@bevel-software/platform-core-backend 0.23.0 → 0.25.0

package/src/modules/workflow/git/__tests__/git.service.prFetchFailure.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import type { WorkspaceService } from '../../../workspace/workspace.service.js';
+import { WorkflowHooks } from '../../workflow-hooks.js';
+import { GitService } from '../git.service.js';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * What the log says when a change request's branches cannot be fetched.
+ *
+ * The fetch is best-effort: when it fails, the refs are resolved from what the
+ * working copy already has. A working copy that could not reach the remote at
+ * all then reported `unknown branch` for every branch it had never seen, and
+ * nothing said the fetch had been refused — the log named a missing branch
+ * that was on the remote the whole time.
+ */
+
+const TRUNK = 'current-company-state';
+const WORKSPACE = 'ws-pr-fetch';
+
+async function runGit(cwd: string, args: string[]): Promise<void> {
+  await execFileAsync('git', args, {
+    cwd,
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: 'Test', GIT_AUTHOR_EMAIL: 't@x.com',
+      GIT_COMMITTER_NAME: 'Test', GIT_COMMITTER_EMAIL: 't@x.com',
+    },
+  });
+}
+
+let root: string;
+let repo: string;
+let upstream: string;
+
+beforeEach(async () => {
+  root = await fs.mkdtemp(path.join(os.tmpdir(), 'git-pr-fetch-'));
+  upstream = path.join(root, 'upstream.git');
+  await runGit(root, ['init', '--bare', '-b', TRUNK, upstream]);
+  const seed = path.join(root, '.seed');
+  await fs.mkdir(seed);
+  await runGit(seed, ['init', '-b', TRUNK]);
+  await runGit(seed, ['remote', 'add', 'origin', upstream]);
+  await fs.writeFile(path.join(seed, 'base.md'), 'base\n');
+  await runGit(seed, ['add', '-A']);
+  await runGit(seed, ['commit', '-m', 'init']);
+  await runGit(seed, ['push', 'origin', TRUNK]);
+  // A draft the working copy below has never seen: pushed after it was cloned.
+  repo = path.join(root, WORKSPACE, 'knowledge-base');
+  await fs.mkdir(path.dirname(repo), { recursive: true });
+  await runGit(root, ['clone', upstream, repo]);
+  await runGit(seed, ['checkout', '-b', 'alice/feature']);
+  await fs.writeFile(path.join(seed, 'new.md'), 'new\n');
+  await runGit(seed, ['add', '-A']);
+  await runGit(seed, ['commit', '-m', 'feature']);
+  await runGit(seed, ['push', 'origin', 'alice/feature']);
+});
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await fs.rm(root, { recursive: true, force: true });
+});
+
+function service(): GitService {
+  const workspaces = {
+    getWorkspacePath: async () => path.dirname(repo),
+  } as unknown as WorkspaceService;
+  return new GitService(workspaces, new WorkflowHooks(), testKbContext());
+}
+
+/** Everything the service logged at warn level, as one string per line. */
+function warnings(spy: ReturnType<typeof vi.spyOn>): string[] {
+  return spy.mock.calls.map((call) => call.map((part) => (typeof part === 'string' ? part : JSON.stringify(part))).join(' '));
+}
+
+describe('a change request whose branches cannot be fetched', () => {
+  it('says the fetch failed, and where, when the working copy cannot reach the remote', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    // The remote this working copy fetches from is gone from under it.
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+
+    await expect(service().changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).rejects.toThrow(
+      'unknown branch: alice/feature',
+    );
+
+    const said = warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    expect(said).toHaveLength(1);
+    expect(said[0]).toContain(`"${WORKSPACE}"`);
+    expect(said[0]).toContain('though it may be on the remote');
+  });
+
+  it('says it once for a list that asks about many requests in one working copy', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+    const git = service();
+
+    for (const branch of ['alice/feature', 'bob/other', 'carol/third']) {
+      await git.changedPathsForPr(WORKSPACE, TRUNK, branch).catch(() => undefined);
+    }
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toHaveLength(1);
+  });
+
+  it('says it again once a minute has passed, and not before', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'no-such-remote.git')]);
+    const git = service();
+    const said = () => warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    // Only the clock the service reads is moved: git itself runs for real.
+    const realNow = Date.now.bind(Date);
+    let ahead = 0;
+    vi.spyOn(Date, 'now').mockImplementation(() => realNow() + ahead);
+
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    ahead = 30_000;
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    ahead = 61_000;
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(2);
+  });
+
+  it('says it again at once for a working copy that reached the remote in between', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const git = service();
+    const said = () => warnings(warn).filter((line) => line.includes('could not fetch change-request branches'));
+    const broken = path.join(root, 'no-such-remote.git');
+
+    await runGit(repo, ['remote', 'set-url', 'origin', broken]);
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature').catch(() => undefined);
+    expect(said()).toHaveLength(1);
+
+    // It reaches the remote again: what was said about it is over, and nothing
+    // of it is kept.
+    await runGit(repo, ['remote', 'set-url', 'origin', upstream]);
+    expect(await git.changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).toEqual(['new.md']);
+
+    // So a failure right after is a new one, said without waiting out a minute.
+    await runGit(repo, ['remote', 'set-url', 'origin', broken]);
+    await git.changedPathsForPr(WORKSPACE, TRUNK, 'bob/other').catch(() => undefined);
+    expect(said()).toHaveLength(2);
+  });
+
+  it('says nothing when the branch is simply gone from the remote: that is what a retired branch looks like', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    await expect(service().changedPathsForPr(WORKSPACE, TRUNK, 'dave/retired')).rejects.toThrow(
+      'unknown branch: dave/retired',
+    );
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toEqual([]);
+  });
+
+  it('says nothing when the fetch works, and finds the branch the working copy had never seen', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    expect(await service().changedPathsForPr(WORKSPACE, TRUNK, 'alice/feature')).toEqual(['new.md']);
+
+    expect(warnings(warn).filter((line) => line.includes('could not fetch change-request branches'))).toEqual([]);
+  });
+});

package/src/modules/workflow/git/git.service.ts

@@ -2959,7 +2959,53 @@ export class GitService implements IGitService {
       'fetch', '--no-write-fetch-head', 'origin',
       `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`,
       `+refs/heads/${headBranch}:refs/remotes/origin/${headBranch}`,
-    ]).catch(() => undefined);
+    ]).then(
+      () => void this.prFetchFailureLoggedAt.delete(cwd),
+      (err: unknown) => this.notePrFetchFailure(cwd, err),
+    );
+  }
+
+  /**
+   * When each working copy's change-request fetch failure was last logged.
+   * Holds only the working copies that are failing NOW: an entry goes the
+   * moment that copy reaches the remote again, so the table never outgrows the
+   * clones that cannot fetch, however many come and go over a process's life.
+   */
+  private readonly prFetchFailureLoggedAt = new Map<string, number>();
+
+  /**
+   * Say WHY a change request's branches could not be fetched, when the reason
+   * is not the one that is expected.
+   *
+   * The fetch stays best-effort, so the caller goes on to resolve the refs
+   * from whatever the clone already has. One failure is ordinary and says
+   * nothing: a branch that is gone from the remote, which is what a retired
+   * source branch looks like. Every OTHER failure is the working copy being
+   * unable to reach the remote at all — a credential it does not have, a host
+   * that does not answer — and swallowed, it resurfaced one step later as
+   * `unknown branch` for a branch that was sitting on the remote the whole
+   * time. A deployment logged that for every open change request on every
+   * list, and nothing in the log said the fetch had been refused.
+   *
+   * Logged once a minute per working copy at most: the list asks once per open
+   * request, and the reason is the same for all of them.
+   */
+  private notePrFetchFailure(cwd: string, err: unknown): void {
+    const message = err instanceof Error ? err.message : String(err);
+    if (isMissingRemoteBranchFailure(message)) {
+      // The remote answered, and said the branch is not there: this working
+      // copy reaches it, so whatever was logged about it before is over.
+      this.prFetchFailureLoggedAt.delete(cwd);
+      return;
+    }
+    const now = Date.now();
+    if (now - (this.prFetchFailureLoggedAt.get(cwd) ?? 0) < 60_000) return;
+    this.prFetchFailureLoggedAt.set(cwd, now);
+    log.warn(
+      `could not fetch change-request branches in the working copy "${path.basename(path.dirname(cwd))}": ` +
+        'a branch it has not seen will be reported as unknown, though it may be on the remote.',
+      { detail: redactGitToken(message, this.credentials.token()) },
+    );
   }
 
   /** Unified-diff patch for one file across the CR range (rename-aware). */

package/src/modules/workflow/pending-commits.service.ts

@@ -195,6 +195,7 @@ export class PendingCommitsService {
       .set({
         queuedAt: new Date(),
         authorEmail: email,
+        authorEmailBidx: email,
         authorName: input.authorName,
         // Reset transient counters — this is effectively a fresh enqueue.
         attempts: 0,
@@ -216,6 +217,7 @@ export class PendingCommitsService {
       branch: input.branch,
       path: input.path,
       authorEmail: email,
+      authorEmailBidx: email,
       authorName: input.authorName,
     });
   }
@@ -249,11 +251,13 @@ export class PendingCommitsService {
         ),
       );
     if ((rows[0]?.count ?? 0) > 0) return false;
+    const email = canonicalEmail(input.authorEmail);
     await this.db.insert(pendingCommits).values({
       workspaceId,
       branch: input.branch,
       path: input.path,
-      authorEmail: canonicalEmail(input.authorEmail),
+      authorEmail: email,
+      authorEmailBidx: email,
       authorName: input.authorName,
     });
     return true;

package/src/modules/workflow/recovery-bot.ts

@@ -41,8 +41,12 @@ export const RECOVERY_BOT_NAME = 'Bevel Recovery Bot';
 export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
   const inserted = await db
     .insert(users)
-    .values({ email: RECOVERY_BOT_EMAIL, name: RECOVERY_BOT_NAME })
-    .onConflictDoNothing({ target: users.email })
+    .values({
+      email: RECOVERY_BOT_EMAIL,
+      emailBidx: RECOVERY_BOT_EMAIL,
+      name: RECOVERY_BOT_NAME,
+    })
+    .onConflictDoNothing({ target: users.emailBidx })
     .returning();
   if (inserted.length > 0) {
     const row = inserted[0];
@@ -57,7 +61,7 @@ export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
   const [row] = await db
     .select()
     .from(users)
-    .where(eq(users.email, RECOVERY_BOT_EMAIL))
+    .where(eq(users.emailBidx, RECOVERY_BOT_EMAIL))
     .limit(1);
   if (!row) {
     // Vanishingly unlikely: the row exists for the conflict to fire but is

package/src/modules/workflow/review-workflow/__tests__/carry-approvals-forward.test.ts

@@ -247,6 +247,9 @@ describe('ReviewWorkflowService.carryApprovalsForward', () => {
         prNumber: PR,
         path: 'Sales/Terms.md',
         approverEmail: 'carol@bevel.software',
+        // The index column of a copied row is written with the address, not
+        // with the stored index read back beside it.
+        approverEmailBidx: 'carol@bevel.software',
         approverName: 'Carol',
         headSha: NEW_HEAD,
         // The reviewer approved THEN, not now — the merge is not an approval.
@@ -256,6 +259,7 @@ describe('ReviewWorkflowService.carryApprovalsForward', () => {
         prNumber: PR,
         path: 'Sales/Pricing.md',
         approverEmail: 'bob@bevel.software',
+        approverEmailBidx: 'bob@bevel.software',
         approverName: 'Bob',
         headSha: NEW_HEAD,
         approvedAt: APPROVED_AT,

package/src/modules/workflow/review-workflow/__tests__/erase-approver.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect } from 'vitest';
+import type { SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
 import { ReviewWorkflowService } from '../review-workflow.service.js';
 import type { ApprovalTx } from '../review-workflow.interface.js';
 
@@ -34,6 +36,8 @@ function harness() {
   const locked: unknown[][] = [];
   const lockSql: string[] = [];
   const sets: unknown[] = [];
+  /** The condition each rewrite was limited to, as the SQL and values it sends. */
+  const wheres: { sql: string; params: unknown[] }[] = [];
   const tx = {
     execute: async (statement: { queryChunks?: unknown[] }) => {
       const text = statementText(statement);
@@ -48,8 +52,9 @@ function harness() {
     },
     update: (table: unknown) => ({
       set: (values: unknown) => ({
-        where: async () => {
+        where: async (condition: SQL) => {
           sets.push(values);
+          wheres.push(new PgDialect().sqlToQuery(condition));
           order.push(`update:${tableOf(table)}`);
         },
       }),
@@ -58,7 +63,7 @@ function harness() {
   // `eraseApprover` touches nothing but the transaction it is given, so the
   // service's own collaborators are never reached.
   const svc = new ReviewWorkflowService({} as never, {} as never, {} as never, {} as never);
-  return { svc, tx: tx as unknown as ApprovalTx, order, locked, lockSql, sets };
+  return { svc, tx: tx as unknown as ApprovalTx, order, locked, lockSql, sets, wheres };
 }
 
 describe('ReviewWorkflowService.eraseApprover', () => {
@@ -79,6 +84,23 @@ describe('ReviewWorkflowService.eraseApprover', () => {
     expect(h.lockSql[0]).toContain('pg_advisory_xact_lock');
     expect(h.lockSql[0]).not.toMatch(/pg_advisory_lock\b/);
     // And the rewrite is to the placeholder identity it was given.
-    expect(h.sets).toEqual([{ approverEmail: 'deleted-1@erased.invalid', approverName: 'Deleted user' }]);
+    // The blind index is rewritten with the email: nothing keyed to the
+    // erased address may survive, and the email itself is ciphertext. The
+    // index column is written with the address; the handle indexes it.
+    expect(h.sets).toEqual([
+      {
+        approverEmail: 'deleted-1@erased.invalid',
+        approverEmailBidx: 'deleted-1@erased.invalid',
+        approverName: 'Deleted user',
+      },
+    ]);
+    // WHICH rows: the ones whose blind index is the erased address's. The
+    // address column holds randomized ciphertext, so a match on it finds
+    // nothing — the rewrite would report success having rewritten no row, and
+    // every approval of the erased person would keep their name.
+    expect(h.wheres).toHaveLength(1);
+    expect(h.wheres[0]!.sql).toMatch(/"approver_email_bidx" = \$1$/);
+    expect(h.wheres[0]!.sql).not.toMatch(/"approver_email" =/);
+    expect(JSON.stringify(h.wheres[0]!.params)).toContain('bob@bevel.software');
   });
 });

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -343,6 +343,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
       .values({
         prNumber,
         authorEmail: canonicalEmail(user.email),
+        authorEmailBidx: user.email,
         authorName: user.name,
         path: input.path ?? null,
         line: input.line ?? null,
@@ -600,6 +601,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
           prNumber,
           path,
           approverEmail: callerEmail,
+          approverEmailBidx: callerEmail,
           approverName: user.name,
           headSha,
         })
@@ -625,10 +627,13 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
     erased: { email: string; name: string },
   ): Promise<void> {
     await takeEveryApprovalLock(tx);
+    // Matched via the blind index — the email column is randomized
+    // ciphertext — and the index is rewritten to the placeholder's too, so no
+    // value keyed to the erased address survives.
     await tx
       .update(prFileApprovals)
-      .set({ approverEmail: erased.email, approverName: erased.name })
-      .where(eq(prFileApprovals.approverEmail, email));
+      .set({ approverEmail: erased.email, approverEmailBidx: erased.email, approverName: erased.name })
+      .where(eq(prFileApprovals.approverEmailBidx, email));
   }
 
   /**
@@ -714,6 +719,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
       .values({
         prNumber,
         triggeredByEmail,
+        triggeredByEmailBidx: triggeredByEmail,
         triggeredByName: user.name,
         headShaAtMerge: headSha,
         mergeMethod: MERGE_METHOD,
@@ -930,6 +936,9 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
           prNumber,
           path: r.path,
           approverEmail: r.approverEmail,
+          // The address, not the stored index read back beside it: an index
+          // column is written with what it is the index of.
+          approverEmailBidx: r.approverEmail,
           approverName: r.approverName,
           headSha: toHeadSha,
           approvedAt: r.approvedAt,
@@ -1013,7 +1022,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
           and(
             eq(prFileApprovals.prNumber, prNumber),
             eq(prFileApprovals.path, path),
-            eq(prFileApprovals.approverEmail, callerEmail),
+            eq(prFileApprovals.approverEmailBidx, callerEmail),
           ),
         );
     });

package/src/modules/workflow/workflow.service.ts

@@ -1770,7 +1770,7 @@ export class WorkflowService implements IWorkflowService {
       .from(changeRequests)
       .where(
         and(
-          eq(changeRequests.authorEmail, email),
+          eq(changeRequests.authorEmailBidx, email),
           eq(changeRequests.sourceBranch, sourceBranch),
           ne(changeRequests.state, 'open'),
         ),
@@ -1910,6 +1910,7 @@ export class WorkflowService implements IWorkflowService {
           title: input.title.trim(),
           body,
           authorEmail: canonicalEmail(user.email),
+          authorEmailBidx: user.email,
           authorName: user.name,
         })
         .returning({ number: changeRequests.number });
@@ -3577,6 +3578,7 @@ export class WorkflowService implements IWorkflowService {
         applyFailureKind: failure.kind,
         applyFailedAt: at,
         applyFailedByName: user.name,
+        applyFailedByEmailBidx: user.email,
       })
       // The write itself refuses to go backwards: the attempt map above is an
       // early exit within this process, but an older UPDATE still in flight (or
@@ -3637,6 +3639,7 @@ export class WorkflowService implements IWorkflowService {
           applyFailureConflicts: null,
           applyFailedAt: null,
           applyFailedByName: null,
+          applyFailedByEmailBidx: null,
           applyFailureKind: null,
         })
         .where(