Useful
", + Fields: map[string]any{"Microsoft.VSTS.Scheduling.Effort": 5}, + }}, + WorkItemComments: map[int][]WorkItemComment{101: {{ID: 2, Content: "Newest"}, {ID: 1, Content: "Older"}}}, + }) + + detail, err := mock.GetWorkItemDetail(t.Context(), "p1", 101) + if err != nil || detail.Description != "Useful" || len(detail.PlanningFields) != 1 { + t.Fatalf("detail = %+v, %v", detail, err) + } + comments, err := mock.ListWorkItemComments(t.Context(), "p1", 101, "opaque") + if err != nil || len(comments.Comments) != 2 || comments.Comments[0].ID != 2 { + t.Fatalf("comments = %+v, %v", comments, err) + } + identity, err := mock.GetCurrentIdentity(t.Context()) + if err != nil || identity.ID != "me" || identity.UniqueName != "ada@example.com" { + t.Fatalf("identity = %+v, %v", identity, err) + } +} + func TestMockClientPaginatesPullRequests(t *testing.T) { mock := NewMockClient() mock.Seed(MockState{PullRequests: []PullRequest{ @@ -46,3 +72,113 @@ func TestMockClientPaginatesPullRequests(t *testing.T) { t.Fatalf("items = %#v, want second pull request only", page.Items) } } + +func TestMockClientBoardReads(t *testing.T) { + mock := NewMockClient() + mock.Seed(MockState{ + Teams: []Team{{ID: "team-1", Name: "Platform Team", ProjectID: "p1"}}, + Boards: []BoardReference{{ID: "board-1", Name: "Stories"}}, + BoardSnapshots: map[string]BoardSnapshot{ + "board-1": { + Board: Board{ + ID: "board-1", + Columns: []BoardColumn{{ID: "todo", Name: "Original column"}}, + Rows: []BoardRow{{ID: "row-1", Name: "Original row"}}, + }, + Items: []BoardWorkItem{{ + WorkItem: WorkItem{ + ID: 101, + Fields: map[string]any{ + "System.Title": "Original", + "Custom.Nested": map[string]any{"labels": []any{"initial-label"}}, + }, + Tags: []string{"initial"}, + }, + }}, + }, + }, + }) + teams, err := mock.ListTeams(t.Context(), "p1") + if err != nil || len(teams) != 1 { + t.Fatalf("teams = %+v, %v", teams, err) + } + boards, err := mock.ListBoards(t.Context(), "p1", "team-1") + if err != nil || len(boards) != 1 || boards[0].ID != "board-1" { + t.Fatalf("boards = %+v, %v", boards, err) + } + snapshot, err := mock.GetBoardSnapshot(t.Context(), "p1", "team-1", "board-1") + if err != nil || snapshot == nil || len(snapshot.Items) != 1 { + t.Fatalf("snapshot = %+v, %v", snapshot, err) + } + snapshot.Items[0].Title = "Mutated caller copy" + snapshot.Items[0].Fields["System.Title"] = "Mutated field" + snapshot.Items[0].Tags[0] = "mutated-tag" + snapshot.Board.Columns[0].Name = "Mutated column" + snapshot.Board.Rows[0].Name = "Mutated row" + snapshot.Items[0].Fields["Custom.Nested"].(map[string]any)["labels"].([]any)[0] = "mutated-label" + again, err := mock.GetBoardSnapshot(t.Context(), "p1", "team-1", "board-1") + if err != nil || again.Items[0].Title == "Mutated caller copy" { + t.Fatalf("subsequent snapshot = %+v, %v", again, err) + } + if again.Items[0].Fields["System.Title"] != "Original" || again.Items[0].Tags[0] != "initial" { + t.Fatalf("subsequent snapshot mutable data = %+v", again.Items[0]) + } + if again.Board.Columns[0].Name != "Original column" || again.Board.Rows[0].Name != "Original row" { + t.Fatalf("subsequent snapshot board data = %+v", again.Board) + } + if got := again.Items[0].Fields["Custom.Nested"].(map[string]any)["labels"].([]any)[0]; got != "initial-label" { + t.Fatalf("subsequent snapshot nested field = %q, want initial-label", got) + } +} + +func TestMockClientUpdateBoardWorkItem(t *testing.T) { + mock := NewMockClient() + action := "assign_current_user" + mock.Seed(MockState{ + Authenticated: true, + User: TestConnectionResult{OK: true, ID: "me", DisplayName: "Ada"}, + BoardSnapshots: map[string]BoardSnapshot{"board-1": {Board: Board{ID: "board-1"}, Items: []BoardWorkItem{{WorkItem: WorkItem{ID: 101, Revision: 7, Title: "Original"}}}}}, + }) + item, err := mock.UpdateBoardWorkItem(t.Context(), "p1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, AssigneeAction: &action}) + if err != nil || item == nil || item.AssignedTo != "Ada" || item.Revision != 8 { + t.Fatalf("updated item = %+v, %v", item, err) + } +} + +func TestMockClientUpdateBoardWorkItemInitializesFieldsForDoneOnlyUpdate(t *testing.T) { + mock := NewMockClient() + done := true + mock.Seed(MockState{ + BoardSnapshots: map[string]BoardSnapshot{"board-1": { + Board: Board{ID: "board-1", Fields: BoardFields{DoneField: FieldReference{ReferenceName: "System.BoardDone"}}}, + Items: []BoardWorkItem{{WorkItem: WorkItem{ID: 101, Revision: 7}}}, + }}, + }) + + item, err := mock.UpdateBoardWorkItem(t.Context(), "p1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, ColumnDone: &done}) + if err != nil || item == nil || !item.ColumnDone || item.Fields["System.BoardDone"] != true { + t.Fatalf("updated item = %+v, %v", item, err) + } +} + +func TestMockClientBoardUpdateKeepsWorkItemReadsInSync(t *testing.T) { + mock := NewMockClient() + action := "assign_current_user" + mock.Seed(MockState{ + Authenticated: true, + User: TestConnectionResult{OK: true, ID: "me", DisplayName: "Ada"}, + BoardSnapshots: map[string]BoardSnapshot{"board-1": { + Board: Board{ID: "board-1"}, + Items: []BoardWorkItem{{WorkItem: WorkItem{ID: 101, Revision: 7, Title: "Original"}}}, + }}, + WorkItems: []WorkItem{{ID: 101, Revision: 7, Title: "Original"}}, + }) + + if _, err := mock.UpdateBoardWorkItem(t.Context(), "p1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, AssigneeAction: &action}); err != nil { + t.Fatalf("update board item: %v", err) + } + item, err := mock.GetWorkItem(t.Context(), "p1", 101) + if err != nil || item.AssignedTo != "Ada" || item.Revision != 8 { + t.Fatalf("work item = %+v, %v", item, err) + } +} diff --git a/apps/backend/internal/azuredevops/models.go b/apps/backend/internal/azuredevops/models.go index 1dc8888063..5547e82246 100644 --- a/apps/backend/internal/azuredevops/models.go +++ b/apps/backend/internal/azuredevops/models.go @@ -89,6 +89,27 @@ type TaskPRsResponse struct { TaskPRs map[string][]*TaskPR `json:"taskPrs"` } +// TaskWorkItem is the persisted Azure Boards summary associated with a Kandev +// task. The provider remains authoritative; this record only supports browse +// and quick-action linkage. +type TaskWorkItem struct { + ID string `json:"id" db:"id"` + TaskID string `json:"taskId" db:"task_id"` + WorkspaceID string `json:"workspaceId" db:"workspace_id"` + ProjectID string `json:"projectId" db:"project_id"` + WorkItemID int `json:"workItemId" db:"work_item_id"` + WorkItemURL string `json:"workItemUrl" db:"work_item_url"` + Title string `json:"title" db:"title"` + State string `json:"state" db:"state"` + Type string `json:"type" db:"type"` + CreatedAt time.Time `json:"createdAt" db:"created_at"` + UpdatedAt time.Time `json:"updatedAt" db:"updated_at"` +} + +type TaskWorkItemsResponse struct { + TaskWorkItems map[string][]*TaskWorkItem `json:"taskWorkItems"` +} + // SecretKeyForWorkspace returns the workspace-isolated encrypted PAT key. func SecretKeyForWorkspace(workspaceID string) string { return cloneauth.AzureDevOpsPATKey(workspaceID) diff --git a/apps/backend/internal/azuredevops/poller.go b/apps/backend/internal/azuredevops/poller.go index aab69311bb..6cb3363ddd 100644 --- a/apps/backend/internal/azuredevops/poller.go +++ b/apps/backend/internal/azuredevops/poller.go @@ -2,15 +2,166 @@ package azuredevops import ( "context" + "sync" + "time" + + "go.uber.org/zap" "github.com/kandev/kandev/internal/common/logger" "github.com/kandev/kandev/internal/integrations/healthpoll" ) -// NewPoller returns the shared auth-health poller for Azure DevOps. Task PR -// refresh remains request-driven in v1. -func NewPoller(service *Service, log *logger.Logger) *healthpoll.Poller { - return healthpoll.New("azure devops", authProber{service: service}, log) +const watcherPollTick = time.Minute + +// Poller combines the shared auth-health poller with Azure watcher checks. +type Poller struct { + service *Service + logger *logger.Logger + auth *healthpoll.Poller + + mu sync.Mutex + cancel context.CancelFunc + wg sync.WaitGroup + started bool +} + +func NewPoller(service *Service, log *logger.Logger) *Poller { + if service == nil { + return nil + } + if log == nil { + log = logger.Default() + } + return &Poller{service: service, logger: log, auth: healthpoll.New("azure devops", authProber{service: service}, log)} +} + +func (p *Poller) Start(ctx context.Context) { + if p == nil { + return + } + p.mu.Lock() + if p.started { + p.mu.Unlock() + return + } + p.started = true + watchCtx, cancel := context.WithCancel(ctx) + p.cancel = cancel + p.mu.Unlock() + p.auth.Start(watchCtx) + p.wg.Add(1) + go p.watchLoop(watchCtx) +} + +func (p *Poller) Stop() { + if p == nil { + return + } + p.mu.Lock() + if !p.started { + p.mu.Unlock() + return + } + cancel := p.cancel + p.started = false + p.cancel = nil + p.mu.Unlock() + if cancel != nil { + cancel() + } + p.auth.Stop() + p.wg.Wait() +} + +func (p *Poller) watchLoop(ctx context.Context) { + defer p.wg.Done() + p.runWatchChecks(ctx) + ticker := time.NewTicker(watcherPollTick) + defer ticker.Stop() + for { + select { + case <-ctx.Done(): + return + case <-ticker.C: + p.runWatchChecks(ctx) + } + } +} + +func (p *Poller) runWatchChecks(ctx context.Context) int { + matched := 0 + now := time.Now().UTC() + workWatches, err := p.service.store.ListEnabledWorkItemWatches(ctx) + if err != nil { + p.logger.Warn("azure devops watcher poll: list work-item watches", zap.Error(err)) + } else { + for _, watch := range workWatches { + if !watchDue(watch.LastPolledAt, watch.PollIntervalSeconds, now) { + continue + } + result, checkErr := p.service.TriggerWorkItemWatch(ctx, watch.WorkspaceID, watch.ID) + if checkErr != nil { + p.logger.Warn("azure devops watcher poll: work-item check failed", zap.String("watch_id", watch.ID), zap.Error(checkErr)) + continue + } + matched += result.Matched + if cleaned := p.service.cleanupWorkItemWatchForPoll(ctx, watch.ID); cleaned > 0 { + p.logger.Info("azure devops watcher poll: cleaned terminal work-item tasks", zap.String("watch_id", watch.ID), zap.Int("tasks", cleaned)) + } + } + } + prWatches, err := p.service.store.ListEnabledPullRequestWatches(ctx) + if err != nil { + p.logger.Warn("azure devops watcher poll: list pull-request watches", zap.Error(err)) + } else { + for _, watch := range prWatches { + if !watchDue(watch.LastPolledAt, watch.PollIntervalSeconds, now) { + continue + } + result, checkErr := p.service.TriggerPullRequestWatch(ctx, watch.WorkspaceID, watch.ID) + if checkErr != nil { + p.logger.Warn("azure devops watcher poll: pull-request check failed", zap.String("watch_id", watch.ID), zap.Error(checkErr)) + continue + } + matched += result.Matched + if cleaned := p.service.cleanupPullRequestWatchForPoll(ctx, watch.ID); cleaned > 0 { + p.logger.Info("azure devops watcher poll: cleaned terminal pull-request tasks", zap.String("watch_id", watch.ID), zap.Int("tasks", cleaned)) + } + } + } + return matched +} + +func (s *Service) cleanupWorkItemWatchForPoll(ctx context.Context, watchID string) int { + watch, err := s.store.GetWorkItemWatch(ctx, watchID) + if err != nil || watch == nil || !watch.Enabled || watch.Deleting { + return 0 + } + client, err := s.clientForWorkspace(ctx, watch.WorkspaceID) + if err != nil { + return 0 + } + return s.cleanupWorkItemWatchWithClient(ctx, watch, client) +} + +func (s *Service) cleanupPullRequestWatchForPoll(ctx context.Context, watchID string) int { + watch, err := s.store.GetPullRequestWatch(ctx, watchID) + if err != nil || watch == nil || !watch.Enabled || watch.Deleting { + return 0 + } + client, err := s.clientForWorkspace(ctx, watch.WorkspaceID) + if err != nil { + return 0 + } + return s.cleanupPullRequestWatchWithClient(ctx, watch, client) +} + +func watchDue(lastPolledAt *time.Time, intervalSeconds int, now time.Time) bool { + if lastPolledAt == nil { + return true + } + interval := time.Duration(normalizePollInterval(intervalSeconds)) * time.Second + return !lastPolledAt.Add(interval).After(now) } type authProber struct { diff --git a/apps/backend/internal/azuredevops/provider.go b/apps/backend/internal/azuredevops/provider.go index 53473f1bb2..e3666d8ba6 100644 --- a/apps/backend/internal/azuredevops/provider.go +++ b/apps/backend/internal/azuredevops/provider.go @@ -17,7 +17,7 @@ func Provide( writer *sqlx.DB, reader *sqlx.DB, secrets SecretStore, - _ bus.EventBus, + eventBus bus.EventBus, log *logger.Logger, ) (*Service, func() error, error) { store, err := NewStore(writer, reader) @@ -31,6 +31,7 @@ func Provide( factory = func(*Config, string) Client { return mock } } service := NewService(store, secrets, factory, log) + service.SetEventBus(eventBus) service.mock = mock return service, func() error { return nil }, nil } diff --git a/apps/backend/internal/azuredevops/rest_client.go b/apps/backend/internal/azuredevops/rest_client.go index e9464435ad..add2138b4d 100644 --- a/apps/backend/internal/azuredevops/rest_client.go +++ b/apps/backend/internal/azuredevops/rest_client.go @@ -10,9 +10,12 @@ import ( "io" "net/http" "net/url" + "sort" "strconv" "strings" "time" + + "golang.org/x/net/html" ) const ( @@ -23,6 +26,7 @@ const ( workItemBatchSize = 200 branchResultLimit = 1000 defaultPRPageSize = 50 + workItemCommentLimit = 100 ) // APIError is a bounded, credential-redacted Azure DevOps response error. @@ -164,6 +168,296 @@ func (c *RESTClient) GetWorkItem(ctx context.Context, projectID string, id int) return &item, nil } +func (c *RESTClient) GetWorkItemDetail(ctx context.Context, projectID string, id int) (*WorkItemDetail, error) { + item, err := c.GetWorkItem(ctx, projectID, id) + if err != nil { + return nil, err + } + detail := &WorkItemDetail{WorkItem: *item, PlanningFields: planningFields(item.Fields)} + detail.Description = sanitizeDescriptionHTML(detail.Description) + return detail, nil +} + +func (c *RESTClient) ListWorkItemComments(ctx context.Context, projectID string, id int, continuationToken string) (*WorkItemCommentPage, error) { + query := url.Values{} + query.Set("$top", strconv.Itoa(workItemCommentLimit)) + query.Set("api-version", "7.1-preview.4") + if strings.TrimSpace(continuationToken) != "" { + query.Set("continuationToken", continuationToken) + } + endpoint := fmt.Sprintf("/%s/_apis/wit/workItems/%d/comments?%s", pathPart(projectID), id, query.Encode()) + var response struct { + Comments []struct { + ID int `json:"id"` + Text string `json:"text"` + IsDeleted bool `json:"isDeleted"` + CreatedDate *time.Time `json:"createdDate"` + ModifiedDate *time.Time `json:"modifiedDate"` + CreatedBy Identity `json:"createdBy"` + } `json:"comments"` + } + var headers http.Header + if err := c.doJSONWithResponseHeaders(ctx, http.MethodGet, endpoint, nil, &response, &headers); err != nil { + return nil, err + } + comments := make([]WorkItemComment, 0, len(response.Comments)) + for _, comment := range response.Comments { + if comment.IsDeleted { + continue + } + comments = append(comments, WorkItemComment{ + ID: comment.ID, Content: comment.Text, Author: comment.CreatedBy, + PublishedAt: comment.CreatedDate, UpdatedAt: comment.ModifiedDate, + }) + } + sort.SliceStable(comments, func(i, j int) bool { + if comments[i].PublishedAt == nil { + return false + } + if comments[j].PublishedAt == nil { + return true + } + return comments[i].PublishedAt.After(*comments[j].PublishedAt) + }) + return &WorkItemCommentPage{Comments: comments, ContinuationToken: headers.Get("x-ms-continuationtoken")}, nil +} + +func (c *RESTClient) GetCurrentIdentity(ctx context.Context) (*Identity, error) { + auth, err := c.TestAuth(ctx) + if err != nil { + return nil, err + } + return &Identity{ID: auth.ID, DisplayName: auth.DisplayName, UniqueName: auth.Email}, nil +} + +func (c *RESTClient) ListTeams(ctx context.Context, projectID string) ([]Team, error) { + var response struct { + Value []struct { + ID string `json:"id"` + Name string `json:"name"` + ProjectID string `json:"projectId"` + ProjectName string `json:"projectName"` + } `json:"value"` + } + endpoint := fmt.Sprintf("/_apis/projects/%s/teams?api-version=%s", pathPart(projectID), restAPIVersion) + if err := c.doJSON(ctx, http.MethodGet, endpoint, nil, &response); err != nil { + return nil, err + } + teams := make([]Team, 0, len(response.Value)) + for _, raw := range response.Value { + teams = append(teams, Team{ID: raw.ID, Name: raw.Name, ProjectID: raw.ProjectID, ProjectName: raw.ProjectName}) + } + return teams, nil +} + +func (c *RESTClient) ListBoards(ctx context.Context, projectID, teamID string) ([]BoardReference, error) { + var response struct { + Value []struct { + ID string `json:"id"` + Name string `json:"name"` + IsHidden bool `json:"isHidden"` + } `json:"value"` + } + endpoint := fmt.Sprintf("/%s/%s/_apis/work/backlogs?api-version=%s", pathPart(projectID), pathPart(teamID), restAPIVersion) + if err := c.doJSON(ctx, http.MethodGet, endpoint, nil, &response); err != nil { + return nil, err + } + boards := make([]BoardReference, 0, len(response.Value)) + for _, raw := range response.Value { + if raw.IsHidden { + continue + } + boards = append(boards, BoardReference{ID: raw.ID, Name: raw.Name}) + } + return boards, nil +} + +func (c *RESTClient) GetBoardSnapshot(ctx context.Context, projectID, teamID, boardID string) (*BoardSnapshot, error) { + var rawBoard struct { + ID string `json:"id"` + Name string `json:"name"` + Columns []struct { + ID string `json:"id"` + Name string `json:"name"` + ColumnType string `json:"columnType"` + Description string `json:"description"` + IsSplit bool `json:"isSplit"` + ItemLimit int `json:"itemLimit"` + StateMappings map[string]string `json:"stateMappings"` + } `json:"columns"` + Fields struct { + ColumnField FieldReference `json:"columnField"` + DoneField FieldReference `json:"doneField"` + RowField FieldReference `json:"rowField"` + } `json:"fields"` + Rows []BoardRow `json:"rows"` + } + boardEndpoint := fmt.Sprintf("/%s/%s/_apis/work/boards/%s?api-version=%s", pathPart(projectID), pathPart(teamID), pathPart(boardID), restAPIVersion) + if err := c.doJSON(ctx, http.MethodGet, boardEndpoint, nil, &rawBoard); err != nil { + return nil, err + } + board := Board{ID: rawBoard.ID, Name: rawBoard.Name, Fields: rawBoard.Fields, Rows: rawBoard.Rows, Columns: make([]BoardColumn, 0, len(rawBoard.Columns))} + for _, column := range rawBoard.Columns { + board.Columns = append(board.Columns, BoardColumn{ID: column.ID, Name: column.Name, ColumnType: column.ColumnType, Description: column.Description, IsSplit: column.IsSplit, ItemLimit: column.ItemLimit, StateMappings: column.StateMappings}) + } + var refs struct { + Value []struct { + ID int `json:"id"` + Target struct { + ID int `json:"id"` + } `json:"target"` + } `json:"value"` + WorkItems []struct { + ID int `json:"id"` + Target struct { + ID int `json:"id"` + } `json:"target"` + } `json:"workItems"` + } + itemsEndpoint := fmt.Sprintf("/%s/%s/_apis/work/backlogs/%s/workItems?api-version=%s", pathPart(projectID), pathPart(teamID), pathPart(boardID), restAPIVersion) + if err := c.doJSON(ctx, http.MethodGet, itemsEndpoint, nil, &refs); err != nil { + return nil, err + } + ids := make([]int, 0, len(refs.Value)) + refsList := refs.Value + if len(refsList) == 0 { + refsList = refs.WorkItems + } + for _, ref := range refsList { + id := ref.ID + if id == 0 { + id = ref.Target.ID + } + if id > 0 { + ids = append(ids, id) + } + } + items, err := c.hydrateWorkItems(ctx, projectID, ids) + if err != nil { + return nil, err + } + result := make([]BoardWorkItem, 0, len(items)) + for _, item := range items { + columnID, done := boardItemPlacement(board, item) + result = append(result, BoardWorkItem{WorkItem: item, ColumnID: columnID, ColumnDone: done}) + } + return &BoardSnapshot{Board: board, Items: result}, nil +} + +func (c *RESTClient) UpdateBoardWorkItem(ctx context.Context, projectID, teamID, boardID string, id int, request BoardWorkItemUpdateRequest) (*BoardWorkItem, error) { + if request.Revision <= 0 { + return nil, fmt.Errorf("%w: revision required", ErrInvalidConfig) + } + var board struct { + Columns []BoardColumn `json:"columns"` + Fields BoardFields `json:"fields"` + } + boardEndpoint := fmt.Sprintf("/%s/%s/_apis/work/boards/%s?api-version=%s", pathPart(projectID), pathPart(teamID), pathPart(boardID), restAPIVersion) + if err := c.doJSON(ctx, http.MethodGet, boardEndpoint, nil, &board); err != nil { + return nil, err + } + patch, err := boardWorkItemPatch(board, request) + if err != nil { + return nil, err + } + endpoint := fmt.Sprintf("/%s/_apis/wit/workitems/%d?api-version=%s", pathPart(projectID), id, restAPIVersion) + var raw rawWorkItem + if err := c.doJSONWithContentType(ctx, http.MethodPatch, endpoint, patch, &raw, "application/json-patch+json"); err != nil { + return nil, err + } + item := convertWorkItem(raw) + columnID, done := boardItemPlacement(Board{Columns: board.Columns, Fields: board.Fields}, item) + if columnID == "" && request.ColumnID != nil { + columnID = *request.ColumnID + } + if request.ColumnDone != nil { + done = *request.ColumnDone + } + return &BoardWorkItem{WorkItem: item, ColumnID: columnID, ColumnDone: done}, nil +} + +func (c *RESTClient) UpdateWorkItem(ctx context.Context, projectID string, id int, request WorkItemAssignmentRequest) (*WorkItem, error) { + patch, err := workItemAssignmentPatch(request) + if err != nil { + return nil, err + } + endpoint := fmt.Sprintf("/%s/_apis/wit/workitems/%d?api-version=%s", pathPart(projectID), id, restAPIVersion) + var raw rawWorkItem + if err := c.doJSONWithContentType(ctx, http.MethodPatch, endpoint, patch, &raw, "application/json-patch+json"); err != nil { + return nil, err + } + item := convertWorkItem(raw) + return &item, nil +} + +func workItemAssignmentPatch(request WorkItemAssignmentRequest) ([]map[string]any, error) { + if err := validateWorkItemAssignment(request); err != nil { + return nil, err + } + if !request.hasResolvedAssignee { + return nil, fmt.Errorf("%w: assignee action must be resolved server-side", ErrInvalidConfig) + } + patch := []map[string]any{{"op": "test", "path": "/rev", "value": request.Revision}} + if request.resolvedAssignee == "" { + patch = append(patch, map[string]any{"op": "remove", "path": "/fields/System.AssignedTo"}) + } else { + patch = append(patch, map[string]any{"op": "add", "path": "/fields/System.AssignedTo", "value": request.resolvedAssignee}) + } + return patch, nil +} + +func boardWorkItemPatch(board struct { + Columns []BoardColumn `json:"columns"` + Fields BoardFields `json:"fields"` +}, request BoardWorkItemUpdateRequest) ([]map[string]any, error) { + if err := validateBoardWorkItemUpdate(request); err != nil { + return nil, err + } + if request.AssigneeAction != nil && !request.hasResolvedAssignee { + return nil, fmt.Errorf("%w: assignee action must be resolved server-side", ErrInvalidConfig) + } + patch := []map[string]any{{"op": "test", "path": "/rev", "value": request.Revision}} + appendField := func(path string, value any) { + patch = append(patch, map[string]any{"op": "replace", "path": path, "value": value}) + } + appendOptionalField := func(path, value string) { + if value == "" { + patch = append(patch, map[string]any{"op": "remove", "path": path}) + return + } + patch = append(patch, map[string]any{"op": "add", "path": path, "value": value}) + } + if request.hasResolvedAssignee { + appendOptionalField("/fields/System.AssignedTo", request.resolvedAssignee) + } + if request.ColumnID != nil { + columnName := "" + for _, column := range board.Columns { + if column.ID == *request.ColumnID { + columnName = column.Name + break + } + } + if columnName == "" { + return nil, fmt.Errorf("%w: unknown board column", ErrInvalidConfig) + } + if board.Fields.ColumnField.ReferenceName == "" { + return nil, errors.New("azure devops: board column field is unavailable") + } + appendField("/fields/"+board.Fields.ColumnField.ReferenceName, columnName) + } + if request.ColumnDone != nil { + if board.Fields.DoneField.ReferenceName == "" { + return nil, errors.New("azure devops: board done field is unavailable") + } + appendField("/fields/"+board.Fields.DoneField.ReferenceName, *request.ColumnDone) + } + if len(patch) == 1 { + return nil, fmt.Errorf("%w: at least one board field is required", ErrInvalidConfig) + } + return patch, nil +} + func (c *RESTClient) ListPullRequests(ctx context.Context, filter PullRequestFilter) (*PullRequestPage, error) { values := url.Values{"api-version": {restAPIVersion}} setPRFilter(values, "searchCriteria.status", filter.Status) @@ -311,6 +605,18 @@ func (c *RESTClient) getWorkItemBatch(ctx context.Context, projectID string, ids } func (c *RESTClient) doJSON(ctx context.Context, method, endpoint string, requestBody, responseBody any) error { + return c.doJSONWithContentType(ctx, method, endpoint, requestBody, responseBody, "application/json") +} + +func (c *RESTClient) doJSONWithResponseHeaders(ctx context.Context, method, endpoint string, requestBody, responseBody any, responseHeaders *http.Header) error { + return c.doJSONWithContentTypeAndResponseHeaders(ctx, method, endpoint, requestBody, responseBody, "application/json", responseHeaders) +} + +func (c *RESTClient) doJSONWithContentType(ctx context.Context, method, endpoint string, requestBody, responseBody any, contentType string) error { + return c.doJSONWithContentTypeAndResponseHeaders(ctx, method, endpoint, requestBody, responseBody, contentType, nil) +} + +func (c *RESTClient) doJSONWithContentTypeAndResponseHeaders(ctx context.Context, method, endpoint string, requestBody, responseBody any, contentType string, responseHeaders *http.Header) error { if c.initErr != nil { return c.initErr } @@ -330,7 +636,7 @@ func (c *RESTClient) doJSON(ctx context.Context, method, endpoint string, reques req.Header.Set("Accept", "application/json") req.Header.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(":"+c.pat))) if requestBody != nil { - req.Header.Set("Content-Type", "application/json") + req.Header.Set("Content-Type", contentType) } resp, err := c.httpClient.Do(req) if err != nil { @@ -340,6 +646,9 @@ func (c *RESTClient) doJSON(ctx context.Context, method, endpoint string, reques if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices { return c.decodeAPIError(resp, endpointPath(endpoint)) } + if responseHeaders != nil { + *responseHeaders = resp.Header.Clone() + } limited := io.LimitReader(resp.Body, maxResponseBodyBytes+1) data, err := io.ReadAll(limited) if err != nil { @@ -420,16 +729,94 @@ func convertRepository(raw rawRepository) Repository { } func convertWorkItem(raw rawWorkItem) WorkItem { + tags := make([]string, 0) + for _, tag := range strings.Split(stringField(raw.Fields, "System.Tags"), ";") { + if tag = strings.TrimSpace(tag); tag != "" { + tags = append(tags, tag) + } + } return WorkItem{ ID: raw.ID, Revision: raw.Rev, Title: stringField(raw.Fields, "System.Title"), Description: stringField(raw.Fields, "System.Description"), State: stringField(raw.Fields, "System.State"), Type: stringField(raw.Fields, "System.WorkItemType"), Project: stringField(raw.Fields, "System.TeamProject"), AreaPath: stringField(raw.Fields, "System.AreaPath"), - AssignedTo: identityDisplayField(raw.Fields, "System.AssignedTo"), WebURL: raw.Links.HTML.Href, + AssignedTo: identityDisplayField(raw.Fields, "System.AssignedTo"), Tags: tags, WebURL: raw.Links.HTML.Href, APIURL: raw.URL, Fields: raw.Fields, } } +var supportedPlanningFields = []struct { + ReferenceName string + Label string +}{ + {ReferenceName: "Microsoft.VSTS.Scheduling.Effort", Label: "Effort"}, + {ReferenceName: "Microsoft.VSTS.Scheduling.StoryPoints", Label: "Story points"}, + {ReferenceName: "Microsoft.VSTS.Scheduling.Size", Label: "Size"}, + {ReferenceName: "Microsoft.VSTS.Scheduling.RemainingWork", Label: "Remaining work"}, + {ReferenceName: "Microsoft.VSTS.Scheduling.OriginalEstimate", Label: "Original estimate"}, + {ReferenceName: "Microsoft.VSTS.Scheduling.CompletedWork", Label: "Completed work"}, +} + +func planningFields(fields map[string]any) []PlanningField { + result := make([]PlanningField, 0, len(supportedPlanningFields)) + for _, field := range supportedPlanningFields { + value, ok := fields[field.ReferenceName] + if !ok || value == nil { + continue + } + formatted := strings.TrimSpace(fmt.Sprint(value)) + if formatted == "" { + continue + } + result = append(result, PlanningField{ReferenceName: field.ReferenceName, Label: field.Label, Value: formatted}) + } + return result +} + +func sanitizeDescriptionHTML(value string) string { + node, err := html.Parse(strings.NewReader(value)) + if err != nil { + return "" + } + var text strings.Builder + var visit func(*html.Node) + visit = func(current *html.Node) { + if current.Type == html.ElementNode && (current.Data == "script" || current.Data == "style") { + return + } + if current.Type == html.TextNode { + text.WriteString(current.Data) + text.WriteByte(' ') + } + for child := current.FirstChild; child != nil; child = child.NextSibling { + visit(child) + } + } + visit(node) + return strings.Join(strings.Fields(text.String()), " ") +} + +func boardItemPlacement(board Board, item WorkItem) (string, bool) { + columnValue := stringField(item.Fields, board.Fields.ColumnField.ReferenceName) + columnID := "" + for _, column := range board.Columns { + if column.Name == columnValue { + columnID = column.ID + break + } + } + done := false + if raw, ok := item.Fields[board.Fields.DoneField.ReferenceName]; ok { + switch value := raw.(type) { + case bool: + done = value + case string: + done = strings.EqualFold(value, "true") + } + } + return columnID, done +} + func convertPullRequest(raw rawPullRequest) PullRequest { webURL := "" if raw.Repository.WebURL != "" && raw.PullRequestID > 0 { diff --git a/apps/backend/internal/azuredevops/rest_client_test.go b/apps/backend/internal/azuredevops/rest_client_test.go index 168cd706e5..99e418f70b 100644 --- a/apps/backend/internal/azuredevops/rest_client_test.go +++ b/apps/backend/internal/azuredevops/rest_client_test.go @@ -58,6 +58,200 @@ func TestRESTClientAuthAndDiscovery(t *testing.T) { } } +func TestRESTClientBoardReads(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + switch r.URL.Path { + case "/acme/_apis/projects/project-1/teams": + _, _ = w.Write([]byte(`{"value":[{"id":"team-1","name":"Platform Team","projectId":"project-1","projectName":"Platform"}]}`)) + case "/acme/project-1/team-1/_apis/work/backlogs": + _, _ = w.Write([]byte(`{"value":[{"id":"Microsoft.RequirementCategory","name":"Stories","isHidden":false},{"id":"Microsoft.TaskCategory","name":"Tasks","isHidden":true}]}`)) + case "/acme/project-1/team-1/_apis/work/boards/Microsoft.RequirementCategory": + _, _ = w.Write([]byte(`{"id":"board-1","name":"Stories","fields":{"columnField":{"referenceName":"System.BoardColumn"},"doneField":{"referenceName":"System.BoardColumnDone"}},"columns":[{"id":"column-todo","name":"To Do","columnType":"incoming","itemLimit":10},{"id":"column-active","name":"Active","columnType":"inProgress"},{"id":"column-done","name":"Done","columnType":"outgoing"}]}`)) + case "/acme/project-1/team-1/_apis/work/backlogs/Microsoft.RequirementCategory/workItems": + _, _ = w.Write([]byte(`{"workItems":[{"target":{"id":2}},{"target":{"id":1}},{"target":{"id":3}}]}`)) + case "/acme/project-1/_apis/wit/workitemsbatch": + _, _ = w.Write([]byte(`{"value":[{"id":1,"rev":4,"fields":{"System.Title":"First","System.WorkItemType":"User Story","System.AssignedTo":"Ada","System.Tags":"one; two","System.BoardColumn":"To Do","System.BoardColumnDone":false}},{"id":2,"rev":5,"fields":{"System.Title":"Second","System.WorkItemType":"Bug","System.BoardColumn":"Done","System.BoardColumnDone":true}}]}`)) + default: + http.NotFound(w, r) + } + })) + t.Cleanup(server.Close) + + client := newTestRESTClient(t, server, "pat") + teams, err := client.ListTeams(context.Background(), "project-1") + if err != nil || len(teams) != 1 || teams[0].Name != "Platform Team" || teams[0].ProjectID != "project-1" || teams[0].ProjectName != "Platform" { + t.Fatalf("ListTeams = %+v, %v", teams, err) + } + boards, err := client.ListBoards(context.Background(), "project-1", "team-1") + if err != nil || len(boards) != 1 || boards[0].ID != "Microsoft.RequirementCategory" { + t.Fatalf("ListBoards = %+v, %v", boards, err) + } + snapshot, err := client.GetBoardSnapshot(context.Background(), "project-1", "team-1", boards[0].ID) + if err != nil { + t.Fatalf("GetBoardSnapshot: %v", err) + } + if len(snapshot.Board.Columns) != 3 || len(snapshot.Items) != 2 { + t.Fatalf("snapshot = %+v", snapshot) + } + if snapshot.Items[0].ID != 2 || snapshot.Items[0].ColumnID != "column-done" || !snapshot.Items[0].ColumnDone { + t.Fatalf("first board item = %+v", snapshot.Items[0]) + } + if snapshot.Items[1].ID != 1 || snapshot.Items[1].ColumnID != "column-todo" || len(snapshot.Items[1].Tags) != 2 { + t.Fatalf("second board item = %+v", snapshot.Items[1]) + } +} + +func TestRESTClientGetWorkItemDetail(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/acme/project-1/_apis/wit/workitems/101" || r.URL.Query().Get("$expand") != "all" { + t.Fatalf("detail request = %s", r.URL.String()) + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"id":101,"rev":8,"url":"https://api/work-items/101","_links":{"html":{"href":"https://dev.azure.com/acme/project/_workitems/edit/101"}},"fields":{"System.Title":"Ship detail","System.WorkItemType":"User Story","System.State":"Active","System.AssignedTo":{"displayName":"Ada"},"System.Tags":"ui; azure","System.Description":"Useful detail
","Microsoft.VSTS.Scheduling.Effort":5,"Microsoft.VSTS.Scheduling.StoryPoints":"3","Microsoft.VSTS.Scheduling.RemainingWork":2.5}}`)) + })) + t.Cleanup(server.Close) + + detail, err := newTestRESTClient(t, server, "pat").GetWorkItemDetail(t.Context(), "project-1", 101) + if err != nil { + t.Fatalf("GetWorkItemDetail: %v", err) + } + if detail.ID != 101 || detail.Revision != 8 || detail.AssignedTo != "Ada" || detail.WebURL == "" { + t.Fatalf("detail core fields = %+v", detail) + } + if strings.Contains(detail.Description, "script") || !strings.Contains(detail.Description, "Useful detail") { + t.Fatalf("description = %q, want sanitized useful content", detail.Description) + } + if len(detail.PlanningFields) != 3 || detail.PlanningFields[0].ReferenceName != "Microsoft.VSTS.Scheduling.Effort" || detail.PlanningFields[2].Value != "2.5" { + t.Fatalf("planning fields = %+v", detail.PlanningFields) + } +} + +func TestRESTClientListWorkItemComments(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/acme/project-1/_apis/wit/workItems/101/comments" || r.URL.Query().Get("continuationToken") != "opaque-token" || r.URL.Query().Get("$top") != "100" { + t.Fatalf("comments request = %s", r.URL.String()) + } + w.Header().Set("Content-Type", "application/json") + w.Header().Set("x-ms-continuationtoken", "next-opaque-token") + _, _ = w.Write([]byte(`{"comments":[{"id":1,"text":"Older","createdDate":"2026-07-20T10:00:00Z","createdBy":{"id":"u1","displayName":"Ada"}},{"id":2,"text":"Deleted","isDeleted":true,"createdDate":"2026-07-21T10:00:00Z"},{"id":3,"text":"Newest","createdDate":"2026-07-22T10:00:00Z"}]}`)) + })) + t.Cleanup(server.Close) + + page, err := newTestRESTClient(t, server, "pat").ListWorkItemComments(t.Context(), "project-1", 101, "opaque-token") + if err != nil { + t.Fatalf("ListWorkItemComments: %v", err) + } + if page.ContinuationToken != "next-opaque-token" || len(page.Comments) != 2 || page.Comments[0].ID != 3 || page.Comments[1].Author.DisplayName != "Ada" { + t.Fatalf("comment page = %+v", page) + } +} + +func TestRESTClientGetCurrentIdentity(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/acme/_apis/connectionData" { + t.Fatalf("identity request = %s", r.URL.String()) + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"authenticatedUser":{"id":"u1","providerDisplayName":"Ada","properties":{"Account":{"$value":"ada@example.com"}}}}`)) + })) + t.Cleanup(server.Close) + + identity, err := newTestRESTClient(t, server, "pat").GetCurrentIdentity(t.Context()) + if err != nil || identity.ID != "u1" || identity.DisplayName != "Ada" || identity.UniqueName != "ada@example.com" { + t.Fatalf("GetCurrentIdentity = %+v, %v", identity, err) + } +} + +func TestBoardWorkItemPatchAssignCurrentUser(t *testing.T) { + action := "assign_current_user" + patch, err := boardWorkItemPatch(struct { + Columns []BoardColumn `json:"columns"` + Fields BoardFields `json:"fields"` + }{}, BoardWorkItemUpdateRequest{Revision: 7, AssigneeAction: &action, resolvedAssignee: "ada@example.com", hasResolvedAssignee: true}) + if err != nil { + t.Fatalf("boardWorkItemPatch: %v", err) + } + if len(patch) != 2 || patch[0]["op"] != "test" || patch[0]["path"] != "/rev" || patch[1]["op"] != "add" || patch[1]["path"] != "/fields/System.AssignedTo" || patch[1]["value"] != "ada@example.com" { + t.Fatalf("patch = %#v", patch) + } +} + +func TestBoardWorkItemPatchUnassign(t *testing.T) { + action := "unassign" + patch, err := boardWorkItemPatch(struct { + Columns []BoardColumn `json:"columns"` + Fields BoardFields `json:"fields"` + }{}, BoardWorkItemUpdateRequest{Revision: 7, AssigneeAction: &action, hasResolvedAssignee: true}) + if err != nil || len(patch) != 2 || patch[1]["op"] != "remove" || patch[1]["path"] != "/fields/System.AssignedTo" { + t.Fatalf("patch = %#v, %v", patch, err) + } +} + +func TestBoardWorkItemPatchRejectsUnsupportedFields(t *testing.T) { + if _, err := boardWorkItemPatch(struct { + Columns []BoardColumn `json:"columns"` + Fields BoardFields `json:"fields"` + }{}, BoardWorkItemUpdateRequest{Revision: 7}); err == nil { + t.Fatal("boardWorkItemPatch accepted an unsupported empty mutation") + } +} + +func TestRESTClientUpdateBoardWorkItem(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + switch r.URL.Path { + case "/acme/project-1/team-1/_apis/work/boards/board-1": + _, _ = w.Write([]byte(`{"id":"board-1","name":"Stories","fields":{"columnField":{"referenceName":"System.BoardColumn"},"doneField":{"referenceName":"System.BoardColumnDone"}},"columns":[{"id":"column-active","name":"Active"}]}`)) + case "/acme/project-1/_apis/wit/workitems/101": + if r.Method != http.MethodPatch || r.Header.Get("Content-Type") != "application/json-patch+json" { + t.Fatalf("request method/content type = %s/%q", r.Method, r.Header.Get("Content-Type")) + } + var patch []map[string]any + if err := json.NewDecoder(r.Body).Decode(&patch); err != nil { + t.Fatalf("decode patch: %v", err) + } + if len(patch) != 3 || patch[0]["op"] != "test" || patch[0]["path"] != "/rev" || patch[0]["value"] != float64(7) || patch[1]["path"] != "/fields/System.BoardColumn" || patch[2]["path"] != "/fields/System.BoardColumnDone" { + t.Fatalf("patch = %#v", patch) + } + _, _ = w.Write([]byte(`{"id":101,"rev":8,"fields":{"System.Title":"Updated","System.AssignedTo":"Grace","System.Tags":"one; two","System.BoardColumn":"Active","System.BoardColumnDone":true}}`)) + default: + http.NotFound(w, r) + } + })) + t.Cleanup(server.Close) + client := newTestRESTClient(t, server, "pat") + column := "column-active" + done := true + item, err := client.UpdateBoardWorkItem(context.Background(), "project-1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, ColumnID: &column, ColumnDone: &done}) + if err != nil || item == nil || item.Revision != 8 || item.ColumnID != "column-active" || !item.ColumnDone { + t.Fatalf("updated item = %+v, %v", item, err) + } +} + +func TestRESTClientUpdateWorkItemAssignment(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/acme/project-1/_apis/wit/workitems/101" || r.Method != http.MethodPatch { + t.Fatalf("assignment request = %s %s", r.Method, r.URL.Path) + } + var patch []map[string]any + if err := json.NewDecoder(r.Body).Decode(&patch); err != nil { + t.Fatalf("decode patch: %v", err) + } + if len(patch) != 2 || patch[0]["path"] != "/rev" || patch[0]["value"] != float64(7) || patch[1]["path"] != "/fields/System.AssignedTo" || patch[1]["value"] != "ada@example.com" { + t.Fatalf("patch = %#v", patch) + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"id":101,"rev":8,"fields":{"System.Title":"Fix build","System.AssignedTo":"Ada"}}`)) + })) + t.Cleanup(server.Close) + action := assignCurrentUserAction + item, err := newTestRESTClient(t, server, "pat").UpdateWorkItem(context.Background(), "project-1", 101, WorkItemAssignmentRequest{Revision: 7, AssigneeAction: &action, resolvedAssignee: "ada@example.com", hasResolvedAssignee: true}) + if err != nil || item == nil || item.Revision != 8 || item.AssignedTo != "Ada" { + t.Fatalf("updated item = %+v, %v", item, err) + } +} + func TestRESTClientQueryWIQLBatchesAndPreservesOrder(t *testing.T) { var mu sync.Mutex var batches [][]int diff --git a/apps/backend/internal/azuredevops/service.go b/apps/backend/internal/azuredevops/service.go index eb7f0f7afe..884dab0110 100644 --- a/apps/backend/internal/azuredevops/service.go +++ b/apps/backend/internal/azuredevops/service.go @@ -7,11 +7,14 @@ import ( "net/url" "regexp" "strings" + "sync" "time" "go.uber.org/zap" "github.com/kandev/kandev/internal/common/logger" + "github.com/kandev/kandev/internal/events/bus" + "github.com/kandev/kandev/internal/watchreset" ) var ( @@ -40,17 +43,90 @@ type SecretStore interface { // Service coordinates workspace configuration, encrypted PATs, and auth // probes. type Service struct { - store *Store - secrets SecretStore - clientFn ClientFactory - log *logger.Logger - mock *MockClient - repoLookup RepositoryLookup + store *Store + secrets SecretStore + clientFn ClientFactory + log *logger.Logger + mock *MockClient + repoLookup RepositoryLookup + watchRepositoryLookup WatchRepositoryLookup + watchDependencyValidator WatchDependencyValidator + // workspaceAuthorizer is wired to the task service when per-user auth is + // enabled. A nil authorizer preserves the unscoped local-development path. + workspaceAuthorizer func(context.Context, string) error + eventBus bus.EventBus + mu sync.RWMutex + cascadeTaskDeleter watchreset.TaskDeleter + taskSessionChecker TaskSessionChecker +} + +// SetEventBus wires watcher events and preserves the nil-safe local test path. +func (s *Service) SetEventBus(eventBus bus.EventBus) { + if s != nil { + s.mu.Lock() + defer s.mu.Unlock() + s.eventBus = eventBus + } +} + +// SetCascadeTaskDeleter wires the shared task-tree cleanup used by watcher +// reset and delete operations. A nil deleter keeps persistence usable in +// local tests while production still clears reservations safely. +func (s *Service) SetCascadeTaskDeleter(deleter watchreset.TaskDeleter) { + if s != nil { + s.mu.Lock() + defer s.mu.Unlock() + s.cascadeTaskDeleter = deleter + } +} + +func (s *Service) getCascadeTaskDeleter() watchreset.TaskDeleter { + if s == nil { + return nil + } + s.mu.RLock() + defer s.mu.RUnlock() + return s.cascadeTaskDeleter +} + +// SetTaskSessionChecker wires the user-engagement check used by the "auto" +// watcher cleanup policy. It is optional for local tests; production wires +// the same task repository adapter used by the other integrations. +func (s *Service) SetTaskSessionChecker(checker TaskSessionChecker) { + if s != nil { + s.mu.Lock() + defer s.mu.Unlock() + s.taskSessionChecker = checker + } +} + +func (s *Service) getTaskSessionChecker() TaskSessionChecker { + if s == nil { + return nil + } + s.mu.RLock() + defer s.mu.RUnlock() + return s.taskSessionChecker } // MockClient returns the E2E mock when the provider is in mock mode. func (s *Service) MockClient() *MockClient { return s.mock } +// SetWorkspaceAuthorizer installs the per-user workspace access boundary for +// Azure DevOps configuration and provider operations. +func (s *Service) SetWorkspaceAuthorizer(authorizer func(context.Context, string) error) { + if s != nil { + s.workspaceAuthorizer = authorizer + } +} + +func (s *Service) authorizeWorkspaceAccess(ctx context.Context, workspaceID string) error { + if s == nil || s.workspaceAuthorizer == nil { + return nil + } + return s.workspaceAuthorizer(ctx, workspaceID) +} + // NewService constructs the Azure DevOps configuration service. func NewService(store *Store, secrets SecretStore, clientFn ClientFactory, log *logger.Logger) *Service { if clientFn == nil { @@ -90,6 +166,9 @@ func (s *Service) GetConfigForWorkspace(ctx context.Context, workspaceID string) if err := validateWorkspaceID(workspaceID); err != nil { return nil, err } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } cfg, err := s.store.GetConfig(ctx, workspaceID) if err != nil || cfg == nil || s.secrets == nil { return cfg, err @@ -111,6 +190,9 @@ func (s *Service) SetConfigForWorkspace( if err := validateWorkspaceID(workspaceID); err != nil { return nil, err } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } cfg, err := configFromRequest(workspaceID, req) if err != nil { return nil, err @@ -171,6 +253,7 @@ func (s *Service) finishConfigUpdate( if err := s.store.ResetAuthHealth(ctx, workspaceID); err != nil { return nil, fmt.Errorf("reset azure devops auth health: %w", err) } + s.RecordAuthHealthForWorkspace(ctx, workspaceID) } return s.GetConfigForWorkspace(ctx, workspaceID) } @@ -180,6 +263,9 @@ func (s *Service) DeleteConfigForWorkspace(ctx context.Context, workspaceID stri if err := validateWorkspaceID(workspaceID); err != nil { return err } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return err + } previous, err := s.readStoredPAT(ctx, workspaceID) if err != nil { return err @@ -295,6 +381,9 @@ func (s *Service) resolveCredentials( if err := validateWorkspaceID(workspaceID); err != nil { return nil, "", err } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, "", err + } if req == nil { req = &SetConfigRequest{} } diff --git a/apps/backend/internal/azuredevops/service_board.go b/apps/backend/internal/azuredevops/service_board.go new file mode 100644 index 0000000000..2034760d03 --- /dev/null +++ b/apps/backend/internal/azuredevops/service_board.go @@ -0,0 +1,109 @@ +package azuredevops + +import ( + "context" + "errors" + "fmt" + "strings" +) + +func (s *Service) boardReaderForWorkspace(ctx context.Context, workspaceID string) (BoardReader, error) { + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + reader, ok := client.(BoardReader) + if !ok { + return nil, fmt.Errorf("%w: board listing is unavailable", ErrNotConfigured) + } + return reader, nil +} + +func (s *Service) ListTeamsForWorkspace(ctx context.Context, workspaceID, projectID string) ([]Team, error) { + if strings.TrimSpace(projectID) == "" { + return nil, fmt.Errorf("%w: project required", ErrInvalidConfig) + } + reader, err := s.boardReaderForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + return reader.ListTeams(ctx, projectID) +} + +func (s *Service) ListBoardsForWorkspace(ctx context.Context, workspaceID, projectID, teamID string) ([]BoardReference, error) { + if strings.TrimSpace(projectID) == "" || strings.TrimSpace(teamID) == "" { + return nil, fmt.Errorf("%w: project and team required", ErrInvalidConfig) + } + reader, err := s.boardReaderForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + return reader.ListBoards(ctx, projectID, teamID) +} + +func (s *Service) GetBoardSnapshotForWorkspace(ctx context.Context, workspaceID, projectID, teamID, boardID string) (*BoardSnapshot, error) { + if strings.TrimSpace(projectID) == "" || strings.TrimSpace(teamID) == "" || strings.TrimSpace(boardID) == "" { + return nil, fmt.Errorf("%w: project, team, and board required", ErrInvalidConfig) + } + reader, err := s.boardReaderForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + return reader.GetBoardSnapshot(ctx, projectID, teamID, boardID) +} + +func (s *Service) UpdateBoardWorkItemForWorkspace(ctx context.Context, workspaceID, projectID, teamID, boardID string, id int, request BoardWorkItemUpdateRequest) (*BoardWorkItem, error) { + if strings.TrimSpace(projectID) == "" || strings.TrimSpace(teamID) == "" || strings.TrimSpace(boardID) == "" || id <= 0 { + return nil, fmt.Errorf("%w: project, team, board, and positive work item id required", ErrInvalidConfig) + } + if err := validateBoardWorkItemUpdate(request); err != nil { + return nil, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + writer, ok := client.(BoardWriter) + if !ok { + return nil, fmt.Errorf("%w: board updates are unavailable", ErrNotConfigured) + } + if request.AssigneeAction != nil { + switch *request.AssigneeAction { + case unassignAction: + request.hasResolvedAssignee = true + case assignCurrentUserAction: + identityReader, available := client.(interface { + GetCurrentIdentity(context.Context) (*Identity, error) + }) + if !available { + return nil, fmt.Errorf("%w: current identity is unavailable", ErrNotConfigured) + } + identity, identityErr := identityReader.GetCurrentIdentity(ctx) + if identityErr != nil { + return nil, identityErr + } + assignee := strings.TrimSpace(identity.UniqueName) + if assignee == "" { + assignee = strings.TrimSpace(identity.DisplayName) + } + if assignee == "" { + return nil, errors.New("azure devops: current identity has no assignable name") + } + request.resolvedAssignee, request.hasResolvedAssignee = assignee, true + } + } + return writer.UpdateBoardWorkItem(ctx, projectID, teamID, boardID, id, request) +} + +func validateBoardWorkItemUpdate(request BoardWorkItemUpdateRequest) error { + if request.Revision <= 0 { + return fmt.Errorf("%w: revision required", ErrInvalidConfig) + } + if request.AssigneeAction != nil && *request.AssigneeAction != assignCurrentUserAction && *request.AssigneeAction != unassignAction { + return fmt.Errorf("%w: unsupported assignee action", ErrInvalidConfig) + } + if request.AssigneeAction == nil && request.ColumnID == nil && request.ColumnDone == nil { + return fmt.Errorf("%w: an assignee action, column, or split state is required", ErrInvalidConfig) + } + return nil +} diff --git a/apps/backend/internal/azuredevops/service_board_test.go b/apps/backend/internal/azuredevops/service_board_test.go new file mode 100644 index 0000000000..b4ede9fe25 --- /dev/null +++ b/apps/backend/internal/azuredevops/service_board_test.go @@ -0,0 +1,126 @@ +package azuredevops + +import ( + "context" + "errors" + "testing" +) + +type fakeBoardReader struct { + teams []Team + boards []BoardReference + snapshot *BoardSnapshot +} + +func TestServiceBoardReadsAuthorizeWorkspaceBeforeCreatingClient(t *testing.T) { + clientCalls := 0 + service, _, _ := newTestService(t, func(*Config, string) Client { + clientCalls++ + return &invalidClient{} + }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + clientCalls = 0 + denied := errors.New("workspace denied") + service.SetWorkspaceAuthorizer(func(context.Context, string) error { return denied }) + + if _, err := service.ListTeamsForWorkspace(t.Context(), "ws-1", "project-1"); !errors.Is(err, denied) { + t.Fatalf("ListTeamsForWorkspace error = %v, want authorization denial", err) + } + if clientCalls != 0 { + t.Fatalf("client factory calls = %d, want 0", clientCalls) + } +} + +func TestServiceBoardCapabilitiesReportNotConfigured(t *testing.T) { + service, _, _ := newTestService(t, func(*Config, string) Client { return &invalidClient{} }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + if _, err := service.ListTeamsForWorkspace(t.Context(), "ws-1", "project-1"); !errors.Is(err, ErrNotConfigured) { + t.Fatalf("ListTeamsForWorkspace error = %v, want ErrNotConfigured", err) + } + column := "column-1" + if _, err := service.UpdateBoardWorkItemForWorkspace(t.Context(), "ws-1", "project-1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, ColumnID: &column}); !errors.Is(err, ErrNotConfigured) { + t.Fatalf("UpdateBoardWorkItemForWorkspace error = %v, want ErrNotConfigured", err) + } +} + +type fakeBoardWriter struct { + *fakeBoardReader + request BoardWorkItemUpdateRequest +} + +func (f *fakeBoardWriter) GetCurrentIdentity(context.Context) (*Identity, error) { + return &Identity{ID: "me", DisplayName: "Ada"}, nil +} + +func (f *fakeBoardWriter) UpdateBoardWorkItem(_ context.Context, _, _, _ string, _ int, request BoardWorkItemUpdateRequest) (*BoardWorkItem, error) { + f.request = request + return &BoardWorkItem{WorkItem: WorkItem{ID: 101, Revision: request.Revision + 1, Title: "Updated"}}, nil +} + +func (f *fakeBoardReader) ListTeams(context.Context, string) ([]Team, error) { + return f.teams, nil +} +func (f *fakeBoardReader) ListBoards(context.Context, string, string) ([]BoardReference, error) { + return f.boards, nil +} +func (f *fakeBoardReader) GetBoardSnapshot(context.Context, string, string, string) (*BoardSnapshot, error) { + return f.snapshot, nil +} + +func TestServiceBoardReads(t *testing.T) { + reader := &fakeBoardReader{ + teams: []Team{{ID: "team-1", Name: "Platform Team", ProjectID: "project-1"}}, + boards: []BoardReference{{ID: "board-1", Name: "Stories"}}, + snapshot: &BoardSnapshot{Board: Board{ID: "board-1", Name: "Stories"}, Items: []BoardWorkItem{{WorkItem: WorkItem{ID: 101, Title: "Fix build"}}}}, + } + service, _, _ := newTestService(t, func(*Config, string) Client { + return &struct { + invalidClient + *fakeBoardReader + }{fakeBoardReader: reader} + }) + if _, err := service.SetConfigForWorkspace(context.Background(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + teams, err := service.ListTeamsForWorkspace(context.Background(), "ws-1", "project-1") + if err != nil || len(teams) != 1 || teams[0].ID != "team-1" { + t.Fatalf("ListTeamsForWorkspace = %+v, %v", teams, err) + } + boards, err := service.ListBoardsForWorkspace(context.Background(), "ws-1", "project-1", "team-1") + if err != nil || len(boards) != 1 || boards[0].ID != "board-1" { + t.Fatalf("ListBoardsForWorkspace = %+v, %v", boards, err) + } + snapshot, err := service.GetBoardSnapshotForWorkspace(context.Background(), "ws-1", "project-1", "team-1", "board-1") + if err != nil || snapshot == nil || len(snapshot.Items) != 1 { + t.Fatalf("GetBoardSnapshotForWorkspace = %+v, %v", snapshot, err) + } +} + +func TestServiceUpdateBoardWorkItemIdentity(t *testing.T) { + reader := &fakeBoardReader{snapshot: &BoardSnapshot{Board: Board{ID: "board-1"}}} + writer := &fakeBoardWriter{fakeBoardReader: reader} + service, _, _ := newTestService(t, func(*Config, string) Client { + return &struct { + invalidClient + *fakeBoardWriter + }{fakeBoardWriter: writer} + }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + assign := "assign_current_user" + item, err := service.UpdateBoardWorkItemForWorkspace(t.Context(), "ws-1", "project-1", "team-1", "board-1", 101, BoardWorkItemUpdateRequest{Revision: 7, AssigneeAction: &assign}) + if err != nil || item == nil || writer.request.Revision != 7 || writer.request.resolvedAssignee != "Ada" { + t.Fatalf("updated item = %+v, request=%+v, err=%v", item, writer.request, err) + } +} + +func TestServiceUpdateBoardWorkItemRejectsUnsupportedFields(t *testing.T) { + if err := validateBoardWorkItemUpdate(BoardWorkItemUpdateRequest{Revision: 7}); err == nil { + t.Fatal("validateBoardWorkItemUpdate accepted an empty mutation") + } +} diff --git a/apps/backend/internal/azuredevops/service_detail_test.go b/apps/backend/internal/azuredevops/service_detail_test.go new file mode 100644 index 0000000000..62a22948cb --- /dev/null +++ b/apps/backend/internal/azuredevops/service_detail_test.go @@ -0,0 +1,75 @@ +package azuredevops + +import ( + "context" + "errors" + "testing" +) + +type fakeDetailClient struct { + invalidClient + detail *WorkItemDetail + comments *WorkItemCommentPage + identity *Identity +} + +func (f *fakeDetailClient) TestAuth(context.Context) (*TestConnectionResult, error) { + return &TestConnectionResult{OK: true, ID: "me", DisplayName: "Ada"}, nil +} + +func (f *fakeDetailClient) GetWorkItemDetail(context.Context, string, int) (*WorkItemDetail, error) { + return f.detail, nil +} + +func (f *fakeDetailClient) ListWorkItemComments(context.Context, string, int, string) (*WorkItemCommentPage, error) { + return f.comments, nil +} + +func (f *fakeDetailClient) GetCurrentIdentity(context.Context) (*Identity, error) { + return f.identity, nil +} + +func TestServiceGetWorkItemDetail(t *testing.T) { + client := &fakeDetailClient{ + detail: &WorkItemDetail{WorkItem: WorkItem{ID: 101, Title: "Ship it"}}, + comments: &WorkItemCommentPage{Comments: []WorkItemComment{{ID: 9, Content: "Looks good"}}}, + identity: &Identity{ID: "me", DisplayName: "Ada"}, + } + service, _, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", PAT: "pat", + }); err != nil { + t.Fatalf("set config: %v", err) + } + + detail, err := service.GetWorkItemDetailForWorkspace(t.Context(), "ws-1", "project-1", 101) + if err != nil || detail.ID != 101 { + t.Fatalf("GetWorkItemDetailForWorkspace = %+v, %v", detail, err) + } + comments, err := service.ListWorkItemCommentsForWorkspace(t.Context(), "ws-1", "project-1", 101, "opaque") + if err != nil || len(comments.Comments) != 1 { + t.Fatalf("ListWorkItemCommentsForWorkspace = %+v, %v", comments, err) + } + identity, err := service.GetCurrentIdentityForWorkspace(t.Context(), "ws-1") + if err != nil || identity.ID != "me" { + t.Fatalf("GetCurrentIdentityForWorkspace = %+v, %v", identity, err) + } +} + +func TestServiceDetailCapabilitiesReportNotConfigured(t *testing.T) { + service, _, _ := newTestService(t, func(*Config, string) Client { return &invalidClient{} }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", PAT: "pat", + }); err != nil { + t.Fatalf("set config: %v", err) + } + if _, err := service.GetWorkItemDetailForWorkspace(t.Context(), "ws-1", "project-1", 101); !errors.Is(err, ErrNotConfigured) { + t.Fatalf("GetWorkItemDetailForWorkspace error = %v, want ErrNotConfigured", err) + } + if _, err := service.ListWorkItemCommentsForWorkspace(t.Context(), "ws-1", "project-1", 101, ""); !errors.Is(err, ErrNotConfigured) { + t.Fatalf("ListWorkItemCommentsForWorkspace error = %v, want ErrNotConfigured", err) + } + if _, err := service.GetCurrentIdentityForWorkspace(t.Context(), "ws-1"); !errors.Is(err, ErrNotConfigured) { + t.Fatalf("GetCurrentIdentityForWorkspace error = %v, want ErrNotConfigured", err) + } +} diff --git a/apps/backend/internal/azuredevops/service_reads.go b/apps/backend/internal/azuredevops/service_reads.go index 0aefef12c1..3c49a114c8 100644 --- a/apps/backend/internal/azuredevops/service_reads.go +++ b/apps/backend/internal/azuredevops/service_reads.go @@ -55,6 +55,12 @@ type branchClient interface { ListBranches(ctx context.Context, projectID, repositoryID string) ([]Branch, error) } +type workItemDetailClient interface { + GetWorkItemDetail(ctx context.Context, projectID string, id int) (*WorkItemDetail, error) + ListWorkItemComments(ctx context.Context, projectID string, id int, continuationToken string) (*WorkItemCommentPage, error) + GetCurrentIdentity(ctx context.Context) (*Identity, error) +} + func (s *Service) ListBranchesForWorkspace( ctx context.Context, workspaceID, organization, projectID, repositoryID string, ) ([]Branch, error) { @@ -105,6 +111,48 @@ func (s *Service) GetWorkItemForWorkspace(ctx context.Context, workspaceID, proj return client.GetWorkItem(ctx, projectID, id) } +func (s *Service) GetWorkItemDetailForWorkspace(ctx context.Context, workspaceID, projectID string, id int) (*WorkItemDetail, error) { + if strings.TrimSpace(projectID) == "" || id <= 0 { + return nil, fmt.Errorf("%w: project and positive work item id required", ErrInvalidConfig) + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + reader, ok := client.(workItemDetailClient) + if !ok { + return nil, fmt.Errorf("%w: work item detail is unavailable", ErrNotConfigured) + } + return reader.GetWorkItemDetail(ctx, projectID, id) +} + +func (s *Service) ListWorkItemCommentsForWorkspace(ctx context.Context, workspaceID, projectID string, id int, continuationToken string) (*WorkItemCommentPage, error) { + if strings.TrimSpace(projectID) == "" || id <= 0 { + return nil, fmt.Errorf("%w: project and positive work item id required", ErrInvalidConfig) + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + reader, ok := client.(workItemDetailClient) + if !ok { + return nil, fmt.Errorf("%w: work item discussion is unavailable", ErrNotConfigured) + } + return reader.ListWorkItemComments(ctx, projectID, id, continuationToken) +} + +func (s *Service) GetCurrentIdentityForWorkspace(ctx context.Context, workspaceID string) (*Identity, error) { + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + reader, ok := client.(workItemDetailClient) + if !ok { + return nil, fmt.Errorf("%w: current identity is unavailable", ErrNotConfigured) + } + return reader.GetCurrentIdentity(ctx) +} + func (s *Service) ListPullRequestsForWorkspace( ctx context.Context, workspaceID string, diff --git a/apps/backend/internal/azuredevops/service_task_work_item.go b/apps/backend/internal/azuredevops/service_task_work_item.go new file mode 100644 index 0000000000..341b3a530e --- /dev/null +++ b/apps/backend/internal/azuredevops/service_task_work_item.go @@ -0,0 +1,39 @@ +package azuredevops + +import ( + "context" + "fmt" + "strings" +) + +func (s *Service) AssociateTaskWorkItem(ctx context.Context, workspaceID, taskID, projectID string, workItemID int) (*TaskWorkItem, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if strings.TrimSpace(taskID) == "" || strings.TrimSpace(projectID) == "" || workItemID <= 0 { + return nil, fmt.Errorf("%w: task, project, and positive work item ID are required", ErrInvalidTaskPRAssociation) + } + owned, err := s.store.TaskBelongsToWorkspace(ctx, taskID, workspaceID) + if err != nil || !owned { + return nil, fmt.Errorf("%w: task belongs to another workspace", ErrInvalidTaskPRAssociation) + } + detail, err := s.GetWorkItemDetailForWorkspace(ctx, workspaceID, projectID, workItemID) + if err != nil { + return nil, fmt.Errorf("validate Azure work item: %w", err) + } + if detail.Project != "" && detail.Project != projectID { + return nil, fmt.Errorf("%w: work item belongs to another project", ErrInvalidTaskPRAssociation) + } + row := &TaskWorkItem{TaskID: taskID, WorkspaceID: workspaceID, ProjectID: projectID, WorkItemID: detail.ID, WorkItemURL: detail.WebURL, Title: detail.Title, State: detail.State, Type: detail.Type} + if err := s.store.UpsertTaskWorkItem(ctx, row); err != nil { + return nil, fmt.Errorf("upsert Azure task work item: %w", err) + } + return row, nil +} + +func (s *Service) ListTaskWorkItemsByWorkspace(ctx context.Context, workspaceID string) (map[string][]*TaskWorkItem, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + return s.store.ListTaskWorkItemsByWorkspace(ctx, workspaceID) +} diff --git a/apps/backend/internal/azuredevops/service_task_work_item_test.go b/apps/backend/internal/azuredevops/service_task_work_item_test.go new file mode 100644 index 0000000000..1650c6eef2 --- /dev/null +++ b/apps/backend/internal/azuredevops/service_task_work_item_test.go @@ -0,0 +1,31 @@ +package azuredevops + +import ( + "context" + "testing" +) + +type taskWorkItemClient struct{ fakeDetailClient } + +func TestTaskWorkItemAssociation(t *testing.T) { + client := &taskWorkItemClient{fakeDetailClient: fakeDetailClient{detail: &WorkItemDetail{WorkItem: WorkItem{ID: 101, Title: "Ship it", Project: "project-1", WebURL: "https://dev.azure.com/acme/p/_workitems/edit/101"}}}} + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := store.db.Exec(`CREATE TABLE tasks (id TEXT PRIMARY KEY, workspace_id TEXT NOT NULL)`); err != nil { + t.Fatalf("create tasks table: %v", err) + } + if _, err := store.db.Exec(`INSERT INTO tasks (id, workspace_id) VALUES ('task-1', 'ws-1')`); err != nil { + t.Fatalf("seed task: %v", err) + } + if _, err := service.SetConfigForWorkspace(context.Background(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + + row, err := service.AssociateTaskWorkItem(t.Context(), "ws-1", "task-1", "project-1", 101) + if err != nil || row.Title != "Ship it" { + t.Fatalf("AssociateTaskWorkItem = %+v, %v", row, err) + } + grouped, err := service.ListTaskWorkItemsByWorkspace(t.Context(), "ws-1") + if err != nil || len(grouped["task-1"]) != 1 || grouped["task-1"][0].ID != row.ID { + t.Fatalf("ListTaskWorkItemsByWorkspace = %+v, %v", grouped, err) + } +} diff --git a/apps/backend/internal/azuredevops/service_test.go b/apps/backend/internal/azuredevops/service_test.go index 510b63dbd4..33c2e091f8 100644 --- a/apps/backend/internal/azuredevops/service_test.go +++ b/apps/backend/internal/azuredevops/service_test.go @@ -126,6 +126,7 @@ func TestListBranchesRejectsOrganizationMismatch(t *testing.T) { }); err != nil { t.Fatalf("set config: %v", err) } + clientCalls = 0 _, err := service.ListBranchesForWorkspace(t.Context(), "ws-a", "other", "project", "repo") if !errors.Is(err, ErrInvalidConfig) { @@ -191,11 +192,57 @@ func TestConfigTestUsesSubmittedAndStoredCredentialsWithoutPersistence(t *testin if err != nil || !res.OK { t.Fatalf("stored probe: result=%+v err=%v", res, err) } - if len(captures) != 2 || captures[0].pat != "submitted" || captures[1].pat != "stored" { + if len(captures) != 3 || captures[0].pat != "submitted" || captures[1].pat != "stored" || captures[2].pat != "stored" { t.Fatalf("captured credentials: %+v", captures) } } +func TestSetConfigProbesImmediately(t *testing.T) { + probeCalls := 0 + svc, _, _ := newTestService(t, func(*Config, string) Client { + probeCalls++ + return &fakeClient{result: &TestConnectionResult{OK: true}} + }) + + config, err := svc.SetConfigForWorkspace(t.Context(), "ws-a", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", + PAT: "pat", + }) + if err != nil { + t.Fatalf("SetConfigForWorkspace() error = %v", err) + } + if probeCalls != 1 { + t.Fatalf("auth probe calls = %d, want 1", probeCalls) + } + if config.LastCheckedAt == nil || !config.LastOK || config.LastError != "" { + t.Fatalf("returned auth health = %+v, want current successful probe", config) + } +} + +func TestSetConfigPersistsProbeFailure(t *testing.T) { + svc, store, secrets := newTestService(t, func(*Config, string) Client { + return &fakeClient{result: &TestConnectionResult{OK: false, Error: "401 unauthorized"}} + }) + + config, err := svc.SetConfigForWorkspace(t.Context(), "ws-a", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", + PAT: "pat", + }) + if err != nil { + t.Fatalf("SetConfigForWorkspace() error = %v", err) + } + if config.LastCheckedAt == nil || config.LastOK || config.LastError != "401 unauthorized" { + t.Fatalf("returned auth health = %+v, want persisted probe failure", config) + } + if pat, err := secrets.Reveal(t.Context(), SecretKeyForWorkspace("ws-a")); err != nil || pat != "pat" { + t.Fatalf("stored PAT = %q, %v; want persisted credential", pat, err) + } + persisted, err := store.GetConfig(t.Context(), "ws-a") + if err != nil || persisted == nil || persisted.LastCheckedAt == nil || persisted.LastOK || persisted.LastError != "401 unauthorized" { + t.Fatalf("persisted auth health = %+v, %v", persisted, err) + } +} + func TestCopyConfigCopiesCredentialAndDeleteIsScoped(t *testing.T) { svc, store, secrets := newTestService(t, nil) ctx := context.Background() @@ -327,8 +374,12 @@ func TestSetConfigRestoresPATWhenStoreFails(t *testing.T) { } } -func TestSetConfigResetsHealthOnlyWhenCredentialsChange(t *testing.T) { - svc, store, _ := newTestService(t, nil) +func TestSetConfigProbesOnlyWhenCredentialsChange(t *testing.T) { + probeCalls := 0 + svc, store, _ := newTestService(t, func(*Config, string) Client { + probeCalls++ + return &fakeClient{result: &TestConnectionResult{OK: true}} + }) ctx := context.Background() if _, err := svc.SetConfigForWorkspace(ctx, "ws-a", &SetConfigRequest{ OrganizationURL: "https://dev.azure.com/acme", PAT: "old-pat", @@ -359,13 +410,19 @@ func TestSetConfigResetsHealthOnlyWhenCredentialsChange(t *testing.T) { t.Fatalf("update project: %v", err) } assertHealth(true, true) + if probeCalls != 1 { + t.Fatalf("auth probe calls after unchanged credentials = %d, want 1", probeCalls) + } if _, err := svc.SetConfigForWorkspace(ctx, "ws-a", &SetConfigRequest{ OrganizationURL: "https://dev.azure.com/other", }); err != nil { t.Fatalf("update organization: %v", err) } - assertHealth(false, false) + assertHealth(true, true) + if probeCalls != 2 { + t.Fatalf("auth probe calls after organization change = %d, want 2", probeCalls) + } setHealthy() if _, err := svc.SetConfigForWorkspace(ctx, "ws-a", &SetConfigRequest{ @@ -373,7 +430,10 @@ func TestSetConfigResetsHealthOnlyWhenCredentialsChange(t *testing.T) { }); err != nil { t.Fatalf("update PAT: %v", err) } - assertHealth(false, false) + assertHealth(true, true) + if probeCalls != 3 { + t.Fatalf("auth probe calls after PAT change = %d, want 3", probeCalls) + } } func TestDeleteConfigLeavesStateWhenSecretDeleteFails(t *testing.T) { @@ -425,6 +485,9 @@ func TestRecordAuthHealthIgnoresParentCancellation(t *testing.T) { }); err != nil { t.Fatalf("seed config: %v", err) } + if err := svc.Store().ResetAuthHealth(t.Context(), "ws-a"); err != nil { + t.Fatalf("reset health: %v", err) + } ctx, cancel := context.WithCancel(t.Context()) cancel() svc.RecordAuthHealthForWorkspace(ctx, "ws-a") diff --git a/apps/backend/internal/azuredevops/store.go b/apps/backend/internal/azuredevops/store.go index f5aad0de14..496987a527 100644 --- a/apps/backend/internal/azuredevops/store.go +++ b/apps/backend/internal/azuredevops/store.go @@ -27,6 +27,8 @@ const createConfigTableSQL = ` last_ok BOOLEAN NOT NULL DEFAULT 0, last_error TEXT NOT NULL DEFAULT '', saved_views TEXT NOT NULL DEFAULT '[]', + workspace_settings TEXT NOT NULL DEFAULT '{}', + workspace_settings_version INTEGER NOT NULL DEFAULT 0, created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL )` @@ -56,7 +58,109 @@ const createTaskPRTableSQL = ` UNIQUE(task_id, repository_id, azure_repository_id, pull_request_id) ); CREATE INDEX IF NOT EXISTS idx_azure_devops_task_prs_task_id - ON azure_devops_task_prs(task_id)` + ON azure_devops_task_prs(task_id)` + +const createTaskWorkItemTableSQL = ` +CREATE TABLE IF NOT EXISTS azure_devops_task_work_items ( + id TEXT PRIMARY KEY, + task_id TEXT NOT NULL, + workspace_id TEXT NOT NULL, + project_id TEXT NOT NULL, + work_item_id INTEGER NOT NULL, + work_item_url TEXT NOT NULL, + title TEXT NOT NULL, + state TEXT NOT NULL, + type TEXT NOT NULL, + created_at DATETIME NOT NULL, + updated_at DATETIME NOT NULL, + UNIQUE(task_id, workspace_id, project_id, work_item_id) +); +CREATE INDEX IF NOT EXISTS idx_azure_devops_task_work_items_task_id ON azure_devops_task_work_items(task_id); +CREATE INDEX IF NOT EXISTS idx_azure_devops_task_work_items_workspace_id ON azure_devops_task_work_items(workspace_id)` + +const createWatchTablesSQL = ` +CREATE TABLE IF NOT EXISTS azure_devops_work_item_watches ( + id TEXT PRIMARY KEY, + workspace_id TEXT NOT NULL, + workflow_id TEXT NOT NULL DEFAULT '', + workflow_step_id TEXT NOT NULL DEFAULT '', + project_id TEXT NOT NULL, + wiql TEXT NOT NULL, + repository_id TEXT NOT NULL DEFAULT '', + base_branch TEXT NOT NULL DEFAULT '', + agent_profile_id TEXT NOT NULL DEFAULT '', + executor_profile_id TEXT NOT NULL DEFAULT '', + prompt TEXT NOT NULL DEFAULT '', + enabled BOOLEAN NOT NULL DEFAULT 1, + poll_interval_seconds INTEGER NOT NULL DEFAULT 300, + cleanup_policy TEXT NOT NULL DEFAULT 'auto', + max_inflight_tasks INTEGER, + generation INTEGER NOT NULL DEFAULT 1, + deleting BOOLEAN NOT NULL DEFAULT 0, + last_error TEXT NOT NULL DEFAULT '', + last_error_at DATETIME, + last_polled_at DATETIME, + created_at DATETIME NOT NULL, + updated_at DATETIME NOT NULL +); +CREATE INDEX IF NOT EXISTS idx_azure_devops_work_item_watches_workspace + ON azure_devops_work_item_watches(workspace_id); +CREATE TABLE IF NOT EXISTS azure_devops_pull_request_watches ( + id TEXT PRIMARY KEY, + workspace_id TEXT NOT NULL, + workflow_id TEXT NOT NULL DEFAULT '', + workflow_step_id TEXT NOT NULL DEFAULT '', + project_id TEXT NOT NULL, + azure_repository_id TEXT NOT NULL DEFAULT '', + status TEXT NOT NULL DEFAULT 'active', + creator_id TEXT NOT NULL DEFAULT '', + reviewer_id TEXT NOT NULL DEFAULT '', + repository_id TEXT NOT NULL DEFAULT '', + base_branch TEXT NOT NULL DEFAULT '', + agent_profile_id TEXT NOT NULL DEFAULT '', + executor_profile_id TEXT NOT NULL DEFAULT '', + prompt TEXT NOT NULL DEFAULT '', + enabled BOOLEAN NOT NULL DEFAULT 1, + poll_interval_seconds INTEGER NOT NULL DEFAULT 300, + cleanup_policy TEXT NOT NULL DEFAULT 'auto', + max_inflight_tasks INTEGER, + generation INTEGER NOT NULL DEFAULT 1, + deleting BOOLEAN NOT NULL DEFAULT 0, + last_error TEXT NOT NULL DEFAULT '', + last_error_at DATETIME, + last_polled_at DATETIME, + created_at DATETIME NOT NULL, + updated_at DATETIME NOT NULL +); +CREATE INDEX IF NOT EXISTS idx_azure_devops_pull_request_watches_workspace + ON azure_devops_pull_request_watches(workspace_id); +CREATE TABLE IF NOT EXISTS azure_devops_work_item_watch_tasks ( + id TEXT PRIMARY KEY, + watch_id TEXT NOT NULL, + project_id TEXT NOT NULL, + work_item_id INTEGER NOT NULL, + work_item_url TEXT NOT NULL, + task_id TEXT NOT NULL DEFAULT '', + generation INTEGER NOT NULL, + created_at DATETIME NOT NULL, + UNIQUE(watch_id, generation, project_id, work_item_id) +); +CREATE INDEX IF NOT EXISTS idx_azure_devops_work_item_watch_tasks_watch + ON azure_devops_work_item_watch_tasks(watch_id); +CREATE TABLE IF NOT EXISTS azure_devops_pull_request_watch_tasks ( + id TEXT PRIMARY KEY, + watch_id TEXT NOT NULL, + project_id TEXT NOT NULL, + azure_repository_id TEXT NOT NULL, + pull_request_id INTEGER NOT NULL, + pull_request_url TEXT NOT NULL, + task_id TEXT NOT NULL DEFAULT '', + generation INTEGER NOT NULL, + created_at DATETIME NOT NULL, + UNIQUE(watch_id, generation, project_id, azure_repository_id, pull_request_id) +); +CREATE INDEX IF NOT EXISTS idx_azure_devops_pull_request_watch_tasks_watch + ON azure_devops_pull_request_watch_tasks(watch_id)` const selectConfigColumns = `workspace_id, organization_url, default_project_id, default_project_name, auth_method, last_checked_at, last_ok, last_error, @@ -77,13 +181,46 @@ func NewStore(writer, reader *sqlx.DB) (*Store, error) { if err := store.ensureSavedViewsColumn(); err != nil { return nil, fmt.Errorf("azure devops saved views schema init: %w", err) } + if err := store.ensureWorkspaceSettingsColumn(); err != nil { + return nil, fmt.Errorf("azure devops workspace settings schema init: %w", err) + } + if err := store.ensureWorkspaceSettingsVersionColumn(); err != nil { + return nil, fmt.Errorf("azure devops workspace settings version schema init: %w", err) + } if _, err := store.db.Exec(createTaskPRTableSQL); err != nil { return nil, fmt.Errorf("azure devops task PR schema init: %w", err) } + if _, err := store.db.Exec(createTaskWorkItemTableSQL); err != nil { + return nil, fmt.Errorf("azure devops task work item schema init: %w", err) + } + if _, err := store.db.Exec(createWatchTablesSQL); err != nil { + return nil, fmt.Errorf("azure devops watcher schema init: %w", err) + } return store, nil } +func (s *Store) ensureWorkspaceSettingsColumn() error { + return s.ensureConfigColumn( + "workspace_settings", + `ALTER TABLE azure_devops_configs ADD COLUMN workspace_settings TEXT NOT NULL DEFAULT '{}'`, + ) +} + +func (s *Store) ensureWorkspaceSettingsVersionColumn() error { + return s.ensureConfigColumn( + "workspace_settings_version", + `ALTER TABLE azure_devops_configs ADD COLUMN workspace_settings_version INTEGER NOT NULL DEFAULT 0`, + ) +} + func (s *Store) ensureSavedViewsColumn() error { + return s.ensureConfigColumn( + "saved_views", + `ALTER TABLE azure_devops_configs ADD COLUMN saved_views TEXT NOT NULL DEFAULT '[]'`, + ) +} + +func (s *Store) ensureConfigColumn(column, statement string) error { rows, err := s.db.Query(`PRAGMA table_info(azure_devops_configs)`) if err != nil { return err @@ -97,14 +234,14 @@ func (s *Store) ensureSavedViewsColumn() error { if scanErr := rows.Scan(&cid, &name, &columnType, ¬Null, &defaultValue, &primaryKey); scanErr != nil { return scanErr } - if name == "saved_views" { + if name == column { return rows.Err() } } if err := rows.Err(); err != nil { return err } - _, err = s.db.Exec(`ALTER TABLE azure_devops_configs ADD COLUMN saved_views TEXT NOT NULL DEFAULT '[]'`) + _, err = s.db.Exec(statement) return err } @@ -237,3 +374,70 @@ func (s *Store) PutSavedViewsJSON(ctx context.Context, workspaceID, raw string) } return nil } + +// WorkspaceSettingsSnapshot is the persisted settings payload and its optimistic-lock version. +type WorkspaceSettingsSnapshot struct { + JSON string + Version int64 +} + +func (s *Store) GetWorkspaceSettingsSnapshot(ctx context.Context, workspaceID string) (WorkspaceSettingsSnapshot, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return WorkspaceSettingsSnapshot{}, err + } + var snapshot WorkspaceSettingsSnapshot + err := s.ro.GetContext(ctx, &snapshot, + `SELECT workspace_settings AS json, workspace_settings_version AS version + FROM azure_devops_configs WHERE workspace_id = ?`, workspaceID) + if errors.Is(err, sql.ErrNoRows) { + return WorkspaceSettingsSnapshot{}, ErrNotConfigured + } + return snapshot, err +} + +func (s *Store) GetWorkspaceSettingsJSON(ctx context.Context, workspaceID string) (string, error) { + snapshot, err := s.GetWorkspaceSettingsSnapshot(ctx, workspaceID) + return snapshot.JSON, err +} + +func (s *Store) PutWorkspaceSettingsJSON(ctx context.Context, workspaceID, raw string) error { + if err := validateWorkspaceID(workspaceID); err != nil { + return err + } + result, err := s.db.ExecContext(ctx, ` + UPDATE azure_devops_configs + SET workspace_settings = ?, workspace_settings_version = workspace_settings_version + 1, updated_at = ? + WHERE workspace_id = ?`, raw, time.Now().UTC(), workspaceID) + if err != nil { + return err + } + updated, err := workspaceSettingsRowsUpdated(result) + if err != nil { + return err + } + if !updated { + return ErrNotConfigured + } + return nil +} + +// PutWorkspaceSettingsJSONIfVersion saves settings only when the caller's +// snapshot is still current. A false result means another writer won the race. +func (s *Store) PutWorkspaceSettingsJSONIfVersion(ctx context.Context, workspaceID, raw string, version int64) (bool, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return false, err + } + result, err := s.db.ExecContext(ctx, ` + UPDATE azure_devops_configs + SET workspace_settings = ?, workspace_settings_version = workspace_settings_version + 1, updated_at = ? + WHERE workspace_id = ? AND workspace_settings_version = ?`, raw, time.Now().UTC(), workspaceID, version) + if err != nil { + return false, err + } + return workspaceSettingsRowsUpdated(result) +} + +func workspaceSettingsRowsUpdated(result sql.Result) (bool, error) { + updated, err := result.RowsAffected() + return updated > 0, err +} diff --git a/apps/backend/internal/azuredevops/store_task_work_item.go b/apps/backend/internal/azuredevops/store_task_work_item.go new file mode 100644 index 0000000000..9b07001ced --- /dev/null +++ b/apps/backend/internal/azuredevops/store_task_work_item.go @@ -0,0 +1,66 @@ +package azuredevops + +import ( + "context" + "errors" + "time" + + "github.com/google/uuid" + "github.com/jmoiron/sqlx" +) + +const taskWorkItemColumns = `id, task_id, workspace_id, project_id, work_item_id, work_item_url, title, state, type, created_at, updated_at` + +func (s *Store) UpsertTaskWorkItem(ctx context.Context, row *TaskWorkItem) error { + if row == nil { + return errors.New("azure devops store: task work item is required") + } + now := time.Now().UTC() + row.UpdatedAt = now + if row.ID == "" { + row.ID = uuid.NewString() + } + if row.CreatedAt.IsZero() { + row.CreatedAt = now + } + query, args, err := sqlx.Named(`INSERT INTO azure_devops_task_work_items (`+taskWorkItemColumns+`) + VALUES (:id,:task_id,:workspace_id,:project_id,:work_item_id,:work_item_url,:title,:state,:type,:created_at,:updated_at) + ON CONFLICT(task_id, workspace_id, project_id, work_item_id) DO UPDATE SET + work_item_url=excluded.work_item_url,title=excluded.title,state=excluded.state,type=excluded.type,updated_at=excluded.updated_at + RETURNING id, created_at`, row) + if err != nil { + return err + } + return s.db.QueryRowxContext(ctx, s.db.Rebind(query), args...).Scan(&row.ID, &row.CreatedAt) +} + +func (s *Store) ListTaskWorkItemsByWorkspace(ctx context.Context, workspaceID string) (map[string][]*TaskWorkItem, error) { + var rows []TaskWorkItem + if err := s.ro.SelectContext(ctx, &rows, `SELECT `+taskWorkItemColumns+` FROM azure_devops_task_work_items WHERE workspace_id = ? ORDER BY created_at ASC`, workspaceID); err != nil { + return nil, err + } + result := make(map[string][]*TaskWorkItem) + for i := range rows { + result[rows[i].TaskID] = append(result[rows[i].TaskID], &rows[i]) + } + return result, nil +} + +func (s *Store) DeleteTaskWorkItemsByTask(ctx context.Context, taskID string) error { + _, err := s.db.ExecContext(ctx, s.db.Rebind(`DELETE FROM azure_devops_task_work_items WHERE task_id = ?`), taskID) + return err +} + +func (s *Store) DeleteTaskWorkItemsByWorkspace(ctx context.Context, workspaceID string) error { + _, err := s.db.ExecContext(ctx, s.db.Rebind(`DELETE FROM azure_devops_task_work_items WHERE workspace_id = ?`), workspaceID) + return err +} + +func (s *Store) TaskBelongsToWorkspace(ctx context.Context, taskID, workspaceID string) (bool, error) { + var found string + err := s.ro.GetContext(ctx, &found, `SELECT workspace_id FROM tasks WHERE id = ?`, taskID) + if err != nil { + return false, err + } + return found == workspaceID, nil +} diff --git a/apps/backend/internal/azuredevops/store_test.go b/apps/backend/internal/azuredevops/store_test.go index c03b464ace..9bc7498365 100644 --- a/apps/backend/internal/azuredevops/store_test.go +++ b/apps/backend/internal/azuredevops/store_test.go @@ -92,6 +92,90 @@ func TestStoreConfigReplayAndDelete(t *testing.T) { } } +func TestWorkspaceSettingsConditionalWriteRejectsStaleVersion(t *testing.T) { + db := newTestDB(t) + store, err := NewStore(db, db) + if err != nil { + t.Fatalf("new store: %v", err) + } + ctx := context.Background() + if err := store.UpsertConfig(ctx, &Config{ + WorkspaceID: "ws-a", OrganizationURL: "https://dev.azure.com/acme", AuthMethod: AuthMethodPAT, + }); err != nil { + t.Fatalf("upsert config: %v", err) + } + + snapshot, err := store.GetWorkspaceSettingsSnapshot(ctx, "ws-a") + if err != nil { + t.Fatalf("get workspace settings snapshot: %v", err) + } + if snapshot.JSON != "{}" || snapshot.Version != 0 { + t.Fatalf("initial snapshot = %+v, want empty settings at version 0", snapshot) + } + updated, err := store.PutWorkspaceSettingsJSONIfVersion(ctx, "ws-a", `{"workItemActions":[]}`, snapshot.Version) + if err != nil || !updated { + t.Fatalf("conditional write = %t, %v, want success", updated, err) + } + updated, err = store.PutWorkspaceSettingsJSONIfVersion(ctx, "ws-a", `{"pullRequestActions":[]}`, snapshot.Version) + if err != nil { + t.Fatalf("stale conditional write: %v", err) + } + if updated { + t.Fatal("stale conditional write unexpectedly succeeded") + } + + current, err := store.GetWorkspaceSettingsSnapshot(ctx, "ws-a") + if err != nil { + t.Fatalf("get current workspace settings snapshot: %v", err) + } + if current.JSON != `{"workItemActions":[]}` || current.Version != 1 { + t.Fatalf("current snapshot = %+v, want successful write at version 1", current) + } +} + +func TestWorkspaceSettingsVersionMigratesExistingConfigTable(t *testing.T) { + db := newTestDB(t) + _, err := db.Exec(` + CREATE TABLE azure_devops_configs ( + workspace_id TEXT PRIMARY KEY, + organization_url TEXT NOT NULL, + default_project_id TEXT NOT NULL DEFAULT '', + default_project_name TEXT NOT NULL DEFAULT '', + auth_method TEXT NOT NULL DEFAULT 'pat', + last_checked_at DATETIME, + last_ok BOOLEAN NOT NULL DEFAULT 0, + last_error TEXT NOT NULL DEFAULT '', + saved_views TEXT NOT NULL DEFAULT '[]', + workspace_settings TEXT NOT NULL DEFAULT '{}', + created_at DATETIME NOT NULL, + updated_at DATETIME NOT NULL + )`) + if err != nil { + t.Fatalf("create previous config schema: %v", err) + } + + store, err := NewStore(db, db) + if err != nil { + t.Fatalf("migrate config schema: %v", err) + } + ctx := context.Background() + if err := store.UpsertConfig(ctx, &Config{ + WorkspaceID: "ws-a", OrganizationURL: "https://dev.azure.com/acme", AuthMethod: AuthMethodPAT, + }); err != nil { + t.Fatalf("upsert config: %v", err) + } + snapshot, err := store.GetWorkspaceSettingsSnapshot(ctx, "ws-a") + if err != nil { + t.Fatalf("get migrated workspace settings snapshot: %v", err) + } + if snapshot.Version != 0 { + t.Fatalf("migrated settings version = %d, want 0", snapshot.Version) + } + if _, err := NewStore(db, db); err != nil { + t.Fatalf("replay migrated config schema: %v", err) + } +} + func TestStoreTaskPRSchemaAndReplay(t *testing.T) { db := newTestDB(t) if _, err := NewStore(db, db); err != nil { @@ -116,6 +200,48 @@ type taskPRStoreContract interface { DeleteTaskPRsByTask(context.Context, string) error } +type taskWorkItemStoreContract interface { + UpsertTaskWorkItem(context.Context, *TaskWorkItem) error + ListTaskWorkItemsByWorkspace(context.Context, string) (map[string][]*TaskWorkItem, error) + DeleteTaskWorkItemsByTask(context.Context, string) error + DeleteTaskWorkItemsByWorkspace(context.Context, string) error +} + +func TestStoreDeleteTaskWorkItemsIsScoped(t *testing.T) { + store, err := NewStore(newTestDB(t), nil) + if err != nil { + t.Fatalf("new store: %v", err) + } + contract, ok := any(store).(taskWorkItemStoreContract) + if !ok { + t.Fatal("Store does not implement the task work item persistence contract") + } + ctx := context.Background() + for _, row := range []*TaskWorkItem{ + {TaskID: "task-a", WorkspaceID: "workspace-a", ProjectID: "project-a", WorkItemID: 1}, + {TaskID: "task-b", WorkspaceID: "workspace-a", ProjectID: "project-a", WorkItemID: 2}, + {TaskID: "task-c", WorkspaceID: "workspace-b", ProjectID: "project-b", WorkItemID: 3}, + } { + if err := contract.UpsertTaskWorkItem(ctx, row); err != nil { + t.Fatalf("upsert task work item: %v", err) + } + } + if err := contract.DeleteTaskWorkItemsByTask(ctx, "task-a"); err != nil { + t.Fatalf("delete task work items by task: %v", err) + } + byWorkspace, err := contract.ListTaskWorkItemsByWorkspace(ctx, "workspace-a") + if err != nil || len(byWorkspace["task-a"]) != 0 || len(byWorkspace["task-b"]) != 1 { + t.Fatalf("task-scoped deletion result = %+v, err = %v", byWorkspace, err) + } + if err := contract.DeleteTaskWorkItemsByWorkspace(ctx, "workspace-a"); err != nil { + t.Fatalf("delete task work items by workspace: %v", err) + } + byWorkspace, err = contract.ListTaskWorkItemsByWorkspace(ctx, "workspace-b") + if err != nil || len(byWorkspace["task-c"]) != 1 { + t.Fatalf("workspace-scoped deletion result = %+v, err = %v", byWorkspace, err) + } +} + func TestStoreDeleteTaskPRsByTaskIsScoped(t *testing.T) { store, err := NewStore(newTestDB(t), nil) if err != nil { diff --git a/apps/backend/internal/azuredevops/store_watch_reset.go b/apps/backend/internal/azuredevops/store_watch_reset.go new file mode 100644 index 0000000000..ec0a6413c3 --- /dev/null +++ b/apps/backend/internal/azuredevops/store_watch_reset.go @@ -0,0 +1,90 @@ +package azuredevops + +import ( + "context" + "database/sql" + "errors" + "fmt" +) + +func (s *Store) BeginWorkItemWatchReset(ctx context.Context, watchID string) (*WatchResetResult, error) { + return s.beginWatchReset(ctx, "azure_devops_work_item_watches", "azure_devops_work_item_watch_tasks", watchID) +} + +func (s *Store) BeginPullRequestWatchReset(ctx context.Context, watchID string) (*WatchResetResult, error) { + return s.beginWatchReset(ctx, "azure_devops_pull_request_watches", "azure_devops_pull_request_watch_tasks", watchID) +} + +func (s *Store) beginWatchReset(ctx context.Context, watchTable, taskTable, watchID string) (*WatchResetResult, error) { + tx, err := s.db.BeginTxx(ctx, nil) + if err != nil { + return nil, err + } + defer func() { _ = tx.Rollback() }() + result, err := tx.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET generation = generation + 1, last_polled_at = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND deleting = 0`, watchTable), watchID) + if err != nil { + return nil, err + } + count, err := result.RowsAffected() + if err != nil { + return nil, err + } + if count == 0 { + return nil, ErrWatchNotFound + } + var generation int64 + if err := tx.QueryRowContext(ctx, fmt.Sprintf(`SELECT generation FROM %s WHERE id = ?`, watchTable), watchID).Scan(&generation); err != nil { + return nil, err + } + var taskIDs []string + if err := tx.SelectContext(ctx, &taskIDs, fmt.Sprintf(`SELECT task_id FROM %s WHERE watch_id = ? AND generation < ? AND task_id <> '' ORDER BY created_at`, taskTable), watchID, generation); err != nil && !errors.Is(err, sql.ErrNoRows) { + return nil, err + } + if err := tx.Commit(); err != nil { + return nil, err + } + return &WatchResetResult{Generation: generation, TaskIDs: taskIDs}, nil +} + +func (s *Store) FinishWorkItemWatchReset(ctx context.Context, watchID string, generation int64) error { + return s.finishWatchReset(ctx, "azure_devops_work_item_watches", "azure_devops_work_item_watch_tasks", watchID, generation) +} + +func (s *Store) FinishPullRequestWatchReset(ctx context.Context, watchID string, generation int64) error { + return s.finishWatchReset(ctx, "azure_devops_pull_request_watches", "azure_devops_pull_request_watch_tasks", watchID, generation) +} + +func (s *Store) finishWatchReset(ctx context.Context, watchTable, taskTable, watchID string, generation int64) error { + tx, err := s.db.BeginTxx(ctx, nil) + if err != nil { + return err + } + defer func() { _ = tx.Rollback() }() + if _, err := tx.ExecContext(ctx, fmt.Sprintf(`DELETE FROM %s WHERE watch_id = ? AND generation < ?`, taskTable), watchID, generation); err != nil { + return err + } + result, err := tx.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET last_polled_at = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND generation = ? AND deleting = 0`, watchTable), watchID, generation) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrWatchOwnershipLost + } + return tx.Commit() +} + +func (s *Store) ListWorkItemWatchTaskIDs(ctx context.Context, watchID string) ([]string, error) { + var ids []string + err := s.ro.SelectContext(ctx, &ids, `SELECT task_id FROM azure_devops_work_item_watch_tasks WHERE watch_id = ? AND task_id <> '' ORDER BY created_at`, watchID) + return ids, err +} + +func (s *Store) ListPullRequestWatchTaskIDs(ctx context.Context, watchID string) ([]string, error) { + var ids []string + err := s.ro.SelectContext(ctx, &ids, `SELECT task_id FROM azure_devops_pull_request_watch_tasks WHERE watch_id = ? AND task_id <> '' ORDER BY created_at`, watchID) + return ids, err +} diff --git a/apps/backend/internal/azuredevops/watch_cleanup.go b/apps/backend/internal/azuredevops/watch_cleanup.go new file mode 100644 index 0000000000..ce8e6d1708 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_cleanup.go @@ -0,0 +1,149 @@ +package azuredevops + +import ( + "context" + "strings" + + "go.uber.org/zap" +) + +// TaskSessionChecker reports whether a user interacted with a task beyond +// the watch's automatic start message. It is intentionally tiny so Azure can +// reuse the shared backend adapter without importing task repository types. +type TaskSessionChecker interface { + HasUserAuthoredMessage(context.Context, string) (bool, error) +} + +func (s *Service) CleanupWorkItemWatch(ctx context.Context, workspaceID, watchID string) (int, error) { + watch, err := s.authorizedWorkItemWatch(ctx, workspaceID, watchID) + if err != nil { + return 0, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return 0, err + } + return s.cleanupWorkItemWatchWithClient(ctx, watch, client), nil +} + +func (s *Service) CleanupPullRequestWatch(ctx context.Context, workspaceID, watchID string) (int, error) { + watch, err := s.authorizedPullRequestWatch(ctx, workspaceID, watchID) + if err != nil { + return 0, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return 0, err + } + return s.cleanupPullRequestWatchWithClient(ctx, watch, client), nil +} + +func (s *Service) cleanupWorkItemWatchWithClient(ctx context.Context, watch *WorkItemWatch, client Client) int { + if watch == nil || client == nil || watch.CleanupPolicy == CleanupPolicyNever { + return 0 + } + rows, err := s.store.ListWorkItemWatchTasks(ctx, watch.ID, watch.Generation) + if err != nil { + s.log.Warn("azure devops watcher: list work-item cleanup rows", zap.String("watch_id", watch.ID), zap.Error(err)) + return 0 + } + deleted := 0 + for _, row := range rows { + if row == nil || row.TaskID == "" { + continue + } + item, fetchErr := client.GetWorkItem(ctx, watch.ProjectID, row.WorkItemID) + if fetchErr != nil || item == nil || !isTerminalWorkItemState(item.State) { + continue + } + if !s.cleanupTaskAllowed(ctx, row.TaskID, watch.CleanupPolicy) { + continue + } + if s.deleteWatchTaskTree(ctx, watch.ID, row.TaskID) { + if err := s.store.DeleteWorkItemWatchTask(ctx, row.ID); err != nil { + s.log.Warn("azure devops watcher: remove work-item cleanup row", zap.String("watch_id", watch.ID), zap.String("row_id", row.ID), zap.Error(err)) + continue + } + deleted++ + } + } + return deleted +} + +func (s *Service) cleanupPullRequestWatchWithClient(ctx context.Context, watch *PullRequestWatch, client Client) int { + if watch == nil || client == nil || watch.CleanupPolicy == CleanupPolicyNever { + return 0 + } + rows, err := s.store.ListPullRequestWatchTasks(ctx, watch.ID, watch.Generation) + if err != nil { + s.log.Warn("azure devops watcher: list pull-request cleanup rows", zap.String("watch_id", watch.ID), zap.Error(err)) + return 0 + } + deleted := 0 + for _, row := range rows { + if row == nil || row.TaskID == "" { + continue + } + pullRequest, fetchErr := client.GetPullRequest(ctx, watch.ProjectID, row.AzureRepositoryID, row.PullRequestID) + if fetchErr != nil || pullRequest == nil || !isTerminalPullRequestStatus(pullRequest.Status) { + continue + } + if !s.cleanupTaskAllowed(ctx, row.TaskID, watch.CleanupPolicy) { + continue + } + if s.deleteWatchTaskTree(ctx, watch.ID, row.TaskID) { + if err := s.store.DeletePullRequestWatchTask(ctx, row.ID); err != nil { + s.log.Warn("azure devops watcher: remove pull-request cleanup row", zap.String("watch_id", watch.ID), zap.String("row_id", row.ID), zap.Error(err)) + continue + } + deleted++ + } + } + return deleted +} + +func (s *Service) cleanupTaskAllowed(ctx context.Context, taskID, policy string) bool { + if policy != CleanupPolicyAuto { + return true + } + checker := s.getTaskSessionChecker() + if checker == nil { + return true + } + authored, err := checker.HasUserAuthoredMessage(ctx, taskID) + if err != nil { + s.log.Warn("azure devops watcher: check task engagement", zap.String("task_id", taskID), zap.Error(err)) + return false + } + return !authored +} + +func (s *Service) deleteWatchTaskTree(ctx context.Context, watchID, taskID string) bool { + deleter := s.getCascadeTaskDeleter() + if deleter == nil { + return false + } + if _, err := deleter.DeleteTaskTree(ctx, taskID, true); err != nil { + s.log.Warn("azure devops watcher: terminal task cleanup failed", zap.String("watch_id", watchID), zap.String("task_id", taskID), zap.Error(err)) + return false + } + return true +} + +func isTerminalWorkItemState(state string) bool { + switch strings.ToLower(strings.TrimSpace(state)) { + case "closed", "done", "completed", "resolved", "removed": + return true + default: + return false + } +} + +func isTerminalPullRequestStatus(status string) bool { + switch strings.ToLower(strings.TrimSpace(status)) { + case "completed", "abandoned", "closed", "merged": + return true + default: + return false + } +} diff --git a/apps/backend/internal/azuredevops/watch_cleanup_test.go b/apps/backend/internal/azuredevops/watch_cleanup_test.go new file mode 100644 index 0000000000..7ae3a0b370 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_cleanup_test.go @@ -0,0 +1,112 @@ +package azuredevops + +import ( + "context" + "testing" + + taskservice "github.com/kandev/kandev/internal/task/service" +) + +type cleanupClient struct { + invalidClient + workItem *WorkItem + pullRequest *PullRequest +} + +func (c *cleanupClient) GetWorkItem(context.Context, string, int) (*WorkItem, error) { + if c.workItem == nil { + return nil, mockNotFound("work item", 0) + } + item := *c.workItem + return &item, nil +} + +func (c *cleanupClient) GetPullRequest(context.Context, string, string, int) (*PullRequest, error) { + if c.pullRequest == nil { + return nil, mockNotFound("pull request", 0) + } + pullRequest := *c.pullRequest + return &pullRequest, nil +} + +type recordingCleanupDeleter struct { + taskIDs []string +} + +func (d *recordingCleanupDeleter) DeleteTaskTree(_ context.Context, taskID string, _ bool) (*taskservice.CascadeOutcome, error) { + d.taskIDs = append(d.taskIDs, taskID) + return &taskservice.CascadeOutcome{}, nil +} + +func (d *recordingCleanupDeleter) DeleteTask(ctx context.Context, taskID string, cascade bool) (*taskservice.CascadeOutcome, error) { + d.taskIDs = append(d.taskIDs, taskID) + return &taskservice.CascadeOutcome{}, nil +} + +type recordingTaskSessionChecker struct{ authored bool } + +func (c recordingTaskSessionChecker) HasUserAuthoredMessage(context.Context, string) (bool, error) { + return c.authored, nil +} + +func TestCleanupWorkItemWatchHonorsAutoEngagementAndTerminalState(t *testing.T) { + client := &cleanupClient{workItem: &WorkItem{ID: 101, State: "Closed"}} + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + watch := &WorkItemWatch{WorkspaceID: "ws-1", ProjectID: "project-1", WIQL: "SELECT", CleanupPolicy: CleanupPolicyAuto} + if err := store.CreateWorkItemWatch(t.Context(), watch); err != nil { + t.Fatalf("create watch: %v", err) + } + if reserved, err := store.ReserveWorkItemWatchTask(t.Context(), watch.ID, watch.Generation, watch.ProjectID, 101, "https://azure/item/101"); err != nil || !reserved { + t.Fatalf("reserve: %v %v", reserved, err) + } + if err := store.AssignWorkItemWatchTaskID(t.Context(), watch.ID, watch.Generation, watch.ProjectID, 101, "task-101"); err != nil { + t.Fatalf("attach: %v", err) + } + deleter := &recordingCleanupDeleter{} + service.SetCascadeTaskDeleter(deleter) + service.SetTaskSessionChecker(recordingTaskSessionChecker{authored: true}) + if deleted, err := service.CleanupWorkItemWatch(t.Context(), "ws-1", watch.ID); err != nil || deleted != 0 { + t.Fatalf("engaged cleanup = %d, %v; want no deletion", deleted, err) + } + service.SetTaskSessionChecker(recordingTaskSessionChecker{}) + deleted, err := service.CleanupWorkItemWatch(t.Context(), "ws-1", watch.ID) + if err != nil || deleted != 1 { + t.Fatalf("terminal cleanup = %d, %v; want one deletion", deleted, err) + } + if len(deleter.taskIDs) != 1 || deleter.taskIDs[0] != "task-101" { + t.Fatalf("deleted task IDs = %v", deleter.taskIDs) + } + rows, err := store.ListWorkItemWatchTasks(t.Context(), watch.ID, watch.Generation) + if err != nil || len(rows) != 0 { + t.Fatalf("cleanup reservations = %v, %v; want empty", rows, err) + } +} + +func TestCleanupPullRequestWatchHonorsNeverPolicy(t *testing.T) { + client := &cleanupClient{pullRequest: &PullRequest{ID: 42, Status: "completed"}} + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + watch := &PullRequestWatch{WorkspaceID: "ws-1", ProjectID: "project-1", AzureRepositoryID: "azure-repo-1", CleanupPolicy: CleanupPolicyNever} + if err := store.CreatePullRequestWatch(t.Context(), watch); err != nil { + t.Fatalf("create watch: %v", err) + } + if reserved, err := store.ReservePullRequestWatchTask(t.Context(), watch.ID, watch.Generation, watch.ProjectID, watch.AzureRepositoryID, 42, "https://azure/pr/42"); err != nil || !reserved { + t.Fatalf("reserve: %v %v", reserved, err) + } + if err := store.AssignPullRequestWatchTaskID(t.Context(), watch.ID, watch.Generation, watch.ProjectID, watch.AzureRepositoryID, 42, "task-42"); err != nil { + t.Fatalf("attach: %v", err) + } + deleter := &recordingCleanupDeleter{} + service.SetCascadeTaskDeleter(deleter) + if deleted, err := service.CleanupPullRequestWatch(t.Context(), "ws-1", watch.ID); err != nil || deleted != 0 { + t.Fatalf("never cleanup = %d, %v; want no deletion", deleted, err) + } + if len(deleter.taskIDs) != 0 { + t.Fatalf("never policy deleted tasks: %v", deleter.taskIDs) + } +} diff --git a/apps/backend/internal/azuredevops/watch_dependencies.go b/apps/backend/internal/azuredevops/watch_dependencies.go new file mode 100644 index 0000000000..2f5b503783 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_dependencies.go @@ -0,0 +1,108 @@ +package azuredevops + +import ( + "context" + "fmt" + "strings" + + "github.com/kandev/kandev/internal/common/securityutil" +) + +// WatchRepositoryLookup validates the Kandev repository selected for an +// Azure watcher and supplies its default branch when the form leaves the +// branch blank. It intentionally differs from RepositoryLookup, which +// validates task↔Azure PR associations. +type WatchRepositoryLookup interface { + GetRepository(ctx context.Context, id string) (workspaceID, defaultBranch string, ok bool) +} + +// WatchDependencyValidator validates references that are used when a watcher +// creates a Kandev task. Keeping this seam narrow lets the integration remain +// independent of workflow and settings storage while still failing closed in +// production. +type WatchDependencyValidator interface { + WorkflowStepBelongs(ctx context.Context, workspaceID, workflowID, stepID string) (bool, error) + AgentProfileBelongs(ctx context.Context, workspaceID, profileID string) (bool, error) + ExecutorProfileBelongs(ctx context.Context, workspaceID, profileID string) (bool, error) +} + +func (s *Service) SetWatchRepositoryLookup(lookup WatchRepositoryLookup) { + if s == nil { + return + } + s.mu.Lock() + defer s.mu.Unlock() + s.watchRepositoryLookup = lookup +} + +func (s *Service) SetWatchDependencyValidator(validator WatchDependencyValidator) { + if s == nil { + return + } + s.mu.Lock() + defer s.mu.Unlock() + s.watchDependencyValidator = validator +} + +func (s *Service) validateWatchDependencies( + ctx context.Context, + workspaceID, workflowID, workflowStepID, agentProfileID, executorProfileID string, +) error { + if strings.TrimSpace(workspaceID) == "" || strings.TrimSpace(workflowID) == "" || + strings.TrimSpace(workflowStepID) == "" || strings.TrimSpace(agentProfileID) == "" || + strings.TrimSpace(executorProfileID) == "" { + return fmt.Errorf("%w: workflow, step, agent profile, and executor profile are required", ErrInvalidConfig) + } + s.mu.RLock() + validator := s.watchDependencyValidator + s.mu.RUnlock() + if validator == nil { + return nil + } + checks := []func() (bool, error){ + func() (bool, error) { + return validator.WorkflowStepBelongs(ctx, workspaceID, workflowID, workflowStepID) + }, + func() (bool, error) { return validator.AgentProfileBelongs(ctx, workspaceID, agentProfileID) }, + func() (bool, error) { + return validator.ExecutorProfileBelongs(ctx, workspaceID, executorProfileID) + }, + } + for _, check := range checks { + valid, err := check() + if err != nil { + return fmt.Errorf("validate Azure DevOps watcher dependencies: %w", err) + } + if !valid { + return fmt.Errorf("%w: watcher dependency does not belong to workspace", ErrInvalidConfig) + } + } + return nil +} + +func (s *Service) resolveWatchRepository( + ctx context.Context, workspaceID, repositoryID, baseBranch string, +) (string, string, error) { + repositoryID = strings.TrimSpace(repositoryID) + baseBranch = strings.TrimSpace(baseBranch) + if repositoryID == "" { + return "", "", fmt.Errorf("%w: Kandev repository is required", ErrInvalidConfig) + } + if baseBranch != "" && !securityutil.IsValidBaseBranchRef(baseBranch) { + return "", "", fmt.Errorf("%w: base branch %q is not a valid git ref", ErrInvalidConfig, baseBranch) + } + s.mu.RLock() + lookup := s.watchRepositoryLookup + s.mu.RUnlock() + if lookup == nil { + return repositoryID, baseBranch, nil + } + repoWorkspace, defaultBranch, ok := lookup.GetRepository(ctx, repositoryID) + if !ok || repoWorkspace != workspaceID { + return "", "", fmt.Errorf("%w: repository %q not found in workspace", ErrInvalidConfig, repositoryID) + } + if baseBranch == "" { + baseBranch = defaultBranch + } + return repositoryID, baseBranch, nil +} diff --git a/apps/backend/internal/azuredevops/watch_models.go b/apps/backend/internal/azuredevops/watch_models.go new file mode 100644 index 0000000000..0d0aa487fe --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_models.go @@ -0,0 +1,253 @@ +package azuredevops + +import ( + "errors" + "time" +) + +const ( + CleanupPolicyAuto = "auto" + CleanupPolicyAlways = "always" + CleanupPolicyNever = "never" + + defaultWatchPollIntervalSeconds = 300 + minWatchPollIntervalSeconds = 60 +) + +var ( + ErrWatchNotFound = errors.New("azure devops: watcher not found") + ErrWatchOwnershipLost = errors.New("azure devops: watcher ownership lost") + ErrReservationNotFound = errors.New("azure devops: watcher reservation not found") +) + +func IsValidCleanupPolicy(value string) bool { + switch value { + case "", CleanupPolicyAuto, CleanupPolicyAlways, CleanupPolicyNever: + return true + default: + return false + } +} + +func normalizeCleanupPolicy(value string) string { + if value == "" { + return CleanupPolicyAuto + } + return value +} + +func normalizePollInterval(value int) int { + if value <= 0 { + return defaultWatchPollIntervalSeconds + } + if value < minWatchPollIntervalSeconds { + return minWatchPollIntervalSeconds + } + return value +} + +func validateMaxInflightTasks(value *int) error { + if value != nil && *value < 0 { + return errors.New("max_inflight_tasks must be zero or greater") + } + return nil +} + +// WorkItemWatch configures periodic matching of Azure Boards work items. +type WorkItemWatch struct { + ID string `json:"id" db:"id"` + WorkspaceID string `json:"workspaceId" db:"workspace_id"` + WorkflowID string `json:"workflowId" db:"workflow_id"` + WorkflowStepID string `json:"workflowStepId" db:"workflow_step_id"` + ProjectID string `json:"projectId" db:"project_id"` + WIQL string `json:"wiql" db:"wiql"` + RepositoryID string `json:"repositoryId" db:"repository_id"` + BaseBranch string `json:"baseBranch" db:"base_branch"` + AgentProfileID string `json:"agentProfileId" db:"agent_profile_id"` + ExecutorProfileID string `json:"executorProfileId" db:"executor_profile_id"` + Prompt string `json:"prompt" db:"prompt"` + Enabled bool `json:"enabled" db:"enabled"` + PollIntervalSeconds int `json:"pollIntervalSeconds" db:"poll_interval_seconds"` + CleanupPolicy string `json:"cleanupPolicy" db:"cleanup_policy"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty" db:"max_inflight_tasks"` + Generation int64 `json:"-" db:"generation"` + Deleting bool `json:"-" db:"deleting"` + LastError string `json:"lastError,omitempty" db:"last_error"` + LastErrorAt *time.Time `json:"lastErrorAt,omitempty" db:"last_error_at"` + LastPolledAt *time.Time `json:"lastPolledAt,omitempty" db:"last_polled_at"` + CreatedAt time.Time `json:"createdAt" db:"created_at"` + UpdatedAt time.Time `json:"updatedAt" db:"updated_at"` +} + +// PullRequestWatch configures periodic matching of Azure Repos pull requests. +type PullRequestWatch struct { + ID string `json:"id" db:"id"` + WorkspaceID string `json:"workspaceId" db:"workspace_id"` + WorkflowID string `json:"workflowId" db:"workflow_id"` + WorkflowStepID string `json:"workflowStepId" db:"workflow_step_id"` + ProjectID string `json:"projectId" db:"project_id"` + AzureRepositoryID string `json:"azureRepositoryId,omitempty" db:"azure_repository_id"` + Status string `json:"status" db:"status"` + CreatorID string `json:"creatorId,omitempty" db:"creator_id"` + ReviewerID string `json:"reviewerId,omitempty" db:"reviewer_id"` + RepositoryID string `json:"repositoryId" db:"repository_id"` + BaseBranch string `json:"baseBranch" db:"base_branch"` + AgentProfileID string `json:"agentProfileId" db:"agent_profile_id"` + ExecutorProfileID string `json:"executorProfileId" db:"executor_profile_id"` + Prompt string `json:"prompt" db:"prompt"` + Enabled bool `json:"enabled" db:"enabled"` + PollIntervalSeconds int `json:"pollIntervalSeconds" db:"poll_interval_seconds"` + CleanupPolicy string `json:"cleanupPolicy" db:"cleanup_policy"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty" db:"max_inflight_tasks"` + Generation int64 `json:"-" db:"generation"` + Deleting bool `json:"-" db:"deleting"` + LastError string `json:"lastError,omitempty" db:"last_error"` + LastErrorAt *time.Time `json:"lastErrorAt,omitempty" db:"last_error_at"` + LastPolledAt *time.Time `json:"lastPolledAt,omitempty" db:"last_polled_at"` + CreatedAt time.Time `json:"createdAt" db:"created_at"` + UpdatedAt time.Time `json:"updatedAt" db:"updated_at"` +} + +type WatchResetResult struct { + Generation int64 + TaskIDs []string +} + +type CreateWorkItemWatchRequest struct { + WorkspaceID string `json:"workspaceId"` + WorkflowID string `json:"workflowId"` + WorkflowStepID string `json:"workflowStepId"` + ProjectID string `json:"projectId"` + WIQL string `json:"wiql"` + RepositoryID string `json:"repositoryId"` + BaseBranch string `json:"baseBranch"` + AgentProfileID string `json:"agentProfileId"` + ExecutorProfileID string `json:"executorProfileId"` + Prompt string `json:"prompt"` + PollIntervalSeconds int `json:"pollIntervalSeconds"` + CleanupPolicy string `json:"cleanupPolicy"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty"` +} + +type UpdateWorkItemWatchRequest struct { + WorkflowID *string `json:"workflowId,omitempty"` + WorkflowStepID *string `json:"workflowStepId,omitempty"` + ProjectID *string `json:"projectId,omitempty"` + WIQL *string `json:"wiql,omitempty"` + RepositoryID *string `json:"repositoryId,omitempty"` + BaseBranch *string `json:"baseBranch,omitempty"` + AgentProfileID *string `json:"agentProfileId,omitempty"` + ExecutorProfileID *string `json:"executorProfileId,omitempty"` + Prompt *string `json:"prompt,omitempty"` + Enabled *bool `json:"enabled,omitempty"` + PollIntervalSeconds *int `json:"pollIntervalSeconds,omitempty"` + CleanupPolicy *string `json:"cleanupPolicy,omitempty"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty"` +} + +type CreatePullRequestWatchRequest struct { + WorkspaceID string `json:"workspaceId"` + WorkflowID string `json:"workflowId"` + WorkflowStepID string `json:"workflowStepId"` + ProjectID string `json:"projectId"` + AzureRepositoryID string `json:"azureRepositoryId"` + Status string `json:"status"` + CreatorID string `json:"creatorId"` + ReviewerID string `json:"reviewerId"` + RepositoryID string `json:"repositoryId"` + BaseBranch string `json:"baseBranch"` + AgentProfileID string `json:"agentProfileId"` + ExecutorProfileID string `json:"executorProfileId"` + Prompt string `json:"prompt"` + PollIntervalSeconds int `json:"pollIntervalSeconds"` + CleanupPolicy string `json:"cleanupPolicy"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty"` +} + +type UpdatePullRequestWatchRequest struct { + WorkflowID *string `json:"workflowId,omitempty"` + WorkflowStepID *string `json:"workflowStepId,omitempty"` + ProjectID *string `json:"projectId,omitempty"` + AzureRepositoryID *string `json:"azureRepositoryId,omitempty"` + Status *string `json:"status,omitempty"` + CreatorID *string `json:"creatorId,omitempty"` + ReviewerID *string `json:"reviewerId,omitempty"` + RepositoryID *string `json:"repositoryId,omitempty"` + BaseBranch *string `json:"baseBranch,omitempty"` + AgentProfileID *string `json:"agentProfileId,omitempty"` + ExecutorProfileID *string `json:"executorProfileId,omitempty"` + Prompt *string `json:"prompt,omitempty"` + Enabled *bool `json:"enabled,omitempty"` + PollIntervalSeconds *int `json:"pollIntervalSeconds,omitempty"` + CleanupPolicy *string `json:"cleanupPolicy,omitempty"` + MaxInflightTasks *int `json:"maxInflightTasks,omitempty"` +} + +type WorkItemWatchEvent struct { + WatchID string + WatchGeneration int64 + WorkspaceID string + WorkflowID string + WorkflowStepID string + RepositoryID string + BaseBranch string + AgentProfileID string + ExecutorProfileID string + Prompt string + CleanupPolicy string + MaxInflightTasks *int + ProjectID string + // ReservationClaimed indicates that the bounded provider check already + // claimed the current-generation reservation before publishing this event. + // The orchestrator source still claims reservations for manually published + // events, but must not claim this one a second time. + ReservationClaimed bool + WorkItem WorkItem +} + +type PullRequestWatchEvent struct { + WatchID string + WatchGeneration int64 + WorkspaceID string + WorkflowID string + WorkflowStepID string + RepositoryID string + BaseBranch string + AgentProfileID string + ExecutorProfileID string + Prompt string + CleanupPolicy string + MaxInflightTasks *int + ProjectID string + AzureRepositoryID string + // ReservationClaimed has the same meaning as the work-item event field. + ReservationClaimed bool + PullRequest PullRequest +} + +// WorkItemWatchTask records a generation-scoped reservation made for an +// Azure Boards work item. A non-empty TaskID means the shared watcher +// dispatcher successfully created the Kandev task for this reservation. +type WorkItemWatchTask struct { + ID string `db:"id"` + WatchID string `db:"watch_id"` + ProjectID string `db:"project_id"` + WorkItemID int `db:"work_item_id"` + WorkItemURL string `db:"work_item_url"` + TaskID string `db:"task_id"` + Generation int64 `db:"generation"` + CreatedAt time.Time `db:"created_at"` +} + +// PullRequestWatchTask is the PR equivalent of WorkItemWatchTask. +type PullRequestWatchTask struct { + ID string `db:"id"` + WatchID string `db:"watch_id"` + ProjectID string `db:"project_id"` + AzureRepositoryID string `db:"azure_repository_id"` + PullRequestID int `db:"pull_request_id"` + PullRequestURL string `db:"pull_request_url"` + TaskID string `db:"task_id"` + Generation int64 `db:"generation"` + CreatedAt time.Time `db:"created_at"` +} diff --git a/apps/backend/internal/azuredevops/watch_service.go b/apps/backend/internal/azuredevops/watch_service.go new file mode 100644 index 0000000000..68d054f23f --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_service.go @@ -0,0 +1,580 @@ +package azuredevops + +import ( + "context" + "fmt" + "time" + + "go.uber.org/zap" + + "github.com/kandev/kandev/internal/events" + "github.com/kandev/kandev/internal/events/bus" +) + +type WatchTriggerResult struct { + Matched int `json:"matched"` +} + +// Reservation methods are intentionally exposed on Service so the +// orchestrator can keep provider-specific deduplication behind its watcher +// source interface. They do not accept a workspace because the reservation +// key is already scoped by the watch ID and generation; authorization happens +// before the event is published. +func (s *Service) ReserveWorkItemWatchTask(ctx context.Context, watchID string, generation int64, projectID string, workItemID int, workItemURL string) (bool, error) { + return s.store.ReserveWorkItemWatchTask(ctx, watchID, generation, projectID, workItemID, workItemURL) +} + +func (s *Service) AssignWorkItemWatchTaskID(ctx context.Context, watchID string, generation int64, projectID string, workItemID int, taskID string) error { + return s.store.AssignWorkItemWatchTaskID(ctx, watchID, generation, projectID, workItemID, taskID) +} + +func (s *Service) ReleaseWorkItemWatchTask(ctx context.Context, watchID string, generation int64, projectID string, workItemID int) error { + return s.store.ReleaseWorkItemWatchTask(ctx, watchID, generation, projectID, workItemID) +} + +func (s *Service) DisableWorkItemWatchWithError(ctx context.Context, watchID, cause string) error { + return s.store.DisableWorkItemWatchWithError(ctx, watchID, cause) +} + +func (s *Service) ReservePullRequestWatchTask(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int, pullRequestURL string) (bool, error) { + return s.store.ReservePullRequestWatchTask(ctx, watchID, generation, projectID, azureRepositoryID, pullRequestID, pullRequestURL) +} + +func (s *Service) AssignPullRequestWatchTaskID(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int, taskID string) error { + return s.store.AssignPullRequestWatchTaskID(ctx, watchID, generation, projectID, azureRepositoryID, pullRequestID, taskID) +} + +func (s *Service) ReleasePullRequestWatchTask(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int) error { + return s.store.ReleasePullRequestWatchTask(ctx, watchID, generation, projectID, azureRepositoryID, pullRequestID) +} + +func (s *Service) DisablePullRequestWatchWithError(ctx context.Context, watchID, cause string) error { + return s.store.DisablePullRequestWatchWithError(ctx, watchID, cause) +} + +func (s *Service) TriggerWorkItemWatch(ctx context.Context, workspaceID, id string) (*WatchTriggerResult, error) { + watch, err := s.authorizedWorkItemWatch(ctx, workspaceID, id) + if err != nil { + return nil, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + _ = s.store.SetWorkItemWatchError(ctx, id, err.Error(), time.Now().UTC()) + return nil, err + } + result, err := client.QueryWIQL(ctx, watch.ProjectID, watch.WIQL, 100) + if err != nil { + _ = s.store.SetWorkItemWatchError(ctx, id, err.Error(), time.Now().UTC()) + return nil, err + } + matched := 0 + publishFailed := false + for _, item := range result.Items { + reserved, reserveErr := s.store.ReserveWorkItemWatchTask(ctx, watch.ID, watch.Generation, watch.ProjectID, item.ID, item.WebURL) + if reserveErr != nil { + _ = s.store.SetWorkItemWatchError(ctx, id, reserveErr.Error(), time.Now().UTC()) + return nil, reserveErr + } + if !reserved { + continue + } + if publishErr := s.publishWorkItemWatchEvent(ctx, watch, item); publishErr != nil { + publishFailed = true + _ = s.store.ReleaseWorkItemWatchTask(ctx, watch.ID, watch.Generation, watch.ProjectID, item.ID) + _ = s.store.SetWorkItemWatchError(ctx, id, publishErr.Error(), time.Now().UTC()) + continue + } + matched++ + } + if !publishFailed { + if err := s.store.ClearWorkItemWatchError(ctx, id, time.Now().UTC()); err != nil { + return nil, err + } + } else if err := s.store.SetWorkItemWatchError(ctx, id, "one or more watcher matches could not be published", time.Now().UTC()); err != nil { + return nil, err + } + return &WatchTriggerResult{Matched: matched}, nil +} + +func (s *Service) TriggerPullRequestWatch(ctx context.Context, workspaceID, id string) (*WatchTriggerResult, error) { + watch, err := s.authorizedPullRequestWatch(ctx, workspaceID, id) + if err != nil { + return nil, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + _ = s.store.SetPullRequestWatchError(ctx, id, err.Error(), time.Now().UTC()) + return nil, err + } + result, err := client.ListPullRequests(ctx, PullRequestFilter{ + ProjectID: watch.ProjectID, RepositoryID: watch.AzureRepositoryID, + Status: watch.Status, CreatorID: watch.CreatorID, ReviewerID: watch.ReviewerID, + Top: 100, + }) + if err != nil { + _ = s.store.SetPullRequestWatchError(ctx, id, err.Error(), time.Now().UTC()) + return nil, err + } + matched := 0 + publishFailed := false + for _, pullRequest := range result.Items { + reserved, reserveErr := s.store.ReservePullRequestWatchTask(ctx, watch.ID, watch.Generation, watch.ProjectID, pullRequest.RepositoryID, pullRequest.ID, pullRequest.WebURL) + if reserveErr != nil { + _ = s.store.SetPullRequestWatchError(ctx, id, reserveErr.Error(), time.Now().UTC()) + return nil, reserveErr + } + if !reserved { + continue + } + if publishErr := s.publishPullRequestWatchEvent(ctx, watch, pullRequest); publishErr != nil { + publishFailed = true + _ = s.store.ReleasePullRequestWatchTask(ctx, watch.ID, watch.Generation, watch.ProjectID, pullRequest.RepositoryID, pullRequest.ID) + _ = s.store.SetPullRequestWatchError(ctx, id, publishErr.Error(), time.Now().UTC()) + continue + } + matched++ + } + if !publishFailed { + if err := s.store.ClearPullRequestWatchError(ctx, id, time.Now().UTC()); err != nil { + return nil, err + } + } else if err := s.store.SetPullRequestWatchError(ctx, id, "one or more watcher matches could not be published", time.Now().UTC()); err != nil { + return nil, err + } + return &WatchTriggerResult{Matched: matched}, nil +} + +func (s *Service) publishWorkItemWatchEvent(ctx context.Context, watch *WorkItemWatch, item WorkItem) error { + if s.eventBus == nil { + return nil + } + event := &WorkItemWatchEvent{ + WatchID: watch.ID, WatchGeneration: watch.Generation, WorkspaceID: watch.WorkspaceID, + WorkflowID: watch.WorkflowID, WorkflowStepID: watch.WorkflowStepID, + RepositoryID: watch.RepositoryID, BaseBranch: watch.BaseBranch, + AgentProfileID: watch.AgentProfileID, ExecutorProfileID: watch.ExecutorProfileID, + Prompt: watch.Prompt, CleanupPolicy: watch.CleanupPolicy, + MaxInflightTasks: watch.MaxInflightTasks, ProjectID: watch.ProjectID, WorkItem: item, + ReservationClaimed: true, + } + if err := s.eventBus.Publish(ctx, events.AzureDevOpsWorkItemWatchMatch, bus.NewEvent(events.AzureDevOpsWorkItemWatchMatch, "azuredevops", event)); err != nil { + s.log.Warn("azure devops: publish work-item watch event failed") + return err + } + return nil +} + +func (s *Service) publishPullRequestWatchEvent(ctx context.Context, watch *PullRequestWatch, pullRequest PullRequest) error { + if s.eventBus == nil { + return nil + } + event := &PullRequestWatchEvent{ + WatchID: watch.ID, WatchGeneration: watch.Generation, WorkspaceID: watch.WorkspaceID, + WorkflowID: watch.WorkflowID, WorkflowStepID: watch.WorkflowStepID, + RepositoryID: watch.RepositoryID, BaseBranch: watch.BaseBranch, + AgentProfileID: watch.AgentProfileID, ExecutorProfileID: watch.ExecutorProfileID, + Prompt: watch.Prompt, CleanupPolicy: watch.CleanupPolicy, + MaxInflightTasks: watch.MaxInflightTasks, ProjectID: watch.ProjectID, + AzureRepositoryID: pullRequest.RepositoryID, PullRequest: pullRequest, + ReservationClaimed: true, + } + if err := s.eventBus.Publish(ctx, events.AzureDevOpsPullRequestWatchMatch, bus.NewEvent(events.AzureDevOpsPullRequestWatchMatch, "azuredevops", event)); err != nil { + s.log.Warn("azure devops: publish pull-request watch event failed") + return err + } + return nil +} + +func (s *Service) CreateWorkItemWatch(ctx context.Context, req *CreateWorkItemWatchRequest) (*WorkItemWatch, error) { + if req == nil { + return nil, fmt.Errorf("%w: request is required", ErrInvalidConfig) + } + if err := validateWorkspaceID(req.WorkspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, req.WorkspaceID); err != nil { + return nil, err + } + if err := s.validateWatchDependencies(ctx, req.WorkspaceID, req.WorkflowID, req.WorkflowStepID, req.AgentProfileID, req.ExecutorProfileID); err != nil { + return nil, err + } + repositoryID, baseBranch, err := s.resolveWatchRepository(ctx, req.WorkspaceID, req.RepositoryID, req.BaseBranch) + if err != nil { + return nil, err + } + watch := &WorkItemWatch{ + WorkspaceID: req.WorkspaceID, WorkflowID: req.WorkflowID, WorkflowStepID: req.WorkflowStepID, + ProjectID: req.ProjectID, WIQL: req.WIQL, RepositoryID: repositoryID, + BaseBranch: baseBranch, AgentProfileID: req.AgentProfileID, + ExecutorProfileID: req.ExecutorProfileID, Prompt: req.Prompt, + PollIntervalSeconds: req.PollIntervalSeconds, CleanupPolicy: req.CleanupPolicy, + MaxInflightTasks: req.MaxInflightTasks, + } + if err := s.store.CreateWorkItemWatch(ctx, watch); err != nil { + return nil, err + } + s.triggerInitialWorkItemWatch(watch) + return watch, nil +} + +func (s *Service) ListWorkItemWatches(ctx context.Context, workspaceID string) ([]*WorkItemWatch, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } + return s.store.ListWorkItemWatches(ctx, workspaceID) +} + +func (s *Service) UpdateWorkItemWatch(ctx context.Context, workspaceID, id string, req *UpdateWorkItemWatchRequest) (*WorkItemWatch, error) { + watch, err := s.authorizedWorkItemWatch(ctx, workspaceID, id) + if err != nil { + return nil, err + } + if req != nil { + applyWorkItemWatchUpdate(watch, req) + } + if err := s.validateWatchDependencies(ctx, watch.WorkspaceID, watch.WorkflowID, watch.WorkflowStepID, watch.AgentProfileID, watch.ExecutorProfileID); err != nil { + return nil, err + } + watch.RepositoryID, watch.BaseBranch, err = s.resolveWatchRepository(ctx, watch.WorkspaceID, watch.RepositoryID, watch.BaseBranch) + if err != nil { + return nil, err + } + if err := s.store.UpdateWorkItemWatch(ctx, watch); err != nil { + return nil, err + } + return watch, nil +} + +func (s *Service) DeleteWorkItemWatch(ctx context.Context, workspaceID, id string) error { + if _, err := s.authorizedWorkItemWatch(ctx, workspaceID, id); err != nil { + return err + } + if err := s.cleanupWatchTaskTrees(ctx, id, s.store.ListWorkItemWatchTaskIDs); err != nil { + return err + } + return s.store.DeleteWorkItemWatch(ctx, id) +} + +func (s *Service) PreviewResetWorkItemWatch(ctx context.Context, workspaceID, id string) (int, error) { + if _, err := s.authorizedWorkItemWatch(ctx, workspaceID, id); err != nil { + return 0, err + } + ids, err := s.store.ListWorkItemWatchTaskIDs(ctx, id) + return len(ids), err +} + +func (s *Service) ResetWorkItemWatch(ctx context.Context, workspaceID, id string) (*WatchResetResult, error) { + if _, err := s.authorizedWorkItemWatch(ctx, workspaceID, id); err != nil { + return nil, err + } + reset, err := s.store.BeginWorkItemWatchReset(ctx, id) + if err != nil { + return nil, err + } + s.cleanupTaskIDs(ctx, id, reset.TaskIDs) + if err := s.store.FinishWorkItemWatchReset(ctx, id, reset.Generation); err != nil { + return nil, err + } + return reset, nil +} + +func (s *Service) CreatePullRequestWatch(ctx context.Context, req *CreatePullRequestWatchRequest) (*PullRequestWatch, error) { + if req == nil { + return nil, fmt.Errorf("%w: request is required", ErrInvalidConfig) + } + if err := validateWorkspaceID(req.WorkspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, req.WorkspaceID); err != nil { + return nil, err + } + if err := s.validateWatchDependencies(ctx, req.WorkspaceID, req.WorkflowID, req.WorkflowStepID, req.AgentProfileID, req.ExecutorProfileID); err != nil { + return nil, err + } + repositoryID, baseBranch, err := s.resolveWatchRepository(ctx, req.WorkspaceID, req.RepositoryID, req.BaseBranch) + if err != nil { + return nil, err + } + watch := &PullRequestWatch{ + WorkspaceID: req.WorkspaceID, WorkflowID: req.WorkflowID, WorkflowStepID: req.WorkflowStepID, + ProjectID: req.ProjectID, AzureRepositoryID: req.AzureRepositoryID, Status: req.Status, + CreatorID: req.CreatorID, ReviewerID: req.ReviewerID, RepositoryID: repositoryID, + BaseBranch: baseBranch, AgentProfileID: req.AgentProfileID, + ExecutorProfileID: req.ExecutorProfileID, Prompt: req.Prompt, + PollIntervalSeconds: req.PollIntervalSeconds, CleanupPolicy: req.CleanupPolicy, + MaxInflightTasks: req.MaxInflightTasks, + } + if err := s.store.CreatePullRequestWatch(ctx, watch); err != nil { + return nil, err + } + s.triggerInitialPullRequestWatch(watch) + return watch, nil +} + +func (s *Service) triggerInitialWorkItemWatch(watch *WorkItemWatch) { + if watch == nil { + return + } + go func() { + if _, err := s.TriggerWorkItemWatch(context.Background(), watch.WorkspaceID, watch.ID); err != nil { + s.log.Warn("azure devops watcher: initial work-item check failed", zap.String("watch_id", watch.ID), zap.Error(err)) + } + }() +} + +func (s *Service) triggerInitialPullRequestWatch(watch *PullRequestWatch) { + if watch == nil { + return + } + go func() { + if _, err := s.TriggerPullRequestWatch(context.Background(), watch.WorkspaceID, watch.ID); err != nil { + s.log.Warn("azure devops watcher: initial pull-request check failed", zap.String("watch_id", watch.ID), zap.Error(err)) + } + }() +} + +func (s *Service) ListPullRequestWatches(ctx context.Context, workspaceID string) ([]*PullRequestWatch, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } + return s.store.ListPullRequestWatches(ctx, workspaceID) +} + +func (s *Service) UpdatePullRequestWatch(ctx context.Context, workspaceID, id string, req *UpdatePullRequestWatchRequest) (*PullRequestWatch, error) { + watch, err := s.authorizedPullRequestWatch(ctx, workspaceID, id) + if err != nil { + return nil, err + } + if req != nil { + applyPullRequestWatchUpdate(watch, req) + } + if err := s.validateWatchDependencies(ctx, watch.WorkspaceID, watch.WorkflowID, watch.WorkflowStepID, watch.AgentProfileID, watch.ExecutorProfileID); err != nil { + return nil, err + } + watch.RepositoryID, watch.BaseBranch, err = s.resolveWatchRepository(ctx, watch.WorkspaceID, watch.RepositoryID, watch.BaseBranch) + if err != nil { + return nil, err + } + if err := s.store.UpdatePullRequestWatch(ctx, watch); err != nil { + return nil, err + } + return watch, nil +} + +func (s *Service) DeletePullRequestWatch(ctx context.Context, workspaceID, id string) error { + if _, err := s.authorizedPullRequestWatch(ctx, workspaceID, id); err != nil { + return err + } + if err := s.cleanupWatchTaskTrees(ctx, id, s.store.ListPullRequestWatchTaskIDs); err != nil { + return err + } + return s.store.DeletePullRequestWatch(ctx, id) +} + +func (s *Service) PreviewResetPullRequestWatch(ctx context.Context, workspaceID, id string) (int, error) { + if _, err := s.authorizedPullRequestWatch(ctx, workspaceID, id); err != nil { + return 0, err + } + ids, err := s.store.ListPullRequestWatchTaskIDs(ctx, id) + return len(ids), err +} + +func (s *Service) ResetPullRequestWatch(ctx context.Context, workspaceID, id string) (*WatchResetResult, error) { + if _, err := s.authorizedPullRequestWatch(ctx, workspaceID, id); err != nil { + return nil, err + } + reset, err := s.store.BeginPullRequestWatchReset(ctx, id) + if err != nil { + return nil, err + } + s.cleanupTaskIDs(ctx, id, reset.TaskIDs) + if err := s.store.FinishPullRequestWatchReset(ctx, id, reset.Generation); err != nil { + return nil, err + } + return reset, nil +} + +func (s *Service) cleanupWatchTaskTrees(ctx context.Context, watchID string, list func(context.Context, string) ([]string, error)) error { + ids, err := list(ctx, watchID) + if err != nil { + return err + } + s.cleanupTaskIDs(ctx, watchID, ids) + return nil +} + +func (s *Service) cleanupTaskIDs(ctx context.Context, watchID string, ids []string) { + deleter := s.getCascadeTaskDeleter() + if deleter == nil { + return + } + for _, taskID := range ids { + if taskID == "" { + continue + } + if _, err := deleter.DeleteTaskTree(ctx, taskID, true); err != nil { + s.log.Warn("azure devops watcher: task cleanup failed", zap.String("watch_id", watchID), zap.String("task_id", taskID), zap.Error(err)) + } + } +} + +func (s *Service) authorizedWorkItemWatch(ctx context.Context, workspaceID, id string) (*WorkItemWatch, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } + watch, err := s.store.GetWorkItemWatch(ctx, id) + if err != nil || watch == nil || watch.WorkspaceID != workspaceID || watch.Deleting { + return nil, ErrWatchNotFound + } + return watch, nil +} + +func (s *Service) authorizedPullRequestWatch(ctx context.Context, workspaceID, id string) (*PullRequestWatch, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } + watch, err := s.store.GetPullRequestWatch(ctx, id) + if err != nil || watch == nil || watch.WorkspaceID != workspaceID || watch.Deleting { + return nil, ErrWatchNotFound + } + return watch, nil +} + +func applyWorkItemWatchUpdate(watch *WorkItemWatch, req *UpdateWorkItemWatchRequest) { + if req.WorkflowID != nil { + watch.WorkflowID = *req.WorkflowID + } + if req.WorkflowStepID != nil { + watch.WorkflowStepID = *req.WorkflowStepID + } + if req.ProjectID != nil { + watch.ProjectID = *req.ProjectID + } + if req.WIQL != nil { + watch.WIQL = *req.WIQL + } + if req.RepositoryID != nil { + watch.RepositoryID = *req.RepositoryID + } + if req.BaseBranch != nil { + watch.BaseBranch = *req.BaseBranch + } + if req.AgentProfileID != nil { + watch.AgentProfileID = *req.AgentProfileID + } + if req.ExecutorProfileID != nil { + watch.ExecutorProfileID = *req.ExecutorProfileID + } + if req.Prompt != nil { + watch.Prompt = *req.Prompt + } + if req.Enabled != nil { + watch.Enabled = *req.Enabled + } + if req.PollIntervalSeconds != nil { + watch.PollIntervalSeconds = *req.PollIntervalSeconds + } + if req.CleanupPolicy != nil { + watch.CleanupPolicy = *req.CleanupPolicy + } + if req.MaxInflightTasks != nil { + if *req.MaxInflightTasks == 0 { + watch.MaxInflightTasks = nil + } else { + watch.MaxInflightTasks = req.MaxInflightTasks + } + } +} + +func applyPullRequestWatchUpdate(watch *PullRequestWatch, req *UpdatePullRequestWatchRequest) { + applyPullRequestWatchFilters(watch, req) + if req.WorkflowID != nil { + watch.WorkflowID = *req.WorkflowID + } + if req.WorkflowStepID != nil { + watch.WorkflowStepID = *req.WorkflowStepID + } + if req.ProjectID != nil { + watch.ProjectID = *req.ProjectID + } + if req.RepositoryID != nil { + watch.RepositoryID = *req.RepositoryID + } + if req.BaseBranch != nil { + watch.BaseBranch = *req.BaseBranch + } + if req.AgentProfileID != nil { + watch.AgentProfileID = *req.AgentProfileID + } + if req.ExecutorProfileID != nil { + watch.ExecutorProfileID = *req.ExecutorProfileID + } + if req.Prompt != nil { + watch.Prompt = *req.Prompt + } + applyWatchRuntimeUpdate( + &watch.Enabled, + &watch.PollIntervalSeconds, + &watch.CleanupPolicy, + &watch.MaxInflightTasks, + req.Enabled, + req.PollIntervalSeconds, + req.CleanupPolicy, + req.MaxInflightTasks, + ) +} + +func applyPullRequestWatchFilters(watch *PullRequestWatch, req *UpdatePullRequestWatchRequest) { + if req.AzureRepositoryID != nil { + watch.AzureRepositoryID = *req.AzureRepositoryID + } + if req.Status != nil { + watch.Status = *req.Status + } + if req.CreatorID != nil { + watch.CreatorID = *req.CreatorID + } + if req.ReviewerID != nil { + watch.ReviewerID = *req.ReviewerID + } +} + +func applyWatchRuntimeUpdate( + enabled *bool, + pollInterval *int, + cleanupPolicy *string, + maxInflight **int, + requestedEnabled *bool, + requestedPollInterval *int, + requestedCleanupPolicy *string, + requestedMaxInflight *int, +) { + if requestedEnabled != nil { + *enabled = *requestedEnabled + } + if requestedPollInterval != nil { + *pollInterval = *requestedPollInterval + } + if requestedCleanupPolicy != nil { + *cleanupPolicy = *requestedCleanupPolicy + } + if requestedMaxInflight != nil { + if *requestedMaxInflight == 0 { + *maxInflight = nil + } else { + *maxInflight = requestedMaxInflight + } + } +} diff --git a/apps/backend/internal/azuredevops/watch_service_test.go b/apps/backend/internal/azuredevops/watch_service_test.go new file mode 100644 index 0000000000..f8d1606751 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_service_test.go @@ -0,0 +1,108 @@ +package azuredevops + +import ( + "context" + "testing" + + "github.com/kandev/kandev/internal/common/logger" + "github.com/kandev/kandev/internal/events" + "github.com/kandev/kandev/internal/events/bus" +) + +func TestTriggerWorkItemWatchPublishesOnlyNewMatches(t *testing.T) { + client := &fakeReadClient{work: &WorkItemSearchResult{Items: []WorkItem{{ID: 101, Title: "Fix build", WebURL: "https://azure/item/101"}}}} + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + watch := &WorkItemWatch{WorkspaceID: "ws-1", ProjectID: "project-1", WIQL: "SELECT [System.Id] FROM WorkItems"} + if err := store.CreateWorkItemWatch(t.Context(), watch); err != nil { + t.Fatalf("create watch: %v", err) + } + eventBus := bus.NewMemoryEventBus(logger.Default()) + service.SetEventBus(eventBus) + seen := make(chan *WorkItemWatchEvent, 1) + _, err := eventBus.Subscribe(events.AzureDevOpsWorkItemWatchMatch, func(_ context.Context, event *bus.Event) error { + payload, ok := event.Data.(*WorkItemWatchEvent) + if !ok { + t.Fatalf("event payload = %T", event.Data) + } + seen <- payload + return nil + }) + if err != nil { + t.Fatalf("subscribe: %v", err) + } + result, err := service.TriggerWorkItemWatch(t.Context(), "ws-1", watch.ID) + if err != nil || result.Matched != 1 { + t.Fatalf("trigger result = %+v err=%v", result, err) + } + select { + case event := <-seen: + if event.WorkItem.ID != 101 || event.WatchGeneration != watch.Generation { + t.Fatalf("watch event = %+v", event) + } + default: + t.Fatal("expected work-item watch event") + } + result, err = service.TriggerWorkItemWatch(t.Context(), "ws-1", watch.ID) + if err != nil || result.Matched != 0 { + t.Fatalf("duplicate trigger result = %+v err=%v", result, err) + } +} + +func TestTriggerPullRequestWatchPublishesOnlyNewMatches(t *testing.T) { + client := &fakeReadClient{prPage: &PullRequestPage{Items: []PullRequest{{ID: 42, ProjectID: "project-1", RepositoryID: "azure-repo-1", WebURL: "https://azure/pr/42", Title: "Ship it"}}}} + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + watch := &PullRequestWatch{WorkspaceID: "ws-1", ProjectID: "project-1", AzureRepositoryID: "azure-repo-1", Status: "active"} + if err := store.CreatePullRequestWatch(t.Context(), watch); err != nil { + t.Fatalf("create watch: %v", err) + } + eventBus := bus.NewMemoryEventBus(logger.Default()) + service.SetEventBus(eventBus) + seen := make(chan *PullRequestWatchEvent, 1) + if _, err := eventBus.Subscribe(events.AzureDevOpsPullRequestWatchMatch, func(_ context.Context, event *bus.Event) error { + seen <- event.Data.(*PullRequestWatchEvent) + return nil + }); err != nil { + t.Fatalf("subscribe: %v", err) + } + result, err := service.TriggerPullRequestWatch(t.Context(), "ws-1", watch.ID) + if err != nil || result.Matched != 1 { + t.Fatalf("trigger result = %+v err=%v", result, err) + } + select { + case event := <-seen: + if event.PullRequest.ID != 42 || event.AzureRepositoryID != "azure-repo-1" { + t.Fatalf("watch event = %+v", event) + } + default: + t.Fatal("expected pull-request watch event") + } +} + +func TestAzurePollerRunsEnabledWatchers(t *testing.T) { + client := &fakeReadClient{ + work: &WorkItemSearchResult{Items: []WorkItem{{ID: 101, WebURL: "https://azure/item/101"}}}, + prPage: &PullRequestPage{Items: []PullRequest{{ID: 42, ProjectID: "project-1", RepositoryID: "azure-repo-1", WebURL: "https://azure/pr/42"}}}, + } + service, store, _ := newTestService(t, func(*Config, string) Client { return client }) + if _, err := service.SetConfigForWorkspace(t.Context(), "ws-1", &SetConfigRequest{OrganizationURL: "https://dev.azure.com/acme", PAT: "pat"}); err != nil { + t.Fatalf("set config: %v", err) + } + workWatch := &WorkItemWatch{WorkspaceID: "ws-1", ProjectID: "project-1", WIQL: "SELECT [System.Id] FROM WorkItems"} + prWatch := &PullRequestWatch{WorkspaceID: "ws-1", ProjectID: "project-1", AzureRepositoryID: "azure-repo-1"} + if err := store.CreateWorkItemWatch(t.Context(), workWatch); err != nil { + t.Fatalf("create work watch: %v", err) + } + if err := store.CreatePullRequestWatch(t.Context(), prWatch); err != nil { + t.Fatalf("create PR watch: %v", err) + } + poller := NewPoller(service, logger.Default()) + if matched := poller.runWatchChecks(t.Context()); matched != 2 { + t.Fatalf("matched = %d, want 2", matched) + } +} diff --git a/apps/backend/internal/azuredevops/watch_store.go b/apps/backend/internal/azuredevops/watch_store.go new file mode 100644 index 0000000000..48a0bff9a4 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_store.go @@ -0,0 +1,514 @@ +package azuredevops + +import ( + "context" + "database/sql" + "errors" + "fmt" + "time" + + "github.com/google/uuid" +) + +func normalizeWatchIdentity(id string) string { + if id == "" { + return uuid.NewString() + } + return id +} + +func normalizeWorkItemWatch(watch *WorkItemWatch) error { + if watch == nil || watch.WorkspaceID == "" || watch.ProjectID == "" || watch.WIQL == "" { + return fmt.Errorf("%w: workspace, project, and WIQL are required", ErrInvalidConfig) + } + if !IsValidCleanupPolicy(watch.CleanupPolicy) { + return fmt.Errorf("%w: invalid cleanup policy", ErrInvalidConfig) + } + if err := validateMaxInflightTasks(watch.MaxInflightTasks); err != nil { + return fmt.Errorf("%w: %v", ErrInvalidConfig, err) + } + watch.ID = normalizeWatchIdentity(watch.ID) + watch.PollIntervalSeconds = normalizePollInterval(watch.PollIntervalSeconds) + watch.CleanupPolicy = normalizeCleanupPolicy(watch.CleanupPolicy) + if watch.Generation <= 0 { + watch.Generation = 1 + } + return nil +} + +func normalizePullRequestWatch(watch *PullRequestWatch) error { + if watch == nil || watch.WorkspaceID == "" || watch.ProjectID == "" { + return fmt.Errorf("%w: workspace and project are required", ErrInvalidConfig) + } + if !IsValidCleanupPolicy(watch.CleanupPolicy) { + return fmt.Errorf("%w: invalid cleanup policy", ErrInvalidConfig) + } + if err := validateMaxInflightTasks(watch.MaxInflightTasks); err != nil { + return fmt.Errorf("%w: %v", ErrInvalidConfig, err) + } + watch.ID = normalizeWatchIdentity(watch.ID) + watch.PollIntervalSeconds = normalizePollInterval(watch.PollIntervalSeconds) + watch.CleanupPolicy = normalizeCleanupPolicy(watch.CleanupPolicy) + if watch.Status == "" { + watch.Status = activePullRequestState + } + if watch.Generation <= 0 { + watch.Generation = 1 + } + return nil +} + +func (s *Store) CreateWorkItemWatch(ctx context.Context, watch *WorkItemWatch) error { + if err := normalizeWorkItemWatch(watch); err != nil { + return err + } + watch.Enabled = true + now := time.Now().UTC() + if watch.CreatedAt.IsZero() { + watch.CreatedAt = now + } + watch.UpdatedAt = now + _, err := s.db.ExecContext(ctx, ` + INSERT INTO azure_devops_work_item_watches + (id, workspace_id, workflow_id, workflow_step_id, project_id, wiql, + repository_id, base_branch, agent_profile_id, executor_profile_id, prompt, + enabled, poll_interval_seconds, cleanup_policy, max_inflight_tasks, + generation, deleting, last_error, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, + watch.ID, watch.WorkspaceID, watch.WorkflowID, watch.WorkflowStepID, + watch.ProjectID, watch.WIQL, watch.RepositoryID, watch.BaseBranch, + watch.AgentProfileID, watch.ExecutorProfileID, watch.Prompt, watch.Enabled, + watch.PollIntervalSeconds, watch.CleanupPolicy, watch.MaxInflightTasks, + watch.Generation, watch.Deleting, watch.LastError, watch.CreatedAt, watch.UpdatedAt) + return err +} + +func (s *Store) GetWorkItemWatch(ctx context.Context, id string) (*WorkItemWatch, error) { + var watch WorkItemWatch + err := s.ro.GetContext(ctx, &watch, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, wiql, repository_id, base_branch, + agent_profile_id, executor_profile_id, prompt, enabled, + poll_interval_seconds, cleanup_policy, max_inflight_tasks, generation, + deleting, last_error, last_error_at, last_polled_at, created_at, updated_at + FROM azure_devops_work_item_watches WHERE id = ?`, id) + if errors.Is(err, sql.ErrNoRows) { + return nil, nil + } + if err != nil { + return nil, err + } + return &watch, nil +} + +func (s *Store) ListWorkItemWatches(ctx context.Context, workspaceID string) ([]*WorkItemWatch, error) { + var watches []*WorkItemWatch + err := s.ro.SelectContext(ctx, &watches, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, wiql, repository_id, base_branch, + agent_profile_id, executor_profile_id, prompt, enabled, + poll_interval_seconds, cleanup_policy, max_inflight_tasks, generation, + deleting, last_error, last_error_at, last_polled_at, created_at, updated_at + FROM azure_devops_work_item_watches WHERE workspace_id = ? AND deleting = 0 + ORDER BY created_at, id`, workspaceID) + return watches, err +} + +func (s *Store) ListEnabledWorkItemWatches(ctx context.Context) ([]*WorkItemWatch, error) { + var watches []*WorkItemWatch + err := s.ro.SelectContext(ctx, &watches, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, wiql, repository_id, base_branch, + agent_profile_id, executor_profile_id, prompt, enabled, + poll_interval_seconds, cleanup_policy, max_inflight_tasks, generation, + deleting, last_error, last_error_at, last_polled_at, created_at, updated_at + FROM azure_devops_work_item_watches WHERE enabled = 1 AND deleting = 0 + ORDER BY last_polled_at IS NOT NULL, last_polled_at, id`) + return watches, err +} + +func (s *Store) UpdateWorkItemWatch(ctx context.Context, watch *WorkItemWatch) error { + if err := normalizeWorkItemWatch(watch); err != nil { + return err + } + watch.UpdatedAt = time.Now().UTC() + result, err := s.db.ExecContext(ctx, `UPDATE azure_devops_work_item_watches SET + workflow_id = ?, workflow_step_id = ?, project_id = ?, wiql = ?, + repository_id = ?, base_branch = ?, agent_profile_id = ?, + executor_profile_id = ?, prompt = ?, enabled = ?, poll_interval_seconds = ?, + cleanup_policy = ?, max_inflight_tasks = ?, updated_at = ? + WHERE id = ? AND deleting = 0`, + watch.WorkflowID, watch.WorkflowStepID, watch.ProjectID, watch.WIQL, + watch.RepositoryID, watch.BaseBranch, watch.AgentProfileID, + watch.ExecutorProfileID, watch.Prompt, watch.Enabled, watch.PollIntervalSeconds, + watch.CleanupPolicy, watch.MaxInflightTasks, watch.UpdatedAt, watch.ID) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrWatchNotFound + } + return nil +} + +func (s *Store) CreatePullRequestWatch(ctx context.Context, watch *PullRequestWatch) error { + if err := normalizePullRequestWatch(watch); err != nil { + return err + } + watch.Enabled = true + now := time.Now().UTC() + if watch.CreatedAt.IsZero() { + watch.CreatedAt = now + } + watch.UpdatedAt = now + _, err := s.db.ExecContext(ctx, ` + INSERT INTO azure_devops_pull_request_watches + (id, workspace_id, workflow_id, workflow_step_id, project_id, + azure_repository_id, status, creator_id, reviewer_id, repository_id, + base_branch, agent_profile_id, executor_profile_id, prompt, enabled, + poll_interval_seconds, cleanup_policy, max_inflight_tasks, generation, + deleting, last_error, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, + watch.ID, watch.WorkspaceID, watch.WorkflowID, watch.WorkflowStepID, + watch.ProjectID, watch.AzureRepositoryID, watch.Status, watch.CreatorID, + watch.ReviewerID, watch.RepositoryID, watch.BaseBranch, watch.AgentProfileID, + watch.ExecutorProfileID, watch.Prompt, watch.Enabled, watch.PollIntervalSeconds, + watch.CleanupPolicy, watch.MaxInflightTasks, watch.Generation, watch.Deleting, + watch.LastError, watch.CreatedAt, watch.UpdatedAt) + return err +} + +func (s *Store) GetPullRequestWatch(ctx context.Context, id string) (*PullRequestWatch, error) { + var watch PullRequestWatch + err := s.ro.GetContext(ctx, &watch, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, azure_repository_id, status, creator_id, + reviewer_id, repository_id, base_branch, agent_profile_id, + executor_profile_id, prompt, enabled, poll_interval_seconds, cleanup_policy, + max_inflight_tasks, generation, deleting, last_error, last_error_at, + last_polled_at, created_at, updated_at + FROM azure_devops_pull_request_watches WHERE id = ?`, id) + if errors.Is(err, sql.ErrNoRows) { + return nil, nil + } + if err != nil { + return nil, err + } + return &watch, nil +} + +func (s *Store) ListPullRequestWatches(ctx context.Context, workspaceID string) ([]*PullRequestWatch, error) { + var watches []*PullRequestWatch + err := s.ro.SelectContext(ctx, &watches, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, azure_repository_id, status, creator_id, + reviewer_id, repository_id, base_branch, agent_profile_id, + executor_profile_id, prompt, enabled, poll_interval_seconds, cleanup_policy, + max_inflight_tasks, generation, deleting, last_error, last_error_at, + last_polled_at, created_at, updated_at + FROM azure_devops_pull_request_watches WHERE workspace_id = ? AND deleting = 0 + ORDER BY created_at, id`, workspaceID) + return watches, err +} + +func (s *Store) ListEnabledPullRequestWatches(ctx context.Context) ([]*PullRequestWatch, error) { + var watches []*PullRequestWatch + err := s.ro.SelectContext(ctx, &watches, `SELECT id, workspace_id, workflow_id, + workflow_step_id, project_id, azure_repository_id, status, creator_id, + reviewer_id, repository_id, base_branch, agent_profile_id, + executor_profile_id, prompt, enabled, poll_interval_seconds, cleanup_policy, + max_inflight_tasks, generation, deleting, last_error, last_error_at, + last_polled_at, created_at, updated_at + FROM azure_devops_pull_request_watches WHERE enabled = 1 AND deleting = 0 + ORDER BY last_polled_at IS NOT NULL, last_polled_at, id`) + return watches, err +} + +func (s *Store) UpdatePullRequestWatch(ctx context.Context, watch *PullRequestWatch) error { + if err := normalizePullRequestWatch(watch); err != nil { + return err + } + watch.UpdatedAt = time.Now().UTC() + result, err := s.db.ExecContext(ctx, `UPDATE azure_devops_pull_request_watches SET + workflow_id = ?, workflow_step_id = ?, project_id = ?, azure_repository_id = ?, + status = ?, creator_id = ?, reviewer_id = ?, repository_id = ?, base_branch = ?, + agent_profile_id = ?, executor_profile_id = ?, prompt = ?, enabled = ?, + poll_interval_seconds = ?, cleanup_policy = ?, max_inflight_tasks = ?, + updated_at = ? WHERE id = ? AND deleting = 0`, + watch.WorkflowID, watch.WorkflowStepID, watch.ProjectID, watch.AzureRepositoryID, + watch.Status, watch.CreatorID, watch.ReviewerID, watch.RepositoryID, + watch.BaseBranch, watch.AgentProfileID, watch.ExecutorProfileID, watch.Prompt, + watch.Enabled, watch.PollIntervalSeconds, watch.CleanupPolicy, + watch.MaxInflightTasks, watch.UpdatedAt, watch.ID) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrWatchNotFound + } + return nil +} + +func (s *Store) SetWorkItemWatchError(ctx context.Context, id, message string, checkedAt time.Time) error { + return s.setWatchError(ctx, "azure_devops_work_item_watches", id, message, checkedAt) +} + +func (s *Store) SetPullRequestWatchError(ctx context.Context, id, message string, checkedAt time.Time) error { + return s.setWatchError(ctx, "azure_devops_pull_request_watches", id, message, checkedAt) +} + +func (s *Store) setWatchError(ctx context.Context, table, id, message string, checkedAt time.Time) error { + _, err := s.db.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET last_error = ?, last_error_at = ?, last_polled_at = ?, updated_at = ? WHERE id = ? AND deleting = 0`, table), message, checkedAt, checkedAt, checkedAt, id) + return err +} + +func (s *Store) ClearWorkItemWatchError(ctx context.Context, id string, polledAt time.Time) error { + return s.clearWatchError(ctx, "azure_devops_work_item_watches", id, polledAt) +} + +func (s *Store) ClearPullRequestWatchError(ctx context.Context, id string, polledAt time.Time) error { + return s.clearWatchError(ctx, "azure_devops_pull_request_watches", id, polledAt) +} + +func (s *Store) clearWatchError(ctx context.Context, table, id string, polledAt time.Time) error { + _, err := s.db.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET last_error = '', last_error_at = NULL, last_polled_at = ?, updated_at = ? WHERE id = ? AND deleting = 0`, table), polledAt, polledAt, id) + return err +} + +func (s *Store) DisableWorkItemWatchWithError(ctx context.Context, id, cause string) error { + return s.disableWatchWithError(ctx, "azure_devops_work_item_watches", id, cause) +} + +func (s *Store) DisablePullRequestWatchWithError(ctx context.Context, id, cause string) error { + return s.disableWatchWithError(ctx, "azure_devops_pull_request_watches", id, cause) +} + +func (s *Store) disableWatchWithError(ctx context.Context, table, id, cause string) error { + result, err := s.db.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET enabled = 0, last_error = ?, last_error_at = ?, updated_at = ? WHERE id = ? AND deleting = 0`, table), cause, time.Now().UTC(), time.Now().UTC(), id) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrWatchNotFound + } + return nil +} + +func (s *Store) DeleteWorkItemWatch(ctx context.Context, id string) error { + return s.deleteWatch(ctx, "azure_devops_work_item_watches", "azure_devops_work_item_watch_tasks", id) +} + +func (s *Store) DeletePullRequestWatch(ctx context.Context, id string) error { + return s.deleteWatch(ctx, "azure_devops_pull_request_watches", "azure_devops_pull_request_watch_tasks", id) +} + +func (s *Store) deleteWatch(ctx context.Context, watchTable, taskTable, id string) error { + tx, err := s.db.BeginTx(ctx, nil) + if err != nil { + return err + } + defer func() { _ = tx.Rollback() }() + if _, err := tx.ExecContext(ctx, fmt.Sprintf(`DELETE FROM %s WHERE watch_id = ?`, taskTable), id); err != nil { + return err + } + result, err := tx.ExecContext(ctx, fmt.Sprintf(`DELETE FROM %s WHERE id = ?`, watchTable), id) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrWatchNotFound + } + return tx.Commit() +} + +func (s *Store) DeleteWorkItemWatchTasksByTask(ctx context.Context, taskID string) error { + _, err := s.db.ExecContext(ctx, `DELETE FROM azure_devops_work_item_watch_tasks WHERE task_id = ?`, taskID) + return err +} + +func (s *Store) DeletePullRequestWatchTasksByTask(ctx context.Context, taskID string) error { + _, err := s.db.ExecContext(ctx, `DELETE FROM azure_devops_pull_request_watch_tasks WHERE task_id = ?`, taskID) + return err +} + +func (s *Store) DeleteWatchesByWorkspace(ctx context.Context, workspaceID string) error { + tx, err := s.db.BeginTx(ctx, nil) + if err != nil { + return err + } + defer func() { _ = tx.Rollback() }() + // These tables intentionally do not rely on SQLite foreign-key pragma + // state. Delete reservations first so a workspace removal cannot leave + // orphaned provider matches that continue to block future imports. + for _, query := range []string{ + `DELETE FROM azure_devops_work_item_watch_tasks WHERE watch_id IN (SELECT id FROM azure_devops_work_item_watches WHERE workspace_id = ?)`, + `DELETE FROM azure_devops_pull_request_watch_tasks WHERE watch_id IN (SELECT id FROM azure_devops_pull_request_watches WHERE workspace_id = ?)`, + `DELETE FROM azure_devops_work_item_watches WHERE workspace_id = ?`, + `DELETE FROM azure_devops_pull_request_watches WHERE workspace_id = ?`, + } { + if _, err := tx.ExecContext(ctx, query, workspaceID); err != nil { + return err + } + } + return tx.Commit() +} + +func (s *Store) ListWorkItemWatchTasks(ctx context.Context, watchID string, generation int64) ([]*WorkItemWatchTask, error) { + var rows []WorkItemWatchTask + err := s.ro.SelectContext(ctx, &rows, `SELECT id, watch_id, project_id, work_item_id, + work_item_url, task_id, generation, created_at + FROM azure_devops_work_item_watch_tasks + WHERE watch_id = ? AND generation = ? ORDER BY created_at`, watchID, generation) + if err != nil { + return nil, err + } + result := make([]*WorkItemWatchTask, 0, len(rows)) + for i := range rows { + result = append(result, &rows[i]) + } + return result, nil +} + +func (s *Store) ListPullRequestWatchTasks(ctx context.Context, watchID string, generation int64) ([]*PullRequestWatchTask, error) { + var rows []PullRequestWatchTask + err := s.ro.SelectContext(ctx, &rows, `SELECT id, watch_id, project_id, + azure_repository_id, pull_request_id, pull_request_url, task_id, generation, + created_at FROM azure_devops_pull_request_watch_tasks + WHERE watch_id = ? AND generation = ? ORDER BY created_at`, watchID, generation) + if err != nil { + return nil, err + } + result := make([]*PullRequestWatchTask, 0, len(rows)) + for i := range rows { + result = append(result, &rows[i]) + } + return result, nil +} + +func (s *Store) DeleteWorkItemWatchTask(ctx context.Context, id string) error { + _, err := s.db.ExecContext(ctx, `DELETE FROM azure_devops_work_item_watch_tasks WHERE id = ?`, id) + return err +} + +func (s *Store) DeletePullRequestWatchTask(ctx context.Context, id string) error { + _, err := s.db.ExecContext(ctx, `DELETE FROM azure_devops_pull_request_watch_tasks WHERE id = ?`, id) + return err +} + +func (s *Store) ReserveWorkItemWatchTask(ctx context.Context, watchID string, generation int64, projectID string, workItemID int, workItemURL string) (bool, error) { + return s.reserveWatchTask(ctx, `azure_devops_work_item_watch_tasks`, ` + INSERT INTO azure_devops_work_item_watch_tasks + (id, watch_id, project_id, work_item_id, work_item_url, task_id, generation, created_at) + SELECT ?, ?, ?, ?, ?, '', ?, ? WHERE EXISTS ( + SELECT 1 FROM azure_devops_work_item_watches WHERE id = ? AND generation = ? AND enabled = 1 AND deleting = 0 + ) ON CONFLICT(watch_id, generation, project_id, work_item_id) DO NOTHING`, + []any{uuid.NewString(), watchID, projectID, workItemID, workItemURL, generation, time.Now().UTC(), watchID, generation}) +} + +func (s *Store) AssignWorkItemWatchTaskID(ctx context.Context, watchID string, generation int64, projectID string, workItemID int, taskID string) error { + return s.assignWatchTaskID(ctx, `azure_devops_work_item_watch_tasks`, watchID, generation, taskID, "project_id = ? AND work_item_id = ?", projectID, workItemID) +} + +func (s *Store) ReleaseWorkItemWatchTask(ctx context.Context, watchID string, generation int64, projectID string, workItemID int) error { + return s.releaseWatchTask(ctx, `azure_devops_work_item_watch_tasks`, watchID, generation, "project_id = ? AND work_item_id = ?", projectID, workItemID) +} + +func (s *Store) ReservePullRequestWatchTask(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int, pullRequestURL string) (bool, error) { + return s.reserveWatchTask(ctx, `azure_devops_pull_request_watch_tasks`, ` + INSERT INTO azure_devops_pull_request_watch_tasks + (id, watch_id, project_id, azure_repository_id, pull_request_id, pull_request_url, task_id, generation, created_at) + SELECT ?, ?, ?, ?, ?, ?, '', ?, ? WHERE EXISTS ( + SELECT 1 FROM azure_devops_pull_request_watches WHERE id = ? AND generation = ? AND enabled = 1 AND deleting = 0 + ) ON CONFLICT(watch_id, generation, project_id, azure_repository_id, pull_request_id) DO NOTHING`, + []any{uuid.NewString(), watchID, projectID, azureRepositoryID, pullRequestID, pullRequestURL, generation, time.Now().UTC(), watchID, generation}) +} + +func (s *Store) AssignPullRequestWatchTaskID(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int, taskID string) error { + return s.assignWatchTaskID(ctx, `azure_devops_pull_request_watch_tasks`, watchID, generation, taskID, "project_id = ? AND azure_repository_id = ? AND pull_request_id = ?", projectID, azureRepositoryID, pullRequestID) +} + +func (s *Store) ReleasePullRequestWatchTask(ctx context.Context, watchID string, generation int64, projectID, azureRepositoryID string, pullRequestID int) error { + return s.releaseWatchTask(ctx, `azure_devops_pull_request_watch_tasks`, watchID, generation, "project_id = ? AND azure_repository_id = ? AND pull_request_id = ?", projectID, azureRepositoryID, pullRequestID) +} + +func (s *Store) reserveWatchTask(ctx context.Context, table, query string, args []any) (bool, error) { + result, err := s.db.ExecContext(ctx, query, args...) + if err != nil { + return false, err + } + count, err := result.RowsAffected() + return count == 1, err +} + +func (s *Store) assignWatchTaskID(ctx context.Context, table, watchID string, generation int64, taskID, identity string, identityArgs ...any) error { + args := []any{taskID, watchID, generation} + args = append(args, identityArgs...) + result, err := s.db.ExecContext(ctx, fmt.Sprintf(`UPDATE %s SET task_id = ? WHERE watch_id = ? AND generation = ? AND %s`, table, identity), args...) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + watch, watchErr := s.watchGeneration(ctx, watchID) + if watchErr != nil || watch == nil || watch.Generation != generation || watch.Deleting || !watch.Enabled { + return ErrWatchOwnershipLost + } + return ErrReservationNotFound + } + return nil +} + +func (s *Store) releaseWatchTask(ctx context.Context, table, watchID string, generation int64, identity string, identityArgs ...any) error { + args := []any{watchID, generation} + args = append(args, identityArgs...) + result, err := s.db.ExecContext(ctx, fmt.Sprintf(`DELETE FROM %s WHERE watch_id = ? AND generation = ? AND %s`, table, identity), args...) + if err != nil { + return err + } + count, err := result.RowsAffected() + if err != nil { + return err + } + if count == 0 { + return ErrReservationNotFound + } + return nil +} + +type watchGenerationRow struct { + Generation int64 `db:"generation"` + Deleting bool `db:"deleting"` + Enabled bool `db:"enabled"` +} + +func (s *Store) watchGeneration(ctx context.Context, watchID string) (*watchGenerationRow, error) { + var row watchGenerationRow + queries := []string{ + `SELECT generation, deleting, enabled FROM azure_devops_work_item_watches WHERE id = ?`, + `SELECT generation, deleting, enabled FROM azure_devops_pull_request_watches WHERE id = ?`, + } + for _, query := range queries { + err := s.ro.GetContext(ctx, &row, query, watchID) + if err == nil { + return &row, nil + } + if !errors.Is(err, sql.ErrNoRows) { + return nil, err + } + } + return nil, nil +} diff --git a/apps/backend/internal/azuredevops/watch_store_test.go b/apps/backend/internal/azuredevops/watch_store_test.go new file mode 100644 index 0000000000..c39e95bac2 --- /dev/null +++ b/apps/backend/internal/azuredevops/watch_store_test.go @@ -0,0 +1,129 @@ +package azuredevops + +import ( + "context" + "errors" + "testing" +) + +func TestAzureWatchStoreRoundTripAndGenerationReservations(t *testing.T) { + store, err := NewStore(newTestDB(t), nil) + if err != nil { + t.Fatalf("new store: %v", err) + } + + watch := &WorkItemWatch{ + WorkspaceID: "ws-1", + WorkflowID: "wf-1", + WorkflowStepID: "step-1", + ProjectID: "project-1", + WIQL: "SELECT [System.Id] FROM WorkItems", + RepositoryID: "repo-1", + BaseBranch: "main", + AgentProfileID: "agent-1", + ExecutorProfileID: "executor-1", + Prompt: "Fix {{title}}", + Enabled: true, + CleanupPolicy: CleanupPolicyAuto, + MaxInflightTasks: intPtr(2), + PollIntervalSeconds: 10, + } + if err := store.CreateWorkItemWatch(context.Background(), watch); err != nil { + t.Fatalf("create work-item watch: %v", err) + } + if watch.ID == "" || watch.Generation != 1 || watch.PollIntervalSeconds != minWatchPollIntervalSeconds { + t.Fatalf("normalized watch = %+v", watch) + } + got, err := store.GetWorkItemWatch(context.Background(), watch.ID) + if err != nil { + t.Fatalf("get work-item watch: %v", err) + } + if got == nil || got.WorkspaceID != "ws-1" || got.WIQL != watch.WIQL || got.MaxInflightTasks == nil || *got.MaxInflightTasks != 2 { + t.Fatalf("round-trip watch = %+v", got) + } + + reserved, err := store.ReserveWorkItemWatchTask(context.Background(), watch.ID, watch.Generation, "project-1", 101, "https://azure/item/101") + if err != nil || !reserved { + t.Fatalf("first reservation: reserved=%v err=%v", reserved, err) + } + reserved, err = store.ReserveWorkItemWatchTask(context.Background(), watch.ID, watch.Generation, "project-1", 101, "https://azure/item/101") + if err != nil || reserved { + t.Fatalf("duplicate reservation: reserved=%v err=%v", reserved, err) + } + if err := store.AssignWorkItemWatchTaskID(context.Background(), watch.ID, watch.Generation, "project-1", 101, "task-1"); err != nil { + t.Fatalf("attach task: %v", err) + } + + reset, err := store.BeginWorkItemWatchReset(context.Background(), watch.ID) + if err != nil { + t.Fatalf("begin reset: %v", err) + } + if reset.Generation != watch.Generation+1 || len(reset.TaskIDs) != 1 || reset.TaskIDs[0] != "task-1" { + t.Fatalf("reset = %+v", reset) + } + if err := store.FinishWorkItemWatchReset(context.Background(), watch.ID, reset.Generation); err != nil { + t.Fatalf("finish reset: %v", err) + } + reserved, err = store.ReserveWorkItemWatchTask(context.Background(), watch.ID, reset.Generation, "project-1", 101, "https://azure/item/101") + if err != nil || !reserved { + t.Fatalf("reservation after reset: reserved=%v err=%v", reserved, err) + } +} + +func TestAzurePullRequestWatchStoreIsWorkspaceScoped(t *testing.T) { + store, err := NewStore(newTestDB(t), nil) + if err != nil { + t.Fatalf("new store: %v", err) + } + first := &PullRequestWatch{WorkspaceID: "ws-1", ProjectID: "project-1", AzureRepositoryID: "azure-repo-1", Status: "active"} + second := &PullRequestWatch{WorkspaceID: "ws-2", ProjectID: "project-2", AzureRepositoryID: "azure-repo-2", Status: "active"} + for _, watch := range []*PullRequestWatch{first, second} { + if err := store.CreatePullRequestWatch(context.Background(), watch); err != nil { + t.Fatalf("create pull-request watch: %v", err) + } + } + list, err := store.ListPullRequestWatches(context.Background(), "ws-1") + if err != nil || len(list) != 1 || list[0].ID != first.ID { + t.Fatalf("workspace watch list = %+v err=%v", list, err) + } + if _, err := store.GetPullRequestWatch(context.Background(), second.ID); err != nil { + t.Fatalf("get second watch: %v", err) + } + if err := store.AssignPullRequestWatchTaskID(context.Background(), first.ID, first.Generation, "project-1", "azure-repo-1", 42, "task-42"); !errors.Is(err, ErrReservationNotFound) { + t.Fatalf("attach without reservation error = %v, want ErrReservationNotFound", err) + } +} + +func TestAzureWatchStoreWorkspaceDeletionRemovesReservations(t *testing.T) { + store, err := NewStore(newTestDB(t), nil) + if err != nil { + t.Fatalf("new store: %v", err) + } + work := &WorkItemWatch{WorkspaceID: "ws-delete", ProjectID: "project-1", WIQL: "SELECT"} + pr := &PullRequestWatch{WorkspaceID: "ws-delete", ProjectID: "project-1", AzureRepositoryID: "repo-1"} + if err := store.CreateWorkItemWatch(t.Context(), work); err != nil { + t.Fatalf("create work watch: %v", err) + } + if err := store.CreatePullRequestWatch(t.Context(), pr); err != nil { + t.Fatalf("create PR watch: %v", err) + } + if ok, err := store.ReserveWorkItemWatchTask(t.Context(), work.ID, work.Generation, work.ProjectID, 101, "item"); err != nil || !ok { + t.Fatalf("reserve work item: %v %v", ok, err) + } + if ok, err := store.ReservePullRequestWatchTask(t.Context(), pr.ID, pr.Generation, pr.ProjectID, pr.AzureRepositoryID, 42, "pr"); err != nil || !ok { + t.Fatalf("reserve pull request: %v %v", ok, err) + } + if err := store.DeleteWatchesByWorkspace(t.Context(), "ws-delete"); err != nil { + t.Fatalf("delete workspace watches: %v", err) + } + workRows, err := store.ListWorkItemWatchTasks(t.Context(), work.ID, work.Generation) + if err != nil || len(workRows) != 0 { + t.Fatalf("work reservations after workspace deletion = %v, %v", workRows, err) + } + prRows, err := store.ListPullRequestWatchTasks(t.Context(), pr.ID, pr.Generation) + if err != nil || len(prRows) != 0 { + t.Fatalf("PR reservations after workspace deletion = %v, %v", prRows, err) + } +} + +func intPtr(value int) *int { return &value } diff --git a/apps/backend/internal/azuredevops/work_item_mutations.go b/apps/backend/internal/azuredevops/work_item_mutations.go new file mode 100644 index 0000000000..26ce8603b2 --- /dev/null +++ b/apps/backend/internal/azuredevops/work_item_mutations.go @@ -0,0 +1,76 @@ +package azuredevops + +import ( + "context" + "fmt" + "strings" +) + +// WorkItemAssignmentRequest is the intentionally narrow mutation surface for +// the detail view. Azure work-item fields stay provider-owned; Kandev only +// changes the assignee and relies on board mutations for status changes. +type WorkItemAssignmentRequest struct { + Revision int `json:"revision"` + AssigneeAction *string `json:"assigneeAction,omitempty"` + + resolvedAssignee string + hasResolvedAssignee bool +} + +type workItemMutationClient interface { + UpdateWorkItem(ctx context.Context, projectID string, id int, request WorkItemAssignmentRequest) (*WorkItem, error) +} + +func (s *Service) UpdateWorkItemForWorkspace(ctx context.Context, workspaceID, projectID string, id int, request WorkItemAssignmentRequest) (*WorkItem, error) { + if strings.TrimSpace(projectID) == "" || id <= 0 { + return nil, fmt.Errorf("%w: project and positive work item id required", ErrInvalidConfig) + } + if err := validateWorkItemAssignment(request); err != nil { + return nil, err + } + client, err := s.clientForWorkspace(ctx, workspaceID) + if err != nil { + return nil, err + } + writer, ok := client.(workItemMutationClient) + if !ok { + return nil, fmt.Errorf("%w: work item assignment is unavailable", ErrNotConfigured) + } + if request.AssigneeAction == nil { + return writer.UpdateWorkItem(ctx, projectID, id, request) + } + if *request.AssigneeAction != assignCurrentUserAction { + request.hasResolvedAssignee = true + return writer.UpdateWorkItem(ctx, projectID, id, request) + } + identityReader, available := client.(interface { + GetCurrentIdentity(context.Context) (*Identity, error) + }) + if !available { + return nil, fmt.Errorf("%w: current identity is unavailable", ErrNotConfigured) + } + identity, identityErr := identityReader.GetCurrentIdentity(ctx) + if identityErr != nil { + return nil, identityErr + } + assignee := strings.TrimSpace(identity.UniqueName) + if assignee == "" { + assignee = strings.TrimSpace(identity.DisplayName) + } + if assignee == "" { + return nil, fmt.Errorf("%w: current identity has no assignable name", ErrInvalidConfig) + } + request.resolvedAssignee = assignee + request.hasResolvedAssignee = true + return writer.UpdateWorkItem(ctx, projectID, id, request) +} + +func validateWorkItemAssignment(request WorkItemAssignmentRequest) error { + if request.Revision <= 0 { + return fmt.Errorf("%w: revision required", ErrInvalidConfig) + } + if request.AssigneeAction == nil || (*request.AssigneeAction != assignCurrentUserAction && *request.AssigneeAction != unassignAction) { + return fmt.Errorf("%w: an assign_current_user or unassign action is required", ErrInvalidConfig) + } + return nil +} diff --git a/apps/backend/internal/azuredevops/workspace_settings.go b/apps/backend/internal/azuredevops/workspace_settings.go new file mode 100644 index 0000000000..e9cfcb334c --- /dev/null +++ b/apps/backend/internal/azuredevops/workspace_settings.go @@ -0,0 +1,244 @@ +package azuredevops + +import ( + "context" + "encoding/json" + "fmt" + "strings" + + "github.com/google/uuid" +) + +// QueryPreset is a provider-native browse query offered in the Azure scope bar. +type QueryPreset struct { + ID string `json:"id"` + Label string `json:"label"` + Group string `json:"group"` + Filters map[string]any `json:"filters"` +} + +// ActionPreset is a configurable task launcher entry for an Azure item. +type ActionPreset struct { + ID string `json:"id"` + Label string `json:"label"` + Hint string `json:"hint"` + Icon string `json:"icon"` + PromptTemplate string `json:"promptTemplate"` +} + +type WorkspaceSettings struct { + WorkspaceID string `json:"workspaceId"` + WorkItemQueries []QueryPreset `json:"workItemQueries"` + PullRequestQueries []QueryPreset `json:"pullRequestQueries"` + WorkItemActions []ActionPreset `json:"workItemActions"` + PullRequestActions []ActionPreset `json:"pullRequestActions"` +} + +type UpdateWorkspaceSettingsRequest struct { + WorkspaceID string `json:"-"` + WorkItemQueries *[]QueryPreset `json:"workItemQueries,omitempty"` + PullRequestQueries *[]QueryPreset `json:"pullRequestQueries,omitempty"` + WorkItemActions *[]ActionPreset `json:"workItemActions,omitempty"` + PullRequestActions *[]ActionPreset `json:"pullRequestActions,omitempty"` + WorkItemQueriesSet bool `json:"-"` + PullRequestQueriesSet bool `json:"-"` + WorkItemActionsSet bool `json:"-"` + PullRequestActionsSet bool `json:"-"` +} + +func (r *UpdateWorkspaceSettingsRequest) UnmarshalJSON(data []byte) error { + type alias UpdateWorkspaceSettingsRequest + var raw map[string]json.RawMessage + if err := json.Unmarshal(data, &raw); err != nil { + return err + } + var decoded alias + if err := json.Unmarshal(data, &decoded); err != nil { + return err + } + *r = UpdateWorkspaceSettingsRequest(decoded) + if _, ok := raw["workItemQueries"]; ok { + r.WorkItemQueriesSet = true + } + if _, ok := raw["pullRequestQueries"]; ok { + r.PullRequestQueriesSet = true + } + if _, ok := raw["workItemActions"]; ok { + r.WorkItemActionsSet = true + } + if _, ok := raw["pullRequestActions"]; ok { + r.PullRequestActionsSet = true + } + return nil +} + +type workspaceSettingsOverrides map[string]json.RawMessage + +const workspaceSettingsUpdateAttempts = 3 + +func DefaultWorkItemQueryPresets() []QueryPreset { + const start = "SELECT [System.Id] FROM WorkItems WHERE [System.TeamProject] = @project" + const order = " ORDER BY [System.ChangedDate] DESC" + return []QueryPreset{ + {ID: "recent", Label: "Recently updated", Group: "inbox", Filters: map[string]any{"wiql": start + order, "top": 50}}, + {ID: "assigned", Label: "Assigned to me", Group: "inbox", Filters: map[string]any{"wiql": start + " AND [System.AssignedTo] = @Me" + order, "top": 50}}, + {ID: "active", Label: "Active", Group: "inbox", Filters: map[string]any{"wiql": start + " AND [System.State] <> 'Closed' AND [System.State] <> 'Done'" + order, "top": 50}}, + {ID: "created", Label: "Created by me", Group: "created", Filters: map[string]any{"wiql": start + " AND [System.CreatedBy] = @Me" + order, "top": 50}}, + } +} +func DefaultPullRequestQueryPresets() []QueryPreset { + return []QueryPreset{ + {ID: "review-requested", Label: "Review requested", Group: "inbox", Filters: map[string]any{"status": "active", "reviewer": "@me", "creator": ""}}, + {ID: "active", Label: "Open", Group: "inbox", Filters: map[string]any{"status": "active", "reviewer": "", "creator": ""}}, + {ID: "completed", Label: "Completed", Group: "created", Filters: map[string]any{"status": "completed", "reviewer": "", "creator": ""}}, + {ID: "created", Label: "Created by me", Group: "created", Filters: map[string]any{"status": "active", "reviewer": "", "creator": "@me"}}, + } +} +func DefaultWorkItemActionPresets() []ActionPreset { + return []ActionPreset{ + {ID: "implement", Label: "Implement", Hint: "Build and open a PR", Icon: "code", PromptTemplate: "Implement the Azure DevOps work item at {{url}} (title: \"{{title}}\"). Open a pull request when complete."}, + {ID: "investigate", Label: "Investigate", Hint: "Find the root cause", Icon: "search", PromptTemplate: "Investigate the Azure DevOps work item at {{url}} (title: \"{{title}}\"). Identify the root cause and summarize findings."}, + {ID: "reproduce", Label: "Reproduce", Hint: "Document repro steps", Icon: "bug", PromptTemplate: "Reproduce the Azure DevOps work item at {{url}} (title: \"{{title}}\"). Document the reproduction steps."}, + } +} +func DefaultPullRequestActionPresets() []ActionPreset { + return []ActionPreset{ + {ID: "review", Label: "Review", Hint: "Read the diff, flag issues", Icon: "eye", PromptTemplate: "Review the Azure DevOps pull request at {{url}}. Provide feedback on code quality and correctness."}, + {ID: "address-feedback", Label: "Address feedback", Hint: "Apply review comments", Icon: "message", PromptTemplate: "Review and address the feedback on the Azure DevOps pull request at {{url}}."}, + {ID: "fix-ci", Label: "Fix CI", Hint: "Diagnose failing checks", Icon: "tool", PromptTemplate: "Investigate and fix CI failures for the Azure DevOps pull request at {{url}}."}, + } +} + +func (s *Service) GetWorkspaceSettings(ctx context.Context, workspaceID string) (*WorkspaceSettings, error) { + if err := validateWorkspaceID(workspaceID); err != nil { + return nil, err + } + if err := s.authorizeWorkspaceAccess(ctx, workspaceID); err != nil { + return nil, err + } + raw, err := s.store.GetWorkspaceSettingsJSON(ctx, workspaceID) + if err != nil { + return nil, err + } + var overrides workspaceSettingsOverrides + if err := json.Unmarshal([]byte(raw), &overrides); err != nil { + return nil, fmt.Errorf("decode Azure workspace settings: %w", err) + } + settings := &WorkspaceSettings{WorkspaceID: workspaceID, WorkItemQueries: DefaultWorkItemQueryPresets(), PullRequestQueries: DefaultPullRequestQueryPresets(), WorkItemActions: DefaultWorkItemActionPresets(), PullRequestActions: DefaultPullRequestActionPresets()} + decodeOverride(overrides, "workItemQueries", &settings.WorkItemQueries) + decodeOverride(overrides, "pullRequestQueries", &settings.PullRequestQueries) + decodeOverride(overrides, "workItemActions", &settings.WorkItemActions) + decodeOverride(overrides, "pullRequestActions", &settings.PullRequestActions) + return settings, nil +} + +func decodeOverride[T any](overrides workspaceSettingsOverrides, key string, target *[]T) { + raw, ok := overrides[key] + if !ok || len(raw) == 0 { + return + } + var value []T + if json.Unmarshal(raw, &value) == nil && len(value) > 0 { + *target = value + } +} + +func (s *Service) UpdateWorkspaceSettings(ctx context.Context, req *UpdateWorkspaceSettingsRequest) (*WorkspaceSettings, error) { + if req == nil || req.WorkspaceID == "" { + return nil, ErrInvalidWorkspaceID + } + if err := s.authorizeWorkspaceAccess(ctx, req.WorkspaceID); err != nil { + return nil, err + } + for attempt := 0; attempt < workspaceSettingsUpdateAttempts; attempt++ { + snapshot, err := s.store.GetWorkspaceSettingsSnapshot(ctx, req.WorkspaceID) + if err != nil { + return nil, err + } + next, err := patchWorkspaceSettingsJSON(snapshot.JSON, req) + if err != nil { + return nil, err + } + updated, err := s.store.PutWorkspaceSettingsJSONIfVersion(ctx, req.WorkspaceID, next, snapshot.Version) + if err != nil { + return nil, err + } + if updated { + return s.GetWorkspaceSettings(ctx, req.WorkspaceID) + } + } + return nil, fmt.Errorf("update Azure workspace settings: concurrent update") +} + +func patchWorkspaceSettingsJSON(raw string, req *UpdateWorkspaceSettingsRequest) (string, error) { + overrides := workspaceSettingsOverrides{} + if err := json.Unmarshal([]byte(raw), &overrides); err != nil { + return "", fmt.Errorf("decode Azure workspace settings: %w", err) + } + if err := patchPresetOverride(overrides, "workItemQueries", req.WorkItemQueriesSet, req.WorkItemQueries, normalizeQueryPresets); err != nil { + return "", err + } + if err := patchPresetOverride(overrides, "pullRequestQueries", req.PullRequestQueriesSet, req.PullRequestQueries, normalizeQueryPresets); err != nil { + return "", err + } + if err := patchPresetOverride(overrides, "workItemActions", req.WorkItemActionsSet, req.WorkItemActions, normalizeActionPresets); err != nil { + return "", err + } + if err := patchPresetOverride(overrides, "pullRequestActions", req.PullRequestActionsSet, req.PullRequestActions, normalizeActionPresets); err != nil { + return "", err + } + next, err := json.Marshal(overrides) + if err != nil { + return "", err + } + return string(next), nil +} + +func patchPresetOverride[T any](overrides workspaceSettingsOverrides, key string, set bool, values *[]T, normalize func([]T) []T) error { + if !set { + return nil + } + if values == nil { + delete(overrides, key) + return nil + } + normalized := normalize(*values) + if len(normalized) == 0 { + return fmt.Errorf("%w: %s must include a valid preset", ErrInvalidConfig, key) + } + raw, err := json.Marshal(normalized) + if err != nil { + return err + } + overrides[key] = raw + return nil +} + +func normalizeQueryPresets(values []QueryPreset) []QueryPreset { + result := make([]QueryPreset, 0, len(values)) + for _, value := range values { + value.ID, value.Label, value.Group = strings.TrimSpace(value.ID), strings.TrimSpace(value.Label), strings.TrimSpace(value.Group) + if value.ID == "" { + value.ID = uuid.NewString() + } + if value.Label == "" || len(value.Filters) == 0 { + continue + } + result = append(result, value) + } + return result +} +func normalizeActionPresets(values []ActionPreset) []ActionPreset { + result := make([]ActionPreset, 0, len(values)) + for _, value := range values { + value.ID, value.Label, value.Hint, value.Icon, value.PromptTemplate = strings.TrimSpace(value.ID), strings.TrimSpace(value.Label), strings.TrimSpace(value.Hint), strings.TrimSpace(value.Icon), strings.TrimSpace(value.PromptTemplate) + if value.Label == "" || value.PromptTemplate == "" { + continue + } + if value.ID == "" { + value.ID = uuid.NewString() + } + result = append(result, value) + } + return result +} diff --git a/apps/backend/internal/azuredevops/workspace_settings_test.go b/apps/backend/internal/azuredevops/workspace_settings_test.go new file mode 100644 index 0000000000..da6a6122f5 --- /dev/null +++ b/apps/backend/internal/azuredevops/workspace_settings_test.go @@ -0,0 +1,105 @@ +package azuredevops + +import ( + "context" + "encoding/json" + "reflect" + "testing" +) + +func TestDefaultQueryPresetsMatchAzureBrowseShortcuts(t *testing.T) { + workItemIDs := make([]string, 0, len(DefaultWorkItemQueryPresets())) + for _, preset := range DefaultWorkItemQueryPresets() { + workItemIDs = append(workItemIDs, preset.ID) + } + pullRequestIDs := make([]string, 0, len(DefaultPullRequestQueryPresets())) + for _, preset := range DefaultPullRequestQueryPresets() { + pullRequestIDs = append(pullRequestIDs, preset.ID) + } + + if want := []string{"recent", "assigned", "active", "created"}; !reflect.DeepEqual(workItemIDs, want) { + t.Fatalf("work-item preset IDs = %v, want %v", workItemIDs, want) + } + if want := []string{"review-requested", "active", "completed", "created"}; !reflect.DeepEqual(pullRequestIDs, want) { + t.Fatalf("pull-request preset IDs = %v, want %v", pullRequestIDs, want) + } +} + +func TestWorkspaceSettingsDefaultsAndActionOverrides(t *testing.T) { + service, _, _ := newTestService(t, nil) + ctx := context.Background() + if _, err := service.SetConfigForWorkspace(ctx, "ws-1", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", PAT: "pat", + }); err != nil { + t.Fatalf("set config: %v", err) + } + + defaults, err := service.GetWorkspaceSettings(ctx, "ws-1") + if err != nil { + t.Fatalf("get defaults: %v", err) + } + if len(defaults.WorkItemActions) == 0 || len(defaults.PullRequestActions) == 0 { + t.Fatalf("expected built-in actions, got %+v", defaults) + } + + custom := []ActionPreset{{Label: "Triage", Hint: "Sort the report", PromptTemplate: "Triage {{url}}"}} + updated, err := service.UpdateWorkspaceSettings(ctx, &UpdateWorkspaceSettingsRequest{ + WorkspaceID: "ws-1", + WorkItemActions: &custom, + WorkItemActionsSet: true, + }) + if err != nil { + t.Fatalf("update actions: %v", err) + } + if len(updated.WorkItemActions) != 1 || updated.WorkItemActions[0].ID == "" { + t.Fatalf("custom actions were not normalized: %+v", updated.WorkItemActions) + } + if len(updated.PullRequestActions) != len(DefaultPullRequestActionPresets()) { + t.Fatalf("untouched PR actions should keep defaults: %+v", updated.PullRequestActions) + } +} + +func TestWorkspaceSettingsPatchRequestPreservesFieldPresence(t *testing.T) { + service, _, _ := newTestService(t, nil) + ctx := context.Background() + if _, err := service.SetConfigForWorkspace(ctx, "ws-1", &SetConfigRequest{ + OrganizationURL: "https://dev.azure.com/acme", PAT: "pat", + }); err != nil { + t.Fatalf("set config: %v", err) + } + + var customRequest UpdateWorkspaceSettingsRequest + if err := json.Unmarshal([]byte(`{"workItemActions":[{"label":"Triage","promptTemplate":"Triage {{url}}"}]}`), &customRequest); err != nil { + t.Fatalf("decode custom patch: %v", err) + } + customRequest.WorkspaceID = "ws-1" + if _, err := service.UpdateWorkspaceSettings(ctx, &customRequest); err != nil { + t.Fatalf("apply custom patch: %v", err) + } + + var omittedRequest UpdateWorkspaceSettingsRequest + if err := json.Unmarshal([]byte(`{}`), &omittedRequest); err != nil { + t.Fatalf("decode omitted patch: %v", err) + } + omittedRequest.WorkspaceID = "ws-1" + omitted, err := service.UpdateWorkspaceSettings(ctx, &omittedRequest) + if err != nil { + t.Fatalf("apply omitted patch: %v", err) + } + if len(omitted.WorkItemActions) != 1 || omitted.WorkItemActions[0].Label != "Triage" { + t.Fatalf("omitted work-item actions = %+v, want saved action", omitted.WorkItemActions) + } + + var resetRequest UpdateWorkspaceSettingsRequest + if err := json.Unmarshal([]byte(`{"workItemActions":null}`), &resetRequest); err != nil { + t.Fatalf("decode null patch: %v", err) + } + resetRequest.WorkspaceID = "ws-1" + reset, err := service.UpdateWorkspaceSettings(ctx, &resetRequest) + if err != nil { + t.Fatalf("apply null patch: %v", err) + } + if !reflect.DeepEqual(reset.WorkItemActions, DefaultWorkItemActionPresets()) { + t.Fatalf("null work-item actions = %+v, want defaults", reset.WorkItemActions) + } +} diff --git a/apps/backend/internal/backendapp/boot_state_routes.go b/apps/backend/internal/backendapp/boot_state_routes.go index 55e35d3e83..1e1e269888 100644 --- a/apps/backend/internal/backendapp/boot_state_routes.go +++ b/apps/backend/internal/backendapp/boot_state_routes.go @@ -481,6 +481,7 @@ func mapUserSettingsState(response userdto.UserSettingsResponse, workspaceID str "terminalFontFamily": nullString(settings.TerminalFontFamily), "terminalFontSize": nullInt(settings.TerminalFontSize), "changesPanelLayout": changesPanelLayout(settings.ChangesPanelLayout), + "azureDevOpsBrowsePreferences": settings.AzureDevOpsBrowsePreferences, "systemMetricsDisplay": map[string]any{ "showInTopbar": settings.SystemMetricsDisplay.ShowInTopbar, "simplified": settings.SystemMetricsDisplay.Simplified, diff --git a/apps/backend/internal/backendapp/boot_state_routes_test.go b/apps/backend/internal/backendapp/boot_state_routes_test.go index eb3c60f3d4..79bb157e09 100644 --- a/apps/backend/internal/backendapp/boot_state_routes_test.go +++ b/apps/backend/internal/backendapp/boot_state_routes_test.go @@ -1,12 +1,46 @@ package backendapp import ( + "encoding/json" "testing" userdto "github.com/kandev/kandev/internal/user/dto" usermodels "github.com/kandev/kandev/internal/user/models" ) +func TestMapUserSettingsStateIncludesAzureDevOpsBrowsePreferences(t *testing.T) { + preferences := json.RawMessage(`{"workspace-1":{"mode":"board","filters":{"projectId":"project-2"},"board":{"teamId":"team-2","boardId":"board-2","focusedColumnId":"done"}}}`) + state := mapUserSettingsState(userdto.UserSettingsResponse{ + Settings: userdto.UserSettingsDTO{AzureDevOpsBrowsePreferences: preferences}, + }, "workspace-1") + + encoded, err := json.Marshal(state) + if err != nil { + t.Fatalf("marshal boot settings: %v", err) + } + var payload struct { + Loaded bool `json:"loaded"` + Preferences map[string]struct { + Mode string `json:"mode"` + Filters struct { + ProjectID string `json:"projectId"` + } `json:"filters"` + Board struct { + TeamID string `json:"teamId"` + BoardID string `json:"boardId"` + } `json:"board"` + } `json:"azureDevOpsBrowsePreferences"` + } + if err := json.Unmarshal(encoded, &payload); err != nil { + t.Fatalf("decode boot settings: %v", err) + } + + preference := payload.Preferences["workspace-1"] + if !payload.Loaded || preference.Mode != "board" || preference.Filters.ProjectID != "project-2" || preference.Board.TeamID != "team-2" || preference.Board.BoardID != "board-2" { + t.Fatalf("Azure browse preferences missing from loaded boot settings: %s", encoded) + } +} + func TestMapUserSettingsStateIncludesPortableTaskAndSidebarSettings(t *testing.T) { state := mapUserSettingsState(userdto.UserSettingsResponse{ Settings: userdto.UserSettingsDTO{ diff --git a/apps/backend/internal/backendapp/helpers.go b/apps/backend/internal/backendapp/helpers.go index 7e4f37dd8d..4bedf4c9d1 100644 --- a/apps/backend/internal/backendapp/helpers.go +++ b/apps/backend/internal/backendapp/helpers.go @@ -570,6 +570,9 @@ func registerRoutes(p routeParams) { if p.services.GitLab != nil { p.services.GitLab.SetCascadeTaskDeleter(handoffSvc) } + if p.services.AzureDevOps != nil { + p.services.AzureDevOps.SetCascadeTaskDeleter(handoffSvc) + } // repoLookup validates a watcher's optional repository binding (workspace // ownership + default-branch fill) on create/update. Shared across the three // repo-less watchers; one concrete adapter satisfies each package's @@ -581,6 +584,12 @@ func registerRoutes(p routeParams) { tasks: p.taskSvc, workflows: p.services.Workflow, agents: p.agentSettingsRepo, }) } + if p.services.AzureDevOps != nil { + p.services.AzureDevOps.SetWatchRepositoryLookup(repoLookup) + p.services.AzureDevOps.SetWatchDependencyValidator(&gitLabWatchDependencyValidator{ + tasks: p.taskSvc, workflows: p.services.Workflow, agents: p.agentSettingsRepo, + }) + } if p.services.Jira != nil { p.services.Jira.SetTaskDeleter(handoffSvc) p.services.Jira.SetRepositoryLookup(repoLookup) diff --git a/apps/backend/internal/backendapp/main.go b/apps/backend/internal/backendapp/main.go index fdede3e541..295d9215ce 100644 --- a/apps/backend/internal/backendapp/main.go +++ b/apps/backend/internal/backendapp/main.go @@ -559,9 +559,11 @@ func startAgentInfrastructure( // and workspace-scoped GitLab credential resolver are both configured. workspaceSourceMaterializer.SetHostRepositoryCloner(orchestratorSvc) - // Azure DevOps v1 owns only connection-health polling. PR summaries are - // refreshed explicitly through their task association routes. + // Azure DevOps owns connection-health and work-item/pull-request watcher + // polling. Watch matches flow through the shared orchestrator coordinator. if services.AzureDevOps != nil { + orchestratorSvc.SetAzureDevOpsService(services.AzureDevOps) + services.AzureDevOps.SetTaskSessionChecker(&taskSessionCheckerAdapter{repo: repos.Task}) azureLifecycle, lifecycleErr := azuredevopspkg.RegisterLifecycleCleanup(eventBus, services.AzureDevOps) if lifecycleErr != nil { log.Warn("Azure DevOps lifecycle cleanup unavailable", zap.Error(lifecycleErr)) diff --git a/apps/backend/internal/backendapp/services.go b/apps/backend/internal/backendapp/services.go index 7df0cb17b3..2d72b6e82d 100644 --- a/apps/backend/internal/backendapp/services.go +++ b/apps/backend/internal/backendapp/services.go @@ -124,6 +124,7 @@ func provideServices(cfg *config.Config, log *logger.Logger, repos *Repositories azureDevOpsSvc := initAzureDevOpsService(dbPool, eventBus, repos.Secrets, log) if azureDevOpsSvc != nil { azureDevOpsSvc.SetRepositoryLookup(&repositoryLookupAdapter{svc: taskSvc}) + azureDevOpsSvc.SetWorkspaceAuthorizer(taskSvc.AuthorizeWorkspaceAccess) } jiraSvc := initJiraService(dbPool, eventBus, repos.Secrets, log) linearSvc := initLinearService(dbPool, eventBus, repos.Secrets, log) diff --git a/apps/backend/internal/events/types.go b/apps/backend/internal/events/types.go index 78638ec988..4b38632fe5 100644 --- a/apps/backend/internal/events/types.go +++ b/apps/backend/internal/events/types.go @@ -117,6 +117,12 @@ const ( RepositoryDeleted = "repository.deleted" ) +// Event types emitted by Azure DevOps watcher polling. +const ( + AzureDevOpsWorkItemWatchMatch = "azure_devops.work_item_watch.match" + AzureDevOpsPullRequestWatchMatch = "azure_devops.pull_request_watch.match" +) + // Event types for repository scripts const ( RepositoryScriptCreated = "repository.script.created" diff --git a/apps/backend/internal/integrations/AGENTS.md b/apps/backend/internal/integrations/AGENTS.md index 6f247327ca..d705ac4d56 100644 --- a/apps/backend/internal/integrations/AGENTS.md +++ b/apps/backend/internal/integrations/AGENTS.md @@ -53,4 +53,4 @@ not read `workspace_id`, so GitLab's `workspace_id`-keyed WS list is unscoped to - **Watch filter persistence:** Jira stores the JQL string verbatim; Linear stores the structured `SearchFilter` as JSON in `filter_json` (Linear has no JQL equivalent). The orchestrator emits `NewJiraIssueEvent` / `NewLinearIssueEvent` respectively and dedups by issue key (Jira) vs identifier (Linear). - **Health column extras:** Linear's `linear_configs` row carries an `org_slug` captured from successful probes; Jira's row does not. - **Sentry — multiple instances per workspace:** unlike the one-config-per-workspace integrations, `sentry_configs` is keyed by an instance `id` (UUID) with a `workspace_id` column + `UNIQUE(workspace_id, name)`, so a workspace holds several named instances. Secrets are keyed `sentry:instance:
+ Type {"{{"} to see available placeholders. {"{{url}}"} and{" "}
+ {"{{title}}"} are substituted when the action runs.
+
+ Could not load existing quick actions: {drafts.loadError} +
+ )} + +