@bevel-software/platform-core-backend 0.25.2 → 0.27.0

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -352,6 +352,39 @@ describe('GitService.pull', () => {
     await runGit(repo, ['push', 'origin', 'target-company-state']);
     await expect(svc.hasUnpushedCommits(workspaceId)).resolves.toBe(false);
   });
+
+  /**
+   * The question the roles.yaml preservation asks before pushing a restore it
+   * finds already committed: not "is there unpushed work" but "would the push
+   * fast-forward origin to HEAD". A clone behind origin answers no, and one
+   * whose tracking ref git cannot even resolve answers with an error — the
+   * guard that asks must fail closed on it, so the probe may not swallow it.
+   */
+  it('headContainsOrigin: true in sync and ahead, false behind origin, an error without a tracking ref', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    const svc = new GitService(
+      stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
+      stubWorkflowHooks(),
+      testKbContext(),
+    );
+
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(true);
+
+    // Ahead: a local commit on top of origin's tip.
+    await fs.writeFile(path.join(repo, 'new.txt'), 'x\n');
+    await runGit(repo, ['add', '.']);
+    await runGit(repo, ['commit', '-m', 'unpushed']);
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(true);
+
+    // Behind: publish it, then step the clone back before it.
+    await runGit(repo, ['push', 'origin', 'target-company-state']);
+    await runGit(repo, ['reset', '--hard', 'HEAD~1']);
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(false);
+
+    // No tracking ref at all: not "false", an error.
+    await runGit(repo, ['checkout', '-b', 'never-pushed']);
+    await expect(svc.headContainsOrigin(workspaceId)).rejects.toThrow();
+  });
 });
 
 /**
@@ -411,7 +444,10 @@ describe('GitService.pull — an unpushed merge commit', () => {
     const workspaceDir = path.join(root, workspaceId);
     const repo = path.join(workspaceDir, 'knowledge-base');
     await fs.mkdir(workspaceDir, { recursive: true });
-    await runGit(root, ['clone', '-b', 'alice/deal', upstream, repo]);
+    // `core.autocrlf=false` on the clone itself, not only afterwards: a
+    // Windows git would otherwise check the files out with CRLF, and the
+    // rebase's autostash of that "dirty" tree conflicts on reapply.
+    await runGit(root, ['-c', 'core.autocrlf=false', 'clone', '-b', 'alice/deal', upstream, repo]);
     await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
     await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
     await runGit(repo, ['config', 'core.autocrlf', 'false']);
@@ -456,6 +492,17 @@ describe('GitService.pull — an unpushed merge commit', () => {
     expect(contains).toBe(false);
   });
 
+  it('survives the background sync, which may reach the branch before any push does', async () => {
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().syncFromRemote(workspaceId);
+
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(true);
+  });
+
   it('survives `preserveMerges`, and the branch still contains the target', async () => {
     const { repo, targetTip } = await seedUnpushedMerge();
     await svcFor().pull(workspaceId, { preserveMerges: true });

package/src/modules/workflow/git/__tests__/node-git-runner.test.ts

@@ -1,9 +1,18 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import fs from 'node:fs/promises';
+import http from 'node:http';
 import os from 'node:os';
 import path from 'node:path';
+import type { AddressInfo } from 'node:net';
 import { NodeGitRunner } from '../node-git-runner.js';
-import { GitRunError, gitCredentials, isGitTimeout } from '../../../../shared/git.contract.js';
+import {
+  GitRunError,
+  gitCredentials,
+  isGitTimeout,
+  type GitCredentials,
+} from '../../../../shared/git.contract.js';
+import { setLogger } from '../../../../shared/logging.js';
+import type { ILogger, LogFields } from '../../../../shared/logger.contract.js';
 
 /**
  * These run REAL git, like the rest of this module's suites: the behaviours
@@ -150,3 +159,223 @@ describe('NodeGitRunner', () => {
     }
   });
 });
+
+/**
+ * A git host that wants a credential, as a real `ls-remote` over HTTP meets
+ * it: a bare repository behind Basic auth, served the dumb way (`info/refs`
+ * as a file), which git falls back to when no smart service answers. Every
+ * refusal below is git's own — "could not read Username" when it had nothing
+ * to offer, "Authentication failed" when what it offered was thrown out.
+ */
+describe('NodeGitRunner: a call the host refuses a credential', () => {
+  let root: string;
+  let clone: string;
+  let server: http.Server;
+  let remote: string;
+  /** The one token the host accepts. */
+  let accepted: string;
+  /** How many times the host was asked, and refused, in order. */
+  let answers: number[];
+  /** No helper from the machine this runs on: the clone's config and the call's `-c` are the whole story. */
+  let env: NodeJS.ProcessEnv;
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'git-runner-auth-'));
+    const empty = path.join(root, 'empty-gitconfig');
+    await fs.writeFile(empty, '');
+    env = { GIT_CONFIG_GLOBAL: empty, GIT_CONFIG_NOSYSTEM: '1' };
+    const plain = new NodeGitRunner();
+    const seed = path.join(root, 'seed');
+    await fs.mkdir(seed);
+    await plain.run(seed, ['init', '--initial-branch=main'], { env });
+    await plain.run(seed, ['-c', 'user.name=t', '-c', 'user.email=t@x', 'commit', '--allow-empty', '-m', 'init'], { env });
+    const upstream = path.join(root, 'upstream.git');
+    await plain.run(root, ['clone', '--bare', seed, upstream], { env });
+    await plain.run(upstream, ['update-server-info'], { env });
+    clone = path.join(root, 'clone');
+    await fs.mkdir(clone);
+    await plain.run(clone, ['init', '--initial-branch=main'], { env });
+
+    accepted = 'ghp_good';
+    answers = [];
+    server = http.createServer(async (req, res) => {
+      const expected = `Basic ${Buffer.from(`x-access-token:${accepted}`).toString('base64')}`;
+      if (req.headers.authorization !== expected) {
+        answers.push(401);
+        res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="upstream"' });
+        res.end();
+        return;
+      }
+      answers.push(200);
+      const file = path.join(upstream, new URL(req.url ?? '/', 'http://x').pathname.replace(/^\/upstream\.git\/?/, ''));
+      try {
+        const bytes = await fs.readFile(file);
+        res.writeHead(200, { 'content-type': 'text/plain' });
+        res.end(bytes);
+      } catch {
+        res.writeHead(404);
+        res.end();
+      }
+    });
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', r));
+    remote = `http://127.0.0.1:${(server.address() as AddressInfo).port}/upstream.git`;
+    await plain.run(clone, ['remote', 'add', 'origin', remote], { env });
+  });
+
+  afterEach(async () => {
+    await new Promise<void>((r) => server.close(() => r()));
+    await fs.rm(root, { recursive: true, force: true }).catch(() => undefined);
+  });
+
+  /** Credentials whose token a test moves, with a `prepare` that records how it was asked. */
+  function moving(initial: string | null, onRefused: (set: (token: string | null) => void) => void = () => undefined) {
+    let token = initial;
+    const prepare = vi.fn(async (opts?: { refused?: boolean }) => {
+      if (opts?.refused) onRefused((next) => { token = next; });
+    });
+    const credentials: GitCredentials = {
+      username: () => 'x-access-token',
+      token: () => token,
+      prepare,
+    };
+    return { credentials, prepare };
+  }
+  const refusals = (prepare: ReturnType<typeof vi.fn>) => prepare.mock.calls.map((c) => (c[0] as { refused?: boolean } | undefined)?.refused ?? false);
+
+  /** Every line the runner logs during a test. */
+  let logged: string[] = [];
+  let previousLogger: ILogger | undefined;
+  const capturing = (bindings: LogFields = {}): ILogger => {
+    const line = (level: string) => (message: string, fields?: LogFields) =>
+      void logged.push(`${level} ${message} ${JSON.stringify({ ...bindings, ...fields })}`);
+    return { debug: line('debug'), info: line('info'), warn: line('warn'), error: line('error'), child: (m) => capturing({ ...bindings, ...m }) };
+  };
+  beforeEach(() => {
+    logged = [];
+    previousLogger = setLogger(capturing());
+  });
+  afterEach(() => {
+    if (previousLogger) setLogger(previousLogger);
+  });
+
+  it('authenticates a clone whose config carries no helper: the helper rides the call', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_good'));
+    const { stdout } = await runner.run(clone, ['ls-remote', 'origin'], { env });
+    expect(stdout).toContain('refs/heads/main');
+    // Refused once, with nothing offered; then every request carried the token.
+    expect(answers.filter((a) => a === 401)).toHaveLength(1);
+    expect(answers).toContain(200);
+  });
+
+  it('with nothing to offer, insists on a token and runs the command once more', async () => {
+    const { credentials, prepare } = moving(null, (set) => set('ghp_good'));
+    const runner = new NodeGitRunner(undefined, credentials);
+    const { stdout } = await runner.run(clone, ['ls-remote', 'origin'], { env });
+    expect(stdout).toContain('refs/heads/main');
+    // The ordinary renewal before the call, then the one that reports the refusal.
+    expect(refusals(prepare)).toEqual([false, true]);
+    expect(logged.some((l) => l.includes('the token was renewed and the command runs again'))).toBe(true);
+    // The first attempt never got to offer anything (one refusal, and git
+    // gave up); the second was refused once more before it offered the token.
+    expect(answers.filter((a) => a === 401)).toHaveLength(2);
+    expect(answers).toContain(200);
+  });
+
+  it('with a token the host throws out, renews it and runs the command once more', async () => {
+    const { credentials, prepare } = moving('ghp_stale', (set) => set('ghp_good'));
+    const runner = new NodeGitRunner(undefined, credentials);
+    const { stdout } = await runner.run(clone, ['ls-remote', 'origin'], { env });
+    expect(stdout).toContain('refs/heads/main');
+    expect(refusals(prepare)).toEqual([false, true]);
+  });
+
+  it('runs the command again ONCE: a refusal with a token just issued is the answer', async () => {
+    const { credentials, prepare } = moving('ghp_stale', (set) => set('ghp_still_stale'));
+    const runner = new NodeGitRunner(undefined, credentials);
+    const err = await runner.run(clone, ['ls-remote', 'origin'], { env }).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(GitRunError);
+    expect(`${(err as GitRunError).stderr}`).toMatch(/Authentication failed/);
+    expect(refusals(prepare).filter(Boolean)).toHaveLength(1);
+    // One attempt with a credential offered is two refusals: git asks bare
+    // first, then with the token. Two attempts, four — and no third.
+    expect(answers).toEqual([401, 401, 401, 401]);
+  });
+
+  it('does not run the command again when no token can be had, and keeps the refusal', async () => {
+    const { credentials, prepare } = moving(null, (set) => set(null));
+    const runner = new NodeGitRunner(undefined, credentials);
+    const err = await runner.run(clone, ['ls-remote', 'origin'], { env }).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(GitRunError);
+    expect(`${(err as GitRunError).stderr}`).toMatch(/could not read Username/);
+    expect(refusals(prepare).filter(Boolean)).toHaveLength(1);
+    // One attempt: with nothing to offer, running it again would only repeat the refusal.
+    expect(answers).toEqual([401]);
+    expect(logged.some((l) => l.includes('no other token could be had'))).toBe(true);
+  });
+
+  it('does not run the command again with the SAME token the host just refused', async () => {
+    // A provider that cannot replace it: the fixed token of a token-mode
+    // deployment, whose `prepare` is absent. Running the command again would
+    // only be refused again.
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_stale'));
+    const err = await runner.run(clone, ['ls-remote', 'origin'], { env }).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(GitRunError);
+    expect(`${(err as GitRunError).stderr}`).toMatch(/Authentication failed/);
+    // One attempt: the bare ask, then the token, refused. Nothing after.
+    expect(answers).toEqual([401, 401]);
+    // And one whose renewal hands back what it had.
+    answers = [];
+    const { credentials, prepare } = moving('ghp_stale', (set) => set('ghp_stale'));
+    await expect(new NodeGitRunner(undefined, credentials).run(clone, ['ls-remote', 'origin'], { env })).rejects.toBeInstanceOf(GitRunError);
+    expect(refusals(prepare).filter(Boolean)).toHaveLength(1);
+    expect(answers).toEqual([401, 401]);
+  });
+
+  it('keeps the refusal, and logs why, when the renewal itself fails', async () => {
+    let token: string | null = 'ghp_stale';
+    const credentials: GitCredentials = {
+      username: () => 'x-access-token',
+      token: () => token,
+      prepare: async (opts) => {
+        if (!opts?.refused) return;
+        // What the host refused is dropped, and GitHub will not replace it.
+        token = null;
+        throw new Error('GitHub answered 401 to the app: bad private key');
+      },
+    };
+    const runner = new NodeGitRunner(undefined, credentials);
+    const err = await runner.run(clone, ['ls-remote', 'origin'], { env }).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(GitRunError);
+    expect(`${(err as GitRunError).stderr}`).toMatch(/Authentication failed/);
+    expect(answers).toEqual([401, 401]);
+    const why = logged.find((l) => l.includes('no other token could be had'));
+    expect(why).toBeDefined();
+    expect(why).toContain('bad private key');
+  });
+
+  it("leaves a credential the caller laid over the call to the caller: the probe's own token is not renewed", async () => {
+    const { credentials, prepare } = moving('ghp_good', (set) => set('ghp_good'));
+    const runner = new NodeGitRunner(undefined, credentials);
+    const err = await runner
+      .run(clone, ['ls-remote', 'origin'], { env: { ...env, GITHUB_TOKEN: 'ghp_being_checked' } })
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(GitRunError);
+    expect(refusals(prepare).filter(Boolean)).toHaveLength(0);
+    expect(answers).toEqual([401, 401]);
+  });
+
+  it('names the command the caller asked for in a failure, never its own helper', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_stale'));
+    const err = await runner.run(clone, ['ls-remote', 'origin'], { env }).catch((e: unknown) => e);
+    expect((err as Error).message).toContain('git ls-remote failed');
+    expect((err as Error).message).not.toContain('credential.helper');
+    expect(`${(err as GitRunError).stderr}`).not.toContain('credential.helper');
+  });
+
+  it('leaves every other failure alone', async () => {
+    const { credentials, prepare } = moving('ghp_good');
+    const runner = new NodeGitRunner(undefined, credentials);
+    await expect(runner.run(clone, ['checkout', 'no-such-branch'], { env })).rejects.toBeInstanceOf(GitRunError);
+    expect(refusals(prepare).filter(Boolean)).toHaveLength(0);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.list-fetch.test.ts

@@ -5,6 +5,7 @@ import type { Database } from '../../../database/connection.js';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import type { GitService } from '../git.service.js';
 import type { IAccessControl } from '../../../access/access-control.interface.js';
+import { WorkflowValidationError } from '../../../../shared/domain-errors.js';
 
 /**
  * What a change-request LIST is allowed to cost.
@@ -47,8 +48,13 @@ function harness(rows = [row(1, 'suggestions/a/knowledge'), row(2, 'suggestions/
       }),
     }),
   } as unknown as Database;
-  const changedPathsForPr = vi.fn(async () => ['Shared/one.pdf']);
-  const git = { changedPathsForPr } as unknown as GitService;
+  // The summary builder asks for the flat paths AND the rename-aware pairs in
+  // one call, so this is the method the per-request cost now lands on.
+  const changedPathsForPr = vi.fn(async () => ({
+    paths: ['Shared/one.pdf'],
+    pairs: [{ path: 'Shared/one.pdf' }],
+  }));
+  const git = { changedPathsAndPairsForPr: changedPathsForPr } as unknown as GitService;
   const ensureRemotesFetched = vi.fn(async () => undefined);
   const workspace = {
     findAnyWorkspaceId: async () => 'ws-main',
@@ -119,3 +125,67 @@ describe('the change-request list refreshes the clone once, not once per request
     expect(changedPathsForPr).toHaveBeenCalledTimes(2);
   });
 });
+
+/**
+ * What a list of APPLIED requests is allowed to cost. Each is read from its
+ * merge commit, which asks git four times per row and never the network. A
+ * merge commit cannot change, so the second list must not ask git again.
+ */
+describe('the list of applied requests reads each merge commit once', () => {
+  const applied = (number: number) => ({
+    ...row(number, `suggestions/${number}/knowledge`),
+    state: 'merged',
+    mergedSha: `${number}`.padStart(40, 'a'),
+    closedAt: new Date('2026-09-19T00:00:00Z'),
+  });
+
+  function appliedHarness(rows: ReturnType<typeof applied>[]) {
+    const db = {
+      select: () => ({
+        from: () => ({
+          where: () => ({ orderBy: async () => rows, limit: async () => rows }),
+        }),
+      }),
+    } as unknown as Database;
+    const ofAppliedChange = vi.fn(async (_w: string, ref: { number: number }) => ({
+      paths: [`Shared/${ref.number}.md`],
+      pairs: [{ path: `Shared/${ref.number}.md` }],
+    }));
+    const git = { changedPathsAndPairsOfAppliedChange: ofAppliedChange } as unknown as GitService;
+    const ensureRemotesFetched = vi.fn(async () => undefined);
+    const workspace = {
+      findAnyWorkspaceId: async () => 'ws-main',
+      ensureRemotesFetched,
+    } as unknown as WorkspaceService;
+    const access = {} as unknown as IAccessControl;
+    return { svc: new PullRequestService(db, workspace, access, git), ofAppliedChange, ensureRemotesFetched };
+  }
+
+  it('asks git once per request, however often the list is read, and refreshes the clone once per list — never per row', async () => {
+    const { svc, ofAppliedChange, ensureRemotesFetched } = appliedHarness([applied(1), applied(2), applied(3)]);
+
+    const first = await svc.listPrsByState(['merged']);
+    const second = await svc.listPrsByState(['merged']);
+
+    expect(first.map((s) => s.touchedNodePaths)).toEqual([['Shared/1.md'], ['Shared/2.md'], ['Shared/3.md']]);
+    expect(second).toEqual(first);
+    expect(ofAppliedChange).toHaveBeenCalledTimes(3);
+    // One refresh per LIST (TTL-cached underneath), not one per row: a merge
+    // commit cannot change, but a clone that has not fetched since the merge
+    // does not hold it, and would read every applied request as author-only.
+    expect(ensureRemotesFetched).toHaveBeenCalledTimes(2);
+  });
+
+  it('asks again for a merge commit the clone did not hold the first time', async () => {
+    const { svc, ofAppliedChange } = appliedHarness([applied(1)]);
+    ofAppliedChange.mockRejectedValueOnce(new WorkflowValidationError('commit is not in this clone'));
+
+    const before = await svc.listPrsByState(['merged']);
+    const after = await svc.listPrsByState(['merged']);
+
+    // Fail-closed while the commit is missing, answered once it is there.
+    expect(before[0].touchedNodePaths).toEqual([]);
+    expect(after[0].touchedNodePaths).toEqual(['Shared/1.md']);
+    expect(ofAppliedChange).toHaveBeenCalledTimes(2);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.placeholder.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { isFolderPlaceholder } from '@bevel-software/platform-shared';
 
 import { PullRequestService } from '../pull-request.service.js';
 import type { Database } from '../../../database/connection.js';
@@ -40,8 +41,19 @@ describe('PullRequestService summaries — folder placeholder', () => {
         }),
       }),
     } as unknown as Database;
-    const changedPathsForPr = vi.fn(async () => paths);
-    const git = { changedPathsForPr } as unknown as GitService;
+    // The real `changedPathPairs` drops the placeholder (it is never a file
+    // anybody reads) while the flat list keeps it for the empty-request check,
+    // so the double answers both the way the service does. It borrows the
+    // production predicate rather than spelling one out: `isFolderPlaceholder`
+    // matches on the BASENAME, so a root-level `.gitkeep` is a placeholder too,
+    // and both of the real readers drop `roles.yaml`.
+    const changedPathsForPr = vi.fn(async () => ({
+      paths: paths.filter((p) => p !== 'roles.yaml'),
+      pairs: paths
+        .filter((p) => !isFolderPlaceholder(p) && p !== 'roles.yaml')
+        .map((path) => ({ path })),
+    }));
+    const git = { changedPathsAndPairsForPr: changedPathsForPr } as unknown as GitService;
     const workspace = {
       findAnyWorkspaceId: async () => 'ws-main',
       ensureRemotesFetched: async () => undefined,
@@ -76,4 +88,14 @@ describe('PullRequestService summaries — folder placeholder', () => {
     const { svc } = harness(['Elsewhere/.gitkeep']);
     expect(await svc.listPrsForOwnerEmail('ws-main', 'bob@bevel.software', { fresh: true })).toEqual([]);
   });
+
+  it('a placeholder at the ROOT is a placeholder too, on both views of the summary', async () => {
+    // `isFolderPlaceholder` matches the basename, so `.gitkeep` with no folder
+    // in front of it is the same non-file — the corner a filter spelled
+    // `endsWith('/.gitkeep')` would get wrong on both the paths and the pairs.
+    const { svc } = harness(['.gitkeep', 'Reports/q3.md']);
+    const [summary] = await svc.listOpenPrs({ fresh: true });
+    expect(summary.touchedNodePaths).toEqual(['Reports/q3.md']);
+    expect(summary.touchedNodeFiles).toEqual([{ path: 'Reports/q3.md' }]);
+  });
 });