@bevel-software/platform-core-backend 0.21.0 → 0.23.0

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -353,3 +353,124 @@ describe('GitService.pull', () => {
     await expect(svc.hasUnpushedCommits(workspaceId)).resolves.toBe(false);
   });
 });
+
+/**
+ * `preserveMerges` — why an unpushed MERGE must survive the pull's rebase.
+ *
+ * The change-request Update merges the target into the proposal branch and
+ * pushes. When that push fails, the merge sits in the clone, and the NEXT
+ * update pulls first. A plain `git rebase` replays `--no-merges
+ * upstream..HEAD`, which turns that merge commit into cherry-picks of the
+ * commits it merged: the target stops being a parent, so the branch never
+ * contains the target's head however many times the update runs, and the
+ * request stays behind for good.
+ */
+describe('GitService.pull — an unpushed merge commit', () => {
+  let root: string;
+  const workspaceId = 'alice%2Fdeal';
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-git-pull-merges-'));
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  /**
+   * A clone of `alice/deal` holding a merge of `target-company-state` that
+   * origin has not seen, with origin's own `alice/deal` one commit further on
+   * so the pull has something to rebase ONTO.
+   */
+  async function seedUnpushedMerge(): Promise<{ repo: string; targetTip: string }> {
+    const upstream = path.join(root, 'upstream.git');
+    await runGit(root, ['init', '--bare', '-b', 'target-company-state', upstream]);
+
+    const seed = path.join(root, '.seed');
+    await fs.mkdir(seed);
+    await runGit(seed, ['init', '-b', 'target-company-state']);
+    await runGit(seed, ['remote', 'add', 'origin', upstream]);
+    await fs.writeFile(path.join(seed, 'shared.txt'), 'one\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'init']);
+    await runGit(seed, ['push', 'origin', 'target-company-state']);
+    // The proposal branch, forked here.
+    await runGit(seed, ['checkout', '-b', 'alice/deal']);
+    await fs.writeFile(path.join(seed, 'proposal.txt'), 'alice proposes\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'propose']);
+    await runGit(seed, ['push', 'origin', 'alice/deal']);
+    // The target moves on, in a file the proposal does not touch.
+    await runGit(seed, ['checkout', 'target-company-state']);
+    await fs.writeFile(path.join(seed, 'elsewhere.txt'), 'someone else\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'target moves']);
+    await runGit(seed, ['push', 'origin', 'target-company-state']);
+    const targetTip = await gitOut(seed, ['rev-parse', 'HEAD']);
+
+    const workspaceDir = path.join(root, workspaceId);
+    const repo = path.join(workspaceDir, 'knowledge-base');
+    await fs.mkdir(workspaceDir, { recursive: true });
+    await runGit(root, ['clone', '-b', 'alice/deal', upstream, repo]);
+    await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
+    await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
+    await runGit(repo, ['config', 'core.autocrlf', 'false']);
+
+    // The Update that merged and could not push: a real merge commit in the
+    // clone, with the target's tip as its second parent.
+    await runGit(repo, ['fetch', 'origin']);
+    await runGit(repo, [
+      'merge', '--no-ff', '-m', 'Refresh alice/deal', 'origin/target-company-state',
+    ]);
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+
+    // Origin's alice/deal moves on too (the author saved from another client),
+    // so the pull has a real rebase to do rather than nothing.
+    await runGit(seed, ['checkout', 'alice/deal']);
+    await fs.writeFile(path.join(seed, 'proposal.txt'), 'alice proposes\nand adds\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'another save']);
+    await runGit(seed, ['push', 'origin', 'alice/deal']);
+
+    return { repo, targetTip };
+  }
+
+  function svcFor(): GitService {
+    return new GitService(
+      stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
+      stubWorkflowHooks(),
+      testKbContext(),
+    );
+  }
+
+  it('is flattened by a plain pull — the branch stops containing the target', async () => {
+    // The bug, stated as the behaviour that causes it. Kept as a test so the
+    // option below is never "simplified" away as redundant.
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().pull(workspaceId);
+
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('0');
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(false);
+  });
+
+  it('survives `preserveMerges`, and the branch still contains the target', async () => {
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().pull(workspaceId, { preserveMerges: true });
+
+    // The merge is still a merge...
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+    // ...so the target's head is an ancestor of the branch, which is exactly
+    // what "this request is no longer behind" means.
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(true);
+    // And the save origin had that the clone did not is replayed on top.
+    expect(await fs.readFile(path.join(repo, 'proposal.txt'), 'utf8')).toBe(
+      'alice proposes\nand adds\n',
+    );
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.getPrDetail.test.ts

@@ -49,7 +49,13 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
     const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
     const changedFilesForPr = vi.fn(async () => []);
     const forkPointForPr = vi.fn(async () => ({ mergeBaseSha: FORK, behind: true }));
-    const git = { resolvePrShas, changedFilesForPr, forkPointForPr } as unknown as GitService;
+    const pathsChangedBetween = vi.fn(async () => []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
     const workspace = {
       findAnyWorkspaceId: async () => 'ws-main',
       ensureRemotesFetched: async () => undefined,
@@ -63,7 +69,14 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
       getApprovalStates,
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });
-    return { svc, resolvePrShas, changedFilesForPr, forkPointForPr, getApprovalStates };
+    return {
+      svc,
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+      getApprovalStates,
+    };
   }
 
   it('pins the file list to the SHAs it just resolved, and keeps patches for a client read', async () => {
@@ -179,3 +192,133 @@ describe('PullRequestService — change request link', () => {
     expect(detail?.urlNote).toBe('Set PUBLIC_FRONTEND_URL to get absolute links.');
   });
 });
+
+/**
+ * `needsUpdate` — the answer the dialog acts on, as distinct from `behind`.
+ *
+ * `behind` is the honest git fact that the two branches have diverged. On a
+ * knowledge base where every shared save commits to the default branch it is
+ * true again minutes after every update, and acting on it made opening a
+ * request pay for a merge on almost every open — for changes to files the
+ * request does not contain. `needsUpdate` adds the half that matters: the
+ * target changed a file THIS request also changes.
+ */
+describe('PullRequestService.getPrDetail — needsUpdate', () => {
+  const FILE = 'Sales/Deal.md';
+  const OTHER = 'Ops/Runbook.md';
+
+  function harness(opts: {
+    behind?: boolean;
+    mergeBaseSha?: string | null;
+    files?: { path: string; previousPath?: string }[];
+    changedOnTarget?: string[];
+    changedOnTargetError?: Error;
+    state?: string;
+  } = {}) {
+    const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
+    const changedFilesForPr = vi.fn(async () => (opts.files ?? [{ path: FILE }]) as never);
+    const forkPointForPr = vi.fn(async () => ({
+      mergeBaseSha: opts.mergeBaseSha === undefined ? FORK : opts.mergeBaseSha,
+      behind: opts.behind ?? true,
+    }));
+    const pathsChangedBetween = opts.changedOnTargetError
+      ? vi.fn().mockRejectedValue(opts.changedOnTargetError)
+      : vi.fn(async () => opts.changedOnTarget ?? []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
+    const workspace = {
+      findAnyWorkspaceId: async () => 'ws-main',
+      ensureRemotesFetched: async () => undefined,
+    } as unknown as WorkspaceService;
+    const access = { canWriteAtRef: async () => false } as unknown as IAccessControl;
+    const db = {
+      select: () => ({
+        from: () => ({
+          where: () => ({ limit: async () => [{ ...ROW, state: opts.state ?? 'open' }] }),
+        }),
+      }),
+    } as unknown as Database;
+    const svc = new PullRequestService(db, workspace, access, git);
+    svc.setDetailEnricher({
+      listComments: async () => [],
+      getApprovalStates: async () => [],
+      evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
+    });
+    return { svc, pathsChangedBetween };
+  }
+
+  it('is false when the target moved in files this request does not change', async () => {
+    // The case that made the message appear on essentially every open: a
+    // shared save somewhere else in the knowledge base.
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.behind).toBe(true);
+    expect(detail?.needsUpdate).toBe(false);
+  });
+
+  it('is true when the target changed a file this request also changes', async () => {
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER, FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    // Intersected over the fork point → the target's tip: the same two
+    // commits the rest of the detail is pinned to.
+    expect(h.pathsChangedBetween).toHaveBeenCalledWith('ws-main', FORK, BASE);
+  });
+
+  it('asks git nothing at all when the request is not behind', async () => {
+    // The common case, and the one that has to stay free.
+    const h = harness({ behind: false });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('asks git nothing when the request changes no files', async () => {
+    const h = harness({ files: [], changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('counts a file the target RENAMED, under either of its names', async () => {
+    // `pathsChangedBetween` runs without rename detection, so the target's
+    // rename reports the path it left as well as the one it arrived at — and
+    // a request still editing the old name is affected.
+    const h = harness({
+      files: [{ path: FILE }],
+      changedOnTarget: [FILE, 'Sales/Deal-2026.md'],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('counts a file THIS request renamed, under the name it came from', async () => {
+    const h = harness({
+      files: [{ path: 'Sales/Deal-final.md', previousPath: FILE }],
+      changedOnTarget: [FILE],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is true when the branches share no history — there is nothing to intersect', async () => {
+    const h = harness({ mergeBaseSha: null });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('is true when the comparison itself fails — an infra error is not "this is fine"', async () => {
+    const h = harness({ changedOnTargetError: new Error('git exploded') });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is false for a request that is not open, whatever git says', async () => {
+    const h = harness({ state: 'merged', changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(detail?.behind).toBe(false);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-delete.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect } from 'vitest';
+import { computeViewerCanDelete } from '../pull-request.service.js';
+import { hashEmail } from '../../../../shared/email-identity.js';
+
+const EMAIL = 'juan@bevel.software';
+const AUTHOR_HASH = hashEmail(EMAIL);
+const OTHER_AUTHOR_HASH = hashEmail('someone-else@bevel.software');
+
+/**
+ * The truth table for who may delete a request outright — close it AND retire
+ * its branch. It must mirror `deleteChangeRequest`'s own check, which is why
+ * the interesting rows here are the ones where it DIFFERS from its siblings:
+ * an owner of every changed file is absent (they decline, they do not
+ * destroy), and a closed request still says yes (its leftover branch is still
+ * the server's to retire).
+ */
+describe('computeViewerCanDelete', () => {
+  it('lets the author delete their own open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('lets an admin delete someone else’s open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('says yes once for a viewer who is both author and admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a signed-in user who is neither author nor admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed with no viewer, even on one’s own-looking request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed for an anonymous admin-flagged read', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to its author — applied history is nobody’s to delete', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to an admin too', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('still says yes on a CLOSED request: the leftover branch is the delete’s job', () => {
+    // Withdrawn in another tab. The server's delete still succeeds there and
+    // removes the branch the withdraw left behind, so the hint must not go
+    // quiet the moment the row flips — unlike `viewerCanCancel`, which is
+    // open-only because there is nothing left to cancel.
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a request with no stored author to a non-admin (opened outside this backend)', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: undefined,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('leaves normalization to hashEmail, exactly as its siblings do', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: '  Juan@Bevel.Software  ',
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('does NOT grant the owner of every changed file — it takes no such input', () => {
+    // Decision 4. The owner of every changed file is exactly the person
+    // `computeViewerCanCancel` says yes to and this predicate must not: they
+    // may decline the request, which leaves the author's branch to rework.
+    // There is no input here to express that grant, and the row a
+    // file-owning non-admin produces reads false.
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+});