From 2b714f5accdac37c8f99ebf421e30a759e186012 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Fri, 4 Sep 2026 23:21:56 +0900
Subject: [PATCH] web: wire branch deletion

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 web/src/lib/api/pull.ts                       | 47 ++++++++++++++-----
 .../repo/pulls/PullActions.stories.svelte     | 11 +++++
 .../components/repo/pulls/PullActions.svelte  | 13 ++++-
 .../[version]/[[range]]/PullViewPage.svelte   | 42 ++++++++++++++---
 4 files changed, 94 insertions(+), 19 deletions(-)

diff --git a/web/src/lib/api/pull.ts b/web/src/lib/api/pull.ts
index 2b6f36907..071960df1 100644
--- a/web/src/lib/api/pull.ts
+++ b/web/src/lib/api/pull.ts
@@ -122,6 +122,7 @@ export const keepCommit = async (
 };
 
 const MERGE_COMMIT_NSID = "sh.tangled.git.mergeCommit";
+const DELETE_BRANCH_NSID = "org.tangled.temp.git.deleteBranch";
 const REPO_PUSH_NSID = "sh.tangled.repo.push";
 
 export interface MergeCommitInput {
@@ -132,31 +133,55 @@ export interface MergeCommitInput {
 	style: "rebase";
 }
 
-export const mergeCommit = async (
+const mirrorPush = async (
 	agent: OAuthUserAgent,
 	mirror: string,
 	knot: string,
-	input: MergeCommitInput,
-	fetch: typeof globalThis.fetch = globalThis.fetch
+	nsid: string,
+	body: unknown,
+	fetch: typeof globalThis.fetch
 ): Promise<void> => {
 	const token = await mintServiceAuth(agent, {
 		aud: serviceDidForHost(knot),
-		// `sh.tangled.git.mergeCommit` expects service-auth token minted for `sh.tangled.repo.push`
-		// so it can reuse it on git-push.
+		// git write operations expect `sh.tangled.repo.push` lxm token
 		lxm: REPO_PUSH_NSID
 	});
-	const response = await fetch(buildUrl(mirror, MERGE_COMMIT_NSID), {
+	const response = await fetch(buildUrl(mirror, nsid), {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
 			accept: "application/json",
 			authorization: `Bearer ${token}`
 		},
-		body: JSON.stringify({
-			target: { $type: `${MERGE_COMMIT_NSID}#target`, ...input.target },
-			source: { $type: `${MERGE_COMMIT_NSID}#source`, ...input.source },
-			style: input.style
-		})
+		body: JSON.stringify(body)
 	});
 	if (!response.ok) throw await toResponseError(response);
 };
+
+export const mergeCommit = (
+	agent: OAuthUserAgent,
+	mirror: string,
+	knot: string,
+	input: MergeCommitInput,
+	fetch: typeof globalThis.fetch = globalThis.fetch
+): Promise<void> =>
+	mirrorPush(
+		agent,
+		mirror,
+		knot,
+		MERGE_COMMIT_NSID,
+		{
+			target: { $type: `${MERGE_COMMIT_NSID}#target`, ...input.target },
+			source: { $type: `${MERGE_COMMIT_NSID}#source`, ...input.source },
+			style: input.style
+		},
+		fetch
+	);
+
+export const deleteBranch = (
+	agent: OAuthUserAgent,
+	mirror: string,
+	knot: string,
+	input: { repo: string; branch: string },
+	fetch: typeof globalThis.fetch = globalThis.fetch
+): Promise<void> => mirrorPush(agent, mirror, knot, DELETE_BRANCH_NSID, input, fetch);
diff --git a/web/src/lib/components/repo/pulls/PullActions.stories.svelte b/web/src/lib/components/repo/pulls/PullActions.stories.svelte
index 45f131ffa..674301ddb 100644
--- a/web/src/lib/components/repo/pulls/PullActions.stories.svelte
+++ b/web/src/lib/components/repo/pulls/PullActions.stories.svelte
@@ -49,6 +49,17 @@
 	args={{ pullState: "merged" as PullState, canChangeState: false, canMerge: false }}
 />
 
+<!-- the source branch is still around and the viewer may push to it -->
+<Story
+	name="Merged, can delete branch"
+	args={{
+		pullState: "merged" as PullState,
+		canChangeState: false,
+		canMerge: false,
+		canDeleteBranch: true
+	}}
+/>
+
 <Story name="Read-only viewer" args={{ canChangeState: false, canMerge: false }} />
 
 <Story name="Interactive">
diff --git a/web/src/lib/components/repo/pulls/PullActions.svelte b/web/src/lib/components/repo/pulls/PullActions.svelte
index b3e22e570..b07bc97ce 100644
--- a/web/src/lib/components/repo/pulls/PullActions.svelte
+++ b/web/src/lib/components/repo/pulls/PullActions.svelte
@@ -13,6 +13,7 @@
 
 <script lang="ts">
 	import Circle from "$icon/circle";
+	import Trash2 from "$icon/trash-2";
 	import GitMerge from "$icon/git-merge";
 	import GitPullRequestClosed from "$icon/git-pull-request-closed";
 	import Button from "$lib/components/ui/Button.svelte";
@@ -27,8 +28,11 @@
 		canMerge?: boolean;
 		/** the merge check found conflicts, so the git-side merges cannot run */
 		conflicted?: boolean;
+		/** the viewer may push to the source repo and the branch is still there */
+		canDeleteBranch?: boolean;
 		onChangeState?: (state: PullState) => void;
 		onMerge?: (style: MergeStyle) => void;
+		onDeleteBranch?: () => void;
 		loading?: boolean;
 		error?: string;
 	}
@@ -38,8 +42,10 @@
 		canChangeState = false,
 		canMerge = false,
 		conflicted = false,
+		canDeleteBranch = false,
 		onChangeState,
 		onMerge,
+		onDeleteBranch,
 		loading = false,
 		error
 	}: Props = $props();
@@ -84,8 +90,11 @@
 				Reopen
 			</Button>
 		{/if}
-		<!-- TODO: wire branch deletion -->
-		<Button class="flex-1" icon={Circle}>Delete Branch</Button>
+		{#if canDeleteBranch}
+			<Button class="flex-1" icon={Trash2} {loading} onclick={onDeleteBranch}>
+				Delete Branch
+			</Button>
+		{/if}
 	{/if}
 </div>
 <ErrorAlert label={error} />
diff --git a/web/src/routes/[handle]/[repo]/pulls/[aturi]/[version]/[[range]]/PullViewPage.svelte b/web/src/routes/[handle]/[repo]/pulls/[aturi]/[version]/[[range]]/PullViewPage.svelte
index 5cf2fbfe4..635d0807f 100644
--- a/web/src/routes/[handle]/[repo]/pulls/[aturi]/[version]/[[range]]/PullViewPage.svelte
+++ b/web/src/routes/[handle]/[repo]/pulls/[aturi]/[version]/[[range]]/PullViewPage.svelte
@@ -20,6 +20,7 @@
 	import { putComment, type CommentRecord } from "$lib/api/comment";
 	import { mergeCheck } from "$lib/api/gitmirror";
 	import {
+		deleteBranch,
 		deletePull,
 		editPull,
 		keepCommit,
@@ -29,6 +30,7 @@
 	} from "$lib/api/pull";
 	import { gitTarget } from "$lib/api/gitclient";
 	import { getPatchStream } from "$lib/api/patchStream";
+	import { getRepoByRepoDid } from "$lib/api/records";
 	import { loadDiff, type PullDiffDeps, type PullDiffSpec } from "$lib/api/pullDiff";
 	import { fileAnchor } from "$lib/components/repo/fileAnchor.svelte";
 	import type { PullView as PullRouteView } from "$lib/api/pullRoute";
@@ -426,12 +428,12 @@
 			serviceUrl: data.publicConfig.knotMirrorUrl,
 			fetch: globalThis.fetch
 		});
-		const target = await getBranch(mirror, {
+		const branch = await getBranch(mirror, {
 			repo: data.repo.repoDid,
 			name: pull.targetBranch
 		});
 		await mergeCommit(agent, data.publicConfig.knotMirrorUrl, data.repo.knot, {
-			target: { repo: data.repo.repoDid, branch: pull.targetBranch, commit: target.hash },
+			target: { repo: data.repo.repoDid, branch: pull.targetBranch, commit: branch.hash },
 			source: { repo: data.sourceRepoDid, commit: head },
 			style: "rebase"
 		});
@@ -439,6 +441,21 @@
 		pull = { ...pull, state: "merged" };
 	});
 
+	const deleteSourceBranch = createAction(async () => {
+		const agent = auth.agent;
+		if (!agent || !sourceBranch) return;
+		const sourceKnot = await (async () => {
+			if (!isForkBased) return data.repo.knot;
+			const ctx = createBobbinClient({ serviceUrl: data.publicConfig.bobbinUrl });
+			return (await getRepoByRepoDid(ctx, data.sourceRepoDid)).value.knot;
+		})();
+		await deleteBranch(agent, data.publicConfig.knotMirrorUrl, sourceKnot, {
+			repo: data.sourceRepoDid,
+			branch: sourceBranch
+		});
+		sourceHead.update(() => undefined);
+	});
+
 	const runMerge = (style: MergeStyle) =>
 		style === "manual" ? setStatus.run("merged") : doMerge.run();
 
@@ -466,14 +483,25 @@
 
 	// the branch tip lives outside the record, so it has to be resolved live
 	const sourceHead = createLoad(async () => {
-		if (!isAuthor || pullState !== "open" || !sourceBranch) return undefined;
+		if (!(isAuthor || canPush) || !sourceBranch) return undefined;
 		const mirror = createBobbinClient({
 			serviceUrl: data.publicConfig.knotMirrorUrl,
 			fetch: globalThis.fetch
 		});
-		return (await getBranch(mirror, { repo: data.sourceRepoDid, name: sourceBranch })).hash;
+		const branch = await getBranch(mirror, {
+			repo: data.sourceRepoDid,
+			name: sourceBranch
+		}).catch(() => undefined);
+		return branch?.hash;
 	});
+
 	const canResubmit = $derived(Boolean(sourceHead.data) && sourceHead.data !== head);
+	// TODO(pre-1.0): better ACL here
+	const canDeleteBranch = $derived(
+		Boolean(sourceHead.data) &&
+			(isForkBased ? isAuthor : canPush) &&
+			sourceBranch !== pull.targetBranch
+	);
 
 	const resubmit = createAction(async () => {
 		const agent = auth.agent;
@@ -769,10 +797,12 @@
 					conflicted={check.data?.isConflicted ?? false}
 					canChangeState={isAuthor}
 					canMerge={isAuthor && !!head}
+					{canDeleteBranch}
 					onChangeState={setStatus.run}
 					onMerge={runMerge}
-					loading={setStatus.loading || doMerge.loading}
-					error={setStatus.error ?? doMerge.error}
+					onDeleteBranch={deleteSourceBranch.run}
+					loading={setStatus.loading || doMerge.loading || deleteSourceBranch.loading}
+					error={setStatus.error ?? doMerge.error ?? deleteSourceBranch.error}
 				/>
 			</div>
 		</div>
-- 
2.51.2