@bevel-software/platform-core-backend 0.25.2 → 0.27.0

package/src/modules/workflow/git/merge-commit.ts

@@ -0,0 +1,88 @@
+/**
+ * The subject line a change request's merge commit carries, written in one place
+ * and READ BACK in another.
+ *
+ * `mergePr` has always built this subject; what is new is that something now
+ * depends on reading it. An applied change request is read back from the merge
+ * commit its row records (`merged_sha`), and that row cannot be trusted to point
+ * at a commit this request created: when the target already contains the source,
+ * `mergeChangeRequest` makes no commit at all and reports the TARGET TIP as the
+ * merged state. In a deployment that lands everything through change requests
+ * that tip is usually ANOTHER request's merge commit — so reading "the recorded
+ * commit's own change" would answer with somebody else's files, under this
+ * request's number (cubic P1 on PR #347).
+ *
+ * The write side is fixed too — a merge that creates no commit now records no
+ * sha — but rows written before that fix exist, so the read verifies rather than
+ * assumes. The number in the subject is the cheapest honest proof available: it
+ * is in the commit, it is immutable, and no other request's merge commit carries
+ * it.
+ *
+ * Both functions live here, next to each other, so the format cannot drift on
+ * one side only. `git.service.appliedChangeShas` is tested against a commit
+ * written with {@link mergeCommitSubject}, so changing the format without
+ * changing the predicate fails the suite rather than quietly making every
+ * applied request author-only.
+ */
+
+/**
+ * The merge commit's subject for request `number` titled `title`.
+ *
+ * The title is flattened to ONE line, because the number only proves anything
+ * where git reports it. `%s` is the first PARAGRAPH of the message joined with
+ * spaces, so a single newline in the title is harmless — but a BLANK line (two
+ * newlines, or a whitespace-only line) ends that paragraph, and nothing rejects
+ * one: a title is stored `.trim()`-ed and the tool schema bounds only its
+ * length. The subject would then end before `(#N)`,
+ * {@link mergeCommitSubjectNames} would refuse the request's OWN merge commit,
+ * and every applied request with such a title would read as author-only with no
+ * files (cubic P2 on PR #347).
+ *
+ * Flattened here rather than rejected at the write side so the titles already
+ * stored are covered too — and because a merge is the wrong moment to discover
+ * that a title typed days ago is unacceptable.
+ */
+export function mergeCommitSubject(title: string, number: number): string {
+  return `${title.replace(/\s+/g, ' ').trim()} (#${number})`;
+}
+
+/**
+ * Whether `subject` is the subject of request `number`'s own merge commit.
+ *
+ * Matched at the END, because that is where {@link mergeCommitSubject} puts the
+ * number and a title may contain anything — including another request's number,
+ * which a looser match would accept.
+ */
+export function mergeCommitSubjectNames(subject: string, number: number): boolean {
+  return subject.trimEnd().endsWith(`(#${number})`);
+}
+
+/**
+ * Whether `message` — a merge commit's WHOLE message — is request `number`'s
+ * own, by the subject rule above or, given the request's stored `title`, by the
+ * form an earlier release wrote.
+ *
+ * That release did not flatten the title, so a title with a blank line in it
+ * put `(#N)` after the blank line, and git's `%s` subject ended before it: such
+ * rows failed {@link mergeCommitSubjectNames} and read as author-only for good.
+ * The commit is still exactly `<title> (#N)` followed by a blank line and the
+ * body, and the row still holds the title — so a message that opens with the
+ * title (its whitespace matched loosely), then ` (#N)`, then the END OF THAT
+ * LINE, is this request's. The line end is what keeps the match this
+ * request's: a title may contain another request's number (`Fix crash (#42)`),
+ * and a CURRENT-format commit of request 43 with that title reads
+ * `Fix crash (#42) (#43)` — the number of 42 there is followed by more text on
+ * the line, so it does not name 42's commit. Only `title` can vouch for the
+ * old format: the number sits wherever that format put it, which nothing else
+ * in a message may say.
+ */
+export function mergeCommitMessageNames(message: string, number: number, title?: string): boolean {
+  // The first paragraph, which is what git reports as `%s`.
+  const subject = message.split(/\r?\n[ \t]*\r?\n/, 1)[0] ?? '';
+  if (mergeCommitSubjectNames(subject.replace(/\s+/g, ' '), number)) return true;
+  if (title === undefined) return false;
+  const words = title.trim().split(/\s+/).map((word) => word.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+  if (words.length === 0 || words[0] === '') return false;
+  const oldFormat = new RegExp(`^\\s*${words.join('\\s+')}\\s+\\(#${number}\\)[ \\t]*(?:\\r?\\n|$)`);
+  return oldFormat.test(message);
+}

package/src/modules/workflow/git/node-git-runner.ts

@@ -9,6 +9,24 @@ import {
   type GitRunResult,
   type IGitRunner,
 } from '../../../shared/git.contract.js';
+import { logger } from '../../../shared/logging.js';
+import { credentialHelperValue } from '../../kb-fs/clone-config.js';
+
+const log = logger('git-runner');
+
+/**
+ * What git says when it had no credential to offer, or offered one the host
+ * threw out. Both happen before a byte of the transfer moves, so a command
+ * that failed this way did nothing, and running it again is safe for every
+ * subcommand — fetch, push, ls-remote and clone alike.
+ */
+const REFUSED_CREDENTIAL_RE = /could not read (?:Username|Password) for|terminal prompts disabled|Authentication failed for/i;
+
+/** Whether this failure is git being refused a credential (see {@link REFUSED_CREDENTIAL_RE}). */
+export function isCredentialRefusal(err: unknown): boolean {
+  if (!(err instanceof GitRunError) || err.timedOut) return false;
+  return REFUSED_CREDENTIAL_RE.test(`${err.stderr ?? ''}\n${err.message}`);
+}
 
 /**
  * The deadline every git call carries unless its caller says otherwise.
@@ -147,7 +165,8 @@ interface CommandFailure extends Error {
  * missing git — a string `code`, which is how callers tell "git never ran"
  * from "git said no"), and cuts off a child whose output passes `maxBuffer`.
  */
-function spawnGit(args: string[], options: SpawnOptions & { maxBuffer: number }): {
+/** `shown` is what a failure message names — the caller's arguments, without the runner's own `-c` pairs. */
+function spawnGit(args: string[], shown: string[], options: SpawnOptions & { maxBuffer: number }): {
   promise: Promise<Captured>;
   child: ChildProcess;
 } {
@@ -195,7 +214,7 @@ function spawnGit(args: string[], options: SpawnOptions & { maxBuffer: number })
         resolve({ stdout, stderr });
         return;
       }
-      const error: CommandFailure = new Error(`Command failed: git ${args.join(' ')}\n${stderr.toString()}`);
+      const error: CommandFailure = new Error(`Command failed: git ${shown.join(' ')}\n${stderr.toString()}`);
       error.code = code ?? undefined;
       error.signal = signal;
       error.stdout = stdout;
@@ -243,21 +262,77 @@ export class NodeGitRunner implements IGitRunner {
     return { ...env, ...overrides, ...FIXED_ENV };
   }
 
+  /**
+   * The credential helper, for THIS invocation, when a token is in hand: the
+   * same inline snippet the clones carry in their config, which reads the
+   * token from the child's environment. Given to every call so that a clone
+   * whose config lost its helper — unstamped while the deployment briefly
+   * had no token, created by a build that authenticated only its own clone,
+   * or touched by hand — still authenticates: the server's calls never
+   * depend on what a `.git/config` on disk happens to say. Nothing for a
+   * runner without a token, and nothing when the username cannot be made
+   * into a helper (the stamp refuses the same one, and says so).
+   */
+  private helperArgs(): string[] {
+    if (!this.credentials.token()) return [];
+    try {
+      const helper = credentialHelperValue(this.credentials);
+      return helper ? ['-c', `credential.helper=${helper}`] : [];
+    } catch {
+      return [];
+    }
+  }
+
   run(cwd: string, args: string[], opts: GitRunOptions & { encoding: 'buffer' }): Promise<GitRunResult<Buffer>>;
   run(cwd: string, args: string[], opts?: GitRunOptions & { encoding?: 'utf8' }): Promise<GitRunResult>;
   async run(cwd: string, args: string[], opts: GitRunOptions = {}): Promise<GitRunResult<string | Buffer>> {
-    const timeoutMs = opts.timeoutMs ?? this.defaultTimeoutMs;
-    const timers: NodeJS.Timeout[] = [];
-    let timedOut = false;
-
     // A credential that expires is renewed before it is read. Renewing is
     // the credential's own business and its failure is not this call's:
     // plenty of git never leaves the disk, and a call that does is told by
     // the host what the token in hand is worth.
     await this.credentials.prepare?.().catch(() => undefined);
+    try {
+      return await this.attempt(cwd, args, opts);
+    } catch (err) {
+      if (!isCredentialRefusal(err)) throw err;
+      // A credential the CALLER laid over the provider's (the setup probe
+      // checking a token it was given) is the caller's to judge: nothing
+      // here can replace it, so the refusal is the answer.
+      if (opts.env?.[GIT_TOKEN_ENV] !== undefined) throw err;
+      // Refused a credential: the token in hand was dead, or there was none
+      // to hand over. Tell the provider so — it drops what the host refused
+      // and asks for another, past whatever it remembers about a recent
+      // failure — and run the command once more ONLY with a credential that
+      // is not the one just refused. The same token again would only be
+      // refused again, and a renewal that failed leaves none.
+      const subcommand = subcommandOf(args);
+      const refused = this.credentials.token();
+      const renewal = await this.credentials.prepare?.({ refused: true }).then(
+        () => null,
+        (e: unknown) => (e instanceof Error ? e.message : String(e)),
+      );
+      const renewed = this.credentials.token();
+      if (!renewed || renewed === refused) {
+        log.warn(
+          `git ${subcommand} was refused a credential, and no other token could be had to run it again` +
+            (renewal ? `: ${redactGitToken(renewal, refused)}` : ''),
+        );
+        throw err;
+      }
+      log.warn(`git ${subcommand} was refused a credential; the token was renewed and the command runs again`);
+      return await this.attempt(cwd, args, opts);
+    }
+  }
+
+  private async attempt(cwd: string, args: string[], opts: GitRunOptions): Promise<GitRunResult<string | Buffer>> {
+    const timeoutMs = opts.timeoutMs ?? this.defaultTimeoutMs;
+    const timers: NodeJS.Timeout[] = [];
+    let timedOut = false;
 
     try {
-      const { promise: pending, child } = spawnGit(args, {
+      // The helper rides the invocation, not the error text: a failure
+      // message names the command the caller asked for.
+      const { promise: pending, child } = spawnGit([...this.helperArgs(), ...args], args, {
         cwd,
         env: this.childEnv(opts.env),
         maxBuffer: MAX_OUTPUT_BYTES,