@bevel-software/platform-core-backend 0.26.0 → 0.27.0

package/src/modules/workflow/pending-commits.service.ts

@@ -34,7 +34,7 @@
  *                                                    (status='needs_attention')
  */
 
-import { and, eq, inArray, isNull, min, or, sql, type SQL } from 'drizzle-orm';
+import { and, asc, eq, inArray, isNull, min, or, sql, type SQL } from 'drizzle-orm';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('pending-commits');
@@ -495,6 +495,34 @@ export class PendingCommitsService {
     return rows[0]?.count ?? 0;
   }
 
+  /**
+   * What still stands between `branch`'s saved files and its remote: how many
+   * commits are queued (`pending` or `running` — a row the worker holds is not
+   * pushed yet either), how many were escalated to `needs_attention`, and the
+   * message of the oldest of those, or null when none was.
+   *
+   * Keyed on the branch the row was written for, not a workspace id: the
+   * question is asked by `mergeBranch`, which merges what the REMOTE holds of
+   * that branch, whichever clone the bytes are waiting in.
+   */
+  async queuedOnBranch(
+    branch: string,
+  ): Promise<{ queued: number; stuck: number; needsAttention: string | null }> {
+    const rows = await this.db
+      .select({ status: pendingCommits.status, lastError: pendingCommits.lastError })
+      .from(pendingCommits)
+      .where(eq(pendingCommits.branch, branch))
+      // Oldest first, so the message reported is the same on every call.
+      .orderBy(asc(pendingCommits.queuedAt), asc(pendingCommits.id));
+    const stuck = rows.filter((r) => r.status === 'needs_attention');
+    return {
+      queued: rows.filter((r) => r.status === 'pending' || r.status === 'running').length,
+      stuck: stuck.length,
+      needsAttention:
+        stuck.length === 0 ? null : (stuck[0]?.lastError || 'A queued commit on this branch failed and needs a person.'),
+    };
+  }
+
   /**
    * Is a LIVE row — `pending` or `running`, the statuses the worker will
    * still drive — queued for `(workspaceId, branch, path)`? A

package/src/modules/workflow/pending-commits.worker.ts

@@ -23,10 +23,20 @@
  * stalled push parked every other user's save behind it.
  */
 
+import { createHash } from 'node:crypto';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('pending-commits');
+
+/**
+ * The commit author's synthetic user id: a digest of the address, so the id
+ * is stable for one person and carries nothing a reader can turn back into
+ * the address. It stands in log lines (`user=<id>`) where a real id would.
+ */
+function authorIdOf(email: string): string {
+  return createHash('sha256').update(email.trim().toLowerCase()).digest('hex').slice(0, 24);
+}
 import type {
   PendingCommit,
   PendingCommitsService,
@@ -56,10 +66,15 @@ export interface ISystemNoticeSink {
   }): Promise<void>;
 }
 
-/** Core default: terminal-failure notices go to stderr (no dashboard). */
+/**
+ * Core default: terminal-failure notices go to stderr (no dashboard).
+ *
+ * Keyed by the user's id, never the email or the name: log lines carry no
+ * personal identifiers, and an operator can look the id up.
+ */
 export const consoleSystemNoticeSink: ISystemNoticeSink = {
   async send(notice) {
-    logger('system-notice').error(`${notice.user.email}: ${notice.message}`);
+    logger('system-notice').error(`user ${notice.user.id}: ${notice.message}`);
   },
 };
 
@@ -337,8 +352,11 @@ export class PendingCommitsWorker {
       // The worker doesn't have a real `users.id` for the commit author —
       // commit attribution flows through `git commit --author="Name <email>"`,
       // not through any FK. Drop a synthetic id so the AuthUser shape is
-      // satisfied without hitting the users table.
-      id: `pending-commit-author:${row.authorEmail}`,
+      // satisfied without hitting the users table. OPAQUE, like a real id:
+      // the push path logs `user=<id>` when a push or its recovery fails,
+      // and log lines carry no email addresses — so the id is a digest of
+      // the address, stable per person and nothing a reader can turn back.
+      id: `pending-commit-author:${authorIdOf(row.authorEmail)}`,
       email: row.authorEmail,
       name: row.authorName,
     };
@@ -462,7 +480,7 @@ function strayPathNotice(row: PendingCommit, error: string, corrected: string):
     `Branch:    ${row.branch}`,
     `Path:      ${row.path}`,
     `Use instead: ${corrected}`,
-    `Original author: ${row.authorEmail}`,
+    `Queue row: ${row.id} (names the author; log lines carry no email addresses)`,
     `Queued at: ${row.queuedAt.toISOString()}`,
     `Error: ${error}`,
     '',
@@ -486,7 +504,7 @@ function terminalFailureNotice(row: PendingCommit, error: string): string {
     `Workspace: ${row.workspaceId}`,
     `Branch:    ${row.branch}`,
     `Path:      ${row.path}`,
-    `Original author: ${row.authorEmail}`,
+    `Queue row: ${row.id} (names the author; log lines carry no email addresses)`,
     `Queued at: ${row.queuedAt.toISOString()} (${elapsed} ago)`,
     `Last error: ${error}`,
     '',

package/src/modules/workflow/recovery-bot.ts

@@ -50,7 +50,7 @@ export async function ensureRecoveryBotUser(db: Database): Promise<AuthUser> {
     .returning();
   if (inserted.length > 0) {
     const row = inserted[0];
-    log.info(`created recovery-bot user id=${row.id} email=${row.email}`);
+    log.info(`created recovery-bot user id=${row.id}`);
     return {
       id: row.id,
       email: row.email,

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -478,7 +478,8 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
           if (batch) viewerCanApproveByPath = batch;
         } catch (err) {
           if (err instanceof AccessUnreadableError) throw err;
-          log.warn(`canWriteBatchAtRef failed for PR #${prNumber} viewer=${viewerEmail}:`, { err });
+          // The viewer is not named: log lines carry no email addresses.
+          log.warn(`canWriteBatchAtRef failed for PR #${prNumber} (for the viewer):`, { err });
         }
       }
     }

package/src/modules/workflow/sanitize-error.ts

@@ -65,3 +65,53 @@ export function sanitizeError(err: unknown, opts: { maxLen?: number } = {}): str
   }
   return out;
 }
+
+/**
+ * What a person reads about a failed push or pull: one of a few fixed
+ * sentences, chosen from the git failure but never quoting it.
+ *
+ * `sanitizeError` masks secrets but still returns the host's own words —
+ * `remote: Internal Server Error`, a git `fatal:` line, a URL — and those must
+ * not reach the browser (the sync banner, a route's answer). The raw text
+ * belongs in the server log, which is where the banner already sends whoever
+ * can act on it. Order matters: an auth failure also reads "unable to access",
+ * and a permission refusal is told apart from a rejected credential.
+ *
+ * `operation` says which side of the sync failed: the same 403 or
+ * "Repository not found" means "may not write here" on a push but "may not
+ * read this repository" on a pull, and the two are fixed in different places.
+ */
+export function describeSyncFailure(err: unknown, operation: 'push' | 'pull' = 'push'): string {
+  const raw = err instanceof Error ? err.message : String(err);
+  // `Permission denied (publickey…)` is ssh refusing the KEY — a rejected
+  // credential, not a missing permission.
+  if (
+    /authentication failed|could not read username|invalid username or (?:password|token)|invalid credentials|\b401\b|permission denied \(publickey/i.test(
+      raw,
+    )
+  ) {
+    return "The repository host did not accept this server's credentials.";
+  }
+  // Credentials the host accepted but that may not act here — a 403, the
+  // host's own "Permission to <repo> denied", a token scoped to other
+  // repositories (GitHub answers those "Repository not found"). Replacing the
+  // credential is the wrong fix; granting it access is the right one. Only
+  // the host's phrasing counts: a bare "Permission denied" is the server's
+  // own filesystem, handled below.
+  // `repository … not found` across the quoted URL git puts between the words.
+  if (/permission to \S+ denied|returned error: 403|write access .* not granted|repository\b.*\bnot found/i.test(raw)) {
+    return operation === 'pull'
+      ? "The repository host did not give this server's credentials access to this repository."
+      : "The repository host did not give this server's credentials permission to push here.";
+  }
+  if (/permission denied|insufficient permission/i.test(raw)) {
+    return "This server could not write to its own copy of the repository.";
+  }
+  if (/could not resolve host|failed to connect|couldn't connect|connection (refused|timed out|reset)|network is unreachable|\btimed out\b|ETIMEDOUT/i.test(raw)) {
+    return 'The repository host could not be reached.';
+  }
+  if (/non-fast-forward|fetch first|updates were rejected/i.test(raw)) {
+    return 'The branch changed on the repository host and could not be reconciled automatically.';
+  }
+  return 'The repository host refused the request.';
+}