@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/github/routes.mutations.test.js

@@ -558,6 +558,245 @@ describe('canonical GitHub mutations', () => {
     if (status === 200) expect(response.body.target.number).toBe(7);
   });
 
+  describe('comments and reviews', () => {
+    const pullTarget = { project: { owner: 'acme', name: 'app' }, number: 7 };
+    const recordRequests = (respond) => {
+      const requests = [];
+      vi.stubGlobal('fetch', vi.fn(async (url, options) => {
+        const entry = { method: options.method, path: new URL(String(url)).pathname, body: options.body ? JSON.parse(options.body) : null };
+        requests.push(entry);
+        return respond(entry);
+      }));
+      return requests;
+    };
+
+    it('comments on a pull request after checking it belongs to the bound repository', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => (entry.method === 'GET' ? jsonResponse(pullRequest()) : jsonResponse({ id: 11 }, 201)));
+      const { app, store } = makeApp();
+
+      const response = await request(app).post('/api/source-control/github/pr/comment')
+        .send({ ...context(account.accountId, { target: pullTarget }), body: 'Looks good' }).expect(200);
+
+      expect(response.body.result).toEqual({});
+      expect(requests).toEqual([
+        { method: 'GET', path: '/repos/acme/app/pulls/7', body: null },
+        { method: 'POST', path: '/repos/acme/app/issues/7/comments', body: { body: 'Looks good' } },
+      ]);
+      expect(store.records.get('request-one')).toMatchObject({ kind: 'change-request-comment', state: 'succeeded' });
+    });
+
+    it('reviews the head commit the client read, with the text as the review body', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => (entry.method === 'GET'
+        ? jsonResponse(pullRequest())
+        : jsonResponse({ id: 12, state: entry.body.event === 'APPROVE' ? 'APPROVED' : 'CHANGES_REQUESTED' })));
+      const { app } = makeApp();
+      const target = { ...pullTarget, headSha: 'abc123' };
+
+      const approved = await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target }), verdict: 'approve' }).expect(200);
+      const requested = await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target, idempotencyKey: 'request-two' }), verdict: 'request-changes', body: 'Rename it' }).expect(200);
+
+      expect(approved.body.result).toEqual({ commented: false });
+      expect(requested.body.result).toEqual({ commented: true });
+      expect(requests.filter((entry) => entry.method === 'POST')).toEqual([
+        { method: 'POST', path: '/repos/acme/app/pulls/7/reviews', body: { commit_id: 'abc123', event: 'APPROVE' } },
+        { method: 'POST', path: '/repos/acme/app/pulls/7/reviews', body: { commit_id: 'abc123', event: 'REQUEST_CHANGES', body: 'Rename it' } },
+      ]);
+    });
+
+    it('refuses a review once the pull request moved past the commit the client read', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests(() => jsonResponse(pullRequest({ head: { ...pullRequest().head, sha: 'def456' } })));
+      const { app } = makeApp();
+
+      const response = await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target: { ...pullTarget, headSha: 'abc123' } }), verdict: 'approve' }).expect(409);
+
+      expect(response.body.code).toBe('SOURCE_CONTROL_MUTATION_TARGET_CHANGED');
+      expect(requests.map((entry) => entry.method)).toEqual(['GET']);
+    });
+
+    it('asks for text before requesting changes and for the reviewed commit, and writes nothing', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests(() => jsonResponse(pullRequest()));
+      const { app } = makeApp();
+
+      await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target: { ...pullTarget, headSha: 'abc123' } }), verdict: 'request-changes', body: '  ' }).expect(400);
+      await request(app).post('/api/source-control/github/pr/comment')
+        .send({ ...context(account.accountId, { target: pullTarget, idempotencyKey: 'request-two' }) }).expect(400);
+      await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target: pullTarget, idempotencyKey: 'request-three' }), verdict: 'approve' }).expect(400);
+
+      expect(requests).toEqual([]);
+    });
+
+    it("passes GitHub's reason when it refuses a review", async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      recordRequests((entry) => (entry.method === 'GET'
+        ? jsonResponse(pullRequest())
+        : jsonResponse({ message: 'Unprocessable Entity', errors: ['Review Can not approve your own pull request'] }, 422)));
+      const { app, store } = makeApp();
+
+      const response = await request(app).post('/api/source-control/github/pr/review')
+        .send({ ...context(account.accountId, { target: { ...pullTarget, headSha: 'abc123' } }), verdict: 'approve' }).expect(422);
+
+      expect(response.body).toEqual({ error: 'Review Can not approve your own pull request', code: 'SOURCE_CONTROL_MUTATION_REJECTED' });
+      expect(store.records.get('request-one')).toMatchObject({ state: 'failed', result: { failureStatus: 422 } });
+    });
+
+    it('comments on an issue and refuses a pull request number on the issue route', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => {
+        if (entry.method === 'POST') return jsonResponse({ id: 13 }, 201);
+        return entry.path.endsWith('/issues/8')
+          ? jsonResponse({ number: 8, pull_request: { url: 'https://api.github.com/repos/acme/app/pulls/8' } })
+          : jsonResponse({ number: 5 });
+      });
+      const { app, store } = makeApp();
+
+      const response = await request(app).post('/api/source-control/github/issues/comment')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 5 } }), body: 'On it' }).expect(200);
+      const refused = await request(app).post('/api/source-control/github/issues/comment')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 8 }, idempotencyKey: 'request-two' }), body: 'On it' }).expect(409);
+
+      expect(response.body.target).toEqual({
+        repositoryId: 'repo-one', bindingRevision: 3, primaryRemote: 'origin',
+        project: { id: 'acme/app', owner: 'acme', name: 'app' }, number: 5,
+      });
+      expect(refused.body.code).toBe('SOURCE_CONTROL_MUTATION_TARGET_INVALID');
+      expect(requests.filter((entry) => entry.method === 'POST')).toEqual([
+        { method: 'POST', path: '/repos/acme/app/issues/5/comments', body: { body: 'On it' } },
+      ]);
+      expect(store.records.get('request-one')).toMatchObject({ kind: 'issue-comment', state: 'succeeded' });
+    });
+
+    it('closes a pull request and reopens an issue, and passes GitHub\'s reason for a merged one', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => {
+        if (entry.path.endsWith('/pulls/7')) {
+          return entry.method === 'GET' ? jsonResponse(pullRequest()) : jsonResponse(pullRequest({ state: 'closed' }));
+        }
+        if (entry.path.endsWith('/pulls/9')) {
+          return entry.method === 'GET'
+            ? jsonResponse(pullRequest({ number: 9, html_url: 'https://github.com/acme/app/pull/9', state: 'closed', merged: true }))
+            : jsonResponse({ message: 'Validation Failed', errors: [{ message: 'state cannot be changed. The pull request has been merged.' }] }, 422);
+        }
+        return entry.method === 'GET' ? jsonResponse({ number: 5, state: 'closed' }) : jsonResponse({ number: 5, state: 'open' });
+      });
+      const { app, store } = makeApp();
+
+      const closed = await request(app).post('/api/source-control/github/pr/state')
+        .send({ ...context(account.accountId, { target: pullTarget }), state: 'closed' }).expect(200);
+      const reopened = await request(app).post('/api/source-control/github/issues/state')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 5 }, idempotencyKey: 'request-two' }), state: 'open' }).expect(200);
+      const merged = await request(app).post('/api/source-control/github/pr/state')
+        .send({ ...context(account.accountId, { target: { ...pullTarget, number: 9 }, idempotencyKey: 'request-three' }), state: 'open' }).expect(422);
+      await request(app).post('/api/source-control/github/pr/state')
+        .send({ ...context(account.accountId, { target: pullTarget, idempotencyKey: 'request-four' }), state: 'merged' }).expect(400);
+
+      expect(closed.body.result).toEqual({ state: 'closed' });
+      expect(reopened.body.result).toEqual({ state: 'open' });
+      expect(merged.body).toEqual({ error: 'state cannot be changed. The pull request has been merged.', code: 'SOURCE_CONTROL_MUTATION_REJECTED' });
+      expect(requests.filter((entry) => entry.method === 'PATCH')).toEqual([
+        { method: 'PATCH', path: '/repos/acme/app/pulls/7', body: { state: 'closed' } },
+        { method: 'PATCH', path: '/repos/acme/app/issues/5', body: { state: 'open' } },
+        { method: 'PATCH', path: '/repos/acme/app/pulls/9', body: { state: 'open' } },
+      ]);
+      expect(store.records.get('request-two')).toMatchObject({ kind: 'issue-state', state: 'succeeded', result: { state: 'open' } });
+    });
+
+    it.each([
+      ['closed', 'succeeded'],
+      ['open', 'failed'],
+    ])('reconciles an interrupted close from the issue being %s without writing again', async (current, outcome) => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const target = {
+        repositoryId: 'repo-one', bindingRevision: 3, primaryRemote: 'origin',
+        project: { id: 'acme/app', owner: 'acme', name: 'app' }, number: 5,
+      };
+      const actor = { provider: 'github', instance: 'github.com', accountId: account.accountId };
+      const input = { kind: 'issue-state', actor, credential: credentialFor(account), target, state: 'closed' };
+      const store = makeStore([{ key: 'request-one', inputDigest: digestMutationInput(input), kind: 'issue-state', actor, target, state: 'running' }]);
+      const fetch = vi.fn(async () => jsonResponse({ number: 5, state: current }));
+      vi.stubGlobal('fetch', fetch);
+      const { app } = makeApp({ store });
+
+      await request(app).post('/api/source-control/github/issues/state')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 5 } }), state: 'closed' })
+        .expect(outcome === 'succeeded' ? 200 : 409);
+
+      expect(store.records.get('request-one').state).toBe(outcome);
+      expect(fetch).toHaveBeenCalledOnce();
+    });
+
+    it('sets labels as one sorted set on pull requests and issues', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => {
+        if (entry.method === 'PUT') return jsonResponse(entry.body.labels.map((name) => ({ name })));
+        return entry.path.endsWith('/pulls/7') ? jsonResponse(pullRequest()) : jsonResponse({ number: 5, state: 'open' });
+      });
+      const { app, store } = makeApp();
+
+      await request(app).post('/api/source-control/github/pr/labels')
+        .send({ ...context(account.accountId, { target: pullTarget }), labels: ['docs', 'bug', 'docs'] }).expect(200);
+      await request(app).post('/api/source-control/github/issues/labels')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 5 }, idempotencyKey: 'request-two' }), labels: [] }).expect(200);
+      await request(app).post('/api/source-control/github/pr/labels')
+        .send({ ...context(account.accountId, { target: pullTarget, idempotencyKey: 'request-three' }), labels: ['  '] }).expect(400);
+
+      expect(requests.filter((entry) => entry.method === 'PUT')).toEqual([
+        { method: 'PUT', path: '/repos/acme/app/issues/7/labels', body: { labels: ['bug', 'docs'] } },
+        { method: 'PUT', path: '/repos/acme/app/issues/5/labels', body: { labels: [] } },
+      ]);
+      expect(store.records.get('request-two')).toMatchObject({ kind: 'issue-labels', state: 'succeeded' });
+    });
+
+    it('asks and stops asking reviewers so the requested set matches', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const requests = recordRequests((entry) => {
+        if (entry.path.endsWith('/requested_reviewers') && entry.method === 'GET') {
+          return jsonResponse({ users: [{ login: 'ann' }, { login: 'bob' }], teams: [] });
+        }
+        if (entry.path.endsWith('/requested_reviewers')) return jsonResponse(pullRequest());
+        return jsonResponse(pullRequest());
+      });
+      const { app } = makeApp();
+
+      const response = await request(app).post('/api/source-control/github/pr/reviewers')
+        .send({ ...context(account.accountId, { target: pullTarget }), reviewers: ['cid', 'ann'] }).expect(200);
+
+      expect(response.body.result).toEqual({});
+      expect(requests.filter((entry) => entry.method !== 'GET')).toEqual([
+        { method: 'POST', path: '/repos/acme/app/pulls/7/requested_reviewers', body: { reviewers: ['cid'] } },
+        { method: 'DELETE', path: '/repos/acme/app/pulls/7/requested_reviewers', body: { reviewers: ['bob'] } },
+      ]);
+    });
+
+    it('leaves a comment interrupted mid-write as outcome unknown instead of posting it again', async () => {
+      const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
+      const target = {
+        repositoryId: 'repo-one', bindingRevision: 3, primaryRemote: 'origin',
+        project: { id: 'acme/app', owner: 'acme', name: 'app' }, number: 5,
+      };
+      const actor = { provider: 'github', instance: 'github.com', accountId: account.accountId };
+      const input = { kind: 'issue-comment', actor, credential: credentialFor(account), target, body: 'On it' };
+      const store = makeStore([{ key: 'request-one', inputDigest: digestMutationInput(input), kind: 'issue-comment', actor, target, state: 'running' }]);
+      const fetch = vi.fn(async () => jsonResponse({}));
+      vi.stubGlobal('fetch', fetch);
+      const { app } = makeApp({ store });
+
+      const response = await request(app).post('/api/source-control/github/issues/comment')
+        .send({ ...context(account.accountId, { target: { project: pullTarget.project, number: 5 } }), body: 'On it' }).expect(409);
+
+      expect(response.body.code).toBe('SOURCE_CONTROL_MUTATION_OUTCOME_UNKNOWN');
+      expect(fetch).not.toHaveBeenCalled();
+    });
+  });
+
   it('does not retry or invalidate after a definite provider rejection', async () => {
     const account = await auth.setGitHubAuth({ accessToken: 'token-one', user: { id: 1, login: 'actor' } });
     const fetch = vi.fn(async () => jsonResponse({ message: 'rejected private payload' }, 422));

package/server/lib/github/routes.test.js

@@ -195,7 +195,7 @@ describe('GET /api/source-control/github/references', () => {
     });
 
     const res = await request(app).get('/api/source-control/github/references')
-      .query({ ...readContext(project), kind: 'issue', filter: 'created', query: 'crash' })
+      .query({ ...readContext(project), kind: 'issue', state: 'open', people: 'created', query: 'crash' })
       .expect(200);
 
     expect(res.body).toMatchObject({ connected: true, cursor: 'c1', hasMore: true, total: 31 });
@@ -224,12 +224,14 @@ describe('GET /api/source-control/github/references', () => {
       number: 4,
       state: 'OPEN',
       reviewDecision: 'APPROVED',
+      headCommit: { nodes: [] },
+      reviewRequests: { nodes: [] },
       additions: 1,
       deletions: 2,
       changedFiles: 1,
       comments: { totalCount: 0, nodes: [] },
       reviews: { nodes: [] },
-      commits: { nodes: [] },
+      commits: { totalCount: 0, nodes: [] },
     } } } }));
 
     const detail = await request(app).get('/api/source-control/github/references/detail')
@@ -248,6 +250,32 @@ describe('GET /api/source-control/github/references', () => {
     expect(graphqlCalls()).toBe(before);
   });
 
+  it("reads a repository's labels and assignable people for the board's pickers, only from the project repo network", async () => {
+    const fetch = vi.fn(async (url) => {
+      const endpoint = new URL(url);
+      if (endpoint.pathname === '/repos/example/project') return response({ full_name: 'example/project', fork: false });
+      if (endpoint.pathname === '/repos/example/project/labels') return response([{ name: 'bug', color: 'd73a4a' }, { name: 'docs', color: '' }]);
+      if (endpoint.pathname === '/repos/example/project/assignees') return response([{ login: 'octo', avatar_url: 'https://avatars/octo' }, { login: 'hubot' }]);
+      throw new Error(`Unexpected GitHub request: ${endpoint.pathname}`);
+    });
+    vi.stubGlobal('fetch', fetch);
+
+    const labels = await request(app).get('/api/source-control/github/references/labels')
+      .query({ ...readContext(project), owner: 'example', repo: 'project' }).expect(200);
+    const reviewers = await request(app).get('/api/source-control/github/references/reviewers')
+      .query({ ...readContext(project), owner: 'example', repo: 'project' }).expect(200);
+
+    expect(labels.body).toEqual({ connected: true, items: [{ name: 'bug', color: 'd73a4a' }, { name: 'docs' }] });
+    expect(reviewers.body).toEqual({ connected: true, items: [
+      { id: 'octo', login: 'octo', avatarUrl: 'https://avatars/octo' },
+      { id: 'hubot', login: 'hubot' },
+    ] });
+    const calls = fetch.mock.calls.length;
+    await request(app).get('/api/source-control/github/references/labels')
+      .query({ ...readContext(project), owner: 'someone', repo: 'else' }).expect(400);
+    expect(fetch.mock.calls.slice(calls).some(([url]) => String(url).includes('/labels'))).toBe(false);
+  });
+
   it('reads the statuses of listed PRs with the sidebar summaries, only from the project repo network', async () => {
     const fetch = serveGitHub((body) => {
       expect(body.variables).toMatchObject({ o0: 'example', n0: 'project', p0: 4, o1: 'example', n1: 'project', p1: 9 });
@@ -306,3 +334,107 @@ describe('GET /api/source-control/github/references', () => {
     expect(res.body).not.toHaveProperty('items');
   });
 });
+
+
+describe('pull request head for a worktree made by number', () => {
+  let github;
+  const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-github-pr-head-'));
+  const project = path.join(dataDir, 'project');
+  const headSha = 'ABCDEF0123456789abcdef0123456789abcdef01';
+  const forkPull = (overrides = {}) => ({
+    ...pull(42),
+    user: { login: 'alice', id: 9 },
+    head: {
+      ref: 'feature/fix',
+      sha: headSha,
+      repo: {
+        name: 'project',
+        owner: { login: 'alice' },
+        html_url: 'https://github.com/alice/project',
+        clone_url: 'https://github.com/alice/project.git',
+      },
+    },
+    ...overrides,
+  });
+
+  beforeAll(async () => {
+    process.env.OPENCHAMBER_DATA_DIR = dataDir;
+    fs.mkdirSync(project);
+    execFileSync('git', ['init', '-q', project]);
+    execFileSync('git', ['-C', project, 'remote', 'add', 'origin', 'https://github.com/example/project.git']);
+    const { setGitHubAuth, setGhCliDisabled } = await import('./auth.js');
+    setGhCliDisabled(true);
+    ({ accountId } = await setGitHubAuth({ accessToken: 'fake-test-token', user: { id: 7, login: 'tester' } }));
+    github = registerGitHubRoutes(express(), routeOptions());
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  afterAll(() => {
+    if (previousDataDir === undefined) delete process.env.OPENCHAMBER_DATA_DIR;
+    else process.env.OPENCHAMBER_DATA_DIR = previousDataDir;
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  });
+
+  const serveGitHub = (pullResponse) => {
+    const fetch = vi.fn(async (url) => {
+      const endpoint = new URL(url);
+      if (endpoint.pathname === '/repos/example/project') return response({ full_name: 'example/project', fork: false });
+      if (endpoint.pathname === '/repos/example/project/pulls/42') return pullResponse();
+      throw new Error(`Unexpected GitHub request: ${endpoint.pathname}`);
+    });
+    vi.stubGlobal('fetch', fetch);
+    return fetch;
+  };
+
+  it('answers the current account when no gh login is in use', async () => {
+    await expect(github.readCurrentAccountId()).resolves.toBe(accountId);
+  });
+
+  // A stand-in `gh` on PATH answers `gh auth token`, as the real CLI does.
+  it.skipIf(process.platform === 'win32')('treats only a rejected gh token as no account', async () => {
+    const binDirectory = path.join(dataDir, 'bin');
+    fs.mkdirSync(binDirectory, { recursive: true });
+    fs.writeFileSync(path.join(binDirectory, 'gh'), '#!/bin/sh\necho fake-gh-token\n', { mode: 0o755 });
+    const previousPath = process.env.PATH;
+    process.env.PATH = `${binDirectory}${path.delimiter}${previousPath}`;
+    const { setGhCliActive, setGhCliDisabled } = await import('./auth.js');
+    setGhCliDisabled(false);
+    setGhCliActive(true);
+    try {
+      vi.stubGlobal('fetch', vi.fn(async () => response({ message: 'Server Error' }, 500)));
+      await expect(github.readCurrentAccountId()).rejects.toMatchObject({ status: 500 });
+      vi.stubGlobal('fetch', vi.fn(async () => response({ message: 'Bad credentials' }, 401)));
+      await expect(github.readCurrentAccountId()).resolves.toBeNull();
+    } finally {
+      setGhCliActive(false);
+      setGhCliDisabled(true);
+      process.env.PATH = previousPath;
+    }
+  });
+
+  it('reads the project, head and head owner from the primary remote', async () => {
+    serveGitHub(() => response(forkPull()));
+    await expect(github.readChangeRequestHead({ context: readContext(project), number: 42 })).resolves.toEqual({
+      project: { id: 'example/project', owner: 'example', name: 'project' },
+      headSha: headSha.toLowerCase(),
+      headBranch: 'feature/fix',
+      headOwner: 'alice',
+    });
+  });
+
+  it('refuses a pull request whose fork was deleted', async () => {
+    serveGitHub(() => response(forkPull({ head: { ref: 'feature/fix', sha: headSha, repo: null } })));
+    await expect(github.readChangeRequestHead({ context: readContext(project), number: 42 }))
+      .rejects.toMatchObject({ status: 409, message: 'Pull request #42 has no branch to check out: its fork was deleted' });
+  });
+
+  it('refuses a number that is not a pull request there', async () => {
+    serveGitHub(() => response({ message: 'Not Found' }, 404));
+    await expect(github.readChangeRequestHead({ context: readContext(project), number: 42 }))
+      .rejects.toMatchObject({ status: 404, message: 'Pull request #42 was not found in example/project' });
+  });
+});

package/server/lib/gitlab/DOCUMENTATION.md

@@ -29,6 +29,9 @@ This module owns GitLab instance validation, authentication, remote resolution,
 - Resource payloads are converted to provider-neutral DTOs inside this module. Project web and clone URLs must match the selected instance and reported project path. Malformed canonical issue, nested issue identity and label data, issue-note, branch, fork metadata, merge-request list, merge-request note, and diff payloads fail the read rather than becoming partial, empty, or not-fork success. Raw GitBeaker payloads do not cross the server boundary.
 - CI lookup is partial enrichment. A jobs failure or malformed jobs payload leaves the merge request authoritative and returns `ci: null`.
 - GitLab supports merge and squash through the shared mutation. Rebase is not advertised because GitLab cannot perform it as the same atomic merge operation.
+- Comments and reviews are canonical mutations too: `/pr/comment` and `/issues/comment` post a note (an issue resolves in the bound project, `resolveIssueMutation`), `/pr/review` approves through the approvals API with the target's `headSha` (a moved head is a target mismatch) or requests changes through GraphQL `mergeRequestRequestChanges` (the REST API has no such call; the requester posts to `../graphql` from the REST base, so the same credential and no-redirect rules apply). GraphQL answers a refusal (not a reviewer, an older GitLab) with errors and status 200; that is a definite `422` failure. GitLab answers an approval it does not allow with `401`, which is reported as `403` so it never invalidates the account. A review's text is a separate note posted after the verdict; if it fails the verdict stands and the result says `commented: false`. Comments and reviews reconcile as `outcome-unknown`.
+- `/pr/state` and `/issues/state` close or reopen through `stateEvent` (`close`/`reopen`) and check the returned state. Restart reconciliation (`reconcileStateMutation`) reads the merge request or issue: the asked state succeeds, the other open/closed state is a definite not-applied failure. GitLab refuses to reopen a merged merge request.
+- `/pr/labels`, `/issues/labels` and `/pr/reviewers` set the whole set through `edit` (`labels` joined by commas, empty clears; `reviewerIds` by numeric user id), deduplicated and sorted for the digest. `reconcileSetMutation` succeeds only when the current set matches, else `outcome-unknown`. `GET /references/labels` and `/references/reviewers` read one page of the project's labels and active members (inherited too) for a project in the bound network. The timeline context carries `reviewers`.
 - The four merge-request mutation routes are canonical only. They require the complete repository binding context and durable idempotency executor; missing validation or execution support returns `501`. Validation runs before credential lookup, client creation, project resolution, or provider access, and mutation authentication uses only the validated account.
 - Canonical mutation target resolution starts only from the trusted primary remote and that project's declared fork parent. The expected target project must match one of those projects. Parent lookup failures fail the request. Create accepts `remote` only when it equals the primary remote. `headRemote` defaults to the primary remote; an explicit value resolves that exact remote without ranking or fallback and must map to the already established primary/parent network.
 - Update, merge, and ready preflight the expected project, merge-request number, head, base, and head SHA against strictly mapped provider state immediately before execution. Mutation preflight, mutation responses, and restart reconciliation also require an authoritative boolean `draft` or `work_in_progress` field. Broader resource reads retain compatibility with older payloads that omit those fields. Durable targets contain the repository and binding revisions, primary remote, server project identity, and actual merge-request coordinates. Digests cover the exact credential account ID and revision, resolved target, and every normalized operation input. Durable records never contain titles, descriptions, provider payloads, tokens, or remote URLs.
@@ -36,7 +39,7 @@ This module owns GitLab instance validation, authentication, remote resolution,
 - Restart reconciliation reads GitLab and never repeats a mutation. Running records resolve provider coordinates only when reconciliation needs them. Create succeeds only when one merge request exactly matches source project and branch plus target project and base. Update remains outcome-unknown because its private title and description are not persisted. Merge succeeds when GitLab reports merged, and ready succeeds when GitLab reports non-draft; authoritative unchanged states become definite failures where safe. Ambiguous or malformed results remain outcome-unknown.
 - Cross-process execution exclusion, lock errors, and stopped-writer orphan recovery follow the [source-control lock contract](../source-control/DOCUMENTATION.md#cross-process-locks-and-manual-recovery). A live or crashed owner's execution lock blocks reconciliation; restarting alone does not remove it.
 - `GET /pr/status` keeps a last-known answer per trusted read context (`source-control/status-cache.js`, 90 s TTL, credential revision in the key). A fresh repeat is answered from it unless `force` is set; a provider round trip is bounded to 12 s; a transient failure (unreachable, 429, 5xx, timeout) answers with the last-known status, or 503 when there is none, so a badge keeps its state through an outage. A refused credential (401) is never answered from it. A successful mutation drops the repository's entries; an invalidated account drops its own. Context, list, and history reads have no caches, and failed mutations do not alter unrelated server state.
-- Issue and merge-request list operations return open records for shared pickers. Direct number/context lookup can still resolve closed records.
+- Issue and merge-request lists take the pickers' `state` (`open` → `opened`, `closed`, `merged`, `all`) and `people` (`assigned` → `assigned_to_me`, `created` → `created_by_me`; `reviewRequested` filters merge requests by the account's own username, read once per service). Unknown values read as open and anyone. Direct number/context lookup resolves any record.
 - Shared picker and sidebar consumers select GitLab only from a matching repository remote. Self-managed hosts must already appear in source-control instance discovery; unknown hosts are never inferred as GitLab.
 
 ## Structure
@@ -47,6 +50,7 @@ This module owns GitLab instance validation, authentication, remote resolution,
 - `verify.js` and `user.js`: token verification and payload parsing.
 - `glab-credential.js`: host-scoped CLI credential retrieval.
 - `client.js`: GitBeaker client factory with OpenChamber's own requester: redirects are refused so the credential header never leaves the instance, and only reads retry after 429/502. Mutations are sent once so an ambiguous proxy failure reaches the durable executor.
+- `changeRequestContext` with `includeTimeline` (`/pulls/context?timeline=1`, only the board and picker preview ask) also returns the newest 50 `commits`, oldest first, `commitsComplete: false` when there are more, and `verdicts`: approvals and change requests GitLab records as system notes. Without it the context carries neither and makes no commit request, so attaching a merge request costs what it did.
 - Resource lists page by GitLab's `x-next-page` header. Notes, diffs, issue comments, and branches are read to completion within 20 pages of 100; past that the read fails rather than returning a capped list as complete. Merges send the preflighted head as `sha`, and GitLab's 409 maps to `SOURCE_CONTROL_MUTATION_TARGET_MISMATCH`. Fork merge requests expose their source project as `headProject`, and CI jobs are read from the pipeline's own project.
 - `repo.js`: instance-bound remote parsing, ranking, and directory resolution.
 - `mappers.js`: GitLab payload validation and provider-neutral DTO conversion.

package/server/lib/gitlab/auth-storage.test.js

@@ -167,3 +167,4 @@ describe('source-control auth storage', () => {
     });
   });
 });
+

package/server/lib/gitlab/mappers.js

@@ -4,7 +4,7 @@ import { parseGitLabRemoteUrl } from './repo.js';
 const text = (value) => isString(value) ? value : '';
 const integer = (value) => Number.isInteger(value) && value >= 0 ? value : null;
 
-function mapGitLabUser(value, identity) {
+export function mapGitLabUser(value, identity) {
   if (!isPlainObject(value) || integer(value.id) === null || !text(value.username)) return null;
   const user = { ...identity, id: String(value.id), username: value.username };
   if (text(value.avatar_url)) user.avatarUrl = value.avatar_url;
@@ -125,6 +125,35 @@ export function mapGitLabNote(value, identity, fallbackUrl = '') {
   return note;
 }
 
+// GitLab writes a review verdict as a system note on the merge request.
+const VERDICT_NOTES = new Map([
+  ['approved this merge request', 'approved'],
+  ['requested changes', 'changes_requested'],
+]);
+
+/** A system note that records an approval or a change request; null for any other note. */
+export function mapGitLabVerdictNote(value, identity, fallbackUrl = '') {
+  if (!isPlainObject(value) || value.system !== true || !isString(value.body)) return null;
+  const state = VERDICT_NOTES.get(value.body.trim().toLowerCase());
+  if (!state) return null;
+  const verdict = { state, url: text(value.web_url) || fallbackUrl, createdAt: text(value.created_at) ? value.created_at : null };
+  const author = mapGitLabUser(value.author, identity);
+  if (author) verdict.author = author;
+  return verdict;
+}
+
+/** A merge request commit as the preview's timeline shows it. */
+export function mapGitLabCommit(value) {
+  if (!isPlainObject(value) || !text(value.id)) return null;
+  return {
+    sha: value.id,
+    headline: text(value.title) || '',
+    authorName: text(value.author_name) || null,
+    committedAt: text(value.committed_date) || text(value.created_at) || null,
+    url: text(value.web_url) || null,
+  };
+}
+
 export function mapGitLabDiff(value) {
   if (!isPlainObject(value) || (!text(value.new_path) && !text(value.old_path))) return null;
   const file = {