@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/dist/modules/workflow/workflow.service.js

@@ -29,7 +29,7 @@ import { promises as fs } from 'node:fs';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { isFolderPlaceholder, folderPlaceholderPath, isPlatformRestoreShape, } from '@bevel-software/platform-shared';
-import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
+import { and, desc, eq, inArray, isNotNull, isNull, lt, ne, or } from 'drizzle-orm';
 import { changeRequests } from '../database/schema.js';
 import { redactSecret } from '../../shared/redact-secret.js';
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
@@ -470,8 +470,8 @@ export class WorkflowService {
      * and nothing else. The pull itself reports the change, since it is the
      * only code that can observe it under the workspace mutex.
      */
-    async pullWorkspace(workspaceId) {
-        const { treeChanged } = await this.git.pull(workspaceId);
+    async pullWorkspace(workspaceId, opts = {}) {
+        const { treeChanged } = await this.git.pull(workspaceId, opts);
         const defaultBranch = this.kb.defaultBranch;
         if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
             this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
@@ -1427,6 +1427,30 @@ export class WorkflowService {
     getChangeRequest(number) {
         return this.prs.getPr(number);
     }
+    /**
+     * The newest non-open change request from `sourceBranch` by `authorEmail`.
+     *
+     * Read straight off `change_requests` rather than through the PR listing,
+     * which serves OPEN requests only: the whole point here is the closed ones.
+     * `author_email` is stored lowercased at insert, so the needle is too.
+     * Ordered by `closed_at` with `created_at` as the tiebreak, because a row
+     * closed before the column existed (or by a path that forgot to stamp it)
+     * still has a creation time and must not sort as the oldest.
+     */
+    async latestClosedChangeRequest(authorEmail, sourceBranch) {
+        const email = authorEmail.trim().toLowerCase();
+        if (!email || !sourceBranch)
+            return null;
+        const [row] = await this.db
+            .select({ number: changeRequests.number, state: changeRequests.state })
+            .from(changeRequests)
+            .where(and(eq(changeRequests.authorEmail, email), eq(changeRequests.sourceBranch, sourceBranch), ne(changeRequests.state, 'open')))
+            .orderBy(desc(changeRequests.closedAt), desc(changeRequests.createdAt))
+            .limit(1);
+        if (!row)
+            return null;
+        return { number: row.number, state: row.state };
+    }
     getChangeRequestDetail(number, opts) {
         return this.prs.getPrDetail(number, opts);
     }
@@ -1594,9 +1618,25 @@ export class WorkflowService {
      * the enforcement read one predicate. A conflicting merge is aborted
      * inside `mergeFromOrigin`: nothing is committed or pushed, and the branch
      * is exactly what it was.
+     *
+     * ONE detail read after the merge. The read before it exists only to
+     * decide authority and to name the two branches, so it asks for no patches
+     * — that is one git subprocess per changed file it does not spend. The
+     * approvals carry-forward runs BEFORE the final read rather than after it,
+     * against a head resolved with `resolvePrShas` (two rev-parses) instead of
+     * a whole second detail, so the detail that goes back already describes the
+     * approvals it carried. What used to be three detail reads is now one.
      */
     async updateFromTarget(workspaceId, user, number) {
-        const detail = await this.prs.getPrDetail(number, { fresh: true, workspaceId, viewerEmail: user.email });
+        // No patches: all this read decides is authority, state and the two
+        // branch names. Asking for patch text here would diff every changed file
+        // in a request that is about to be merged and read in full anyway.
+        const detail = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+            patches: false,
+        });
         if (!detail) {
             throw new WorkflowValidationError(`Change request #${number} not found.`, { kind: 'change-request-not-found', number });
         }
@@ -1615,8 +1655,15 @@ export class WorkflowService {
         // merge commit that then cannot push, stranding it in the workspace. A
         // rebase conflict hands the stranded saves to recovery, as every other
         // pull does, before the refusal reaches the caller.
+        //
+        // `preserveMerges`: this is the one pull whose unpushed commit may be a
+        // MERGE — the update that ran before this one and could not push. A plain
+        // rebase replays it as cherry-picks of the target's commits, which drops
+        // the target as a parent, so the branch never contains the target's head
+        // however many times the update runs. Replayed with `--rebase-merges` it
+        // stays a merge and the next push ends the loop.
         try {
-            await this.pullWorkspace(workspaceId);
+            await this.pullWorkspace(workspaceId, { preserveMerges: true });
         }
         catch (err) {
             if (err instanceof PullRebaseConflictError) {
@@ -1648,21 +1695,47 @@ export class WorkflowService {
         if (outcome.kind === 'conflicts') {
             throw new ChangeRequestConflictsError(detail.branch, detail.base, outcome.paths);
         }
-        // If a new merge commit landed, push so the CR picks it up. When
-        // already up to date there's nothing to share — short-circuit the push.
-        if (!outcome.alreadyUpToDate) {
+        // Push whenever the CLONE holds a commit origin has not seen — not when
+        // THIS merge authored one. The two differ in exactly the case that keeps
+        // a request behind for good: an earlier update merged, its push failed,
+        // and the merge is sitting in the workspace. That merge already contains
+        // the target, so this call's `mergeFromOrigin` reports
+        // `alreadyUpToDate` and the old gate skipped the push — leaving the
+        // request behind on the remote, and the next open with the same work to
+        // do. Asking git what is unpushed retries it instead.
+        //
+        // A failed probe falls back to the old gate rather than to "push
+        // anyway": `trackedPush` on a clone with nothing to push is a wasted
+        // round trip on every single update.
+        const hasUnpushed = await this.git
+            .hasUnpushedCommits(workspaceId)
+            .catch((err) => {
+            log.warn(`could not tell whether change request #${number} has unpushed commits; falling back to whether this merge authored one`, { err });
+            return !outcome.alreadyUpToDate;
+        });
+        if (hasUnpushed) {
             await this.trackedPush(workspaceId, user);
-            // The source head moved: the refusal described a revision that is gone.
-            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
-        this.prs.invalidateDetailCache(number);
-        const refreshed = await this.prs.getPrDetail(number, {
-            fresh: true,
-            workspaceId,
-            viewerEmail: user.email,
-        });
-        if (!refreshed) {
-            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        // Where the branch ended up, as PUBLISHED — two rev-parses, not a second
+        // detail read. Everything below needs only the sha, and the detail that
+        // goes back to the caller is read once, at the end, after the approvals
+        // it should describe have been carried.
+        let headAfterMerge = headBeforeMerge;
+        try {
+            const at = await this.git.resolvePrShas(workspaceId, detail.base, detail.branch);
+            headAfterMerge = at.headSha;
+        }
+        catch (err) {
+            log.warn(`could not resolve the published head of change request #${number} after updating it from target`, { err });
+        }
+        const headMoved = Boolean(headBeforeMerge) && headAfterMerge !== headBeforeMerge;
+        // The source head moved: the refusal described a revision that is gone.
+        // `hasUnpushed` counts as well as the sha comparison, and deliberately —
+        // a push that just landed moved the published head by definition, and
+        // reading the sha to confirm it is a call that can fail. A refusal left
+        // standing over a revision nobody can apply any more is the worse error.
+        if (headMoved || hasUnpushed) {
+            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
         // The merge is a commit the APPROVERS did not make. Re-pin their
         // approvals onto the new head for every file whose bytes it left alone —
@@ -1671,35 +1744,48 @@ export class WorkflowService {
         // than the bookkeeping, so a failure here is logged and the fresh detail
         // still goes back.
         //
-        // `alreadyUpToDate` is the real gate: no merge commit, no head to compare,
-        // nothing moved under anyone. The other two conditions are belt-and-braces
-        // over a sha that is not a sha — a resolve that failed onto a detail with
-        // no head, or two heads that somehow read equal — both of which
-        // `pathsChangedBetween` and `carryApprovalsForward` would refuse anyway.
-        // A merge that authored a commit cannot leave the head where it was.
-        if (!outcome.alreadyUpToDate && headBeforeMerge && refreshed.headSha !== headBeforeMerge) {
+        // The head moving is the real gate: nothing moved, nothing moved under
+        // anyone. It also covers the sha that is not a sha — a resolve that
+        // failed onto a detail with no head — which `pathsChangedBetween` and
+        // `carryApprovalsForward` would refuse anyway.
+        //
+        // This runs BEFORE the detail read, not after it. The rows it writes are
+        // what the caller's `approvals` must describe, so doing it first means
+        // the one read at the end is already correct — where carrying afterwards
+        // needed a THIRD read to correct a detail assembled before the rows
+        // existed.
+        //
+        // The same list answers the caller's `updatedPaths`: "which files did
+        // this merge change" is one question, and the two answers must not be
+        // allowed to differ — a file whose approval was carried (so: untouched)
+        // that the dialog then re-read would be the dialog discarding content the
+        // server just called unchanged.
+        let updatedPaths = [];
+        if (headMoved) {
             try {
-                const changedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, refreshed.headSha);
-                const carried = await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, refreshed.headSha, changedPaths);
-                // The detail above was assembled before those rows existed, so its
-                // `approvals` (and the merge gate derived from them) still describe
-                // the pre-merge head. Only re-read when something actually carried.
-                if (carried > 0) {
-                    this.prs.invalidateDetailCache(number);
-                    const withApprovals = await this.prs.getPrDetail(number, {
-                        fresh: true,
-                        workspaceId,
-                        viewerEmail: user.email,
-                    });
-                    if (withApprovals)
-                        return withApprovals;
-                }
+                updatedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, headAfterMerge);
+                await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, headAfterMerge, updatedPaths);
             }
             catch (err) {
                 log.warn(`could not carry approvals forward on change request #${number} after updating from target`, { err });
+                // The diff is what failed, so which files moved is unknown. Say so as
+                // "every file this request had", which is every file a caller can
+                // already be showing: slow beats a dialog that goes on presenting
+                // pre-merge text as current. Anything the merge ADDED is not on the
+                // list and does not need to be — no caller has read it yet.
+                updatedPaths = (detail.files ?? []).map((f) => f.path);
             }
         }
-        return refreshed;
+        this.prs.invalidateDetailCache(number);
+        const refreshed = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+        });
+        if (!refreshed) {
+            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        }
+        return { ...refreshed, updatedPaths };
     }
     listComments(number) {
         return this.reviewWorkflow.listComments(number);
@@ -2126,11 +2212,16 @@ export class WorkflowService {
     /**
      * DELETE a change request outright: close it (whatever its diff says) and
      * retire its source branch — the request, its proposal, and the branch that
-     * carried it are gone in one verb. Admin-only, resolved the same way every
-     * other admin check here is (write on `roles.yaml` at `origin/<base>`,
-     * never a local ref): this is the moderation verb for a shared deployment,
-     * stronger than reject (which the author or the files' owners can do, and
-     * which leaves the branch for a second round).
+     * carried it are gone in one verb. The request's AUTHOR or an admin, and
+     * nobody else: it is the author's own proposal and their own branch to throw
+     * away, and it is the moderation verb for a shared deployment. Admin rights
+     * resolve the same way every other admin check here does (write on
+     * `roles.yaml` at `origin/<base>`, never a local ref); authorship is the
+     * STORED `authorId` hash, never anything the caller sends.
+     *
+     * Stronger than reject, which the changed files' owners may also do and which
+     * leaves the branch for a second round. They keep reject and do not get this:
+     * an owner must not be able to destroy someone else's text and branch.
      */
     async deleteChangeRequest(number, user) {
         const summary = await this.prs.getPr(number);
@@ -2180,8 +2271,17 @@ export class WorkflowService {
             this.kickDeletedBranchSweep();
             throw new WorkflowDomainError(`The base branch "${summary.base}" could not be resolved — it may have been deleted, or origin was unreachable. A background check is running; retry in a moment.`, 409);
         }
-        if (isAdmin !== true) {
-            throw new WorkflowDomainError('Only an admin can delete a change request.', 403);
+        // Authorship is decided from the STORED author hash, never from anything
+        // the caller sends. Note what is deliberately NOT short-circuited for an
+        // author: the strict fetch and the `null` check above still run. An
+        // author's grant needs no `roles.yaml` read, so skipping them would look
+        // free — but it would let a delete close the request while the branch
+        // removal silently failed against an unreachable origin, and "the shared
+        // repository was down, so nothing changed" is the one refusal that has to
+        // stay honest.
+        const callerIsAuthor = !!(summary.authorId && summary.authorId === hashEmail(user.email));
+        if (!callerIsAuthor && isAdmin !== true) {
+            throw new WorkflowDomainError("Only the request's author or an admin can delete it.", 403);
         }
         // Close first (idempotent: an already-closed request just skips to the
         // branch retirement). Guarded on `open` so a concurrent merge wins.