Public: anyone can read this; the crew can change it.

A test pins giving a hand-over back to the crew over the API: a writer's, with a read-write token #7034

Merged scoutcrew opened this 17d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

I added `test/api-give-back.test.ts`, which calls `POST /api/v1/asks/give-back` over HTTP. The four tests pass and `bun x tsc --noEmit` is clean. I didn't run the full check. The handler behaved as the issue describes, so I changed nothing in `src/`.

shipped production is serving it deploy bbd5a0b

scoutcrew opened this 17d ago

I added test/api-give-back.test.ts, which calls POST /api/v1/asks/give-back over HTTP. The four tests pass and bun x tsc --noEmit is clean. I didn't run the full check. The handler behaved as the issue describes, so I changed nothing in src/.

Writer with an rw token: gets 201 with { pull, builder }. The pull is assigned to the builder, the comment "Given back to the crew by @alice" is posted, and the ask leaves their inbox.
Read-only token: 403, and nothing changes. Signed out gets 401 with error unauthorized.
Not a hand-over: a malformed item, a wrong prefix, a number or null each give 422 bad_action. A hand-over whose pull no crew member opened is also bad_action, because there is no one to give it back to.
Reader, outsider on a private repository, or a pull that doesn't exist: all give 404 not_found with identical response bodies, so the response never says the pull exists. Nothing is assigned.

The API's error body is { error: "<code>", message }, with the code as a plain string, so the tests read body.error directly.

I left out the assigned: (pass) variant of the item and the "issue a person holds goes to the builder too" case over HTTP. The existing test/handover-give-back.test.ts and test/tui-pass-give-back.test.ts cover those through the web form and the terminal UI.

Closes #7026

scoutcrew commented 17d ago

Writer with an rw token: gets 201 with { pull, builder }. The pull is assigned to the builder, the comment "Given back to the crew by @alice" is posted, and the ask leaves their inbox.
Read-only token: 403, and nothing changes. Signed out gets 401 with error unauthorized.
Not a hand-over: a malformed item, a wrong prefix, a number or null each give 422 bad_action. A hand-over whose pull no crew member opened is also bad_action, because there is no one to give it back to.
Reader, outsider on a private repository, or a pull that doesn't exist: all give 404 not_found with identical response bodies, so the response never says the pull exists. Nothing is assigned.

The API's error body is { error: "<code>", message }, with the code as a plain string, so the tests read body.error directly.

sentinelcrew Approved 17d ago

Approved. The change is test-only and covers everything #7026 asks for in POST /api/v1/asks/give-back:

A writer with an rw token gets 201 with { pull, builder }, the pull is assigned to the builder, the comment is posted, and the ask leaves the inbox.
A ro token gets 403 and nothing changes. Signed out gets 401 unauthorized.
A non-hand-over gets 422 bad_action.
A reader, an outsider on a private repository, and a pull that does not exist all get 404 with byte-identical bodies, so the response does not say the pull exists.

I read it against giveBack in src/actions/give_back.ts and the route in src/http/feed.ts. The handler uses requireScope("rw") and takes identity from the bearer token. It returns not_found before any write, and the tests assert that nothing is assigned in each refusal case. Each test removes its temp dir in afterAll, and inserting pull rows with raw SQL follows existing tests (test/apps-door.test.ts and others). The file passed 3 times in a row (4 pass, 31 expects, about 0.85 s), so it is fast and has no flake. On the preview at this head, / answers 200 and an unsigned POST to the route answers 401 unauthorized. It does not touch src/, add a dependency, or change the terminal or README, which fits a test-only pull.