@gitkraken/core-gitlens 0.9.3 → 0.9.5

package/dist/plus/integrations/providers/azureDevOps.js

@@ -1,5 +1,7 @@
+import { chunk } from "../../../utils/array.js";
 import { CancellationError } from "../../../utils/cancellation.js";
 import { mapSettledBounded } from "../../../utils/promise.js";
+import { PromiseCache } from "../../../utils/promiseCache.js";
 import "../../../git/models/pullRequest.js";
 import "../constants.js";
 import { toCollectionScopeFailure } from "../collectionMetadata.js";
@@ -8,8 +10,11 @@ import "../providerFilters.js";
 import { collectProviderPagedResult, flatSettledResultsOrThrow, mergeCollectionMetadata, resolveBranchPullRequests, selectBranchPullRequests } from "./utils/providerPaging.js";
 import { decodePathSegment } from "../utils/domain.utils.js";
 import { fromProviderIssue, fromProviderPullRequest, getProviderPullRequestIdentity, providerPullRequestMatchesSearch, providersMetadata, toIssueShape, toProviderPullRequestStates } from "./models.js";
+import { toAzurePullRequestEtagFields, toAzureWorkItemEtagFields } from "./azure/models.js";
 import { GitHostIntegration } from "../models/gitHostIntegration.js";
 import { getAzurePullRequestIdentityFromMaybeUrl } from "./azure/azure.utils.js";
+import { discoveryCacheTtl } from "./utils/discoveryCache.js";
+import { GitPullRequestState } from "@gitkraken/provider-apis";
 //#region ../plus/integrations/src/providers/azureDevOps.ts
 function getAzureRepositoryIdentity(repo) {
 	const match = /^([^/]+)\/_git\/([^/]+)$/i.exec(repo.name);
@@ -49,6 +54,42 @@ function uniqueAzureNames(names) {
 	return unique;
 }
 /**
+* Flags the reviews of `pr` that name one of the current user's groups (see `PullRequestReviewer.isMyGroup`), which a
+* reviewer read finds through that group rather than through the user.
+*/
+function markMyGroupReviews(pr, groupIds) {
+	if (pr.reviews == null || !pr.reviews.some((r) => groupIds.has(r.reviewer.id))) return pr;
+	return {
+		...pr,
+		reviews: pr.reviews.map((r) => groupIds.has(r.reviewer.id) ? {
+			...r,
+			isMyGroup: true
+		} : r)
+	};
+}
+/**
+* The reads a reviewer relationship over `states` (omitted: open) takes for `userId`, whose groups are `groupIds`:
+*
+* - Open pull requests: all of them, kept when one names the user, or names one of the user's groups and the user
+*   didn't write it. Azure's reviewer filter only matches the identity it names, never the groups that identity is in,
+*   and a group asked to review the user's own pull request isn't asking the user.
+* - Closed and merged ones: Azure's own filter for the user. They are every pull request a project ever had, too many
+*   to read whole on every read, so a group's request is only followed while the pull request is open.
+*/
+function toAzureReviewerReads(userId, groupIds, states) {
+	const reads = [];
+	if (states == null || states.includes(GitPullRequestState.Open)) reads.push({
+		filter: { states: [GitPullRequestState.Open] },
+		keep: (pr) => pr.reviews?.some((r) => r.reviewer.id === userId || groupIds.has(r.reviewer.id) && pr.author?.id !== userId) ?? false
+	});
+	const closed = states?.filter((s) => s !== GitPullRequestState.Open) ?? [];
+	if (closed.length > 0) reads.push({ filter: {
+		reviewerId: userId,
+		states: closed
+	} });
+	return reads;
+}
+/**
 * Matches an org/project descriptor against a caller-supplied name, mirroring the facade's own
 * key/id/name comparison so `listIssuesPage({ org, project })` narrows on the same identifiers a consumer
 * already got back from `listOrgs`/`listProjects`.
@@ -93,6 +134,44 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		return (await this.getProviderCurrentAccount(session))?.id;
 	}
 	/**
+	* The current user's groups per credential, collection and user, kept for {@link discoveryCacheTtl} like the other
+	* discovered sets: membership changes rarely, and a sweep that reads every few minutes would otherwise pay for it
+	* every time. A failed read isn't kept, and a re-sync drops them all (see {@link invalidateDiscoveryCaches}).
+	*/
+	_reviewerGroupIds = new PromiseCache({
+		capacity: 50,
+		createTTL: discoveryCacheTtl
+	});
+	/**
+	* Every group the current user (`userId`, as {@link getFilterUserId} resolved it) is a member of in `collection`:
+	* teams and security groups, in any project, directly or through other groups. Two requests per collection,
+	* however many groups, and none while the last read is kept.
+	*/
+	getReviewerGroupIds(session, collection, userId) {
+		return this._reviewerGroupIds.getOrCreate(JSON.stringify([
+			this.discoveryKey(session),
+			collection.toLowerCase(),
+			userId
+		]), async () => {
+			const api = await this.getProvidersApi();
+			const { tokenWithInfo } = this.getApiOptions(session);
+			const ids = await api.getAzureGroupIdsForUser(tokenWithInfo, collection, userId, this.getCollectionApiOptions(session, collection));
+			return new Set(ids);
+		});
+	}
+	invalidateDiscoveryCaches() {
+		super.invalidateDiscoveryCaches();
+		this._reviewerGroupIds.clear();
+	}
+	/**
+	* For one read, the current account as each organization's pull requests identify it, given the account itself
+	* (`undefined` when it couldn't be read). Azure DevOps Services gives a person one id, so that is `account`; the
+	* server override resolves each collection's own, once per read.
+	*/
+	getOrganizationViewers(_session, account) {
+		return () => Promise.resolve(account);
+	}
+	/**
 	* What the discovery caches (account, organizations, projects, and their stored copies) are keyed by. Azure DevOps
 	* Services has a single address, so the credential alone identifies what it discovers; the server override adds
 	* the installation address.
@@ -434,7 +513,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 				project: c.project
 			}, c.number, this.getCollectionApiOptions(session, c.owner));
 			if (issue == null) return void 0;
-			const shape = toIssueShape(issue, this);
+			const shape = toIssueShape(issue, this, { projection: "batch" });
 			if (shape == null) throw new Error(`Azure DevOps returned work item ${c.number} without a URL or change date`);
 			return shape;
 		});
@@ -447,6 +526,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 	async getProviderPullRequestsBatch(session, coordinates, options, _cancellation) {
 		const api = await this.getProvidersApi();
 		const { tokenWithInfo } = this.getApiOptions(session);
+		const viewerFor = this.getOrganizationViewers(session, options?.currentAccount);
 		return mapSettledBounded(coordinates, 6, async (c) => {
 			const pr = await api.getPullRequestForRepo(tokenWithInfo, {
 				namespace: c.owner,
@@ -456,7 +536,127 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 				...this.getCollectionApiOptions(session, c.owner),
 				includeRemoteInfo: true
 			});
-			return pr != null ? fromProviderPullRequest(pr, this, { currentAccount: options?.currentAccount }) : void 0;
+			if (pr == null) return void 0;
+			return fromProviderPullRequest(pr, this, {
+				currentAccount: await viewerFor(c.owner),
+				projection: "batch"
+			});
+		});
+	}
+	/**
+	* The cheap check behind the batch issue read's etags: one request per organization, project and
+	* {@link azureWorkItemsEtagFieldsMaxIds} distinct ids, where {@link getProviderIssuesBatch} sends one per target,
+	* asking only for each work item's change state. A request that throws rejects only its own targets' slots, with
+	* its error classified as the full read's would be.
+	*
+	* Never proves an absence. Azure silently leaves out every id it can't return, whether missing, hidden or failing,
+	* so such a target's slot is rejected and the full read, whose not-found does prove an absence, decides. So is a
+	* work item in another project, which the full read fails. When no target was answered and nothing failed, the
+	* check declines instead, so a batch of only such ids costs a full read, not a failure.
+	*
+	* A work item has no reactions, and its full row no count, so `'reactions'` reads nothing and costs nothing.
+	*/
+	async getProviderIssuesEtagFields(session, coordinates, _options, _cancellation) {
+		const slots = new Array(coordinates.length);
+		let answered = false;
+		let failed = false;
+		const byProject = /* @__PURE__ */ new Map();
+		for (const [index, c] of coordinates.entries()) {
+			if (c.project == null) {
+				slots[index] = {
+					status: "rejected",
+					reason: /* @__PURE__ */ new Error(`Azure DevOps needs a project to read work item ${c.number}`)
+				};
+				failed = true;
+				continue;
+			}
+			const key = JSON.stringify([c.owner, c.project]);
+			let group = byProject.get(key);
+			if (group == null) {
+				group = {
+					owner: c.owner,
+					project: c.project,
+					ids: /* @__PURE__ */ new Map()
+				};
+				byProject.set(key, group);
+			}
+			let indices = group.ids.get(c.number);
+			if (indices == null) {
+				indices = [];
+				group.ids.set(c.number, indices);
+			}
+			indices.push(index);
+		}
+		const requests = [...byProject.values()].flatMap((group) => chunk([...group.ids], 200).map((entries) => ({
+			...group,
+			entries
+		})));
+		if (!requests.length) return slots;
+		const api = await this.getProvidersApi();
+		const { tokenWithInfo } = this.getApiOptions(session);
+		const answers = await mapSettledBounded(requests, 6, (r) => api.getAzureWorkItemsEtagFields(tokenWithInfo, {
+			namespace: r.owner,
+			project: r.project
+		}, r.entries.map(([id]) => id), this.getCollectionApiOptions(session, r.owner)));
+		for (const [i, answer] of answers.entries()) {
+			const { project, entries } = requests[i];
+			if (answer.status === "rejected") {
+				failed = true;
+				for (const [, indices] of entries) for (const index of indices) slots[index] = answer;
+				continue;
+			}
+			const workItems = /* @__PURE__ */ new Map();
+			for (const workItem of answer.value) workItems.set(workItem.id, workItem);
+			for (const [id, indices] of entries) {
+				const workItem = workItems.get(id);
+				let slot;
+				if (workItem == null) slot = {
+					status: "rejected",
+					reason: /* @__PURE__ */ new Error(`Azure DevOps did not return work item ${id}`)
+				};
+				else try {
+					slot = {
+						status: "fulfilled",
+						value: toAzureWorkItemEtagFields(workItem, project)
+					};
+					answered = true;
+				} catch (ex) {
+					slot = {
+						status: "rejected",
+						reason: ex
+					};
+					failed = true;
+				}
+				for (const index of indices) slots[index] = slot;
+			}
+		}
+		return answered || failed ? slots : void 0;
+	}
+	/**
+	* The cheap check behind the batch pull request read's etags: still one request per target, as Azure DevOps has
+	* no read of several pull requests by id, but only the one {@link getProviderPullRequestsBatch} sends first —
+	* not the repository read provider-apis adds to it for clone URLs, once per pull request. Settled per target,
+	* with absence proven by the same not-found rule as the full read.
+	*
+	* Azure DevOps reports no update time, so a full row's `updatedDate` is its close time, else its creation time,
+	* and moves only when it closes. Its etag therefore adds a `revision` of the fields that change without it —
+	* title, description, target branch, and every reviewer and their vote — read off the same response at no extra
+	* cost. It sees a pull request's state, draft flag, head commit and those fields, and, when included, its
+	* mergeability and its required reviewers' review decision; never a comment or a label, which its full row
+	* doesn't carry either. A full row carries no check rollup, so the `checks` include adds nothing and costs nothing.
+	*/
+	async getProviderPullRequestsEtagFields(session, coordinates, options, _cancellation) {
+		const api = await this.getProvidersApi();
+		const { tokenWithInfo } = this.getApiOptions(session);
+		const etagIncludes = options.etagIncludes ?? [];
+		return mapSettledBounded(coordinates, 6, async (c) => {
+			if (c.project == null) throw new Error(`Azure DevOps needs a project to read pull request ${c.number}`);
+			const pr = await api.getAzurePullRequest(tokenWithInfo, {
+				namespace: c.owner,
+				project: c.project,
+				name: c.repo
+			}, c.number, this.getCollectionApiOptions(session, c.owner));
+			return pr != null ? toAzurePullRequestEtagFields(pr, etagIncludes) : void 0;
 		});
 	}
 	/**
@@ -518,42 +718,13 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		return (await this.authenticationService.apis.azure)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), repo) }, cancellation);
 	}
 	async searchProviderMyPullRequests(session, repos, _cancellation, options) {
-		const api = await this.getProvidersApi();
 		if (repos != null) return;
-		const states = toProviderPullRequestStates(options?.state);
-		if ((await this.getProviderCurrentAccount(session))?.id == null) return void 0;
-		const orgs = await this.getProviderResourcesForUser(session);
-		if (orgs == null || orgs.length === 0) return void 0;
-		const projects = await this.getProviderProjectsForResources(session, orgs);
-		if (projects.values.length === 0) return void 0;
-		const repoDescriptors = [...(await this.getRepoDescriptorsForProjects(session, projects.values) ?? /* @__PURE__ */ new Map()).values()].filter((r) => r != null).flat();
-		const { tokenWithInfo } = this.getApiOptions(session);
-		const assignedPrs = [];
-		const authoredPrs = [];
-		for (const org of uniqueAzureNames(projects.values.map((p) => p.resourceName))) {
-			const userId = await this.getFilterUserId(session, org);
-			if (userId == null) continue;
-			const projectInputs = projects.values.filter((p) => sameAzureName(p.resourceName, org)).map((p) => ({
-				namespace: p.resourceName,
-				project: p.name
-			}));
-			const orgOptions = this.getCollectionApiOptions(session, org);
-			const reads = [[{ assigneeLogins: [userId] }, assignedPrs], [{ authorLogin: userId }, authoredPrs]];
-			for (const [filter, into] of reads) {
-				const result = await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
-					...orgOptions,
-					...filter,
-					states
-				});
-				into.push(...result.values.map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values)));
-			}
-		}
-		const prsByIdentity = /* @__PURE__ */ new Map();
-		for (const pr of [...authoredPrs, ...assignedPrs]) {
-			const identity = `${pr.repository.owner}/${pr.repository.id || pr.repository.repo}#${pr.id}`;
-			if (!prsByIdentity.has(identity)) prsByIdentity.set(identity, pr);
-		}
-		return [...prsByIdentity.values()];
+		const result = await this.getProviderMyPullRequestsForUser(session, { state: options?.state != null ? [options.state] : void 0 });
+		if (result == null) return void 0;
+		const projects = (await this.getProviderProjectsForResources(session, await this.getProviderResourcesForUser(session) ?? [])).values;
+		if (projects.length === 0) return void 0;
+		const repoDescriptors = [...(await this.getRepoDescriptorsForProjects(session, projects) ?? /* @__PURE__ */ new Map()).values()].filter((r) => r != null).flat();
+		return result.values.map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects, "search"));
 	}
 	async getProviderMyPullRequestsForUser(session, options) {
 		const api = await this.getProvidersApi();
@@ -582,8 +753,8 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			for (let i = 0; i < maxPagesPerProject; i++) try {
 				const result = await api.getPullRequestsForAzureProject(tokenWithInfo, project, {
 					...this.getCollectionApiOptions(session, project.namespace),
-					...filter,
 					states,
+					...filter,
 					page
 				});
 				if (result == null) {
@@ -625,6 +796,8 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		const wantReviewed = requested == null || requested.has("assignee") || requested.has("review-requested");
 		const userIds = /* @__PURE__ */ new Map();
 		for (const org of uniqueAzureNames(projects.values.map((p) => p.resourceName))) userIds.set(org.toLowerCase(), await this.getFilterUserId(session, org));
+		const groups = wantReviewed ? await this.getReviewerGroupsByOrganization(session, projects.values, userIds, failures) : void 0;
+		if (groups?.incomplete) truncated = true;
 		const outcomes = await Promise.all(projects.values.flatMap((p) => {
 			const project = {
 				namespace: p.resourceName,
@@ -643,7 +816,13 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			}
 			const drains = [];
 			if (wantAuthored) drains.push(drainProject(project, scope, { authorLogin: userId }));
-			if (wantReviewed) drains.push(drainProject(project, scope, { reviewerId: userId }));
+			if (wantReviewed) {
+				const groupIds = groups?.byOrganization.get(p.resourceName.toLowerCase()) ?? /* @__PURE__ */ new Set();
+				for (const { filter, keep } of toAzureReviewerReads(userId, groupIds, states)) drains.push(drainProject(project, scope, filter).then((o) => keep != null ? {
+					...o,
+					prs: o.prs.filter(keep)
+				} : o));
+			}
 			return drains;
 		}));
 		const prsByIdentity = /* @__PURE__ */ new Map();
@@ -658,8 +837,9 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			completeness: "partial",
 			failures
 		} : void 0, projects.metadata);
+		const groupIds = groups?.groupIds ?? /* @__PURE__ */ new Set();
 		return {
-			values: [...prsByIdentity.values()],
+			values: Array.from(prsByIdentity.values(), (pr) => markMyGroupReviews(pr, groupIds)),
 			paging: {
 				cursor: "{}",
 				more: false,
@@ -668,6 +848,38 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			metadata
 		};
 	}
+	/**
+	* Per organization (keyed by its lowercased name), every group the user is in (see {@link getReviewerGroupIds}),
+	* and their union. An organization whose groups can't be read gets none and is recorded in `failures`, with the
+	* read reported `incomplete`: what only its groups review is missing, while what names the user is still read.
+	* Organizations whose user could not be resolved are left out; the read already reports them.
+	*/
+	async getReviewerGroupsByOrganization(session, projects, userIds, failures) {
+		const byOrganization = /* @__PURE__ */ new Map();
+		const groupIds = /* @__PURE__ */ new Set();
+		let incomplete = false;
+		await Promise.all(uniqueAzureNames(projects.map((p) => p.resourceName)).map(async (org) => {
+			const userId = userIds.get(org.toLowerCase());
+			if (userId == null) return;
+			try {
+				const ids = await this.getReviewerGroupIds(session, org, userId);
+				byOrganization.set(org.toLowerCase(), ids);
+				for (const id of ids) groupIds.add(id);
+			} catch (ex) {
+				const resourceId = projects.find((p) => sameAzureName(p.resourceName, org)).resourceId;
+				failures.push(toCollectionScopeFailure({
+					providerId: this.id,
+					resourceId
+				}, ex));
+				incomplete = true;
+			}
+		}));
+		return {
+			byOrganization,
+			groupIds,
+			incomplete
+		};
+	}
 	async searchProviderPullRequests(session, searchQuery, repos, cancellation, options) {
 		if (cancellation?.aborted) throw new CancellationError();
 		const orgs = await this.getProviderResourcesForUser(session);
@@ -719,7 +931,7 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			return values;
 		}));
 		if (cancellation?.aborted) throw new CancellationError();
-		return [...new Map(providerPullRequests.map((pr) => [pr.url ?? `${pr.repository.id}:${pr.id}`, pr])).values()].filter((pr) => providerPullRequestMatchesSearch(pr, searchQuery)).map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects));
+		return [...new Map(providerPullRequests.map((pr) => [pr.url ?? `${pr.repository.id}:${pr.id}`, pr])).values()].filter((pr) => providerPullRequestMatchesSearch(pr, searchQuery)).map((pr) => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects, "text-search"));
 	}
 	async searchProviderMyIssues(session, repos) {
 		return (await this.searchProviderMyIssuesWithTruncation(session, repos))?.values;
@@ -779,7 +991,10 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 				projectId: p.name
 			});
 			return {
-				issues: result.values.map((i) => fromProviderIssue(i, this, { project: p })),
+				issues: result.values.map((i) => fromProviderIssue(i, this, {
+					project: p,
+					projection: "account"
+				})),
 				projectKey: `${p.resourceId}:${p.id}`,
 				truncated: result.truncated ?? false,
 				metadata: result.metadata
@@ -887,8 +1102,9 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 		this._organizations = void 0;
 		this._projects = void 0;
 		this._accounts = void 0;
+		this._reviewerGroupIds.clear();
 	}
-	fromAzureProviderPullRequest(azurePullRequest, repoDescriptors, projectDescriptors) {
+	fromAzureProviderPullRequest(azurePullRequest, repoDescriptors, projectDescriptors, projection) {
 		const baseRepoDescriptor = repoDescriptors.find((r) => r.id === azurePullRequest.repository.id);
 		const headRepoDescriptor = azurePullRequest.headRepository != null ? repoDescriptors.find((r) => r.id === azurePullRequest.headRepository.id) : void 0;
 		let project;
@@ -909,7 +1125,10 @@ var AzureDevOpsIntegrationBase = class extends GitHostIntegration {
 			}
 		};
 		if (baseRepoDescriptor?.projectName != null) project = projectDescriptors.find((p) => p.resourceName === baseRepoDescriptor.resourceName && p.name === baseRepoDescriptor.projectName);
-		return fromProviderPullRequest(azurePullRequest, this, { project });
+		return fromProviderPullRequest(azurePullRequest, this, {
+			project,
+			projection
+		});
 	}
 };
 const cloudMetadata = providersMetadata["azureDevOps"];
@@ -930,6 +1149,6 @@ var AzureDevOpsIntegration = class extends AzureDevOpsIntegrationBase {
 	}
 };
 //#endregion
-export { AzureDevOpsIntegration, AzureDevOpsIntegrationBase, getAzureRepositoryApiBaseUrl, getAzureRepositoryIdentity, sameAzureName, uniqueAzureNames };
+export { AzureDevOpsIntegration, AzureDevOpsIntegrationBase, getAzureRepositoryApiBaseUrl, getAzureRepositoryIdentity, markMyGroupReviews, sameAzureName, toAzureReviewerReads, uniqueAzureNames };
 
 //# sourceMappingURL=azureDevOps.js.map