@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/src/modules/workflow/git/pull-request.service.ts

@@ -366,6 +366,60 @@ export class PullRequestService implements IPullRequestService {
     return this.summaryOf(row, workspaceId);
   }
 
+  /**
+   * Did the target change, since the fork point, any file this request also
+   * changes? The question behind `needsUpdate`.
+   *
+   * The intersection is taken over BOTH names of every rename on both sides,
+   * because a wrong "no" is the expensive answer: it would open a request on
+   * a diff read against text that has since moved, with Approve live. So
+   * `pathsChangedBetween` runs without rename detection (a rename on the
+   * TARGET reports the path it left as well as the one it arrived at), and
+   * the request's own side contributes each file's `previousPath` alongside
+   * its `path`.
+   *
+   * Answers true without asking git in the two cases where nothing may be
+   * assumed: no fork point (the branches share no history, so there is no
+   * range to diff) and a failed diff (an infra error must not read as "this
+   * request is fine"). Answers false without asking git when the request is
+   * not behind at all, or changes no files — the common case, and the one
+   * that must stay free.
+   */
+  private async targetTouchesRequestFiles(
+    workspaceId: string,
+    forkPoint: { mergeBaseSha: string | null; behind: boolean },
+    baseSha: string,
+    files: PullRequestFile[],
+  ): Promise<boolean> {
+    if (!forkPoint.behind) return false;
+    if (files.length === 0) return false;
+    // Diverged with no common ancestor: the target's whole history is
+    // "changed since the fork point", so anything this request touches is
+    // touched. Nothing to intersect against, and nothing to skip for.
+    if (!forkPoint.mergeBaseSha) return true;
+    const requestPaths = new Set<string>();
+    for (const f of files) {
+      requestPaths.add(f.path);
+      if (f.previousPath) requestPaths.add(f.previousPath);
+    }
+    try {
+      const onTarget = await this.gitService.pathsChangedBetween(
+        workspaceId,
+        forkPoint.mergeBaseSha,
+        // The target tip the WHOLE detail is pinned to, so this range ends
+        // exactly where `behind` and the file list were computed.
+        baseSha,
+      );
+      return onTarget.some((path) => requestPaths.has(path));
+    } catch (err) {
+      log.warn(
+        'could not compare the target against a change request\'s files; treating it as needing an update',
+        { err },
+      );
+      return true;
+    }
+  }
+
   async getPrDetail(
     prNumber: number,
     opts: { fresh?: boolean; workspaceId?: string; viewerEmail?: string; patches?: boolean } = {},
@@ -392,6 +446,8 @@ export class PullRequestService implements IPullRequestService {
       mergeBaseSha: null,
       behind: false,
     };
+    /** Did the target change, since the fork point, a file this request changes? */
+    let targetChangedShared = false;
     if (workspaceId) {
       const shas = await this.gitService.resolvePrShas(
         workspaceId,
@@ -417,6 +473,17 @@ export class PullRequestService implements IPullRequestService {
       // Pinned to the same two commits as the file list, so "needs updating"
       // and the diff it qualifies can never describe different heads.
       forkPoint = await this.gitService.forkPointForPr(workspaceId, { baseSha, headSha });
+      // Only a target that moved in a file THIS request also changes makes the
+      // proposal's diff describe text that has moved. One extra
+      // `diff --name-only` (and only when the branches have diverged at all)
+      // buys the difference between opening instantly and paying for a merge,
+      // a push and a second detail read.
+      targetChangedShared = await this.targetTouchesRequestFiles(
+        workspaceId,
+        forkPoint,
+        baseSha,
+        files,
+      );
     }
 
     // Validated cache hit: TTL fresh AND head SHA unchanged since we cached.
@@ -511,6 +578,22 @@ export class PullRequestService implements IPullRequestService {
       approvals,
     });
 
+    // Hashed here, not on the client: the detail carries an author HASH and no
+    // author email, so the comparison can only happen where the viewer's email
+    // is already known.
+    const viewerIsAuthor = !!(
+      opts.viewerEmail &&
+      summary.authorId &&
+      summary.authorId === hashEmail(opts.viewerEmail)
+    );
+
+    const viewerCanDelete = computeViewerCanDelete({
+      state: summary.state,
+      authorId: summary.authorId,
+      viewerEmail: opts.viewerEmail,
+      viewerCanBypassMerge,
+    });
+
     const detail: PullRequestDetail = {
       ...summary,
       body: row.body,
@@ -526,7 +609,12 @@ export class PullRequestService implements IPullRequestService {
       viewerCanCancel,
       mergeBaseSha: forkPoint.mergeBaseSha,
       behind: summary.state === 'open' && forkPoint.behind,
+      // `behind` AND the divergence actually reaches this request's files.
+      // Both halves, in this order, so a closed request is never either.
+      needsUpdate: summary.state === 'open' && forkPoint.behind && targetChangedShared,
       viewerCanUpdate,
+      viewerIsAuthor,
+      viewerCanDelete,
     };
 
     // A patch-less detail is an internal read; it must not be served to the
@@ -631,7 +719,38 @@ export function computeViewerCanUpdate(input: {
   return viewerIsAuthor || input.viewerCanBypassMerge || viewerMayApply;
 }
 
+/**
+ * Pure predicate for the `viewerCanDelete` hint — who may delete a request
+ * outright, closing it AND retiring its branch. The author (their own
+ * proposal and their own branch) or an admin (`viewerCanBypassMerge` is the
+ * proxy — the same `canWriteAtRef('roles.yaml')` predicate the DELETE route
+ * enforces). Mirrors `deleteChangeRequest` exactly, which is why it differs
+ * from its two siblings in both directions:
+ *
+ * - It does NOT grant the owner of every changed file, as
+ *   `computeViewerCanCancel` does. Declining someone else's request leaves
+ *   their branch to rework; deleting it destroys their text.
+ * - It bars only `merged`, not everything that is not `open`. A request
+ *   withdrawn in another tab is `closed` and still has a leftover branch the
+ *   server will retire, so the button must survive it. Applied history is
+ *   nobody's to delete.
+ *
+ * Fail-closed: no viewer email → false, whatever the grants say.
+ */
+export function computeViewerCanDelete(input: {
+  state: PullRequestState;
+  authorId: string | undefined;
+  viewerEmail: string | undefined;
+  viewerCanBypassMerge: boolean;
+}): boolean {
+  if (input.state === 'merged') return false;
+  if (!input.viewerEmail) return false;
+  const viewerIsAuthor = !!(input.authorId && input.authorId === hashEmail(input.viewerEmail));
+  return viewerIsAuthor || input.viewerCanBypassMerge;
+}
+
 export const __testing = {
   computeViewerCanCancel,
   computeViewerCanUpdate,
+  computeViewerCanDelete,
 };

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -18,6 +18,7 @@ import { changeRequests, prComments, prFileApprovals, prMergeLog, users } from '
 import { AccessUnreadableError } from '../../access-model/access-errors.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { GitService } from '../git/git.service.js';
+import { redactSecret } from '../../../shared/redact-secret.js';
 import {
   ChangeRequestConflictsError,
   WorkflowDomainError,
@@ -45,11 +46,13 @@ import {
 const MERGE_METHOD = 'merge' as const;
 const EVERYONE_CANONICAL = 'everyone';
 
-function redactTokens(msg: string): string {
-  const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter(
-    (t): t is string => !!t && t.length > 0,
-  );
-  return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before it is stored: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg: string, token: string | null | undefined): string {
+  return redactSecret(msg, [token]);
 }
 
 class CommentAuthError extends WorkflowDomainError {
@@ -743,7 +746,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
         user,
       );
     } catch (err) {
-      const redacted = redactTokens(err instanceof Error ? err.message : String(err));
+      const redacted = redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token());
       await this.db
         .update(prMergeLog)
         .set({ succeeded: false, completedAt: new Date(), error: redacted })

package/src/modules/workflow/session-ontology.service.ts

@@ -33,6 +33,7 @@
 
 import { eq, lt } from 'drizzle-orm';
 import { ontologyOf } from '../../shared/kb-layout.js';
+import type { KbContext } from '../../shared/kb-context.js';
 
 import type { Database } from '../database/connection.js';
 import { sessionOntologyTouches } from '../database/schema.js';
@@ -77,7 +78,11 @@ export class SessionOntologyService implements ISessionOntologyService {
    */
   private readonly locks = new WorkspaceMutex();
 
-  constructor(private readonly db: Database) {}
+  constructor(
+    private readonly db: Database,
+    /** Names the knowledge-base root a path is classified under; read per call. */
+    private readonly kb: Pick<KbContext, 'layout'>,
+  ) {}
 
   /**
    * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
@@ -89,7 +94,7 @@ export class SessionOntologyService implements ISessionOntologyService {
     isWrite: boolean,
     kbDirName?: string,
   ): Promise<OperationDecision> {
-    return this.checkOntology(sessionId, ontologyOf(wsPath, kbDirName), isWrite);
+    return this.checkOntology(sessionId, ontologyOf(wsPath, this.kb.layout, kbDirName), isWrite);
   }
 
   /**

package/src/modules/workflow/workflow.routes.ts

@@ -790,7 +790,9 @@ export function createWorkflowRoutes(
 
   /**
    * Delete a change request outright — close it and retire its source
-   * branch. Admin-only; the moderation verb for a shared deployment.
+   * branch. The request's author or an admin: their own proposal to throw
+   * away, and the moderation verb for a shared deployment. The changed files'
+   * owners are NOT included — they keep reject, which leaves the branch.
    */
   router.delete('/workflow/change-requests/:number', async (req, res) => {
     const num = parsePrNumber(req.params.number);