flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh

git agents cloudflare rust forge mcp

1,973 linesCode BlameRaw

1	//! A repository's lifecycle after it is made: renaming it, archiving it,
2	//! making it public or private, changing or renaming its default branch,
3	//! and deleting it with a window to restore it.
4	//!
5	//! Deleting is soft. The row gets `deleted_at` and `purge_after`
6	//! ([`RESTORE_DAYS`] on), every read in the registry leaves it out, git
7	//! refuses it, and `repo.deleted` tells every service to stop what runs for
8	//! it and hide it. Restoring clears the columns (`repo.restored`). Purging,
9	//! by an owner from the Recently deleted list or by the hourly sweep once
10	//! `purge_after` has passed, removes the git data from the store, then the
11	//! rows (its pull requests' working copies with it) and its redirects, and
12	//! announces `repo.purged`, on which services drop what they keep for it.
13	//! Until then its name stays taken, so a restore always has its path back.
14	//!
15	//! A rename is a path change like a transfer: the old path is kept in
16	//! `repo_redirects`, the git store key never changes, the tokens of agents
17	//! at work on it are moved with identity, and `repo.renamed` is handled by
18	//! services with the same helper as `repo.transferred`
19	//! (`g1t_kit::transfer`).
20
21	use g1t_contracts::audit::{
22	AuditActor, AuditOutcome, AuditTarget, NewAuditEntry, RecordAuditArgs, Surface,
23	};
24	use g1t_contracts::events::{
25	BranchRenamed, NewEvent, RepoArchived, RepoDefaultBranchChanged, RepoDeleted, RepoPurged,
26	RepoRenamed, RepoRestored, RepoUpdated, RepoVisibilityChanged, WorkspaceDeleted,
27	WorkspaceDeleting, WorkspaceRestored,
28	};
29	use g1t_contracts::identity::TransferRepoScopesArgs;
30	use g1t_contracts::repos::{
31	ArchiveArgs, Branch, CreateBranchArgs, DeleteArgs, DeletedArgs, DeletedRepo, DeletedRepoArgs,
32	PurgeDueArgs, RESTORE_DAYS, RemoveBranchArgs, RenameArgs, RenameBranchArgs, Repo, RepoPath,
33	RepoStatus, ResolveBranchArgs,
34	SetDefaultBranchArgs, SetVisibilityArgs, StatusByIdArgs, archived_message,
35	is_valid_branch_name,
36	};
37	use g1t_contracts::access::{self, Capability, RepoRole};
38	use g1t_contracts::time::rfc3339;
39	use g1t_contracts::{FailureCode, Outcome, PrincipalKind, Role, User, is_valid_repo_name, new_id};
40	use g1t_kit::now_ms;
41	use serde::Deserialize;
42	use worker::Result;
43	use worker::wasm_bindgen::JsValue;
44
45	use crate::registry::{Registry, remember_store, store_key};
46	use crate::store::{GitRepo, GitStore, Scope};
47	use crate::{Repos, SOURCE, UNVERIFIED, git_ops, land, not_found};
48
49	use crate::land::EMPTY_PACK;
50
51	/// How many pull request working copies follow a change of the default
52	/// branch (newest first). Older ones keep the branch they were made with.
53	const FORKS_FOLLOWING: u32 = 100;
54
55	/// How many deleted repositories one sweep purges.
56	const PURGES_PER_SWEEP: u32 = 25;
57
58	type Refusal = (FailureCode, String);
59
60	/// Who is asking, as far as an owner's or an admin's action cares.
61	#[derive(Clone, Copy, Debug)]
62	pub struct Asker {
63	/// A person, not a workspace's or an agent's token.
64	pub person: bool,
65	pub verified: bool,
66	/// Their role in the repository's workspace.
67	pub role: Option<Role>,
68	/// Their role on the repository itself (see g1t_contracts::access).
69	/// None where only the workspace is known, as for deleted ones.
70	pub repo_role: Option<RepoRole>,
71	/// The workspace's member privileges, as their membership carries them.
72	pub privileges: g1t_contracts::MemberPrivileges,
73	}
74
75	impl Asker {
76	pub fn of(user: &User, namespace: &str) -> Self {
77	Asker {
78	person: user.kind == PrincipalKind::User,
79	verified: user.verified,
80	role: user.role_in(&namespace.to_lowercase()),
81	repo_role: None,
82	privileges: user.privileges_in(&namespace.to_lowercase()),
83	}
84	}
85
86	/// The asker, with their role on `repo`.
87	pub fn on(user: &User, repo: &Repo) -> Self {
88	Asker {
89	repo_role: crate::registry::role(repo, &Some(user.clone())),
90	..Asker::of(user, &repo.namespace)
91	}
92	}
93	}
94
95	/// Whether `asker` may `what` ("rename", "archive"...) a repository of
96	/// `namespace` that takes `capability`: a verified person with the role
97	/// the permission table asks (Admin), and for changing visibility,
98	/// transferring and deleting, an owner of the workspace as well, unless its
99	/// member privileges let its members with Admin do it.
100	pub fn admin_only(asker: Asker, namespace: &str, what: &str, capability: Capability) -> std::result::Result<(), Refusal> {
101	let admins_may = asker.role == Some(Role::Member)
102	&& asker.repo_role == Some(RepoRole::Admin)
103	&& !access::owner_only(capability, &asker.privileges);
104	if access::OWNER_ONLY.contains(&capability) && !admins_may {
105	// Someone who can see the repository is told why, not that it is missing.
106	if asker.role.is_none() && asker.repo_role.is_some() && asker.person {
107	return Err((
108	FailureCode::Forbidden,
109	format!("Only an owner of {namespace} can {what} its repositories."),
110	));
111	}
112	return owner_only(asker, namespace, what);
113	}
114	if asker.role.is_none() && asker.repo_role.is_none() {
115	return Err((FailureCode::NotFound, "Repository not found.".into()));
116	}
117	if !asker.person {
118	return Err((
119	FailureCode::Forbidden,
120	format!("Only a person can {what} a repository. Sign in, or use a personal access token."),
121	));
122	}
123	if !asker.repo_role.is_some_and(\|role\| access::allows(role, capability)) {
124	return Err((
125	FailureCode::Forbidden,
126	format!(
127	"You need the {} role on a repository of {namespace} to {what} it.",
128	access::least_role(capability).label()
129	),
130	));
131	}
132	if !asker.verified {
133	return Err((FailureCode::Forbidden, UNVERIFIED.into()));
134	}
135	Ok(())
136	}
137
138	/// Making a repository public or private is, as far as the workspace's
139	/// member privileges go, creating one of that kind: a member may only make
140	/// it what they may create.
141	pub fn visibility_refusal(actor: &User, repo: &Repo, private: bool) -> Option<String> {
142	if repo.is_private == private {
143	return None;
144	}
145	let role = actor.role_in(&repo.namespace.to_lowercase())?;
146	actor.privileges_in(&repo.namespace.to_lowercase()).creation_refusal(role, private, &repo.namespace)
147	}
148
149	/// Whether `asker` may `what` ("delete", "rename"...) a repository of
150	/// `namespace`: a verified person who owns the workspace.
151	pub fn owner_only(asker: Asker, namespace: &str, what: &str) -> std::result::Result<(), Refusal> {
152	if asker.role.is_none() {
153	return Err((FailureCode::NotFound, "Repository not found.".into()));
154	}
155	if !asker.person {
156	return Err((
157	FailureCode::Forbidden,
158	format!("Only a person can {what} a repository. Sign in, or use a personal access token."),
159	));
160	}
161	if asker.role != Some(Role::Owner) {
162	return Err((
163	FailureCode::Forbidden,
164	format!("Only an owner of {namespace} can {what} its repositories."),
165	));
166	}
167	if !asker.verified {
168	return Err((FailureCode::Forbidden, UNVERIFIED.into()));
169	}
170	Ok(())
171	}
172
173	/// Whether what was typed to confirm names the repository: its full name,
174	/// `namespace/name`, in any case.
175	pub fn confirmed(path: &RepoPath, typed: &str) -> bool {
176	typed.trim().to_lowercase() == format!("{}/{}", path.namespace, path.name).to_lowercase()
177	}
178
179	fn confirm_refusal(path: &RepoPath) -> Refusal {
180	(
181	FailureCode::Invalid,
182	format!("Type {}/{} to confirm.", path.namespace, path.name),
183	)
184	}
185
186	/// When a repository deleted at `now_ms` is purged.
187	pub fn purge_after(now_ms: u64) -> String {
188	rfc3339(now_ms + RESTORE_DAYS * 86_400_000)
189	}
190
191	/// Whether a repository to be purged at `purge_after` can still be
192	/// restored at `now` (both RFC 3339, which compare as text).
193	pub fn restorable(purge_after: &str, now: &str) -> bool {
194	now < purge_after
195	}
196
197	/// Whether a workspace's repositories may go with it: never a protected
198	/// workspace's (`protected` is `g1t_contracts::identity::protected_names`),
199	/// however the event came to be published.
200	pub fn may_go_with_workspace(namespace: &str, protected: &[String]) -> std::result::Result<(), String> {
201	if protected.iter().any(\|name\| name.eq_ignore_ascii_case(namespace)) {
202	return Err(g1t_contracts::identity::protected_refusal(namespace));
203	}
204	Ok(())
205	}
206
207	/// Whether a deleted repository comes back when the workspace
208	/// `workspace_id` is restored: only if it went with that workspace
209	/// (`deleted_with`), not if it was deleted on its own before.
210	pub fn comes_back_with(deleted_with: Option<&str>, workspace_id: &str) -> bool {
211	deleted_with == Some(workspace_id)
212	}
213
214	/// Where a repository is in its life, from its row.
215	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
216	pub enum State {
217	Active,
218	Archived,
219	/// Deleted, and restorable until purged.
220	Deleted,
221	/// Deleted, and due to be purged by the next sweep.
222	Due,
223	}
224
225	pub fn state(archived_at: Option<&str>, deleted: Option<(&str, &str)>, now: &str) -> State {
226	match deleted {
227	Some((_, purge_after)) if !restorable(purge_after, now) => State::Due,
228	Some(_) => State::Deleted,
229	None if archived_at.is_some() => State::Archived,
230	None => State::Active,
231	}
232	}
233
234	/// What holds a name in a workspace.
235	#[derive(Clone, Copy, Debug, PartialEq, Eq)]
236	pub enum Held {
237	Free,
238	ByRepo,
239	/// A repository deleted but not yet purged.
240	ByDeleted,
241	}
242
243	/// The name a repository at `current` can be renamed to, tidied, or why
244	/// not.
245	pub fn new_name(namespace: &str, current: &str, wanted: &str, held: Held) -> std::result::Result<String, Refusal> {
246	let name = wanted.trim().to_lowercase();
247	if !is_valid_repo_name(&name) {
248	return Err((
249	FailureCode::Invalid,
250	"Use letters, digits, dots, hyphens and underscores only.".into(),
251	));
252	}
253	if name == current {
254	return Err((FailureCode::Invalid, format!("It is already called {name}.")));
255	}
256	match held {
257	Held::Free => Ok(name),
258	Held::ByRepo => Err((
259	FailureCode::Conflict,
260	format!("{namespace} already has a repository named {name}."),
261	)),
262	Held::ByDeleted => Err((
263	FailureCode::Conflict,
264	format!(
265	"{namespace}/{name} was deleted recently and can still be restored. Restore it and rename it, or delete it permanently from the workspace's Recently deleted list first."
266	),
267	)),
268	}
269	}
270
271	/// Why a write to `repo` is refused because it is archived, if it is.
272	pub fn archived_refusal(repo: &Repo) -> Option<Refusal> {
273	repo.archived()
274	.then(\|\| (FailureCode::Forbidden, archived_message(&repo.namespace, &repo.name)))
275	}
276
277	/// Why a repository takes no pushes, merges or new work now: it is
278	/// archived.
279	pub fn read_only_refusal(repo: &Repo) -> Option<Refusal> {
280	repo.read_only_reason().map(\|message\| (FailureCode::Forbidden, message))
281	}
282
283	/// Everything that decides whether a repository may go private or public.
284	#[derive(Debug, Default)]
285	pub struct VisibilityFacts {
286	pub to_private: bool,
287	/// The workspace is on no plan, so its private storage is capped.
288	pub free: bool,
289	/// What its private repositories hold now.
290	pub private_bytes: i64,
291	/// What this repository holds.
292	pub bytes: i64,
293	/// What a free workspace's private repositories may hold.
294	pub free_private_bytes: i64,
295	}
296
297	/// Whether the visibility change `facts` describe may happen.
298	pub fn visibility_check(namespace: &str, facts: &VisibilityFacts) -> std::result::Result<(), Refusal> {
299	if facts.to_private
300	&& facts.free
301	&& git_ops::storage_full(facts.private_bytes + facts.bytes, facts.free_private_bytes)
302	{
303	return Err((
304	FailureCode::PaymentRequired,
305	format!(
306	"{namespace}'s private repositories would hold {:.2} GB, more than the {:.0} GB a free workspace has. Start the g1t plan in {namespace}, or keep the repository public.",
307	(facts.private_bytes + facts.bytes) as f64 / 1e9,
308	facts.free_private_bytes as f64 / 1e9,
309	),
310	));
311	}
312	Ok(())
313	}
314
315	/// Whether `from` can be renamed to `to` in a repository whose branches
316	/// are `branches`. `to` is tidied of surrounding space.
317	pub fn branch_rename(from: &str, to: &str, branches: &[String]) -> std::result::Result<String, Refusal> {
318	let to = to.trim().to_owned();
319	if !branches.iter().any(\|branch\| branch == from) {
320	return Err((FailureCode::NotFound, format!("There is no branch named {from}.")));
321	}
322	if !is_valid_branch_name(&to) {
323	return Err((
324	FailureCode::Invalid,
325	format!("{to:?} cannot be a branch name. Use letters, digits, '/', '-', '_' and '.', and no spaces."),
326	));
327	}
328	if to == from {
329	return Err((FailureCode::Invalid, format!("It is already called {to}.")));
330	}
331	if branches.contains(&to) {
332	return Err((FailureCode::Conflict, format!("There is already a branch named {to}.")));
333	}
334	Ok(to)
335	}
336
337	/// Whether a branch named `name` can be made in a repository whose
338	/// branches are `branches`: a valid name, free, and neither inside nor
339	/// holding another branch's name as a folder (git keeps `feature` and
340	/// `feature/login` apart only as a file and a directory, which cannot
341	/// both be). `name` is tidied of surrounding space.
342	pub fn branch_creation(name: &str, branches: &[Branch]) -> std::result::Result<String, Refusal> {
343	let name = name.trim().to_owned();
344	if !is_valid_branch_name(&name) {
345	return Err((
346	FailureCode::Invalid,
347	format!("{name:?} cannot be a branch name. Use letters, digits, '/', '-', '_' and '.', and no spaces."),
348	));
349	}
350	if branches.iter().any(\|branch\| branch.name == name) {
351	return Err((FailureCode::Conflict, format!("There is already a branch named {name}.")));
352	}
353	if let Some(clash) = branches.iter().find(\|branch\| {
354	name.starts_with(&format!("{}/", branch.name)) \|\| branch.name.starts_with(&format!("{name}/"))
355	}) {
356	return Err((
357	FailureCode::Conflict,
358	format!("{name} cannot sit beside {}: one name would be a folder of the other.", clash.name),
359	));
360	}
361	Ok(name)
362	}
363
364	/// The commit `branch` points to, when it may be deleted from a repository
365	/// whose default branch is `default_branch` and whose branches are
366	/// `branches`: never the default, and, when the caller says which commit
367	/// it saw (`head`), only while it still points there.
368	pub fn branch_removal(
369	branch: &str,
370	default_branch: &str,
371	head: Option<&str>,
372	branches: &[Branch],
373	) -> std::result::Result<String, Refusal> {
374	if branch == default_branch {
375	return Err((
376	FailureCode::Forbidden,
377	format!("{branch} is the default branch, which is never deleted. Make another branch the default first."),
378	));
379	}
380	let Some(found) = branches.iter().find(\|found\| found.name == branch) else {
381	return Err((FailureCode::NotFound, format!("There is no branch named {branch}.")));
382	};
383	if head.is_some_and(\|head\| !head.is_empty() && head != found.hash) {
384	return Err((
385	FailureCode::Conflict,
386	format!("{branch} has new commits since you looked, so it was left alone. Reload to see them."),
387	));
388	}
389	Ok(found.hash.clone())
390	}
391
392	/// The row of a deleted repository.
393	#[derive(Deserialize)]
394	struct DeletedRow {
395	id: String,
396	namespace: String,
397	name: String,
398	is_private: u8,
399	deleted_at: String,
400	#[serde(default)]
401	deleted_by: Option<String>,
402	purge_after: String,
403	#[serde(default)]
404	deleted_with: Option<String>,
405	}
406
407	impl From<DeletedRow> for DeletedRepo {
408	fn from(row: DeletedRow) -> Self {
409	DeletedRepo {
410	id: row.id,
411	namespace: row.namespace,
412	name: row.name,
413	is_private: row.is_private != 0,
414	deleted_at: row.deleted_at,
415	deleted_by: row.deleted_by.unwrap_or_default(),
416	purge_after: row.purge_after,
417	}
418	}
419	}
420
421	const DELETED_COLUMNS: &str =
422	"id, namespace, name, is_private, deleted_at, deleted_by, purge_after, deleted_with";
423
424	impl Registry {
425	/// Deletes a repository and its pull requests' working copies, softly.
426	pub async fn soft_delete(&self, id: &str, by: &str, at: &str, purge_after: &str) -> Result<()> {
427	self.db
428	.prepare(
429	"UPDATE repos SET deleted_at = ?1, deleted_by = ?2, purge_after = ?3
430	WHERE (id = ?4 OR fork_of = ?4) AND deleted_at IS NULL",
431	)
432	.bind(&[at.into(), by.into(), purge_after.into(), id.into()])?
433	.run()
434	.await?;
435	Ok(())
436	}
437
438	/// Brings a deleted repository and its working copies back.
439	pub async fn undelete(&self, id: &str) -> Result<()> {
440	self.db
441	.prepare(
442	"UPDATE repos SET deleted_at = NULL, deleted_by = NULL, purge_after = NULL
443	WHERE id = ?1 OR fork_of = ?1",
444	)
445	.bind(&[id.into()])?
446	.run()
447	.await?;
448	Ok(())
449	}
450
451	/// Deletes every live repository of `namespace`, and the working
452	/// copies of its repositories, softly, each marked as gone with the
453	/// workspace `workspace_id`. Those already deleted are left as they
454	/// are. Returns every repository so marked, this time or before, so a
455	/// delivery again tells services again.
456	pub async fn delete_with_workspace(
457	&self,
458	namespace: &str,
459	workspace_id: &str,
460	by: &str,
461	at: &str,
462	purge_after: &str,
463	) -> Result<Vec<DeletedRepo>> {
464	self.db
465	.prepare(
466	"UPDATE repos SET deleted_at = ?1, deleted_by = ?2, purge_after = ?3, deleted_with = ?4
467	WHERE deleted_at IS NULL
468	AND (namespace = ?5 OR fork_of IN (SELECT id FROM repos WHERE namespace = ?5))",
469	)
470	.bind(&[at.into(), by.into(), purge_after.into(), workspace_id.into(), namespace.into()])?
471	.run()
472	.await?;
473	self.deleted_with(workspace_id).await
474	}
475
476	/// The repositories deleted with the workspace `workspace_id`.
477	pub async fn deleted_with(&self, workspace_id: &str) -> Result<Vec<DeletedRepo>> {
478	Ok(self
479	.db
480	.prepare(format!(
481	"SELECT {DELETED_COLUMNS} FROM repos WHERE deleted_with = ? AND fork_of IS NULL"
482	))
483	.bind(&[workspace_id.into()])?
484	.all()
485	.await?
486	.results::<DeletedRow>()?
487	.into_iter()
488	.filter(\|row\| comes_back_with(row.deleted_with.as_deref(), workspace_id))
489	.map(DeletedRepo::from)
490	.collect())
491	}
492
493	/// Brings back the repositories, and their working copies, deleted
494	/// with the workspace `workspace_id`, and only those.
495	pub async fn undelete_with_workspace(&self, workspace_id: &str) -> Result<()> {
496	self.db
497	.prepare(
498	"UPDATE repos SET deleted_at = NULL, deleted_by = NULL, purge_after = NULL, deleted_with = NULL
499	WHERE deleted_with = ?",
500	)
501	.bind(&[workspace_id.into()])?
502	.run()
503	.await?;
504	Ok(())
505	}
506
507	/// A workspace's deleted repositories, newest first.
508	pub async fn deleted_in(&self, namespace: &str) -> Result<Vec<DeletedRepo>> {
509	Ok(self
510	.db
511	.prepare(format!(
512	"SELECT {DELETED_COLUMNS} FROM repos
513	WHERE namespace = ? AND deleted_at IS NOT NULL AND fork_of IS NULL
514	ORDER BY deleted_at DESC LIMIT 200"
515	))
516	.bind(&[namespace.to_lowercase().into()])?
517	.all()
518	.await?
519	.results::<DeletedRow>()?
520	.into_iter()
521	.map(DeletedRepo::from)
522	.collect())
523	}
524
525	/// The deleted repository at `path`, if that is what holds it.
526	pub async fn deleted_at(&self, path: &RepoPath) -> Result<Option<DeletedRepo>> {
527	Ok(self
528	.db
529	.prepare(format!(
530	"SELECT {DELETED_COLUMNS} FROM repos
531	WHERE namespace = ? AND name = ? AND deleted_at IS NOT NULL AND fork_of IS NULL"
532	))
533	.bind(&[
534	path.namespace.to_lowercase().into(),
535	path.name.to_lowercase().into(),
536	])?
537	.first::<DeletedRow>(None)
538	.await?
539	.map(DeletedRepo::from))
540	}
541
542	/// Deleted repositories whose time to be restored has passed.
543	pub async fn due(&self, now: &str, limit: u32) -> Result<Vec<DeletedRepo>> {
544	Ok(self
545	.db
546	.prepare(format!(
547	"SELECT {DELETED_COLUMNS} FROM repos
548	WHERE deleted_at IS NOT NULL AND purge_after <= ? AND fork_of IS NULL
549	ORDER BY purge_after LIMIT ?"
550	))
551	.bind(&[now.into(), limit.into()])?
552	.all()
553	.await?
554	.results::<DeletedRow>()?
555	.into_iter()
556	.map(DeletedRepo::from)
557	.collect())
558	}
559
560	/// Every deleted repository left in a workspace, for when the
561	/// workspace itself is deleted.
562	pub async fn deleted_ids_in(&self, namespace: &str) -> Result<Vec<DeletedRepo>> {
563	self.deleted_in(namespace).await
564	}
565
566	/// The git store keys of a repository and of its working copies.
567	pub async fn store_keys(&self, id: &str) -> Result<Vec<String>> {
568	#[derive(Deserialize)]
569	struct Row {
570	namespace: String,
571	name: String,
572	#[serde(default)]
573	store: Option<String>,
574	}
575	Ok(self
576	.db
577	.prepare("SELECT namespace, name, store FROM repos WHERE id = ?1 OR fork_of = ?1")
578	.bind(&[id.into()])?
579	.all()
580	.await?
581	.results::<Row>()?
582	.into_iter()
583	.map(\|row\| row.store.unwrap_or_else(\|\| format!("{}--{}", row.namespace, row.name)))
584	.collect())
585	}
586
587	/// Forgets a purged repository: its rows, its working copies' rows and
588	/// every redirect to it.
589	pub async fn erase(&self, id: &str) -> Result<()> {
590	self.db
591	.batch(vec![
592	self.db.prepare("DELETE FROM repos WHERE fork_of = ?1").bind(&[id.into()])?,
593	// Its forks stay, now forks of what it was a fork of.
594	self.db
595	.prepare("UPDATE repos SET parent_id = (SELECT parent_id FROM repos WHERE id = ?1) WHERE parent_id = ?1")
596	.bind(&[id.into()])?,
597	self.db.prepare("DELETE FROM repos WHERE id = ?1").bind(&[id.into()])?,
598	self.db
599	.prepare("DELETE FROM repo_redirects WHERE repo_id = ?1")
600	.bind(&[id.into()])?,
601	self.db
602	.prepare("DELETE FROM branch_redirects WHERE repo_id = ?1")
603	.bind(&[id.into()])?,
604	// Its About, stars and releases (about.rs).
605	self.db.prepare("DELETE FROM repo_stats WHERE repo_id = ?1").bind(&[id.into()])?,
606	self.db.prepare("DELETE FROM repo_stars WHERE repo_id = ?1").bind(&[id.into()])?,
607	self.db.prepare("DELETE FROM releases WHERE repo_id = ?1").bind(&[id.into()])?,
608	])
609	.await?;
610	Ok(())
611	}
612
613	/// Renames a repository, keeping its old path as a redirect. Any
614	/// redirect held by the new path gives way.
615	pub async fn rename(&self, repo: &Repo, name: &str) -> Result<()> {
616	let now = rfc3339(now_ms());
617	self.db
618	.batch(vec![
619	self.db
620	.prepare("UPDATE repos SET name = ? WHERE id = ? AND name = ?")
621	.bind(&[name.into(), repo.id.as_str().into(), repo.name.as_str().into()])?,
622	self.db
623	.prepare("DELETE FROM repo_redirects WHERE namespace = ? AND name = ?")
624	.bind(&[repo.namespace.as_str().into(), name.into()])?,
625	self.db
626	.prepare(
627	"INSERT OR REPLACE INTO repo_redirects (namespace, name, repo_id, created_at)
628	VALUES (?, ?, ?, ?)",
629	)
630	.bind(&[
631	repo.namespace.as_str().into(),
632	repo.name.as_str().into(),
633	repo.id.as_str().into(),
634	now.as_str().into(),
635	])?,
636	])
637	.await?;
638	Ok(())
639	}
640
641	pub async fn set_archived(&self, id: &str, at: Option<&str>) -> Result<()> {
642	self.db
643	.prepare("UPDATE repos SET archived_at = ? WHERE id = ?")
644	.bind(&[at.map_or(JsValue::NULL, JsValue::from), id.into()])?
645	.run()
646	.await?;
647	Ok(())
648	}
649
650	/// Makes a repository and its working copies public or private.
651	pub async fn set_private(&self, id: &str, private: bool) -> Result<()> {
652	self.db
653	.prepare("UPDATE repos SET is_private = ?1 WHERE id = ?2 OR fork_of = ?2")
654	.bind(&[u32::from(private).into(), id.into()])?
655	.run()
656	.await?;
657	Ok(())
658	}
659
660	pub async fn set_default_branch(&self, id: &str, branch: &str) -> Result<()> {
661	self.db
662	.prepare("UPDATE repos SET default_branch = ? WHERE id = ?")
663	.bind(&[branch.into(), id.into()])?
664	.run()
665	.await?;
666	Ok(())
667	}
668
669	/// Working copies of a repository, newest first, at most `limit`.
670	pub async fn forks_of(&self, id: &str, limit: u32) -> Result<Vec<Repo>> {
671	let rows = self
672	.db
673	.prepare(
674	"SELECT * FROM repos WHERE fork_of = ? AND deleted_at IS NULL AND retired_at IS NULL
675	ORDER BY created_at DESC LIMIT ?",
676	)
677	.bind(&[id.into(), limit.into()])?
678	.all()
679	.await?
680	.results::<crate::registry::RepoRow>()?;
681	Ok(rows.into_iter().map(Repo::from).collect())
682	}
683
684	/// Records that `from` is now called `to`. Redirects that pointed at
685	/// `from` point at `to`, and one held by `to` itself ends.
686	pub async fn add_branch_redirect(&self, repo_id: &str, from: &str, to: &str) -> Result<()> {
687	let now = rfc3339(now_ms());
688	self.db
689	.batch(vec![
690	self.db
691	.prepare("DELETE FROM branch_redirects WHERE repo_id = ? AND branch = ?")
692	.bind(&[repo_id.into(), to.into()])?,
693	self.db
694	.prepare("UPDATE branch_redirects SET now = ? WHERE repo_id = ? AND now = ?")
695	.bind(&[to.into(), repo_id.into(), from.into()])?,
696	self.db
697	.prepare(
698	"INSERT OR REPLACE INTO branch_redirects (repo_id, branch, now, created_at)
699	VALUES (?, ?, ?, ?)",
700	)
701	.bind(&[repo_id.into(), from.into(), to.into(), now.as_str().into()])?,
702	])
703	.await?;
704	Ok(())
705	}
706
707	pub async fn branch_redirect(&self, repo_id: &str, branch: &str) -> Result<Option<String>> {
708	#[derive(Deserialize)]
709	struct Row {
710	now: String,
711	}
712	Ok(self
713	.db
714	.prepare("SELECT now FROM branch_redirects WHERE repo_id = ? AND branch = ?")
715	.bind(&[repo_id.into(), branch.into()])?
716	.first::<Row>(None)
717	.await?
718	.map(\|row\| row.now))
719	}
720
721	/// Whether a repository is archived or deleted; unknown is deleted.
722	pub async fn status(&self, id: &str) -> Result<RepoStatus> {
723	#[derive(Deserialize)]
724	struct Row {
725	#[serde(default)]
726	archived_at: Option<String>,
727	#[serde(default)]
728	deleted_at: Option<String>,
729	}
730	Ok(self
731	.db
732	.prepare("SELECT archived_at, deleted_at FROM repos WHERE id = ?")
733	.bind(&[id.into()])?
734	.first::<Row>(None)
735	.await?
736	.map_or(
737	RepoStatus {
738	archived: false,
739	deleted: true,
740	},
741	\|row\| RepoStatus {
742	archived: row.archived_at.is_some(),
743	deleted: row.deleted_at.is_some(),
744	},
745	))
746	}
747	}
748
749	/// An audit entry for something done to a repository.
750	fn entry(actor: AuditActor, action: &str, surface: Option<Surface>, path: &RepoPath, rule: &str, message: String) -> NewAuditEntry {
751	NewAuditEntry {
752	actor,
753	action: action.to_owned(),
754	surface: surface.unwrap_or(Surface::Web),
755	target: AuditTarget {
756	workspace: path.namespace.clone(),
757	repo: Some(format!("{}/{}", path.namespace, path.name)),
758	..AuditTarget::default()
759	},
760	outcome: AuditOutcome::Allowed,
761	rule: rule.to_owned(),
762	result: Some("ok".to_owned()),
763	message: Some(message),
764	request_id: new_id("req", now_ms()),
765	}
766	}
767
768	/// g1t itself, as the actor of what its schedule does.
769	fn g1t_actor() -> AuditActor {
770	AuditActor::system()
771	}
772
773	fn fail<T>((code, message): Refusal) -> Outcome<T> {
774	Outcome::fail(code, message)
775	}
776
777	fn path_of(repo: &Repo) -> RepoPath {
778	RepoPath {
779	namespace: repo.namespace.clone(),
780	name: repo.name.clone(),
781	}
782	}
783
784	impl<S: GitStore> Repos<S> {
785	pub(crate) async fn record(&self, entries: Vec<NewAuditEntry>) {
786	let recorded: Result<u32> =
787	g1t_kit::call(&self.events, "audit_record", &RecordAuditArgs { entries }).await;
788	if let Err(error) = recorded {
789	worker::console_error!("audit entries not recorded: {error}");
790	}
791	}
792
793	/// The repository at `path` an admin is acting on: found, not a
794	/// working copy, and the actor allowed `capability` on it (Admin, and
795	/// for deleting, an owner of its workspace).
796	async fn owned(
797	&self,
798	actor: &User,
799	path: &RepoPath,
800	what: &str,
801	capability: Capability,
802	) -> Result<std::result::Result<Repo, Refusal>> {
803	let viewer = Some(actor.clone());
804	let Some(repo) = self.readable(path, &viewer).await? else {
805	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
806	};
807	if repo.fork_of.is_some() {
808	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
809	}
810	if let Err(refusal) = admin_only(Asker::on(actor, &repo), &repo.namespace, what, capability) {
811	return Ok(Err(refusal));
812	}
813	Ok(Ok(repo))
814	}
815
816	/// `delete`: see `g1t_contracts::repos::DeleteArgs`.
817	pub(crate) async fn delete(&self, a: DeleteArgs) -> Result<Outcome<DeletedRepo>> {
818	let repo = match self.owned(&a.actor, &a.path, "delete", Capability::Delete).await? {
819	Ok(repo) => repo,
820	Err(refusal) => return Ok(fail(refusal)),
821	};
822	let path = path_of(&repo);
823	if !confirmed(&path, &a.confirm) {
824	return Ok(fail(confirm_refusal(&path)));
825	}
826	let now = now_ms();
827	let at = rfc3339(now);
828	let purge = purge_after(now);
829	self.registry
830	.soft_delete(&repo.id, &a.actor.username, &at, &purge)
831	.await?;
832	self.publish(NewEvent {
833	kind: "repo.deleted",
834	source: SOURCE,
835	repo_id: Some(repo.id.clone()),
836	actor: Some(a.actor.id.clone()),
837	data: RepoDeleted {
838	repo_id: repo.id.clone(),
839	namespace: repo.namespace.clone(),
840	name: repo.name.clone(),
841	is_private: repo.is_private,
842	purge_after: purge.clone(),
843	with_workspace: false,
844	},
845	})
846	.await?;
847	self.record(vec![entry(
848	AuditActor::of(&a.actor),
849	"repo.deleted",
850	a.surface,
851	&path,
852	"owner",
853	format!("Deleted; restorable until {purge}"),
854	)])
855	.await;
856	Ok(Outcome::Ok(DeletedRepo {
857	id: repo.id,
858	namespace: repo.namespace,
859	name: repo.name,
860	is_private: repo.is_private,
861	deleted_at: at,
862	deleted_by: a.actor.username,
863	purge_after: purge,
864	}))
865	}
866
867	/// `deleted`: see `g1t_contracts::repos::DeletedArgs`.
868	pub(crate) async fn deleted(&self, a: DeletedArgs) -> Result<Vec<DeletedRepo>> {
869	let namespace = a.namespace.to_lowercase();
870	let owner = a
871	.viewer
872	.as_ref()
873	.is_some_and(\|user\| user.role_in(&namespace) == Some(Role::Owner));
874	if !owner {
875	return Ok(Vec::new());
876	}
877	self.registry.deleted_in(&namespace).await
878	}
879
880	/// The deleted repository an owner is acting on.
881	async fn owned_deleted(
882	&self,
883	actor: &User,
884	path: &RepoPath,
885	what: &str,
886	) -> Result<std::result::Result<DeletedRepo, Refusal>> {
887	if let Err(refusal) = owner_only(Asker::of(actor, &path.namespace), &path.namespace.to_lowercase(), what) {
888	return Ok(Err(refusal));
889	}
890	Ok(match self.registry.deleted_at(path).await? {
891	Some(deleted) => Ok(deleted),
892	None => Err((
893	FailureCode::NotFound,
894	format!(
895	"{}/{} is not among the workspace's recently deleted repositories.",
896	path.namespace, path.name
897	),
898	)),
899	})
900	}
901
902	/// `restore`: see `g1t_contracts::repos::DeletedRepoArgs`.
903	pub(crate) async fn restore(&self, a: DeletedRepoArgs) -> Result<Outcome<Repo>> {
904	let deleted = match self.owned_deleted(&a.actor, &a.path, "restore").await? {
905	Ok(deleted) => deleted,
906	Err(refusal) => return Ok(fail(refusal)),
907	};
908	let deleted_state = state(
909	None,
910	Some((&deleted.deleted_at, &deleted.purge_after)),
911	&rfc3339(now_ms()),
912	);
913	if deleted_state == State::Due {
914	return Ok(Outcome::fail(
915	FailureCode::Conflict,
916	format!("{}/{} is being purged and can no longer be restored.", deleted.namespace, deleted.name),
917	));
918	}
919	self.registry.undelete(&deleted.id).await?;
920	let Some(repo) = self.registry.by_id(&deleted.id).await? else {
921	return Ok(not_found());
922	};
923	self.publish(NewEvent {
924	kind: "repo.restored",
925	source: SOURCE,
926	repo_id: Some(repo.id.clone()),
927	actor: Some(a.actor.id.clone()),
928	data: RepoRestored {
929	repo_id: repo.id.clone(),
930	namespace: repo.namespace.clone(),
931	name: repo.name.clone(),
932	is_private: repo.is_private,
933	with_workspace: false,
934	},
935	})
936	.await?;
937	self.record(vec![entry(
938	AuditActor::of(&a.actor),
939	"repo.restored",
940	a.surface,
941	&path_of(&repo),
942	"owner",
943	format!("Restored; deleted by {} at {}", deleted.deleted_by, deleted.deleted_at),
944	)])
945	.await;
946	Ok(Outcome::Ok(repo))
947	}
948
949	/// `purge`: see `g1t_contracts::repos::DeletedRepoArgs`.
950	pub(crate) async fn purge(&self, a: DeletedRepoArgs) -> Result<Outcome<bool>> {
951	let deleted = match self.owned_deleted(&a.actor, &a.path, "permanently delete").await? {
952	Ok(deleted) => deleted,
953	Err(refusal) => return Ok(fail(refusal)),
954	};
955	let path = RepoPath {
956	namespace: deleted.namespace.clone(),
957	name: deleted.name.clone(),
958	};
959	if !confirmed(&path, a.confirm.as_deref().unwrap_or_default()) {
960	return Ok(fail(confirm_refusal(&path)));
961	}
962	self.purge_now(&deleted, Some(&a.actor.id)).await?;
963	self.record(vec![entry(
964	AuditActor::of(&a.actor),
965	"repo.purged",
966	a.surface,
967	&path,
968	"owner",
969	"Permanently deleted, with its git data".to_owned(),
970	)])
971	.await;
972	Ok(Outcome::Ok(true))
973	}
974
975	/// Removes a deleted repository for good: git data first, so a failure
976	/// leaves it to the next sweep, then its rows; then says so.
977	async fn purge_now(&self, deleted: &DeletedRepo, actor: Option<&str>) -> Result<()> {
978	for key in self.registry.store_keys(&deleted.id).await? {
979	self.store.delete(&key).await?;
980	}
981	self.registry.erase(&deleted.id).await?;
982	// Who had access to it goes with it.
983	if let Some(identity) = &self.identity {
984	let forgotten: Result<bool> = g1t_kit::call(
985	identity,
986	"forget_repo_access",
987	&g1t_contracts::access::ForgetRepoAccessArgs {
988	repo_id: deleted.id.clone(),
989	},
990	)
991	.await;
992	if let Err(error) = forgotten {
993	worker::console_error!("access to {} not forgotten: {error}", deleted.id);
994	}
995	}
996	self.publish(NewEvent {
997	kind: "repo.purged",
998	source: SOURCE,
999	repo_id: Some(deleted.id.clone()),
1000	actor: actor.map(str::to_owned),
1001	data: RepoPurged {
1002	repo_id: deleted.id.clone(),
1003	namespace: deleted.namespace.clone(),
1004	name: deleted.name.clone(),
1005	},
1006	})
1007	.await
1008	}
1009
1010	/// `purge_due`: see `g1t_contracts::repos::PurgeDueArgs`.
1011	pub(crate) async fn purge_due(&self, a: PurgeDueArgs) -> Result<u32> {
1012	let limit = a.limit.unwrap_or(PURGES_PER_SWEEP).clamp(1, 100);
1013	let due = self.registry.due(&rfc3339(now_ms()), limit).await?;
1014	let mut purged = 0;
1015	for deleted in due {
1016	match self.purge_now(&deleted, None).await {
1017	Ok(()) => {
1018	purged += 1;
1019	let path = RepoPath {
1020	namespace: deleted.namespace.clone(),
1021	name: deleted.name.clone(),
1022	};
1023	self.record(vec![entry(
1024	g1t_actor(),
1025	"repo.purged",
1026	None,
1027	&path,
1028	"schedule",
1029	format!("Purged {RESTORE_DAYS} days after {} deleted it", deleted.deleted_by),
1030	)])
1031	.await;
1032	}
1033	Err(error) => worker::console_error!("{} not purged: {error}", deleted.id),
1034	}
1035	}
1036	Ok(purged)
1037	}
1038
1039	/// `workspace.deleting`: every live repository of the workspace is
1040	/// deleted with it, marked so its restore brings back exactly these,
1041	/// and `repo.deleted` (with `with_workspace`) tells services to stop
1042	/// what runs for each and hide it. They are purged with the workspace,
1043	/// or by the sweep at the same `purge_after`. Never for a protected
1044	/// workspace, whoever published it.
1045	pub(crate) async fn delete_with_workspace(&self, deleting: &WorkspaceDeleting, protected: &[String]) -> Result<()> {
1046	let namespace = deleting.slug.to_lowercase();
1047	if let Err(why) = may_go_with_workspace(&namespace, protected) {
1048	worker::console_error!("workspace.deleting for {namespace} ignored: {why}");
1049	return Ok(());
1050	}
1051	let marked = self
1052	.registry
1053	.delete_with_workspace(
1054	&namespace,
1055	&deleting.workspace_id,
1056	&deleting.by,
1057	&rfc3339(now_ms()),
1058	&deleting.purge_after,
1059	)
1060	.await?;
1061	for repo in marked {
1062	self.publish(NewEvent {
1063	kind: "repo.deleted",
1064	source: SOURCE,
1065	repo_id: Some(repo.id.clone()),
1066	actor: None,
1067	data: RepoDeleted {
1068	repo_id: repo.id.clone(),
1069	namespace: repo.namespace.clone(),
1070	name: repo.name.clone(),
1071	is_private: repo.is_private,
1072	purge_after: repo.purge_after.clone(),
1073	with_workspace: true,
1074	},
1075	})
1076	.await?;
1077	}
1078	Ok(())
1079	}
1080
1081	/// `workspace.restored`: the repositories deleted with the workspace
1082	/// come back, and `repo.restored` (with `with_workspace`) says so for
1083	/// each. Ones deleted on their own before stay deleted.
1084	pub(crate) async fn restore_with_workspace(&self, restored: &WorkspaceRestored) -> Result<()> {
1085	let marked = self.registry.deleted_with(&restored.workspace_id).await?;
1086	self.registry.undelete_with_workspace(&restored.workspace_id).await?;
1087	for deleted in marked {
1088	let Some(repo) = self.registry.by_id(&deleted.id).await? else {
1089	continue;
1090	};
1091	self.publish(NewEvent {
1092	kind: "repo.restored",
1093	source: SOURCE,
1094	repo_id: Some(repo.id.clone()),
1095	actor: None,
1096	data: RepoRestored {
1097	repo_id: repo.id.clone(),
1098	namespace: repo.namespace.clone(),
1099	name: repo.name.clone(),
1100	is_private: repo.is_private,
1101	with_workspace: true,
1102	},
1103	})
1104	.await?;
1105	}
1106	Ok(())
1107	}
1108
1109	/// `workspace.deleted`: the workspace is purged, and every repository
1110	/// it had goes with it: those deleted with it, those deleted before,
1111	/// and any still live (a `workspace.deleting` that never arrived).
1112	pub(crate) async fn purge_workspace(&self, deleted: &WorkspaceDeleted, protected: &[String]) -> Result<()> {
1113	let namespace = deleted.slug.to_lowercase();
1114	if let Err(why) = may_go_with_workspace(&namespace, protected) {
1115	worker::console_error!("workspace.deleted for {namespace} ignored: {why}");
1116	return Ok(());
1117	}
1118	let now = rfc3339(now_ms());
1119	self.registry
1120	.delete_with_workspace(&namespace, &deleted.workspace_id, "g1t", &now, &now)
1121	.await?;
1122	// A page at a time; one that fails is left to the hourly sweep.
1123	loop {
1124	let page = self.registry.deleted_ids_in(&namespace).await?;
1125	let mut purged = 0;
1126	for repo in &page {
1127	match self.purge_now(repo, None).await {
1128	Ok(()) => purged += 1,
1129	Err(error) => worker::console_error!("{} not purged with its workspace: {error}", repo.id),
1130	}
1131	}
1132	if purged == 0 {
1133	break;
1134	}
1135	}
1136	Ok(())
1137	}
1138
1139	/// `rename`: see `g1t_contracts::repos::RenameArgs`.
1140	pub(crate) async fn rename(&self, a: RenameArgs) -> Result<Outcome<Repo>> {
1141	let repo = match self.owned(&a.actor, &a.path, "rename", Capability::Administer).await? {
1142	Ok(repo) => repo,
1143	Err(refusal) => return Ok(fail(refusal)),
1144	};
1145	let wanted = RepoPath {
1146	namespace: repo.namespace.clone(),
1147	name: a.name.trim().to_lowercase(),
1148	};
1149	let held = match self.registry.by_path_any(&wanted).await? {
1150	None => Held::Free,
1151	Some((_, None)) => Held::ByRepo,
1152	Some((_, Some(_))) => Held::ByDeleted,
1153	};
1154	let name = match new_name(&repo.namespace, &repo.name, &a.name, held) {
1155	Ok(name) => name,
1156	Err(refusal) => return Ok(fail(refusal)),
1157	};
1158	// The git store key stays what it was; the new path must not
1159	// change where it is read from.
1160	let key = store_key(&repo);
1161	self.registry.rename(&repo, &name).await?;
1162	let renamed = Repo {
1163	name: name.clone(),
1164	..repo.clone()
1165	};
1166	remember_store(&renamed, &key);
1167	let from = path_of(&repo);
1168	let to = path_of(&renamed);
1169	if let Some(identity) = &self.identity {
1170	let moved: Result<bool> = g1t_kit::call(
1171	identity,
1172	"transfer_repo_scopes",
1173	&TransferRepoScopesArgs {
1174	from: from.clone(),
1175	to: to.clone(),
1176	},
1177	)
1178	.await;
1179	if let Err(error) = moved {
1180	worker::console_error!("agent scopes for {} not moved: {error}", repo.id);
1181	}
1182	}
1183	self.publish(NewEvent {
1184	kind: "repo.renamed",
1185	source: SOURCE,
1186	repo_id: Some(repo.id.clone()),
1187	actor: Some(a.actor.id.clone()),
1188	data: RepoRenamed {
1189	repo_id: repo.id.clone(),
1190	namespace: repo.namespace.clone(),
1191	from: repo.name.clone(),
1192	to: name.clone(),
1193	},
1194	})
1195	.await?;
1196	self.record(vec![entry(
1197	AuditActor::of(&a.actor),
1198	"repo.renamed",
1199	a.surface,
1200	&to,
1201	"owner",
1202	format!("Renamed from {}/{}", from.namespace, from.name),
1203	)])
1204	.await;
1205	Ok(Outcome::Ok(renamed))
1206	}
1207
1208	/// `archive`: see `g1t_contracts::repos::ArchiveArgs`.
1209	pub(crate) async fn archive(&self, a: ArchiveArgs) -> Result<Outcome<Repo>> {
1210	let what = if a.archived { "archive" } else { "unarchive" };
1211	let repo = match self.owned(&a.actor, &a.path, what, Capability::Administer).await? {
1212	Ok(repo) => repo,
1213	Err(refusal) => return Ok(fail(refusal)),
1214	};
1215	if repo.archived() == a.archived {
1216	return Ok(Outcome::Ok(repo));
1217	}
1218	let at = a.archived.then(\|\| rfc3339(now_ms()));
1219	self.registry.set_archived(&repo.id, at.as_deref()).await?;
1220	let changed = Repo {
1221	archived_at: at,
1222	..repo
1223	};
1224	let kind = if a.archived { "repo.archived" } else { "repo.unarchived" };
1225	self.publish(NewEvent {
1226	kind,
1227	source: SOURCE,
1228	repo_id: Some(changed.id.clone()),
1229	actor: Some(a.actor.id.clone()),
1230	data: RepoArchived {
1231	repo_id: changed.id.clone(),
1232	namespace: changed.namespace.clone(),
1233	name: changed.name.clone(),
1234	archived: a.archived,
1235	},
1236	})
1237	.await?;
1238	self.record(vec![entry(
1239	AuditActor::of(&a.actor),
1240	kind,
1241	a.surface,
1242	&path_of(&changed),
1243	"owner",
1244	if a.archived {
1245	"Archived: read-only".to_owned()
1246	} else {
1247	"Unarchived".to_owned()
1248	},
1249	)])
1250	.await;
1251	Ok(Outcome::Ok(changed))
1252	}
1253
1254	/// `set_visibility`: see `g1t_contracts::repos::SetVisibilityArgs`.
1255	pub(crate) async fn set_visibility(&self, a: SetVisibilityArgs) -> Result<Outcome<Repo>> {
1256	let repo = match self.owned(&a.actor, &a.path, "change the visibility of", Capability::ChangeVisibility).await? {
1257	Ok(repo) => repo,
1258	Err(refusal) => return Ok(fail(refusal)),
1259	};
1260	if !confirmed(&path_of(&repo), &a.confirm) {
1261	return Ok(fail(confirm_refusal(&path_of(&repo))));
1262	}
1263	if let Some(why) = visibility_refusal(&a.actor, &repo, a.is_private) {
1264	return Ok(Outcome::fail(FailureCode::Forbidden, why));
1265	}
1266	self.change_visibility(repo, a.is_private, &a.actor, a.surface).await
1267	}
1268
1269	/// Makes `repo` public or private, if the workspace's storage allows,
1270	/// and says so: `repo.updated` and `repo.visibility_changed`. The
1271	/// caller has checked the actor may.
1272	pub(crate) async fn change_visibility(
1273	&self,
1274	repo: Repo,
1275	private: bool,
1276	actor: &User,
1277	surface: Option<Surface>,
1278	) -> Result<Outcome<Repo>> {
1279	if repo.is_private == private {
1280	return Ok(Outcome::Ok(repo));
1281	}
1282	if repo.parent_id.is_some() {
1283	return Ok(Outcome::fail(
1284	FailureCode::Invalid,
1285	format!(
1286	"{}/{} is a fork, as visible as the repository it came from. Detach it from its fork network in its settings to change who can see it.",
1287	repo.namespace, repo.name
1288	),
1289	));
1290	}
1291	let facts = if private {
1292	VisibilityFacts {
1293	to_private: true,
1294	free: git_ops::is_free(self.billing.as_ref(), &repo.namespace).await,
1295	private_bytes: self.registry.private_bytes(&repo.namespace).await.unwrap_or(0),
1296	bytes: self.registry.stored_bytes(&repo.id).await?,
1297	free_private_bytes: self.free_private_bytes,
1298	}
1299	} else {
1300	VisibilityFacts::default()
1301	};
1302	if let Err(refusal) = visibility_check(&repo.namespace, &facts) {
1303	return Ok(fail(refusal));
1304	}
1305	self.registry.set_private(&repo.id, private).await?;
1306	// Its forks keep who can see them, and leave its network.
1307	for fork_id in self.registry.detach_forks_of(&repo.id).await? {
1308	self.publish_detached(&fork_id, &repo.id).await?;
1309	}
1310	let changed = Repo {
1311	is_private: private,
1312	..repo
1313	};
1314	self.publish(NewEvent {
1315	kind: "repo.updated",
1316	source: SOURCE,
1317	repo_id: Some(changed.id.clone()),
1318	actor: Some(actor.id.clone()),
1319	data: RepoUpdated {
1320	repo_id: changed.id.clone(),
1321	namespace: changed.namespace.clone(),
1322	name: changed.name.clone(),
1323	is_private: private,
1324	visibility_changed: true,
1325	},
1326	})
1327	.await?;
1328	self.publish(NewEvent {
1329	kind: "repo.visibility_changed",
1330	source: SOURCE,
1331	repo_id: Some(changed.id.clone()),
1332	actor: Some(actor.id.clone()),
1333	data: RepoVisibilityChanged {
1334	repo_id: changed.id.clone(),
1335	is_private: private,
1336	},
1337	})
1338	.await?;
1339	self.record(vec![entry(
1340	AuditActor::of(actor),
1341	"repo.visibility_changed",
1342	surface,
1343	&path_of(&changed),
1344	"owner",
1345	if private { "Made private".to_owned() } else { "Made public".to_owned() },
1346	)])
1347	.await;
1348	Ok(Outcome::Ok(changed))
1349	}
1350
1351	/// The repository at `path` someone is changing the branches of:
1352	/// found, not a working copy, the actor allowed `capability` on it
1353	/// (Push to rename a branch, Administer to change the default),
1354	/// verified, and not archived.
1355	async fn writable_by(
1356	&self,
1357	actor: &User,
1358	path: &RepoPath,
1359	capability: Capability,
1360	) -> Result<std::result::Result<Repo, Refusal>> {
1361	let viewer = Some(actor.clone());
1362	let Some(repo) = self.readable(path, &viewer).await? else {
1363	return Ok(Err((FailureCode::NotFound, "Repository not found.".into())));
1364	};
1365	if repo.fork_of.is_some() \|\| !crate::registry::can(&repo, &viewer, capability) {
1366	return Ok(Err((
1367	FailureCode::Forbidden,
1368	access::needs(capability, &format!("{}/{}", repo.namespace, repo.name)),
1369	)));
1370	}
1371	if !actor.verified {
1372	return Ok(Err((FailureCode::Forbidden, UNVERIFIED.into())));
1373	}
1374	if let Some(refusal) = archived_refusal(&repo) {
1375	return Ok(Err(refusal));
1376	}
1377	// Moving between namespaces: wait for it (moves.rs).
1378	self.unpaused(repo).await
1379	}
1380
1381	/// `set_default_branch`: see `g1t_contracts::repos::SetDefaultBranchArgs`.
1382	pub(crate) async fn set_default_branch(&self, a: SetDefaultBranchArgs) -> Result<Outcome<Repo>> {
1383	let repo = match self.writable_by(&a.actor, &a.path, Capability::Administer).await? {
1384	Ok(repo) => repo,
1385	Err(refusal) => return Ok(fail(refusal)),
1386	};
1387	let branch = a.branch.trim().to_owned();
1388	if branch == repo.default_branch {
1389	return Ok(Outcome::Ok(repo));
1390	}
1391	let git = self.store.open(&store_key(&repo)).await?;
1392	if !git.branches().await?.iter().any(\|b\| b.name == branch) {
1393	return Ok(Outcome::fail(
1394	FailureCode::Invalid,
1395	format!("There is no branch named {branch}. Push it first."),
1396	));
1397	}
1398	self.registry.set_default_branch(&repo.id, &branch).await?;
1399	// HEAD in what git is told follows it.
1400	self.refs_moved(&repo.id).await;
1401	let from = repo.default_branch.clone();
1402	let changed = Repo {
1403	default_branch: branch.clone(),
1404	..repo
1405	};
1406	self.forks_follow(&changed, &from, &branch, false).await;
1407	self.publish(NewEvent {
1408	kind: "repo.default_branch_changed",
1409	source: SOURCE,
1410	repo_id: Some(changed.id.clone()),
1411	actor: Some(a.actor.id.clone()),
1412	data: RepoDefaultBranchChanged {
1413	repo_id: changed.id.clone(),
1414	from: from.clone(),
1415	to: branch.clone(),
1416	renamed: false,
1417	},
1418	})
1419	.await?;
1420	self.record(vec![entry(
1421	AuditActor::of(&a.actor),
1422	"repo.default_branch_changed",
1423	a.surface,
1424	&path_of(&changed),
1425	"member",
1426	format!("Default branch changed from {from} to {branch}"),
1427	)])
1428	.await;
1429	Ok(Outcome::Ok(changed))
1430	}
1431
1432	/// `rename_branch`: see `g1t_contracts::repos::RenameBranchArgs`.
1433	pub(crate) async fn rename_branch(&self, a: RenameBranchArgs) -> Result<Outcome<Repo>> {
1434	let repo = match self.writable_by(&a.actor, &a.path, Capability::Push).await? {
1435	Ok(repo) => repo,
1436	Err(refusal) => return Ok(fail(refusal)),
1437	};
1438	let from = a.from.trim().to_owned();
1439	let is_default = from == repo.default_branch;
1440	if is_default
1441	&& let Err(refusal) = admin_only(
1442	Asker::on(&a.actor, &repo),
1443	&repo.namespace,
1444	"rename the default branch of",
1445	Capability::Administer,
1446	)
1447	{
1448	return Ok(fail(refusal));
1449	}
1450	let git = self.store.open(&store_key(&repo)).await?;
1451	let branches = git.branches().await?;
1452	let names: Vec<String> = branches.iter().map(\|b\| b.name.clone()).collect();
1453	let to = match branch_rename(&from, &a.to, &names) {
1454	Ok(to) => to,
1455	Err(refusal) => return Ok(fail(refusal)),
1456	};
1457	let Some(head) = branches.iter().find(\|b\| b.name == from).map(\|b\| b.hash.clone()) else {
1458	return Ok(not_found());
1459	};
1460	// A rename deletes one name and creates another: the rules of both
1461	// hold (rules.rs).
1462	let renamed = vec![
1463	g1t_rules::push::RefChange {
1464	git_ref: format!("refs/heads/{from}"),
1465	old: Some(head.clone()),
1466	new: None,
1467	complete: true,
1468	..Default::default()
1469	},
1470	g1t_rules::push::RefChange {
1471	git_ref: format!("refs/heads/{to}"),
1472	old: None,
1473	new: Some(head.clone()),
1474	complete: true,
1475	..Default::default()
1476	},
1477	];
1478	if let crate::rules::Ruled::Refused { message, .. } =
1479	self.check_changes(&repo, &a.actor, g1t_contracts::rules::Action::RenameRef, renamed).await?
1480	{
1481	return Ok(Outcome::fail(FailureCode::Forbidden, message));
1482	}
1483	let access = git.access(Scope::Write).await?;
1484	let made = land::push_pack(&access, &to, None, &head, EMPTY_PACK.to_vec()).await?;
1485	self.refs_moved(&repo.id).await;
1486	if let Err(reason) = made {
1487	return Ok(Outcome::fail(FailureCode::Conflict, format!("{to} could not be made: {reason}")));
1488	}
1489	// The default moves before the old name goes, so it never names a
1490	// branch that is not there.
1491	if is_default {
1492	self.registry.set_default_branch(&repo.id, &to).await?;
1493	}
1494	let removed = land::delete_ref(&access, &from, &head).await;
1495	self.refs_moved(&repo.id).await;
1496	if let Err(reason) = removed? {
1497	worker::console_error!("{from} not removed after renaming it to {to}: {reason}");
1498	}
1499	self.registry.add_branch_redirect(&repo.id, &from, &to).await?;
1500	let changed = if is_default {
1501	Repo {
1502	default_branch: to.clone(),
1503	..repo
1504	}
1505	} else {
1506	repo
1507	};
1508	if is_default {
1509	self.forks_follow(&changed, &from, &to, true).await;
1510	}
1511	self.publish(NewEvent {
1512	kind: "branch.renamed",
1513	source: SOURCE,
1514	repo_id: Some(changed.id.clone()),
1515	actor: Some(a.actor.id.clone()),
1516	data: BranchRenamed {
1517	repo_id: changed.id.clone(),
1518	from: from.clone(),
1519	to: to.clone(),
1520	default_branch: is_default,
1521	},
1522	})
1523	.await?;
1524	if is_default {
1525	self.publish(NewEvent {
1526	kind: "repo.default_branch_changed",
1527	source: SOURCE,
1528	repo_id: Some(changed.id.clone()),
1529	actor: Some(a.actor.id.clone()),
1530	data: RepoDefaultBranchChanged {
1531	repo_id: changed.id.clone(),
1532	from: from.clone(),
1533	to: to.clone(),
1534	renamed: true,
1535	},
1536	})
1537	.await?;
1538	}
1539	self.record(vec![entry(
1540	AuditActor::of(&a.actor),
1541	"branch.renamed",
1542	a.surface,
1543	&path_of(&changed),
1544	if is_default { "owner" } else { "member" },
1545	format!("Branch {from} renamed to {to}"),
1546	)])
1547	.await;
1548	Ok(Outcome::Ok(changed))
1549	}
1550
1551	/// `create_branch`: see `g1t_contracts::repos::CreateBranchArgs`.
1552	pub(crate) async fn create_branch(&self, a: CreateBranchArgs) -> Result<Outcome<Branch>> {
1553	let repo = match self.writable_by(&a.actor, &a.path, Capability::Push).await? {
1554	Ok(repo) => repo,
1555	Err(refusal) => return Ok(fail(refusal)),
1556	};
1557	let git = self.store.open(&store_key(&repo)).await?;
1558	let branches = git.branches().await?;
1559	let name = match branch_creation(&a.name, &branches) {
1560	Ok(name) => name,
1561	Err(refusal) => return Ok(fail(refusal)),
1562	};
1563	let from = a.from.trim();
1564	let from = if from.is_empty() { repo.default_branch.as_str() } else { from };
1565	// A branch by its name, else whatever git makes of it: a tag or a commit.
1566	let head = match branches.iter().find(\|branch\| branch.name == from) {
1567	Some(branch) => Some(branch.hash.clone()),
1568	None => git.log(from, 1).await?.into_iter().next().map(\|commit\| commit.hash),
1569	};
1570	let Some(head) = head else {
1571	return Ok(Outcome::fail(FailureCode::NotFound, format!("There is no branch, tag or commit {from}.")));
1572	};
1573	let made = vec![g1t_rules::push::RefChange {
1574	git_ref: format!("refs/heads/{name}"),
1575	old: None,
1576	new: Some(head.clone()),
1577	complete: true,
1578	..Default::default()
1579	}];
1580	if let crate::rules::Ruled::Refused { message, .. } =
1581	self.check_changes(&repo, &a.actor, g1t_contracts::rules::Action::CreateRef, made).await?
1582	{
1583	return Ok(Outcome::fail(FailureCode::Forbidden, message));
1584	}
1585	let access = git.access(Scope::Write).await?;
1586	let pushed = land::push_pack(&access, &name, None, &head, EMPTY_PACK.to_vec()).await?;
1587	self.refs_moved(&repo.id).await;
1588	if let Err(reason) = pushed {
1589	return Ok(Outcome::fail(FailureCode::Conflict, format!("{name} could not be made: {reason}")));
1590	}
1591	self.publish_push(&repo, &format!("refs/heads/{name}"), None, &head, Some(&a.actor), Some(0)).await?;
1592	self.record(vec![entry(
1593	AuditActor::of(&a.actor),
1594	"branch.created",
1595	a.surface,
1596	&path_of(&repo),
1597	"member",
1598	format!("Branch {name} created at {}", &head[..head.len().min(7)]),
1599	)])
1600	.await;
1601	Ok(Outcome::Ok(Branch { name, hash: head }))
1602	}
1603
1604	/// `remove_branch`: see `g1t_contracts::repos::RemoveBranchArgs`.
1605	pub(crate) async fn remove_branch(&self, a: RemoveBranchArgs) -> Result<Outcome<Branch>> {
1606	let repo = match self.writable_by(&a.actor, &a.path, Capability::Push).await? {
1607	Ok(repo) => repo,
1608	Err(refusal) => return Ok(fail(refusal)),
1609	};
1610	let branch = a.branch.trim().to_owned();
1611	let git = self.store.open(&store_key(&repo)).await?;
1612	let branches = git.branches().await?;
1613	let head = match branch_removal(&branch, &repo.default_branch, a.head.as_deref(), &branches) {
1614	Ok(head) => head,
1615	Err(refusal) => return Ok(fail(refusal)),
1616	};
1617	let removed = vec![g1t_rules::push::RefChange {
1618	git_ref: format!("refs/heads/{branch}"),
1619	old: Some(head.clone()),
1620	new: None,
1621	complete: true,
1622	..Default::default()
1623	}];
1624	if let crate::rules::Ruled::Refused { message, .. } =
1625	self.check_changes(&repo, &a.actor, g1t_contracts::rules::Action::DeleteRef, removed).await?
1626	{
1627	return Ok(Outcome::fail(FailureCode::Forbidden, message));
1628	}
1629	let access = git.access(Scope::Write).await?;
1630	let deleted = land::delete_ref(&access, &branch, &head).await?;
1631	self.refs_moved(&repo.id).await;
1632	if let Err(reason) = deleted {
1633	return Ok(Outcome::fail(FailureCode::Conflict, format!("{branch} could not be deleted: {reason}")));
1634	}
1635	let git_ref = format!("refs/heads/{branch}");
1636	self.publish_deleted(&repo, &[(git_ref, head.clone())], Some(&a.actor.id), None).await?;
1637	self.record(vec![entry(
1638	AuditActor::of(&a.actor),
1639	"branch.deleted",
1640	a.surface,
1641	&path_of(&repo),
1642	"member",
1643	format!("Branch {branch} deleted at {}", &head[..head.len().min(7)]),
1644	)])
1645	.await;
1646	Ok(Outcome::Ok(Branch { name: branch, hash: head }))
1647	}
1648
1649	/// Pull requests' working copies name their branch after the default
1650	/// branch of the repository they came from. When it changes, the
1651	/// newest of them get a branch of the new name at the same commit (and,
1652	/// for a rename, lose the old one), so agents and merges find it.
1653	/// Best effort: a copy that cannot follow is logged and left.
1654	async fn forks_follow(&self, repo: &Repo, from: &str, to: &str, renamed: bool) {
1655	let forks = match self.registry.forks_of(&repo.id, FORKS_FOLLOWING).await {
1656	Ok(forks) => forks,
1657	Err(error) => {
1658	worker::console_error!("working copies of {} not listed: {error}", repo.id);
1659	return;
1660	}
1661	};
1662	for fork in forks {
1663	let followed: Result<()> = async {
1664	let git = self.store.open(&store_key(&fork)).await?;
1665	let branches = git.branches().await?;
1666	let Some(head) = branches.iter().find(\|b\| b.name == from).map(\|b\| b.hash.clone()) else {
1667	return Ok(());
1668	};
1669	let access = git.access(Scope::Write).await?;
1670	if !branches.iter().any(\|b\| b.name == to) {
1671	let made = land::push_pack(&access, to, None, &head, EMPTY_PACK.to_vec()).await;
1672	self.refs_moved(&fork.id).await;
1673	if let Err(reason) = made? {
1674	worker::console_error!("working copy {} did not get {to}: {reason}", fork.id);
1675	return Ok(());
1676	}
1677	}
1678	self.registry.set_default_branch(&fork.id, to).await?;
1679	if renamed {
1680	let removed = land::delete_ref(&access, from, &head).await;
1681	self.refs_moved(&fork.id).await;
1682	if let Err(reason) = removed? {
1683	worker::console_error!("working copy {} kept {from}: {reason}", fork.id);
1684	}
1685	}
1686	Ok(())
1687	}
1688	.await;
1689	if let Err(error) = followed {
1690	worker::console_error!("working copy {} did not follow {from} → {to}: {error}", fork.id);
1691	}
1692	}
1693	}
1694
1695	/// `resolve_branch`: see `g1t_contracts::repos::ResolveBranchArgs`.
1696	pub(crate) async fn resolve_branch(&self, a: ResolveBranchArgs) -> Result<Option<String>> {
1697	let Some(now) = self.registry.branch_redirect(&a.repo_id, &a.branch).await? else {
1698	return Ok(None);
1699	};
1700	// A branch made again under the old name ends the redirect.
1701	let Some(repo) = self.registry.by_id(&a.repo_id).await? else {
1702	return Ok(None);
1703	};
1704	let git = self.store.open(&store_key(&repo)).await?;
1705	let branches = git.branches().await?;
1706	if branches.iter().any(\|b\| b.name == a.branch) \|\| !branches.iter().any(\|b\| b.name == now) {
1707	return Ok(None);
1708	}
1709	Ok(Some(now))
1710	}
1711
1712	/// `status_by_id`: see `g1t_contracts::repos::StatusByIdArgs`.
1713	pub(crate) async fn status_by_id(&self, a: StatusByIdArgs) -> Result<RepoStatus> {
1714	self.registry.status(&a.id).await
1715	}
1716	}
1717
1718	#[cfg(test)]
1719	mod tests {
1720	use super::*;
1721
1722	fn owner() -> Asker {
1723	Asker {
1724	person: true,
1725	verified: true,
1726	role: Some(Role::Owner),
1727	repo_role: Some(RepoRole::Admin),
1728	privileges: g1t_contracts::MemberPrivileges::default(),
1729	}
1730	}
1731
1732	fn path() -> RepoPath {
1733	RepoPath {
1734	namespace: "acme".into(),
1735	name: "rocket".into(),
1736	}
1737	}
1738
1739	#[test]
1740	fn only_a_verified_person_who_owns_the_workspace_may() {
1741	assert!(owner_only(owner(), "acme", "delete").is_ok());
1742	let member = Asker { role: Some(Role::Member), ..owner() };
1743	let (code, message) = owner_only(member, "acme", "delete").unwrap_err();
1744	assert_eq!(code, FailureCode::Forbidden);
1745	assert_eq!(message, "Only an owner of acme can delete its repositories.");
1746	assert_eq!(owner_only(Asker { person: false, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::Forbidden);
1747	assert_eq!(owner_only(Asker { verified: false, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::Forbidden);
1748	// Outside the workspace, a private repository is not there at all.
1749	assert_eq!(owner_only(Asker { role: None, ..owner() }, "acme", "delete").unwrap_err().0, FailureCode::NotFound);
1750	}
1751
1752	/// Renaming, archiving and changing visibility take Admin on the
1753	/// repository, which a direct grant can give; deleting and
1754	/// transferring still take an owner of the workspace.
1755	#[test]
1756	fn admin_on_the_repository_may_administer_but_not_delete() {
1757	let admin = Asker { role: None, repo_role: Some(RepoRole::Admin), ..owner() };
1758	assert!(admin_only(admin, "acme", "rename", Capability::Administer).is_ok());
1759	let (code, message) = admin_only(admin, "acme", "delete", Capability::Delete).unwrap_err();
1760	assert_eq!(code, FailureCode::Forbidden);
1761	assert_eq!(message, "Only an owner of acme can delete its repositories.");
1762	let member_admin = Asker { role: Some(Role::Member), ..admin };
1763	assert_eq!(admin_only(member_admin, "acme", "delete", Capability::Delete).unwrap_err().0, FailureCode::Forbidden);
1764	// Write (the default base permission) cannot rename.
1765	// By default a member with Admin changes visibility but does not
1766	// delete; the workspace's member privileges change both.
1767	assert!(admin_only(member_admin, "acme", "change the visibility of", Capability::ChangeVisibility).is_ok());
1768	let open = Asker {
1769	privileges: g1t_contracts::MemberPrivileges { members_can_delete_repositories: true, ..g1t_contracts::MemberPrivileges::default() },
1770	..member_admin
1771	};
1772	assert!(admin_only(open, "acme", "delete", Capability::Delete).is_ok());
1773	let closed = Asker {
1774	privileges: g1t_contracts::MemberPrivileges { members_can_change_repo_visibility: false, ..g1t_contracts::MemberPrivileges::default() },
1775	..member_admin
1776	};
1777	assert_eq!(
1778	admin_only(closed, "acme", "change the visibility of", Capability::ChangeVisibility).unwrap_err().0,
1779	FailureCode::Forbidden
1780	);
1781	// An outside collaborator with Admin never can.
1782	assert_eq!(admin_only(Asker { privileges: open.privileges, ..admin }, "acme", "delete", Capability::Delete).unwrap_err().0, FailureCode::Forbidden);
1783	let writer = Asker { role: Some(Role::Member), repo_role: Some(RepoRole::Write), ..owner() };
1784	let (code, message) = admin_only(writer, "acme", "rename", Capability::Administer).unwrap_err();
1785	assert_eq!(code, FailureCode::Forbidden);
1786	assert_eq!(message, "You need the Admin role on a repository of acme to rename it.");
1787	// Someone who can read a public repository is refused, not told it is missing.
1788	let reader = Asker { role: None, repo_role: Some(RepoRole::Read), ..owner() };
1789	assert_eq!(admin_only(reader, "acme", "archive", Capability::Administer).unwrap_err().0, FailureCode::Forbidden);
1790	let stranger = Asker { role: None, repo_role: None, ..owner() };
1791	assert_eq!(admin_only(stranger, "acme", "archive", Capability::Administer).unwrap_err().0, FailureCode::NotFound);
1792	assert_eq!(admin_only(Asker { person: false, ..owner() }, "acme", "rename", Capability::Administer).unwrap_err().0, FailureCode::Forbidden);
1793	}
1794
1795	#[test]
1796	fn a_workspace_restore_brings_back_only_what_went_with_it() {
1797	assert!(comes_back_with(Some("wsp_1"), "wsp_1"));
1798	// Deleted on its own before the workspace was.
1799	assert!(!comes_back_with(None, "wsp_1"));
1800	// Went with another workspace (it was transferred since).
1801	assert!(!comes_back_with(Some("wsp_2"), "wsp_1"));
1802	}
1803
1804	#[test]
1805	fn a_protected_workspace_keeps_its_repositories_whatever_is_published() {
1806	let protected = g1t_contracts::identity::protected_names(None);
1807	assert_eq!(
1808	may_go_with_workspace("flagon-io", &protected).unwrap_err(),
1809	"flagon-io is protected and can never be deleted."
1810	);
1811	assert!(may_go_with_workspace("FLAGON-IO", &protected).is_err());
1812	assert!(may_go_with_workspace("acme", &protected).is_ok());
1813	let configured = g1t_contracts::identity::protected_names(Some("acme"));
1814	assert!(may_go_with_workspace("acme", &configured).is_err());
1815	}
1816
1817	#[test]
1818	fn the_full_name_confirms_in_any_case() {
1819	assert!(confirmed(&path(), "acme/rocket"));
1820	assert!(confirmed(&path(), " ACME/Rocket "));
1821	assert!(!confirmed(&path(), "rocket"));
1822	assert!(!confirmed(&path(), ""));
1823	}
1824
1825	#[test]
1826	fn a_deleted_repository_is_restorable_for_thirty_days_then_due() {
1827	let deleted_at = 1_790_000_000_000u64;
1828	let purge = purge_after(deleted_at);
1829	assert_eq!(purge, rfc3339(deleted_at + 30 * 86_400_000));
1830	let day = 86_400_000u64;
1831	let at = \|ms: u64\| rfc3339(ms);
1832	assert_eq!(state(None, None, &at(deleted_at)), State::Active);
1833	assert_eq!(state(Some("2026-10-01T00:00:00.000Z"), None, &at(deleted_at)), State::Archived);
1834	let deleted = Some((at(deleted_at), purge.clone()));
1835	let deleted = deleted.as_ref().map(\|(a, b)\| (a.as_str(), b.as_str()));
1836	assert_eq!(state(None, deleted, &at(deleted_at + day)), State::Deleted);
1837	assert_eq!(state(None, deleted, &at(deleted_at + 30 * day - 1)), State::Deleted);
1838	assert_eq!(state(None, deleted, &at(deleted_at + 30 * day)), State::Due);
1839	// Archived and then deleted: deleted is what counts.
1840	assert_eq!(state(Some("x"), deleted, &at(deleted_at + day)), State::Deleted);
1841	assert!(restorable(&purge, &at(deleted_at + 29 * day)));
1842	assert!(!restorable(&purge, &at(deleted_at + 31 * day)));
1843	}
1844
1845	#[test]
1846	fn a_rename_needs_a_valid_free_name() {
1847	assert_eq!(new_name("acme", "rocket", " Booster ", Held::Free).unwrap(), "booster");
1848	assert_eq!(new_name("acme", "rocket", "rocket", Held::Free).unwrap_err().0, FailureCode::Invalid);
1849	assert_eq!(new_name("acme", "rocket", "no spaces", Held::Free).unwrap_err().0, FailureCode::Invalid);
1850	assert_eq!(new_name("acme", "rocket", "x.git", Held::Free).unwrap_err().0, FailureCode::Invalid);
1851	let (code, message) = new_name("acme", "rocket", "booster", Held::ByRepo).unwrap_err();
1852	assert_eq!(code, FailureCode::Conflict);
1853	assert_eq!(message, "acme already has a repository named booster.");
1854	let (code, message) = new_name("acme", "rocket", "booster", Held::ByDeleted).unwrap_err();
1855	assert_eq!(code, FailureCode::Conflict);
1856	assert!(message.contains("deleted recently"));
1857	}
1858
1859	fn repo(archived: bool) -> Repo {
1860	Repo {
1861	id: "rep_1".into(),
1862	namespace: "acme".into(),
1863	name: "rocket".into(),
1864	is_private: false,
1865	owner_id: "usr_1".into(),
1866	default_branch: "main".into(),
1867	fork_of: None,
1868	parent_id: None,
1869	forked_from: None,
1870	parent: None,
1871	allow_forking: false,
1872	max_ref_updates: None,
1873	protected: false,
1874	created_at: String::new(),
1875	topics: Vec::new(),
1876	website: None,
1877	archived_at: archived.then(\|\| "2026-10-05T00:00:00.000Z".to_owned()),
1878	}
1879	}
1880
1881	#[test]
1882	fn an_archived_repository_refuses_writes() {
1883	let (code, message) = read_only_refusal(&repo(true)).unwrap();
1884	assert_eq!(code, FailureCode::Forbidden);
1885	assert!(message.contains("archived"));
1886	assert!(read_only_refusal(&repo(false)).is_none());
1887	}
1888
1889	#[test]
1890	fn an_archived_repository_refuses_writes_with_the_reason() {
1891	assert!(archived_refusal(&repo(false)).is_none());
1892	let (code, message) = archived_refusal(&repo(true)).unwrap();
1893	assert_eq!(code, FailureCode::Forbidden);
1894	assert_eq!(message, "acme/rocket is archived, so it is read-only. An owner can unarchive it in its settings.");
1895	}
1896
1897	#[test]
1898	fn going_private_on_a_free_workspace_needs_room() {
1899	let full = VisibilityFacts {
1900	to_private: true,
1901	free: true,
1902	private_bytes: 900_000_000,
1903	bytes: 200_000_000,
1904	free_private_bytes: 1_000_000_000,
1905	};
1906	assert_eq!(visibility_check("acme", &full).unwrap_err().0, FailureCode::PaymentRequired);
1907	assert!(visibility_check("acme", &VisibilityFacts { free: false, ..full }).is_ok());
1908	let full = VisibilityFacts {
1909	to_private: true,
1910	free: true,
1911	private_bytes: 900_000_000,
1912	bytes: 200_000_000,
1913	free_private_bytes: 1_000_000_000,
1914	};
1915	// Going public is never refused.
1916	assert!(visibility_check("acme", &VisibilityFacts { to_private: false, ..full }).is_ok());
1917	let light = VisibilityFacts {
1918	to_private: true,
1919	free: true,
1920	private_bytes: 1_000,
1921	bytes: 1_000,
1922	free_private_bytes: 1_000_000_000,
1923	};
1924	assert!(visibility_check("acme", &light).is_ok());
1925	}
1926
1927	#[test]
1928	fn a_branch_is_renamed_to_a_free_valid_name() {
1929	let branches = vec!["main".to_owned(), "dev".to_owned()];
1930	assert_eq!(branch_rename("main", " trunk ", &branches).unwrap(), "trunk");
1931	assert_eq!(branch_rename("nope", "trunk", &branches).unwrap_err().0, FailureCode::NotFound);
1932	assert_eq!(branch_rename("main", "dev", &branches).unwrap_err().0, FailureCode::Conflict);
1933	assert_eq!(branch_rename("main", "main", &branches).unwrap_err().0, FailureCode::Invalid);
1934	assert_eq!(branch_rename("main", "a b", &branches).unwrap_err().0, FailureCode::Invalid);
1935	assert_eq!(branch_rename("main", "g1t-queue", &branches).unwrap_err().0, FailureCode::Invalid);
1936	}
1937
1938	fn branch(name: &str, hash: &str) -> Branch {
1939	Branch { name: name.to_owned(), hash: hash.to_owned() }
1940	}
1941
1942	#[test]
1943	fn a_branch_is_made_with_a_free_valid_name_that_is_no_other_branch_folder() {
1944	let branches = vec![branch("main", "aaa"), branch("feature", "bbb"), branch("fix/login", "ccc")];
1945	assert_eq!(branch_creation(" docs/intro ", &branches).unwrap(), "docs/intro");
1946	assert_eq!(branch_creation("main", &branches).unwrap_err().0, FailureCode::Conflict);
1947	// `feature` is a branch, so it cannot also be a folder of one.
1948	assert_eq!(branch_creation("feature/new", &branches).unwrap_err().0, FailureCode::Conflict);
1949	// `fix` holds `fix/login`, so it cannot be a branch itself.
1950	assert_eq!(branch_creation("fix", &branches).unwrap_err().0, FailureCode::Conflict);
1951	assert!(branch_creation("fixes", &branches).is_ok());
1952	assert_eq!(branch_creation("a b", &branches).unwrap_err().0, FailureCode::Invalid);
1953	assert_eq!(branch_creation("g1t-queue/1", &branches).unwrap_err().0, FailureCode::Invalid);
1954	assert_eq!(branch_creation("", &branches).unwrap_err().0, FailureCode::Invalid);
1955	}
1956
1957	#[test]
1958	fn a_branch_is_deleted_only_when_it_is_not_the_default_and_has_not_moved() {
1959	let branches = vec![branch("main", "aaa"), branch("feature", "bbb")];
1960	assert_eq!(branch_removal("feature", "main", None, &branches).unwrap(), "bbb");
1961	assert_eq!(branch_removal("feature", "main", Some("bbb"), &branches).unwrap(), "bbb");
1962	assert_eq!(branch_removal("feature", "main", Some(""), &branches).unwrap(), "bbb");
1963	assert_eq!(branch_removal("feature", "main", Some("ccc"), &branches).unwrap_err().0, FailureCode::Conflict);
1964	assert_eq!(branch_removal("main", "main", None, &branches).unwrap_err().0, FailureCode::Forbidden);
1965	assert_eq!(branch_removal("gone", "main", None, &branches).unwrap_err().0, FailureCode::NotFound);
1966	}
1967
1968	#[test]
1969	fn the_empty_pack_is_well_formed() {
1970	assert_eq!(EMPTY_PACK.len(), 32);
1971	assert!(EMPTY_PACK.starts_with(b"PACK\0\0\0\x02\0\0\0\0"));
1972	}
1973	}