shithub Public

Notifications Fork 0 Star 0

Comparing changes

Choose two branches to see what's changed or to start a new pull request.

Create pull request

Able to merge. These branches can be automatically merged.

34 commits 104 files changed 3 contributors

Commits on s50/cross-cutting

changelog: note S50 §0 cross-cutting REST API contract d8d5c07 mfwolffe committed yesterday
docs/api: document JSON error envelope, X-OAuth-Scopes, rate limits, meta c1b73b6 mfwolffe committed yesterday
api: cross-cutting contract tests (envelope, headers, meta, rate limit) 7f5534e mfwolffe committed yesterday
api: wire apilimit + meta into Mount, expose BaseURL/APILimit on Deps 828eb18 mfwolffe committed yesterday
web/auth_wiring: pass BaseURL + apilimit config into api.Deps 8bbbb65 mfwolffe committed yesterday
api/meta: GET /api/v1/meta capability discovery endpoint 8f8c84e mfwolffe committed yesterday
api/apipage: pagination Link header helper for list endpoints 4e49e63 mfwolffe committed yesterday
api/apilimit: rate-limit + header-stamp middleware for /api/v1/* 1d477a7 mfwolffe committed yesterday
middleware/pat: JSON envelope on 401/403, set X-OAuth-Scopes header d3a1df9 mfwolffe committed yesterday
config: add ratelimit.api budgets with defaults + validation 9191613 mfwolffe committed yesterday
Merge pull request #127 from tenseleyFlow/pr-open-flow-parity 7c44705 mfw committed yesterday
Surface branch PR entrypoints 748915b mfwolffe committed yesterday
Align compare and new PR flow 50a1a7e mfwolffe committed yesterday
Merge pull request #126 from tenseleyFlow/s41h/operator-docs-smoke e120339 Matthew Forrester Wolffe committed yesterday
docs/actions: add operator smoke guide de4f850 mfwolffe committed yesterday
actions/admin: cancel active runs in bulk 44f779f mfwolffe committed yesterday
Merge pull request #125 from tenseleyFlow/s41h/polish-actions-feed f1e40ac Matthew Forrester Wolffe committed yesterday
Merge pull request #124 from tenseleyFlow/payments-sp00-01 687af56 mfw committed yesterday
Fix billing lint findings 3ca141a mfwolffe committed yesterday
actions/events: satisfy lifecycle lint (S41h) c3b4552 mfwolffe committed yesterday
web/repo: expose actions runs atom feed (S41h) 06ca804 mfwolffe committed yesterday
actions/events: emit workflow lifecycle webhooks (S41h) 29771c7 mfwolffe committed yesterday
Add billing state service eaedf22 mfwolffe committed yesterday
Add billing domain schema 2d00a68 mfwolffe committed yesterday
Capture paid org copy rules 8f9f8d6 mfwolffe committed yesterday
Document entitlement authorization split d92b17d mfwolffe committed yesterday
Guard org plan entitlement boundary 5b1a1f3 mfwolffe committed yesterday
Document paid org billing contract bb04500 mfwolffe committed yesterday
Merge pull request #123 from tenseleyFlow/s41g/audit-fixes 582d0a5 Matthew Forrester Wolffe committed yesterday
profile: satisfy policy boundary lint 90c7bfb mfwolffe committed yesterday
api: propagate PAT policy actors d933bdc mfwolffe committed yesterday
actions/logstream: isolate SSE transport cleanup b4c53a7 mfwolffe committed yesterday
Merge pull request #122 from tenseleyFlow/explore-load-more-parity 50f04e8 Matthew Forrester Wolffe committed yesterday
Append Explore feed pages in place 3012166 mfwolffe committed yesterday

.env.examplemodified

9 lines changed — click to load

  # AEAD key for at-rest TOTP secrets (S06). Generate once and persist —
  # rotating without re-encrypting every row breaks every existing 2FA login.
  # SHITHUB_TOTP_KEY=$(openssl rand -base64 32)
++
 +# ----- rate limits (S50 §0) -----
 +# Per-hour budgets for /api/v1/* requests. Authed keyed by token id;
 +# anon keyed by remote IP. Zero falls back to the default.
 +SHITHUB_RATELIMIT__API__AUTHED_PER_HOUR=5000
 +SHITHUB_RATELIMIT__API__ANON_PER_HOUR=60

CHANGELOG.mdmodified

29 lines changed — click to load

  ## [Unreleased]
 -(Empty — first post-launch entries land here.)
 +### Added
++
 +- **REST API contract (S50 §0).** `GET /api/v1/meta` returns the
 +  server's version stamp and a list of feature capability strings
 +  for client-side feature detection. Every `/api/v1/*` response
 +  now carries `X-RateLimit-Limit`, `X-RateLimit-Remaining`,
 +  `X-RateLimit-Reset`, and (when PAT-authenticated) `X-OAuth-Scopes`.
 +  The 403 scope-reject response also carries
 +  `X-Accepted-OAuth-Scopes`. Operators tune the API rate-limit
 +  budgets via `ratelimit.api.authed_per_hour` /
 +  `ratelimit.api.anon_per_hour` (defaults: 5000 / 60).
 +- **Pagination helper** `internal/web/handlers/api/apipage` —
 +  emits canonical RFC 8288 Link headers (`first`/`prev`/`next`/`last`)
 +  with absolute URLs rooted at the configured public base URL.
++
 +### Changed
++
 +- **JSON error envelope on `/api/v1/*`.** `401` and `403`
 +  responses now emit `{"error": "..."}` with
 +  `Content-Type: application/json` (previously `text/plain`).
 +  Existing `4xx`/`5xx` responses from the handler bodies are
 +  unchanged.
  ## [0.1.0] — TBD (operator fills in cutover date)

Makefilemodified

25 lines changed — click to load

  # Targets mirror what CI runs. The Makefile is the source of truth.
  .DEFAULT_GOAL := help
 -.PHONY: help dev build test test-race lint lint-policy lint-markdown lint-secret-logs lint-spdx lint-unused lint-migrations verify-api-docs fmt tidy clean ci assets install-tools version deploy deploy-check restore-drill bench-staging docs docs-serve docs-verify gen-third-party-notices audit-a11y audit-a11y-pa11y audit-a11y-axe load-test
 +.PHONY: help dev build test test-race lint lint-policy lint-markdown lint-org-plan lint-secret-logs lint-spdx lint-unused lint-migrations verify-api-docs fmt tidy clean ci assets install-tools version deploy deploy-check restore-drill bench-staging docs docs-serve docs-verify gen-third-party-notices audit-a11y audit-a11y-pa11y audit-a11y-axe load-test
  # Build metadata embedded into the binary via -ldflags.
  VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
  		echo "warn: .refs/primer-css/dist not found; run 'git clone https://github.com/primer/css .refs/primer-css' first"; \
  	fi
 -ci: lint lint-policy lint-markdown lint-secret-logs lint-spdx lint-unused lint-migrations verify-api-docs test build ## Full CI pipeline (matches .github/workflows/ci.yml).
 +ci: lint lint-policy lint-markdown lint-org-plan lint-secret-logs lint-spdx lint-unused lint-migrations verify-api-docs test build ## Full CI pipeline (matches .github/workflows/ci.yml).
  	@echo "ci: ok"
  lint-policy: ## Enforce policy-package boundary (no inline auth checks in handlers/git/cmd).
  lint-markdown: ## Enforce markdown-package boundary (no goldmark/bluemonday outside internal/markdown).
  	@scripts/lint-markdown-boundary.sh
 +lint-org-plan: ## Enforce paid org entitlement boundary (no direct orgs.plan feature gates).
 +	@scripts/lint-org-plan-boundary.sh
++
  lint-secret-logs: ## Fail when source emits log lines containing token-prefix patterns.
  	@scripts/lint-secret-logs.sh

bench/fixtures/README.mdmodified

11 lines changed — click to load

  regressions in the harness itself plus the small-scale handler
  latency floor; the big-fixture targets in S36's "Definition of
  done" land with the generators above.
++
 +## Actions smoke fixture
++
 +`actions/smoke-run-only.yml` is the canonical first end-to-end Actions
 +workflow fixture. Copy it into `.shithub/workflows/smoke.yml` in a
 +repository with a registered `ubuntu-latest` runner. It intentionally uses only
 +`run:` steps because the current executor rejects reserved `uses:` aliases
 +until checkout and artifact execution are implemented.

bench/fixtures/actions/smoke-run-only.ymladded

10 lines changed — click to load

 +name: smoke
 +on: [push, workflow_dispatch]
 +jobs:
 +  hello:
 +    runs-on: ubuntu-latest
 +    env:
 +      RUN_ID: ${{ shithub.run_id }}
 +    steps:
 +      - run: echo "hello from shithub actions"
 +      - run: test -n "$RUN_ID"

cmd/shithubd/admin_actions.gomodified

136 lines changed — click to load

  package main
  import (
 +	"context"
  	"encoding/json"
 +	"errors"
  	"fmt"
  	"os"
 +	"time"
  	"github.com/spf13/cobra"
 +	actionslifecycle "github.com/tenseleyFlow/shithub/internal/actions/lifecycle"
 +	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
  	"github.com/tenseleyFlow/shithub/internal/actions/workflow"
 +	"github.com/tenseleyFlow/shithub/internal/infra/config"
 +	"github.com/tenseleyFlow/shithub/internal/infra/db"
+ )
  // adminActionsCmd is the parent group for actions-related operator
  	},
+ }
 +func newAdminActionsCancelAllCmd() *cobra.Command {
 +	var repoID int64
 +	var limit int
 +	var dryRun bool
 +	var confirm bool
++
 +	cmd := &cobra.Command{
 +		Use:   "cancel-all",
 +		Short: "Request cancellation for active Actions workflow runs",
 +		Long: `Requests cancellation for queued/running Actions workflow runs.
++
 +By default this scans all repositories, oldest first. Use --repo-id to scope
 +the operation to one repository. Running jobs receive cancel_requested=true and
 +are killed by their runner's cancel-check loop; queued jobs become terminal
 +immediately.
++
 +This is an operator break-glass command. Run with --dry-run first, then repeat
 +with --confirm to mutate state.`,
 +		Args: cobra.NoArgs,
 +		RunE: func(cmd *cobra.Command, _ []string) error {
 +			if repoID < 0 {
 +				return errors.New("admin actions cancel-all: --repo-id must be zero or positive")
 +			}
 +			if limit < 1 || limit > 5000 {
 +				return errors.New("admin actions cancel-all: --limit must be between 1 and 5000")
 +			}
 +			if !dryRun && !confirm {
 +				return errors.New("admin actions cancel-all: refusing to mutate without --confirm; use --dry-run to inspect")
 +			}
++
 +			cfg, err := config.Load(nil)
 +			if err != nil {
 +				return err
 +			}
 +			if cfg.DB.URL == "" {
 +				return errors.New("admin actions cancel-all: DB not configured (set SHITHUB_DATABASE_URL)")
 +			}
 +			ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Minute)
 +			defer cancel()
++
 +			pool, err := db.Open(ctx, db.Config{
 +				URL:            cfg.DB.URL,
 +				MaxConns:       2,
 +				MinConns:       0,
 +				ConnectTimeout: cfg.DB.ConnectTimeout,
 +			})
 +			if err != nil {
 +				return fmt.Errorf("admin actions cancel-all: db open: %w", err)
 +			}
 +			defer pool.Close()
++
 +			q := actionsdb.New()
 +			runs, err := q.ListActiveWorkflowRunsForAdmin(ctx, pool, actionsdb.ListActiveWorkflowRunsForAdminParams{
 +				RepoID:     repoID,
 +				LimitCount: int32(limit),
 +			})
 +			if err != nil {
 +				return fmt.Errorf("admin actions cancel-all: list active runs: %w", err)
 +			}
++
 +			out := cmd.OutOrStdout()
 +			scope := "all repositories"
 +			if repoID != 0 {
 +				scope = fmt.Sprintf("repo_id=%d", repoID)
 +			}
 +			if dryRun {
 +				for _, run := range runs {
 +					_, _ = fmt.Fprintf(out,
 +						"would cancel: run_id=%d repo_id=%d run_index=%d status=%s workflow=%s ref=%s sha=%s\n",
 +						run.ID, run.RepoID, run.RunIndex, run.Status, run.WorkflowFile, run.HeadRef, run.HeadSha)
 +				}
 +				_, _ = fmt.Fprintf(out, "cancel-all dry-run: found %d active run(s) in %s (limit=%d)\n",
 +					len(runs), scope, limit)
 +				return nil
 +			}
++
 +			cancelledRuns := 0
 +			cancelledJobs := 0
 +			completedRuns := 0
 +			for _, run := range runs {
 +				result, err := actionslifecycle.CancelRun(ctx, actionslifecycle.Deps{Pool: pool}, run.ID, actionslifecycle.CancelReasonUser)
 +				if err != nil {
 +					return fmt.Errorf("admin actions cancel-all: cancel run %d: %w", run.ID, err)
 +				}
 +				if len(result.ChangedJobs) > 0 {
 +					cancelledRuns++
 +				}
 +				cancelledJobs += len(result.ChangedJobs)
 +				if result.RunCompleted {
 +					completedRuns++
 +				}
 +				_, _ = fmt.Fprintf(out,
 +					"cancelled: run_id=%d repo_id=%d run_index=%d changed_jobs=%d run_completed=%t\n",
 +					run.ID, run.RepoID, run.RunIndex, len(result.ChangedJobs), result.RunCompleted)
 +			}
 +			_, _ = fmt.Fprintf(out,
 +				"cancel-all: scanned %d active run(s) in %s; changed_runs=%d changed_jobs=%d completed_runs=%d\n",
 +				len(runs), scope, cancelledRuns, cancelledJobs, completedRuns)
 +			return nil
 +		},
 +	}
 +	cmd.Flags().Int64Var(&repoID, "repo-id", 0, "Repository id to scope cancellation to; 0 scans all repositories")
 +	cmd.Flags().IntVar(&limit, "limit", 500, "Maximum active runs to scan")
 +	cmd.Flags().BoolVar(&dryRun, "dry-run", false, "Print matching active runs without mutating state")
 +	cmd.Flags().BoolVar(&confirm, "confirm", false, "Confirm cancellation of matching active runs")
 +	return cmd
 +}
++
  func init() {
  	adminActionsCmd.AddCommand(adminActionsParseCmd)
 +	adminActionsCmd.AddCommand(newAdminActionsCancelAllCmd())
  	adminCmd.AddCommand(adminActionsCmd)
+ }

docs/internal/actions-schema.mdmodified

68 lines changed — click to load

  ### `uses:` allowlist
 -Exactly three aliases, no exceptions:
 +Exactly three aliases are reserved at parse time, no exceptions:
 -| Alias                            | What it does                              |
 -| -------------------------------- | ----------------------------------------- |
 -| `actions/checkout@v4`            | Clones the repo into the workspace        |
 -| `shithub/upload-artifact@v1`     | Uploads files to `workflow_artifacts`     |
 -| `shithub/download-artifact@v1`   | Pulls artifacts back in a downstream job  |
 +| Alias                            | Parser status | Runner status                              |
 +| -------------------------------- | ------------- | ------------------------------------------ |
 +| `actions/checkout@v4`            | accepted      | rejected until checkout support lands      |
 +| `shithub/upload-artifact@v1`     | accepted      | rejected until artifact upload lands       |
 +| `shithub/download-artifact@v1`   | accepted      | rejected until artifact download lands     |
  Any other `uses:` value (community actions, Docker images, composite
  actions) is an Error-severity diagnostic. The marketplace problem is
  explicitly out of scope for v1; revisit only if a real demand exists
  and we have an answer for supply-chain trust.
 +The current Docker executor runs `run:` steps only. It fails a reserved
 +`uses:` alias deliberately instead of pretending checkout/artifact
 +semantics exist. This keeps the first end-to-end smoke path honest:
 +`run:`-only workflows are executable now, while repository checkout and
 +artifact transfer remain explicit follow-up work.
++
  ### File-size + parser caps
  - **64 KB** workflow file size cap (`workflow.MaxWorkflowFileBytes`).
    ref defaults to the repo's default branch). Returns 204 No Content
    on success. Synchronous trigger.Enqueue (no discovery — file is
    named in the URL). Auth: requires repo write.
 +- `GET /{owner}/{repo}/actions.atom`
 +  Returns the last 50 workflow runs as an Atom feed. Auth and visibility
 +  match the Actions tab (`repo:read`). Entries link to
 +  `/{owner}/{repo}/actions/runs/{run_index}` and include the workflow
 +  name/path, event, branch, short SHA, status, and conclusion.
++
 +### Webhook events (S41h)
++
 +Actions emits webhook-facing domain events through `notif.EmitTx` on
 +state transitions:
++
 +- `workflow_run`, with `payload.action` set to `queued`, `running`, or
 +  `completed` (`completed` may carry `conclusion:"cancelled"`).
 +- `workflow_job`, with `payload.action` set to `queued`, `running`,
 +  `completed`, or `cancelled`.
++
 +Payloads are structural snapshots only. They include ids, run index,
 +workflow path/name, head SHA/ref, event kind, status, conclusion,
 +timestamps, job key/name/runner id, needs, timeout, and cancellation
 +state. They deliberately exclude `workflow_runs.event_payload`, env,
 +permissions, logs, runner JWTs, and secret values. This keeps the
 +webhook surface stable without turning arbitrary workflow input into
 +subscriber-facing data.
  ### What S41b deliberately doesn't do
    but no caller produces them yet. S41b-2 adds the sweep + the
    `robfig/cron/v3` dep + `shithubd-cron.service` wiring.
  - External-PR triggers. Conservative collaborator gate above.
 -- `workflow_run` webhook events. S41h adds the webhook event family
 -  + atom feed.
  ## Secrets + variables settings surface (S41c)

docs/internal/billing.mdadded

201 lines changed — click to load

 +# Billing and paid organizations
++
 +shithub's first paid surface is organization billing. The code does not
 +ship billing yet; this document records the product and engineering
 +contract that the PAYMENTS sprint series implements.
++
 +The current implementation already has the important shape for paid
 +organizations: `orgs.plan` is an enum with `free`, `team`, and
 +`enterprise`; organizations own repositories; organization members and
 +teams exist; branch protection and PR review gates exist; Actions has
 +schema for org/repo secrets, variables, and artifacts. Billing must
 +turn that substrate into a fair hosted service without taxing
 +public/open-source collaboration.
++
 +## Product contract
++
 +As of 2026-05-12, GitHub's public pricing page presents Free at
 +`$0`, Team at `$4/user/month`, and Enterprise starting at
 +`$21/user/month`. shithub follows the same mental model but removes
 +Copilot/AI promises from the paid-org offering.
++
 +Initial decisions:
++
 +- Free organizations remain self-serve.
 +- Team is `$4` per active organization member per month.
 +- Active organization members, including owners, count as paid seats.
 +- Team has no launch trial.
 +- Enterprise is a visible contact-sales stub, not self-serve.
 +- Stripe Billing is the first payment processor.
 +- PayPal, manual invoices, SAML, SCIM, LDAP, enterprise account
 +  hierarchy, and contracts are deferred.
++
 +The fairness rule is explicit: public/open-source collaboration should
 +stay generous. Paid gates focus on private collaboration, hosted cost,
 +advanced organization controls, and support expectations.
++
 +## Pricing copy rules
++
 +Pricing and onboarding pages must describe only features shithub can
 +actually deliver on the hosted service. Before changing pricing copy,
 +refresh the official GitHub pricing source and the Stripe Billing docs
 +because both are time-sensitive inputs.
++
 +Rules for paid-org copy:
++
 +- Do not mention Copilot, AI agents, AI code review, or AI quotas.
 +- Do not promise SAML, SCIM, LDAP, managed users, audit exports, data
 +  residency, compliance attestations, contracts, or custom support
 +  until the matching implementation sprint ships.
 +- Do not advertise Packages, Pages, Wikis, Projects, Actions minutes,
 +  or storage quotas until those surfaces have enforcement and usage
 +  accounting.
 +- Use upgrade language for unavailable Team features instead of hiding
 +  existing data. Downgrades preserve configuration and make gated
 +  settings read-only where possible.
 +- Keep public/open-source collaboration generous in both copy and
 +  enforcement. Avoid copy that makes public repositories feel like a
 +  second-class Free tier.
 +- Enterprise is a contact-sales stub in v1. It should collect interest
 +  without promising contractual features.
++
 +## Entitlement matrix
++
 +| Capability | Free | Team | Enterprise stub |
 +| --- | --- | --- | --- |
 +| Public org repositories | Included | Included | Contact sales |
 +| Basic private org repositories | Included | Included | Contact sales |
 +| Org members and invitations | Included | Billed by active member | Contact sales |
 +| Visible teams | Included | Included | Contact sales |
 +| Secret teams | Upgrade | Included | Contact sales |
 +| Basic branch protection | Included | Included | Contact sales |
 +| Advanced private-repo branch protection | Upgrade | Included | Contact sales |
 +| Required reviewers on private org repos | Upgrade | Included | Contact sales |
 +| CODEOWNERS review | Deferred | Deferred | Deferred |
 +| Org-level Actions secrets | Upgrade | Included | Contact sales |
 +| Org-level Actions variables | Upgrade | Included | Contact sales |
 +| Actions minutes | Low quota once metered | Higher quota once metered | Contact sales |
 +| Actions artifacts/storage | Low quota once metered | Higher quota once metered | Contact sales |
 +| Packages storage | Deferred until Packages is active | Deferred until Packages is active | Deferred |
 +| Pages/Wikis/Projects | Do not promise until shipped | Do not promise until shipped | Deferred |
 +| Audit log export | Deferred | Deferred | Later Enterprise feature |
 +| SAML/SCIM/managed users | Deferred | Deferred | Later Enterprise feature |
 +| Data residency/compliance | Deferred | Deferred | Later Enterprise feature |
 +| Billing support | Basic instance support | Billing support after runbook exists | Contact sales |
++
 +## Current capability audit
++
 +Already present and safe to gate:
++
 +- Organizations with `plan` and `billing_email`.
 +- Organization members, owner role, and invitations.
 +- Teams, including `privacy='secret'`.
 +- Branch protection rules and required review counts.
 +- PR review and reviewer-request substrate.
 +- Org/repo Actions secrets and variables schema.
++
 +Present but missing enforcement or metering:
++
 +- Storage quota type exists, but quota persistence and enforcement are
 +  incomplete.
 +- Actions minutes, artifacts, and object usage need accounting before
 +  paid limits can be promised.
 +- Packages storage cannot be sold until the Packages sprint is active
 +  and quota enforcement exists.
++
 +Deferred:
++
 +- SAML, SCIM, LDAP, enterprise account hierarchy, audit-log export, data
 +  residency, compliance promises, and custom support SLAs.
 +- Copilot/AI features are intentionally outside shithub's paid-org
 +  product.
++
 +## Billing architecture
++
 +Stripe is the payment source of truth. shithub is the entitlement source
 +of truth.
++
 +The billing implementation should add a local billing domain that stores
 +only Stripe IDs and payment summaries, never card data. Webhooks update
 +local subscription state after signature verification. Policy and
 +request handlers read local billing/entitlement state and must not call
 +Stripe in hot paths.
++
 +Required local concepts:
++
 +- Stripe customer per billable organization.
 +- Subscription state per organization.
 +- Subscription item ID for seat quantity sync.
 +- Immutable webhook receipts with unique provider event IDs.
 +- Invoice/payment summaries for UI.
 +- Seat snapshots for auditability.
 +- Billing grace/lock state derived from processed subscription events.
++
 +PAYMENTS SP02 adds these as local database tables:
++
 +- `org_billing_states` stores the organization billing projection used
 +  by entitlement checks.
 +- `billing_seat_snapshots` records active and billable seat counts over
 +  time.
 +- `billing_invoices` stores invoice/payment summaries for billing UI.
 +- `billing_webhook_events` stores immutable provider event receipts for
 +  idempotent webhook processing.
++
 +New organizations receive a Free billing state from a database trigger,
 +and the migration backfills existing organizations as Free. Subscription
 +snapshot writes also keep `orgs.plan` synchronized as the
 +human-facing summary.
++
 +## Entitlement architecture
++
 +Paid feature checks must live behind a central entitlement package, not
 +as scattered `orgs.plan` checks in handlers.
++
 +`make lint-org-plan` enforces this boundary. Schema/sqlc plumbing may
 +store and scan the plan value, but product behavior should ask the
 +entitlement package whether a feature key is available.
++
 +Expected feature keys:
++
 +- `org.secret_teams`
 +- `org.advanced_branch_protection`
 +- `org.required_reviewers`
 +- `org.actions_org_secrets`
 +- `org.actions_org_variables`
 +- `org.private_collaboration_limit`
 +- `org.storage_quota`
 +- `org.actions_minutes_quota`
++
 +Authorization and entitlement are separate gates. A user must have both
 +the policy permission and the paid entitlement for gated writes. Denials
 +must preserve existing `policy.Maybe404` behavior where existence leaks
 +matter.
++
 +## Downgrade behavior
++
 +Downgrades must preserve customer data. Moving from Team to Free should
 +not delete teams, secrets, variables, branch rules, or review settings.
 +Existing gated resources become read-only where possible. Users can
 +remove gated configuration, but cannot create or expand it until the
 +organization upgrades again.
++
 +## Open questions for implementation
++
 +- Whether Free should limit private org collaborators before usage
 +  metering exists, or whether the first paid gates are advanced controls
 +  only.
 +- Whether required reviewers are gated only for private org repos. The
 +  current lean is private-org-only.
 +- Whether org-level Actions secrets and variables should be Team-only
 +  even for public repositories. The current lean is yes for org scope.
 +- Exact Free and Team quota numbers for Actions and storage. These must
 +  come from real host-cost estimates before SP08.
++
 +## Source references
++
 +- GitHub pricing: `https://github.com/pricing`
 +- GitHub plans docs:
 +  `https://docs.github.com/en/get-started/learning-about-github/githubs-plans`
 +- Stripe Billing: `https://docs.stripe.com/billing`
 +- Stripe pricing models:
 +  `https://docs.stripe.com/products-prices/pricing-models`

docs/internal/branch-protection.mdmodified

25 lines changed — click to load

  | ------------------------------------------------------- | ----------------------------- |
  | `GET /{owner}/{repo}/branches?filter=active|stale|`       | `branchesList`                |
  | `GET /{owner}/{repo}/tags`                              | `tagsList`                    |
 +| `GET /{owner}/{repo}/compare`                           | `compareView`                 |
  | `GET /{owner}/{repo}/compare/{base}...{head}`           | `compareView`                 |
  | `GET /{owner}/{repo}/settings/branches`                 | `settingsBranches` (auth-gated) |
  | `POST /{owner}/{repo}/settings/branches`                | upsert rule                   |
  ## Compare view
  Inputs: `base` and `head` (defaults to `repo.default_branch` when
 -empty). Renders:
+-
 -- A summary line: ahead/behind counts plus a "Create pull request"
 -  button when `head` has commits not on `base`.
 +empty). The bare `/compare` route renders GitHub's branch/tag picker
 +blank slate instead of redirecting to `default...default`. Renders:
++
 +- Base/head dropdowns listing local branches and tags with live
 +  filtering. Cross-repo `fork:branch` input is still normalized to a
 +  local ref until fork PRs ship.
 +- A mergeability/status line plus a "Create pull request" button when
 +  `head` has commits not on `base`.
  - The commits-list (head-side only) via
    `repogit.CommitsBetween(base, head, 250)`.
  - The three-dot diff via S19's renderer fed from

docs/internal/index.mdmodified

8 lines changed — click to load

  - [actions-schema.md](./actions-schema.md),
    [actions-runner-api.md](./actions-runner-api.md)
  - [orgs.md](./orgs.md), [teams.md](./teams.md)
 +- [billing.md](./billing.md) — paid org product contract,
 +  entitlements, and Stripe integration guardrails.
  - [notifications.md](./notifications.md)
  - [search.md](./search.md), [markdown.md](./markdown.md)
  - [seo.md](./seo.md) — crawler endpoints, metadata, sitemap, and

docs/internal/orgs.mdmodified

18 lines changed — click to load

  becomes available — the username_redirects table still preserves the
  old slug for 301s during the rename cooldown.
 +## Billing posture
++
 +Organizations are the first planned paid shithub surface. The
 +`orgs.plan` and `billing_email` fields are present today, but payment
 +processing and entitlement enforcement live in the PAYMENTS sprint
 +series. The durable product and implementation contract is tracked in
 +[`billing.md`](./billing.md).
++
 +Until that series lands, production code must not branch on
 +`orgs.plan` for feature access. Paid feature checks should go through
 +the future entitlement package described in the billing doc.
++
  ## What we deferred from the spec
  * **`username_redirects` rename to `principal_redirects`**. The

docs/internal/permissions.mdmodified

53 lines changed — click to load

 . **Login-required actions** (star/fork) on anonymous → deny
     (`DenyAnonymous`).
 +## Authorization versus entitlements
++
 +`policy.Can` answers only one question: is this actor allowed to
 +perform this action on this resource under shithub's permission model?
 +It must not decide whether an organization has paid for a feature.
++
 +Paid organization checks are a second gate after authorization. The
 +expected flow for gated writes is:
++
 +1. Load the resource and run the normal policy check.
 +2. Preserve `policy.Maybe404` behavior for private-resource denials.
 +3. Ask the entitlement layer whether the organization has the specific
 +   feature key.
 +4. If the feature is unavailable, return a billing/upgrade response
 +   without re-deriving ownership, visibility, role, or plan state in
 +   the handler.
++
 +The entitlement layer may inspect billing state and plan-derived
 +features. Policy code, handlers, git transports, and domain packages
 +must not branch directly on `orgs.plan` or sqlc `OrgPlan*` constants.
 +That keeps security authorization independent from commercial product
 +packaging, and makes downgrades/grace periods possible without
 +rewriting role checks.
++
  ## Existence-leak guard
  `policy.Maybe404(decision, repo, actor)` maps a denial to a status
    suspending an account takes effect on the user's next click.
  * **Web (PAT)** — `middleware.PATAuthMiddleware` rejects requests
    whose owning user has `suspended_at IS NOT NULL` with a 401 before
 -  the handler runs. Code paths under PAT auth construct
 -  `policy.UserActor(..., IsSuspended: false, ...)` because the gate
 -  is upstream; the field is still passed for honesty and is correct
 -  by construction.
 +  the handler runs. It still binds username, suspension, and site-admin
 +  fields into `middleware.PATAuth`; API policy gates must construct
 +  actors through `PATAuth.PolicyActor()` so the request actor stays
 +  honest even as the middleware evolves.
  * **git over HTTPS (`internal/web/handlers/githttp`)** — the basic-
    auth resolver (`auth.go::resolveViaPAT`/`resolveViaPassword`)
    rejects suspended owners with `errBadCredentials` *before* the
  Test files everywhere are exempt — they legitimately seed state. If a
  new pattern surfaces (e.g. an issue handler reads `issue.author_id`),
  extend the script accordingly.
++
 +`scripts/lint-org-plan-boundary.sh` also runs in `make ci`. It fails on
 +direct plan feature gates outside `internal/billing/`,
 +`internal/entitlements/`, generated sqlc models, migrations, and tests.
 +When adding a paid feature, add or use an entitlement feature key rather
 +than comparing `OrgPlanTeam` or `OrgPlanEnterprise` at the call site.

docs/internal/pull-requests.mdmodified

30 lines changed — click to load

  | `POST /{owner}/{repo}/pulls/{number}/ready`           | RequireUser   |
  | `POST /{owner}/{repo}/pulls/{number}/merge`           | RequireUser   |
 -The compare view (S20) links into `/pulls/new?base=...&head=...` so
 -the entry point matches GitHub's flow.
 +The pull-request list's "New pull request" button starts at
 +`/{owner}/{repo}/compare`, where the user picks base/head refs. Once
 +the head is ahead of base, compare links into
 +`/pulls/new?base=...&head=...`. `/pulls/new` redirects back to
 +compare when no head ref is supplied so the GitHub-style branch picker
 +remains the canonical entry point.
  ## Auto-synchronize on head push
  ## Web UI
 +- Compare/new-PR entry follows GitHub's range editor: base and head
 +  dropdowns list branches and tags with live filtering, preserve the
 +  opposite side of the comparison, and render compare URLs with the
 +  `base...head` shape.
 +- The open-PR page reuses the compare state: ahead/behind counts,
 +  mergeability probe, commits, and three-dot diff all render before
 +  submission. The form posts the selected refs as hidden fields.
 +- The new PR description uses the shared GitHub-like Markdown editor
 +  (write/preview, toolbar, mentions/references/saved replies shell).
 +  Copilot suggestions are intentionally omitted.
  - Tabbed view at `/pulls/{number}` switches between Conversation,
    Commits, Files, Checks via the `Tab` field on the template data.
  - Conversation follows GitHub's PageHeader + tab strip shape: state

docs/internal/runbooks/actions.mdmodified

149 lines changed — click to load

  # Actions runbook
 +This is the operator runbook for shithub Actions. Host provisioning lives in
 +[runner-deploy.md](./runner-deploy.md), and runner protocol details live in
 +[actions-runner-api.md](../actions-runner-api.md).
++
 +## Shape
++
 +```text
 +git push / workflow_dispatch / schedule / pull_request
 +        |
 +        v
 +workflow:trigger worker job
 +        |
 +        v
 +workflow_runs + workflow_jobs + workflow_steps + check_runs
 +        |
 +        v
 +registered runner heartbeat claims a matching queued job
 +        |
 +        v
 +containerized run: steps -> log chunks -> step/job status -> run rollup
 +```
++
 +The v1 executor supports containerized `run:` steps. The parser reserves
 +`actions/checkout@v4`, `shithub/upload-artifact@v1`, and
 +`shithub/download-artifact@v1`, but the Docker runner rejects `uses:` steps
 +until checkout metadata and artifact transfer are wired end to end. Do not use
 +`actions/checkout@v4` in production smoke workflows yet.
++
 +## First smoke
++
 +1. Confirm migrations are applied and the web process can enqueue workers.
 +2. Register one runner with a label that matches the workflow:
++
 +```sh
 +shithubd admin runner register \
 +  --name smoke-runner-1 \
 +  --labels self-hosted,linux,ubuntu-latest \
 +  --capacity 1
 +```
++
 +3. Start `shithubd-runner` with the printed token. For production hosts, use
 +   the Ansible/systemd path in [runner-deploy.md](./runner-deploy.md).
 +4. Push a `run:`-only workflow:
++
 +```yaml
 +name: smoke
 +on: [push, workflow_dispatch]
 +jobs:
 +  hello:
 +    runs-on: ubuntu-latest
 +    env:
 +      RUN_ID: ${{ shithub.run_id }}
 +    steps:
 +      - run: echo "hello from shithub actions"
 +      - run: test -n "$RUN_ID"
 +```
++
 +5. Expected result:
++
 +- `workflow:trigger` enqueues a workflow run.
 +- A runner heartbeat claims the queued job within one idle poll interval.
 +- The Actions run page streams step logs while the job is running.
 +- The matching check run completes with `success`.
 +- `/{owner}/{repo}/actions.atom` includes the completed run.
++
 +Repeat with `exit 1`; the check should complete with `failure`.
++
  ## Live log tail
  Step log pages open an SSE stream at:
  `?after=<seq>` for the first connection from a rendered log page. A terminal
  step sends `event: done` and closes the stream.
 +In `shithubd`, this route is mounted outside the normal app compression and
 +30-second timeout middleware. If a future route move puts live logs back under
 +either middleware, EventSource clients will churn and logs can buffer despite
 +the Caddy flush setting.
++
  Log chunks are never sent through Postgres `NOTIFY`. Runner log writes append
  to `workflow_step_log_chunks`, then `NOTIFY step_log_<step_id>` with only the
  sequence number. Step completion notifies `done`.
  ```sh
  sudo caddy reload --config /etc/caddy/Caddyfile
  ```
++
 +## Runner health
++
 +On the runner host:
++
 +```sh
 +systemctl status shithubd-runner
 +journalctl -u shithubd-runner -n 100 --no-pager
 +```
++
 +On the app host, inspect runner registration and heartbeat state:
++
 +```sh
 +shithubd admin actions runner list
 +```
++
 +Important metrics:
++
 +- `shithub_actions_runner_heartbeats_total{result="claimed|no_job"}`
 +- `shithub_actions_runner_jwt_total{result="issued|rejected|replay"}`
 +- `shithub_actions_jobs_cancelled_total{reason="user|concurrency|timeout"}`
 +- `shithub_actions_log_scrub_replacements_total{location="server"}`
 +- `shithub_actions_step_timeouts_total`
++
 +## Emergency cancel
++
 +Start with a dry run:
++
 +```sh
 +shithubd admin actions cancel-all --dry-run --limit 100
 +```
++
 +Scope to one repository when possible:
++
 +```sh
 +shithubd admin actions cancel-all --dry-run --repo-id 42
 +```
++
 +Then confirm:
++
 +```sh
 +shithubd admin actions cancel-all --confirm --repo-id 42
 +```
++
 +Queued jobs are marked cancelled immediately. Running jobs receive
 +`cancel_requested=true`; the runner sees that through `/cancel-check`, kills the
 +active container, and reports terminal `cancelled`.
++
 +## Common failures
++
 +- **Run never appears:** confirm the workflow file is under
 +  `.shithub/workflows/`, parse it with `shithubd admin actions parse <file>`,
 +  and verify the trigger event matches `on:`.
 +- **Run stays queued:** confirm a runner is registered with matching labels and
 +  capacity, then inspect runner journal output and heartbeat metrics.
 +- **Step logs buffer:** verify the Caddy route above and confirm the SSE route
 +  is still mounted outside compression and short timeouts.
 +- **`uses:` step fails:** expected for now. Replace with a `run:` step until
 +  checkout/artifact support lands.
 +- **Secrets appear masked inconsistently:** check
 +  `shithub_actions_log_scrub_replacements_total{location="server"}` and confirm
 +  the job was claimed after the secret was created or rotated. Mask snapshots
 +  are captured at claim time.

docs/internal/security-checklist.mdmodified

7 lines changed — click to load

  | Org suspension blocks writes | `policy.Can` + `DenyOrgSuspended` | S30 |
  | Repo soft-delete blocks all actions | `policy.Can` + `DenyRepoDeleted` | S15 |
  | Author-self-close on issues/PRs | `policy.Can` author branch | S21/S22 |
 +| Paid org feature gates stay behind entitlements | `scripts/lint-org-plan-boundary.sh` in `make ci` | PAYMENTS SP01 |
  ## Input handling

docs/public/SUMMARY.mdmodified

15 lines changed — click to load

  - [Issues](./user/issues.md)
  - [Pull requests](./user/pull-requests.md)
    - [Branch protection & reviews](./user/branch-protection.md)
 +- [Actions](./user/actions.md)
  - [Notifications](./user/notifications.md)
  - [Webhooks](./user/webhooks.md)
  - [Search](./user/search.md)
  - [Issues](./api/issues.md)
  - [Pull requests](./api/pulls.md)
  - [Status checks](./api/checks.md)
 +- [Actions workflow API](./api/actions.md)
 +- [Actions runner API](./api/actions-runner.md)
  - [Webhooks](./api/webhooks.md)
  - [Search](./api/search.md)
  - [Admin (site-admin only)](./api/admin.md)

docs/public/api/actions.mdadded

65 lines changed — click to load

 +# Actions workflow API
++
 +Actions workflow lifecycle endpoints are PAT-authenticated and require
 +`repo:write`. The token's user must also have write permission on the
 +repository that owns the target run or job.
++
 +## Runs Atom feed
++
 +```text
 +GET /{owner}/{repo}/actions.atom
 +```
++
 +Returns the last 50 workflow runs as `application/atom+xml`. Visibility
 +matches the Actions tab: public repositories are public; private
 +repositories require repository read access.
++
 +Each entry links to the run page and summarizes workflow name, event,
 +branch, commit, status, and conclusion.
++
 +## Cancel job
++
 +```text
 +POST /api/v1/jobs/{id}/cancel
 +```
++
 +Requests cancellation for a workflow job. Queued jobs become terminal
 +immediately. Running jobs set `cancel_requested=true`; the runner observes
 +that flag through its cancel-check endpoint, stops the active container, and
 +reports the terminal status.
++
 +Response: `202 Accepted`.
++
 +```json
 +{
 +  "job_id": 10,
 +  "run_id": 4,
 +  "repo_id": 2,
 +  "changed_jobs": 1,
 +  "run_completed": false,
 +  "run_conclusion": ""
 +}
 +```
++
 +## Re-run workflow run
++
 +```text
 +POST /api/v1/runs/{id}/rerun
 +```
++
 +Creates a new workflow run from the original run's commit and workflow file.
 +Only terminal runs are rerunnable. The new run records `parent_run_id` so the
 +history remains linked.
++
 +Response: `201 Created`.
++
 +```json
 +{
 +  "run_id": 12,
 +  "run_index": 8,
 +  "parent_run_id": 4,
 +  "repo_id": 2,
 +  "workflow_file": ".shithub/workflows/ci.yml",
 +  "head_sha": "0123456789abcdef0123456789abcdef01234567"
 +}
 +```

docs/public/api/overview.mdmodified

95 lines changed — click to load

  > **Status.** The API is intentionally narrow today. Endpoints
  > currently shipped: `GET /api/v1/user`, the
  > `/api/v1/repos/{owner}/{repo}/check-runs` family, and the
 -> `/api/v1/user/starred*` stars endpoints. Other sections of this
 +> `/api/v1/user/starred*` stars endpoints, plus the Actions lifecycle
 +> routes in [Actions workflow API](actions.md). Other sections of this
  > reference (Issues, Pull requests, Webhooks, etc.) describe the
  > **planned** shape and will land in subsequent sprints. Pages
  > that document planned-only endpoints carry a banner.
  `Authorization: token shp_…` is also accepted as a synonym.
  A request with no `Authorization` header — or with an invalid /
 -expired / revoked PAT — returns `401 Unauthorized` with:
 +expired / revoked PAT — returns `401 Unauthorized` with the
 +canonical JSON error envelope. The response also carries a
 +`WWW-Authenticate: Bearer realm="shithub", error="invalid_token"`
 +challenge so HTTP-aware clients can reauthenticate cleanly.
  ```json
 -{"error": "unauthenticated"}
 +{"error": "invalid token"}
  ```
  A request whose PAT lacks the scope a route requires returns
 -`403 Forbidden` with:
 +`403 Forbidden` with the required scope surfaced in the
 +`X-Accepted-OAuth-Scopes` response header. The token's actual
 +scopes are echoed on every PAT-authenticated response (including
 +errors) via `X-OAuth-Scopes`, so clients can build precise
 +"missing scope X, present scopes Y, Z" error messages without
 +parsing the body:
 -```json
 -{"error": "insufficient scope"}
 +```
 +HTTP/1.1 403 Forbidden
 +X-OAuth-Scopes: user:read
 +X-Accepted-OAuth-Scopes: repo:write
 +Content-Type: application/json; charset=utf-8
++
 +{"error":"token lacks required scope: repo:write"}
  ```
  ## Scopes
    conventional HTTP status.
  - **Cache-Control:** every API response sets `no-store`.
  - **Pagination:** list endpoints accept `?per_page=` (default 30,
 -  max 100) and return a `Link:` header with `next`, `prev`,
 -  `first`, `last` URLs (RFC 5988). Cursor pagination on hot lists
 -  uses `?cursor=…` and returns the next cursor in the `Link:`
 +  max 100) and return an RFC 8288 `Link:` header with `next`,
 +  `prev`, `first`, `last` URLs. URLs are absolute and use the
 +  instance's configured public base URL. Forward-only feeds emit
 +  only `next` / `prev` (no `first` / `last`) when totals are
 +  expensive to compute. Cursor pagination on hot lists uses
 +  `?cursor=…` and returns the next cursor in the same `Link:`
    header.
  - **Body cap:** request bodies are capped at 256 KiB. Larger
    payloads return `413`.
  - **Rate limits:** every response includes `X-RateLimit-Limit`,
    `X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers (Unix
 -  timestamp). Exceeding the limit returns `429`.
 +  timestamp). Exceeding the limit returns `429` with the canonical
 +  error envelope, a `Retry-After` header (seconds), and
 +  `X-RateLimit-Remaining: 0`. Defaults: 5000 / hour for PAT
 +  callers (keyed by token id) and 60 / hour for anonymous callers
 +  (keyed by remote IP). Operators tune via
 +  `SHITHUB_RATELIMIT__API__AUTHED_PER_HOUR` and
 +  `SHITHUB_RATELIMIT__API__ANON_PER_HOUR`.
 +- **Request id:** every response echoes `X-Request-Id`. If the
 +  caller sends one (matching `[a-z0-9/:_-]{1,128}`) it's reused;
 +  otherwise the server generates a fresh 16-byte hex id. Quote
 +  this id in support reports — it correlates against the server
 +  logs.
++
 +## Capability discovery
++
 +`GET /api/v1/meta` is unauthenticated and returns the server's
 +version stamp plus a list of feature capability strings. Clients
 +use it to gate optional features without trial-and-error:
++
 +```json
 +{
 +  "version": "v0.2.0",
 +  "commit": "abc1234",
 +  "built_at": "2026-05-12T03:00:00Z",
 +  "capabilities": ["pat-auth", "check-runs", "stars", "actions-lifecycle"]
 +}
 +```
++
 +New capability identifiers are appended as feature batches land;
 +existing entries are stable.
  ## Versioning

docs/public/api/webhooks.mdmodified

20 lines changed — click to load

  - `check_run` (actions: `created`, `completed`, `rerequested`)
  - `check_suite` (actions: `requested`, `completed`,
    `rerequested`)
 +- `workflow_run` (actions: `queued`, `running`, `completed`)
 +- `workflow_job` (actions: `queued`, `running`, `completed`,
 +  `cancelled`)
  - `star`
  - `fork`
  - `repository` (actions: `created`, `deleted`, `archived`,
  Each event's payload is documented per-type in the webhook detail
  page's "Recent deliveries" inspector — that's currently the
  authoritative reference until per-event documentation lands here.
++
 +### Actions payload safety
++
 +`workflow_run` and `workflow_job` payloads are structural snapshots:
 +ids, run index, workflow path/name, head SHA/ref, event kind, status,
 +conclusion, timestamps, job key/name, runner id, needs, timeout, and
 +cancellation state. They intentionally do **not** include workflow
 +event payloads, env, permissions, logs, runner JWTs, or secret values.

docs/public/user/webhooks.mdmodified

27 lines changed — click to load

  Each delivery includes:
 -- `X-Shithub-Event: <event-name>` — e.g., `push`, `pull_request`.
 +- `X-Shithub-Event: <event-name>` — e.g., `push`, `pull_request`,
 +  `workflow_run`.
  - `X-Shithub-Delivery: <uuid>` — unique per delivery (idempotent).
  - `X-Shithub-Signature-256: sha256=<hex>` — HMAC-SHA256 of the
    raw body using your configured secret.
  Stored bodies are capped at 32 KiB (your endpoint can accept
  bigger; we just don't keep more for the inspector).
 +## Actions events
++
 +Repository webhooks can subscribe to Actions lifecycle events:
++
 +- `workflow_run` actions: `queued`, `running`, `completed`.
 +- `workflow_job` actions: `queued`, `running`, `completed`,
 +  `cancelled`.
++
 +Actions payloads only carry structural run/job metadata. shithub does
 +not include workflow event payloads, env, permissions, logs, runner
 +tokens, or secrets in webhook bodies.
++
  ## SSRF defense
  shithub validates webhook URLs server-side: hostnames are

internal/actions/events/emit.goadded

143 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +// Package events emits webhook-facing Actions lifecycle events.
 +//
 +// These payloads are deliberately structural. Do not include workflow
 +// event_payload, env, permissions, step logs, runner JWTs, or secret material.
 +package events
++
 +import (
 +	"context"
++
 +	"github.com/jackc/pgx/v5"
 +	"github.com/jackc/pgx/v5/pgtype"
++
 +	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/notif"
 +)
++
 +const (
 +	KindWorkflowRun = "workflow_run"
 +	KindWorkflowJob = "workflow_job"
++
 +	ActionQueued    = "queued"
 +	ActionRunning   = "running"
 +	ActionCompleted = "completed"
 +	ActionCancelled = "cancelled"
 +)
++
 +// EmitRunTx writes one workflow_run domain event inside the caller's
 +// transaction. Use it when the run mutation and event row must commit
 +// atomically.
 +func EmitRunTx(ctx context.Context, tx pgx.Tx, run actionsdb.WorkflowRun, action string) error {
 +	return notif.EmitTx(ctx, tx, runEvent(run, action))
 +}
++
 +// EmitJobTx writes one workflow_job domain event inside the caller's
 +// transaction. The parent run snapshot is included so webhook subscribers do
 +// not need a second API call to identify the workflow execution.
 +func EmitJobTx(ctx context.Context, tx pgx.Tx, run actionsdb.WorkflowRun, job actionsdb.WorkflowJob, action string) error {
 +	return notif.EmitTx(ctx, tx, jobEvent(run, job, action))
 +}
++
 +func runEvent(run actionsdb.WorkflowRun, action string) notif.Event {
 +	return notif.Event{
 +		ActorUserID: int8Value(run.ActorUserID),
 +		Kind:        KindWorkflowRun,
 +		RepoID:      run.RepoID,
 +		SourceKind:  KindWorkflowRun,
 +		SourceID:    run.ID,
 +		Public:      false,
 +		Extra: map[string]any{
 +			"action":       action,
 +			"workflow_run": runPayload(run),
 +		},
 +	}
 +}
++
 +func jobEvent(run actionsdb.WorkflowRun, job actionsdb.WorkflowJob, action string) notif.Event {
 +	return notif.Event{
 +		ActorUserID: int8Value(run.ActorUserID),
 +		Kind:        KindWorkflowJob,
 +		RepoID:      run.RepoID,
 +		SourceKind:  KindWorkflowJob,
 +		SourceID:    job.ID,
 +		Public:      false,
 +		Extra: map[string]any{
 +			"action":       action,
 +			"workflow_run": runPayload(run),
 +			"workflow_job": jobPayload(job),
 +		},
 +	}
 +}
++
 +func runPayload(run actionsdb.WorkflowRun) map[string]any {
 +	return map[string]any{
 +		"id":               run.ID,
 +		"repo_id":          run.RepoID,
 +		"run_index":        run.RunIndex,
 +		"workflow_file":    run.WorkflowFile,
 +		"workflow_name":    run.WorkflowName,
 +		"head_sha":         run.HeadSha,
 +		"head_ref":         run.HeadRef,
 +		"event":            string(run.Event),
 +		"status":           string(run.Status),
 +		"conclusion":       conclusionValue(run.Conclusion),
 +		"actor_user_id":    int8Nullable(run.ActorUserID),
 +		"parent_run_id":    int8Nullable(run.ParentRunID),
 +		"created_at":       timeValue(run.CreatedAt),
 +		"updated_at":       timeValue(run.UpdatedAt),
 +		"started_at":       timeValue(run.StartedAt),
 +		"completed_at":     timeValue(run.CompletedAt),
 +		"trigger_event_id": run.TriggerEventID,
 +	}
 +}
++
 +func jobPayload(job actionsdb.WorkflowJob) map[string]any {
 +	return map[string]any{
 +		"id":               job.ID,
 +		"run_id":           job.RunID,
 +		"job_index":        job.JobIndex,
 +		"job_key":          job.JobKey,
 +		"job_name":         job.JobName,
 +		"runs_on":          job.RunsOn,
 +		"runner_id":        int8Nullable(job.RunnerID),
 +		"needs_jobs":       job.NeedsJobs,
 +		"timeout_minutes":  job.TimeoutMinutes,
 +		"status":           string(job.Status),
 +		"conclusion":       conclusionValue(job.Conclusion),
 +		"cancel_requested": job.CancelRequested,
 +		"created_at":       timeValue(job.CreatedAt),
 +		"updated_at":       timeValue(job.UpdatedAt),
 +		"started_at":       timeValue(job.StartedAt),
 +		"completed_at":     timeValue(job.CompletedAt),
 +	}
 +}
++
 +func conclusionValue(v actionsdb.NullCheckConclusion) any {
 +	if !v.Valid {
 +		return nil
 +	}
 +	return string(v.CheckConclusion)
 +}
++
 +func int8Value(v pgtype.Int8) int64 {
 +	if !v.Valid {
 +		return 0
 +	}
 +	return v.Int64
 +}
++
 +func int8Nullable(v pgtype.Int8) any {
 +	if !v.Valid {
 +		return nil
 +	}
 +	return v.Int64
 +}
++
 +func timeValue(v pgtype.Timestamptz) any {
 +	if !v.Valid {
 +		return nil
 +	}
 +	return v.Time.UTC().Format("2006-01-02T15:04:05.999999999Z07:00")
 +}

internal/actions/events/emit_test.goadded

83 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package events
++
 +import (
 +	"encoding/json"
 +	"strings"
 +	"testing"
 +	"time"
++
 +	"github.com/jackc/pgx/v5/pgtype"
++
 +	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
 +)
++
 +func TestPayloadsExcludeSensitiveWorkflowState(t *testing.T) {
 +	now := pgtype.Timestamptz{Time: time.Date(2026, 5, 12, 12, 0, 0, 0, time.UTC), Valid: true}
 +	run := actionsdb.WorkflowRun{
 +		ID:             11,
 +		RepoID:         22,
 +		RunIndex:       3,
 +		WorkflowFile:   ".shithub/workflows/ci.yml",
 +		WorkflowName:   "CI",
 +		HeadSha:        strings.Repeat("a", 40),
 +		HeadRef:        "refs/heads/trunk",
 +		Event:          actionsdb.WorkflowRunEventPush,
 +		EventPayload:   []byte(`{"secret":"do-not-emit"}`),
 +		ActorUserID:    pgtype.Int8{Int64: 33, Valid: true},
 +		Status:         actionsdb.WorkflowRunStatusRunning,
 +		TriggerEventID: "push:demo",
 +		CreatedAt:      now,
 +		UpdatedAt:      now,
 +		StartedAt:      now,
 +	}
 +	job := actionsdb.WorkflowJob{
 +		ID:             44,
 +		RunID:          run.ID,
 +		JobIndex:       0,
 +		JobKey:         "build",
 +		JobName:        "Build",
 +		RunsOn:         "ubuntu-latest",
 +		NeedsJobs:      []string{},
 +		TimeoutMinutes: 30,
 +		Permissions:    []byte(`{"contents":"read"}`),
 +		JobEnv:         []byte(`{"TOKEN":"do-not-emit"}`),
 +		Status:         actionsdb.WorkflowJobStatusCompleted,
 +		Conclusion:     actionsdb.NullCheckConclusion{CheckConclusion: actionsdb.CheckConclusionSuccess, Valid: true},
 +		CreatedAt:      now,
 +		UpdatedAt:      now,
 +		StartedAt:      now,
 +		CompletedAt:    now,
 +	}
++
 +	payload, err := json.Marshal(jobEvent(run, job, ActionCompleted).Extra)
 +	if err != nil {
 +		t.Fatalf("marshal payload: %v", err)
 +	}
 +	got := string(payload)
 +	for _, forbidden := range []string{
 +		"event_payload",
 +		"do-not-emit",
 +		"permissions",
 +		"job_env",
 +		"TOKEN",
 +		"secret",
 +	} {
 +		if strings.Contains(got, forbidden) {
 +			t.Fatalf("payload leaked %q: %s", forbidden, got)
 +		}
 +	}
 +	for _, required := range []string{
 +		`"action":"completed"`,
 +		`"workflow_run"`,
 +		`"workflow_job"`,
 +		`"status":"completed"`,
 +		`"conclusion":"success"`,
 +		`"trigger_event_id":"push:demo"`,
 +	} {
 +		if !strings.Contains(got, required) {
 +			t.Fatalf("payload missing %q: %s", required, got)
 +		}
 +	}
 +}

internal/actions/lifecycle/cancel.gomodified

60 lines changed — click to load

  	"github.com/jackc/pgx/v5"
  	"github.com/tenseleyFlow/shithub/internal/actions/checksync"
 +	actionsevents "github.com/tenseleyFlow/shithub/internal/actions/events"
  	"github.com/tenseleyFlow/shithub/internal/actions/runstate"
  	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
  	"github.com/tenseleyFlow/shithub/internal/infra/metrics"
  		if err != nil {
  			return CancelResult{}, err
+ 		}
 +		run, err := q.GetWorkflowRunByID(ctx, tx, runID)
 +		if err != nil {
 +			return CancelResult{}, err
 +		}
 +		if err := emitCancelEvents(ctx, tx, run, changed, runCompleted); err != nil {
 +			return CancelResult{}, err
 +		}
+ 	}
  	if err := tx.Commit(ctx); err != nil {
  		return CancelResult{}, err
  		if err != nil {
  			return CancelResult{}, err
+ 		}
 +		run, err := q.GetWorkflowRunByID(ctx, tx, runID)
 +		if err != nil {
 +			return CancelResult{}, err
 +		}
 +		if err := emitCancelEvents(ctx, tx, run, changed, runCompleted); err != nil {
 +			return CancelResult{}, err
 +		}
+ 	}
  	if err := tx.Commit(ctx); err != nil {
  		return CancelResult{}, err
  	metrics.ActionsJobsCancelledTotal.WithLabelValues(cancelReason(reason)).Add(float64(len(jobs)))
+ }
 +func emitCancelEvents(ctx context.Context, tx pgx.Tx, run actionsdb.WorkflowRun, jobs []actionsdb.WorkflowJob, runCompleted bool) error {
 +	for _, job := range jobs {
 +		if job.Status != actionsdb.WorkflowJobStatusCancelled {
 +			continue
 +		}
 +		if err := actionsevents.EmitJobTx(ctx, tx, run, job, actionsevents.ActionCancelled); err != nil {
 +			return err
 +		}
 +	}
 +	if runCompleted {
 +		action := actionsevents.ActionCompleted
 +		if run.Status == actionsdb.WorkflowRunStatusCancelled {
 +			action = actionsevents.ActionCancelled
 +		}
 +		if err := actionsevents.EmitRunTx(ctx, tx, run, action); err != nil {
 +			return err
 +		}
 +	}
 +	return nil
 +}
++
  func cancelReason(reason string) string {
  	switch strings.TrimSpace(reason) {
  	case CancelReasonUser:

internal/actions/lifecycle/cancel_test.gomodified

95 lines changed — click to load

+ 	}
+ }
 +func TestListActiveWorkflowRunsForAdminFiltersActiveRuns(t *testing.T) {
 +	ctx := context.Background()
 +	pool := dbtest.NewTestDB(t)
 +	repoID, userID := setupLifecycleRepo(t, pool)
 +	q := actionsdb.New()
++
 +	queued := insertLifecycleRun(t, pool, repoID, userID, 1)
 +	running := insertLifecycleRun(t, pool, repoID, userID, 2)
 +	running, err := q.StartWorkflowRun(ctx, pool, running.ID)
 +	if err != nil {
 +		t.Fatalf("StartWorkflowRun: %v", err)
 +	}
 +	completed := insertLifecycleRun(t, pool, repoID, userID, 3)
 +	if _, err := q.CompleteWorkflowRun(ctx, pool, actionsdb.CompleteWorkflowRunParams{
 +		ID:         completed.ID,
 +		Conclusion: actionsdb.CheckConclusionSuccess,
 +	}); err != nil {
 +		t.Fatalf("CompleteWorkflowRun: %v", err)
 +	}
 +	otherRepoID, otherUserID := setupNamedLifecycleRepo(t, pool, "bob", "other")
 +	otherRepoRun := insertLifecycleRun(t, pool, otherRepoID, otherUserID, 1)
++
 +	all, err := q.ListActiveWorkflowRunsForAdmin(ctx, pool, actionsdb.ListActiveWorkflowRunsForAdminParams{
 +		RepoID:     0,
 +		LimitCount: 10,
 +	})
 +	if err != nil {
 +		t.Fatalf("ListActiveWorkflowRunsForAdmin all: %v", err)
 +	}
 +	assertRunIDs(t, all, queued.ID, running.ID, otherRepoRun.ID)
++
 +	repoOnly, err := q.ListActiveWorkflowRunsForAdmin(ctx, pool, actionsdb.ListActiveWorkflowRunsForAdminParams{
 +		RepoID:     repoID,
 +		LimitCount: 10,
 +	})
 +	if err != nil {
 +		t.Fatalf("ListActiveWorkflowRunsForAdmin repo: %v", err)
 +	}
 +	assertRunIDs(t, repoOnly, queued.ID, running.ID)
++
 +	limited, err := q.ListActiveWorkflowRunsForAdmin(ctx, pool, actionsdb.ListActiveWorkflowRunsForAdminParams{
 +		RepoID:     0,
 +		LimitCount: 1,
 +	})
 +	if err != nil {
 +		t.Fatalf("ListActiveWorkflowRunsForAdmin limited: %v", err)
 +	}
 +	assertRunIDs(t, limited, queued.ID)
 +}
++
  func setupLifecycleRepo(t *testing.T, db actionsdb.DBTX) (repoID, userID int64) {
 +	t.Helper()
 +	return setupNamedLifecycleRepo(t, db, "alice", "demo")
 +}
++
 +func setupNamedLifecycleRepo(t *testing.T, db actionsdb.DBTX, username, repoName string) (repoID, userID int64) {
  	t.Helper()
  	ctx := context.Background()
  	user, err := usersdb.New().CreateUser(ctx, db, usersdb.CreateUserParams{
 -		Username:     "alice",
 -		DisplayName:  "Alice",
 +		Username:     username,
 +		DisplayName:  username,
  		PasswordHash: fixtureHash,
  	})
  	if err != nil {
+ 	}
  	repo, err := reposdb.New().CreateRepo(ctx, db, reposdb.CreateRepoParams{
  		OwnerUserID:   pgtype.Int8{Int64: user.ID, Valid: true},
 -		Name:          "demo",
 +		Name:          repoName,
  		DefaultBranch: "trunk",
  		Visibility:    reposdb.RepoVisibilityPublic,
  	})
  	return repo.ID, user.ID
+ }
 +func assertRunIDs(t *testing.T, runs []actionsdb.WorkflowRun, want ...int64) {
 +	t.Helper()
 +	if len(runs) != len(want) {
 +		t.Fatalf("got %d runs, want %d: %+v", len(runs), len(want), runs)
 +	}
 +	for i := range want {
 +		if runs[i].ID != want[i] {
 +			t.Fatalf("run[%d] id=%d, want %d; runs=%+v", i, runs[i].ID, want[i], runs)
 +		}
 +	}
 +}
++
  func insertLifecycleRun(t *testing.T, db actionsdb.DBTX, repoID, userID, runIndex int64) actionsdb.WorkflowRun {
  	t.Helper()
  	run, err := actionsdb.New().InsertWorkflowRun(context.Background(), db, actionsdb.InsertWorkflowRunParams{

internal/actions/logstream/logstream.gomodified

11 lines changed — click to load

  	return "LISTEN " + pgx.Identifier{Channel(stepID)}.Sanitize()
+ }
 +// UnlistenSQL returns a quoted UNLISTEN statement for the per-step channel.
 +func UnlistenSQL(stepID int64) string {
 +	return "UNLISTEN " + pgx.Identifier{Channel(stepID)}.Sanitize()
 +}
++
  // NotifyChunk wakes log tailers for a newly-persisted chunk.
  func NotifyChunk(ctx context.Context, db DBTX, stepID int64, seq int32) error {
  	return notify(ctx, db, stepID, strconv.FormatInt(int64(seq), 10))

internal/actions/logstream/logstream_test.gomodified

9 lines changed — click to load


 	if got := ListenSQL(42); got != `LISTEN "step_log_42"` {
 		t.Fatalf("ListenSQL=%q", got)
 	}
+	if got := UnlistenSQL(42); got != `UNLISTEN "step_log_42"` {
+		t.Fatalf("UnlistenSQL=%q", got)
+	}
 }
 
 func TestParsePayload(t *testing.T) {

internal/actions/queries/workflow_runs.sqlmodified

37 lines changed — click to load

      updated_at = now()
  WHERE id = $1 AND status = 'queued';
 +-- name: StartWorkflowRun :one
 +UPDATE workflow_runs
 +SET status = 'running',
 +    started_at = COALESCE(started_at, now()),
 +    version = version + 1,
 +    updated_at = now()
 +WHERE id = $1 AND status = 'queued'
 +RETURNING id, repo_id, run_index, workflow_file, workflow_name,
 +          head_sha, head_ref, event, event_payload,
 +          actor_user_id, parent_run_id, concurrency_group,
 +          status, conclusion, pinned, need_approval, approved_by_user_id,
 +          started_at, completed_at, version, created_at, updated_at, trigger_event_id;
++
  -- name: CompleteWorkflowRun :one
  UPDATE workflow_runs
  SET status = 'completed',
    AND (sqlc.narg(conclusion)::check_conclusion IS NULL OR r.conclusion = sqlc.narg(conclusion)::check_conclusion)
    AND (sqlc.narg(actor_username)::text IS NULL OR u.username = sqlc.narg(actor_username)::citext);
 +-- name: ListActiveWorkflowRunsForAdmin :many
 +SELECT id, repo_id, run_index, workflow_file, workflow_name,
 +       head_sha, head_ref, event, event_payload,
 +       actor_user_id, parent_run_id, concurrency_group,
 +       status, conclusion, pinned, need_approval, approved_by_user_id,
 +       started_at, completed_at, version, created_at, updated_at, trigger_event_id
 +FROM workflow_runs
 +WHERE status IN ('queued', 'running')
 +  AND (sqlc.arg(repo_id)::bigint = 0 OR repo_id = sqlc.arg(repo_id)::bigint)
 +ORDER BY created_at ASC, id ASC
 +LIMIT sqlc.arg(limit_count)::int;
++
  -- name: ListWorkflowRunWorkflowsForRepo :many
  WITH ranked AS (
      SELECT workflow_file,

internal/actions/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/actions/sqlc/querier.gomodified

14 lines changed — click to load

  	InsertWorkflowRun(ctx context.Context, db DBTX, arg InsertWorkflowRunParams) (WorkflowRun, error)
  	// SPDX-License-Identifier: AGPL-3.0-or-later
  	InsertWorkflowStep(ctx context.Context, db DBTX, arg InsertWorkflowStepParams) (WorkflowStep, error)
 +	ListActiveWorkflowRunsForAdmin(ctx context.Context, db DBTX, arg ListActiveWorkflowRunsForAdminParams) ([]WorkflowRun, error)
  	ListAllStepLogChunksForStep(ctx context.Context, db DBTX, stepID int64) ([]WorkflowStepLogChunk, error)
  	ListArtifactsForRun(ctx context.Context, db DBTX, runID int64) ([]ListArtifactsForRunRow, error)
  	// Older queued/running runs with the same group block the new run while they
  	RequestWorkflowJobCancel(ctx context.Context, db DBTX, id int64) (WorkflowJob, error)
  	RequestWorkflowRunCancel(ctx context.Context, db DBTX, runID int64) ([]WorkflowJob, error)
  	RevokeAllTokensForRunner(ctx context.Context, db DBTX, runnerID int64) error
 +	StartWorkflowRun(ctx context.Context, db DBTX, id int64) (WorkflowRun, error)
  	TouchRunnerHeartbeat(ctx context.Context, db DBTX, arg TouchRunnerHeartbeatParams) error
  	UpdateStepLogChunk(ctx context.Context, db DBTX, arg UpdateStepLogChunkParams) error
  	UpdateWorkflowJobStatus(ctx context.Context, db DBTX, arg UpdateWorkflowJobStatusParams) (WorkflowJob, error)

internal/actions/sqlc/workflow_runs.sql.gomodified

116 lines changed — click to load

  	return i, err
+ }
 +const listActiveWorkflowRunsForAdmin = `-- name: ListActiveWorkflowRunsForAdmin :many
 +SELECT id, repo_id, run_index, workflow_file, workflow_name,
 +       head_sha, head_ref, event, event_payload,
 +       actor_user_id, parent_run_id, concurrency_group,
 +       status, conclusion, pinned, need_approval, approved_by_user_id,
 +       started_at, completed_at, version, created_at, updated_at, trigger_event_id
 +FROM workflow_runs
 +WHERE status IN ('queued', 'running')
 +  AND ($1::bigint = 0 OR repo_id = $1::bigint)
 +ORDER BY created_at ASC, id ASC
 +LIMIT $2::int
 +`
++
 +type ListActiveWorkflowRunsForAdminParams struct {
 +	RepoID     int64
 +	LimitCount int32
 +}
++
 +func (q *Queries) ListActiveWorkflowRunsForAdmin(ctx context.Context, db DBTX, arg ListActiveWorkflowRunsForAdminParams) ([]WorkflowRun, error) {
 +	rows, err := db.Query(ctx, listActiveWorkflowRunsForAdmin, arg.RepoID, arg.LimitCount)
 +	if err != nil {
 +		return nil, err
 +	}
 +	defer rows.Close()
 +	items := []WorkflowRun{}
 +	for rows.Next() {
 +		var i WorkflowRun
 +		if err := rows.Scan(
 +			&i.ID,
 +			&i.RepoID,
 +			&i.RunIndex,
 +			&i.WorkflowFile,
 +			&i.WorkflowName,
 +			&i.HeadSha,
 +			&i.HeadRef,
 +			&i.Event,
 +			&i.EventPayload,
 +			&i.ActorUserID,
 +			&i.ParentRunID,
 +			&i.ConcurrencyGroup,
 +			&i.Status,
 +			&i.Conclusion,
 +			&i.Pinned,
 +			&i.NeedApproval,
 +			&i.ApprovedByUserID,
 +			&i.StartedAt,
 +			&i.CompletedAt,
 +			&i.Version,
 +			&i.CreatedAt,
 +			&i.UpdatedAt,
 +			&i.TriggerEventID,
 +		); err != nil {
 +			return nil, err
 +		}
 +		items = append(items, i)
 +	}
 +	if err := rows.Err(); err != nil {
 +		return nil, err
 +	}
 +	return items, nil
 +}
++
  const listBlockingConcurrencyRunsForUpdate = `-- name: ListBlockingConcurrencyRunsForUpdate :many
  SELECT r.id, r.repo_id, r.run_index, r.workflow_file, r.workflow_name,
         r.head_sha, r.head_ref, r.event, r.event_payload,
  	err := row.Scan(&next_index)
  	return next_index, err
+ }
++
 +const startWorkflowRun = `-- name: StartWorkflowRun :one
 +UPDATE workflow_runs
 +SET status = 'running',
 +    started_at = COALESCE(started_at, now()),
 +    version = version + 1,
 +    updated_at = now()
 +WHERE id = $1 AND status = 'queued'
 +RETURNING id, repo_id, run_index, workflow_file, workflow_name,
 +          head_sha, head_ref, event, event_payload,
 +          actor_user_id, parent_run_id, concurrency_group,
 +          status, conclusion, pinned, need_approval, approved_by_user_id,
 +          started_at, completed_at, version, created_at, updated_at, trigger_event_id
 +`
++
 +func (q *Queries) StartWorkflowRun(ctx context.Context, db DBTX, id int64) (WorkflowRun, error) {
 +	row := db.QueryRow(ctx, startWorkflowRun, id)
 +	var i WorkflowRun
 +	err := row.Scan(
 +		&i.ID,
 +		&i.RepoID,
 +		&i.RunIndex,
 +		&i.WorkflowFile,
 +		&i.WorkflowName,
 +		&i.HeadSha,
 +		&i.HeadRef,
 +		&i.Event,
 +		&i.EventPayload,
 +		&i.ActorUserID,
 +		&i.ParentRunID,
 +		&i.ConcurrencyGroup,
 +		&i.Status,
 +		&i.Conclusion,
 +		&i.Pinned,
 +		&i.NeedApproval,
 +		&i.ApprovedByUserID,
 +		&i.StartedAt,
 +		&i.CompletedAt,
 +		&i.Version,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +		&i.TriggerEventID,
 +	)
 +	return i, err
 +}

internal/actions/trigger/enqueue.gomodified

84 lines changed — click to load

  	"github.com/tenseleyFlow/shithub/internal/actions/checksync"
  	"github.com/tenseleyFlow/shithub/internal/actions/concurrency"
 +	actionsevents "github.com/tenseleyFlow/shithub/internal/actions/events"
  	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
  	"github.com/tenseleyFlow/shithub/internal/actions/workflow"
  	"github.com/tenseleyFlow/shithub/internal/checks"
+ 		}
  		return Result{}, fmt.Errorf("trigger: insert run: %w", err)
+ 	}
 +	if err := actionsevents.EmitRunTx(ctx, tx, run, actionsevents.ActionQueued); err != nil {
 +		return Result{}, fmt.Errorf("trigger: emit run queued event: %w", err)
 +	}
  	// Persist child jobs + their steps. Order in Workflow.Jobs is YAML
  	// document order, which we preserve via job_index.
  			return Result{}, fmt.Errorf("trigger: insert job %s: %w", j.Key, err)
+ 		}
  		jobIDs[i] = job.ID
 +		if err := actionsevents.EmitJobTx(ctx, tx, run, job, actionsevents.ActionQueued); err != nil {
 +			return Result{}, fmt.Errorf("trigger: emit job queued event for %s: %w", j.Key, err)
 +		}
  		for si, s := range j.Steps {
  			stepEnvJSON, err := marshalEnv(s.Env)
  	if err != nil {
  		return Result{}, fmt.Errorf("trigger: enforce concurrency: %w", err)
+ 	}
 +	if err := emitConcurrencyCancelEvents(ctx, tx, q, concurrencyResult.CancelledJobs); err != nil {
 +		return Result{}, err
 +	}
  	if err := tx.Commit(ctx); err != nil {
  		return Result{}, fmt.Errorf("trigger: commit run tx: %w", err)
  	return rows, nil
+ }
 +func emitConcurrencyCancelEvents(
 +	ctx context.Context,
 +	tx pgx.Tx,
 +	q *actionsdb.Queries,
 +	jobs []actionsdb.WorkflowJob,
 +) error {
 +	if len(jobs) == 0 {
 +		return nil
 +	}
 +	emittedRun := map[int64]struct{}{}
 +	for _, job := range jobs {
 +		run, err := q.GetWorkflowRunByID(ctx, tx, job.RunID)
 +		if err != nil {
 +			return fmt.Errorf("trigger: load concurrency-cancelled run: %w", err)
 +		}
 +		if job.Status == actionsdb.WorkflowJobStatusCancelled {
 +			if err := actionsevents.EmitJobTx(ctx, tx, run, job, actionsevents.ActionCancelled); err != nil {
 +				return fmt.Errorf("trigger: emit concurrency job cancelled event: %w", err)
 +			}
 +		}
 +		if _, ok := emittedRun[run.ID]; ok {
 +			continue
 +		}
 +		if workflowRunTerminal(run.Status) {
 +			if err := actionsevents.EmitRunTx(ctx, tx, run, runTerminalAction(run)); err != nil {
 +				return fmt.Errorf("trigger: emit concurrency run terminal event: %w", err)
 +			}
 +			emittedRun[run.ID] = struct{}{}
 +		}
 +	}
 +	return nil
 +}
++
 +func workflowRunTerminal(status actionsdb.WorkflowRunStatus) bool {
 +	return status == actionsdb.WorkflowRunStatusCompleted || status == actionsdb.WorkflowRunStatusCancelled
 +}
++
 +func runTerminalAction(run actionsdb.WorkflowRun) string {
 +	if run.Status == actionsdb.WorkflowRunStatusCancelled {
 +		return actionsevents.ActionCancelled
 +	}
 +	return actionsevents.ActionCompleted
 +}
++
  func pgInt8(v int64) pgtype.Int8 {
  	return pgtype.Int8{Int64: v, Valid: v != 0}
+ }

internal/actions/trigger/enqueue_test.gomodified

36 lines changed — click to load

  	if run.Status != actionsdb.WorkflowRunStatusQueued {
  		t.Errorf("status: got %s want queued", run.Status)
+ 	}
 +	assertDomainEventCounts(t, f.pool, f.repoID, map[string]int64{
 +		"workflow_run": 1,
 +		"workflow_job": 1,
 +	})
+ }
  func TestEnqueue_ResolvesConcurrencyGroupExpression(t *testing.T) {
  	if newRun.Status != actionsdb.WorkflowRunStatusQueued {
  		t.Fatalf("new run status: got %s want queued", newRun.Status)
+ 	}
 +	assertDomainEventCounts(t, f.pool, f.repoID, map[string]int64{
 +		"workflow_run": 3,
 +		"workflow_job": 3,
 +	})
 +}
++
 +func assertDomainEventCounts(t *testing.T, db actionsdb.DBTX, repoID int64, want map[string]int64) {
 +	t.Helper()
 +	for kind, n := range want {
 +		var got int64
 +		if err := db.QueryRow(context.Background(),
 +			`SELECT count(*) FROM domain_events WHERE repo_id = $1 AND kind = $2`,
 +			repoID, kind,
 +		).Scan(&got); err != nil {
 +			t.Fatalf("count domain events %s: %v", kind, err)
 +		}
 +		if got != n {
 +			t.Fatalf("domain_events[%s] = %d, want %d", kind, got, n)
 +		}
 +	}
+ }
  func TestClaimQueuedWorkflowJob_BlocksYoungerConcurrencyRun(t *testing.T) {

internal/admin/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/auth/audit/audit.gomodified

17 lines changed — click to load

  	ActionActionsVariableSet     Action = "actions_variable_set"
  	ActionActionsVariableDeleted Action = "actions_variable_deleted"
 +	// S41h — Actions run/job lifecycle. Metadata must stay structural:
 +	// run/job ids, status, conclusion, workflow path/name. Never include
 +	// event payloads, env, logs, permissions, tokens, or secret values.
 +	ActionWorkflowRunCreated   Action = "workflow_run_created"
 +	ActionWorkflowRunStarted   Action = "workflow_run_started"
 +	ActionWorkflowRunCompleted Action = "workflow_run_completed"
 +	ActionWorkflowJobCreated   Action = "workflow_job_created"
 +	ActionWorkflowJobStarted   Action = "workflow_job_started"
 +	ActionWorkflowJobCompleted Action = "workflow_job_completed"
 +	ActionWorkflowJobCancelled Action = "workflow_job_cancelled"
++
  	// S34 — site admin actions. Always recorded with the real admin's
  	// id in actor_id; impersonation flows additionally carry the
  	// impersonated user's id in meta.impersonated_user_id.

internal/auth/policy/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/billing/billing.goadded

309 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +// Package billing owns local paid-organization state. It stores Stripe
 +// identifiers and derived subscription state, but it does not call
 +// Stripe directly; webhook/API integration lands in SP03.
 +package billing
++
 +import (
 +	"context"
 +	"encoding/json"
 +	"errors"
 +	"fmt"
 +	"strings"
 +	"time"
++
 +	"github.com/jackc/pgx/v5"
 +	"github.com/jackc/pgx/v5/pgtype"
 +	"github.com/jackc/pgx/v5/pgxpool"
++
 +	billingdb "github.com/tenseleyFlow/shithub/internal/billing/sqlc"
 +)
++
 +type Deps struct {
 +	Pool *pgxpool.Pool
 +}
++
 +type (
 +	Plan               = billingdb.OrgPlan
 +	SubscriptionStatus = billingdb.BillingSubscriptionStatus
 +	State              = billingdb.OrgBillingState
 +)
++
 +const (
 +	PlanFree       = billingdb.OrgPlanFree
 +	PlanTeam       = billingdb.OrgPlanTeam
 +	PlanEnterprise = billingdb.OrgPlanEnterprise
++
 +	SubscriptionStatusNone       = billingdb.BillingSubscriptionStatusNone
 +	SubscriptionStatusIncomplete = billingdb.BillingSubscriptionStatusIncomplete
 +	SubscriptionStatusTrialing   = billingdb.BillingSubscriptionStatusTrialing
 +	SubscriptionStatusActive     = billingdb.BillingSubscriptionStatusActive
 +	SubscriptionStatusPastDue    = billingdb.BillingSubscriptionStatusPastDue
 +	SubscriptionStatusCanceled   = billingdb.BillingSubscriptionStatusCanceled
 +	SubscriptionStatusUnpaid     = billingdb.BillingSubscriptionStatusUnpaid
 +	SubscriptionStatusPaused     = billingdb.BillingSubscriptionStatusPaused
 +)
++
 +var (
 +	ErrPoolRequired     = errors.New("billing: pool is required")
 +	ErrOrgIDRequired    = errors.New("billing: org id is required")
 +	ErrStripeCustomerID = errors.New("billing: stripe customer id is required")
 +	ErrInvalidPlan      = errors.New("billing: invalid plan")
 +	ErrInvalidStatus    = errors.New("billing: invalid subscription status")
 +	ErrInvalidSeatCount = errors.New("billing: seat counts cannot be negative")
 +	ErrWebhookEventID   = errors.New("billing: webhook event id is required")
 +	ErrWebhookEventType = errors.New("billing: webhook event type is required")
 +	ErrWebhookPayload   = errors.New("billing: webhook payload must be a JSON object")
 +)
++
 +// SubscriptionSnapshot is the local projection of a provider
 +// subscription event. Provider-specific conversion belongs in SP03.
 +type SubscriptionSnapshot struct {
 +	OrgID                    int64
 +	Plan                     Plan
 +	Status                   SubscriptionStatus
 +	StripeSubscriptionID     string
 +	StripeSubscriptionItemID string
 +	CurrentPeriodStart       time.Time
 +	CurrentPeriodEnd         time.Time
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 time.Time
 +	CanceledAt               time.Time
 +	LastWebhookEventID       string
 +}
++
 +type SeatSnapshot struct {
 +	OrgID                int64
 +	StripeSubscriptionID string
 +	ActiveMembers        int
 +	BillableSeats        int
 +	Source               string
 +}
++
 +type WebhookEvent struct {
 +	ProviderEventID string
 +	EventType       string
 +	APIVersion      string
 +	Payload         []byte
 +}
++
 +func GetOrgBillingState(ctx context.Context, deps Deps, orgID int64) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if orgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	return billingdb.New().GetOrgBillingState(ctx, deps.Pool, orgID)
 +}
++
 +func SetStripeCustomer(ctx context.Context, deps Deps, orgID int64, customerID string) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if orgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	customerID = strings.TrimSpace(customerID)
 +	if customerID == "" {
 +		return State{}, ErrStripeCustomerID
 +	}
 +	return billingdb.New().SetStripeCustomer(ctx, deps.Pool, billingdb.SetStripeCustomerParams{
 +		OrgID:            orgID,
 +		StripeCustomerID: pgText(customerID),
 +	})
 +}
++
 +func ApplySubscriptionSnapshot(ctx context.Context, deps Deps, snap SubscriptionSnapshot) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if snap.OrgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	if !validPlan(snap.Plan) {
 +		return State{}, fmt.Errorf("%w: %q", ErrInvalidPlan, snap.Plan)
 +	}
 +	if !validStatus(snap.Status) {
 +		return State{}, fmt.Errorf("%w: %q", ErrInvalidStatus, snap.Status)
 +	}
 +	row, err := billingdb.New().ApplySubscriptionSnapshot(ctx, deps.Pool, billingdb.ApplySubscriptionSnapshotParams{
 +		OrgID:                    snap.OrgID,
 +		Plan:                     snap.Plan,
 +		SubscriptionStatus:       snap.Status,
 +		StripeSubscriptionID:     pgText(snap.StripeSubscriptionID),
 +		StripeSubscriptionItemID: pgText(snap.StripeSubscriptionItemID),
 +		CurrentPeriodStart:       pgTime(snap.CurrentPeriodStart),
 +		CurrentPeriodEnd:         pgTime(snap.CurrentPeriodEnd),
 +		CancelAtPeriodEnd:        snap.CancelAtPeriodEnd,
 +		TrialEnd:                 pgTime(snap.TrialEnd),
 +		CanceledAt:               pgTime(snap.CanceledAt),
 +		LastWebhookEventID:       strings.TrimSpace(snap.LastWebhookEventID),
 +	})
 +	if err != nil {
 +		return State{}, err
 +	}
 +	return stateFromApply(row), nil
 +}
++
 +func RecordWebhookEvent(ctx context.Context, deps Deps, event WebhookEvent) (billingdb.BillingWebhookEvent, bool, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return billingdb.BillingWebhookEvent{}, false, err
 +	}
 +	event.ProviderEventID = strings.TrimSpace(event.ProviderEventID)
 +	event.EventType = strings.TrimSpace(event.EventType)
 +	event.APIVersion = strings.TrimSpace(event.APIVersion)
 +	if event.ProviderEventID == "" {
 +		return billingdb.BillingWebhookEvent{}, false, ErrWebhookEventID
 +	}
 +	if event.EventType == "" {
 +		return billingdb.BillingWebhookEvent{}, false, ErrWebhookEventType
 +	}
 +	if !jsonObject(event.Payload) {
 +		return billingdb.BillingWebhookEvent{}, false, ErrWebhookPayload
 +	}
 +	row, err := billingdb.New().CreateWebhookEventReceipt(ctx, deps.Pool, billingdb.CreateWebhookEventReceiptParams{
 +		ProviderEventID: event.ProviderEventID,
 +		EventType:       event.EventType,
 +		ApiVersion:      event.APIVersion,
 +		Payload:         event.Payload,
 +	})
 +	if err != nil {
 +		if errors.Is(err, pgx.ErrNoRows) {
 +			return billingdb.BillingWebhookEvent{}, false, nil
 +		}
 +		return billingdb.BillingWebhookEvent{}, false, err
 +	}
 +	return row, true, nil
 +}
++
 +func SyncSeatSnapshot(ctx context.Context, deps Deps, snap SeatSnapshot) (billingdb.BillingSeatSnapshot, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return billingdb.BillingSeatSnapshot{}, err
 +	}
 +	if snap.OrgID == 0 {
 +		return billingdb.BillingSeatSnapshot{}, ErrOrgIDRequired
 +	}
 +	if snap.ActiveMembers < 0 || snap.BillableSeats < 0 {
 +		return billingdb.BillingSeatSnapshot{}, ErrInvalidSeatCount
 +	}
 +	source := strings.TrimSpace(snap.Source)
 +	if source == "" {
 +		source = "local"
 +	}
 +	row, err := billingdb.New().CreateSeatSnapshot(ctx, deps.Pool, billingdb.CreateSeatSnapshotParams{
 +		OrgID:                snap.OrgID,
 +		StripeSubscriptionID: pgText(snap.StripeSubscriptionID),
 +		ActiveMembers:        int32(snap.ActiveMembers),
 +		BillableSeats:        int32(snap.BillableSeats),
 +		Source:               source,
 +	})
 +	if err != nil {
 +		return billingdb.BillingSeatSnapshot{}, err
 +	}
 +	return billingdb.BillingSeatSnapshot(row), nil
 +}
++
 +func MarkPastDue(ctx context.Context, deps Deps, orgID int64, graceUntil time.Time, lastWebhookEventID string) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if orgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	return billingdb.New().MarkPastDue(ctx, deps.Pool, billingdb.MarkPastDueParams{
 +		OrgID:              orgID,
 +		GraceUntil:         pgTime(graceUntil),
 +		LastWebhookEventID: strings.TrimSpace(lastWebhookEventID),
 +	})
 +}
++
 +func MarkCanceled(ctx context.Context, deps Deps, orgID int64, lastWebhookEventID string) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if orgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	row, err := billingdb.New().MarkCanceled(ctx, deps.Pool, billingdb.MarkCanceledParams{
 +		OrgID:              orgID,
 +		LastWebhookEventID: strings.TrimSpace(lastWebhookEventID),
 +	})
 +	if err != nil {
 +		return State{}, err
 +	}
 +	return stateFromCanceled(row), nil
 +}
++
 +func ClearBillingLock(ctx context.Context, deps Deps, orgID int64) (State, error) {
 +	if err := validateDeps(deps); err != nil {
 +		return State{}, err
 +	}
 +	if orgID == 0 {
 +		return State{}, ErrOrgIDRequired
 +	}
 +	row, err := billingdb.New().ClearBillingLock(ctx, deps.Pool, orgID)
 +	if err != nil {
 +		return State{}, err
 +	}
 +	return stateFromClear(row), nil
 +}
++
 +func validateDeps(deps Deps) error {
 +	if deps.Pool == nil {
 +		return ErrPoolRequired
 +	}
 +	return nil
 +}
++
 +func validPlan(plan Plan) bool {
 +	switch plan {
 +	case PlanFree, PlanTeam, PlanEnterprise:
 +		return true
 +	default:
 +		return false
 +	}
 +}
++
 +func validStatus(status SubscriptionStatus) bool {
 +	switch status {
 +	case SubscriptionStatusNone,
 +		SubscriptionStatusIncomplete,
 +		SubscriptionStatusTrialing,
 +		SubscriptionStatusActive,
 +		SubscriptionStatusPastDue,
 +		SubscriptionStatusCanceled,
 +		SubscriptionStatusUnpaid,
 +		SubscriptionStatusPaused:
 +		return true
 +	default:
 +		return false
 +	}
 +}
++
 +func pgText(s string) pgtype.Text {
 +	s = strings.TrimSpace(s)
 +	return pgtype.Text{String: s, Valid: s != ""}
 +}
++
 +func pgTime(t time.Time) pgtype.Timestamptz {
 +	return pgtype.Timestamptz{Time: t, Valid: !t.IsZero()}
 +}
++
 +func jsonObject(payload []byte) bool {
 +	var v map[string]any
 +	return json.Unmarshal(payload, &v) == nil && v != nil
 +}
++
 +func stateFromApply(row billingdb.ApplySubscriptionSnapshotRow) State {
 +	return State(row)
 +}
++
 +func stateFromCanceled(row billingdb.MarkCanceledRow) State {
 +	return State(row)
 +}
++
 +func stateFromClear(row billingdb.ClearBillingLockRow) State {
 +	return State(row)
 +}

internal/billing/billing_test.goadded

208 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package billing_test
++
 +import (
 +	"context"
 +	"io"
 +	"log/slog"
 +	"testing"
 +	"time"
++
 +	"github.com/jackc/pgx/v5/pgxpool"
++
 +	"github.com/tenseleyFlow/shithub/internal/billing"
 +	billingdb "github.com/tenseleyFlow/shithub/internal/billing/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/orgs"
 +	orgsdb "github.com/tenseleyFlow/shithub/internal/orgs/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/testing/dbtest"
 +	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
 +)
++
 +const fixtureHash = "$argon2id$v=19$m=16384,t=1,p=1$" +
 +	"AAAAAAAAAAAAAAAA$" +
 +	"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
++
 +func setup(t *testing.T) (*pgxpool.Pool, billing.Deps, orgsdb.Org) {
 +	t.Helper()
 +	pool := dbtest.NewTestDB(t)
 +	ctx := context.Background()
 +	u, err := usersdb.New().CreateUser(ctx, pool, usersdb.CreateUserParams{
 +		Username: "alice", DisplayName: "Alice", PasswordHash: fixtureHash,
 +	})
 +	if err != nil {
 +		t.Fatalf("create user: %v", err)
 +	}
 +	odeps := orgs.Deps{
 +		Pool:   pool,
 +		Logger: slog.New(slog.NewTextHandler(io.Discard, nil)),
 +	}
 +	org, err := orgs.Create(ctx, odeps, orgs.CreateParams{
 +		Slug: "acme", DisplayName: "Acme Inc", CreatedByUserID: u.ID,
 +	})
 +	if err != nil {
 +		t.Fatalf("create org: %v", err)
 +	}
 +	return pool, billing.Deps{Pool: pool}, org
 +}
++
 +func TestBillingStateTransitions(t *testing.T) {
 +	pool, deps, org := setup(t)
 +	ctx := context.Background()
++
 +	state, err := billing.GetOrgBillingState(ctx, deps, org.ID)
 +	if err != nil {
 +		t.Fatalf("GetOrgBillingState: %v", err)
 +	}
 +	if state.Plan != billing.PlanFree || state.SubscriptionStatus != billing.SubscriptionStatusNone {
 +		t.Fatalf("new org state: plan=%s status=%s", state.Plan, state.SubscriptionStatus)
 +	}
++
 +	state, err = billing.SetStripeCustomer(ctx, deps, org.ID, "cus_test")
 +	if err != nil {
 +		t.Fatalf("SetStripeCustomer: %v", err)
 +	}
 +	if !state.StripeCustomerID.Valid || state.StripeCustomerID.String != "cus_test" {
 +		t.Fatalf("stripe customer not set: %+v", state.StripeCustomerID)
 +	}
++
 +	start := time.Now().UTC().Truncate(time.Second)
 +	state, err = billing.ApplySubscriptionSnapshot(ctx, deps, billing.SubscriptionSnapshot{
 +		OrgID:                    org.ID,
 +		Plan:                     billing.PlanTeam,
 +		Status:                   billing.SubscriptionStatusActive,
 +		StripeSubscriptionID:     "sub_test",
 +		StripeSubscriptionItemID: "si_test",
 +		CurrentPeriodStart:       start,
 +		CurrentPeriodEnd:         start.Add(30 * 24 * time.Hour),
 +		LastWebhookEventID:       "evt_active",
 +	})
 +	if err != nil {
 +		t.Fatalf("ApplySubscriptionSnapshot active: %v", err)
 +	}
 +	assertState(t, state, billing.PlanTeam, billing.SubscriptionStatusActive)
 +	if state.LockedAt.Valid || state.LockReason.Valid {
 +		t.Fatalf("active subscription should not be locked: %+v", state)
 +	}
 +	assertOrgPlan(t, pool, org.ID, orgsdb.OrgPlanTeam)
++
 +	grace := start.Add(7 * 24 * time.Hour)
 +	state, err = billing.MarkPastDue(ctx, deps, org.ID, grace, "evt_past_due")
 +	if err != nil {
 +		t.Fatalf("MarkPastDue: %v", err)
 +	}
 +	assertState(t, state, billing.PlanTeam, billing.SubscriptionStatusPastDue)
 +	if !state.LockedAt.Valid || !state.LockReason.Valid || state.LockReason.BillingLockReason != billingdb.BillingLockReasonPastDue {
 +		t.Fatalf("past_due should set lock fields: %+v", state)
 +	}
 +	if !state.GraceUntil.Valid {
 +		t.Fatalf("past_due should set grace_until")
 +	}
++
 +	state, err = billing.ApplySubscriptionSnapshot(ctx, deps, billing.SubscriptionSnapshot{
 +		OrgID:                    org.ID,
 +		Plan:                     billing.PlanTeam,
 +		Status:                   billing.SubscriptionStatusActive,
 +		StripeSubscriptionID:     "sub_test",
 +		StripeSubscriptionItemID: "si_test",
 +		CurrentPeriodStart:       start,
 +		CurrentPeriodEnd:         start.Add(30 * 24 * time.Hour),
 +		LastWebhookEventID:       "evt_recovered",
 +	})
 +	if err != nil {
 +		t.Fatalf("ApplySubscriptionSnapshot recovered: %v", err)
 +	}
 +	assertState(t, state, billing.PlanTeam, billing.SubscriptionStatusActive)
 +	if state.LockedAt.Valid || state.LockReason.Valid || state.GraceUntil.Valid || state.PastDueAt.Valid {
 +		t.Fatalf("recovered subscription should clear lock/grace/past_due: %+v", state)
 +	}
++
 +	state, err = billing.MarkCanceled(ctx, deps, org.ID, "evt_canceled")
 +	if err != nil {
 +		t.Fatalf("MarkCanceled: %v", err)
 +	}
 +	assertState(t, state, billing.PlanFree, billing.SubscriptionStatusCanceled)
 +	if !state.LockedAt.Valid || !state.LockReason.Valid || state.LockReason.BillingLockReason != billingdb.BillingLockReasonCanceled {
 +		t.Fatalf("canceled subscription should set canceled lock: %+v", state)
 +	}
 +	assertOrgPlan(t, pool, org.ID, orgsdb.OrgPlanFree)
++
 +	state, err = billing.ClearBillingLock(ctx, deps, org.ID)
 +	if err != nil {
 +		t.Fatalf("ClearBillingLock: %v", err)
 +	}
 +	assertState(t, state, billing.PlanFree, billing.SubscriptionStatusNone)
 +	if state.LockedAt.Valid || state.LockReason.Valid || state.GraceUntil.Valid {
 +		t.Fatalf("free state should clear billing lock: %+v", state)
 +	}
 +}
++
 +func TestRecordWebhookEventIsIdempotent(t *testing.T) {
 +	_, deps, _ := setup(t)
 +	ctx := context.Background()
++
 +	event := billing.WebhookEvent{
 +		ProviderEventID: "evt_test",
 +		EventType:       "customer.subscription.updated",
 +		APIVersion:      "2024-06-20",
 +		Payload:         []byte(`{"id":"evt_test"}`),
 +	}
 +	row, created, err := billing.RecordWebhookEvent(ctx, deps, event)
 +	if err != nil {
 +		t.Fatalf("RecordWebhookEvent first: %v", err)
 +	}
 +	if !created || row.ProviderEventID != "evt_test" {
 +		t.Fatalf("first receipt created=%v row=%+v", created, row)
 +	}
++
 +	_, created, err = billing.RecordWebhookEvent(ctx, deps, event)
 +	if err != nil {
 +		t.Fatalf("RecordWebhookEvent duplicate: %v", err)
 +	}
 +	if created {
 +		t.Fatalf("duplicate receipt should not be created")
 +	}
 +}
++
 +func TestSyncSeatSnapshotUpdatesBillingState(t *testing.T) {
 +	_, deps, org := setup(t)
 +	ctx := context.Background()
++
 +	snap, err := billing.SyncSeatSnapshot(ctx, deps, billing.SeatSnapshot{
 +		OrgID:                org.ID,
 +		StripeSubscriptionID: "sub_test",
 +		ActiveMembers:        2,
 +		BillableSeats:        2,
 +	})
 +	if err != nil {
 +		t.Fatalf("SyncSeatSnapshot: %v", err)
 +	}
 +	if snap.ActiveMembers != 2 || snap.BillableSeats != 2 || snap.Source != "local" {
 +		t.Fatalf("unexpected snapshot: %+v", snap)
 +	}
 +	state, err := billing.GetOrgBillingState(ctx, deps, org.ID)
 +	if err != nil {
 +		t.Fatalf("GetOrgBillingState: %v", err)
 +	}
 +	if state.BillableSeats != 2 || !state.SeatSnapshotAt.Valid {
 +		t.Fatalf("state did not record seat snapshot: %+v", state)
 +	}
 +}
++
 +func assertState(t *testing.T, state billing.State, plan billing.Plan, status billing.SubscriptionStatus) {
 +	t.Helper()
 +	if state.Plan != plan || state.SubscriptionStatus != status {
 +		t.Fatalf("state: want plan=%s status=%s, got plan=%s status=%s", plan, status, state.Plan, state.SubscriptionStatus)
 +	}
 +}
++
 +func assertOrgPlan(t *testing.T, pool *pgxpool.Pool, orgID int64, want orgsdb.OrgPlan) {
 +	t.Helper()
 +	row, err := orgsdb.New().GetOrgByID(context.Background(), pool, orgID)
 +	if err != nil {
 +		t.Fatalf("GetOrgByID: %v", err)
 +	}
 +	if row.Plan != want {
 +		t.Fatalf("org plan: want %s, got %s", want, row.Plan)
 +	}
 +}

internal/billing/queries/billing.sqladded

291 lines changed — click to load

 +-- SPDX-License-Identifier: AGPL-3.0-or-later
++
 +-- ─── org_billing_states ────────────────────────────────────────────
++
 +-- name: GetOrgBillingState :one
 +SELECT * FROM org_billing_states WHERE org_id = $1;
++
 +-- name: SetStripeCustomer :one
 +INSERT INTO org_billing_states (org_id, provider, stripe_customer_id)
 +VALUES ($1, 'stripe', $2)
 +ON CONFLICT (org_id) DO UPDATE
 +   SET stripe_customer_id = EXCLUDED.stripe_customer_id,
 +       provider = 'stripe',
 +       updated_at = now()
 +RETURNING *;
++
 +-- name: ApplySubscriptionSnapshot :one
 +WITH state AS (
 +    INSERT INTO org_billing_states (
 +        org_id,
 +        provider,
 +        plan,
 +        subscription_status,
 +        stripe_subscription_id,
 +        stripe_subscription_item_id,
 +        current_period_start,
 +        current_period_end,
 +        cancel_at_period_end,
 +        trial_end,
 +        canceled_at,
 +        last_webhook_event_id,
 +        past_due_at,
 +        locked_at,
 +        lock_reason,
 +        grace_until
 +    )
 +    VALUES (
 +        sqlc.arg(org_id)::bigint,
 +        'stripe',
 +        sqlc.arg(plan)::org_plan,
 +        sqlc.arg(subscription_status)::billing_subscription_status,
 +        sqlc.narg(stripe_subscription_id)::text,
 +        sqlc.narg(stripe_subscription_item_id)::text,
 +        sqlc.narg(current_period_start)::timestamptz,
 +        sqlc.narg(current_period_end)::timestamptz,
 +        sqlc.arg(cancel_at_period_end)::boolean,
 +        sqlc.narg(trial_end)::timestamptz,
 +        sqlc.narg(canceled_at)::timestamptz,
 +        sqlc.arg(last_webhook_event_id)::text,
 +        CASE
 +            WHEN sqlc.arg(subscription_status)::billing_subscription_status = 'past_due' THEN now()
 +            ELSE NULL
 +        END,
 +        NULL,
 +        NULL,
 +        NULL
 +    )
 +    ON CONFLICT (org_id) DO UPDATE
 +       SET plan = EXCLUDED.plan,
 +           subscription_status = EXCLUDED.subscription_status,
 +           stripe_subscription_id = EXCLUDED.stripe_subscription_id,
 +           stripe_subscription_item_id = EXCLUDED.stripe_subscription_item_id,
 +           current_period_start = EXCLUDED.current_period_start,
 +           current_period_end = EXCLUDED.current_period_end,
 +           cancel_at_period_end = EXCLUDED.cancel_at_period_end,
 +           trial_end = EXCLUDED.trial_end,
 +           canceled_at = EXCLUDED.canceled_at,
 +           last_webhook_event_id = EXCLUDED.last_webhook_event_id,
 +           past_due_at = CASE
 +               WHEN EXCLUDED.subscription_status = 'past_due' THEN COALESCE(org_billing_states.past_due_at, now())
 +               ELSE NULL
 +           END,
 +           locked_at = NULL,
 +           lock_reason = NULL,
 +           grace_until = NULL,
 +           updated_at = now()
 +    RETURNING *
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = sqlc.arg(plan)::org_plan,
 +           updated_at = now()
 +     WHERE id = sqlc.arg(org_id)::bigint
 +    RETURNING id
 +)
 +SELECT * FROM state;
++
 +-- name: MarkPastDue :one
 +UPDATE org_billing_states
 +   SET subscription_status = 'past_due',
 +       past_due_at = COALESCE(past_due_at, now()),
 +       locked_at = now(),
 +       lock_reason = 'past_due',
 +       grace_until = sqlc.narg(grace_until)::timestamptz,
 +       last_webhook_event_id = sqlc.arg(last_webhook_event_id)::text,
 +       updated_at = now()
 + WHERE org_id = sqlc.arg(org_id)::bigint
 +RETURNING *;
++
 +-- name: MarkCanceled :one
 +WITH state AS (
 +    UPDATE org_billing_states
 +       SET plan = 'free',
 +           subscription_status = 'canceled',
 +           canceled_at = COALESCE(canceled_at, now()),
 +           locked_at = now(),
 +           lock_reason = 'canceled',
 +           grace_until = NULL,
 +           cancel_at_period_end = false,
 +           last_webhook_event_id = sqlc.arg(last_webhook_event_id)::text,
 +           updated_at = now()
 +     WHERE org_id = sqlc.arg(org_id)::bigint
 +    RETURNING *
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = 'free',
 +           updated_at = now()
 +     WHERE id = sqlc.arg(org_id)::bigint
 +    RETURNING id
 +)
 +SELECT * FROM state;
++
 +-- name: ClearBillingLock :one
 +WITH state AS (
 +    UPDATE org_billing_states
 +       SET plan = CASE
 +               WHEN subscription_status = 'canceled' THEN 'free'
 +               ELSE plan
 +           END,
 +           subscription_status = CASE
 +               WHEN subscription_status = 'canceled' THEN 'none'
 +               ELSE subscription_status
 +           END,
 +           locked_at = NULL,
 +           lock_reason = NULL,
 +           grace_until = NULL,
 +           updated_at = now()
 +     WHERE org_id = $1
 +    RETURNING *
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = state.plan,
 +           updated_at = now()
 +      FROM state
 +     WHERE orgs.id = state.org_id
 +    RETURNING orgs.id
 +)
 +SELECT * FROM state;
++
 +-- ─── billing_seat_snapshots ────────────────────────────────────────
++
 +-- name: CreateSeatSnapshot :one
 +WITH snapshot AS (
 +    INSERT INTO billing_seat_snapshots (
 +        org_id,
 +        provider,
 +        stripe_subscription_id,
 +        active_members,
 +        billable_seats,
 +        source
 +    )
 +    VALUES (
 +        sqlc.arg(org_id)::bigint,
 +        'stripe',
 +        sqlc.narg(stripe_subscription_id)::text,
 +        sqlc.arg(active_members)::integer,
 +        sqlc.arg(billable_seats)::integer,
 +        sqlc.arg(source)::text
 +    )
 +    RETURNING *
 +), state AS (
 +    INSERT INTO org_billing_states (org_id, billable_seats, seat_snapshot_at)
 +    SELECT org_id, billable_seats, captured_at FROM snapshot
 +    ON CONFLICT (org_id) DO UPDATE
 +       SET billable_seats = EXCLUDED.billable_seats,
 +           seat_snapshot_at = EXCLUDED.seat_snapshot_at,
 +           updated_at = now()
 +    RETURNING org_id
 +)
 +SELECT * FROM snapshot;
++
 +-- name: ListSeatSnapshotsForOrg :many
 +SELECT * FROM billing_seat_snapshots
 +WHERE org_id = $1
 +ORDER BY captured_at DESC, id DESC
 +LIMIT $2;
++
 +-- ─── billing_invoices ──────────────────────────────────────────────
++
 +-- name: UpsertInvoice :one
 +INSERT INTO billing_invoices (
 +    org_id,
 +    provider,
 +    stripe_invoice_id,
 +    stripe_customer_id,
 +    stripe_subscription_id,
 +    status,
 +    number,
 +    currency,
 +    amount_due_cents,
 +    amount_paid_cents,
 +    amount_remaining_cents,
 +    hosted_invoice_url,
 +    invoice_pdf_url,
 +    period_start,
 +    period_end,
 +    due_at,
 +    paid_at,
 +    voided_at
 +)
 +VALUES (
 +    sqlc.arg(org_id)::bigint,
 +    'stripe',
 +    sqlc.arg(stripe_invoice_id)::text,
 +    sqlc.arg(stripe_customer_id)::text,
 +    sqlc.narg(stripe_subscription_id)::text,
 +    sqlc.arg(status)::billing_invoice_status,
 +    sqlc.arg(number)::text,
 +    sqlc.arg(currency)::text,
 +    sqlc.arg(amount_due_cents)::bigint,
 +    sqlc.arg(amount_paid_cents)::bigint,
 +    sqlc.arg(amount_remaining_cents)::bigint,
 +    sqlc.arg(hosted_invoice_url)::text,
 +    sqlc.arg(invoice_pdf_url)::text,
 +    sqlc.narg(period_start)::timestamptz,
 +    sqlc.narg(period_end)::timestamptz,
 +    sqlc.narg(due_at)::timestamptz,
 +    sqlc.narg(paid_at)::timestamptz,
 +    sqlc.narg(voided_at)::timestamptz
 +)
 +ON CONFLICT (provider, stripe_invoice_id) DO UPDATE
 +   SET org_id = EXCLUDED.org_id,
 +       stripe_customer_id = EXCLUDED.stripe_customer_id,
 +       stripe_subscription_id = EXCLUDED.stripe_subscription_id,
 +       status = EXCLUDED.status,
 +       number = EXCLUDED.number,
 +       currency = EXCLUDED.currency,
 +       amount_due_cents = EXCLUDED.amount_due_cents,
 +       amount_paid_cents = EXCLUDED.amount_paid_cents,
 +       amount_remaining_cents = EXCLUDED.amount_remaining_cents,
 +       hosted_invoice_url = EXCLUDED.hosted_invoice_url,
 +       invoice_pdf_url = EXCLUDED.invoice_pdf_url,
 +       period_start = EXCLUDED.period_start,
 +       period_end = EXCLUDED.period_end,
 +       due_at = EXCLUDED.due_at,
 +       paid_at = EXCLUDED.paid_at,
 +       voided_at = EXCLUDED.voided_at,
 +       updated_at = now()
 +RETURNING *;
++
 +-- name: ListInvoicesForOrg :many
 +SELECT * FROM billing_invoices
 +WHERE org_id = $1
 +ORDER BY created_at DESC, id DESC
 +LIMIT $2;
++
 +-- ─── billing_webhook_events ────────────────────────────────────────
++
 +-- name: CreateWebhookEventReceipt :one
 +INSERT INTO billing_webhook_events (
 +    provider,
 +    provider_event_id,
 +    event_type,
 +    api_version,
 +    payload
 +)
 +VALUES (
 +    'stripe',
 +    sqlc.arg(provider_event_id)::text,
 +    sqlc.arg(event_type)::text,
 +    sqlc.arg(api_version)::text,
 +    sqlc.arg(payload)::jsonb
 +)
 +ON CONFLICT (provider, provider_event_id) DO NOTHING
 +RETURNING *;
++
 +-- name: MarkWebhookEventProcessed :one
 +UPDATE billing_webhook_events
 +   SET processed_at = now(),
 +       process_error = '',
 +       processing_attempts = processing_attempts + 1
 + WHERE provider = 'stripe'
 +   AND provider_event_id = $1
 +RETURNING *;
++
 +-- name: MarkWebhookEventFailed :one
 +UPDATE billing_webhook_events
 +   SET process_error = $2,
 +       processing_attempts = processing_attempts + 1
 + WHERE provider = 'stripe'
 +   AND provider_event_id = $1
 +RETURNING *;

internal/billing/sqlc/billing.sql.goadded

865 lines changed — click to load

 +// Code generated by sqlc. DO NOT EDIT.
 +// versions:
 +//   sqlc v1.31.1
 +// source: billing.sql
++
 +package billingdb
++
 +import (
 +	"context"
++
 +	"github.com/jackc/pgx/v5/pgtype"
 +)
++
 +const applySubscriptionSnapshot = `-- name: ApplySubscriptionSnapshot :one
 +WITH state AS (
 +    INSERT INTO org_billing_states (
 +        org_id,
 +        provider,
 +        plan,
 +        subscription_status,
 +        stripe_subscription_id,
 +        stripe_subscription_item_id,
 +        current_period_start,
 +        current_period_end,
 +        cancel_at_period_end,
 +        trial_end,
 +        canceled_at,
 +        last_webhook_event_id,
 +        past_due_at,
 +        locked_at,
 +        lock_reason,
 +        grace_until
 +    )
 +    VALUES (
 +        $1::bigint,
 +        'stripe',
 +        $2::org_plan,
 +        $3::billing_subscription_status,
 +        $4::text,
 +        $5::text,
 +        $6::timestamptz,
 +        $7::timestamptz,
 +        $8::boolean,
 +        $9::timestamptz,
 +        $10::timestamptz,
 +        $11::text,
 +        CASE
 +            WHEN $3::billing_subscription_status = 'past_due' THEN now()
 +            ELSE NULL
 +        END,
 +        NULL,
 +        NULL,
 +        NULL
 +    )
 +    ON CONFLICT (org_id) DO UPDATE
 +       SET plan = EXCLUDED.plan,
 +           subscription_status = EXCLUDED.subscription_status,
 +           stripe_subscription_id = EXCLUDED.stripe_subscription_id,
 +           stripe_subscription_item_id = EXCLUDED.stripe_subscription_item_id,
 +           current_period_start = EXCLUDED.current_period_start,
 +           current_period_end = EXCLUDED.current_period_end,
 +           cancel_at_period_end = EXCLUDED.cancel_at_period_end,
 +           trial_end = EXCLUDED.trial_end,
 +           canceled_at = EXCLUDED.canceled_at,
 +           last_webhook_event_id = EXCLUDED.last_webhook_event_id,
 +           past_due_at = CASE
 +               WHEN EXCLUDED.subscription_status = 'past_due' THEN COALESCE(org_billing_states.past_due_at, now())
 +               ELSE NULL
 +           END,
 +           locked_at = NULL,
 +           lock_reason = NULL,
 +           grace_until = NULL,
 +           updated_at = now()
 +    RETURNING org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = $2::org_plan,
 +           updated_at = now()
 +     WHERE id = $1::bigint
 +    RETURNING id
 +)
 +SELECT org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at FROM state
 +`
++
 +type ApplySubscriptionSnapshotParams struct {
 +	OrgID                    int64
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +}
++
 +type ApplySubscriptionSnapshotRow struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
 +func (q *Queries) ApplySubscriptionSnapshot(ctx context.Context, db DBTX, arg ApplySubscriptionSnapshotParams) (ApplySubscriptionSnapshotRow, error) {
 +	row := db.QueryRow(ctx, applySubscriptionSnapshot,
 +		arg.OrgID,
 +		arg.Plan,
 +		arg.SubscriptionStatus,
 +		arg.StripeSubscriptionID,
 +		arg.StripeSubscriptionItemID,
 +		arg.CurrentPeriodStart,
 +		arg.CurrentPeriodEnd,
 +		arg.CancelAtPeriodEnd,
 +		arg.TrialEnd,
 +		arg.CanceledAt,
 +		arg.LastWebhookEventID,
 +	)
 +	var i ApplySubscriptionSnapshotRow
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const clearBillingLock = `-- name: ClearBillingLock :one
 +WITH state AS (
 +    UPDATE org_billing_states
 +       SET plan = CASE
 +               WHEN subscription_status = 'canceled' THEN 'free'
 +               ELSE plan
 +           END,
 +           subscription_status = CASE
 +               WHEN subscription_status = 'canceled' THEN 'none'
 +               ELSE subscription_status
 +           END,
 +           locked_at = NULL,
 +           lock_reason = NULL,
 +           grace_until = NULL,
 +           updated_at = now()
 +     WHERE org_id = $1
 +    RETURNING org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = state.plan,
 +           updated_at = now()
 +      FROM state
 +     WHERE orgs.id = state.org_id
 +    RETURNING orgs.id
 +)
 +SELECT org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at FROM state
 +`
++
 +type ClearBillingLockRow struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
 +func (q *Queries) ClearBillingLock(ctx context.Context, db DBTX, orgID int64) (ClearBillingLockRow, error) {
 +	row := db.QueryRow(ctx, clearBillingLock, orgID)
 +	var i ClearBillingLockRow
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const createSeatSnapshot = `-- name: CreateSeatSnapshot :one
++
 +WITH snapshot AS (
 +    INSERT INTO billing_seat_snapshots (
 +        org_id,
 +        provider,
 +        stripe_subscription_id,
 +        active_members,
 +        billable_seats,
 +        source
 +    )
 +    VALUES (
 +        $1::bigint,
 +        'stripe',
 +        $2::text,
 +        $3::integer,
 +        $4::integer,
 +        $5::text
 +    )
 +    RETURNING id, org_id, provider, stripe_subscription_id, active_members, billable_seats, source, captured_at
 +), state AS (
 +    INSERT INTO org_billing_states (org_id, billable_seats, seat_snapshot_at)
 +    SELECT org_id, billable_seats, captured_at FROM snapshot
 +    ON CONFLICT (org_id) DO UPDATE
 +       SET billable_seats = EXCLUDED.billable_seats,
 +           seat_snapshot_at = EXCLUDED.seat_snapshot_at,
 +           updated_at = now()
 +    RETURNING org_id
 +)
 +SELECT id, org_id, provider, stripe_subscription_id, active_members, billable_seats, source, captured_at FROM snapshot
 +`
++
 +type CreateSeatSnapshotParams struct {
 +	OrgID                int64
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +}
++
 +type CreateSeatSnapshotRow struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +// ─── billing_seat_snapshots ────────────────────────────────────────
 +func (q *Queries) CreateSeatSnapshot(ctx context.Context, db DBTX, arg CreateSeatSnapshotParams) (CreateSeatSnapshotRow, error) {
 +	row := db.QueryRow(ctx, createSeatSnapshot,
 +		arg.OrgID,
 +		arg.StripeSubscriptionID,
 +		arg.ActiveMembers,
 +		arg.BillableSeats,
 +		arg.Source,
 +	)
 +	var i CreateSeatSnapshotRow
 +	err := row.Scan(
 +		&i.ID,
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeSubscriptionID,
 +		&i.ActiveMembers,
 +		&i.BillableSeats,
 +		&i.Source,
 +		&i.CapturedAt,
 +	)
 +	return i, err
 +}
++
 +const createWebhookEventReceipt = `-- name: CreateWebhookEventReceipt :one
++
 +INSERT INTO billing_webhook_events (
 +    provider,
 +    provider_event_id,
 +    event_type,
 +    api_version,
 +    payload
 +)
 +VALUES (
 +    'stripe',
 +    $1::text,
 +    $2::text,
 +    $3::text,
 +    $4::jsonb
 +)
 +ON CONFLICT (provider, provider_event_id) DO NOTHING
 +RETURNING id, provider, provider_event_id, event_type, api_version, payload, received_at, processed_at, process_error, processing_attempts
 +`
++
 +type CreateWebhookEventReceiptParams struct {
 +	ProviderEventID string
 +	EventType       string
 +	ApiVersion      string
 +	Payload         []byte
 +}
++
 +// ─── billing_webhook_events ────────────────────────────────────────
 +func (q *Queries) CreateWebhookEventReceipt(ctx context.Context, db DBTX, arg CreateWebhookEventReceiptParams) (BillingWebhookEvent, error) {
 +	row := db.QueryRow(ctx, createWebhookEventReceipt,
 +		arg.ProviderEventID,
 +		arg.EventType,
 +		arg.ApiVersion,
 +		arg.Payload,
 +	)
 +	var i BillingWebhookEvent
 +	err := row.Scan(
 +		&i.ID,
 +		&i.Provider,
 +		&i.ProviderEventID,
 +		&i.EventType,
 +		&i.ApiVersion,
 +		&i.Payload,
 +		&i.ReceivedAt,
 +		&i.ProcessedAt,
 +		&i.ProcessError,
 +		&i.ProcessingAttempts,
 +	)
 +	return i, err
 +}
++
 +const getOrgBillingState = `-- name: GetOrgBillingState :one
++
++
 +SELECT org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at FROM org_billing_states WHERE org_id = $1
 +`
++
 +// SPDX-License-Identifier: AGPL-3.0-or-later
 +// ─── org_billing_states ────────────────────────────────────────────
 +func (q *Queries) GetOrgBillingState(ctx context.Context, db DBTX, orgID int64) (OrgBillingState, error) {
 +	row := db.QueryRow(ctx, getOrgBillingState, orgID)
 +	var i OrgBillingState
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const listInvoicesForOrg = `-- name: ListInvoicesForOrg :many
 +SELECT id, org_id, provider, stripe_invoice_id, stripe_customer_id, stripe_subscription_id, status, number, currency, amount_due_cents, amount_paid_cents, amount_remaining_cents, hosted_invoice_url, invoice_pdf_url, period_start, period_end, due_at, paid_at, voided_at, created_at, updated_at FROM billing_invoices
 +WHERE org_id = $1
 +ORDER BY created_at DESC, id DESC
 +LIMIT $2
 +`
++
 +type ListInvoicesForOrgParams struct {
 +	OrgID int64
 +	Limit int32
 +}
++
 +func (q *Queries) ListInvoicesForOrg(ctx context.Context, db DBTX, arg ListInvoicesForOrgParams) ([]BillingInvoice, error) {
 +	rows, err := db.Query(ctx, listInvoicesForOrg, arg.OrgID, arg.Limit)
 +	if err != nil {
 +		return nil, err
 +	}
 +	defer rows.Close()
 +	items := []BillingInvoice{}
 +	for rows.Next() {
 +		var i BillingInvoice
 +		if err := rows.Scan(
 +			&i.ID,
 +			&i.OrgID,
 +			&i.Provider,
 +			&i.StripeInvoiceID,
 +			&i.StripeCustomerID,
 +			&i.StripeSubscriptionID,
 +			&i.Status,
 +			&i.Number,
 +			&i.Currency,
 +			&i.AmountDueCents,
 +			&i.AmountPaidCents,
 +			&i.AmountRemainingCents,
 +			&i.HostedInvoiceUrl,
 +			&i.InvoicePdfUrl,
 +			&i.PeriodStart,
 +			&i.PeriodEnd,
 +			&i.DueAt,
 +			&i.PaidAt,
 +			&i.VoidedAt,
 +			&i.CreatedAt,
 +			&i.UpdatedAt,
 +		); err != nil {
 +			return nil, err
 +		}
 +		items = append(items, i)
 +	}
 +	if err := rows.Err(); err != nil {
 +		return nil, err
 +	}
 +	return items, nil
 +}
++
 +const listSeatSnapshotsForOrg = `-- name: ListSeatSnapshotsForOrg :many
 +SELECT id, org_id, provider, stripe_subscription_id, active_members, billable_seats, source, captured_at FROM billing_seat_snapshots
 +WHERE org_id = $1
 +ORDER BY captured_at DESC, id DESC
 +LIMIT $2
 +`
++
 +type ListSeatSnapshotsForOrgParams struct {
 +	OrgID int64
 +	Limit int32
 +}
++
 +func (q *Queries) ListSeatSnapshotsForOrg(ctx context.Context, db DBTX, arg ListSeatSnapshotsForOrgParams) ([]BillingSeatSnapshot, error) {
 +	rows, err := db.Query(ctx, listSeatSnapshotsForOrg, arg.OrgID, arg.Limit)
 +	if err != nil {
 +		return nil, err
 +	}
 +	defer rows.Close()
 +	items := []BillingSeatSnapshot{}
 +	for rows.Next() {
 +		var i BillingSeatSnapshot
 +		if err := rows.Scan(
 +			&i.ID,
 +			&i.OrgID,
 +			&i.Provider,
 +			&i.StripeSubscriptionID,
 +			&i.ActiveMembers,
 +			&i.BillableSeats,
 +			&i.Source,
 +			&i.CapturedAt,
 +		); err != nil {
 +			return nil, err
 +		}
 +		items = append(items, i)
 +	}
 +	if err := rows.Err(); err != nil {
 +		return nil, err
 +	}
 +	return items, nil
 +}
++
 +const markCanceled = `-- name: MarkCanceled :one
 +WITH state AS (
 +    UPDATE org_billing_states
 +       SET plan = 'free',
 +           subscription_status = 'canceled',
 +           canceled_at = COALESCE(canceled_at, now()),
 +           locked_at = now(),
 +           lock_reason = 'canceled',
 +           grace_until = NULL,
 +           cancel_at_period_end = false,
 +           last_webhook_event_id = $1::text,
 +           updated_at = now()
 +     WHERE org_id = $2::bigint
 +    RETURNING org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at
 +), org_update AS (
 +    UPDATE orgs
 +       SET plan = 'free',
 +           updated_at = now()
 +     WHERE id = $2::bigint
 +    RETURNING id
 +)
 +SELECT org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at FROM state
 +`
++
 +type MarkCanceledParams struct {
 +	LastWebhookEventID string
 +	OrgID              int64
 +}
++
 +type MarkCanceledRow struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
 +func (q *Queries) MarkCanceled(ctx context.Context, db DBTX, arg MarkCanceledParams) (MarkCanceledRow, error) {
 +	row := db.QueryRow(ctx, markCanceled, arg.LastWebhookEventID, arg.OrgID)
 +	var i MarkCanceledRow
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const markPastDue = `-- name: MarkPastDue :one
 +UPDATE org_billing_states
 +   SET subscription_status = 'past_due',
 +       past_due_at = COALESCE(past_due_at, now()),
 +       locked_at = now(),
 +       lock_reason = 'past_due',
 +       grace_until = $1::timestamptz,
 +       last_webhook_event_id = $2::text,
 +       updated_at = now()
 + WHERE org_id = $3::bigint
 +RETURNING org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at
 +`
++
 +type MarkPastDueParams struct {
 +	GraceUntil         pgtype.Timestamptz
 +	LastWebhookEventID string
 +	OrgID              int64
 +}
++
 +func (q *Queries) MarkPastDue(ctx context.Context, db DBTX, arg MarkPastDueParams) (OrgBillingState, error) {
 +	row := db.QueryRow(ctx, markPastDue, arg.GraceUntil, arg.LastWebhookEventID, arg.OrgID)
 +	var i OrgBillingState
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const markWebhookEventFailed = `-- name: MarkWebhookEventFailed :one
 +UPDATE billing_webhook_events
 +   SET process_error = $2,
 +       processing_attempts = processing_attempts + 1
 + WHERE provider = 'stripe'
 +   AND provider_event_id = $1
 +RETURNING id, provider, provider_event_id, event_type, api_version, payload, received_at, processed_at, process_error, processing_attempts
 +`
++
 +type MarkWebhookEventFailedParams struct {
 +	ProviderEventID string
 +	ProcessError    string
 +}
++
 +func (q *Queries) MarkWebhookEventFailed(ctx context.Context, db DBTX, arg MarkWebhookEventFailedParams) (BillingWebhookEvent, error) {
 +	row := db.QueryRow(ctx, markWebhookEventFailed, arg.ProviderEventID, arg.ProcessError)
 +	var i BillingWebhookEvent
 +	err := row.Scan(
 +		&i.ID,
 +		&i.Provider,
 +		&i.ProviderEventID,
 +		&i.EventType,
 +		&i.ApiVersion,
 +		&i.Payload,
 +		&i.ReceivedAt,
 +		&i.ProcessedAt,
 +		&i.ProcessError,
 +		&i.ProcessingAttempts,
 +	)
 +	return i, err
 +}
++
 +const markWebhookEventProcessed = `-- name: MarkWebhookEventProcessed :one
 +UPDATE billing_webhook_events
 +   SET processed_at = now(),
 +       process_error = '',
 +       processing_attempts = processing_attempts + 1
 + WHERE provider = 'stripe'
 +   AND provider_event_id = $1
 +RETURNING id, provider, provider_event_id, event_type, api_version, payload, received_at, processed_at, process_error, processing_attempts
 +`
++
 +func (q *Queries) MarkWebhookEventProcessed(ctx context.Context, db DBTX, providerEventID string) (BillingWebhookEvent, error) {
 +	row := db.QueryRow(ctx, markWebhookEventProcessed, providerEventID)
 +	var i BillingWebhookEvent
 +	err := row.Scan(
 +		&i.ID,
 +		&i.Provider,
 +		&i.ProviderEventID,
 +		&i.EventType,
 +		&i.ApiVersion,
 +		&i.Payload,
 +		&i.ReceivedAt,
 +		&i.ProcessedAt,
 +		&i.ProcessError,
 +		&i.ProcessingAttempts,
 +	)
 +	return i, err
 +}
++
 +const setStripeCustomer = `-- name: SetStripeCustomer :one
 +INSERT INTO org_billing_states (org_id, provider, stripe_customer_id)
 +VALUES ($1, 'stripe', $2)
 +ON CONFLICT (org_id) DO UPDATE
 +   SET stripe_customer_id = EXCLUDED.stripe_customer_id,
 +       provider = 'stripe',
 +       updated_at = now()
 +RETURNING org_id, provider, stripe_customer_id, stripe_subscription_id, stripe_subscription_item_id, plan, subscription_status, billable_seats, seat_snapshot_at, current_period_start, current_period_end, cancel_at_period_end, trial_end, past_due_at, canceled_at, locked_at, lock_reason, grace_until, last_webhook_event_id, created_at, updated_at
 +`
++
 +type SetStripeCustomerParams struct {
 +	OrgID            int64
 +	StripeCustomerID pgtype.Text
 +}
++
 +func (q *Queries) SetStripeCustomer(ctx context.Context, db DBTX, arg SetStripeCustomerParams) (OrgBillingState, error) {
 +	row := db.QueryRow(ctx, setStripeCustomer, arg.OrgID, arg.StripeCustomerID)
 +	var i OrgBillingState
 +	err := row.Scan(
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.StripeSubscriptionItemID,
 +		&i.Plan,
 +		&i.SubscriptionStatus,
 +		&i.BillableSeats,
 +		&i.SeatSnapshotAt,
 +		&i.CurrentPeriodStart,
 +		&i.CurrentPeriodEnd,
 +		&i.CancelAtPeriodEnd,
 +		&i.TrialEnd,
 +		&i.PastDueAt,
 +		&i.CanceledAt,
 +		&i.LockedAt,
 +		&i.LockReason,
 +		&i.GraceUntil,
 +		&i.LastWebhookEventID,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}
++
 +const upsertInvoice = `-- name: UpsertInvoice :one
++
 +INSERT INTO billing_invoices (
 +    org_id,
 +    provider,
 +    stripe_invoice_id,
 +    stripe_customer_id,
 +    stripe_subscription_id,
 +    status,
 +    number,
 +    currency,
 +    amount_due_cents,
 +    amount_paid_cents,
 +    amount_remaining_cents,
 +    hosted_invoice_url,
 +    invoice_pdf_url,
 +    period_start,
 +    period_end,
 +    due_at,
 +    paid_at,
 +    voided_at
 +)
 +VALUES (
 +    $1::bigint,
 +    'stripe',
 +    $2::text,
 +    $3::text,
 +    $4::text,
 +    $5::billing_invoice_status,
 +    $6::text,
 +    $7::text,
 +    $8::bigint,
 +    $9::bigint,
 +    $10::bigint,
 +    $11::text,
 +    $12::text,
 +    $13::timestamptz,
 +    $14::timestamptz,
 +    $15::timestamptz,
 +    $16::timestamptz,
 +    $17::timestamptz
 +)
 +ON CONFLICT (provider, stripe_invoice_id) DO UPDATE
 +   SET org_id = EXCLUDED.org_id,
 +       stripe_customer_id = EXCLUDED.stripe_customer_id,
 +       stripe_subscription_id = EXCLUDED.stripe_subscription_id,
 +       status = EXCLUDED.status,
 +       number = EXCLUDED.number,
 +       currency = EXCLUDED.currency,
 +       amount_due_cents = EXCLUDED.amount_due_cents,
 +       amount_paid_cents = EXCLUDED.amount_paid_cents,
 +       amount_remaining_cents = EXCLUDED.amount_remaining_cents,
 +       hosted_invoice_url = EXCLUDED.hosted_invoice_url,
 +       invoice_pdf_url = EXCLUDED.invoice_pdf_url,
 +       period_start = EXCLUDED.period_start,
 +       period_end = EXCLUDED.period_end,
 +       due_at = EXCLUDED.due_at,
 +       paid_at = EXCLUDED.paid_at,
 +       voided_at = EXCLUDED.voided_at,
 +       updated_at = now()
 +RETURNING id, org_id, provider, stripe_invoice_id, stripe_customer_id, stripe_subscription_id, status, number, currency, amount_due_cents, amount_paid_cents, amount_remaining_cents, hosted_invoice_url, invoice_pdf_url, period_start, period_end, due_at, paid_at, voided_at, created_at, updated_at
 +`
++
 +type UpsertInvoiceParams struct {
 +	OrgID                int64
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +}
++
 +// ─── billing_invoices ──────────────────────────────────────────────
 +func (q *Queries) UpsertInvoice(ctx context.Context, db DBTX, arg UpsertInvoiceParams) (BillingInvoice, error) {
 +	row := db.QueryRow(ctx, upsertInvoice,
 +		arg.OrgID,
 +		arg.StripeInvoiceID,
 +		arg.StripeCustomerID,
 +		arg.StripeSubscriptionID,
 +		arg.Status,
 +		arg.Number,
 +		arg.Currency,
 +		arg.AmountDueCents,
 +		arg.AmountPaidCents,
 +		arg.AmountRemainingCents,
 +		arg.HostedInvoiceUrl,
 +		arg.InvoicePdfUrl,
 +		arg.PeriodStart,
 +		arg.PeriodEnd,
 +		arg.DueAt,
 +		arg.PaidAt,
 +		arg.VoidedAt,
 +	)
 +	var i BillingInvoice
 +	err := row.Scan(
 +		&i.ID,
 +		&i.OrgID,
 +		&i.Provider,
 +		&i.StripeInvoiceID,
 +		&i.StripeCustomerID,
 +		&i.StripeSubscriptionID,
 +		&i.Status,
 +		&i.Number,
 +		&i.Currency,
 +		&i.AmountDueCents,
 +		&i.AmountPaidCents,
 +		&i.AmountRemainingCents,
 +		&i.HostedInvoiceUrl,
 +		&i.InvoicePdfUrl,
 +		&i.PeriodStart,
 +		&i.PeriodEnd,
 +		&i.DueAt,
 +		&i.PaidAt,
 +		&i.VoidedAt,
 +		&i.CreatedAt,
 +		&i.UpdatedAt,
 +	)
 +	return i, err
 +}

internal/billing/sqlc/db.goadded

25 lines changed — click to load

 +// Code generated by sqlc. DO NOT EDIT.
 +// versions:
 +//   sqlc v1.31.1
++
 +package billingdb
++
 +import (
 +	"context"
++
 +	"github.com/jackc/pgx/v5"
 +	"github.com/jackc/pgx/v5/pgconn"
 +)
++
 +type DBTX interface {
 +	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
 +	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
 +	QueryRow(context.Context, string, ...interface{}) pgx.Row
 +}
++
 +func New() *Queries {
 +	return &Queries{}
 +}
++
 +type Queries struct {
 +}

internal/actions/sqlc/models.go → internal/billing/sqlc/models.gocopied (89% similarity)

276 lines changed — click to load

  // versions:
  //   sqlc v1.31.1
 -package actionsdb
 +package billingdb
  import (
  	"database/sql/driver"
  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/billing/sqlc/querier.goadded

32 lines changed — click to load

 +// Code generated by sqlc. DO NOT EDIT.
 +// versions:
 +//   sqlc v1.31.1
++
 +package billingdb
++
 +import (
 +	"context"
 +)
++
 +type Querier interface {
 +	ApplySubscriptionSnapshot(ctx context.Context, db DBTX, arg ApplySubscriptionSnapshotParams) (ApplySubscriptionSnapshotRow, error)
 +	ClearBillingLock(ctx context.Context, db DBTX, orgID int64) (ClearBillingLockRow, error)
 +	// ─── billing_seat_snapshots ────────────────────────────────────────
 +	CreateSeatSnapshot(ctx context.Context, db DBTX, arg CreateSeatSnapshotParams) (CreateSeatSnapshotRow, error)
 +	// ─── billing_webhook_events ────────────────────────────────────────
 +	CreateWebhookEventReceipt(ctx context.Context, db DBTX, arg CreateWebhookEventReceiptParams) (BillingWebhookEvent, error)
 +	// SPDX-License-Identifier: AGPL-3.0-or-later
 +	// ─── org_billing_states ────────────────────────────────────────────
 +	GetOrgBillingState(ctx context.Context, db DBTX, orgID int64) (OrgBillingState, error)
 +	ListInvoicesForOrg(ctx context.Context, db DBTX, arg ListInvoicesForOrgParams) ([]BillingInvoice, error)
 +	ListSeatSnapshotsForOrg(ctx context.Context, db DBTX, arg ListSeatSnapshotsForOrgParams) ([]BillingSeatSnapshot, error)
 +	MarkCanceled(ctx context.Context, db DBTX, arg MarkCanceledParams) (MarkCanceledRow, error)
 +	MarkPastDue(ctx context.Context, db DBTX, arg MarkPastDueParams) (OrgBillingState, error)
 +	MarkWebhookEventFailed(ctx context.Context, db DBTX, arg MarkWebhookEventFailedParams) (BillingWebhookEvent, error)
 +	MarkWebhookEventProcessed(ctx context.Context, db DBTX, providerEventID string) (BillingWebhookEvent, error)
 +	SetStripeCustomer(ctx context.Context, db DBTX, arg SetStripeCustomerParams) (OrgBillingState, error)
 +	// ─── billing_invoices ──────────────────────────────────────────────
 +	UpsertInvoice(ctx context.Context, db DBTX, arg UpsertInvoiceParams) (BillingInvoice, error)
 +}
++
 +var _ Querier = (*Queries)(nil)

internal/checks/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/infra/config/config.gomodified

56 lines changed — click to load

  	Storage        StorageConfig        `toml:"storage"`
  	Auth           AuthConfig           `toml:"auth"`
  	Notif          NotifConfig          `toml:"notif"`
 +	RateLimit      RateLimitConfig      `toml:"ratelimit"`
 +}
++
 +// RateLimitConfig configures runtime rate-limit budgets for surfaces that
 +// don't carry a domain-specific limiter. The /api/v1/ JSON surface uses
 +// the API.* sub-block; future surfaces (search, git transports) get their
 +// own sub-blocks here as they're factored out of their handlers.
 +type RateLimitConfig struct {
 +	API APIRateLimitConfig `toml:"api"`
 +}
++
 +// APIRateLimitConfig sets the per-hour budgets for /api/v1/* requests.
 +// AuthedPerHour applies when the caller presents a valid PAT (keyed by
 +// token id). AnonPerHour applies to unauthenticated callers (keyed by
 +// remote IP). Defaults are GitHub-aligned: 5000/h authed, 60/h anon —
 +// operators tune via SHITHUB_RATELIMIT__API__AUTHED_PER_HOUR /
 +// SHITHUB_RATELIMIT__API__ANON_PER_HOUR.
 +type APIRateLimitConfig struct {
 +	AuthedPerHour int `toml:"authed_per_hour"`
 +	AnonPerHour   int `toml:"anon_per_hour"`
+ }
  // NotifConfig configures the S29 notification surface. UnsubscribeKeyB64
  				ForcePathStyle: true,
  			},
  		},
 +		RateLimit: RateLimitConfig{
 +			API: APIRateLimitConfig{
 +				AuthedPerHour: 5000,
 +				AnonPerHour:   60,
 +			},
 +		},
  		Auth: AuthConfig{
  			RequireEmailVerification: true,
  			BaseURL:                  "http://127.0.0.1:8080",
  	if c.Auth.EmailFrom == "" {
  		return errors.New("config: auth.email_from is required")
+ 	}
 +	if c.RateLimit.API.AuthedPerHour < 0 {
 +		return fmt.Errorf("config: ratelimit.api.authed_per_hour: must be >= 0, got %d", c.RateLimit.API.AuthedPerHour)
 +	}
 +	if c.RateLimit.API.AnonPerHour < 0 {
 +		return fmt.Errorf("config: ratelimit.api.anon_per_hour: must be >= 0, got %d", c.RateLimit.API.AnonPerHour)
 +	}
 +	if c.RateLimit.API.AuthedPerHour == 0 {
 +		c.RateLimit.API.AuthedPerHour = 5000
 +	}
 +	if c.RateLimit.API.AnonPerHour == 0 {
 +		c.RateLimit.API.AnonPerHour = 60
 +	}
  	return nil
+ }

internal/infra/config/config_test.gomodified

62 lines changed — click to load

  		t.Errorf("Web.Addr: got %q, want :7777", cfg.Web.Addr)
+ 	}
+ }
++
 +func TestDefaults_RateLimitAPI(t *testing.T) {
 +	t.Parallel()
 +	cfg := Defaults()
 +	if cfg.RateLimit.API.AuthedPerHour != 5000 {
 +		t.Errorf("RateLimit.API.AuthedPerHour: got %d, want 5000", cfg.RateLimit.API.AuthedPerHour)
 +	}
 +	if cfg.RateLimit.API.AnonPerHour != 60 {
 +		t.Errorf("RateLimit.API.AnonPerHour: got %d, want 60", cfg.RateLimit.API.AnonPerHour)
 +	}
 +}
++
 +func TestValidate_RejectsNegativeRateLimit(t *testing.T) {
 +	t.Parallel()
 +	cfg := Defaults()
 +	cfg.RateLimit.API.AuthedPerHour = -1
 +	if err := Validate(&cfg); err == nil {
 +		t.Errorf("expected validation error for ratelimit.api.authed_per_hour=-1")
 +	}
 +	cfg = Defaults()
 +	cfg.RateLimit.API.AnonPerHour = -5
 +	if err := Validate(&cfg); err == nil {
 +		t.Errorf("expected validation error for ratelimit.api.anon_per_hour=-5")
 +	}
 +}
++
 +func TestValidate_RateLimitZeroFillsDefault(t *testing.T) {
 +	t.Parallel()
 +	cfg := Defaults()
 +	cfg.RateLimit.API.AuthedPerHour = 0
 +	cfg.RateLimit.API.AnonPerHour = 0
 +	if err := Validate(&cfg); err != nil {
 +		t.Fatalf("Validate: %v", err)
 +	}
 +	if cfg.RateLimit.API.AuthedPerHour != 5000 {
 +		t.Errorf("zero-fill authed: got %d, want 5000", cfg.RateLimit.API.AuthedPerHour)
 +	}
 +	if cfg.RateLimit.API.AnonPerHour != 60 {
 +		t.Errorf("zero-fill anon: got %d, want 60", cfg.RateLimit.API.AnonPerHour)
 +	}
 +}
++
 +func TestMergeEnv_RateLimitAPI(t *testing.T) {
 +	t.Parallel()
 +	cfg := Defaults()
 +	env := []string{
 +		"SHITHUB_RATELIMIT__API__AUTHED_PER_HOUR=10000",
 +		"SHITHUB_RATELIMIT__API__ANON_PER_HOUR=120",
 +	}
 +	if err := mergeEnv(&cfg, env); err != nil {
 +		t.Fatalf("mergeEnv: %v", err)
 +	}
 +	if cfg.RateLimit.API.AuthedPerHour != 10000 {
 +		t.Errorf("AuthedPerHour: got %d, want 10000", cfg.RateLimit.API.AuthedPerHour)
 +	}
 +	if cfg.RateLimit.API.AnonPerHour != 120 {
 +		t.Errorf("AnonPerHour: got %d, want 120", cfg.RateLimit.API.AnonPerHour)
 +	}
 +}

internal/issues/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/meta/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/migrationsfs/migrations/0061_billing_domain.sqladded

252 lines changed — click to load

 +-- SPDX-License-Identifier: AGPL-3.0-or-later
 +--
 +-- PAYMENTS SP02 — local billing domain.
 +--
 +-- Stripe remains the payment source of truth, but shithub needs local
 +-- state for entitlement checks, UI summaries, idempotent webhook
 +-- processing, and seat snapshots. These tables deliberately store
 +-- provider IDs and invoice metadata only; card data never touches
 +-- shithub.
++
 +-- +goose Up
++
 +CREATE TYPE billing_provider AS ENUM ('stripe');
++
 +CREATE TYPE billing_subscription_status AS ENUM (
 +    'none',
 +    'incomplete',
 +    'trialing',
 +    'active',
 +    'past_due',
 +    'canceled',
 +    'unpaid',
 +    'paused'
 +);
++
 +CREATE TYPE billing_lock_reason AS ENUM (
 +    'past_due',
 +    'canceled',
 +    'unpaid',
 +    'manual'
 +);
++
 +CREATE TYPE billing_invoice_status AS ENUM (
 +    'draft',
 +    'open',
 +    'paid',
 +    'void',
 +    'uncollectible'
 +);
++
 +CREATE TABLE org_billing_states (
 +    org_id                      bigint                       PRIMARY KEY REFERENCES orgs(id) ON DELETE CASCADE,
 +    provider                    billing_provider             NOT NULL DEFAULT 'stripe',
 +    stripe_customer_id          text,
 +    stripe_subscription_id      text,
 +    stripe_subscription_item_id text,
 +    plan                        org_plan                     NOT NULL DEFAULT 'free',
 +    subscription_status         billing_subscription_status   NOT NULL DEFAULT 'none',
 +    billable_seats              integer                      NOT NULL DEFAULT 0,
 +    seat_snapshot_at            timestamptz,
 +    current_period_start        timestamptz,
 +    current_period_end          timestamptz,
 +    cancel_at_period_end        boolean                      NOT NULL DEFAULT false,
 +    trial_end                   timestamptz,
 +    past_due_at                 timestamptz,
 +    canceled_at                 timestamptz,
 +    locked_at                   timestamptz,
 +    lock_reason                 billing_lock_reason,
 +    grace_until                 timestamptz,
 +    last_webhook_event_id       text                          NOT NULL DEFAULT '',
 +    created_at                  timestamptz                   NOT NULL DEFAULT now(),
 +    updated_at                  timestamptz                   NOT NULL DEFAULT now(),
++
 +    CONSTRAINT org_billing_states_seats_nonnegative CHECK (billable_seats >= 0),
 +    CONSTRAINT org_billing_states_customer_id_not_blank CHECK (
 +        stripe_customer_id IS NULL OR char_length(stripe_customer_id) > 0
 +    ),
 +    CONSTRAINT org_billing_states_subscription_id_not_blank CHECK (
 +        stripe_subscription_id IS NULL OR char_length(stripe_subscription_id) > 0
 +    ),
 +    CONSTRAINT org_billing_states_subscription_item_id_not_blank CHECK (
 +        stripe_subscription_item_id IS NULL OR char_length(stripe_subscription_item_id) > 0
 +    ),
 +    CONSTRAINT org_billing_states_lock_reason_requires_locked CHECK (
 +        lock_reason IS NULL OR locked_at IS NOT NULL
 +    ),
 +    CONSTRAINT org_billing_states_grace_requires_locked CHECK (
 +        grace_until IS NULL OR locked_at IS NOT NULL
 +    ),
 +    CONSTRAINT org_billing_states_period_order CHECK (
 +        current_period_start IS NULL
 +     OR current_period_end IS NULL
 +     OR current_period_start <= current_period_end
 +    )
 +);
++
 +CREATE UNIQUE INDEX org_billing_states_stripe_customer_unique
 +    ON org_billing_states (stripe_customer_id)
 +    WHERE stripe_customer_id IS NOT NULL;
++
 +CREATE UNIQUE INDEX org_billing_states_stripe_subscription_unique
 +    ON org_billing_states (stripe_subscription_id)
 +    WHERE stripe_subscription_id IS NOT NULL;
++
 +CREATE UNIQUE INDEX org_billing_states_stripe_subscription_item_unique
 +    ON org_billing_states (stripe_subscription_item_id)
 +    WHERE stripe_subscription_item_id IS NOT NULL;
++
 +CREATE INDEX org_billing_states_status_idx
 +    ON org_billing_states (subscription_status, updated_at DESC);
++
 +CREATE INDEX org_billing_states_locked_idx
 +    ON org_billing_states (locked_at)
 +    WHERE locked_at IS NOT NULL;
++
 +CREATE TRIGGER set_updated_at BEFORE UPDATE ON org_billing_states
 +    FOR EACH ROW EXECUTE FUNCTION tg_set_updated_at();
++
 +-- Backfill current organizations as Free. orgs.plan remains the
 +-- human-facing summary; billing state starts conservative until Stripe
 +-- webhooks activate a paid subscription.
 +INSERT INTO org_billing_states (org_id, plan)
 +SELECT id, 'free'::org_plan
 +FROM orgs
 +ON CONFLICT (org_id) DO NOTHING;
++
 +-- +goose StatementBegin
 +CREATE OR REPLACE FUNCTION tg_org_billing_state_seed() RETURNS trigger AS $$
 +BEGIN
 +    INSERT INTO org_billing_states (org_id, plan)
 +    VALUES (NEW.id, 'free'::org_plan)
 +    ON CONFLICT (org_id) DO NOTHING;
 +    RETURN NEW;
 +END;
 +$$ LANGUAGE plpgsql;
 +-- +goose StatementEnd
++
 +CREATE TRIGGER tg_org_billing_state_seed_ai
 +    AFTER INSERT ON orgs
 +    FOR EACH ROW EXECUTE FUNCTION tg_org_billing_state_seed();
++
 +CREATE TABLE billing_seat_snapshots (
 +    id                         bigserial          PRIMARY KEY,
 +    org_id                     bigint             NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
 +    provider                   billing_provider   NOT NULL DEFAULT 'stripe',
 +    stripe_subscription_id     text,
 +    active_members             integer            NOT NULL,
 +    billable_seats             integer            NOT NULL,
 +    source                     text               NOT NULL DEFAULT 'local',
 +    captured_at                timestamptz        NOT NULL DEFAULT now(),
++
 +    CONSTRAINT billing_seat_snapshots_active_members_nonnegative CHECK (active_members >= 0),
 +    CONSTRAINT billing_seat_snapshots_billable_seats_nonnegative CHECK (billable_seats >= 0),
 +    CONSTRAINT billing_seat_snapshots_source_length CHECK (char_length(source) BETWEEN 1 AND 64)
 +);
++
 +CREATE INDEX billing_seat_snapshots_org_captured_idx
 +    ON billing_seat_snapshots (org_id, captured_at DESC);
++
 +CREATE TABLE billing_invoices (
 +    id                         bigserial               PRIMARY KEY,
 +    org_id                     bigint                  NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
 +    provider                   billing_provider        NOT NULL DEFAULT 'stripe',
 +    stripe_invoice_id          text                    NOT NULL,
 +    stripe_customer_id         text                    NOT NULL,
 +    stripe_subscription_id     text,
 +    status                     billing_invoice_status  NOT NULL,
 +    number                     text                    NOT NULL DEFAULT '',
 +    currency                   text                    NOT NULL,
 +    amount_due_cents           bigint                  NOT NULL DEFAULT 0,
 +    amount_paid_cents          bigint                  NOT NULL DEFAULT 0,
 +    amount_remaining_cents     bigint                  NOT NULL DEFAULT 0,
 +    hosted_invoice_url         text                    NOT NULL DEFAULT '',
 +    invoice_pdf_url            text                    NOT NULL DEFAULT '',
 +    period_start               timestamptz,
 +    period_end                 timestamptz,
 +    due_at                     timestamptz,
 +    paid_at                    timestamptz,
 +    voided_at                  timestamptz,
 +    created_at                 timestamptz             NOT NULL DEFAULT now(),
 +    updated_at                 timestamptz             NOT NULL DEFAULT now(),
++
 +    CONSTRAINT billing_invoices_stripe_invoice_not_blank CHECK (char_length(stripe_invoice_id) > 0),
 +    CONSTRAINT billing_invoices_stripe_customer_not_blank CHECK (char_length(stripe_customer_id) > 0),
 +    CONSTRAINT billing_invoices_currency_iso CHECK (
 +        char_length(currency) = 3 AND currency = lower(currency)
 +    ),
 +    CONSTRAINT billing_invoices_amounts_nonnegative CHECK (
 +        amount_due_cents >= 0
 +        AND amount_paid_cents >= 0
 +        AND amount_remaining_cents >= 0
 +    ),
 +    CONSTRAINT billing_invoices_period_order CHECK (
 +        period_start IS NULL OR period_end IS NULL OR period_start <= period_end
 +    ),
++
 +    UNIQUE (provider, stripe_invoice_id)
 +);
++
 +CREATE INDEX billing_invoices_org_created_idx
 +    ON billing_invoices (org_id, created_at DESC);
++
 +CREATE INDEX billing_invoices_status_idx
 +    ON billing_invoices (status, created_at DESC);
++
 +CREATE TRIGGER set_updated_at BEFORE UPDATE ON billing_invoices
 +    FOR EACH ROW EXECUTE FUNCTION tg_set_updated_at();
++
 +CREATE TABLE billing_webhook_events (
 +    id                         bigserial          PRIMARY KEY,
 +    provider                   billing_provider   NOT NULL DEFAULT 'stripe',
 +    provider_event_id          text               NOT NULL,
 +    event_type                 text               NOT NULL,
 +    api_version                text               NOT NULL DEFAULT '',
 +    payload                    jsonb              NOT NULL DEFAULT '{}'::jsonb,
 +    received_at                timestamptz        NOT NULL DEFAULT now(),
 +    processed_at               timestamptz,
 +    process_error              text               NOT NULL DEFAULT '',
 +    processing_attempts        integer            NOT NULL DEFAULT 0,
++
 +    CONSTRAINT billing_webhook_events_provider_event_not_blank CHECK (char_length(provider_event_id) > 0),
 +    CONSTRAINT billing_webhook_events_type_not_blank CHECK (char_length(event_type) > 0),
 +    CONSTRAINT billing_webhook_events_attempts_nonnegative CHECK (processing_attempts >= 0),
 +    CONSTRAINT billing_webhook_events_payload_object CHECK (jsonb_typeof(payload) = 'object'),
++
 +    UNIQUE (provider, provider_event_id)
 +);
++
 +CREATE INDEX billing_webhook_events_received_idx
 +    ON billing_webhook_events (received_at DESC);
++
 +CREATE INDEX billing_webhook_events_processed_idx
 +    ON billing_webhook_events (processed_at)
 +    WHERE processed_at IS NULL;
++
 +-- +goose Down
 +DROP INDEX IF EXISTS billing_webhook_events_processed_idx;
 +DROP INDEX IF EXISTS billing_webhook_events_received_idx;
 +DROP TABLE IF EXISTS billing_webhook_events;
++
 +DROP TRIGGER IF EXISTS set_updated_at ON billing_invoices;
 +DROP INDEX IF EXISTS billing_invoices_status_idx;
 +DROP INDEX IF EXISTS billing_invoices_org_created_idx;
 +DROP TABLE IF EXISTS billing_invoices;
++
 +DROP INDEX IF EXISTS billing_seat_snapshots_org_captured_idx;
 +DROP TABLE IF EXISTS billing_seat_snapshots;
++
 +DROP TRIGGER IF EXISTS tg_org_billing_state_seed_ai ON orgs;
 +DROP FUNCTION IF EXISTS tg_org_billing_state_seed();
 +DROP TRIGGER IF EXISTS set_updated_at ON org_billing_states;
 +DROP INDEX IF EXISTS org_billing_states_locked_idx;
 +DROP INDEX IF EXISTS org_billing_states_status_idx;
 +DROP INDEX IF EXISTS org_billing_states_stripe_subscription_item_unique;
 +DROP INDEX IF EXISTS org_billing_states_stripe_subscription_unique;
 +DROP INDEX IF EXISTS org_billing_states_stripe_customer_unique;
 +DROP TABLE IF EXISTS org_billing_states;
++
 +DROP TYPE IF EXISTS billing_invoice_status;
 +DROP TYPE IF EXISTS billing_lock_reason;
 +DROP TYPE IF EXISTS billing_subscription_status;
 +DROP TYPE IF EXISTS billing_provider;

internal/notif/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/orgs/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/pulls/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/ratelimit/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/repos/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/social/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/users/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/web/auth_wiring.gomodified

19 lines changed — click to load

  	"github.com/tenseleyFlow/shithub/internal/ratelimit"
  	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
  	apih "github.com/tenseleyFlow/shithub/internal/web/handlers/api"
 +	"github.com/tenseleyFlow/shithub/internal/web/handlers/api/apilimit"
  	authh "github.com/tenseleyFlow/shithub/internal/web/handlers/auth"
  	"github.com/tenseleyFlow/shithub/internal/web/middleware"
  	"github.com/tenseleyFlow/shithub/internal/web/render"
  		RunnerJWT:   runnerJWT,
  		SecretBox:   secretBox,
  		RateLimiter: rateLimiter,
 +		BaseURL:     cfg.Auth.BaseURL,
 +		APILimit: apilimit.Config{
 +			AuthedPerHour: cfg.RateLimit.API.AuthedPerHour,
 +			AnonPerHour:   cfg.RateLimit.API.AnonPerHour,
 +			Logger:        logger,
 +		},
  	})
+ }

internal/web/embed_test.gomodified

34 lines changed — click to load

+ 	}
+ }
 +func TestExploreFeedFragmentAppendsRowsAndReplacesPagination(t *testing.T) {
 +	t.Parallel()
 +	r, err := render.New(TemplatesFS(), render.Options{})
 +	if err != nil {
 +		t.Fatalf("render.New: %v", err)
 +	}
 +	rw := httptest.NewRecorder()
 +	if err := r.RenderFragment(rw, "explore/feed_page", map[string]any{
 +		"FeedHasNext": true,
 +		"FeedNextURL": "/explore?before=2026-05-12T03%3A00%3A00Z~42",
 +	}); err != nil {
 +		t.Fatalf("RenderFragment: %v", err)
 +	}
 +	body := rw.Body.String()
 +	for _, want := range []string{
 +		`id="shithub-feed-fragment-rows"`,
 +		`hx-target="#shithub-feed-list"`,
 +		`hx-swap="beforeend"`,
 +		`hx-select="#shithub-feed-fragment-rows > *"`,
 +		`hx-select-oob="#shithub-feed-pagination:outerHTML"`,
 +		`Loading...`,
 +	} {
 +		if !strings.Contains(body, want) {
 +			t.Fatalf("fragment missing %q in:\n%s", want, body)
 +		}
 +	}
 +}
++
  // errorOriginatesInPartial returns true when an html/template execute
  // error blames a file whose basename starts with `_`. Errors from such
  // files are bugs in the partial because we render with an empty map

internal/web/handlers/api/actions_cancel.gomodified

23 lines changed — click to load

  		writeAPIError(w, http.StatusNotFound, "job not found")
  		return
+ 	}
 -	job, run, repo, ok := h.resolveCancellableJob(w, r, auth.UserID, jobID)
 +	job, run, repo, ok := h.resolveCancellableJob(w, r, auth.PolicyActor(), jobID)
  	if !ok {
  		return
+ 	}
  func (h *Handlers) resolveCancellableJob(
  	w http.ResponseWriter,
  	r *http.Request,
 -	userID int64,
 +	actor policy.Actor,
  	jobID int64,
  ) (actionsdb.WorkflowJob, actionsdb.WorkflowRun, reposdb.Repo, bool) {
  	q := actionsdb.New()
+ 		}
  		return actionsdb.WorkflowJob{}, actionsdb.WorkflowRun{}, reposdb.Repo{}, false
+ 	}
 -	actor := policy.UserActor(userID, "", false, false)
  	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, actor, policy.ActionRepoWrite, policy.NewRepoRefFromRepo(repo)).Allow {
  		writeAPIError(w, http.StatusNotFound, "job not found")
  		return actionsdb.WorkflowJob{}, actionsdb.WorkflowRun{}, reposdb.Repo{}, false

internal/web/handlers/api/actions_rerun.gomodified

23 lines changed — click to load

  		writeAPIError(w, http.StatusNotFound, "run not found")
  		return
+ 	}
 -	run, repo, ok := h.resolveLifecycleRun(w, r, auth.UserID, runID)
 +	run, repo, ok := h.resolveLifecycleRun(w, r, auth.PolicyActor(), runID)
  	if !ok {
  		return
+ 	}
  func (h *Handlers) resolveLifecycleRun(
  	w http.ResponseWriter,
  	r *http.Request,
 -	userID int64,
 +	actor policy.Actor,
  	runID int64,
  ) (actionsdb.WorkflowRun, reposdb.Repo, bool) {
  	q := actionsdb.New()
+ 		}
  		return actionsdb.WorkflowRun{}, reposdb.Repo{}, false
+ 	}
 -	actor := policy.UserActor(userID, "", false, false)
  	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, actor, policy.ActionRepoWrite, policy.NewRepoRefFromRepo(repo)).Allow {
  		writeAPIError(w, http.StatusNotFound, "run not found")
  		return actionsdb.WorkflowRun{}, reposdb.Repo{}, false

internal/web/handlers/api/api.gomodified

48 lines changed — click to load

  	"github.com/tenseleyFlow/shithub/internal/infra/storage"
  	"github.com/tenseleyFlow/shithub/internal/ratelimit"
  	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/web/handlers/api/apilimit"
  	"github.com/tenseleyFlow/shithub/internal/web/middleware"
+ )
  	RunnerJWT   *runnerjwt.Signer
  	SecretBox   *secretbox.Box
  	RateLimiter *ratelimit.Limiter
 +	// BaseURL is the public scheme://host prefix used for absolute
 +	// pagination Link headers. Empty falls back to path-relative URLs.
 +	BaseURL string
 +	// APILimit configures the /api/v1/* rate-limit middleware. Zero
 +	// values inherit apilimit.Middleware's no-op fallback.
 +	APILimit apilimit.Config
+ }
  // Handlers is the registered API handler set. Construct with New.
  // Mount registers /api/v1/* on r. Caller is responsible for putting r
  // in a CSRF-exempt group.
 +//
 +// Outer middleware on every /api/v1/* request: apilimit stamps the
 +// X-RateLimit-* headers and refuses over-budget callers with a JSON
 +// 429. Inner groups attach body caps, PAT auth, and scope decorators
 +// according to the surface they expose.
  func (h *Handlers) Mount(r chi.Router) {
 +	apiLimitMW := apilimit.Middleware(h.d.RateLimiter, apilimit.Config{
 +		AuthedPerHour: h.d.APILimit.AuthedPerHour,
 +		AnonPerHour:   h.d.APILimit.AnonPerHour,
 +		Logger:        h.d.Logger,
 +	})
  	r.Group(func(r chi.Router) {
  		r.Use(middleware.MaxBodySize(runnerAPIMaxBodyBytes))
 +		r.Use(apiLimitMW)
  		h.mountRunners(r)
  	})
  	r.Group(func(r chi.Router) {
  			Pool:      h.d.Pool,
  			Debouncer: h.d.Debouncer,
  		}))
 +		r.Use(apiLimitMW)
 +		// /meta is capability discovery — no scope required, anon ok.
 +		h.mountMeta(r)
  		r.Group(func(r chi.Router) {
  			r.Use(middleware.RequireScope(pat.ScopeUserRead))
  			r.Get("/api/v1/user", h.userMe)

internal/web/handlers/api/apilimit/apilimit.goadded

105 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +// Package apilimit is the per-request rate limiter that fronts /api/v1/.
 +// It does two things on every request:
 +//
 +//  1. Buckets the caller: PAT-authenticated requests are keyed by token
 +//     id (scope "api:authed"); anonymous requests are keyed by remote
 +//     IP (scope "api:anon"). Budgets come from cfg.RateLimit.API.
 +//  2. Stamps X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset
 +//     on the response — even on success. The shithub-cli HTTP client
 +//     parses these headers on every response to surface back-off hints
 +//     (shithub-cli/internal/api/errors.go).
 +//
 +// On deny, the response is the canonical /api/v1 JSON error envelope
 +// `{"error": "rate limit exceeded"}` with Retry-After set. Postgres
 +// errors fail open (ratelimit.Allow's documented behavior); the request
 +// proceeds with whatever decision we have and a warn-level log line.
 +package apilimit
++
 +import (
 +	"log/slog"
 +	"net/http"
 +	"strconv"
 +	"time"
++
 +	"github.com/tenseleyFlow/shithub/internal/ratelimit"
 +	"github.com/tenseleyFlow/shithub/internal/web/middleware"
 +)
++
 +// Config is the per-instance configuration for the middleware. Both
 +// budgets are required to be positive at construction.
 +type Config struct {
 +	// AuthedPerHour is the bucket size for PAT-authenticated callers.
 +	AuthedPerHour int
 +	// AnonPerHour is the bucket size for unauthenticated callers.
 +	AnonPerHour int
 +	// Logger receives warn-level lines when the backing counter errors.
 +	// nil disables logging.
 +	Logger *slog.Logger
 +}
++
 +// Middleware returns a chi-compatible middleware that applies the
 +// configured budgets and stamps the standard X-RateLimit-* headers.
 +// When l is nil the middleware is a no-op (used by tests that don't
 +// stand up the ratelimit DB).
 +func Middleware(l *ratelimit.Limiter, cfg Config) func(http.Handler) http.Handler {
 +	authedPolicy := ratelimit.Policy{
 +		Scope:  "api:authed",
 +		Max:    cfg.AuthedPerHour,
 +		Window: time.Hour,
 +	}
 +	anonPolicy := ratelimit.Policy{
 +		Scope:  "api:anon",
 +		Max:    cfg.AnonPerHour,
 +		Window: time.Hour,
 +	}
 +	logger := cfg.Logger
 +	return func(next http.Handler) http.Handler {
 +		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 +			if l == nil {
 +				next.ServeHTTP(w, r)
 +				return
 +			}
 +			policy, key := pickBucket(r, authedPolicy, anonPolicy)
 +			if policy.Max <= 0 || key == "" {
 +				// Misconfigured budget or no key derivable — fail open
 +				// rather than refuse service. The boot-time validation
 +				// in config.Validate keeps this branch unreachable in
 +				// practice.
 +				next.ServeHTTP(w, r)
 +				return
 +			}
 +			decision, err := l.Allow(r.Context(), policy, key)
 +			if err != nil && logger != nil {
 +				logger.WarnContext(r.Context(), "apilimit: counter error", "scope", policy.Scope, "key", key, "error", err)
 +			}
 +			ratelimit.StampHeaders(w, decision)
 +			if !decision.Allowed {
 +				retry := int(decision.RetryAfter / time.Second)
 +				if retry < 1 {
 +					retry = 1
 +				}
 +				w.Header().Set("Retry-After", strconv.Itoa(retry))
 +				w.Header().Set("Content-Type", "application/json; charset=utf-8")
 +				w.Header().Set("Cache-Control", "no-store")
 +				w.WriteHeader(http.StatusTooManyRequests)
 +				_, _ = w.Write([]byte(`{"error":"rate limit exceeded"}` + "\n"))
 +				return
 +			}
 +			next.ServeHTTP(w, r)
 +		})
 +	}
 +}
++
 +func pickBucket(r *http.Request, authed, anon ratelimit.Policy) (ratelimit.Policy, string) {
 +	auth := middleware.PATAuthFromContext(r.Context())
 +	if auth.TokenID != 0 {
 +		return authed, "pat:" + strconv.FormatInt(auth.TokenID, 10)
 +	}
 +	ip := middleware.RealIPFromContext(r.Context(), r)
 +	if ip == "" {
 +		return anon, ""
 +	}
 +	return anon, "ip:" + ip
 +}

internal/web/handlers/api/apipage/page.goadded

171 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +// Package apipage centralizes /api/v1 list-endpoint pagination concerns:
 +// reading page / per_page query params with sensible defaults and clamps,
 +// and emitting the canonical RFC 8288 Link header for cursor navigation.
 +//
 +// The Link header format matches GitHub's REST API verbatim so existing
 +// gh-style clients (including shithub-cli/internal/api.ParseLinkHeader)
 +// keep working. All emitted URLs are absolute when a baseURL is provided;
 +// callers should pass their configured public base URL so links survive
 +// reverse-proxying and host-rewriting.
 +package apipage
++
 +import (
 +	"net/http"
 +	"net/url"
 +	"strconv"
 +	"strings"
 +)
++
 +// DefaultPerPage is the per_page value used when the caller omits it.
 +const DefaultPerPage = 30
++
 +// MaxPerPage caps per_page to prevent unbounded list responses. Mirrors
 +// GitHub REST's 100 ceiling so client expectations port directly.
 +const MaxPerPage = 100
++
 +// Page describes a paginated response state. Total >= 0 enables emitting
 +// first/last in the Link header. Total == -1 disables them and falls
 +// back to HasMore for forward-only pagination (used when totals are
 +// expensive to compute and a "next" cursor is cheap).
 +type Page struct {
 +	Current int  // 1-indexed; must be >= 1
 +	PerPage int  // > 0
 +	Total   int  // total items across all pages; -1 when unknown
 +	HasMore bool // honored only when Total < 0
 +}
++
 +// ParseQuery reads ?page= and ?per_page= from r.URL.Query() with
 +// defaults page=1, per_page=defaultPerPage. per_page is clamped to
 +// [1, maxPerPage]. Non-integer or negative values fall back to defaults
 +// rather than 400 — matches gh/GitHub leniency for list endpoints.
 +func ParseQuery(r *http.Request, defaultPerPage, maxPerPage int) (page, perPage int) {
 +	if defaultPerPage <= 0 {
 +		defaultPerPage = DefaultPerPage
 +	}
 +	if maxPerPage <= 0 {
 +		maxPerPage = MaxPerPage
 +	}
 +	q := r.URL.Query()
 +	page = atoiOr(q.Get("page"), 1)
 +	if page < 1 {
 +		page = 1
 +	}
 +	perPage = atoiOr(q.Get("per_page"), defaultPerPage)
 +	if perPage < 1 {
 +		perPage = defaultPerPage
 +	}
 +	if perPage > maxPerPage {
 +		perPage = maxPerPage
 +	}
 +	return page, perPage
 +}
++
 +// LinkHeader returns the canonical Link header value for p. The header
 +// is composed of up to four entries (first, prev, next, last) with
 +// rel values quoted per RFC 8288.
 +//
 +// baseURL is the public scheme://host prefix (e.g. "https://shithub.sh");
 +// when empty, links are emitted as path-relative URLs. reqURL is the
 +// incoming request URL — its query string is preserved and only the
 +// page parameter is rewritten per rel.
 +//
 +// Returns "" when there is no useful link to emit (single-page result
 +// with no forward signal).
 +func (p Page) LinkHeader(baseURL string, reqURL *url.URL) string {
 +	if reqURL == nil || p.PerPage <= 0 {
 +		return ""
 +	}
 +	cur := p.Current
 +	if cur < 1 {
 +		cur = 1
 +	}
++
 +	var lastPage int
 +	knownTotal := p.Total >= 0
 +	if knownTotal {
 +		lastPage = lastPageFor(p.Total, p.PerPage)
 +	}
++
 +	var hasPrev, hasNext bool
 +	switch {
 +	case knownTotal:
 +		hasPrev = cur > 1 && lastPage >= 1
 +		hasNext = cur < lastPage
 +	default:
 +		hasPrev = cur > 1
 +		hasNext = p.HasMore
 +	}
++
 +	if !hasPrev && !hasNext && !knownTotal {
 +		return ""
 +	}
 +	if knownTotal && lastPage <= 1 {
 +		return ""
 +	}
++
 +	prefix := strings.TrimRight(baseURL, "/")
++
 +	var entries []string
 +	if knownTotal {
 +		entries = append(entries, formatLink(prefix, reqURL, 1, "first"))
 +	}
 +	if hasPrev {
 +		entries = append(entries, formatLink(prefix, reqURL, cur-1, "prev"))
 +	}
 +	if hasNext {
 +		entries = append(entries, formatLink(prefix, reqURL, cur+1, "next"))
 +	}
 +	if knownTotal && lastPage >= 1 {
 +		entries = append(entries, formatLink(prefix, reqURL, lastPage, "last"))
 +	}
 +	return strings.Join(entries, ", ")
 +}
++
 +// lastPageFor returns the 1-indexed page count for a known total. Always
 +// >= 1 so callers can render "first" / "last" even on an empty result.
 +func lastPageFor(total, perPage int) int {
 +	if total <= 0 {
 +		return 1
 +	}
 +	pages := total / perPage
 +	if total%perPage != 0 {
 +		pages++
 +	}
 +	if pages < 1 {
 +		pages = 1
 +	}
 +	return pages
 +}
++
 +func formatLink(prefix string, reqURL *url.URL, page int, rel string) string {
 +	q := reqURL.Query()
 +	q.Set("page", strconv.Itoa(page))
 +	rebuilt := *reqURL
 +	rebuilt.RawQuery = q.Encode()
 +	rebuilt.Scheme = ""
 +	rebuilt.Host = ""
++
 +	var b strings.Builder
 +	b.WriteByte('<')
 +	if prefix != "" {
 +		b.WriteString(prefix)
 +	}
 +	b.WriteString(rebuilt.RequestURI())
 +	b.WriteString(`>; rel="`)
 +	b.WriteString(rel)
 +	b.WriteByte('"')
 +	return b.String()
 +}
++
 +func atoiOr(s string, fallback int) int {
 +	if s == "" {
 +		return fallback
 +	}
 +	n, err := strconv.Atoi(s)
 +	if err != nil {
 +		return fallback
 +	}
 +	return n
 +}

internal/web/handlers/api/apipage/page_test.goadded

256 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package apipage_test
++
 +import (
 +	"net/http/httptest"
 +	"net/url"
 +	"strings"
 +	"testing"
++
 +	"github.com/tenseleyFlow/shithub/internal/web/handlers/api/apipage"
 +)
++
 +func TestParseQuery_Defaults(t *testing.T) {
 +	t.Parallel()
 +	r := httptest.NewRequest("GET", "/api/v1/things", nil)
 +	page, perPage := apipage.ParseQuery(r, 0, 0)
 +	if page != 1 || perPage != apipage.DefaultPerPage {
 +		t.Fatalf("got page=%d, perPage=%d; want 1/%d", page, perPage, apipage.DefaultPerPage)
 +	}
 +}
++
 +func TestParseQuery_ClampsPerPage(t *testing.T) {
 +	t.Parallel()
 +	r := httptest.NewRequest("GET", "/api/v1/things?page=2&per_page=500", nil)
 +	page, perPage := apipage.ParseQuery(r, 30, 100)
 +	if page != 2 {
 +		t.Errorf("page: got %d, want 2", page)
 +	}
 +	if perPage != 100 {
 +		t.Errorf("per_page: got %d, want 100", perPage)
 +	}
 +}
++
 +func TestParseQuery_NegativeFallback(t *testing.T) {
 +	t.Parallel()
 +	r := httptest.NewRequest("GET", "/api/v1/things?page=-3&per_page=-1", nil)
 +	page, perPage := apipage.ParseQuery(r, 0, 0)
 +	if page != 1 || perPage != apipage.DefaultPerPage {
 +		t.Fatalf("got page=%d, perPage=%d; want 1/%d", page, perPage, apipage.DefaultPerPage)
 +	}
 +}
++
 +func TestParseQuery_NonInteger(t *testing.T) {
 +	t.Parallel()
 +	r := httptest.NewRequest("GET", "/api/v1/things?page=banana&per_page=cherry", nil)
 +	page, perPage := apipage.ParseQuery(r, 25, 50)
 +	if page != 1 || perPage != 25 {
 +		t.Fatalf("got page=%d, perPage=%d; want 1/25", page, perPage)
 +	}
 +}
++
 +func TestLinkHeader_MiddlePage(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/user/starred?per_page=30&page=2")
 +	p := apipage.Page{Current: 2, PerPage: 30, Total: 120}
 +	h := p.LinkHeader("https://shithub.sh", u)
++
 +	links := parseLink(h)
 +	wantRels := []string{"first", "prev", "next", "last"}
 +	for _, rel := range wantRels {
 +		if _, ok := links[rel]; !ok {
 +			t.Errorf("missing rel=%q in %s", rel, h)
 +		}
 +	}
 +	if got := pageFor(links["next"]); got != "3" {
 +		t.Errorf("next page: got %s, want 3", got)
 +	}
 +	if got := pageFor(links["prev"]); got != "1" {
 +		t.Errorf("prev page: got %s, want 1", got)
 +	}
 +	if got := pageFor(links["last"]); got != "4" {
 +		t.Errorf("last page: got %s, want 4", got)
 +	}
 +	if got := pageFor(links["first"]); got != "1" {
 +		t.Errorf("first page: got %s, want 1", got)
 +	}
 +	if !strings.HasPrefix(links["next"], "https://shithub.sh/api/v1/user/starred?") {
 +		t.Errorf("next link not absolute: %s", links["next"])
 +	}
 +}
++
 +func TestLinkHeader_FirstPage(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/repos?per_page=10&page=1")
 +	p := apipage.Page{Current: 1, PerPage: 10, Total: 25}
 +	links := parseLink(p.LinkHeader("https://shithub.sh", u))
 +	if _, ok := links["prev"]; ok {
 +		t.Errorf("prev should be absent on first page; got %v", links)
 +	}
 +	if _, ok := links["next"]; !ok {
 +		t.Error("next should be present on first page")
 +	}
 +	if got := pageFor(links["last"]); got != "3" {
 +		t.Errorf("last page: got %s, want 3", got)
 +	}
 +}
++
 +func TestLinkHeader_LastPage(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/repos?per_page=10&page=3")
 +	p := apipage.Page{Current: 3, PerPage: 10, Total: 25}
 +	links := parseLink(p.LinkHeader("https://shithub.sh", u))
 +	if _, ok := links["next"]; ok {
 +		t.Errorf("next should be absent on last page; got %v", links)
 +	}
 +	if _, ok := links["prev"]; !ok {
 +		t.Error("prev should be present on last page")
 +	}
 +}
++
 +func TestLinkHeader_SinglePage(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/repos?per_page=30&page=1")
 +	p := apipage.Page{Current: 1, PerPage: 30, Total: 5}
 +	if got := p.LinkHeader("https://shithub.sh", u); got != "" {
 +		t.Errorf("expected empty header for single-page result; got %q", got)
 +	}
 +}
++
 +func TestLinkHeader_StreamForm(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/feed?page=2")
 +	p := apipage.Page{Current: 2, PerPage: 30, Total: -1, HasMore: true}
 +	links := parseLink(p.LinkHeader("https://shithub.sh", u))
 +	if _, ok := links["first"]; ok {
 +		t.Error("first should not appear when total unknown")
 +	}
 +	if _, ok := links["last"]; ok {
 +		t.Error("last should not appear when total unknown")
 +	}
 +	if _, ok := links["next"]; !ok {
 +		t.Error("next should appear when HasMore=true")
 +	}
 +	if _, ok := links["prev"]; !ok {
 +		t.Error("prev should appear when Current > 1")
 +	}
 +}
++
 +func TestLinkHeader_StreamFormExhausted(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/feed?page=4")
 +	p := apipage.Page{Current: 4, PerPage: 30, Total: -1, HasMore: false}
 +	links := parseLink(p.LinkHeader("https://shithub.sh", u))
 +	if _, ok := links["next"]; ok {
 +		t.Error("next should be absent when HasMore=false")
 +	}
 +	if _, ok := links["prev"]; !ok {
 +		t.Error("prev should still appear when Current > 1")
 +	}
 +}
++
 +func TestLinkHeader_PreservesOtherQueryParams(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/issues?state=open&labels=bug,ux&per_page=30&page=2")
 +	p := apipage.Page{Current: 2, PerPage: 30, Total: 120}
 +	links := parseLink(p.LinkHeader("https://shithub.sh", u))
 +	for rel, link := range links {
 +		if !strings.Contains(link, "state=open") {
 +			t.Errorf("rel=%s lost state=open: %s", rel, link)
 +		}
 +		if !strings.Contains(link, "labels=") {
 +			t.Errorf("rel=%s lost labels: %s", rel, link)
 +		}
 +	}
 +}
++
 +func TestLinkHeader_RelativeWhenBaseURLEmpty(t *testing.T) {
 +	t.Parallel()
 +	u, _ := url.Parse("/api/v1/repos?page=1&per_page=10")
 +	p := apipage.Page{Current: 1, PerPage: 10, Total: 25}
 +	h := p.LinkHeader("", u)
 +	if !strings.HasPrefix(h, "</api/v1/repos?") {
 +		t.Errorf("expected path-relative link; got %s", h)
 +	}
 +}
++
 +// parseLink reimplements the gh-compatible parser used by
 +// shithub-cli/internal/api.ParseLinkHeader. Kept in-test so apipage has
 +// no cross-module dependency, but we exercise the same algorithm here.
 +func parseLink(header string) map[string]string {
 +	out := map[string]string{}
 +	if header == "" {
 +		return out
 +	}
 +	for _, entry := range splitLinkEntries(header) {
 +		u, rel, ok := parseLinkEntry(entry)
 +		if !ok {
 +			continue
 +		}
 +		out[rel] = u
 +	}
 +	return out
 +}
++
 +func splitLinkEntries(header string) []string {
 +	var (
 +		entries []string
 +		buf     strings.Builder
 +		depth   int
 +	)
 +	for _, r := range header {
 +		switch r {
 +		case '<':
 +			depth++
 +		case '>':
 +			if depth > 0 {
 +				depth--
 +			}
 +		case ',':
 +			if depth == 0 {
 +				entries = append(entries, strings.TrimSpace(buf.String()))
 +				buf.Reset()
 +				continue
 +			}
 +		}
 +		buf.WriteRune(r)
 +	}
 +	if buf.Len() > 0 {
 +		entries = append(entries, strings.TrimSpace(buf.String()))
 +	}
 +	return entries
 +}
++
 +func parseLinkEntry(entry string) (linkURL, rel string, ok bool) {
 +	lt := strings.Index(entry, "<")
 +	gt := strings.Index(entry, ">")
 +	if lt < 0 || gt < 0 || gt < lt {
 +		return "", "", false
 +	}
 +	linkURL = entry[lt+1 : gt]
 +	rest := entry[gt+1:]
 +	for _, attr := range strings.Split(rest, ";") {
 +		attr = strings.TrimSpace(attr)
 +		if !strings.HasPrefix(attr, "rel=") {
 +			continue
 +		}
 +		rel = strings.Trim(attr[len("rel="):], `"`)
 +	}
 +	if rel == "" {
 +		return "", "", false
 +	}
 +	return linkURL, rel, true
 +}
++
 +func pageFor(link string) string {
 +	idx := strings.Index(link, "?")
 +	if idx < 0 {
 +		return ""
 +	}
 +	q, err := url.ParseQuery(link[idx+1:])
 +	if err != nil {
 +		return ""
 +	}
 +	return q.Get("page")
 +}

internal/web/handlers/api/checks.gomodified

9 lines changed — click to load

  		writeAPIError(w, http.StatusNotFound, "repo not found")
  		return nil, false
+ 	}
 -	actor := policy.UserActor(auth.UserID, "", false, false)
 -	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, actor, action, policy.NewRepoRefFromRepo(repo)).Allow {
 +	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, auth.PolicyActor(), action, policy.NewRepoRefFromRepo(repo)).Allow {
  		// Existence-leak: 404 instead of 403 when the actor can't see
  		// the repo. The PAT-scope check above is the public 403; this
  		// is the visibility gate.

internal/web/handlers/api/cross_test.goadded

280 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package api_test
++
 +import (
 +	"context"
 +	"encoding/json"
 +	"io"
 +	"log/slog"
 +	"net/http"
 +	"net/http/httptest"
 +	"strings"
 +	"testing"
++
 +	"github.com/go-chi/chi/v5"
 +	"github.com/jackc/pgx/v5/pgxpool"
++
 +	"github.com/tenseleyFlow/shithub/internal/auth/pat"
 +	"github.com/tenseleyFlow/shithub/internal/ratelimit"
 +	"github.com/tenseleyFlow/shithub/internal/testing/dbtest"
 +	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/version"
 +	apih "github.com/tenseleyFlow/shithub/internal/web/handlers/api"
 +	"github.com/tenseleyFlow/shithub/internal/web/handlers/api/apilimit"
 +)
++
 +// newCrossCuttingAPIRouter builds the smallest /api/v1 router we can —
 +// no runner JWT, no secret box, no object store. Enough to exercise the
 +// PATAuth + RequireScope + apilimit + meta surface.
 +func newCrossCuttingAPIRouter(t *testing.T, pool *pgxpool.Pool) http.Handler {
 +	t.Helper()
 +	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 +	h, err := apih.New(apih.Deps{
 +		Pool:        pool,
 +		Logger:      logger,
 +		RateLimiter: ratelimit.New(pool),
 +		BaseURL:     "https://shithub.test",
 +		APILimit: apilimit.Config{
 +			AuthedPerHour: 5000,
 +			AnonPerHour:   60,
 +			Logger:        logger,
 +		},
 +	})
 +	if err != nil {
 +		t.Fatalf("api.New: %v", err)
 +	}
 +	r := chi.NewRouter()
 +	h.Mount(r)
 +	return r
 +}
++
 +func crossCuttingUser(t *testing.T, pool *pgxpool.Pool) int64 {
 +	t.Helper()
 +	user, err := usersdb.New().CreateUser(context.Background(), pool, usersdb.CreateUserParams{
 +		Username:     "alice",
 +		DisplayName:  "Alice",
 +		PasswordHash: runnerAPIFixtureHash,
 +	})
 +	if err != nil {
 +		t.Fatalf("CreateUser: %v", err)
 +	}
 +	return user.ID
 +}
++
 +func TestCrossCutting_AuthFailureReturnsJSONEnvelope(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
++
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/user", nil)
 +	req.Header.Set("Authorization", "Bearer not-a-real-token")
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusUnauthorized {
 +		t.Fatalf("status: got %d, want 401; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
 +		t.Errorf("Content-Type: got %q, want application/json prefix", ct)
 +	}
 +	if wa := rr.Header().Get("WWW-Authenticate"); !strings.Contains(wa, "Bearer") {
 +		t.Errorf("WWW-Authenticate missing Bearer challenge: %q", wa)
 +	}
 +	var envelope struct {
 +		Error string `json:"error"`
 +	}
 +	if err := json.Unmarshal(rr.Body.Bytes(), &envelope); err != nil {
 +		t.Fatalf("decode error envelope: %v; body=%s", err, rr.Body.String())
 +	}
 +	if envelope.Error == "" {
 +		t.Errorf("error envelope empty: %s", rr.Body.String())
 +	}
 +}
++
 +func TestCrossCutting_ScopeRejectReturnsJSONEnvelope(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
 +	userID := crossCuttingUser(t, pool)
 +	// User has only user:read; /api/v1/user needs user:read, so to
 +	// exercise a scope reject we use a different route that requires
 +	// repo:write. We don't have a repo wired here, so we forge a path
 +	// the scope-decorator wrapped around check-runs, knowing it will
 +	// short-circuit on scope before policy resolution. The scope check
 +	// runs before the resolveAPIRepo call, so we get 403 directly.
 +	token := mintRunnerAPIPAT(t, pool, userID, string(pat.ScopeUserRead))
++
 +	req := httptest.NewRequest(http.MethodPost, "/api/v1/repos/alice/demo/check-runs", strings.NewReader(`{}`))
 +	req.Header.Set("Authorization", "Bearer "+token)
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusForbidden {
 +		t.Fatalf("status: got %d, want 403; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
 +		t.Errorf("Content-Type: got %q, want application/json prefix", ct)
 +	}
 +	if want := string(pat.ScopeRepoWrite); rr.Header().Get("X-Accepted-OAuth-Scopes") != want {
 +		t.Errorf("X-Accepted-OAuth-Scopes: got %q, want %q", rr.Header().Get("X-Accepted-OAuth-Scopes"), want)
 +	}
 +	if got := rr.Header().Get("X-OAuth-Scopes"); got != string(pat.ScopeUserRead) {
 +		t.Errorf("X-OAuth-Scopes: got %q, want %q", got, pat.ScopeUserRead)
 +	}
 +	var envelope struct {
 +		Error string `json:"error"`
 +	}
 +	if err := json.Unmarshal(rr.Body.Bytes(), &envelope); err != nil {
 +		t.Fatalf("decode error envelope: %v; body=%s", err, rr.Body.String())
 +	}
 +	if !strings.Contains(envelope.Error, "scope") {
 +		t.Errorf("error envelope: got %q, want one mentioning scope", envelope.Error)
 +	}
 +}
++
 +func TestCrossCutting_XOAuthScopesOnSuccess(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
 +	userID := crossCuttingUser(t, pool)
 +	token := mintRunnerAPIPAT(t, pool, userID, string(pat.ScopeUserRead))
++
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/user", nil)
 +	req.Header.Set("Authorization", "Bearer "+token)
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusOK {
 +		t.Fatalf("status: got %d, want 200; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if got := rr.Header().Get("X-OAuth-Scopes"); got != string(pat.ScopeUserRead) {
 +		t.Errorf("X-OAuth-Scopes: got %q, want %q", got, pat.ScopeUserRead)
 +	}
 +}
++
 +func TestCrossCutting_RateLimitHeadersStampedAuthed(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
 +	userID := crossCuttingUser(t, pool)
 +	token := mintRunnerAPIPAT(t, pool, userID, string(pat.ScopeUserRead))
++
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/user", nil)
 +	req.Header.Set("Authorization", "Bearer "+token)
 +	req.RemoteAddr = "10.0.0.5:12345"
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusOK {
 +		t.Fatalf("status: got %d, want 200; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if got := rr.Header().Get("X-RateLimit-Limit"); got != "5000" {
 +		t.Errorf("X-RateLimit-Limit: got %q, want 5000", got)
 +	}
 +	if rr.Header().Get("X-RateLimit-Remaining") == "" {
 +		t.Errorf("X-RateLimit-Remaining missing")
 +	}
 +	if rr.Header().Get("X-RateLimit-Reset") == "" {
 +		t.Errorf("X-RateLimit-Reset missing")
 +	}
 +}
++
 +func TestCrossCutting_RateLimitHeadersStampedAnon(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
++
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/meta", nil)
 +	req.RemoteAddr = "10.0.0.6:54321"
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusOK {
 +		t.Fatalf("status: got %d, want 200; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if got := rr.Header().Get("X-RateLimit-Limit"); got != "60" {
 +		t.Errorf("X-RateLimit-Limit (anon): got %q, want 60", got)
 +	}
 +}
++
 +func TestCrossCutting_MetaPayload(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	router := newCrossCuttingAPIRouter(t, pool)
++
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/meta", nil)
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
++
 +	if rr.Code != http.StatusOK {
 +		t.Fatalf("status: got %d, want 200; body=%s", rr.Code, rr.Body.String())
 +	}
 +	var resp struct {
 +		Version      string   `json:"version"`
 +		Commit       string   `json:"commit"`
 +		BuiltAt      string   `json:"built_at"`
 +		Capabilities []string `json:"capabilities"`
 +	}
 +	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
 +		t.Fatalf("decode meta: %v; body=%s", err, rr.Body.String())
 +	}
 +	if resp.Version != version.Version {
 +		t.Errorf("version: got %q, want %q", resp.Version, version.Version)
 +	}
 +	if len(resp.Capabilities) == 0 {
 +		t.Errorf("capabilities empty: %#v", resp)
 +	}
 +	if !containsString(resp.Capabilities, "pat-auth") {
 +		t.Errorf("capabilities missing pat-auth: %v", resp.Capabilities)
 +	}
 +}
++
 +func TestCrossCutting_RateLimitDeniedJSON(t *testing.T) {
 +	pool := dbtest.NewTestDB(t)
 +	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 +	// Tiny limits so we can trigger the deny path without 5001 requests.
 +	h, err := apih.New(apih.Deps{
 +		Pool:        pool,
 +		Logger:      logger,
 +		RateLimiter: ratelimit.New(pool),
 +		BaseURL:     "https://shithub.test",
 +		APILimit: apilimit.Config{
 +			AuthedPerHour: 1,
 +			AnonPerHour:   1,
 +			Logger:        logger,
 +		},
 +	})
 +	if err != nil {
 +		t.Fatalf("api.New: %v", err)
 +	}
 +	router := chi.NewRouter()
 +	h.Mount(router)
++
 +	// First anon request consumes the entire budget.
 +	req := httptest.NewRequest(http.MethodGet, "/api/v1/meta", nil)
 +	req.RemoteAddr = "10.0.0.99:11111"
 +	rr := httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
 +	if rr.Code != http.StatusOK {
 +		t.Fatalf("first call status: got %d, want 200; body=%s", rr.Code, rr.Body.String())
 +	}
++
 +	// Second request exceeds the budget.
 +	req = httptest.NewRequest(http.MethodGet, "/api/v1/meta", nil)
 +	req.RemoteAddr = "10.0.0.99:11112"
 +	rr = httptest.NewRecorder()
 +	router.ServeHTTP(rr, req)
 +	if rr.Code != http.StatusTooManyRequests {
 +		t.Fatalf("second call status: got %d, want 429; body=%s", rr.Code, rr.Body.String())
 +	}
 +	if ct := rr.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
 +		t.Errorf("Content-Type: got %q, want application/json prefix", ct)
 +	}
 +	if rr.Header().Get("Retry-After") == "" {
 +		t.Errorf("Retry-After missing on 429")
 +	}
 +	var envelope struct {
 +		Error string `json:"error"`
 +	}
 +	if err := json.Unmarshal(rr.Body.Bytes(), &envelope); err != nil {
 +		t.Fatalf("decode 429 envelope: %v; body=%s", err, rr.Body.String())
 +	}
 +	if !strings.Contains(envelope.Error, "rate") {
 +		t.Errorf("429 error: got %q", envelope.Error)
 +	}
 +}

internal/web/handlers/api/meta.goadded

51 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package api
++
 +import (
 +	"net/http"
++
 +	"github.com/go-chi/chi/v5"
++
 +	"github.com/tenseleyFlow/shithub/internal/version"
 +)
++
 +// APICapabilities is the canonical list of feature capabilities exposed
 +// by this server. Each S50 batch (§1 user, §2 repos, §3 issues, …)
 +// appends its capability name here so the CLI can gate behavior. The
 +// values are short kebab-case identifiers, GitHub-flavored when an
 +// obvious mapping exists.
 +//
 +// Append-only is a soft contract: removing an entry is a breaking
 +// change for clients that read this list.
 +var APICapabilities = []string{
 +	"pat-auth",
 +	"check-runs",
 +	"stars",
 +	"actions-lifecycle",
 +}
++
 +type metaResponse struct {
 +	Version      string   `json:"version"`
 +	Commit       string   `json:"commit"`
 +	BuiltAt      string   `json:"built_at"`
 +	Capabilities []string `json:"capabilities"`
 +}
++
 +// mountMeta registers the capability-discovery endpoint. /api/v1/meta is
 +// unauthenticated by design — clients use it to negotiate capabilities
 +// before they have credentials.
 +func (h *Handlers) mountMeta(r chi.Router) {
 +	r.Get("/api/v1/meta", h.metaGet)
 +}
++
 +func (h *Handlers) metaGet(w http.ResponseWriter, _ *http.Request) {
 +	caps := make([]string, len(APICapabilities))
 +	copy(caps, APICapabilities)
 +	writeJSON(w, http.StatusOK, metaResponse{
 +		Version:      version.Version,
 +		Commit:       version.Commit,
 +		BuiltAt:      version.BuiltAt,
 +		Capabilities: caps,
 +	})
 +}

internal/web/handlers/api/runners.gomodified

149 lines changed — click to load

  	"github.com/jackc/pgx/v5"
  	"github.com/jackc/pgx/v5/pgtype"
 +	actionsevents "github.com/tenseleyFlow/shithub/internal/actions/events"
  	"github.com/tenseleyFlow/shithub/internal/actions/finalize"
  	actionslifecycle "github.com/tenseleyFlow/shithub/internal/actions/lifecycle"
  	"github.com/tenseleyFlow/shithub/internal/actions/logstream"
  		committed = true
  		return actionsdb.ClaimQueuedWorkflowJobRow{}, nil, nil, false, nil
+ 	}
 -	if err := q.MarkWorkflowRunRunning(ctx, tx, job.RunID); err != nil {
 +	run, err := q.StartWorkflowRun(ctx, tx, job.RunID)
 +	switch {
 +	case err == nil:
 +		if err := actionsevents.EmitRunTx(ctx, tx, run, actionsevents.ActionRunning); err != nil {
 +			return actionsdb.ClaimQueuedWorkflowJobRow{}, nil, nil, false, err
 +		}
 +	case errors.Is(err, pgx.ErrNoRows):
 +		run, err = q.GetWorkflowRunByID(ctx, tx, job.RunID)
 +		if err != nil {
 +			return actionsdb.ClaimQueuedWorkflowJobRow{}, nil, nil, false, err
 +		}
 +	default:
 +		return actionsdb.ClaimQueuedWorkflowJobRow{}, nil, nil, false, err
 +	}
 +	if err := actionsevents.EmitJobTx(ctx, tx, run, claimRowWorkflowJob(job), actionsevents.ActionRunning); err != nil {
  		return actionsdb.ClaimQueuedWorkflowJobRow{}, nil, nil, false, err
+ 	}
  	steps, err := q.ListRunnerStepsForJob(ctx, tx, job.ID)
  		return actionsdb.WorkflowJob{}, false, "", err
+ 	}
  	runConclusion, complete := deriveWorkflowRunConclusion(jobs)
 +	runAfter, err := q.GetWorkflowRunByID(ctx, tx, updated.RunID)
 +	if err != nil {
 +		return actionsdb.WorkflowJob{}, false, "", err
 +	}
 +	runBefore := runAfter
 +	runStarted := false
 +	runTerminalChanged := false
  	if complete {
 -		if _, err := q.CompleteWorkflowRun(ctx, tx, actionsdb.CompleteWorkflowRunParams{
 +		runAfter, err = q.CompleteWorkflowRun(ctx, tx, actionsdb.CompleteWorkflowRunParams{
  			ID:         updated.RunID,
  			Conclusion: runConclusion,
 -		}); err != nil {
 +		})
 +		if err != nil {
 +			return actionsdb.WorkflowJob{}, false, "", err
 +		}
 +		runTerminalChanged = workflowRunLifecycleChanged(runBefore, runAfter)
 +	} else {
 +		startedRun, err := q.StartWorkflowRun(ctx, tx, updated.RunID)
 +		if err == nil {
 +			runAfter = startedRun
 +			runStarted = true
 +		} else if !errors.Is(err, pgx.ErrNoRows) {
 +			return actionsdb.WorkflowJob{}, false, "", err
 +		}
 +	}
 +	if jobLifecycleChanged(job, updated) {
 +		if err := actionsevents.EmitJobTx(ctx, tx, runAfter, updated, workflowJobEventAction(updated.Status)); err != nil {
 +			return actionsdb.WorkflowJob{}, false, "", err
 +		}
 +	}
 +	if runStarted {
 +		if err := actionsevents.EmitRunTx(ctx, tx, runAfter, actionsevents.ActionRunning); err != nil {
 +			return actionsdb.WorkflowJob{}, false, "", err
 +		}
 +	}
 +	if complete && runTerminalChanged {
 +		if err := actionsevents.EmitRunTx(ctx, tx, runAfter, workflowRunEventAction(runAfter.Status)); err != nil {
  			return actionsdb.WorkflowJob{}, false, "", err
+ 		}
 -	} else if err := q.MarkWorkflowRunRunning(ctx, tx, updated.RunID); err != nil {
 -		return actionsdb.WorkflowJob{}, false, "", err
+ 	}
  	if err := tx.Commit(ctx); err != nil {
  		return actionsdb.WorkflowJob{}, false, "", err
  	return updated, complete, runConclusion, nil
+ }
 +func claimRowWorkflowJob(row actionsdb.ClaimQueuedWorkflowJobRow) actionsdb.WorkflowJob {
 +	return actionsdb.WorkflowJob{
 +		ID:              row.ID,
 +		RunID:           row.RunID,
 +		JobIndex:        row.JobIndex,
 +		JobKey:          row.JobKey,
 +		JobName:         row.JobName,
 +		RunsOn:          row.RunsOn,
 +		RunnerID:        row.RunnerID,
 +		NeedsJobs:       row.NeedsJobs,
 +		IfExpr:          row.IfExpr,
 +		TimeoutMinutes:  row.TimeoutMinutes,
 +		Permissions:     row.Permissions,
 +		JobEnv:          row.JobEnv,
 +		Status:          row.Status,
 +		Conclusion:      row.Conclusion,
 +		CancelRequested: row.CancelRequested,
 +		StartedAt:       row.StartedAt,
 +		CompletedAt:     row.CompletedAt,
 +		Version:         row.Version,
 +		CreatedAt:       row.CreatedAt,
 +		UpdatedAt:       row.UpdatedAt,
 +	}
 +}
++
 +func jobLifecycleChanged(before, after actionsdb.WorkflowJob) bool {
 +	if before.Status != after.Status {
 +		return true
 +	}
 +	if before.Conclusion.Valid != after.Conclusion.Valid {
 +		return true
 +	}
 +	return before.Conclusion.Valid && before.Conclusion.CheckConclusion != after.Conclusion.CheckConclusion
 +}
++
 +func workflowRunLifecycleChanged(before, after actionsdb.WorkflowRun) bool {
 +	if before.Status != after.Status {
 +		return true
 +	}
 +	if before.Conclusion.Valid != after.Conclusion.Valid {
 +		return true
 +	}
 +	return before.Conclusion.Valid && before.Conclusion.CheckConclusion != after.Conclusion.CheckConclusion
 +}
++
 +func workflowJobEventAction(status actionsdb.WorkflowJobStatus) string {
 +	switch status {
 +	case actionsdb.WorkflowJobStatusCancelled:
 +		return actionsevents.ActionCancelled
 +	case actionsdb.WorkflowJobStatusCompleted, actionsdb.WorkflowJobStatusSkipped:
 +		return actionsevents.ActionCompleted
 +	case actionsdb.WorkflowJobStatusRunning:
 +		return actionsevents.ActionRunning
 +	default:
 +		return actionsevents.ActionQueued
 +	}
 +}
++
 +func workflowRunEventAction(status actionsdb.WorkflowRunStatus) string {
 +	if status == actionsdb.WorkflowRunStatusCancelled {
 +		return actionsevents.ActionCancelled
 +	}
 +	return actionsevents.ActionCompleted
 +}
++
  func deriveWorkflowRunConclusion(jobs []actionsdb.ListJobsForRunRow) (actionsdb.CheckConclusion, bool) {
  	if len(jobs) == 0 {
  		return actionsdb.CheckConclusionFailure, true

internal/web/handlers/api/stars.gomodified

12 lines changed — click to load

  		writeAPIError(w, http.StatusNotFound, "repo not found")
  		return reposdb.Repo{}, false
+ 	}
 -	// PAT-auth path: the middleware already rejected suspended
 -	// accounts; passing IsSuspended=false here is correct by
 -	// construction (documented in docs/internal/permissions.md).
 -	actor := policy.UserActor(auth.UserID, "", false, false)
 -	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, actor, policy.ActionStarCreate, policy.NewRepoRefFromRepo(repo)).Allow {
 +	if !policy.Can(r.Context(), policy.Deps{Pool: h.d.Pool}, auth.PolicyActor(), policy.ActionStarCreate, policy.NewRepoRefFromRepo(repo)).Allow {
  		writeAPIError(w, http.StatusNotFound, "repo not found")
  		return reposdb.Repo{}, false
+ 	}

internal/web/handlers/explore.gomodified

51 lines changed — click to load

+ 			}
  			return social.PublicFeed(r.Context(), deps, cursor, limit)
  		})
 +		if activeTab == "activity" && isExploreFeedFragmentRequest(r) {
 +			h.renderFeedFragment(w, r, feed, hasNext, nextURL)
 +			return
 +		}
  		if viewer.ID != 0 {
  			var err error
  			topRepos, err = social.DashboardRepos(r.Context(), deps, viewer.ID, 30)
  			h.logger.WarnContext(r.Context(), "explore trending users", "error", err)
+ 		}
+ 	}
 +	if activeTab == "activity" && isExploreFeedFragmentRequest(r) {
 +		h.renderFeedFragment(w, r, feed, hasNext, nextURL)
 +		return
 +	}
  	pageHeading := title
  	feedHeading := "Public activity"
  		"TrendingRepos":  trendingRepos,
  		"TrendingUsers":  trendingUsers,
  		"Path":           path,
 +		"UseHTMX":        true,
+ 	}
  	if err := h.render.RenderPage(w, r, "explore/index", data); err != nil {
  		if h.logger != nil {
+ 	}
+ }
 +func (h exploreHandler) renderFeedFragment(w http.ResponseWriter, r *http.Request, feed []social.FeedItem, hasNext bool, nextURL string) {
 +	data := map[string]any{
 +		"Feed":        feed,
 +		"FeedHasNext": hasNext,
 +		"FeedNextURL": nextURL,
 +	}
 +	if err := h.render.RenderFragment(w, "explore/feed_page", data); err != nil {
 +		if h.logger != nil {
 +			h.logger.ErrorContext(r.Context(), "render explore feed fragment", "error", err)
 +		}
 +		http.Error(w, "internal server error", http.StatusInternalServerError)
 +	}
 +}
++
 +func isExploreFeedFragmentRequest(r *http.Request) bool {
 +	return r.Header.Get("HX-Request") == "true" && r.URL.Query().Get("before") != ""
 +}
++
  func feedPageFor(r *http.Request, load func(social.FeedCursor, int32) ([]social.FeedItem, error)) ([]social.FeedItem, bool, string) {
  	items, err := load(parseFeedCursor(r), feedDisplayLimit+1)
  	if err != nil {

internal/web/handlers/explore_test.goadded

71 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package handlers
++
 +import (
 +	"net/http/httptest"
 +	"net/url"
 +	"testing"
 +	"time"
++
 +	"github.com/tenseleyFlow/shithub/internal/social"
 +)
++
 +func TestExploreFeedFragmentRequestRequiresHTMXAndCursor(t *testing.T) {
 +	t.Parallel()
++
 +	req := httptest.NewRequest("GET", "/explore?before=2026-05-12T00:00:00Z~42", nil)
 +	if isExploreFeedFragmentRequest(req) {
 +		t.Fatal("plain cursor request should stay a full-page no-JS fallback")
 +	}
++
 +	req.Header.Set("HX-Request", "true")
 +	if !isExploreFeedFragmentRequest(req) {
 +		t.Fatal("HTMX cursor request should render feed fragment")
 +	}
++
 +	req = httptest.NewRequest("GET", "/explore", nil)
 +	req.Header.Set("HX-Request", "true")
 +	if isExploreFeedFragmentRequest(req) {
 +		t.Fatal("HTMX first-page request should not render feed fragment")
 +	}
 +}
++
 +func TestFeedPageForBuildsNextCursorFromLastDisplayedItem(t *testing.T) {
 +	t.Parallel()
++
 +	req := httptest.NewRequest("GET", "/explore?tab=activity", nil)
 +	base := time.Date(2026, 5, 12, 14, 0, 0, 0, time.UTC)
 +	items := make([]social.FeedItem, 0, feedDisplayLimit+1)
 +	for i := int32(0); i < feedDisplayLimit+1; i++ {
 +		items = append(items, social.FeedItem{
 +			ID:        int64(1000 + i),
 +			CreatedAt: base.Add(-time.Duration(i) * time.Minute),
 +		})
 +	}
++
 +	got, hasNext, nextURL := feedPageFor(req, func(cursor social.FeedCursor, limit int32) ([]social.FeedItem, error) {
 +		if !cursor.BeforeCreatedAt.IsZero() || cursor.BeforeID != 0 {
 +			t.Fatalf("first page cursor = %+v, want zero", cursor)
 +		}
 +		if limit != feedDisplayLimit+1 {
 +			t.Fatalf("limit = %d, want %d", limit, feedDisplayLimit+1)
 +		}
 +		return items, nil
 +	})
++
 +	if len(got) != int(feedDisplayLimit) {
 +		t.Fatalf("display item count = %d, want %d", len(got), feedDisplayLimit)
 +	}
 +	if !hasNext {
 +		t.Fatal("hasNext = false, want true")
 +	}
 +	wantCursor := got[len(got)-1].CreatedAt.UTC().Format(time.RFC3339Nano) + "~" + "1019"
 +	parsed, err := url.Parse(nextURL)
 +	if err != nil {
 +		t.Fatalf("parse nextURL: %v", err)
 +	}
 +	if parsed.Query().Get("tab") != "activity" || parsed.Query().Get("before") != wantCursor {
 +		t.Fatalf("nextURL = %q, want preserved query and cursor %q", nextURL, wantCursor)
 +	}
 +}

internal/web/handlers/handlers.gomodified

31 lines changed — click to load

  	// workflow_dispatch endpoint (S41b). Auth-required + per-handler
  	// repo-write check.
  	RepoActionsAPIMounter func(chi.Router)
 +	// RepoActionsStreamMounter registers long-lived Actions log-stream
 +	// routes. It MUST bypass response compression and request timeout;
 +	// the handler still runs the normal repo-read policy gate.
 +	RepoActionsStreamMounter func(chi.Router)
  	// RepoSettingsGeneralMounter registers the General/Access tabs and
  	// the deferred-tab placeholders (webhooks, keys, notifications,
  	// tags) under /{owner}/{repo}/settings/* (S32). Auth-required.
  		})
+ 	}
 +	// Actions step-log SSE also streams for minutes. Keep it out of the
 +	// app group's timeout/compression stack so EventSource receives each
 +	// event as the handler flushes it. Browser CSRF protection is not
 +	// needed for this GET-only route; repo visibility is enforced inside
 +	// the handler through policy.ActionRepoRead.
 +	if deps.RepoActionsStreamMounter != nil {
 +		r.Group(func(r chi.Router) {
 +			deps.RepoActionsStreamMounter(r)
 +		})
 +	}
++
  	// Application routes — CSRF protected. Compress + Timeout live in
  	// this group (and the static one above) rather than globally so the
 -	// git-HTTP group can opt out.
 +	// streaming groups can opt out.
  	r.Group(func(r chi.Router) {
  		r.Use(middleware.Compress)
  		r.Use(middleware.Timeout(30 * time.Second))

internal/web/handlers/handlers_test.gomodified

51 lines changed — click to load

  	"net/http/httptest"
  	"strings"
  	"testing"
++
 +	"github.com/go-chi/chi/v5"
+ )
  func TestHandlers(t *testing.T) {
  		t.Fatalf("HEAD /healthz: status %d, want 200", rec.Code)
+ 	}
+ }
++
 +func TestActionsLogStreamRouteBypassesCompressAndTimeout(t *testing.T) {
 +	t.Parallel()
++
 +	mux := http.NewServeMux()
 +	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 +	if err := Register(mux, Deps{
 +		Logger:      logger,
 +		TemplatesFS: testTemplatesFS(t),
 +		StaticFS:    testStaticFS(t),
 +		LogoSVG:     `<svg xmlns="http://www.w3.org/2000/svg"><title>shithub</title></svg>`,
 +		RepoActionsStreamMounter: func(r chi.Router) {
 +			r.Get("/{owner}/{repo}/actions/runs/{runIndex}/jobs/{jobIndex}/steps/{stepIndex}/log/stream", func(w http.ResponseWriter, r *http.Request) {
 +				w.Header().Set("Content-Type", "text/event-stream; charset=utf-8")
 +				if _, ok := r.Context().Deadline(); ok {
 +					_, _ = io.WriteString(w, "deadline")
 +					return
 +				}
 +				_, _ = io.WriteString(w, "no-deadline")
 +			})
 +		},
 +	}); err != nil {
 +		t.Fatalf("Register: %v", err)
 +	}
++
 +	req := httptest.NewRequest(http.MethodGet, "/octo/demo/actions/runs/1/jobs/0/steps/0/log/stream", nil)
 +	req.Header.Set("Accept-Encoding", "gzip")
 +	rec := httptest.NewRecorder()
 +	mux.ServeHTTP(rec, req)
++
 +	if rec.Code != http.StatusOK {
 +		t.Fatalf("status: got %d, want %d body=%q", rec.Code, http.StatusOK, rec.Body.String())
 +	}
 +	if got := rec.Header().Get("Content-Encoding"); got != "" {
 +		t.Fatalf("Content-Encoding: got %q, want empty", got)
 +	}
 +	if got := rec.Body.String(); got != "no-deadline" {
 +		t.Fatalf("body: got %q, want no-deadline", got)
 +	}
 +}

internal/web/handlers/profile/overview.gomodified

61 lines changed — click to load

  	Repo                  reposdb.Repo
  	OwnerSlug             string
  	AllowIdentityFallback bool
 +	IsPrivate             bool
 +	IsProfileOwnedPublic  bool
+ }
  func (h *Handlers) visibleUserRepos(ctx context.Context, userID int64, viewer middleware.CurrentUser) []reposdb.Repo {
  		if !source.Repo.CreatedAt.Valid || created.Before(windowStart) || !created.Before(windowEnd) {
  			continue
+ 		}
 -		if source.Repo.OwnerUserID.Int64 != user.ID || source.Repo.Visibility != reposdb.RepoVisibilityPublic {
 +		if !source.IsProfileOwnedPublic {
  			continue
+ 		}
  		activity.addCreatedRepo(created, source)
+ }
  func (b *profileActivityBuilder) addCommit(day time.Time, source profileContributionRepo) {
 -	isPrivate := source.Repo.Visibility == reposdb.RepoVisibilityPrivate
 +	isPrivate := source.IsPrivate
  	fullName := source.OwnerSlug + "/" + source.Repo.Name
  	url := "/" + url.PathEscape(source.OwnerSlug) + "/" + url.PathEscape(source.Repo.Name)
  	if isPrivate {
+ 	}
  	deps := policy.Deps{Pool: h.d.Pool}
  	for _, row := range rows {
 -		if row.Visibility == issuesdb.RepoVisibilityPrivate && !user.IncludePrivateContributions {
 -			continue
 -		}
  		ref := policy.RepoRef{
  			ID:          row.RepoID,
  			OwnerUserID: row.OwnerUserID.Int64,
  			OwnerOrgID:  row.OwnerOrgID.Int64,
  			Visibility:  string(row.Visibility),
+ 		}
 +		if ref.IsPrivate() && !user.IncludePrivateContributions {
 +			continue
 +		}
  		if !policy.IsVisibleTo(ctx, deps, actor, ref) {
  			continue
+ 		}
  			Repo:                  repo,
  			OwnerSlug:             ownerSlug,
  			AllowIdentityFallback: allowIdentityFallback,
 +			IsPrivate:             repoRef.IsPrivate(),
 +			IsProfileOwnedPublic:  isProfileOwnedPublicRepo(repo, repoRef, user.ID),
  		})
+ 	}
  	return out
+ }
 +func isProfileOwnedPublicRepo(repo reposdb.Repo, ref policy.RepoRef, userID int64) bool {
 +	ownerUserID := repo.OwnerUserID.Int64
 +	return ownerUserID == userID && ref.IsPublic()
 +}
++
  func selectedContributionYear(query url.Values, currentYear int) int {
  	for _, key := range []string{"year", "from"} {
  		raw := strings.TrimSpace(query.Get(key))

internal/web/handlers/profile/profile_test.gomodified

16 lines changed — click to load


 			t.Errorf("missing %q in body: %s", want, body)
 		}
 	}
-	if strings.Contains(body, strconv.FormatInt(oldRepoID, 10)) {
-		t.Fatalf("test template leaked implementation ids unexpectedly: %s", body)
+	for _, leak := range []string{
+		fmt.Sprintf("repo_id=%d", oldRepoID),
+		fmt.Sprintf(`data-repo-id="%d"`, oldRepoID),
+		fmt.Sprintf("RepoID:%d", oldRepoID),
+	} {
+		if strings.Contains(body, leak) {
+			t.Fatalf("test template leaked implementation id marker %q unexpectedly: %s", leak, body)
+		}
 	}
 }
 

internal/web/handlers/profile/stars_tab.gomodified

8 lines changed — click to load

  			URL:             "/" + url.PathEscape(ownerName) + "/" + url.PathEscape(row.RepoName),
  			Description:     row.Description,
  			Visibility:      string(row.Visibility),
 -			IsPrivate:       row.Visibility == socialdb.RepoVisibilityPrivate,
 +			IsPrivate:       ref.IsPrivate(),
  			StarCount:       row.StarCount,
  			PrimaryLanguage: language,
  			LanguageColor:   template.CSS(orgLanguageColor(language)), //nolint:gosec // server-side constant map.

internal/web/handlers/repo/actions_atom.goadded

123 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package repo
++
 +import (
 +	"encoding/xml"
 +	"fmt"
 +	"io"
 +	"net/http"
 +	"strconv"
 +	"strings"
 +	"time"
++
 +	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/auth/policy"
 +)
++
 +const actionsAtomRunLimit = int32(50)
++
 +func (h *Handlers) repoActionsAtom(w http.ResponseWriter, r *http.Request) {
 +	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionRepoRead)
 +	if !ok {
 +		return
 +	}
 +	runs, err := actionsdb.New().ListWorkflowRunsForRepo(r.Context(), h.d.Pool, actionsdb.ListWorkflowRunsForRepoParams{
 +		RepoID:     row.ID,
 +		PageLimit:  actionsAtomRunLimit,
 +		PageOffset: 0,
 +	})
 +	if err != nil {
 +		h.d.Logger.WarnContext(r.Context(), "repo actions atom: list workflow runs", "repo_id", row.ID, "error", err)
 +		h.d.Render.HTTPError(w, r, http.StatusInternalServerError, "")
 +		return
 +	}
 +	w.Header().Set("Content-Type", "application/atom+xml; charset=utf-8")
 +	writeActionsAtom(w, owner.Username, row.Name, runs, time.Now())
 +}
++
 +func writeActionsAtom(w io.Writer, owner, repoName string, runs []actionsdb.ListWorkflowRunsForRepoRow, now time.Time) {
 +	type atomAuthor struct {
 +		Name string `xml:"name"`
 +	}
 +	type atomEntry struct {
 +		ID      string     `xml:"id"`
 +		Title   string     `xml:"title"`
 +		Updated string     `xml:"updated"`
 +		Author  atomAuthor `xml:"author"`
 +		Summary string     `xml:"summary"`
 +		Link    struct {
 +			Href string `xml:"href,attr"`
 +			Rel  string `xml:"rel,attr,omitempty"`
 +		} `xml:"link"`
 +	}
 +	type atomFeed struct {
 +		XMLName xml.Name `xml:"http://www.w3.org/2005/Atom feed"`
 +		Title   string   `xml:"title"`
 +		ID      string   `xml:"id"`
 +		Updated string   `xml:"updated"`
 +		Link    struct {
 +			Href string `xml:"href,attr"`
 +			Rel  string `xml:"rel,attr,omitempty"`
 +		} `xml:"link"`
 +		Entries []atomEntry `xml:"entry"`
 +	}
++
 +	feedUpdated := now.UTC()
 +	if len(runs) > 0 {
 +		feedUpdated = pgTime(runs[0].UpdatedAt, runs[0].CreatedAt.Time).UTC()
 +	}
 +	feed := atomFeed{
 +		Title:   fmt.Sprintf("%s/%s Actions runs", owner, repoName),
 +		ID:      fmt.Sprintf("urn:shithub:actions:%s:%s", owner, repoName),
 +		Updated: feedUpdated.Format(time.RFC3339),
 +	}
 +	feed.Link.Href = fmt.Sprintf("/%s/%s/actions.atom", owner, repoName)
 +	feed.Link.Rel = "self"
++
 +	for _, run := range runs {
 +		var e atomEntry
 +		e.ID = fmt.Sprintf("urn:shithub:workflow_run:%d", run.ID)
 +		e.Title = actionsAtomRunTitle(run)
 +		e.Updated = pgTime(run.UpdatedAt, run.CreatedAt.Time).UTC().Format(time.RFC3339)
 +		e.Author.Name = actionsAtomActor(run.ActorUsername)
 +		e.Summary = actionsAtomRunSummary(run)
 +		e.Link.Href = fmt.Sprintf("/%s/%s/actions/runs/%d", owner, repoName, run.RunIndex)
 +		feed.Entries = append(feed.Entries, e)
 +	}
++
 +	enc := xml.NewEncoder(w)
 +	enc.Indent("", "  ")
 +	_, _ = io.WriteString(w, xml.Header)
 +	_ = enc.Encode(feed)
 +	_ = enc.Flush()
 +}
++
 +func actionsAtomRunTitle(run actionsdb.ListWorkflowRunsForRepoRow) string {
 +	title := workflowDisplayName(run.WorkflowName, run.WorkflowFile)
 +	state, _, _ := workflowRunState(run.Status, run.Conclusion)
 +	return fmt.Sprintf("%s #%d %s", title, run.RunIndex, strings.ToLower(state))
 +}
++
 +func actionsAtomRunSummary(run actionsdb.ListWorkflowRunsForRepoRow) string {
 +	parts := []string{
 +		"Workflow: " + workflowDisplayName(run.WorkflowName, run.WorkflowFile),
 +		"Event: " + workflowRunEventLabel(string(run.Event)),
 +		"Status: " + string(run.Status),
 +		"Branch: " + run.HeadRef,
 +		"Commit: " + shortSHA(run.HeadSha),
 +	}
 +	if run.Conclusion.Valid {
 +		parts = append(parts, "Conclusion: "+string(run.Conclusion.CheckConclusion))
 +	}
 +	parts = append(parts, "Run: #"+strconv.FormatInt(run.RunIndex, 10))
 +	return strings.Join(parts, "\n")
 +}
++
 +func actionsAtomActor(username string) string {
 +	username = strings.TrimSpace(username)
 +	if username == "" {
 +		return "shithub"
 +	}
 +	return username
 +}

internal/web/handlers/repo/actions_atom_test.goadded

79 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package repo
++
 +import (
 +	"bytes"
 +	"encoding/xml"
 +	"strings"
 +	"testing"
 +	"time"
++
 +	"github.com/jackc/pgx/v5/pgtype"
++
 +	actionsdb "github.com/tenseleyFlow/shithub/internal/actions/sqlc"
 +)
++
 +func TestWriteActionsAtomEscapesRunsAndUsesLatestUpdate(t *testing.T) {
 +	ts1 := pgtype.Timestamptz{Time: time.Date(2026, 5, 12, 10, 0, 0, 0, time.UTC), Valid: true}
 +	ts2 := pgtype.Timestamptz{Time: time.Date(2026, 5, 12, 9, 0, 0, 0, time.UTC), Valid: true}
 +	var buf bytes.Buffer
 +	writeActionsAtom(&buf, "alice", "demo", []actionsdb.ListWorkflowRunsForRepoRow{
 +		{
 +			ID:            12,
 +			RunIndex:      7,
 +			WorkflowFile:  ".shithub/workflows/ci.yml",
 +			WorkflowName:  "CI <release>",
 +			HeadSha:       strings.Repeat("a", 40),
 +			HeadRef:       "refs/heads/trunk",
 +			Event:         actionsdb.WorkflowRunEventPush,
 +			Status:        actionsdb.WorkflowRunStatusCompleted,
 +			Conclusion:    actionsdb.NullCheckConclusion{CheckConclusion: actionsdb.CheckConclusionSuccess, Valid: true},
 +			ActorUsername: "dev<one>",
 +			CreatedAt:     ts2,
 +			UpdatedAt:     ts1,
 +		},
 +	}, time.Date(2026, 5, 12, 8, 0, 0, 0, time.UTC))
++
 +	type feed struct {
 +		XMLName xml.Name `xml:"feed"`
 +		Title   string   `xml:"title"`
 +		Updated string   `xml:"updated"`
 +		Entries []struct {
 +			Title   string `xml:"title"`
 +			Updated string `xml:"updated"`
 +			Author  struct {
 +				Name string `xml:"name"`
 +			} `xml:"author"`
 +			Summary string `xml:"summary"`
 +			Link    struct {
 +				Href string `xml:"href,attr"`
 +			} `xml:"link"`
 +		} `xml:"entry"`
 +	}
 +	var got feed
 +	if err := xml.Unmarshal(buf.Bytes(), &got); err != nil {
 +		t.Fatalf("unmarshal atom: %v\n%s", err, buf.String())
 +	}
 +	if got.Title != "alice/demo Actions runs" {
 +		t.Fatalf("title = %q", got.Title)
 +	}
 +	if got.Updated != "2026-05-12T10:00:00Z" {
 +		t.Fatalf("updated = %q", got.Updated)
 +	}
 +	if len(got.Entries) != 1 {
 +		t.Fatalf("entries = %d", len(got.Entries))
 +	}
 +	if got.Entries[0].Title != "CI <release> #7 success" {
 +		t.Fatalf("entry title = %q", got.Entries[0].Title)
 +	}
 +	if got.Entries[0].Author.Name != "dev<one>" {
 +		t.Fatalf("author = %q", got.Entries[0].Author.Name)
 +	}
 +	if got.Entries[0].Link.Href != "/alice/demo/actions/runs/7" {
 +		t.Fatalf("link = %q", got.Entries[0].Link.Href)
 +	}
 +	if !strings.Contains(got.Entries[0].Summary, "Conclusion: success") {
 +		t.Fatalf("summary = %q", got.Entries[0].Summary)
 +	}
 +}

internal/web/handlers/repo/actions_log_stream.gomodified

13 lines changed — click to load

  		h.d.Render.HTTPError(w, r, http.StatusInternalServerError, "")
  		return
+ 	}
 +	defer func() {
 +		ctx, cancel := context.WithTimeout(context.Background(), actionsLogStreamReleaseTimeout)
 +		defer cancel()
 +		if _, err := conn.Exec(ctx, logstream.UnlistenSQL(step.ID)); err != nil && h.d.Logger != nil {
 +			h.d.Logger.WarnContext(ctx, "repo actions: unlisten log stream", "step_id", step.ID, "error", err)
 +		}
 +	}()
  	w.Header().Set("Content-Type", "text/event-stream; charset=utf-8")
  	w.Header().Set("Cache-Control", "no-cache, no-transform")

internal/web/handlers/repo/branches.gomodified

110 lines changed — click to load

  func (h *Handlers) MountRefs(r chi.Router) {
  	r.Get("/{owner}/{repo}/branches", h.branchesList)
  	r.Get("/{owner}/{repo}/tags", h.tagsList)
 +	r.Get("/{owner}/{repo}/compare", h.compareView)
  	// Compare uses `...` as the base/head separator (matches GitHub).
  	// chi can't represent the literal `...` in a route param so we use
  	// a wildcard and parse server-side.
  		return
+ 	}
  	rest := strings.Trim(chi.URLParam(r, "*"), "/")
 -	if rest == "" {
 -		http.Redirect(w, r, "/"+owner.Username+"/"+row.Name+"/compare/"+row.DefaultBranch+"..."+row.DefaultBranch, http.StatusSeeOther)
 -		return
 -	}
 -	base, head, ok := strings.Cut(rest, "...")
 -	if !ok {
 -		// Two-dot shape — accept but treat as three-dot for the diff.
 -		base, head, ok = strings.Cut(rest, "..")
 -		if !ok {
 -			head = rest
 +	hasSelection := rest != ""
 +	base := row.DefaultBranch
 +	head := row.DefaultBranch
 +	if hasSelection {
 +		var found bool
 +		base, head, found = strings.Cut(rest, "...")
 +		if !found {
 +			// Two-dot shape — accept but treat as three-dot for the diff.
 +			base, head, found = strings.Cut(rest, "..")
 +			if !found {
 +				head = rest
 +				base = row.DefaultBranch
 +			}
 +		}
 +		if base == "" {
  			base = row.DefaultBranch
+ 		}
 -	}
 -	if base == "" {
 -		base = row.DefaultBranch
 +		if head == "" {
 +			head = row.DefaultBranch
 +		}
+ 	}
  	// Strip cross-repo "fork:branch" prefix for the local path; full
  	base = stripCrossRepoPrefix(base)
  	head = stripCrossRepoPrefix(head)
 -	commits, cerr := repogit.CommitsBetween(r.Context(), gitDir, base, head, 250)
 -	ahead, behind, abErr := repogit.AheadBehind(r.Context(), gitDir, base, head)
+-
 -	notFound := abErr != nil
+-
 -	// Build an inline diff (three-dot via FromMergeBase).
 -	var diffHTML string
 -	if !notFound {
 -		patch, perr := compareSourceMergeBase(r, gitDir, base, head)
 -		if perr == nil {
 -			diffHTML = renderCompareDiff(patch)
 -		}
 -	}
+-
 -	refs, _ := repogit.ListRefs(r.Context(), gitDir)
 -	h.d.Render.RenderPage(w, r, "repo/compare", map[string]any{
 -		"Title":      "Compare · " + row.Name,
 -		"CSRFToken":  middleware.CSRFTokenForRequest(r),
 -		"Owner":      owner.Username,
 -		"Repo":       row,
 -		"Base":       base,
 -		"Head":       head,
 -		"Ahead":      ahead,
 -		"Behind":     behind,
 -		"Commits":    commits,
 -		"DiffHTML":   diffHTML,
 -		"NotFound":   notFound,
 -		"CommitsErr": cerr != nil,
 -		"Branches":   refs.Branches,
 -		"Tags":       refs.Tags,
 -	})
 +	state := h.buildCompareState(r, owner.Username, row, gitDir, base, head, hasSelection, compareMenuTargetCompare)
 +	h.d.Render.RenderPage(w, r, "repo/compare", mergePageData(
 +		h.repoPageChrome(r, owner.Username, row, "code"),
 +		map[string]any{
 +			"Title":        "Compare · " + row.Name,
 +			"UseCompareJS": true,
 +			"Compare":      state,
 +			"Base":         state.Base,
 +			"Head":         state.Head,
 +			"HasSelection": state.HasSelection,
 +			"SameRef":      state.SameRef,
 +			"NotFound":     state.NotFound,
 +			"CommitsErr":   state.CommitsErr,
 +			"NoCommits":    state.NoCommits,
 +			"Ahead":        state.Ahead,
 +			"Behind":       state.Behind,
 +			"Commits":      state.Commits,
 +			"DiffHTML":     state.DiffHTML,
 +			"Stats":        state.Stats,
 +			"MergeState":   state.MergeState,
 +			"CanOpenPull":  state.CanOpenPull,
 +			"PullNewHref":  state.PullNewHref,
 +			"BaseMenu":     state.BaseMenu,
 +			"HeadMenu":     state.HeadMenu,
 +			"Examples":     state.Examples,
 +		},
 +	))
+ }
  // stripCrossRepoPrefix turns "fork:branch" into "branch". Local-only

internal/web/handlers/repo/code.gomodified

57 lines changed — click to load

  import (
  	"bytes"
 +	"context"
  	"errors"
  	"fmt"
  	"html/template"
  	subpath string // path inside the ref, no leading slash
+ }
 +type codeBranchCompare struct {
 +	Show          bool
 +	HasRecentPush bool
 +	Base          string
 +	Head          string
 +	Ahead         int
 +	Behind        int
 +	CompareHref   string
 +	PullNewHref   string
 +}
++
  // loadCodeContext does the resolve dance for tree/blob/raw/find. On
  // any failure it writes the response and returns ok=false.
  func (h *Handlers) loadCodeContext(w http.ResponseWriter, r *http.Request) (*codeContext, bool) {
  	return false
+ }
 +func codeBranchCompareData(ctx context.Context, cc *codeContext) codeBranchCompare {
 +	if !cc.isBranchRef() || cc.ref == cc.row.DefaultBranch {
 +		return codeBranchCompare{}
 +	}
 +	ahead, behind, err := repogit.AheadBehind(ctx, cc.gitDir, cc.row.DefaultBranch, cc.ref)
 +	if err != nil {
 +		return codeBranchCompare{}
 +	}
 +	return codeBranchCompare{
 +		Show:          true,
 +		HasRecentPush: ahead > 0,
 +		Base:          cc.row.DefaultBranch,
 +		Head:          cc.ref,
 +		Ahead:         ahead,
 +		Behind:        behind,
 +		CompareHref:   compareURL(cc.owner, cc.row.Name, cc.row.DefaultBranch, cc.ref),
 +		PullNewHref:   pullNewURL(cc.owner, cc.row.Name, cc.row.DefaultBranch, cc.ref),
 +	}
 +}
++
  func (h *Handlers) canWriteRepo(r *http.Request, row reposdb.Repo) bool {
  	viewer := middleware.CurrentUserFromContext(r.Context())
  	if viewer.IsAnonymous() {
  		"Head":          head,
  		"HeadFound":     headFound,
  		"HeadAuthor":    headAuthor,
 +		"BranchCompare": codeBranchCompareData(r.Context(), cc),
  		"CommitCount":   commitCount,
  		"README":        template.HTML(readme.HTML), //nolint:gosec // sanitized by mdrender
  		"READMEPath":    readme.Path,

internal/web/handlers/repo/compare_ui.goadded

361 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package repo
++
 +import (
 +	"context"
 +	"errors"
 +	"net/http"
 +	"net/url"
 +	"strings"
++
 +	repogit "github.com/tenseleyFlow/shithub/internal/repos/git"
 +	reposdb "github.com/tenseleyFlow/shithub/internal/repos/sqlc"
 +	"github.com/tenseleyFlow/shithub/internal/web/middleware"
 +)
++
 +type compareMenuTarget string
++
 +const (
 +	compareMenuTargetCompare compareMenuTarget = "compare"
 +	compareMenuTargetPullNew compareMenuTarget = "pull_new"
 +)
++
 +type compareRefOption struct {
 +	Name      string
 +	Href      string
 +	Current   bool
 +	IsDefault bool
 +}
++
 +type compareRefMenu struct {
 +	ID      string
 +	Label   string
 +	Title   string
 +	Current string
++
 +	Branches []compareRefOption
 +	Tags     []compareRefOption
 +}
++
 +type compareExample struct {
 +	Name string
 +	Href string
 +}
++
 +type compareStats struct {
 +	CommitCount      int
 +	FileCount        int
 +	ContributorCount int
 +}
++
 +type compareMergeState struct {
 +	State       string
 +	Label       string
 +	Description string
 +}
++
 +type compareState struct {
 +	Base         string
 +	Head         string
 +	HasSelection bool
 +	SameRef      bool
 +	NotFound     bool
 +	CommitsErr   bool
 +	NoCommits    bool
 +	Ahead        int
 +	Behind       int
++
 +	Commits     []repogit.Commit
 +	DiffHTML    string
 +	Stats       compareStats
 +	MergeState  compareMergeState
 +	CanOpenPull bool
 +	PullNewHref string
++
 +	BaseMenu compareRefMenu
 +	HeadMenu compareRefMenu
 +	Examples []compareExample
 +}
++
 +func (h *Handlers) repoPageChrome(r *http.Request, owner string, row reposdb.Repo, activeSubnav string) map[string]any {
 +	return map[string]any{
 +		"CSRFToken":    middleware.CSRFTokenForRequest(r),
 +		"Owner":        owner,
 +		"Repo":         row,
 +		"RepoActions":  h.repoActions(r, row.ID),
 +		"RepoCounts":   h.subnavCounts(r.Context(), row.ID, row.ForkCount),
 +		"CanSettings":  h.canViewSettings(middleware.CurrentUserFromContext(r.Context())),
 +		"ActiveSubnav": activeSubnav,
 +	}
 +}
++
 +func mergePageData(base map[string]any, extra map[string]any) map[string]any {
 +	out := make(map[string]any, len(base)+len(extra))
 +	for k, v := range base {
 +		out[k] = v
 +	}
 +	for k, v := range extra {
 +		out[k] = v
 +	}
 +	return out
 +}
++
 +func (h *Handlers) buildCompareState(r *http.Request, owner string, row reposdb.Repo, gitDir, base, head string, hasSelection bool, target compareMenuTarget) compareState {
 +	if strings.TrimSpace(base) == "" {
 +		base = row.DefaultBranch
 +	}
 +	if strings.TrimSpace(head) == "" {
 +		head = row.DefaultBranch
 +	}
++
 +	refs, _ := repogit.ListRefs(r.Context(), gitDir)
 +	state := compareState{
 +		Base:         base,
 +		Head:         head,
 +		HasSelection: hasSelection,
 +		SameRef:      base == head,
 +		PullNewHref:  pullNewURL(owner, row.Name, base, head),
 +		MergeState: compareMergeState{
 +			State:       "pending",
 +			Label:       "Checking mergeability...",
 +			Description: "You can still create the pull request while shithub checks these branches.",
 +		},
 +	}
 +	state.BaseMenu, state.HeadMenu = buildCompareMenus(owner, row.Name, row.DefaultBranch, base, head, refs, target)
 +	state.Examples = buildCompareExamples(owner, row.Name, row.DefaultBranch, refs)
++
 +	if !hasSelection || base == "" || head == "" {
 +		state.MergeState = compareMergeState{}
 +		return state
 +	}
++
 +	commits, cerr := repogit.CommitsBetween(r.Context(), gitDir, base, head, 250)
 +	if cerr != nil {
 +		state.CommitsErr = true
 +	}
 +	state.Commits = commits
++
 +	ahead, behind, abErr := repogit.AheadBehind(r.Context(), gitDir, base, head)
 +	if abErr != nil {
 +		state.NotFound = true
 +		state.MergeState = compareMergeState{
 +			State:       "missing",
 +			Label:       "There was a problem comparing these refs.",
 +			Description: "One or both refs were not found in this repository.",
 +		}
 +		return state
 +	}
 +	state.Ahead = ahead
 +	state.Behind = behind
 +	state.NoCommits = ahead <= 0
 +	state.Stats.CommitCount = len(commits)
 +	state.Stats.ContributorCount = countCommitContributors(commits)
++
 +	if state.SameRef {
 +		state.MergeState = compareMergeState{}
 +		return state
 +	}
 +	if state.NoCommits {
 +		state.MergeState = compareMergeState{
 +			State:       "empty",
 +			Label:       "There isn't anything to compare.",
 +			Description: head + " is up to date with " + base + ".",
 +		}
 +		return state
 +	}
++
 +	patch, perr := compareSourceMergeBase(r, gitDir, base, head)
 +	if perr == nil {
 +		state.DiffHTML = renderCompareDiff(patch)
 +		state.Stats.FileCount = countPatchFiles(patch)
 +	}
 +	state.CanOpenPull = true
 +	state.MergeState = probeCompareMerge(r.Context(), gitDir, base, head)
 +	return state
 +}
++
 +func buildCompareMenus(owner, repo, defaultBranch, base, head string, refs repogit.RefListing, target compareMenuTarget) (compareRefMenu, compareRefMenu) {
 +	baseMenu := compareRefMenu{
 +		ID:      "base",
 +		Label:   "base:",
 +		Title:   "Choose a base ref",
 +		Current: base,
 +	}
 +	headMenu := compareRefMenu{
 +		ID:      "head",
 +		Label:   "compare:",
 +		Title:   "Choose a head ref",
 +		Current: head,
 +	}
++
 +	baseMenu.Branches = compareRefOptions(owner, repo, defaultBranch, base, head, base, refs.Branches, target, true)
 +	headMenu.Branches = compareRefOptions(owner, repo, defaultBranch, base, head, head, refs.Branches, target, false)
 +	baseMenu.Tags = compareRefOptions(owner, repo, defaultBranch, base, head, base, refs.Tags, target, true)
 +	headMenu.Tags = compareRefOptions(owner, repo, defaultBranch, base, head, head, refs.Tags, target, false)
++
 +	baseMenu.Branches = ensureCompareRefOption(baseMenu.Branches, owner, repo, defaultBranch, base, head, base, target, true)
 +	headMenu.Branches = ensureCompareRefOption(headMenu.Branches, owner, repo, defaultBranch, base, head, head, target, false)
 +	return baseMenu, headMenu
 +}
++
 +func compareRefOptions(owner, repo, defaultBranch, base, head, current string, refs []repogit.RefEntry, target compareMenuTarget, changingBase bool) []compareRefOption {
 +	options := make([]compareRefOption, 0, len(refs))
 +	for _, ref := range refs {
 +		options = append(options, compareRefOption{
 +			Name:      ref.Name,
 +			Href:      compareRefHref(owner, repo, base, head, ref.Name, target, changingBase),
 +			Current:   ref.Name == current,
 +			IsDefault: ref.Name == defaultBranch,
 +		})
 +	}
 +	return options
 +}
++
 +func ensureCompareRefOption(options []compareRefOption, owner, repo, defaultBranch, base, head, current string, target compareMenuTarget, changingBase bool) []compareRefOption {
 +	if current == "" {
 +		return options
 +	}
 +	for _, option := range options {
 +		if option.Name == current {
 +			return options
 +		}
 +	}
 +	return append([]compareRefOption{{
 +		Name:      current,
 +		Href:      compareRefHref(owner, repo, base, head, current, target, changingBase),
 +		Current:   true,
 +		IsDefault: current == defaultBranch,
 +	}}, options...)
 +}
++
 +func compareRefHref(owner, repo, base, head, ref string, target compareMenuTarget, changingBase bool) string {
 +	if changingBase {
 +		base = ref
 +	} else {
 +		head = ref
 +	}
 +	if target == compareMenuTargetPullNew {
 +		return pullNewURL(owner, repo, base, head)
 +	}
 +	return compareURL(owner, repo, base, head)
 +}
++
 +func buildCompareExamples(owner, repo, defaultBranch string, refs repogit.RefListing) []compareExample {
 +	examples := make([]compareExample, 0, 5)
 +	for _, branch := range refs.Branches {
 +		if branch.Name == defaultBranch {
 +			continue
 +		}
 +		examples = append(examples, compareExample{
 +			Name: branch.Name,
 +			Href: compareURL(owner, repo, defaultBranch, branch.Name),
 +		})
 +		if len(examples) == 5 {
 +			break
 +		}
 +	}
 +	return examples
 +}
++
 +func compareURL(owner, repo, base, head string) string {
 +	return "/" + url.PathEscape(owner) + "/" + url.PathEscape(repo) + "/compare/" + escapePathSegments(base) + "..." + escapePathSegments(head)
 +}
++
 +func pullNewURL(owner, repo, base, head string) string {
 +	q := url.Values{}
 +	q.Set("base", base)
 +	q.Set("head", head)
 +	return "/" + url.PathEscape(owner) + "/" + url.PathEscape(repo) + "/pulls/new?" + q.Encode()
 +}
++
 +func countPatchFiles(patch []byte) int {
 +	if len(patch) == 0 {
 +		return 0
 +	}
 +	count := 0
 +	for _, line := range strings.Split(string(patch), "\n") {
 +		if strings.HasPrefix(line, "diff --git ") {
 +			count++
 +		}
 +	}
 +	return count
 +}
++
 +func countCommitContributors(commits []repogit.Commit) int {
 +	if len(commits) == 0 {
 +		return 0
 +	}
 +	seen := map[string]struct{}{}
 +	for _, commit := range commits {
 +		key := strings.ToLower(strings.TrimSpace(commit.AuthorEmail))
 +		if key == "" {
 +			key = strings.ToLower(strings.TrimSpace(commit.AuthorName))
 +		}
 +		if key != "" {
 +			seen[key] = struct{}{}
 +		}
 +	}
 +	return len(seen)
 +}
++
 +func defaultPullTitle(head string, commits []repogit.Commit) string {
 +	if len(commits) == 1 && strings.TrimSpace(commits[0].Subject) != "" {
 +		return commits[0].Subject
 +	}
 +	if strings.TrimSpace(head) == "" {
 +		return ""
 +	}
 +	return head
 +}
++
 +func probeCompareMerge(ctx context.Context, gitDir, base, head string) compareMergeState {
 +	baseOID, berr := repogit.ResolveRefOID(ctx, gitDir, base)
 +	headOID, herr := repogit.ResolveRefOID(ctx, gitDir, head)
 +	if berr != nil || herr != nil {
 +		return compareMergeState{
 +			State:       "missing",
 +			Label:       "Unable to check mergeability.",
 +			Description: "One or both refs could not be resolved.",
 +		}
 +	}
 +	result, err := repogit.ProbeMerge(ctx, gitDir, baseOID, headOID)
 +	if err != nil {
 +		if errors.Is(err, repogit.ErrRefNotFound) {
 +			return compareMergeState{
 +				State:       "missing",
 +				Label:       "Unable to check mergeability.",
 +				Description: "One or both refs could not be resolved.",
 +			}
 +		}
 +		return compareMergeState{
 +			State:       "unknown",
 +			Label:       "Mergeability could not be checked.",
 +			Description: "You can still create the pull request and shithub will retry the check.",
 +		}
 +	}
 +	if result.HasConflict {
 +		return compareMergeState{
 +			State:       "conflict",
 +			Label:       "Cannot automatically merge.",
 +			Description: "These branches have conflicts that must be resolved.",
 +		}
 +	}
 +	return compareMergeState{
 +		State:       "clean",
 +		Label:       "Able to merge.",
 +		Description: "These branches can be automatically merged.",
 +	}
 +}
++
 +func pullNewCommentEditorConfig(viewer middleware.CurrentUser) commentEditorConfig {
 +	if viewer.IsAnonymous() || strings.EqualFold(viewer.Username, "copilot") {
 +		return commentEditorConfig{}
 +	}
 +	return commentEditorConfig{
 +		Mentions: []commentEditorMention{{
 +			Username:  viewer.Username,
 +			AvatarURL: commentEditorAvatarURL(viewer.Username),
 +		}},
 +	}
 +}

internal/web/handlers/repo/compare_ui_test.goadded

65 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +package repo
++
 +import (
 +	"testing"
++
 +	repogit "github.com/tenseleyFlow/shithub/internal/repos/git"
 +)
++
 +func TestCompareURLsEscapeBranchSegments(t *testing.T) {
 +	got := compareURL("tenseleyFlow", "shithub", "trunk", "feature/a b")
 +	want := "/tenseleyFlow/shithub/compare/trunk...feature/a%20b"
 +	if got != want {
 +		t.Fatalf("compareURL() = %q, want %q", got, want)
 +	}
++
 +	got = pullNewURL("tenseleyFlow", "shithub", "trunk", "feature/a b")
 +	want = "/tenseleyFlow/shithub/pulls/new?base=trunk&head=feature%2Fa+b"
 +	if got != want {
 +		t.Fatalf("pullNewURL() = %q, want %q", got, want)
 +	}
 +}
++
 +func TestBuildCompareMenusPreservesOtherSide(t *testing.T) {
 +	refs := repogit.RefListing{
 +		Branches: []repogit.RefEntry{
 +			{Name: "trunk"},
 +			{Name: "scratch"},
 +		},
 +		Tags: []repogit.RefEntry{{Name: "v1.0.0"}},
 +	}
++
 +	baseMenu, headMenu := buildCompareMenus("octo", "demo", "trunk", "trunk", "scratch", refs, compareMenuTargetCompare)
 +	if baseMenu.Branches[1].Href != "/octo/demo/compare/scratch...scratch" {
 +		t.Fatalf("base branch href = %q", baseMenu.Branches[1].Href)
 +	}
 +	if headMenu.Branches[0].Href != "/octo/demo/compare/trunk...trunk" {
 +		t.Fatalf("head branch href = %q", headMenu.Branches[0].Href)
 +	}
 +	if !baseMenu.Branches[0].IsDefault {
 +		t.Fatalf("default branch not marked")
 +	}
++
 +	_, pullHeadMenu := buildCompareMenus("octo", "demo", "trunk", "trunk", "scratch", refs, compareMenuTargetPullNew)
 +	if pullHeadMenu.Branches[1].Href != "/octo/demo/pulls/new?base=trunk&head=scratch" {
 +		t.Fatalf("pull new head href = %q", pullHeadMenu.Branches[1].Href)
 +	}
 +}
++
 +func TestCountPatchFiles(t *testing.T) {
 +	patch := []byte(`diff --git a/one.txt b/one.txt
 +index 1111111..2222222 100644
 +--- a/one.txt
 ++++ b/one.txt
 +@@ -1 +1 @@
 +-old
 ++new
 +diff --git a/two.txt b/two.txt
 +new file mode 100644
 +`)
 +	if got := countPatchFiles(patch); got != 2 {
 +		t.Fatalf("countPatchFiles() = %d, want 2", got)
 +	}
 +}

internal/web/handlers/repo/pulls.gomodified

120 lines changed — click to load

  		base = row.DefaultBranch
+ 	}
  	head := r.URL.Query().Get("head")
 -	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 -	_ = h.d.Render.RenderPage(w, r, "repo/pull_new", map[string]any{
 -		"Title":     "New pull request · " + row.Name,
 -		"Owner":     owner.Username,
 -		"Repo":      row,
 -		"Base":      base,
 -		"Head":      head,
 -		"CSRFToken": middleware.CSRFTokenForRequest(r),
 +	if strings.TrimSpace(head) == "" {
 +		http.Redirect(w, r, "/"+owner.Username+"/"+row.Name+"/compare", http.StatusSeeOther)
 +		return
 +	}
 +	h.renderPullNewForm(w, r, owner.Username, row, pullNewFormOptions{
 +		Base: base,
 +		Head: head,
  	})
+ }
 +type pullNewFormOptions struct {
 +	Base      string
 +	Head      string
 +	FormTitle string
 +	FormBody  string
 +	Error     string
 +	Status    int
 +}
++
 +func (h *Handlers) renderPullNewForm(w http.ResponseWriter, r *http.Request, owner string, row reposdb.Repo, opts pullNewFormOptions) {
 +	gitDir, err := h.d.RepoFS.RepoPath(owner, row.Name)
 +	if err != nil {
 +		h.d.Render.HTTPError(w, r, http.StatusNotFound, "")
 +		return
 +	}
 +	base := strings.TrimSpace(opts.Base)
 +	if base == "" {
 +		base = row.DefaultBranch
 +	}
 +	head := strings.TrimSpace(opts.Head)
 +	if head == "" {
 +		head = row.DefaultBranch
 +	}
 +	state := h.buildCompareState(r, owner, row, gitDir, base, head, true, compareMenuTargetPullNew)
 +	formTitle := opts.FormTitle
 +	if strings.TrimSpace(formTitle) == "" && opts.Error == "" {
 +		formTitle = defaultPullTitle(state.Head, state.Commits)
 +	}
 +	viewer := middleware.CurrentUserFromContext(r.Context())
 +	status := opts.Status
 +	if status == 0 {
 +		status = http.StatusOK
 +	}
 +	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 +	if status != http.StatusOK {
 +		w.WriteHeader(status)
 +	}
 +	_ = h.d.Render.RenderPage(w, r, "repo/pull_new", mergePageData(
 +		h.repoPageChrome(r, owner, row, "pulls"),
 +		map[string]any{
 +			"Title":               "Open a pull request · " + row.Name,
 +			"UseCompareJS":        true,
 +			"UseCommentEditor":    true,
 +			"CommentEditorConfig": commentEditorConfigJSON(pullNewCommentEditorConfig(viewer)),
 +			"Viewer":              viewer,
 +			"ViewerAvatarURL":     commentEditorAvatarURL(viewer.Username),
 +			"Error":               opts.Error,
 +			"FormTitle":           formTitle,
 +			"FormBody":            opts.FormBody,
 +			"Base":                state.Base,
 +			"Head":                state.Head,
 +			"HasSelection":        state.HasSelection,
 +			"SameRef":             state.SameRef,
 +			"NotFound":            state.NotFound,
 +			"CommitsErr":          state.CommitsErr,
 +			"NoCommits":           state.NoCommits,
 +			"Ahead":               state.Ahead,
 +			"Behind":              state.Behind,
 +			"Commits":             state.Commits,
 +			"DiffHTML":            state.DiffHTML,
 +			"Stats":               state.Stats,
 +			"MergeState":          state.MergeState,
 +			"CanOpenPull":         state.CanOpenPull,
 +			"CanCreatePull":       state.CanOpenPull && !state.NotFound && !state.CommitsErr,
 +			"PullNewHref":         state.PullNewHref,
 +			"BaseMenu":            state.BaseMenu,
 +			"HeadMenu":            state.HeadMenu,
 +		},
 +	))
 +}
++
  // pullCreate handles POST /{owner}/{repo}/pulls.
  func (h *Handlers) pullCreate(w http.ResponseWriter, r *http.Request) {
  	row, owner, ok := h.loadRepoAndAuthorize(w, r, policy.ActionPullCreate)
  	case errors.Is(err, issues.ErrBodyTooLong):
  		msg = "Body is too long."
+ 	}
 -	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 -	w.WriteHeader(http.StatusBadRequest)
 -	_ = h.d.Render.RenderPage(w, r, "repo/pull_new", map[string]any{
 -		"Title":     "New pull request · " + row.Name,
 -		"Owner":     owner,
 -		"Repo":      row,
 -		"Base":      r.PostFormValue("base"),
 -		"Head":      r.PostFormValue("head"),
 -		"FormTitle": r.PostFormValue("title"),
 -		"FormBody":  r.PostFormValue("body"),
 -		"Error":     msg,
 -		"CSRFToken": middleware.CSRFTokenForRequest(r),
 +	h.renderPullNewForm(w, r, owner, row, pullNewFormOptions{
 +		Base:      r.PostFormValue("base"),
 +		Head:      r.PostFormValue("head"),
 +		FormTitle: r.PostFormValue("title"),
 +		FormBody:  r.PostFormValue("body"),
 +		Error:     msg,
 +		Status:    http.StatusBadRequest,
  	})
+ }

internal/web/handlers/repo/repo.gomodified

19 lines changed — click to load

  	r.Post("/{owner}/{repo}/actions/workflows/{file}/dispatches", h.repoActionsDispatch)
+ }
 +// MountRepoActionsStreams registers long-lived Actions streaming routes.
 +// Caller must mount this outside compression and request-timeout middleware.
 +func (h *Handlers) MountRepoActionsStreams(r chi.Router) {
 +	r.Get("/{owner}/{repo}/actions/runs/{runIndex}/jobs/{jobIndex}/steps/{stepIndex}/log/stream", h.repoActionStepLogStream)
 +}
++
  // MountRepoHome registers the root repository route plus product-tab shells
  // that are intentionally public and read-gated like the Code tab. The
  // two-segment route doesn't collide with the /{username} catch-all from S09;
  // caller is responsible for ordering this BEFORE /{username}.
  func (h *Handlers) MountRepoHome(r chi.Router) {
 -	r.Get("/{owner}/{repo}/actions/runs/{runIndex}/jobs/{jobIndex}/steps/{stepIndex}/log/stream", h.repoActionStepLogStream)
 +	r.Get("/{owner}/{repo}/actions.atom", h.repoActionsAtom)
  	r.Get("/{owner}/{repo}/actions/runs/{runIndex}/jobs/{jobIndex}/steps/{stepIndex}", h.repoActionStepLog)
  	r.Get("/{owner}/{repo}/actions/runs/{runIndex}/status", h.repoActionRunStatus)
  	r.Get("/{owner}/{repo}/actions/runs/{runIndex}", h.repoActionRun)

internal/web/middleware/middleware_test.gomodified

23 lines changed — click to load

+ 	}
+ }
 +func TestPATAuthPolicyActorPropagatesResolvedUserFlags(t *testing.T) {
 +	t.Parallel()
++
 +	actor := PATAuth{
 +		UserID:      42,
 +		Username:    "alice",
 +		IsSuspended: true,
 +		IsSiteAdmin: true,
 +	}.PolicyActor()
 +	if actor.UserID != 42 || actor.Username != "alice" || !actor.IsSuspended || !actor.IsSiteAdmin {
 +		t.Fatalf("PolicyActor did not propagate PAT user flags: %+v", actor)
 +	}
 +	if anon := (PATAuth{}).PolicyActor(); !anon.IsAnonymous {
 +		t.Fatalf("zero PATAuth should produce anonymous actor: %+v", anon)
 +	}
 +}
++
  // TestOptionalUser_StaleEpochSkipsBind is the corollary: when the
  // recorded session epoch doesn't match the current users.session_epoch
  // (because the user logged out everywhere), the binding is skipped so

internal/web/middleware/pat.gomodified

148 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgxpool"
  	"github.com/tenseleyFlow/shithub/internal/auth/pat"
 +	"github.com/tenseleyFlow/shithub/internal/auth/policy"
  	usersdb "github.com/tenseleyFlow/shithub/internal/users/sqlc"
+ )
  // the auth check passed via PAT, `Token != nil` and Scopes is the parsed
  // scope list. Pure session callers see the zero value.
  type PATAuth struct {
 -	UserID  int64
 -	TokenID int64
 -	Scopes  []string
 +	UserID      int64
 +	Username    string
 +	TokenID     int64
 +	Scopes      []string
 +	IsSuspended bool
 +	IsSiteAdmin bool
+ }
  // PATAuthFromContext returns the resolved PAT auth state, or the zero
  	return PATAuth{}
+ }
 +// PolicyActor returns the canonical policy actor for a resolved PAT request.
 +func (p PATAuth) PolicyActor() policy.Actor {
 +	if p.UserID == 0 {
 +		return policy.AnonymousActor()
 +	}
 +	return policy.UserActor(p.UserID, p.Username, p.IsSuspended, p.IsSiteAdmin)
 +}
++
  // PATConfig configures the PAT auth middleware.
  type PATConfig struct {
  	Pool      *pgxpool.Pool
  				}()
+ 			}
 +			// X-OAuth-Scopes echoes the token's scopes on every response —
 +			// even errors emitted further down the chain — so the CLI's
 +			// error path (shithub-cli/internal/api/errors.go) can report
 +			// provided scopes alongside the required scope on 403.
 +			w.Header().Set("X-OAuth-Scopes", strings.Join(row.Scopes, ", "))
++
  			ctx := context.WithValue(r.Context(), patAuthKey, PATAuth{
 -				UserID:  row.UserID,
 -				TokenID: row.ID,
 -				Scopes:  row.Scopes,
 +				UserID:      row.UserID,
 +				Username:    user.Username,
 +				TokenID:     row.ID,
 +				Scopes:      row.Scopes,
 +				IsSuspended: user.SuspendedAt.Valid,
 +				IsSiteAdmin: user.IsSiteAdmin,
  			})
  			next.ServeHTTP(w, r.WithContext(ctx))
  		})
  // RequireScope rejects with 403 if the request was authenticated via PAT
  // and the token's scopes don't include required. Pure-session callers
  // (PATAuth zero) pass through — sessions have implicit full scope.
 +//
 +// The 403 response is the canonical /api/v1 JSON envelope
 +// `{"error": "token lacks required scope: <scope>"}` and carries
 +// X-Accepted-OAuth-Scopes so the CLI can format an actionable error
 +// without parsing the message body.
  func RequireScope(required pat.Scope) func(http.Handler) http.Handler {
  	return func(next http.Handler) http.Handler {
  		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  				return
+ 			}
  			if !pat.HasScope(auth.Scopes, required) {
 -				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 -				w.WriteHeader(http.StatusForbidden)
 -				_, _ = w.Write([]byte("token lacks required scope: " + string(required) + "\n"))
 +				w.Header().Set("X-Accepted-OAuth-Scopes", string(required))
 +				writeAPIJSONError(w, http.StatusForbidden, "token lacks required scope: "+string(required))
  				return
+ 			}
  			next.ServeHTTP(w, r)
+ 	}
+ }
 +// writeAPIJSONError writes the canonical /api/v1 error envelope. Kept
 +// inline so package middleware doesn't depend on the api handler package
 +// (which would import-cycle).
 +func writeAPIJSONError(w http.ResponseWriter, status int, msg string) {
 +	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 +	w.Header().Set("Cache-Control", "no-store")
 +	w.WriteHeader(status)
 +	// Escape the inner message just enough for embedding in a JSON
 +	// string literal. The reason strings here are package-controlled —
 +	// no user input — but defensive escaping keeps this honest if a
 +	// caller ever passes through external data.
 +	_, _ = w.Write([]byte(`{"error":` + jsonString(msg) + `}` + "\n"))
 +}
++
 +// jsonString returns s wrapped in JSON-string quoting, escaping the
 +// minimum required characters. Avoiding encoding/json here keeps
 +// allocations down on the hot challenge path.
 +func jsonString(s string) string {
 +	var b strings.Builder
 +	b.Grow(len(s) + 2)
 +	b.WriteByte('"')
 +	for _, r := range s {
 +		switch r {
 +		case '"', '\\':
 +			b.WriteByte('\\')
 +			b.WriteRune(r)
 +		case '\n':
 +			b.WriteString(`\n`)
 +		case '\r':
 +			b.WriteString(`\r`)
 +		case '\t':
 +			b.WriteString(`\t`)
 +		default:
 +			if r < 0x20 {
 +				// Control chars: emit as \u00XX.
 +				const hex = "0123456789abcdef"
 +				b.WriteString(`\u00`)
 +				b.WriteByte(hex[byte(r)>>4])
 +				b.WriteByte(hex[byte(r)&0x0f])
 +				continue
 +			}
 +			b.WriteRune(r)
 +		}
 +	}
 +	b.WriteByte('"')
 +	return b.String()
 +}
++
  // errNoCredentials is the sentinel that says "no Authorization header at
  // all" — distinct from "Authorization present but malformed."
  var errNoCredentials = errors.New("middleware: no credentials")
+ }
  // writePATChallenge writes the canonical 401 with a Bearer challenge.
 +// Body is the /api/v1 JSON error envelope so the shithub-cli client and
 +// any other JSON consumer can decode the failure uniformly.
  func writePATChallenge(w http.ResponseWriter, realm, reason string) {
  	w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`", error="invalid_token", error_description="`+reason+`"`)
 -	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 -	w.WriteHeader(http.StatusUnauthorized)
 -	_, _ = w.Write([]byte(reason + "\n"))
 +	writeAPIJSONError(w, http.StatusUnauthorized, reason)
+ }
  // remoteAddrFromRequest pulls the client IP for last_used_ip. Reuses the

internal/web/server.gomodified

7 lines changed — click to load

  			})
+ 		}
  		deps.RepoHomeMounter = repoH.MountRepoHome
 +		deps.RepoActionsStreamMounter = repoH.MountRepoActionsStreams
  		deps.RepoCodeMounter = repoH.MountCode
  		deps.RepoHistoryMounter = repoH.MountHistory
  		deps.RepoRefsMounter = repoH.MountRefs

internal/web/static/css/shithub.cssmodified

508 lines changed — click to load

    border-bottom: 1px solid var(--border-default);
+ }
  .shithub-branches-subject { color: var(--fg-default); }
 -.shithub-compare-summary { padding: 0.75rem 1rem; background: var(--canvas-subtle); border-radius: 6px; display: flex; gap: 1rem; align-items: center; flex-wrap: wrap; }
 -.shithub-compare-empty { padding: 1.5rem; text-align: center; color: var(--fg-muted); border: 1px dashed var(--border-default); border-radius: 6px; }
 -.shithub-compare-commits { margin-top: 1.5rem; }
 +.shithub-compare-flow {
 +  max-width: 62.5rem;
 +  margin: 1.5rem auto 3rem;
 +  padding: 0 1rem;
 +}
 +.shithub-compare-subhead {
 +  padding-bottom: 0.75rem;
 +  margin-bottom: 0.75rem;
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-compare-subhead h1 {
 +  margin: 0 0 0.25rem;
 +  font-size: 1.5rem;
 +}
 +.shithub-compare-subhead p {
 +  margin: 0;
 +  color: var(--fg-muted);
 +}
 +.shithub-branch-push-banner,
 +.shithub-branch-compare-bar {
 +  display: flex;
 +  align-items: center;
 +  justify-content: space-between;
 +  gap: 1rem;
 +  margin-bottom: 0.75rem;
 +  padding: 0.75rem 1rem;
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +}
 +.shithub-branch-push-banner {
 +  border-color: rgba(187, 128, 9, 0.45);
 +  background: rgba(187, 128, 9, 0.12);
 +}
 +.shithub-branch-push-banner > div,
 +.shithub-branch-compare-bar > div {
 +  display: flex;
 +  align-items: center;
 +  gap: 0.4rem;
 +  min-width: 0;
 +  flex-wrap: wrap;
 +}
 +.shithub-branch-compare-bar {
 +  background: var(--canvas-subtle);
 +}
 +.shithub-contribute-menu {
 +  position: relative;
 +  flex: 0 0 auto;
 +}
 +.shithub-contribute-menu > summary {
 +  list-style: none;
 +}
 +.shithub-contribute-menu > summary::-webkit-details-marker {
 +  display: none;
 +}
 +.shithub-contribute-menu-panel {
 +  position: absolute;
 +  z-index: 60;
 +  right: 0;
 +  top: calc(100% + 0.25rem);
 +  width: min(26rem, calc(100vw - 2rem));
 +  padding: 1rem;
 +  color: var(--fg-default);
 +  background: var(--canvas-overlay, var(--canvas-default));
 +  border: 1px solid var(--border-default);
 +  border-radius: 8px;
 +  box-shadow: var(--shadow-large, 0 16px 32px rgba(1, 4, 9, 0.35));
 +}
 +.shithub-contribute-menu-panel p {
 +  margin: 0.25rem 0 0;
 +  color: var(--fg-muted);
 +}
 +.shithub-contribute-actions {
 +  display: flex;
 +  justify-content: flex-end;
 +  gap: 0.5rem;
 +  margin-top: 1rem;
 +}
 +.shithub-range-editor {
 +  display: flex;
 +  align-items: center;
 +  gap: 0.5rem;
 +  flex-wrap: wrap;
 +  padding: 0.75rem 0;
 +}
 +.shithub-range-separator {
 +  color: var(--fg-muted);
 +  font-weight: 600;
 +}
 +.shithub-range-create {
 +  margin-left: auto;
 +}
 +.shithub-compare-ref-menu {
 +  position: relative;
 +}
 +.shithub-compare-ref-summary {
 +  display: inline-flex;
 +  align-items: center;
 +  gap: 0.35rem;
 +  list-style: none;
 +}
 +.shithub-compare-ref-summary::-webkit-details-marker {
 +  display: none;
 +}
 +.shithub-compare-ref-label {
 +  color: var(--fg-muted);
 +}
 +.shithub-compare-ref-current {
 +  color: var(--fg-default);
 +  font-weight: 600;
 +}
 +.shithub-compare-ref-panel {
 +  position: absolute;
 +  z-index: 70;
 +  top: calc(100% + 0.25rem);
 +  left: 0;
 +  width: min(20rem, calc(100vw - 2rem));
 +  overflow: hidden;
 +  background: var(--canvas-overlay, var(--canvas-default));
 +  border: 1px solid var(--border-default);
 +  border-radius: 8px;
 +  box-shadow: var(--shadow-large, 0 16px 32px rgba(1, 4, 9, 0.35));
 +}
 +.shithub-compare-ref-panel-head {
 +  display: flex;
 +  align-items: center;
 +  justify-content: space-between;
 +  gap: 0.75rem;
 +  padding: 0.75rem;
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-compare-ref-filter {
 +  display: flex;
 +  align-items: center;
 +  gap: 0.4rem;
 +  margin: 0.5rem;
 +  padding: 0 0.5rem;
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +  color: var(--fg-muted);
 +}
 +.shithub-compare-ref-filter input {
 +  width: 100%;
 +  min-width: 0;
 +  padding: 0.45rem 0;
 +  color: var(--fg-default);
 +  background: transparent;
 +  border: 0;
 +  outline: 0;
 +  font: inherit;
 +}
 +.shithub-compare-ref-tabs {
 +  display: flex;
 +  border-top: 1px solid var(--border-default);
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-compare-ref-tabs button {
 +  flex: 1 1 0;
 +  padding: 0.55rem 0.75rem;
 +  color: var(--fg-muted);
 +  background: transparent;
 +  border: 0;
 +  border-bottom: 2px solid transparent;
 +  font: inherit;
 +  font-weight: 600;
 +  cursor: pointer;
 +}
 +.shithub-compare-ref-tabs button.is-active {
 +  color: var(--fg-default);
 +  border-bottom-color: var(--accent-emphasis);
 +}
 +.shithub-compare-ref-list {
 +  max-height: 19rem;
 +  overflow: auto;
 +}
 +.shithub-compare-ref-option {
 +  display: grid;
 +  grid-template-columns: 1.25rem minmax(0, 1fr) auto;
 +  align-items: center;
 +  gap: 0.4rem;
 +  padding: 0.55rem 0.75rem;
 +  color: var(--fg-default);
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-compare-ref-option:hover,
 +.shithub-compare-ref-option.is-current {
 +  color: #ffffff;
 +  text-decoration: none;
 +  background: var(--accent-emphasis);
 +}
 +.shithub-compare-ref-check {
 +  display: inline-flex;
 +  color: currentColor;
 +}
 +.shithub-compare-ref-option-name {
 +  overflow: hidden;
 +  text-overflow: ellipsis;
 +  white-space: nowrap;
 +}
 +.shithub-compare-ref-default {
 +  padding: 0.05rem 0.35rem;
 +  color: var(--fg-default);
 +  border: 1px solid var(--border-default);
 +  border-radius: 999px;
 +  font-size: 0.75rem;
 +  font-weight: 600;
 +}
 +.shithub-compare-ref-option:hover .shithub-compare-ref-default,
 +.shithub-compare-ref-option.is-current .shithub-compare-ref-default {
 +  color: #ffffff;
 +  border-color: rgba(255, 255, 255, 0.65);
 +}
 +.shithub-compare-ref-empty {
 +  padding: 1rem;
 +  color: var(--fg-muted);
 +  text-align: center;
 +}
 +.shithub-compare-flash {
 +  display: flex;
 +  align-items: flex-start;
 +  gap: 0.75rem;
 +  padding: 0.75rem 1rem;
 +  margin: 0.5rem 0 1rem;
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +  background: var(--canvas-subtle);
 +}
 +.shithub-compare-flash p {
 +  margin: 0.2rem 0 0;
 +  color: var(--fg-muted);
 +}
 +.shithub-compare-flash-warning {
 +  border-color: rgba(187, 128, 9, 0.45);
 +  background: rgba(187, 128, 9, 0.12);
 +}
 +.shithub-compare-flash-danger,
 +.shithub-compare-flash-conflict {
 +  border-color: rgba(248, 81, 73, 0.45);
 +  background: rgba(248, 81, 73, 0.10);
 +}
 +.shithub-compare-flash-clean,
 +.shithub-range-merge-clean {
 +  color: var(--success-fg);
 +}
 +.shithub-compare-blankslate {
 +  display: grid;
 +  justify-items: center;
 +  gap: 0.35rem;
 +  padding: 2.5rem 1rem;
 +  color: var(--fg-muted);
 +  text-align: center;
 +}
 +.shithub-compare-blankslate h2 {
 +  margin: 0;
 +  color: var(--fg-default);
 +  font-size: 1.25rem;
 +}
 +.shithub-compare-examples {
 +  width: min(28rem, 100%);
 +  margin-top: 0.75rem;
 +  overflow: hidden;
 +  text-align: left;
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +}
 +.shithub-compare-examples-head,
 +.shithub-compare-examples a {
 +  display: flex;
 +  align-items: center;
 +  justify-content: space-between;
 +  gap: 0.75rem;
 +  padding: 0.55rem 0.75rem;
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-compare-examples a:last-child {
 +  border-bottom: 0;
 +}
 +.shithub-compare-examples-head {
 +  color: var(--fg-muted);
 +  background: var(--canvas-subtle);
 +  font-weight: 600;
 +}
 +.shithub-compare-stats {
 +  display: grid;
 +  grid-template-columns: repeat(3, 1fr);
 +  margin: 1rem 0;
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +  overflow: hidden;
 +}
 +.shithub-compare-stats span {
 +  display: flex;
 +  align-items: center;
 +  justify-content: center;
 +  gap: 0.4rem;
 +  padding: 0.75rem;
 +  color: var(--fg-muted);
 +  border-right: 1px solid var(--border-default);
 +}
 +.shithub-compare-stats span:last-child {
 +  border-right: 0;
 +}
 +.shithub-compare-commits {
 +  margin-top: 1.5rem;
 +}
 +.shithub-compare-commits h2 {
 +  margin: 0 0 0.5rem;
 +  font-size: 1rem;
 +}
 +.shithub-range-merge-state {
 +  display: inline-flex;
 +  align-items: center;
 +  gap: 0.25rem;
 +  font-weight: 600;
 +}
 +.shithub-range-merge-conflict,
 +.shithub-range-merge-missing {
 +  color: var(--danger-fg, #f85149);
 +}
 +.shithub-pull-open-flow {
 +  max-width: 72rem;
 +}
 +.shithub-pull-new-layout {
 +  display: grid;
 +  grid-template-columns: minmax(0, 1fr) 17rem;
 +  gap: 1.5rem;
 +  align-items: start;
 +  margin-top: 0.75rem;
 +}
 +.shithub-pull-new-form {
 +  min-width: 0;
 +}
 +.shithub-pull-new-title-row {
 +  display: grid;
 +  grid-template-columns: 2.5rem minmax(0, 1fr);
 +  gap: 0.75rem;
 +  align-items: start;
 +}
 +.shithub-pull-new-title,
 +.shithub-pull-new-description-label {
 +  display: grid;
 +  gap: 0.35rem;
 +  font-weight: 600;
 +}
 +.shithub-pull-new-title input {
 +  width: 100%;
 +  padding: 0.5rem 0.75rem;
 +  color: var(--fg-default);
 +  background: var(--canvas-default);
 +  border: 1px solid var(--border-default);
 +  border-radius: 6px;
 +  font: inherit;
 +}
 +.shithub-pull-new-description {
 +  margin: 0.75rem 0 0 3.25rem;
 +}
 +.shithub-pull-new-description .shithub-comment-editor-box {
 +  margin-top: 0.35rem;
 +}
 +.shithub-pull-new-actions {
 +  display: flex;
 +  justify-content: flex-end;
 +  align-items: stretch;
 +  gap: 0;
 +  margin-top: 0.75rem;
 +}
 +.shithub-pull-new-actions > .shithub-button-primary {
 +  border-top-right-radius: 0;
 +  border-bottom-right-radius: 0;
 +}
 +.shithub-pr-submit-menu {
 +  position: relative;
 +}
 +.shithub-pr-submit-menu > summary {
 +  height: 100%;
 +  border-top-left-radius: 0;
 +  border-bottom-left-radius: 0;
 +  list-style: none;
 +}
 +.shithub-pr-submit-menu > summary::-webkit-details-marker {
 +  display: none;
 +}
 +.shithub-pr-submit-menu-popover {
 +  position: absolute;
 +  z-index: 65;
 +  right: 0;
 +  top: calc(100% + 0.25rem);
 +  width: min(21rem, calc(100vw - 2rem));
 +  overflow: hidden;
 +  background: var(--canvas-overlay, var(--canvas-default));
 +  border: 1px solid var(--border-default);
 +  border-radius: 8px;
 +  box-shadow: var(--shadow-large, 0 16px 32px rgba(1, 4, 9, 0.35));
 +}
 +.shithub-pr-submit-menu-popover button {
 +  display: grid;
 +  gap: 0.25rem;
 +  width: 100%;
 +  padding: 0.75rem 1rem;
 +  color: var(--fg-default);
 +  text-align: left;
 +  background: transparent;
 +  border: 0;
 +  border-bottom: 1px solid var(--border-default);
 +  font: inherit;
 +  cursor: pointer;
 +}
 +.shithub-pr-submit-menu-popover button:last-child {
 +  border-bottom: 0;
 +}
 +.shithub-pr-submit-menu-popover button:hover,
 +.shithub-pr-submit-menu-popover button.is-active {
 +  color: #ffffff;
 +  background: var(--accent-emphasis);
 +}
 +.shithub-pr-submit-menu-popover span {
 +  color: inherit;
 +  opacity: 0.85;
 +  font-size: 0.85rem;
 +}
 +.shithub-pull-new-sidebar {
 +  display: grid;
 +  gap: 0;
 +  color: var(--fg-muted);
 +  font-size: 0.9rem;
 +}
 +.shithub-pull-new-sidebar section {
 +  padding: 0.75rem 0;
 +  border-bottom: 1px solid var(--border-default);
 +}
 +.shithub-pull-new-sidebar h2 {
 +  display: flex;
 +  align-items: center;
 +  justify-content: space-between;
 +  gap: 0.5rem;
 +  margin: 0 0 0.4rem;
 +  color: var(--fg-muted);
 +  font-size: 0.85rem;
 +}
 +.shithub-pull-new-sidebar p {
 +  margin: 0;
 +}
 +@media (max-width: 760px) {
 +  .shithub-range-create {
 +    margin-left: 0;
 +    width: 100%;
 +    justify-content: center;
 +  }
 +  .shithub-compare-stats {
 +    grid-template-columns: 1fr;
 +  }
 +  .shithub-compare-stats span {
 +    border-right: 0;
 +    border-bottom: 1px solid var(--border-default);
 +  }
 +  .shithub-compare-stats span:last-child {
 +    border-bottom: 0;
 +  }
 +  .shithub-pull-new-layout {
 +    grid-template-columns: 1fr;
 +  }
 +  .shithub-pull-new-description {
 +    margin-left: 0;
 +  }
 +  .shithub-pull-new-sidebar {
 +    order: 2;
 +  }
 +  .shithub-branch-push-banner,
 +  .shithub-branch-compare-bar {
 +    align-items: stretch;
 +    flex-direction: column;
 +  }
 +  .shithub-contribute-menu,
 +  .shithub-contribute-menu > summary,
 +  .shithub-branch-push-banner .shithub-button {
 +    width: 100%;
 +    justify-content: center;
 +  }
 +}
  .shithub-settings-branches form label { display: block; margin: 0.5rem 0; }
  .shithub-settings-branches form input[type=text],
  .shithub-settings-branches form select { font: inherit; padding: 0.4rem 0.6rem; border: 1px solid var(--border-default); border-radius: 6px; min-width: 280px; }
    justify-content: center;
    padding-top: 1rem;
+ }
 +.shithub-feed-pagination:empty {
 +  display: none;
 +}
 +.shithub-feed-more-button {
 +  min-width: 4.5rem;
 +}
 +.shithub-feed-more-loading {
 +  display: none;
 +}
 +.shithub-feed-more-button.htmx-request .shithub-feed-more-label {
 +  display: none;
 +}
 +.shithub-feed-more-button.htmx-request .shithub-feed-more-loading {
 +  display: inline;
 +}
  .shithub-side-panel {
    padding: 0 0 1.25rem;
    margin-bottom: 1.25rem;

internal/web/static/js/compare.jsadded

60 lines changed — click to load

 +// SPDX-License-Identifier: AGPL-3.0-or-later
++
 +(function () {
 +  function setActivePanel(menu, name) {
 +    menu.querySelectorAll("[data-ref-tab]").forEach(function (tab) {
 +      var active = tab.getAttribute("data-ref-tab") === name;
 +      tab.classList.toggle("is-active", active);
 +      tab.setAttribute("aria-selected", active ? "true" : "false");
 +    });
 +    menu.querySelectorAll("[data-ref-panel]").forEach(function (panel) {
 +      panel.hidden = panel.getAttribute("data-ref-panel") !== name;
 +    });
 +    var input = menu.querySelector("[data-ref-filter]");
 +    if (input) {
 +      input.value = "";
 +      input.setAttribute("placeholder", name === "tags" ? "Find a tag" : "Find a branch");
 +      input.setAttribute("aria-label", name === "tags" ? "Find a tag" : "Find a branch");
 +      filterPanel(menu);
 +      input.focus();
 +    }
 +  }
++
 +  function filterPanel(menu) {
 +    var input = menu.querySelector("[data-ref-filter]");
 +    var query = input ? input.value.trim().toLowerCase() : "";
 +    var panel = Array.prototype.find.call(menu.querySelectorAll("[data-ref-panel]"), function (candidate) {
 +      return !candidate.hidden;
 +    });
 +    if (!panel) return;
 +    var visible = 0;
 +    panel.querySelectorAll("[data-ref-option]").forEach(function (option) {
 +      var name = (option.getAttribute("data-ref-name") || option.textContent || "").toLowerCase();
 +      var match = !query || name.indexOf(query) !== -1;
 +      option.hidden = !match;
 +      if (match) visible += 1;
 +    });
 +    var empty = panel.querySelector("[data-ref-empty]");
 +    if (empty) empty.hidden = visible !== 0;
 +  }
++
 +  document.querySelectorAll("[data-ref-menu]").forEach(function (menu) {
 +    menu.querySelectorAll("[data-ref-tab]").forEach(function (tab) {
 +      tab.addEventListener("click", function () {
 +        setActivePanel(menu, tab.getAttribute("data-ref-tab") || "branches");
 +      });
 +    });
 +    var input = menu.querySelector("[data-ref-filter]");
 +    if (input) {
 +      input.addEventListener("input", function () { filterPanel(menu); });
 +    }
 +    menu.querySelectorAll("[data-ref-close]").forEach(function (close) {
 +      close.addEventListener("click", function () { menu.open = false; });
 +    });
 +    menu.addEventListener("toggle", function () {
 +      if (menu.open && input) {
 +        setTimeout(function () { input.focus(); }, 0);
 +      }
 +    });
 +  });
 +})();

internal/web/templates/_compare_ref_menu.htmladded

44 lines changed — click to load

 +{{ define "compare-ref-menu" -}}
 +{{ $menu := .Menu -}}
 +<details class="shithub-compare-ref-menu" data-ref-menu>
 +  <summary class="shithub-button shithub-button-small shithub-compare-ref-summary">
 +    <span class="shithub-compare-ref-label">{{ $menu.Label }}</span>
 +    <span class="shithub-compare-ref-current">{{ $menu.Current }}</span>
 +    {{ octicon "triangle-down" }}
 +  </summary>
 +  <div class="shithub-compare-ref-panel">
 +    <div class="shithub-compare-ref-panel-head">
 +      <strong>{{ $menu.Title }}</strong>
 +      <button type="button" class="shithub-icon-button shithub-compare-ref-close" aria-label="Close" data-ref-close>{{ octicon "x" }}</button>
 +    </div>
 +    <div class="shithub-compare-ref-filter">
 +      {{ octicon "search" }}
 +      <input type="search" placeholder="Find a branch" aria-label="Find a branch" data-ref-filter>
 +    </div>
 +    <div class="shithub-compare-ref-tabs" role="tablist" aria-label="{{ $menu.Title }}">
 +      <button type="button" class="is-active" role="tab" aria-selected="true" data-ref-tab="branches">Branches</button>
 +      <button type="button" role="tab" aria-selected="false" data-ref-tab="tags">Tags</button>
 +    </div>
 +    <div class="shithub-compare-ref-list" data-ref-panel="branches">
 +      {{ range $menu.Branches }}
 +      <a href="{{ .Href }}" class="shithub-compare-ref-option{{ if .Current }} is-current{{ end }}" data-ref-option data-ref-name="{{ .Name }}">
 +        <span class="shithub-compare-ref-check">{{ if .Current }}{{ octicon "check" }}{{ end }}</span>
 +        <span class="shithub-compare-ref-option-name">{{ .Name }}</span>
 +        {{ if .IsDefault }}<span class="shithub-compare-ref-default">default</span>{{ end }}
 +      </a>
 +      {{ end }}
 +      <div class="shithub-compare-ref-empty" data-ref-empty hidden>No matching branches.</div>
 +    </div>
 +    <div class="shithub-compare-ref-list" data-ref-panel="tags" hidden>
 +      {{ range $menu.Tags }}
 +      <a href="{{ .Href }}" class="shithub-compare-ref-option{{ if .Current }} is-current{{ end }}" data-ref-option data-ref-name="{{ .Name }}">
 +        <span class="shithub-compare-ref-check">{{ if .Current }}{{ octicon "check" }}{{ end }}</span>
 +        <span class="shithub-compare-ref-option-name">{{ .Name }}</span>
 +        {{ if .IsDefault }}<span class="shithub-compare-ref-default">default</span>{{ end }}
 +      </a>
 +      {{ end }}
 +      <div class="shithub-compare-ref-empty" data-ref-empty hidden>No matching tags.</div>
 +    </div>
 +  </div>
 +</details>
 +{{- end }}

internal/web/templates/_explore_feed_pagination.htmladded

21 lines changed — click to load

 +{{ define "explore-feed-pagination" -}}
 +{{ if .FeedHasNext }}
 +<nav id="shithub-feed-pagination" class="shithub-feed-pagination" aria-label="Activity pagination">
 +  <a
 +    class="shithub-button shithub-feed-more-button"
 +    href="{{ .FeedNextURL }}"
 +    hx-get="{{ .FeedNextURL }}"
 +    hx-target="#shithub-feed-list"
 +    hx-swap="beforeend"
 +    hx-select="#shithub-feed-fragment-rows > *"
 +    hx-select-oob="#shithub-feed-pagination:outerHTML"
 +    hx-indicator="this"
 +  >
 +    <span class="shithub-feed-more-label">More</span>
 +    <span class="shithub-feed-more-loading">Loading...</span>
 +  </a>
 +</nav>
 +{{ else }}
 +<nav id="shithub-feed-pagination" class="shithub-feed-pagination" aria-label="Activity pagination"></nav>
 +{{ end }}
 +{{- end }}

internal/web/templates/_layout.htmlmodified

7 lines changed — click to load

    <link rel="stylesheet" href="/static/css/shithub.css">
    <link rel="stylesheet" href="/static/css/chroma.css">
    {{ if flag . "UseHTMX" }}<script src="/static/vendor/htmx/htmx.min.js" defer></script>{{ end }}
 +  {{ if flag . "UseCompareJS" }}<script src="/static/js/compare.js" defer></script>{{ end }}
    {{ if flag . "UseCommentEditor" }}<script src="/static/js/comment-editor.js" defer></script>{{ end }}
  </head>
  <body class="shithub-body">

internal/web/templates/explore/feed_page.htmladded

6 lines changed — click to load

 +{{ define "page" -}}
 +<div id="shithub-feed-fragment-rows">
 +  {{ range .Feed }}{{ template "feed-row" . }}{{ end }}
 +</div>
 +{{ template "explore-feed-pagination" . }}
 +{{- end }}

internal/web/templates/explore/index.htmlmodified

20 lines changed — click to load

          <button type="button" class="shithub-button shithub-button-small" disabled>{{ octicon "list-unordered" }} Filter</button>
        </div>
        {{ if .Feed }}
 -      <ol class="shithub-feed-list">
 +      <ol id="shithub-feed-list" class="shithub-feed-list" aria-live="polite">
          {{ range .Feed }}{{ template "feed-row" . }}{{ end }}
        </ol>
        {{ else }}
          {{ if .Viewer.ID }}<a href="/trending" class="shithub-button">Explore trending repositories</a>{{ end }}
        </div>
        {{ end }}
 -      {{ if .FeedHasNext }}
 -      <nav class="shithub-feed-pagination" aria-label="Public activity pagination">
 -        <a class="shithub-button" href="{{ .FeedNextURL }}">More</a>
 -      </nav>
 -      {{ end }}
 +      {{ template "explore-feed-pagination" . }}
        {{ end }}
      </main>

internal/web/templates/repo/compare.htmlmodified

157 lines changed — click to load

  {{ define "page" -}}
 -<section class="shithub-compare">
 -  <header class="shithub-code-head">
 -    <h1>
 -      <a href="/{{ .Owner }}/{{ .Repo.Name }}/tree/{{ .Repo.DefaultBranch }}">{{ .Owner }}/{{ .Repo.Name }}</a>
 -      <span class="shithub-code-sep">/</span>
 -      Compare <code>{{ .Base }}</code> ... <code>{{ .Head }}</code>
 -    </h1>
 -  </header>
 +<section class="shithub-repo-page">
 +  {{ template "repo-header" . }}
 -  {{ if .NotFound }}
 -  <div class="shithub-compare-empty">One or both refs were not found in this repository.</div>
 -  {{ else }}
 -  <p class="shithub-compare-summary">
 -    {{ if eq .Base .Head }}
 -    Base and head are the same — nothing to compare.
 -    {{ else if le .Ahead 0 }}
 -    There isn't anything to compare. <code>{{ .Head }}</code> is up to date with <code>{{ .Base }}</code>.
 -    {{ else }}
 -    <strong>{{ .Ahead }}</strong> commit{{ if ne .Ahead 1 }}s{{ end }} ahead, <strong>{{ .Behind }}</strong> behind <code>{{ .Base }}</code>.
 -    <a href="/{{ .Owner }}/{{ .Repo.Name }}/pulls/new?base={{ .Base }}&amp;head={{ .Head }}" class="shithub-button shithub-button-primary">Create pull request</a>
 -    {{ end }}
 -  </p>
 +  <div class="shithub-compare-flow">
 +    <header class="shithub-compare-subhead">
 +      <h1>{{ if .HasSelection }}Comparing changes{{ else }}Compare changes{{ end }}</h1>
 +      <p>
 +        {{ if .HasSelection }}
 +        Choose two branches to see what's changed or to start a new pull request.
 +        {{ else }}
 +        Compare changes across branches, commits, tags, and more below.
 +        {{ end }}
 +      </p>
 +    </header>
 -  {{ if .Commits }}
 -  <section class="shithub-compare-commits">
 -    <h2>Commits in <code>{{ .Head }}</code></h2>
 -    <ul class="shithub-commits-list">
 -      {{ range .Commits }}
 -      <li class="shithub-commits-row">
 -        <div class="shithub-commits-meta">
 -          <a class="shithub-commits-subject" href="/{{ $.Owner }}/{{ $.Repo.Name }}/commit/{{ .OID }}">{{ .Subject }}</a>
 -          <code class="shithub-commits-sha">{{ .ShortOID }}</code>
 -          <small>{{ .AuthorName }} · <time datetime="{{ .AuthorWhen.Format "2006-01-02T15:04:05Z" }}">{{ relativeTime .AuthorWhen }}</time></small>
 -        </div>
 -      </li>
 +    <div class="shithub-range-editor" aria-label="Compare branches">
 +      {{ template "compare-ref-menu" (dict "Menu" .BaseMenu) }}
 +      <span class="shithub-range-separator" aria-hidden="true">...</span>
 +      {{ template "compare-ref-menu" (dict "Menu" .HeadMenu) }}
 +      {{ if .CanOpenPull }}
 +      <a href="{{ .PullNewHref }}" class="shithub-button shithub-button-primary shithub-range-create">Create pull request</a>
 +      {{ else }}
 +      <button type="button" class="shithub-button shithub-button-primary shithub-range-create" disabled>Create pull request</button>
        {{ end }}
 -    </ul>
 -  </section>
 -  {{ end }}
 +    </div>
++
 +    {{ if .NotFound }}
 +    <div class="shithub-compare-flash shithub-compare-flash-danger" role="alert">
 +      {{ octicon "x-circle" }}
 +      <div>
 +        <strong>There was a problem comparing these refs.</strong>
 +        <p>One or both refs were not found in this repository.</p>
 +      </div>
 +    </div>
 +    {{ else if not .HasSelection }}
 +    <div class="shithub-compare-flash shithub-compare-flash-warning">
 +      {{ octicon "git-pull-request" }}
 +      <div>Choose different branches or tags above to discuss and review changes.</div>
 +    </div>
 +    <section class="shithub-compare-blankslate">
 +      {{ octicon "git-pull-request" }}
 +      <h2>Compare and review just about anything</h2>
 +      <p>Branches, tags, commits, and time ranges in the same repository can be compared from here.</p>
 +      {{ if .Examples }}
 +      <div class="shithub-compare-examples">
 +        <div class="shithub-compare-examples-head">Example comparisons</div>
 +        {{ range .Examples }}
 +        <a href="{{ .Href }}">
 +          <span>{{ octicon "git-branch" }} {{ .Name }}</span>
 +          <span>compare</span>
 +        </a>
 +        {{ end }}
 +      </div>
 +      {{ end }}
 +    </section>
 +    {{ else if .SameRef }}
 +    <div class="shithub-compare-flash shithub-compare-flash-warning">
 +      {{ octicon "git-pull-request" }}
 +      <div>Choose different branches or tags above to discuss and review changes.</div>
 +    </div>
 +    <section class="shithub-compare-blankslate">
 +      {{ octicon "git-pull-request" }}
 +      <h2>Compare and review just about anything</h2>
 +      <p><code>{{ .Base }}</code> and <code>{{ .Head }}</code> are the same ref.</p>
 +    </section>
 +    {{ else if .NoCommits }}
 +    <div class="shithub-compare-flash shithub-compare-flash-warning">
 +      {{ octicon "check-circle" }}
 +      <div>
 +        <strong>There isn't anything to compare.</strong>
 +        <p><code>{{ .Head }}</code> is up to date with <code>{{ .Base }}</code>.</p>
 +      </div>
 +    </div>
 +    {{ else }}
 +    <div class="shithub-compare-flash shithub-compare-flash-{{ .MergeState.State }}">
 +      {{ if eq .MergeState.State "clean" }}{{ octicon "check" }}{{ else if eq .MergeState.State "conflict" }}{{ octicon "x-circle" }}{{ else }}{{ octicon "git-pull-request" }}{{ end }}
 +      <div>
 +        <strong>{{ .MergeState.Label }}</strong>
 +        <span>{{ .MergeState.Description }}</span>
 +      </div>
 +    </div>
 -  {{ if .DiffHTML }}
 -  <section class="shithub-diff-body" aria-label="Diff">
 -    {{ safeHTML .DiffHTML }}
 -  </section>
 -  {{ end }}
 -  {{ end }}
 +    <div class="shithub-compare-stats" aria-label="Comparison summary">
 +      <span>{{ octicon "git-commit" }} {{ .Stats.CommitCount }} {{ pluralize .Stats.CommitCount "commit" "commits" }}</span>
 +      <span>{{ octicon "diff" }} {{ .Stats.FileCount }} {{ pluralize .Stats.FileCount "file changed" "files changed" }}</span>
 +      <span>{{ octicon "person" }} {{ .Stats.ContributorCount }} {{ pluralize .Stats.ContributorCount "contributor" "contributors" }}</span>
 +    </div>
++
 +    {{ if .Commits }}
 +    <section class="shithub-compare-commits">
 +      <h2>Commits on {{ .Head }}</h2>
 +      <ul class="shithub-commits-list">
 +        {{ range .Commits }}
 +        <li class="shithub-commits-row">
 +          <div class="shithub-commits-meta">
 +            <a class="shithub-commits-subject" href="/{{ $.Owner }}/{{ $.Repo.Name }}/commit/{{ .OID }}">{{ .Subject }}</a>
 +            <code class="shithub-commits-sha">{{ .ShortOID }}</code>
 +            <small>{{ .AuthorName }} committed <time datetime="{{ .AuthorWhen.Format "2006-01-02T15:04:05Z" }}">{{ relativeTime .AuthorWhen }}</time></small>
 +          </div>
 +        </li>
 +        {{ end }}
 +      </ul>
 +    </section>
 +    {{ end }}
++
 +    {{ if .DiffHTML }}
 +    <section class="shithub-diff-body" aria-label="Diff">
 +      {{ safeHTML .DiffHTML }}
 +    </section>
 +    {{ end }}
 +    {{ end }}
 +  </div>
  </section>
  {{- end }}

internal/web/templates/repo/pull_new.htmlmodified

248 lines changed — click to load

  {{ define "page" -}}
 -<section class="shithub-issue-new">
 -  <header class="shithub-issues-head">
 -    <h1>
 -      <a href="/{{ .Owner }}/{{ .Repo.Name }}">{{ .Owner }}/{{ .Repo.Name }}</a>
 -      <span class="shithub-code-sep">/</span>
 -      <a href="/{{ .Owner }}/{{ .Repo.Name }}/pulls">Pull requests</a>
 -      <span class="shithub-code-sep">/</span>
 -      New
 -    </h1>
 -  </header>
+-
 -  {{ if .Error }}<div class="shithub-error" role="alert">{{ .Error }}</div>{{ end }}
+-
 -  <form method="post" action="/{{ .Owner }}/{{ .Repo.Name }}/pulls" class="shithub-issue-form">
 -    <input type="hidden" name="csrf_token" value="{{ .CSRFToken }}">
 -    <div class="shithub-form-row shithub-pull-refs">
 -      <label>
 -        <span>Base</span>
 -        <input type="text" name="base" value="{{ .Base }}" required>
 -      </label>
 -      <span class="shithub-pull-arrow">←</span>
 -      <label>
 -        <span>Head</span>
 -        <input type="text" name="head" value="{{ .Head }}" required>
 -      </label>
 +<section class="shithub-repo-page">
 +  {{ template "repo-header" . }}
++
 +  <div class="shithub-compare-flow shithub-pull-open-flow">
 +    <header class="shithub-compare-subhead">
 +      <h1>Open a pull request</h1>
 +      <p>Create a new pull request by comparing changes across two branches.</p>
 +    </header>
++
 +    <div class="shithub-range-editor" aria-label="Choose pull request branches">
 +      {{ template "compare-ref-menu" (dict "Menu" .BaseMenu) }}
 +      <span class="shithub-range-separator" aria-hidden="true">...</span>
 +      {{ template "compare-ref-menu" (dict "Menu" .HeadMenu) }}
 +      {{ if .MergeState.Label }}
 +      <span class="shithub-range-merge-state shithub-range-merge-{{ .MergeState.State }}">
 +        {{ if eq .MergeState.State "clean" }}{{ octicon "check" }}{{ else if eq .MergeState.State "conflict" }}{{ octicon "x-circle" }}{{ else }}{{ octicon "git-pull-request" }}{{ end }}
 +        {{ .MergeState.Label }}
 +      </span>
 +      {{ end }}
 +    </div>
++
 +    {{ if .Error }}<div class="shithub-error" role="alert">{{ .Error }}</div>{{ end }}
 +    {{ if .NotFound }}
 +    <div class="shithub-compare-flash shithub-compare-flash-danger" role="alert">
 +      {{ octicon "x-circle" }}
 +      <div>
 +        <strong>There was a problem comparing these refs.</strong>
 +        <p>One or both refs were not found in this repository.</p>
 +      </div>
      </div>
 -    <label class="shithub-form-row">
 -      <span>Title</span>
 -      <input type="text" name="title" maxlength="256" required value="{{ .FormTitle }}" autofocus>
 -    </label>
 -    <label class="shithub-form-row">
 -      <span>Body (Markdown)</span>
 -      <textarea name="body" rows="14" maxlength="65535">{{ .FormBody }}</textarea>
 -    </label>
 -    <label class="shithub-form-row">
 -      <input type="checkbox" name="draft" value="on">
 -      Open as draft
 -    </label>
 -    <div class="shithub-form-actions">
 -      <a href="/{{ .Owner }}/{{ .Repo.Name }}/pulls" class="shithub-button">Cancel</a>
 -      <button type="submit" class="shithub-button shithub-button-primary">Create pull request</button>
 +    {{ else if or .SameRef .NoCommits }}
 +    <div class="shithub-compare-flash shithub-compare-flash-warning">
 +      {{ octicon "git-pull-request" }}
 +      <div>
 +        <strong>Choose different branches to open a pull request.</strong>
 +        <p><code>{{ .Head }}</code> has no commits ahead of <code>{{ .Base }}</code>.</p>
 +      </div>
      </div>
 -  </form>
 +    {{ end }}
++
 +    <div class="shithub-pull-new-layout">
 +      <form method="post" action="/{{ .Owner }}/{{ .Repo.Name }}/pulls" class="shithub-pull-new-form">
 +        <input type="hidden" name="csrf_token" value="{{ .CSRFToken }}">
 +        <input type="hidden" name="base" value="{{ .Base }}">
 +        <input type="hidden" name="head" value="{{ .Head }}">
++
 +        <div class="shithub-pull-new-title-row">
 +          <a class="shithub-comment-composer-avatar" href="/{{ .Viewer.Username }}" aria-label="@{{ .Viewer.Username }}">
 +            <img src="{{ .ViewerAvatarURL }}" alt="" width="40" height="40">
 +          </a>
 +          <label class="shithub-pull-new-title">
 +            <span>Add a title <strong>*</strong></span>
 +            <input type="text" name="title" maxlength="256" required value="{{ .FormTitle }}" autofocus>
 +          </label>
 +        </div>
++
 +        <div class="shithub-pull-new-description" data-comment-editor data-preview-url="/{{ .Owner }}/{{ .Repo.Name }}/markdown-preview" data-preview-ref="{{ .Base }}">
 +          <script type="application/json" data-comment-editor-config>{{ jsField . "CommentEditorConfig" }}</script>
 +          <label class="shithub-pull-new-description-label" for="pull-new-body">Add a description</label>
 +          <div class="shithub-comment-editor-box">
 +            <div class="shithub-comment-editor-head">
 +              <div class="shithub-comment-editor-tabs" role="tablist" aria-label="Pull request description tabs">
 +                <button type="button" class="is-active" role="tab" aria-selected="true" data-comment-tab="write">Write</button>
 +                <button type="button" role="tab" aria-selected="false" data-comment-tab="preview">Preview</button>
 +              </div>
 +              <div class="shithub-comment-toolbar" aria-label="Formatting tools">
 +                <button type="button" class="shithub-comment-tool" data-comment-action="mention" title="Mention a user">{{ octicon "people" }}</button>
 +                <span class="shithub-comment-toolbar-separator" aria-hidden="true"></span>
 +                <button type="button" class="shithub-comment-tool shithub-comment-tool-text" data-comment-action="heading" title="Add heading">H</button>
 +                <button type="button" class="shithub-comment-tool shithub-comment-tool-text" data-comment-action="bold" title="Add bold text">B</button>
 +                <button type="button" class="shithub-comment-tool shithub-comment-tool-text is-italic" data-comment-action="italic" title="Add italic text">I</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="quote" title="Quote text">{{ octicon "comment" }}</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="code" title="Add code">{{ octicon "code" }}</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="link" title="Add link">{{ octicon "link" }}</button>
 +                <span class="shithub-comment-toolbar-separator" aria-hidden="true"></span>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="list" title="Add unordered list">{{ octicon "list-unordered" }}</button>
 +                <button type="button" class="shithub-comment-tool shithub-comment-tool-text" data-comment-action="ordered-list" title="Add ordered list">1.</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="task-list" title="Add task list">{{ octicon "checklist" }}</button>
 +                <span class="shithub-comment-toolbar-separator" aria-hidden="true"></span>
 +                <label class="shithub-comment-tool" title="Attach files">
 +                  {{ octicon "upload" }}
 +                  <input type="file" multiple data-comment-file-input>
 +                </label>
 +                <button type="button" class="shithub-comment-tool shithub-comment-tool-text" data-comment-action="reference" title="Reference an issue or pull request">#</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-saved-replies-open title="Saved replies">{{ octicon "comment-discussion" }}</button>
 +                <button type="button" class="shithub-comment-tool" data-comment-action="fullscreen" title="Fullscreen editor">{{ octicon "screen-full" }}</button>
 +              </div>
 +            </div>
 +            <div class="shithub-comment-editor-write" data-comment-write-pane>
 +              <textarea id="pull-new-body" name="body" rows="10" maxlength="65535" placeholder="Add your description here..." data-comment-textarea>{{ .FormBody }}</textarea>
 +              <div class="shithub-comment-suggestions" data-comment-suggestions hidden></div>
 +            </div>
 +            <div class="shithub-comment-editor-preview markdown-body" data-comment-preview-pane hidden>
 +              <p class="shithub-editor-preview-empty">Nothing to preview.</p>
 +            </div>
 +            <div class="shithub-comment-editor-footer">
 +              <span>{{ octicon "code-square" }} Markdown is supported</span>
 +              <span data-comment-attachment-copy>{{ octicon "file" }} Paste, drop, or click to add files</span>
 +              <span class="shithub-comment-file-list" data-comment-file-list hidden></span>
 +            </div>
 +          </div>
 +          <dialog class="shithub-comment-saved-dialog" data-comment-saved-dialog>
 +            <div class="shithub-comment-saved-head">
 +              <strong>Select a reply</strong>
 +              <button type="button" class="shithub-icon-button" aria-label="Close" data-comment-saved-close>{{ octicon "x" }}</button>
 +            </div>
 +            <input type="search" placeholder="Search saved replies" data-comment-saved-filter>
 +            <button type="button" class="shithub-comment-saved-item" data-comment-saved-insert="Duplicate of #">
 +              <strong>Duplicate pull request</strong>
 +              <span>Duplicate of #</span>
 +              <kbd>ctrl 1</kbd>
 +            </button>
 +            <button type="button" class="shithub-comment-saved-create">{{ octicon "plus" }} Create a new saved reply</button>
 +          </dialog>
 +        </div>
++
 +        <p class="shithub-comment-policy-note">
 +          {{ octicon "alert" }} Remember, contributions to this repository should follow its
 +          <a href="/{{ .Owner }}/{{ .Repo.Name }}/blob/{{ .Repo.DefaultBranch }}/CONTRIBUTING.md">contributing guidelines</a>,
 +          <a href="/{{ .Owner }}/{{ .Repo.Name }}/blob/{{ .Repo.DefaultBranch }}/SECURITY.md">security policy</a>, and
 +          <a href="/{{ .Owner }}/{{ .Repo.Name }}/blob/{{ .Repo.DefaultBranch }}/CODE_OF_CONDUCT.md">code of conduct</a>.
 +        </p>
++
 +        <div class="shithub-pull-new-actions">
 +          {{ if .CanCreatePull }}
 +          <button type="submit" class="shithub-button shithub-button-primary">Create pull request</button>
 +          <details class="shithub-pr-submit-menu">
 +            <summary class="shithub-button shithub-button-primary shithub-button-icon" aria-label="Create options">{{ octicon "triangle-down" }}</summary>
 +            <div class="shithub-pr-submit-menu-popover">
 +              <button type="submit" class="is-active">
 +                <strong>{{ octicon "check" }} Create pull request</strong>
 +                <span>Open a pull request that is ready for review</span>
 +              </button>
 +              <button type="submit" name="draft" value="on">
 +                <strong>Create draft pull request</strong>
 +                <span>Cannot be merged until marked ready for review</span>
 +              </button>
 +            </div>
 +          </details>
 +          {{ else }}
 +          <button type="submit" class="shithub-button shithub-button-primary" disabled>Create pull request</button>
 +          {{ end }}
 +        </div>
 +      </form>
++
 +      <aside class="shithub-pull-new-sidebar" aria-label="Pull request metadata">
 +        <section>
 +          <h2>Reviewers <button type="button" class="shithub-icon-button" aria-label="Edit reviewers">{{ octicon "gear" }}</button></h2>
 +          <p>No reviewers</p>
 +        </section>
 +        <section>
 +          <h2>Assignees <button type="button" class="shithub-icon-button" aria-label="Edit assignees">{{ octicon "gear" }}</button></h2>
 +          <p>No one - <a href="/{{ .Viewer.Username }}">assign yourself</a></p>
 +        </section>
 +        <section>
 +          <h2>Labels <button type="button" class="shithub-icon-button" aria-label="Edit labels">{{ octicon "gear" }}</button></h2>
 +          <p>None yet</p>
 +        </section>
 +        <section>
 +          <h2>Projects <button type="button" class="shithub-icon-button" aria-label="Edit projects">{{ octicon "gear" }}</button></h2>
 +          <p>None yet</p>
 +        </section>
 +        <section>
 +          <h2>Milestone <button type="button" class="shithub-icon-button" aria-label="Edit milestone">{{ octicon "gear" }}</button></h2>
 +          <p>No milestone</p>
 +        </section>
 +        <section>
 +          <h2>Development</h2>
 +          <p>Use closing keywords in the description to automatically close issues</p>
 +        </section>
 +      </aside>
 +    </div>
++
 +    {{ if and (not .NotFound) (not .SameRef) }}
 +    <div class="shithub-compare-stats" aria-label="Comparison summary">
 +      <span>{{ octicon "git-commit" }} {{ .Stats.CommitCount }} {{ pluralize .Stats.CommitCount "commit" "commits" }}</span>
 +      <span>{{ octicon "diff" }} {{ .Stats.FileCount }} {{ pluralize .Stats.FileCount "file changed" "files changed" }}</span>
 +      <span>{{ octicon "person" }} {{ .Stats.ContributorCount }} {{ pluralize .Stats.ContributorCount "contributor" "contributors" }}</span>
 +    </div>
++
 +    {{ if .Commits }}
 +    <section class="shithub-compare-commits">
 +      <h2>Commits on {{ .Head }}</h2>
 +      <ul class="shithub-commits-list">
 +        {{ range .Commits }}
 +        <li class="shithub-commits-row">
 +          <div class="shithub-commits-meta">
 +            <a class="shithub-commits-subject" href="/{{ $.Owner }}/{{ $.Repo.Name }}/commit/{{ .OID }}">{{ .Subject }}</a>
 +            <code class="shithub-commits-sha">{{ .ShortOID }}</code>
 +            <small>{{ .AuthorName }} committed <time datetime="{{ .AuthorWhen.Format "2006-01-02T15:04:05Z" }}">{{ relativeTime .AuthorWhen }}</time></small>
 +          </div>
 +        </li>
 +        {{ end }}
 +      </ul>
 +    </section>
 +    {{ end }}
++
 +    {{ if .DiffHTML }}
 +    <section class="shithub-diff-body" aria-label="Diff">
 +      {{ safeHTML .DiffHTML }}
 +    </section>
 +    {{ end }}
 +    {{ end }}
 +  </div>
  </section>
  {{- end }}

internal/web/templates/repo/pulls_list.htmlmodified

8 lines changed — click to load

    <header class="shithub-issues-head">
      <h1>Pull requests</h1>
      <div class="shithub-issues-actions">
 -      <a href="/{{ .Owner }}/{{ .Repo.Name }}/compare/{{ .Repo.DefaultBranch }}...{{ .Repo.DefaultBranch }}" class="shithub-button shithub-button-primary">New pull request</a>
 +      <a href="/{{ .Owner }}/{{ .Repo.Name }}/compare" class="shithub-button shithub-button-primary">New pull request</a>
      </div>
    </header>

internal/web/templates/repo/tree.htmlmodified

44 lines changed — click to load

            </div>
          </header>
 +        {{ if .BranchCompare.Show }}
 +        {{ if and .BranchCompare.HasRecentPush .HeadFound }}
 +        <div class="shithub-branch-push-banner">
 +          <div>
 +            {{ octicon "git-pull-request" }}
 +            <strong>{{ .BranchCompare.Head }}</strong> had recent pushes <time datetime="{{ .Head.AuthorWhen.Format "2006-01-02T15:04:05Z" }}">{{ relativeTime .Head.AuthorWhen }}</time>
 +          </div>
 +          <a href="{{ .BranchCompare.PullNewHref }}" class="shithub-button shithub-button-primary">Compare &amp; pull request</a>
 +        </div>
 +        {{ end }}
 +        <div class="shithub-branch-compare-bar">
 +          <div>
 +            This branch is
 +            <a href="{{ .BranchCompare.CompareHref }}">{{ .BranchCompare.Ahead }} {{ pluralize .BranchCompare.Ahead "commit" "commits" }} ahead</a>
 +            of and
 +            <a href="{{ .BranchCompare.CompareHref }}">{{ .BranchCompare.Behind }} {{ pluralize .BranchCompare.Behind "commit" "commits" }} behind</a>
 +            <code>{{ .BranchCompare.Base }}</code>.
 +          </div>
 +          <details class="shithub-contribute-menu">
 +            <summary class="shithub-button">{{ octicon "git-pull-request" }} Contribute {{ octicon "triangle-down" }}</summary>
 +            <div class="shithub-contribute-menu-panel">
 +              <div>
 +                <strong>This branch is {{ .BranchCompare.Ahead }} {{ pluralize .BranchCompare.Ahead "commit" "commits" }} ahead of <code>{{ .BranchCompare.Base }}</code>.</strong>
 +                <p>Open a pull request to contribute your changes upstream.</p>
 +              </div>
 +              <div class="shithub-contribute-actions">
 +                <a href="{{ .BranchCompare.CompareHref }}" class="shithub-button">Compare</a>
 +                {{ if gt .BranchCompare.Ahead 0 }}
 +                <a href="{{ .BranchCompare.PullNewHref }}" class="shithub-button shithub-button-primary">Open pull request</a>
 +                {{ else }}
 +                <button type="button" class="shithub-button shithub-button-primary" disabled>Open pull request</button>
 +                {{ end }}
 +              </div>
 +            </div>
 +          </details>
 +        </div>
 +        {{ end }}
++
          {{ if .Path }}
          <nav class="shithub-code-crumbs" aria-label="Breadcrumb">
            {{ range $i, $c := .Crumbs }}

internal/webhook/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

internal/worker/sqlc/models.gomodified

268 lines changed — click to load

  	"github.com/jackc/pgx/v5/pgtype"
+ )
 +type BillingInvoiceStatus string
++
 +const (
 +	BillingInvoiceStatusDraft         BillingInvoiceStatus = "draft"
 +	BillingInvoiceStatusOpen          BillingInvoiceStatus = "open"
 +	BillingInvoiceStatusPaid          BillingInvoiceStatus = "paid"
 +	BillingInvoiceStatusVoid          BillingInvoiceStatus = "void"
 +	BillingInvoiceStatusUncollectible BillingInvoiceStatus = "uncollectible"
 +)
++
 +func (e *BillingInvoiceStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingInvoiceStatus(s)
 +	case string:
 +		*e = BillingInvoiceStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingInvoiceStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingInvoiceStatus struct {
 +	BillingInvoiceStatus BillingInvoiceStatus
 +	Valid                bool // Valid is true if BillingInvoiceStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingInvoiceStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingInvoiceStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingInvoiceStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingInvoiceStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingInvoiceStatus), nil
 +}
++
 +type BillingLockReason string
++
 +const (
 +	BillingLockReasonPastDue  BillingLockReason = "past_due"
 +	BillingLockReasonCanceled BillingLockReason = "canceled"
 +	BillingLockReasonUnpaid   BillingLockReason = "unpaid"
 +	BillingLockReasonManual   BillingLockReason = "manual"
 +)
++
 +func (e *BillingLockReason) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingLockReason(s)
 +	case string:
 +		*e = BillingLockReason(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingLockReason: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingLockReason struct {
 +	BillingLockReason BillingLockReason
 +	Valid             bool // Valid is true if BillingLockReason is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingLockReason) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingLockReason, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingLockReason.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingLockReason) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingLockReason), nil
 +}
++
 +type BillingProvider string
++
 +const (
 +	BillingProviderStripe BillingProvider = "stripe"
 +)
++
 +func (e *BillingProvider) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingProvider(s)
 +	case string:
 +		*e = BillingProvider(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingProvider: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingProvider struct {
 +	BillingProvider BillingProvider
 +	Valid           bool // Valid is true if BillingProvider is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingProvider) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingProvider, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingProvider.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingProvider) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingProvider), nil
 +}
++
 +type BillingSubscriptionStatus string
++
 +const (
 +	BillingSubscriptionStatusNone       BillingSubscriptionStatus = "none"
 +	BillingSubscriptionStatusIncomplete BillingSubscriptionStatus = "incomplete"
 +	BillingSubscriptionStatusTrialing   BillingSubscriptionStatus = "trialing"
 +	BillingSubscriptionStatusActive     BillingSubscriptionStatus = "active"
 +	BillingSubscriptionStatusPastDue    BillingSubscriptionStatus = "past_due"
 +	BillingSubscriptionStatusCanceled   BillingSubscriptionStatus = "canceled"
 +	BillingSubscriptionStatusUnpaid     BillingSubscriptionStatus = "unpaid"
 +	BillingSubscriptionStatusPaused     BillingSubscriptionStatus = "paused"
 +)
++
 +func (e *BillingSubscriptionStatus) Scan(src interface{}) error {
 +	switch s := src.(type) {
 +	case []byte:
 +		*e = BillingSubscriptionStatus(s)
 +	case string:
 +		*e = BillingSubscriptionStatus(s)
 +	default:
 +		return fmt.Errorf("unsupported scan type for BillingSubscriptionStatus: %T", src)
 +	}
 +	return nil
 +}
++
 +type NullBillingSubscriptionStatus struct {
 +	BillingSubscriptionStatus BillingSubscriptionStatus
 +	Valid                     bool // Valid is true if BillingSubscriptionStatus is not NULL
 +}
++
 +// Scan implements the Scanner interface.
 +func (ns *NullBillingSubscriptionStatus) Scan(value interface{}) error {
 +	if value == nil {
 +		ns.BillingSubscriptionStatus, ns.Valid = "", false
 +		return nil
 +	}
 +	ns.Valid = true
 +	return ns.BillingSubscriptionStatus.Scan(value)
 +}
++
 +// Value implements the driver Valuer interface.
 +func (ns NullBillingSubscriptionStatus) Value() (driver.Value, error) {
 +	if !ns.Valid {
 +		return nil, nil
 +	}
 +	return string(ns.BillingSubscriptionStatus), nil
 +}
++
  type CheckConclusion string
  const (
  	WindowStartedAt pgtype.Timestamptz
+ }
 +type BillingInvoice struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeInvoiceID      string
 +	StripeCustomerID     string
 +	StripeSubscriptionID pgtype.Text
 +	Status               BillingInvoiceStatus
 +	Number               string
 +	Currency             string
 +	AmountDueCents       int64
 +	AmountPaidCents      int64
 +	AmountRemainingCents int64
 +	HostedInvoiceUrl     string
 +	InvoicePdfUrl        string
 +	PeriodStart          pgtype.Timestamptz
 +	PeriodEnd            pgtype.Timestamptz
 +	DueAt                pgtype.Timestamptz
 +	PaidAt               pgtype.Timestamptz
 +	VoidedAt             pgtype.Timestamptz
 +	CreatedAt            pgtype.Timestamptz
 +	UpdatedAt            pgtype.Timestamptz
 +}
++
 +type BillingSeatSnapshot struct {
 +	ID                   int64
 +	OrgID                int64
 +	Provider             BillingProvider
 +	StripeSubscriptionID pgtype.Text
 +	ActiveMembers        int32
 +	BillableSeats        int32
 +	Source               string
 +	CapturedAt           pgtype.Timestamptz
 +}
++
 +type BillingWebhookEvent struct {
 +	ID                 int64
 +	Provider           BillingProvider
 +	ProviderEventID    string
 +	EventType          string
 +	ApiVersion         string
 +	Payload            []byte
 +	ReceivedAt         pgtype.Timestamptz
 +	ProcessedAt        pgtype.Timestamptz
 +	ProcessError       string
 +	ProcessingAttempts int32
 +}
++
  type BranchProtectionRule struct {
  	ID                             int64
  	RepoID                         int64
  	UpdatedAt             pgtype.Timestamptz
+ }
 +type OrgBillingState struct {
 +	OrgID                    int64
 +	Provider                 BillingProvider
 +	StripeCustomerID         pgtype.Text
 +	StripeSubscriptionID     pgtype.Text
 +	StripeSubscriptionItemID pgtype.Text
 +	Plan                     OrgPlan
 +	SubscriptionStatus       BillingSubscriptionStatus
 +	BillableSeats            int32
 +	SeatSnapshotAt           pgtype.Timestamptz
 +	CurrentPeriodStart       pgtype.Timestamptz
 +	CurrentPeriodEnd         pgtype.Timestamptz
 +	CancelAtPeriodEnd        bool
 +	TrialEnd                 pgtype.Timestamptz
 +	PastDueAt                pgtype.Timestamptz
 +	CanceledAt               pgtype.Timestamptz
 +	LockedAt                 pgtype.Timestamptz
 +	LockReason               NullBillingLockReason
 +	GraceUntil               pgtype.Timestamptz
 +	LastWebhookEventID       string
 +	CreatedAt                pgtype.Timestamptz
 +	UpdatedAt                pgtype.Timestamptz
 +}
++
  type OrgGithubImport struct {
  	ID                int64
  	OrgID             int64

scripts/lint-org-plan-boundary.shadded

41 lines changed — click to load

 +#!/usr/bin/env bash
 +# SPDX-License-Identifier: AGPL-3.0-or-later
 +#
 +# Fail when paid-organization feature decisions branch directly on
 +# orgs.plan outside the billing/entitlement boundary. Plan storage is
 +# allowed in schema/sqlc plumbing, but handlers and domain packages
 +# should ask the entitlement layer whether a feature is available.
 +#
 +# Allowed locations:
 +#   internal/billing/...          — owns subscription state
 +#   internal/entitlements/...     — owns feature availability
 +#   internal/*/sqlc/...           — generated data models
 +#   internal/migrationsfs/...     — schema definitions
 +#   *_test.go everywhere          — tests may seed or assert plan values
 +#
 +# Run from `make ci`.
++
 +set -euo pipefail
++
 +cd "$(git rev-parse --show-toplevel)"
++
 +PATTERN='OrgPlan(Free|Team|Enterprise)|\.Plan[[:space:]]*(==|!=)|orgs\.plan|plan[[:space:]]+org_plan'
++
 +matches=$(git grep -nE "$PATTERN" -- \
 +  'cmd' 'internal' \
 +  ':!internal/billing/*' \
 +  ':!internal/entitlements/*' \
 +  ':!internal/*/sqlc/*' \
 +  ':!internal/migrationsfs/*' \
 +  ':!**/*_test.go' \
 +  2>/dev/null || true)
++
 +if [[ -n "$matches" ]]; then
 +  echo "lint-org-plan-boundary: direct org plan feature gate outside billing/entitlements:" >&2
 +  echo "$matches" | sed 's/^/  /' >&2
 +  echo "" >&2
 +  echo "Fix: add or use an entitlement feature check instead of branching on orgs.plan directly." >&2
 +  exit 1
 +fi
++
 +echo "lint-org-plan-boundary: ok"

sqlc.yamlmodified

19 lines changed — click to load

          emit_exact_table_names: false
          emit_empty_slices: true
          emit_methods_with_db_argument: true
++
 +  - engine: postgresql
 +    schema: internal/migrationsfs/migrations
 +    queries: internal/billing/queries
 +    gen:
 +      go:
 +        package: billingdb
 +        out: internal/billing/sqlc
 +        sql_package: pgx/v5
 +        emit_json_tags: false
 +        emit_pointers_for_null_types: false
 +        emit_prepared_queries: false
 +        emit_interface: true
 +        emit_exact_table_names: false
 +        emit_empty_slices: true
 +        emit_methods_with_db_argument: true

Diff truncated: 104 files; expand each to load its hunks.

  - public org-scoped activity for followed orgs.
  Anonymous Explore uses the global public feed. Both feeds page with a
 -keyset cursor over `(created_at, id)`.
 +keyset cursor over `(created_at, id)`. Full-page requests with a
 +`before` cursor still render that cursor window for no-JavaScript
 +fallbacks; HTMX requests return only the next feed rows plus a replacement
 +`More` control, so the browser appends activity in place like GitHub's
 +dashboard feed.
  ## Event Kinds

 +# Actions
++
 +shithub Actions runs CI workflows from `.shithub/workflows/*.yml`.
 +The workflow format intentionally follows the parts of GitHub Actions that are
 +useful for ordinary repository CI, while keeping the runner surface small enough
 +to secure.
++
 +## Minimal workflow
++
 +```yaml
 +name: smoke
 +on: [push, workflow_dispatch]
 +jobs:
 +  hello:
 +    runs-on: ubuntu-latest
 +    env:
 +      RUN_ID: ${{ shithub.run_id }}
 +    steps:
 +      - run: echo "hello from shithub actions"
 +      - run: test -n "$RUN_ID"
 +```
++
 +Commit that file as `.shithub/workflows/smoke.yml` and push to the repository.
 +The run appears under the repository's Actions tab and its job also appears as
 +a check run on matching pull requests.
++
 +## What works today
++
 +- `push`, `pull_request`, `schedule`, and `workflow_dispatch` triggers
 +- `run:` steps executed in the operator-configured runner image
 +- `runs-on:` label matching against registered runners
 +- workflow, job, and step `env:`
 +- `${{ secrets.NAME }}`, `${{ vars.NAME }}`, `${{ env.NAME }}`, and
 +  `${{ shithub.* }}` expressions
 +- `needs:`, `if:`, `timeout-minutes:`, and concurrency groups
 +- live step logs, cancel, re-run, check-run sync, and the Actions Atom feed
++
 +`runs-on: ubuntu-latest` is a runner label, not a promise that shithub downloads
 +a hosted Ubuntu image for you. The site operator decides which image a matching
 +runner uses. On shithub.sh, use the labels published by the instance operator.
++
 +## Current limit
++
 +Use `run:` steps for now. The parser accepts these reserved aliases:
++
 +- `actions/checkout@v4`
 +- `shithub/upload-artifact@v1`
 +- `shithub/download-artifact@v1`
++
 +The runner does not execute them yet. A workflow containing those `uses:` steps
 +will fail until checkout and artifact execution land. If you need repository
 +files in a smoke workflow today, keep the command self-contained or fetch what
 +you need explicitly inside a `run:` step.
++
 +## Expressions
++
 +Use the shithub namespace:
++
 +```yaml
 +env:
 +  REF: ${{ shithub.ref }}
 +  SHA: ${{ shithub.sha }}
 +  RUN_ID: ${{ shithub.run_id }}
 +```
++
 +The `github.*` namespace is accepted as a compatibility alias for the fields
 +shithub exposes, but new workflows should use `shithub.*`.
++
 +Event payload values such as `${{ shithub.event.pull_request.title }}` are
 +treated as untrusted. The runner passes them through temporary environment
 +bindings instead of splicing them directly into shell command text.
++
 +## Secrets and variables
++
 +Repository and organization settings expose Actions secrets and variables.
 +Secrets are encrypted at rest and are redacted from logs. Variables are
 +plaintext configuration and are suitable for non-secret values such as tool
 +versions or feature flags.
++
 +Repo-scoped values shadow organization-scoped values with the same name.
++
 +## Migrating from GitHub Actions
++
 +Most simple CI files need three edits:
++
 +1. Move the workflow file from `.github/workflows/` to `.shithub/workflows/`.
 +2. Replace `uses:` actions with equivalent `run:` commands.
 +3. Confirm `runs-on:` matches a label registered by your shithub operator.
++
 +Marketplace actions, Docker actions, composite actions, hosted runner images,
 +matrix expansion, service containers, and built-in checkout are not part of the
 +current v1 runner.

`@@ -12,6 +12,9 @@` func TestChannelAndListenSQL(t *testing.T) {
12	12	if got := ListenSQL(42); got != `LISTEN "step_log_42"` {
13	13	t.Fatalf("ListenSQL=%q", got)
14	14	}
	15	+ if got := UnlistenSQL(42); got != `UNLISTEN "step_log_42"` {
	16	+ t.Fatalf("UnlistenSQL=%q", got)
	17	+ }
15	18	}
16	19
17	20	func TestParsePayload(t *testing.T) {

`@@ -640,8 +640,14 @@` func TestProfile_ContributionActivityIncludesCommitsReposIssuesAndPulls(t *testi
640	640	t.Errorf("missing %q in body: %s", want, body)
641	641	}
642	642	}
643		- if strings.Contains(body, strconv.FormatInt(oldRepoID, 10)) {
644		- t.Fatalf("test template leaked implementation ids unexpectedly: %s", body)
	643	+ for _, leak := range []string{
	644	+ fmt.Sprintf("repo_id=%d", oldRepoID),
	645	+ fmt.Sprintf(`data-repo-id="%d"`, oldRepoID),
	646	+ fmt.Sprintf("RepoID:%d", oldRepoID),
	647	+ } {
	648	+ if strings.Contains(body, leak) {
	649	+ t.Fatalf("test template leaked implementation id marker %q unexpectedly: %s", leak, body)
	650	+ }
645	651	}
646	652	}
647	653