@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/src/modules/workflow/git/pull-request.service.ts

@@ -366,6 +366,60 @@ export class PullRequestService implements IPullRequestService {
     return this.summaryOf(row, workspaceId);
   }
 
+  /**
+   * Did the target change, since the fork point, any file this request also
+   * changes? The question behind `needsUpdate`.
+   *
+   * The intersection is taken over BOTH names of every rename on both sides,
+   * because a wrong "no" is the expensive answer: it would open a request on
+   * a diff read against text that has since moved, with Approve live. So
+   * `pathsChangedBetween` runs without rename detection (a rename on the
+   * TARGET reports the path it left as well as the one it arrived at), and
+   * the request's own side contributes each file's `previousPath` alongside
+   * its `path`.
+   *
+   * Answers true without asking git in the two cases where nothing may be
+   * assumed: no fork point (the branches share no history, so there is no
+   * range to diff) and a failed diff (an infra error must not read as "this
+   * request is fine"). Answers false without asking git when the request is
+   * not behind at all, or changes no files — the common case, and the one
+   * that must stay free.
+   */
+  private async targetTouchesRequestFiles(
+    workspaceId: string,
+    forkPoint: { mergeBaseSha: string | null; behind: boolean },
+    baseSha: string,
+    files: PullRequestFile[],
+  ): Promise<boolean> {
+    if (!forkPoint.behind) return false;
+    if (files.length === 0) return false;
+    // Diverged with no common ancestor: the target's whole history is
+    // "changed since the fork point", so anything this request touches is
+    // touched. Nothing to intersect against, and nothing to skip for.
+    if (!forkPoint.mergeBaseSha) return true;
+    const requestPaths = new Set<string>();
+    for (const f of files) {
+      requestPaths.add(f.path);
+      if (f.previousPath) requestPaths.add(f.previousPath);
+    }
+    try {
+      const onTarget = await this.gitService.pathsChangedBetween(
+        workspaceId,
+        forkPoint.mergeBaseSha,
+        // The target tip the WHOLE detail is pinned to, so this range ends
+        // exactly where `behind` and the file list were computed.
+        baseSha,
+      );
+      return onTarget.some((path) => requestPaths.has(path));
+    } catch (err) {
+      log.warn(
+        'could not compare the target against a change request\'s files; treating it as needing an update',
+        { err },
+      );
+      return true;
+    }
+  }
+
   async getPrDetail(
     prNumber: number,
     opts: { fresh?: boolean; workspaceId?: string; viewerEmail?: string; patches?: boolean } = {},
@@ -392,6 +446,8 @@ export class PullRequestService implements IPullRequestService {
       mergeBaseSha: null,
       behind: false,
     };
+    /** Did the target change, since the fork point, a file this request changes? */
+    let targetChangedShared = false;
     if (workspaceId) {
       const shas = await this.gitService.resolvePrShas(
         workspaceId,
@@ -417,6 +473,17 @@ export class PullRequestService implements IPullRequestService {
       // Pinned to the same two commits as the file list, so "needs updating"
       // and the diff it qualifies can never describe different heads.
       forkPoint = await this.gitService.forkPointForPr(workspaceId, { baseSha, headSha });
+      // Only a target that moved in a file THIS request also changes makes the
+      // proposal's diff describe text that has moved. One extra
+      // `diff --name-only` (and only when the branches have diverged at all)
+      // buys the difference between opening instantly and paying for a merge,
+      // a push and a second detail read.
+      targetChangedShared = await this.targetTouchesRequestFiles(
+        workspaceId,
+        forkPoint,
+        baseSha,
+        files,
+      );
     }
 
     // Validated cache hit: TTL fresh AND head SHA unchanged since we cached.
@@ -511,6 +578,22 @@ export class PullRequestService implements IPullRequestService {
       approvals,
     });
 
+    // Hashed here, not on the client: the detail carries an author HASH and no
+    // author email, so the comparison can only happen where the viewer's email
+    // is already known.
+    const viewerIsAuthor = !!(
+      opts.viewerEmail &&
+      summary.authorId &&
+      summary.authorId === hashEmail(opts.viewerEmail)
+    );
+
+    const viewerCanDelete = computeViewerCanDelete({
+      state: summary.state,
+      authorId: summary.authorId,
+      viewerEmail: opts.viewerEmail,
+      viewerCanBypassMerge,
+    });
+
     const detail: PullRequestDetail = {
       ...summary,
       body: row.body,
@@ -526,7 +609,12 @@ export class PullRequestService implements IPullRequestService {
       viewerCanCancel,
       mergeBaseSha: forkPoint.mergeBaseSha,
       behind: summary.state === 'open' && forkPoint.behind,
+      // `behind` AND the divergence actually reaches this request's files.
+      // Both halves, in this order, so a closed request is never either.
+      needsUpdate: summary.state === 'open' && forkPoint.behind && targetChangedShared,
       viewerCanUpdate,
+      viewerIsAuthor,
+      viewerCanDelete,
     };
 
     // A patch-less detail is an internal read; it must not be served to the
@@ -631,7 +719,38 @@ export function computeViewerCanUpdate(input: {
   return viewerIsAuthor || input.viewerCanBypassMerge || viewerMayApply;
 }
 
+/**
+ * Pure predicate for the `viewerCanDelete` hint — who may delete a request
+ * outright, closing it AND retiring its branch. The author (their own
+ * proposal and their own branch) or an admin (`viewerCanBypassMerge` is the
+ * proxy — the same `canWriteAtRef('roles.yaml')` predicate the DELETE route
+ * enforces). Mirrors `deleteChangeRequest` exactly, which is why it differs
+ * from its two siblings in both directions:
+ *
+ * - It does NOT grant the owner of every changed file, as
+ *   `computeViewerCanCancel` does. Declining someone else's request leaves
+ *   their branch to rework; deleting it destroys their text.
+ * - It bars only `merged`, not everything that is not `open`. A request
+ *   withdrawn in another tab is `closed` and still has a leftover branch the
+ *   server will retire, so the button must survive it. Applied history is
+ *   nobody's to delete.
+ *
+ * Fail-closed: no viewer email → false, whatever the grants say.
+ */
+export function computeViewerCanDelete(input: {
+  state: PullRequestState;
+  authorId: string | undefined;
+  viewerEmail: string | undefined;
+  viewerCanBypassMerge: boolean;
+}): boolean {
+  if (input.state === 'merged') return false;
+  if (!input.viewerEmail) return false;
+  const viewerIsAuthor = !!(input.authorId && input.authorId === hashEmail(input.viewerEmail));
+  return viewerIsAuthor || input.viewerCanBypassMerge;
+}
+
 export const __testing = {
   computeViewerCanCancel,
   computeViewerCanUpdate,
+  computeViewerCanDelete,
 };

package/src/modules/workflow/workflow.routes.ts

@@ -790,7 +790,9 @@ export function createWorkflowRoutes(
 
   /**
    * Delete a change request outright — close it and retire its source
-   * branch. Admin-only; the moderation verb for a shared deployment.
+   * branch. The request's author or an admin: their own proposal to throw
+   * away, and the moderation verb for a shared deployment. The changed files'
+   * owners are NOT included — they keep reject, which leaves the branch.
    */
   router.delete('/workflow/change-requests/:number', async (req, res) => {
     const num = parsePrNumber(req.params.number);

package/src/modules/workflow/workflow.service.ts

@@ -43,6 +43,7 @@ import type {
   ChangeRequestApplyFailureKind,
   ChangeRequestComment,
   ChangeRequestDetail,
+  ChangeRequestUpdateResult,
   ChangeRequestState,
   ChangedFile,
   FileApproval,
@@ -62,7 +63,7 @@ import {
   isPlatformRestoreShape,
 } from '@bevel-software/platform-shared';
 import type { KbContext } from '../../shared/kb-context.js';
-import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
+import { and, desc, eq, inArray, isNotNull, isNull, lt, ne, or } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
 import { changeRequests } from '../database/schema.js';
 import type { GitService } from './git/git.service.js';
@@ -576,8 +577,11 @@ export class WorkflowService implements IWorkflowService {
    * and nothing else. The pull itself reports the change, since it is the
    * only code that can observe it under the workspace mutex.
    */
-  private async pullWorkspace(workspaceId: string): Promise<boolean> {
-    const { treeChanged } = await this.git.pull(workspaceId);
+  private async pullWorkspace(
+    workspaceId: string,
+    opts: { preserveMerges?: boolean } = {},
+  ): Promise<boolean> {
+    const { treeChanged } = await this.git.pull(workspaceId, opts);
     const defaultBranch = this.kb.defaultBranch;
     if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
       this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
@@ -1729,6 +1733,38 @@ export class WorkflowService implements IWorkflowService {
     return this.prs.getPr(number);
   }
 
+  /**
+   * The newest non-open change request from `sourceBranch` by `authorEmail`.
+   *
+   * Read straight off `change_requests` rather than through the PR listing,
+   * which serves OPEN requests only: the whole point here is the closed ones.
+   * `author_email` is stored lowercased at insert, so the needle is too.
+   * Ordered by `closed_at` with `created_at` as the tiebreak, because a row
+   * closed before the column existed (or by a path that forgot to stamp it)
+   * still has a creation time and must not sort as the oldest.
+   */
+  async latestClosedChangeRequest(
+    authorEmail: string,
+    sourceBranch: string,
+  ): Promise<{ number: number; state: ChangeRequestState } | null> {
+    const email = authorEmail.trim().toLowerCase();
+    if (!email || !sourceBranch) return null;
+    const [row] = await this.db
+      .select({ number: changeRequests.number, state: changeRequests.state })
+      .from(changeRequests)
+      .where(
+        and(
+          eq(changeRequests.authorEmail, email),
+          eq(changeRequests.sourceBranch, sourceBranch),
+          ne(changeRequests.state, 'open'),
+        ),
+      )
+      .orderBy(desc(changeRequests.closedAt), desc(changeRequests.createdAt))
+      .limit(1);
+    if (!row) return null;
+    return { number: row.number, state: row.state as ChangeRequestState };
+  }
+
   getChangeRequestDetail(
     number: number,
     opts?: { fresh?: boolean; workspaceId?: string; viewerEmail?: string; patches?: boolean },
@@ -1953,13 +1989,29 @@ export class WorkflowService implements IWorkflowService {
    * the enforcement read one predicate. A conflicting merge is aborted
    * inside `mergeFromOrigin`: nothing is committed or pushed, and the branch
    * is exactly what it was.
+   *
+   * ONE detail read after the merge. The read before it exists only to
+   * decide authority and to name the two branches, so it asks for no patches
+   * — that is one git subprocess per changed file it does not spend. The
+   * approvals carry-forward runs BEFORE the final read rather than after it,
+   * against a head resolved with `resolvePrShas` (two rev-parses) instead of
+   * a whole second detail, so the detail that goes back already describes the
+   * approvals it carried. What used to be three detail reads is now one.
    */
   async updateFromTarget(
     workspaceId: string,
     user: AuthUser,
     number: number,
-  ): Promise<ChangeRequestDetail> {
-    const detail = await this.prs.getPrDetail(number, { fresh: true, workspaceId, viewerEmail: user.email });
+  ): Promise<ChangeRequestUpdateResult> {
+    // No patches: all this read decides is authority, state and the two
+    // branch names. Asking for patch text here would diff every changed file
+    // in a request that is about to be merged and read in full anyway.
+    const detail = await this.prs.getPrDetail(number, {
+      fresh: true,
+      workspaceId,
+      viewerEmail: user.email,
+      patches: false,
+    });
     if (!detail) {
       throw new WorkflowValidationError(
         `Change request #${number} not found.`,
@@ -1987,8 +2039,15 @@ export class WorkflowService implements IWorkflowService {
     // merge commit that then cannot push, stranding it in the workspace. A
     // rebase conflict hands the stranded saves to recovery, as every other
     // pull does, before the refusal reaches the caller.
+    //
+    // `preserveMerges`: this is the one pull whose unpushed commit may be a
+    // MERGE — the update that ran before this one and could not push. A plain
+    // rebase replays it as cherry-picks of the target's commits, which drops
+    // the target as a parent, so the branch never contains the target's head
+    // however many times the update runs. Replayed with `--rebase-merges` it
+    // stays a merge and the next push ends the loop.
     try {
-      await this.pullWorkspace(workspaceId);
+      await this.pullWorkspace(workspaceId, { preserveMerges: true });
     } catch (err) {
       if (err instanceof PullRebaseConflictError) {
         await this.queuePullConflictRecovery(workspaceId, err, user);
@@ -2026,24 +2085,53 @@ export class WorkflowService implements IWorkflowService {
     if (outcome.kind === 'conflicts') {
       throw new ChangeRequestConflictsError(detail.branch, detail.base, outcome.paths);
     }
-    // If a new merge commit landed, push so the CR picks it up. When
-    // already up to date there's nothing to share — short-circuit the push.
-    if (!outcome.alreadyUpToDate) {
+    // Push whenever the CLONE holds a commit origin has not seen — not when
+    // THIS merge authored one. The two differ in exactly the case that keeps
+    // a request behind for good: an earlier update merged, its push failed,
+    // and the merge is sitting in the workspace. That merge already contains
+    // the target, so this call's `mergeFromOrigin` reports
+    // `alreadyUpToDate` and the old gate skipped the push — leaving the
+    // request behind on the remote, and the next open with the same work to
+    // do. Asking git what is unpushed retries it instead.
+    //
+    // A failed probe falls back to the old gate rather than to "push
+    // anyway": `trackedPush` on a clone with nothing to push is a wasted
+    // round trip on every single update.
+    const hasUnpushed = await this.git
+      .hasUnpushedCommits(workspaceId)
+      .catch((err: unknown) => {
+        log.warn(
+          `could not tell whether change request #${number} has unpushed commits; falling back to whether this merge authored one`,
+          { err },
+        );
+        return !outcome.alreadyUpToDate;
+      });
+    if (hasUnpushed) {
       await this.trackedPush(workspaceId, user);
-      // The source head moved: the refusal described a revision that is gone.
-      await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
     }
-    this.prs.invalidateDetailCache(number);
-    const refreshed = await this.prs.getPrDetail(number, {
-      fresh: true,
-      workspaceId,
-      viewerEmail: user.email,
-    });
-    if (!refreshed) {
-      throw new WorkflowValidationError(
-        `Refreshed change request #${number} but could not re-fetch its detail.`,
+    // Where the branch ended up, as PUBLISHED — two rev-parses, not a second
+    // detail read. Everything below needs only the sha, and the detail that
+    // goes back to the caller is read once, at the end, after the approvals
+    // it should describe have been carried.
+    let headAfterMerge = headBeforeMerge;
+    try {
+      const at = await this.git.resolvePrShas(workspaceId, detail.base, detail.branch);
+      headAfterMerge = at.headSha;
+    } catch (err) {
+      log.warn(
+        `could not resolve the published head of change request #${number} after updating it from target`,
+        { err },
       );
     }
+    const headMoved = Boolean(headBeforeMerge) && headAfterMerge !== headBeforeMerge;
+    // The source head moved: the refusal described a revision that is gone.
+    // `hasUnpushed` counts as well as the sha comparison, and deliberately —
+    // a push that just landed moved the published head by definition, and
+    // reading the sha to confirm it is a call that can fail. A refusal left
+    // standing over a revision nobody can apply any more is the worse error.
+    if (headMoved || hasUnpushed) {
+      await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
+    }
     // The merge is a commit the APPROVERS did not make. Re-pin their
     // approvals onto the new head for every file whose bytes it left alone —
     // git's own two-dot diff between the two heads is the verdict on which
@@ -2051,45 +2139,61 @@ export class WorkflowService implements IWorkflowService {
     // than the bookkeeping, so a failure here is logged and the fresh detail
     // still goes back.
     //
-    // `alreadyUpToDate` is the real gate: no merge commit, no head to compare,
-    // nothing moved under anyone. The other two conditions are belt-and-braces
-    // over a sha that is not a sha — a resolve that failed onto a detail with
-    // no head, or two heads that somehow read equal — both of which
-    // `pathsChangedBetween` and `carryApprovalsForward` would refuse anyway.
-    // A merge that authored a commit cannot leave the head where it was.
-    if (!outcome.alreadyUpToDate && headBeforeMerge && refreshed.headSha !== headBeforeMerge) {
+    // The head moving is the real gate: nothing moved, nothing moved under
+    // anyone. It also covers the sha that is not a sha — a resolve that
+    // failed onto a detail with no head — which `pathsChangedBetween` and
+    // `carryApprovalsForward` would refuse anyway.
+    //
+    // This runs BEFORE the detail read, not after it. The rows it writes are
+    // what the caller's `approvals` must describe, so doing it first means
+    // the one read at the end is already correct — where carrying afterwards
+    // needed a THIRD read to correct a detail assembled before the rows
+    // existed.
+    //
+    // The same list answers the caller's `updatedPaths`: "which files did
+    // this merge change" is one question, and the two answers must not be
+    // allowed to differ — a file whose approval was carried (so: untouched)
+    // that the dialog then re-read would be the dialog discarding content the
+    // server just called unchanged.
+    let updatedPaths: string[] = [];
+    if (headMoved) {
       try {
-        const changedPaths = await this.git.pathsChangedBetween(
+        updatedPaths = await this.git.pathsChangedBetween(
           workspaceId,
           headBeforeMerge,
-          refreshed.headSha,
+          headAfterMerge,
         );
-        const carried = await this.reviewWorkflow.carryApprovalsForward(
+        await this.reviewWorkflow.carryApprovalsForward(
           number,
           headBeforeMerge,
-          refreshed.headSha,
-          changedPaths,
+          headAfterMerge,
+          updatedPaths,
         );
-        // The detail above was assembled before those rows existed, so its
-        // `approvals` (and the merge gate derived from them) still describe
-        // the pre-merge head. Only re-read when something actually carried.
-        if (carried > 0) {
-          this.prs.invalidateDetailCache(number);
-          const withApprovals = await this.prs.getPrDetail(number, {
-            fresh: true,
-            workspaceId,
-            viewerEmail: user.email,
-          });
-          if (withApprovals) return withApprovals;
-        }
       } catch (err) {
         log.warn(
           `could not carry approvals forward on change request #${number} after updating from target`,
           { err },
         );
+        // The diff is what failed, so which files moved is unknown. Say so as
+        // "every file this request had", which is every file a caller can
+        // already be showing: slow beats a dialog that goes on presenting
+        // pre-merge text as current. Anything the merge ADDED is not on the
+        // list and does not need to be — no caller has read it yet.
+        updatedPaths = (detail.files ?? []).map((f) => f.path);
       }
     }
-    return refreshed;
+    this.prs.invalidateDetailCache(number);
+    const refreshed = await this.prs.getPrDetail(number, {
+      fresh: true,
+      workspaceId,
+      viewerEmail: user.email,
+    });
+    if (!refreshed) {
+      throw new WorkflowValidationError(
+        `Refreshed change request #${number} but could not re-fetch its detail.`,
+      );
+    }
+    return { ...refreshed, updatedPaths };
   }
 
   listComments(number: number): Promise<ChangeRequestComment[]> {
@@ -2651,11 +2755,16 @@ export class WorkflowService implements IWorkflowService {
   /**
    * DELETE a change request outright: close it (whatever its diff says) and
    * retire its source branch — the request, its proposal, and the branch that
-   * carried it are gone in one verb. Admin-only, resolved the same way every
-   * other admin check here is (write on `roles.yaml` at `origin/<base>`,
-   * never a local ref): this is the moderation verb for a shared deployment,
-   * stronger than reject (which the author or the files' owners can do, and
-   * which leaves the branch for a second round).
+   * carried it are gone in one verb. The request's AUTHOR or an admin, and
+   * nobody else: it is the author's own proposal and their own branch to throw
+   * away, and it is the moderation verb for a shared deployment. Admin rights
+   * resolve the same way every other admin check here does (write on
+   * `roles.yaml` at `origin/<base>`, never a local ref); authorship is the
+   * STORED `authorId` hash, never anything the caller sends.
+   *
+   * Stronger than reject, which the changed files' owners may also do and which
+   * leaves the branch for a second round. They keep reject and do not get this:
+   * an owner must not be able to destroy someone else's text and branch.
    */
   async deleteChangeRequest(number: number, user: AuthUser): Promise<void> {
     const summary = await this.prs.getPr(number);
@@ -2714,8 +2823,17 @@ export class WorkflowService implements IWorkflowService {
         409,
       );
     }
-    if (isAdmin !== true) {
-      throw new WorkflowDomainError('Only an admin can delete a change request.', 403);
+    // Authorship is decided from the STORED author hash, never from anything
+    // the caller sends. Note what is deliberately NOT short-circuited for an
+    // author: the strict fetch and the `null` check above still run. An
+    // author's grant needs no `roles.yaml` read, so skipping them would look
+    // free — but it would let a delete close the request while the branch
+    // removal silently failed against an unreachable origin, and "the shared
+    // repository was down, so nothing changed" is the one refusal that has to
+    // stay honest.
+    const callerIsAuthor = !!(summary.authorId && summary.authorId === hashEmail(user.email));
+    if (!callerIsAuthor && isAdmin !== true) {
+      throw new WorkflowDomainError("Only the request's author or an admin can delete it.", 403);
     }
 
     // Close first (idempotent: an already-closed request just skips to the

package/src/modules/workspace/__tests__/workspace.service.unknown-branch.test.ts

@@ -77,6 +77,49 @@ describe('WorkspaceService — a branch origin does not have', () => {
     });
   });
 
+  /**
+   * The second defect on this ticket. A bootstrap that fails to clone used to
+   * leave its workspace directory behind, and a directory named after a branch
+   * is one of the ways the platform remembers having KNOWN a branch. So the
+   * first attempt at a typo answered 404 and then quietly created the evidence
+   * that turned every later attempt into 410 — the reader was told a branch
+   * they had invented "no longer exists on the remote".
+   */
+  it('leaves nothing on disk when the clone fails, so a second attempt is still a 404', async () => {
+    const svc = service();
+
+    await expect(svc.getOrCreateForBranch('nobody/never-made-this')).rejects.toMatchObject({
+      name: 'BranchNotFoundError',
+      status: 404,
+    });
+    // The failed bootstrap rolled back completely — not the clone directory,
+    // not the workspace shell around it.
+    expect(await fs.readdir(workspacesRoot)).toEqual([]);
+
+    // The same name again, on the same instance that has now already failed on
+    // it once. Nothing about the first failure may change this answer.
+    await expect(svc.getOrCreateForBranch('nobody/never-made-this')).rejects.toMatchObject({
+      name: 'BranchNotFoundError',
+      status: 404,
+      message: 'There is no branch named nobody/never-made-this.',
+      payload: { kind: 'branch-not-found', branch: 'nobody/never-made-this' },
+    });
+    expect(await fs.readdir(workspacesRoot)).toEqual([]);
+  });
+
+  it('does not count a bare directory with no clone in it as a branch it knew', async () => {
+    // A shell left by an older process (one that crashed mid-bootstrap, or that
+    // predates the rollback above). The "have I heard of this branch" probe asks
+    // for a COMPLETED clone, so a directory with no `.git` under it is absence:
+    // the honest 404 survives whatever is lying around the workspaces root.
+    await fs.mkdir(path.join(workspacesRoot, workspaceIdForBranch('nobody/never-made-this')), { recursive: true });
+
+    await expect(service().getOrCreateForBranch('nobody/never-made-this')).rejects.toMatchObject({
+      name: 'BranchNotFoundError',
+      status: 404,
+    });
+  });
+
   it('a name a listing showed us, and origin no longer has, stays a 410', async () => {
     const svc = service();
     // What the branch selector saw while the draft still existed.