diff --git a/appview/pulls/pulls.go b/appview/pulls/pulls.go --- a/appview/pulls/pulls.go +++ b/appview/pulls/pulls.go @@ -849,6 +849,7 @@ targetBranch := r.FormValue("targetBranch") fromFork := r.FormValue("fork") sourceBranch := r.FormValue("sourceBranch") patch := r.FormValue("patch") + userDid := syntax.DID(user.Active.Did) if targetBranch == "" { s.pages.Notice(w, "pull", "Target branch is required.") @@ -856,7 +857,7 @@ return } // Determine PR type based on input parameters - roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(user.Active.Did, f.Knot, f.DidSlashRepo())} + roles := repoinfo.RolesInRepo{Roles: s.enforcer.GetPermissionsInRepo(userDid.String(), f.Knot, f.DidSlashRepo())} isPushAllowed := roles.IsPushAllowed() isBranchBased := isPushAllowed && sourceBranch != "" && fromFork == "" isForkBased := fromFork != "" && sourceBranch != "" @@ -934,19 +935,19 @@ if !caps.PullRequests.BranchSubmissions { s.pages.Notice(w, "pull", "This knot doesn't support branch-based pull requests. Try another way?") return } - s.handleBranchBasedPull(w, r, f, user, title, body, targetBranch, sourceBranch, isStacked) + s.handleBranchBasedPull(w, r, f, userDid, title, body, targetBranch, sourceBranch, isStacked) } else if isForkBased { if !caps.PullRequests.ForkSubmissions { s.pages.Notice(w, "pull", "This knot doesn't support fork-based pull requests. Try another way?") return } - s.handleForkBasedPull(w, r, f, user, fromFork, title, body, targetBranch, sourceBranch, isStacked) + s.handleForkBasedPull(w, r, f, userDid, fromFork, title, body, targetBranch, sourceBranch, isStacked) } else if isPatchBased { if !caps.PullRequests.PatchSubmissions { s.pages.Notice(w, "pull", "This knot doesn't support patch-based pull requests. Send your patch over email.") return } - s.handlePatchBasedPull(w, r, f, user, title, body, targetBranch, patch, isStacked) + s.handlePatchBasedPull(w, r, f, userDid, title, body, targetBranch, patch, isStacked) } return } @@ -956,7 +957,7 @@ func (s *Pulls) handleBranchBasedPull( w http.ResponseWriter, r *http.Request, repo *models.Repo, - user *oauth.MultiAccountUser, + userDid syntax.DID, title, body, targetBranch, @@ -1010,20 +1011,20 @@ Branch: sourceBranch, Sha: comparison.Rev2, } - s.createPullRequest(w, r, repo, user, title, body, targetBranch, patch, combined, sourceRev, pullSource, recordPullSource, isStacked) + s.createPullRequest(w, r, repo, userDid, title, body, targetBranch, patch, combined, sourceRev, pullSource, recordPullSource, isStacked) } -func (s *Pulls) handlePatchBasedPull(w http.ResponseWriter, r *http.Request, repo *models.Repo, user *oauth.MultiAccountUser, title, body, targetBranch, patch string, isStacked bool) { +func (s *Pulls) handlePatchBasedPull(w http.ResponseWriter, r *http.Request, repo *models.Repo, userDid syntax.DID, title, body, targetBranch, patch string, isStacked bool) { if err := s.validator.ValidatePatch(&patch); err != nil { s.logger.Error("patch validation failed", "err", err) s.pages.Notice(w, "pull", "Invalid patch format. Please provide a valid diff.") return } - s.createPullRequest(w, r, repo, user, title, body, targetBranch, patch, "", "", nil, nil, isStacked) + s.createPullRequest(w, r, repo, userDid, title, body, targetBranch, patch, "", "", nil, nil, isStacked) } -func (s *Pulls) handleForkBasedPull(w http.ResponseWriter, r *http.Request, repo *models.Repo, user *oauth.MultiAccountUser, forkRepo string, title, body, targetBranch, sourceBranch string, isStacked bool) { +func (s *Pulls) handleForkBasedPull(w http.ResponseWriter, r *http.Request, repo *models.Repo, userDid syntax.DID, forkRepo string, title, body, targetBranch, sourceBranch string, isStacked bool) { repoString := strings.SplitN(forkRepo, "/", 2) forkOwnerDid := repoString[0] repoName := repoString[1] @@ -1125,14 +1126,14 @@ Repo: &forkAtUriStr, Sha: sourceRev, } - s.createPullRequest(w, r, repo, user, title, body, targetBranch, patch, combined, sourceRev, pullSource, recordPullSource, isStacked) + s.createPullRequest(w, r, repo, userDid, title, body, targetBranch, patch, combined, sourceRev, pullSource, recordPullSource, isStacked) } func (s *Pulls) createPullRequest( w http.ResponseWriter, r *http.Request, repo *models.Repo, - user *oauth.MultiAccountUser, + userDid syntax.DID, title, body, targetBranch string, patch string, combined string, @@ -1147,7 +1148,7 @@ s.createStackedPullRequest( w, r, repo, - user, + userDid, targetBranch, patch, sourceRev, @@ -1204,7 +1205,7 @@ pull := &models.Pull{ Title: title, Body: body, TargetBranch: targetBranch, - OwnerDid: user.Active.Did, + OwnerDid: userDid.String(), RepoAt: repo.RepoAt(), Rkey: rkey, Mentions: mentions, @@ -1236,7 +1237,7 @@ } _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ Collection: tangled.RepoPullNSID, - Repo: user.Active.Did, + Repo: userDid.String(), Rkey: rkey, Record: &lexutil.LexiconTypeDecoder{ Val: &tangled.RepoPull{ @@ -1273,7 +1274,7 @@ func (s *Pulls) createStackedPullRequest( w http.ResponseWriter, r *http.Request, repo *models.Repo, - user *oauth.MultiAccountUser, + userDid syntax.DID, targetBranch string, patch string, sourceRev string, @@ -1304,7 +1305,7 @@ } // build a stack out of this patch stackId := uuid.New() - stack, err := s.newStack(r.Context(), repo, user, targetBranch, patch, pullSource, stackId.String()) + stack, err := s.newStack(r.Context(), repo, userDid, targetBranch, patch, pullSource, stackId.String()) if err != nil { log.Println("failed to create stack", err) s.pages.Notice(w, "pull", fmt.Sprintf("Failed to create stack: %v", err)) @@ -1341,7 +1342,7 @@ }, }) } _, err = comatproto.RepoApplyWrites(r.Context(), client, &comatproto.RepoApplyWrites_Input{ - Repo: user.Active.Did, + Repo: userDid.String(), Writes: writes, }) if err != nil { @@ -1625,21 +1626,21 @@ s.pages.Notice(w, "pull-error", "Failed to edit patch. Try again later.") return } + if user == nil || user.Active.Did != pull.OwnerDid { + log.Println("unauthorized user") + w.WriteHeader(http.StatusUnauthorized) + return + } + f, err := s.repoResolver.Resolve(r) if err != nil { log.Println("failed to get repo and knot", err) return } - if user.Active.Did != pull.OwnerDid { - log.Println("unauthorized user") - w.WriteHeader(http.StatusUnauthorized) - return - } - patch := r.FormValue("patch") - s.resubmitPullHelper(w, r, f, user, pull, patch, "", "") + s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, "", "") } func (s *Pulls) resubmitBranch(w http.ResponseWriter, r *http.Request) { @@ -1652,15 +1653,15 @@ s.pages.Notice(w, "resubmit-error", "Failed to edit patch. Try again later.") return } - f, err := s.repoResolver.Resolve(r) - if err != nil { - log.Println("failed to get repo and knot", err) + if user == nil || user.Active.Did != pull.OwnerDid { + log.Println("unauthorized user") + w.WriteHeader(http.StatusUnauthorized) return } - if user.Active.Did != pull.OwnerDid { - log.Println("unauthorized user") - w.WriteHeader(http.StatusUnauthorized) + f, err := s.repoResolver.Resolve(r) + if err != nil { + log.Println("failed to get repo and knot", err) return } @@ -1704,7 +1705,7 @@ sourceRev := comparison.Rev2 patch := comparison.FormatPatchRaw combined := comparison.CombinedPatchRaw - s.resubmitPullHelper(w, r, f, user, pull, patch, combined, sourceRev) + s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, combined, sourceRev) } func (s *Pulls) resubmitFork(w http.ResponseWriter, r *http.Request) { @@ -1717,18 +1718,18 @@ s.pages.Notice(w, "resubmit-error", "Failed to edit patch. Try again later.") return } + if user == nil || user.Active.Did != pull.OwnerDid { + log.Println("unauthorized user") + w.WriteHeader(http.StatusUnauthorized) + return + } + f, err := s.repoResolver.Resolve(r) if err != nil { log.Println("failed to get repo and knot", err) return } - if user.Active.Did != pull.OwnerDid { - log.Println("unauthorized user") - w.WriteHeader(http.StatusUnauthorized) - return - } - forkRepo, err := db.GetRepoByAtUri(s.db, pull.PullSource.RepoAt.String()) if err != nil { log.Println("failed to get source repo", err) @@ -1801,14 +1802,14 @@ sourceRev := comparison.Rev2 patch := comparison.FormatPatchRaw combined := comparison.CombinedPatchRaw - s.resubmitPullHelper(w, r, f, user, pull, patch, combined, sourceRev) + s.resubmitPullHelper(w, r, f, syntax.DID(user.Active.Did), pull, patch, combined, sourceRev) } func (s *Pulls) resubmitPullHelper( w http.ResponseWriter, r *http.Request, repo *models.Repo, - user *oauth.MultiAccountUser, + userDid syntax.DID, pull *models.Pull, patch string, combined string, @@ -1816,7 +1817,7 @@ sourceRev string, ) { if pull.IsStacked() { log.Println("resubmitting stacked PR") - s.resubmitStackedPullHelper(w, r, repo, user, pull, patch, pull.StackId) + s.resubmitStackedPullHelper(w, r, repo, userDid, pull, patch, pull.StackId) return } @@ -1864,7 +1865,7 @@ s.pages.Notice(w, "resubmit-error", "Failed to create pull request. Try again later.") return } - ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoPullNSID, user.Active.Did, pull.Rkey) + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoPullNSID, userDid.String(), pull.Rkey) if err != nil { // failed to get record s.pages.Notice(w, "resubmit-error", "Failed to update pull, no record found on PDS.") @@ -1884,7 +1885,7 @@ record.Source.Sha = newSourceRev _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ Collection: tangled.RepoPullNSID, - Repo: user.Active.Did, + Repo: userDid.String(), Rkey: pull.Rkey, SwapRecord: ex.Cid, Record: &lexutil.LexiconTypeDecoder{ @@ -1911,7 +1912,7 @@ func (s *Pulls) resubmitStackedPullHelper( w http.ResponseWriter, r *http.Request, repo *models.Repo, - user *oauth.MultiAccountUser, + userDid syntax.DID, pull *models.Pull, patch string, stackId string, @@ -1919,7 +1920,7 @@ ) { targetBranch := pull.TargetBranch origStack, _ := r.Context().Value("stack").(models.Stack) - newStack, err := s.newStack(r.Context(), repo, user, targetBranch, patch, pull.PullSource, stackId) + newStack, err := s.newStack(r.Context(), repo, userDid, targetBranch, patch, pull.PullSource, stackId) if err != nil { log.Println("failed to create resubmitted stack", err) s.pages.Notice(w, "pull-merge-error", "Failed to merge pull request. Try again later.") @@ -2101,7 +2102,7 @@ return } _, err = comatproto.RepoApplyWrites(r.Context(), client, &comatproto.RepoApplyWrites_Input{ - Repo: user.Active.Did, + Repo: userDid.String(), Writes: writes, }) if err != nil { @@ -2380,7 +2381,7 @@ ownerSlashRepo := reporesolver.GetBaseRepoPath(r, f) s.pages.HxLocation(w, fmt.Sprintf("/%s/pulls/%d", ownerSlashRepo, pull.PullId)) } -func (s *Pulls) newStack(ctx context.Context, repo *models.Repo, user *oauth.MultiAccountUser, targetBranch, patch string, pullSource *models.PullSource, stackId string) (models.Stack, error) { +func (s *Pulls) newStack(ctx context.Context, repo *models.Repo, userDid syntax.DID, targetBranch, patch string, pullSource *models.PullSource, stackId string) (models.Stack, error) { formatPatches, err := patchutil.ExtractPatches(patch) if err != nil { return nil, fmt.Errorf("Failed to extract patches: %v", err) @@ -2416,7 +2417,7 @@ pull := models.Pull{ Title: title, Body: body, TargetBranch: targetBranch, - OwnerDid: user.Active.Did, + OwnerDid: userDid.String(), RepoAt: repo.RepoAt(), Rkey: rkey, Mentions: mentions,