@bevel-software/platform-core-backend 0.21.0 → 0.23.0

package/dist/modules/workflow/workflow.service.js

@@ -29,7 +29,7 @@ import { promises as fs } from 'node:fs';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { isFolderPlaceholder, folderPlaceholderPath, isPlatformRestoreShape, } from '@bevel-software/platform-shared';
-import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
+import { and, desc, eq, inArray, isNotNull, isNull, lt, ne, or, sql } from 'drizzle-orm';
 import { changeRequests } from '../database/schema.js';
 import { redactSecret } from '../../shared/redact-secret.js';
 import { workspaceIdForBranch, branchForWorkspaceId } from '../../shared/workspace-id.js';
@@ -249,9 +249,9 @@ export class WorkflowService {
      * the composition root registers module-owned behavior against it
      * (`core.workflowService.hooks.onCommitValidation(…)` /
      * `.onPreWrite(…)`) after `createCoreServices` returns. The composition
-     * root passes the SAME instance `GitService` and the session-ontology
-     * gate consult; the default keeps test constructions (which don't
-     * exercise hooks) unchanged.
+     * root passes the SAME instance `GitService` and the agent-access gate
+     * consult; the default keeps test constructions (which don't exercise
+     * hooks) unchanged.
      */
     hooks = new WorkflowHooks()) {
         this.db = db;
@@ -470,8 +470,8 @@ export class WorkflowService {
      * and nothing else. The pull itself reports the change, since it is the
      * only code that can observe it under the workspace mutex.
      */
-    async pullWorkspace(workspaceId) {
-        const { treeChanged } = await this.git.pull(workspaceId);
+    async pullWorkspace(workspaceId, opts = {}) {
+        const { treeChanged } = await this.git.pull(workspaceId, opts);
         const defaultBranch = this.kb.defaultBranch;
         if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
             this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
@@ -756,6 +756,16 @@ export class WorkflowService {
     fileAtChange(workspaceId, path, sha) {
         return this.git.fileContentsAtCommit(workspaceId, path, sha);
     }
+    /**
+     * The BYTES of one file at a change — what the file page's byte-reading
+     * viewers (pdf, image, docx, pptx, xlsx, email) need to show a past save,
+     * and what "Download this version" hands over. `fileAtChange` above cannot
+     * serve them: it decodes to UTF-8, which ruins every format that is not
+     * text.
+     */
+    fileBytesAtChange(workspaceId, path, sha, side) {
+        return this.git.fileBytesAtCommit(workspaceId, path, sha, side);
+    }
     /**
      * Resolve write permission for `targetPath` against the access tree at
      * `HEAD` of `branch`. Throws `AccessDeniedError` on denial with the
@@ -1427,6 +1437,30 @@ export class WorkflowService {
     getChangeRequest(number) {
         return this.prs.getPr(number);
     }
+    /**
+     * The newest non-open change request from `sourceBranch` by `authorEmail`.
+     *
+     * Read straight off `change_requests` rather than through the PR listing,
+     * which serves OPEN requests only: the whole point here is the closed ones.
+     * `author_email` is stored lowercased at insert, so the needle is too.
+     * Ordered by `closed_at` with `created_at` as the tiebreak, because a row
+     * closed before the column existed (or by a path that forgot to stamp it)
+     * still has a creation time and must not sort as the oldest.
+     */
+    async latestClosedChangeRequest(authorEmail, sourceBranch) {
+        const email = authorEmail.trim().toLowerCase();
+        if (!email || !sourceBranch)
+            return null;
+        const [row] = await this.db
+            .select({ number: changeRequests.number, state: changeRequests.state })
+            .from(changeRequests)
+            .where(and(eq(changeRequests.authorEmail, email), eq(changeRequests.sourceBranch, sourceBranch), ne(changeRequests.state, 'open')))
+            .orderBy(desc(changeRequests.closedAt), desc(changeRequests.createdAt))
+            .limit(1);
+        if (!row)
+            return null;
+        return { number: row.number, state: row.state };
+    }
     getChangeRequestDetail(number, opts) {
         return this.prs.getPrDetail(number, opts);
     }
@@ -1594,9 +1628,25 @@ export class WorkflowService {
      * the enforcement read one predicate. A conflicting merge is aborted
      * inside `mergeFromOrigin`: nothing is committed or pushed, and the branch
      * is exactly what it was.
+     *
+     * ONE detail read after the merge. The read before it exists only to
+     * decide authority and to name the two branches, so it asks for no patches
+     * — that is one git subprocess per changed file it does not spend. The
+     * approvals carry-forward runs BEFORE the final read rather than after it,
+     * against a head resolved with `resolvePrShas` (two rev-parses) instead of
+     * a whole second detail, so the detail that goes back already describes the
+     * approvals it carried. What used to be three detail reads is now one.
      */
     async updateFromTarget(workspaceId, user, number) {
-        const detail = await this.prs.getPrDetail(number, { fresh: true, workspaceId, viewerEmail: user.email });
+        // No patches: all this read decides is authority, state and the two
+        // branch names. Asking for patch text here would diff every changed file
+        // in a request that is about to be merged and read in full anyway.
+        const detail = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+            patches: false,
+        });
         if (!detail) {
             throw new WorkflowValidationError(`Change request #${number} not found.`, { kind: 'change-request-not-found', number });
         }
@@ -1615,8 +1665,15 @@ export class WorkflowService {
         // merge commit that then cannot push, stranding it in the workspace. A
         // rebase conflict hands the stranded saves to recovery, as every other
         // pull does, before the refusal reaches the caller.
+        //
+        // `preserveMerges`: this is the one pull whose unpushed commit may be a
+        // MERGE — the update that ran before this one and could not push. A plain
+        // rebase replays it as cherry-picks of the target's commits, which drops
+        // the target as a parent, so the branch never contains the target's head
+        // however many times the update runs. Replayed with `--rebase-merges` it
+        // stays a merge and the next push ends the loop.
         try {
-            await this.pullWorkspace(workspaceId);
+            await this.pullWorkspace(workspaceId, { preserveMerges: true });
         }
         catch (err) {
             if (err instanceof PullRebaseConflictError) {
@@ -1648,21 +1705,47 @@ export class WorkflowService {
         if (outcome.kind === 'conflicts') {
             throw new ChangeRequestConflictsError(detail.branch, detail.base, outcome.paths);
         }
-        // If a new merge commit landed, push so the CR picks it up. When
-        // already up to date there's nothing to share — short-circuit the push.
-        if (!outcome.alreadyUpToDate) {
+        // Push whenever the CLONE holds a commit origin has not seen — not when
+        // THIS merge authored one. The two differ in exactly the case that keeps
+        // a request behind for good: an earlier update merged, its push failed,
+        // and the merge is sitting in the workspace. That merge already contains
+        // the target, so this call's `mergeFromOrigin` reports
+        // `alreadyUpToDate` and the old gate skipped the push — leaving the
+        // request behind on the remote, and the next open with the same work to
+        // do. Asking git what is unpushed retries it instead.
+        //
+        // A failed probe falls back to the old gate rather than to "push
+        // anyway": `trackedPush` on a clone with nothing to push is a wasted
+        // round trip on every single update.
+        const hasUnpushed = await this.git
+            .hasUnpushedCommits(workspaceId)
+            .catch((err) => {
+            log.warn(`could not tell whether change request #${number} has unpushed commits; falling back to whether this merge authored one`, { err });
+            return !outcome.alreadyUpToDate;
+        });
+        if (hasUnpushed) {
             await this.trackedPush(workspaceId, user);
-            // The source head moved: the refusal described a revision that is gone.
-            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
-        this.prs.invalidateDetailCache(number);
-        const refreshed = await this.prs.getPrDetail(number, {
-            fresh: true,
-            workspaceId,
-            viewerEmail: user.email,
-        });
-        if (!refreshed) {
-            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        // Where the branch ended up, as PUBLISHED — two rev-parses, not a second
+        // detail read. Everything below needs only the sha, and the detail that
+        // goes back to the caller is read once, at the end, after the approvals
+        // it should describe have been carried.
+        let headAfterMerge = headBeforeMerge;
+        try {
+            const at = await this.git.resolvePrShas(workspaceId, detail.base, detail.branch);
+            headAfterMerge = at.headSha;
+        }
+        catch (err) {
+            log.warn(`could not resolve the published head of change request #${number} after updating it from target`, { err });
+        }
+        const headMoved = Boolean(headBeforeMerge) && headAfterMerge !== headBeforeMerge;
+        // The source head moved: the refusal described a revision that is gone.
+        // `hasUnpushed` counts as well as the sha comparison, and deliberately —
+        // a push that just landed moved the published head by definition, and
+        // reading the sha to confirm it is a call that can fail. A refusal left
+        // standing over a revision nobody can apply any more is the worse error.
+        if (headMoved || hasUnpushed) {
+            await this.clearApplyFailure(number, { recordedBefore: headMovedAfter });
         }
         // The merge is a commit the APPROVERS did not make. Re-pin their
         // approvals onto the new head for every file whose bytes it left alone —
@@ -1671,35 +1754,48 @@ export class WorkflowService {
         // than the bookkeeping, so a failure here is logged and the fresh detail
         // still goes back.
         //
-        // `alreadyUpToDate` is the real gate: no merge commit, no head to compare,
-        // nothing moved under anyone. The other two conditions are belt-and-braces
-        // over a sha that is not a sha — a resolve that failed onto a detail with
-        // no head, or two heads that somehow read equal — both of which
-        // `pathsChangedBetween` and `carryApprovalsForward` would refuse anyway.
-        // A merge that authored a commit cannot leave the head where it was.
-        if (!outcome.alreadyUpToDate && headBeforeMerge && refreshed.headSha !== headBeforeMerge) {
+        // The head moving is the real gate: nothing moved, nothing moved under
+        // anyone. It also covers the sha that is not a sha — a resolve that
+        // failed onto a detail with no head — which `pathsChangedBetween` and
+        // `carryApprovalsForward` would refuse anyway.
+        //
+        // This runs BEFORE the detail read, not after it. The rows it writes are
+        // what the caller's `approvals` must describe, so doing it first means
+        // the one read at the end is already correct — where carrying afterwards
+        // needed a THIRD read to correct a detail assembled before the rows
+        // existed.
+        //
+        // The same list answers the caller's `updatedPaths`: "which files did
+        // this merge change" is one question, and the two answers must not be
+        // allowed to differ — a file whose approval was carried (so: untouched)
+        // that the dialog then re-read would be the dialog discarding content the
+        // server just called unchanged.
+        let updatedPaths = [];
+        if (headMoved) {
             try {
-                const changedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, refreshed.headSha);
-                const carried = await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, refreshed.headSha, changedPaths);
-                // The detail above was assembled before those rows existed, so its
-                // `approvals` (and the merge gate derived from them) still describe
-                // the pre-merge head. Only re-read when something actually carried.
-                if (carried > 0) {
-                    this.prs.invalidateDetailCache(number);
-                    const withApprovals = await this.prs.getPrDetail(number, {
-                        fresh: true,
-                        workspaceId,
-                        viewerEmail: user.email,
-                    });
-                    if (withApprovals)
-                        return withApprovals;
-                }
+                updatedPaths = await this.git.pathsChangedBetween(workspaceId, headBeforeMerge, headAfterMerge);
+                await this.reviewWorkflow.carryApprovalsForward(number, headBeforeMerge, headAfterMerge, updatedPaths);
             }
             catch (err) {
                 log.warn(`could not carry approvals forward on change request #${number} after updating from target`, { err });
+                // The diff is what failed, so which files moved is unknown. Say so as
+                // "every file this request had", which is every file a caller can
+                // already be showing: slow beats a dialog that goes on presenting
+                // pre-merge text as current. Anything the merge ADDED is not on the
+                // list and does not need to be — no caller has read it yet.
+                updatedPaths = (detail.files ?? []).map((f) => f.path);
             }
         }
-        return refreshed;
+        this.prs.invalidateDetailCache(number);
+        const refreshed = await this.prs.getPrDetail(number, {
+            fresh: true,
+            workspaceId,
+            viewerEmail: user.email,
+        });
+        if (!refreshed) {
+            throw new WorkflowValidationError(`Refreshed change request #${number} but could not re-fetch its detail.`);
+        }
+        return { ...refreshed, updatedPaths };
     }
     listComments(number) {
         return this.reviewWorkflow.listComments(number);
@@ -2126,11 +2222,16 @@ export class WorkflowService {
     /**
      * DELETE a change request outright: close it (whatever its diff says) and
      * retire its source branch — the request, its proposal, and the branch that
-     * carried it are gone in one verb. Admin-only, resolved the same way every
-     * other admin check here is (write on `roles.yaml` at `origin/<base>`,
-     * never a local ref): this is the moderation verb for a shared deployment,
-     * stronger than reject (which the author or the files' owners can do, and
-     * which leaves the branch for a second round).
+     * carried it are gone in one verb. The request's AUTHOR or an admin, and
+     * nobody else: it is the author's own proposal and their own branch to throw
+     * away, and it is the moderation verb for a shared deployment. Admin rights
+     * resolve the same way every other admin check here does (write on
+     * `roles.yaml` at `origin/<base>`, never a local ref); authorship is the
+     * STORED `authorId` hash, never anything the caller sends.
+     *
+     * Stronger than reject, which the changed files' owners may also do and which
+     * leaves the branch for a second round. They keep reject and do not get this:
+     * an owner must not be able to destroy someone else's text and branch.
      */
     async deleteChangeRequest(number, user) {
         const summary = await this.prs.getPr(number);
@@ -2180,8 +2281,17 @@ export class WorkflowService {
             this.kickDeletedBranchSweep();
             throw new WorkflowDomainError(`The base branch "${summary.base}" could not be resolved — it may have been deleted, or origin was unreachable. A background check is running; retry in a moment.`, 409);
         }
-        if (isAdmin !== true) {
-            throw new WorkflowDomainError('Only an admin can delete a change request.', 403);
+        // Authorship is decided from the STORED author hash, never from anything
+        // the caller sends. Note what is deliberately NOT short-circuited for an
+        // author: the strict fetch and the `null` check above still run. An
+        // author's grant needs no `roles.yaml` read, so skipping them would look
+        // free — but it would let a delete close the request while the branch
+        // removal silently failed against an unreachable origin, and "the shared
+        // repository was down, so nothing changed" is the one refusal that has to
+        // stay honest.
+        const callerIsAuthor = !!(summary.authorId && summary.authorId === hashEmail(user.email));
+        if (!callerIsAuthor && isAdmin !== true) {
+            throw new WorkflowDomainError("Only the request's author or an admin can delete it.", 403);
         }
         // Close first (idempotent: an already-closed request just skips to the
         // branch retirement). Guarded on `open` so a concurrent merge wins.
@@ -2375,6 +2485,103 @@ export class WorkflowService {
         }
         return closed;
     }
+    /**
+     * How many change requests are open right now.
+     *
+     * Read by the setup screen's repository-change confirmation, which has to
+     * say how many requests the admin is deciding about BEFORE the address is
+     * saved. A plain count — nothing here reaches the repository, so it answers
+     * just as well for a repository that is already gone.
+     */
+    async countOpenChangeRequests() {
+        const [row] = await this.db
+            .select({ open: sql `count(*)::int` })
+            .from(changeRequests)
+            .where(eq(changeRequests.state, 'open'));
+        return row?.open ?? 0;
+    }
+    /**
+     * Close every open change request because the knowledge-base REPOSITORY was
+     * replaced, and answer how many were closed.
+     *
+     * The admin's own choice on the setup screen: a repository that merely
+     * MOVED keeps its requests (the branches came along), while a repository
+     * that was REPLACED has none of those branches, so every request points at
+     * something this deployment can no longer fetch. Nothing is deleted — the
+     * rows stay, closed, carrying `closed_reason = 'repository-replaced'` so
+     * the reason survives the person who chose it.
+     *
+     * Locks held on those branches go with them. Their holder cannot publish
+     * the bytes (the branch is not in the new repository) and cannot release
+     * the lock by finishing (the request is closed), so the row would sit there
+     * refusing the path until its TTL ran out — and a still-connected client's
+     * heartbeat keeps pushing that out.
+     *
+     * The close is ONE statement per pass — `update … where state = 'open'
+     * returning` — not a count followed by a row-at-a-time loop. Read first and
+     * then written, every request opened while the loop ran would be missed and
+     * left open against a branch the new repository does not have. One
+     * set-shaped statement cannot miss a row that exists when it runs, and the
+     * guard is the statement's own `where`, so a merge or a withdrawal racing it
+     * wins and its request is simply not in the returned set.
+     *
+     * Repeated while a pass still finds something, because a request can be
+     * opened BETWEEN passes: the caller has not saved the new address yet, so
+     * the deployment is still live and `POST /change-requests` is still being
+     * served. Bounded, so a client opening requests in a loop cannot hold the
+     * save open forever — what survives the last pass is a request opened after
+     * the repository was replaced, which the deleted-branch sweep closes on its
+     * own terms.
+     */
+    async closeOpenChangeRequestsAsRepositoryReplaced() {
+        let closed = 0;
+        for (let pass = 0; pass < 5; pass++) {
+            const now = new Date();
+            const justClosed = await this.db
+                .update(changeRequests)
+                .set({ state: 'closed', closedAt: now, updatedAt: now, closedReason: 'repository-replaced' })
+                .where(eq(changeRequests.state, 'open'))
+                .returning({ number: changeRequests.number, sourceBranch: changeRequests.sourceBranch });
+            if (justClosed.length === 0)
+                break;
+            for (const cr of justClosed) {
+                // Best effort, per branch: a lock table that will not answer must not
+                // leave the requests half closed — the close is the decision the admin
+                // made, and the locks expire on their own within the minute.
+                try {
+                    const released = await this.fileLocks.releaseAllOnBranch(cr.sourceBranch);
+                    if (released > 0) {
+                        crLog.info(`released ${released} file lock(s) held on "${cr.sourceBranch}"`);
+                    }
+                }
+                catch (err) {
+                    crLog.warn(`could not release the file locks on "${cr.sourceBranch}":`, { err });
+                }
+                // The bytes a release already enqueued belong to the repository that
+                // is gone — see `markNeedsAttentionOnBranch`. Taken out of the
+                // worker's reach in the same breath as the locks, because dropping a
+                // lock is precisely what leaves a row behind.
+                try {
+                    const quarantined = await this.pendingCommits.markNeedsAttentionOnBranch(cr.sourceBranch, 'The knowledge-base repository was replaced while this commit was still queued, so it was never ' +
+                        'written. The bytes are kept here: the branch it was meant for belongs to the previous repository.');
+                    if (quarantined > 0) {
+                        crLog.warn(`${quarantined} queued commit(s) on "${cr.sourceBranch}" need attention: the repository was replaced ` +
+                            'before they landed, so they were not written to the new one.');
+                    }
+                }
+                catch (err) {
+                    crLog.warn(`could not set aside the queued commits on "${cr.sourceBranch}":`, { err });
+                }
+                this.prs.invalidateDetailCache(cr.number);
+                this.events?.emit({ kind: 'change-request-rejected', number: cr.number });
+                closed++;
+            }
+        }
+        if (closed > 0) {
+            crLog.info(`closed ${closed} change request(s): the knowledge-base repository was replaced`);
+        }
+        return closed;
+    }
     /**
      * The sweep above, on demand. Boot runs it once (`create-core-server`),
      * which clears requests stranded BEFORE the process started; a branch that