Blame · Line-by-line history

`commit-statuses.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

commit-statuses.tsBlame158 lines · 1 contributor

Normal view Raw

0cdfd89Claude	1	/**
	2	* Block J8 — Commit status API (GitHub-parity).
	3	*
	4	* External CI / automation systems POST statuses against a (repo, sha, context)
	5	* triple. Reads are public for public repos (softAuth visibility check) and
	6	* writes require repo-owner auth (session / OAuth / PAT accepted by
	7	* requireAuth).
	8	*
	9	* POST /api/v1/repos/:owner/:repo/statuses/:sha
	10	* body: { state, context?, description?, target_url? }
	11	* 200: { ok: true, status }
	12	* 400: invalid state / sha
	13	* 401/403: auth / permission
	14	*
	15	* GET /api/v1/repos/:owner/:repo/commits/:sha/statuses
	16	* 200: { total, statuses: [...] }
	17	*
	18	* GET /api/v1/repos/:owner/:repo/commits/:sha/status
	19	* 200: { state, total, counts, contexts }
	20	*/
	21
	22	import { Hono } from "hono";
	23	import { and, eq } from "drizzle-orm";
	24	import { db } from "../db";
	25	import { repositories, users } from "../db/schema";
	26	import { softAuth, requireAuth } from "../middleware/auth";
	27	import type { AuthEnv } from "../middleware/auth";
	28	import {
	29	combinedStatus,
	30	isValidSha,
	31	isValidState,
	32	listStatuses,
	33	setStatus,
	34	} from "../lib/commit-statuses";
	35
	36	const statuses = new Hono<AuthEnv>();
	37
	38	async function resolveRepo(ownerName: string, repoName: string) {
	39	const [owner] = await db
	40	.select()
	41	.from(users)
	42	.where(eq(users.username, ownerName))
	43	.limit(1);
	44	if (!owner) return null;
	45	const [repo] = await db
	46	.select()
	47	.from(repositories)
	48	.where(
	49	and(eq(repositories.ownerId, owner.id), eq(repositories.name, repoName))
	50	)
	51	.limit(1);
	52	if (!repo) return null;
	53	return { owner, repo };
	54	}
	55
	56	// ---------------------------------------------------------------------------
	57	// POST status
	58	// ---------------------------------------------------------------------------
052c2e6Claude	59	/**
	60	* Handler body for POST <prefix>/repos/:owner/:repo/statuses/:sha — shared
	61	* between the v1 mount here (session/OAuth/PAT via softAuth+requireAuth) and
	62	* the v2 alias in `src/routes/api-v2.ts` (PAT via apiAuth+requireApiAuth +
	63	* `repo` scope). The behaviour is identical; the only difference is which
	64	* middleware stack authenticates the user.
	65	*/
	66	export async function postCommitStatusHandler(c: any) {
	67	const { owner: ownerName, repo: repoName, sha } = c.req.param();
	68	const user = c.get("user")!;
	69	if (!isValidSha(sha)) {
	70	return c.json({ error: "Invalid sha" }, 400);
	71	}
	72	const resolved = await resolveRepo(ownerName, repoName);
	73	if (!resolved) return c.json({ error: "Repository not found" }, 404);
	74	if (resolved.owner.id !== user.id) {
	75	return c.json({ error: "Forbidden" }, 403);
	76	}
0cdfd89Claude	77
052c2e6Claude	78	let body: any = {};
	79	try {
	80	body = await c.req.json();
	81	} catch {
	82	body = {};
	83	}
0cdfd89Claude	84
052c2e6Claude	85	const state = body.state;
	86	if (!isValidState(state)) {
	87	return c.json(
	88	{
	89	error:
	90	"Invalid state; must be one of pending, success, failure, error",
	91	},
	92	400
	93	);
	94	}
0cdfd89Claude	95
052c2e6Claude	96	const row = await setStatus({
	97	repositoryId: resolved.repo.id,
	98	commitSha: sha,
	99	state,
	100	context: body.context ?? body.Context ?? "default",
	101	description: body.description ?? null,
	102	targetUrl: body.target_url ?? body.targetUrl ?? null,
	103	creatorId: user.id,
	104	});
0cdfd89Claude	105
052c2e6Claude	106	if (!row) return c.json({ error: "Could not save status" }, 500);
0cdfd89Claude	107
052c2e6Claude	108	return c.json({ ok: true, status: row });
	109	}
	110
	111	statuses.post(
	112	"/api/v1/repos/:owner/:repo/statuses/:sha",
	113	softAuth,
	114	requireAuth,
	115	postCommitStatusHandler
0cdfd89Claude	116	);
	117
	118	// ---------------------------------------------------------------------------
	119	// GET statuses list
	120	// ---------------------------------------------------------------------------
	121	statuses.get(
	122	"/api/v1/repos/:owner/:repo/commits/:sha/statuses",
	123	softAuth,
	124	async (c) => {
	125	const { owner: ownerName, repo: repoName, sha } = c.req.param();
	126	if (!isValidSha(sha)) return c.json({ error: "Invalid sha" }, 400);
	127	const resolved = await resolveRepo(ownerName, repoName);
	128	if (!resolved) return c.json({ error: "Repository not found" }, 404);
	129	const user = c.get("user");
	130	if (resolved.repo.isPrivate && (!user \|\| user.id !== resolved.owner.id)) {
	131	return c.json({ error: "Forbidden" }, 403);
	132	}
	133	const rows = await listStatuses(resolved.repo.id, sha);
	134	return c.json({ total: rows.length, statuses: rows });
	135	}
	136	);
	137
	138	// ---------------------------------------------------------------------------
	139	// GET combined status
	140	// ---------------------------------------------------------------------------
	141	statuses.get(
	142	"/api/v1/repos/:owner/:repo/commits/:sha/status",
	143	softAuth,
	144	async (c) => {
	145	const { owner: ownerName, repo: repoName, sha } = c.req.param();
	146	if (!isValidSha(sha)) return c.json({ error: "Invalid sha" }, 400);
	147	const resolved = await resolveRepo(ownerName, repoName);
	148	if (!resolved) return c.json({ error: "Repository not found" }, 404);
	149	const user = c.get("user");
	150	if (resolved.repo.isPrivate && (!user \|\| user.id !== resolved.owner.id)) {
	151	return c.json({ error: "Forbidden" }, 403);
	152	}
	153	const combined = await combinedStatus(resolved.repo.id, sha);
	154	return c.json(combined);
	155	}
	156	);
	157
	158	export default statuses;