yuzpxzopsouqmerged#6

fix: 500 error because of database is patched

snow →main1 revisioncommit c7c99b4291c4

21 files+2654−321

Comparingv1 against its parent

Mdocker/Dockerfile+8−3

-# Installed into each repository's hooks/ directory at creation.
-COPY --from=builder /build/target/release/dogfood-hook /usr/local/bin/dogfood-hook
-EXPOSE 8080
-−
+# The container is healthy when it can serve; readiness (database reachable) is
-−
+# checked separately by the orchestrator via /readyz.
-# /readyz, not /healthz: /healthz is an unconditional 200, so it reported this
-# container healthy through the two hours of 2026-08-03 in which every request
-# 500ed on an exhausted connection pool. Docker does not act on this status by
-# itself — compose restarts on exit, not on unhealthy — so this buys visibility,
-# not recovery. The 5s timeout is deliberately below the pool's 10s
-# acquire_timeout, so a pool that can no longer hand out connections fails the
-# check instead of slowly answering it.
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-−
+    CMD wget -qO- http://127.0.0.1:8080/healthz >/dev/null || exit 1
-    CMD wget -qO- http://127.0.0.1:8080/readyz >/dev/null || exit 1
-ENTRYPOINT ["/usr/local/bin/dogfood-web"]
-# ─── worker ──────────────────────────────────────────────────────────────────

Mcrates/df-auth/src/session.rs+142−29

-//! "Sessions are server-side rows with an opaque ID in a cookie: HttpOnly,
-//! Secure, SameSite=Lax, 14-day sliding expiry. Store nothing in the cookie but
-//! the ID."
-//!
-//! The cookie carries a [`generate_token`] value — 32 bytes from the OS CSPRNG,
-//! hex-encoded — and never the row's `id`. The two are deliberately different
-//! things: `id` is a UUIDv7, which is time-ordered and carries a counter that
-//! only reseeds once per millisecond, so ids minted close together share their
-//! leading bits and any *other* id from the same generator (a comment id, say,
-//! which is rendered into review pages) narrows the search space for the rest.
-//! That is fine for a primary key and disqualifying for a bearer secret.
-//!
-//! Only the SHA-256 of the token is stored, so a leaked dump of this table
-//! contains nothing that can be presented back to the server. SHA-256 rather
-//! than Argon2 on purpose: the token has 256 bits of entropy, so there is no
-//! guessing attack for a slow hash to frustrate, and this runs on every request.
-use anyhow::Result;
-use chrono::{DateTime, Duration, Utc};
-use df_db::ids::new_id;
-use df_db::models::{Session, User};
-use rand::RngCore;
-use sha2::{Digest, Sha256};
-use sqlx::PgPool;
-use uuid::Uuid;
-pub const COOKIE_NAME: &str = "dogfood_session";
-−
+/// Create a session row and return its id, which becomes the cookie value.
-/// Entropy in a session token. 32 bytes is the usual bar for a bearer secret
-/// and leaves no meaningful margin for a birthday collision across the table.
-const TOKEN_BYTES: usize = 32;
-/// Length of the hex form, which is what the cookie carries.
-const TOKEN_HEX_LEN: usize = TOKEN_BYTES * 2;
-/// A freshly created session. The token exists only here and in the cookie.
-pub struct NewSession {
-    pub id: Uuid,
-    /// The cookie value. Not recoverable from the database afterwards.
-    pub token: String,
-    pub expires_at: DateTime<Utc>,
+}
-/// Mint a session token.
-pub fn generate_token() -> String {
-    let mut bytes = [0u8; TOKEN_BYTES];
-    rand::thread_rng().fill_bytes(&mut bytes);
-    hex::encode(bytes)
+}
-/// What the database stores in place of the token.
-fn hash_token(token: &str) -> String {
-    hex::encode(Sha256::digest(token.as_bytes()))
+}
-/// Reject anything that is not shaped like one of our tokens.
-///
-/// Cheap, and it means a request carrying a junk cookie — the shape a flood
-/// takes — is refused before it costs a database round trip.
-fn well_formed(token: &str) -> bool {
-    token.len() == TOKEN_HEX_LEN && token.bytes().all(|b| b.is_ascii_hexdigit())
+}
-/// Create a session row and return the token that addresses it.
-pub async fn create(
-    db: &PgPool,
-    user_id: Uuid,
-    user_agent: Option<&str>,
-    ip: Option<std::net::IpAddr>,
-    id_token: Option<&str>,
-−
+) -> Result<(Uuid, DateTime<Utc>)> {
-) -> Result<NewSession> {
-    let id = new_id();
-    let token = generate_token();
-    let expires_at = Utc::now() + Duration::days(ttl_days);
-    sqlx::query(
-−
+        "INSERT INTO sessions (id, user_id, expires_at, user_agent, ip, id_token)
-−
+         VALUES ($1, $2, $3, $4, $5, $6)",
-        "INSERT INTO sessions (id, user_id, token_hash, expires_at, user_agent, ip, id_token)
-         VALUES ($1, $2, $3, $4, $5, $6, $7)",
+    )
-    .bind(id)
-    .bind(user_id)
-    .bind(hash_token(&token))
-    .bind(expires_at)
-    // Truncated: a hostile client can send a multi-kilobyte User-Agent and
-    // there is no reason to store it.
-    .execute(db)
-    .await?;
-−
+    Ok((id, expires_at))
 −
 −
-−
+/// The ID token stashed at login, for `id_token_hint` on RP-Initiated Logout.
-−
+///
-−
+/// `None` both when the session predates this column and when the login that
-−
+/// created it had no token to store (the pending-handle path) — callers treat
-−
+/// both the same way: fall back to clearing the local session only.
-−
+pub async fn id_token(db: &PgPool, session_id: Uuid) -> Result<Option<String>> {
-−
+    let row: Option<(Option<String>,)> =
-−
+        sqlx::query_as("SELECT id_token FROM sessions WHERE id = $1")
-−
+            .bind(session_id)
-−
+            .fetch_optional(db)
-−
+            .await?;
-−
+    Ok(row.and_then(|r| r.0))
-    Ok(NewSession { id, token, expires_at })
+}
-−
+/// Load the user for a session id, if the session exists and has not expired.
-/// Load the user for a session token, if the session exists and has not expired.
-///
-/// Returns the session so the caller can decide whether to slide the expiry.
-−
+pub async fn load(db: &PgPool, session_id: Uuid) -> Result<Option<(Session, User)>> {
-pub async fn load(db: &PgPool, token: &str) -> Result<Option<(Session, User)>> {
-    if !well_formed(token) {
-        return Ok(None);
+    }
-    let row = sqlx::query_as::<_, (Uuid, Uuid, DateTime<Utc>, Uuid, String, String, Option<String>, Option<String>, Option<String>, bool, DateTime<Utc>)>(
-        "SELECT s.id, s.user_id, s.expires_at,
-                u.id, u.subject, u.handle, u.display_name, u.email, u.avatar_url,
-                u.is_admin, u.created_at
-         FROM sessions s
-         JOIN users u ON u.id = s.user_id
-−
+         WHERE s.id = $1 AND s.expires_at > now()",
-         WHERE s.token_hash = $1 AND s.expires_at > now()",
+    )
-−
+    .bind(session_id)
-    .bind(hash_token(token))
-    .fetch_optional(db)
-    .await?;
-    remaining < Duration::days(ttl_days) / 2
+}
-−
+pub async fn destroy(db: &PgPool, session_id: Uuid) -> Result<()> {
-−
+    sqlx::query("DELETE FROM sessions WHERE id = $1")
-−
+        .bind(session_id)
-−
+        .execute(db)
-−
+        .await?;
-−
+    Ok(())
-/// Destroy a session, returning the ID token stashed at login.
-///
-/// One statement rather than a read followed by a delete: logout needs the
-/// token for `id_token_hint` on RP-Initiated Logout, and doing it atomically
-/// means two logouts racing cannot both believe they ended the session.
-///
-/// `None` covers every "nothing to hand the provider" case — an unknown token,
-/// a session created down the pending-handle path with no token to store — and
-/// callers treat them the same way: clear the local session and go home.
-pub async fn destroy(db: &PgPool, token: &str) -> Result<Option<String>> {
-    if !well_formed(token) {
-        return Ok(None);
+    }
-    let row: Option<(Option<String>,)> =
-        sqlx::query_as("DELETE FROM sessions WHERE token_hash = $1 RETURNING id_token")
-            .bind(hash_token(token))
-            .fetch_optional(db)
-            .await?;
-    Ok(row.and_then(|r| r.0))
+}
-/// Invalidate every session for a user. Used when an account is disabled.
-        // should_slide in practice; asserted so the interaction stays obvious.
-        assert!(should_slide(Utc::now() - Duration::days(1), 14));
+    }
-    // ─── the token is a bearer secret, not an identifier ─────────────────────
-    #[test]
-    fn tokens_are_full_length_hex_and_unique() {
-        use std::collections::HashSet;
-        let set: HashSet<String> = (0..1000).map(|_| generate_token()).collect();
-        assert_eq!(set.len(), 1000, "tokens must not repeat");
-        for t in &set {
-            assert_eq!(t.len(), TOKEN_HEX_LEN);
-            assert!(t.bytes().all(|b| b.is_ascii_hexdigit()), "not hex: {t}");
-            assert!(well_formed(t));
+        }
+    }
-    #[test]
-    fn successive_tokens_share_no_prefix() {
-        // The property a UUIDv7 does not have, and the whole reason for this
-        // type: consecutive ids from a v7 generator agree in their leading ~96
-        // bits, so one of them narrows the search space for its neighbours.
-        let a = generate_token();
-        let b = generate_token();
-        let shared = a
-            .bytes()
-            .zip(b.bytes())
-            .take_while(|(x, y)| x == y)
-            .count();
-        assert!(shared < 8, "tokens share a {shared}-character prefix: {a} / {b}");
+    }
-    #[test]
-    fn the_stored_hash_is_not_the_token() {
-        let t = generate_token();
-        let h = hash_token(&t);
-        assert_ne!(h, t, "storing the token itself defeats the point");
-        assert_eq!(h, hash_token(&t), "hashing must be deterministic to look up");
-        assert_ne!(h, hash_token(&generate_token()));
+    }
-    #[test]
-    fn malformed_cookies_are_refused_before_the_database() {
-        // Each of these would otherwise be a query per request, which is the
-        // work an unauthenticated flood gets for free.
-        for bad in [
-            "",
-            "not-hex",
-            &"a".repeat(TOKEN_HEX_LEN - 1),
-            &"a".repeat(TOKEN_HEX_LEN + 1),
-            &"g".repeat(TOKEN_HEX_LEN),
-            // The old cookie value: a session id must no longer authenticate.
-            &Uuid::now_v7().to_string(),
-        ] {
-            assert!(!well_formed(bad), "must reject {bad:?}");
+        }
+    }
+}

Mcrates/df-ssh/src/repo.rs+21−2

-        .env("HOME", "/nonexistent")
-        .env("GIT_CONFIG_NOSYSTEM", "1")
-        .env("GIT_TERMINAL_PROMPT", "0")
-        // So a git that is still running when the runtime tears the task down
-        // is killed rather than orphaned.
-        .kill_on_drop(true)
-        // Consumed by the pre-receive hook.
-        .env("DOGFOOD_REPO_ID", repo_id.to_string())
-        .env("DOGFOOD_PUSHER_ID", user_id.to_string())
-        let handle = handle.clone();
-        tokio::spawn(async move {
-            let mut buf = vec![0u8; 32 * 1024];
-            // Once the client is gone we keep reading, discarding what we read.
-            // Stopping instead would leave git blocked writing into a pipe
-            // nobody drains — and since the reaper below waits on the child, it
-            // would wait forever. The pack is already being produced; draining
-            // it costs a copy and lets the process exit.
-            let mut client_gone = false;
-            loop {
-                match stdout.read(&mut buf).await {
-                    Ok(0) | Err(_) => break,
-                    Ok(n) => {
-                        if client_gone {
-                            continue;
+                        }
-                        if handle.data(channel, buf[..n].to_vec().into()).await.is_err() {
-−
+                            break;
-                            tracing::debug!("ssh client went away mid-stream; draining git");
-                            client_gone = true;
+                        }
+                    }
+                }
-        let handle = handle.clone();
-        tokio::spawn(async move {
-            let mut buf = vec![0u8; 8 * 1024];
-            // Drained past a dead channel for the same reason as stdout: a
-            // full stderr pipe blocks git just as thoroughly as a full stdout.
-            let mut client_gone = false;
-            loop {
-                match stderr.read(&mut buf).await {
-                    Ok(0) | Err(_) => break,
-                    Ok(n) => {
-                        if client_gone {
-                            continue;
+                        }
-                        // Stream 1 is stderr; this is where the pre-receive
-                        // hook's rejection messages reach the user.
-                        if handle
-                            .await
-                            .is_err()
+                        {
-−
+                            break;
-                            client_gone = true;
+                        }
+                    }
+                }

Mcrates/df-store/tests/git_store.rs+25−0

-    assert!(!d.truncated);
+}
-/// The tree walk reports the directories it descends through as well as the
-/// files inside them. A directory is not a changed file: it has no content, so
-/// it reached the renderer as a hunkless "binary file" and padded the file
-/// count of every change that touched a new subdirectory.
-#[tokio::test]
-async fn a_diff_lists_files_and_not_the_directories_holding_them() {
-    for case in ["basic", "stack", "renames", "mixed", "hostile"] {
-        let Some(f) = load(case) else { continue };
-        let rev = head(&f).await;
-        let d = f
-            .store
-            .diff_from_parent(f.id, &rev, Default::default())
-            .await
-            .expect("diff");
-        let paths: Vec<&str> = d.files.iter().map(|x| x.path.as_str()).collect();
-        for p in &paths {
-            assert!(
-                !paths.iter().any(|q| q.starts_with(&format!("{p}/"))),
-                "{case}: {p:?} is a directory, not a changed file: {paths:#?}"
-            );
+        }
+    }
+}
-#[tokio::test]
-async fn diff_of_a_revision_against_itself_is_empty() {
-    let Some(f) = load("basic") else { return };

Mcrates/df-web/assets/app.css853 lines+673−38

+  }
+}
-/* ─── one commit ─── */
-/* The header of the commit page: the message, who wrote it, and where the
-   commit sits in history. Three bands separated by rules, because they answer
-   three different questions and a reader is usually after exactly one. */
-.commit-meta {
-  padding: 0;
-  margin-bottom: 10px;
+}
-.commit-msg {
-  padding: 12px 14px;
+}
-.commit-msg h1 {
-  margin: 0;
-  font-size: var(--text-lg);
-  line-height: 1.35;
+}
-/* The trailing body of a commit message is preformatted text — wrapped rather
-   than scrolled, since a paragraph someone hard-wrapped at 72 columns is still
-   prose and should read like it. */
-.commit-body {
-  margin: 8px 0 0;
-  font-family: var(--font-mono);
-  font-size: var(--text-sm);
-  line-height: 1.55;
-  color: var(--text-dim);
-  white-space: pre-wrap;
-  overflow-wrap: anywhere;
+}
-.commit-byline,
-.commit-ids {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  flex-wrap: wrap;
-  padding: 8px 14px;
-  border-top: 1px solid var(--border);
-  font-size: var(--text-sm);
-  color: var(--text-dim);
+}
-.commit-ids {
-  background: var(--surface-raised);
-  border-radius: 0 0 var(--radius) var(--radius);
+}
-.commit-parent {
-  font-size: var(--text-xs);
-  color: var(--text-faint);
-  white-space: nowrap;
+}
-.commit-parent:hover { color: var(--action); }
-/* The bordered container shared by the file listing, the bookmarks table and
-   the README panel. */
-.filelist {
+}
-/* Fixed layout is what makes the `max-width: 0` ellipsis trick on
-−
+   `.filelist-name` / `.bookmark-title` actually hold: under the default auto
-−
+   layout the browser sizes columns from content instead, so the name column
-−
+   never truncates and the icon column drifts away from it as the viewport
-−
+   narrows. */
-   `.filelist-message` / `.bookmark-title` actually hold: under the default auto
-   layout the browser sizes columns from content instead, so a long commit
-   message pushes the row wider rather than truncating. */
-.filelist table {
-  width: 100%;
-  table-layout: fixed;
-  padding: 0 8px;
-  height: 28px;
-  vertical-align: middle;
 −
 −
-−
+/* A literal pixel width, not the old auto-layout `1px` shrink-to-content
-−
+   hack: `table-layout: fixed` takes column widths at face value, so a hint
-−
+   width no longer holds and has to be the icon's real footprint (8px
-−
+   padding-left + 16px icon). */
-−
+.filelist-icon {
-−
+  width: 28px;
-−
+  padding-right: 0 !important;
-−
+  line-height: 0;
+}
-.icon-dir {
-  color: var(--text-faint);
+}
-/* The icon shares the name's cell rather than owning a column of its own.
-   As its own column it was a fixed 28px, and any slack the table had to hand
-   out widened it, so the icon stayed pinned left while the filename started
-   further and further right — worst below the breakpoints that drop the
-   message and change columns. In one cell the two are always 8px apart. */
-.filelist-name {
-−
+  max-width: 0;
-−
+  width: 32%;
-  width: calc(32% + 28px);
+}
-.filelist-entry {
-  display: flex;
-  align-items: center;
-  min-width: 0;
+}
-−
+.filelist-name a {
-.filelist-entry-link {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  min-width: 0;
-  color: var(--text);
+}
-.filelist-entry-link svg {
-  flex: none;
+}
-/* `line-height: 1` here, not just on `.filelist-entry-link`: the body default
-   of 1.5 gives the name span extra leading that JetBrains Mono splits
-   unevenly above/below the glyphs, so the text visibly hangs below the
-   icon's center instead of sitting beside it. */
-.filelist-entry-name {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-−
+  display: inline-block;
-−
+  max-width: 100%;
-−
+  vertical-align: bottom;
-  line-height: 1;
+}
-−
+.filelist-name a.is-dir {
-.filelist-entry-link.is-dir {
-  font-weight: 500;
+}
-−
+.filelist tr:hover .filelist-name a {
-/* The underline goes on the text, not the link: on the link the rule would
-   run under the icon as well. */
-.filelist tr:hover .filelist-entry-link {
-  color: var(--action);
+}
-.filelist tr:hover .filelist-entry-name {
-  text-decoration: underline;
+}
-.filelist-note {
-  flex: none;
-  margin-left: 8px;
-  font-size: var(--text-xs);
+}
-−
+/* The commit message column. `max-width: 0` is the same "shrink to let the
-−
+   sibling ellipsis rule take over" trick `.filelist-name` uses — without it
-−
+   an auto-layout table lets a long message push the row wider instead of
-−
+   truncating. */
-/* The commit message column. `max-width: 0` is the "shrink to let the sibling
-   ellipsis rule take over" trick — without it an auto-layout table lets a long
-   message push the row wider instead of truncating. */
-.filelist-message {
-  max-width: 0;
-  font-size: var(--text-xs);
-  color: var(--text-faint);
+}
-/* The blanket `thead th` rule left the header hugging the left edge of a
-   column whose ages are set flush right. Follow the cells. */
-.filelist thead th.filelist-when {
-  text-align: right;
+}
-/* Below the wide breakpoint the listing keeps only what a filename needs. */
-@media (max-width: 1120px) {
-  .filelist-change {
-  .filelist-message {
-    display: none;
+  }
-  /* The message column was the one soaking up the table's leftover width;
-     with it gone, hand the slack to the name instead of letting fixed layout
-     split it across every remaining column. */
-  .filelist-name {
-    width: auto;
+  }
+}
-/* ─── the repository sidebar ───────────────────────────────────────────────── */
-  white-space: nowrap;
+}
-.bookmark-table thead th:nth-child(4) {
-  text-align: right;
+}
-.bookmark-when {
-  width: 72px;
-  text-align: right;
-/* ─── diffs and review ─────────────────────────────────────────────────────── */
-/* The diff is read in three passes, and the layout is built for that order:
-   the bar says what is being compared and how big it is, the index says which
-   files, and only then the code. Each of the first two stays out of the way of
-   the third — the bar is one line, the index folds. */
-/* ─── the sticky diff bar ─── */
-/* `top` clears the 46px masthead. z-index sits under the masthead (30) and over
-   the file headers (10), which is the order they overlap in. */
-.diffbar {
-  position: sticky;
-  top: 46px;
-  z-index: 20;
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  flex-wrap: wrap;
-  padding: 7px 12px;
-  margin-bottom: 8px;
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  background: var(--surface-raised);
-  font-size: var(--text-sm);
-  color: var(--text-dim);
+}
-/* Opening the compare form makes the bar two rows tall, which would leave the
-   file headers sticking to a height that no longer exists. While it is open the
-   bar is an ordinary block and scrolls away. */
-.diffbar:has(.cmpbox[open]) {
-  position: static;
+}
-.diffbar-stat {
-  display: flex;
-  align-items: center;
-  gap: 8px;
+}
-.diffbar-stat strong {
-  color: var(--text);
+}
-.diffbar-link {
-  font-size: var(--text-sm);
-  white-space: nowrap;
+}
-/* The compare control: closed it is a label reading "Comparing v2 → v3", which
-   is information the reviewer needs on every screen. Open it is the form. */
-.cmpbox > summary {
-  cursor: pointer;
-  list-style: none;
-  display: flex;
-  align-items: baseline;
-  gap: 6px;
-  padding: 2px 8px;
-  border: 1px solid var(--border-strong);
-  border-radius: var(--radius);
-  color: var(--text);
-  white-space: nowrap;
+}
-.cmpbox > summary::-webkit-details-marker { display: none; }
-.cmpbox > summary:hover { border-color: var(--action); color: var(--action); }
-.cmpform {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  flex-wrap: wrap;
-  padding: 10px 0 2px;
+}
-/* ─── the changed-file tree, beside the diff ─── */
-/* Two columns: the tree, and the diff. The tree is fixed-width because it is a
-   reference the eye returns to at a known place, and `minmax(0, 1fr)` is what
-   stops a long unbroken code line from widening the grid track and pushing the
-   tree off the screen. */
-.difflayout {
-  display: grid;
-  grid-template-columns: 250px minmax(0, 1fr);
-  gap: 12px;
-  align-items: start;
+}
-/* A diff with no files renders no tree, and a one-column grid should not leave
-   a 250px hole where it would have been. */
-.difflayout:not(:has(.difftree)) {
-  grid-template-columns: minmax(0, 1fr);
+}
-.diffmain {
-  min-width: 0;
+}
-/* `top` clears the masthead (46px) and the sticky diff bar under it, so the
-   tree comes to rest just below the bar rather than behind it. Scrolls
-   independently once it outgrows the viewport — a 200-file commit must not
-   make the sidebar taller than the page. */
-.difftree {
-  position: sticky;
-  top: 92px;
-  max-height: calc(100vh - 104px);
-  overflow-y: auto;
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  background: var(--surface);
-  font-size: var(--text-sm);
+}
-.dt-head {
-  position: sticky;
-  top: 0;
-  padding: 8px 10px;
-  border-bottom: 1px solid var(--border);
-  background: var(--surface-raised);
-  color: var(--text-dim);
-  font-size: var(--text-xs);
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
+}
-.dt-body {
-  padding: 6px 8px 8px;
+}
-/* Each level indents by one step and draws a rule down its own children, which
-   is what makes the nesting readable at a glance rather than countable. */
-.dt-kids {
-  margin-left: 5px;
-  padding-left: 7px;
-  border-left: 1px solid var(--border);
+}
-.dt-row,
-.dt-file {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  padding: 2px 4px;
-  border-radius: 3px;
-  font-family: var(--font-mono);
-  line-height: 1.5;
-  text-decoration: none;
-  color: var(--text);
+}
-.dt-row {
-  cursor: pointer;
-  list-style: none;
-  color: var(--text-dim);
+}
-.dt-row::-webkit-details-marker { display: none; }
-.dt-row:hover,
-.dt-file:hover { background: var(--surface-raised); }
-.dt-file:hover .dt-name { color: var(--action); }
-.dt-caret {
-  width: 0;
-  height: 0;
-  flex: none;
-  border-left: 5px solid var(--text-faint);
-  border-top: 4px solid transparent;
-  border-bottom: 4px solid transparent;
-  transition: transform 90ms ease;
+}
-details[open] > .dt-row .dt-caret {
-  transform: rotate(90deg);
+}
-/* The directory name is context and the file name is the thing, so only the
-   directory dims — the same rule the file index and the file headers follow. */
-.dt-dirname,
-.dt-name {
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
+}
-.dt-dirname {
-  font-size: var(--text-xs);
+}
-/* The counts are a magnitude, not a figure to read: small, and never allowed to
-   squeeze the name they sit beside. */
-.dt-file .cl-add,
-.dt-file .cl-del {
-  flex: none;
-  font-size: var(--text-xs);
+}
-/* Under about 900px there is no room for a column beside the diff, so the tree
-   becomes a capped block above it rather than disappearing. */
-@media (max-width: 900px) {
-  .difflayout {
-    grid-template-columns: minmax(0, 1fr);
+  }
-  /* Stacked, the tree is no longer a column and stretching it the full width
-     of the page strands the counts a screen away from their filenames. */
-  .difftree {
-    position: static;
-    max-width: 560px;
-    max-height: 260px;
-    margin-bottom: 10px;
+  }
+}
-/* On a change's files tab the diff already has the reviewers aside to its
-   right, so the tree makes three columns and needs the room for it. It gives
-   up its column earlier than on the commit page — the media query measures the
-   viewport, but what is actually short here is the main column inside it. */
-@media (max-width: 1280px) {
-  .columns-main .difflayout {
-    grid-template-columns: minmax(0, 1fr);
+  }
-  .columns-main .difftree {
-    position: static;
-    max-width: 560px;
-    max-height: 260px;
-    margin-bottom: 10px;
+  }
+}
-/* ─── the file index ─── */
-.fileindex {
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-  background: var(--surface);
-  margin-bottom: 10px;
+}
-.fileindex > summary {
-  cursor: pointer;
-  list-style: none;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 8px 12px;
-  font-size: var(--text-sm);
-  color: var(--text-dim);
+}
-.fileindex > summary::-webkit-details-marker { display: none; }
-.fx-caret,
-.fd-caret {
-  width: 0;
-  height: 0;
-  border-left: 5px solid var(--text-faint);
-  border-top: 4px solid transparent;
-  border-bottom: 4px solid transparent;
-  transition: transform 90ms ease;
-  flex: none;
+}
-details[open] > summary .fx-caret,
-details[open] > summary .fd-caret {
-  transform: rotate(90deg);
+}
-/* Capped and scrolled: a forty-file index should not push the diff off the
-   first screen, which is the thing it exists to get you to. */
-.fx-list {
-  max-height: 300px;
-  overflow-y: auto;
-  border-top: 1px solid var(--border);
+}
-.fx-row {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 3px 12px;
-  font-size: var(--text-sm);
-  color: var(--text);
-  text-decoration: none;
-  border-bottom: 1px solid var(--border);
+}
-.fx-row:last-child { border-bottom: 0; }
-.fx-row:hover { background: var(--surface-raised); }
-/* The directory is context, the basename is the thing. Dimming the leading path
-   is what makes a column of deep paths scannable, and truncating only the
-   directory means the basename — the part being looked for — never disappears
-   into an ellipsis. */
-.fx-path,
-.fd-path {
-  display: flex;
-  min-width: 0;
-  font-family: var(--font-mono);
-  font-size: var(--text-xs);
-  white-space: nowrap;
+}
-.fx-dir,
-.fd-dir {
-  color: var(--text-faint);
-  overflow: hidden;
-  text-overflow: ellipsis;
+}
-.fx-name,
-.fd-name {
-  color: var(--text);
-  flex: none;
+}
-.fx-bin,
-.fd-note {
-  font-size: var(--text-xs);
-  color: var(--text-faint);
-  white-space: nowrap;
+}
-/* ─── the status letter ─── */
-.fkind {
-  flex: none;
-  width: 16px;
-  height: 16px;
-  display: inline-grid;
-  place-items: center;
-  border-radius: var(--radius-sm);
-  font-family: var(--font-mono);
-  font-size: 10px;
-  font-weight: 600;
-  line-height: 1;
-  color: var(--on-action);
+}
-.fkind.is-add { background: var(--diff-add-text); }
-.fkind.is-mod { background: var(--identity); }
-.fkind.is-del { background: var(--diff-del-text); }
-.fkind.is-ren { background: var(--merged); color: #fff; }
-/* ─── the add/delete ratio bar ─── */
-.statbar {
-  flex: none;
-  display: flex;
-  width: 44px;
-  height: 7px;
-  border-radius: 1px;
-  overflow: hidden;
-  background: var(--border);
+}
-.statbar-add { background: var(--diff-add-text); }
-.statbar-del { background: var(--diff-del-text); }
-/* ─── one file ─── */
-/* The base box is shared with the interdiff and the conflict view, which build
-   it out of plain divs and scroll horizontally. Only the foldable version in
-   the files tab gets the sticky, clickable header below. */
-.filediff {
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-−
+  margin-bottom: 14px;
-  margin-bottom: 10px;
-  background: var(--surface);
-  overflow-x: auto;
+}
-  border-bottom: 1px solid var(--border);
+}
-/* ─── the foldable file, files tab only ─── */
-details.filediff {
-  /* Wrapping the code removes the reason to scroll, and a scroll container
-     would stop the header sticking to the viewport. */
-  overflow-x: visible;
-  /* Jumping from the index must not land the header under the sticky bar. */
-  scroll-margin-top: 92px;
+}
-/* Sticky, so the path stays readable a thousand lines into the file. It is the
-   summary itself rather than a child, because `details` is the containing
-   block here and a sticky grandchild would stop at its padding box. */
-summary.filediff-head {
-  position: sticky;
-  top: 84px;
-  z-index: 10;
-  cursor: pointer;
-  list-style: none;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 7px 10px;
-  border-radius: var(--radius) var(--radius) 0 0;
+}
-summary.filediff-head::-webkit-details-marker { display: none; }
-summary.filediff-head:hover .fd-name { color: var(--action); }
-details.filediff:not([open]) > .filediff-head { border-bottom-color: transparent; }
-/* A folded large file still has to look like something you can open, not like
-   something that failed to render. */
-details.filediff.is-big:not([open]) > .filediff-head {
-  border-left: 2px solid var(--identity);
+}
-.fd-old {
-  font-size: var(--text-xs);
-  color: var(--text-faint);
-  white-space: nowrap;
+}
-/* "View file" — only the commit page sets it, where the revision is one the
-   browse routes can serve. Quiet until the header is hovered: it is the answer
-   to a question most hunks never raise. */
-.fd-view {
-  font-size: var(--text-xs);
-  color: var(--text-faint);
-  white-space: nowrap;
+}
-summary.filediff-head:hover .fd-view { color: var(--action); }
-/* ─── the lines ─── */
-.difftable {
-  width: 100%;
-  border-collapse: collapse;
-  font-size: 12.5px;
-  line-height: 19px;
+}
-/* Two number columns and a sign column, all fixed and all unselectable, so a
-   copy of the diff is a copy of the code. */
-.difftable .lineno {
-  position: relative;
-  width: 1%;
-  min-width: 44px;
-  text-align: right;
-  padding: 0 8px;
-  user-select: none;
-  white-space: nowrap;
-  color: var(--text-faint);
-  font-size: var(--text-xs);
-  background: color-mix(in srgb, var(--bg) 60%, transparent);
+}
-.difftable .lineno + .lineno {
-  border-right: 1px solid var(--border);
+}
-.difftable .dl-mark {
-  width: 1%;
-  padding: 0 0 0 6px;
-  user-select: none;
-  text-align: center;
-  font-weight: 600;
+}
-.difftable .codeline {
-−
+  padding: 0 10px;
-  padding: 0 10px 0 4px;
-  /* Wrap rather than scroll: a horizontal scrollbar per file makes a long diff
-     unreadable, and a scroll container would also break the sticky header.
-     Continuation lines are hung two characters in so a wrap is visibly a wrap
-     and not a new line of code. */
-  white-space: pre-wrap;
-−
+  word-break: break-all;
-  overflow-wrap: anywhere;
-  word-break: normal;
-  text-indent: -2ch;
-  padding-left: calc(4px + 2ch);
+}
-.difftable .hunkhead td {
-−
+  padding: 2px 10px;
-  padding: 3px 10px;
-  color: var(--text-faint);
-  background: var(--bg);
-  border-top: 1px solid var(--border);
-  border-bottom: 1px solid var(--border);
-  font-size: var(--text-xs);
+}
-−
+.line-add { background: var(--diff-add-bg); color: var(--diff-add-text); }
-−
+.line-del { background: var(--diff-del-bg); color: var(--diff-del-text); }
-.difftable tbody tr:first-child .hunkhead td,
-.difftable .hunkhead:first-child td {
-  border-top: 0;
+}
-/* In the commentable table the wash carries the add/delete signal on its own
-   and the text stays body colour. Colouring whole lines green and red — as this
-   used to — costs contrast on every character and drowns the word-level
-   emphasis that says what actually changed on the line. The 2px rule is what
-   survives a monochrome rendering.
-   The `.diffline` variant (interdiff, design specimens) keeps the coloured text
-   it had: it is read in short bursts, and it has no gutter to carry the colour
-   instead. */
-.diffline.line-add { background: var(--diff-add-bg); color: var(--diff-add-text); }
-.diffline.line-del { background: var(--diff-del-bg); color: var(--diff-del-text); }
-.diff-sign {
-  display: inline-block;
-  width: 1ch;
+}
-.line-add > .lineno,
-.line-add > .dl-mark,
-.line-add > .codeline { background: var(--diff-add-bg); }
-.line-del > .lineno,
-.line-del > .dl-mark,
-.line-del > .codeline { background: var(--diff-del-bg); }
-.line-add > .dl-mark { color: var(--diff-add-text); }
-.line-del > .dl-mark { color: var(--diff-del-text); }
-.line-add > .lineno:first-child { box-shadow: inset 2px 0 0 var(--diff-add-text); }
-.line-del > .lineno:first-child { box-shadow: inset 2px 0 0 var(--diff-del-text); }
-.dl:hover > .lineno { color: var(--text-dim); }
-/* The comment affordance. Absolutely positioned so it costs no layout, hidden
-   until the row is hovered or it is focused — which is what lets the diff be a
-   wall of code again instead of a wall of "Comment on line N". */
-.dl-add {
-  position: absolute;
-  left: 2px;
-  top: 50%;
-  transform: translateY(-50%);
-  width: 15px;
-  height: 15px;
-  display: grid;
-  place-items: center;
-  border-radius: var(--radius-sm);
-  background: var(--action);
-  color: var(--on-action);
-  font-size: 12px;
-  line-height: 1;
-  text-decoration: none;
-  opacity: 0;
-  pointer-events: none;
+}
-.dl:hover .dl-add,
-.dl-add:focus-visible {
-  opacity: 1;
-  pointer-events: auto;
+}
-@media (hover: none) {
-  /* No hover to reveal it with, so it is always there, just quiet. */
-  .dl-add { opacity: 0.45; pointer-events: auto; }
+}
-/* A diff line outside the commentable table: the interdiff and the design
-   sheet's specimen rows. A grid rather than a table, because there is no
-   comment column to align against — just a gutter and the code.
-  white-space: normal;
+}
-/* The comment form exists in the markup for every commentable line and is shown
-   for exactly one: the one named in the fragment. `:target` does the work, so
-   there is no per-line chrome in the resting diff, no script, and an open form
-   has a URL that can be linked at somebody. */
-.inline-form {
-−
+  padding: 4px 14px 10px;
-  display: none;
+}
-.inline-form:target {
-  display: table-row;
-  scroll-margin-top: 120px;
+}
-.inline-form > td {
-  padding: 10px 14px;
-  background: var(--surface);
-  border-top: 2px solid var(--action);
-  border-bottom: 1px solid var(--border);
-  white-space: normal;
+}
-−
+.inline-form summary {
-−
+  cursor: pointer;
-−
+  font-size: 12px;
-.inline-form textarea {
-  width: 100%;
+}
-/* A comment is a boxed object; an event is a line. That difference is the
-.sidebar-header {
-  display: flex;
-  align-items: center;
-−
+  gap: 6px;
-  gap: 8px;
-  padding: 10px 12px;
-  border-bottom: 1px solid var(--border);
-  font-size: var(--text-sm);
-  line-height: 1;
+}
-.file-tree {
-  flex-direction: column;
+}
-/* `line-height: 1`: without it the body default of 1.5 gives the label extra
-   leading that JetBrains Mono splits unevenly above/below the glyphs, so the
-   text hangs below the icon instead of sitting beside it (same fix as
-   `.filelist-entry-name`). */
-.file-tree-item {
-  display: flex;
-  align-items: center;
-−
+  gap: 6px;
-  gap: 8px;
-  padding: 5px 12px;
-  font-size: var(--text-sm);
-  font-family: var(--font-mono);
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  line-height: 1;
+}
-.file-tree-item:last-child {
-  color: var(--text-dim);
+}
-.sidebar-header svg,
-.file-tree-item svg {
-  flex: none;
+}
-.file-tree-parent {
-  color: var(--text-dim);
+}

Mcrates/df-web/src/config.rs+44−0

-//! boot rather than at the first request that needs it.
-use anyhow::{bail, Context, Result};
-use sqlx::types::ipnetwork::IpNetwork;
-#[derive(Debug, Clone)]
-pub struct Config {
-    /// stray comma cannot widen access.
-    pub allowlist: Vec<String>,
-    /// Networks whose `X-Forwarded-For` header is believed.
-    ///
-    /// Empty means "believe nobody", which is the only safe default: `XFF` is a
-    /// request header, so trusting it from an arbitrary peer lets any client
-    /// name its own address and walk straight through the rate limiter.
-    ///
-    /// This must list the edge proxy, or every request appears to come from the
-    /// proxy and all anonymous traffic shares one bucket — which is not a
-    /// tighter limit but a global one, and a single client can spend it.
-    pub trusted_proxies: Vec<IpNetwork>,
-    pub session_secret: Vec<u8>,
-    pub session_ttl_days: i64,
+    }
+}
-/// Parse `TRUSTED_PROXIES`: comma-separated CIDRs, or bare addresses meaning a
-/// single host.
-///
-/// A malformed entry is fatal rather than skipped. Dropping one silently would
-/// mean the proxy is not trusted, every client looks like the proxy, and the
-/// rate limiter degrades to a single global bucket — a failure that presents as
-/// mysterious 429s rather than as a configuration error.
-fn parse_trusted_proxies(raw: &str) -> Result<Vec<IpNetwork>> {
-    raw.split(',')
-        .map(str::trim)
-        .filter(|s| !s.is_empty())
-        .map(|s| {
-            s.parse::<IpNetwork>()
-                .with_context(|| format!("TRUSTED_PROXIES entry {s:?} is not an address or CIDR"))
-        })
-        .collect()
+}
-impl Config {
-    pub fn from_env() -> Result<Self> {
-        let base_url = var_or("BASE_URL", "http://localhost:8080")
-            );
+        }
-        let trusted_proxies = parse_trusted_proxies(&var_or("TRUSTED_PROXIES", ""))?;
-        if trusted_proxies.is_empty() {
-            tracing::warn!(
-                "TRUSTED_PROXIES is empty; rate limits key on the TCP peer. \
-                 Behind a reverse proxy that makes every anonymous request share \
-                 one bucket — set it to the proxy's network."
-            );
-        } else {
-            tracing::info!(?trusted_proxies, "trusting X-Forwarded-For from these networks");
+        }
-        let cfg = Config {
-            database_url: var("DATABASE_URL")?,
-            database_max_connections: parse_num("DATABASE_MAX_CONNECTIONS", 10)?,
-            oidc_scopes: var_or("OIDC_SCOPES", "openid profile email"),
-            allowlist,
-            trusted_proxies,
-            session_secret,
-            session_ttl_days: parse_num("SESSION_TTL_DAYS", 14i64)?,
-            oidc_redirect_url: "https://dogfood.test/auth/callback".into(),
-            oidc_scopes: "openid profile email".into(),
-            allowlist: vec![],
-            trusted_proxies: vec![],
-            session_secret: vec![7; 32],
-            session_ttl_days: 14,
-            hook_binary: "/usr/local/bin/dogfood-hook".into(),
-            oidc_redirect_url: format!("{base}/auth/callback"),
-            oidc_scopes: "openid".into(),
-            allowlist: vec![],
-            trusted_proxies: vec![],
-            session_secret: vec![0; 32],
-            session_ttl_days: 14,
-            hook_binary: "/usr/local/bin/dogfood-hook".into(),

Mcrates/df-web/src/main.rs+13−4

-            get(routes::edit::show).post(routes::edit::save),
+        )
-        .route("/{owner}/{repo}/log", get(routes::repo::log))
-        .route("/{owner}/{repo}/commit/{rev}", get(routes::repo::commit))
-        .route(
-            "/{owner}/{repo}/changes",
-            get(routes::change::list).post(routes::change::create),
-        // (spec §7, §10).
-        .route("/metrics", get(routes::metrics::metrics))
-        // Order matters. Layers run outermost-last in this builder, so the
-−
+        // effective order per request is: security → session → rate limit →
-−
+        // handler. The limiter runs *after* the session so an authenticated
-        // effective order per request is: security → edge limit → session →
-        // rate limit → handler.
-        //
-        // The fine-grained limiter runs *after* the session so an authenticated
-        // request gets its own bucket rather than sharing its neighbours'
-−
+        // address, and *inside* the security layer so a 429 still carries the
-−
+        // security headers.
-        // address. That leaves session resolution — a database round trip —
-        // ahead of it, so a coarse per-address limit runs before the session to
-        // bound what an unauthenticated flood can force. Both sit inside the
-        // security layer, so a 429 still carries the security headers.
-        .layer(axum::middleware::from_fn_with_state(
-            state.clone(),
-            ratelimit::layer,
-        ))
-        .layer(axum::middleware::from_fn_with_state(
-            state.clone(),
-            ratelimit::edge_layer,
-        ))
-        .layer(axum::middleware::from_fn_with_state(
-            state.clone(),
-            middleware::security_layer,
-        ))
-        .layer(CatchPanicLayer::new())

Mcrates/df-web/src/middleware.rs+14−15

-use axum_extra::extract::cookie::{Cookie, SameSite};
-use df_auth::{csrf, session};
-use rand::RngCore;
-−
+use uuid::Uuid;
-use crate::state::{AppState, CsrfToken, CurrentUser, Nonce};
-    let mut current = CurrentUser(None);
-    if let Some(raw) = jar.get(session::COOKIE_NAME).map(|c| c.value().to_owned()) {
-−
+        if let Ok(id) = raw.parse::<Uuid>() {
-−
+            match session::load(&state.db, id).await {
-−
+                Ok(Some((sess, user))) => {
-−
+                    // Slide the expiry only past the halfway point, to avoid a
-−
+                    // database write on every page view.
-−
+                    if session::should_slide(sess.expires_at, state.config.session_ttl_days) {
-−
+                        if let Err(e) =
-−
+                            session::slide(&state.db, sess.id, state.config.session_ttl_days).await
 −
-−
+                            tracing::warn!("sliding session failed: {e}");
 −
-        // The cookie is the session's token, not its id. `load` rejects
-        // anything not shaped like one without touching the database.
-        match session::load(&state.db, &raw).await {
-            Ok(Some((sess, user))) => {
-                // Slide the expiry only past the halfway point, to avoid a
-                // database write on every page view.
-                if session::should_slide(sess.expires_at, state.config.session_ttl_days) {
-                    if let Err(e) =
-                        session::slide(&state.db, sess.id, state.config.session_ttl_days).await
+                    {
-                        tracing::warn!("sliding session failed: {e}");
+                    }
-−
+                    current = CurrentUser(Some(Arc::new(user)));
+                }
-−
+                Ok(None) => { /* expired or unknown: treated as signed out */ }
-−
+                Err(e) => tracing::error!("loading session failed: {e}"),
-                current = CurrentUser(Some(Arc::new(user)));
+            }
-            Ok(None) => { /* expired or unknown: treated as signed out */ }
-            Err(e) => tracing::error!("loading session failed: {e}"),
+        }
+    }

Mcrates/df-web/src/ratelimit.rs460 lines+360−27

-//! team behind one NAT is not one attacker, and one attacker on a hundred
-//! addresses is still one account.
-//!
-//! "By IP" means [`client_ip`], not the TCP peer. Behind a reverse proxy the
-//! peer is the proxy for every request in the world, so keying on it does not
-//! produce a strict limit — it produces a *global* one, and a single client can
-//! spend the whole budget and lock every signed-out visitor out of the site.
-//! `TRUSTED_PROXIES` is what closes that, and an empty setting is loud about it.
-//!
-//! There are two token buckets in the request path, at different depths.
-//! Resolving a session is a database round trip and it happens *before* the
-//! limiter that knows who you are, so a coarse per-address bucket
-//! ([`edge_layer`]) runs ahead of it, and the real one ([`layer`]) runs after.
-//!
-//! In-memory, deliberately. A shared limiter would mean Redis, and this is a
-//! single-instance product (spec §1). The state is small, bounded, and reset by
-//! a restart — which is the correct behaviour for a limiter whose only job is to
-use std::time::{Duration, Instant};
-use axum::extract::{ConnectInfo, Request, State};
-−
+use axum::http::StatusCode;
-use axum::http::{HeaderMap, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use sqlx::types::ipnetwork::IpNetwork;
-use crate::state::{AppState, CurrentUser};
-/// identity holding all of them.
-const MAX_CONCURRENT: u32 = 12;
-/// The coarse bucket applied before the session is resolved.
-///
-/// Deliberately far above [`BURST`]: it is not a second rate limit, it is a
-/// bound on how much work an unauthenticated flood can force *ahead of* the
-/// real limiter. Session resolution is a database round trip and it runs first,
-/// so without this a client can spend a query per request no matter what the
-/// bucket below decides.
-const EDGE_REFILL_PER_SEC: f64 = 50.0;
-const EDGE_BURST: f64 = 200.0;
-/// Entries idle longer than this are dropped, so the map does not grow with
-/// every address that has ever connected.
-const IDLE_EVICT: Duration = Duration::from_secs(600);
-struct Bucket {
-    tokens: f64,
-    auth_tokens: f64,
-    edge_tokens: f64,
-    in_flight: u32,
-    last: Instant,
+}
-impl Bucket {
-    fn full(now: Instant) -> Bucket {
-        Bucket {
-            tokens: BURST,
-            auth_tokens: AUTH_BURST,
-            edge_tokens: EDGE_BURST,
-            in_flight: 0,
-            last: now,
+        }
+    }
-    /// Refill for the time that passed.
-    ///
-    /// `saturating_duration_since` because a clock that went backwards must not
-    /// mint tokens.
-    fn refill(&mut self, now: Instant) {
-        let elapsed = now.saturating_duration_since(self.last).as_secs_f64();
-        self.tokens = (self.tokens + elapsed * REFILL_PER_SEC).min(BURST);
-        self.auth_tokens = (self.auth_tokens + elapsed * AUTH_REFILL_PER_SEC).min(AUTH_BURST);
-        self.edge_tokens = (self.edge_tokens + elapsed * EDGE_REFILL_PER_SEC).min(EDGE_BURST);
-        self.last = now;
+    }
+}
-impl Default for Limiter {
-    fn default() -> Self {
-        Self::new()
-            return None;
+        }
-−
+        let bucket = inner.buckets.entry(key.clone()).or_insert(Bucket {
-−
+            tokens: BURST,
-−
+            auth_tokens: AUTH_BURST,
-−
+            in_flight: 0,
-−
+            last: now,
-−
+        });
 −
-−
+        // Refill for the time that passed. `saturating_duration_since` because a
-−
+        // clock that went backwards must not mint tokens.
-−
+        let elapsed = now.saturating_duration_since(bucket.last).as_secs_f64();
-−
+        bucket.tokens = (bucket.tokens + elapsed * REFILL_PER_SEC).min(BURST);
-−
+        bucket.auth_tokens = (bucket.auth_tokens + elapsed * AUTH_REFILL_PER_SEC).min(AUTH_BURST);
-−
+        bucket.last = now;
-        let bucket = inner.buckets.entry(key.clone()).or_insert(Bucket::full(now));
-        bucket.refill(now);
-        if bucket.in_flight >= MAX_CONCURRENT {
-            return None;
-        Some(Guard { limiter: self.clone(), key })
+    }
-    /// Take one token from the coarse pre-session bucket.
-    ///
-    /// No concurrency slot: this runs before the handler is chosen and releases
-    /// nothing, so it bounds arrival rate only.
-    fn acquire_edge(&self, ip: IpAddr, now: Instant) -> bool {
-        let key = Key::Addr(ip);
-        let mut inner = self.0.lock().expect("rate limiter poisoned");
-        inner.sweep(now);
-        if inner.buckets.len() >= MAX_TRACKED && !inner.buckets.contains_key(&key) {
-            return false;
+        }
-        let bucket = inner.buckets.entry(key).or_insert(Bucket::full(now));
-        bucket.refill(now);
-        if bucket.edge_tokens < 1.0 {
-            return false;
+        }
-        bucket.edge_tokens -= 1.0;
-        true
+    }
-    fn release(&self, key: &Key) {
-        if let Ok(mut inner) = self.0.lock() {
-            if let Some(b) = inner.buckets.get_mut(key) {
-    matches!(path, "/healthz" | "/readyz") || path.starts_with("/assets/")
+}
-/// Not in `http::header`, which only defines registered headers.
-const X_FORWARDED_FOR: &str = "x-forwarded-for";
-/// One `X-Forwarded-For` entry as an address.
-///
-/// Proxies vary: bare addresses, `addr:port`, and bracketed IPv6 all appear.
-/// Anything that does not parse is discarded rather than guessed at.
-fn parse_forwarded(entry: &str) -> Option<IpAddr> {
-    let s = entry.trim();
-    if s.is_empty() {
-        return None;
+    }
-    // `[::1]` or `[::1]:8080`
-    if let Some(rest) = s.strip_prefix('[') {
-        let (inner, _) = rest.split_once(']')?;
-        return inner.parse().ok();
+    }
-    if let Ok(ip) = s.parse::<IpAddr>() {
-        return Some(ip);
+    }
-    // `1.2.3.4:5678`. Only IPv4 — a bare IPv6 has colons of its own and was
-    // handled by the parse above.
-    s.rsplit_once(':').and_then(|(host, _)| host.parse().ok())
+}
-/// The address to attribute a request to.
-///
-/// The TCP peer is the truth unless it is a proxy we were told to trust, in
-/// which case the client is the rightmost `X-Forwarded-For` entry that is not
-/// itself trusted — walking from the right because the entries an attacker can
-/// forge are on the left, appended before ours.
-///
-/// With no trusted proxies configured the header is ignored entirely. That is
-/// the only safe default: `XFF` is client-controlled, so honouring it from an
-/// arbitrary peer would let anyone claim a fresh bucket per request.
-pub fn client_ip(
-    headers: &HeaderMap,
-    peer: Option<IpAddr>,
-    trusted: &[IpNetwork],
-) -> Option<IpAddr> {
-    let peer = peer?;
-    let is_trusted = |ip: IpAddr| trusted.iter().any(|n| n.contains(ip));
-    if !is_trusted(peer) {
-        return Some(peer);
+    }
-    headers
-        .get_all(X_FORWARDED_FOR)
-        .iter()
-        .filter_map(|v| v.to_str().ok())
-        .flat_map(|v| v.split(','))
-        .filter_map(parse_forwarded)
-        .collect::<Vec<_>>()
-        .into_iter()
-        .rev()
-        .find(|ip| !is_trusted(*ip))
-        // Every hop was a trusted proxy, or the header was absent: the peer is
-        // the closest thing to a client we can honestly name.
-        .or(Some(peer))
+}
-/// The client address for this request, or the shared unknown-peer bucket.
-fn request_ip(state: &AppState, req: &Request) -> IpAddr {
-    let peer = req
-        .extensions()
-        .get::<ConnectInfo<std::net::SocketAddr>>()
-        .map(|c| c.0.ip());
-    client_ip(req.headers(), peer, &state.config.trusted_proxies).unwrap_or(UNKNOWN_PEER)
+}
-/// The coarse limiter, which runs *before* the session is resolved.
-///
-/// Its only job is to stop an unauthenticated flood buying a database round trip
-/// per request: session resolution sits between this layer and [`layer`].
-pub async fn edge_layer(State(state): State<AppState>, req: Request, next: Next) -> Response {
-    let path = req.uri().path().to_owned();
-    if is_exempt(&path) {
-        return next.run(req).await;
+    }
-    let ip = request_ip(&state, &req);
-    if !state.limiter.acquire_edge(ip, Instant::now()) {
-        tracing::warn!(%path, %ip, "rate limited at the edge");
-        return too_many();
+    }
-    next.run(req).await
+}
-/// The rate-limiting middleware.
-///
-/// `ConnectInfo` is optional so a missing peer address cannot turn every
-/// `into_make_service_with_connect_info` — and its absence falls back to a
-/// single shared bucket, which is stricter than per-address, not looser.
-pub async fn layer(State(state): State<AppState>, req: Request, next: Next) -> Response {
-−
+    let addr = req
-−
+        .extensions()
-−
+        .get::<ConnectInfo<std::net::SocketAddr>>()
-−
+        .map(|c| c.0);
-    let path = req.uri().path().to_owned();
-    if is_exempt(&path) {
-        return next.run(req).await;
-    // neighbours' address.
-    let key = match req.extensions().get::<CurrentUser>().and_then(|u| u.0.as_ref()) {
-        Some(user) => Key::User(user.id),
-−
+        None => Key::Addr(addr.map(|a| a.ip()).unwrap_or(UNKNOWN_PEER)),
-        None => Key::Addr(request_ip(&state, &req)),
-    };
-−
+    let Some(_guard) = state.limiter.acquire(key, is_auth_path(&path), Instant::now()) else {
-−
+        tracing::warn!(%path, peer = ?addr, "rate limited");
-−
+        return (
-−
+            StatusCode::TOO_MANY_REQUESTS,
-−
+            [(axum::http::header::RETRY_AFTER, "5")],
-−
+            "Too many requests. Try again in a moment.",
 −
-−
+            .into_response();
-    let Some(_guard) = state.limiter.acquire(key.clone(), is_auth_path(&path), Instant::now())
-    else {
-        tracing::warn!(%path, ?key, "rate limited");
-        return too_many();
-    };
-    next.run(req).await
+}
-fn too_many() -> Response {
+    (
-        StatusCode::TOO_MANY_REQUESTS,
-        [(axum::http::header::RETRY_AFTER, "5")],
-        "Too many requests. Try again in a moment.",
+    )
-        .into_response()
+}
-#[cfg(test)]
-mod tests {
-    use super::*;
-        Key::Addr("10.0.0.1".parse().unwrap())
+    }
-    // ─── attributing a request to a client ───────────────────────────────────
-    fn ip(s: &str) -> IpAddr {
-        s.parse().unwrap()
+    }
-    fn nets(v: &[&str]) -> Vec<IpNetwork> {
-        v.iter().map(|s| s.parse().unwrap()).collect()
+    }
-    fn xff(value: &str) -> HeaderMap {
-        let mut h = HeaderMap::new();
-        h.insert(X_FORWARDED_FOR, value.parse().unwrap());
+        h
+    }
-    #[test]
-    fn without_trusted_proxies_the_header_is_ignored() {
-        // The spoofing case: believing this header from an arbitrary peer lets
-        // any client mint a fresh bucket per request.
-        let h = xff("1.2.3.4");
-        assert_eq!(
-            client_ip(&h, Some(ip("203.0.113.9")), &[]),
-            Some(ip("203.0.113.9"))
-        );
+    }
-    #[test]
-    fn a_forged_header_from_an_untrusted_peer_is_ignored() {
-        let h = xff("1.2.3.4");
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&h, Some(ip("198.51.100.7")), &trusted),
-            Some(ip("198.51.100.7")),
-            "only the configured proxy may speak for a client"
-        );
+    }
-    #[test]
-    fn behind_the_proxy_the_client_is_taken_from_the_header() {
-        // The bug this exists to fix: without it every request looks like the
-        // proxy and all anonymous traffic shares one bucket.
-        let h = xff("203.0.113.9");
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&h, Some(ip("172.23.0.2")), &trusted),
-            Some(ip("203.0.113.9"))
-        );
+    }
-    #[test]
-    fn a_client_cannot_prepend_its_way_to_a_fresh_bucket() {
-        // A client that sends its own XFF has it *prepended* to by the proxy,
-        // so the entries it controls are on the left. Reading from the right is
-        // what makes them inert.
-        let h = xff("9.9.9.9, 8.8.8.8, 203.0.113.9");
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&h, Some(ip("172.23.0.2")), &trusted),
-            Some(ip("203.0.113.9")),
-            "the rightmost untrusted entry is the only honest one"
-        );
+    }
-    #[test]
-    fn trusted_hops_are_skipped_from_the_right() {
-        let h = xff("203.0.113.9, 172.23.0.5, 172.23.0.9");
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&h, Some(ip("172.23.0.2")), &trusted),
-            Some(ip("203.0.113.9"))
-        );
+    }
-    #[test]
-    fn an_all_trusted_chain_falls_back_to_the_peer() {
-        let h = xff("172.23.0.5");
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&h, Some(ip("172.23.0.2")), &trusted),
-            Some(ip("172.23.0.2"))
-        );
+    }
-    #[test]
-    fn a_proxy_that_sends_no_header_falls_back_to_the_peer() {
-        let trusted = nets(&["172.23.0.0/16"]);
-        assert_eq!(
-            client_ip(&HeaderMap::new(), Some(ip("172.23.0.2")), &trusted),
-            Some(ip("172.23.0.2"))
-        );
+    }
-    #[test]
-    fn forwarded_entries_parse_in_the_shapes_proxies_actually_send() {
-        assert_eq!(parse_forwarded("1.2.3.4"), Some(ip("1.2.3.4")));
-        assert_eq!(parse_forwarded("  1.2.3.4  "), Some(ip("1.2.3.4")));
-        assert_eq!(parse_forwarded("1.2.3.4:5678"), Some(ip("1.2.3.4")));
-        assert_eq!(parse_forwarded("::1"), Some(ip("::1")));
-        assert_eq!(parse_forwarded("[::1]"), Some(ip("::1")));
-        assert_eq!(parse_forwarded("[2001:db8::1]:443"), Some(ip("2001:db8::1")));
-        // Junk is discarded, never guessed at.
-        assert_eq!(parse_forwarded(""), None);
-        assert_eq!(parse_forwarded("unknown"), None);
-        assert_eq!(parse_forwarded("_secret"), None);
+    }
-    #[test]
-    fn a_missing_peer_yields_no_address() {
-        assert_eq!(client_ip(&xff("1.2.3.4"), None, &nets(&["0.0.0.0/0"])), None);
+    }
-    #[test]
-    fn distinct_clients_behind_one_proxy_get_distinct_buckets() {
-        // The property the whole fix is for: two visitors must not be able to
-        // spend each other's budget.
-        let trusted = nets(&["172.23.0.0/16"]);
-        let peer = Some(ip("172.23.0.2"));
-        let a = client_ip(&xff("203.0.113.1"), peer, &trusted).unwrap();
-        let b = client_ip(&xff("203.0.113.2"), peer, &trusted).unwrap();
-        assert_ne!(a, b);
-        let l = Limiter::new();
-        let now = Instant::now();
-        let mut held = Vec::new();
-        for _ in 0..MAX_CONCURRENT {
-            held.push(l.acquire(Key::Addr(a), false, now).expect("under the cap"));
+        }
-        assert!(
-            l.acquire(Key::Addr(a), false, now).is_none(),
-            "the first client has spent its own budget"
-        );
-        assert!(
-            l.acquire(Key::Addr(b), false, now).is_some(),
-            "one client must not be able to lock everyone else out"
-        );
+    }
-    // ─── the coarse pre-session bucket ───────────────────────────────────────
-    // Asserting on constants is the point: this pins a relationship between
-    // them that a later edit could quietly break.
-    #[test]
-    #[allow(clippy::assertions_on_constants)]
-    fn the_edge_bucket_is_far_looser_than_the_real_one() {
-        // It must never be what stops ordinary traffic; the limiter after the
-        // session is where policy lives.
-        assert!(EDGE_BURST > BURST * 4.0);
-        assert!(EDGE_REFILL_PER_SEC > REFILL_PER_SEC * 4.0);
+    }
-    #[test]
-    fn the_edge_bucket_bites_eventually() {
-        let l = Limiter::new();
-        let now = Instant::now();
-        for i in 0..EDGE_BURST as usize {
-            assert!(l.acquire_edge(ip("10.0.0.1"), now), "request {i} of the burst");
+        }
-        assert!(!l.acquire_edge(ip("10.0.0.1"), now), "the edge burst is spent");
-        assert!(
-            l.acquire_edge(ip("10.0.0.2"), now),
-            "and it is per-address, not global"
-        );
+    }
-    #[test]
-    fn the_edge_bucket_takes_no_concurrency_slot() {
-        // It runs before the handler is chosen and releases nothing, so it must
-        // not consume the cap the real limiter enforces.
-        let l = Limiter::new();
-        let now = Instant::now();
-        for _ in 0..50 {
-            assert!(l.acquire_edge(ip("10.0.0.1"), now));
+        }
-        let mut held = Vec::new();
-        for _ in 0..MAX_CONCURRENT {
-            held.push(
-                l.acquire(Key::Addr(ip("10.0.0.1")), false, now)
-                    .expect("the concurrency cap is untouched by the edge bucket"),
-            );
+        }
+    }
-    #[test]
-    fn a_burst_is_allowed_then_refused() {
-        let l = Limiter::new();

Mcrates/df-web/src/security_tests.rs+76−18

+    }
-    /// A GET as a signed-in user.
-−
+    async fn get_as(&self, path: &str, session: &Uuid) -> Response {
-−
+        self.request(path, Some(*session)).await
-    async fn get_as(&self, path: &str, session: &str) -> Response {
-        self.request(path, Some(session)).await
+    }
-−
+    async fn request(&self, path: &str, session: Option<Uuid>) -> Response {
-    async fn request(&self, path: &str, session: Option<&str>) -> Response {
-        let mut req = Request::builder().uri(path).method("GET");
-        if let Some(s) = session {
-            req = req.header("cookie", format!("{}={s}", df_auth::session::COOKIE_NAME));
-    })
+}
-−
+/// Seed a user and an active session, returning `(user_id, session_id)`.
-−
+async fn user(db: &PgPool, handle: &str, admin: bool) -> (Uuid, Uuid) {
-/// Seed a user and an active session, returning `(user_id, session_token)`.
-///
-/// The second element is the cookie value, which is the token and not the row
-/// id — the id is never accepted as a credential.
-async fn user(db: &PgPool, handle: &str, admin: bool) -> (Uuid, String) {
-    let id = Uuid::now_v7();
-    sqlx::query(
-        "INSERT INTO users (id, subject, handle, display_name, is_admin)
-    .await
-    .expect("seeding a user");
-−
+    let session = Uuid::now_v7();
-−
+    sqlx::query("INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, now() + '14 days')")
-−
+        .bind(session)
-−
+        .bind(id)
-−
+        .execute(db)
-−
+        .await
-−
+        .expect("seeding a session");
-    // Minted the same way a real login does, so the tests exercise the token
-    // path rather than a shape only the tests produce.
-    let token = df_auth::session::generate_token();
-    sqlx::query(
-        "INSERT INTO sessions (id, user_id, token_hash, expires_at)
-         VALUES ($1, $2, encode(sha256($3::bytea), 'hex'), now() + '14 days')",
+    )
-    .bind(Uuid::now_v7())
-    .bind(id)
-    .bind(token.as_bytes())
-    .execute(db)
-    .await
-    .expect("seeding a session");
-−
+    (id, session)
-    (id, token)
+}
-/// Seed a repository owned by `owner`, returning its id.
-        "/alice/hidden/issues/1",
-        "/alice/hidden/stacks/klxqnvpqlnlvtkmuqmtmxktlnvnomvwv",
-    ] {
-−
+        for session in [None, Some(mallory)] {
-        for session in [None, Some(mallory.as_str())] {
-            let res = h.request(path, session).await;
-            assert_eq!(res.status(), StatusCode::NOT_FOUND, "{path} was reachable");
-            let body = h.body(res).await;
-        "/bob/public-fork/issues/1",
-        "/alice/private-parent",
-    ] {
-−
+        for session in [None, Some(mallory)] {
-        for session in [None, Some(mallory.as_str())] {
-            let res = h.request(path, session).await;
-            assert_eq!(res.status(), StatusCode::NOT_FOUND, "{path}");
-            let body = h.body(res).await;
-    issue(&h.db, hidden, 1, "widgetconfidential issue").await;
-    change(&h.db, public, 1, "mmmmnvpqlnlvtkmuqmtmxktlnvnomvwv", "widgetpublic change").await;
-−
+    for session in [None, Some(mallory)] {
-    for session in [None, Some(mallory.as_str())] {
-        let res = h.request("/search?q=widget", session).await;
-        assert_eq!(res.status(), StatusCode::OK);
-        let body = h.body(res).await;
-    change(&h.db, hidden, 1, "klxqnvpqlnlvtkmuqmtmxktlnvnomvwv", "widgetconfidential change").await;
-    change(&h.db, public, 1, "mmmmnvpqlnlvtkmuqmtmxktlnvnomvwv", "widgetpublic change").await;
-−
+    for session in [None, Some(mallory)] {
-    for session in [None, Some(mallory.as_str())] {
-        let res = h.request("/search?q=widget&fragment=1", session).await;
-        assert_eq!(res.status(), StatusCode::OK);
-        let body = h.body(res).await;
-    repo(&h.db, alice, "unlistable-repo", true).await;
-    repo(&h.db, alice, "listable-repo", false).await;
-−
+    for session in [None, Some(mallory)] {
-    for session in [None, Some(mallory.as_str())] {
-        let res = h.request("/alice", session).await;
-        assert_eq!(res.status(), StatusCode::OK);
-        let body = h.body(res).await;
-    h.drop_schema().await;
+}
-/// The session cookie is a bearer token, and the row id is not a credential.
-///
-/// The cookie used to be `sessions.id`, a UUIDv7 — time-ordered, with a counter
-/// that only reseeds once a millisecond, so ids minted together share their
-/// leading bits and any other id from the same generator narrows the rest. The
-/// id is still the primary key; what this pins is that presenting it no longer
-/// signs anybody in.
-#[tokio::test]
-async fn a_session_row_id_is_not_a_credential() {
-    let Some(h) = harness("sessionid").await else { return };
-    let (alice, token) = user(&h.db, "alice", false).await;
-    repo(&h.db, alice, "hidden", true).await;
-    // The token works.
-    assert_eq!(
-        h.get_as("/alice/hidden", &token).await.status(),
-        StatusCode::OK,
-        "the session token must sign alice in"
-    );
-    // The row id, which is what the old cookie carried, does not.
-    let id: Uuid = sqlx::query_scalar("SELECT id FROM sessions WHERE user_id = $1")
-        .bind(alice)
-        .fetch_one(&h.db)
-        .await
-        .expect("the seeded session");
-    assert_eq!(
-        h.get_as("/alice/hidden", &id.to_string()).await.status(),
-        StatusCode::NOT_FOUND,
-        "a session id must not authenticate — it is an identifier, not a secret"
-    );
-    // Neither does the stored hash, which is what a database leak would yield.
-    let hash: String = sqlx::query_scalar("SELECT token_hash FROM sessions WHERE user_id = $1")
-        .bind(alice)
-        .fetch_one(&h.db)
-        .await
-        .expect("the seeded session");
-    assert_ne!(hash, token, "the plaintext token must not be stored");
-    assert_eq!(
-        h.get_as("/alice/hidden", &hash).await.status(),
-        StatusCode::NOT_FOUND,
-        "the stored hash must not be replayable as the token"
-    );
-    h.drop_schema().await;
+}
-/// An archived repository is read-only. The settings page promises that in so
-/// many words, so it has to be true on the wire — enforcing it only in the UI
-/// would leave the promise false for every Git client.

Mcrates/df-store/src/git/diff.rs+12−4

+            }
-            use gix::object::tree::diff::Change;
-            // Blobs only. The walk reports the directories on the way down as
-            // well as the files inside them, and a tree entry has no content to
-            // diff — it used to reach the renderer as a "binary file" with no
-            // hunks, so a change touching four crates listed eleven phantom
-            // files nobody edited. `is_blob` also excludes symlinks and
-            // submodule gitlinks, which is what the old check was reaching for.
-            let pc = match change {
-                Change::Addition { entry_mode, id, .. } => {
-−
+                    (!entry_mode.is_link() && !entry_mode.is_commit()).then(|| PathChange {
-                    entry_mode.is_blob().then(|| PathChange {
-                        path: path.clone(),
-                        old_path: None,
-                        kind: ChangeKind::Added,
-                    })
+                }
-                Change::Deletion { entry_mode, id, .. } => {
-−
+                    (!entry_mode.is_link() && !entry_mode.is_commit()).then(|| PathChange {
-                    entry_mode.is_blob().then(|| PathChange {
-                        path: path.clone(),
-                        old_path: None,
-                        kind: ChangeKind::Deleted,
-                    previous_id,
-                    id,
-                    ..
-−
+                } => (!entry_mode.is_link() && !entry_mode.is_commit()).then(|| PathChange {
-                } => entry_mode.is_blob().then(|| PathChange {
-                    path: path.clone(),
-                    old_path: None,
-                    kind: ChangeKind::Modified,
-                    new_id: Some(id.detach()),
-                }),
-                Change::Rewrite {
-                    entry_mode,
-                    source_location,
-                    source_id,
-                    id,
-                    ..
-−
+                } => Some(PathChange {
-                } => entry_mode.is_blob().then(|| PathChange {
-                    path: path.clone(),
-                    old_path: Some(source_location.to_string()),
-                    kind: ChangeKind::Renamed,

Mcrates/df-web/src/git_http/mod.rs+9−1

-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        // Without this the `GIT_TIMEOUT` below bounds how long we *wait*, not
-        // how long git runs: tokio does not kill a child when its handle is
-        // dropped unless asked, so a timed-out `upload-pack` on a hostile
-        // repository would keep burning CPU with nothing left watching it.
-        .kill_on_drop(true)
-        // Never let a repository's own config influence what we run, and never
-        // let git prompt for anything.
-        .env_clear()
-            return Err(AppError::Internal(anyhow::anyhow!("running git: {e}")));
+        }
-        Err(_) => {
-−
+            tracing::error!(?args, "git operation timed out");
-            // Dropping the timed-out future drops the `Child`, and
-            // `kill_on_drop` above turns that into a SIGKILL. The process is
-            // gone by the time this returns rather than orphaned.
-            tracing::error!(?args, "git operation timed out; killing it");
-            return Err(AppError::Internal(anyhow::anyhow!("git timed out")));
+        }
-    };

Mcrates/df-web/src/routes/auth.rs+98−9

-/// selection. Short-lived and self-contained, so no extra table is needed.
-const PENDING_COOKIE: &str = "dogfood_pending";
-/// How long a pending identity stays usable.
-///
-/// Enforced inside the signature, not only as the cookie's `Max-Age`: `Max-Age`
-/// is a request to the browser, and a copy of the cookie taken anywhere else
-/// would otherwise stay redeemable for an account forever.
-const PENDING_TTL_MINUTES: i64 = 15;
-fn stash_pending(
-    jar: CookieJar,
-    state: &AppState,
-        "email": identity.email,
-        "name": identity.name,
-        "id_token": identity.id_token,
-        "exp": (chrono::Utc::now() + chrono::Duration::minutes(PENDING_TTL_MINUTES)).timestamp(),
-    })
-    .to_string();
-            .secure(state.config.secure_cookies())
-            .http_only(true)
-            .same_site(SameSite::Lax)
-−
+            .max_age(time::Duration::minutes(15))
-            .max_age(time::Duration::minutes(PENDING_TTL_MINUTES))
-            .build(),
-    ))
+}
+}
-fn read_pending(secret: &[u8], jar: &CookieJar) -> Option<df_auth::Identity> {
-    verify_pending(secret, jar.get(PENDING_COOKIE)?.value())
+}
-/// Verify and decode a pending-identity cookie value.
-///
-/// Split out from [`read_pending`] so the signature and expiry rules are
-/// testable without building a cookie jar.
-fn verify_pending(secret: &[u8], raw: &str) -> Option<df_auth::Identity> {
-    use subtle::ConstantTimeEq;
-−
+    let raw = jar.get(PENDING_COOKIE)?.value();
-    let (payload_hex, mac) = raw.split_once('.')?;
-    let payload = String::from_utf8(hex::decode(payload_hex).ok()?).ok()?;
+    }
-    let v: serde_json::Value = serde_json::from_str(&payload).ok()?;
-    // The signature proves we minted it; `exp` is what stops it being minted
-    // once and redeemed indefinitely. A payload without one predates this and
-    // is refused rather than grandfathered.
-    let exp = v.get("exp").and_then(serde_json::Value::as_i64)?;
-    if chrono::Utc::now().timestamp() > exp {
-        return None;
+    }
-    Some(df_auth::Identity {
-        subject: v.get("sub")?.as_str()?.to_string(),
-        email: v.get("email").and_then(|e| e.as_str()).map(str::to_string),
-        .get(axum::http::header::USER_AGENT)
-        .and_then(|v| v.to_str().ok());
-−
+    let (id, expires) = session::create(
-    let s = session::create(
-        &state.db,
-        user_id,
-        state.config.session_ttl_days,
-        id_token,
+    )
-    .await?;
-    let expires = s.expires_at;
-−
+    let cookie = Cookie::build((session::COOKIE_NAME, id.to_string()))
-    // The cookie carries the token. The row id never leaves the server.
-    let cookie = Cookie::build((session::COOKIE_NAME, s.token))
-        .path("/")
-        .secure(state.config.secure_cookies())
-        .http_only(true)
-) -> AppResult<Response> {
-    let mut id_token_hint = None;
-    if let Some(raw) = jar.get(session::COOKIE_NAME) {
-−
+        if let Ok(id) = raw.value().parse::<uuid::Uuid>() {
-−
+            id_token_hint = session::id_token(&state.db, id).await.unwrap_or_default();
-−
+            if let Err(e) = session::destroy(&state.db, id).await {
-−
+                tracing::warn!("destroying session failed: {e}");
 −
-        // Deletes the row and hands back the stashed ID token in one statement.
-        match session::destroy(&state.db, raw.value()).await {
-            Ok(hint) => id_token_hint = hint,
-            Err(e) => tracing::warn!("destroying session failed: {e}"),
+        }
+    }
-        // A changed payload must not verify against the old tag.
-        assert_ne!(mac, sign_pending(secret, r#"{"sub":"attacker"}"#));
+    }
-    const PENDING_SECRET: &[u8] = b"secret-key-for-pending-identity-cookie";
-    /// Build a cookie value the way `stash_pending` does, with a chosen expiry.
-    fn pending_cookie(exp: i64) -> String {
-        let payload = serde_json::json!({
-            "sub": "abc",
-            "email": "a@b.c",
-            "name": null,
-            "id_token": null,
-            "exp": exp,
-        })
-        .to_string();
-        format!(
-            "{}.{}",
-            hex::encode(&payload),
-            sign_pending(PENDING_SECRET, &payload)
+        )
+    }
-    #[test]
-    fn a_live_pending_cookie_verifies() {
-        let raw = pending_cookie(chrono::Utc::now().timestamp() + 600);
-        let identity = verify_pending(PENDING_SECRET, &raw).expect("should verify");
-        assert_eq!(identity.subject, "abc");
+    }
-    #[test]
-    fn an_expired_pending_cookie_is_refused_even_though_it_is_signed() {
-        // The attack `Max-Age` alone does not stop: the browser's copy is gone,
-        // but a copy taken anywhere else still carries our signature.
-        let raw = pending_cookie(chrono::Utc::now().timestamp() - 1);
-        assert!(verify_pending(PENDING_SECRET, &raw).is_none());
+    }
-    #[test]
-    fn a_pending_cookie_without_an_expiry_is_refused() {
-        // The pre-expiry format. Grandfathering it in would leave the old
-        // indefinitely-redeemable cookie working.
-        let payload = r#"{"sub":"abc","email":"a@b.c","name":null}"#;
-        let raw = format!(
-            "{}.{}",
-            hex::encode(payload),
-            sign_pending(PENDING_SECRET, payload)
-        );
-        assert!(verify_pending(PENDING_SECRET, &raw).is_none());
+    }
-    #[test]
-    fn a_pending_cookie_cannot_have_its_expiry_extended() {
-        let raw = pending_cookie(chrono::Utc::now().timestamp() - 1);
-        let (payload_hex, mac) = raw.split_once('.').unwrap();
-        let payload = String::from_utf8(hex::decode(payload_hex).unwrap()).unwrap();
-        // Push the expiry out without re-signing, which is all an attacker can do.
-        let forged = payload.replace(
-            &format!("\"exp\":{}", chrono::Utc::now().timestamp() - 1),
-            &format!("\"exp\":{}", chrono::Utc::now().timestamp() + 86_400),
-        );
-        assert_ne!(forged, payload, "the test must actually change the expiry");
-        let tampered = format!("{}.{mac}", hex::encode(&forged));
-        assert!(verify_pending(PENDING_SECRET, &tampered).is_none());
+    }
+}

Mcrates/df-web/src/routes/health.rs+28−6

-//! Liveness and readiness.
-//!
-//! `/healthz` answers whether the process is up; `/readyz` answers whether it
-−
+//! can serve, which means the database is reachable. Container orchestration
-−
+//! restarts on the former and withholds traffic on the latter, so conflating
-−
+//! them turns a transient database blip into a restart loop.
-//! can serve, which means the database is reachable and the pool can still hand
-//! out a connection.
-//!
-//! The container healthcheck reads `/readyz`. It used to read `/healthz` on the
-//! reasoning that restarting on readiness turns a transient database blip into a
-//! restart loop — but nothing restarts on either signal here (compose restarts
-//! on exit), so all that bought was a container reporting healthy while it
-//! served nothing but 500s.
-use axum::extract::State;
-use axum::http::StatusCode;
+}
-pub async fn readyz(State(state): State<AppState>) -> impl IntoResponse {
-    // Reported either way: a pool that is at its ceiling with nothing idle is
-    // the signature of connections stuck in the pool rather than of a database
-    // that has gone away, and the two need different responses from whoever is
-    // reading this.
-    let open = state.db.size();
-    let idle = state.db.num_idle();
-    match df_db::ping(&state.db).await {
-−
+        Ok(()) => (StatusCode::OK, "ready\n"),
-        Ok(()) => (
-            StatusCode::OK,
-            format!("ready\npool: {idle} idle / {open} open\n"),
-        ),
-        Err(e) => {
-−
+            tracing::error!("readiness check failed: {e}");
-−
+            (StatusCode::SERVICE_UNAVAILABLE, "database unreachable\n")
-            tracing::error!(
-                pool_open = open,
-                pool_idle = idle,
-                "readiness check failed: {e}"
-            );
+            (
-                StatusCode::SERVICE_UNAVAILABLE,
-                format!("database unreachable\npool: {idle} idle / {open} open\n"),
+            )
+        }
+    }
+}

Mcrates/df-web/src/routes/repo.rs+73−0

-    Ok(render(&ctx, "code", &csrf, &nonce, user.as_deref(), body))
+}
-#[derive(Deserialize, Default)]
-pub struct CommitQuery {
-    /// Fold every file. A link rather than a script, so the folded view is a
-    /// URL and works with scripting off.
-    pub collapse: Option<String>,
+}
-/// `GET /{owner}/{repo}/commit/{rev}`
-///
-/// One commit and its patch against the first parent. A root commit has no
-/// parent and diffs against an empty tree, so the first commit in a repository
-/// renders as an all-additions patch rather than as an error.
-pub async fn commit(
-    State(state): State<AppState>,
-    UrlPath((owner, name, rev_spec)): UrlPath<(String, String, String)>,
-    Query(q): Query<CommitQuery>,
-    CurrentUser(user): CurrentUser,
-    CsrfToken(csrf): CsrfToken,
-    Nonce(nonce): Nonce,
-) -> AppResult<Response> {
-    let ctx = RepoContext::load(&state, &owner, &name, user.as_deref()).await?;
-    // Bookmark names resolve too: `/commit/main` is a reasonable thing to type,
-    // and it lands on whichever commit that name points at right now.
-    let rev = state
-        .store
-        .resolve(ctx.store_id(), &rev_spec)
-        .await
-        .map_err(store_err)?;
-    let revision = state
-        .store
-        .revision(ctx.store_id(), &rev)
-        .await
-        .map_err(store_err)?;
-    let opts = df_store::DiffOpts {
-        context_lines: 3,
-        max_files: state.config.max_diff_files,
-        max_lines: state.config.max_diff_lines,
-    };
-    // Best-effort: a commit whose patch cannot be rendered still has a message,
-    // an author and parents worth showing, and the view says so in place of the
-    // diff rather than 500-ing the page.
-    let diff = match state.store.diff_from_parent(ctx.store_id(), &rev, opts).await {
-        Ok(d) => Some(d),
-        Err(e) => {
-            tracing::warn!("diffing {rev} failed: {e}");
-            None
+        }
-    };
-    let handles = handles_for_emails(
-        &state,
-        [revision.author.email.as_str(), revision.committer.email.as_str()],
+    )
-    .await;
-    let body = v::commit_view(
-        &ctx,
-        v::CommitPage {
-            rev: &revision,
-            author_handle: handles.get(&revision.author.email).map(String::as_str),
-            committer_handle: handles.get(&revision.committer.email).map(String::as_str),
-            diff: diff.as_ref(),
-            collapsed: q.collapse.is_some(),
-        },
-    );
-    Ok(render(&ctx, "code", &csrf, &nonce, user.as_deref(), body))
+}
-/// `GET /{owner}/{repo}/bookmarks`
-pub async fn bookmarks(
-    State(state): State<AppState>,

Mcrates/df-web/src/routes/review.rs+4−0

-pub struct FilesQuery {
-    pub rev: Option<String>,
-    pub against: Option<String>,
-    /// Fold every file. A link rather than a script, so the folded view is a
-    /// URL and works with scripting off.
-    pub collapse: Option<String>,
+}
-/// `GET /{owner}/{repo}/changes/{ref}/files`
-            rev: rev.as_deref().unwrap_or(""),
-            against: against.as_deref(),
-            revisions: &l.revisions,
-            collapsed: q.collapse.is_some(),
-        })))
-    };

Mcrates/df-web/src/views/mod.rs+1−0

-pub mod change;
-pub mod design;
-pub mod diff;
-pub mod edit;
-pub mod issue;
-pub mod layout;

Mcrates/df-web/src/views/repo.rs+305−19

-                    caption .sr-only { "Files in this directory" }
-                    thead {
-                        tr {
-−
+                            th .filelist-icon { span .sr-only { "Kind" } }
-                            th .filelist-name { "Name" }
-                            th .filelist-message { "Last change" }
-                            th .filelist-change { "Change" }
-                    tbody {
-                        @if !path.is_empty() {
-                            tr {
-−
+                                td .filelist-icon {
-−
+                                    a href=(parent_link(&base, rev_label, path)) aria-label="Parent directory" {
-−
+                                        (dir_icon())
 −
 −
-                                td .filelist-name colspan="4" {
-−
+                                    a .mono href=(parent_link(&base, rev_label, path)) { ".." }
-                                    span .filelist-entry {
-                                        a .filelist-entry-link.mono
-                                            href=(parent_link(&base, rev_label, path))
-                                            aria-label="Parent directory" {
-                                            (dir_icon())
-                                            span .filelist-entry-name { ".." }
+                                        }
+                                    }
+                                }
+                            }
+                        }
-                        @for e in entries {
-                            tr {
-−
+                                td .filelist-icon {
-−
+                                    a href=(entry_link(&base, rev_label, e)) tabindex="-1" aria-hidden="true" {
-−
+                                        @if e.kind == EntryKind::Directory { (dir_icon()) } @else { (file_icon()) }
 −
 −
-                                td .filelist-name {
-−
+                                    a .mono href=(entry_link(&base, rev_label, e))
-−
+                                        .is-dir[e.kind == EntryKind::Directory] {
-−
+                                        (e.name)
-                                    span .filelist-entry {
-                                        a .filelist-entry-link.mono href=(entry_link(&base, rev_label, e))
-                                            .is-dir[e.kind == EntryKind::Directory] {
-                                            @if e.kind == EntryKind::Directory { (dir_icon()) } @else { (file_icon()) }
-                                            span .filelist-entry-name { (e.name) }
+                                        }
-                                        @if e.kind == EntryKind::Symlink {
-                                            span .faint .filelist-note { "symlink" }
+                                        }
+                                    }
-−
+                                    @if e.kind == EntryKind::Symlink {
-−
+                                        span .faint .filelist-note { "symlink" }
 −
+                                }
-                                @match history.get(&e.name) {
-                                    Some(h) => {
-                    @for r in revisions {
-                        div style="padding:10px 0;border-bottom:1px solid var(--border)" {
-                            div .row {
-−
+                                a href=(format!("{base}/tree/{}/", r.rev)) { (r.summary()) }
-                                // The message leads to the commit's own page —
-                                // what it changed is the question a log row
-                                // raises, and the tree at that revision is not
-                                // an answer to it.
-                                a href=(format!("{base}/commit/{}", r.rev)) { (r.summary()) }
-                                @if r.conflicted {
-                                    span .badge.badge-conflict { "conflict" }
+                                }
-                                } @else {
-                                    span .chip title="authored with plain git" { "git" }
+                                }
-                                a .mono.faint href=(format!("{base}/commit/{}", r.rev))
-                                  title=(r.rev.as_str()) {
-                                    (df_store::abbreviate_rev(r.rev.as_str()))
+                                }
-                                span .faint {
-                                    (crate::views::person(
-                                        handles.get(&r.author.email).map(String::as_str),
+    }
+}
-// ─── one commit ──────────────────────────────────────────────────────────────
-/// Everything the commit page shows about one revision.
-pub struct CommitPage<'a> {
-    pub rev: &'a Revision,
-    /// The account the author's email resolved to, when it matched one.
-    pub author_handle: Option<&'a str>,
-    /// The account the committer's email resolved to. Only rendered when the
-    /// committer differs from the author — on a rebase or an amend they part
-    /// company, and that is exactly when a reader wants to know.
-    pub committer_handle: Option<&'a str>,
-    /// The patch against the first parent. `None` when the diff exceeded the
-    /// store's limits or could not be read.
-    pub diff: Option<&'a df_store::Diff>,
-    /// Fold every file, for skimming the shape of a large commit first.
-    pub collapsed: bool,
+}
-/// One commit: what it says, who wrote it, where it sits in history, and what
-/// it changed.
-///
-/// The diff is against the first parent, which is what makes a merge readable
-/// as "what this merge brought in" rather than as a second copy of both sides.
-pub fn commit_view(ctx: &RepoContext, c: CommitPage<'_>) -> Markup {
-    use crate::views::diff as vd;
-    let base = ctx.base();
-    let rev = c.rev.rev.as_str();
-    let blob_base = format!("{base}/blob/{rev}");
-    let now = chrono::Utc::now();
-    // The commit's own hash, not a bookmark name: a page about one commit must
-    // keep pointing at that commit after the bookmark moves.
-    let toggle = if c.collapsed {
-        format!("{base}/commit/{rev}")
-    } else {
-        format!("{base}/commit/{rev}?collapse=1")
-    };
-    // A different committer is worth a line; the usual case, where they are the
-    // same person, is not.
-    let amended = c.rev.committer.email != c.rev.author.email;
-    html! {
-        div .panel .commit-meta {
-            div .commit-msg {
-                h1 { (c.rev.summary()) }
-                @if !c.rev.body().is_empty() {
-                    pre .commit-body { (c.rev.body()) }
+                }
+            }
-            div .commit-byline {
-                (avatar(c.author_handle.unwrap_or(&c.rev.author.name)))
-                span {
-                    (crate::views::person(c.author_handle, Some(&c.rev.author.name)))
-                    " authored "
-                    span .faint title=(c.rev.author.when.format("%Y-%m-%d %H:%M UTC").to_string()) {
-                        (crate::views::relative_time(c.rev.author.when, now))
+                    }
+                }
-                @if amended {
-                    span .faint {
-                        "· committed by "
-                        (crate::views::person(c.committer_handle, Some(&c.rev.committer.name)))
-                        " "
-                        span title=(c.rev.committer.when.format("%Y-%m-%d %H:%M UTC").to_string()) {
-                            (crate::views::relative_time(c.rev.committer.when, now))
+                        }
+                    }
+                }
-                @if c.rev.conflicted {
-                    span .badge.badge-conflict { "conflict" }
+                }
+            }
-            div .commit-ids {
-                // The change id is the identity; the revision is a point in its
-                // history (spec §4). Both are shown, and the identity links.
-                @if let Some(id) = &c.rev.change_id {
-                    a .cid href=(format!("{base}/changes/{id}"))
-                      title=(format!("jj change id: {id}")) { (cid_parts(id)) }
-                } @else {
-                    span .chip title="authored with plain git" { "git" }
+                }
-                span .mono.faint title=(rev) { (df_store::abbreviate_rev(rev)) }
-                span .spacer {}
-                @for p in &c.rev.parents {
-                    a .mono.commit-parent href=(format!("{base}/commit/{p}"))
-                      title=(format!("parent {p}")) {
-                        "parent " (df_store::abbreviate_rev(p.as_str()))
+                    }
+                }
-                a href=(format!("{base}/tree/{rev}/")) { "Browse files" }
+            }
+        }
-        @match c.diff {
-            None => div .panel { p .dim style="margin:0" {
-                "This commit's diff could not be rendered. Fetch the revision with "
-                code { "jj" } " to read it in full."
-            } },
-            Some(d) => {
-                div .diffbar {
-                    (vd::stat_summary(d))
-                    span .spacer {}
-                    @if !d.files.is_empty() {
-                        a .diffbar-link href=(toggle) {
-                            (if c.collapsed { "Expand all" } else { "Collapse all" })
+                        }
+                    }
+                }
-                // The tree stands in for the flat file index here: it answers
-                // the same "which files" question and answers it better, and
-                // stacking both above the diff would make the reader scroll
-                // past the same thirty paths twice.
-                div .difflayout {
-                    (vd::tree(d))
-                    div .diffmain {
-                        (vd::files(&vd::DiffView {
-                            collapsed: c.collapsed,
-                            // A commit is a revision the browse routes can
-                            // serve, so every file header reaches the whole
-                            // file at this point in history — the step a hunk
-                            // always raises.
-                            blob_base: Some(&blob_base),
-                            ..vd::DiffView::new(d)
-                        }))
+                    }
+                }
+            }
+        }
+    }
+}
-/// Bookmark list.
-/// The bookmarks page.
-///
-        assert_eq!(parent_link("/o/r", "main", "a/b/c"), "/o/r/tree/main/a/b");
-        assert_eq!(parent_link("/o/r", "main", "a"), "/o/r/tree/main/");
+    }
-    // ─── the commit page ─────────────────────────────────────────────────────
-    fn ctx() -> RepoContext {
-        RepoContext {
-            repo: df_db::models::Repo {
-                id: uuid::Uuid::nil(),
-                owner_kind: df_db::models::OwnerKind::User,
-                owner_user_id: None,
-                owner_org_id: None,
-                name: "r".into(),
-                description: None,
-                visibility: df_db::models::Visibility::Public,
-                default_bookmark: "main".into(),
-                fork_of_repo_id: None,
-                size_bytes: 0,
-                pushed_at: None,
-                archived: false,
-                created_at: chrono::Utc::now(),
-            },
-            owner: "o".into(),
-            access: df_auth::RepoAccess::DENIED,
-            nav: crate::repo_ctx::RepoNav::default(),
+        }
+    }
-    fn sig(name: &str) -> df_store::Signature {
-        df_store::Signature {
-            name: name.into(),
-            email: format!("{name}@example.test"),
-            when: chrono::Utc::now(),
+        }
+    }
-    fn revision() -> Revision {
-        Revision {
-            rev: df_store::RevId::from_stored(
-                "0123456789abcdef0123456789abcdef01234567".to_string(),
-            ),
-            change_id: Some("kksontuqryot".into()),
-            parents: vec![df_store::RevId::from_stored(
-                "fedcba9876543210fedcba9876543210fedcba98".to_string(),
-            )],
-            author: sig("alice"),
-            committer: sig("alice"),
-            message: "fix the thing\n\nA longer explanation.\n".into(),
-            conflicted: false,
-            conflict_sides: Vec::new(),
-            conflict_bases: Vec::new(),
+        }
+    }
-    fn page(rev: &Revision, diff: Option<&df_store::Diff>) -> String {
-        commit_view(
-            &ctx(),
-            CommitPage {
-                rev,
-                author_handle: Some("alice"),
-                committer_handle: Some("alice"),
-                diff,
-                collapsed: false,
-            },
+        )
-        .into_string()
+    }
-    /// The three things a commit page is for: what it says, which commit it is,
-    /// and what it changed.
-    #[test]
-    fn a_commit_shows_its_message_its_ids_and_its_patch() {
-        let r = revision();
-        let d = crate::views::diff::tests::fixture(6);
-        let html = page(&r, Some(&d));
-        assert!(html.contains("fix the thing"));
-        assert!(html.contains("A longer explanation."));
-        // Abbreviation goes through the store (spec §3 rule 2) — never a slice.
-        assert!(html.contains("0123456789ab"), "{html:.800}");
-        assert!(!html.contains("0123456789abcdef0123456789abcdef01234567<"));
-        // The change id is the identity, and it links to the change.
-        assert!(html.contains("href=\"/o/r/changes/kksontuqryot\""));
-        assert!(html.contains("difftable"));
+    }
-    /// The parent is the other half of "what changed": the diff is *against* it,
-    /// so walking back one commit has to be one click.
-    #[test]
-    fn parents_link_to_their_own_commit_pages() {
-        let r = revision();
-        let html = page(&r, None);
-        assert!(
-            html.contains(
-                "href=\"/o/r/commit/fedcba9876543210fedcba9876543210fedcba98\""
-            ),
-            "{html:.800}"
-        );
+    }
-    /// A commit whose patch could not be rendered still has a message, an
-    /// author and parents worth reading.
-    #[test]
-    fn a_commit_with_no_renderable_diff_still_renders() {
-        let html = page(&revision(), None);
-        assert!(html.contains("fix the thing"));
-        assert!(html.contains("could not be rendered"));
-        assert!(!html.contains("difftable"));
+    }
-    /// The collapse link is a URL, so a folded commit can be pasted at
-    /// somebody — and it points back at the commit's own hash rather than at
-    /// whatever bookmark was typed to reach it.
-    #[test]
-    fn the_collapse_toggle_is_a_permalink() {
-        let r = revision();
-        let d = crate::views::diff::tests::fixture(6);
-        let expanded = page(&r, Some(&d));
-        assert!(expanded.contains(&format!("/o/r/commit/{}?collapse=1", r.rev)));
-        let folded = commit_view(
-            &ctx(),
-            CommitPage {
-                rev: &r,
-                author_handle: None,
-                committer_handle: None,
-                diff: Some(&d),
-                collapsed: true,
-            },
+        )
-        .into_string();
-        assert!(folded.contains("Expand all"));
-        assert!(!folded.contains("collapse=1"));
+    }
-    /// An amend or a rebase parts the author from the committer, and that is
-    /// exactly when the second name is worth the line it costs.
-    #[test]
-    fn a_committer_is_only_named_when_they_differ_from_the_author() {
-        assert!(!page(&revision(), None).contains("committed by"));
-        let mut r = revision();
-        r.committer = sig("bob");
-        assert!(page(&r, None).contains("committed by"));
+    }
+}

Mcrates/df-web/src/views/review.rs423 lines+206−146

-use maud::{html, Markup, PreEscaped};
-use uuid::Uuid;
-−
+use df_store::{ConflictedFile, Diff, DiffLineKind, DiffSpan};
-use df_store::{ConflictedFile, Diff, DiffLine, FileDiff};
-use crate::repo_ctx::RepoContext;
-use crate::views::change::{change_chip, state_badge};
-use crate::views::diff::{
-    self, line_class, marker, path_anchor, spans, stat_summary, DiffView, LineHooks,
-};
-// ─── shared shape ────────────────────────────────────────────────────────────
-    pub against: Option<&'a str>,
-    /// Every revision of the change, for the compare selectors.
-    pub revisions: &'a [(i32, String)],
-    /// Fold every file, for skimming the shape of a large change first.
-    pub collapsed: bool,
+}
-pub fn files(ctx: &RepoContext, c: &ChangeHead<'_>, f: FilesView<'_>) -> Markup {
-    let base = format!("{}/changes/{}", ctx.base(), c.number);
-    html! {
-−
+        div .panel {
-        @match f.diff {
-            None => div .panel { div .empty { h2 { "Nothing to show" } p { "This change has no revisions yet." } } },
-            Some(d) => {
-                (diff_bar(d, &base, &f))
-                // The changed-file tree beside the diff, as on the commit page.
-                // A reviewer's first question on a forty-file change is "what
-                // did this touch", and the tree answers it in the shape the
-                // code actually has rather than as forty near-identical paths.
-                div .difflayout {
-                    (diff::tree(d))
-                    div .diffmain {
-                        (diff_with_comments(d, f.comments, c, &base, f.rev, f.collapsed))
+                    }
+                }
+            }
+        }
+    }
+}
-/// The bar that follows the reader down the diff: what is being compared, how
-/// big it is, and the two controls that change either.
-///
-/// It stays on screen because the question it answers — *which* two revisions
-/// am I looking at — is the one a reviewer loses first when scrolling a long
-/// diff, and getting it wrong means reviewing the wrong code.
-fn diff_bar(d: &Diff, base: &str, f: &FilesView<'_>) -> Markup {
-    let seq_of = |rev: &str| f.revisions.iter().find(|(_, r)| r == rev).map(|(s, _)| *s);
-    let label = |rev: &str| match seq_of(rev) {
-        Some(s) => format!("v{s}"),
-        None => df_store::abbreviate_rev(rev).to_owned(),
-    };
-    let comparing = match f.against {
-        Some(a) => format!("{} → {}", label(a), label(f.rev)),
-        None => format!("{} against its parent", label(f.rev)),
-    };
-    // Collapse/expand is a link, not a script: it survives scripting being off
-    // and it is a URL, so "here is the shape of it" can be pasted at somebody.
-    let toggle = {
-        let mut q = format!("?rev={}", f.rev);
-        if let Some(a) = f.against {
-            q.push_str(&format!("&against={a}"));
+        }
-        if !f.collapsed {
-            q.push_str("&collapse=1");
+        }
-        format!("{base}/files{q}")
-    };
-    html! {
-        div .diffbar {
-            (stat_summary(d))
-            span .spacer {}
-            @if !d.files.is_empty() {
-                a .diffbar-link href=(toggle) {
-                    (if f.collapsed { "Expand all" } else { "Collapse all" })
+                }
+            }
-            // Revision-to-revision diffing (M4): compare any two revisions of
-            // the change, which is what makes "what changed since I reviewed"
-−
+            // answerable at all.
-−
+            form method="get" action=(format!("{base}/files")) .row style="gap:10px;flex-wrap:wrap" {
-−
+                label for="against" .label-condensed { "Compare" }
-−
+                select id="against" name="against" {
-−
+                    option value="" selected[f.against.is_none()] { "against the parent" }
-−
+                    @for (seq, rev) in f.revisions {
-−
+                        option value=(rev) selected[f.against == Some(rev.as_str())] {
-−
+                            "v" (seq) " · " (df_store::abbreviate_rev(rev))
-            // answerable at all. Folded away by default — the answer matters on
-            // every screen, the control only when you want a different one.
-            details .cmpbox {
-                summary { span .label-condensed { "Comparing" } (comparing) }
-                form method="get" action=(format!("{base}/files")) .cmpform {
-                    label for="against" .label-condensed { "Compare" }
-                    select id="against" name="against" {
-                        option value="" selected[f.against.is_none()] { "against the parent" }
-                        @for (seq, rev) in f.revisions {
-                            option value=(rev) selected[f.against == Some(rev.as_str())] {
-                                "v" (seq) " · " (df_store::abbreviate_rev(rev))
+                            }
+                        }
+                    }
 −
-−
+                label for="rev" .label-condensed { "of" }
-−
+                select id="rev" name="rev" {
-−
+                    @for (seq, rev) in f.revisions {
-−
+                        option value=(rev) selected[f.rev == rev] {
-−
+                            "v" (seq) " · " (df_store::abbreviate_rev(rev))
-                    label for="rev" .label-condensed { "of" }
-                    select id="rev" name="rev" {
-                        @for (seq, rev) in f.revisions {
-                            option value=(rev) selected[f.rev == rev] {
-                                "v" (seq) " · " (df_store::abbreviate_rev(rev))
+                            }
+                        }
+                    }
-                    button .btn type="submit" { "Show" }
+                }
-−
+                button .btn type="submit" { "Show" }
+            }
+        }
 −
-−
+        @match f.diff {
-−
+            None => div .panel { div .empty { h2 { "Nothing to show" } p { "This change has no revisions yet." } } },
-−
+            Some(d) => (diff_with_comments(d, f.comments, c, &base, f.rev)),
 −
+    }
+}
-    c: &ChangeHead<'_>,
-    base: &str,
-    rev: &str,
-    collapsed: bool,
-) -> Markup {
-−
+    html! {
-−
+        div .panel {
-−
+            div .row style="margin-bottom:12px" {
-−
+                h2 style="margin:0" { "Files changed" }
-−
+                span .faint { (diff.files.len()) " file(s)" }
-−
+                span style="color:var(--diff-add-text)" { "+" (diff.total_additions) }
-−
+                span style="color:var(--diff-del-text)" { "−" (diff.total_deletions) }
 −
-    // The comment affordance: a target link, so the form below opens with no
-    // script and the open form has a URL of its own.
-    let gutter = |file: &FileDiff, l: &DiffLine| -> Markup {
-        let Some(n) = l.new_lineno else { return html! {} };
-        if !c.can_comment {
-            return html! {};
+        }
-        let id = comment_anchor(&file.path, n);
-        html! {
-            a .dl-add href=(format!("#{id}"))
-              title=(format!("Comment on line {n}"))
-              aria-label=(format!("Comment on line {n}"))
-              { "+" }
+        }
-    };
-−
+            @if diff.truncated {
-−
+                div .banner.banner-error role="alert" {
-−
+                    "This diff exceeds the render limits and is shown in part. \
-−
+                     Fetch the revision with " code { "jj" } " to read it in full."
 −
 −
-    // Threads anchored to this line, then the form to add one. Both are plain
-    // HTML, and the form is laid out only when it is the fragment target — a
-    // visible form per line is what made a large change unreadable.
-    let under = |file: &FileDiff, l: &DiffLine| -> Markup {
-        let Some(n) = l.new_lineno else { return html! {} };
-        let here: Vec<&CommentRow> = comments
-            .iter()
-            .filter(|cm| {
-                cm.anchor_path.as_deref() == Some(file.path.as_str())
-                    && cm.anchor_line == Some(n as i32)
-            })
-            .collect();
-−
+            @if diff.files.is_empty() {
-−
+                p .dim { "No changes." }
-        html! {
-            @if !here.is_empty() {
-                tr { td colspan="4" .inline-thread {
-                    @for cm in here { (comment(cm, c, base, false)) }
-                } }
+            }
 −
-−
+            @for file in &diff.files {
-−
+                div .filediff {
-−
+                    div .row .filediff-head id=(format!("f-{}", path_anchor(&file.path))) {
-−
+                        span .mono { (file.path) }
-−
+                        @if let Some(old) = &file.old_path { span .faint { " ← " (old) } }
-−
+                        span .faint style="margin-left:auto" {
-−
+                            "+" (file.additions) " −" (file.deletions)
 −
 −
 −
-−
+                    @if file.binary {
-−
+                        p .dim style="padding:10px" { "Binary file not shown." }
-−
+                    } @else {
-−
+                        table .mono .difftable {
-−
+                            tbody {
-−
+                                @for hunk in &file.hunks {
-−
+                                    tr .hunkhead {
-−
+                                        td colspan="3" {
-−
+                                            "@@ -" (hunk.old_start) "," (hunk.old_lines)
-−
+                                            " +" (hunk.new_start) "," (hunk.new_lines) " @@"
 −
 −
-−
+                                    @for l in &hunk.lines {
-−
+                                        tr .(line_class(l.kind)) {
-−
+                                            td .faint .lineno { @if let Some(n) = l.old_lineno { (n) } }
-−
+                                            td .faint .lineno { @if let Some(n) = l.new_lineno { (n) } }
-−
+                                            td .codeline {
-−
+                                                (marker(l.kind))
-−
+                                                (spans(&l.spans, l.kind))
 −
 −
 −
-−
+                                        // Threads anchored to this line, then the
-−
+                                        // form to add one. Both are plain HTML.
-−
+                                        @if let Some(n) = l.new_lineno {
-−
+                                            @let here: Vec<&CommentRow> = comments
-−
+                                                .iter()
-−
+                                                .filter(|cm| {
-−
+                                                    cm.anchor_path.as_deref() == Some(file.path.as_str())
-−
+                                                        && cm.anchor_line == Some(n as i32)
-−
+                                                })
-−
+                                                .collect();
-−
+                                            @if !here.is_empty() {
-−
+                                                tr { td colspan="3" .inline-thread {
-−
+                                                    @for cm in here { (comment(cm, c, base, false)) }
-−
+                                                } }
 −
-−
+                                            @if c.can_comment {
-−
+                                                tr { td colspan="3" .inline-form {
-−
+                                                    details {
-−
+                                                        summary .faint { "Comment on line " (n) }
-−
+                                                        form method="post"
-−
+                                                             action=(format!("{base}/comments")) .stack {
-−
+                                                            input type="hidden" name="_csrf" value=(c.csrf);
-−
+                                                            input type="hidden" name="path" value=(file.path);
-−
+                                                            input type="hidden" name="line" value=(n);
-−
+                                                            input type="hidden" name="side" value="new";
-−
+                                                            input type="hidden" name="rev" value=(rev);
-−
+                                                            input type="hidden" name="context" value=(l.content);
-−
+                                                            textarea name="body" rows="3" required {}
-−
+                                                            button .btn.btn-primary type="submit" { "Comment" }
 −
 −
-−
+                                                } }
 −
 −
 −
 −
-            @if c.can_comment {
-                tr .inline-form id=(comment_anchor(&file.path, n)) {
-                    td colspan="4" {
-                        form method="post" action=(format!("{base}/comments")) .stack {
-                            input type="hidden" name="_csrf" value=(c.csrf);
-                            input type="hidden" name="path" value=(file.path);
-                            input type="hidden" name="line" value=(n);
-                            input type="hidden" name="side" value="new";
-                            input type="hidden" name="rev" value=(rev);
-                            input type="hidden" name="context" value=(l.content);
-                            div .label-condensed { "Comment on " (file.path) ":" (n) }
-                            textarea name="body" rows="3" required {}
-                            div .row {
-                                button .btn.btn-primary type="submit" { "Comment" }
-                                a .btn href="#" { "Cancel" }
+                            }
+                        }
+                    }
+                }
+            }
+        }
 −
-    };
-    diff::files(&DiffView {
-        diff,
-        collapsed,
-        // A change's revision is not necessarily reachable through the browse
-        // routes, so the file headers stay link-free here.
-        blob_base: None,
-        hooks: Some(LineHooks { gutter: &gutter, under: &under }),
-    })
+}
-−
+/// Render a line's word-level spans (spec §8).
-−
+fn spans(spans: &[DiffSpan], kind: DiffLineKind) -> Markup {
-−
+    html! {
-−
+        @for s in spans {
-−
+            @if s.emphasis && !matches!(kind, DiffLineKind::Context) {
-−
+                span .word-changed { (s.text) }
-−
+            } @else {
-−
+                (s.text)
 −
 −
 −
-/// The fragment a line's comment form answers to.
-fn comment_anchor(path: &str, line: u32) -> String {
-    format!("c-{}-{line}", path_anchor(path))
+}
-// ─── revisions ───────────────────────────────────────────────────────────────
-                                            @if let Some(n) = l.new_lineno.or(l.old_lineno) { (n) }
+                                        }
-                                        span .diff-text {
-−
+                                            (marker(l.kind)) (spans(&l.spans, l.kind))
-                                            // Fixed-width, so a context line's
-                                            // absent sign still holds its column.
-                                            span .diff-sign { (marker(l.kind)) }
-                                            (spans(&l.spans, l.kind))
+                                        }
+                                    }
+                                }
+}
-// ─── helpers ─────────────────────────────────────────────────────────────────
 −
-−
+fn line_class(kind: DiffLineKind) -> &'static str {
-−
+    match kind {
-−
+        DiffLineKind::Added => "line-add",
-−
+        DiffLineKind::Deleted => "line-del",
-−
+        DiffLineKind::Context => "line-ctx",
 −
 −
 −
-−
+fn marker(kind: DiffLineKind) -> &'static str {
-−
+    match kind {
-−
+        DiffLineKind::Added => "+",
-−
+        DiffLineKind::Deleted => "-",
-−
+        DiffLineKind::Context => " ",
 −
 −
-fn first_line(s: &str) -> &str {
-    s.lines().next().unwrap_or("").trim()
+}
-−
+/// A path turned into a fragment-safe anchor.
-−
+fn path_anchor(path: &str) -> String {
-−
+    path.chars()
-−
+        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })
-−
+        .collect()
 −
 −
-#[cfg(test)]
-mod tests {
-    use super::*;
-        assert!(text.ends_with("0123456789ab"), "{text}");
+    }
-    use crate::views::diff::tests::fixture as diff_fixture;
-    fn head() -> ChangeHead<'static> {
-        ChangeHead {
-            number: 3,
-            change_id: "kksontuqryot",
-            synthetic: false,
-            title: "t",
-            state: "open",
-            conflicted: false,
-            target_bookmark: "main",
-            author: None,
-            author_name: None,
-            revision_count: 1,
-            head_commit: None,
-            created_at: Utc::now(),
-            updated_at: Utc::now(),
-            file_count: Some(1),
-            comment_count: 0,
-            can_manage: false,
-            can_comment: true,
-            csrf: "tok",
+        }
+    }
-    /// The resting diff must be code and nothing else. Every commentable line
-    /// carries a form, but a form that is laid out costs a row per line and is
-    /// what made a large change unreadable — so the markup is there and the
-    /// `:target` rule is what reveals exactly one.
-    #[test]
-    fn a_comment_form_exists_per_line_but_none_is_open_by_default() {
-        let d = diff_fixture(30);
-        let html = diff_with_comments(&d, &[], &head(), "/o/r/changes/3", "abc", false).into_string();
-        assert_eq!(html.matches("class=\"inline-form\"").count(), 30);
-        // Nothing renders the old always-visible summary chrome any more.
-        assert!(!html.contains("Comment on line 1<"), "per-line chrome is back");
-        // The affordance and the form agree on the fragment.
-        let anchor = path_anchor("crates/df-web/src/views/review.rs");
-        assert!(html.contains(&format!("href=\"#c-{anchor}-7\"")));
-        assert!(html.contains(&format!("id=\"c-{anchor}-7\"")));
+    }
-    /// A reader with no comment rights gets the diff and nothing else — no
-    /// dead affordance, and none of the per-line form markup either.
-    #[test]
-−
+    fn path_anchors_cannot_break_out_of_a_fragment() {
-−
+        assert_eq!(path_anchor("src/a b.rs"), "src-a-b-rs");
-−
+        assert_eq!(path_anchor("a\"><script>"), "a---script-");
-    fn a_reader_who_cannot_comment_gets_no_forms() {
-        let d = diff_fixture(9);
-        let head = ChangeHead { can_comment: false, ..head() };
-        let html = diff_with_comments(&d, &[], &head, "/b", "abc", false).into_string();
-        assert!(!html.contains("inline-form"));
-        assert!(!html.contains("dl-add"));
-        // The diff itself is still there.
-        assert!(html.contains("difftable"));
+    }
+}

Acrates/df-web/src/views/diff.rs519 lines+519−0

-//! One diff renderer, shared by every page that shows a patch.
-//!
-//! A change's files tab and a commit's page are the same reading task — which
-//! files, how big, and what changed in each — so they are the same markup and
-//! the same CSS. What differs is what hangs *off* the diff: the change view
-//! anchors comment threads to lines, the commit view links each file to its
-//! blob. Both arrive through [`DiffView`] rather than by growing a second
-//! renderer that drifts from this one.
-use std::collections::BTreeMap;
-use maud::{html, Markup};
-use df_store::{ChangeKind, Diff, DiffLine, DiffLineKind, DiffSpan, FileDiff};
-/// A file this long is folded by default. Past a few hundred lines a file is
-/// no longer something a reviewer reads on the way past — it is a destination —
-/// and leaving it open buries every file after it.
-pub const LARGE_FILE_LINES: usize = 400;
-/// Per-line markup a caller wants woven into the table.
-///
-/// Both hooks are called for every rendered line, so an implementation that
-/// only cares about one side must check the line itself; a hook that returns
-/// empty markup costs nothing.
-pub struct LineHooks<'a> {
-    /// Extra markup inside the new-side line-number cell — the comment
-    /// affordance, in practice.
-    pub gutter: &'a dyn Fn(&FileDiff, &DiffLine) -> Markup,
-    /// Full-width `<tr>`s placed directly beneath the line. Anything returned
-    /// here must be table rows, since that is where it lands.
-    pub under: &'a dyn Fn(&FileDiff, &DiffLine) -> Markup,
+}
-/// A diff and the decisions a page makes about how to show it.
-pub struct DiffView<'a> {
-    pub diff: &'a Diff,
-    /// Fold every file, for skimming the shape of a large change first.
-    pub collapsed: bool,
-    /// `…/blob/{rev}` — when set, every file header links to the file as it
-    /// stands at this revision. A change's files tab leaves it `None`: the
-    /// revision under review is not necessarily one the browser can serve.
-    pub blob_base: Option<&'a str>,
-    pub hooks: Option<LineHooks<'a>>,
+}
-impl<'a> DiffView<'a> {
-    /// A diff with no annotations — the commit page's default.
-    pub fn new(diff: &'a Diff) -> Self {
-        DiffView { diff, collapsed: false, blob_base: None, hooks: None }
+    }
+}
-/// How much changed, as one line: the count, the two totals, and the ratio bar.
-pub fn stat_summary(d: &Diff) -> Markup {
-    html! {
-        div .diffbar-stat {
-            strong { (d.files.len()) }
-            " " (if d.files.len() == 1 { "file" } else { "files" })
-            span .cl-add { "+" (d.total_additions) }
-            span .cl-del { "−" (d.total_deletions) }
-            (stat_bar(d.total_additions, d.total_deletions))
+        }
+    }
+}
-// ─── the changed-file tree ───────────────────────────────────────────────────
-/// The changed files as the directory tree they actually live in.
-///
-/// A flat list of thirty paths in a Rust workspace is thirty rows that all
-/// begin `crates/df-…/src/`, and the eye has to read to the end of each one to
-/// tell them apart. The tree factors that prefix out once, so what is left on
-/// each row is the part that differs — and the shape of the commit ("this
-/// touched the store and the web crate") becomes visible without reading at
-/// all.
-///
-/// Directories are `<details>`, so folding one needs no script.
-pub fn tree(d: &Diff) -> Markup {
-    if d.files.is_empty() {
-        return html! {};
+    }
-    let root = TreeNode::build(&d.files);
-    html! {
-        aside .difftree aria-label="Changed files" {
-            div .dt-head {
-                (d.files.len()) " " (if d.files.len() == 1 { "file" } else { "files" }) " changed"
+            }
-            nav .dt-body { (tree_level(&root)) }
+        }
+    }
+}
-/// One level of the changed-file tree.
-#[derive(Default)]
-struct TreeNode<'a> {
-    /// Ordered by name, which is how every file browser lists a directory and
-    /// therefore where a reader already expects to find things.
-    dirs: BTreeMap<&'a str, TreeNode<'a>>,
-    files: Vec<&'a FileDiff>,
+}
-impl<'a> TreeNode<'a> {
-    fn build(files: &'a [FileDiff]) -> TreeNode<'a> {
-        let mut root = TreeNode::default();
-        for f in files {
-            let mut node = &mut root;
-            let mut segments = f.path.split('/').filter(|s| !s.is_empty()).peekable();
-            while let Some(seg) = segments.next() {
-                if segments.peek().is_none() {
-                    node.files.push(f);
-                } else {
-                    node = node.dirs.entry(seg).or_default();
+                }
+            }
+        }
-        root
+    }
-    /// Fold a chain of single-child directories into one row.
-    ///
-    /// `crates/df-web/src/views/` is one place, not four, and indenting it four
-    /// times spends the whole width of the sidebar saying nothing. Returns the
-    /// joined label and the first node that actually branches.
-    fn collapse(&'a self, name: &'a str) -> (String, &'a TreeNode<'a>) {
-        let mut label = name.to_string();
-        let mut node = self;
-        while node.files.is_empty() && node.dirs.len() == 1 {
-            let (child_name, child) = node.dirs.iter().next().expect("len == 1");
-            label.push('/');
-            label.push_str(child_name);
-            node = child;
+        }
-        (label, node)
+    }
+}
-/// Directories first, then files — both alphabetical.
-fn tree_level(node: &TreeNode<'_>) -> Markup {
-    html! {
-        @for (name, child) in &node.dirs {
-            @let (label, child) = child.collapse(name);
-            details .dt-dir open {
-                summary .dt-row {
-                    span .dt-caret aria-hidden="true" {}
-                    span .dt-dirname { (label) }
+                }
-                div .dt-kids { (tree_level(child)) }
+            }
+        }
-        @for f in &node.files { (tree_file(f)) }
+    }
+}
-fn tree_file(f: &FileDiff) -> Markup {
-    let (_, name) = split_path(&f.path);
-    html! {
-        // The full path in `title`, because the visible name is truncated and
-        // two files can share a basename.
-        a .dt-file href=(format!("#f-{}", path_anchor(&f.path))) title=(f.path) {
-            (kind_glyph(f.kind))
-            span .dt-name { (name) }
-            span .spacer {}
-            @if f.binary {
-                span .fx-bin { "bin" }
-            } @else {
-                span .cl-add { "+" (f.additions) }
-                span .cl-del { "−" (f.deletions) }
+            }
+        }
+    }
+}
-/// The diff itself: one foldable block per file, each a table of numbered
-/// lines.
-pub fn files(v: &DiffView<'_>) -> Markup {
-    let d = v.diff;
-    html! {
-        @if d.truncated {
-            div .banner.banner-error role="alert" {
-                "This diff exceeds the render limits and is shown in part. \
-                 Fetch the revision with " code { "jj" } " to read it in full."
+            }
+        }
-        @if d.files.is_empty() {
-            div .panel { p .dim style="margin:0" { "No changes." } }
+        }
-        @for file in &d.files {
-            @let anchor = path_anchor(&file.path);
-            @let len: usize = file.hunks.iter().map(|h| h.lines.len()).sum();
-            @let big = len > LARGE_FILE_LINES;
-            details .filediff.is-big[big] id=(format!("f-{}", anchor))
-                    open[!v.collapsed && !big && !file.binary] {
-                summary .filediff-head {
-                    span .fd-caret aria-hidden="true" {}
-                    (kind_glyph(file.kind))
-                    span .fd-path.mono {
-                        @let (dir, name) = split_path(&file.path);
-                        @if !dir.is_empty() { span .fd-dir { (dir) } }
-                        span .fd-name { (name) }
+                    }
-                    @if let Some(old) = &file.old_path {
-                        span .fd-old .mono { "← " (old) }
+                    }
-                    span .spacer {}
-                    // A deleted file has no blob at this revision to link to.
-                    @if let (Some(b), false) = (v.blob_base, file.kind == ChangeKind::Deleted) {
-                        a .fd-view href=(format!("{b}/{}", file.path)) { "View file" }
+                    }
-                    @if big { span .fd-note { (len) " lines" } }
-                    @if file.binary {
-                        span .fx-bin { "binary" }
-                    } @else {
-                        span .cl-add { "+" (file.additions) }
-                        span .cl-del { "−" (file.deletions) }
-                        (stat_bar(file.additions, file.deletions))
+                    }
+                }
-                @if file.binary {
-                    p .dim style="padding:10px 12px;margin:0" { "Binary file not shown." }
-                } @else {
-                    table .mono .difftable {
-                        tbody {
-                            @for hunk in &file.hunks {
-                                tr .hunkhead {
-                                    td colspan="4" {
-                                        span .hh-at { "@@ −" (hunk.old_start) "," (hunk.old_lines)
-                                                      " +" (hunk.new_start) "," (hunk.new_lines) " @@" }
+                                    }
+                                }
-                                @for l in &hunk.lines {
-                                    tr .dl.(line_class(l.kind)) {
-                                        td .lineno { @if let Some(n) = l.old_lineno { (n) } }
-                                        td .lineno {
-                                            @if let Some(n) = l.new_lineno { (n) }
-                                            @if let Some(h) = &v.hooks { ((h.gutter)(file, l)) }
+                                        }
-                                        td .dl-mark { (marker(l.kind)) }
-                                        td .codeline { (spans(&l.spans, l.kind)) }
+                                    }
-                                    @if let Some(h) = &v.hooks { ((h.under)(file, l)) }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
-/// The add/delete ratio as a bar. Two numbers say how much; the bar says which
-/// way, which is the thing that reads at a glance down a list of forty files.
-pub fn stat_bar(add: usize, del: usize) -> Markup {
-    let total = add + del;
-    let pct = (add * 100).checked_div(total).unwrap_or(0);
-    html! {
-        span .statbar aria-hidden="true" {
-            @if total > 0 {
-                span .statbar-add style=(format!("width:{pct}%")) {}
-                span .statbar-del style=(format!("width:{}%", 100 - pct)) {}
+            }
+        }
+    }
+}
-/// A/M/D/R — the one-letter status every reviewer already reads without
-/// thinking, from `git status` onwards.
-pub fn kind_glyph(k: ChangeKind) -> Markup {
-    let (letter, class, title) = match k {
-        ChangeKind::Added => ("A", "is-add", "added"),
-        ChangeKind::Modified => ("M", "is-mod", "modified"),
-        ChangeKind::Deleted => ("D", "is-del", "deleted"),
-        ChangeKind::Renamed => ("R", "is-ren", "renamed"),
-    };
-    html! { span .fkind.(class) title=(title) { (letter) } }
+}
-/// `("crates/df-web/src/", "views.rs")` — the directory dims, the file does not.
-pub fn split_path(path: &str) -> (&str, &str) {
-    match path.rfind('/') {
-        Some(i) => (&path[..=i], &path[i + 1..]),
-        None => ("", path),
+    }
+}
-/// A path turned into a fragment-safe anchor.
-pub fn path_anchor(path: &str) -> String {
-    path.chars()
-        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })
-        .collect()
+}
-/// Render a line's word-level spans (spec §8).
-pub(crate) fn spans(spans: &[DiffSpan], kind: DiffLineKind) -> Markup {
-    html! {
-        @for s in spans {
-            @if s.emphasis && !matches!(kind, DiffLineKind::Context) {
-                span .word-changed { (s.text) }
-            } @else {
-                (s.text)
+            }
+        }
+    }
+}
-pub(crate) fn line_class(kind: DiffLineKind) -> &'static str {
-    match kind {
-        DiffLineKind::Added => "line-add",
-        DiffLineKind::Deleted => "line-del",
-        DiffLineKind::Context => "line-ctx",
+    }
+}
-/// The sign in its own column, so the code starts at the same x on every line.
-/// Inlining it into the text — as this used to — shifts context lines one
-/// character against the lines around them, and that misalignment is most of
-/// why an unstyled diff is hard to read.
-pub(crate) fn marker(kind: DiffLineKind) -> &'static str {
-    match kind {
-        DiffLineKind::Added => "+",
-        DiffLineKind::Deleted => "−",
-        DiffLineKind::Context => "",
+    }
+}
-#[cfg(test)]
-pub(crate) mod tests {
-    use super::*;
-    #[test]
-    fn path_anchors_cannot_break_out_of_a_fragment() {
-        assert_eq!(path_anchor("src/a b.rs"), "src-a-b-rs");
-        assert_eq!(path_anchor("a\"><script>"), "a---script-");
+    }
-    #[test]
-    fn a_path_splits_into_a_dimmable_directory_and_a_basename() {
-        assert_eq!(split_path("crates/df-web/views.rs"), ("crates/df-web/", "views.rs"));
-        assert_eq!(split_path("Cargo.toml"), ("", "Cargo.toml"));
-        assert_eq!(split_path("a/"), ("a/", ""));
+    }
-    /// Shared by the tests here and in `review`, so both views are exercised
-    /// against the same shape.
-    pub(crate) fn fixture(lines: usize) -> Diff {
-        let hunk = df_store::Hunk {
-            old_start: 1,
-            old_lines: lines as u32,
-            new_start: 1,
-            new_lines: lines as u32,
-            lines: (0..lines)
-                .map(|i| DiffLine {
-                    kind: if i % 3 == 0 { DiffLineKind::Added } else { DiffLineKind::Context },
-                    old_lineno: Some(i as u32 + 1),
-                    new_lineno: Some(i as u32 + 1),
-                    content: format!("line {i}"),
-                    spans: vec![DiffSpan { text: format!("line {i}"), emphasis: false }],
-                })
-                .collect(),
-        };
-        Diff {
-            files: vec![FileDiff {
-                path: "crates/df-web/src/views/review.rs".into(),
-                old_path: None,
-                kind: ChangeKind::Modified,
-                binary: false,
-                additions: lines / 3,
-                deletions: 0,
-                hunks: vec![hunk],
-            }],
-            truncated: false,
-            total_additions: lines / 3,
-            total_deletions: 0,
+        }
+    }
-    /// A diff of the given paths, with no content — enough for anything that
-    /// only cares about the set of files.
-    fn paths(paths: &[&str]) -> Diff {
-        Diff {
-            files: paths
-                .iter()
-                .map(|p| FileDiff {
-                    path: (*p).into(),
-                    old_path: None,
-                    kind: ChangeKind::Modified,
-                    binary: false,
-                    additions: 1,
-                    deletions: 0,
-                    hunks: Vec::new(),
-                })
-                .collect(),
-            truncated: false,
-            total_additions: paths.len(),
-            total_deletions: 0,
+        }
+    }
-    /// The tree exists to factor the shared prefix out of a column of paths,
-    /// and every leaf still has to reach its diff.
-    #[test]
-    fn the_tree_nests_directories_and_links_each_file_to_its_anchor() {
-        let d = paths(&["crates/df-web/src/main.rs", "crates/df-store/src/lib.rs"]);
-        let html = tree(&d).into_string();
-        // The shared prefix is one row, not two.
-        assert_eq!(html.matches(">crates<").count(), 1, "{html}");
-        // Both crates branch under it, in name order — and each one's own
-        // single-child chain has already folded into its row.
-        let store = html.find(">df-store/src<").expect("df-store/src");
-        let web = html.find(">df-web/src<").expect("df-web/src");
-        assert!(store < web, "directories are not alphabetical");
-        // Only the basename shows; the anchor carries the whole path.
-        assert!(html.contains(&format!(
-            "href=\"#f-{}\"",
-            path_anchor("crates/df-web/src/main.rs")
-        )));
-        assert!(html.contains(">main.rs<"));
-        // The full path stays reachable, since the visible name is truncated.
-        assert!(html.contains("title=\"crates/df-web/src/main.rs\""));
+    }
-    /// `crates/df-web/src/views/` is one place, not four. Indenting it four
-    /// times spends the whole sidebar saying nothing.
-    #[test]
-    fn a_chain_of_single_child_directories_collapses_to_one_row() {
-        let d = paths(&["crates/df-web/src/views/repo.rs"]);
-        let html = tree(&d).into_string();
-        assert!(html.contains(">crates/df-web/src/views<"), "{html}");
-        assert_eq!(html.matches("<details").count(), 1, "still nested: {html}");
-        // A directory that branches must *not* be folded into its parent.
-        let d = paths(&["a/b/one.rs", "a/c/two.rs"]);
-        let html = tree(&d).into_string();
-        assert!(html.contains(">a<"), "{html}");
-        assert!(!html.contains(">a/b<"));
+    }
-    /// Directories first, then files — the order every file browser uses, and
-    /// therefore where a reader already looks.
-    #[test]
-    fn root_files_sit_at_the_root_below_the_directories() {
-        let d = paths(&["Cargo.toml", "crates/df-web/src/main.rs"]);
-        let html = tree(&d).into_string();
-        let dir = html.find(">crates/df-web/src<").expect("crates/df-web/src");
-        let file = html.find(">Cargo.toml<").expect("Cargo.toml");
-        assert!(dir < file, "a root file came before the directories");
+    }
-    #[test]
-    fn an_empty_diff_gets_no_tree() {
-        assert!(tree(&Diff::default()).into_string().is_empty());
+    }
-    /// A file long enough to bury everything after it starts folded, and the
-    /// `collapsed` flag folds the rest.
-    #[test]
-    fn large_files_and_the_collapse_flag_fold_the_diff() {
-        let big = fixture(LARGE_FILE_LINES + 1);
-        let html = files(&DiffView::new(&big)).into_string();
-        assert!(html.contains("class=\"filediff is-big\""), "{html:.400}");
-        assert!(!html.contains("class=\"filediff is-big\" id=\"f-crates-df-web-src-views-review-rs\" open"));
-        let small = fixture(10);
-        assert!(files(&DiffView::new(&small)).into_string().contains(" open>"));
-        let folded = files(&DiffView { collapsed: true, ..DiffView::new(&small) }).into_string();
-        assert!(!folded.contains(" open>"), "collapsed folds every file");
+    }
-    /// The commit view's file header reaches the blob at that exact revision —
-    /// the "and now show me the whole file" step, one click from any hunk.
-    #[test]
-    fn a_blob_base_links_each_file_to_its_content_at_the_revision() {
-        let d = fixture(4);
-        let html =
-            files(&DiffView { blob_base: Some("/o/r/blob/abc"), ..DiffView::new(&d) }).into_string();
-        assert!(
-            html.contains("href=\"/o/r/blob/abc/crates/df-web/src/views/review.rs\""),
-            "{html:.600}"
-        );
-        // Without one, no link — a change's revision may not be browsable.
-        assert!(!files(&DiffView::new(&d)).into_string().contains("fd-view"));
+    }
-    /// A deleted file has no content at this revision, so linking to it would
-    /// be a 404 with extra steps.
-    #[test]
-    fn a_deleted_file_gets_no_view_link() {
-        let mut d = fixture(4);
-        d.files[0].kind = ChangeKind::Deleted;
-        let html =
-            files(&DiffView { blob_base: Some("/o/r/blob/abc"), ..DiffView::new(&d) }).into_string();
-        assert!(!html.contains("fd-view"), "{html:.400}");
+    }
-    #[test]
-    fn hunk_headers_carry_both_side_ranges() {
-        let d = fixture(4);
-        let html = files(&DiffView::new(&d)).into_string();
-        assert!(html.contains("@@ −1,4 +1,4 @@"), "{html:.600}");
+    }
+}

Amigrations/0005_session_tokens.sql+23−0

--- Session cookies carry a random token, not the row id.
---
--- The cookie used to be the `sessions.id` UUIDv7: a 48-bit millisecond
--- timestamp plus a counter that is reseeded once per millisecond and then
--- incremented. Sessions minted in the same millisecond therefore shared their
--- leading bits, and other UUIDs from the same generator (comment ids, which are
--- rendered into review pages) disclosed the counter state. A UUIDv7 is a good
--- primary key and was never meant to be a bearer secret.
---
--- The cookie now carries 32 CSPRNG bytes and this table stores only their
--- SHA-256, so a leaked snapshot of `sessions` no longer contains anything that
--- can be presented to the server.
---
--- Existing rows cannot be migrated: their tokens never existed, and the id is
--- deliberately no longer accepted. Everyone is signed out exactly once, which
--- is the correct price for the change.
-DELETE FROM sessions;
-ALTER TABLE sessions ADD COLUMN token_hash text NOT NULL;
--- Unique because it is the lookup key, and the index is what makes resolving a
--- session one probe rather than a scan.
-CREATE UNIQUE INDEX sessions_token_hash_idx ON sessions (token_hash);