gitpane 1.0.0__py3-none-any.whl

gitpane/commit/commit_metadata.py

@@ -0,0 +1,88 @@
+"""Select commit verification candidates without reading otherwise clean file contents."""
+
+from __future__ import annotations
+
+import ctypes
+import os
+from ctypes import wintypes
+from typing import TYPE_CHECKING
+
+from gitpane.worktree.worktree_file import stat_identity, validate_destination
+
+if TYPE_CHECKING:
+    from gitpane.history.repository_value import RepositoryContext
+
+FILE_READ_ATTRIBUTES = 0x0080
+FILE_SHARE_READ_WRITE_DELETE = 0x0007
+OPEN_EXISTING = 3
+FILE_FLAG_BACKUP_SEMANTICS = 0x02000000
+FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000
+FILE_BASIC_INFO_CLASS = 0
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+
+
+class _FileBasicInformation(ctypes.Structure):
+    """Match the Windows structure that distinguishes change time from creation time."""
+
+    _fields_ = [("creation_time", ctypes.c_longlong), ("last_access_time", ctypes.c_longlong), ("last_write_time", ctypes.c_longlong),
+                ("change_time", ctypes.c_longlong), ("file_attributes", wintypes.DWORD)]
+
+
+if os.name == "nt":
+    _kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+    _kernel.CreateFileW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, wintypes.DWORD, ctypes.c_void_p, wintypes.DWORD, wintypes.DWORD, wintypes.HANDLE]
+    _kernel.CreateFileW.restype = wintypes.HANDLE
+    _kernel.GetFileInformationByHandleEx.argtypes = [wintypes.HANDLE, ctypes.c_int, ctypes.c_void_p, wintypes.DWORD]
+    _kernel.GetFileInformationByHandleEx.restype = wintypes.BOOL
+    _kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+    _kernel.CloseHandle.restype = wintypes.BOOL
+
+
+def _windows_change_time(filename: str) -> int:
+    """Read NTFS change time because Windows stat ctime can still mean creation time."""
+    handle = _kernel.CreateFileW(filename, FILE_READ_ATTRIBUTES, FILE_SHARE_READ_WRITE_DELETE, None, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, None)
+    if handle == INVALID_HANDLE_VALUE:
+        raise ctypes.WinError(ctypes.get_last_error())
+    try:
+        information = _FileBasicInformation()
+        if not _kernel.GetFileInformationByHandleEx(handle, FILE_BASIC_INFO_CLASS, ctypes.byref(information), ctypes.sizeof(information)):
+            raise ctypes.WinError(ctypes.get_last_error())
+        return information.change_time
+    finally:
+        _kernel.CloseHandle(handle)
+
+
+def read_path_metadata(filename: str) -> tuple[int, ...] | None:
+    """Read the identity and change time of one absolute path without opening its content.
+
+    Answers None only when the path does not exist; an access error or a path that changes while it is read is
+    propagated, never replaced by the modification time alone. Git can miss a same-size write whose modification time
+    was put back; the Windows ChangeTime survives that restoration, and POSIX stat already supplies the change ctime.
+    Opening a Windows handle for these attributes reads no byte of the file.
+    """
+    try:
+        identity = stat_identity(os.lstat(filename))
+    except FileNotFoundError:
+        return None
+    change_time = _windows_change_time(filename) if os.name == "nt" else os.lstat(filename).st_ctime_ns
+    if identity != stat_identity(os.lstat(filename)):
+        raise ValueError("A file changed while its metadata was read")
+    return (*identity, change_time)
+
+
+def read_commit_metadata(context: RepositoryContext, paths: tuple[bytes, ...]) -> dict[bytes, tuple[int, ...] | None]:
+    """Observe tracked-file identities and change times; propagate inaccessible or unstable reads."""
+    metadata_by_path: dict[bytes, tuple[int, ...] | None] = {}
+    for path in paths:
+        if path in metadata_by_path:
+            continue
+        filename, parents = validate_destination(context, path, allow_missing_parents=True)
+        metadata = read_path_metadata(filename)
+        if metadata is None:
+            metadata_by_path[path] = None
+            continue
+        _filename, after_parents = validate_destination(context, path, allow_missing_parents=True)
+        if parents != after_parents:
+            raise ValueError("Working directory changed during commit metadata verification")
+        metadata_by_path[path] = metadata
+    return metadata_by_path

gitpane/commit/commit_push.py

@@ -0,0 +1,276 @@
+"""Keep a successful local commit separate from its later network delivery."""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, Signal
+
+from gitpane.account.authentication import transfer_account
+from gitpane.config import LOCAL_PREFIX
+from gitpane.history.file_history import WindowCapability
+from gitpane.operation.console_line import NOT_STARTED_STATUS_SET
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.repository_operation import OperationIntent
+from gitpane.process.process_runner import READ_PROFILE
+from gitpane.reference.reference_edit import reference_signature
+from gitpane.transport.branch_exchange import TransportRequest
+from gitpane.transport.refusal_notice import failure_headline, failure_summary
+from gitpane.transport.remote_config import config_signature, default_push_destination_name, fetch_remote_name
+from gitpane.worktree.command_sequence import FileTask, GitCommand
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator
+
+    from gitpane.commit.commit_write import CommitOutcome, CommitRequest
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.transport.branch_exchange import PushTarget, TransportOutcome, TransportRun, TransportService
+    from gitpane.transport.remote_config import RemoteSnapshot
+
+COMMIT_PUSH_CHOOSE = "Commit created. Choose a push destination."
+COMMIT_PUSH_FAILED = "Commit created, but push failed. The local commit is kept. Review the details and retry the push."
+NO_PROPOSED_REMOTE_TEXT = "Push proposes no remote for this branch."
+NO_PROPOSED_DESTINATION_TEXT = "Push proposes no remote branch for this branch."
+
+
+@dataclass(frozen=True)
+class PushDestination:
+    """Retain the remote, branch and exact endpoint the toolbar Push window proposes."""
+
+    remote_name: str
+    destination_ref: str
+    target: PushTarget
+
+
+@dataclass(frozen=True)
+class CommitPushIntent:
+    """Bind the sole commit request to its original branch, config and window authority.
+
+    ``reason`` explains why the push did not happen by itself; ``push_failed`` tells that it comes from a push that ran
+    and failed, so the Push window shows it as a failure rather than as a routing note. ``reason_headline`` is the
+    sentence naming the address and account a refused push used; it is kept apart from ``reason`` because the Push
+    window filters the reason but not this sentence, which holds no secret.
+    """
+
+    operation: OperationIntent
+    commit_request: CommitRequest
+    source_ref: str = ""
+    snapshot: RemoteSnapshot | None = None
+    destination: PushDestination | None = None
+    created_oid: str = ""
+    reason: str = ""
+    push_failed: bool = False
+    reason_headline: str = ""
+
+
+class CommitPushService(QObject):
+    """Own the chain beyond staging closure and never replay a successful commit."""
+
+    choose_requested = Signal(object, str)
+    push_started = Signal(object)
+    # The commit exists and has a complete destination: the controller decides on the tracking reference from the
+    # capture taken before the commit, asking the user when nothing decides it already, then calls push_after_decision.
+    tracking_decision_requested = Signal(object)
+
+    def __init__(self, transport: TransportService, *, current_operation: Callable[[OperationIntent], OperationIntent | None], parent: QObject | None = None) -> None:
+        """Inject transport and the live management authority for each independent repository."""
+        super().__init__(parent)
+        self.transport = transport
+        self.current_operation = current_operation
+        self.intent_by_id: dict[str, CommitPushIntent] = {}
+        self.intent_by_push_id: dict[str, CommitPushIntent] = {}
+        self.finished_id_set: set[str] = set()
+        transport.finished.connect(self._push_finished)
+
+    def resolve_destination(self, snapshot: RemoteSnapshot, source_ref: str) -> PushDestination:
+        """Pick the remote, branch and address the toolbar Push window proposes for the current branch.
+
+        Commit & push sends exactly where Push would send. Git's own push defaults (push.default, pushRemote,
+        remote.pushDefault, a configured push mapping) are not followed, as Push does not follow them. An upstream is set
+        only as Push sets it: after the tracking question answered Yes, or a kept Always add, and once the Push is
+        verified. Without a complete proposal (no remote, several addresses, no remote branch), the created commit
+        waits for a choice in the Push window.
+        """
+        if not source_ref.startswith(LOCAL_PREFIX) or source_ref not in snapshot.tracking_by_ref:
+            raise ValueError("A current local branch is required for a default push.")
+        remote_name = fetch_remote_name(snapshot, source_ref)
+        entry = snapshot.entry_by_name.get(remote_name)
+        if entry is None:
+            raise ValueError(NO_PROPOSED_REMOTE_TEXT)
+        if len(entry.push_urls) != 1:
+            raise ValueError("The default Push remote needs one unambiguous endpoint.")
+        endpoint, = entry.push_urls
+        destination_name = default_push_destination_name(snapshot, source_ref, remote_name)
+        if not destination_name:
+            raise ValueError(NO_PROPOSED_DESTINATION_TEXT)
+        return PushDestination(remote_name, LOCAL_PREFIX + destination_name, self.transport.capture_push_target(snapshot, remote_name, endpoint))
+
+    def capture(self, operation: OperationIntent, request: CommitRequest, complete: Callable[[CommitPushIntent | None, Exception | None], None]) -> None:
+        """Read routing before the sole commit submission without contacting any server."""
+        if (operation.capability != WindowCapability.MANAGE or self.current_operation(operation) is None or request.operation_id in self.intent_by_id
+                or request.snapshot.context != operation.context or request.snapshot.git_filename != operation.git_filename or request.key != operation.key):
+            complete(None, ValueError("Commit & push is no longer authorized."))
+            return
+        intent = CommitPushIntent(operation, request)
+        self.intent_by_id[request.operation_id] = intent
+        captured_ref: str | None = None
+
+        def read() -> Generator:
+            """Capture HEAD and its destination in one routing capture under the original index authority.
+
+            The capture observes HEAD between its own reference signatures. When it fails, HEAD is read alone, only while
+            the operation is still current, so a routing error still allows the commit with a manual push choice.
+            """
+            nonlocal captured_ref
+            try:
+                snapshot = yield from self.transport.remote.capture(operation.context, operation.git_filename, operation.generation)
+            except (ValueError, OSError, RuntimeError):
+                if self.current_operation(operation) is None:
+                    raise
+                captured_ref = yield from self._read_current_head(operation.context)
+                raise
+            if snapshot.head_ref is None:
+                raise ValueError("The current branch could not be captured.")
+            source_ref = snapshot.head_ref
+            captured_ref = source_ref
+            reason = ""
+            destination = None
+            try:
+                destination = self.resolve_destination(snapshot, source_ref)
+            except (ValueError, OSError, RuntimeError) as error:
+                reason = str(error)
+            return replace(intent, commit_request=replace(request, expected_head_ref=source_ref), source_ref=source_ref, snapshot=snapshot, destination=destination, reason=reason)
+
+        def captured(value: CommitPushIntent | None, error: Exception | None) -> None:
+            """Preserve a recoverable routing failure while rejecting revoked commit authority."""
+            if self.current_operation(operation) is None:
+                complete(None, ValueError("Commit & push is no longer authorized."))
+                return
+            if captured_ref is None:
+                complete(None, error or ValueError("The current branch could not be captured."))
+                return
+            value = value or replace(intent, commit_request=replace(request, expected_head_ref=captured_ref), source_ref=captured_ref, reason=str(error))
+            self.intent_by_id[request.operation_id] = value
+            complete(value, None)
+
+        self.transport.remote.worktree_service.run(operation.context, operation.git_filename, read(), captured)
+
+    def commit_finished(self, outcome: CommitOutcome) -> None:
+        """Accept only the successful outcome's observed OID, once, after staging closes."""
+        intent = self.intent_by_id.get(outcome.operation_id)
+        if intent is None or outcome.operation_id in self.finished_id_set:
+            return
+        if outcome.key != intent.commit_request.key or (outcome.after is not None and outcome.after.snapshot.context != intent.operation.context):
+            return
+        self.finished_id_set.add(outcome.operation_id)
+        if outcome.status != OperationStatus.SUCCESS or outcome.after is None or not outcome.after.snapshot.head_oid:
+            return
+        intent = replace(intent, created_oid=outcome.after.snapshot.head_oid)
+        self.intent_by_id[outcome.operation_id] = intent
+        if intent.destination is None or intent.snapshot is None:
+            self.choose_requested.emit(intent, COMMIT_PUSH_CHOOSE)
+            return
+        self.tracking_decision_requested.emit(intent)
+
+    def push_after_decision(self, intent: CommitPushIntent, add_tracking: bool, not_sent: Callable[[], None]) -> None:
+        """Read the configuration, HEAD and destination again once the tracking reference is decided, then push the created commit.
+
+        The decision can wait on the user as long as they like, so this read comes after it and right before the Push:
+        a remote address, account or branch changed meanwhile sends the same created commit to the Push window instead.
+        ``add_tracking`` links the branch to the remote branch once the Push is verified. ``not_sent`` runs when the
+        window's management authority or the captured commit is gone, before or after the read, so nothing is pushed.
+        """
+        operation = self.current_operation(intent.operation)
+        if operation is None:
+            not_sent()
+            return
+
+        def read() -> Generator:
+            """Reject changed config or branch identity while retaining the created commit."""
+            if config_signature(intent.snapshot.context, intent.snapshot.values) != intent.snapshot.signature:
+                raise ValueError("Push configuration changed after the commit.")
+            snapshot = yield from self.transport.remote.capture(operation.context, operation.git_filename, operation.generation)
+            branch = snapshot.tracking_by_ref.get(intent.source_ref)
+            # The branch name comes from HEAD itself: another branch can hold the same commit.
+            if (snapshot.head_ref is None or snapshot.head_ref != intent.source_ref or snapshot.head_oid != intent.created_oid
+                    or branch is None or branch.oid != intent.created_oid):
+                raise ValueError("HEAD changed after the commit.")
+            if snapshot.values != intent.snapshot.values or self.resolve_destination(snapshot, intent.source_ref) != intent.destination:
+                raise ValueError("The default push destination changed after the commit.")
+            return snapshot
+
+        def ready(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Route a stale or failed destination to the same immutable commit's Push form, else push to the destination just read."""
+            if error is not None:
+                self.choose_requested.emit(replace(intent, reason=str(error)), COMMIT_PUSH_CHOOSE)
+                return
+            destination = intent.destination
+            if self.retry_push(intent, snapshot, destination.remote_name, destination.target.endpoint, destination.destination_ref, destination.target,
+                               add_tracking=add_tracking) is None:
+                not_sent()
+
+        self.transport.remote.worktree_service.run(operation.context, operation.git_filename, read(), ready)
+
+    def _read_current_head(self, context: RepositoryContext) -> Generator:
+        """Read the branch HEAD is on, alone, after a failed routing capture, and only if no reference moved meanwhile.
+
+        Answers the full branch name, or an empty string for a detached HEAD. A failed or cut answer, or references
+        that moved during the read, refuse the commit rather than guessing which branch it would land on.
+        """
+        before = yield FileTask(lambda: reference_signature(context))
+        output = yield GitCommand(["symbolic-ref", "--quiet", "HEAD"], accepted_codes=(0, 1), profile=READ_PROFILE)
+        after = yield FileTask(lambda: reference_signature(context))
+        if before != after:
+            raise ValueError("The current branch changed while capturing Commit & push.")
+        if output and not output.endswith(b"\n"):
+            raise ValueError("Git returned an incomplete current branch.")
+        return output.decode("utf-8", "surrogateescape").strip()
+
+    def retry_push(self, intent: CommitPushIntent, snapshot: RemoteSnapshot, remote_name: str, endpoint: str, destination_ref: str, target: PushTarget,
+                   force: bool = False, *, add_tracking: bool = False) -> TransportRun | None:
+        """Submit only the already-created commit under freshly selected destination authority, the way the toolbar Push sends.
+
+        ``add_tracking`` links the branch to the remote branch once the Push is verified, as the tracking answer asked.
+        """
+        operation = self.current_operation(intent.operation)
+        captured = self.intent_by_id.get(intent.commit_request.operation_id)
+        if (not intent.created_oid or operation is None or operation.capability != WindowCapability.MANAGE or captured is None
+                or captured.created_oid != intent.created_oid or captured.commit_request != intent.commit_request or captured.operation != intent.operation or captured.source_ref != intent.source_ref):
+            return None
+        operation = replace(operation, operation_id=uuid.uuid4().hex, operation="Push", targets=(intent.created_oid, destination_ref, endpoint))
+        snapshot = replace(snapshot, generation=operation.generation)
+        self.intent_by_push_id[operation.operation_id] = intent
+        run = self.transport.push(TransportRequest(operation, mode="push", snapshot=snapshot, remote_name=remote_name, source_ref=intent.source_ref,
+                                                   source_oid=intent.created_oid, destination_ref=destination_ref, endpoint=endpoint, push_target=target, force=force,
+                                                   immutable_commit=True, add_tracking=add_tracking))
+        self.push_started.emit(run)
+        return run
+
+    def _push_finished(self, outcome: TransportOutcome) -> None:
+        """Offer a push-only recovery after an unsuccessful push without touching the local commit.
+
+        The note under the created commit is red only when Git really contacted the remote and the push failed there,
+        a refused authentication on the first contact included. A push refused before any contact, for example by a
+        destination name Git rejects, only asks to choose a destination.
+
+        The reason shown is the same short summary as the Push console's: a sentence naming the address and the account
+        used when the server refused it, then Git's own lines. An account already known to have lost its stored secret
+        is said to need a reconnect there too; one found out later is only marked in the Push console and in Settings.
+        """
+        intent = self.intent_by_push_id.get(outcome.operation_id)
+        if intent is not None and outcome.status != OperationStatus.SUCCESS:
+            run = self.transport.run_by_id[outcome.operation_id]
+            # A recorded step whose process never started, refused by its launch check for instance, contacted no server;
+            # checks refused before any process record no step at all.
+            attempted = False
+            for step in run.steps:
+                if step.process_status not in NOT_STARTED_STATUS_SET:
+                    attempted = True
+                    break
+            reason, headline = intent.reason, ""
+            if outcome.diagnostic:
+                reason = failure_summary(outcome.diagnostic)
+                headline = failure_headline(outcome.diagnostic, transfer_account(outcome.selection, outcome.endpoint, self.transport.authentication.missing_secret_namespace_set))
+            self.choose_requested.emit(replace(intent, reason=reason, reason_headline=headline, push_failed=attempted), COMMIT_PUSH_FAILED if attempted else COMMIT_PUSH_CHOOSE)