@bevel-software/platform-core-backend 0.4.0 → 0.5.0

package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-cancel.test.ts

@@ -14,6 +14,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: undefined,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -25,6 +26,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -36,6 +38,7 @@ describe('computeViewerCanCancel', () => {
         authorId: OTHER_AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -47,6 +50,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -58,6 +62,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -69,6 +74,7 @@ describe('computeViewerCanCancel', () => {
         authorId: OTHER_AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -80,6 +86,7 @@ describe('computeViewerCanCancel', () => {
         authorId: undefined,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -95,7 +102,44 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: '  Juan@Bevel.Software  ',
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
+
+  it('returns true for a non-author, non-admin who writes EVERY changed file (the reject route’s third grant)', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('fails closed for an anonymous viewer even with the owner grant', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('terminal states refuse the owner grant too', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'merged',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(false);
+  });
 });

package/src/modules/workflow/git/branch-name.ts

@@ -7,7 +7,11 @@ export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-
 // picker's `canDelete` rule and the backend authorisation check on
 // `deleteBranch` must agree on every edge case (uppercase email, dotted
 // localpart, etc.).
-export { branchAuthorLocalpart, isBranchAuthoredBy } from '@bevel-software/platform-shared';
+export {
+  branchAuthorLocalpart,
+  isBranchAuthoredBy,
+  isOwnSuggestionsBranch,
+} from '@bevel-software/platform-shared';
 
 const VALID_BRANCH_REGEX = /^[A-Za-z0-9][A-Za-z0-9/_\-.]*$/;
 

package/src/modules/workflow/git/git.service.ts

@@ -22,6 +22,7 @@ import {
   assertValidBranchName,
   assertValidRelativePath,
   isBranchAuthoredBy,
+  isOwnSuggestionsBranch,
   isProtectedBranch,
   PROTECTED_BRANCHES,
 } from './branch-name.js';
@@ -607,7 +608,7 @@ export class GitService implements IGitService {
     workspaceId: string,
     name: string,
     user: AuthUser,
-    opts: { onlyIfNoRemote?: boolean } = {},
+    opts: { onlyIfNoRemote?: boolean; systemCleanup?: boolean } = {},
   ): Promise<void> {
     assertValidBranchName(name);
     if (isProtectedBranch(name)) {
@@ -622,7 +623,12 @@ export class GitService implements IGitService {
         );
       }
 
-      if (opts.onlyIfNoRemote) {
+      if (opts.systemCleanup) {
+        // Internal post-merge retirement (never reachable from a route): the
+        // merge that emptied this branch was itself authorized, so no
+        // authorship check — the protected-branch and checked-out guards
+        // above still hold.
+      } else if (opts.onlyIfNoRemote) {
         // Legacy orphan-cleanup path (PR merged + remote head pruned). Skip
         // the authorship check — callers prune any orphan they encounter,
         // not just their own — but keep the "refuse if origin still has the
@@ -642,7 +648,13 @@ export class GitService implements IGitService {
         // that predicate is the existing source of truth for `Admin`-role
         // membership inside the access model — no separate `isAdmin()` plumbing
         // needed.
-        const isAuthor = isBranchAuthoredBy(name, user.email);
+        // Two authorship conventions: `<localpart>/…` UI drafts, and the
+        // `suggestions/<who>-<id8>/…` namespace the propose flow files its
+        // branches under — a user resetting THEIR OWN suggestion bundle is
+        // deleting their own branch.
+        const isAuthor =
+          isBranchAuthoredBy(name, user.email) ||
+          isOwnSuggestionsBranch(name, { email: user.email, id: user.id });
         const isAdmin = this.accessControl
           ? await this.accessControl.canWrite(workspaceId, user.email, 'roles.yaml')
           : false;
@@ -1017,7 +1029,11 @@ export class GitService implements IGitService {
     });
   }
 
-  async push(workspaceId: string, user: AuthUser): Promise<void> {
+  async push(
+    workspaceId: string,
+    user: AuthUser,
+    opts?: { systemAuthorized?: boolean },
+  ): Promise<void> {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       const branch = await this.currentBranch(cwd);
@@ -1030,7 +1046,14 @@ export class GitService implements IGitService {
       // PR. Gate against `origin/<branch>` — the published state — for
       // protected pushes; that's defence-in-depth against local rebases or
       // `commit-tree` shenanigans that might bypass the commit-time gate.
-      if (isProtectedBranch(branch)) {
+      // `systemAuthorized` skips the gate for flows whose ENDPOINT is the
+      // authorization — group provisioning commits an access.md into a
+      // folder that does not exist at origin yet, which this gate can only
+      // ever read as "write: Admin". The provisioning service has already
+      // decided the write is legitimate (unused name, exclusive create);
+      // gating it here again just refuses every non-admin the product
+      // promised a group to.
+      if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
         const touched = await this.unpushedTouchedPaths(cwd);
         await this.assertCanWriteAtRef(
           workspaceId,
@@ -1403,12 +1426,23 @@ export class GitService implements IGitService {
         // A failed rebase leaves the repo in a "REBASE_HEAD" / detached-apply state,
         // which makes every subsequent git command behave unexpectedly. Return the
         // working tree to a clean state before surfacing the original error.
-        await this.git(cwd, ['rebase', '--abort']).catch(() => undefined);
-        if (conflictedPaths.length > 0) {
+        let abortSucceeded = true;
+        await this.git(cwd, ['rebase', '--abort']).catch(() => {
+          abortSucceeded = false;
+        });
+        if (abortSucceeded && conflictedPaths.length > 0) {
           // Typed so the workflow layer can queue background recovery — this
           // divergence never resolves on its own (every retry pull hits the
           // same conflict) and the unpushed local commits are someone's saved
           // content stuck violating save=share.
+          //
+          // Gated on the abort succeeding: a failed abort means either no
+          // rebase was ever active (the unmerged paths pre-date this pull —
+          // some earlier operation left the index broken) or the clone is in
+          // a state git itself can't unwind. Queueing recovery there would
+          // point the worker's commitFile at a repo mid-conflict, risking a
+          // commit full of conflict markers — surface the raw error instead
+          // and leave diagnosis to a human.
           throw new PullRebaseConflictError(
             branch,
             conflictedPaths,
@@ -1597,60 +1631,6 @@ export class GitService implements IGitService {
     });
   }
 
-  async revertCommit(
-    workspaceId: string,
-    user: AuthUser,
-    sha: string,
-  ): Promise<CommitAttribution> {
-    if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-      throw new WorkflowValidationError('invalid commit sha');
-    }
-    assertValidAuthor(user);
-    return this.mutex.run(workspaceId, async () => {
-      const cwd = await this.repoDir(workspaceId);
-      const branch = await this.currentBranch(cwd);
-
-      // Revert creates a new commit reversing `sha`. Same model as commit:
-      // gate only on protected branches; reverts on feature/draft branches
-      // are free (they produce a commit that would still need to merge via
-      // PR to affect canonical state).
-      if (isProtectedBranch(branch)) {
-        const { stdout: diffOut } = await this.git(cwd, [
-          'diff-tree', '--no-commit-id', '--name-only', '-r', sha,
-        ]);
-        const touched = diffOut.split('\n').map((s) => s.trim()).filter(Boolean);
-        await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
-      }
-
-      await this.git(cwd, [
-        'revert',
-        '--no-edit',
-        `--author=${user.name} <${user.email}>`,
-        sha,
-      ]);
-
-      const { stdout } = await this.git(cwd, [
-        'log',
-        '-1',
-        '--pretty=format:%H%x00%an%x00%ae%x00%s%x00%aI',
-      ]);
-      const [headSha, authorName, authorEmail, subj, committedAt] = stdout.split('\x00');
-
-      // A revert may have touched roles.yaml or access.md — drop cached
-      // access state so the next gate read reflects the rolled-back tree.
-      // Mirrors the commit / pull paths.
-      this.accessControl?.invalidate(workspaceId);
-
-      return {
-        sha: headSha?.trim() ?? '',
-        authorName: authorName ?? '',
-        authorEmail: authorEmail ?? '',
-        subject: subj ?? '',
-        committedAt: committedAt?.trim() ?? new Date().toISOString(),
-      };
-    });
-  }
-
   async logForFile(
     workspaceId: string,
     relativePath: string,
@@ -1715,6 +1695,44 @@ export class GitService implements IGitService {
     });
   }
 
+  /**
+   * Full file contents on both sides of one commit: `baseline` is the file at
+   * `<sha>^` (the parent), `current` at `<sha>`. Null means the file is absent
+   * at that ref — added files have `baseline: null`, deleted files
+   * `current: null`. A root commit (no parent) also yields `baseline: null`.
+   * Feeds the rendered-markdown history view, which needs before/after text
+   * rather than the patch `diffFileAtCommit` returns.
+   */
+  async fileContentsAtCommit(
+    workspaceId: string,
+    relativePath: string,
+    sha: string,
+  ): Promise<{ baseline: string | null; current: string | null }> {
+    assertValidRelativePath(relativePath);
+    if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
+      throw new WorkflowValidationError('invalid commit sha');
+    }
+    const repoRelativePath = this.stripRepoPrefix(relativePath);
+    return this.mutex.run(workspaceId, async () => {
+      const current = await this.readFileAtRef(workspaceId, sha, repoRelativePath);
+      let baseline: string | null;
+      try {
+        baseline = await this.readFileAtRef(workspaceId, `${sha}^`, repoRelativePath);
+      } catch (err) {
+        // `readFileAtRef` maps "path absent at ref" to null but propagates an
+        // unresolvable ref. `<sha>^` on a root commit is exactly that (git
+        // reports it as "invalid object name '<sha>^'", or "unknown/bad
+        // revision" in other codepaths), and it legitimately means "no parent
+        // side" — fold it into null. Anything else stays fatal.
+        const stderr =
+          (err as { stderr?: string }).stderr ?? (err instanceof Error ? err.message : String(err));
+        if (/invalid object name|unknown revision|bad revision/i.test(stderr)) baseline = null;
+        else throw err;
+      }
+      return { baseline, current };
+    });
+  }
+
   async diffFileBetweenBranches(
     workspaceId: string,
     relativePath: string,
@@ -1848,8 +1866,20 @@ export class GitService implements IGitService {
         this.git(cwd, ['diff', '-M', '-z', '--name-status', range]),
         this.git(cwd, ['diff', '-M', '-z', '--numstat', range]),
       ]);
-      const statuses = parseNameStatusZ(nameStatusOut);
-      const counts = parseNumstatZ(numstatOut);
+      let statuses = parseNameStatusZ(nameStatusOut);
+      let counts = parseNumstatZ(numstatOut);
+      // roles.yaml can NEVER change through a merge — `preserveBaseRolesYaml`
+      // restores the base copy onto the source branch before every merge — so
+      // listing it as "changed" claims something the merge will not do, and
+      // (worse) makes its approval a requirement for a change that cannot
+      // land. Filter it from the review surface entirely; the neutralisation
+      // reads the raw refs itself and is unaffected. Both lists are filtered
+      // IN STEP so the index-zip below stays aligned.
+      if (statuses.some((s) => s.path === 'roles.yaml')) {
+        const keep = statuses.map((s) => s.path !== 'roles.yaml');
+        statuses = statuses.filter((_, i) => keep[i]);
+        if (counts.length === keep.length) counts = counts.filter((_, i) => keep[i]);
+      }
 
       // `--name-status` and `--numstat` enumerate the same files in the same
       // order (same `-M` over the same range), so we zip by index. If the two
@@ -1913,7 +1943,85 @@ export class GitService implements IGitService {
       const { stdout } = await this.git(cwd, [
         'diff', '-M', '--name-only', `${baseRef}...${headRef}`,
       ]);
-      return stdout.split('\n').map((s) => s.trim()).filter(Boolean);
+      return (
+        stdout
+          .split('\n')
+          .map((s) => s.trim())
+          .filter(Boolean)
+          // Same rule as `changedFilesForPr`: a roles.yaml change never
+          // survives a merge, so it is not a touched path for routing or
+          // summaries either.
+          .filter((p) => p !== 'roles.yaml')
+      );
+    });
+  }
+
+  /**
+   * The merge-base commit of a change request's two branches (their origin
+   * refs), or null when they share no history. This is the "before" the CR's
+   * three-dot diff is read against — the ref a per-file revert restores from,
+   * so the reverted file drops OUT of that same diff.
+   */
+  async mergeBaseForPr(
+    workspaceId: string,
+    baseBranch: string,
+    headBranch: string,
+  ): Promise<string | null> {
+    assertValidBranchName(baseBranch);
+    assertValidBranchName(headBranch);
+    const cwd = await this.repoDir(workspaceId);
+    await this.fetchPrRefs(cwd, baseBranch, headBranch);
+    return this.mutex.run(workspaceId, async () => {
+      const baseRef = await this.resolveBranchRef(cwd, baseBranch);
+      const headRef = await this.resolveBranchRef(cwd, headBranch);
+      try {
+        const { stdout } = await this.git(cwd, ['merge-base', baseRef, headRef]);
+        return stdout.trim() || null;
+      } catch (err) {
+        // Exit 1 is git's specific "no common ancestor" answer; anything else
+        // is an infra failure that must not masquerade as it.
+        if ((err as { exitCode?: number }).exitCode === 1) return null;
+        throw err;
+      }
+    });
+  }
+
+  /**
+   * Restore one path in the working tree (and index) to its content at `ref`;
+   * a path ABSENT at `ref` is deleted — the revert of an added file is its
+   * removal. Byte-exact via git itself (`checkout <ref> -- <path>`), never a
+   * read-as-string round-trip that would mangle binary files. The caller owns
+   * committing the result (see `commitFile`).
+   */
+  async restorePathFromRef(
+    workspaceId: string,
+    ref: string,
+    repoRelativePath: string,
+  ): Promise<void> {
+    assertValidRelativePath(repoRelativePath);
+    return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      let existsAtRef = true;
+      try {
+        await this.git(cwd, ['cat-file', '-e', `${ref}:${repoRelativePath}`]);
+      } catch {
+        existsAtRef = false;
+      }
+      if (existsAtRef) {
+        await this.git(cwd, ['checkout', ref, '--', repoRelativePath]);
+      } else {
+        // First re-align the INDEX with HEAD for this path. A previous failed
+        // attempt (the git-rm era of this method) can have left a staged
+        // deletion — index entry gone — and `git add` can only stage a
+        // deletion for a path the index still tracks. No-op on a clean tree.
+        await this.git(cwd, ['reset', '-q', 'HEAD', '--', repoRelativePath]);
+        // Then delete from the WORKING TREE only, never `git rm`: the
+        // follow-up `commitFile` stages via `git add -- <path>`, and dropping
+        // the index entry too made that add match nothing — the whole revert
+        // failed with "pathspec did not match any files". A tracked file
+        // missing from disk is exactly what `git add` records as deleted.
+        await fs.rm(path.join(cwd, repoRelativePath), { force: true });
+      }
     });
   }
 

package/src/modules/workflow/git/pull-request.service.ts

@@ -183,10 +183,13 @@ export class PullRequestService implements IPullRequestService {
     return summaries;
   }
 
-  async listPrsAuthoredBy(loginOrEmail: string): Promise<PullRequestSummary[]> {
+  async listPrsAuthoredBy(
+    loginOrEmail: string,
+    opts: { fresh?: boolean } = {},
+  ): Promise<PullRequestSummary[]> {
     const needle = loginOrEmail.trim().toLowerCase();
     if (!needle) return [];
-    const prs = await this.listOpenPrs();
+    const prs = await this.listOpenPrs(opts);
     const needleIsEmail = needle.includes('@');
     const needleHash = needleIsEmail ? hashEmail(needle) : null;
     return prs.filter((p) => {
@@ -378,6 +381,11 @@ export class PullRequestService implements IPullRequestService {
       authorId: summary.authorId,
       viewerEmail: opts.viewerEmail,
       viewerCanBypassMerge,
+      // The reject route's third grant (see `rejectChangeRequest`): write on
+      // every changed file at origin/<base>. Derived from the per-file
+      // `viewerCanApprove` flags — the SAME `canWriteBatchAtRef` predicate the
+      // route enforces — so the hint cannot drift from the enforcement.
+      viewerWritesAllFiles: approvals.length > 0 && approvals.every((a) => a.viewerCanApprove),
     });
 
     const detail: PullRequestDetail = {
@@ -423,23 +431,26 @@ export class PullRequestService implements IPullRequestService {
 }
 
 /**
- * Pure predicate for the cancel-button's enabled state. The viewer can cancel
- * iff the PR is open AND they're either the author (hash-match against the
- * stored author) or an admin (`viewerCanBypassMerge` is the proxy — same
- * `canWriteAtRef('roles.yaml')` predicate). Fail-closed defaults: missing
- * email → false.
+ * Pure predicate for the `viewerCanCancel` hint. The viewer can cancel iff
+ * the PR is open AND they're the author (hash-match against the stored
+ * author), an admin (`viewerCanBypassMerge` is the proxy — same
+ * `canWriteAtRef('roles.yaml')` predicate), or they hold write on EVERY
+ * changed file (`viewerWritesAllFiles`) — the reject route's full
+ * authorization set, mirrored exactly so the hint never claims less (or
+ * more) than the server enforces. Fail-closed: no viewer email → false,
+ * whatever the grants say.
  */
 export function computeViewerCanCancel(input: {
   state: PullRequestState;
   authorId: string | undefined;
   viewerEmail: string | undefined;
   viewerCanBypassMerge: boolean;
+  viewerWritesAllFiles: boolean;
 }): boolean {
   if (input.state !== 'open') return false;
-  const viewerIsAuthor = !!(
-    input.authorId && input.viewerEmail && input.authorId === hashEmail(input.viewerEmail)
-  );
-  return viewerIsAuthor || input.viewerCanBypassMerge;
+  if (!input.viewerEmail) return false;
+  const viewerIsAuthor = !!(input.authorId && input.authorId === hashEmail(input.viewerEmail));
+  return viewerIsAuthor || input.viewerCanBypassMerge || input.viewerWritesAllFiles;
 }
 
 export const __testing = {

package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts

@@ -100,7 +100,10 @@ describe('ReviewWorkflowService.cancelPr', () => {
     ).rejects.toMatchObject({
       name: 'CancelAuthError',
       status: 403,
-      message: expect.stringMatching(/only the author or an admin/i),
+      // Names the FULL authorization set — the facade's owner grant
+      // (write on every changed file) included, so the refusal never
+      // undersells who could actually do this.
+      message: expect.stringMatching(/author, an admin, or having edit access to every file/i),
     });
     expect(updateReturning).not.toHaveBeenCalled();
   });

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -106,7 +106,8 @@ class CancelStateError extends WorkflowDomainError {
 class CancelAuthError extends WorkflowDomainError {
   constructor() {
     super(
-      "You can't cancel this change request — only the author or an admin can.",
+      "You can't cancel this change request — that takes being its author, an admin, " +
+        'or having edit access to every file it changes.',
       403,
     );
     this.name = 'CancelAuthError';
@@ -500,7 +501,11 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
       })
       .onConflictDoNothing();
 
-    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId);
+    // WITH the caller as viewer: these approvals go straight back to the UI
+    // that just clicked, and omitting the viewer computed every
+    // `viewerCanApprove` as false — one approval made the apply button and
+    // every remaining approve control vanish until a fresh detail fetch.
+    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId, user.email);
   }
 
   evaluateMergeGate(input: MergeGateInput): MergeGateResult {
@@ -801,6 +806,10 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
         ),
       );
 
-    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId);
+    // WITH the caller as viewer: these approvals go straight back to the UI
+    // that just clicked, and omitting the viewer computed every
+    // `viewerCanApprove` as false — one approval made the apply button and
+    // every remaining approve control vanish until a fresh detail fetch.
+    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId, user.email);
   }
 }