| 1 | import { execFile, execFileSync } from 'node:child_process'; |
| 2 | import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'; |
| 3 | import { tmpdir } from 'node:os'; |
| 4 | import path from 'node:path'; |
| 5 | import { promisify } from 'node:util'; |
| 6 | import type { INestApplication } from '@nestjs/common'; |
| 7 | import request from 'supertest'; |
| 8 | import { afterAll, beforeAll, describe, expect, it } from 'vitest'; |
| 9 | |
| 10 | import { hasBackends, signUp, startApp } from './harness.js'; |
| 11 | |
| 12 | describe.skipIf(!hasBackends)('pull request reviews and drafts', () => { |
| 13 | let app: INestApplication; |
| 14 | let origin: string; |
| 15 | let author: { cookie: string; key: string }; |
| 16 | let reviewer: { cookie: string; key: string }; |
| 17 | let bystander: { cookie: string; key: string; username: string }; |
| 18 | let work: string; |
| 19 | const owner = `author${Date.now()}`; |
| 20 | const other = `reviewer${Date.now()}`; |
| 21 | let repo: string; |
| 22 | |
| 23 | const api = () => request(app.getHttpServer()); |
| 24 | const pull = (suffix = '') => |
| 25 | `/api/repositories/${owner}/${repo}/pulls/1${suffix}`; |
| 26 | const git = (...args: string[]) => |
| 27 | execFileSync( |
| 28 | 'git', |
| 29 | ['-c', 'user.name=E2E', '-c', 'user.email=e2e@example.com', ...args], |
| 30 | { cwd: work, encoding: 'utf8' }, |
| 31 | ).trim(); |
| 32 | // The server runs in this process, so anything that talks to it must not block the event loop. |
| 33 | const remote = (verb: 'push' | 'fetch', ...refs: string[]) => |
| 34 | promisify(execFile)( |
| 35 | 'git', |
| 36 | [ |
| 37 | verb, |
| 38 | '-q', |
| 39 | `${origin.replace('://', `://${owner}:${author.key}@`)}/${owner}/${repo}.git`, |
| 40 | ...refs, |
| 41 | ], |
| 42 | { cwd: work, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } }, |
| 43 | ); |
| 44 | const push = (...refs: string[]) => remote('push', ...refs); |
| 45 | const review = (cookie: string, body: object) => |
| 46 | api().post(pull('/reviews')).set('cookie', cookie).send(body); |
| 47 | |
| 48 | beforeAll(async () => { |
| 49 | ({ app, origin } = await startApp()); |
| 50 | author = await signUp(app, owner); |
| 51 | reviewer = await signUp(app, other); |
| 52 | const bystanderName = `bystander${Date.now()}`; |
| 53 | bystander = { |
| 54 | ...(await signUp(app, bystanderName)), |
| 55 | username: bystanderName, |
| 56 | }; |
| 57 | |
| 58 | repo = ( |
| 59 | await api() |
| 60 | .post('/api/repositories') |
| 61 | .set('cookie', author.cookie) |
| 62 | .send({ name: 'reviewed', visibility: 'public' }) |
| 63 | .expect(201) |
| 64 | ).body.slug; |
| 65 | work = mkdtempSync(path.join(tmpdir(), 'ghost-e2e-review-')); |
| 66 | git('init', '-q', '-b', 'main'); |
| 67 | writeFileSync(path.join(work, 'a.txt'), 'one\n'); |
| 68 | // Twenty lines changed at both ends diff as two hunks. |
| 69 | const lines = Array.from({ length: 20 }, (_, i) => `line ${i + 1}`); |
| 70 | writeFileSync(path.join(work, 'b.txt'), `${lines.join('\n')}\n`); |
| 71 | git('add', '.'); |
| 72 | git('commit', '-q', '-m', 'first'); |
| 73 | git('checkout', '-q', '-b', 'feature'); |
| 74 | writeFileSync(path.join(work, 'a.txt'), 'one\ntwo\n'); |
| 75 | writeFileSync( |
| 76 | path.join(work, 'b.txt'), |
| 77 | `${['first', ...lines.slice(1, -1), 'last'].join('\n')}\n`, |
| 78 | ); |
| 79 | git('commit', '-q', '-am', 'second'); |
| 80 | await push('main', 'feature'); |
| 81 | |
| 82 | await api() |
| 83 | .post(`/api/repositories/${owner}/${repo}/pulls`) |
| 84 | .set('cookie', author.cookie) |
| 85 | .send({ title: 'Feature', base: 'main', head: 'feature', draft: true }) |
| 86 | .expect(201) |
| 87 | .expect(({ body }) => expect(body.draft).toBe(true)); |
| 88 | }, 120_000); |
| 89 | |
| 90 | afterAll(async () => { |
| 91 | await app?.close(); |
| 92 | if (work) rmSync(work, { recursive: true, force: true }); |
| 93 | }); |
| 94 | |
| 95 | it('refuses to merge a draft, and lets only the author or a writer mark it ready', async () => { |
| 96 | const merge = await api() |
| 97 | .post(pull('/merge')) |
| 98 | .set('cookie', author.cookie) |
| 99 | .send({}) |
| 100 | .expect(409); |
| 101 | expect(merge.body.message).toContain('draft'); |
| 102 | expect((await api().get(pull()).expect(200)).body.mergeable).toBe(false); |
| 103 | |
| 104 | await api().post(pull('/ready')).set('cookie', reviewer.cookie).expect(403); |
| 105 | const ready = await api() |
| 106 | .post(pull('/ready')) |
| 107 | .set('cookie', author.cookie) |
| 108 | .expect(201); |
| 109 | expect(ready.body.draft).toBe(false); |
| 110 | // A second call changes nothing and records nothing. |
| 111 | await api().post(pull('/ready')).set('cookie', author.cookie).expect(201); |
| 112 | |
| 113 | const { body } = await api().get(pull()).expect(200); |
| 114 | expect(body.draft).toBe(false); |
| 115 | }); |
| 116 | |
| 117 | it('rejects reviews that say nothing, verdicts on your own request, and lines outside the diff', async () => { |
| 118 | await review(author.cookie, { state: 'approved' }).expect(400); |
| 119 | await review(reviewer.cookie, { state: 'commented', body: ' ' }).expect( |
| 120 | 400, |
| 121 | ); |
| 122 | for (const [path, side, line] of [ |
| 123 | ['missing.txt', 'additions', 1], |
| 124 | ['a.txt', 'additions', 3], |
| 125 | ['a.txt', 'deletions', 2], |
| 126 | ] as const) { |
| 127 | const stray = await review(reviewer.cookie, { |
| 128 | state: 'commented', |
| 129 | comments: [{ path, side, line, body: 'x' }], |
| 130 | }).expect(400); |
| 131 | expect(stray.body.message).toContain(`${path}:${line}`); |
| 132 | } |
| 133 | }); |
| 134 | |
| 135 | it('keeps pending comments private until the review is submitted, then records what they mention', async () => { |
| 136 | await api() |
| 137 | .post(`/api/repositories/${owner}/${repo}/issues`) |
| 138 | .set('cookie', author.cookie) |
| 139 | .send({ title: 'Tracked' }) |
| 140 | .expect(201); |
| 141 | const mentions = async () => |
| 142 | ( |
| 143 | await api() |
| 144 | .get(`/api/repositories/${owner}/${repo}/issues/2/timeline`) |
| 145 | .expect(200) |
| 146 | ).body.timeline.filter( |
| 147 | (item: { kind: string }) => item.kind === 'reference', |
| 148 | ); |
| 149 | |
| 150 | const added = await api() |
| 151 | .post(pull('/reviews/pending/comments')) |
| 152 | .set('cookie', reviewer.cookie) |
| 153 | .send({ path: 'a.txt', side: 'additions', line: 2, body: 'See #2' }) |
| 154 | .expect(201); |
| 155 | expect(added.body.review).toMatchObject({ |
| 156 | state: null, |
| 157 | comments: [{ line: 2, body: 'See #2' }], |
| 158 | }); |
| 159 | const pendingId = added.body.review.comments[0].id; |
| 160 | |
| 161 | const { body: others } = await api() |
| 162 | .get(pull('/reviews/pending')) |
| 163 | .set('cookie', bystander.cookie) |
| 164 | .expect(200); |
| 165 | expect(others.review).toBeNull(); |
| 166 | await api() |
| 167 | .patch(pull(`/comments/${pendingId}`)) |
| 168 | .set('cookie', author.cookie) |
| 169 | .send({ body: 'x' }) |
| 170 | .expect(404); |
| 171 | await api() |
| 172 | .post(pull(`/comments/${pendingId}/replies`)) |
| 173 | .set('cookie', reviewer.cookie) |
| 174 | .send({ body: 'x' }) |
| 175 | .expect(409); |
| 176 | expect(await mentions()).toEqual([]); |
| 177 | |
| 178 | // Discarding throws the batch away; the next comment starts a new one. |
| 179 | await api() |
| 180 | .delete(pull('/reviews/pending')) |
| 181 | .set('cookie', reviewer.cookie) |
| 182 | .expect(200); |
| 183 | expect( |
| 184 | ( |
| 185 | await api() |
| 186 | .get(pull('/reviews/pending')) |
| 187 | .set('cookie', reviewer.cookie) |
| 188 | .expect(200) |
| 189 | ).body.review, |
| 190 | ).toBeNull(); |
| 191 | await api() |
| 192 | .post(pull('/reviews/pending/comments')) |
| 193 | .set('cookie', reviewer.cookie) |
| 194 | .send({ path: 'a.txt', side: 'additions', line: 2, body: 'See #2' }) |
| 195 | .expect(201); |
| 196 | |
| 197 | const submitted = await review(reviewer.cookie, { |
| 198 | state: 'changes_requested', |
| 199 | body: 'Needs work', |
| 200 | }).expect(201); |
| 201 | expect(submitted.body).toMatchObject({ |
| 202 | kind: 'review', |
| 203 | state: 'changes_requested', |
| 204 | authorUsername: other, |
| 205 | comments: [ |
| 206 | { |
| 207 | path: 'a.txt', |
| 208 | side: 'additions', |
| 209 | line: 2, |
| 210 | body: 'See #2', |
| 211 | authorUsername: other, |
| 212 | diffHunk: '@@ -1,1 +1,2 @@\n one\n+two', |
| 213 | replies: [], |
| 214 | }, |
| 215 | ], |
| 216 | }); |
| 217 | expect( |
| 218 | ( |
| 219 | await api() |
| 220 | .get(pull('/reviews/pending')) |
| 221 | .set('cookie', reviewer.cookie) |
| 222 | .expect(200) |
| 223 | ).body.review, |
| 224 | ).toBeNull(); |
| 225 | expect(await mentions()).toHaveLength(1); |
| 226 | }); |
| 227 | |
| 228 | it('threads replies, and limits editing and deleting to the author or a writer', async () => { |
| 229 | const { body } = await api() |
| 230 | .get(`/api/repositories/${owner}/${repo}/issues/1/timeline`) |
| 231 | .expect(200); |
| 232 | const [thread] = body.timeline.find( |
| 233 | (item: { kind: string }) => item.kind === 'review', |
| 234 | ).comments; |
| 235 | |
| 236 | const first = await api() |
| 237 | .post(pull(`/comments/${thread.id}/replies`)) |
| 238 | .set('cookie', author.cookie) |
| 239 | .send({ body: 'Fixed' }) |
| 240 | .expect(201); |
| 241 | expect(first.body).toMatchObject({ body: 'Fixed', authorUsername: owner }); |
| 242 | // A reply to a reply joins the same thread. |
| 243 | await api() |
| 244 | .post(pull(`/comments/${first.body.id}/replies`)) |
| 245 | .set('cookie', bystander.cookie) |
| 246 | .send({ body: 'Nice' }) |
| 247 | .expect(201); |
| 248 | |
| 249 | await api() |
| 250 | .patch(pull(`/comments/${first.body.id}`)) |
| 251 | .set('cookie', bystander.cookie) |
| 252 | .send({ body: 'x' }) |
| 253 | .expect(403); |
| 254 | // A writer may delete someone else's comment, but only its author may edit it. |
| 255 | await api() |
| 256 | .patch(pull(`/comments/${thread.id}`)) |
| 257 | .set('cookie', author.cookie) |
| 258 | .send({ body: 'Edited by a writer' }) |
| 259 | .expect(403); |
| 260 | const edited = await api() |
| 261 | .patch(pull(`/comments/${thread.id}`)) |
| 262 | .set('cookie', reviewer.cookie) |
| 263 | .send({ body: 'Edited by its author' }) |
| 264 | .expect(200); |
| 265 | expect(edited.body).toMatchObject({ |
| 266 | body: 'Edited by its author', |
| 267 | authorUsername: other, |
| 268 | }); |
| 269 | |
| 270 | const reviewId = body.timeline.find( |
| 271 | (item: { kind: string }) => item.kind === 'review', |
| 272 | ).id; |
| 273 | for (const cookie of [bystander.cookie, author.cookie]) { |
| 274 | await api() |
| 275 | .patch(pull(`/reviews/${reviewId}`)) |
| 276 | .set('cookie', cookie) |
| 277 | .send({ body: 'x' }) |
| 278 | .expect(403); |
| 279 | } |
| 280 | await api() |
| 281 | .patch(pull(`/reviews/${reviewId}`)) |
| 282 | .set('cookie', reviewer.cookie) |
| 283 | .send({ body: 'Still needs work' }) |
| 284 | .expect(200); |
| 285 | |
| 286 | const { body: after } = await api() |
| 287 | .get(`/api/repositories/${owner}/${repo}/issues/1/timeline`) |
| 288 | .expect(200); |
| 289 | const reviewed = after.timeline.find( |
| 290 | (item: { kind: string }) => item.kind === 'review', |
| 291 | ); |
| 292 | expect(reviewed.body).toBe('Still needs work'); |
| 293 | expect( |
| 294 | reviewed.comments[0].replies.map((r: { body: string }) => r.body), |
| 295 | ).toEqual(['Fixed', 'Nice']); |
| 296 | |
| 297 | await api() |
| 298 | .delete(pull(`/comments/${first.body.id}`)) |
| 299 | .set('cookie', bystander.cookie) |
| 300 | .expect(403); |
| 301 | await api() |
| 302 | .delete(pull(`/comments/${first.body.id}`)) |
| 303 | .set('cookie', author.cookie) |
| 304 | .expect(200); |
| 305 | |
| 306 | const issueComment = (id = '') => |
| 307 | `/api/repositories/${owner}/${repo}/issues/1/comments${id && `/${id}`}`; |
| 308 | const posted = await api() |
| 309 | .post(issueComment()) |
| 310 | .set('cookie', bystander.cookie) |
| 311 | .send({ body: 'From the sidelines' }) |
| 312 | .expect(201); |
| 313 | await api() |
| 314 | .patch(issueComment(posted.body.id)) |
| 315 | .set('cookie', author.cookie) |
| 316 | .send({ body: 'Rewritten by the owner' }) |
| 317 | .expect(403); |
| 318 | await api() |
| 319 | .delete(issueComment(posted.body.id)) |
| 320 | .set('cookie', author.cookie) |
| 321 | .expect(200); |
| 322 | }); |
| 323 | |
| 324 | it('drops a comment-only review once its last comment is deleted', async () => { |
| 325 | const { body } = await review(bystander.cookie, { |
| 326 | state: 'commented', |
| 327 | comments: [ |
| 328 | { path: 'a.txt', side: 'deletions', line: 1, body: 'Old line' }, |
| 329 | ], |
| 330 | }).expect(201); |
| 331 | await api() |
| 332 | .delete(pull(`/comments/${body.comments[0].id}`)) |
| 333 | .set('cookie', bystander.cookie) |
| 334 | .expect(200); |
| 335 | await api() |
| 336 | .patch(pull(`/reviews/${body.id}`)) |
| 337 | .set('cookie', bystander.cookie) |
| 338 | .send({ body: 'x' }) |
| 339 | .expect(404); |
| 340 | }); |
| 341 | |
| 342 | it('counts each reviewer’s latest verdict until a writer dismisses it', async () => { |
| 343 | const approval = await review(reviewer.cookie, { |
| 344 | state: 'approved', |
| 345 | }).expect(201); |
| 346 | expect((await api().get(pull()).expect(200)).body.reviewers).toEqual([ |
| 347 | // signUp gives no avatar |
| 348 | { username: other, image: null, state: 'approved' }, |
| 349 | ]); |
| 350 | |
| 351 | await api() |
| 352 | .post(pull(`/reviews/${approval.body.id}/dismiss`)) |
| 353 | .set('cookie', reviewer.cookie) |
| 354 | .send({ message: 'no' }) |
| 355 | .expect(403); |
| 356 | const dismissed = await api() |
| 357 | .post(pull(`/reviews/${approval.body.id}/dismiss`)) |
| 358 | .set('cookie', author.cookie) |
| 359 | .send({ message: 'Stale' }) |
| 360 | .expect(201); |
| 361 | expect(dismissed.body).toMatchObject({ |
| 362 | dismissedByUsername: owner, |
| 363 | dismissalMessage: 'Stale', |
| 364 | }); |
| 365 | await api() |
| 366 | .post(pull(`/reviews/${approval.body.id}/dismiss`)) |
| 367 | .set('cookie', author.cookie) |
| 368 | .send({ message: 'Again' }) |
| 369 | .expect(409); |
| 370 | |
| 371 | // The older request for changes does not come back. |
| 372 | expect((await api().get(pull()).expect(200)).body.reviewers).toEqual([]); |
| 373 | }); |
| 374 | |
| 375 | it('turns a request back into a draft for the author or a writer, and records it', async () => { |
| 376 | await api() |
| 377 | .post(pull('/draft')) |
| 378 | .set('cookie', bystander.cookie) |
| 379 | .expect(403); |
| 380 | const draft = await api() |
| 381 | .post(pull('/draft')) |
| 382 | .set('cookie', author.cookie) |
| 383 | .expect(201); |
| 384 | expect(draft.body.draft).toBe(true); |
| 385 | await api() |
| 386 | .post(pull('/merge')) |
| 387 | .set('cookie', author.cookie) |
| 388 | .send({}) |
| 389 | .expect(409); |
| 390 | await api().post(pull('/ready')).set('cookie', author.cookie).expect(201); |
| 391 | |
| 392 | const { body } = await api() |
| 393 | .get(`/api/repositories/${owner}/${repo}/issues/1/timeline`) |
| 394 | .expect(200); |
| 395 | const events = body.timeline |
| 396 | .filter((item: { kind: string }) => item.kind === 'event') |
| 397 | .map((item: { event: { type: string } }) => item.event.type); |
| 398 | expect(events).toEqual([ |
| 399 | 'opened', |
| 400 | 'ready_for_review', |
| 401 | 'converted_to_draft', |
| 402 | 'ready_for_review', |
| 403 | ]); |
| 404 | }); |
| 405 | |
| 406 | it('comments on a range of lines, which must start before it ends and sit inside the diff', async () => { |
| 407 | const range = (startLine: number, line: number) => |
| 408 | review(bystander.cookie, { |
| 409 | state: 'commented', |
| 410 | comments: [ |
| 411 | { |
| 412 | path: 'a.txt', |
| 413 | side: 'additions', |
| 414 | line, |
| 415 | startLine, |
| 416 | body: 'Both lines', |
| 417 | }, |
| 418 | ], |
| 419 | }); |
| 420 | await range(2, 1).expect(400); |
| 421 | await range(3, 2).expect(400); |
| 422 | const { body } = await range(1, 2).expect(201); |
| 423 | expect(body.comments[0]).toMatchObject({ |
| 424 | startLine: 1, |
| 425 | startSide: null, |
| 426 | line: 2, |
| 427 | }); |
| 428 | }); |
| 429 | |
| 430 | it('applies a suggestion as a commit on the head branch for someone who can write to it', async () => { |
| 431 | const { body } = await review(bystander.cookie, { |
| 432 | state: 'commented', |
| 433 | comments: [ |
| 434 | { |
| 435 | path: 'a.txt', |
| 436 | side: 'additions', |
| 437 | line: 2, |
| 438 | body: 'Shout it:\n```suggestion\nTWO\n```', |
| 439 | }, |
| 440 | ], |
| 441 | }).expect(201); |
| 442 | const suggestion = body.comments[0].id; |
| 443 | const plain = ( |
| 444 | await review(bystander.cookie, { |
| 445 | state: 'commented', |
| 446 | comments: [ |
| 447 | { |
| 448 | path: 'a.txt', |
| 449 | side: 'deletions', |
| 450 | line: 1, |
| 451 | body: '```suggestion\nx\n```', |
| 452 | }, |
| 453 | ], |
| 454 | }).expect(201) |
| 455 | ).body.comments[0].id; |
| 456 | |
| 457 | await api() |
| 458 | .post(pull(`/comments/${suggestion}/apply`)) |
| 459 | .set('cookie', bystander.cookie) |
| 460 | .expect(403); |
| 461 | await api() |
| 462 | .post(pull(`/comments/${plain}/apply`)) |
| 463 | .set('cookie', author.cookie) |
| 464 | .expect(400); |
| 465 | |
| 466 | const applied = await api() |
| 467 | .post(pull(`/comments/${suggestion}/apply`)) |
| 468 | .set('cookie', author.cookie) |
| 469 | .expect(201); |
| 470 | expect((await api().get(pull()).expect(200)).body.headSha).toBe( |
| 471 | applied.body.commitSha, |
| 472 | ); |
| 473 | const commits = await api().get(pull('/commits')).expect(200); |
| 474 | expect(commits.body.commits[0]).toMatchObject({ |
| 475 | sha: applied.body.commitSha, |
| 476 | subject: `Apply suggestion from ${bystander.username}`, |
| 477 | }); |
| 478 | const patch = await api() |
| 479 | .get(pull('/patch')) |
| 480 | .query({ path: 'a.txt' }) |
| 481 | .expect(200); |
| 482 | expect(patch.text).toContain('+TWO'); |
| 483 | |
| 484 | // The branch has moved past the commit the suggestion was made on. |
| 485 | await api() |
| 486 | .post(pull(`/comments/${suggestion}/apply`)) |
| 487 | .set('cookie', author.cookie) |
| 488 | .expect(409); |
| 489 | }); |
| 490 | |
| 491 | it('keeps a range inside one hunk, so it never covers lines the diff hides', async () => { |
| 492 | const { body } = await review(bystander.cookie, { |
| 493 | state: 'commented', |
| 494 | comments: [ |
| 495 | { |
| 496 | path: 'b.txt', |
| 497 | side: 'additions', |
| 498 | startLine: 1, |
| 499 | line: 20, |
| 500 | body: 'All of it', |
| 501 | }, |
| 502 | ], |
| 503 | }).expect(400); |
| 504 | expect(body.message).toContain('b.txt:1'); |
| 505 | }); |
| 506 | |
| 507 | it('closes reviews once the request is merged', async () => { |
| 508 | await api() |
| 509 | .post(pull('/merge')) |
| 510 | .set('cookie', author.cookie) |
| 511 | .send({}) |
| 512 | .expect(201); |
| 513 | await review(reviewer.cookie, { state: 'approved' }).expect(409); |
| 514 | }); |
| 515 | |
| 516 | it('names the files a conflicting request clashes on, and refuses to merge it', async () => { |
| 517 | await remote('fetch', 'main'); |
| 518 | git('checkout', '-q', '-B', 'main', 'FETCH_HEAD'); |
| 519 | git('checkout', '-q', '-b', 'clash'); |
| 520 | writeFileSync(path.join(work, 'a.txt'), 'uno\n'); |
| 521 | git('commit', '-q', '-am', 'clash side'); |
| 522 | git('checkout', '-q', 'main'); |
| 523 | writeFileSync(path.join(work, 'a.txt'), 'ONE\n'); |
| 524 | git('commit', '-q', '-am', 'main side'); |
| 525 | await push('main', 'clash'); |
| 526 | |
| 527 | const { body: opened } = await api() |
| 528 | .post(`/api/repositories/${owner}/${repo}/pulls`) |
| 529 | .set('cookie', author.cookie) |
| 530 | .send({ title: 'Clash', base: 'main', head: 'clash' }) |
| 531 | .expect(201); |
| 532 | const at = `/api/repositories/${owner}/${repo}/pulls/${opened.number}`; |
| 533 | |
| 534 | const { body } = await api().get(at).expect(200); |
| 535 | expect(body).toMatchObject({ mergeable: false, conflicts: ['a.txt'] }); |
| 536 | const merge = await api() |
| 537 | .post(`${at}/merge`) |
| 538 | .set('cookie', author.cookie) |
| 539 | .send({}) |
| 540 | .expect(409); |
| 541 | expect(merge.body.message).toContain('a.txt'); |
| 542 | }); |
| 543 | }); |