String(err)),
+                detail: redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token()),
             });
             return [];
         }