@bevel-software/platform-core-backend 0.21.0 → 0.23.0

package/src/modules/workflow/__tests__/pending-commits.repository-replaced.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
+import { PendingCommitsService } from '../pending-commits.service.js';
+import type { Database } from '../../database/connection.js';
+
+/**
+ * Commits still queued for a branch when the knowledge-base repository is
+ * REPLACED.
+ *
+ * A release enqueues the bytes and only then drops its lock, so the moment the
+ * locks on a branch are dropped there may be rows already waiting — written
+ * against a working copy of the repository that is gone. Left `pending`, the
+ * worker picks them up after the re-clone and commits them onto a same-named
+ * branch of a DIFFERENT repository: somebody else's file, overwritten by a
+ * change nobody made to it.
+ *
+ * So they are escalated, never dropped: the bytes stay in the row, the reason
+ * is on it, and a person decides.
+ */
+function makeFakeDb(moved: Array<{ id: string }>) {
+  const sets: Record<string, unknown>[] = [];
+  const db = {
+    update: vi.fn(() => ({
+      set: (values: Record<string, unknown>) => {
+        sets.push(values);
+        return { where: () => ({ returning: async () => moved }) };
+      },
+    })),
+    // Queued bytes are never thrown away over this.
+    delete: () => {
+      throw new Error('a queued commit must never be deleted');
+    },
+  } as unknown as Database;
+  return { db, sets };
+}
+
+describe('PendingCommitsService.markNeedsAttentionOnBranch', () => {
+  it('escalates every queued commit on the branch, with the reason, and answers how many', async () => {
+    const { db, sets } = makeFakeDb([{ id: 'a' }, { id: 'b' }]);
+    const svc = new PendingCommitsService(db);
+
+    await expect(
+      svc.markNeedsAttentionOnBranch('alice/draft', 'The repository was replaced.'),
+    ).resolves.toBe(2);
+
+    expect(sets).toHaveLength(1);
+    // `needs_attention` is the status the admin surface reads — the row is out
+    // of the worker's reach and in front of a person.
+    expect(sets[0]?.status).toBe('needs_attention');
+    expect(sets[0]?.lastError).toBe('The repository was replaced.');
+    expect(sets[0]?.lastAttemptedAt).toBeInstanceOf(Date);
+  });
+
+  it('answers zero when nothing was queued for that branch', async () => {
+    const { db } = makeFakeDb([]);
+    const svc = new PendingCommitsService(db);
+    await expect(svc.markNeedsAttentionOnBranch('quiet/branch', 'whatever')).resolves.toBe(0);
+  });
+});
+
+/**
+ * The same, keyed on the WORKING COPY that was set aside. Closing change
+ * requests covers their branches and nothing else; a commit queued on the
+ * default branch was written against the repository that was left all the
+ * same, and the path it names is about to hold a clone of another one.
+ */
+describe('PendingCommitsService.markNeedsAttentionInWorkspace', () => {
+  it('escalates every queued commit for the working copy, with the reason, and answers how many', async () => {
+    const { db, sets } = makeFakeDb([{ id: 'a' }, { id: 'b' }, { id: 'c' }]);
+    const svc = new PendingCommitsService(db);
+
+    await expect(svc.markNeedsAttentionInWorkspace('main', 'The repository was replaced.')).resolves.toBe(3);
+
+    expect(sets).toHaveLength(1);
+    expect(sets[0]?.status).toBe('needs_attention');
+    expect(sets[0]?.lastError).toBe('The repository was replaced.');
+    expect(sets[0]?.lastAttemptedAt).toBeInstanceOf(Date);
+  });
+
+  /**
+   * Rows are stored under the encoded id, whichever spelling the caller
+   * enqueued with. The predicate is rendered and read, since the stub does
+   * not evaluate it: the id it compares must be the stored spelling, and it
+   * must match only the two statuses a worker could still write, `pending`
+   * and `running`.
+   */
+  it('looks for the working copy under the id the queue stores, and only for commits still queued', async () => {
+    const wheres: SQL[] = [];
+    const db = {
+      update: () => ({
+        set: () => ({
+          where: (predicate: SQL) => {
+            wheres.push(predicate);
+            return { returning: async () => [] };
+          },
+        }),
+      }),
+    } as unknown as Database;
+    await new PendingCommitsService(db).markNeedsAttentionInWorkspace('alice/feature', 'whatever');
+
+    const { sql: text, params } = new PgDialect().sqlToQuery(wheres[0]!);
+    expect(text).toContain('"workspace_id" =');
+    expect(params).toEqual(['alice%2Ffeature', 'pending', 'running']);
+  });
+
+  it('answers zero when nothing was queued for it', async () => {
+    const { db } = makeFakeDb([]);
+    await expect(new PendingCommitsService(db).markNeedsAttentionInWorkspace('main', 'whatever')).resolves.toBe(0);
+  });
+});

package/src/modules/workflow/__tests__/workflow.routes.history-read-gate.test.ts

@@ -8,6 +8,10 @@ import type { AuthService } from '../../auth/auth.service.js';
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { WorkflowEventBus } from '../event-bus.js';
 import { createWorkflowRoutes } from '../workflow.routes.js';
+import {
+  VersionNotOnBranchError,
+  VERSION_NOT_ON_BRANCH_MESSAGE,
+} from '../../../shared/domain-errors.js';
 
 // A file's history is its content with a time axis: the same default-deny
 // read model that hides a file must hide its commit list, its diffs, and its
@@ -129,6 +133,27 @@ describe('history routes enforce the read model', () => {
     expect((await get(`/compare-file?from=a&to=b&path=${OPEN}`)).status).toBe(403);
   });
 
+  it.each([
+    ['/show-file?sha=abc1234&path=%s', 'showFileAtChange'],
+    ['/file-at-change?sha=abc1234&path=%s', 'fileAtChange'],
+  ] as const)(
+    '%s: a save off this branch is refused with the history message',
+    async (route, method) => {
+      // The service raises it (the git layer knows the branch); the route has
+      // to pass the typed refusal through with its own status and sentence,
+      // because a reader who is told "not found" about a file that is plainly
+      // there learns the wrong thing. The bytes route carries the same rule,
+      // so neither can be read around through the other.
+      h = await makeHarness();
+      h.workflow[method].mockRejectedValueOnce(new VersionNotOnBranchError());
+      const res = await get(route.replace('%s', OPEN));
+      expect(res.status).toBe(404);
+      expect(((await res.json()) as { error: string }).error).toBe(
+        VERSION_NOT_ON_BRANCH_MESSAGE,
+      );
+    },
+  );
+
   it('an access-model error fails closed, not open', async () => {
     h = await makeHarness();
     h.canRead.mockRejectedValueOnce(new Error('access tree unreadable'));

package/src/modules/workflow/__tests__/workflow.service.facade.test.ts

@@ -17,6 +17,7 @@ import { PullRebaseConflictError, WorkflowDomainError } from '../../../shared/do
 import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import type { Database } from '../../database/connection.js';
 import { openChangeGate } from '../../../__tests__/open-change-gate.js';
+import { hashEmail } from '../../../shared/email-identity.js';
 
 // `deleteBranch`'s open-request guard is the only DB touch these tests
 // exercise. The stub ANSWERS FROM THE WHERE-CLAUSE rather than returning the
@@ -375,7 +376,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     expect(outcome).toEqual({ kind: 'merged', result: mergeResult });
     // The target branch's workspace is pulled so it doesn't fall behind origin.
     expect(workspaceService.getOrCreateForBranch).toHaveBeenCalledWith('main');
-    expect(git.pull).toHaveBeenCalledWith('main');
+    expect(git.pull).toHaveBeenCalledWith('main', {});
     expect(reviewWorkflow.mergePr).toHaveBeenCalledWith(
       4,
       expect.objectContaining({ email: 'alice@example.com' }),
@@ -784,8 +785,13 @@ describe('WorkflowService — revertChangeRequestFile / closeEmptyChangeRequest'
   });
 });
 
-describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () => {
-  function makeDeleteHarness(opts: { isAdmin?: boolean; prState?: string } = {}) {
+describe('WorkflowService — deleteChangeRequest (the author’s and the admin’s verb)', () => {
+  const AUTHOR_EMAIL = 'alice@example.com'; // makeUser()'s default caller
+  const STRANGER_AUTHOR = 'mallory@example.com';
+
+  function makeDeleteHarness(
+    opts: { isAdmin?: boolean; prState?: string; authorEmail?: string | null } = {},
+  ) {
     const git = Object.assign(makeGit(), {
       changedPathsForPr: vi.fn().mockResolvedValue(['Docs/a.md']),
     }) as unknown as GitService;
@@ -795,26 +801,83 @@ describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () =
       base: 'main',
       branch: 'mallory/spam',
       state: opts.prState ?? 'open',
+      // Authorship as the server reads it: the stored hash, never the caller's
+      // claim. Defaults to someone OTHER than makeUser(), so a test that says
+      // nothing about authorship is testing the admin grant alone.
+      // `null` means a request with no stored author (opened outside this
+      // backend); undefined means "someone, just not the caller".
+      authorId:
+        opts.authorEmail === null ? undefined : hashEmail(opts.authorEmail ?? STRANGER_AUTHOR),
     });
     const access = makeAccessControl();
     (access.canWriteAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(opts.isAdmin ?? false);
     const chain: Record<string, unknown> = {};
+    // Two different selects run under one chain mock: the branch-retirement
+    // lookup asks for `{ sourceBranch }`, and `openChangeRequestOn` asks for
+    // `{ number, sourceBranch }`. Answer by projection rather than call order,
+    // so the retirement path is exercised (a branch to retire, and no other
+    // open request holding it) without the test depending on call sequence.
+    let projection: Record<string, unknown> = {};
     Object.assign(chain, {
-      select: vi.fn(() => chain),
+      select: vi.fn((proj?: Record<string, unknown>) => {
+        projection = proj ?? {};
+        return chain;
+      }),
       from: vi.fn(() => chain),
       where: vi.fn(() => chain),
-      limit: vi.fn(async () => []),
+      limit: vi.fn(async () =>
+        'number' in projection ? [] : [{ sourceBranch: 'mallory/spam' }],
+      ),
       update: vi.fn(() => chain),
       set: vi.fn(() => chain),
       returning: vi.fn(async () => [{ id: 1 }]),
     });
     const workspaces = makeWorkspaceService();
     const svc = new WorkflowService(chain as unknown as Database, git, prs, makeReviewWorkflow(), workspaces, access, makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
-    return { svc, prs, db: chain, access, workspaces };
+    return { svc, prs, db: chain, access, workspaces, git };
   }
 
-  it('refuses a non-admin with 403 and touches nothing', async () => {
-    const { svc, db } = makeDeleteHarness({ isAdmin: false });
+  it('refuses a non-admin who is not the author, with 403 and the author-or-admin message', async () => {
+    const { svc, db, git } = makeDeleteHarness({ isAdmin: false });
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 403,
+      message: "Only the request's author or an admin can delete it.",
+    });
+    // "Changes nothing" is the whole promise of the refusal: no row flipped,
+    // no branch removed.
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('lets the AUTHOR delete their own request without admin rights: closes it and retires the branch', async () => {
+    const { svc, prs, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    await svc.deleteChangeRequest(9, makeUser());
+    expect(db.update).toHaveBeenCalled();
+    expect(prs.invalidateDetailCache).toHaveBeenCalledWith(9);
+    expect(git.deleteBranch).toHaveBeenCalledWith(
+      expect.any(String),
+      'mallory/spam',
+      expect.objectContaining({ email: AUTHOR_EMAIL }),
+      expect.objectContaining({ systemCleanup: true }),
+    );
+  });
+
+  it('matches the author case-insensitively, as hashEmail does', async () => {
+    // The stored hash is of the normalized address; a caller signed in as
+    // `Alice@Example.com` is the same person and must not be refused.
+    const { svc, db } = makeDeleteHarness({ isAdmin: false, authorEmail: AUTHOR_EMAIL });
+    await svc.deleteChangeRequest(9, makeUser({ email: '  Alice@Example.com  ' }));
+    expect(db.update).toHaveBeenCalled();
+  });
+
+  it('refuses a request with no stored author to a non-admin', async () => {
+    // Opened outside this backend: nobody can claim authorship of it, so the
+    // admin grant is the only one left. An absent hash must never read as a
+    // match.
+    const { svc, db } = makeDeleteHarness({ isAdmin: false, authorEmail: null });
     await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({ status: 403 });
     expect(db.update).not.toHaveBeenCalled();
   });
@@ -832,6 +895,94 @@ describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () =
     expect(db.update).not.toHaveBeenCalled();
   });
 
+  it('refuses the AUTHOR on an applied request with 422 and the applied message', async () => {
+    // Applied between opening the dialog and confirming. The author's new
+    // grant does not reach applied history either.
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      prState: 'merged',
+      authorEmail: AUTHOR_EMAIL,
+    });
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 422,
+      message: 'This change request has already been applied.',
+    });
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('refuses the AUTHOR with 409 when the base cannot be verified, and changes nothing', async () => {
+    // The strict base fetch is NOT skipped for an author, even though their
+    // grant needs no roles.yaml read: an unreachable origin means the branch
+    // removal would fail silently, and the delete must refuse whole rather
+    // than close the request and leave the branch.
+    const { svc, db, git, workspaces } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    (workspaces.ensureRemotesFetched as ReturnType<typeof vi.fn>).mockRejectedValue(
+      new Error('origin unreachable'),
+    );
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({
+      status: 409,
+      message: expect.stringContaining('Retry in a moment.'),
+    });
+    expect(db.update).not.toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
+  it('refuses the AUTHOR with 409 when the base ref does not resolve', async () => {
+    const { svc, db, access } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    (access.canWriteAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(null);
+    await expect(svc.deleteChangeRequest(9, makeUser())).rejects.toMatchObject({ status: 409 });
+    expect(db.update).not.toHaveBeenCalled();
+  });
+
+  it('a request already closed elsewhere still has its branch retired', async () => {
+    // Withdrawn in another tab: the guarded update flips no row, the request
+    // is not merged, so the delete finishes the job the withdraw left undone.
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      prState: 'closed',
+      authorEmail: AUTHOR_EMAIL,
+    });
+    // The update is guarded on `state = 'open'`, so it flips nothing here.
+    (db.returning as ReturnType<typeof vi.fn>).mockResolvedValue([]);
+    await expect(svc.deleteChangeRequest(9, makeUser())).resolves.toBeUndefined();
+    expect(git.deleteBranch).toHaveBeenCalledWith(
+      expect.any(String),
+      'mallory/spam',
+      expect.anything(),
+      expect.objectContaining({ systemCleanup: true }),
+    );
+  });
+
+  it('keeps a branch another open request still uses, and closes the request silently', async () => {
+    const { svc, db, git } = makeDeleteHarness({
+      isAdmin: false,
+      authorEmail: AUTHOR_EMAIL,
+    });
+    // `openChangeRequestOn` finds a live request on the branch (the
+    // `{ number, sourceBranch }` projection), so retirement backs off.
+    let projection: Record<string, unknown> = {};
+    (db.select as ReturnType<typeof vi.fn>).mockImplementation((proj?: Record<string, unknown>) => {
+      projection = proj ?? {};
+      return db;
+    });
+    (db.limit as ReturnType<typeof vi.fn>).mockImplementation(async () =>
+      'number' in projection
+        ? [{ number: 11, sourceBranch: 'mallory/spam' }]
+        : [{ sourceBranch: 'mallory/spam' }],
+    );
+    // No throw, no message: the request closes and the branch survives.
+    await expect(svc.deleteChangeRequest(9, makeUser())).resolves.toBeUndefined();
+    expect(db.update).toHaveBeenCalled();
+    expect(git.deleteBranch).not.toHaveBeenCalled();
+  });
+
   it('kicks the deleted-branch sweep when the base workspace cannot be resolved', async () => {
     const { svc, db, workspaces } = makeDeleteHarness({ isAdmin: true });
     (workspaces.getOrCreateForBranch as ReturnType<typeof vi.fn>).mockRejectedValue(

package/src/modules/workflow/__tests__/workflow.service.repository-replaced.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
+import type { GitService } from '../git/git.service.js';
+import type { PullRequestService } from '../git/pull-request.service.js';
+import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
+import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { IAccessControl } from '../../access/access-control.interface.js';
+import type { FileLockService } from '../file-lock.service.js';
+import type { PendingCommitsService } from '../pending-commits.service.js';
+import type { Database } from '../../database/connection.js';
+import { WorkflowService } from '../workflow.service.js';
+import { openChangeGate } from '../../../__tests__/open-change-gate.js';
+
+/**
+ * The CLOSE half of the admin's choice when the knowledge-base repository is
+ * replaced: the requests point at branches that are not in the new
+ * repository, so they are closed — with a reason, releasing the locks held on
+ * those branches and taking any commit still queued for them off the worker,
+ * and without deleting a single row.
+ */
+
+interface ClosedRow {
+  number: number;
+  sourceBranch: string;
+}
+
+/**
+ * DB stub shaped like the real close: ONE `update … where state = 'open'
+ * returning` per pass, answering with the rows that pass actually closed.
+ *
+ * `passes` is therefore what the statement RETURNS, pass by pass — which is
+ * how a request already closed by a merge or a withdrawal is expressed (it is
+ * simply not in the returned set) and how a request opened BETWEEN passes is
+ * expressed (it turns up in a later one). A pass past the end answers nothing,
+ * which is what stops the loop.
+ */
+function makeDb(passes: ClosedRow[][], sets: Record<string, unknown>[], openCount: number) {
+  let pass = 0;
+  const db = {
+    // The count is a SQL aggregate: one row, one integer.
+    select: () => ({ from: () => ({ where: async () => [{ open: openCount }] }) }),
+    update: () => ({
+      set: (values: Record<string, unknown>) => {
+        sets.push(values);
+        return { where: () => ({ returning: async () => passes[pass++] ?? [] }) };
+      },
+    }),
+    // Nothing here may ever delete a change request.
+    delete: () => {
+      throw new Error('a change request must never be deleted');
+    },
+  };
+  return db as unknown as Database;
+}
+
+function makeService(passes: ClosedRow[][], openCount = passes.flat().length) {
+  const sets: Record<string, unknown>[] = [];
+  const unlocked: string[] = [];
+  const dequeued: string[] = [];
+  const invalidated: number[] = [];
+  const emitted: unknown[] = [];
+  const fileLocks = {
+    releaseAllOnBranch: vi.fn(async (branch: string) => {
+      unlocked.push(branch);
+      return 2;
+    }),
+  } as unknown as FileLockService;
+  const pendingCommits = {
+    markNeedsAttentionOnBranch: vi.fn(async (branch: string) => {
+      dequeued.push(branch);
+      return 1;
+    }),
+  } as unknown as PendingCommitsService;
+  const prs = {
+    invalidateDetailCache: vi.fn((n: number) => invalidated.push(n)),
+  } as unknown as PullRequestService;
+  const svc = new WorkflowService(
+    makeDb(passes, sets, openCount),
+    {} as GitService,
+    prs,
+    {} as IReviewWorkflowService,
+    {} as WorkspaceService,
+    {} as IAccessControl,
+    fileLocks,
+    pendingCommits,
+    testKbContext(),
+    openChangeGate(),
+  );
+  (svc as unknown as { events?: { emit(e: unknown): void } }).events = {
+    emit: (e: unknown) => emitted.push(e),
+  };
+  return { svc, sets, unlocked, dequeued, invalidated, emitted, fileLocks, pendingCommits };
+}
+
+describe('closeOpenChangeRequestsAsRepositoryReplaced', () => {
+  it('closes every open request with the reason, and deletes nothing', async () => {
+    const { svc, sets, invalidated, emitted } = makeService([
+      [
+        { number: 7, sourceBranch: 'alice/draft' },
+        { number: 9, sourceBranch: 'bob/draft' },
+      ],
+    ]);
+
+    await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(2);
+
+    // ONE statement closed both: a read-then-write loop would have missed any
+    // request opened while it ran.
+    expect(sets).toHaveLength(2); // the closing pass, then the pass that found nothing
+    expect(sets[0]?.state).toBe('closed');
+    // The reason outlives the admin who chose it — that is the whole point
+    // of a column rather than a log line.
+    expect(sets[0]?.closedReason).toBe('repository-replaced');
+    expect(sets[0]?.closedAt).toBeInstanceOf(Date);
+    expect(invalidated).toEqual([7, 9]);
+    expect(emitted).toEqual([
+      { kind: 'change-request-rejected', number: 7 },
+      { kind: 'change-request-rejected', number: 9 },
+    ]);
+  });
+
+  it('closes a request opened while it was closing the others', async () => {
+    // The deployment is still live — the address has not been saved yet — so
+    // `POST /change-requests` is still being served. The first pass closed two;
+    // #11 arrived after it and is closed by the next one.
+    const { svc, invalidated } = makeService([
+      [
+        { number: 7, sourceBranch: 'alice/draft' },
+        { number: 9, sourceBranch: 'bob/draft' },
+      ],
+      [{ number: 11, sourceBranch: 'carol/draft' }],
+    ]);
+
+    await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(3);
+    expect(invalidated).toEqual([7, 9, 11]);
+  });
+
+  it('gives up after a bounded number of passes rather than holding the save open', async () => {
+    // A client opening requests in a loop must not be able to keep the save
+    // from ever returning. What survives the last pass was opened after the
+    // repository was replaced, and the deleted-branch sweep owns it.
+    const endless = Array.from({ length: 50 }, (_, i) => [
+      { number: i + 1, sourceBranch: `writer-${i}/draft` },
+    ]);
+    const { svc } = makeService(endless, 50);
+    const closed = await svc.closeOpenChangeRequestsAsRepositoryReplaced();
+    expect(closed).toBeGreaterThan(0);
+    expect(closed).toBeLessThan(50);
+  });
+
+  it('skips a request a merge or a withdrawal closed first', async () => {
+    // The guard is the statement's own `where state = 'open'`: #9 was closed by
+    // somebody else between the count and this call, so it is not in the
+    // returned set — and nothing is done on its behalf.
+    const { svc, unlocked, dequeued, invalidated, emitted } = makeService(
+      [[{ number: 7, sourceBranch: 'alice/draft' }]],
+      2,
+    );
+
+    await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(1);
+
+    expect(unlocked).toEqual(['alice/draft']);
+    expect(dequeued).toEqual(['alice/draft']);
+    expect(invalidated).toEqual([7]);
+    expect(emitted).toEqual([{ kind: 'change-request-rejected', number: 7 }]);
+  });
+
+  it('releases the file locks held on the branches it closes', async () => {
+    const { svc, unlocked } = makeService([
+      [
+        { number: 7, sourceBranch: 'alice/draft' },
+        { number: 9, sourceBranch: 'bob/draft' },
+      ],
+    ]);
+
+    await svc.closeOpenChangeRequestsAsRepositoryReplaced();
+
+    // Nobody can publish those bytes or release the lock by finishing: the
+    // branch belongs to a repository this deployment no longer has.
+    expect(unlocked).toEqual(['alice/draft', 'bob/draft']);
+  });
+
+  it('takes the commits already queued for those branches off the worker', async () => {
+    const { svc, dequeued, pendingCommits } = makeService([
+      [{ number: 7, sourceBranch: 'alice/draft' }],
+    ]);
+
+    await svc.closeOpenChangeRequestsAsRepositoryReplaced();
+
+    // A release ENQUEUES the bytes and only then drops its lock, so dropping
+    // the locks can leave rows waiting. Left pending, the worker would commit
+    // them onto a same-named branch of a different repository after the
+    // re-clone.
+    expect(dequeued).toEqual(['alice/draft']);
+    expect(vi.mocked(pendingCommits.markNeedsAttentionOnBranch).mock.calls[0]?.[1]).toMatch(
+      /repository was replaced/,
+    );
+  });
+
+  it('still closes the requests when a lock release fails', async () => {
+    const { svc, fileLocks } = makeService([[{ number: 7, sourceBranch: 'alice/draft' }]]);
+    vi.mocked(fileLocks.releaseAllOnBranch).mockRejectedValueOnce(new Error('lock table is down'));
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      // The close is the decision the admin made; a lock expires on its own
+      // within the minute, so it is not worth half-closing the set over.
+      await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(1);
+    } finally {
+      vi.restoreAllMocks();
+    }
+  });
+
+  it('still closes the requests when the queued commits cannot be set aside', async () => {
+    const { svc, pendingCommits, unlocked } = makeService([
+      [{ number: 7, sourceBranch: 'alice/draft' }],
+    ]);
+    vi.mocked(pendingCommits.markNeedsAttentionOnBranch).mockRejectedValueOnce(
+      new Error('pending_commits is down'),
+    );
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(1);
+      expect(unlocked).toEqual(['alice/draft']);
+    } finally {
+      vi.restoreAllMocks();
+    }
+  });
+
+  it('closes nothing, and asks nothing of the lock table, when no request is open', async () => {
+    const { svc, unlocked, dequeued, emitted } = makeService([]);
+    await expect(svc.closeOpenChangeRequestsAsRepositoryReplaced()).resolves.toBe(0);
+    expect(unlocked).toEqual([]);
+    expect(dequeued).toEqual([]);
+    expect(emitted).toEqual([]);
+  });
+});
+
+describe('countOpenChangeRequests', () => {
+  it('answers how many are open, so the confirmation can say what it is about', async () => {
+    const { svc } = makeService([], 2);
+    // A SQL aggregate: the question is an integer, and materializing one row
+    // per open request to answer it would scale with the wrong thing.
+    await expect(svc.countOpenChangeRequests()).resolves.toBe(2);
+  });
+
+  it('answers zero when the aggregate comes back empty', async () => {
+    const { svc } = makeService([], 0);
+    await expect(svc.countOpenChangeRequests()).resolves.toBe(0);
+  });
+});