0e6522c Merge c06416608f94ed9c0eb6c312204173b5bac6d8d3 into 00396122d39c11f2d7ecd211a94f823937ff76c0 · ermite

M docs/cli.md +2 -1


@@ -55,7 +55,8 @@ ermite token create <label> [--preset cli\|agent\|ci\|runner] [--scope …] [--repo
55	55		ermite token list \| revoke <id>
56	56
57	57		ermite mr create <repo> --source <branch> --title … \| list <repo> \| show <repo> <n> [--diff]
58		-	ermite mr comment <repo> <n> -m … [--path … --line … --side old\|new] \| resolve <repo> <n> <comment>
	58	+	ermite mr comment <repo> <n> -m … [--path … --line N\|A-B --side old\|new] [--reply <id>] [--approve\|--request-changes]
	59	+	ermite mr resolve <repo> <n> <comment> \| edit-comment <repo> <n> <comment> -m … \| delete-comment <repo> <n> <comment>
59	60		ermite mr merge <repo> <n> --head <id> [--squash] [--delete-branch] \| close <repo> <n>
60	61
61	62		ermite run list <repo> [--workflow …] [--branch …] [--status …]


@@ -55,7 +55,8 @@ ermite token create <label> [--preset cli\|agent\|ci\|runner] [--scope …] [--repo
55		ermite token list \| revoke <id>	55		ermite token list \| revoke <id>
56			56
57		ermite mr create <repo> --source <branch> --title … \| list <repo> \| show <repo> <n> [--diff]	57		ermite mr create <repo> --source <branch> --title … \| list <repo> \| show <repo> <n> [--diff]
58	-	ermite mr comment <repo> <n> -m … [--path … --line … --side old\|new] \| resolve <repo> <n> <comment>	58	+	ermite mr comment <repo> <n> -m … [--path … --line N\|A-B --side old\|new] [--reply <id>] [--approve\|--request-changes]
			59	+	ermite mr resolve <repo> <n> <comment> \| edit-comment <repo> <n> <comment> -m … \| delete-comment <repo> <n> <comment>
59		ermite mr merge <repo> <n> --head <id> [--squash] [--delete-branch] \| close <repo> <n>	60		ermite mr merge <repo> <n> --head <id> [--squash] [--delete-branch] \| close <repo> <n>
60			61
61		ermite run list <repo> [--workflow …] [--branch …] [--status …]	62		ermite run list <repo> [--workflow …] [--branch …] [--status …]

M docs/merge-requests.md +30 -1


@@ -13,10 +13,39 @@ ermite mr merge myrepo 1 --head <commit> [--squash] [--delete-branch]
13	13		- With `failing_checks_block` on (default), the merge is refused while a check of the head failed or is still running.
14	14		- `--delete-branch` deletes the source branch, unless it is the default branch or another open request uses it.
15	15		- `ermite repo edit --merge-modes` limits the modes per repository.
16		-	- Scopes: `mr:write` to open and comment, `mr:merge` to merge.
	16	+	- Scopes: `mr:write` to open and comment, `mr:review` to give a verdict, `mr:merge` to merge.
17	17
18	18		Verify squash commits with the `allowed_signers` line from `ermite signing-key show`:
19	19
20	20		```sh
21	21		git verify-commit <commit>
22	22		```
	23	+
	24	+	## Notes
	25	+
	26	+	A note is the only review object. It is published as soon as it is written: there is no draft and no submit step.
	27	+
	28	+	```sh
	29	+	ermite mr comment myrepo 1 -m "General remark"
	30	+	ermite mr comment myrepo 1 -m "Why?" --path main.go --line 10-14 --side new
	31	+	ermite mr comment myrepo 1 -m "Fixed in ^3" --reply 2
	32	+	ermite mr resolve myrepo 1 2
	33	+	ermite mr edit-comment myrepo 1 2 -m "New text"
	34	+	ermite mr delete-comment myrepo 1 2
	35	+	```
	36	+
	37	+	- Notes are Markdown, up to 8000 characters, rendered without raw HTML. Quote with `> `.
	38	+	- `^N` in a note or a description links to note N of the same merge request. A reference to a missing note stays plain text.
	39	+	- A note is general, on one line, or on a range `A-B` of lines on one side (`old` or `new`) of the diff. The lines must be in the diff.
	40	+	- Threads have one level: a reply (`--reply <id>`) takes the anchor of its root and cannot carry a verdict. Resolving or reopening is done on the root and covers its replies.
	41	+	- Only the author edits or deletes a note. An edited note shows "edited". A deleted note loses its text; a deleted root with replies stays as "deleted note".
	42	+
	43	+	## Verdicts
	44	+
	45	+	A root note can carry a verdict: `--approve` or `--request-changes`. The text may then be empty. A verdict needs the `mr:review` scope (or the owner); `mr:write` comments but cannot give one.
	46	+
	47	+	- A verdict ends a review: agents and `ermite watch` act on it, not on each note.
	48	+	- Verdicts are informative: none blocks or allows a merge.
	49	+	- `mr show` lists the latest verdict of each author (`verdicts` in `--json`).
	50	+	- An approval is stale once the branch head differs from the head it was given on. Changes requested stay current until their author gives a new verdict, whatever is pushed.
	51	+	- Verdicts are immutable: editing or deleting the note keeps its verdict. Only a new verdict of the same author replaces it.


@@ -13,10 +13,39 @@ ermite mr merge myrepo 1 --head <commit> [--squash] [--delete-branch]
13		- With `failing_checks_block` on (default), the merge is refused while a check of the head failed or is still running.	13		- With `failing_checks_block` on (default), the merge is refused while a check of the head failed or is still running.
14		- `--delete-branch` deletes the source branch, unless it is the default branch or another open request uses it.	14		- `--delete-branch` deletes the source branch, unless it is the default branch or another open request uses it.
15		- `ermite repo edit --merge-modes` limits the modes per repository.	15		- `ermite repo edit --merge-modes` limits the modes per repository.
16	-	- Scopes: `mr:write` to open and comment, `mr:merge` to merge.	16	+	- Scopes: `mr:write` to open and comment, `mr:review` to give a verdict, `mr:merge` to merge.
17			17
18		Verify squash commits with the `allowed_signers` line from `ermite signing-key show`:	18		Verify squash commits with the `allowed_signers` line from `ermite signing-key show`:
19			19
20		```sh	20		```sh
21		git verify-commit <commit>	21		git verify-commit <commit>
22		```	22		```
			23	+
			24	+	## Notes
			25	+
			26	+	A note is the only review object. It is published as soon as it is written: there is no draft and no submit step.
			27	+
			28	+	```sh
			29	+	ermite mr comment myrepo 1 -m "General remark"
			30	+	ermite mr comment myrepo 1 -m "Why?" --path main.go --line 10-14 --side new
			31	+	ermite mr comment myrepo 1 -m "Fixed in ^3" --reply 2
			32	+	ermite mr resolve myrepo 1 2
			33	+	ermite mr edit-comment myrepo 1 2 -m "New text"
			34	+	ermite mr delete-comment myrepo 1 2
			35	+	```
			36	+
			37	+	- Notes are Markdown, up to 8000 characters, rendered without raw HTML. Quote with `> `.
			38	+	- `^N` in a note or a description links to note N of the same merge request. A reference to a missing note stays plain text.
			39	+	- A note is general, on one line, or on a range `A-B` of lines on one side (`old` or `new`) of the diff. The lines must be in the diff.
			40	+	- Threads have one level: a reply (`--reply <id>`) takes the anchor of its root and cannot carry a verdict. Resolving or reopening is done on the root and covers its replies.
			41	+	- Only the author edits or deletes a note. An edited note shows "edited". A deleted note loses its text; a deleted root with replies stays as "deleted note".
			42	+
			43	+	## Verdicts
			44	+
			45	+	A root note can carry a verdict: `--approve` or `--request-changes`. The text may then be empty. A verdict needs the `mr:review` scope (or the owner); `mr:write` comments but cannot give one.
			46	+
			47	+	- A verdict ends a review: agents and `ermite watch` act on it, not on each note.
			48	+	- Verdicts are informative: none blocks or allows a merge.
			49	+	- `mr show` lists the latest verdict of each author (`verdicts` in `--json`).
			50	+	- An approval is stale once the branch head differs from the head it was given on. Changes requested stay current until their author gives a new verdict, whatever is pushed.
			51	+	- Verdicts are immutable: editing or deleting the note keeps its verdict. Only a new verdict of the same author replaces it.

M docs/tokens.md +2 -2


@@ -6,7 +6,7 @@ ermite token list
6	6		ermite token revoke <id>
7	7		```
8	8
9		-	The secret is printed once. Presets and `--scope` add up. The full scope list is in [`skills/ermite/CLI.md`](../skills/ermite/CLI.md).
	9	+	The secret is printed once. Presets and `--scope` add up. The full scope list is in [`skills/ermite/CLI.md`](../skills/ermite/CLI.md). `mr:review` lets a token give a merge request verdict (`--approve`, `--request-changes`); the `cli` preset includes it, the `agent` preset does not. A token created before `mr:review` existed lacks it: recreate it with `--preset cli` using the root token or from a signed-in owner web session (an old token lacking `mr:review` cannot grant it), then replace the stored CLI secret and revoke the old token to keep the owner's rights.
10	10
11	11		\| Preset \| For \|
12	12		\|---\|---\|

@@ -28,7 +28,7 @@ ermite token create claude --preset agent --scope repo:read --repo myrepo --bran
28	28		The token can:
29	29
30	30		- push, force-push and delete branches under its prefixes;
31		-	- open, comment on and close merge requests;
	31	+	- open, comment on and close merge requests; with `mr:review`, give verdicts;
32	32		- with `mr:merge`, merge into a branch under its prefixes;
33	33		- read CI runs, logs and checks; with `ci:write`, cancel and re-run runs of its own branches;
34	34		- create tokens whose prefixes lie within its own.


@@ -6,7 +6,7 @@ ermite token list
6		ermite token revoke <id>	6		ermite token revoke <id>
7		```	7		```
8			8
9	-	The secret is printed once. Presets and `--scope` add up. The full scope list is in [`skills/ermite/CLI.md`](../skills/ermite/CLI.md).	9	+	The secret is printed once. Presets and `--scope` add up. The full scope list is in [`skills/ermite/CLI.md`](../skills/ermite/CLI.md). `mr:review` lets a token give a merge request verdict (`--approve`, `--request-changes`); the `cli` preset includes it, the `agent` preset does not. A token created before `mr:review` existed lacks it: recreate it with `--preset cli` using the root token or from a signed-in owner web session (an old token lacking `mr:review` cannot grant it), then replace the stored CLI secret and revoke the old token to keep the owner's rights.
10			10
11		\| Preset \| For \|	11		\| Preset \| For \|
12		\|---\|---\|	12		\|---\|---\|

@@ -28,7 +28,7 @@ ermite token create claude --preset agent --scope repo:read --repo myrepo --bran
28		The token can:	28		The token can:
29			29
30		- push, force-push and delete branches under its prefixes;	30		- push, force-push and delete branches under its prefixes;
31	-	- open, comment on and close merge requests;	31	+	- open, comment on and close merge requests; with `mr:review`, give verdicts;
32		- with `mr:merge`, merge into a branch under its prefixes;	32		- with `mr:merge`, merge into a branch under its prefixes;
33		- read CI runs, logs and checks; with `ci:write`, cancel and re-run runs of its own branches;	33		- read CI runs, logs and checks; with `ci:write`, cancel and re-run runs of its own branches;
34		- create tokens whose prefixes lie within its own.	34		- create tokens whose prefixes lie within its own.

M gen/ermite/storage/merge_request.pb.go +122 -18


@@ -180,6 +180,56 @@ func (DiffSide) EnumDescriptor() ([]byte, []int) {
180	180		return file_ermite_storage_merge_request_proto_rawDescGZIP(), []int{2}
181	181		}
182	182
	183	+	// Verdict is the immutable review decision of a note.
	184	+	type Verdict int32
	185	+
	186	+	const (
	187	+	Verdict_VERDICT_UNSPECIFIED Verdict = 0
	188	+	Verdict_VERDICT_APPROVE Verdict = 1
	189	+	Verdict_VERDICT_CHANGES_REQUESTED Verdict = 2
	190	+	)
	191	+
	192	+	// Enum value maps for Verdict.
	193	+	var (
	194	+	Verdict_name = map[int32]string{
	195	+	0: "VERDICT_UNSPECIFIED",
	196	+	1: "VERDICT_APPROVE",
	197	+	2: "VERDICT_CHANGES_REQUESTED",
	198	+	}
	199	+	Verdict_value = map[string]int32{
	200	+	"VERDICT_UNSPECIFIED": 0,
	201	+	"VERDICT_APPROVE": 1,
	202	+	"VERDICT_CHANGES_REQUESTED": 2,
	203	+	}
	204	+	)
	205	+
	206	+	func (x Verdict) Enum() *Verdict {
	207	+	p := new(Verdict)
	208	+	*p = x
	209	+	return p
	210	+	}
	211	+
	212	+	func (x Verdict) String() string {
	213	+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
	214	+	}
	215	+
	216	+	func (Verdict) Descriptor() protoreflect.EnumDescriptor {
	217	+	return file_ermite_storage_merge_request_proto_enumTypes[3].Descriptor()
	218	+	}
	219	+
	220	+	func (Verdict) Type() protoreflect.EnumType {
	221	+	return &file_ermite_storage_merge_request_proto_enumTypes[3]
	222	+	}
	223	+
	224	+	func (x Verdict) Number() protoreflect.EnumNumber {
	225	+	return protoreflect.EnumNumber(x)
	226	+	}
	227	+
	228	+	// Deprecated: Use Verdict.Descriptor instead.
	229	+	func (Verdict) EnumDescriptor() ([]byte, []int) {
	230	+	return file_ermite_storage_merge_request_proto_rawDescGZIP(), []int{3}
	231	+	}
	232	+
183	233		// RepoSettings are the merge settings of a repository, stored inside Repo.
184	234		type RepoSettings struct {
185	235		state protoimpl.MessageState `protogen:"open.v1"`

@@ -401,6 +451,11 @@ type Comment struct {
401	451		Text string `protobuf:"bytes,7,opt,name=text,proto3" json:"text,omitempty"`
402	452		Resolved bool `protobuf:"varint,8,opt,name=resolved,proto3" json:"resolved,omitempty"`
403	453		CreatedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	454	+	ReplyTo int64 `protobuf:"varint,10,opt,name=reply_to,json=replyTo,proto3" json:"reply_to,omitempty"`
	455	+	StartLine int32 `protobuf:"varint,11,opt,name=start_line,json=startLine,proto3" json:"start_line,omitempty"`
	456	+	Verdict Verdict `protobuf:"varint,12,opt,name=verdict,proto3,enum=ermite.storage.Verdict" json:"verdict,omitempty"`
	457	+	EditedAt *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=edited_at,json=editedAt,proto3" json:"edited_at,omitempty"`
	458	+	Deleted bool `protobuf:"varint,14,opt,name=deleted,proto3" json:"deleted,omitempty"`
404	459		unknownFields protoimpl.UnknownFields
405	460		sizeCache protoimpl.SizeCache
406	461		}

@@ -498,6 +553,41 @@ func (x Comment) GetCreatedAt() timestamppb.Timestamp {
498	553		return nil
499	554		}
500	555
	556	+	func (x *Comment) GetReplyTo() int64 {
	557	+	if x != nil {
	558	+	return x.ReplyTo
	559	+	}
	560	+	return 0
	561	+	}
	562	+
	563	+	func (x *Comment) GetStartLine() int32 {
	564	+	if x != nil {
	565	+	return x.StartLine
	566	+	}
	567	+	return 0
	568	+	}
	569	+
	570	+	func (x *Comment) GetVerdict() Verdict {
	571	+	if x != nil {
	572	+	return x.Verdict
	573	+	}
	574	+	return Verdict_VERDICT_UNSPECIFIED
	575	+	}
	576	+
	577	+	func (x Comment) GetEditedAt() timestamppb.Timestamp {
	578	+	if x != nil {
	579	+	return x.EditedAt
	580	+	}
	581	+	return nil
	582	+	}
	583	+
	584	+	func (x *Comment) GetDeleted() bool {
	585	+	if x != nil {
	586	+	return x.Deleted
	587	+	}
	588	+	return false
	589	+	}
	590	+
501	591		// Sequence is stored under the key "mrseq/<repo>": the last merge request
502	592		// number handed out for the repository.
503	593		type Sequence struct {

@@ -571,7 +661,7 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
571	661		"\n" +
572	662		"merge_mode\x18\r \x01(\x0e2\x19.ermite.storage.MergeModeR\tmergeMode\x12\x1f\n" +
573	663		"\vcomment_seq\x18\x0e \x01(\x03R\n" +
574		-	"commentSeq\"\x8f\x02\n" +
	664	+	"commentSeq\"\xcf\x03\n" +
575	665		"\aComment\x12\x0e\n" +
576	666		"\x02id\x18\x01 \x01(\x03R\x02id\x12\x16\n" +
577	667		"\x06author\x18\x02 \x01(\tR\x06author\x12\x12\n" +

@@ -582,7 +672,14 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
582	672		"\x04text\x18\a \x01(\tR\x04text\x12\x1a\n" +
583	673		"\bresolved\x18\b \x01(\bR\bresolved\x129\n" +
584	674		"\n" +
585		-	"created_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\"\x1e\n" +
	675	+	"created_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x19\n" +
	676	+	"\breply_to\x18\n" +
	677	+	" \x01(\x03R\areplyTo\x12\x1d\n" +
	678	+	"\n" +
	679	+	"start_line\x18\v \x01(\x05R\tstartLine\x121\n" +
	680	+	"\averdict\x18\f \x01(\x0e2\x17.ermite.storage.VerdictR\averdict\x127\n" +
	681	+	"\tedited_at\x18\r \x01(\v2\x1a.google.protobuf.TimestampR\beditedAt\x12\x18\n" +
	682	+	"\adeleted\x18\x0e \x01(\bR\adeleted\"\x1e\n" +
586	683		"\bSequence\x12\x12\n" +
587	684		"\x04last\x18\x01 \x01(\x03R\x04last*[\n" +
588	685		"\tMergeMode\x12\x1a\n" +

@@ -597,7 +694,11 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
597	694		"\bDiffSide\x12\x19\n" +
598	695		"\x15DIFF_SIDE_UNSPECIFIED\x10\x00\x12\x11\n" +
599	696		"\rDIFF_SIDE_OLD\x10\x01\x12\x11\n" +
600		-	"\rDIFF_SIDE_NEW\x10\x02B/Z-bnema.dev/ermite/gen/ermite/storage;storagepbb\x06proto3"
	697	+	"\rDIFF_SIDE_NEW\x10\x02*V\n" +
	698	+	"\aVerdict\x12\x17\n" +
	699	+	"\x13VERDICT_UNSPECIFIED\x10\x00\x12\x13\n" +
	700	+	"\x0fVERDICT_APPROVE\x10\x01\x12\x1d\n" +
	701	+	"\x19VERDICT_CHANGES_REQUESTED\x10\x02B/Z-bnema.dev/ermite/gen/ermite/storage;storagepbb\x06proto3"
601	702
602	703		var (
603	704		file_ermite_storage_merge_request_proto_rawDescOnce sync.Once

@@ -611,31 +712,34 @@ func file_ermite_storage_merge_request_proto_rawDescGZIP() []byte {
611	712		return file_ermite_storage_merge_request_proto_rawDescData
612	713		}
613	714
614		-	var file_ermite_storage_merge_request_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
	715	+	var file_ermite_storage_merge_request_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
615	716		var file_ermite_storage_merge_request_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
616	717		var file_ermite_storage_merge_request_proto_goTypes = []any{
617	718		(MergeMode)(0), // 0: ermite.storage.MergeMode
618	719		(MergeRequestState)(0), // 1: ermite.storage.MergeRequestState
619	720		(DiffSide)(0), // 2: ermite.storage.DiffSide
620		-	(*RepoSettings)(nil), // 3: ermite.storage.RepoSettings
621		-	(*MergeRequest)(nil), // 4: ermite.storage.MergeRequest
622		-	(*Comment)(nil), // 5: ermite.storage.Comment
623		-	(*Sequence)(nil), // 6: ermite.storage.Sequence
624		-	(*timestamppb.Timestamp)(nil), // 7: google.protobuf.Timestamp
	721	+	(Verdict)(0), // 3: ermite.storage.Verdict
	722	+	(*RepoSettings)(nil), // 4: ermite.storage.RepoSettings
	723	+	(*MergeRequest)(nil), // 5: ermite.storage.MergeRequest
	724	+	(*Comment)(nil), // 6: ermite.storage.Comment
	725	+	(*Sequence)(nil), // 7: ermite.storage.Sequence
	726	+	(*timestamppb.Timestamp)(nil), // 8: google.protobuf.Timestamp
625	727		}
626	728		var file_ermite_storage_merge_request_proto_depIdxs = []int32{
627	729		0, // 0: ermite.storage.RepoSettings.allowed_merge_modes:type_name -> ermite.storage.MergeMode
628	730		1, // 1: ermite.storage.MergeRequest.state:type_name -> ermite.storage.MergeRequestState
629		-	7, // 2: ermite.storage.MergeRequest.created_at:type_name -> google.protobuf.Timestamp
630		-	7, // 3: ermite.storage.MergeRequest.updated_at:type_name -> google.protobuf.Timestamp
	731	+	8, // 2: ermite.storage.MergeRequest.created_at:type_name -> google.protobuf.Timestamp
	732	+	8, // 3: ermite.storage.MergeRequest.updated_at:type_name -> google.protobuf.Timestamp
631	733		0, // 4: ermite.storage.MergeRequest.merge_mode:type_name -> ermite.storage.MergeMode
632	734		2, // 5: ermite.storage.Comment.side:type_name -> ermite.storage.DiffSide
633		-	7, // 6: ermite.storage.Comment.created_at:type_name -> google.protobuf.Timestamp
634		-	7, // [7:7] is the sub-list for method output_type
635		-	7, // [7:7] is the sub-list for method input_type
636		-	7, // [7:7] is the sub-list for extension type_name
637		-	7, // [7:7] is the sub-list for extension extendee
638		-	0, // [0:7] is the sub-list for field type_name
	735	+	8, // 6: ermite.storage.Comment.created_at:type_name -> google.protobuf.Timestamp
	736	+	3, // 7: ermite.storage.Comment.verdict:type_name -> ermite.storage.Verdict
	737	+	8, // 8: ermite.storage.Comment.edited_at:type_name -> google.protobuf.Timestamp
	738	+	9, // [9:9] is the sub-list for method output_type
	739	+	9, // [9:9] is the sub-list for method input_type
	740	+	9, // [9:9] is the sub-list for extension type_name
	741	+	9, // [9:9] is the sub-list for extension extendee
	742	+	0, // [0:9] is the sub-list for field type_name
639	743		}
640	744
641	745		func init() { file_ermite_storage_merge_request_proto_init() }

@@ -648,7 +752,7 @@ func file_ermite_storage_merge_request_proto_init() {
648	752		File: protoimpl.DescBuilder{
649	753		GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
650	754		RawDescriptor: unsafe.Slice(unsafe.StringData(file_ermite_storage_merge_request_proto_rawDesc), len(file_ermite_storage_merge_request_proto_rawDesc)),
651		-	NumEnums: 3,
	755	+	NumEnums: 4,
652	756		NumMessages: 4,
653	757		NumExtensions: 0,
654	758		NumServices: 0,


@@ -180,6 +180,56 @@ func (DiffSide) EnumDescriptor() ([]byte, []int) {
180		return file_ermite_storage_merge_request_proto_rawDescGZIP(), []int{2}	180		return file_ermite_storage_merge_request_proto_rawDescGZIP(), []int{2}
181		}	181		}
182			182
			183	+	// Verdict is the immutable review decision of a note.
			184	+	type Verdict int32
			185	+
			186	+	const (
			187	+	Verdict_VERDICT_UNSPECIFIED Verdict = 0
			188	+	Verdict_VERDICT_APPROVE Verdict = 1
			189	+	Verdict_VERDICT_CHANGES_REQUESTED Verdict = 2
			190	+	)
			191	+
			192	+	// Enum value maps for Verdict.
			193	+	var (
			194	+	Verdict_name = map[int32]string{
			195	+	0: "VERDICT_UNSPECIFIED",
			196	+	1: "VERDICT_APPROVE",
			197	+	2: "VERDICT_CHANGES_REQUESTED",
			198	+	}
			199	+	Verdict_value = map[string]int32{
			200	+	"VERDICT_UNSPECIFIED": 0,
			201	+	"VERDICT_APPROVE": 1,
			202	+	"VERDICT_CHANGES_REQUESTED": 2,
			203	+	}
			204	+	)
			205	+
			206	+	func (x Verdict) Enum() *Verdict {
			207	+	p := new(Verdict)
			208	+	*p = x
			209	+	return p
			210	+	}
			211	+
			212	+	func (x Verdict) String() string {
			213	+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
			214	+	}
			215	+
			216	+	func (Verdict) Descriptor() protoreflect.EnumDescriptor {
			217	+	return file_ermite_storage_merge_request_proto_enumTypes[3].Descriptor()
			218	+	}
			219	+
			220	+	func (Verdict) Type() protoreflect.EnumType {
			221	+	return &file_ermite_storage_merge_request_proto_enumTypes[3]
			222	+	}
			223	+
			224	+	func (x Verdict) Number() protoreflect.EnumNumber {
			225	+	return protoreflect.EnumNumber(x)
			226	+	}
			227	+
			228	+	// Deprecated: Use Verdict.Descriptor instead.
			229	+	func (Verdict) EnumDescriptor() ([]byte, []int) {
			230	+	return file_ermite_storage_merge_request_proto_rawDescGZIP(), []int{3}
			231	+	}
			232	+
183		// RepoSettings are the merge settings of a repository, stored inside Repo.	233		// RepoSettings are the merge settings of a repository, stored inside Repo.
184		type RepoSettings struct {	234		type RepoSettings struct {
185		state protoimpl.MessageState `protogen:"open.v1"`	235		state protoimpl.MessageState `protogen:"open.v1"`

@@ -401,6 +451,11 @@ type Comment struct {
401		Text string `protobuf:"bytes,7,opt,name=text,proto3" json:"text,omitempty"`	451		Text string `protobuf:"bytes,7,opt,name=text,proto3" json:"text,omitempty"`
402		Resolved bool `protobuf:"varint,8,opt,name=resolved,proto3" json:"resolved,omitempty"`	452		Resolved bool `protobuf:"varint,8,opt,name=resolved,proto3" json:"resolved,omitempty"`
403		CreatedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`	453		CreatedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
			454	+	ReplyTo int64 `protobuf:"varint,10,opt,name=reply_to,json=replyTo,proto3" json:"reply_to,omitempty"`
			455	+	StartLine int32 `protobuf:"varint,11,opt,name=start_line,json=startLine,proto3" json:"start_line,omitempty"`
			456	+	Verdict Verdict `protobuf:"varint,12,opt,name=verdict,proto3,enum=ermite.storage.Verdict" json:"verdict,omitempty"`
			457	+	EditedAt *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=edited_at,json=editedAt,proto3" json:"edited_at,omitempty"`
			458	+	Deleted bool `protobuf:"varint,14,opt,name=deleted,proto3" json:"deleted,omitempty"`
404		unknownFields protoimpl.UnknownFields	459		unknownFields protoimpl.UnknownFields
405		sizeCache protoimpl.SizeCache	460		sizeCache protoimpl.SizeCache
406		}	461		}

@@ -498,6 +553,41 @@ func (x Comment) GetCreatedAt() timestamppb.Timestamp {
498		return nil	553		return nil
499		}	554		}
500			555
			556	+	func (x *Comment) GetReplyTo() int64 {
			557	+	if x != nil {
			558	+	return x.ReplyTo
			559	+	}
			560	+	return 0
			561	+	}
			562	+
			563	+	func (x *Comment) GetStartLine() int32 {
			564	+	if x != nil {
			565	+	return x.StartLine
			566	+	}
			567	+	return 0
			568	+	}
			569	+
			570	+	func (x *Comment) GetVerdict() Verdict {
			571	+	if x != nil {
			572	+	return x.Verdict
			573	+	}
			574	+	return Verdict_VERDICT_UNSPECIFIED
			575	+	}
			576	+
			577	+	func (x Comment) GetEditedAt() timestamppb.Timestamp {
			578	+	if x != nil {
			579	+	return x.EditedAt
			580	+	}
			581	+	return nil
			582	+	}
			583	+
			584	+	func (x *Comment) GetDeleted() bool {
			585	+	if x != nil {
			586	+	return x.Deleted
			587	+	}
			588	+	return false
			589	+	}
			590	+
501		// Sequence is stored under the key "mrseq/<repo>": the last merge request	591		// Sequence is stored under the key "mrseq/<repo>": the last merge request
502		// number handed out for the repository.	592		// number handed out for the repository.
503		type Sequence struct {	593		type Sequence struct {

@@ -571,7 +661,7 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
571		"\n" +	661		"\n" +
572		"merge_mode\x18\r \x01(\x0e2\x19.ermite.storage.MergeModeR\tmergeMode\x12\x1f\n" +	662		"merge_mode\x18\r \x01(\x0e2\x19.ermite.storage.MergeModeR\tmergeMode\x12\x1f\n" +
573		"\vcomment_seq\x18\x0e \x01(\x03R\n" +	663		"\vcomment_seq\x18\x0e \x01(\x03R\n" +
574	-	"commentSeq\"\x8f\x02\n" +	664	+	"commentSeq\"\xcf\x03\n" +
575		"\aComment\x12\x0e\n" +	665		"\aComment\x12\x0e\n" +
576		"\x02id\x18\x01 \x01(\x03R\x02id\x12\x16\n" +	666		"\x02id\x18\x01 \x01(\x03R\x02id\x12\x16\n" +
577		"\x06author\x18\x02 \x01(\tR\x06author\x12\x12\n" +	667		"\x06author\x18\x02 \x01(\tR\x06author\x12\x12\n" +

@@ -582,7 +672,14 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
582		"\x04text\x18\a \x01(\tR\x04text\x12\x1a\n" +	672		"\x04text\x18\a \x01(\tR\x04text\x12\x1a\n" +
583		"\bresolved\x18\b \x01(\bR\bresolved\x129\n" +	673		"\bresolved\x18\b \x01(\bR\bresolved\x129\n" +
584		"\n" +	674		"\n" +
585	-	"created_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\"\x1e\n" +	675	+	"created_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x12\x19\n" +
			676	+	"\breply_to\x18\n" +
			677	+	" \x01(\x03R\areplyTo\x12\x1d\n" +
			678	+	"\n" +
			679	+	"start_line\x18\v \x01(\x05R\tstartLine\x121\n" +
			680	+	"\averdict\x18\f \x01(\x0e2\x17.ermite.storage.VerdictR\averdict\x127\n" +
			681	+	"\tedited_at\x18\r \x01(\v2\x1a.google.protobuf.TimestampR\beditedAt\x12\x18\n" +
			682	+	"\adeleted\x18\x0e \x01(\bR\adeleted\"\x1e\n" +
586		"\bSequence\x12\x12\n" +	683		"\bSequence\x12\x12\n" +
587		"\x04last\x18\x01 \x01(\x03R\x04last*[\n" +	684		"\x04last\x18\x01 \x01(\x03R\x04last*[\n" +
588		"\tMergeMode\x12\x1a\n" +	685		"\tMergeMode\x12\x1a\n" +

@@ -597,7 +694,11 @@ const file_ermite_storage_merge_request_proto_rawDesc = "" +
597		"\bDiffSide\x12\x19\n" +	694		"\bDiffSide\x12\x19\n" +
598		"\x15DIFF_SIDE_UNSPECIFIED\x10\x00\x12\x11\n" +	695		"\x15DIFF_SIDE_UNSPECIFIED\x10\x00\x12\x11\n" +
599		"\rDIFF_SIDE_OLD\x10\x01\x12\x11\n" +	696		"\rDIFF_SIDE_OLD\x10\x01\x12\x11\n" +
600	-	"\rDIFF_SIDE_NEW\x10\x02B/Z-bnema.dev/ermite/gen/ermite/storage;storagepbb\x06proto3"	697	+	"\rDIFF_SIDE_NEW\x10\x02*V\n" +
			698	+	"\aVerdict\x12\x17\n" +
			699	+	"\x13VERDICT_UNSPECIFIED\x10\x00\x12\x13\n" +
			700	+	"\x0fVERDICT_APPROVE\x10\x01\x12\x1d\n" +
			701	+	"\x19VERDICT_CHANGES_REQUESTED\x10\x02B/Z-bnema.dev/ermite/gen/ermite/storage;storagepbb\x06proto3"
601			702
602		var (	703		var (
603		file_ermite_storage_merge_request_proto_rawDescOnce sync.Once	704		file_ermite_storage_merge_request_proto_rawDescOnce sync.Once

@@ -611,31 +712,34 @@ func file_ermite_storage_merge_request_proto_rawDescGZIP() []byte {
611		return file_ermite_storage_merge_request_proto_rawDescData	712		return file_ermite_storage_merge_request_proto_rawDescData
612		}	713		}
613			714
614	-	var file_ermite_storage_merge_request_proto_enumTypes = make([]protoimpl.EnumInfo, 3)	715	+	var file_ermite_storage_merge_request_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
615		var file_ermite_storage_merge_request_proto_msgTypes = make([]protoimpl.MessageInfo, 4)	716		var file_ermite_storage_merge_request_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
616		var file_ermite_storage_merge_request_proto_goTypes = []any{	717		var file_ermite_storage_merge_request_proto_goTypes = []any{
617		(MergeMode)(0), // 0: ermite.storage.MergeMode	718		(MergeMode)(0), // 0: ermite.storage.MergeMode
618		(MergeRequestState)(0), // 1: ermite.storage.MergeRequestState	719		(MergeRequestState)(0), // 1: ermite.storage.MergeRequestState
619		(DiffSide)(0), // 2: ermite.storage.DiffSide	720		(DiffSide)(0), // 2: ermite.storage.DiffSide
620	-	(*RepoSettings)(nil), // 3: ermite.storage.RepoSettings	721	+	(Verdict)(0), // 3: ermite.storage.Verdict
621	-	(*MergeRequest)(nil), // 4: ermite.storage.MergeRequest	722	+	(*RepoSettings)(nil), // 4: ermite.storage.RepoSettings
622	-	(*Comment)(nil), // 5: ermite.storage.Comment	723	+	(*MergeRequest)(nil), // 5: ermite.storage.MergeRequest
623	-	(*Sequence)(nil), // 6: ermite.storage.Sequence	724	+	(*Comment)(nil), // 6: ermite.storage.Comment
624	-	(*timestamppb.Timestamp)(nil), // 7: google.protobuf.Timestamp	725	+	(*Sequence)(nil), // 7: ermite.storage.Sequence
			726	+	(*timestamppb.Timestamp)(nil), // 8: google.protobuf.Timestamp
625		}	727		}
626		var file_ermite_storage_merge_request_proto_depIdxs = []int32{	728		var file_ermite_storage_merge_request_proto_depIdxs = []int32{
627		0, // 0: ermite.storage.RepoSettings.allowed_merge_modes:type_name -> ermite.storage.MergeMode	729		0, // 0: ermite.storage.RepoSettings.allowed_merge_modes:type_name -> ermite.storage.MergeMode
628		1, // 1: ermite.storage.MergeRequest.state:type_name -> ermite.storage.MergeRequestState	730		1, // 1: ermite.storage.MergeRequest.state:type_name -> ermite.storage.MergeRequestState
629	-	7, // 2: ermite.storage.MergeRequest.created_at:type_name -> google.protobuf.Timestamp	731	+	8, // 2: ermite.storage.MergeRequest.created_at:type_name -> google.protobuf.Timestamp
630	-	7, // 3: ermite.storage.MergeRequest.updated_at:type_name -> google.protobuf.Timestamp	732	+	8, // 3: ermite.storage.MergeRequest.updated_at:type_name -> google.protobuf.Timestamp
631		0, // 4: ermite.storage.MergeRequest.merge_mode:type_name -> ermite.storage.MergeMode	733		0, // 4: ermite.storage.MergeRequest.merge_mode:type_name -> ermite.storage.MergeMode
632		2, // 5: ermite.storage.Comment.side:type_name -> ermite.storage.DiffSide	734		2, // 5: ermite.storage.Comment.side:type_name -> ermite.storage.DiffSide
633	-	7, // 6: ermite.storage.Comment.created_at:type_name -> google.protobuf.Timestamp	735	+	8, // 6: ermite.storage.Comment.created_at:type_name -> google.protobuf.Timestamp
634	-	7, // [7:7] is the sub-list for method output_type	736	+	3, // 7: ermite.storage.Comment.verdict:type_name -> ermite.storage.Verdict
635	-	7, // [7:7] is the sub-list for method input_type	737	+	8, // 8: ermite.storage.Comment.edited_at:type_name -> google.protobuf.Timestamp
636	-	7, // [7:7] is the sub-list for extension type_name	738	+	9, // [9:9] is the sub-list for method output_type
637	-	7, // [7:7] is the sub-list for extension extendee	739	+	9, // [9:9] is the sub-list for method input_type
638	-	0, // [0:7] is the sub-list for field type_name	740	+	9, // [9:9] is the sub-list for extension type_name
			741	+	9, // [9:9] is the sub-list for extension extendee
			742	+	0, // [0:9] is the sub-list for field type_name
639		}	743		}
640			744
641		func init() { file_ermite_storage_merge_request_proto_init() }	745		func init() { file_ermite_storage_merge_request_proto_init() }

@@ -648,7 +752,7 @@ func file_ermite_storage_merge_request_proto_init() {
648		File: protoimpl.DescBuilder{	752		File: protoimpl.DescBuilder{
649		GoPackagePath: reflect.TypeOf(x{}).PkgPath(),	753		GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
650		RawDescriptor: unsafe.Slice(unsafe.StringData(file_ermite_storage_merge_request_proto_rawDesc), len(file_ermite_storage_merge_request_proto_rawDesc)),	754		RawDescriptor: unsafe.Slice(unsafe.StringData(file_ermite_storage_merge_request_proto_rawDesc), len(file_ermite_storage_merge_request_proto_rawDesc)),
651	-	NumEnums: 3,	755	+	NumEnums: 4,
652		NumMessages: 4,	756		NumMessages: 4,
653		NumExtensions: 0,	757		NumExtensions: 0,
654		NumServices: 0,	758		NumServices: 0,

M internal/adapters/client/scopes_test.go +1 -0


@@ -16,6 +16,7 @@ import (
16	16
17	17		func TestScopeWireNames(t *testing.T) {
18	18		want := map[ermite.Scope]string{
	19	+	ermite.Scope_SCOPE_MR_REVIEW: "mr:review",
19	20		ermite.Scope_SCOPE_REPO_READ: "repo:read",
20	21		ermite.Scope_SCOPE_REPO_WRITE: "repo:write",
21	22		ermite.Scope_SCOPE_REPO_ADMIN: "repo:admin",


@@ -16,6 +16,7 @@ import (
16		16
17	func TestScopeWireNames(t *testing.T) {	17		func TestScopeWireNames(t *testing.T) {
18	want := map[ermite.Scope]string{	18		want := map[ermite.Scope]string{
		19	+	ermite.Scope_SCOPE_MR_REVIEW: "mr:review",
19	ermite.Scope_SCOPE_REPO_READ: "repo:read",	20		ermite.Scope_SCOPE_REPO_READ: "repo:read",
20	ermite.Scope_SCOPE_REPO_WRITE: "repo:write",	21		ermite.Scope_SCOPE_REPO_WRITE: "repo:write",
21	ermite.Scope_SCOPE_REPO_ADMIN: "repo:admin",	22		ermite.Scope_SCOPE_REPO_ADMIN: "repo:admin",

M internal/adapters/kvstore/mergerequests.go +6 -0


@@ -570,6 +570,11 @@ func encodeComment(c domain.Comment) ([]byte, error) {
570	570		return nil, err
571	571		}
572	572		return mustMarshal(&storagepb.Comment{
	573	+	ReplyTo: c.ReplyTo,
	574	+	StartLine: int32(c.StartLine), //nolint:gosec // validated against the diff
	575	+	Verdict: storagepb.Verdict(c.Verdict),
	576	+	EditedAt: encodeTime(c.EditedAt),
	577	+	Deleted: c.Deleted,
573	578		Id: c.ID,
574	579		Author: c.Author,
575	580		Path: c.Path,

@@ -593,6 +598,7 @@ func decodeComment(item kv.Item) (domain.Comment, error) {
593	598		return domain.Comment{}, fmt.Errorf("decode comment %d: %w", pb.GetId(), err)
594	599		}
595	600		c := domain.Comment{
	601	+	ReplyTo: pb.GetReplyTo(), StartLine: int(pb.GetStartLine()), Verdict: domain.Verdict(pb.GetVerdict()), EditedAt: decodeTime(pb.GetEditedAt()), Deleted: pb.GetDeleted(),
596	602		ID: pb.GetId(), Author: pb.GetAuthor(), Path: pb.GetPath(), Line: int(pb.GetLine()),
597	603		Side: decodeSide(pb.GetSide()), Text: text, Resolved: pb.GetResolved(),
598	604		CreatedAt: decodeTime(pb.GetCreatedAt()), Version: item.Version,


@@ -570,6 +570,11 @@ func encodeComment(c domain.Comment) ([]byte, error) {
570	return nil, err	570		return nil, err
571	}	571		}
572	return mustMarshal(&storagepb.Comment{	572		return mustMarshal(&storagepb.Comment{
		573	+	ReplyTo: c.ReplyTo,
		574	+	StartLine: int32(c.StartLine), //nolint:gosec // validated against the diff
		575	+	Verdict: storagepb.Verdict(c.Verdict),
		576	+	EditedAt: encodeTime(c.EditedAt),
		577	+	Deleted: c.Deleted,
573	Id: c.ID,	578		Id: c.ID,
574	Author: c.Author,	579		Author: c.Author,
575	Path: c.Path,	580		Path: c.Path,

@@ -593,6 +598,7 @@ func decodeComment(item kv.Item) (domain.Comment, error) {
593	return domain.Comment{}, fmt.Errorf("decode comment %d: %w", pb.GetId(), err)	598		return domain.Comment{}, fmt.Errorf("decode comment %d: %w", pb.GetId(), err)
594	}	599		}
595	c := domain.Comment{	600		c := domain.Comment{
		601	+	ReplyTo: pb.GetReplyTo(), StartLine: int(pb.GetStartLine()), Verdict: domain.Verdict(pb.GetVerdict()), EditedAt: decodeTime(pb.GetEditedAt()), Deleted: pb.GetDeleted(),
596	ID: pb.GetId(), Author: pb.GetAuthor(), Path: pb.GetPath(), Line: int(pb.GetLine()),	602		ID: pb.GetId(), Author: pb.GetAuthor(), Path: pb.GetPath(), Line: int(pb.GetLine()),
597	Side: decodeSide(pb.GetSide()), Text: text, Resolved: pb.GetResolved(),	603		Side: decodeSide(pb.GetSide()), Text: text, Resolved: pb.GetResolved(),
598	CreatedAt: decodeTime(pb.GetCreatedAt()), Version: item.Version,	604		CreatedAt: decodeTime(pb.GetCreatedAt()), Version: item.Version,

M internal/adapters/kvstore/mergerequests_test.go +25 -0


@@ -547,3 +547,28 @@ func TestSigningSeedRejectsBadGenerators(t *testing.T) {
547	547		_, err = s.SigningSeed(ctx, func() ([]byte, error) { return nil, assert.AnError }, created)
548	548		require.ErrorIs(t, err, assert.AnError)
549	549		}
	550	+
	551	+	func TestNoteFieldsRoundTrip(t *testing.T) {
	552	+	ctx := context.Background()
	553	+	_, store, name := repoWithMRs(t)
	554	+	mr, err := store.Create(ctx, newMR(t, name, "notes"))
	555	+	require.NoError(t, err)
	556	+	for id := int64(1); id <= 2; id++ {
	557	+	mr, err = store.Get(ctx, name, mr.Number)
	558	+	require.NoError(t, err)
	559	+	c := newComment(t, id, "note")
	560	+	if id == 2 {
	561	+	c.ReplyTo = 1
	562	+	c.StartLine = 1
	563	+	c.Verdict = domain.VerdictApprove
	564	+	c.EditedAt = created
	565	+	c.Deleted = true
	566	+	}
	567	+	mr.CommentSeq = id
	568	+	require.NoError(t, store.SaveComment(ctx, mr, c))
	569	+	got, err := store.GetComment(ctx, name, mr.Number, id)
	570	+	require.NoError(t, err)
	571	+	c.Version = got.Version
	572	+	assert.Equal(t, c, got)
	573	+	}
	574	+	}


@@ -547,3 +547,28 @@ func TestSigningSeedRejectsBadGenerators(t *testing.T) {
547	_, err = s.SigningSeed(ctx, func() ([]byte, error) { return nil, assert.AnError }, created)	547		_, err = s.SigningSeed(ctx, func() ([]byte, error) { return nil, assert.AnError }, created)
548	require.ErrorIs(t, err, assert.AnError)	548		require.ErrorIs(t, err, assert.AnError)
549	}	549		}
		550	+
		551	+	func TestNoteFieldsRoundTrip(t *testing.T) {
		552	+	ctx := context.Background()
		553	+	_, store, name := repoWithMRs(t)
		554	+	mr, err := store.Create(ctx, newMR(t, name, "notes"))
		555	+	require.NoError(t, err)
		556	+	for id := int64(1); id <= 2; id++ {
		557	+	mr, err = store.Get(ctx, name, mr.Number)
		558	+	require.NoError(t, err)
		559	+	c := newComment(t, id, "note")
		560	+	if id == 2 {
		561	+	c.ReplyTo = 1
		562	+	c.StartLine = 1
		563	+	c.Verdict = domain.VerdictApprove
		564	+	c.EditedAt = created
		565	+	c.Deleted = true
		566	+	}
		567	+	mr.CommentSeq = id
		568	+	require.NoError(t, store.SaveComment(ctx, mr, c))
		569	+	got, err := store.GetComment(ctx, name, mr.Number, id)
		570	+	require.NoError(t, err)
		571	+	c.Version = got.Version
		572	+	assert.Equal(t, c, got)
		573	+	}
		574	+	}

M internal/adapters/rpc/convert.go +10 -0


@@ -124,6 +124,7 @@ func mergeModesFromPB(in []pb.MergeMode) ([]domain.MergeMode, error) {
124	124		}
125	125
126	126		var scopeToPB = map[domain.Scope]pb.Scope{
	127	+	domain.ScopeMRReview: pb.Scope_SCOPE_MR_REVIEW,
127	128		domain.ScopeRepoRead: pb.Scope_SCOPE_REPO_READ,
128	129		domain.ScopeRepoWrite: pb.Scope_SCOPE_REPO_WRITE,
129	130		domain.ScopeRepoAdmin: pb.Scope_SCOPE_REPO_ADMIN,

@@ -471,6 +472,15 @@ func watchEventToPB(we ports.WatchEvent) *pb.Event {
471	472		case domain.CommentAdded:
472	473		out.Time = timestamp(ev.At)
473	474		out.Kind = &pb.Event_CommentAdded{CommentAdded: &pb.CommentAdded{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
	475	+	case domain.CommentEdited:
	476	+	out.Time = timestamp(ev.At)
	477	+	out.Kind = &pb.Event_CommentEdited{CommentEdited: &pb.CommentEdited{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
	478	+	case domain.CommentDeleted:
	479	+	out.Time = timestamp(ev.At)
	480	+	out.Kind = &pb.Event_CommentDeleted{CommentDeleted: &pb.CommentDeleted{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
	481	+	case domain.CommentResolved:
	482	+	out.Time = timestamp(ev.At)
	483	+	out.Kind = &pb.Event_CommentResolved{CommentResolved: &pb.CommentResolved{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
474	484		case domain.RunUpdated:
475	485		out.Time = timestamp(ev.At)
476	486		out.Kind = runEventToPB(ev)


@@ -124,6 +124,7 @@ func mergeModesFromPB(in []pb.MergeMode) ([]domain.MergeMode, error) {
124	}	124		}
125		125
126	var scopeToPB = map[domain.Scope]pb.Scope{	126		var scopeToPB = map[domain.Scope]pb.Scope{
		127	+	domain.ScopeMRReview: pb.Scope_SCOPE_MR_REVIEW,
127	domain.ScopeRepoRead: pb.Scope_SCOPE_REPO_READ,	128		domain.ScopeRepoRead: pb.Scope_SCOPE_REPO_READ,
128	domain.ScopeRepoWrite: pb.Scope_SCOPE_REPO_WRITE,	129		domain.ScopeRepoWrite: pb.Scope_SCOPE_REPO_WRITE,
129	domain.ScopeRepoAdmin: pb.Scope_SCOPE_REPO_ADMIN,	130		domain.ScopeRepoAdmin: pb.Scope_SCOPE_REPO_ADMIN,

@@ -471,6 +472,15 @@ func watchEventToPB(we ports.WatchEvent) *pb.Event {
471	case domain.CommentAdded:	472		case domain.CommentAdded:
472	out.Time = timestamp(ev.At)	473		out.Time = timestamp(ev.At)
473	out.Kind = &pb.Event_CommentAdded{CommentAdded: &pb.CommentAdded{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}	474		out.Kind = &pb.Event_CommentAdded{CommentAdded: &pb.CommentAdded{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
		475	+	case domain.CommentEdited:
		476	+	out.Time = timestamp(ev.At)
		477	+	out.Kind = &pb.Event_CommentEdited{CommentEdited: &pb.CommentEdited{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
		478	+	case domain.CommentDeleted:
		479	+	out.Time = timestamp(ev.At)
		480	+	out.Kind = &pb.Event_CommentDeleted{CommentDeleted: &pb.CommentDeleted{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
		481	+	case domain.CommentResolved:
		482	+	out.Time = timestamp(ev.At)
		483	+	out.Kind = &pb.Event_CommentResolved{CommentResolved: &pb.CommentResolved{Repo: ev.Repo.String(), Number: ev.Number, Comment: commentToPB(ev.Comment)}}
474	case domain.RunUpdated:	484		case domain.RunUpdated:
475	out.Time = timestamp(ev.At)	485		out.Time = timestamp(ev.At)
476	out.Kind = runEventToPB(ev)	486		out.Kind = runEventToPB(ev)

M internal/adapters/rpc/mergerequest.go +70 -0


@@ -17,6 +17,52 @@ import (
17	17		// mergeRequestService implements ermiteconnect.MergeRequestServiceHandler.
18	18		type mergeRequestService struct{ mrs ports.MergeRequestService }
19	19
	20	+	func (s mergeRequestService) EditComment(ctx context.Context, req connect.Request[pb.EditCommentRequest]) (*connect.Response[pb.EditCommentResponse], error) {
	21	+	name, err := domain.ParseRepoName(req.Msg.GetRepo())
	22	+	if err != nil {
	23	+	return nil, connectError(ctx, err)
	24	+	}
	25	+	c, err := s.mrs.EditComment(ctx, caller(ctx), name, req.Msg.GetNumber(), commentID(req.Msg.GetCommentId()), req.Msg.GetText())
	26	+	if err != nil {
	27	+	return nil, connectError(ctx, err)
	28	+	}
	29	+	return connect.NewResponse(&pb.EditCommentResponse{Comment: commentToPB(c)}), nil
	30	+	}
	31	+
	32	+	func (s mergeRequestService) DeleteComment(ctx context.Context, req connect.Request[pb.DeleteCommentRequest]) (*connect.Response[pb.DeleteCommentResponse], error) {
	33	+	name, err := domain.ParseRepoName(req.Msg.GetRepo())
	34	+	if err != nil {
	35	+	return nil, connectError(ctx, err)
	36	+	}
	37	+	c, err := s.mrs.DeleteComment(ctx, caller(ctx), name, req.Msg.GetNumber(), commentID(req.Msg.GetCommentId()))
	38	+	if err != nil {
	39	+	return nil, connectError(ctx, err)
	40	+	}
	41	+	return connect.NewResponse(&pb.DeleteCommentResponse{Comment: commentToPB(c)}), nil
	42	+	}
	43	+
	44	+	func verdictToPB(v domain.Verdict) pb.Verdict {
	45	+	switch v {
	46	+	case domain.VerdictApprove:
	47	+	return pb.Verdict_VERDICT_APPROVE
	48	+	case domain.VerdictChangesRequested:
	49	+	return pb.Verdict_VERDICT_CHANGES_REQUESTED
	50	+	}
	51	+	return pb.Verdict_VERDICT_UNSPECIFIED
	52	+	}
	53	+
	54	+	func verdictFromPB(v pb.Verdict) (domain.Verdict, error) {
	55	+	switch v {
	56	+	case pb.Verdict_VERDICT_UNSPECIFIED:
	57	+	return domain.VerdictNone, nil
	58	+	case pb.Verdict_VERDICT_APPROVE:
	59	+	return domain.VerdictApprove, nil
	60	+	case pb.Verdict_VERDICT_CHANGES_REQUESTED:
	61	+	return domain.VerdictChangesRequested, nil
	62	+	}
	63	+	return domain.VerdictNone, fmt.Errorf("%w: verdict %v", domain.ErrInvalid, v)
	64	+	}
	65	+
20	66		func mergeRequestStateToPB(s domain.MRState) pb.MergeRequestState {
21	67		switch s {
22	68		case domain.MRStateOpen:

@@ -96,9 +142,19 @@ func commentToPB(c domain.Comment) *pb.Comment {
96	142		Text: c.Text.String(),
97	143		Resolved: c.Resolved,
98	144		CreatedAt: timestamp(c.CreatedAt),
	145	+	ReplyTo: optionalCommentID(c.ReplyTo),
	146	+	StartLine: int32(c.StartLine), //nolint:gosec // validated diff line
	147	+	Verdict: verdictToPB(c.Verdict), EditedAt: timestamp(c.EditedAt), Deleted: c.Deleted,
99	148		}
100	149		}
101	150
	151	+	func optionalCommentID(id int64) string {
	152	+	if id == 0 {
	153	+	return ""
	154	+	}
	155	+	return strconv.FormatInt(id, 10)
	156	+	}
	157	+
102	158		// commentID parses the opaque id of a comment. One that this server never
103	159		// issued is 0, which names no comment.
104	160		func commentID(s string) int64 {

@@ -185,6 +241,9 @@ func (s mergeRequestService) GetMergeRequest(ctx context.Context, req connect.
185	241		for _, c := range d.Comments {
186	242		out.Comments = append(out.Comments, commentToPB(c))
187	243		}
	244	+	for _, v := range d.Verdicts {
	245	+	out.Verdicts = append(out.Verdicts, &pb.AuthorVerdict{Author: v.Author, Verdict: verdictToPB(v.Verdict), CommentId: strconv.FormatInt(v.CommentID, 10), CommitId: v.CommitID.String(), CreatedAt: timestamp(v.At), Stale: v.Stale})
	246	+	}
188	247		return connect.NewResponse(out), nil
189	248		}
190	249

@@ -197,7 +256,18 @@ func (s mergeRequestService) AddComment(ctx context.Context, req connect.Reque
197	256		if err != nil {
198	257		return nil, connectError(ctx, err)
199	258		}
	259	+	verdict, err := verdictFromPB(req.Msg.GetVerdict())
	260	+	if err != nil {
	261	+	return nil, connectError(ctx, err)
	262	+	}
	263	+	replyTo := commentID(req.Msg.GetReplyTo())
	264	+	if req.Msg.GetReplyTo() != "" && replyTo == 0 {
	265	+	var v domain.Violations
	266	+	v.Add("reply_to", "is not a note id")
	267	+	return nil, connectError(ctx, v.Err())
	268	+	}
200	269		c, err := s.mrs.AddComment(ctx, caller(ctx), name, req.Msg.GetNumber(), ports.AddCommentParams{
	270	+	ReplyTo: replyTo, StartLine: int(req.Msg.GetStartLine()), Verdict: verdict,
201	271		Path: req.Msg.GetPath(), Line: int(req.Msg.GetLine()), Side: side, Text: req.Msg.GetText(),
202	272		})
203	273		if err != nil {


@@ -17,6 +17,52 @@ import (
17	// mergeRequestService implements ermiteconnect.MergeRequestServiceHandler.	17		// mergeRequestService implements ermiteconnect.MergeRequestServiceHandler.
18	type mergeRequestService struct{ mrs ports.MergeRequestService }	18		type mergeRequestService struct{ mrs ports.MergeRequestService }
19		19
		20	+	func (s mergeRequestService) EditComment(ctx context.Context, req connect.Request[pb.EditCommentRequest]) (*connect.Response[pb.EditCommentResponse], error) {
		21	+	name, err := domain.ParseRepoName(req.Msg.GetRepo())
		22	+	if err != nil {
		23	+	return nil, connectError(ctx, err)
		24	+	}
		25	+	c, err := s.mrs.EditComment(ctx, caller(ctx), name, req.Msg.GetNumber(), commentID(req.Msg.GetCommentId()), req.Msg.GetText())
		26	+	if err != nil {
		27	+	return nil, connectError(ctx, err)
		28	+	}
		29	+	return connect.NewResponse(&pb.EditCommentResponse{Comment: commentToPB(c)}), nil
		30	+	}
		31	+
		32	+	func (s mergeRequestService) DeleteComment(ctx context.Context, req connect.Request[pb.DeleteCommentRequest]) (*connect.Response[pb.DeleteCommentResponse], error) {
		33	+	name, err := domain.ParseRepoName(req.Msg.GetRepo())
		34	+	if err != nil {
		35	+	return nil, connectError(ctx, err)
		36	+	}
		37	+	c, err := s.mrs.DeleteComment(ctx, caller(ctx), name, req.Msg.GetNumber(), commentID(req.Msg.GetCommentId()))
		38	+	if err != nil {
		39	+	return nil, connectError(ctx, err)
		40	+	}
		41	+	return connect.NewResponse(&pb.DeleteCommentResponse{Comment: commentToPB(c)}), nil
		42	+	}
		43	+
		44	+	func verdictToPB(v domain.Verdict) pb.Verdict {
		45	+	switch v {
		46	+	case domain.VerdictApprove:
		47	+	return pb.Verdict_VERDICT_APPROVE
		48	+	case domain.VerdictChangesRequested:
		49	+	return pb.Verdict_VERDICT_CHANGES_REQUESTED
		50	+	}
		51	+	return pb.Verdict_VERDICT_UNSPECIFIED
		52	+	}
		53	+
		54	+	func verdictFromPB(v pb.Verdict) (domain.Verdict, error) {
		55	+	switch v {
		56	+	case pb.Verdict_VERDICT_UNSPECIFIED:
		57	+	return domain.VerdictNone, nil
		58	+	case pb.Verdict_VERDICT_APPROVE:
		59	+	return domain.VerdictApprove, nil
		60	+	case pb.Verdict_VERDICT_CHANGES_REQUESTED:
		61	+	return domain.VerdictChangesRequested, nil
		62	+	}
		63	+	return domain.VerdictNone, fmt.Errorf("%w: verdict %v", domain.ErrInvalid, v)
		64	+	}
		65	+
20	func mergeRequestStateToPB(s domain.MRState) pb.MergeRequestState {	66		func mergeRequestStateToPB(s domain.MRState) pb.MergeRequestState {
21	switch s {	67		switch s {
22	case domain.MRStateOpen:	68		case domain.MRStateOpen:

@@ -96,9 +142,19 @@ func commentToPB(c domain.Comment) *pb.Comment {
96	Text: c.Text.String(),	142		Text: c.Text.String(),
97	Resolved: c.Resolved,	143		Resolved: c.Resolved,
98	CreatedAt: timestamp(c.CreatedAt),	144		CreatedAt: timestamp(c.CreatedAt),
		145	+	ReplyTo: optionalCommentID(c.ReplyTo),
		146	+	StartLine: int32(c.StartLine), //nolint:gosec // validated diff line
		147	+	Verdict: verdictToPB(c.Verdict), EditedAt: timestamp(c.EditedAt), Deleted: c.Deleted,
99	}	148		}
100	}	149		}
101		150
		151	+	func optionalCommentID(id int64) string {
		152	+	if id == 0 {
		153	+	return ""
		154	+	}
		155	+	return strconv.FormatInt(id, 10)
		156	+	}
		157	+
102	// commentID parses the opaque id of a comment. One that this server never	158		// commentID parses the opaque id of a comment. One that this server never
103	// issued is 0, which names no comment.	159		// issued is 0, which names no comment.
104	func commentID(s string) int64 {	160		func commentID(s string) int64 {

@@ -185,6 +241,9 @@ func (s mergeRequestService) GetMergeRequest(ctx context.Context, req connect.
185	for _, c := range d.Comments {	241		for _, c := range d.Comments {
186	out.Comments = append(out.Comments, commentToPB(c))	242		out.Comments = append(out.Comments, commentToPB(c))
187	}	243		}
		244	+	for _, v := range d.Verdicts {
		245	+	out.Verdicts = append(out.Verdicts, &pb.AuthorVerdict{Author: v.Author, Verdict: verdictToPB(v.Verdict), CommentId: strconv.FormatInt(v.CommentID, 10), CommitId: v.CommitID.String(), CreatedAt: timestamp(v.At), Stale: v.Stale})
		246	+	}
188	return connect.NewResponse(out), nil	247		return connect.NewResponse(out), nil
189	}	248		}
190		249

@@ -197,7 +256,18 @@ func (s mergeRequestService) AddComment(ctx context.Context, req connect.Reque
197	if err != nil {	256		if err != nil {
198	return nil, connectError(ctx, err)	257		return nil, connectError(ctx, err)
199	}	258		}
		259	+	verdict, err := verdictFromPB(req.Msg.GetVerdict())
		260	+	if err != nil {
		261	+	return nil, connectError(ctx, err)
		262	+	}
		263	+	replyTo := commentID(req.Msg.GetReplyTo())
		264	+	if req.Msg.GetReplyTo() != "" && replyTo == 0 {
		265	+	var v domain.Violations
		266	+	v.Add("reply_to", "is not a note id")
		267	+	return nil, connectError(ctx, v.Err())
		268	+	}
200	c, err := s.mrs.AddComment(ctx, caller(ctx), name, req.Msg.GetNumber(), ports.AddCommentParams{	269		c, err := s.mrs.AddComment(ctx, caller(ctx), name, req.Msg.GetNumber(), ports.AddCommentParams{
		270	+	ReplyTo: replyTo, StartLine: int(req.Msg.GetStartLine()), Verdict: verdict,
201	Path: req.Msg.GetPath(), Line: int(req.Msg.GetLine()), Side: side, Text: req.Msg.GetText(),	271		Path: req.Msg.GetPath(), Line: int(req.Msg.GetLine()), Side: side, Text: req.Msg.GetText(),
202	})	272		})
203	if err != nil {	273		if err != nil {

A internal/adapters/rpc/mr_api_test.go +124 -0

@@ -0,0 +1,124 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package rpc
	4	+
	5	+	import (
	6	+	"testing"
	7	+	"time"
	8	+
	9	+	pb "bnema.dev/ermite-api/gen/ermite"
	10	+	"bnema.dev/ermite/internal/domain"
	11	+	"bnema.dev/ermite/internal/ports"
	12	+	"bnema.dev/ermite/internal/ports/mocks"
	13	+	"connectrpc.com/connect"
	14	+	"github.com/stretchr/testify/assert"
	15	+	"github.com/stretchr/testify/mock"
	16	+	"github.com/stretchr/testify/require"
	17	+	)
	18	+
	19	+	func TestNoteRPCFields(t *testing.T) {
	20	+	now := time.Now().UTC()
	21	+	note := domain.Comment{ID: 4, ReplyTo: 2, StartLine: 10, Line: 24, Verdict: domain.VerdictApprove, EditedAt: now, Deleted: true}
	22	+	got := commentToPB(note)
	23	+	assert.Equal(t, "2", got.GetReplyTo())
	24	+	assert.EqualValues(t, 10, got.GetStartLine())
	25	+	assert.Equal(t, pb.Verdict_VERDICT_APPROVE, got.GetVerdict())
	26	+	assert.Equal(t, now, got.GetEditedAt().AsTime())
	27	+	assert.True(t, got.GetDeleted())
	28	+	assert.Empty(t, commentToPB(domain.Comment{}).GetReplyTo())
	29	+	assert.Nil(t, commentToPB(domain.Comment{}).GetEditedAt())
	30	+	for _, v := range []domain.Verdict{domain.VerdictNone, domain.VerdictApprove, domain.VerdictChangesRequested} {
	31	+	back, err := verdictFromPB(verdictToPB(v))
	32	+	require.NoError(t, err)
	33	+	assert.Equal(t, v, back)
	34	+	}
	35	+	m := mocks.NewMergeRequestService(t)
	36	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{Text: "note", StartLine: 10, Line: 24, Verdict: domain.VerdictApprove}).Return(note, nil).Once()
	37	+	res, err := (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, Text: "note", StartLine: 10, Line: 24, Verdict: pb.Verdict_VERDICT_APPROVE}))
	38	+	require.NoError(t, err)
	39	+	assert.Equal(t, got, res.Msg.GetComment())
	40	+	_, err = (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Verdict: pb.Verdict(99)}))
	41	+	requireCode(t, connect.CodeInvalidArgument, err)
	42	+	}
	43	+
	44	+	func TestNoteMutationRPCCodes(t *testing.T) {
	45	+	for _, edit := range []bool{false, true} {
	46	+	for _, failure := range []error{nil, domain.ErrForbidden, domain.ErrPreconditionFailed, domain.ErrNotFound} {
	47	+	m := mocks.NewMergeRequestService(t)
	48	+	note := domain.Comment{ID: 2, Deleted: !edit}
	49	+	var err error
	50	+	if edit {
	51	+	m.EXPECT().EditComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), int64(2), "new").Return(note, failure).Once()
	52	+	_, err = (&mergeRequestService{m}).EditComment(ownerCtx(), connect.NewRequest(&pb.EditCommentRequest{Repo: "demo", Number: 1, CommentId: "2", Text: "new"}))
	53	+	} else {
	54	+	m.EXPECT().DeleteComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), int64(2)).Return(note, failure).Once()
	55	+	_, err = (&mergeRequestService{m}).DeleteComment(ownerCtx(), connect.NewRequest(&pb.DeleteCommentRequest{Repo: "demo", Number: 1, CommentId: "2"}))
	56	+	}
	57	+	switch failure {
	58	+	case nil:
	59	+	require.NoError(t, err)
	60	+	case domain.ErrForbidden:
	61	+	requireCode(t, connect.CodePermissionDenied, err)
	62	+	case domain.ErrPreconditionFailed:
	63	+	requireCode(t, connect.CodeFailedPrecondition, err)
	64	+	case domain.ErrNotFound:
	65	+	requireCode(t, connect.CodeNotFound, err)
	66	+	}
	67	+	}
	68	+	}
	69	+	}
	70	+
	71	+	func TestNoteEventsRPC(t *testing.T) {
	72	+	repo := mustRepoName(t, "demo")
	73	+	note := domain.Comment{ID: 3, Verdict: domain.VerdictApprove, Deleted: true}
	74	+	at := time.Now().UTC()
	75	+	events := []domain.Event{
	76	+	domain.CommentEdited{Repo: repo, Number: 1, Comment: note, At: at},
	77	+	domain.CommentDeleted{Repo: repo, Number: 1, Comment: note, At: at},
	78	+	domain.CommentResolved{Repo: repo, Number: 1, Comment: note, At: at},
	79	+	}
	80	+	for i, ev := range events {
	81	+	got := watchEventToPB(ports.WatchEvent{ID: "e", Event: ev})
	82	+	require.NotNil(t, got)
	83	+	assert.Equal(t, at, got.GetTime().AsTime())
	84	+	var c *pb.Comment
	85	+	switch i {
	86	+	case 0:
	87	+	c = got.GetCommentEdited().GetComment()
	88	+	case 1:
	89	+	c = got.GetCommentDeleted().GetComment()
	90	+	case 2:
	91	+	c = got.GetCommentResolved().GetComment()
	92	+	}
	93	+	assert.Equal(t, "3", c.GetId())
	94	+	assert.True(t, c.GetDeleted())
	95	+	assert.Equal(t, pb.Verdict_VERDICT_APPROVE, c.GetVerdict())
	96	+	}
	97	+	}
	98	+
	99	+	func TestNoteReplyIDValidation(t *testing.T) {
	100	+	for _, id := range []string{"abc", "0", "-1", "01", "9223372036854775808"} {
	101	+	_, err := (&mergeRequestService{mocks.NewMergeRequestService(t)}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, ReplyTo: id, Text: "reply"}))
	102	+	requireCode(t, connect.CodeInvalidArgument, err)
	103	+	assert.Contains(t, err.Error(), "reply_to")
	104	+	assert.Contains(t, err.Error(), "is not a note id")
	105	+	}
	106	+	m := mocks.NewMergeRequestService(t)
	107	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{ReplyTo: 2, Text: "reply"}).Return(domain.Comment{ID: 3, ReplyTo: 2}, nil).Once()
	108	+	res, err := (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, ReplyTo: "2", Text: "reply"}))
	109	+	require.NoError(t, err)
	110	+	assert.Equal(t, "2", res.Msg.GetComment().GetReplyTo())
	111	+	}
	112	+
	113	+	func TestNoteVerdictsDetailAndScope(t *testing.T) {
	114	+	m := mocks.NewMergeRequestService(t)
	115	+	m.EXPECT().Get(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.GetMergeRequestOptions{}).Return(ports.MergeRequestDetail{Verdicts: []domain.AuthorVerdict{{Author: "owner", Verdict: domain.VerdictApprove, CommentID: 4, Stale: true}}}, nil).Once()
	116	+	res, err := (&mergeRequestService{m}).GetMergeRequest(ownerCtx(), connect.NewRequest(&pb.GetMergeRequestRequest{Repo: "demo", Number: 1}))
	117	+	require.NoError(t, err)
	118	+	require.Len(t, res.Msg.GetVerdicts(), 1)
	119	+	assert.Equal(t, "4", res.Msg.GetVerdicts()[0].GetCommentId())
	120	+	assert.True(t, res.Msg.GetVerdicts()[0].GetStale())
	121	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{Verdict: domain.VerdictApprove}).Return(domain.Comment{}, domain.ErrForbidden).Once()
	122	+	_, err = (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, Verdict: pb.Verdict_VERDICT_APPROVE}))
	123	+	requireCode(t, connect.CodePermissionDenied, err)
	124	+	}

@@ -0,0 +1,124 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package rpc
	4	+
	5	+	import (
	6	+	"testing"
	7	+	"time"
	8	+
	9	+	pb "bnema.dev/ermite-api/gen/ermite"
	10	+	"bnema.dev/ermite/internal/domain"
	11	+	"bnema.dev/ermite/internal/ports"
	12	+	"bnema.dev/ermite/internal/ports/mocks"
	13	+	"connectrpc.com/connect"
	14	+	"github.com/stretchr/testify/assert"
	15	+	"github.com/stretchr/testify/mock"
	16	+	"github.com/stretchr/testify/require"
	17	+	)
	18	+
	19	+	func TestNoteRPCFields(t *testing.T) {
	20	+	now := time.Now().UTC()
	21	+	note := domain.Comment{ID: 4, ReplyTo: 2, StartLine: 10, Line: 24, Verdict: domain.VerdictApprove, EditedAt: now, Deleted: true}
	22	+	got := commentToPB(note)
	23	+	assert.Equal(t, "2", got.GetReplyTo())
	24	+	assert.EqualValues(t, 10, got.GetStartLine())
	25	+	assert.Equal(t, pb.Verdict_VERDICT_APPROVE, got.GetVerdict())
	26	+	assert.Equal(t, now, got.GetEditedAt().AsTime())
	27	+	assert.True(t, got.GetDeleted())
	28	+	assert.Empty(t, commentToPB(domain.Comment{}).GetReplyTo())
	29	+	assert.Nil(t, commentToPB(domain.Comment{}).GetEditedAt())
	30	+	for _, v := range []domain.Verdict{domain.VerdictNone, domain.VerdictApprove, domain.VerdictChangesRequested} {
	31	+	back, err := verdictFromPB(verdictToPB(v))
	32	+	require.NoError(t, err)
	33	+	assert.Equal(t, v, back)
	34	+	}
	35	+	m := mocks.NewMergeRequestService(t)
	36	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{Text: "note", StartLine: 10, Line: 24, Verdict: domain.VerdictApprove}).Return(note, nil).Once()
	37	+	res, err := (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, Text: "note", StartLine: 10, Line: 24, Verdict: pb.Verdict_VERDICT_APPROVE}))
	38	+	require.NoError(t, err)
	39	+	assert.Equal(t, got, res.Msg.GetComment())
	40	+	_, err = (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Verdict: pb.Verdict(99)}))
	41	+	requireCode(t, connect.CodeInvalidArgument, err)
	42	+	}
	43	+
	44	+	func TestNoteMutationRPCCodes(t *testing.T) {
	45	+	for _, edit := range []bool{false, true} {
	46	+	for _, failure := range []error{nil, domain.ErrForbidden, domain.ErrPreconditionFailed, domain.ErrNotFound} {
	47	+	m := mocks.NewMergeRequestService(t)
	48	+	note := domain.Comment{ID: 2, Deleted: !edit}
	49	+	var err error
	50	+	if edit {
	51	+	m.EXPECT().EditComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), int64(2), "new").Return(note, failure).Once()
	52	+	_, err = (&mergeRequestService{m}).EditComment(ownerCtx(), connect.NewRequest(&pb.EditCommentRequest{Repo: "demo", Number: 1, CommentId: "2", Text: "new"}))
	53	+	} else {
	54	+	m.EXPECT().DeleteComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), int64(2)).Return(note, failure).Once()
	55	+	_, err = (&mergeRequestService{m}).DeleteComment(ownerCtx(), connect.NewRequest(&pb.DeleteCommentRequest{Repo: "demo", Number: 1, CommentId: "2"}))
	56	+	}
	57	+	switch failure {
	58	+	case nil:
	59	+	require.NoError(t, err)
	60	+	case domain.ErrForbidden:
	61	+	requireCode(t, connect.CodePermissionDenied, err)
	62	+	case domain.ErrPreconditionFailed:
	63	+	requireCode(t, connect.CodeFailedPrecondition, err)
	64	+	case domain.ErrNotFound:
	65	+	requireCode(t, connect.CodeNotFound, err)
	66	+	}
	67	+	}
	68	+	}
	69	+	}
	70	+
	71	+	func TestNoteEventsRPC(t *testing.T) {
	72	+	repo := mustRepoName(t, "demo")
	73	+	note := domain.Comment{ID: 3, Verdict: domain.VerdictApprove, Deleted: true}
	74	+	at := time.Now().UTC()
	75	+	events := []domain.Event{
	76	+	domain.CommentEdited{Repo: repo, Number: 1, Comment: note, At: at},
	77	+	domain.CommentDeleted{Repo: repo, Number: 1, Comment: note, At: at},
	78	+	domain.CommentResolved{Repo: repo, Number: 1, Comment: note, At: at},
	79	+	}
	80	+	for i, ev := range events {
	81	+	got := watchEventToPB(ports.WatchEvent{ID: "e", Event: ev})
	82	+	require.NotNil(t, got)
	83	+	assert.Equal(t, at, got.GetTime().AsTime())
	84	+	var c *pb.Comment
	85	+	switch i {
	86	+	case 0:
	87	+	c = got.GetCommentEdited().GetComment()
	88	+	case 1:
	89	+	c = got.GetCommentDeleted().GetComment()
	90	+	case 2:
	91	+	c = got.GetCommentResolved().GetComment()
	92	+	}
	93	+	assert.Equal(t, "3", c.GetId())
	94	+	assert.True(t, c.GetDeleted())
	95	+	assert.Equal(t, pb.Verdict_VERDICT_APPROVE, c.GetVerdict())
	96	+	}
	97	+	}
	98	+
	99	+	func TestNoteReplyIDValidation(t *testing.T) {
	100	+	for _, id := range []string{"abc", "0", "-1", "01", "9223372036854775808"} {
	101	+	_, err := (&mergeRequestService{mocks.NewMergeRequestService(t)}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, ReplyTo: id, Text: "reply"}))
	102	+	requireCode(t, connect.CodeInvalidArgument, err)
	103	+	assert.Contains(t, err.Error(), "reply_to")
	104	+	assert.Contains(t, err.Error(), "is not a note id")
	105	+	}
	106	+	m := mocks.NewMergeRequestService(t)
	107	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{ReplyTo: 2, Text: "reply"}).Return(domain.Comment{ID: 3, ReplyTo: 2}, nil).Once()
	108	+	res, err := (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, ReplyTo: "2", Text: "reply"}))
	109	+	require.NoError(t, err)
	110	+	assert.Equal(t, "2", res.Msg.GetComment().GetReplyTo())
	111	+	}
	112	+
	113	+	func TestNoteVerdictsDetailAndScope(t *testing.T) {
	114	+	m := mocks.NewMergeRequestService(t)
	115	+	m.EXPECT().Get(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.GetMergeRequestOptions{}).Return(ports.MergeRequestDetail{Verdicts: []domain.AuthorVerdict{{Author: "owner", Verdict: domain.VerdictApprove, CommentID: 4, Stale: true}}}, nil).Once()
	116	+	res, err := (&mergeRequestService{m}).GetMergeRequest(ownerCtx(), connect.NewRequest(&pb.GetMergeRequestRequest{Repo: "demo", Number: 1}))
	117	+	require.NoError(t, err)
	118	+	require.Len(t, res.Msg.GetVerdicts(), 1)
	119	+	assert.Equal(t, "4", res.Msg.GetVerdicts()[0].GetCommentId())
	120	+	assert.True(t, res.Msg.GetVerdicts()[0].GetStale())
	121	+	m.EXPECT().AddComment(mock.Anything, domain.Owner(), mustRepoName(t, "demo"), int64(1), ports.AddCommentParams{Verdict: domain.VerdictApprove}).Return(domain.Comment{}, domain.ErrForbidden).Once()
	122	+	_, err = (&mergeRequestService{m}).AddComment(ownerCtx(), connect.NewRequest(&pb.AddCommentRequest{Repo: "demo", Number: 1, Verdict: pb.Verdict_VERDICT_APPROVE}))
	123	+	requireCode(t, connect.CodePermissionDenied, err)
	124	+	}

M internal/adapters/web/diff.go +1 -0


@@ -30,6 +30,7 @@ type Seg struct {
30	30		// DiffLine is one line of a hunk, in the unified view and, paired, in the
31	31		// split view.
32	32		type DiffLine struct {
	33	+	Selected bool
33	34		Kind string // "ctx", "add", "del"
34	35		Mark string // " ", "+", "-": every change keeps its marker, not only a colour
35	36		Old, New string // line numbers, "" when the side has none


@@ -30,6 +30,7 @@ type Seg struct {
30	// DiffLine is one line of a hunk, in the unified view and, paired, in the	30		// DiffLine is one line of a hunk, in the unified view and, paired, in the
31	// split view.	31		// split view.
32	type DiffLine struct {	32		type DiffLine struct {
		33	+	Selected bool
33	Kind string // "ctx", "add", "del"	34		Kind string // "ctx", "add", "del"
34	Mark string // " ", "+", "-": every change keeps its marker, not only a colour	35		Mark string // " ", "+", "-": every change keeps its marker, not only a colour
35	Old, New string // line numbers, "" when the side has none	36		Old, New string // line numbers, "" when the side has none

M internal/adapters/web/diff.templ +4 -4


@@ -232,7 +232,7 @@ templ DiffFileView(f DiffFile, p DiffView) {
232	232		}
233	233		<tr class="hunk"><td colspan="4">{ h.Header }</td></tr>
234	234		for _, ln := range h.Lines {
235		-	<tr class={ ln.Kind }>
	235	+	<tr class={ ln.Kind, templ.KV("sel", ln.Selected) }>
236	236		<td class="ln">@gutter(ln.Old, ln.OldHref)</td>
237	237		<td class="ln">@gutter(ln.New, ln.NewHref)</td>
238	238		<td class="m">{ ln.Mark }</td>

@@ -369,15 +369,15 @@ templ splitSide(ln *DiffLine, old bool) {
369	369		<td class="m none"></td>
370	370		<td class="tx none"></td>
371	371		} else {
372		-	<td class={ "ln", ln.Kind }>
	372	+	<td class={ "ln", ln.Kind, templ.KV("sel", ln.Selected) }>
373	373		if old {
374	374		@gutter(ln.Old, ln.OldHref)
375	375		} else {
376	376		@gutter(ln.New, ln.NewHref)
377	377		}
378	378		</td>
379		-	<td class={ "m", ln.Kind }>{ ln.Mark }</td>
380		-	<td class={ "tx", "chroma", ln.Kind }>@codeLine(*ln)</td>
	379	+	<td class={ "m", ln.Kind, templ.KV("sel", ln.Selected) }>{ ln.Mark }</td>
	380	+	<td class={ "tx", "chroma", ln.Kind, templ.KV("sel", ln.Selected) }>@codeLine(*ln)</td>
381	381		}
382	382		}
383	383


@@ -232,7 +232,7 @@ templ DiffFileView(f DiffFile, p DiffView) {
232		}	232		}
233		<tr class="hunk"><td colspan="4">{ h.Header }</td></tr>	233		<tr class="hunk"><td colspan="4">{ h.Header }</td></tr>
234		for _, ln := range h.Lines {	234		for _, ln := range h.Lines {
235	-	<tr class={ ln.Kind }>	235	+	<tr class={ ln.Kind, templ.KV("sel", ln.Selected) }>
236		<td class="ln">@gutter(ln.Old, ln.OldHref)</td>	236		<td class="ln">@gutter(ln.Old, ln.OldHref)</td>
237		<td class="ln">@gutter(ln.New, ln.NewHref)</td>	237		<td class="ln">@gutter(ln.New, ln.NewHref)</td>
238		<td class="m">{ ln.Mark }</td>	238		<td class="m">{ ln.Mark }</td>

@@ -369,15 +369,15 @@ templ splitSide(ln *DiffLine, old bool) {
369		<td class="m none"></td>	369		<td class="m none"></td>
370		<td class="tx none"></td>	370		<td class="tx none"></td>
371		} else {	371		} else {
372	-	<td class={ "ln", ln.Kind }>	372	+	<td class={ "ln", ln.Kind, templ.KV("sel", ln.Selected) }>
373		if old {	373		if old {
374		@gutter(ln.Old, ln.OldHref)	374		@gutter(ln.Old, ln.OldHref)
375		} else {	375		} else {
376		@gutter(ln.New, ln.NewHref)	376		@gutter(ln.New, ln.NewHref)
377		}	377		}
378		</td>	378		</td>
379	-	<td class={ "m", ln.Kind }>{ ln.Mark }</td>	379	+	<td class={ "m", ln.Kind, templ.KV("sel", ln.Selected) }>{ ln.Mark }</td>
380	-	<td class={ "tx", "chroma", ln.Kind }>@codeLine(*ln)</td>	380	+	<td class={ "tx", "chroma", ln.Kind, templ.KV("sel", ln.Selected) }>@codeLine(*ln)</td>
381		}	381		}
382		}	382		}
383			383

M internal/adapters/web/diff_templ.go +5 -5 generated file: collapsed

load diff

M internal/adapters/web/fragments.go +7 -1


@@ -58,7 +58,7 @@ func liveEvent(we ports.WatchEvent) bool {
58	58		}
59	59		switch we.Event.(type) {
60	60		case domain.RepoCreated, domain.RepoUpdated, domain.RepoDeleted, domain.PushEvent,
61		-	domain.MergeRequestOpened, domain.MergeRequestMerged, domain.MergeRequestClosed, domain.MergeRequestReady, domain.CommentAdded,
	61	+	domain.MergeRequestOpened, domain.MergeRequestMerged, domain.MergeRequestClosed, domain.MergeRequestReady, domain.CommentAdded, domain.CommentEdited, domain.CommentDeleted, domain.CommentResolved,
62	62		domain.RunUpdated, domain.JobUpdated:
63	63		return true
64	64		}

@@ -164,6 +164,12 @@ func (l *liveStream) repoPage(ctx context.Context, we ports.WatchEvent) ([]fragm
164	164		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request was closed — reload")
165	165		case domain.MergeRequestReady:
166	166		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request is ready for review — reload")
	167	+	case domain.CommentEdited:
	168	+	return l.mrNotice(ctx, ev.Number, "a note was edited — reload")
	169	+	case domain.CommentDeleted:
	170	+	return l.mrNotice(ctx, ev.Number, "a note was deleted — reload")
	171	+	case domain.CommentResolved:
	172	+	return l.mrNotice(ctx, ev.Number, "a thread was resolved — reload")
167	173		case domain.CommentAdded:
168	174		return l.mrNotice(ctx, ev.Number, "a comment was added — reload")
169	175		case domain.PushEvent:

 	}
 	switch we.Event.(type) {
 	case domain.RepoCreated, domain.RepoUpdated, domain.RepoDeleted, domain.PushEvent,
-		domain.MergeRequestOpened, domain.MergeRequestMerged, domain.MergeRequestClosed, domain.MergeRequestReady, domain.CommentAdded,
+		domain.MergeRequestOpened, domain.MergeRequestMerged, domain.MergeRequestClosed, domain.MergeRequestReady, domain.CommentAdded, domain.CommentEdited, domain.CommentDeleted, domain.CommentResolved,
 		domain.RunUpdated, domain.JobUpdated:
 		return true
 	}
 		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request was closed — reload")
 	case domain.MergeRequestReady:
 		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request is ready for review — reload")
+	case domain.CommentEdited:
+		return l.mrNotice(ctx, ev.Number, "a note was edited — reload")
+	case domain.CommentDeleted:
+		return l.mrNotice(ctx, ev.Number, "a note was deleted — reload")
+	case domain.CommentResolved:
+		return l.mrNotice(ctx, ev.Number, "a thread was resolved — reload")
 	case domain.CommentAdded:
 		return l.mrNotice(ctx, ev.Number, "a comment was added — reload")
 	case domain.PushEvent:

M internal/adapters/web/jstest/mr.test.mjs +56 -0


@@ -36,3 +36,59 @@ test('step: stays in the list', () => {
36	36		assert.equal(C.step(-1, -1, 3), 2);
37	37		assert.equal(C.step(0, 1, 0), -1);
38	38		});
	39	+
	40	+	test('rangeURL requires the same file, side and MR and sorts endpoints', () => {
	41	+	const base = 'https://forge.test/demo/merge-requests/1';
	42	+	const a = base+'?on=new:24:dir%2Fa.go#f1';
	43	+	const b = base+'?from=25&on=new:10:dir%2Fa.go#f1';
	44	+	const u = new URL(C.rangeURL(a,b,base));
	45	+	assert.equal(u.searchParams.get('on'),'new:10-24:dir/a.go');
	46	+	assert.equal(u.searchParams.get('from'),'25');
	47	+	assert.equal(u.hash,'#f1');
	48	+	assert.equal(C.rangeURL(a,a,base),null);
	49	+	assert.equal(C.rangeURL(a,b.replace('new:','old:'),base),null);
	50	+	assert.equal(C.rangeURL(a,b.replace('a.go','b.go'),base),null);
	51	+	assert.equal(C.rangeURL(a,b.replace('/1?','/2?'),base),null);
	52	+	});
	53	+
	54	+	test('quote opens the thread reply and prefills and focuses its textarea', () => {
	55	+	let focused=false;
	56	+	const field={value:'',focus(){focused=true;}};
	57	+	const details={open:false,querySelector(){return field;}};
	58	+	const thread={querySelector(){return details;}};
	59	+	const button={dataset:{quote:'> source\n\n^2 '},closest(){return {closest(){return thread;}};}};
	60	+	assert.equal(C.quote(button),true);
	61	+	assert.equal(details.open,true);
	62	+	assert.equal(field.value,'> source\n\n^2 ');
	63	+	assert.equal(focused,true);
	64	+	});
	65	+
	66	+	for (const dataset of [{diff:'split'}, {view:'split'}]) test(`reveal selects the split note (${JSON.stringify(dataset)}), including after lazy loading`, async () => {
	67	+	const saved = globalThis.document;
	68	+	const savedRAF = globalThis.requestAnimationFrame;
	69	+	let scrolled = '';
	70	+	const details = {open:false};
	71	+	const node = id => ({id, querySelector(){return null;}, closest(){return details;}, scrollIntoView(){scrolled=id;}});
	72	+	const nodes = new Map([['c12',node('c12')],['c12-s',node('c12-s')]]);
	73	+	const ph = {dataset:{notes:'c12'}};
	74	+	globalThis.document = {
	75	+	querySelector: sel => sel === '#diffs' ? {dataset} : null,
	76	+	querySelectorAll: () => [ph],
	77	+	getElementById: id => nodes.get(id),
	78	+	};
	79	+	globalThis.requestAnimationFrame = fn => fn();
	80	+	try {
	81	+	assert.equal(window.ermiteMR.reveal('c12'),false);
	82	+	assert.equal(scrolled,'c12-s');
	83	+	assert.equal(details.open,true);
	84	+	nodes.clear(); scrolled=''; details.open=false;
	85	+	assert.equal(window.ermiteMR.reveal('c12'),true);
	86	+	nodes.set('c12',node('c12')); nodes.set('c12-s',node('c12-s'));
	87	+	await Promise.resolve();
	88	+	assert.equal(scrolled,'c12-s');
	89	+	assert.equal(details.open,true);
	90	+	} finally {
	91	+	globalThis.document=saved;
	92	+	globalThis.requestAnimationFrame=savedRAF;
	93	+	}
	94	+	});


@@ -36,3 +36,59 @@ test('step: stays in the list', () => {
36	assert.equal(C.step(-1, -1, 3), 2);	36		assert.equal(C.step(-1, -1, 3), 2);
37	assert.equal(C.step(0, 1, 0), -1);	37		assert.equal(C.step(0, 1, 0), -1);
38	});	38		});
		39	+
		40	+	test('rangeURL requires the same file, side and MR and sorts endpoints', () => {
		41	+	const base = 'https://forge.test/demo/merge-requests/1';
		42	+	const a = base+'?on=new:24:dir%2Fa.go#f1';
		43	+	const b = base+'?from=25&on=new:10:dir%2Fa.go#f1';
		44	+	const u = new URL(C.rangeURL(a,b,base));
		45	+	assert.equal(u.searchParams.get('on'),'new:10-24:dir/a.go');
		46	+	assert.equal(u.searchParams.get('from'),'25');
		47	+	assert.equal(u.hash,'#f1');
		48	+	assert.equal(C.rangeURL(a,a,base),null);
		49	+	assert.equal(C.rangeURL(a,b.replace('new:','old:'),base),null);
		50	+	assert.equal(C.rangeURL(a,b.replace('a.go','b.go'),base),null);
		51	+	assert.equal(C.rangeURL(a,b.replace('/1?','/2?'),base),null);
		52	+	});
		53	+
		54	+	test('quote opens the thread reply and prefills and focuses its textarea', () => {
		55	+	let focused=false;
		56	+	const field={value:'',focus(){focused=true;}};
		57	+	const details={open:false,querySelector(){return field;}};
		58	+	const thread={querySelector(){return details;}};
		59	+	const button={dataset:{quote:'> source\n\n^2 '},closest(){return {closest(){return thread;}};}};
		60	+	assert.equal(C.quote(button),true);
		61	+	assert.equal(details.open,true);
		62	+	assert.equal(field.value,'> source\n\n^2 ');
		63	+	assert.equal(focused,true);
		64	+	});
		65	+
		66	+	for (const dataset of [{diff:'split'}, {view:'split'}]) test(`reveal selects the split note (${JSON.stringify(dataset)}), including after lazy loading`, async () => {
		67	+	const saved = globalThis.document;
		68	+	const savedRAF = globalThis.requestAnimationFrame;
		69	+	let scrolled = '';
		70	+	const details = {open:false};
		71	+	const node = id => ({id, querySelector(){return null;}, closest(){return details;}, scrollIntoView(){scrolled=id;}});
		72	+	const nodes = new Map([['c12',node('c12')],['c12-s',node('c12-s')]]);
		73	+	const ph = {dataset:{notes:'c12'}};
		74	+	globalThis.document = {
		75	+	querySelector: sel => sel === '#diffs' ? {dataset} : null,
		76	+	querySelectorAll: () => [ph],
		77	+	getElementById: id => nodes.get(id),
		78	+	};
		79	+	globalThis.requestAnimationFrame = fn => fn();
		80	+	try {
		81	+	assert.equal(window.ermiteMR.reveal('c12'),false);
		82	+	assert.equal(scrolled,'c12-s');
		83	+	assert.equal(details.open,true);
		84	+	nodes.clear(); scrolled=''; details.open=false;
		85	+	assert.equal(window.ermiteMR.reveal('c12'),true);
		86	+	nodes.set('c12',node('c12')); nodes.set('c12-s',node('c12-s'));
		87	+	await Promise.resolve();
		88	+	assert.equal(scrolled,'c12-s');
		89	+	assert.equal(details.open,true);
		90	+	} finally {
		91	+	globalThis.document=saved;
		92	+	globalThis.requestAnimationFrame=savedRAF;
		93	+	}
		94	+	});

M internal/adapters/web/markdown.go +79 -0


@@ -7,6 +7,8 @@ import (
7	7		"html/template"
8	8		"net/url"
9	9		"path"
	10	+	"regexp"
	11	+	"strconv"
10	12		"strings"
11	13
12	14		"github.com/yuin/goldmark"

@@ -62,10 +64,40 @@ func (m *markdown) render(source []byte, repo, ref, dir string) (template.HTML,
62	64		// #fragment links chosen, so that several documents on one page (the summaries
63	65		// of a run) do not share ids.
64	66		func (m *markdown) renderWithIDs(source []byte, repo, ref, dir, idPrefix string) (template.HTML, []Heading, error) {
	67	+	return m.renderDocument(source, repo, ref, dir, idPrefix, nil)
	68	+	}
	69	+
	70	+	// renderNote uses the repository Markdown policy, then adds local note links.
	71	+	func (m *markdown) renderNote(source []byte, repo, ref, idPrefix string, notes func(int64) bool) (template.HTML, error) {
	72	+	h, _, err := m.renderDocument(source, repo, ref, "", idPrefix, notes)
	73	+	return h, err
	74	+	}
	75	+
	76	+	func (m *markdown) renderDocument(source []byte, repo, ref, dir, idPrefix string, notes func(int64) bool) (template.HTML, []Heading, error) {
65	77		pc := parser.NewContext(parser.WithIDs(&prefixedIDs{prefix: idPrefix, inner: parser.NewContext().IDs()}))
66	78		doc := m.md.Parser().Parse(text.NewReader(source), parser.WithContext(pc))
67	79		pol := linkPolicy{repo: repo, ref: ref, dir: dir, source: source, idPrefix: idPrefix}
	80	+	// Collect eligible text before the policy unwraps rejected links: their
	81	+	// labels must not accidentally become references either.
	82	+	var refs []*ast.Text
	83	+	if notes != nil {
	84	+	_ = ast.Walk(doc, func(n ast.Node, entering bool) (ast.WalkStatus, error) {
	85	+	if !entering {
	86	+	return ast.WalkContinue, nil
	87	+	}
	88	+	switch n := n.(type) {
	89	+	case ast.CodeSpan, ast.Link, ast.AutoLink, ast.Image, ast.CodeBlock, ast.FencedCodeBlock:
	90	+	return ast.WalkSkipChildren, nil
	91	+	case *ast.Text:
	92	+	refs = append(refs, n)
	93	+	}
	94	+	return ast.WalkContinue, nil
	95	+	})
	96	+	}
68	97		pol.apply(doc)
	98	+	for _, t := range refs {
	99	+	noteReferences(t, source, notes)
	100	+	}
69	101
70	102		var buf bytes.Buffer
71	103		if err := m.md.Renderer().Render(&buf, source, doc); err != nil {

@@ -291,3 +323,50 @@ func (altRenderer) RegisterFuncs(r renderer.NodeRendererFuncRegisterer) {
291	323		return ast.WalkContinue, nil
292	324		})
293	325		}
	326	+
	327	+	var noteReferencePattern = regexp.MustCompile(`(^\|[^0-9A-Za-z_^])\^([1-9][0-9]{0,5})\b`)
	328	+
	329	+	// noteReferences changes only text segments; code and link labels never enter
	330	+	// this function. New fragment links deliberately bypass heading-prefix rewriting.
	331	+	func noteReferences(t *ast.Text, source []byte, exists func(int64) bool) {
	332	+	parent := t.Parent()
	333	+	if parent == nil {
	334	+	return
	335	+	}
	336	+	value := t.Value(source)
	337	+	offset := 0
	338	+	for _, match := range noteReferencePattern.FindAllSubmatchIndex(value, -1) {
	339	+	id := string(value[match[4]:match[5]])
	340	+	n, err := strconv.ParseInt(id, 10, 64)
	341	+	if err != nil \|\| !exists(n) {
	342	+	continue
	343	+	}
	344	+	start := match[4] - 1
	345	+	// Markdown punctuation may split adjacent text into separate AST nodes.
	346	+	// Check the original preceding byte as well as the segment-local regex.
	347	+	if at := t.Segment.Start + start; at > 0 {
	348	+	prev := source[at-1]
	349	+	if prev >= '0' && prev <= '9' \|\| prev >= 'A' && prev <= 'Z' \|\| prev >= 'a' && prev <= 'z' \|\| prev == '_' \|\| prev == '^' {
	350	+	continue
	351	+	}
	352	+	}
	353	+	if start > offset {
	354	+	parent.InsertBefore(parent, t, ast.NewTextSegment(text.NewSegment(t.Segment.Start+offset, t.Segment.Start+start)))
	355	+	}
	356	+	link := ast.NewLink()
	357	+	link.Destination = []byte("#c" + id)
	358	+	link.Title = []byte("note " + id)
	359	+	link.SetAttributeString("class", []byte("ref"))
	360	+	link.AppendChild(link, ast.NewString(value[start:match[5]]))
	361	+	parent.InsertBefore(parent, t, link)
	362	+	offset = match[5]
	363	+	}
	364	+	if offset == 0 {
	365	+	return
	366	+	}
	367	+	tail := ast.NewTextSegment(text.NewSegment(t.Segment.Start+offset, t.Segment.Stop))
	368	+	tail.SetSoftLineBreak(t.SoftLineBreak())
	369	+	tail.SetHardLineBreak(t.HardLineBreak())
	370	+	parent.InsertBefore(parent, t, tail)
	371	+	parent.RemoveChild(parent, t)
	372	+	}


@@ -7,6 +7,8 @@ import (
7	"html/template"	7		"html/template"
8	"net/url"	8		"net/url"
9	"path"	9		"path"
		10	+	"regexp"
		11	+	"strconv"
10	"strings"	12		"strings"
11		13
12	"github.com/yuin/goldmark"	14		"github.com/yuin/goldmark"

@@ -62,10 +64,40 @@ func (m *markdown) render(source []byte, repo, ref, dir string) (template.HTML,
62	// #fragment links chosen, so that several documents on one page (the summaries	64		// #fragment links chosen, so that several documents on one page (the summaries
63	// of a run) do not share ids.	65		// of a run) do not share ids.
64	func (m *markdown) renderWithIDs(source []byte, repo, ref, dir, idPrefix string) (template.HTML, []Heading, error) {	66		func (m *markdown) renderWithIDs(source []byte, repo, ref, dir, idPrefix string) (template.HTML, []Heading, error) {
		67	+	return m.renderDocument(source, repo, ref, dir, idPrefix, nil)
		68	+	}
		69	+
		70	+	// renderNote uses the repository Markdown policy, then adds local note links.
		71	+	func (m *markdown) renderNote(source []byte, repo, ref, idPrefix string, notes func(int64) bool) (template.HTML, error) {
		72	+	h, _, err := m.renderDocument(source, repo, ref, "", idPrefix, notes)
		73	+	return h, err
		74	+	}
		75	+
		76	+	func (m *markdown) renderDocument(source []byte, repo, ref, dir, idPrefix string, notes func(int64) bool) (template.HTML, []Heading, error) {
65	pc := parser.NewContext(parser.WithIDs(&prefixedIDs{prefix: idPrefix, inner: parser.NewContext().IDs()}))	77		pc := parser.NewContext(parser.WithIDs(&prefixedIDs{prefix: idPrefix, inner: parser.NewContext().IDs()}))
66	doc := m.md.Parser().Parse(text.NewReader(source), parser.WithContext(pc))	78		doc := m.md.Parser().Parse(text.NewReader(source), parser.WithContext(pc))
67	pol := linkPolicy{repo: repo, ref: ref, dir: dir, source: source, idPrefix: idPrefix}	79		pol := linkPolicy{repo: repo, ref: ref, dir: dir, source: source, idPrefix: idPrefix}
		80	+	// Collect eligible text before the policy unwraps rejected links: their
		81	+	// labels must not accidentally become references either.
		82	+	var refs []*ast.Text
		83	+	if notes != nil {
		84	+	_ = ast.Walk(doc, func(n ast.Node, entering bool) (ast.WalkStatus, error) {
		85	+	if !entering {
		86	+	return ast.WalkContinue, nil
		87	+	}
		88	+	switch n := n.(type) {
		89	+	case ast.CodeSpan, ast.Link, ast.AutoLink, ast.Image, ast.CodeBlock, ast.FencedCodeBlock:
		90	+	return ast.WalkSkipChildren, nil
		91	+	case *ast.Text:
		92	+	refs = append(refs, n)
		93	+	}
		94	+	return ast.WalkContinue, nil
		95	+	})
		96	+	}
68	pol.apply(doc)	97		pol.apply(doc)
		98	+	for _, t := range refs {
		99	+	noteReferences(t, source, notes)
		100	+	}
69		101
70	var buf bytes.Buffer	102		var buf bytes.Buffer
71	if err := m.md.Renderer().Render(&buf, source, doc); err != nil {	103		if err := m.md.Renderer().Render(&buf, source, doc); err != nil {

@@ -291,3 +323,50 @@ func (altRenderer) RegisterFuncs(r renderer.NodeRendererFuncRegisterer) {
291	return ast.WalkContinue, nil	323		return ast.WalkContinue, nil
292	})	324		})
293	}	325		}
		326	+
		327	+	var noteReferencePattern = regexp.MustCompile(`(^\|[^0-9A-Za-z_^])\^([1-9][0-9]{0,5})\b`)
		328	+
		329	+	// noteReferences changes only text segments; code and link labels never enter
		330	+	// this function. New fragment links deliberately bypass heading-prefix rewriting.
		331	+	func noteReferences(t *ast.Text, source []byte, exists func(int64) bool) {
		332	+	parent := t.Parent()
		333	+	if parent == nil {
		334	+	return
		335	+	}
		336	+	value := t.Value(source)
		337	+	offset := 0
		338	+	for _, match := range noteReferencePattern.FindAllSubmatchIndex(value, -1) {
		339	+	id := string(value[match[4]:match[5]])
		340	+	n, err := strconv.ParseInt(id, 10, 64)
		341	+	if err != nil \|\| !exists(n) {
		342	+	continue
		343	+	}
		344	+	start := match[4] - 1
		345	+	// Markdown punctuation may split adjacent text into separate AST nodes.
		346	+	// Check the original preceding byte as well as the segment-local regex.
		347	+	if at := t.Segment.Start + start; at > 0 {
		348	+	prev := source[at-1]
		349	+	if prev >= '0' && prev <= '9' \|\| prev >= 'A' && prev <= 'Z' \|\| prev >= 'a' && prev <= 'z' \|\| prev == '_' \|\| prev == '^' {
		350	+	continue
		351	+	}
		352	+	}
		353	+	if start > offset {
		354	+	parent.InsertBefore(parent, t, ast.NewTextSegment(text.NewSegment(t.Segment.Start+offset, t.Segment.Start+start)))
		355	+	}
		356	+	link := ast.NewLink()
		357	+	link.Destination = []byte("#c" + id)
		358	+	link.Title = []byte("note " + id)
		359	+	link.SetAttributeString("class", []byte("ref"))
		360	+	link.AppendChild(link, ast.NewString(value[start:match[5]]))
		361	+	parent.InsertBefore(parent, t, link)
		362	+	offset = match[5]
		363	+	}
		364	+	if offset == 0 {
		365	+	return
		366	+	}
		367	+	tail := ast.NewTextSegment(text.NewSegment(t.Segment.Start+offset, t.Segment.Stop))
		368	+	tail.SetSoftLineBreak(t.SoftLineBreak())
		369	+	tail.SetHardLineBreak(t.HardLineBreak())
		370	+	parent.InsertBefore(parent, t, tail)
		371	+	parent.RemoveChild(parent, t)
		372	+	}

M internal/adapters/web/markdown_test.go +29 -0


@@ -136,3 +136,32 @@ func TestMarkdownGFM(t *testing.T) {
136	136		assert.Contains(t, out, "<del>gone</del>")
137	137		assert.Contains(t, out, `type="checkbox"`)
138	138		}
	139	+
	140	+	func TestNoteMarkdown(t *testing.T) {
	141	+	t.Parallel()
	142	+	tests := []struct {
	143	+	source string
	144	+	links int
	145	+	}{
	146	+	{"^2 ^99 a^2 _^2 ^^2 1^2", 1},
	147	+	{"`^2` [^2](https://example.org) [^2](javascript:alert(1))", 0},
	148	+	{"```\n^2\n```", 0},
	149	+	{"^2, ^2\n^2", 3},
	150	+	}
	151	+	for _, tt := range tests {
	152	+	t.Run(tt.source, func(t *testing.T) {
	153	+	t.Parallel()
	154	+	h, err := newMarkdown().renderNote([]byte(tt.source), "demo", "main", "c1-", func(n int64) bool { return n == 2 })
	155	+	require.NoError(t, err)
	156	+	assert.Equal(t, tt.links, strings.Count(string(h), `href="#c2"`), string(h))
	157	+	assert.NotContains(t, string(h), `href="#c99"`)
	158	+	assert.NotContains(t, string(h), "javascript:")
	159	+	})
	160	+	}
	161	+	h, err := newMarkdown().renderNote([]byte("# Heading\n\n<script>alert(1)</script>\n\nbold ^2"), "demo", "main", "c1-", func(n int64) bool { return n == 2 })
	162	+	require.NoError(t, err)
	163	+	assert.Contains(t, string(h), `id="c1-heading"`)
	164	+	assert.Contains(t, string(h), "<strong>bold</strong>")
	165	+	assert.NotContains(t, string(h), "<script")
	166	+	assert.Contains(t, string(h), `title="note 2"`)
	167	+	}


@@ -136,3 +136,32 @@ func TestMarkdownGFM(t *testing.T) {
136	assert.Contains(t, out, "<del>gone</del>")	136		assert.Contains(t, out, "<del>gone</del>")
137	assert.Contains(t, out, `type="checkbox"`)	137		assert.Contains(t, out, `type="checkbox"`)
138	}	138		}
		139	+
		140	+	func TestNoteMarkdown(t *testing.T) {
		141	+	t.Parallel()
		142	+	tests := []struct {
		143	+	source string
		144	+	links int
		145	+	}{
		146	+	{"^2 ^99 a^2 _^2 ^^2 1^2", 1},
		147	+	{"`^2` [^2](https://example.org) [^2](javascript:alert(1))", 0},
		148	+	{"```\n^2\n```", 0},
		149	+	{"^2, ^2\n^2", 3},
		150	+	}
		151	+	for _, tt := range tests {
		152	+	t.Run(tt.source, func(t *testing.T) {
		153	+	t.Parallel()
		154	+	h, err := newMarkdown().renderNote([]byte(tt.source), "demo", "main", "c1-", func(n int64) bool { return n == 2 })
		155	+	require.NoError(t, err)
		156	+	assert.Equal(t, tt.links, strings.Count(string(h), `href="#c2"`), string(h))
		157	+	assert.NotContains(t, string(h), `href="#c99"`)
		158	+	assert.NotContains(t, string(h), "javascript:")
		159	+	})
		160	+	}
		161	+	h, err := newMarkdown().renderNote([]byte("# Heading\n\n<script>alert(1)</script>\n\nbold ^2"), "demo", "main", "c1-", func(n int64) bool { return n == 2 })
		162	+	require.NoError(t, err)
		163	+	assert.Contains(t, string(h), `id="c1-heading"`)
		164	+	assert.Contains(t, string(h), "<strong>bold</strong>")
		165	+	assert.NotContains(t, string(h), "<script")
		166	+	assert.Contains(t, string(h), `title="note 2"`)
		167	+	}

M internal/adapters/web/mr.go +129 -25


@@ -101,13 +101,19 @@ type MRListPage struct {
101	101
102	102		// CommentView is a comment of a merge request, ready to show.
103	103		type CommentView struct {
104		-	ID string
105		-	Author string
106		-	When string
107		-	WhenAt string
108		-	Abs string
109		-	Parts []TextPart
110		-	Resolved bool
	104	+	ID string
	105	+	Author string
	106	+	When string
	107	+	WhenAt string
	108	+	Abs string
	109	+	Body, BodySplit template.HTML
	110	+	Replies []CommentView
	111	+	Edited, Deleted bool
	112	+	Verdict, Range, Quote string
	113	+	Edit *EditForm
	114	+	Delete *DeleteForm
	115	+	Reply *CommentForm
	116	+	Resolved bool
111	117		// Outdated is true when the head moved since the comment was written, so
112	118		// its line may have moved too.
113	119		Outdated bool

@@ -119,6 +125,19 @@ type CommentView struct {
119	125		Resolve *ResolveForm
120	126		}
121	127
	128	+	type EditForm struct {
	129	+	Action, Text string
	130	+	From int
	131	+	}
	132	+	type DeleteForm struct {
	133	+	Action string
	134	+	From int
	135	+	}
	136	+	type VerdictView struct {
	137	+	Author, Label, Href, Short string
	138	+	Stale bool
	139	+	}
	140	+
122	141		// ResolveForm is the POST that changes the resolved state of a comment.
123	142		type ResolveForm struct {
124	143		Action string

@@ -135,9 +154,10 @@ type CommentForm struct {
135	154		Action string
136	155		Title string
137	156		// Path, Line and Side designate the line; empty for a general comment.
138		-	Path, Line, Side string
139		-	Cancel string
140		-	Focus bool
	157	+	Path, Line, Side string
	158	+	StartLine, ReplyTo string
	159	+	Cancel string
	160	+	Focus bool
141	161		// From is the window of the page the form is on (see mrWindow), sent
142	162		// back so that the answer returns to it; 0 for the first.
143	163		From int

@@ -192,6 +212,7 @@ type MRPage struct {
192	212		State string
193	213		Open bool
194	214		Signed bool
	215	+	NoteAuthor string
195	216		Source, Target string
196	217		SourceHref string
197	218		TargetHref string

@@ -226,6 +247,7 @@ type MRPage struct {
226	247		NComments int
227	248		NUnresolved int
228	249		GeneralForm *CommentForm
	250	+	Verdicts []VerdictView
229	251
230	252		Commits []MRCommit
231	253		CommitsNote string

@@ -471,7 +493,7 @@ func (s Server) mrPage(ctx context.Context, r http.Request, since bool) (templ
471	493
472	494		p := MRPage{
473	495		Number: "#" + strconv.FormatInt(n, 10), Title: visibleText(m.Title.String()),
474		-	State: mrStateName(m), Open: open, Signed: signed,
	496	+	State: mrStateName(m), Open: open, Signed: signed, NoteAuthor: domain.AuthorName(principal(ctx)),
475	497		Source: visibleText(m.Source), Target: visibleText(m.Target),
476	498		Author: s.who(m.Author),
477	499		Head: head, HeadShort: short(head),

@@ -485,12 +507,15 @@ func (s Server) mrPage(ctx context.Context, r http.Request, since bool) (templ
485	507		// Relative links point into the source branch as it is now (its head
486	508		// commit); the heading ids carry their own prefix, apart from the
487	509		// ids of the diff.
488		-	h, _, err := s.md.renderWithIDs([]byte(desc), d.name(), head, "", "mr-desc-")
	510	+	h, err := s.md.renderNote([]byte(desc), d.name(), head, "mr-desc-", noteIDs(res.Comments))
489	511		if err != nil {
490	512		return nil, 0, err
491	513		}
492	514		p.Desc = h
493	515		}
	516	+	for _, v := range res.Verdicts {
	517	+	p.Verdicts = append(p.Verdicts, VerdictView{Author: s.who(v.Author), Label: v.Verdict.String(), Stale: v.Stale, Href: "#c" + strconv.FormatInt(v.CommentID, 10), Short: short(v.CommitID.String())})
	518	+	}
494	519		p.Opened.Name = p.Author
495	520		p.Opened.When, p.Opened.WhenAt = whenOf(now, m.CreatedAt)
496	521		if !m.CreatedAt.IsZero() {

@@ -684,9 +709,10 @@ func shellWord(s string) string {
684	709		// lineRef designates a line of the diff in the query of the comment form:
685	710		// "?on=new:12:path/to/file".
686	711		type lineRef struct {
687		-	side string
688		-	line int
689		-	path string
	712	+	side string
	713	+	line int
	714	+	start int
	715	+	path string
690	716		}
691	717
692	718		func parseOn(s string) *lineRef {

@@ -695,11 +721,21 @@ func parseOn(s string) *lineRef {
695	721		return nil
696	722		}
697	723		num, path, ok := strings.Cut(rest, ":")
	724	+	start := 0
	725	+	if a, b, rangeOK := strings.Cut(num, "-"); rangeOK {
	726	+	var e error
	727	+	start, e = strconv.Atoi(a)
	728	+	end, e2 := strconv.Atoi(b)
	729	+	if e != nil \|\| e2 != nil \|\| start < 1 \|\| start >= end {
	730	+	return nil
	731	+	}
	732	+	num = b
	733	+	}
698	734		line, err := strconv.Atoi(num)
699	735		if !ok \|\| err != nil \|\| line < 1 \|\| path == "" {
700	736		return nil
701	737		}
702		-	return &lineRef{side: side, line: line, path: path}
	738	+	return &lineRef{side: side, line: line, start: start, path: path}
703	739		}
704	740
705	741		// placeComments puts every comment under its line when the diff shown has it,

@@ -757,21 +793,66 @@ func (s Server) placeComments(p MRPage, repo string, n int64, comments []domai
757	793		return index[lineKey{path, side, line}]
758	794		}
759	795
	796	+	exists := noteIDs(comments)
	797	+	children := map[int64][]domain.Comment{}
760	798		for _, c := range comments {
	799	+	if c.ReplyTo != 0 && !c.Deleted {
	800	+	children[c.ReplyTo] = append(children[c.ReplyTo], c)
	801	+	}
	802	+	if !c.Deleted {
	803	+	p.NComments++
	804	+	}
	805	+	if c.ReplyTo == 0 && !c.Deleted && !c.Resolved {
	806	+	p.NUnresolved++
	807	+	}
	808	+	}
	809	+	var view func(domain.Comment, bool) CommentView
	810	+	view = func(c domain.Comment, replyable bool) CommentView {
761	811		cid := strconv.FormatInt(c.ID, 10)
762		-	v := CommentView{
763		-	ID: cid, Author: s.who(c.Author),
764		-	Parts: plainParts(c.Text.String()), Resolved: c.Resolved,
765		-	Outdated: !c.CommitID.IsZero() && c.CommitID.String() != head,
	812	+	body, err := s.md.renderNote([]byte(c.Text.String()), repo, head, "c"+cid+"-", exists)
	813	+	if err != nil {
	814	+	body = ""
766	815		}
	816	+	bodySplit, err := s.md.renderNote([]byte(c.Text.String()), repo, head, "c"+cid+"s-", exists)
	817	+	if err != nil {
	818	+	bodySplit = ""
	819	+	}
	820	+	v := CommentView{BodySplit: bodySplit, ID: cid, Author: s.who(c.Author), Body: body, Resolved: c.Resolved, Deleted: c.Deleted, Edited: !c.EditedAt.IsZero(), Verdict: c.Verdict.String(), Outdated: !c.CommitID.IsZero() && c.CommitID.String() != head}
767	821		v.When, v.WhenAt = whenOf(now, c.CreatedAt)
768	822		if !c.CreatedAt.IsZero() {
769	823		v.Abs = absolute(c.CreatedAt)
770	824		}
771		-	p.NComments++
772		-	if !c.Resolved {
773		-	p.NUnresolved++
	825	+	if c.StartLine > 0 {
	826	+	v.Range = "lines " + itoa(c.StartLine) + "–" + itoa(c.Line)
774	827		}
	828	+	if canWrite && !c.Deleted {
	829	+	from := windowStart(fileAt[c.Path])
	830	+	root := cid
	831	+	if c.ReplyTo != 0 {
	832	+	root = strconv.FormatInt(c.ReplyTo, 10)
	833	+	}
	834	+	if replyable {
	835	+	v.Quote = "> " + strings.ReplaceAll(c.Text.String(), "\n", "\n> ") + "\n\n^" + cid + " "
	836	+	}
	837	+	if c.ReplyTo == 0 {
	838	+	v.Reply = &CommentForm{ID: "reply-" + cid, Action: mrHref(repo, n, "comments"), Title: "Reply", ReplyTo: root, From: from}
	839	+	}
	840	+	if c.Author == p.NoteAuthor {
	841	+	v.Edit = &EditForm{Action: mrHref(repo, n, "comments", cid, "edit"), Text: c.Text.String(), From: from}
	842	+	v.Delete = &DeleteForm{Action: mrHref(repo, n, "comments", cid, "delete"), From: from}
	843	+	}
	844	+	}
	845	+	for _, reply := range children[c.ID] {
	846	+	v.Replies = append(v.Replies, view(reply, replyable))
	847	+	}
	848	+	return v
	849	+	}
	850	+	for _, c := range comments {
	851	+	if c.ReplyTo != 0 \|\| c.Deleted && c.Verdict == domain.VerdictNone && len(children[c.ID]) == 0 {
	852	+	continue
	853	+	}
	854	+	cid := strconv.FormatInt(c.ID, 10)
	855	+	v := view(c, canWrite && !c.Deleted)
775	856		general := c.Path == ""
776	857		fi, listed := fileAt[c.Path]
777	858		if !general && listed && p.Files[fi].Lazy {

@@ -789,7 +870,7 @@ func (s Server) placeComments(p MRPage, repo string, n int64, comments []domai
789	870		v.Where = visibleText(c.Path) + ":" + itoa(c.Line) + " (" + side + ")"
790	871		}
791	872		}
792		-	if canWrite {
	873	+	if canWrite && !c.Deleted {
793	874		v.Resolve = &ResolveForm{Action: resolveAction(cid), Value: !c.Resolved, Label: "Resolve"}
794	875		if !general && listed {
795	876		v.Resolve.From = windowStart(fi)

@@ -815,9 +896,18 @@ func (s Server) placeComments(p MRPage, repo string, n int64, comments []domai
815	896		if on.side == "old" {
816	897		side = domain.SideOld
817	898		}
	899	+	start := on.start
	900	+	if start == 0 {
	901	+	start = on.line
	902	+	}
	903	+	for key, ln := range index {
	904	+	if key.path == on.path && key.side == side && key.line >= start && key.line <= on.line {
	905	+	ln.Selected = true
	906	+	}
	907	+	}
818	908		if ln := find(on.path, side, on.line); ln != nil {
819	909		ln.Form = &CommentForm{
820		-	ID: "cf-line", Action: mrHref(repo, n, "comments"), Path: on.path, Line: itoa(on.line), Side: on.side,
	910	+	StartLine: optionalLine(on.start), ID: "cf-line", Action: mrHref(repo, n, "comments"), Path: on.path, Line: itoa(on.line), Side: on.side,
821	911		Title: "comment on " + visibleText(on.path) + ":" + itoa(on.line) + " (" + on.side + ")",
822	912		Cancel: withFrom(self, windowStart(fileAt[on.path])) + "#" + fileIDs[on.path], Focus: true,
823	913		From: windowStart(fileAt[on.path]),

@@ -842,3 +932,17 @@ func userText(parts []TextPart) templ.Component {
842	932		return err
843	933		})
844	934		}
	935	+
	936	+	func noteIDs(comments []domain.Comment) func(int64) bool {
	937	+	ids := make(map[int64]bool, len(comments))
	938	+	for _, c := range comments {
	939	+	ids[c.ID] = true
	940	+	}
	941	+	return func(n int64) bool { return ids[n] }
	942	+	}
	943	+	func optionalLine(n int) string {
	944	+	if n == 0 {
	945	+	return ""
	946	+	}
	947	+	return itoa(n)
	948	+	}

 // CommentView is a comment of a merge request, ready to show.
 type CommentView struct {
-	ID       string
+	ID                    string
-	Author   string
+	Author                string
-	When     string
+	When                  string
-	WhenAt   string
+	WhenAt                string
-	Abs      string
+	Abs                   string
-	Parts    []TextPart
+	Body, BodySplit       template.HTML
-	Resolved bool
+	Replies               []CommentView
+	Edited, Deleted       bool
+	Verdict, Range, Quote string
+	Edit                  *EditForm
+	Delete                *DeleteForm
+	Reply                 *CommentForm
+	Resolved              bool
 	// Outdated is true when the head moved since the comment was written, so
 	// its line may have moved too.
 	Outdated bool
 	Resolve *ResolveForm
 }
+type EditForm struct {
+	Action, Text string
+	From         int
+}
+type DeleteForm struct {
+	Action string
+	From   int
+}
+type VerdictView struct {
+	Author, Label, Href, Short string
+	Stale                      bool
+}
 // ResolveForm is the POST that changes the resolved state of a comment.
 type ResolveForm struct {
 	Action string
 	Action string
 	Title  string
 	// Path, Line and Side designate the line; empty for a general comment.
-	Path, Line, Side string
+	Path, Line, Side   string
-	Cancel           string
+	StartLine, ReplyTo string
-	Focus            bool
+	Cancel             string
+	Focus              bool
 	// From is the window of the page the form is on (see mrWindow), sent
 	// back so that the answer returns to it; 0 for the first.
 	From int
 	State          string
 	Open           bool
 	Signed         bool
+	NoteAuthor     string
 	Source, Target string
 	SourceHref     string
 	TargetHref     string
 	NComments      int
 	NUnresolved    int
 	GeneralForm    *CommentForm
+	Verdicts       []VerdictView
 	Commits     []MRCommit
 	CommitsNote string
 	p := MRPage{
 		Number: "#" + strconv.FormatInt(n, 10), Title: visibleText(m.Title.String()),
-		State: mrStateName(m), Open: open, Signed: signed,
+		State: mrStateName(m), Open: open, Signed: signed, NoteAuthor: domain.AuthorName(principal(ctx)),
 		Source: visibleText(m.Source), Target: visibleText(m.Target),
 		Author: s.who(m.Author),
 		Head:   head, HeadShort: short(head),
 		// Relative links point into the source branch as it is now (its head
 		// commit); the heading ids carry their own prefix, apart from the
 		// ids of the diff.
-		h, _, err := s.md.renderWithIDs([]byte(desc), d.name(), head, "", "mr-desc-")
+		h, err := s.md.renderNote([]byte(desc), d.name(), head, "mr-desc-", noteIDs(res.Comments))
 		if err != nil {
 			return nil, 0, err
 		}
 		p.Desc = h
 	}
+	for _, v := range res.Verdicts {
+		p.Verdicts = append(p.Verdicts, VerdictView{Author: s.who(v.Author), Label: v.Verdict.String(), Stale: v.Stale, Href: "#c" + strconv.FormatInt(v.CommentID, 10), Short: short(v.CommitID.String())})
+	}
 	p.Opened.Name = p.Author
 	p.Opened.When, p.Opened.WhenAt = whenOf(now, m.CreatedAt)
 	if !m.CreatedAt.IsZero() {
 // lineRef designates a line of the diff in the query of the comment form:
 // "?on=new:12:path/to/file".
 type lineRef struct {
-	side string
+	side  string
-	line int
+	line  int
-	path string
+	start int
+	path  string
 }
 func parseOn(s string) *lineRef {
 		return nil
 	}
 	num, path, ok := strings.Cut(rest, ":")
+	start := 0
+	if a, b, rangeOK := strings.Cut(num, "-"); rangeOK {
+		var e error
+		start, e = strconv.Atoi(a)
+		end, e2 := strconv.Atoi(b)
+		if e != nil || e2 != nil || start < 1 || start >= end {
+			return nil
+		}
+		num = b
+	}
 	line, err := strconv.Atoi(num)
 	if !ok || err != nil || line < 1 || path == "" {
 		return nil
 	}
-	return &lineRef{side: side, line: line, path: path}
+	return &lineRef{side: side, line: line, start: start, path: path}
 }
 // placeComments puts every comment under its line when the diff shown has it,
 		return index[lineKey{path, side, line}]
 	}
+	exists := noteIDs(comments)
+	children := map[int64][]domain.Comment{}
 	for _, c := range comments {
+		if c.ReplyTo != 0 && !c.Deleted {
+			children[c.ReplyTo] = append(children[c.ReplyTo], c)
+		}
+		if !c.Deleted {
+			p.NComments++
+		}
+		if c.ReplyTo == 0 && !c.Deleted && !c.Resolved {
+			p.NUnresolved++
+		}
+	}
+	var view func(domain.Comment, bool) CommentView
+	view = func(c domain.Comment, replyable bool) CommentView {
 		cid := strconv.FormatInt(c.ID, 10)
-		v := CommentView{
+		body, err := s.md.renderNote([]byte(c.Text.String()), repo, head, "c"+cid+"-", exists)
-			ID: cid, Author: s.who(c.Author),
+		if err != nil {
-			Parts: plainParts(c.Text.String()), Resolved: c.Resolved,
+			body = ""
-			Outdated: !c.CommitID.IsZero() && c.CommitID.String() != head,
 		}
+		bodySplit, err := s.md.renderNote([]byte(c.Text.String()), repo, head, "c"+cid+"s-", exists)
+		if err != nil {
+			bodySplit = ""
+		}
+		v := CommentView{BodySplit: bodySplit, ID: cid, Author: s.who(c.Author), Body: body, Resolved: c.Resolved, Deleted: c.Deleted, Edited: !c.EditedAt.IsZero(), Verdict: c.Verdict.String(), Outdated: !c.CommitID.IsZero() && c.CommitID.String() != head}
 		v.When, v.WhenAt = whenOf(now, c.CreatedAt)
 		if !c.CreatedAt.IsZero() {
 			v.Abs = absolute(c.CreatedAt)
 		}
-		p.NComments++
+		if c.StartLine > 0 {
-		if !c.Resolved {
+			v.Range = "lines " + itoa(c.StartLine) + "–" + itoa(c.Line)
-			p.NUnresolved++
 		}
+		if canWrite && !c.Deleted {
+			from := windowStart(fileAt[c.Path])
+			root := cid
+			if c.ReplyTo != 0 {
+				root = strconv.FormatInt(c.ReplyTo, 10)
+			}
+			if replyable {
+				v.Quote = "> " + strings.ReplaceAll(c.Text.String(), "\n", "\n> ") + "\n\n^" + cid + " "
+			}
+			if c.ReplyTo == 0 {
+				v.Reply = &CommentForm{ID: "reply-" + cid, Action: mrHref(repo, n, "comments"), Title: "Reply", ReplyTo: root, From: from}
+			}
+			if c.Author == p.NoteAuthor {
+				v.Edit = &EditForm{Action: mrHref(repo, n, "comments", cid, "edit"), Text: c.Text.String(), From: from}
+				v.Delete = &DeleteForm{Action: mrHref(repo, n, "comments", cid, "delete"), From: from}
+			}
+		}
+		for _, reply := range children[c.ID] {
+			v.Replies = append(v.Replies, view(reply, replyable))
+		}
+		return v
+	}
+	for _, c := range comments {
+		if c.ReplyTo != 0 || c.Deleted && c.Verdict == domain.VerdictNone && len(children[c.ID]) == 0 {
+			continue
+		}
+		cid := strconv.FormatInt(c.ID, 10)
+		v := view(c, canWrite && !c.Deleted)
 		general := c.Path == ""
 		fi, listed := fileAt[c.Path]
 		if !general && listed && p.Files[fi].Lazy {
 				v.Where = visibleText(c.Path) + ":" + itoa(c.Line) + " (" + side + ")"
 			}
 		}
-		if canWrite {
+		if canWrite && !c.Deleted {
 			v.Resolve = &ResolveForm{Action: resolveAction(cid), Value: !c.Resolved, Label: "Resolve"}
 			if !general && listed {
 				v.Resolve.From = windowStart(fi)
 		if on.side == "old" {
 			side = domain.SideOld
 		}
+		start := on.start
+		if start == 0 {
+			start = on.line
+		}
+		for key, ln := range index {
+			if key.path == on.path && key.side == side && key.line >= start && key.line <= on.line {
+				ln.Selected = true
+			}
+		}
 		if ln := find(on.path, side, on.line); ln != nil {
 			ln.Form = &CommentForm{
-				ID: "cf-line", Action: mrHref(repo, n, "comments"), Path: on.path, Line: itoa(on.line), Side: on.side,
+				StartLine: optionalLine(on.start), ID: "cf-line", Action: mrHref(repo, n, "comments"), Path: on.path, Line: itoa(on.line), Side: on.side,
 				Title:  "comment on " + visibleText(on.path) + ":" + itoa(on.line) + " (" + on.side + ")",
 				Cancel: withFrom(self, windowStart(fileAt[on.path])) + "#" + fileIDs[on.path], Focus: true,
 				From: windowStart(fileAt[on.path]),
 		return err
 	})
 }
+func noteIDs(comments []domain.Comment) func(int64) bool {
+	ids := make(map[int64]bool, len(comments))
+	for _, c := range comments {
+		ids[c.ID] = true
+	}
+	return func(n int64) bool { return ids[n] }
+}
+func optionalLine(n int) string {
+	if n == 0 {
+		return ""
+	}
+	return itoa(n)
+}

M internal/adapters/web/mr.templ +66 -6


@@ -229,10 +229,9 @@ templ lineNotes(notes []CommentView, form *CommentForm, suffix string) {
229	229		}
230	230
231	231		// commentView is a note: a ruled block, under its line in the diff or in the
232		-	// list of comments. The text is plain: escaped, its line breaks kept, its
233		-	// http(s) addresses linked.
	232	+	// list of comments. Body comes only from the safe Markdown renderer.
234	233		templ commentView(c CommentView, suffix string) {
235		-	<div class="cmt" id={ "c" + c.ID + suffix } data-resolved={ boolText(c.Resolved) }>
	234	+	<div class="cmt" id={ "c" + c.ID + suffix } data-resolved={ boolText(c.Resolved) } data-thread?={ c.Reply != nil }>
236	235		<p class="c-head">
237	236		<span class="c-who">{ c.Author }</span>
238	237		if c.WhenAt != "" {

@@ -248,7 +247,47 @@ templ commentView(c CommentView, suffix string) {
248	247		{ " " }<span class="c-where mute">{ c.Where }</span>
249	248		}
250	249		</p>
251		-	<p class="c-text">@userText(c.Parts)</p>
	250	+	if c.Deleted {
	251	+	if c.Verdict != "" {
	252	+	<p class="mute">text deleted</p>
	253	+	} else {
	254	+	<p class="mute">deleted note</p>
	255	+	}
	256	+	} else {
	257	+	<div class="c-body prose">
	258	+	if suffix == "-s" {
	259	+	@templ.Raw(string(c.BodySplit))
	260	+	} else {
	261	+	@templ.Raw(string(c.Body))
	262	+	}
	263	+	</div>
	264	+	}
	265	+	if c.Edited {
	266	+	<span class="mute">edited</span>
	267	+	}
	268	+	if c.Verdict != "" {
	269	+	<span class="c-state">{ c.Verdict }</span>
	270	+	}
	271	+	if c.Range != "" {
	272	+	<span class="mute">{ c.Range }</span>
	273	+	}
	274	+	if c.Quote != "" {
	275	+	<button type="button" class="btn" data-js data-quote={ c.Quote }>Quote</button>
	276	+	}
	277	+	if c.Edit != nil {
	278	+	<details><summary>Edit</summary><form method="post" action={ templ.SafeURL(c.Edit.Action) }><input type="hidden" name="from" value={ itoa(c.Edit.From) }/><textarea name="text" maxlength="8000">{ c.Edit.Text }</textarea><button class="btn" type="submit">Save</button></form></details>
	279	+	}
	280	+	if c.Delete != nil {
	281	+	<details><summary>Delete</summary><form method="post" action={ templ.SafeURL(c.Delete.Action) }><input type="hidden" name="from" value={ itoa(c.Delete.From) }/><p>Delete this note?</p><button class="btn" type="submit">Confirm delete</button></form></details>
	282	+	}
	283	+	for _, reply := range c.Replies {
	284	+	@commentView(reply, suffix)
	285	+	}
	286	+	if c.Reply != nil {
	287	+	<details data-reply>
	288	+	<summary>Reply</summary>@commentForm(*c.Reply, suffix)
	289	+	</details>
	290	+	}
252	291		if c.Resolve != nil {
253	292		<form class="c-act" method="post" action={ templ.SafeURL(c.Resolve.Action) }>
254	293		<input type="hidden" name="resolved" value={ boolText(c.Resolve.Value) }/>

@@ -277,8 +316,7 @@ templ commentForm(f CommentForm, suffix string) {
277	316		name="text"
278	317		rows="3"
279	318		maxlength="8000"
280		-	required
281		-	placeholder="plain text, 8000 characters at most"
	319	+	placeholder="Markdown, 8000 characters at most"
282	320		if f.Focus {
283	321		autofocus
284	322		}

@@ -287,6 +325,13 @@ templ commentForm(f CommentForm, suffix string) {
287	325		<input type="hidden" name="path" value={ f.Path }/>
288	326		<input type="hidden" name="line" value={ f.Line }/>
289	327		<input type="hidden" name="side" value={ f.Side }/>
	328	+	<label>from line <input type="number" name="start_line" min="1" value={ f.StartLine }/></label>
	329	+	}
	330	+	if f.ReplyTo != "" {
	331	+	<input type="hidden" name="reply_to" value={ f.ReplyTo }/>
	332	+	}
	333	+	if f.Path == "" && f.ReplyTo == "" {
	334	+	<fieldset><legend>Verdict</legend><label><input type="radio" name="verdict" value="" checked/>Note</label><label><input type="radio" name="verdict" value="approve"/>Approve</label><label><input type="radio" name="verdict" value="changes_requested"/>Request changes</label></fieldset>
290	335		}
291	336		if f.From > 0 {
292	337		<input type="hidden" name="from" value={ itoa(f.From) }/>

@@ -310,6 +355,21 @@ templ mrRail(p MRPage) {
310	355		</h2>
311	356		@FileList(p.Files)
312	357		</section>
	358	+	if len(p.Verdicts) > 0 {
	359	+	<section>
	360	+	<h2>Verdicts</h2>
	361	+	<ul>
	362	+	for _, v := range p.Verdicts {
	363	+	<li>
	364	+	<a href={ templ.SafeURL(v.Href) }>{ v.Author }: { v.Label }</a>
	365	+	if v.Stale {
	366	+	<span class="mute">(stale)</span>
	367	+	}
	368	+	</li>
	369	+	}
	370	+	</ul>
	371	+	</section>
	372	+	}
313	373		@MRChecks(p.Checks)
314	374		<section aria-labelledby="r-commits">
315	375		<h2 id="r-commits">Commits <span class="count">{ itoa(len(p.Commits)) }</span></h2>


@@ -229,10 +229,9 @@ templ lineNotes(notes []CommentView, form *CommentForm, suffix string) {
229		}	229		}
230			230
231		// commentView is a note: a ruled block, under its line in the diff or in the	231		// commentView is a note: a ruled block, under its line in the diff or in the
232	-	// list of comments. The text is plain: escaped, its line breaks kept, its	232	+	// list of comments. Body comes only from the safe Markdown renderer.
233	-	// http(s) addresses linked.
234		templ commentView(c CommentView, suffix string) {	233		templ commentView(c CommentView, suffix string) {
235	-	<div class="cmt" id={ "c" + c.ID + suffix } data-resolved={ boolText(c.Resolved) }>	234	+	<div class="cmt" id={ "c" + c.ID + suffix } data-resolved={ boolText(c.Resolved) } data-thread?={ c.Reply != nil }>
236		<p class="c-head">	235		<p class="c-head">
237		<span class="c-who">{ c.Author }</span>	236		<span class="c-who">{ c.Author }</span>
238		if c.WhenAt != "" {	237		if c.WhenAt != "" {

@@ -248,7 +247,47 @@ templ commentView(c CommentView, suffix string) {
248		{ " " }<span class="c-where mute">{ c.Where }</span>	247		{ " " }<span class="c-where mute">{ c.Where }</span>
249		}	248		}
250		</p>	249		</p>
251	-	<p class="c-text">@userText(c.Parts)</p>	250	+	if c.Deleted {
			251	+	if c.Verdict != "" {
			252	+	<p class="mute">text deleted</p>
			253	+	} else {
			254	+	<p class="mute">deleted note</p>
			255	+	}
			256	+	} else {
			257	+	<div class="c-body prose">
			258	+	if suffix == "-s" {
			259	+	@templ.Raw(string(c.BodySplit))
			260	+	} else {
			261	+	@templ.Raw(string(c.Body))
			262	+	}
			263	+	</div>
			264	+	}
			265	+	if c.Edited {
			266	+	<span class="mute">edited</span>
			267	+	}
			268	+	if c.Verdict != "" {
			269	+	<span class="c-state">{ c.Verdict }</span>
			270	+	}
			271	+	if c.Range != "" {
			272	+	<span class="mute">{ c.Range }</span>
			273	+	}
			274	+	if c.Quote != "" {
			275	+	<button type="button" class="btn" data-js data-quote={ c.Quote }>Quote</button>
			276	+	}
			277	+	if c.Edit != nil {
			278	+	<details><summary>Edit</summary><form method="post" action={ templ.SafeURL(c.Edit.Action) }><input type="hidden" name="from" value={ itoa(c.Edit.From) }/><textarea name="text" maxlength="8000">{ c.Edit.Text }</textarea><button class="btn" type="submit">Save</button></form></details>
			279	+	}
			280	+	if c.Delete != nil {
			281	+	<details><summary>Delete</summary><form method="post" action={ templ.SafeURL(c.Delete.Action) }><input type="hidden" name="from" value={ itoa(c.Delete.From) }/><p>Delete this note?</p><button class="btn" type="submit">Confirm delete</button></form></details>
			282	+	}
			283	+	for _, reply := range c.Replies {
			284	+	@commentView(reply, suffix)
			285	+	}
			286	+	if c.Reply != nil {
			287	+	<details data-reply>
			288	+	<summary>Reply</summary>@commentForm(*c.Reply, suffix)
			289	+	</details>
			290	+	}
252		if c.Resolve != nil {	291		if c.Resolve != nil {
253		<form class="c-act" method="post" action={ templ.SafeURL(c.Resolve.Action) }>	292		<form class="c-act" method="post" action={ templ.SafeURL(c.Resolve.Action) }>
254		<input type="hidden" name="resolved" value={ boolText(c.Resolve.Value) }/>	293		<input type="hidden" name="resolved" value={ boolText(c.Resolve.Value) }/>

@@ -277,8 +316,7 @@ templ commentForm(f CommentForm, suffix string) {
277		name="text"	316		name="text"
278		rows="3"	317		rows="3"
279		maxlength="8000"	318		maxlength="8000"
280	-	required	319	+	placeholder="Markdown, 8000 characters at most"
281	-	placeholder="plain text, 8000 characters at most"
282		if f.Focus {	320		if f.Focus {
283		autofocus	321		autofocus
284		}	322		}

@@ -287,6 +325,13 @@ templ commentForm(f CommentForm, suffix string) {
287		<input type="hidden" name="path" value={ f.Path }/>	325		<input type="hidden" name="path" value={ f.Path }/>
288		<input type="hidden" name="line" value={ f.Line }/>	326		<input type="hidden" name="line" value={ f.Line }/>
289		<input type="hidden" name="side" value={ f.Side }/>	327		<input type="hidden" name="side" value={ f.Side }/>
			328	+	<label>from line <input type="number" name="start_line" min="1" value={ f.StartLine }/></label>
			329	+	}
			330	+	if f.ReplyTo != "" {
			331	+	<input type="hidden" name="reply_to" value={ f.ReplyTo }/>
			332	+	}
			333	+	if f.Path == "" && f.ReplyTo == "" {
			334	+	<fieldset><legend>Verdict</legend><label><input type="radio" name="verdict" value="" checked/>Note</label><label><input type="radio" name="verdict" value="approve"/>Approve</label><label><input type="radio" name="verdict" value="changes_requested"/>Request changes</label></fieldset>
290		}	335		}
291		if f.From > 0 {	336		if f.From > 0 {
292		<input type="hidden" name="from" value={ itoa(f.From) }/>	337		<input type="hidden" name="from" value={ itoa(f.From) }/>

@@ -310,6 +355,21 @@ templ mrRail(p MRPage) {
310		</h2>	355		</h2>
311		@FileList(p.Files)	356		@FileList(p.Files)
312		</section>	357		</section>
			358	+	if len(p.Verdicts) > 0 {
			359	+	<section>
			360	+	<h2>Verdicts</h2>
			361	+	<ul>
			362	+	for _, v := range p.Verdicts {
			363	+	<li>
			364	+	<a href={ templ.SafeURL(v.Href) }>{ v.Author }: { v.Label }</a>
			365	+	if v.Stale {
			366	+	<span class="mute">(stale)</span>
			367	+	}
			368	+	</li>
			369	+	}
			370	+	</ul>
			371	+	</section>
			372	+	}
313		@MRChecks(p.Checks)	373		@MRChecks(p.Checks)
314		<section aria-labelledby="r-commits">	374		<section aria-labelledby="r-commits">
315		<h2 id="r-commits">Commits <span class="count">{ itoa(len(p.Commits)) }</span></h2>	375		<h2 id="r-commits">Commits <span class="count">{ itoa(len(p.Commits)) }</span></h2>

M internal/adapters/web/mr_files.go +5 -3


@@ -131,8 +131,10 @@ func countNotes(files []DiffFile, comments []domain.Comment) {
131	131		if c.Path == "" \|\| !ok {
132	132		continue
133	133		}
134		-	files[i].Notes++
135		-	if !c.Resolved {
	134	+	if c.ReplyTo == 0 && !c.Deleted {
	135	+	files[i].Notes++
	136	+	}
	137	+	if c.ReplyTo == 0 && !c.Deleted && !c.Resolved {
136	138		files[i].OpenNotes++
137	139		}
138	140		ids[i] = append(ids[i], "c"+strconv.FormatInt(c.ID, 10))

@@ -196,7 +198,7 @@ func (s Server) mrFiles(ctx context.Context, r http.Request) (templ.Component,
196	198		m := res.MergeRequest
197	199		signed := SignedIn(ctx)
198	200		canWrite := signed && m.State == domain.MRStateOpen && !since
199		-	p := MRPage{Files: s.hl.files(ctx, res.Diff.Files), LooseInFiles: true}
	201	+	p := MRPage{Files: s.hl.files(ctx, res.Diff.Files), LooseInFiles: true, NoteAuthor: domain.AuthorName(principal(ctx))}
200	202		contextGaps(p.Files, res.Diff.Files, repoHref(d.name(), "context", head.String()))
201	203		s.placeComments(&p, d.name(), n, res.Comments, m.HeadID.String(), !since, canWrite, nil)
202	204		window := p.Files[from:min(from+mrWindow, len(p.Files))]

 		if c.Path == "" || !ok {
 			continue
 		}
-		files[i].Notes++
+		if c.ReplyTo == 0 && !c.Deleted {
-		if !c.Resolved {
+			files[i].Notes++
+		}
+		if c.ReplyTo == 0 && !c.Deleted && !c.Resolved {
 			files[i].OpenNotes++
 		}
 		ids[i] = append(ids[i], "c"+strconv.FormatInt(c.ID, 10))
 	m := res.MergeRequest
 	signed := SignedIn(ctx)
 	canWrite := signed && m.State == domain.MRStateOpen && !since
-	p := MRPage{Files: s.hl.files(ctx, res.Diff.Files), LooseInFiles: true}
+	p := MRPage{Files: s.hl.files(ctx, res.Diff.Files), LooseInFiles: true, NoteAuthor: domain.AuthorName(principal(ctx))}
 	contextGaps(p.Files, res.Diff.Files, repoHref(d.name(), "context", head.String()))
 	s.placeComments(&p, d.name(), n, res.Comments, m.HeadID.String(), !since, canWrite, nil)
 	window := p.Files[from:min(from+mrWindow, len(p.Files))]

A internal/adapters/web/mr_notes_test.go +162 -0

@@ -0,0 +1,162 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package web
	4	+
	5	+	import (
	6	+	"bnema.dev/ermite/internal/ports/mocks"
	7	+	"bytes"
	8	+	"context"
	9	+	"github.com/stretchr/testify/mock"
	10	+	"net/http"
	11	+	"net/http/httptest"
	12	+	"net/url"
	13	+	"strings"
	14	+	"testing"
	15	+	"time"
	16	+
	17	+	"bnema.dev/ermite/internal/domain"
	18	+	"bnema.dev/ermite/internal/ports"
	19	+	"github.com/stretchr/testify/assert"
	20	+	"github.com/stretchr/testify/require"
	21	+	)
	22	+
	23	+	func TestParseOnRange(t *testing.T) {
	24	+	t.Parallel()
	25	+	for _, raw := range []string{"new:0-2:a", "new:2-2:a", "new:3-2:a", "new:1-x:a", "new:1-2:", "other:1-2:a"} {
	26	+	assert.Nil(t, parseOn(raw), raw)
	27	+	}
	28	+	assert.Equal(t, &lineRef{side: "new", start: 10, line: 24, path: "dir:a.go"}, parseOn("new:10-24:dir:a.go"))
	29	+	assert.Equal(t, &lineRef{side: "old", line: 10, path: "a"}, parseOn("old:10:a"))
	30	+	}
	31	+
	32	+	func TestNoteThreads(t *testing.T) {
	33	+	t.Parallel()
	34	+	text, err := domain.ParsePlainText("hello ^2")
	35	+	require.NoError(t, err)
	36	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	37	+	comments := []domain.Comment{
	38	+	{ID: 1, Author: "alice", Text: text},
	39	+	{ID: 2, Author: "bob", ReplyTo: 1, Text: text},
	40	+	{ID: 3, Author: "alice", Deleted: true},
	41	+	{ID: 4, Author: "alice", Deleted: true},
	42	+	{ID: 5, Author: "bob", ReplyTo: 4, Text: text},
	43	+	{ID: 6, Author: "alice", Text: text, Verdict: domain.VerdictApprove, Resolved: true},
	44	+	}
	45	+	p := MRPage{NoteAuthor: "alice"}
	46	+	s.placeComments(&p, "demo", 1, comments, "", true, true, nil)
	47	+	require.Len(t, p.General, 3)
	48	+	assert.Equal(t, 4, p.NComments)
	49	+	assert.Equal(t, 1, p.NUnresolved)
	50	+	require.Len(t, p.General[0].Replies, 1)
	51	+	assert.NotNil(t, p.General[0].Edit)
	52	+	assert.Nil(t, p.General[0].Replies[0].Edit)
	53	+	assert.Nil(t, p.General[0].Replies[0].Resolve)
	54	+	assert.Contains(t, string(p.General[0].Body), "<strong>hello</strong>")
	55	+	assert.Contains(t, string(p.General[0].Body), `href="#c2"`)
	56	+	assert.True(t, p.General[1].Deleted)
	57	+	var b bytes.Buffer
	58	+	require.NoError(t, commentView(p.General[0], "").Render(context.Background(), &b))
	59	+	assert.Contains(t, b.String(), `name="reply_to" value="1"`)
	60	+	assert.Contains(t, b.String(), `data-js data-quote=`)
	61	+	assert.Contains(t, b.String(), `/comments/1/edit`)
	62	+	assert.NotContains(t, b.String(), `/comments/2/edit`)
	63	+	}
	64	+
	65	+	func TestNoteLiveEvents(t *testing.T) {
	66	+	t.Parallel()
	67	+	l := liveStream{view: "mr", n: "1"}
	68	+	events := []domain.Event{domain.CommentEdited{Number: 1}, domain.CommentDeleted{Number: 1}, domain.CommentResolved{Number: 1}}
	69	+	for _, ev := range events {
	70	+	we := ports.WatchEvent{Event: ev}
	71	+	assert.True(t, liveEvent(we))
	72	+	fs, err := l.repoPage(context.Background(), we)
	73	+	require.NoError(t, err)
	74	+	require.Len(t, fs, 1)
	75	+	assert.Contains(t, fs[0].html, "reload")
	76	+	}
	77	+	}
	78	+
	79	+	func TestNotePosts(t *testing.T) {
	80	+	t.Parallel()
	81	+	svc := mocks.NewMergeRequestService(t)
	82	+	repo := repoName(t, "demo")
	83	+	s := &Server{cfg: Config{MergeRequests: svc}}
	84	+	ctx := domain.ContextWithPrincipal(context.Background(), domain.Owner())
	85	+	request := func(values url.Values) *http.Request {
	86	+	r := httptest.NewRequest("POST", "/demo/merge-requests/1/comments", strings.NewReader(values.Encode())).WithContext(ctx)
	87	+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	88	+	r.SetPathValue("repo", "demo")
	89	+	r.SetPathValue("n", "1")
	90	+	r.SetPathValue("id", "2")
	91	+	require.NoError(t, r.ParseForm())
	92	+	return r
	93	+	}
	94	+	svc.EXPECT().AddComment(mock.Anything, mock.Anything, repo, int64(1), mock.MatchedBy(func(p ports.AddCommentParams) bool { return p.ReplyTo == 2 && p.Text == "reply" })).Return(domain.Comment{ID: 7}, nil).Once()
	95	+	to, _, err := s.mrComment(ctx, request(url.Values{"reply_to": {"2"}, "text": {"reply"}}))
	96	+	require.NoError(t, err)
	97	+	assert.Equal(t, "/demo/merge-requests/1#c7", to)
	98	+	svc.EXPECT().AddComment(mock.Anything, mock.Anything, repo, int64(1), mock.MatchedBy(func(p ports.AddCommentParams) bool {
	99	+	return p.StartLine == 10 && p.Line == 24 && p.Path == "a.go" && p.Verdict == domain.VerdictApprove
	100	+	})).Return(domain.Comment{ID: 8}, nil).Once()
	101	+	to, _, err = s.mrComment(ctx, request(url.Values{"path": {"a.go"}, "line": {"24"}, "start_line": {"10"}, "side": {"new"}, "verdict": {"approve"}}))
	102	+	require.NoError(t, err)
	103	+	assert.Equal(t, "/demo/merge-requests/1#c8", to)
	104	+	svc.EXPECT().EditComment(mock.Anything, mock.Anything, repo, int64(1), int64(2), "new\ntext").Return(domain.Comment{ID: 2}, nil).Once()
	105	+	to, _, err = s.mrEditComment(ctx, request(url.Values{"text": {"new\r\ntext"}}))
	106	+	require.NoError(t, err)
	107	+	assert.Equal(t, "/demo/merge-requests/1#c2", to)
	108	+	svc.EXPECT().DeleteComment(mock.Anything, mock.Anything, repo, int64(1), int64(2)).Return(domain.Comment{ID: 2}, nil).Once()
	109	+	to, _, err = s.mrDeleteComment(ctx, request(nil))
	110	+	require.NoError(t, err)
	111	+	assert.Equal(t, "/demo/merge-requests/1#c2", to)
	112	+	}
	113	+
	114	+	func TestDeletedNoteRendering(t *testing.T) {
	115	+	t.Parallel()
	116	+	text, err := domain.ParsePlainText("surviving reply")
	117	+	require.NoError(t, err)
	118	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	119	+	p := MRPage{}
	120	+	s.placeComments(&p, "demo", 1, []domain.Comment{
	121	+	{ID: 1, Author: "reviewer", Deleted: true, Verdict: domain.VerdictApprove},
	122	+	{ID: 2, Deleted: true},
	123	+	{ID: 3, ReplyTo: 2, Deleted: true},
	124	+	{ID: 4, Deleted: true},
	125	+	{ID: 5, ReplyTo: 4, Text: text},
	126	+	}, "", true, true, nil)
	127	+	require.Len(t, p.General, 2)
	128	+	assert.Equal(t, "1", p.General[0].ID)
	129	+	assert.Equal(t, "4", p.General[1].ID)
	130	+	var b bytes.Buffer
	131	+	require.NoError(t, commentView(p.General[0], "").Render(context.Background(), &b))
	132	+	assert.Contains(t, b.String(), `<span class="c-who">owner</span>`)
	133	+	assert.Contains(t, b.String(), "approve")
	134	+	assert.Contains(t, b.String(), "text deleted")
	135	+	b.Reset()
	136	+	require.NoError(t, commentView(p.General[1], "").Render(context.Background(), &b))
	137	+	assert.Contains(t, b.String(), "surviving reply")
	138	+	assert.NotContains(t, b.String(), "Quote")
	139	+	assert.NotContains(t, b.String(), "data-quote")
	140	+	}
	141	+
	142	+	func TestInlineNoteHeadingIDs(t *testing.T) {
	143	+	t.Parallel()
	144	+	// "S H" would get the id the split copy of "H" gets if the prefixes of the
	145	+	// two copies overlapped.
	146	+	text, err := domain.ParsePlainText("# H\n\n# S H\n\n[jump](#h)")
	147	+	require.NoError(t, err)
	148	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	149	+	p := MRPage{Files: []DiffFile{{Key: "a", ID: "f1", Hunks: []DiffHunk{{Lines: []DiffLine{{Kind: "add", newN: 1}}}}}}}
	150	+	s.placeComments(&p, "demo", 1, []domain.Comment{{ID: 12, Path: "a", Side: domain.SideNew, Line: 1, Text: text}}, "", true, true, nil)
	151	+	notes := p.Files[0].Hunks[0].Lines[0].Notes
	152	+	require.Len(t, notes, 1)
	153	+	var b bytes.Buffer
	154	+	require.NoError(t, commentView(notes[0], "").Render(context.Background(), &b))
	155	+	require.NoError(t, commentView(notes[0], "-s").Render(context.Background(), &b))
	156	+	html := b.String()
	157	+	for _, id := range []string{"c12-h", "c12-s-h", "c12s-h", "c12s-s-h"} {
	158	+	assert.Equal(t, 1, strings.Count(html, `id="`+id+`"`), id)
	159	+	}
	160	+	assert.Contains(t, html, `href="#c12-h"`)
	161	+	assert.Contains(t, html, `href="#c12s-h"`)
	162	+	}

@@ -0,0 +1,162 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package web
	4	+
	5	+	import (
	6	+	"bnema.dev/ermite/internal/ports/mocks"
	7	+	"bytes"
	8	+	"context"
	9	+	"github.com/stretchr/testify/mock"
	10	+	"net/http"
	11	+	"net/http/httptest"
	12	+	"net/url"
	13	+	"strings"
	14	+	"testing"
	15	+	"time"
	16	+
	17	+	"bnema.dev/ermite/internal/domain"
	18	+	"bnema.dev/ermite/internal/ports"
	19	+	"github.com/stretchr/testify/assert"
	20	+	"github.com/stretchr/testify/require"
	21	+	)
	22	+
	23	+	func TestParseOnRange(t *testing.T) {
	24	+	t.Parallel()
	25	+	for _, raw := range []string{"new:0-2:a", "new:2-2:a", "new:3-2:a", "new:1-x:a", "new:1-2:", "other:1-2:a"} {
	26	+	assert.Nil(t, parseOn(raw), raw)
	27	+	}
	28	+	assert.Equal(t, &lineRef{side: "new", start: 10, line: 24, path: "dir:a.go"}, parseOn("new:10-24:dir:a.go"))
	29	+	assert.Equal(t, &lineRef{side: "old", line: 10, path: "a"}, parseOn("old:10:a"))
	30	+	}
	31	+
	32	+	func TestNoteThreads(t *testing.T) {
	33	+	t.Parallel()
	34	+	text, err := domain.ParsePlainText("hello ^2")
	35	+	require.NoError(t, err)
	36	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	37	+	comments := []domain.Comment{
	38	+	{ID: 1, Author: "alice", Text: text},
	39	+	{ID: 2, Author: "bob", ReplyTo: 1, Text: text},
	40	+	{ID: 3, Author: "alice", Deleted: true},
	41	+	{ID: 4, Author: "alice", Deleted: true},
	42	+	{ID: 5, Author: "bob", ReplyTo: 4, Text: text},
	43	+	{ID: 6, Author: "alice", Text: text, Verdict: domain.VerdictApprove, Resolved: true},
	44	+	}
	45	+	p := MRPage{NoteAuthor: "alice"}
	46	+	s.placeComments(&p, "demo", 1, comments, "", true, true, nil)
	47	+	require.Len(t, p.General, 3)
	48	+	assert.Equal(t, 4, p.NComments)
	49	+	assert.Equal(t, 1, p.NUnresolved)
	50	+	require.Len(t, p.General[0].Replies, 1)
	51	+	assert.NotNil(t, p.General[0].Edit)
	52	+	assert.Nil(t, p.General[0].Replies[0].Edit)
	53	+	assert.Nil(t, p.General[0].Replies[0].Resolve)
	54	+	assert.Contains(t, string(p.General[0].Body), "<strong>hello</strong>")
	55	+	assert.Contains(t, string(p.General[0].Body), `href="#c2"`)
	56	+	assert.True(t, p.General[1].Deleted)
	57	+	var b bytes.Buffer
	58	+	require.NoError(t, commentView(p.General[0], "").Render(context.Background(), &b))
	59	+	assert.Contains(t, b.String(), `name="reply_to" value="1"`)
	60	+	assert.Contains(t, b.String(), `data-js data-quote=`)
	61	+	assert.Contains(t, b.String(), `/comments/1/edit`)
	62	+	assert.NotContains(t, b.String(), `/comments/2/edit`)
	63	+	}
	64	+
	65	+	func TestNoteLiveEvents(t *testing.T) {
	66	+	t.Parallel()
	67	+	l := liveStream{view: "mr", n: "1"}
	68	+	events := []domain.Event{domain.CommentEdited{Number: 1}, domain.CommentDeleted{Number: 1}, domain.CommentResolved{Number: 1}}
	69	+	for _, ev := range events {
	70	+	we := ports.WatchEvent{Event: ev}
	71	+	assert.True(t, liveEvent(we))
	72	+	fs, err := l.repoPage(context.Background(), we)
	73	+	require.NoError(t, err)
	74	+	require.Len(t, fs, 1)
	75	+	assert.Contains(t, fs[0].html, "reload")
	76	+	}
	77	+	}
	78	+
	79	+	func TestNotePosts(t *testing.T) {
	80	+	t.Parallel()
	81	+	svc := mocks.NewMergeRequestService(t)
	82	+	repo := repoName(t, "demo")
	83	+	s := &Server{cfg: Config{MergeRequests: svc}}
	84	+	ctx := domain.ContextWithPrincipal(context.Background(), domain.Owner())
	85	+	request := func(values url.Values) *http.Request {
	86	+	r := httptest.NewRequest("POST", "/demo/merge-requests/1/comments", strings.NewReader(values.Encode())).WithContext(ctx)
	87	+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	88	+	r.SetPathValue("repo", "demo")
	89	+	r.SetPathValue("n", "1")
	90	+	r.SetPathValue("id", "2")
	91	+	require.NoError(t, r.ParseForm())
	92	+	return r
	93	+	}
	94	+	svc.EXPECT().AddComment(mock.Anything, mock.Anything, repo, int64(1), mock.MatchedBy(func(p ports.AddCommentParams) bool { return p.ReplyTo == 2 && p.Text == "reply" })).Return(domain.Comment{ID: 7}, nil).Once()
	95	+	to, _, err := s.mrComment(ctx, request(url.Values{"reply_to": {"2"}, "text": {"reply"}}))
	96	+	require.NoError(t, err)
	97	+	assert.Equal(t, "/demo/merge-requests/1#c7", to)
	98	+	svc.EXPECT().AddComment(mock.Anything, mock.Anything, repo, int64(1), mock.MatchedBy(func(p ports.AddCommentParams) bool {
	99	+	return p.StartLine == 10 && p.Line == 24 && p.Path == "a.go" && p.Verdict == domain.VerdictApprove
	100	+	})).Return(domain.Comment{ID: 8}, nil).Once()
	101	+	to, _, err = s.mrComment(ctx, request(url.Values{"path": {"a.go"}, "line": {"24"}, "start_line": {"10"}, "side": {"new"}, "verdict": {"approve"}}))
	102	+	require.NoError(t, err)
	103	+	assert.Equal(t, "/demo/merge-requests/1#c8", to)
	104	+	svc.EXPECT().EditComment(mock.Anything, mock.Anything, repo, int64(1), int64(2), "new\ntext").Return(domain.Comment{ID: 2}, nil).Once()
	105	+	to, _, err = s.mrEditComment(ctx, request(url.Values{"text": {"new\r\ntext"}}))
	106	+	require.NoError(t, err)
	107	+	assert.Equal(t, "/demo/merge-requests/1#c2", to)
	108	+	svc.EXPECT().DeleteComment(mock.Anything, mock.Anything, repo, int64(1), int64(2)).Return(domain.Comment{ID: 2}, nil).Once()
	109	+	to, _, err = s.mrDeleteComment(ctx, request(nil))
	110	+	require.NoError(t, err)
	111	+	assert.Equal(t, "/demo/merge-requests/1#c2", to)
	112	+	}
	113	+
	114	+	func TestDeletedNoteRendering(t *testing.T) {
	115	+	t.Parallel()
	116	+	text, err := domain.ParsePlainText("surviving reply")
	117	+	require.NoError(t, err)
	118	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	119	+	p := MRPage{}
	120	+	s.placeComments(&p, "demo", 1, []domain.Comment{
	121	+	{ID: 1, Author: "reviewer", Deleted: true, Verdict: domain.VerdictApprove},
	122	+	{ID: 2, Deleted: true},
	123	+	{ID: 3, ReplyTo: 2, Deleted: true},
	124	+	{ID: 4, Deleted: true},
	125	+	{ID: 5, ReplyTo: 4, Text: text},
	126	+	}, "", true, true, nil)
	127	+	require.Len(t, p.General, 2)
	128	+	assert.Equal(t, "1", p.General[0].ID)
	129	+	assert.Equal(t, "4", p.General[1].ID)
	130	+	var b bytes.Buffer
	131	+	require.NoError(t, commentView(p.General[0], "").Render(context.Background(), &b))
	132	+	assert.Contains(t, b.String(), `<span class="c-who">owner</span>`)
	133	+	assert.Contains(t, b.String(), "approve")
	134	+	assert.Contains(t, b.String(), "text deleted")
	135	+	b.Reset()
	136	+	require.NoError(t, commentView(p.General[1], "").Render(context.Background(), &b))
	137	+	assert.Contains(t, b.String(), "surviving reply")
	138	+	assert.NotContains(t, b.String(), "Quote")
	139	+	assert.NotContains(t, b.String(), "data-quote")
	140	+	}
	141	+
	142	+	func TestInlineNoteHeadingIDs(t *testing.T) {
	143	+	t.Parallel()
	144	+	// "S H" would get the id the split copy of "H" gets if the prefixes of the
	145	+	// two copies overlapped.
	146	+	text, err := domain.ParsePlainText("# H\n\n# S H\n\n[jump](#h)")
	147	+	require.NoError(t, err)
	148	+	s := &Server{cfg: Config{Now: time.Now}, md: newMarkdown()}
	149	+	p := MRPage{Files: []DiffFile{{Key: "a", ID: "f1", Hunks: []DiffHunk{{Lines: []DiffLine{{Kind: "add", newN: 1}}}}}}}
	150	+	s.placeComments(&p, "demo", 1, []domain.Comment{{ID: 12, Path: "a", Side: domain.SideNew, Line: 1, Text: text}}, "", true, true, nil)
	151	+	notes := p.Files[0].Hunks[0].Lines[0].Notes
	152	+	require.Len(t, notes, 1)
	153	+	var b bytes.Buffer
	154	+	require.NoError(t, commentView(notes[0], "").Render(context.Background(), &b))
	155	+	require.NoError(t, commentView(notes[0], "-s").Render(context.Background(), &b))
	156	+	html := b.String()
	157	+	for _, id := range []string{"c12-h", "c12-s-h", "c12s-h", "c12s-s-h"} {
	158	+	assert.Equal(t, 1, strings.Count(html, `id="`+id+`"`), id)
	159	+	}
	160	+	assert.Contains(t, html, `href="#c12-h"`)
	161	+	assert.Contains(t, html, `href="#c12s-h"`)
	162	+	}

M internal/adapters/web/mr_post.go +47 -0


@@ -177,6 +177,23 @@ func (s Server) mrComment(ctx context.Context, r http.Request) (string, string
177	177		return "", back, formError("side must be new or old")
178	178		}
179	179		}
	180	+	if raw := r.PostFormValue("reply_to"); raw != "" {
	181	+	params.ReplyTo = commentID(raw)
	182	+	if params.ReplyTo == 0 {
	183	+	return "", back, formError("reply_to is not a note id")
	184	+	}
	185	+	}
	186	+	if raw := r.PostFormValue("start_line"); raw != "" {
	187	+	v, e := strconv.ParseInt(raw, 10, 32)
	188	+	if e != nil {
	189	+	return "", back, formError("start_line is not a number")
	190	+	}
	191	+	params.StartLine = int(v)
	192	+	}
	193	+	params.Verdict, err = domain.ParseVerdict(r.PostFormValue("verdict"))
	194	+	if err != nil {
	195	+	return "", back, err
	196	+	}
180	197		name, err := domain.ParseRepoName(repo)
181	198		if err != nil {
182	199		return "", back, err

@@ -356,3 +373,33 @@ func formBool(s string) (bool, error) {
356	373		func normalizeNewlines(s string) string {
357	374		return strings.ReplaceAll(s, "\r\n", "\n")
358	375		}
	376	+
	377	+	// mrEditComment passes source text to the author-checked use case.
	378	+	func (s Server) mrEditComment(ctx context.Context, r http.Request) (string, string, error) {
	379	+	n, err := number(r)
	380	+	if err != nil {
	381	+	return "", "", err
	382	+	}
	383	+	back := withFrom(mrHref(r.PathValue("repo"), n), formFrom(r))
	384	+	name, err := domain.ParseRepoName(r.PathValue("repo"))
	385	+	if err != nil {
	386	+	return "", back, err
	387	+	}
	388	+	c, err := s.cfg.MergeRequests.EditComment(ctx, principal(ctx), name, n, commentID(r.PathValue("id")), normalizeNewlines(r.PostFormValue("text")))
	389	+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, err
	390	+	}
	391	+
	392	+	// mrDeleteComment passes the note id to the author-checked use case.
	393	+	func (s Server) mrDeleteComment(ctx context.Context, r http.Request) (string, string, error) {
	394	+	n, err := number(r)
	395	+	if err != nil {
	396	+	return "", "", err
	397	+	}
	398	+	back := withFrom(mrHref(r.PathValue("repo"), n), formFrom(r))
	399	+	name, err := domain.ParseRepoName(r.PathValue("repo"))
	400	+	if err != nil {
	401	+	return "", back, err
	402	+	}
	403	+	c, err := s.cfg.MergeRequests.DeleteComment(ctx, principal(ctx), name, n, commentID(r.PathValue("id")))
	404	+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, err
	405	+	}


@@ -177,6 +177,23 @@ func (s Server) mrComment(ctx context.Context, r http.Request) (string, string
177	return "", back, formError("side must be new or old")	177		return "", back, formError("side must be new or old")
178	}	178		}
179	}	179		}
		180	+	if raw := r.PostFormValue("reply_to"); raw != "" {
		181	+	params.ReplyTo = commentID(raw)
		182	+	if params.ReplyTo == 0 {
		183	+	return "", back, formError("reply_to is not a note id")
		184	+	}
		185	+	}
		186	+	if raw := r.PostFormValue("start_line"); raw != "" {
		187	+	v, e := strconv.ParseInt(raw, 10, 32)
		188	+	if e != nil {
		189	+	return "", back, formError("start_line is not a number")
		190	+	}
		191	+	params.StartLine = int(v)
		192	+	}
		193	+	params.Verdict, err = domain.ParseVerdict(r.PostFormValue("verdict"))
		194	+	if err != nil {
		195	+	return "", back, err
		196	+	}
180	name, err := domain.ParseRepoName(repo)	197		name, err := domain.ParseRepoName(repo)
181	if err != nil {	198		if err != nil {
182	return "", back, err	199		return "", back, err

@@ -356,3 +373,33 @@ func formBool(s string) (bool, error) {
356	func normalizeNewlines(s string) string {	373		func normalizeNewlines(s string) string {
357	return strings.ReplaceAll(s, "\r\n", "\n")	374		return strings.ReplaceAll(s, "\r\n", "\n")
358	}	375		}
		376	+
		377	+	// mrEditComment passes source text to the author-checked use case.
		378	+	func (s Server) mrEditComment(ctx context.Context, r http.Request) (string, string, error) {
		379	+	n, err := number(r)
		380	+	if err != nil {
		381	+	return "", "", err
		382	+	}
		383	+	back := withFrom(mrHref(r.PathValue("repo"), n), formFrom(r))
		384	+	name, err := domain.ParseRepoName(r.PathValue("repo"))
		385	+	if err != nil {
		386	+	return "", back, err
		387	+	}
		388	+	c, err := s.cfg.MergeRequests.EditComment(ctx, principal(ctx), name, n, commentID(r.PathValue("id")), normalizeNewlines(r.PostFormValue("text")))
		389	+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, err
		390	+	}
		391	+
		392	+	// mrDeleteComment passes the note id to the author-checked use case.
		393	+	func (s Server) mrDeleteComment(ctx context.Context, r http.Request) (string, string, error) {
		394	+	n, err := number(r)
		395	+	if err != nil {
		396	+	return "", "", err
		397	+	}
		398	+	back := withFrom(mrHref(r.PathValue("repo"), n), formFrom(r))
		399	+	name, err := domain.ParseRepoName(r.PathValue("repo"))
		400	+	if err != nil {
		401	+	return "", back, err
		402	+	}
		403	+	c, err := s.cfg.MergeRequests.DeleteComment(ctx, principal(ctx), name, n, commentID(r.PathValue("id")))
		404	+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, err
		405	+	}

M internal/adapters/web/mr_templ.go +777 -480 generated file: collapsed

load diff

M internal/adapters/web/static/css/55-diff.css +4 -0


@@ -6,3 +6,7 @@
6	6		}
7	7		.eol { color: var(--ink-mute); padding-left: 1ch; user-select: none; }
8	8		}
	9	+
	10	+	@layer components {
	11	+	.sel { outline: 1px solid var(--ink-dim); outline-offset: -1px; }
	12	+	}


@@ -6,3 +6,7 @@
6	}	6		}
7	.eol { color: var(--ink-mute); padding-left: 1ch; user-select: none; }	7		.eol { color: var(--ink-mute); padding-left: 1ch; user-select: none; }
8	}	8		}
		9	+
		10	+	@layer components {
		11	+	.sel { outline: 1px solid var(--ink-dim); outline-offset: -1px; }
		12	+	}

M internal/adapters/web/static/css/60-mr.css +8 -3


@@ -11,7 +11,6 @@
11	11		.mr-desc.prose { max-width: none; padding: var(--s4) var(--s5); background: var(--bg-surface); border: 1px solid var(--border); border-radius: var(--r); }
12	12		.mr-desc.prose > * { max-width: var(--measure); }
13	13		.mr-desc.prose > pre, .mr-desc.prose > table { max-width: 100%; }
14		-	.c-text a { text-decoration: underline; }
15	14
16	15		.since {
17	16		display: inline-flex; flex-wrap: wrap; gap: var(--s1); padding: var(--s1);

@@ -147,12 +146,11 @@
147	146		& p { white-space: normal; }
148	147		& .c-who { font-weight: bold; }
149	148		& .c-state { color: var(--ink-dim); }
150		-	& .c-text { white-space: pre-wrap; overflow-wrap: anywhere; }
151	149		& .c-where { font-size: var(--fs-s); overflow-wrap: anywhere; }
152	150		& .c-act { margin-top: var(--s2); }
153	151		& .c-act button { height: 26px; font-size: var(--fs-xs); }
154	152		&[data-resolved="true"] { border-left-color: var(--border-strong); }
155		-	&[data-resolved="true"] .c-text { color: var(--ink-dim); }
	153	+	&[data-resolved="true"] .c-body { color: var(--ink-dim); }
156	154		}
157	155		.dt .fnote td { background: var(--bg-canvas); padding: var(--s2) var(--s3); white-space: normal; }
158	156		.dt .fnote .cmt, .dt .fnote .cform { margin: 0; }

@@ -190,3 +188,10 @@
190	188		.list.mrs .c-who { display: none; }
191	189		}
192	190		}
	191	+
	192	+	@layer components {
	193	+	.c-body { white-space: normal; overflow-wrap: anywhere; }
	194	+	.c-body.prose > * { margin-block: .5em; }
	195	+	.c-body .ref { font-variant-numeric: tabular-nums; text-decoration: underline; }
	196	+	.cmt > .cmt { margin-inline-start: 2ch; }
	197	+	}

   .mr-desc.prose { max-width: none; padding: var(--s4) var(--s5); background: var(--bg-surface); border: 1px solid var(--border); border-radius: var(--r); }
   .mr-desc.prose > * { max-width: var(--measure); }
   .mr-desc.prose > pre, .mr-desc.prose > table { max-width: 100%; }
-  .c-text a { text-decoration: underline; }
   .since {
     display: inline-flex; flex-wrap: wrap; gap: var(--s1); padding: var(--s1);
     & p { white-space: normal; }
     & .c-who { font-weight: bold; }
     & .c-state { color: var(--ink-dim); }
-    & .c-text { white-space: pre-wrap; overflow-wrap: anywhere; }
     & .c-where { font-size: var(--fs-s); overflow-wrap: anywhere; }
     & .c-act { margin-top: var(--s2); }
     & .c-act button { height: 26px; font-size: var(--fs-xs); }
     &[data-resolved="true"] { border-left-color: var(--border-strong); }
-    &[data-resolved="true"] .c-text { color: var(--ink-dim); }
+    &[data-resolved="true"] .c-body { color: var(--ink-dim); }
   }
   .dt .fnote td { background: var(--bg-canvas); padding: var(--s2) var(--s3); white-space: normal; }
   .dt .fnote .cmt, .dt .fnote .cform { margin: 0; }
     .list.mrs .c-who { display: none; }
   }
 }
+@layer components {
+  .c-body { white-space: normal; overflow-wrap: anywhere; }
+  .c-body.prose > * { margin-block: .5em; }
+  .c-body .ref { font-variant-numeric: tabular-nums; text-decoration: underline; }
+  .cmt > .cmt { margin-inline-start: 2ch; }
+}

M internal/adapters/web/static/js/mr.js +51 -2


@@ -18,6 +18,25 @@
18	18		window.ermiteMR = (() => {
19	19		// core: the decisions, without the DOM.
20	20		const core = {
	21	+	rangeURL(previous, current, base) {
	22	+	const a = new URL(previous, base), b = new URL(current, base);
	23	+	const parse = (u) => /^(new\|old):(\d+):(.+)$/.exec(u.searchParams.get('on') \|\| '');
	24	+	const x = parse(a), y = parse(b);
	25	+	if (!x \|\| !y \|\| a.pathname !== b.pathname \|\| x[1] !== y[1] \|\| x[3] !== y[3] \|\| x[2] === y[2]) return null;
	26	+	const nums = [Number(x[2]), Number(y[2])].sort((a,b) => a-b);
	27	+	b.searchParams.set('on', `${y[1]}:${nums[0]}-${nums[1]}:${y[3]}`);
	28	+	return b.href;
	29	+	},
	30	+	quote(button) {
	31	+	const thread = button.closest('.cmt').closest('[data-thread]');
	32	+	const details = thread?.querySelector(':scope > details[data-reply]');
	33	+	const field = details?.querySelector('textarea');
	34	+	if (!field) return false;
	35	+	details.open = true;
	36	+	field.value = button.dataset.quote;
	37	+	field.focus();
	38	+	return true;
	39	+	},
21	40		// windowOf is the start of the window of file i (files are f1, f2, ...).
22	41		windowOf(id, size) {
23	42		const n = Number(String(id).replace(/^f/, '')) - 1;

@@ -107,16 +126,34 @@ window.ermiteMR = (() => {
107	126		function reveal(id, scroll = true) {
108	127		// Any navigation, loaded or not, makes the reveals still loading stale.
109	128		const gen = ++revealGen;
	129	+	const target = () => {
	130	+	// A page with both layouts says which shows in data-diff; a large diff
	131	+	// rendered in one layout only says it in data-view.
	132	+	const diffs = $('#diffs')?.dataset;
	133	+	if (/^c\d+$/.test(id) && (diffs?.diff \|\| diffs?.view) === 'split') {
	134	+	const split = document.getElementById(id + '-s');
	135	+	if (split) return split;
	136	+	}
	137	+	return document.getElementById(id);
	138	+	};
110	139		let ph = document.getElementById(id)?.querySelector(':scope > .dlazy');
111	140		if (!ph && /^c\d+/.test(id) && !document.getElementById(id)) {
112	141		const base = id.replace(/-s$/, '');
113	142		ph = $$('.dlazy[data-notes]').find((p) => p.dataset.notes.split(' ').includes(base));
114	143		}
115		-	if (!ph) return false;
	144	+	if (!ph) {
	145	+	const el = target();
	146	+	if (el && el.id !== id) {
	147	+	const d = el.closest('details');
	148	+	if (d) d.open = true;
	149	+	if (scroll) el.scrollIntoView({ block: 'start' });
	150	+	}
	151	+	return false;
	152	+	}
116	153		load(ph).then(() => {
117	154		// A later reveal (another file asked meanwhile) owns the view.
118	155		if (gen !== revealGen) return;
119		-	const el = document.getElementById(id);
	156	+	const el = target();
120	157		if (!el) return;
121	158		const d = el.closest('details');
122	159		if (d) d.open = true;

@@ -262,6 +299,18 @@ window.ermiteMR = (() => {
262	299		};
263	300		addEventListener('hashchange', hash);
264	301		hash();
	302	+	let lastLine = null;
	303	+	try { lastLine = sessionStorage.getItem('mr-last-line'); } catch { /* storage optional */ }
	304	+	addEventListener('click', (e) => {
	305	+	const quote = e.target.closest?.('[data-quote]');
	306	+	if (quote) { core.quote(quote); return; }
	307	+	const link = e.target.closest?.('a[href*="on="]');
	308	+	if (!link \|\| e.ctrlKey \|\| e.metaKey \|\| e.altKey) return;
	309	+	const next = e.shiftKey && lastLine && core.rangeURL(lastLine, link.href, location.href);
	310	+	lastLine = link.href;
	311	+	try { sessionStorage.setItem('mr-last-line', lastLine); } catch { /* storage optional */ }
	312	+	if (next) { e.preventDefault(); location.assign(next); }
	313	+	});
265	314		// A click outside an open menu closes it.
266	315		addEventListener('click', (e) => {
267	316		for (const d of $$('details.menu[open]')) if (!d.contains(e.target)) d.open = false;


@@ -18,6 +18,25 @@
18		window.ermiteMR = (() => {	18		window.ermiteMR = (() => {
19		// core: the decisions, without the DOM.	19		// core: the decisions, without the DOM.
20		const core = {	20		const core = {
			21	+	rangeURL(previous, current, base) {
			22	+	const a = new URL(previous, base), b = new URL(current, base);
			23	+	const parse = (u) => /^(new\|old):(\d+):(.+)$/.exec(u.searchParams.get('on') \|\| '');
			24	+	const x = parse(a), y = parse(b);
			25	+	if (!x \|\| !y \|\| a.pathname !== b.pathname \|\| x[1] !== y[1] \|\| x[3] !== y[3] \|\| x[2] === y[2]) return null;
			26	+	const nums = [Number(x[2]), Number(y[2])].sort((a,b) => a-b);
			27	+	b.searchParams.set('on', `${y[1]}:${nums[0]}-${nums[1]}:${y[3]}`);
			28	+	return b.href;
			29	+	},
			30	+	quote(button) {
			31	+	const thread = button.closest('.cmt').closest('[data-thread]');
			32	+	const details = thread?.querySelector(':scope > details[data-reply]');
			33	+	const field = details?.querySelector('textarea');
			34	+	if (!field) return false;
			35	+	details.open = true;
			36	+	field.value = button.dataset.quote;
			37	+	field.focus();
			38	+	return true;
			39	+	},
21		// windowOf is the start of the window of file i (files are f1, f2, ...).	40		// windowOf is the start of the window of file i (files are f1, f2, ...).
22		windowOf(id, size) {	41		windowOf(id, size) {
23		const n = Number(String(id).replace(/^f/, '')) - 1;	42		const n = Number(String(id).replace(/^f/, '')) - 1;

@@ -107,16 +126,34 @@ window.ermiteMR = (() => {
107		function reveal(id, scroll = true) {	126		function reveal(id, scroll = true) {
108		// Any navigation, loaded or not, makes the reveals still loading stale.	127		// Any navigation, loaded or not, makes the reveals still loading stale.
109		const gen = ++revealGen;	128		const gen = ++revealGen;
			129	+	const target = () => {
			130	+	// A page with both layouts says which shows in data-diff; a large diff
			131	+	// rendered in one layout only says it in data-view.
			132	+	const diffs = $('#diffs')?.dataset;
			133	+	if (/^c\d+$/.test(id) && (diffs?.diff \|\| diffs?.view) === 'split') {
			134	+	const split = document.getElementById(id + '-s');
			135	+	if (split) return split;
			136	+	}
			137	+	return document.getElementById(id);
			138	+	};
110		let ph = document.getElementById(id)?.querySelector(':scope > .dlazy');	139		let ph = document.getElementById(id)?.querySelector(':scope > .dlazy');
111		if (!ph && /^c\d+/.test(id) && !document.getElementById(id)) {	140		if (!ph && /^c\d+/.test(id) && !document.getElementById(id)) {
112		const base = id.replace(/-s$/, '');	141		const base = id.replace(/-s$/, '');
113		ph = $$('.dlazy[data-notes]').find((p) => p.dataset.notes.split(' ').includes(base));	142		ph = $$('.dlazy[data-notes]').find((p) => p.dataset.notes.split(' ').includes(base));
114		}	143		}
115	-	if (!ph) return false;	144	+	if (!ph) {
			145	+	const el = target();
			146	+	if (el && el.id !== id) {
			147	+	const d = el.closest('details');
			148	+	if (d) d.open = true;
			149	+	if (scroll) el.scrollIntoView({ block: 'start' });
			150	+	}
			151	+	return false;
			152	+	}
116		load(ph).then(() => {	153		load(ph).then(() => {
117		// A later reveal (another file asked meanwhile) owns the view.	154		// A later reveal (another file asked meanwhile) owns the view.
118		if (gen !== revealGen) return;	155		if (gen !== revealGen) return;
119	-	const el = document.getElementById(id);	156	+	const el = target();
120		if (!el) return;	157		if (!el) return;
121		const d = el.closest('details');	158		const d = el.closest('details');
122		if (d) d.open = true;	159		if (d) d.open = true;

@@ -262,6 +299,18 @@ window.ermiteMR = (() => {
262		};	299		};
263		addEventListener('hashchange', hash);	300		addEventListener('hashchange', hash);
264		hash();	301		hash();
			302	+	let lastLine = null;
			303	+	try { lastLine = sessionStorage.getItem('mr-last-line'); } catch { /* storage optional */ }
			304	+	addEventListener('click', (e) => {
			305	+	const quote = e.target.closest?.('[data-quote]');
			306	+	if (quote) { core.quote(quote); return; }
			307	+	const link = e.target.closest?.('a[href*="on="]');
			308	+	if (!link \|\| e.ctrlKey \|\| e.metaKey \|\| e.altKey) return;
			309	+	const next = e.shiftKey && lastLine && core.rangeURL(lastLine, link.href, location.href);
			310	+	lastLine = link.href;
			311	+	try { sessionStorage.setItem('mr-last-line', lastLine); } catch { /* storage optional */ }
			312	+	if (next) { e.preventDefault(); location.assign(next); }
			313	+	});
265		// A click outside an open menu closes it.	314		// A click outside an open menu closes it.
266		addEventListener('click', (e) => {	315		addEventListener('click', (e) => {
267		for (const d of $$('details.menu[open]')) if (!d.contains(e.target)) d.open = false;	316		for (const d of $$('details.menu[open]')) if (!d.contains(e.target)) d.open = false;

M internal/adapters/web/web.go +2 -0


@@ -190,6 +190,8 @@ func (s Server) routes() http.ServeMux {
190	190		mux.HandleFunc("POST /{repo}/merge-requests", s.mrAction(s.mrCreate))
191	191		mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments", s.mrAction(s.mrComment))
192	192		mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/resolve", s.mrAction(s.mrResolve))
	193	+	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/edit", s.mrAction(s.mrEditComment))
	194	+	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/delete", s.mrAction(s.mrDeleteComment))
193	195		mux.HandleFunc("POST /{repo}/merge-requests/{n}/merge", s.mrAction(s.mrMerge))
194	196		mux.HandleFunc("POST /{repo}/merge-requests/{n}/close", s.mrAction(s.mrClose))
195	197		mux.HandleFunc("POST /{repo}/merge-requests/{n}/ready", s.mrAction(s.mrReady))


@@ -190,6 +190,8 @@ func (s Server) routes() http.ServeMux {
190	mux.HandleFunc("POST /{repo}/merge-requests", s.mrAction(s.mrCreate))	190		mux.HandleFunc("POST /{repo}/merge-requests", s.mrAction(s.mrCreate))
191	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments", s.mrAction(s.mrComment))	191		mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments", s.mrAction(s.mrComment))
192	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/resolve", s.mrAction(s.mrResolve))	192		mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/resolve", s.mrAction(s.mrResolve))
		193	+	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/edit", s.mrAction(s.mrEditComment))
		194	+	mux.HandleFunc("POST /{repo}/merge-requests/{n}/comments/{id}/delete", s.mrAction(s.mrDeleteComment))
193	mux.HandleFunc("POST /{repo}/merge-requests/{n}/merge", s.mrAction(s.mrMerge))	195		mux.HandleFunc("POST /{repo}/merge-requests/{n}/merge", s.mrAction(s.mrMerge))
194	mux.HandleFunc("POST /{repo}/merge-requests/{n}/close", s.mrAction(s.mrClose))	196		mux.HandleFunc("POST /{repo}/merge-requests/{n}/close", s.mrAction(s.mrClose))
195	mux.HandleFunc("POST /{repo}/merge-requests/{n}/ready", s.mrAction(s.mrReady))	197		mux.HandleFunc("POST /{repo}/merge-requests/{n}/ready", s.mrAction(s.mrReady))

M internal/app/cli_mr.go +226 -25


@@ -141,12 +141,28 @@ type jsonComment struct {
141	141		Text string `json:"text"`
142	142		Resolved bool `json:"resolved"`
143	143		CreatedAt *string `json:"created_at"`
	144	+	ReplyTo string `json:"reply_to"`
	145	+	StartLine int32 `json:"start_line"`
	146	+	Verdict string `json:"verdict"`
	147	+	EditedAt *string `json:"edited_at"`
	148	+	Deleted bool `json:"deleted"`
	149	+	}
	150	+
	151	+	func verdictName(v ermite.Verdict) string {
	152	+	switch v {
	153	+	case ermite.Verdict_VERDICT_APPROVE:
	154	+	return "approve"
	155	+	case ermite.Verdict_VERDICT_CHANGES_REQUESTED:
	156	+	return "changes_requested"
	157	+	}
	158	+	return ""
144	159		}
145	160
146	161		func toJSONComment(c *ermite.Comment) jsonComment {
147	162		return jsonComment{
148	163		ID: c.GetId(), Author: c.GetAuthor(), Path: c.GetPath(), Line: c.GetLine(), Side: sideName(c.GetSide()),
149	164		CommitID: c.GetCommitId(), Text: c.GetText(), Resolved: c.GetResolved(), CreatedAt: jsonTime(c.GetCreatedAt()),
	165	+	ReplyTo: c.GetReplyTo(), StartLine: c.GetStartLine(), Verdict: verdictName(c.GetVerdict()), EditedAt: jsonTime(c.GetEditedAt()), Deleted: c.GetDeleted(),
150	166		}
151	167		}
152	168

@@ -160,7 +176,8 @@ unless merged).`
160	176		const jsonCommentHelp = `
161	177		JSON fields of a comment: id, author, path, line and side ("old" or "new"; empty path, line 0
162	178		and empty side for a general comment), commit_id (the head when it was written), text,
163		-	resolved, created_at.`
	179	+	resolved, created_at, reply_to (empty for roots), start_line (0 for a single line),
	180	+	verdict ("", "approve", "changes_requested"), edited_at (nullable RFC 3339), deleted.`
164	181
165	182		func newMRCmd(env cliEnv) cobra.Command {
166	183		mr := &cobra.Command{

@@ -172,7 +189,7 @@ func newMRCmd(env cliEnv) cobra.Command {
172	189		}
173	190		mr.AddCommand(
174	191		newMRCreateCmd(env), newMRListCmd(env), newMRShowCmd(env), newMRCommentCmd(env),
175		-	newMRResolveCmd(env), newMRMergeCmd(env), newMRCloseCmd(env),
	192	+	newMRResolveCmd(env), newMREditCommentCmd(env), newMRDeleteCommentCmd(env), newMRMergeCmd(env), newMRCloseCmd(env),
176	193		)
177	194		return mr
178	195		}

@@ -385,15 +402,25 @@ type jsonCommit struct {
385	402		// jsonMRDetail is the stable JSON shape of `mr show --json`.
386	403		type jsonMRDetail struct {
387	404		jsonMergeRequest
388		-	Commits []jsonCommit `json:"commits"`
389		-	CommitsTruncated bool `json:"commits_truncated"`
390		-	DiffBaseID string `json:"diff_base_id"`
391		-	Stats jsonStats `json:"stats"`
392		-	DiffTruncated bool `json:"diff_truncated"`
393		-	Files []jsonFile `json:"files"`
394		-	Comments []jsonComment `json:"comments"`
395		-	LastReadID string `json:"last_read_id"`
396		-	LastReadLost bool `json:"last_read_lost"`
	405	+	Commits []jsonCommit `json:"commits"`
	406	+	CommitsTruncated bool `json:"commits_truncated"`
	407	+	DiffBaseID string `json:"diff_base_id"`
	408	+	Stats jsonStats `json:"stats"`
	409	+	DiffTruncated bool `json:"diff_truncated"`
	410	+	Files []jsonFile `json:"files"`
	411	+	Comments []jsonComment `json:"comments"`
	412	+	Verdicts []jsonAuthorVerdict `json:"verdicts"`
	413	+	LastReadID string `json:"last_read_id"`
	414	+	LastReadLost bool `json:"last_read_lost"`
	415	+	}
	416	+
	417	+	type jsonAuthorVerdict struct {
	418	+	Author string `json:"author"`
	419	+	Verdict string `json:"verdict"`
	420	+	CommentID string `json:"comment_id"`
	421	+	CommitID string `json:"commit_id"`
	422	+	CreatedAt *string `json:"created_at"`
	423	+	Stale bool `json:"stale"`
397	424		}
398	425
399	426		func fileStatusName(s ermite.FileStatus) string {

@@ -413,7 +440,7 @@ func toJSONDetail(d *ermite.GetMergeRequestResponse, withDiff bool) jsonMRDetail
413	440		FilesChanged: d.GetStats().GetFilesChanged(), Additions: d.GetStats().GetAdditions(), Deletions: d.GetStats().GetDeletions(),
414	441		},
415	442		DiffTruncated: d.GetDiff().GetTruncated(),
416		-	Files: []jsonFile{}, Comments: []jsonComment{},
	443	+	Files: []jsonFile{}, Comments: []jsonComment{}, Verdicts: []jsonAuthorVerdict{},
417	444		LastReadID: d.GetLastReadId(), LastReadLost: d.GetLastReadLost(),
418	445		}
419	446		for _, c := range d.GetCommits() {

@@ -443,6 +470,9 @@ func toJSONDetail(d *ermite.GetMergeRequestResponse, withDiff bool) jsonMRDetail
443	470		for _, c := range d.GetComments() {
444	471		out.Comments = append(out.Comments, toJSONComment(c))
445	472		}
	473	+	for _, v := range d.GetVerdicts() {
	474	+	out.Verdicts = append(out.Verdicts, jsonAuthorVerdict{Author: v.GetAuthor(), Verdict: verdictName(v.GetVerdict()), CommentID: v.GetCommentId(), CommitID: v.GetCommitId(), CreatedAt: jsonTime(v.GetCreatedAt()), Stale: v.GetStale()})
	475	+	}
446	476		return out
447	477		}
448	478

@@ -461,7 +491,7 @@ func newMRShowCmd(env cliEnv) cobra.Command {
461	491		"diff_base_id (the commit the diff starts from), stats (files_changed, additions, deletions),\n" +
462	492		"diff_truncated, files (old_path, new_path, status, additions, deletions, binary, truncated and,\n" +
463	493		"with --diff, hunks of lines with kind, old_number, new_number and text), comments, last_read_id\n" +
464		-	"and last_read_lost.",
	494	+	"and last_read_lost; verdicts (author, verdict, comment_id, commit_id, created_at, stale).",
465	495		Args: cobra.ExactArgs(2),
466	496		ValidArgsFunction: completeMRRepoThenNumber(env),
467	497		}

@@ -529,6 +559,25 @@ func printMRDetail(w io.Writer, d *ermite.GetMergeRequestResponse, withDiff, sin
529	559		if m.GetState() == ermite.MergeRequestState_MERGE_REQUEST_STATE_MERGED {
530	560		pairs = append(pairs, [2]string{"merged", orDash(m.GetMergedCommitId()) + " (" + modeName(m.GetMergeMode()) + ")"})
531	561		}
	562	+	if len(d.GetVerdicts()) > 0 {
	563	+	var verdicts []string
	564	+	for _, v := range d.GetVerdicts() {
	565	+	var label string
	566	+	switch v.GetVerdict() {
	567	+	case ermite.Verdict_VERDICT_APPROVE:
	568	+	label = "approved"
	569	+	case ermite.Verdict_VERDICT_CHANGES_REQUESTED:
	570	+	label = "changes requested"
	571	+	default:
	572	+	label = fmt.Sprintf("verdict %d", v.GetVerdict())
	573	+	}
	574	+	if v.GetStale() {
	575	+	label += " (stale)"
	576	+	}
	577	+	verdicts = append(verdicts, v.GetAuthor()+" "+label)
	578	+	}
	579	+	pairs = append(pairs, [2]string{"verdicts", strings.Join(verdicts, ", ")})
	580	+	}
532	581		if err := fields(w, pairs); err != nil {
533	582		return err
534	583		}

@@ -561,16 +610,46 @@ func printMRDetail(w io.Writer, d *ermite.GetMergeRequestResponse, withDiff, sin
561	610		}
562	611
563	612		_, _ = fmt.Fprintf(w, "\ncomments (%d)\n", len(d.GetComments()))
564		-	for _, c := range d.GetComments() {
	613	+	var ordered []*ermite.Comment
	614	+	for _, root := range d.GetComments() {
	615	+	if root.GetReplyTo() != "" {
	616	+	continue
	617	+	}
	618	+	ordered = append(ordered, root)
	619	+	for _, reply := range d.GetComments() {
	620	+	if reply.GetReplyTo() == root.GetId() {
	621	+	ordered = append(ordered, reply)
	622	+	}
	623	+	}
	624	+	}
	625	+	for _, c := range ordered {
565	626		where := "general"
566	627		if c.GetPath() != "" {
567	628		where = fmt.Sprintf("%s:%d (%s)", clean(c.GetPath()), c.GetLine(), sideName(c.GetSide()))
568	629		}
	630	+	if c.GetStartLine() > 0 {
	631	+	where = fmt.Sprintf("%s:lines %d-%d (%s)", clean(c.GetPath()), c.GetStartLine(), c.GetLine(), sideName(c.GetSide()))
	632	+	}
569	633		mark := ""
	634	+	if c.GetEditedAt() != nil {
	635	+	mark += " (edited)"
	636	+	}
	637	+	if c.GetDeleted() {
	638	+	mark += " [deleted]"
	639	+	}
	640	+	if c.GetVerdict() != ermite.Verdict_VERDICT_UNSPECIFIED {
	641	+	mark += " [" + verdictName(c.GetVerdict()) + "]"
	642	+	}
570	643		if c.GetResolved() {
571		-	mark = " [resolved]"
	644	+	mark += " [resolved]"
572	645		}
573		-	_, _ = fmt.Fprintf(w, " #%s %s, %s, %s%s\n%s\n", c.GetId(), clean(c.GetAuthor()), shortTime(c.GetCreatedAt(), "-"), where, mark, indentText(c.GetText()))
	646	+	prefix := " "
	647	+	body := indentText(c.GetText())
	648	+	if c.GetReplyTo() != "" {
	649	+	prefix += " "
	650	+	body = " " + strings.ReplaceAll(body, "\n", "\n ")
	651	+	}
	652	+	_, _ = fmt.Fprintf(w, "%s#%s %s, %s, %s%s\n%s\n", prefix, c.GetId(), clean(c.GetAuthor()), shortTime(c.GetCreatedAt(), "-"), where, mark, body)
574	653		}
575	654		if withDiff {
576	655		printDiff(w, d.GetDiff())

@@ -643,12 +722,14 @@ func printDiff(w io.Writer, d *ermite.Diff) {
643	722		}
644	723
645	724		func newMRCommentCmd(env cliEnv) cobra.Command {
646		-	var message, path, side string
647		-	var line int
	725	+	var message, path, side, line, reply string
	726	+	var approve, requestChanges bool
648	727		cmd := &cobra.Command{
649	728		Use: "comment <repo> <number>",
650	729		Short: "Comment on a merge request",
651		-	Long: "Add a plain-text comment (at most 8000 characters, no control characters except line breaks).\n" +
	730	+	Long: "Add a Markdown note (at most 8000 characters); ^N refers to a note in this merge request.\n" +
	731	+	"--reply replies to a root note. --line accepts N or A-B. --approve and --request-changes\n" +
	732	+	"set a verdict (needs mr:review) and allow an empty message.\n" +
652	733		"-m - reads it from standard input. Without --path it is a general comment. With --path, --line and\n" +
653	734		"--side (default new) it is attached to a line of the current diff: the path as in `mr show --diff`\n" +
654	735		"(the new path, the old one for a deleted file), the line number on the old or new side; a line\n" +

@@ -656,11 +737,18 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
656	737		Args: cobra.ExactArgs(2),
657	738		ValidArgsFunction: completeMRRepoThenNumber(env),
658	739		}
659		-	cmd.Flags().StringVarP(&message, "message", "m", "", "text of the comment, or - to read standard input (required)")
	740	+	cmd.Flags().StringVarP(&message, "message", "m", "", "Markdown text, or - to read standard input (required unless setting a verdict)")
660	741		cmd.Flags().StringVar(&path, "path", "", "file the comment is attached to")
661		-	cmd.Flags().IntVar(&line, "line", 0, "1-based line number on --side")
	742	+	cmd.Flags().StringVar(&line, "line", "", "1-based line N or range A-B on --side")
	743	+	cmd.Flags().StringVar(&reply, "reply", "", "reply to root note (^12, #12 or 12)")
	744	+	cmd.Flags().BoolVar(&approve, "approve", false, "approve (needs mr:review)")
	745	+	cmd.Flags().BoolVar(&requestChanges, "request-changes", false, "request changes (needs mr:review)")
662	746		cmd.Flags().StringVar(&side, "side", sideNew, "side the line counts on: old or new")
663		-	_ = cmd.MarkFlagRequired("message")
	747	+	cmd.MarkFlagsMutuallyExclusive("approve", "request-changes")
	748	+	for _, flag := range []string{"path", "line", "side", "approve", "request-changes"} {
	749	+	cmd.MarkFlagsMutuallyExclusive("reply", flag)
	750	+	}
	751	+	// A verdict note may omit its message.
664	752		_ = cmd.RegisterFlagCompletionFunc("side", func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
665	753		return []string{sideOld, sideNew}, cobra.ShellCompDirectiveNoFileComp
666	754		})

@@ -674,17 +762,36 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
674	762		if err != nil {
675	763		return err
676	764		}
	765	+	if !cmd.Flags().Changed("message") && !approve && !requestChanges {
	766	+	return errors.New("--message is required unless --approve or --request-changes is set")
	767	+	}
677	768		req := &ermite.AddCommentRequest{Repo: args[0], Number: n, Text: text}
	769	+	if approve {
	770	+	req.Verdict = ermite.Verdict_VERDICT_APPROVE
	771	+	}
	772	+	if requestChanges {
	773	+	req.Verdict = ermite.Verdict_VERDICT_CHANGES_REQUESTED
	774	+	}
	775	+	if cmd.Flags().Changed("reply") {
	776	+	req.ReplyTo, err = parseNoteID(reply)
	777	+	if err != nil {
	778	+	return err
	779	+	}
	780	+	}
678	781		switch {
679	782		case path != "":
680		-	if line < 1 {
	783	+	if line == "" {
681	784		return errors.New("--line is required with --path: give the line number")
682	785		}
	786	+	req.StartLine, req.Line, err = parseLineRange(line)
	787	+	if err != nil {
	788	+	return err
	789	+	}
683	790		if req.Side, err = parseSide(side); err != nil {
684	791		return err
685	792		}
686		-	req.Path, req.Line = path, int32(line) //nolint:gosec // a line number typed by a person
687		-	case line != 0 \|\| cmd.Flags().Changed("side"):
	793	+	req.Path = path
	794	+	case cmd.Flags().Changed("line") \|\| cmd.Flags().Changed("side"):
688	795		return errors.New("--line and --side need --path")
689	796		}
690	797		c, err := env.client(cmd)

@@ -704,6 +811,100 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
704	811		return cmd
705	812		}
706	813
	814	+	func parseNoteID(s string) (string, error) {
	815	+	id := strings.TrimLeft(strings.TrimSpace(s), "^#")
	816	+	n, err := strconv.ParseInt(id, 10, 64)
	817	+	if err != nil \|\| n < 1 {
	818	+	return "", fmt.Errorf("invalid note id %q: use ^12, #12 or 12", s)
	819	+	}
	820	+	return strconv.FormatInt(n, 10), nil
	821	+	}
	822	+
	823	+	func parseLineRange(s string) (start, end int32, err error) {
	824	+	parts := strings.Split(s, "-")
	825	+	invalid := fmt.Errorf("invalid --line %q: use N or A-B with 1 <= A < B", s)
	826	+	if len(parts) < 1 \|\| len(parts) > 2 {
	827	+	return 0, 0, invalid
	828	+	}
	829	+	parse := func(v string) (int32, error) {
	830	+	n, e := strconv.ParseInt(v, 10, 32)
	831	+	if e != nil \|\| n < 1 {
	832	+	return 0, invalid
	833	+	}
	834	+	return int32(n), nil
	835	+	}
	836	+	end, err = parse(parts[len(parts)-1])
	837	+	if err != nil {
	838	+	return 0, 0, err
	839	+	}
	840	+	if len(parts) == 2 {
	841	+	start, err = parse(parts[0])
	842	+	if err != nil \|\| start >= end {
	843	+	return 0, 0, invalid
	844	+	}
	845	+	}
	846	+	return start, end, nil
	847	+	}
	848	+
	849	+	func newMREditCommentCmd(env cliEnv) cobra.Command { return newMRNoteMutationCmd(env, true) }
	850	+	func newMRDeleteCommentCmd(env cliEnv) cobra.Command { return newMRNoteMutationCmd(env, false) }
	851	+
	852	+	func newMRNoteMutationCmd(env cliEnv, edit bool) cobra.Command {
	853	+	verb := "delete"
	854	+	if edit {
	855	+	verb = "edit"
	856	+	}
	857	+	var message string
	858	+	cmd := &cobra.Command{Use: verb + "-comment <repo> <number> <comment-id>", Short: verb + " your own merge request note", Long: "Edit or delete your own note on an open merge request. Needs mr:write. Verdicts are unchanged." + jsonCommentHelp, Args: cobra.ExactArgs(3), ValidArgsFunction: completeMRRepoThenNumber(env)}
	859	+	if edit {
	860	+	cmd.Flags().StringVarP(&message, "message", "m", "", "Markdown text, or - to read standard input (required)")
	861	+	_ = cmd.MarkFlagRequired("message")
	862	+	}
	863	+	asJSON := addJSONFlag(cmd)
	864	+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
	865	+	n, err := parseNumber(args[1])
	866	+	if err != nil {
	867	+	return err
	868	+	}
	869	+	id, err := parseNoteID(args[2])
	870	+	if err != nil {
	871	+	return err
	872	+	}
	873	+	text, err := readText(cmd, message)
	874	+	if err != nil {
	875	+	return err
	876	+	}
	877	+	c, err := env.client(cmd)
	878	+	if err != nil {
	879	+	return err
	880	+	}
	881	+	var note *ermite.Comment
	882	+	if edit {
	883	+	res, e := c.MergeRequests().EditComment(env.ctx(cmd), connect.NewRequest(&ermite.EditCommentRequest{Repo: args[0], Number: n, CommentId: id, Text: text}))
	884	+	if e != nil {
	885	+	return c.Describe(e)
	886	+	}
	887	+	note = res.Msg.GetComment()
	888	+	} else {
	889	+	res, e := c.MergeRequests().DeleteComment(env.ctx(cmd), connect.NewRequest(&ermite.DeleteCommentRequest{Repo: args[0], Number: n, CommentId: id}))
	890	+	if e != nil {
	891	+	return c.Describe(e)
	892	+	}
	893	+	note = res.Msg.GetComment()
	894	+	}
	895	+	if *asJSON {
	896	+	return writeJSON(cmd.OutOrStdout(), toJSONComment(note))
	897	+	}
	898	+	past := "deleted"
	899	+	if edit {
	900	+	past = "edited"
	901	+	}
	902	+	_, err = fmt.Fprintf(cmd.OutOrStdout(), "comment %s of %s!%d %s\n", clean(id), clean(args[0]), n, past)
	903	+	return err
	904	+	}
	905	+	return cmd
	906	+	}
	907	+
707	908		func newMRResolveCmd(env cliEnv) cobra.Command {
708	909		var undo bool
709	910		cmd := &cobra.Command{


@@ -141,12 +141,28 @@ type jsonComment struct {
141		Text string `json:"text"`	141		Text string `json:"text"`
142		Resolved bool `json:"resolved"`	142		Resolved bool `json:"resolved"`
143		CreatedAt *string `json:"created_at"`	143		CreatedAt *string `json:"created_at"`
			144	+	ReplyTo string `json:"reply_to"`
			145	+	StartLine int32 `json:"start_line"`
			146	+	Verdict string `json:"verdict"`
			147	+	EditedAt *string `json:"edited_at"`
			148	+	Deleted bool `json:"deleted"`
			149	+	}
			150	+
			151	+	func verdictName(v ermite.Verdict) string {
			152	+	switch v {
			153	+	case ermite.Verdict_VERDICT_APPROVE:
			154	+	return "approve"
			155	+	case ermite.Verdict_VERDICT_CHANGES_REQUESTED:
			156	+	return "changes_requested"
			157	+	}
			158	+	return ""
144		}	159		}
145			160
146		func toJSONComment(c *ermite.Comment) jsonComment {	161		func toJSONComment(c *ermite.Comment) jsonComment {
147		return jsonComment{	162		return jsonComment{
148		ID: c.GetId(), Author: c.GetAuthor(), Path: c.GetPath(), Line: c.GetLine(), Side: sideName(c.GetSide()),	163		ID: c.GetId(), Author: c.GetAuthor(), Path: c.GetPath(), Line: c.GetLine(), Side: sideName(c.GetSide()),
149		CommitID: c.GetCommitId(), Text: c.GetText(), Resolved: c.GetResolved(), CreatedAt: jsonTime(c.GetCreatedAt()),	164		CommitID: c.GetCommitId(), Text: c.GetText(), Resolved: c.GetResolved(), CreatedAt: jsonTime(c.GetCreatedAt()),
			165	+	ReplyTo: c.GetReplyTo(), StartLine: c.GetStartLine(), Verdict: verdictName(c.GetVerdict()), EditedAt: jsonTime(c.GetEditedAt()), Deleted: c.GetDeleted(),
150		}	166		}
151		}	167		}
152			168

@@ -160,7 +176,8 @@ unless merged).`
160		const jsonCommentHelp = `	176		const jsonCommentHelp = `
161		JSON fields of a comment: id, author, path, line and side ("old" or "new"; empty path, line 0	177		JSON fields of a comment: id, author, path, line and side ("old" or "new"; empty path, line 0
162		and empty side for a general comment), commit_id (the head when it was written), text,	178		and empty side for a general comment), commit_id (the head when it was written), text,
163	-	resolved, created_at.`	179	+	resolved, created_at, reply_to (empty for roots), start_line (0 for a single line),
			180	+	verdict ("", "approve", "changes_requested"), edited_at (nullable RFC 3339), deleted.`
164			181
165		func newMRCmd(env cliEnv) cobra.Command {	182		func newMRCmd(env cliEnv) cobra.Command {
166		mr := &cobra.Command{	183		mr := &cobra.Command{

@@ -172,7 +189,7 @@ func newMRCmd(env cliEnv) cobra.Command {
172		}	189		}
173		mr.AddCommand(	190		mr.AddCommand(
174		newMRCreateCmd(env), newMRListCmd(env), newMRShowCmd(env), newMRCommentCmd(env),	191		newMRCreateCmd(env), newMRListCmd(env), newMRShowCmd(env), newMRCommentCmd(env),
175	-	newMRResolveCmd(env), newMRMergeCmd(env), newMRCloseCmd(env),	192	+	newMRResolveCmd(env), newMREditCommentCmd(env), newMRDeleteCommentCmd(env), newMRMergeCmd(env), newMRCloseCmd(env),
176		)	193		)
177		return mr	194		return mr
178		}	195		}

@@ -385,15 +402,25 @@ type jsonCommit struct {
385		// jsonMRDetail is the stable JSON shape of `mr show --json`.	402		// jsonMRDetail is the stable JSON shape of `mr show --json`.
386		type jsonMRDetail struct {	403		type jsonMRDetail struct {
387		jsonMergeRequest	404		jsonMergeRequest
388	-	Commits []jsonCommit `json:"commits"`	405	+	Commits []jsonCommit `json:"commits"`
389	-	CommitsTruncated bool `json:"commits_truncated"`	406	+	CommitsTruncated bool `json:"commits_truncated"`
390	-	DiffBaseID string `json:"diff_base_id"`	407	+	DiffBaseID string `json:"diff_base_id"`
391	-	Stats jsonStats `json:"stats"`	408	+	Stats jsonStats `json:"stats"`
392	-	DiffTruncated bool `json:"diff_truncated"`	409	+	DiffTruncated bool `json:"diff_truncated"`
393	-	Files []jsonFile `json:"files"`	410	+	Files []jsonFile `json:"files"`
394	-	Comments []jsonComment `json:"comments"`	411	+	Comments []jsonComment `json:"comments"`
395	-	LastReadID string `json:"last_read_id"`	412	+	Verdicts []jsonAuthorVerdict `json:"verdicts"`
396	-	LastReadLost bool `json:"last_read_lost"`	413	+	LastReadID string `json:"last_read_id"`
			414	+	LastReadLost bool `json:"last_read_lost"`
			415	+	}
			416	+
			417	+	type jsonAuthorVerdict struct {
			418	+	Author string `json:"author"`
			419	+	Verdict string `json:"verdict"`
			420	+	CommentID string `json:"comment_id"`
			421	+	CommitID string `json:"commit_id"`
			422	+	CreatedAt *string `json:"created_at"`
			423	+	Stale bool `json:"stale"`
397		}	424		}
398			425
399		func fileStatusName(s ermite.FileStatus) string {	426		func fileStatusName(s ermite.FileStatus) string {

@@ -413,7 +440,7 @@ func toJSONDetail(d *ermite.GetMergeRequestResponse, withDiff bool) jsonMRDetail
413		FilesChanged: d.GetStats().GetFilesChanged(), Additions: d.GetStats().GetAdditions(), Deletions: d.GetStats().GetDeletions(),	440		FilesChanged: d.GetStats().GetFilesChanged(), Additions: d.GetStats().GetAdditions(), Deletions: d.GetStats().GetDeletions(),
414		},	441		},
415		DiffTruncated: d.GetDiff().GetTruncated(),	442		DiffTruncated: d.GetDiff().GetTruncated(),
416	-	Files: []jsonFile{}, Comments: []jsonComment{},	443	+	Files: []jsonFile{}, Comments: []jsonComment{}, Verdicts: []jsonAuthorVerdict{},
417		LastReadID: d.GetLastReadId(), LastReadLost: d.GetLastReadLost(),	444		LastReadID: d.GetLastReadId(), LastReadLost: d.GetLastReadLost(),
418		}	445		}
419		for _, c := range d.GetCommits() {	446		for _, c := range d.GetCommits() {

@@ -443,6 +470,9 @@ func toJSONDetail(d *ermite.GetMergeRequestResponse, withDiff bool) jsonMRDetail
443		for _, c := range d.GetComments() {	470		for _, c := range d.GetComments() {
444		out.Comments = append(out.Comments, toJSONComment(c))	471		out.Comments = append(out.Comments, toJSONComment(c))
445		}	472		}
			473	+	for _, v := range d.GetVerdicts() {
			474	+	out.Verdicts = append(out.Verdicts, jsonAuthorVerdict{Author: v.GetAuthor(), Verdict: verdictName(v.GetVerdict()), CommentID: v.GetCommentId(), CommitID: v.GetCommitId(), CreatedAt: jsonTime(v.GetCreatedAt()), Stale: v.GetStale()})
			475	+	}
446		return out	476		return out
447		}	477		}
448			478

@@ -461,7 +491,7 @@ func newMRShowCmd(env cliEnv) cobra.Command {
461		"diff_base_id (the commit the diff starts from), stats (files_changed, additions, deletions),\n" +	491		"diff_base_id (the commit the diff starts from), stats (files_changed, additions, deletions),\n" +
462		"diff_truncated, files (old_path, new_path, status, additions, deletions, binary, truncated and,\n" +	492		"diff_truncated, files (old_path, new_path, status, additions, deletions, binary, truncated and,\n" +
463		"with --diff, hunks of lines with kind, old_number, new_number and text), comments, last_read_id\n" +	493		"with --diff, hunks of lines with kind, old_number, new_number and text), comments, last_read_id\n" +
464	-	"and last_read_lost.",	494	+	"and last_read_lost; verdicts (author, verdict, comment_id, commit_id, created_at, stale).",
465		Args: cobra.ExactArgs(2),	495		Args: cobra.ExactArgs(2),
466		ValidArgsFunction: completeMRRepoThenNumber(env),	496		ValidArgsFunction: completeMRRepoThenNumber(env),
467		}	497		}

@@ -529,6 +559,25 @@ func printMRDetail(w io.Writer, d *ermite.GetMergeRequestResponse, withDiff, sin
529		if m.GetState() == ermite.MergeRequestState_MERGE_REQUEST_STATE_MERGED {	559		if m.GetState() == ermite.MergeRequestState_MERGE_REQUEST_STATE_MERGED {
530		pairs = append(pairs, [2]string{"merged", orDash(m.GetMergedCommitId()) + " (" + modeName(m.GetMergeMode()) + ")"})	560		pairs = append(pairs, [2]string{"merged", orDash(m.GetMergedCommitId()) + " (" + modeName(m.GetMergeMode()) + ")"})
531		}	561		}
			562	+	if len(d.GetVerdicts()) > 0 {
			563	+	var verdicts []string
			564	+	for _, v := range d.GetVerdicts() {
			565	+	var label string
			566	+	switch v.GetVerdict() {
			567	+	case ermite.Verdict_VERDICT_APPROVE:
			568	+	label = "approved"
			569	+	case ermite.Verdict_VERDICT_CHANGES_REQUESTED:
			570	+	label = "changes requested"
			571	+	default:
			572	+	label = fmt.Sprintf("verdict %d", v.GetVerdict())
			573	+	}
			574	+	if v.GetStale() {
			575	+	label += " (stale)"
			576	+	}
			577	+	verdicts = append(verdicts, v.GetAuthor()+" "+label)
			578	+	}
			579	+	pairs = append(pairs, [2]string{"verdicts", strings.Join(verdicts, ", ")})
			580	+	}
532		if err := fields(w, pairs); err != nil {	581		if err := fields(w, pairs); err != nil {
533		return err	582		return err
534		}	583		}

@@ -561,16 +610,46 @@ func printMRDetail(w io.Writer, d *ermite.GetMergeRequestResponse, withDiff, sin
561		}	610		}
562			611
563		_, _ = fmt.Fprintf(w, "\ncomments (%d)\n", len(d.GetComments()))	612		_, _ = fmt.Fprintf(w, "\ncomments (%d)\n", len(d.GetComments()))
564	-	for _, c := range d.GetComments() {	613	+	var ordered []*ermite.Comment
			614	+	for _, root := range d.GetComments() {
			615	+	if root.GetReplyTo() != "" {
			616	+	continue
			617	+	}
			618	+	ordered = append(ordered, root)
			619	+	for _, reply := range d.GetComments() {
			620	+	if reply.GetReplyTo() == root.GetId() {
			621	+	ordered = append(ordered, reply)
			622	+	}
			623	+	}
			624	+	}
			625	+	for _, c := range ordered {
565		where := "general"	626		where := "general"
566		if c.GetPath() != "" {	627		if c.GetPath() != "" {
567		where = fmt.Sprintf("%s:%d (%s)", clean(c.GetPath()), c.GetLine(), sideName(c.GetSide()))	628		where = fmt.Sprintf("%s:%d (%s)", clean(c.GetPath()), c.GetLine(), sideName(c.GetSide()))
568		}	629		}
			630	+	if c.GetStartLine() > 0 {
			631	+	where = fmt.Sprintf("%s:lines %d-%d (%s)", clean(c.GetPath()), c.GetStartLine(), c.GetLine(), sideName(c.GetSide()))
			632	+	}
569		mark := ""	633		mark := ""
			634	+	if c.GetEditedAt() != nil {
			635	+	mark += " (edited)"
			636	+	}
			637	+	if c.GetDeleted() {
			638	+	mark += " [deleted]"
			639	+	}
			640	+	if c.GetVerdict() != ermite.Verdict_VERDICT_UNSPECIFIED {
			641	+	mark += " [" + verdictName(c.GetVerdict()) + "]"
			642	+	}
570		if c.GetResolved() {	643		if c.GetResolved() {
571	-	mark = " [resolved]"	644	+	mark += " [resolved]"
572		}	645		}
573	-	_, _ = fmt.Fprintf(w, " #%s %s, %s, %s%s\n%s\n", c.GetId(), clean(c.GetAuthor()), shortTime(c.GetCreatedAt(), "-"), where, mark, indentText(c.GetText()))	646	+	prefix := " "
			647	+	body := indentText(c.GetText())
			648	+	if c.GetReplyTo() != "" {
			649	+	prefix += " "
			650	+	body = " " + strings.ReplaceAll(body, "\n", "\n ")
			651	+	}
			652	+	_, _ = fmt.Fprintf(w, "%s#%s %s, %s, %s%s\n%s\n", prefix, c.GetId(), clean(c.GetAuthor()), shortTime(c.GetCreatedAt(), "-"), where, mark, body)
574		}	653		}
575		if withDiff {	654		if withDiff {
576		printDiff(w, d.GetDiff())	655		printDiff(w, d.GetDiff())

@@ -643,12 +722,14 @@ func printDiff(w io.Writer, d *ermite.Diff) {
643		}	722		}
644			723
645		func newMRCommentCmd(env cliEnv) cobra.Command {	724		func newMRCommentCmd(env cliEnv) cobra.Command {
646	-	var message, path, side string	725	+	var message, path, side, line, reply string
647	-	var line int	726	+	var approve, requestChanges bool
648		cmd := &cobra.Command{	727		cmd := &cobra.Command{
649		Use: "comment <repo> <number>",	728		Use: "comment <repo> <number>",
650		Short: "Comment on a merge request",	729		Short: "Comment on a merge request",
651	-	Long: "Add a plain-text comment (at most 8000 characters, no control characters except line breaks).\n" +	730	+	Long: "Add a Markdown note (at most 8000 characters); ^N refers to a note in this merge request.\n" +
			731	+	"--reply replies to a root note. --line accepts N or A-B. --approve and --request-changes\n" +
			732	+	"set a verdict (needs mr:review) and allow an empty message.\n" +
652		"-m - reads it from standard input. Without --path it is a general comment. With --path, --line and\n" +	733		"-m - reads it from standard input. Without --path it is a general comment. With --path, --line and\n" +
653		"--side (default new) it is attached to a line of the current diff: the path as in `mr show --diff`\n" +	734		"--side (default new) it is attached to a line of the current diff: the path as in `mr show --diff`\n" +
654		"(the new path, the old one for a deleted file), the line number on the old or new side; a line\n" +	735		"(the new path, the old one for a deleted file), the line number on the old or new side; a line\n" +

@@ -656,11 +737,18 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
656		Args: cobra.ExactArgs(2),	737		Args: cobra.ExactArgs(2),
657		ValidArgsFunction: completeMRRepoThenNumber(env),	738		ValidArgsFunction: completeMRRepoThenNumber(env),
658		}	739		}
659	-	cmd.Flags().StringVarP(&message, "message", "m", "", "text of the comment, or - to read standard input (required)")	740	+	cmd.Flags().StringVarP(&message, "message", "m", "", "Markdown text, or - to read standard input (required unless setting a verdict)")
660		cmd.Flags().StringVar(&path, "path", "", "file the comment is attached to")	741		cmd.Flags().StringVar(&path, "path", "", "file the comment is attached to")
661	-	cmd.Flags().IntVar(&line, "line", 0, "1-based line number on --side")	742	+	cmd.Flags().StringVar(&line, "line", "", "1-based line N or range A-B on --side")
			743	+	cmd.Flags().StringVar(&reply, "reply", "", "reply to root note (^12, #12 or 12)")
			744	+	cmd.Flags().BoolVar(&approve, "approve", false, "approve (needs mr:review)")
			745	+	cmd.Flags().BoolVar(&requestChanges, "request-changes", false, "request changes (needs mr:review)")
662		cmd.Flags().StringVar(&side, "side", sideNew, "side the line counts on: old or new")	746		cmd.Flags().StringVar(&side, "side", sideNew, "side the line counts on: old or new")
663	-	_ = cmd.MarkFlagRequired("message")	747	+	cmd.MarkFlagsMutuallyExclusive("approve", "request-changes")
			748	+	for _, flag := range []string{"path", "line", "side", "approve", "request-changes"} {
			749	+	cmd.MarkFlagsMutuallyExclusive("reply", flag)
			750	+	}
			751	+	// A verdict note may omit its message.
664		_ = cmd.RegisterFlagCompletionFunc("side", func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {	752		_ = cmd.RegisterFlagCompletionFunc("side", func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
665		return []string{sideOld, sideNew}, cobra.ShellCompDirectiveNoFileComp	753		return []string{sideOld, sideNew}, cobra.ShellCompDirectiveNoFileComp
666		})	754		})

@@ -674,17 +762,36 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
674		if err != nil {	762		if err != nil {
675		return err	763		return err
676		}	764		}
			765	+	if !cmd.Flags().Changed("message") && !approve && !requestChanges {
			766	+	return errors.New("--message is required unless --approve or --request-changes is set")
			767	+	}
677		req := &ermite.AddCommentRequest{Repo: args[0], Number: n, Text: text}	768		req := &ermite.AddCommentRequest{Repo: args[0], Number: n, Text: text}
			769	+	if approve {
			770	+	req.Verdict = ermite.Verdict_VERDICT_APPROVE
			771	+	}
			772	+	if requestChanges {
			773	+	req.Verdict = ermite.Verdict_VERDICT_CHANGES_REQUESTED
			774	+	}
			775	+	if cmd.Flags().Changed("reply") {
			776	+	req.ReplyTo, err = parseNoteID(reply)
			777	+	if err != nil {
			778	+	return err
			779	+	}
			780	+	}
678		switch {	781		switch {
679		case path != "":	782		case path != "":
680	-	if line < 1 {	783	+	if line == "" {
681		return errors.New("--line is required with --path: give the line number")	784		return errors.New("--line is required with --path: give the line number")
682		}	785		}
			786	+	req.StartLine, req.Line, err = parseLineRange(line)
			787	+	if err != nil {
			788	+	return err
			789	+	}
683		if req.Side, err = parseSide(side); err != nil {	790		if req.Side, err = parseSide(side); err != nil {
684		return err	791		return err
685		}	792		}
686	-	req.Path, req.Line = path, int32(line) //nolint:gosec // a line number typed by a person	793	+	req.Path = path
687	-	case line != 0 \|\| cmd.Flags().Changed("side"):	794	+	case cmd.Flags().Changed("line") \|\| cmd.Flags().Changed("side"):
688		return errors.New("--line and --side need --path")	795		return errors.New("--line and --side need --path")
689		}	796		}
690		c, err := env.client(cmd)	797		c, err := env.client(cmd)

@@ -704,6 +811,100 @@ func newMRCommentCmd(env cliEnv) cobra.Command {
704		return cmd	811		return cmd
705		}	812		}
706			813
			814	+	func parseNoteID(s string) (string, error) {
			815	+	id := strings.TrimLeft(strings.TrimSpace(s), "^#")
			816	+	n, err := strconv.ParseInt(id, 10, 64)
			817	+	if err != nil \|\| n < 1 {
			818	+	return "", fmt.Errorf("invalid note id %q: use ^12, #12 or 12", s)
			819	+	}
			820	+	return strconv.FormatInt(n, 10), nil
			821	+	}
			822	+
			823	+	func parseLineRange(s string) (start, end int32, err error) {
			824	+	parts := strings.Split(s, "-")
			825	+	invalid := fmt.Errorf("invalid --line %q: use N or A-B with 1 <= A < B", s)
			826	+	if len(parts) < 1 \|\| len(parts) > 2 {
			827	+	return 0, 0, invalid
			828	+	}
			829	+	parse := func(v string) (int32, error) {
			830	+	n, e := strconv.ParseInt(v, 10, 32)
			831	+	if e != nil \|\| n < 1 {
			832	+	return 0, invalid
			833	+	}
			834	+	return int32(n), nil
			835	+	}
			836	+	end, err = parse(parts[len(parts)-1])
			837	+	if err != nil {
			838	+	return 0, 0, err
			839	+	}
			840	+	if len(parts) == 2 {
			841	+	start, err = parse(parts[0])
			842	+	if err != nil \|\| start >= end {
			843	+	return 0, 0, invalid
			844	+	}
			845	+	}
			846	+	return start, end, nil
			847	+	}
			848	+
			849	+	func newMREditCommentCmd(env cliEnv) cobra.Command { return newMRNoteMutationCmd(env, true) }
			850	+	func newMRDeleteCommentCmd(env cliEnv) cobra.Command { return newMRNoteMutationCmd(env, false) }
			851	+
			852	+	func newMRNoteMutationCmd(env cliEnv, edit bool) cobra.Command {
			853	+	verb := "delete"
			854	+	if edit {
			855	+	verb = "edit"
			856	+	}
			857	+	var message string
			858	+	cmd := &cobra.Command{Use: verb + "-comment <repo> <number> <comment-id>", Short: verb + " your own merge request note", Long: "Edit or delete your own note on an open merge request. Needs mr:write. Verdicts are unchanged." + jsonCommentHelp, Args: cobra.ExactArgs(3), ValidArgsFunction: completeMRRepoThenNumber(env)}
			859	+	if edit {
			860	+	cmd.Flags().StringVarP(&message, "message", "m", "", "Markdown text, or - to read standard input (required)")
			861	+	_ = cmd.MarkFlagRequired("message")
			862	+	}
			863	+	asJSON := addJSONFlag(cmd)
			864	+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
			865	+	n, err := parseNumber(args[1])
			866	+	if err != nil {
			867	+	return err
			868	+	}
			869	+	id, err := parseNoteID(args[2])
			870	+	if err != nil {
			871	+	return err
			872	+	}
			873	+	text, err := readText(cmd, message)
			874	+	if err != nil {
			875	+	return err
			876	+	}
			877	+	c, err := env.client(cmd)
			878	+	if err != nil {
			879	+	return err
			880	+	}
			881	+	var note *ermite.Comment
			882	+	if edit {
			883	+	res, e := c.MergeRequests().EditComment(env.ctx(cmd), connect.NewRequest(&ermite.EditCommentRequest{Repo: args[0], Number: n, CommentId: id, Text: text}))
			884	+	if e != nil {
			885	+	return c.Describe(e)
			886	+	}
			887	+	note = res.Msg.GetComment()
			888	+	} else {
			889	+	res, e := c.MergeRequests().DeleteComment(env.ctx(cmd), connect.NewRequest(&ermite.DeleteCommentRequest{Repo: args[0], Number: n, CommentId: id}))
			890	+	if e != nil {
			891	+	return c.Describe(e)
			892	+	}
			893	+	note = res.Msg.GetComment()
			894	+	}
			895	+	if *asJSON {
			896	+	return writeJSON(cmd.OutOrStdout(), toJSONComment(note))
			897	+	}
			898	+	past := "deleted"
			899	+	if edit {
			900	+	past = "edited"
			901	+	}
			902	+	_, err = fmt.Fprintf(cmd.OutOrStdout(), "comment %s of %s!%d %s\n", clean(id), clean(args[0]), n, past)
			903	+	return err
			904	+	}
			905	+	return cmd
			906	+	}
			907	+
707		func newMRResolveCmd(env cliEnv) cobra.Command {	908		func newMRResolveCmd(env cliEnv) cobra.Command {
708		var undo bool	909		var undo bool
709		cmd := &cobra.Command{	910		cmd := &cobra.Command{

M internal/app/cli_mr_e2e_test.go +72 -0


@@ -420,3 +420,75 @@ func (w watchProc) nextOfType(t testing.T, typ string) eventOut {
420	420		t.Fatalf("no %s event", typ)
421	421		return eventOut{}
422	422		}
	423	+
	424	+	func TestMergeRequestNotesCLIEndToEnd(t *testing.T) {
	425	+	c := newCLIHarness(t)
	426	+	c.cli(t, adminToken, "repo", "create", "notes", "--visibility", "public").ok(t)
	427	+	wt := c.workTree("main", "README.md")
	428	+	c.mustGit(wt, "checkout", "-q", "-b", "feat/notes")
	429	+	c.writeFile(wt, "notes.txt", []byte("one\ntwo\nthree\nfour\n"))
	430	+	c.mustGit(wt, "push", "-q", c.urlAuth(adminToken, "/notes.git"), "main", "feat/notes")
	431	+	c.cli(t, adminToken, "mr", "create", "notes", "--source", "feat/notes", "--title", "Notes").ok(t)
	432	+	w := c.startWatch(t, adminToken)
	433	+	res := c.cli(t, adminToken, "mr", "comment", "notes", "1", "--path", "notes.txt", "--line", "1-3", "-m", "range", "--json").ok(t)
	434	+	root := decode[jsonComment](t, res.stdout)
	435	+	assert.EqualValues(t, 1, root.StartLine)
	436	+	assert.EqualValues(t, 3, root.Line)
	437	+	w.nextOfType(t, "comment_added")
	438	+	res = c.cli(t, adminToken, "mr", "comment", "notes", "1", "--reply", "^"+root.ID, "-m", "reply to ^"+root.ID, "--json").ok(t)
	439	+	reply := decode[jsonComment](t, res.stdout)
	440	+	assert.Equal(t, root.ID, reply.ReplyTo)
	441	+	assert.Equal(t, root.Path, reply.Path)
	442	+	assert.Equal(t, root.StartLine, reply.StartLine)
	443	+	assert.Equal(t, root.Line, reply.Line)
	444	+	w.nextOfType(t, "comment_added")
	445	+	require.Error(t, c.cli(t, adminToken, "mr", "comment", "notes", "1", "--reply", reply.ID, "-m", "nested").err)
	446	+	require.Error(t, c.cli(t, adminToken, "mr", "resolve", "notes", "1", reply.ID).err)
	447	+	writer := c.token([]domain.Scope{domain.ScopeRepoRead, domain.ScopeMRWrite})
	448	+	denied := c.cli(t, writer, "mr", "comment", "notes", "1", "--approve")
	449	+	require.Error(t, denied.err)
	450	+	assert.Contains(t, denied.err.Error(), "mr:review")
	451	+	res = c.cli(t, adminToken, "mr", "comment", "notes", "1", "--approve", "--json").ok(t)
	452	+	verdict := decode[jsonComment](t, res.stdout)
	453	+	assert.Equal(t, "approve", verdict.Verdict)
	454	+	assert.True(t, verdict.Resolved)
	455	+	assert.Empty(t, verdict.Text)
	456	+	w.nextOfType(t, "comment_added")
	457	+	require.Error(t, c.cli(t, writer, "mr", "edit-comment", "notes", "1", verdict.ID, "-m", "not mine").err)
	458	+	res = runCLI(t, c.vars(adminToken), "edited from stdin\n", "mr", "edit-comment", "notes", "1", "#"+reply.ID, "-m", "-", "--json").ok(t)
	459	+	edited := decode[jsonComment](t, res.stdout)
	460	+	assert.Equal(t, "edited from stdin", edited.Text)
	461	+	require.NotNil(t, edited.EditedAt)
	462	+	w.nextOfType(t, "comment_edited")
	463	+	res = c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", verdict.ID, "--json").ok(t)
	464	+	deleted := decode[jsonComment](t, res.stdout)
	465	+	assert.True(t, deleted.Deleted)
	466	+	assert.Equal(t, "approve", deleted.Verdict)
	467	+	assert.Empty(t, deleted.Text)
	468	+	require.NotNil(t, deleted.EditedAt)
	469	+	w.nextOfType(t, "comment_deleted")
	470	+	c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", verdict.ID).ok(t)
	471	+	c.cli(t, adminToken, "mr", "resolve", "notes", "1", root.ID).ok(t)
	472	+	w.nextOfType(t, "comment_resolved")
	473	+	res = c.cli(t, "", "mr", "show", "notes", "1", "--json").ok(t)
	474	+	detail := decode[jsonMRDetail](t, res.stdout)
	475	+	require.Len(t, detail.Comments, 3)
	476	+	require.Len(t, detail.Verdicts, 1)
	477	+	assert.Equal(t, verdict.ID, detail.Verdicts[0].CommentID)
	478	+	assert.Equal(t, "approve", detail.Verdicts[0].Verdict)
	479	+	assert.False(t, detail.Verdicts[0].Stale)
	480	+	res = c.cli(t, "", "mr", "show", "notes", "1").ok(t)
	481	+	assert.Contains(t, res.stdout, "lines 1-3")
	482	+	assert.Contains(t, res.stdout, "(edited)")
	483	+	assert.Contains(t, res.stdout, "[deleted]")
	484	+	assert.Contains(t, res.stdout, "approved")
	485	+	assert.Contains(t, res.stdout, " #"+reply.ID)
	486	+	c.cli(t, adminToken, "mr", "comment", "notes", "1", "--request-changes", "-m", "needs work").ok(t)
	487	+	res = c.cli(t, "", "mr", "show", "notes", "1", "--json").ok(t)
	488	+	detail = decode[jsonMRDetail](t, res.stdout)
	489	+	require.Len(t, detail.Verdicts, 1)
	490	+	assert.Equal(t, "changes_requested", detail.Verdicts[0].Verdict)
	491	+	c.cli(t, adminToken, "mr", "close", "notes", "1").ok(t)
	492	+	require.Error(t, c.cli(t, adminToken, "mr", "edit-comment", "notes", "1", root.ID, "-m", "late").err)
	493	+	require.Error(t, c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", root.ID).err)
	494	+	}


@@ -420,3 +420,75 @@ func (w watchProc) nextOfType(t testing.T, typ string) eventOut {
420	t.Fatalf("no %s event", typ)	420		t.Fatalf("no %s event", typ)
421	return eventOut{}	421		return eventOut{}
422	}	422		}
		423	+
		424	+	func TestMergeRequestNotesCLIEndToEnd(t *testing.T) {
		425	+	c := newCLIHarness(t)
		426	+	c.cli(t, adminToken, "repo", "create", "notes", "--visibility", "public").ok(t)
		427	+	wt := c.workTree("main", "README.md")
		428	+	c.mustGit(wt, "checkout", "-q", "-b", "feat/notes")
		429	+	c.writeFile(wt, "notes.txt", []byte("one\ntwo\nthree\nfour\n"))
		430	+	c.mustGit(wt, "push", "-q", c.urlAuth(adminToken, "/notes.git"), "main", "feat/notes")
		431	+	c.cli(t, adminToken, "mr", "create", "notes", "--source", "feat/notes", "--title", "Notes").ok(t)
		432	+	w := c.startWatch(t, adminToken)
		433	+	res := c.cli(t, adminToken, "mr", "comment", "notes", "1", "--path", "notes.txt", "--line", "1-3", "-m", "range", "--json").ok(t)
		434	+	root := decode[jsonComment](t, res.stdout)
		435	+	assert.EqualValues(t, 1, root.StartLine)
		436	+	assert.EqualValues(t, 3, root.Line)
		437	+	w.nextOfType(t, "comment_added")
		438	+	res = c.cli(t, adminToken, "mr", "comment", "notes", "1", "--reply", "^"+root.ID, "-m", "reply to ^"+root.ID, "--json").ok(t)
		439	+	reply := decode[jsonComment](t, res.stdout)
		440	+	assert.Equal(t, root.ID, reply.ReplyTo)
		441	+	assert.Equal(t, root.Path, reply.Path)
		442	+	assert.Equal(t, root.StartLine, reply.StartLine)
		443	+	assert.Equal(t, root.Line, reply.Line)
		444	+	w.nextOfType(t, "comment_added")
		445	+	require.Error(t, c.cli(t, adminToken, "mr", "comment", "notes", "1", "--reply", reply.ID, "-m", "nested").err)
		446	+	require.Error(t, c.cli(t, adminToken, "mr", "resolve", "notes", "1", reply.ID).err)
		447	+	writer := c.token([]domain.Scope{domain.ScopeRepoRead, domain.ScopeMRWrite})
		448	+	denied := c.cli(t, writer, "mr", "comment", "notes", "1", "--approve")
		449	+	require.Error(t, denied.err)
		450	+	assert.Contains(t, denied.err.Error(), "mr:review")
		451	+	res = c.cli(t, adminToken, "mr", "comment", "notes", "1", "--approve", "--json").ok(t)
		452	+	verdict := decode[jsonComment](t, res.stdout)
		453	+	assert.Equal(t, "approve", verdict.Verdict)
		454	+	assert.True(t, verdict.Resolved)
		455	+	assert.Empty(t, verdict.Text)
		456	+	w.nextOfType(t, "comment_added")
		457	+	require.Error(t, c.cli(t, writer, "mr", "edit-comment", "notes", "1", verdict.ID, "-m", "not mine").err)
		458	+	res = runCLI(t, c.vars(adminToken), "edited from stdin\n", "mr", "edit-comment", "notes", "1", "#"+reply.ID, "-m", "-", "--json").ok(t)
		459	+	edited := decode[jsonComment](t, res.stdout)
		460	+	assert.Equal(t, "edited from stdin", edited.Text)
		461	+	require.NotNil(t, edited.EditedAt)
		462	+	w.nextOfType(t, "comment_edited")
		463	+	res = c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", verdict.ID, "--json").ok(t)
		464	+	deleted := decode[jsonComment](t, res.stdout)
		465	+	assert.True(t, deleted.Deleted)
		466	+	assert.Equal(t, "approve", deleted.Verdict)
		467	+	assert.Empty(t, deleted.Text)
		468	+	require.NotNil(t, deleted.EditedAt)
		469	+	w.nextOfType(t, "comment_deleted")
		470	+	c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", verdict.ID).ok(t)
		471	+	c.cli(t, adminToken, "mr", "resolve", "notes", "1", root.ID).ok(t)
		472	+	w.nextOfType(t, "comment_resolved")
		473	+	res = c.cli(t, "", "mr", "show", "notes", "1", "--json").ok(t)
		474	+	detail := decode[jsonMRDetail](t, res.stdout)
		475	+	require.Len(t, detail.Comments, 3)
		476	+	require.Len(t, detail.Verdicts, 1)
		477	+	assert.Equal(t, verdict.ID, detail.Verdicts[0].CommentID)
		478	+	assert.Equal(t, "approve", detail.Verdicts[0].Verdict)
		479	+	assert.False(t, detail.Verdicts[0].Stale)
		480	+	res = c.cli(t, "", "mr", "show", "notes", "1").ok(t)
		481	+	assert.Contains(t, res.stdout, "lines 1-3")
		482	+	assert.Contains(t, res.stdout, "(edited)")
		483	+	assert.Contains(t, res.stdout, "[deleted]")
		484	+	assert.Contains(t, res.stdout, "approved")
		485	+	assert.Contains(t, res.stdout, " #"+reply.ID)
		486	+	c.cli(t, adminToken, "mr", "comment", "notes", "1", "--request-changes", "-m", "needs work").ok(t)
		487	+	res = c.cli(t, "", "mr", "show", "notes", "1", "--json").ok(t)
		488	+	detail = decode[jsonMRDetail](t, res.stdout)
		489	+	require.Len(t, detail.Verdicts, 1)
		490	+	assert.Equal(t, "changes_requested", detail.Verdicts[0].Verdict)
		491	+	c.cli(t, adminToken, "mr", "close", "notes", "1").ok(t)
		492	+	require.Error(t, c.cli(t, adminToken, "mr", "edit-comment", "notes", "1", root.ID, "-m", "late").err)
		493	+	require.Error(t, c.cli(t, adminToken, "mr", "delete-comment", "notes", "1", root.ID).err)
		494	+	}

M internal/app/cli_mr_test.go +89 -0


@@ -381,3 +381,92 @@ func TestSigningKeyShowOutput(t *testing.T) {
381	381		res = runCLI(t, envFor(url), "", "signing-key", "show", "--json").ok(t)
382	382		assert.JSONEq(t, `{"public_key":"ssh-ed25519 AAAAC3Nz","fingerprint":"SHA256:abc","committer_name":"ermite","committer_email":"ermite@git.example.org","allowed_signers":"ermite@git.example.org ssh-ed25519 AAAAC3Nz"}`, res.stdout)
383	383		}
	384	+
	385	+	func TestNoteRangesAndIDs(t *testing.T) {
	386	+	for _, tc := range []struct {
	387	+	input string
	388	+	start, end int32
	389	+	}{{"1", 0, 1}, {"10-24", 10, 24}, {"2147483647", 0, 2147483647}} {
	390	+	start, end, err := parseLineRange(tc.input)
	391	+	require.NoError(t, err)
	392	+	assert.Equal(t, tc.start, start)
	393	+	assert.Equal(t, tc.end, end)
	394	+	}
	395	+	for _, input := range []string{"", "0", "-1", "1-1", "24-10", "0-2", "1-2-3", "2147483648", "a", "1-"} {
	396	+	_, _, err := parseLineRange(input)
	397	+	require.Error(t, err, input)
	398	+	}
	399	+	for _, input := range []string{"12", "^12", "#12"} {
	400	+	got, err := parseNoteID(input)
	401	+	require.NoError(t, err)
	402	+	assert.Equal(t, "12", got)
	403	+	}
	404	+	}
	405	+
	406	+	func TestNoteFlags(t *testing.T) {
	407	+	f := &fakeAPI{addComment: func(r ermite.AddCommentRequest) (ermite.AddCommentResponse, error) {
	408	+	return &ermite.AddCommentResponse{Comment: &ermite.Comment{Id: "1", ReplyTo: r.GetReplyTo(), StartLine: r.GetStartLine(), Line: r.GetLine(), Verdict: r.GetVerdict()}}, nil
	409	+	}}
	410	+	url := f.serve(t)
	411	+	for _, tc := range []struct {
	412	+	flags []string
	413	+	reply string
	414	+	start int32
	415	+	verdict string
	416	+	}{
	417	+	{[]string{"--reply", "^12", "-m", "reply"}, "12", 0, ""},
	418	+	{[]string{"--path", "x", "--line", "10-24", "-m", "range"}, "", 10, ""},
	419	+	{[]string{"--approve"}, "", 0, "approve"},
	420	+	{[]string{"--request-changes"}, "", 0, "changes_requested"},
	421	+	} {
	422	+	res := runCLI(t, envFor(url), "", append([]string{"mr", "comment", "alpha", "1", "--json"}, tc.flags...)...).ok(t)
	423	+	got := decode[jsonComment](t, res.stdout)
	424	+	assert.Equal(t, tc.reply, got.ReplyTo)
	425	+	assert.Equal(t, tc.start, got.StartLine)
	426	+	assert.Equal(t, tc.verdict, got.Verdict)
	427	+	}
	428	+	for _, flags := range [][]string{{"--approve", "--request-changes"}, {"--reply", "1", "--path", "x"}, {"--reply", "1", "--line", "2"}, {"--reply", "1", "--side", "new"}, {"--reply", "1", "--approve"}, {"--reply", "1", "--request-changes"}} {
	429	+	require.Error(t, runCLI(t, envFor(url), "", append([]string{"mr", "comment", "alpha", "1", "-m", "x"}, flags...)...).err)
	430	+	}
	431	+	}
	432	+
	433	+	func TestNoteDetailOutput(t *testing.T) {
	434	+	d := &ermite.GetMergeRequestResponse{MergeRequest: mrOne, Comments: []*ermite.Comment{
	435	+	{Id: "1", Path: "x", StartLine: 10, Line: 24, Text: "root"},
	436	+	{Id: "3", Text: "other", Deleted: true},
	437	+	{Id: "2", ReplyTo: "1", Text: "reply", EditedAt: ts("2026-10-10T12:00:00Z")},
	438	+	}, Verdicts: []*ermite.AuthorVerdict{
	439	+	{Author: "owner", Verdict: ermite.Verdict_VERDICT_APPROVE, CommentId: "1", Stale: true},
	440	+	{Author: "bot", Verdict: ermite.Verdict_VERDICT_CHANGES_REQUESTED, CommentId: "3"},
	441	+	}}
	442	+	var out strings.Builder
	443	+	require.NoError(t, printMRDetail(&out, d, false, false))
	444	+	text := out.String()
	445	+	assert.Contains(t, text, "owner approved (stale), bot changes requested")
	446	+	assert.Contains(t, text, "lines 10-24")
	447	+	assert.Contains(t, text, "(edited)")
	448	+	assert.Contains(t, text, "[deleted]")
	449	+	assert.Less(t, strings.Index(text, " #2"), strings.Index(text, " #3"))
	450	+	got := toJSONDetail(d, false)
	451	+	require.Len(t, got.Verdicts, 2)
	452	+	assert.True(t, got.Verdicts[0].Stale)
	453	+	assert.Equal(t, "changes_requested", got.Verdicts[1].Verdict)
	454	+	assert.Equal(t, "1", got.Comments[2].ReplyTo)
	455	+	assert.NotNil(t, got.Comments[2].EditedAt)
	456	+	}
	457	+
	458	+	func TestUnknownVerdictDetailOutput(t *testing.T) {
	459	+	var out strings.Builder
	460	+	require.NoError(t, printMRDetail(&out, &ermite.GetMergeRequestResponse{MergeRequest: mrOne, Verdicts: []*ermite.AuthorVerdict{{Author: "future", Verdict: ermite.Verdict(99)}}}, false, false))
	461	+	assert.Contains(t, out.String(), "future verdict 99")
	462	+	assert.NotContains(t, out.String(), "changes requested")
	463	+	assert.NotContains(t, out.String(), "approved")
	464	+	}
	465	+
	466	+	func TestMRReviewScopeCompletion(t *testing.T) {
	467	+	cmd := newTokenCreateCmd(&cliEnv{})
	468	+	complete, ok := cmd.GetFlagCompletionFunc("scope")
	469	+	require.True(t, ok)
	470	+	values, _ := complete(cmd, nil, "")
	471	+	assert.Contains(t, values, "mr:review")
	472	+	}


@@ -381,3 +381,92 @@ func TestSigningKeyShowOutput(t *testing.T) {
381	res = runCLI(t, envFor(url), "", "signing-key", "show", "--json").ok(t)	381		res = runCLI(t, envFor(url), "", "signing-key", "show", "--json").ok(t)
382	assert.JSONEq(t, `{"public_key":"ssh-ed25519 AAAAC3Nz","fingerprint":"SHA256:abc","committer_name":"ermite","committer_email":"ermite@git.example.org","allowed_signers":"ermite@git.example.org ssh-ed25519 AAAAC3Nz"}`, res.stdout)	382		assert.JSONEq(t, `{"public_key":"ssh-ed25519 AAAAC3Nz","fingerprint":"SHA256:abc","committer_name":"ermite","committer_email":"ermite@git.example.org","allowed_signers":"ermite@git.example.org ssh-ed25519 AAAAC3Nz"}`, res.stdout)
383	}	383		}
		384	+
		385	+	func TestNoteRangesAndIDs(t *testing.T) {
		386	+	for _, tc := range []struct {
		387	+	input string
		388	+	start, end int32
		389	+	}{{"1", 0, 1}, {"10-24", 10, 24}, {"2147483647", 0, 2147483647}} {
		390	+	start, end, err := parseLineRange(tc.input)
		391	+	require.NoError(t, err)
		392	+	assert.Equal(t, tc.start, start)
		393	+	assert.Equal(t, tc.end, end)
		394	+	}
		395	+	for _, input := range []string{"", "0", "-1", "1-1", "24-10", "0-2", "1-2-3", "2147483648", "a", "1-"} {
		396	+	_, _, err := parseLineRange(input)
		397	+	require.Error(t, err, input)
		398	+	}
		399	+	for _, input := range []string{"12", "^12", "#12"} {
		400	+	got, err := parseNoteID(input)
		401	+	require.NoError(t, err)
		402	+	assert.Equal(t, "12", got)
		403	+	}
		404	+	}
		405	+
		406	+	func TestNoteFlags(t *testing.T) {
		407	+	f := &fakeAPI{addComment: func(r ermite.AddCommentRequest) (ermite.AddCommentResponse, error) {
		408	+	return &ermite.AddCommentResponse{Comment: &ermite.Comment{Id: "1", ReplyTo: r.GetReplyTo(), StartLine: r.GetStartLine(), Line: r.GetLine(), Verdict: r.GetVerdict()}}, nil
		409	+	}}
		410	+	url := f.serve(t)
		411	+	for _, tc := range []struct {
		412	+	flags []string
		413	+	reply string
		414	+	start int32
		415	+	verdict string
		416	+	}{
		417	+	{[]string{"--reply", "^12", "-m", "reply"}, "12", 0, ""},
		418	+	{[]string{"--path", "x", "--line", "10-24", "-m", "range"}, "", 10, ""},
		419	+	{[]string{"--approve"}, "", 0, "approve"},
		420	+	{[]string{"--request-changes"}, "", 0, "changes_requested"},
		421	+	} {
		422	+	res := runCLI(t, envFor(url), "", append([]string{"mr", "comment", "alpha", "1", "--json"}, tc.flags...)...).ok(t)
		423	+	got := decode[jsonComment](t, res.stdout)
		424	+	assert.Equal(t, tc.reply, got.ReplyTo)
		425	+	assert.Equal(t, tc.start, got.StartLine)
		426	+	assert.Equal(t, tc.verdict, got.Verdict)
		427	+	}
		428	+	for _, flags := range [][]string{{"--approve", "--request-changes"}, {"--reply", "1", "--path", "x"}, {"--reply", "1", "--line", "2"}, {"--reply", "1", "--side", "new"}, {"--reply", "1", "--approve"}, {"--reply", "1", "--request-changes"}} {
		429	+	require.Error(t, runCLI(t, envFor(url), "", append([]string{"mr", "comment", "alpha", "1", "-m", "x"}, flags...)...).err)
		430	+	}
		431	+	}
		432	+
		433	+	func TestNoteDetailOutput(t *testing.T) {
		434	+	d := &ermite.GetMergeRequestResponse{MergeRequest: mrOne, Comments: []*ermite.Comment{
		435	+	{Id: "1", Path: "x", StartLine: 10, Line: 24, Text: "root"},
		436	+	{Id: "3", Text: "other", Deleted: true},
		437	+	{Id: "2", ReplyTo: "1", Text: "reply", EditedAt: ts("2026-10-10T12:00:00Z")},
		438	+	}, Verdicts: []*ermite.AuthorVerdict{
		439	+	{Author: "owner", Verdict: ermite.Verdict_VERDICT_APPROVE, CommentId: "1", Stale: true},
		440	+	{Author: "bot", Verdict: ermite.Verdict_VERDICT_CHANGES_REQUESTED, CommentId: "3"},
		441	+	}}
		442	+	var out strings.Builder
		443	+	require.NoError(t, printMRDetail(&out, d, false, false))
		444	+	text := out.String()
		445	+	assert.Contains(t, text, "owner approved (stale), bot changes requested")
		446	+	assert.Contains(t, text, "lines 10-24")
		447	+	assert.Contains(t, text, "(edited)")
		448	+	assert.Contains(t, text, "[deleted]")
		449	+	assert.Less(t, strings.Index(text, " #2"), strings.Index(text, " #3"))
		450	+	got := toJSONDetail(d, false)
		451	+	require.Len(t, got.Verdicts, 2)
		452	+	assert.True(t, got.Verdicts[0].Stale)
		453	+	assert.Equal(t, "changes_requested", got.Verdicts[1].Verdict)
		454	+	assert.Equal(t, "1", got.Comments[2].ReplyTo)
		455	+	assert.NotNil(t, got.Comments[2].EditedAt)
		456	+	}
		457	+
		458	+	func TestUnknownVerdictDetailOutput(t *testing.T) {
		459	+	var out strings.Builder
		460	+	require.NoError(t, printMRDetail(&out, &ermite.GetMergeRequestResponse{MergeRequest: mrOne, Verdicts: []*ermite.AuthorVerdict{{Author: "future", Verdict: ermite.Verdict(99)}}}, false, false))
		461	+	assert.Contains(t, out.String(), "future verdict 99")
		462	+	assert.NotContains(t, out.String(), "changes requested")
		463	+	assert.NotContains(t, out.String(), "approved")
		464	+	}
		465	+
		466	+	func TestMRReviewScopeCompletion(t *testing.T) {
		467	+	cmd := newTokenCreateCmd(&cliEnv{})
		468	+	complete, ok := cmd.GetFlagCompletionFunc("scope")
		469	+	require.True(t, ok)
		470	+	values, _ := complete(cmd, nil, "")
		471	+	assert.Contains(t, values, "mr:review")
		472	+	}

M internal/app/cli_token.go +1 -1


@@ -86,7 +86,7 @@ func newTokenCreateCmd(env cliEnv) cobra.Command {
86	86		"or store it right away); details go to standard error. With --json, standard output is one\n" +
87	87		"object holding the token fields and the secret.\n\n" +
88	88		"What the token may do is chosen with --preset and/or --scope (they add up); there is no default:\n" +
89		-	" cli every scope, for your own daily use\n" +
	89	+	" cli every scope, including mr:review for verdicts, for your own daily use\n" +
90	90		" agent repo:write, mr:write\n" +
91	91		" runner runner:register (a CI runner host)\n" +
92	92		" ci repo:read\n" +


@@ -86,7 +86,7 @@ func newTokenCreateCmd(env cliEnv) cobra.Command {
86		"or store it right away); details go to standard error. With --json, standard output is one\n" +	86		"or store it right away); details go to standard error. With --json, standard output is one\n" +
87		"object holding the token fields and the secret.\n\n" +	87		"object holding the token fields and the secret.\n\n" +
88		"What the token may do is chosen with --preset and/or --scope (they add up); there is no default:\n" +	88		"What the token may do is chosen with --preset and/or --scope (they add up); there is no default:\n" +
89	-	" cli every scope, for your own daily use\n" +	89	+	" cli every scope, including mr:review for verdicts, for your own daily use\n" +
90		" agent repo:write, mr:write\n" +	90		" agent repo:write, mr:write\n" +
91		" runner runner:register (a CI runner host)\n" +	91		" runner runner:register (a CI runner host)\n" +
92		" ci repo:read\n" +	92		" ci repo:read\n" +

M internal/app/cli_watch.go +21 -8


@@ -45,10 +45,13 @@ const (
45	45		eventPushed = "pushed"
46	46		eventGap = "gap"
47	47
48		-	eventMROpened = "merge_request_opened"
49		-	eventMRMerged = "merge_request_merged"
50		-	eventMRClosed = "merge_request_closed"
51		-	eventCommentAdded = "comment_added"
	48	+	eventMROpened = "merge_request_opened"
	49	+	eventMRMerged = "merge_request_merged"
	50	+	eventMRClosed = "merge_request_closed"
	51	+	eventCommentAdded = "comment_added"
	52	+	eventCommentEdited = "comment_edited"
	53	+	eventCommentDeleted = "comment_deleted"
	54	+	eventCommentResolved = "comment_resolved"
52	55		)
53	56
54	57		// toJSONEvent maps an event; ok is false for kinds this client does not know,

@@ -82,6 +85,15 @@ func toJSONEvent(ev *ermite.Event) (jsonEvent, bool) {
82	85		case *ermite.Event_CommentAdded:
83	86		c := toJSONComment(k.CommentAdded.GetComment())
84	87		out.Type, out.Repo, out.Number, out.Comment = eventCommentAdded, k.CommentAdded.GetRepo(), k.CommentAdded.GetNumber(), &c
	88	+	case *ermite.Event_CommentEdited:
	89	+	c := toJSONComment(k.CommentEdited.GetComment())
	90	+	out.Type, out.Repo, out.Number, out.Comment = eventCommentEdited, k.CommentEdited.GetRepo(), k.CommentEdited.GetNumber(), &c
	91	+	case *ermite.Event_CommentDeleted:
	92	+	c := toJSONComment(k.CommentDeleted.GetComment())
	93	+	out.Type, out.Repo, out.Number, out.Comment = eventCommentDeleted, k.CommentDeleted.GetRepo(), k.CommentDeleted.GetNumber(), &c
	94	+	case *ermite.Event_CommentResolved:
	95	+	c := toJSONComment(k.CommentResolved.GetComment())
	96	+	out.Type, out.Repo, out.Number, out.Comment = eventCommentResolved, k.CommentResolved.GetRepo(), k.CommentResolved.GetNumber(), &c
85	97		case *ermite.Event_Gap:
86	98		out.Type = eventGap
87	99		default:

@@ -112,7 +124,7 @@ func eventLine(e jsonEvent) string {
112	124		detail = e.Repo + " " + strings.Join(parts, ", ")
113	125		case eventMROpened, eventMRMerged, eventMRClosed:
114	126		detail = fmt.Sprintf("%s!%d %s -> %s", e.Repo, e.MergeRequest.Number, e.MergeRequest.SourceBranch, e.MergeRequest.TargetBranch)
115		-	case eventCommentAdded:
	127	+	case eventCommentAdded, eventCommentEdited, eventCommentDeleted, eventCommentResolved:
116	128		detail = fmt.Sprintf("%s!%d by %s", e.Repo, e.Number, e.Comment.Author)
117	129		case eventGap:
118	130		detail = "events were lost, reload what you display"

@@ -142,17 +154,18 @@ func newWatchCmd(env cliEnv) cobra.Command {
142	154		Use: "watch [repo]",
143	155		Short: "Print repository events as they happen",
144	156		Long: "Print one line per event (repository created, updated or deleted, refs pushed, merge requests\n" +
145		-	"opened, merged or closed, comments added) for every\n" +
	157	+	"opened, merged or closed, notes added, edited, deleted or resolved) for every\n" +
146	158		"repository you can see, or only for [repo]. It runs until interrupted. When the connection drops it\n" +
147	159		"reconnects with a growing delay and resumes after the last event it printed; if the server no longer\n" +
148	160		"has that event it prints a gap event: reload what you display. Connection notices go to standard\n" +
149	161		"error.\n\n" +
150	162		"--json prints one JSON object per line (NDJSON). Fields: id, time (RFC 3339 UTC), type\n" +
151	163		"(repo_created, repo_updated, repo_deleted, pushed, merge_request_opened, merge_request_merged,\n" +
152		-	"merge_request_closed, comment_added or gap) and, depending on the type, repo (name),\n" +
	164	+	"merge_request_closed, comment_added, comment_edited, comment_deleted, comment_resolved or gap)\n" +
	165	+	"and, depending on the type, repo (name),\n" +
153	166		"repository (the repository fields of `repo show --json`), ref_updates (array of ref, old_id,\n" +
154	167		"new_id; an empty id means the ref was created or deleted), merge_request (the fields of\n" +
155		-	"`mr show --json`) and, for comment_added, number (of the merge request) and comment. Unknown\n" +
	168	+	"`mr show --json`) and, for comment events, number (of the merge request) and comment. Unknown\n" +
156	169		"event types are skipped.",
157	170		Args: cobra.MaximumNArgs(1),
158	171		ValidArgsFunction: completeRepoNames(env),

 	eventPushed      = "pushed"
 	eventGap         = "gap"
-	eventMROpened     = "merge_request_opened"
+	eventMROpened        = "merge_request_opened"
-	eventMRMerged     = "merge_request_merged"
+	eventMRMerged        = "merge_request_merged"
-	eventMRClosed     = "merge_request_closed"
+	eventMRClosed        = "merge_request_closed"
-	eventCommentAdded = "comment_added"
+	eventCommentAdded    = "comment_added"
+	eventCommentEdited   = "comment_edited"
+	eventCommentDeleted  = "comment_deleted"
+	eventCommentResolved = "comment_resolved"
 )
 // toJSONEvent maps an event; ok is false for kinds this client does not know,
 	case *ermite.Event_CommentAdded:
 		c := toJSONComment(k.CommentAdded.GetComment())
 		out.Type, out.Repo, out.Number, out.Comment = eventCommentAdded, k.CommentAdded.GetRepo(), k.CommentAdded.GetNumber(), &c
+	case *ermite.Event_CommentEdited:
+		c := toJSONComment(k.CommentEdited.GetComment())
+		out.Type, out.Repo, out.Number, out.Comment = eventCommentEdited, k.CommentEdited.GetRepo(), k.CommentEdited.GetNumber(), &c
+	case *ermite.Event_CommentDeleted:
+		c := toJSONComment(k.CommentDeleted.GetComment())
+		out.Type, out.Repo, out.Number, out.Comment = eventCommentDeleted, k.CommentDeleted.GetRepo(), k.CommentDeleted.GetNumber(), &c
+	case *ermite.Event_CommentResolved:
+		c := toJSONComment(k.CommentResolved.GetComment())
+		out.Type, out.Repo, out.Number, out.Comment = eventCommentResolved, k.CommentResolved.GetRepo(), k.CommentResolved.GetNumber(), &c
 	case *ermite.Event_Gap:
 		out.Type = eventGap
 	default:
 		detail = e.Repo + " " + strings.Join(parts, ", ")
 	case eventMROpened, eventMRMerged, eventMRClosed:
 		detail = fmt.Sprintf("%s!%d %s -> %s", e.Repo, e.MergeRequest.Number, e.MergeRequest.SourceBranch, e.MergeRequest.TargetBranch)
-	case eventCommentAdded:
+	case eventCommentAdded, eventCommentEdited, eventCommentDeleted, eventCommentResolved:
 		detail = fmt.Sprintf("%s!%d by %s", e.Repo, e.Number, e.Comment.Author)
 	case eventGap:
 		detail = "events were lost, reload what you display"
 		Use:   "watch [repo]",
 		Short: "Print repository events as they happen",
 		Long: "Print one line per event (repository created, updated or deleted, refs pushed, merge requests\n" +
-			"opened, merged or closed, comments added) for every\n" +
+			"opened, merged or closed, notes added, edited, deleted or resolved) for every\n" +
 			"repository you can see, or only for [repo]. It runs until interrupted. When the connection drops it\n" +
 			"reconnects with a growing delay and resumes after the last event it printed; if the server no longer\n" +
 			"has that event it prints a gap event: reload what you display. Connection notices go to standard\n" +
 			"error.\n\n" +
 			"--json prints one JSON object per line (NDJSON). Fields: id, time (RFC 3339 UTC), type\n" +
 			"(repo_created, repo_updated, repo_deleted, pushed, merge_request_opened, merge_request_merged,\n" +
-			"merge_request_closed, comment_added or gap) and, depending on the type, repo (name),\n" +
+			"merge_request_closed, comment_added, comment_edited, comment_deleted, comment_resolved or gap)\n" +
+			"and, depending on the type, repo (name),\n" +
 			"repository (the repository fields of `repo show --json`), ref_updates (array of ref, old_id,\n" +
 			"new_id; an empty id means the ref was created or deleted), merge_request (the fields of\n" +
-			"`mr show --json`) and, for comment_added, number (of the merge request) and comment. Unknown\n" +
+			"`mr show --json`) and, for comment events, number (of the merge request) and comment. Unknown\n" +
 			"event types are skipped.",
 		Args:              cobra.MaximumNArgs(1),
 		ValidArgsFunction: completeRepoNames(env),

M internal/app/cli_watch_test.go +24 -0


@@ -199,3 +199,27 @@ func TestWatchMergeRequestEvents(t *testing.T) {
199	199		assert.Equal(t, "merge_request_merged", decode[eventOut](t, lines[2]).Type)
200	200		assert.Equal(t, "merge_request_closed", decode[eventOut](t, lines[3]).Type)
201	201		}
	202	+
	203	+	func TestNoteWatchEvents(t *testing.T) {
	204	+	note := &ermite.Comment{Id: "4", ReplyTo: "2", StartLine: 10, Line: 24, Verdict: ermite.Verdict_VERDICT_APPROVE, EditedAt: ts("2026-10-10T12:00:00Z"), Deleted: true, Author: "owner"}
	205	+	events := []*ermite.Event{
	206	+	{Kind: &ermite.Event_CommentEdited{CommentEdited: &ermite.CommentEdited{Repo: "alpha", Number: 1, Comment: note}}},
	207	+	{Kind: &ermite.Event_CommentDeleted{CommentDeleted: &ermite.CommentDeleted{Repo: "alpha", Number: 1, Comment: note}}},
	208	+	{Kind: &ermite.Event_CommentResolved{CommentResolved: &ermite.CommentResolved{Repo: "alpha", Number: 1, Comment: note}}},
	209	+	}
	210	+	for i, ev := range events {
	211	+	got, ok := toJSONEvent(ev)
	212	+	require.True(t, ok)
	213	+	assert.Equal(t, []string{"comment_edited", "comment_deleted", "comment_resolved"}[i], got.Type)
	214	+	assert.Equal(t, "alpha", got.Repo)
	215	+	assert.EqualValues(t, 1, got.Number)
	216	+	require.NotNil(t, got.Comment)
	217	+	assert.True(t, got.Comment.Deleted)
	218	+	assert.Equal(t, "2", got.Comment.ReplyTo)
	219	+	assert.Equal(t, "approve", got.Comment.Verdict)
	220	+	assert.Contains(t, eventLine(got), got.Type+" alpha!1 by owner")
	221	+	raw, err := json.Marshal(got)
	222	+	require.NoError(t, err)
	223	+	assert.Contains(t, string(raw), `"edited_at":"2026-10-10T12:00:00Z"`)
	224	+	}
	225	+	}


@@ -199,3 +199,27 @@ func TestWatchMergeRequestEvents(t *testing.T) {
199	assert.Equal(t, "merge_request_merged", decode[eventOut](t, lines[2]).Type)	199		assert.Equal(t, "merge_request_merged", decode[eventOut](t, lines[2]).Type)
200	assert.Equal(t, "merge_request_closed", decode[eventOut](t, lines[3]).Type)	200		assert.Equal(t, "merge_request_closed", decode[eventOut](t, lines[3]).Type)
201	}	201		}
		202	+
		203	+	func TestNoteWatchEvents(t *testing.T) {
		204	+	note := &ermite.Comment{Id: "4", ReplyTo: "2", StartLine: 10, Line: 24, Verdict: ermite.Verdict_VERDICT_APPROVE, EditedAt: ts("2026-10-10T12:00:00Z"), Deleted: true, Author: "owner"}
		205	+	events := []*ermite.Event{
		206	+	{Kind: &ermite.Event_CommentEdited{CommentEdited: &ermite.CommentEdited{Repo: "alpha", Number: 1, Comment: note}}},
		207	+	{Kind: &ermite.Event_CommentDeleted{CommentDeleted: &ermite.CommentDeleted{Repo: "alpha", Number: 1, Comment: note}}},
		208	+	{Kind: &ermite.Event_CommentResolved{CommentResolved: &ermite.CommentResolved{Repo: "alpha", Number: 1, Comment: note}}},
		209	+	}
		210	+	for i, ev := range events {
		211	+	got, ok := toJSONEvent(ev)
		212	+	require.True(t, ok)
		213	+	assert.Equal(t, []string{"comment_edited", "comment_deleted", "comment_resolved"}[i], got.Type)
		214	+	assert.Equal(t, "alpha", got.Repo)
		215	+	assert.EqualValues(t, 1, got.Number)
		216	+	require.NotNil(t, got.Comment)
		217	+	assert.True(t, got.Comment.Deleted)
		218	+	assert.Equal(t, "2", got.Comment.ReplyTo)
		219	+	assert.Equal(t, "approve", got.Comment.Verdict)
		220	+	assert.Contains(t, eventLine(got), got.Type+" alpha!1 by owner")
		221	+	raw, err := json.Marshal(got)
		222	+	require.NoError(t, err)
		223	+	assert.Contains(t, string(raw), `"edited_at":"2026-10-10T12:00:00Z"`)
		224	+	}
		225	+	}

M internal/app/web_mr_test.go +6 -3


@@ -284,7 +284,7 @@ func TestWebMergeRequestReviewAndFastForward(t *testing.T) {
284	284		require.GreaterOrEqual(t, i, 0, "a note row under the line")
285	285		note := anon.body[i:]
286	286		assert.Less(t, strings.Index(note, "Why <i>empty</i>?"), strings.Index(note, "</tr>"), "the note sits in the row under its line")
287		-	assert.Contains(t, anon.body, `<a href="https://example.org/a" rel="noopener nofollow ugc">https://example.org/a</a>.`)
	287	+	assert.Contains(t, anon.body, `<a href="https://example.org/a" rel="nofollow noopener noreferrer">https://example.org/a</a>.`)
288	288		assert.NotContains(t, anon.body, "<i>empty</i>")
289	289		assert.Contains(t, anon.body, "Looks fine overall.")
290	290		assert.Equal(t, 2, len(reNoteID.FindAllString(anon.body, -1)))

@@ -338,7 +338,8 @@ func TestWebMergeRequestReviewAndFastForward(t *testing.T) {
338	338		assert.Contains(t, since.body, "changes since "+head1[:7])
339	339		assert.Contains(t, since.body, "extra</td>")
340	340		assert.NotContains(t, since.body, `<span class="kn">package</span> search</td>`, "only what changed after the read head")
341		-	assert.Contains(t, since.body, "Why <i>empty</i>?", "the notes are listed below, their lines are not in this diff")
	341	+	assert.Contains(t, since.body, "empty", "the notes are listed below, their lines are not in this diff")
	342	+	assert.NotContains(t, since.body, "<i>", "raw HTML is dropped")
342	343		assert.Contains(t, since.body, "search.go:3 (new)")
343	344		assert.NotContains(t, since.body, `<form class="cform"`, "no comment form on this diff")
344	345

@@ -554,7 +555,9 @@ func TestWebMergeRequestEscapesText(t *testing.T) {
554	555		assert.NotContains(t, body, "<img src=x")
555	556		assert.NotContains(t, body, "<script>x</script>")
556	557		assert.Contains(t, html.UnescapeString(body), `"><script>alert(1)</script>`)
557		-	assert.Contains(t, body, "<script>x</script> & more")
	558	+	// A note is safe Markdown: a line that opens with an HTML tag is an HTML
	559	+	// block, dropped whole.
	560	+	assert.Contains(t, body, `class="c-body prose"><!-- raw HTML omitted -->`)
558	561		assertNoInline(t, body)
559	562		assert.NotContains(t, body, `onmouseover="alert`, "an address stops at a quote")
560	563		}

 	require.GreaterOrEqual(t, i, 0, "a note row under the line")
 	note := anon.body[i:]
 	assert.Less(t, strings.Index(note, "Why &lt;i&gt;empty&lt;/i&gt;?"), strings.Index(note, "</tr>"), "the note sits in the row under its line")
-	assert.Contains(t, anon.body, `<a href="https://example.org/a" rel="noopener nofollow ugc">https://example.org/a</a>.`)
+	assert.Contains(t, anon.body, `<a href="https://example.org/a" rel="nofollow noopener noreferrer">https://example.org/a</a>.`)
 	assert.NotContains(t, anon.body, "<i>empty</i>")
 	assert.Contains(t, anon.body, "Looks fine overall.")
 	assert.Equal(t, 2, len(reNoteID.FindAllString(anon.body, -1)))
 	assert.Contains(t, since.body, "changes since "+head1[:7])
 	assert.Contains(t, since.body, "extra</td>")
 	assert.NotContains(t, since.body, `<span class="kn">package</span> search</td>`, "only what changed after the read head")
-	assert.Contains(t, since.body, "Why &lt;i&gt;empty&lt;/i&gt;?", "the notes are listed below, their lines are not in this diff")
+	assert.Contains(t, since.body, "empty", "the notes are listed below, their lines are not in this diff")
+	assert.NotContains(t, since.body, "<i>", "raw HTML is dropped")
 	assert.Contains(t, since.body, "search.go:3 (new)")
 	assert.NotContains(t, since.body, `<form class="cform"`, "no comment form on this diff")
 		assert.NotContains(t, body, "<img src=x")
 		assert.NotContains(t, body, "<script>x</script>")
 		assert.Contains(t, html.UnescapeString(body), `"><script>alert(1)</script>`)
-		assert.Contains(t, body, "&lt;script&gt;x&lt;/script&gt; &amp; more")
+		// A note is safe Markdown: a line that opens with an HTML tag is an HTML
+		// block, dropped whole.
+		assert.Contains(t, body, `class="c-body prose"><!-- raw HTML omitted -->`)
 		assertNoInline(t, body)
 		assert.NotContains(t, body, `onmouseover="alert`, "an address stops at a quote")
 	}

M internal/domain/event.go +39 -0


@@ -173,6 +173,45 @@ type CommentAdded struct {
173	173		// EventKind implements Event.
174	174		func (CommentAdded) EventKind() string { return "mr.comment_added" }
175	175
	176	+	// CommentEdited is published when the text of a note was edited.
	177	+	type CommentEdited struct {
	178	+	Repo RepoName
	179	+	Number int64
	180	+	Comment Comment
	181	+	At time.Time
	182	+	Visibility Visibility
	183	+	CreatedAt time.Time
	184	+	}
	185	+
	186	+	// EventKind implements Event.
	187	+	func (CommentEdited) EventKind() string { return "mr.comment_edited" }
	188	+
	189	+	// CommentDeleted is published when the text of a note was deleted.
	190	+	type CommentDeleted struct {
	191	+	Repo RepoName
	192	+	Number int64
	193	+	Comment Comment
	194	+	At time.Time
	195	+	Visibility Visibility
	196	+	CreatedAt time.Time
	197	+	}
	198	+
	199	+	// EventKind implements Event.
	200	+	func (CommentDeleted) EventKind() string { return "mr.comment_deleted" }
	201	+
	202	+	// CommentResolved is published when a thread was resolved or reopened.
	203	+	type CommentResolved struct {
	204	+	Repo RepoName
	205	+	Number int64
	206	+	Comment Comment
	207	+	At time.Time
	208	+	Visibility Visibility
	209	+	CreatedAt time.Time
	210	+	}
	211	+
	212	+	// EventKind implements Event.
	213	+	func (CommentResolved) EventKind() string { return "mr.comment_resolved" }
	214	+
176	215		// EventGap tells a subscriber that it missed events because it was too slow;
177	216		// it must refresh its whole view.
178	217		type EventGap struct{}


@@ -173,6 +173,45 @@ type CommentAdded struct {
173	// EventKind implements Event.	173		// EventKind implements Event.
174	func (CommentAdded) EventKind() string { return "mr.comment_added" }	174		func (CommentAdded) EventKind() string { return "mr.comment_added" }
175		175
		176	+	// CommentEdited is published when the text of a note was edited.
		177	+	type CommentEdited struct {
		178	+	Repo RepoName
		179	+	Number int64
		180	+	Comment Comment
		181	+	At time.Time
		182	+	Visibility Visibility
		183	+	CreatedAt time.Time
		184	+	}
		185	+
		186	+	// EventKind implements Event.
		187	+	func (CommentEdited) EventKind() string { return "mr.comment_edited" }
		188	+
		189	+	// CommentDeleted is published when the text of a note was deleted.
		190	+	type CommentDeleted struct {
		191	+	Repo RepoName
		192	+	Number int64
		193	+	Comment Comment
		194	+	At time.Time
		195	+	Visibility Visibility
		196	+	CreatedAt time.Time
		197	+	}
		198	+
		199	+	// EventKind implements Event.
		200	+	func (CommentDeleted) EventKind() string { return "mr.comment_deleted" }
		201	+
		202	+	// CommentResolved is published when a thread was resolved or reopened.
		203	+	type CommentResolved struct {
		204	+	Repo RepoName
		205	+	Number int64
		206	+	Comment Comment
		207	+	At time.Time
		208	+	Visibility Visibility
		209	+	CreatedAt time.Time
		210	+	}
		211	+
		212	+	// EventKind implements Event.
		213	+	func (CommentResolved) EventKind() string { return "mr.comment_resolved" }
		214	+
176	// EventGap tells a subscriber that it missed events because it was too slow;	215		// EventGap tells a subscriber that it missed events because it was too slow;
177	// it must refresh its whole view.	216		// it must refresh its whole view.
178	type EventGap struct{}	217		type EventGap struct{}

M internal/domain/mergerequest.go +80 -0


@@ -186,6 +186,11 @@ func (m MergeRequest) IsOpen() bool { return m.State == MRStateOpen }
186	186
187	187		// Comment is a note on a merge request, general or on a line of its diff.
188	188		type Comment struct {
	189	+	ReplyTo int64
	190	+	StartLine int
	191	+	Verdict Verdict
	192	+	EditedAt time.Time
	193	+	Deleted bool
189	194		// ID is unique within the merge request, in order of creation.
190	195		ID int64
191	196		Author string

@@ -348,3 +353,78 @@ func singleLine(s string) string {
348	353		return r
349	354		}, s)
350	355		}
	356	+
	357	+	// Verdict is an immutable review decision on a root note.
	358	+	type Verdict uint8
	359	+
	360	+	// Review verdicts.
	361	+	const (
	362	+	VerdictNone Verdict = iota
	363	+	VerdictApprove
	364	+	VerdictChangesRequested
	365	+	)
	366	+
	367	+	// String returns the wire name of a verdict.
	368	+	func (v Verdict) String() string {
	369	+	switch v {
	370	+	case VerdictApprove:
	371	+	return "approve"
	372	+	case VerdictChangesRequested:
	373	+	return "changes_requested"
	374	+	}
	375	+	return ""
	376	+	}
	377	+
	378	+	// ParseVerdict parses a review decision.
	379	+	func ParseVerdict(s string) (Verdict, error) {
	380	+	switch s {
	381	+	case "":
	382	+	return VerdictNone, nil
	383	+	case "approve":
	384	+	return VerdictApprove, nil
	385	+	case "changes_requested":
	386	+	return VerdictChangesRequested, nil
	387	+	}
	388	+	return VerdictNone, fmt.Errorf("%w: verdict %q", ErrInvalid, s)
	389	+	}
	390	+
	391	+	// IsReply reports whether this note replies to a root.
	392	+	func (c Comment) IsReply() bool { return c.ReplyTo != 0 }
	393	+
	394	+	// IsRange reports whether this note anchors a range.
	395	+	func (c Comment) IsRange() bool { return c.StartLine != 0 }
	396	+
	397	+	// AuthorVerdict is an author's latest review decision.
	398	+	type AuthorVerdict struct {
	399	+	Author string
	400	+	Verdict Verdict
	401	+	CommentID int64
	402	+	CommitID ObjectID
	403	+	At time.Time
	404	+	Stale bool
	405	+	}
	406	+
	407	+	// CurrentVerdicts returns the latest verdict per author, including deleted notes,
	408	+	// in note ID order. Only approvals become stale when the head changes.
	409	+	func CurrentVerdicts(comments []Comment, head ObjectID) []AuthorVerdict {
	410	+	latest := make(map[string]Comment)
	411	+	for _, c := range comments {
	412	+	if c.Verdict != VerdictNone && c.ID > latest[c.Author].ID {
	413	+	latest[c.Author] = c
	414	+	}
	415	+	}
	416	+	out := make([]AuthorVerdict, 0, len(latest))
	417	+	for _, c := range latest {
	418	+	out = append(out, AuthorVerdict{Author: c.Author, Verdict: c.Verdict, CommentID: c.ID, CommitID: c.CommitID, At: c.CreatedAt, Stale: c.Verdict == VerdictApprove && (head == (ObjectID{}) \|\| c.CommitID != head)})
	419	+	}
	420	+	slices.SortFunc(out, func(a, b AuthorVerdict) int {
	421	+	if a.CommentID < b.CommentID {
	422	+	return -1
	423	+	}
	424	+	if a.CommentID > b.CommentID {
	425	+	return 1
	426	+	}
	427	+	return 0
	428	+	})
	429	+	return out
	430	+	}


@@ -186,6 +186,11 @@ func (m MergeRequest) IsOpen() bool { return m.State == MRStateOpen }
186		186
187	// Comment is a note on a merge request, general or on a line of its diff.	187		// Comment is a note on a merge request, general or on a line of its diff.
188	type Comment struct {	188		type Comment struct {
		189	+	ReplyTo int64
		190	+	StartLine int
		191	+	Verdict Verdict
		192	+	EditedAt time.Time
		193	+	Deleted bool
189	// ID is unique within the merge request, in order of creation.	194		// ID is unique within the merge request, in order of creation.
190	ID int64	195		ID int64
191	Author string	196		Author string

@@ -348,3 +353,78 @@ func singleLine(s string) string {
348	return r	353		return r
349	}, s)	354		}, s)
350	}	355		}
		356	+
		357	+	// Verdict is an immutable review decision on a root note.
		358	+	type Verdict uint8
		359	+
		360	+	// Review verdicts.
		361	+	const (
		362	+	VerdictNone Verdict = iota
		363	+	VerdictApprove
		364	+	VerdictChangesRequested
		365	+	)
		366	+
		367	+	// String returns the wire name of a verdict.
		368	+	func (v Verdict) String() string {
		369	+	switch v {
		370	+	case VerdictApprove:
		371	+	return "approve"
		372	+	case VerdictChangesRequested:
		373	+	return "changes_requested"
		374	+	}
		375	+	return ""
		376	+	}
		377	+
		378	+	// ParseVerdict parses a review decision.
		379	+	func ParseVerdict(s string) (Verdict, error) {
		380	+	switch s {
		381	+	case "":
		382	+	return VerdictNone, nil
		383	+	case "approve":
		384	+	return VerdictApprove, nil
		385	+	case "changes_requested":
		386	+	return VerdictChangesRequested, nil
		387	+	}
		388	+	return VerdictNone, fmt.Errorf("%w: verdict %q", ErrInvalid, s)
		389	+	}
		390	+
		391	+	// IsReply reports whether this note replies to a root.
		392	+	func (c Comment) IsReply() bool { return c.ReplyTo != 0 }
		393	+
		394	+	// IsRange reports whether this note anchors a range.
		395	+	func (c Comment) IsRange() bool { return c.StartLine != 0 }
		396	+
		397	+	// AuthorVerdict is an author's latest review decision.
		398	+	type AuthorVerdict struct {
		399	+	Author string
		400	+	Verdict Verdict
		401	+	CommentID int64
		402	+	CommitID ObjectID
		403	+	At time.Time
		404	+	Stale bool
		405	+	}
		406	+
		407	+	// CurrentVerdicts returns the latest verdict per author, including deleted notes,
		408	+	// in note ID order. Only approvals become stale when the head changes.
		409	+	func CurrentVerdicts(comments []Comment, head ObjectID) []AuthorVerdict {
		410	+	latest := make(map[string]Comment)
		411	+	for _, c := range comments {
		412	+	if c.Verdict != VerdictNone && c.ID > latest[c.Author].ID {
		413	+	latest[c.Author] = c
		414	+	}
		415	+	}
		416	+	out := make([]AuthorVerdict, 0, len(latest))
		417	+	for _, c := range latest {
		418	+	out = append(out, AuthorVerdict{Author: c.Author, Verdict: c.Verdict, CommentID: c.ID, CommitID: c.CommitID, At: c.CreatedAt, Stale: c.Verdict == VerdictApprove && (head == (ObjectID{}) \|\| c.CommitID != head)})
		419	+	}
		420	+	slices.SortFunc(out, func(a, b AuthorVerdict) int {
		421	+	if a.CommentID < b.CommentID {
		422	+	return -1
		423	+	}
		424	+	if a.CommentID > b.CommentID {
		425	+	return 1
		426	+	}
		427	+	return 0
		428	+	})
		429	+	return out
		430	+	}

M internal/domain/mergerequest_test.go +48 -0


@@ -235,3 +235,51 @@ func TestMergeRequestDraft(t *testing.T) {
235	235		assert.Equal(t, tc.ready, ready.String(), tc.title)
236	236		}
237	237		}
	238	+
	239	+	func TestNoteVerdicts(t *testing.T) {
	240	+	head, old := oid(t, 'a'), oid(t, 'b')
	241	+	for _, tc := range []struct {
	242	+	text string
	243	+	verdict domain.Verdict
	244	+	}{{"", domain.VerdictNone}, {"approve", domain.VerdictApprove}, {"changes_requested", domain.VerdictChangesRequested}} {
	245	+	v, err := domain.ParseVerdict(tc.text)
	246	+	require.NoError(t, err)
	247	+	assert.Equal(t, tc.verdict, v)
	248	+	assert.Equal(t, tc.text, v.String())
	249	+	}
	250	+	_, err := domain.ParseVerdict("unknown")
	251	+	require.ErrorIs(t, err, domain.ErrInvalid)
	252	+	comments := []domain.Comment{{ID: 3, Author: "a", Verdict: domain.VerdictApprove, CommitID: old, Deleted: true}, {ID: 1, Author: "a", Verdict: domain.VerdictChangesRequested}, {ID: 2, Author: "b", Verdict: domain.VerdictChangesRequested, CommitID: old}, {ID: 4, Author: "a"}}
	253	+	for _, h := range []domain.ObjectID{head, {}} {
	254	+	got := domain.CurrentVerdicts(comments, h)
	255	+	require.Len(t, got, 2)
	256	+	assert.Equal(t, int64(2), got[0].CommentID)
	257	+	assert.False(t, got[0].Stale)
	258	+	assert.Equal(t, int64(3), got[1].CommentID)
	259	+	assert.True(t, got[1].Stale)
	260	+	}
	261	+	comments[0].CommitID = head
	262	+	assert.False(t, domain.CurrentVerdicts(comments, head)[1].Stale)
	263	+	assert.True(t, (domain.Comment{ReplyTo: 1}).IsReply())
	264	+	assert.True(t, (domain.Comment{StartLine: 1}).IsRange())
	265	+	}
	266	+
	267	+	func TestReviewScopeOwnerRights(t *testing.T) {
	268	+	var old []domain.Scope
	269	+	for _, s := range domain.AllScopes() {
	270	+	if s != domain.ScopeMRReview {
	271	+	old = append(old, s)
	272	+	}
	273	+	}
	274	+	assert.False(t, domain.TokenPrincipal(domain.Token{Scopes: old}).HasOwnerRights())
	275	+	assert.True(t, domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes()}).HasOwnerRights())
	276	+	s, err := domain.ParseScope("mr:review")
	277	+	require.NoError(t, err)
	278	+	assert.Equal(t, domain.ScopeMRReview, s)
	279	+	for _, tc := range []struct {
	280	+	p domain.Principal
	281	+	want string
	282	+	}{{domain.Root(), "root"}, {domain.Owner(), "owner"}, {domain.Anonymous(), "owner"}, {domain.TokenPrincipal(domain.Token{Label: "bot"}), "bot"}} {
	283	+	assert.Equal(t, tc.want, domain.AuthorName(tc.p))
	284	+	}
	285	+	}


@@ -235,3 +235,51 @@ func TestMergeRequestDraft(t *testing.T) {
235	assert.Equal(t, tc.ready, ready.String(), tc.title)	235		assert.Equal(t, tc.ready, ready.String(), tc.title)
236	}	236		}
237	}	237		}
		238	+
		239	+	func TestNoteVerdicts(t *testing.T) {
		240	+	head, old := oid(t, 'a'), oid(t, 'b')
		241	+	for _, tc := range []struct {
		242	+	text string
		243	+	verdict domain.Verdict
		244	+	}{{"", domain.VerdictNone}, {"approve", domain.VerdictApprove}, {"changes_requested", domain.VerdictChangesRequested}} {
		245	+	v, err := domain.ParseVerdict(tc.text)
		246	+	require.NoError(t, err)
		247	+	assert.Equal(t, tc.verdict, v)
		248	+	assert.Equal(t, tc.text, v.String())
		249	+	}
		250	+	_, err := domain.ParseVerdict("unknown")
		251	+	require.ErrorIs(t, err, domain.ErrInvalid)
		252	+	comments := []domain.Comment{{ID: 3, Author: "a", Verdict: domain.VerdictApprove, CommitID: old, Deleted: true}, {ID: 1, Author: "a", Verdict: domain.VerdictChangesRequested}, {ID: 2, Author: "b", Verdict: domain.VerdictChangesRequested, CommitID: old}, {ID: 4, Author: "a"}}
		253	+	for _, h := range []domain.ObjectID{head, {}} {
		254	+	got := domain.CurrentVerdicts(comments, h)
		255	+	require.Len(t, got, 2)
		256	+	assert.Equal(t, int64(2), got[0].CommentID)
		257	+	assert.False(t, got[0].Stale)
		258	+	assert.Equal(t, int64(3), got[1].CommentID)
		259	+	assert.True(t, got[1].Stale)
		260	+	}
		261	+	comments[0].CommitID = head
		262	+	assert.False(t, domain.CurrentVerdicts(comments, head)[1].Stale)
		263	+	assert.True(t, (domain.Comment{ReplyTo: 1}).IsReply())
		264	+	assert.True(t, (domain.Comment{StartLine: 1}).IsRange())
		265	+	}
		266	+
		267	+	func TestReviewScopeOwnerRights(t *testing.T) {
		268	+	var old []domain.Scope
		269	+	for _, s := range domain.AllScopes() {
		270	+	if s != domain.ScopeMRReview {
		271	+	old = append(old, s)
		272	+	}
		273	+	}
		274	+	assert.False(t, domain.TokenPrincipal(domain.Token{Scopes: old}).HasOwnerRights())
		275	+	assert.True(t, domain.TokenPrincipal(domain.Token{Scopes: domain.AllScopes()}).HasOwnerRights())
		276	+	s, err := domain.ParseScope("mr:review")
		277	+	require.NoError(t, err)
		278	+	assert.Equal(t, domain.ScopeMRReview, s)
		279	+	for _, tc := range []struct {
		280	+	p domain.Principal
		281	+	want string
		282	+	}{{domain.Root(), "root"}, {domain.Owner(), "owner"}, {domain.Anonymous(), "owner"}, {domain.TokenPrincipal(domain.Token{Label: "bot"}), "bot"}} {
		283	+	assert.Equal(t, tc.want, domain.AuthorName(tc.p))
		284	+	}
		285	+	}

M internal/domain/principal.go +15 -0


@@ -230,3 +230,18 @@ func (p Principal) ArchiveGrant() (repo RepoName, sha string, ok bool) {
230	230		}
231	231		return p.archiveRepo, p.archiveSha, true
232	232		}
	233	+
	234	+	// AuthorName names who acts, for the author of a merge request or a comment: the
	235	+	// label of the token, "root" for the root token, "owner" for the owner signed
	236	+	// in on the web and for any other caller without a label.
	237	+	func AuthorName(p Principal) string {
	238	+	switch {
	239	+	case p.IsOwner():
	240	+	return "owner"
	241	+	case p.IsRoot():
	242	+	return "root"
	243	+	case p.TokenLabel() != "":
	244	+	return p.TokenLabel()
	245	+	}
	246	+	return "owner"
	247	+	}


@@ -230,3 +230,18 @@ func (p Principal) ArchiveGrant() (repo RepoName, sha string, ok bool) {
230	}	230		}
231	return p.archiveRepo, p.archiveSha, true	231		return p.archiveRepo, p.archiveSha, true
232	}	232		}
		233	+
		234	+	// AuthorName names who acts, for the author of a merge request or a comment: the
		235	+	// label of the token, "root" for the root token, "owner" for the owner signed
		236	+	// in on the web and for any other caller without a label.
		237	+	func AuthorName(p Principal) string {
		238	+	switch {
		239	+	case p.IsOwner():
		240	+	return "owner"
		241	+	case p.IsRoot():
		242	+	return "root"
		243	+	case p.TokenLabel() != "":
		244	+	return p.TokenLabel()
		245	+	}
		246	+	return "owner"
		247	+	}

M internal/domain/token.go +4 -2


@@ -30,6 +30,8 @@ const (
30	30		ScopeMRWrite Scope = "mr:write"
31	31		// ScopeMRMerge merges, and deletes the merged source branch on request.
32	32		ScopeMRMerge Scope = "mr:merge"
	33	+	// ScopeMRReview sets a verdict on a merge request.
	34	+	ScopeMRReview Scope = "mr:review"
33	35		// ScopeCIWrite re-runs or cancels CI runs.
34	36		ScopeCIWrite Scope = "ci:write"
35	37		// ScopeSecretsWrite sets and deletes secrets and variables.

@@ -40,11 +42,11 @@ const (
40	42		ScopeTokenAdmin Scope = "token:admin"
41	43		)
42	44
43		-	// AllScopes returns the nine scopes in a stable order.
	45	+	// AllScopes returns the ten scopes in a stable order.
44	46		func AllScopes() []Scope {
45	47		return []Scope{
46	48		ScopeRepoRead, ScopeRepoWrite, ScopeRepoAdmin,
47		-	ScopeMRWrite, ScopeMRMerge,
	49	+	ScopeMRWrite, ScopeMRMerge, ScopeMRReview,
48	50		ScopeCIWrite, ScopeSecretsWrite, ScopeRunnerRegister,
49	51		ScopeTokenAdmin,
50	52		}

 	ScopeMRWrite Scope = "mr:write"
 	// ScopeMRMerge merges, and deletes the merged source branch on request.
 	ScopeMRMerge Scope = "mr:merge"
+	// ScopeMRReview sets a verdict on a merge request.
+	ScopeMRReview Scope = "mr:review"
 	// ScopeCIWrite re-runs or cancels CI runs.
 	ScopeCIWrite Scope = "ci:write"
 	// ScopeSecretsWrite sets and deletes secrets and variables.
 	ScopeTokenAdmin Scope = "token:admin"
 )
-// AllScopes returns the nine scopes in a stable order.
+// AllScopes returns the ten scopes in a stable order.
 func AllScopes() []Scope {
 	return []Scope{
 		ScopeRepoRead, ScopeRepoWrite, ScopeRepoAdmin,
-		ScopeMRWrite, ScopeMRMerge,
+		ScopeMRWrite, ScopeMRMerge, ScopeMRReview,
 		ScopeCIWrite, ScopeSecretsWrite, ScopeRunnerRegister,
 		ScopeTokenAdmin,
 	}

M internal/domain/token_test.go +1 -1


@@ -16,7 +16,7 @@ import (
16	16		func TestScopes(t *testing.T) {
17	17		t.Parallel()
18	18		all := domain.AllScopes()
19		-	assert.Len(t, all, 9)
	19	+	assert.Len(t, all, 10)
20	20		for _, s := range all {
21	21		got, err := domain.ParseScope(s.String())
22	22		require.NoError(t, err)


@@ -16,7 +16,7 @@ import (
16		func TestScopes(t *testing.T) {	16		func TestScopes(t *testing.T) {
17		t.Parallel()	17		t.Parallel()
18		all := domain.AllScopes()	18		all := domain.AllScopes()
19	-	assert.Len(t, all, 9)	19	+	assert.Len(t, all, 10)
20		for _, s := range all {	20		for _, s := range all {
21		got, err := domain.ParseScope(s.String())	21		got, err := domain.ParseScope(s.String())
22		require.NoError(t, err)	22		require.NoError(t, err)

M internal/ports/dto.go +8 -0


@@ -212,6 +212,8 @@ type MergeRequestDetail struct {
212	212		Diff domain.Diff
213	213		// Comments are the comments, oldest first.
214	214		Comments []domain.Comment
	215	+	// Verdicts are the latest verdict per author in note ID order.
	216	+	Verdicts []domain.AuthorVerdict
215	217		// LastReadID is the head recorded by MarkRead; zero when none.
216	218		LastReadID domain.ObjectID
217	219		// LastReadLost tells that since-last-read was asked for, a head was

@@ -241,6 +243,12 @@ type FileWindow struct{ From, To int }
241	243
242	244		// AddCommentParams describes the comment to add.
243	245		type AddCommentParams struct {
	246	+	// ReplyTo names a non-deleted root; replies cannot specify an anchor or verdict.
	247	+	ReplyTo int64
	248	+	// StartLine starts an inclusive range, requiring a path and 1 <= StartLine < Line.
	249	+	StartLine int
	250	+	// Verdict requires mr:review and is only permitted on roots.
	251	+	Verdict domain.Verdict
244	252		// Path, Line and Side designate a line of the diff; all empty for a
245	253		// general comment.
246	254		Path string


@@ -212,6 +212,8 @@ type MergeRequestDetail struct {
212	Diff domain.Diff	212		Diff domain.Diff
213	// Comments are the comments, oldest first.	213		// Comments are the comments, oldest first.
214	Comments []domain.Comment	214		Comments []domain.Comment
		215	+	// Verdicts are the latest verdict per author in note ID order.
		216	+	Verdicts []domain.AuthorVerdict
215	// LastReadID is the head recorded by MarkRead; zero when none.	217		// LastReadID is the head recorded by MarkRead; zero when none.
216	LastReadID domain.ObjectID	218		LastReadID domain.ObjectID
217	// LastReadLost tells that since-last-read was asked for, a head was	219		// LastReadLost tells that since-last-read was asked for, a head was

@@ -241,6 +243,12 @@ type FileWindow struct{ From, To int }
241		243
242	// AddCommentParams describes the comment to add.	244		// AddCommentParams describes the comment to add.
243	type AddCommentParams struct {	245		type AddCommentParams struct {
		246	+	// ReplyTo names a non-deleted root; replies cannot specify an anchor or verdict.
		247	+	ReplyTo int64
		248	+	// StartLine starts an inclusive range, requiring a path and 1 <= StartLine < Line.
		249	+	StartLine int
		250	+	// Verdict requires mr:review and is only permitted on roots.
		251	+	Verdict domain.Verdict
244	// Path, Line and Side designate a line of the diff; all empty for a	252		// Path, Line and Side designate a line of the diff; all empty for a
245	// general comment.	253		// general comment.
246	Path string	254		Path string

M internal/ports/mocks/MergeRequestService.go +174 -0


@@ -360,6 +360,180 @@ func (_c *MergeRequestService_Create_Call) RunAndReturn(run func(ctx context.Con
360	360		return _c
361	361		}
362	362
	363	+	// DeleteComment provides a mock function for the type MergeRequestService
	364	+	func (_mock *MergeRequestService) DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64) (domain.Comment, error) {
	365	+	ret := _mock.Called(ctx, p, name, number, commentID)
	366	+
	367	+	if len(ret) == 0 {
	368	+	panic("no return value specified for DeleteComment")
	369	+	}
	370	+
	371	+	var r0 domain.Comment
	372	+	var r1 error
	373	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) (domain.Comment, error)); ok {
	374	+	return returnFunc(ctx, p, name, number, commentID)
	375	+	}
	376	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) domain.Comment); ok {
	377	+	r0 = returnFunc(ctx, p, name, number, commentID)
	378	+	} else {
	379	+	r0 = ret.Get(0).(domain.Comment)
	380	+	}
	381	+	if returnFunc, ok := ret.Get(1).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) error); ok {
	382	+	r1 = returnFunc(ctx, p, name, number, commentID)
	383	+	} else {
	384	+	r1 = ret.Error(1)
	385	+	}
	386	+	return r0, r1
	387	+	}
	388	+
	389	+	// MergeRequestService_DeleteComment_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteComment'
	390	+	type MergeRequestService_DeleteComment_Call struct {
	391	+	*mock.Call
	392	+	}
	393	+
	394	+	// DeleteComment is a helper method to define mock.On call
	395	+	// - ctx context.Context
	396	+	// - p domain.Principal
	397	+	// - name domain.RepoName
	398	+	// - number int64
	399	+	// - commentID int64
	400	+	func (_e MergeRequestService_Expecter) DeleteComment(ctx any, p any, name any, number any, commentID any) MergeRequestService_DeleteComment_Call {
	401	+	return &MergeRequestService_DeleteComment_Call{Call: _e.mock.On("DeleteComment", ctx, p, name, number, commentID)}
	402	+	}
	403	+
	404	+	func (_c MergeRequestService_DeleteComment_Call) Run(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64)) MergeRequestService_DeleteComment_Call {
	405	+	_c.Call.Run(func(args mock.Arguments) {
	406	+	var arg0 context.Context
	407	+	if args[0] != nil {
	408	+	arg0 = args[0].(context.Context)
	409	+	}
	410	+	var arg1 domain.Principal
	411	+	if args[1] != nil {
	412	+	arg1 = args[1].(domain.Principal)
	413	+	}
	414	+	var arg2 domain.RepoName
	415	+	if args[2] != nil {
	416	+	arg2 = args[2].(domain.RepoName)
	417	+	}
	418	+	var arg3 int64
	419	+	if args[3] != nil {
	420	+	arg3 = args[3].(int64)
	421	+	}
	422	+	var arg4 int64
	423	+	if args[4] != nil {
	424	+	arg4 = args[4].(int64)
	425	+	}
	426	+	run(
	427	+	arg0,
	428	+	arg1,
	429	+	arg2,
	430	+	arg3,
	431	+	arg4,
	432	+	)
	433	+	})
	434	+	return _c
	435	+	}
	436	+
	437	+	func (_c MergeRequestService_DeleteComment_Call) Return(comment domain.Comment, err error) MergeRequestService_DeleteComment_Call {
	438	+	_c.Call.Return(comment, err)
	439	+	return _c
	440	+	}
	441	+
	442	+	func (_c MergeRequestService_DeleteComment_Call) RunAndReturn(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64) (domain.Comment, error)) MergeRequestService_DeleteComment_Call {
	443	+	_c.Call.Return(run)
	444	+	return _c
	445	+	}
	446	+
	447	+	// EditComment provides a mock function for the type MergeRequestService
	448	+	func (_mock *MergeRequestService) EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string) (domain.Comment, error) {
	449	+	ret := _mock.Called(ctx, p, name, number, commentID, text)
	450	+
	451	+	if len(ret) == 0 {
	452	+	panic("no return value specified for EditComment")
	453	+	}
	454	+
	455	+	var r0 domain.Comment
	456	+	var r1 error
	457	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) (domain.Comment, error)); ok {
	458	+	return returnFunc(ctx, p, name, number, commentID, text)
	459	+	}
	460	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) domain.Comment); ok {
	461	+	r0 = returnFunc(ctx, p, name, number, commentID, text)
	462	+	} else {
	463	+	r0 = ret.Get(0).(domain.Comment)
	464	+	}
	465	+	if returnFunc, ok := ret.Get(1).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) error); ok {
	466	+	r1 = returnFunc(ctx, p, name, number, commentID, text)
	467	+	} else {
	468	+	r1 = ret.Error(1)
	469	+	}
	470	+	return r0, r1
	471	+	}
	472	+
	473	+	// MergeRequestService_EditComment_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'EditComment'
	474	+	type MergeRequestService_EditComment_Call struct {
	475	+	*mock.Call
	476	+	}
	477	+
	478	+	// EditComment is a helper method to define mock.On call
	479	+	// - ctx context.Context
	480	+	// - p domain.Principal
	481	+	// - name domain.RepoName
	482	+	// - number int64
	483	+	// - commentID int64
	484	+	// - text string
	485	+	func (_e MergeRequestService_Expecter) EditComment(ctx any, p any, name any, number any, commentID any, text any) MergeRequestService_EditComment_Call {
	486	+	return &MergeRequestService_EditComment_Call{Call: _e.mock.On("EditComment", ctx, p, name, number, commentID, text)}
	487	+	}
	488	+
	489	+	func (_c MergeRequestService_EditComment_Call) Run(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string)) MergeRequestService_EditComment_Call {
	490	+	_c.Call.Run(func(args mock.Arguments) {
	491	+	var arg0 context.Context
	492	+	if args[0] != nil {
	493	+	arg0 = args[0].(context.Context)
	494	+	}
	495	+	var arg1 domain.Principal
	496	+	if args[1] != nil {
	497	+	arg1 = args[1].(domain.Principal)
	498	+	}
	499	+	var arg2 domain.RepoName
	500	+	if args[2] != nil {
	501	+	arg2 = args[2].(domain.RepoName)
	502	+	}
	503	+	var arg3 int64
	504	+	if args[3] != nil {
	505	+	arg3 = args[3].(int64)
	506	+	}
	507	+	var arg4 int64
	508	+	if args[4] != nil {
	509	+	arg4 = args[4].(int64)
	510	+	}
	511	+	var arg5 string
	512	+	if args[5] != nil {
	513	+	arg5 = args[5].(string)
	514	+	}
	515	+	run(
	516	+	arg0,
	517	+	arg1,
	518	+	arg2,
	519	+	arg3,
	520	+	arg4,
	521	+	arg5,
	522	+	)
	523	+	})
	524	+	return _c
	525	+	}
	526	+
	527	+	func (_c MergeRequestService_EditComment_Call) Return(comment domain.Comment, err error) MergeRequestService_EditComment_Call {
	528	+	_c.Call.Return(comment, err)
	529	+	return _c
	530	+	}
	531	+
	532	+	func (_c MergeRequestService_EditComment_Call) RunAndReturn(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string) (domain.Comment, error)) MergeRequestService_EditComment_Call {
	533	+	_c.Call.Return(run)
	534	+	return _c
	535	+	}
	536	+
363	537		// Get provides a mock function for the type MergeRequestService
364	538		func (_mock *MergeRequestService) Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts ports.GetMergeRequestOptions) (ports.MergeRequestDetail, error) {
365	539		ret := _mock.Called(ctx, p, name, number, opts)


@@ -360,6 +360,180 @@ func (_c *MergeRequestService_Create_Call) RunAndReturn(run func(ctx context.Con
360	return _c	360		return _c
361	}	361		}
362		362
		363	+	// DeleteComment provides a mock function for the type MergeRequestService
		364	+	func (_mock *MergeRequestService) DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64) (domain.Comment, error) {
		365	+	ret := _mock.Called(ctx, p, name, number, commentID)
		366	+
		367	+	if len(ret) == 0 {
		368	+	panic("no return value specified for DeleteComment")
		369	+	}
		370	+
		371	+	var r0 domain.Comment
		372	+	var r1 error
		373	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) (domain.Comment, error)); ok {
		374	+	return returnFunc(ctx, p, name, number, commentID)
		375	+	}
		376	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) domain.Comment); ok {
		377	+	r0 = returnFunc(ctx, p, name, number, commentID)
		378	+	} else {
		379	+	r0 = ret.Get(0).(domain.Comment)
		380	+	}
		381	+	if returnFunc, ok := ret.Get(1).(func(context.Context, domain.Principal, domain.RepoName, int64, int64) error); ok {
		382	+	r1 = returnFunc(ctx, p, name, number, commentID)
		383	+	} else {
		384	+	r1 = ret.Error(1)
		385	+	}
		386	+	return r0, r1
		387	+	}
		388	+
		389	+	// MergeRequestService_DeleteComment_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteComment'
		390	+	type MergeRequestService_DeleteComment_Call struct {
		391	+	*mock.Call
		392	+	}
		393	+
		394	+	// DeleteComment is a helper method to define mock.On call
		395	+	// - ctx context.Context
		396	+	// - p domain.Principal
		397	+	// - name domain.RepoName
		398	+	// - number int64
		399	+	// - commentID int64
		400	+	func (_e MergeRequestService_Expecter) DeleteComment(ctx any, p any, name any, number any, commentID any) MergeRequestService_DeleteComment_Call {
		401	+	return &MergeRequestService_DeleteComment_Call{Call: _e.mock.On("DeleteComment", ctx, p, name, number, commentID)}
		402	+	}
		403	+
		404	+	func (_c MergeRequestService_DeleteComment_Call) Run(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64)) MergeRequestService_DeleteComment_Call {
		405	+	_c.Call.Run(func(args mock.Arguments) {
		406	+	var arg0 context.Context
		407	+	if args[0] != nil {
		408	+	arg0 = args[0].(context.Context)
		409	+	}
		410	+	var arg1 domain.Principal
		411	+	if args[1] != nil {
		412	+	arg1 = args[1].(domain.Principal)
		413	+	}
		414	+	var arg2 domain.RepoName
		415	+	if args[2] != nil {
		416	+	arg2 = args[2].(domain.RepoName)
		417	+	}
		418	+	var arg3 int64
		419	+	if args[3] != nil {
		420	+	arg3 = args[3].(int64)
		421	+	}
		422	+	var arg4 int64
		423	+	if args[4] != nil {
		424	+	arg4 = args[4].(int64)
		425	+	}
		426	+	run(
		427	+	arg0,
		428	+	arg1,
		429	+	arg2,
		430	+	arg3,
		431	+	arg4,
		432	+	)
		433	+	})
		434	+	return _c
		435	+	}
		436	+
		437	+	func (_c MergeRequestService_DeleteComment_Call) Return(comment domain.Comment, err error) MergeRequestService_DeleteComment_Call {
		438	+	_c.Call.Return(comment, err)
		439	+	return _c
		440	+	}
		441	+
		442	+	func (_c MergeRequestService_DeleteComment_Call) RunAndReturn(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64) (domain.Comment, error)) MergeRequestService_DeleteComment_Call {
		443	+	_c.Call.Return(run)
		444	+	return _c
		445	+	}
		446	+
		447	+	// EditComment provides a mock function for the type MergeRequestService
		448	+	func (_mock *MergeRequestService) EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string) (domain.Comment, error) {
		449	+	ret := _mock.Called(ctx, p, name, number, commentID, text)
		450	+
		451	+	if len(ret) == 0 {
		452	+	panic("no return value specified for EditComment")
		453	+	}
		454	+
		455	+	var r0 domain.Comment
		456	+	var r1 error
		457	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) (domain.Comment, error)); ok {
		458	+	return returnFunc(ctx, p, name, number, commentID, text)
		459	+	}
		460	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) domain.Comment); ok {
		461	+	r0 = returnFunc(ctx, p, name, number, commentID, text)
		462	+	} else {
		463	+	r0 = ret.Get(0).(domain.Comment)
		464	+	}
		465	+	if returnFunc, ok := ret.Get(1).(func(context.Context, domain.Principal, domain.RepoName, int64, int64, string) error); ok {
		466	+	r1 = returnFunc(ctx, p, name, number, commentID, text)
		467	+	} else {
		468	+	r1 = ret.Error(1)
		469	+	}
		470	+	return r0, r1
		471	+	}
		472	+
		473	+	// MergeRequestService_EditComment_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'EditComment'
		474	+	type MergeRequestService_EditComment_Call struct {
		475	+	*mock.Call
		476	+	}
		477	+
		478	+	// EditComment is a helper method to define mock.On call
		479	+	// - ctx context.Context
		480	+	// - p domain.Principal
		481	+	// - name domain.RepoName
		482	+	// - number int64
		483	+	// - commentID int64
		484	+	// - text string
		485	+	func (_e MergeRequestService_Expecter) EditComment(ctx any, p any, name any, number any, commentID any, text any) MergeRequestService_EditComment_Call {
		486	+	return &MergeRequestService_EditComment_Call{Call: _e.mock.On("EditComment", ctx, p, name, number, commentID, text)}
		487	+	}
		488	+
		489	+	func (_c MergeRequestService_EditComment_Call) Run(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string)) MergeRequestService_EditComment_Call {
		490	+	_c.Call.Run(func(args mock.Arguments) {
		491	+	var arg0 context.Context
		492	+	if args[0] != nil {
		493	+	arg0 = args[0].(context.Context)
		494	+	}
		495	+	var arg1 domain.Principal
		496	+	if args[1] != nil {
		497	+	arg1 = args[1].(domain.Principal)
		498	+	}
		499	+	var arg2 domain.RepoName
		500	+	if args[2] != nil {
		501	+	arg2 = args[2].(domain.RepoName)
		502	+	}
		503	+	var arg3 int64
		504	+	if args[3] != nil {
		505	+	arg3 = args[3].(int64)
		506	+	}
		507	+	var arg4 int64
		508	+	if args[4] != nil {
		509	+	arg4 = args[4].(int64)
		510	+	}
		511	+	var arg5 string
		512	+	if args[5] != nil {
		513	+	arg5 = args[5].(string)
		514	+	}
		515	+	run(
		516	+	arg0,
		517	+	arg1,
		518	+	arg2,
		519	+	arg3,
		520	+	arg4,
		521	+	arg5,
		522	+	)
		523	+	})
		524	+	return _c
		525	+	}
		526	+
		527	+	func (_c MergeRequestService_EditComment_Call) Return(comment domain.Comment, err error) MergeRequestService_EditComment_Call {
		528	+	_c.Call.Return(comment, err)
		529	+	return _c
		530	+	}
		531	+
		532	+	func (_c MergeRequestService_EditComment_Call) RunAndReturn(run func(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, commentID int64, text string) (domain.Comment, error)) MergeRequestService_EditComment_Call {
		533	+	_c.Call.Return(run)
		534	+	return _c
		535	+	}
		536	+
363	// Get provides a mock function for the type MergeRequestService	537		// Get provides a mock function for the type MergeRequestService
364	func (_mock *MergeRequestService) Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts ports.GetMergeRequestOptions) (ports.MergeRequestDetail, error) {	538		func (_mock *MergeRequestService) Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts ports.GetMergeRequestOptions) (ports.MergeRequestDetail, error) {
365	ret := _mock.Called(ctx, p, name, number, opts)	539		ret := _mock.Called(ctx, p, name, number, opts)

M internal/ports/services.go +2 -0


@@ -113,6 +113,8 @@ type MergeRequestService interface {
113	113		List(ctx context.Context, p domain.Principal, name domain.RepoName, params ListMergeRequestsParams) (MergeRequestPage, error)
114	114		Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts GetMergeRequestOptions) (MergeRequestDetail, error)
115	115		AddComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, params AddCommentParams) (domain.Comment, error)
	116	+	EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string) (domain.Comment, error)
	117	+	DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64) (domain.Comment, error)
116	118		ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error)
117	119		Close(ctx context.Context, p domain.Principal, name domain.RepoName, number int64) (domain.MergeRequest, error)
118	120		MarkRead(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, head domain.ObjectID) (domain.ObjectID, error)


@@ -113,6 +113,8 @@ type MergeRequestService interface {
113	List(ctx context.Context, p domain.Principal, name domain.RepoName, params ListMergeRequestsParams) (MergeRequestPage, error)	113		List(ctx context.Context, p domain.Principal, name domain.RepoName, params ListMergeRequestsParams) (MergeRequestPage, error)
114	Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts GetMergeRequestOptions) (MergeRequestDetail, error)	114		Get(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, opts GetMergeRequestOptions) (MergeRequestDetail, error)
115	AddComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, params AddCommentParams) (domain.Comment, error)	115		AddComment(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, params AddCommentParams) (domain.Comment, error)
		116	+	EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string) (domain.Comment, error)
		117	+	DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64) (domain.Comment, error)
116	ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error)	118		ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error)
117	Close(ctx context.Context, p domain.Principal, name domain.RepoName, number int64) (domain.MergeRequest, error)	119		Close(ctx context.Context, p domain.Principal, name domain.RepoName, number int64) (domain.MergeRequest, error)
118	MarkRead(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, head domain.ObjectID) (domain.ObjectID, error)	120		MarkRead(ctx context.Context, p domain.Principal, name domain.RepoName, number int64, head domain.ObjectID) (domain.ObjectID, error)

M internal/usecase/access.go +0 -15


@@ -91,18 +91,3 @@ func scopeAccess(p domain.Principal, repo domain.Repo, scope domain.Scope) error
91	91		}
92	92		return fmt.Errorf("%w: this needs the %s scope on %s", domain.ErrForbidden, scope, repo.Name)
93	93		}
94		-
95		-	// authorOf names who acts, for the author of a merge request or a comment: the
96		-	// label of the token, "root" for the root token, "owner" for the owner signed
97		-	// in on the web and for any other caller without a label.
98		-	func authorOf(p domain.Principal) string {
99		-	switch {
100		-	case p.IsOwner():
101		-	return "owner"
102		-	case p.IsRoot():
103		-	return "root"
104		-	case p.TokenLabel() != "":
105		-	return p.TokenLabel()
106		-	}
107		-	return "owner"
108		-	}


@@ -91,18 +91,3 @@ func scopeAccess(p domain.Principal, repo domain.Repo, scope domain.Scope) error
91		}	91	}
92		return fmt.Errorf("%w: this needs the %s scope on %s", domain.ErrForbidden, scope, repo.Name)	92	return fmt.Errorf("%w: this needs the %s scope on %s", domain.ErrForbidden, scope, repo.Name)
93		}	93	}
94	-
95	-	// authorOf names who acts, for the author of a merge request or a comment: the
96	-	// label of the token, "root" for the root token, "owner" for the owner signed
97	-	// in on the web and for any other caller without a label.
98	-	func authorOf(p domain.Principal) string {
99	-	switch {
100	-	case p.IsOwner():
101	-	return "owner"
102	-	case p.IsRoot():
103	-	return "root"
104	-	case p.TokenLabel() != "":
105	-	return p.TokenLabel()
106	-	}
107	-	return "owner"
108	-	}

M internal/usecase/ci_dispatch.go +1 -1


@@ -135,7 +135,7 @@ func (c *CI) dispatchCaller(ctx context.Context, p domain.Principal, name domain
135	135		if err != nil {
136	136		return repo, "", pusher, false, err
137	137		}
138		-	return repo, authorOf(p), domain.PusherOf(p), domain.TrustedActor(p), nil
	138	+	return repo, domain.AuthorName(p), domain.PusherOf(p), domain.TrustedActor(p), nil
139	139		}
140	140
141	141		// dispatchPath checks the workflow file of a dispatch: a file of


@@ -135,7 +135,7 @@ func (c *CI) dispatchCaller(ctx context.Context, p domain.Principal, name domain
135		if err != nil {	135		if err != nil {
136		return repo, "", pusher, false, err	136		return repo, "", pusher, false, err
137		}	137		}
138	-	return repo, authorOf(p), domain.PusherOf(p), domain.TrustedActor(p), nil	138	+	return repo, domain.AuthorName(p), domain.PusherOf(p), domain.TrustedActor(p), nil
139		}	139		}
140			140
141		// dispatchPath checks the workflow file of a dispatch: a file of	141		// dispatchPath checks the workflow file of a dispatch: a file of

M internal/usecase/ci_pull.go +1 -1


@@ -203,7 +203,7 @@ func (c *CI) OnPullRequest(ctx context.Context, repo domain.RepoName, ev ports.P
203	203		}
204	204		e := pullEvent{
205	205		repo: repo, number: ev.Number, action: ev.Action, head: ev.Head, base: ev.Base,
206		-	actor: authorOf(p), pusher: domain.PusherOf(p), run: !p.ViaJobToken(), log: zerowrap.FromCtx(ctx),
	206	+	actor: domain.AuthorName(p), pusher: domain.PusherOf(p), run: !p.ViaJobToken(), log: zerowrap.FromCtx(ctx),
207	207		actorTrusted: domain.TrustedActor(p), target: c.defaultTipOf(ctx, repo),
208	208		}
209	209		if e.actorTrusted {


@@ -203,7 +203,7 @@ func (c *CI) OnPullRequest(ctx context.Context, repo domain.RepoName, ev ports.P
203		}	203		}
204		e := pullEvent{	204		e := pullEvent{
205		repo: repo, number: ev.Number, action: ev.Action, head: ev.Head, base: ev.Base,	205		repo: repo, number: ev.Number, action: ev.Action, head: ev.Head, base: ev.Base,
206	-	actor: authorOf(p), pusher: domain.PusherOf(p), run: !p.ViaJobToken(), log: zerowrap.FromCtx(ctx),	206	+	actor: domain.AuthorName(p), pusher: domain.PusherOf(p), run: !p.ViaJobToken(), log: zerowrap.FromCtx(ctx),
207		actorTrusted: domain.TrustedActor(p), target: c.defaultTipOf(ctx, repo),	207		actorTrusted: domain.TrustedActor(p), target: c.defaultTipOf(ctx, repo),
208		}	208		}
209		if e.actorTrusted {	209		if e.actorTrusted {

M internal/usecase/ci_runs.go +1 -1


@@ -332,7 +332,7 @@ func (c *CI) CancelRun(ctx context.Context, p domain.Principal, name domain.Repo
332	332		}
333	333		if !rs.run.CancelRequested {
334	334		rs.run.CancelRequested, rs.run.CancelRequestedAt, rs.runDirty = true, c.now(), true
335		-	rs.cancelAll("Canceled by " + authorOf(p))
	335	+	rs.cancelAll("Canceled by " + domain.AuthorName(p))
336	336		}
337	337		if err := rs.flush(ctx); err != nil {
338	338		return err


@@ -332,7 +332,7 @@ func (c *CI) CancelRun(ctx context.Context, p domain.Principal, name domain.Repo
332		}	332		}
333		if !rs.run.CancelRequested {	333		if !rs.run.CancelRequested {
334		rs.run.CancelRequested, rs.run.CancelRequestedAt, rs.runDirty = true, c.now(), true	334		rs.run.CancelRequested, rs.run.CancelRequestedAt, rs.runDirty = true, c.now(), true
335	-	rs.cancelAll("Canceled by " + authorOf(p))	335	+	rs.cancelAll("Canceled by " + domain.AuthorName(p))
336		}	336		}
337		if err := rs.flush(ctx); err != nil {	337		if err := rs.flush(ctx); err != nil {
338		return err	338		return err

M internal/usecase/ci_tips.go +1 -1


@@ -85,7 +85,7 @@ func (c *CI) scheduleActor(ctx context.Context, repo domain.RepoName, branch str
85	85		if t, ok := c.refTip(ctx, repo, "refs/heads/"+branch, tip); ok {
86	86		return t.Actor, t.Pusher, t.Trusted
87	87		}
88		-	return authorOf(domain.Owner()), domain.CIPusher{}, false
	88	+	return domain.AuthorName(domain.Owner()), domain.CIPusher{}, false
89	89		}
90	90
91	91		// refTrusted reports whether the ref was set to exactly the pinned object by a


@@ -85,7 +85,7 @@ func (c *CI) scheduleActor(ctx context.Context, repo domain.RepoName, branch str
85		if t, ok := c.refTip(ctx, repo, "refs/heads/"+branch, tip); ok {	85		if t, ok := c.refTip(ctx, repo, "refs/heads/"+branch, tip); ok {
86		return t.Actor, t.Pusher, t.Trusted	86		return t.Actor, t.Pusher, t.Trusted
87		}	87		}
88	-	return authorOf(domain.Owner()), domain.CIPusher{}, false	88	+	return domain.AuthorName(domain.Owner()), domain.CIPusher{}, false
89		}	89		}
90			90
91		// refTrusted reports whether the ref was set to exactly the pinned object by a	91		// refTrusted reports whether the ref was set to exactly the pinned object by a

M internal/usecase/ci_trigger.go +4 -4


@@ -59,13 +59,13 @@ func (c *CI) OnPush(ctx context.Context, repo domain.RepoName, updates []domain.
59	59		c.markSchedulesDirty(repo, updates)
60	60		// The merge requests follow the push whoever made it (their refs); only a
61	61		// push that is not a job's starts pull_request runs.
62		-	defer c.onBranchesMoved(ctx, repo, updates, authorOf(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher), !pusher.ViaJobToken())
	62	+	defer c.onBranchesMoved(ctx, repo, updates, domain.AuthorName(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher), !pusher.ViaJobToken())
63	63		if pusher.ViaJobToken() {
64	64		log := zerowrap.FromCtx(ctx)
65	65		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("push by a job token starts no run")
66	66		return
67	67		}
68		-	c.enqueue(ctx, repo, updates, authorOf(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher))
	68	+	c.enqueue(ctx, repo, updates, domain.AuthorName(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher))
69	69		}
70	70
71	71		// OnMerge queues the move of a target branch by a merge. The actor of the run is

@@ -79,13 +79,13 @@ func (c *CI) OnMerge(ctx context.Context, repo domain.RepoName, updates []domain
79	79		// The merge moved a target branch: the test merges of the other requests
80	80		// into it are computed again (a merge starts no synchronize run), after the
81	81		// push workflows are queued.
82		-	defer c.onBranchesMoved(ctx, repo, updates, authorOf(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger), false)
	82	+	defer c.onBranchesMoved(ctx, repo, updates, domain.AuthorName(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger), false)
83	83		if merger.ViaJobToken() {
84	84		log := zerowrap.FromCtx(ctx)
85	85		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("merge by a job token starts no run")
86	86		return
87	87		}
88		-	c.enqueue(ctx, repo, updates, authorOf(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger))
	88	+	c.enqueue(ctx, repo, updates, domain.AuthorName(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger))
89	89		}
90	90
91	91		func (c *CI) enqueue(ctx context.Context, repo domain.RepoName, updates []domain.RefUpdate, actor string, pusher domain.CIPusher, trusted bool) {


@@ -59,13 +59,13 @@ func (c *CI) OnPush(ctx context.Context, repo domain.RepoName, updates []domain.
59		c.markSchedulesDirty(repo, updates)	59		c.markSchedulesDirty(repo, updates)
60		// The merge requests follow the push whoever made it (their refs); only a	60		// The merge requests follow the push whoever made it (their refs); only a
61		// push that is not a job's starts pull_request runs.	61		// push that is not a job's starts pull_request runs.
62	-	defer c.onBranchesMoved(ctx, repo, updates, authorOf(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher), !pusher.ViaJobToken())	62	+	defer c.onBranchesMoved(ctx, repo, updates, domain.AuthorName(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher), !pusher.ViaJobToken())
63		if pusher.ViaJobToken() {	63		if pusher.ViaJobToken() {
64		log := zerowrap.FromCtx(ctx)	64		log := zerowrap.FromCtx(ctx)
65		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("push by a job token starts no run")	65		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("push by a job token starts no run")
66		return	66		return
67		}	67		}
68	-	c.enqueue(ctx, repo, updates, authorOf(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher))	68	+	c.enqueue(ctx, repo, updates, domain.AuthorName(pusher), domain.PusherOf(pusher), domain.TrustedActor(pusher))
69		}	69		}
70			70
71		// OnMerge queues the move of a target branch by a merge. The actor of the run is	71		// OnMerge queues the move of a target branch by a merge. The actor of the run is

@@ -79,13 +79,13 @@ func (c *CI) OnMerge(ctx context.Context, repo domain.RepoName, updates []domain
79		// The merge moved a target branch: the test merges of the other requests	79		// The merge moved a target branch: the test merges of the other requests
80		// into it are computed again (a merge starts no synchronize run), after the	80		// into it are computed again (a merge starts no synchronize run), after the
81		// push workflows are queued.	81		// push workflows are queued.
82	-	defer c.onBranchesMoved(ctx, repo, updates, authorOf(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger), false)	82	+	defer c.onBranchesMoved(ctx, repo, updates, domain.AuthorName(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger), false)
83		if merger.ViaJobToken() {	83		if merger.ViaJobToken() {
84		log := zerowrap.FromCtx(ctx)	84		log := zerowrap.FromCtx(ctx)
85		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("merge by a job token starts no run")	85		log.Debug().Str("repo", repo.String()).Int("refs", len(updates)).Msg("merge by a job token starts no run")
86		return	86		return
87		}	87		}
88	-	c.enqueue(ctx, repo, updates, authorOf(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger))	88	+	c.enqueue(ctx, repo, updates, domain.AuthorName(domain.Owner()), domain.PusherOf(merger), domain.TrustedActor(merger))
89		}	89		}
90			90
91		func (c *CI) enqueue(ctx context.Context, repo domain.RepoName, updates []domain.RefUpdate, actor string, pusher domain.CIPusher, trusted bool) {	91		func (c *CI) enqueue(ctx context.Context, repo domain.RepoName, updates []domain.RefUpdate, actor string, pusher domain.CIPusher, trusted bool) {

M internal/usecase/events.go +12 -0


@@ -178,6 +178,12 @@ func (e *Events) snapshot(ctx context.Context, ev domain.Event) bufferedEvent {
178	178		return repoSnapshot(ev.Visibility, ev.CreatedAt)
179	179		case domain.CommentAdded:
180	180		return repoSnapshot(ev.Visibility, ev.CreatedAt)
	181	+	case domain.CommentEdited:
	182	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
	183	+	case domain.CommentDeleted:
	184	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
	185	+	case domain.CommentResolved:
	186	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
181	187		case domain.RunUpdated:
182	188		return repoSnapshot(ev.Visibility, ev.CreatedAt)
183	189		case domain.JobUpdated:

@@ -487,6 +493,12 @@ func (e Events) deliver(ctx context.Context, w watch, be bufferedEvent, send f
487	493		return e.deliverRepo(ctx, w, ev.MergeRequest.Repo, false, be, out, send)
488	494		case domain.CommentAdded:
489	495		return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
	496	+	case domain.CommentEdited:
	497	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
	498	+	case domain.CommentDeleted:
	499	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
	500	+	case domain.CommentResolved:
	501	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
490	502		case domain.RunUpdated:
491	503		// Home shows the CI state of each repository.
492	504		return e.deliverRepo(ctx, w, ev.Run.Repo, false, be, out, send)


@@ -178,6 +178,12 @@ func (e *Events) snapshot(ctx context.Context, ev domain.Event) bufferedEvent {
178	return repoSnapshot(ev.Visibility, ev.CreatedAt)	178		return repoSnapshot(ev.Visibility, ev.CreatedAt)
179	case domain.CommentAdded:	179		case domain.CommentAdded:
180	return repoSnapshot(ev.Visibility, ev.CreatedAt)	180		return repoSnapshot(ev.Visibility, ev.CreatedAt)
		181	+	case domain.CommentEdited:
		182	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
		183	+	case domain.CommentDeleted:
		184	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
		185	+	case domain.CommentResolved:
		186	+	return repoSnapshot(ev.Visibility, ev.CreatedAt)
181	case domain.RunUpdated:	187		case domain.RunUpdated:
182	return repoSnapshot(ev.Visibility, ev.CreatedAt)	188		return repoSnapshot(ev.Visibility, ev.CreatedAt)
183	case domain.JobUpdated:	189		case domain.JobUpdated:

@@ -487,6 +493,12 @@ func (e Events) deliver(ctx context.Context, w watch, be bufferedEvent, send f
487	return e.deliverRepo(ctx, w, ev.MergeRequest.Repo, false, be, out, send)	493		return e.deliverRepo(ctx, w, ev.MergeRequest.Repo, false, be, out, send)
488	case domain.CommentAdded:	494		case domain.CommentAdded:
489	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)	495		return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
		496	+	case domain.CommentEdited:
		497	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
		498	+	case domain.CommentDeleted:
		499	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
		500	+	case domain.CommentResolved:
		501	+	return e.deliverRepo(ctx, w, ev.Repo, false, be, out, send)
490	case domain.RunUpdated:	502		case domain.RunUpdated:
491	// Home shows the CI state of each repository.	503		// Home shows the CI state of each repository.
492	return e.deliverRepo(ctx, w, ev.Run.Repo, false, be, out, send)	504		return e.deliverRepo(ctx, w, ev.Run.Repo, false, be, out, send)

M internal/usecase/events_test.go +32 -0


@@ -922,3 +922,35 @@ func TestWatchHomeGetsRunUpdates(t *testing.T) {
922	922		root.quiet(t, r, pub)
923	923		})
924	924		}
	925	+
	926	+	func TestNoteMutationEventVisibility(t *testing.T) {
	927	+	synctest.Test(t, func(t *testing.T) {
	928	+	r := newEventRig(t, 0)
	929	+	pub := r.repo("pub", domain.VisibilityPublic)
	930	+	priv := r.repo("priv", domain.VisibilityPrivate)
	931	+	ctx, cancel := context.WithCancel(context.Background())
	932	+	defer cancel()
	933	+	anon := r.watch(ctx, domain.Anonymous(), ports.WatchParams{})
	934	+	owner := r.watch(ctx, domain.Root(), ports.WatchParams{Topics: []string{"repo:priv"}})
	935	+	synctest.Wait()
	936	+	for _, kind := range []string{"edited", "deleted", "resolved"} {
	937	+	for _, n := range []domain.RepoName{priv, pub} {
	938	+	vis := domain.VisibilityPublic
	939	+	if n == priv {
	940	+	vis = domain.VisibilityPrivate
	941	+	}
	942	+	switch kind {
	943	+	case "edited":
	944	+	r.feed <- domain.CommentEdited{Repo: n, Visibility: vis, CreatedAt: now, At: now}
	945	+	case "deleted":
	946	+	r.feed <- domain.CommentDeleted{Repo: n, Visibility: vis, CreatedAt: now, At: now}
	947	+	case "resolved":
	948	+	r.feed <- domain.CommentResolved{Repo: n, Visibility: vis, CreatedAt: now, At: now}
	949	+	}
	950	+	}
	951	+	assert.Equal(t, "mr.comment_"+kind, anon.next(t).Event.EventKind())
	952	+	assert.Equal(t, "mr.comment_"+kind, owner.next(t).Event.EventKind())
	953	+	anon.quiet(t, r, pub)
	954	+	}
	955	+	})
	956	+	}


@@ -922,3 +922,35 @@ func TestWatchHomeGetsRunUpdates(t *testing.T) {
922	root.quiet(t, r, pub)	922		root.quiet(t, r, pub)
923	})	923		})
924	}	924		}
		925	+
		926	+	func TestNoteMutationEventVisibility(t *testing.T) {
		927	+	synctest.Test(t, func(t *testing.T) {
		928	+	r := newEventRig(t, 0)
		929	+	pub := r.repo("pub", domain.VisibilityPublic)
		930	+	priv := r.repo("priv", domain.VisibilityPrivate)
		931	+	ctx, cancel := context.WithCancel(context.Background())
		932	+	defer cancel()
		933	+	anon := r.watch(ctx, domain.Anonymous(), ports.WatchParams{})
		934	+	owner := r.watch(ctx, domain.Root(), ports.WatchParams{Topics: []string{"repo:priv"}})
		935	+	synctest.Wait()
		936	+	for _, kind := range []string{"edited", "deleted", "resolved"} {
		937	+	for _, n := range []domain.RepoName{priv, pub} {
		938	+	vis := domain.VisibilityPublic
		939	+	if n == priv {
		940	+	vis = domain.VisibilityPrivate
		941	+	}
		942	+	switch kind {
		943	+	case "edited":
		944	+	r.feed <- domain.CommentEdited{Repo: n, Visibility: vis, CreatedAt: now, At: now}
		945	+	case "deleted":
		946	+	r.feed <- domain.CommentDeleted{Repo: n, Visibility: vis, CreatedAt: now, At: now}
		947	+	case "resolved":
		948	+	r.feed <- domain.CommentResolved{Repo: n, Visibility: vis, CreatedAt: now, At: now}
		949	+	}
		950	+	}
		951	+	assert.Equal(t, "mr.comment_"+kind, anon.next(t).Event.EventKind())
		952	+	assert.Equal(t, "mr.comment_"+kind, owner.next(t).Event.EventKind())
		953	+	anon.quiet(t, r, pub)
		954	+	}
		955	+	})
		956	+	}

M internal/usecase/export_test.go +0 -3


@@ -15,9 +15,6 @@ import (
15	15		"bnema.dev/ermite/internal/ports"
16	16		)
17	17
18		-	// AuthorOf exposes authorOf to the tests.
19		-	func AuthorOf(p domain.Principal) string { return authorOf(p) }
20		-
21	18		// Sweep exposes the daily sweep to the tests.
22	19		func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }
23	20


@@ -15,9 +15,6 @@ import (
15		"bnema.dev/ermite/internal/ports"	15	"bnema.dev/ermite/internal/ports"
16		)	16	)
17			17
18	-	// AuthorOf exposes authorOf to the tests.
19	-	func AuthorOf(p domain.Principal) string { return authorOf(p) }
20	-
21		// Sweep exposes the daily sweep to the tests.	18	// Sweep exposes the daily sweep to the tests.
22		func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }	19	func (c *CI) Sweep(ctx context.Context) { c.sweep(ctx) }
23			20

M internal/usecase/mergerequests.go +137 -9


@@ -241,7 +241,7 @@ func (m *MergeRequests) Create(ctx context.Context, p domain.Principal, name dom
241	241		now := m.clock.Now().UTC()
242	242		mr, err := m.store.Create(ctx, domain.MergeRequest{
243	243		Repo: name, Title: title, Description: desc, Source: source, Target: target,
244		-	State: domain.MRStateOpen, Author: authorOf(p), CreatedAt: now, UpdatedAt: now,
	244	+	State: domain.MRStateOpen, Author: domain.AuthorName(p), CreatedAt: now, UpdatedAt: now,
245	245		})
246	246		if err != nil {
247	247		return domain.MergeRequest{}, fmt.Errorf("create merge request of %q: %w", name, err)

@@ -468,6 +468,7 @@ func (m *MergeRequests) Get(ctx context.Context, p domain.Principal, name domain
468	468		if d.Comments, err = m.store.ListComments(ctx, name, number); err != nil {
469	469		return ports.MergeRequestDetail{}, fmt.Errorf("list comments of !%d in %q: %w", number, name, err)
470	470		}
	471	+	d.Verdicts = domain.CurrentVerdicts(d.Comments, mr.HeadID)
471	472		if d.LastReadID, err = m.store.GetRead(ctx, name, number); err != nil {
472	473		return ports.MergeRequestDetail{}, err
473	474		}

@@ -547,7 +548,7 @@ func (m *MergeRequests) rangeOf(ctx context.Context, mr domain.MergeRequest) (ex
547	548		}
548	549
549	550		// AddComment adds a comment and publishes CommentAdded. The principal needs
550		-	// mr:write. The text must follow the rules of ADR 0017 and not be blank; a
	551	+	// mr:write. The text must follow the rules of ADR 0032 and not be blank unless carrying a verdict; a
551	552		// comment on a line must name a line of the current diff of the request (see
552	553		// domain.Diff.HasLine), else the call fails with domain.ErrInvalid. A request
553	554		// that is not open gives domain.ErrPreconditionFailed, and one that already

@@ -566,21 +567,44 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
566	567		switch {
567	568		case err != nil:
568	569		v.AddErr("text", err)
569		-	case text.IsBlank():
	570	+	case text.IsBlank() && params.Verdict == domain.VerdictNone:
570	571		v.Add("text", "is required")
571	572		}
572	573		general := params.Path == ""
573	574		switch {
574		-	case general && (params.Line != 0 \|\| params.Side != domain.SideNone):
	575	+	case general && (params.Line != 0 \|\| params.Side != domain.SideNone \|\| params.StartLine != 0):
575	576		v.Add("path", "is required with line and side")
576	577		case !general && params.Line < 1:
577	578		v.Add("line", "must be 1 or more with a path")
578	579		case !general && params.Side != domain.SideOld && params.Side != domain.SideNew:
579	580		v.Add("side", "is required with a path")
580	581		}
	582	+	if params.StartLine != 0 && (params.StartLine < 1 \|\| params.StartLine >= params.Line) {
	583	+	v.Add("start_line", "must be 1 or more and less than line")
	584	+	}
	585	+	if params.Verdict > domain.VerdictChangesRequested {
	586	+	v.Add("verdict", "is unknown")
	587	+	}
	588	+	if params.ReplyTo != 0 {
	589	+	if params.Path != "" \|\| params.Line != 0 \|\| params.StartLine != 0 \|\| params.Side != domain.SideNone \|\| params.Verdict != domain.VerdictNone {
	590	+	v.Add("reply_to", "a reply cannot specify an anchor or verdict")
	591	+	}
	592	+	}
581	593		if err := v.Err(); err != nil {
582	594		return domain.Comment{}, err
583	595		}
	596	+	if params.ReplyTo != 0 {
	597	+	root, err := m.replyRoot(ctx, name, number, params.ReplyTo)
	598	+	if err != nil {
	599	+	return domain.Comment{}, err
	600	+	}
	601	+	params.Path, params.Line, params.StartLine, params.Side = root.Path, root.Line, root.StartLine, root.Side
	602	+	}
	603	+	if params.Verdict != domain.VerdictNone {
	604	+	if err := scopeAccess(p, repo, domain.ScopeMRReview); err != nil {
	605	+	return domain.Comment{}, err
	606	+	}
	607	+	}
584	608		if !mr.IsOpen() {
585	609		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
586	610		}

@@ -588,7 +612,7 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
588	612		if mr, err = m.withHead(ctx, mr); err != nil {
589	613		return domain.Comment{}, err
590	614		}
591		-	if !general {
	615	+	if !general && params.ReplyTo == 0 {
592	616		if err := m.checkLine(ctx, mr, params); err != nil {
593	617		return domain.Comment{}, err
594	618		}

@@ -600,7 +624,8 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
600	624		return domain.Comment{}, fmt.Errorf("%w: !%d already has %d comments", domain.ErrResourceExhausted, number, MaxCommentsPerMergeRequest)
601	625		}
602	626		c = domain.Comment{
603		-	ID: mr.CommentSeq + 1, Author: authorOf(p), Path: params.Path, Line: params.Line, Side: params.Side,
	627	+	ID: mr.CommentSeq + 1, Author: domain.AuthorName(p), Path: params.Path, Line: params.Line, Side: params.Side,
	628	+	ReplyTo: params.ReplyTo, StartLine: params.StartLine, Verdict: params.Verdict, Resolved: params.Verdict == domain.VerdictApprove,
604	629		CommitID: mr.HeadID, Text: text, CreatedAt: m.clock.Now().UTC(),
605	630		}
606	631		mr.CommentSeq, mr.UpdatedAt = c.ID, c.CreatedAt

@@ -616,6 +641,12 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
616	641		if !fresh.IsOpen() {
617	642		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, fresh.State)
618	643		}
	644	+	if params.ReplyTo != 0 {
	645	+	// The root may have been deleted by the write that got in between.
	646	+	if _, rerr := m.replyRoot(ctx, name, number, params.ReplyTo); rerr != nil {
	647	+	return domain.Comment{}, rerr
	648	+	}
	649	+	}
619	650		fresh.HeadID = mr.HeadID
620	651		mr = fresh
621	652		}

@@ -624,7 +655,7 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
624	655		}
625	656		log := zerowrap.FromCtx(ctx)
626	657		log.Info().Str("repo", name.String()).Int64("number", number).Int64("comment", c.ID).
627		-	Bool("on_line", !general).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment added")
	658	+	Int64("reply_to", c.ReplyTo).Str("verdict", c.Verdict.String()).Bool("on_line", !general).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment added")
628	659		m.bus.Publish(ctx, domain.CommentAdded{
629	660		Repo: name, Number: number, Comment: c, At: c.CreatedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt,
630	661		})

@@ -667,6 +698,9 @@ func (m *MergeRequests) checkLine(ctx context.Context, mr domain.MergeRequest, p
667	698		if idx < 0 \|\| !diff.HasLine(params.Path, params.Side, params.Line) {
668	699		v.Add("path", fmt.Sprintf("%s:%d on the %s side is not a line of the diff", params.Path, params.Line, params.Side))
669	700		}
	701	+	if params.StartLine != 0 && !diff.HasLine(params.Path, params.Side, params.StartLine) {
	702	+	v.Add("start_line", "is not a line of the diff")
	703	+	}
670	704		return v.Err()
671	705		}
672	706

@@ -683,7 +717,8 @@ func diffFileName(f domain.FileDiff) string {
683	717		// not open domain.ErrPreconditionFailed. Setting the state the comment already
684	718		// has succeeds and writes nothing.
685	719		func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error) {
686		-	if _, err := m.writable(ctx, p, name, domain.ScopeMRWrite); err != nil {
	720	+	repo, err := m.writable(ctx, p, name, domain.ScopeMRWrite)
	721	+	if err != nil {
687	722		return domain.Comment{}, err
688	723		}
689	724		for range maxWriteRetries {

@@ -698,6 +733,11 @@ func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal,
698	733		if !mr.IsOpen() {
699	734		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
700	735		}
	736	+	if c.IsReply() {
	737	+	var v domain.Violations
	738	+	v.Add("comment_id", fmt.Sprintf("resolve the thread on its root ^%d", c.ReplyTo))
	739	+	return domain.Comment{}, v.Err()
	740	+	}
701	741		if c.Resolved == resolved {
702	742		return c, nil
703	743		}

@@ -710,6 +750,7 @@ func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal,
710	750		if err != nil {
711	751		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, err)
712	752		}
	753	+	m.bus.Publish(ctx, domain.CommentResolved{Repo: name, Number: number, Comment: c, At: mr.UpdatedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
713	754		return c, nil
714	755		}
715	756		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, domain.ErrConflict)

@@ -1090,7 +1131,7 @@ func (m *MergeRequests) moveTarget(ctx context.Context, mr domain.MergeRequest,
1090	1131		// does, under the merge lock (domain.CIRefTip). The run shows the owner, as a
1091	1132		// merge's push does on GitHub.
1092	1133		if err := recordRefTips(ctx, m.tips, mr.Repo, []domain.RefUpdate{{Old: tip.String(), New: newTip.String(), Ref: "refs/heads/" + mr.Target}},
1093		-	authorOf(domain.Owner()), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
	1134	+	domain.AuthorName(domain.Owner()), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
1094	1135		return domain.ObjectID{}, err
1095	1136		}
1096	1137		err := m.git.UpdateBranch(ctx, mr.Repo, mr.Target, tip, newTip)

@@ -1129,3 +1170,90 @@ func (m *MergeRequests) markMerged(ctx context.Context, name domain.RepoName, nu
1129	1170		Msg("the target branch moved but the merge request could not be marked merged")
1130	1171		return domain.MergeRequest{}, fmt.Errorf("record the merge of !%d in %q: %w", number, name, domain.ErrConflict)
1131	1172		}
	1173	+
	1174	+	// EditComment changes only the author's text, preserving the immutable verdict.
	1175	+	func (m *MergeRequests) EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string) (domain.Comment, error) {
	1176	+	return m.changeComment(ctx, p, name, number, commentID, text, false)
	1177	+	}
	1178	+
	1179	+	// DeleteComment removes text but retains the anchor, ID and verdict. Repeated deletion is a no-op.
	1180	+	func (m *MergeRequests) DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64) (domain.Comment, error) {
	1181	+	return m.changeComment(ctx, p, name, number, commentID, "", true)
	1182	+	}
	1183	+
	1184	+	func (m *MergeRequests) changeComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string, remove bool) (domain.Comment, error) {
	1185	+	repo, err := m.writable(ctx, p, name, domain.ScopeMRWrite)
	1186	+	if err != nil {
	1187	+	return domain.Comment{}, err
	1188	+	}
	1189	+	for range maxWriteRetries {
	1190	+	mr, err := m.store.Get(ctx, name, number)
	1191	+	if err != nil {
	1192	+	return domain.Comment{}, err
	1193	+	}
	1194	+	c, err := m.store.GetComment(ctx, name, number, commentID)
	1195	+	if err != nil {
	1196	+	return domain.Comment{}, err
	1197	+	}
	1198	+	if !mr.IsOpen() {
	1199	+	return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
	1200	+	}
	1201	+	if domain.AuthorName(p) != c.Author {
	1202	+	return domain.Comment{}, fmt.Errorf("%w: only the author of a note can edit or delete it", domain.ErrForbidden)
	1203	+	}
	1204	+	if c.Deleted {
	1205	+	if remove {
	1206	+	return c, nil
	1207	+	}
	1208	+	return domain.Comment{}, fmt.Errorf("%w: the note was deleted", domain.ErrPreconditionFailed)
	1209	+	}
	1210	+	parsed, err := domain.ParsePlainText(text)
	1211	+	var v domain.Violations
	1212	+	if err != nil {
	1213	+	v.AddErr("text", err)
	1214	+	} else if !remove && parsed.IsBlank() && c.Verdict == domain.VerdictNone {
	1215	+	v.Add("text", "is required")
	1216	+	}
	1217	+	if err := v.Err(); err != nil {
	1218	+	return domain.Comment{}, err
	1219	+	}
	1220	+	if !remove && parsed == c.Text {
	1221	+	return c, nil
	1222	+	}
	1223	+	c.Text, c.Deleted, c.EditedAt = parsed, remove, m.clock.Now().UTC()
	1224	+	mr.UpdatedAt = c.EditedAt
	1225	+	if err := m.store.SaveComment(ctx, mr, c); errors.Is(err, domain.ErrConflict) {
	1226	+	continue
	1227	+	} else if err != nil {
	1228	+	return domain.Comment{}, fmt.Errorf("save note %d of !%d in %q: %w", commentID, number, name, err)
	1229	+	}
	1230	+	log := zerowrap.FromCtx(ctx)
	1231	+	log.Info().Str("repo", name.String()).Int64("number", number).Int64("comment", c.ID).Bool("deleted", remove).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment changed")
	1232	+	if remove {
	1233	+	m.bus.Publish(ctx, domain.CommentDeleted{Repo: name, Number: number, Comment: c, At: c.EditedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
	1234	+	} else {
	1235	+	m.bus.Publish(ctx, domain.CommentEdited{Repo: name, Number: number, Comment: c, At: c.EditedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
	1236	+	}
	1237	+	return c, nil
	1238	+	}
	1239	+	return domain.Comment{}, fmt.Errorf("save note %d of !%d in %q: %w", commentID, number, name, domain.ErrConflict)
	1240	+	}
	1241	+
	1242	+	// replyRoot returns the note a reply targets, or a violation when it is
	1243	+	// missing, itself a reply, or deleted.
	1244	+	func (m *MergeRequests) replyRoot(ctx context.Context, name domain.RepoName, number, id int64) (domain.Comment, error) {
	1245	+	root, err := m.store.GetComment(ctx, name, number, id)
	1246	+	var v domain.Violations
	1247	+	switch {
	1248	+	case errors.Is(err, domain.ErrNotFound):
	1249	+	v.Add("reply_to", fmt.Sprintf("no note ^%d", id))
	1250	+	case err != nil:
	1251	+	return domain.Comment{}, err
	1252	+	case root.IsReply() \|\| root.Deleted:
	1253	+	v.Add("reply_to", "must name a non-deleted root note")
	1254	+	}
	1255	+	if err := v.Err(); err != nil {
	1256	+	return domain.Comment{}, err
	1257	+	}
	1258	+	return root, nil
	1259	+	}


@@ -241,7 +241,7 @@ func (m *MergeRequests) Create(ctx context.Context, p domain.Principal, name dom
241		now := m.clock.Now().UTC()	241		now := m.clock.Now().UTC()
242		mr, err := m.store.Create(ctx, domain.MergeRequest{	242		mr, err := m.store.Create(ctx, domain.MergeRequest{
243		Repo: name, Title: title, Description: desc, Source: source, Target: target,	243		Repo: name, Title: title, Description: desc, Source: source, Target: target,
244	-	State: domain.MRStateOpen, Author: authorOf(p), CreatedAt: now, UpdatedAt: now,	244	+	State: domain.MRStateOpen, Author: domain.AuthorName(p), CreatedAt: now, UpdatedAt: now,
245		})	245		})
246		if err != nil {	246		if err != nil {
247		return domain.MergeRequest{}, fmt.Errorf("create merge request of %q: %w", name, err)	247		return domain.MergeRequest{}, fmt.Errorf("create merge request of %q: %w", name, err)

@@ -468,6 +468,7 @@ func (m *MergeRequests) Get(ctx context.Context, p domain.Principal, name domain
468		if d.Comments, err = m.store.ListComments(ctx, name, number); err != nil {	468		if d.Comments, err = m.store.ListComments(ctx, name, number); err != nil {
469		return ports.MergeRequestDetail{}, fmt.Errorf("list comments of !%d in %q: %w", number, name, err)	469		return ports.MergeRequestDetail{}, fmt.Errorf("list comments of !%d in %q: %w", number, name, err)
470		}	470		}
			471	+	d.Verdicts = domain.CurrentVerdicts(d.Comments, mr.HeadID)
471		if d.LastReadID, err = m.store.GetRead(ctx, name, number); err != nil {	472		if d.LastReadID, err = m.store.GetRead(ctx, name, number); err != nil {
472		return ports.MergeRequestDetail{}, err	473		return ports.MergeRequestDetail{}, err
473		}	474		}

@@ -547,7 +548,7 @@ func (m *MergeRequests) rangeOf(ctx context.Context, mr domain.MergeRequest) (ex
547		}	548		}
548			549
549		// AddComment adds a comment and publishes CommentAdded. The principal needs	550		// AddComment adds a comment and publishes CommentAdded. The principal needs
550	-	// mr:write. The text must follow the rules of ADR 0017 and not be blank; a	551	+	// mr:write. The text must follow the rules of ADR 0032 and not be blank unless carrying a verdict; a
551		// comment on a line must name a line of the current diff of the request (see	552		// comment on a line must name a line of the current diff of the request (see
552		// domain.Diff.HasLine), else the call fails with domain.ErrInvalid. A request	553		// domain.Diff.HasLine), else the call fails with domain.ErrInvalid. A request
553		// that is not open gives domain.ErrPreconditionFailed, and one that already	554		// that is not open gives domain.ErrPreconditionFailed, and one that already

@@ -566,21 +567,44 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
566		switch {	567		switch {
567		case err != nil:	568		case err != nil:
568		v.AddErr("text", err)	569		v.AddErr("text", err)
569	-	case text.IsBlank():	570	+	case text.IsBlank() && params.Verdict == domain.VerdictNone:
570		v.Add("text", "is required")	571		v.Add("text", "is required")
571		}	572		}
572		general := params.Path == ""	573		general := params.Path == ""
573		switch {	574		switch {
574	-	case general && (params.Line != 0 \|\| params.Side != domain.SideNone):	575	+	case general && (params.Line != 0 \|\| params.Side != domain.SideNone \|\| params.StartLine != 0):
575		v.Add("path", "is required with line and side")	576		v.Add("path", "is required with line and side")
576		case !general && params.Line < 1:	577		case !general && params.Line < 1:
577		v.Add("line", "must be 1 or more with a path")	578		v.Add("line", "must be 1 or more with a path")
578		case !general && params.Side != domain.SideOld && params.Side != domain.SideNew:	579		case !general && params.Side != domain.SideOld && params.Side != domain.SideNew:
579		v.Add("side", "is required with a path")	580		v.Add("side", "is required with a path")
580		}	581		}
			582	+	if params.StartLine != 0 && (params.StartLine < 1 \|\| params.StartLine >= params.Line) {
			583	+	v.Add("start_line", "must be 1 or more and less than line")
			584	+	}
			585	+	if params.Verdict > domain.VerdictChangesRequested {
			586	+	v.Add("verdict", "is unknown")
			587	+	}
			588	+	if params.ReplyTo != 0 {
			589	+	if params.Path != "" \|\| params.Line != 0 \|\| params.StartLine != 0 \|\| params.Side != domain.SideNone \|\| params.Verdict != domain.VerdictNone {
			590	+	v.Add("reply_to", "a reply cannot specify an anchor or verdict")
			591	+	}
			592	+	}
581		if err := v.Err(); err != nil {	593		if err := v.Err(); err != nil {
582		return domain.Comment{}, err	594		return domain.Comment{}, err
583		}	595		}
			596	+	if params.ReplyTo != 0 {
			597	+	root, err := m.replyRoot(ctx, name, number, params.ReplyTo)
			598	+	if err != nil {
			599	+	return domain.Comment{}, err
			600	+	}
			601	+	params.Path, params.Line, params.StartLine, params.Side = root.Path, root.Line, root.StartLine, root.Side
			602	+	}
			603	+	if params.Verdict != domain.VerdictNone {
			604	+	if err := scopeAccess(p, repo, domain.ScopeMRReview); err != nil {
			605	+	return domain.Comment{}, err
			606	+	}
			607	+	}
584		if !mr.IsOpen() {	608		if !mr.IsOpen() {
585		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)	609		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
586		}	610		}

@@ -588,7 +612,7 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
588		if mr, err = m.withHead(ctx, mr); err != nil {	612		if mr, err = m.withHead(ctx, mr); err != nil {
589		return domain.Comment{}, err	613		return domain.Comment{}, err
590		}	614		}
591	-	if !general {	615	+	if !general && params.ReplyTo == 0 {
592		if err := m.checkLine(ctx, mr, params); err != nil {	616		if err := m.checkLine(ctx, mr, params); err != nil {
593		return domain.Comment{}, err	617		return domain.Comment{}, err
594		}	618		}

@@ -600,7 +624,8 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
600		return domain.Comment{}, fmt.Errorf("%w: !%d already has %d comments", domain.ErrResourceExhausted, number, MaxCommentsPerMergeRequest)	624		return domain.Comment{}, fmt.Errorf("%w: !%d already has %d comments", domain.ErrResourceExhausted, number, MaxCommentsPerMergeRequest)
601		}	625		}
602		c = domain.Comment{	626		c = domain.Comment{
603	-	ID: mr.CommentSeq + 1, Author: authorOf(p), Path: params.Path, Line: params.Line, Side: params.Side,	627	+	ID: mr.CommentSeq + 1, Author: domain.AuthorName(p), Path: params.Path, Line: params.Line, Side: params.Side,
			628	+	ReplyTo: params.ReplyTo, StartLine: params.StartLine, Verdict: params.Verdict, Resolved: params.Verdict == domain.VerdictApprove,
604		CommitID: mr.HeadID, Text: text, CreatedAt: m.clock.Now().UTC(),	629		CommitID: mr.HeadID, Text: text, CreatedAt: m.clock.Now().UTC(),
605		}	630		}
606		mr.CommentSeq, mr.UpdatedAt = c.ID, c.CreatedAt	631		mr.CommentSeq, mr.UpdatedAt = c.ID, c.CreatedAt

@@ -616,6 +641,12 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
616		if !fresh.IsOpen() {	641		if !fresh.IsOpen() {
617		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, fresh.State)	642		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, fresh.State)
618		}	643		}
			644	+	if params.ReplyTo != 0 {
			645	+	// The root may have been deleted by the write that got in between.
			646	+	if _, rerr := m.replyRoot(ctx, name, number, params.ReplyTo); rerr != nil {
			647	+	return domain.Comment{}, rerr
			648	+	}
			649	+	}
619		fresh.HeadID = mr.HeadID	650		fresh.HeadID = mr.HeadID
620		mr = fresh	651		mr = fresh
621		}	652		}

@@ -624,7 +655,7 @@ func (m *MergeRequests) AddComment(ctx context.Context, p domain.Principal, name
624		}	655		}
625		log := zerowrap.FromCtx(ctx)	656		log := zerowrap.FromCtx(ctx)
626		log.Info().Str("repo", name.String()).Int64("number", number).Int64("comment", c.ID).	657		log.Info().Str("repo", name.String()).Int64("number", number).Int64("comment", c.ID).
627	-	Bool("on_line", !general).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment added")	658	+	Int64("reply_to", c.ReplyTo).Str("verdict", c.Verdict.String()).Bool("on_line", !general).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment added")
628		m.bus.Publish(ctx, domain.CommentAdded{	659		m.bus.Publish(ctx, domain.CommentAdded{
629		Repo: name, Number: number, Comment: c, At: c.CreatedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt,	660		Repo: name, Number: number, Comment: c, At: c.CreatedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt,
630		})	661		})

@@ -667,6 +698,9 @@ func (m *MergeRequests) checkLine(ctx context.Context, mr domain.MergeRequest, p
667		if idx < 0 \|\| !diff.HasLine(params.Path, params.Side, params.Line) {	698		if idx < 0 \|\| !diff.HasLine(params.Path, params.Side, params.Line) {
668		v.Add("path", fmt.Sprintf("%s:%d on the %s side is not a line of the diff", params.Path, params.Line, params.Side))	699		v.Add("path", fmt.Sprintf("%s:%d on the %s side is not a line of the diff", params.Path, params.Line, params.Side))
669		}	700		}
			701	+	if params.StartLine != 0 && !diff.HasLine(params.Path, params.Side, params.StartLine) {
			702	+	v.Add("start_line", "is not a line of the diff")
			703	+	}
670		return v.Err()	704		return v.Err()
671		}	705		}
672			706

@@ -683,7 +717,8 @@ func diffFileName(f domain.FileDiff) string {
683		// not open domain.ErrPreconditionFailed. Setting the state the comment already	717		// not open domain.ErrPreconditionFailed. Setting the state the comment already
684		// has succeeds and writes nothing.	718		// has succeeds and writes nothing.
685		func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error) {	719		func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, resolved bool) (domain.Comment, error) {
686	-	if _, err := m.writable(ctx, p, name, domain.ScopeMRWrite); err != nil {	720	+	repo, err := m.writable(ctx, p, name, domain.ScopeMRWrite)
			721	+	if err != nil {
687		return domain.Comment{}, err	722		return domain.Comment{}, err
688		}	723		}
689		for range maxWriteRetries {	724		for range maxWriteRetries {

@@ -698,6 +733,11 @@ func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal,
698		if !mr.IsOpen() {	733		if !mr.IsOpen() {
699		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)	734		return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
700		}	735		}
			736	+	if c.IsReply() {
			737	+	var v domain.Violations
			738	+	v.Add("comment_id", fmt.Sprintf("resolve the thread on its root ^%d", c.ReplyTo))
			739	+	return domain.Comment{}, v.Err()
			740	+	}
701		if c.Resolved == resolved {	741		if c.Resolved == resolved {
702		return c, nil	742		return c, nil
703		}	743		}

@@ -710,6 +750,7 @@ func (m *MergeRequests) ResolveComment(ctx context.Context, p domain.Principal,
710		if err != nil {	750		if err != nil {
711		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, err)	751		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, err)
712		}	752		}
			753	+	m.bus.Publish(ctx, domain.CommentResolved{Repo: name, Number: number, Comment: c, At: mr.UpdatedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
713		return c, nil	754		return c, nil
714		}	755		}
715		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, domain.ErrConflict)	756		return domain.Comment{}, fmt.Errorf("resolve comment %d of !%d in %q: %w", commentID, number, name, domain.ErrConflict)

@@ -1090,7 +1131,7 @@ func (m *MergeRequests) moveTarget(ctx context.Context, mr domain.MergeRequest,
1090		// does, under the merge lock (domain.CIRefTip). The run shows the owner, as a	1131		// does, under the merge lock (domain.CIRefTip). The run shows the owner, as a
1091		// merge's push does on GitHub.	1132		// merge's push does on GitHub.
1092		if err := recordRefTips(ctx, m.tips, mr.Repo, []domain.RefUpdate{{Old: tip.String(), New: newTip.String(), Ref: "refs/heads/" + mr.Target}},	1133		if err := recordRefTips(ctx, m.tips, mr.Repo, []domain.RefUpdate{{Old: tip.String(), New: newTip.String(), Ref: "refs/heads/" + mr.Target}},
1093	-	authorOf(domain.Owner()), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {	1134	+	domain.AuthorName(domain.Owner()), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
1094		return domain.ObjectID{}, err	1135		return domain.ObjectID{}, err
1095		}	1136		}
1096		err := m.git.UpdateBranch(ctx, mr.Repo, mr.Target, tip, newTip)	1137		err := m.git.UpdateBranch(ctx, mr.Repo, mr.Target, tip, newTip)

@@ -1129,3 +1170,90 @@ func (m *MergeRequests) markMerged(ctx context.Context, name domain.RepoName, nu
1129		Msg("the target branch moved but the merge request could not be marked merged")	1170		Msg("the target branch moved but the merge request could not be marked merged")
1130		return domain.MergeRequest{}, fmt.Errorf("record the merge of !%d in %q: %w", number, name, domain.ErrConflict)	1171		return domain.MergeRequest{}, fmt.Errorf("record the merge of !%d in %q: %w", number, name, domain.ErrConflict)
1131		}	1172		}
			1173	+
			1174	+	// EditComment changes only the author's text, preserving the immutable verdict.
			1175	+	func (m *MergeRequests) EditComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string) (domain.Comment, error) {
			1176	+	return m.changeComment(ctx, p, name, number, commentID, text, false)
			1177	+	}
			1178	+
			1179	+	// DeleteComment removes text but retains the anchor, ID and verdict. Repeated deletion is a no-op.
			1180	+	func (m *MergeRequests) DeleteComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64) (domain.Comment, error) {
			1181	+	return m.changeComment(ctx, p, name, number, commentID, "", true)
			1182	+	}
			1183	+
			1184	+	func (m *MergeRequests) changeComment(ctx context.Context, p domain.Principal, name domain.RepoName, number, commentID int64, text string, remove bool) (domain.Comment, error) {
			1185	+	repo, err := m.writable(ctx, p, name, domain.ScopeMRWrite)
			1186	+	if err != nil {
			1187	+	return domain.Comment{}, err
			1188	+	}
			1189	+	for range maxWriteRetries {
			1190	+	mr, err := m.store.Get(ctx, name, number)
			1191	+	if err != nil {
			1192	+	return domain.Comment{}, err
			1193	+	}
			1194	+	c, err := m.store.GetComment(ctx, name, number, commentID)
			1195	+	if err != nil {
			1196	+	return domain.Comment{}, err
			1197	+	}
			1198	+	if !mr.IsOpen() {
			1199	+	return domain.Comment{}, fmt.Errorf("%w: !%d is %s", domain.ErrPreconditionFailed, number, mr.State)
			1200	+	}
			1201	+	if domain.AuthorName(p) != c.Author {
			1202	+	return domain.Comment{}, fmt.Errorf("%w: only the author of a note can edit or delete it", domain.ErrForbidden)
			1203	+	}
			1204	+	if c.Deleted {
			1205	+	if remove {
			1206	+	return c, nil
			1207	+	}
			1208	+	return domain.Comment{}, fmt.Errorf("%w: the note was deleted", domain.ErrPreconditionFailed)
			1209	+	}
			1210	+	parsed, err := domain.ParsePlainText(text)
			1211	+	var v domain.Violations
			1212	+	if err != nil {
			1213	+	v.AddErr("text", err)
			1214	+	} else if !remove && parsed.IsBlank() && c.Verdict == domain.VerdictNone {
			1215	+	v.Add("text", "is required")
			1216	+	}
			1217	+	if err := v.Err(); err != nil {
			1218	+	return domain.Comment{}, err
			1219	+	}
			1220	+	if !remove && parsed == c.Text {
			1221	+	return c, nil
			1222	+	}
			1223	+	c.Text, c.Deleted, c.EditedAt = parsed, remove, m.clock.Now().UTC()
			1224	+	mr.UpdatedAt = c.EditedAt
			1225	+	if err := m.store.SaveComment(ctx, mr, c); errors.Is(err, domain.ErrConflict) {
			1226	+	continue
			1227	+	} else if err != nil {
			1228	+	return domain.Comment{}, fmt.Errorf("save note %d of !%d in %q: %w", commentID, number, name, err)
			1229	+	}
			1230	+	log := zerowrap.FromCtx(ctx)
			1231	+	log.Info().Str("repo", name.String()).Int64("number", number).Int64("comment", c.ID).Bool("deleted", remove).Str("principal", p.Label()).Str("token_id", p.TokenID()).Msg("comment changed")
			1232	+	if remove {
			1233	+	m.bus.Publish(ctx, domain.CommentDeleted{Repo: name, Number: number, Comment: c, At: c.EditedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
			1234	+	} else {
			1235	+	m.bus.Publish(ctx, domain.CommentEdited{Repo: name, Number: number, Comment: c, At: c.EditedAt, Visibility: repo.Visibility, CreatedAt: repo.CreatedAt})
			1236	+	}
			1237	+	return c, nil
			1238	+	}
			1239	+	return domain.Comment{}, fmt.Errorf("save note %d of !%d in %q: %w", commentID, number, name, domain.ErrConflict)
			1240	+	}
			1241	+
			1242	+	// replyRoot returns the note a reply targets, or a violation when it is
			1243	+	// missing, itself a reply, or deleted.
			1244	+	func (m *MergeRequests) replyRoot(ctx context.Context, name domain.RepoName, number, id int64) (domain.Comment, error) {
			1245	+	root, err := m.store.GetComment(ctx, name, number, id)
			1246	+	var v domain.Violations
			1247	+	switch {
			1248	+	case errors.Is(err, domain.ErrNotFound):
			1249	+	v.Add("reply_to", fmt.Sprintf("no note ^%d", id))
			1250	+	case err != nil:
			1251	+	return domain.Comment{}, err
			1252	+	case root.IsReply() \|\| root.Deleted:
			1253	+	v.Add("reply_to", "must name a non-deleted root note")
			1254	+	}
			1255	+	if err := v.Err(); err != nil {
			1256	+	return domain.Comment{}, err
			1257	+	}
			1258	+	return root, nil
			1259	+	}

M internal/usecase/mergerequests_integration_test.go +107 -1


@@ -689,7 +689,10 @@ func TestResolveComment(t *testing.T) {
689	689		_, err = r.mrs.ResolveComment(r.ctx, mrW, r.repo, mr.Number, 0, true)
690	690		assert.ErrorIs(t, err, domain.ErrNotFound)
691	691
692		-	assert.Empty(t, r.drain(), "a resolved comment has no event")
	692	+	events := r.drain()
	693	+	require.Len(t, events, 2, "only state changes publish resolution events")
	694	+	assert.True(t, events[0].(domain.CommentResolved).Comment.Resolved)
	695	+	assert.False(t, events[1].(domain.CommentResolved).Comment.Resolved)
693	696		}
694	697
695	698		func TestEventsOfAMergeRequest(t *testing.T) {

@@ -1342,3 +1345,106 @@ func TestCommentsPerMergeRequestAreBounded(t *testing.T) {
1342	1345		_, err = r.mrs.AddComment(r.ctx, mrW, r.repo, other.Number, ports.AddCommentParams{Text: "fine"})
1343	1346		require.NoError(t, err)
1344	1347		}
	1348	+
	1349	+	func TestNoteThreadsRangesAndVerdicts(t *testing.T) {
	1350	+	t.Run("start outside diff", func(t *testing.T) {
	1351	+	r := newMRRig(t)
	1352	+	r.seed()
	1353	+	before := strings.Repeat("unchanged\n", 30)
	1354	+	r.commit(author, "long.txt", before, "long base")
	1355	+	r.push("main")
	1356	+	r.sh("checkout", "-q", "-B", "range", "main")
	1357	+	r.commit(author, "long.txt", before+"changed\n", "late hunk")
	1358	+	r.push("range")
	1359	+	mr := r.open("range")
	1360	+	_, err := r.mrs.AddComment(r.ctx, root, r.repo, mr.Number, ports.AddCommentParams{Path: "long.txt", Line: 31, Side: domain.SideNew, Text: "valid"})
	1361	+	require.NoError(t, err)
	1362	+	_, err = r.mrs.AddComment(r.ctx, root, r.repo, mr.Number, ports.AddCommentParams{Path: "long.txt", StartLine: 1, Line: 31, Side: domain.SideNew, Text: "invalid range"})
	1363	+	require.ErrorIs(t, err, domain.ErrInvalid)
	1364	+	assert.Contains(t, fieldsOf(t, err), "start_line")
	1365	+	})
	1366	+	r := newMRRig(t)
	1367	+	r.seed()
	1368	+	head := r.feature("feat")
	1369	+	mr := r.open("feat")
	1370	+	add := func(p domain.Principal, params ports.AddCommentParams) (domain.Comment, error) {
	1371	+	return r.mrs.AddComment(r.ctx, p, r.repo, mr.Number, params)
	1372	+	}
	1373	+	rootNote, err := add(root, ports.AddCommentParams{Path: "a.txt", StartLine: 1, Line: 3, Side: domain.SideNew, Text: "range"})
	1374	+	require.NoError(t, err)
	1375	+	reply, err := add(mrW, ports.AddCommentParams{ReplyTo: rootNote.ID, Text: "reply"})
	1376	+	require.NoError(t, err)
	1377	+	assert.Equal(t, rootNote.Path, reply.Path)
	1378	+	assert.Equal(t, rootNote.StartLine, reply.StartLine)
	1379	+	assert.Equal(t, rootNote.Line, reply.Line)
	1380	+	assert.Equal(t, rootNote.Side, reply.Side)
	1381	+	assert.Equal(t, head, reply.CommitID)
	1382	+	assert.False(t, reply.Resolved)
	1383	+	for _, params := range []ports.AddCommentParams{
	1384	+	{ReplyTo: reply.ID, Text: "x"}, {ReplyTo: 999, Text: "x"}, {ReplyTo: rootNote.ID, Path: "a.txt", Text: "x"}, {ReplyTo: rootNote.ID, Line: 1, Text: "x"}, {ReplyTo: rootNote.ID, Side: domain.SideNew, Text: "x"}, {ReplyTo: rootNote.ID, StartLine: 1, Text: "x"}, {ReplyTo: rootNote.ID, Verdict: domain.VerdictApprove},
	1385	+	{StartLine: 1, Text: "x"}, {Path: "a.txt", StartLine: 3, Line: 3, Side: domain.SideNew, Text: "x"}, {Path: "a.txt", StartLine: -1, Line: 3, Side: domain.SideNew, Text: "x"}, {Path: "a.txt", StartLine: 1, Line: 99, Side: domain.SideNew, Text: "x"},
	1386	+	} {
	1387	+	_, err := add(root, params)
	1388	+	assert.ErrorIs(t, err, domain.ErrInvalid, "%+v", params)
	1389	+	}
	1390	+	_, err = r.mrs.ResolveComment(r.ctx, root, r.repo, mr.Number, reply.ID, true)
	1391	+	assert.ErrorIs(t, err, domain.ErrInvalid)
	1392	+	assert.ErrorContains(t, err, fmt.Sprintf("root ^%d", rootNote.ID))
	1393	+	_, err = add(mrW, ports.AddCommentParams{Verdict: domain.VerdictApprove})
	1394	+	assert.ErrorIs(t, err, domain.ErrForbidden)
	1395	+	assert.ErrorContains(t, err, "this needs the mr:review scope")
	1396	+	reviewer := domain.TokenPrincipal(domain.Token{Label: "reviewer", Scopes: []domain.Scope{domain.ScopeMRWrite, domain.ScopeMRReview}})
	1397	+	approve, err := add(reviewer, ports.AddCommentParams{Verdict: domain.VerdictApprove})
	1398	+	require.NoError(t, err)
	1399	+	assert.True(t, approve.Resolved)
	1400	+	changes, err := add(root, ports.AddCommentParams{Verdict: domain.VerdictChangesRequested})
	1401	+	require.NoError(t, err)
	1402	+	assert.False(t, changes.Resolved)
	1403	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, approve.ID, "no")
	1404	+	assert.ErrorIs(t, err, domain.ErrForbidden)
	1405	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, approve.ID)
	1406	+	assert.ErrorIs(t, err, domain.ErrForbidden)
	1407	+	r.drain()
	1408	+	edited, err := r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "updated")
	1409	+	require.NoError(t, err)
	1410	+	assert.False(t, edited.EditedAt.IsZero())
	1411	+	assert.Equal(t, approve.Verdict, edited.Verdict)
	1412	+	_, err = r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "updated")
	1413	+	require.NoError(t, err)
	1414	+	events := r.drain()
	1415	+	require.Len(t, events, 1)
	1416	+	assert.IsType(t, domain.CommentEdited{}, events[0])
	1417	+	deleted, err := r.mrs.DeleteComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID)
	1418	+	require.NoError(t, err)
	1419	+	assert.True(t, deleted.Deleted)
	1420	+	assert.Equal(t, "", deleted.Text.String())
	1421	+	assert.Equal(t, approve.Verdict, deleted.Verdict)
	1422	+	again, err := r.mrs.DeleteComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID)
	1423	+	require.NoError(t, err)
	1424	+	deleted.Version = again.Version // SaveComment assigns the new version on the next read.
	1425	+	assert.Equal(t, deleted, again)
	1426	+	events = r.drain()
	1427	+	require.Len(t, events, 1)
	1428	+	assert.IsType(t, domain.CommentDeleted{}, events[0])
	1429	+	_, err = r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "x")
	1430	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
	1431	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, rootNote.ID, "")
	1432	+	assert.ErrorIs(t, err, domain.ErrInvalid)
	1433	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, rootNote.ID)
	1434	+	require.NoError(t, err)
	1435	+	_, err = add(root, ports.AddCommentParams{ReplyTo: rootNote.ID, Text: "x"})
	1436	+	assert.ErrorIs(t, err, domain.ErrInvalid)
	1437	+	r.commit(author, "a.txt", "changed\n2\nthree\n", "advance")
	1438	+	r.push("feat")
	1439	+	detail, err := r.mrs.Get(r.ctx, root, r.repo, mr.Number, ports.GetMergeRequestOptions{})
	1440	+	require.NoError(t, err)
	1441	+	require.Len(t, detail.Verdicts, 2)
	1442	+	assert.True(t, detail.Verdicts[0].Stale)
	1443	+	assert.False(t, detail.Verdicts[1].Stale)
	1444	+	_, err = r.mrs.Close(r.ctx, root, r.repo, mr.Number)
	1445	+	require.NoError(t, err)
	1446	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, changes.ID, "x")
	1447	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
	1448	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, changes.ID)
	1449	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
	1450	+	}


@@ -689,7 +689,10 @@ func TestResolveComment(t *testing.T) {
689		_, err = r.mrs.ResolveComment(r.ctx, mrW, r.repo, mr.Number, 0, true)	689		_, err = r.mrs.ResolveComment(r.ctx, mrW, r.repo, mr.Number, 0, true)
690		assert.ErrorIs(t, err, domain.ErrNotFound)	690		assert.ErrorIs(t, err, domain.ErrNotFound)
691			691
692	-	assert.Empty(t, r.drain(), "a resolved comment has no event")	692	+	events := r.drain()
			693	+	require.Len(t, events, 2, "only state changes publish resolution events")
			694	+	assert.True(t, events[0].(domain.CommentResolved).Comment.Resolved)
			695	+	assert.False(t, events[1].(domain.CommentResolved).Comment.Resolved)
693		}	696		}
694			697
695		func TestEventsOfAMergeRequest(t *testing.T) {	698		func TestEventsOfAMergeRequest(t *testing.T) {

@@ -1342,3 +1345,106 @@ func TestCommentsPerMergeRequestAreBounded(t *testing.T) {
1342		_, err = r.mrs.AddComment(r.ctx, mrW, r.repo, other.Number, ports.AddCommentParams{Text: "fine"})	1345		_, err = r.mrs.AddComment(r.ctx, mrW, r.repo, other.Number, ports.AddCommentParams{Text: "fine"})
1343		require.NoError(t, err)	1346		require.NoError(t, err)
1344		}	1347		}
			1348	+
			1349	+	func TestNoteThreadsRangesAndVerdicts(t *testing.T) {
			1350	+	t.Run("start outside diff", func(t *testing.T) {
			1351	+	r := newMRRig(t)
			1352	+	r.seed()
			1353	+	before := strings.Repeat("unchanged\n", 30)
			1354	+	r.commit(author, "long.txt", before, "long base")
			1355	+	r.push("main")
			1356	+	r.sh("checkout", "-q", "-B", "range", "main")
			1357	+	r.commit(author, "long.txt", before+"changed\n", "late hunk")
			1358	+	r.push("range")
			1359	+	mr := r.open("range")
			1360	+	_, err := r.mrs.AddComment(r.ctx, root, r.repo, mr.Number, ports.AddCommentParams{Path: "long.txt", Line: 31, Side: domain.SideNew, Text: "valid"})
			1361	+	require.NoError(t, err)
			1362	+	_, err = r.mrs.AddComment(r.ctx, root, r.repo, mr.Number, ports.AddCommentParams{Path: "long.txt", StartLine: 1, Line: 31, Side: domain.SideNew, Text: "invalid range"})
			1363	+	require.ErrorIs(t, err, domain.ErrInvalid)
			1364	+	assert.Contains(t, fieldsOf(t, err), "start_line")
			1365	+	})
			1366	+	r := newMRRig(t)
			1367	+	r.seed()
			1368	+	head := r.feature("feat")
			1369	+	mr := r.open("feat")
			1370	+	add := func(p domain.Principal, params ports.AddCommentParams) (domain.Comment, error) {
			1371	+	return r.mrs.AddComment(r.ctx, p, r.repo, mr.Number, params)
			1372	+	}
			1373	+	rootNote, err := add(root, ports.AddCommentParams{Path: "a.txt", StartLine: 1, Line: 3, Side: domain.SideNew, Text: "range"})
			1374	+	require.NoError(t, err)
			1375	+	reply, err := add(mrW, ports.AddCommentParams{ReplyTo: rootNote.ID, Text: "reply"})
			1376	+	require.NoError(t, err)
			1377	+	assert.Equal(t, rootNote.Path, reply.Path)
			1378	+	assert.Equal(t, rootNote.StartLine, reply.StartLine)
			1379	+	assert.Equal(t, rootNote.Line, reply.Line)
			1380	+	assert.Equal(t, rootNote.Side, reply.Side)
			1381	+	assert.Equal(t, head, reply.CommitID)
			1382	+	assert.False(t, reply.Resolved)
			1383	+	for _, params := range []ports.AddCommentParams{
			1384	+	{ReplyTo: reply.ID, Text: "x"}, {ReplyTo: 999, Text: "x"}, {ReplyTo: rootNote.ID, Path: "a.txt", Text: "x"}, {ReplyTo: rootNote.ID, Line: 1, Text: "x"}, {ReplyTo: rootNote.ID, Side: domain.SideNew, Text: "x"}, {ReplyTo: rootNote.ID, StartLine: 1, Text: "x"}, {ReplyTo: rootNote.ID, Verdict: domain.VerdictApprove},
			1385	+	{StartLine: 1, Text: "x"}, {Path: "a.txt", StartLine: 3, Line: 3, Side: domain.SideNew, Text: "x"}, {Path: "a.txt", StartLine: -1, Line: 3, Side: domain.SideNew, Text: "x"}, {Path: "a.txt", StartLine: 1, Line: 99, Side: domain.SideNew, Text: "x"},
			1386	+	} {
			1387	+	_, err := add(root, params)
			1388	+	assert.ErrorIs(t, err, domain.ErrInvalid, "%+v", params)
			1389	+	}
			1390	+	_, err = r.mrs.ResolveComment(r.ctx, root, r.repo, mr.Number, reply.ID, true)
			1391	+	assert.ErrorIs(t, err, domain.ErrInvalid)
			1392	+	assert.ErrorContains(t, err, fmt.Sprintf("root ^%d", rootNote.ID))
			1393	+	_, err = add(mrW, ports.AddCommentParams{Verdict: domain.VerdictApprove})
			1394	+	assert.ErrorIs(t, err, domain.ErrForbidden)
			1395	+	assert.ErrorContains(t, err, "this needs the mr:review scope")
			1396	+	reviewer := domain.TokenPrincipal(domain.Token{Label: "reviewer", Scopes: []domain.Scope{domain.ScopeMRWrite, domain.ScopeMRReview}})
			1397	+	approve, err := add(reviewer, ports.AddCommentParams{Verdict: domain.VerdictApprove})
			1398	+	require.NoError(t, err)
			1399	+	assert.True(t, approve.Resolved)
			1400	+	changes, err := add(root, ports.AddCommentParams{Verdict: domain.VerdictChangesRequested})
			1401	+	require.NoError(t, err)
			1402	+	assert.False(t, changes.Resolved)
			1403	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, approve.ID, "no")
			1404	+	assert.ErrorIs(t, err, domain.ErrForbidden)
			1405	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, approve.ID)
			1406	+	assert.ErrorIs(t, err, domain.ErrForbidden)
			1407	+	r.drain()
			1408	+	edited, err := r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "updated")
			1409	+	require.NoError(t, err)
			1410	+	assert.False(t, edited.EditedAt.IsZero())
			1411	+	assert.Equal(t, approve.Verdict, edited.Verdict)
			1412	+	_, err = r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "updated")
			1413	+	require.NoError(t, err)
			1414	+	events := r.drain()
			1415	+	require.Len(t, events, 1)
			1416	+	assert.IsType(t, domain.CommentEdited{}, events[0])
			1417	+	deleted, err := r.mrs.DeleteComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID)
			1418	+	require.NoError(t, err)
			1419	+	assert.True(t, deleted.Deleted)
			1420	+	assert.Equal(t, "", deleted.Text.String())
			1421	+	assert.Equal(t, approve.Verdict, deleted.Verdict)
			1422	+	again, err := r.mrs.DeleteComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID)
			1423	+	require.NoError(t, err)
			1424	+	deleted.Version = again.Version // SaveComment assigns the new version on the next read.
			1425	+	assert.Equal(t, deleted, again)
			1426	+	events = r.drain()
			1427	+	require.Len(t, events, 1)
			1428	+	assert.IsType(t, domain.CommentDeleted{}, events[0])
			1429	+	_, err = r.mrs.EditComment(r.ctx, reviewer, r.repo, mr.Number, approve.ID, "x")
			1430	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
			1431	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, rootNote.ID, "")
			1432	+	assert.ErrorIs(t, err, domain.ErrInvalid)
			1433	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, rootNote.ID)
			1434	+	require.NoError(t, err)
			1435	+	_, err = add(root, ports.AddCommentParams{ReplyTo: rootNote.ID, Text: "x"})
			1436	+	assert.ErrorIs(t, err, domain.ErrInvalid)
			1437	+	r.commit(author, "a.txt", "changed\n2\nthree\n", "advance")
			1438	+	r.push("feat")
			1439	+	detail, err := r.mrs.Get(r.ctx, root, r.repo, mr.Number, ports.GetMergeRequestOptions{})
			1440	+	require.NoError(t, err)
			1441	+	require.Len(t, detail.Verdicts, 2)
			1442	+	assert.True(t, detail.Verdicts[0].Stale)
			1443	+	assert.False(t, detail.Verdicts[1].Stale)
			1444	+	_, err = r.mrs.Close(r.ctx, root, r.repo, mr.Number)
			1445	+	require.NoError(t, err)
			1446	+	_, err = r.mrs.EditComment(r.ctx, root, r.repo, mr.Number, changes.ID, "x")
			1447	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
			1448	+	_, err = r.mrs.DeleteComment(r.ctx, root, r.repo, mr.Number, changes.ID)
			1449	+	assert.ErrorIs(t, err, domain.ErrPreconditionFailed)
			1450	+	}

M internal/usecase/mergerequests_test.go +116 -0


@@ -6,6 +6,7 @@ import (
6	6		"context"
7	7		"errors"
8	8		"testing"
	9	+	"time"
9	10
10	11		"github.com/stretchr/testify/assert"
11	12		"github.com/stretchr/testify/mock"

@@ -117,3 +118,118 @@ func TestMergeReturnsTheFailureToReadTheSettings(t *testing.T) {
117	118		})
118	119		}
119	120		}
	121	+
	122	+	func TestNoteMutationRetries(t *testing.T) {
	123	+	for _, action := range []string{"edit", "delete", "resolve"} {
	124	+	t.Run(action, func(t *testing.T) {
	125	+	u := newMRUnit(t)
	126	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
	127	+	mr := domain.MergeRequest{Repo: u.repo.Name, Number: 1, State: domain.MRStateOpen}
	128	+	text, err := domain.ParsePlainText("before")
	129	+	require.NoError(t, err)
	130	+	c := domain.Comment{ID: 1, Author: "root", Text: text}
	131	+	freshMR := mr
	132	+	freshMR.Version = 2
	133	+	fresh := c
	134	+	fresh.Version = 3
	135	+	fresh.CreatedAt = now.Add(-time.Hour)
	136	+	if action != "resolve" {
	137	+	fresh.Resolved = true
	138	+	}
	139	+	want := fresh
	140	+	switch action {
	141	+	case "edit":
	142	+	want.Text, err = domain.ParsePlainText("after")
	143	+	require.NoError(t, err)
	144	+	want.EditedAt = now.UTC()
	145	+	case "delete":
	146	+	want.Text, err = domain.ParsePlainText("")
	147	+	require.NoError(t, err)
	148	+	want.Deleted = true
	149	+	want.EditedAt = now.UTC()
	150	+	case "resolve":
	151	+	want.Resolved = true
	152	+	}
	153	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(mr, nil).Once()
	154	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(freshMR, nil).Once()
	155	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(c, nil).Once()
	156	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(fresh, nil).Once()
	157	+	u.store.EXPECT().SaveComment(mock.Anything, mock.Anything, mock.Anything).Return(domain.ErrConflict).Once()
	158	+	u.store.EXPECT().SaveComment(mock.Anything, mock.MatchedBy(func(saved domain.MergeRequest) bool {
	159	+	return saved.Version == freshMR.Version
	160	+	}), mock.MatchedBy(func(saved domain.Comment) bool { return saved == want })).Return(nil).Once()
	161	+	bus := mocks.NewEventBus(t)
	162	+	bus.EXPECT().Publish(mock.Anything, mock.MatchedBy(func(e domain.Event) bool {
	163	+	switch event := e.(type) {
	164	+	case domain.CommentEdited:
	165	+	return action == "edit" && event.Comment == want
	166	+	case domain.CommentDeleted:
	167	+	return action == "delete" && event.Comment == want
	168	+	case domain.CommentResolved:
	169	+	return action == "resolve" && event.Comment == want
	170	+	}
	171	+	return false
	172	+	})).Return().Once()
	173	+	clock := mocks.NewClock(t)
	174	+	clock.EXPECT().Now().Return(now)
	175	+	svc := usecase.NewMergeRequests(usecase.MergeRequestsConfig{Meta: u.meta, Store: u.store, Bus: bus, Clock: clock})
	176	+	var got domain.Comment
	177	+	switch action {
	178	+	case "edit":
	179	+	got, err = svc.EditComment(context.Background(), domain.Root(), u.repo.Name, 1, 1, "after")
	180	+	case "delete":
	181	+	got, err = svc.DeleteComment(context.Background(), domain.Root(), u.repo.Name, 1, 1)
	182	+	case "resolve":
	183	+	got, err = svc.ResolveComment(context.Background(), domain.Root(), u.repo.Name, 1, 1, true)
	184	+	}
	185	+	require.NoError(t, err)
	186	+	assert.Equal(t, want, got)
	187	+	})
	188	+	}
	189	+	}
	190	+
	191	+	// A reply whose root is deleted while the save is retried is rejected.
	192	+	func TestAddNoteRechecksReplyRootOnConflict(t *testing.T) {
	193	+	u := newMRUnit(t)
	194	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
	195	+	u.git.EXPECT().BranchHead(mock.Anything, mock.Anything, mock.Anything).Return(domain.ObjectID{}, domain.ErrNotFound)
	196	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(domain.MergeRequest{State: domain.MRStateOpen}, nil).Twice()
	197	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(domain.Comment{ID: 1}, nil).Once()
	198	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(domain.Comment{ID: 1, Deleted: true}, nil).Once()
	199	+	u.store.EXPECT().SaveComment(mock.Anything, mock.Anything, mock.Anything).Return(domain.ErrConflict).Once()
	200	+	_, err := u.mrs.AddComment(context.Background(), domain.Root(), u.repo.Name, 1, ports.AddCommentParams{ReplyTo: 1, Text: "x"})
	201	+	require.ErrorIs(t, err, domain.ErrInvalid)
	202	+	}
	203	+
	204	+	func TestAddNoteValidation(t *testing.T) {
	205	+	for _, tc := range []struct {
	206	+	name string
	207	+	params ports.AddCommentParams
	208	+	target domain.Comment
	209	+	missing bool
	210	+	}{
	211	+	{name: "range without path", params: ports.AddCommentParams{StartLine: 1, Text: "x"}},
	212	+	{name: "equal ends", params: ports.AddCommentParams{Path: "a", StartLine: 3, Line: 3, Side: domain.SideNew, Text: "x"}},
	213	+	{name: "reversed ends", params: ports.AddCommentParams{Path: "a", StartLine: 4, Line: 3, Side: domain.SideNew, Text: "x"}},
	214	+	{name: "reply anchor", params: ports.AddCommentParams{ReplyTo: 1, Path: "a", Line: 1, Side: domain.SideNew, Text: "x"}},
	215	+	{name: "reply verdict", params: ports.AddCommentParams{ReplyTo: 1, Verdict: domain.VerdictApprove}},
	216	+	{name: "reply to reply", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, target: domain.Comment{ReplyTo: 2}},
	217	+	{name: "deleted root", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, target: domain.Comment{Deleted: true}},
	218	+	{name: "missing root", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, missing: true},
	219	+	} {
	220	+	t.Run(tc.name, func(t *testing.T) {
	221	+	u := newMRUnit(t)
	222	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
	223	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(domain.MergeRequest{State: domain.MRStateOpen}, nil)
	224	+	if tc.name == "reply to reply" \|\| tc.name == "deleted root" \|\| tc.missing {
	225	+	var err error
	226	+	if tc.missing {
	227	+	err = domain.ErrNotFound
	228	+	}
	229	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(tc.target, err)
	230	+	}
	231	+	_, err := u.mrs.AddComment(context.Background(), domain.Root(), u.repo.Name, 1, tc.params)
	232	+	require.ErrorIs(t, err, domain.ErrInvalid)
	233	+	})
	234	+	}
	235	+	}


@@ -6,6 +6,7 @@ import (
6	"context"	6		"context"
7	"errors"	7		"errors"
8	"testing"	8		"testing"
		9	+	"time"
9		10
10	"github.com/stretchr/testify/assert"	11		"github.com/stretchr/testify/assert"
11	"github.com/stretchr/testify/mock"	12		"github.com/stretchr/testify/mock"

@@ -117,3 +118,118 @@ func TestMergeReturnsTheFailureToReadTheSettings(t *testing.T) {
117	})	118		})
118	}	119		}
119	}	120		}
		121	+
		122	+	func TestNoteMutationRetries(t *testing.T) {
		123	+	for _, action := range []string{"edit", "delete", "resolve"} {
		124	+	t.Run(action, func(t *testing.T) {
		125	+	u := newMRUnit(t)
		126	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
		127	+	mr := domain.MergeRequest{Repo: u.repo.Name, Number: 1, State: domain.MRStateOpen}
		128	+	text, err := domain.ParsePlainText("before")
		129	+	require.NoError(t, err)
		130	+	c := domain.Comment{ID: 1, Author: "root", Text: text}
		131	+	freshMR := mr
		132	+	freshMR.Version = 2
		133	+	fresh := c
		134	+	fresh.Version = 3
		135	+	fresh.CreatedAt = now.Add(-time.Hour)
		136	+	if action != "resolve" {
		137	+	fresh.Resolved = true
		138	+	}
		139	+	want := fresh
		140	+	switch action {
		141	+	case "edit":
		142	+	want.Text, err = domain.ParsePlainText("after")
		143	+	require.NoError(t, err)
		144	+	want.EditedAt = now.UTC()
		145	+	case "delete":
		146	+	want.Text, err = domain.ParsePlainText("")
		147	+	require.NoError(t, err)
		148	+	want.Deleted = true
		149	+	want.EditedAt = now.UTC()
		150	+	case "resolve":
		151	+	want.Resolved = true
		152	+	}
		153	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(mr, nil).Once()
		154	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(freshMR, nil).Once()
		155	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(c, nil).Once()
		156	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(fresh, nil).Once()
		157	+	u.store.EXPECT().SaveComment(mock.Anything, mock.Anything, mock.Anything).Return(domain.ErrConflict).Once()
		158	+	u.store.EXPECT().SaveComment(mock.Anything, mock.MatchedBy(func(saved domain.MergeRequest) bool {
		159	+	return saved.Version == freshMR.Version
		160	+	}), mock.MatchedBy(func(saved domain.Comment) bool { return saved == want })).Return(nil).Once()
		161	+	bus := mocks.NewEventBus(t)
		162	+	bus.EXPECT().Publish(mock.Anything, mock.MatchedBy(func(e domain.Event) bool {
		163	+	switch event := e.(type) {
		164	+	case domain.CommentEdited:
		165	+	return action == "edit" && event.Comment == want
		166	+	case domain.CommentDeleted:
		167	+	return action == "delete" && event.Comment == want
		168	+	case domain.CommentResolved:
		169	+	return action == "resolve" && event.Comment == want
		170	+	}
		171	+	return false
		172	+	})).Return().Once()
		173	+	clock := mocks.NewClock(t)
		174	+	clock.EXPECT().Now().Return(now)
		175	+	svc := usecase.NewMergeRequests(usecase.MergeRequestsConfig{Meta: u.meta, Store: u.store, Bus: bus, Clock: clock})
		176	+	var got domain.Comment
		177	+	switch action {
		178	+	case "edit":
		179	+	got, err = svc.EditComment(context.Background(), domain.Root(), u.repo.Name, 1, 1, "after")
		180	+	case "delete":
		181	+	got, err = svc.DeleteComment(context.Background(), domain.Root(), u.repo.Name, 1, 1)
		182	+	case "resolve":
		183	+	got, err = svc.ResolveComment(context.Background(), domain.Root(), u.repo.Name, 1, 1, true)
		184	+	}
		185	+	require.NoError(t, err)
		186	+	assert.Equal(t, want, got)
		187	+	})
		188	+	}
		189	+	}
		190	+
		191	+	// A reply whose root is deleted while the save is retried is rejected.
		192	+	func TestAddNoteRechecksReplyRootOnConflict(t *testing.T) {
		193	+	u := newMRUnit(t)
		194	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
		195	+	u.git.EXPECT().BranchHead(mock.Anything, mock.Anything, mock.Anything).Return(domain.ObjectID{}, domain.ErrNotFound)
		196	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(domain.MergeRequest{State: domain.MRStateOpen}, nil).Twice()
		197	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(domain.Comment{ID: 1}, nil).Once()
		198	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(domain.Comment{ID: 1, Deleted: true}, nil).Once()
		199	+	u.store.EXPECT().SaveComment(mock.Anything, mock.Anything, mock.Anything).Return(domain.ErrConflict).Once()
		200	+	_, err := u.mrs.AddComment(context.Background(), domain.Root(), u.repo.Name, 1, ports.AddCommentParams{ReplyTo: 1, Text: "x"})
		201	+	require.ErrorIs(t, err, domain.ErrInvalid)
		202	+	}
		203	+
		204	+	func TestAddNoteValidation(t *testing.T) {
		205	+	for _, tc := range []struct {
		206	+	name string
		207	+	params ports.AddCommentParams
		208	+	target domain.Comment
		209	+	missing bool
		210	+	}{
		211	+	{name: "range without path", params: ports.AddCommentParams{StartLine: 1, Text: "x"}},
		212	+	{name: "equal ends", params: ports.AddCommentParams{Path: "a", StartLine: 3, Line: 3, Side: domain.SideNew, Text: "x"}},
		213	+	{name: "reversed ends", params: ports.AddCommentParams{Path: "a", StartLine: 4, Line: 3, Side: domain.SideNew, Text: "x"}},
		214	+	{name: "reply anchor", params: ports.AddCommentParams{ReplyTo: 1, Path: "a", Line: 1, Side: domain.SideNew, Text: "x"}},
		215	+	{name: "reply verdict", params: ports.AddCommentParams{ReplyTo: 1, Verdict: domain.VerdictApprove}},
		216	+	{name: "reply to reply", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, target: domain.Comment{ReplyTo: 2}},
		217	+	{name: "deleted root", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, target: domain.Comment{Deleted: true}},
		218	+	{name: "missing root", params: ports.AddCommentParams{ReplyTo: 1, Text: "x"}, missing: true},
		219	+	} {
		220	+	t.Run(tc.name, func(t *testing.T) {
		221	+	u := newMRUnit(t)
		222	+	u.meta.EXPECT().Get(mock.Anything, u.repo.Name).Return(u.repo, nil)
		223	+	u.store.EXPECT().Get(mock.Anything, u.repo.Name, int64(1)).Return(domain.MergeRequest{State: domain.MRStateOpen}, nil)
		224	+	if tc.name == "reply to reply" \|\| tc.name == "deleted root" \|\| tc.missing {
		225	+	var err error
		226	+	if tc.missing {
		227	+	err = domain.ErrNotFound
		228	+	}
		229	+	u.store.EXPECT().GetComment(mock.Anything, u.repo.Name, int64(1), int64(1)).Return(tc.target, err)
		230	+	}
		231	+	_, err := u.mrs.AddComment(context.Background(), domain.Root(), u.repo.Name, 1, tc.params)
		232	+	require.ErrorIs(t, err, domain.ErrInvalid)
		233	+	})
		234	+	}
		235	+	}

M internal/usecase/pushes.go +1 -1


@@ -179,7 +179,7 @@ func (u *Pushes) Check(ctx context.Context, p domain.Principal, name domain.Repo
179	179		// recorded before Git moves them, so that a tip never has the record of an
180	180		// earlier pusher at the same commit (domain.CIRefTip). A record that cannot
181	181		// be written refuses the push, as it cannot be run later with a known trust.
182		-	if err := recordRefTips(ctx, u.tips, name, updates, authorOf(p), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
	182	+	if err := recordRefTips(ctx, u.tips, name, updates, domain.AuthorName(p), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
183	183		return err
184	184		}
185	185		log := zerowrap.FromCtx(ctx)


@@ -179,7 +179,7 @@ func (u *Pushes) Check(ctx context.Context, p domain.Principal, name domain.Repo
179		// recorded before Git moves them, so that a tip never has the record of an	179		// recorded before Git moves them, so that a tip never has the record of an
180		// earlier pusher at the same commit (domain.CIRefTip). A record that cannot	180		// earlier pusher at the same commit (domain.CIRefTip). A record that cannot
181		// be written refuses the push, as it cannot be run later with a known trust.	181		// be written refuses the push, as it cannot be run later with a known trust.
182	-	if err := recordRefTips(ctx, u.tips, name, updates, authorOf(p), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {	182	+	if err := recordRefTips(ctx, u.tips, name, updates, domain.AuthorName(p), domain.PusherOf(p), domain.TrustedActor(p)); err != nil {
183		return err	183		return err
184		}	184		}
185		log := zerowrap.FromCtx(ctx)	185		log := zerowrap.FromCtx(ctx)

M internal/usecase/sessions_test.go +0 -9


@@ -334,12 +334,3 @@ func TestSignOutEverywhereEndsSessions(t *testing.T) {
334	334		_, err = f.sessions.Verify(ctx, c)
335	335		assert.NoError(t, err, "a new session works")
336	336		}
337		-
338		-	// The owner signed in on the web signs what it writes as "owner", where root
339		-	// signs as "root" although both hold every right.
340		-	func TestAuthorOfOwnerSession(t *testing.T) {
341		-	t.Parallel()
342		-	assert.Equal(t, "owner", usecase.AuthorOf(domain.Owner()))
343		-	assert.Equal(t, "root", usecase.AuthorOf(domain.Root()))
344		-	assert.Equal(t, "ci", usecase.AuthorOf(domain.TokenPrincipal(domain.Token{Label: "ci", Scopes: domain.AllScopes()})))
345		-	}


@@ -334,12 +334,3 @@ func TestSignOutEverywhereEndsSessions(t *testing.T) {
334		_, err = f.sessions.Verify(ctx, c)	334	_, err = f.sessions.Verify(ctx, c)
335		assert.NoError(t, err, "a new session works")	335	assert.NoError(t, err, "a new session works")
336		}	336	}
337	-
338	-	// The owner signed in on the web signs what it writes as "owner", where root
339	-	// signs as "root" although both hold every right.
340	-	func TestAuthorOfOwnerSession(t *testing.T) {
341	-	t.Parallel()
342	-	assert.Equal(t, "owner", usecase.AuthorOf(domain.Owner()))
343	-	assert.Equal(t, "root", usecase.AuthorOf(domain.Root()))
344	-	assert.Equal(t, "ci", usecase.AuthorOf(domain.TokenPrincipal(domain.Token{Label: "ci", Scopes: domain.AllScopes()})))
345	-	}

M proto/ermite/storage/merge_request.proto +12 -0


@@ -64,6 +64,13 @@ message MergeRequest {
64	64		int64 comment_seq = 14;
65	65		}
66	66
	67	+	// Verdict is the immutable review decision of a note.
	68	+	enum Verdict {
	69	+	VERDICT_UNSPECIFIED = 0;
	70	+	VERDICT_APPROVE = 1;
	71	+	VERDICT_CHANGES_REQUESTED = 2;
	72	+	}
	73	+
67	74		// Comment is stored under the key "mrc/<repo>/<number:010d>/<id:010d>".
68	75		message Comment {
69	76		int64 id = 1;

@@ -75,6 +82,11 @@ message Comment {
75	82		string text = 7;
76	83		bool resolved = 8;
77	84		google.protobuf.Timestamp created_at = 9;
	85	+	int64 reply_to = 10;
	86	+	int32 start_line = 11;
	87	+	Verdict verdict = 12;
	88	+	google.protobuf.Timestamp edited_at = 13;
	89	+	bool deleted = 14;
78	90		}
79	91
80	92		// Sequence is stored under the key "mrseq/<repo>": the last merge request


@@ -64,6 +64,13 @@ message MergeRequest {
64	int64 comment_seq = 14;	64		int64 comment_seq = 14;
65	}	65		}
66		66
		67	+	// Verdict is the immutable review decision of a note.
		68	+	enum Verdict {
		69	+	VERDICT_UNSPECIFIED = 0;
		70	+	VERDICT_APPROVE = 1;
		71	+	VERDICT_CHANGES_REQUESTED = 2;
		72	+	}
		73	+
67	// Comment is stored under the key "mrc/<repo>/<number:010d>/<id:010d>".	74		// Comment is stored under the key "mrc/<repo>/<number:010d>/<id:010d>".
68	message Comment {	75		message Comment {
69	int64 id = 1;	76		int64 id = 1;

@@ -75,6 +82,11 @@ message Comment {
75	string text = 7;	82		string text = 7;
76	bool resolved = 8;	83		bool resolved = 8;
77	google.protobuf.Timestamp created_at = 9;	84		google.protobuf.Timestamp created_at = 9;
		85	+	int64 reply_to = 10;
		86	+	int32 start_line = 11;
		87	+	Verdict verdict = 12;
		88	+	google.protobuf.Timestamp edited_at = 13;
		89	+	bool deleted = 14;
78	}	90		}
79		91
80	// Sequence is stored under the key "mrseq/<repo>": the last merge request	92		// Sequence is stored under the key "mrseq/<repo>": the last merge request

M skills/ermite/CLI.md +11 -6


@@ -28,7 +28,7 @@ Presets add up with `--scope` (repeatable or comma-separated):
28	28
29	29		\| Preset \| Scopes \|
30	30		\|---\|---\|
31		-	\| `cli` \| every scope, for the owner's daily use \|
	31	+	\| `cli` \| every scope (including `mr:review`), for the owner's daily use; a token created before `mr:review` existed lacks it and loses owner rights: recreate it with `--preset cli` using the root token or from a signed-in owner web session (an old token lacking `mr:review` cannot grant it), then replace the stored CLI secret and revoke the old token \|
32	32		\| `agent` \| `repo:write`, `mr:write` \|
33	33		\| `ci` \| `repo:read` \|
34	34

@@ -39,7 +39,8 @@ Scopes:
39	39		\| `repo:read` \| read private repositories \|
40	40		\| `repo:write` \| push, create a repository \|
41	41		\| `repo:admin` \| delete a repository, change visibility, description, default branch, merge settings \|
42		-	\| `mr:write` \| open, comment on, resolve, close, mark read \|
	42	+	\| `mr:write` \| open, comment on, reply, edit and delete own notes, resolve, close, mark read \|
	43	+	\| `mr:review` \| give a verdict (`--approve`, `--request-changes`) \|
43	44		\| `mr:merge` \| merge, and delete the merged source branch with `--delete-branch` \|
44	45		\| `token:admin` \| create, list and revoke tokens \|
45	46		\| `ci:write`, `secrets:write`, `runner:register` \| reserved for CI \|

@@ -55,12 +56,16 @@ A token can never grant more than the token that creates it. `--repo` (repeatabl
55	56		\| `mr create <repo> --source B --title T [--target B] [--description TEXT\\|-]` \| `mr:write` \| target defaults to the default branch; title of 120 characters max; `-` reads standard input \|
56	57		\| `mr list <repo> [--state open\\|merged\\|closed\\|all] [--json]` \| none \| default `open` \|
57	58		\| `mr show <repo> <n> [--diff] [--since-last-read] [--mark-read] [--json]` \| `mr:write` for `--mark-read` \| commits, changed files and comments; `--diff` adds hunks with line numbers \|
58		-	\| `mr comment <repo> <n> -m TEXT\\|- [--path P --line N --side old\\|new]` \| `mr:write` \| the line must be in the current diff; a deleted file uses its old path \|
59		-	\| `mr resolve <repo> <n> <comment-id> [--undo]` \| `mr:write` \| doing it twice is not an error \|
	59	+	\| `mr comment <repo> <n> -m TEXT\\|- [--path P --line N\\|A-B --side old\\|new] [--reply ID] [--approve\\|--request-changes]` \| `mr:write`; verdicts `mr:review` \| Markdown note (8000 characters max); the lines must be in the current diff on one side; a deleted file uses its old path; `--reply` takes a root note (`12`, `#12` or `^12`), inherits its anchor and cannot carry a verdict; a verdict note may have no message \|
	60	+	\| `mr edit-comment <repo> <n> <comment-id> -m TEXT\\|-` \| `mr:write` \| author only, open merge request; the verdict is unchanged \|
	61	+	\| `mr delete-comment <repo> <n> <comment-id>` \| `mr:write` \| author only; the text is lost, the verdict is kept \|
	62	+	\| `mr resolve <repo> <n> <comment-id> [--undo]` \| `mr:write` \| on the thread root, covers its replies; doing it twice is not an error \|
60	63		\| `mr merge <repo> <n> --head <full-id> [--squash] [--delete-branch]` \| `mr:merge` \| refused if the branch moved or the target is not an ancestor of the head; `--delete-branch` deletes the source after the merge (refused for the default branch or a branch another open request uses; JSON adds `source_branch_deleted`) \|
61	64		\| `mr close <repo> <n>` \| `mr:write` \| a closed merge request cannot be reopened \|
62	65
63		-	Merge request JSON: `repo`, `number`, `title`, `description`, `source_branch`, `target_branch`, `state`, `author` (token label), `created_at`, `updated_at`, `head_id`, `merged_commit_id`, `merge_mode`. `mr show --json` adds `commits`, `diff_base_id`, `stats`, `files` (with `hunks` under `--diff`: `kind`, `old_number`, `new_number`, `text`), `comments`, `last_read_id`, `last_read_lost`.
	66	+	Merge request JSON: `repo`, `number`, `title`, `description`, `source_branch`, `target_branch`, `state`, `author` (token label), `created_at`, `updated_at`, `head_id`, `merged_commit_id`, `merge_mode`. `mr show --json` adds `commits`, `diff_base_id`, `stats`, `files` (with `hunks` under `--diff`: `kind`, `old_number`, `new_number`, `text`), `comments`, `verdicts`, `last_read_id`, `last_read_lost`.
	67	+
	68	+	Comment JSON: `id`, `author`, `path`, `line`, `side`, `commit_id`, `text`, `resolved`, `created_at`, `reply_to` (empty for roots), `start_line` (0 for a single line), `verdict` (`""`, `approve`, `changes_requested`), `edited_at`, `deleted`. Verdict JSON (latest per author): `author`, `verdict`, `comment_id`, `commit_id`, `created_at`, `stale` (an approval given on another head; changes requested are never stale). Verdicts are informative and never block a merge. In notes, `^N` refers to note N.
64	69
65	70		## Workflows
66	71

@@ -82,7 +87,7 @@ Workflow JSON: `repo`, `file` (always `.github/workflows/<file>`), `name` (the `
82	87		\| `repo_created`, `repo_updated`, `repo_deleted` \| `repo`, `repository` \|
83	88		\| `pushed` \| `repo`, `ref_updates` (`ref`, `old_id`, `new_id`; an empty id means created or deleted) \|
84	89		\| `merge_request_opened`, `merge_request_merged`, `merge_request_closed` \| `repo`, `merge_request` \|
85		-	\| `comment_added` \| `repo`, `number`, `comment` \|
	90	+	\| `comment_added`, `comment_edited`, `comment_deleted`, `comment_resolved` \| `repo`, `number`, `comment` (a verdict note has `verdict` set) \|
86	91		\| `gap` \| none: events were lost, reload the state \|
87	92
88	93		## Server and web

 | Preset | Scopes |
 |---|---|
-| `cli` | every scope, for the owner's daily use |
+| `cli` | every scope (including `mr:review`), for the owner's daily use; a token created before `mr:review` existed lacks it and loses owner rights: recreate it with `--preset cli` using the root token or from a signed-in owner web session (an old token lacking `mr:review` cannot grant it), then replace the stored CLI secret and revoke the old token |
 | `agent` | `repo:write`, `mr:write` |
 | `ci` | `repo:read` |
 | `repo:read` | read private repositories |
 | `repo:write` | push, create a repository |
 | `repo:admin` | delete a repository, change visibility, description, default branch, merge settings |
-| `mr:write` | open, comment on, resolve, close, mark read |
+| `mr:write` | open, comment on, reply, edit and delete own notes, resolve, close, mark read |
+| `mr:review` | give a verdict (`--approve`, `--request-changes`) |
 | `mr:merge` | merge, and delete the merged source branch with `--delete-branch` |
 | `token:admin` | create, list and revoke tokens |
 | `ci:write`, `secrets:write`, `runner:register` | reserved for CI |
 | `mr create <repo> --source B --title T [--target B] [--description TEXT\|-]` | `mr:write` | target defaults to the default branch; title of 120 characters max; `-` reads standard input |
 | `mr list <repo> [--state open\|merged\|closed\|all] [--json]` | none | default `open` |
 | `mr show <repo> <n> [--diff] [--since-last-read] [--mark-read] [--json]` | `mr:write` for `--mark-read` | commits, changed files and comments; `--diff` adds hunks with line numbers |
-| `mr comment <repo> <n> -m TEXT\|- [--path P --line N --side old\|new]` | `mr:write` | the line must be in the current diff; a deleted file uses its old path |
+| `mr comment <repo> <n> -m TEXT\|- [--path P --line N\|A-B --side old\|new] [--reply ID] [--approve\|--request-changes]` | `mr:write`; verdicts `mr:review` | Markdown note (8000 characters max); the lines must be in the current diff on one side; a deleted file uses its old path; `--reply` takes a root note (`12`, `#12` or `^12`), inherits its anchor and cannot carry a verdict; a verdict note may have no message |
-| `mr resolve <repo> <n> <comment-id> [--undo]` | `mr:write` | doing it twice is not an error |
+| `mr edit-comment <repo> <n> <comment-id> -m TEXT\|-` | `mr:write` | author only, open merge request; the verdict is unchanged |
+| `mr delete-comment <repo> <n> <comment-id>` | `mr:write` | author only; the text is lost, the verdict is kept |
+| `mr resolve <repo> <n> <comment-id> [--undo]` | `mr:write` | on the thread root, covers its replies; doing it twice is not an error |
 | `mr merge <repo> <n> --head <full-id> [--squash] [--delete-branch]` | `mr:merge` | refused if the branch moved or the target is not an ancestor of the head; `--delete-branch` deletes the source after the merge (refused for the default branch or a branch another open request uses; JSON adds `source_branch_deleted`) |
 | `mr close <repo> <n>` | `mr:write` | a closed merge request cannot be reopened |
-Merge request JSON: `repo`, `number`, `title`, `description`, `source_branch`, `target_branch`, `state`, `author` (token label), `created_at`, `updated_at`, `head_id`, `merged_commit_id`, `merge_mode`. `mr show --json` adds `commits`, `diff_base_id`, `stats`, `files` (with `hunks` under `--diff`: `kind`, `old_number`, `new_number`, `text`), `comments`, `last_read_id`, `last_read_lost`.
+Merge request JSON: `repo`, `number`, `title`, `description`, `source_branch`, `target_branch`, `state`, `author` (token label), `created_at`, `updated_at`, `head_id`, `merged_commit_id`, `merge_mode`. `mr show --json` adds `commits`, `diff_base_id`, `stats`, `files` (with `hunks` under `--diff`: `kind`, `old_number`, `new_number`, `text`), `comments`, `verdicts`, `last_read_id`, `last_read_lost`.
+Comment JSON: `id`, `author`, `path`, `line`, `side`, `commit_id`, `text`, `resolved`, `created_at`, `reply_to` (empty for roots), `start_line` (0 for a single line), `verdict` (`""`, `approve`, `changes_requested`), `edited_at`, `deleted`. Verdict JSON (latest per author): `author`, `verdict`, `comment_id`, `commit_id`, `created_at`, `stale` (an approval given on another head; changes requested are never stale). Verdicts are informative and never block a merge. In notes, `^N` refers to note N.
 ## Workflows
 | `repo_created`, `repo_updated`, `repo_deleted` | `repo`, `repository` |
 | `pushed` | `repo`, `ref_updates` (`ref`, `old_id`, `new_id`; an empty id means created or deleted) |
 | `merge_request_opened`, `merge_request_merged`, `merge_request_closed` | `repo`, `merge_request` |
-| `comment_added` | `repo`, `number`, `comment` |
+| `comment_added`, `comment_edited`, `comment_deleted`, `comment_resolved` | `repo`, `number`, `comment` (a verdict note has `verdict` set) |
 | `gap` | none: events were lost, reload the state |
 ## Server and web

M skills/ermite/SKILL.md +13 -4


@@ -35,11 +35,20 @@ git push https://git.example.com/<repo>.git main # password = token,
35	35
36	36		1. List: `ermite mr list <repo> --json`.
37	37		2. Read: `ermite mr show <repo> <n> --diff --json`. Keep `head_id`; take line numbers from the hunks.
38		-	3. Comment on a line: `ermite mr comment <repo> <n> -m "text" --path <file> --line <n> --side new`. Without `--path` the comment is general. The line must appear in the diff.
39		-	4. Merge only when asked: `ermite mr merge <repo> <n> --head <head_id>`, with `--squash` for one commit signed by the server and `--delete-branch` to delete the source branch afterwards.
	38	+	3. Comment on a line: `ermite mr comment <repo> <n> -m "text" --path <file> --line <n> --side new`; `--line 10-14` covers a range on one side. Without `--path` the comment is general. The line must appear in the diff. Notes are Markdown; `^N` refers to note N.
	39	+	4. End a review with a verdict (needs `mr:review`): `--approve` or `--request-changes`, alone or with a message. Verdicts are informative and cannot be edited; a new verdict replaces the previous one.
	40	+	5. Merge only when asked: `ermite mr merge <repo> <n> --head <head_id>`, with `--squash` for one commit signed by the server and `--delete-branch` to delete the source branch afterwards.
40	41
41	42		The merge is refused when the branch moved since `head_id` (review again) or when the target is not an ancestor of the head (rebase and push again). The repository may allow only one merge mode.
42	43
	44	+	### Act on a review
	45	+
	46	+	Notes are visible as soon as they are written, so a review is not finished until its verdict. Act on a verdict, not on each note (`ermite watch --json` shows `verdict` on the `comment_added` event).
	47	+
	48	+	On `changes_requested`: run `ermite mr show <repo> <n> --json`, read the open threads (roots with `resolved` false and their replies), fix the code, push, then answer each thread with `ermite mr comment <repo> <n> --reply <id> -m "Fixed in ^N"`. Leave resolving to the reviewer: do not run `mr resolve` on their threads. Edit or delete only your own notes (`mr edit-comment`, `mr delete-comment`).
	49	+
	50	+	An approval is stale after a push; changes requested stay until the reviewer gives a new verdict.
	51	+
43	52		Open one: `ermite mr create <repo> --source <branch> --title "..."`. After new pushes, `mr show --since-last-read` shows only what changed since `--mark-read`.
44	53
45	54		## Tokens

@@ -48,11 +57,11 @@ Open one: `ermite mr create <repo> --source <branch> --title "..."`. After new p
48	57		ermite token create my-agent --preset agent --repo <repo> --expires 30d
49	58		```
50	59
51		-	The secret is printed once. Presets: `agent` (push, open and comment on merge requests), `ci` (read), `cli` (everything). Add `--scope mr:merge` to let an agent merge. A token can never grant more than the token that creates it. Full scope list: [CLI.md](CLI.md).
	60	+	The secret is printed once. Presets: `agent` (push, open and comment on merge requests; no verdicts), `ci` (read), `cli` (everything). Add `--scope mr:review` to let an agent give verdicts, `--scope mr:merge` to let it merge. A token can never grant more than the token that creates it. Full scope list: [CLI.md](CLI.md).
52	61
53	62		## Follow events
54	63
55		-	`ermite watch [repo] --json` prints one JSON object per event (pushes, repositories, merge requests, comments). It reconnects and resumes on its own; a `gap` event means some events were lost, so reload the state.
	64	+	`ermite watch [repo] --json` prints one JSON object per event (pushes, repositories, merge requests, notes: added, edited, deleted, resolved). It reconnects and resumes on its own; a `gap` event means some events were lost, so reload the state.
56	65
57	66		## Run a server
58	67

 1. List: `ermite mr list <repo> --json`.
 2. Read: `ermite mr show <repo> <n> --diff --json`. Keep `head_id`; take line numbers from the hunks.
-3. Comment on a line: `ermite mr comment <repo> <n> -m "text" --path <file> --line <n> --side new`. Without `--path` the comment is general. The line must appear in the diff.
+3. Comment on a line: `ermite mr comment <repo> <n> -m "text" --path <file> --line <n> --side new`; `--line 10-14` covers a range on one side. Without `--path` the comment is general. The line must appear in the diff. Notes are Markdown; `^N` refers to note N.
-4. Merge only when asked: `ermite mr merge <repo> <n> --head <head_id>`, with `--squash` for one commit signed by the server and `--delete-branch` to delete the source branch afterwards.
+4. End a review with a verdict (needs `mr:review`): `--approve` or `--request-changes`, alone or with a message. Verdicts are informative and cannot be edited; a new verdict replaces the previous one.
+5. Merge only when asked: `ermite mr merge <repo> <n> --head <head_id>`, with `--squash` for one commit signed by the server and `--delete-branch` to delete the source branch afterwards.
 The merge is refused when the branch moved since `head_id` (review again) or when the target is not an ancestor of the head (rebase and push again). The repository may allow only one merge mode.
+### Act on a review
+Notes are visible as soon as they are written, so a review is not finished until its verdict. Act on a verdict, not on each note (`ermite watch --json` shows `verdict` on the `comment_added` event).
+On `changes_requested`: run `ermite mr show <repo> <n> --json`, read the open threads (roots with `resolved` false and their replies), fix the code, push, then answer each thread with `ermite mr comment <repo> <n> --reply <id> -m "Fixed in ^N"`. Leave resolving to the reviewer: do not run `mr resolve` on their threads. Edit or delete only your own notes (`mr edit-comment`, `mr delete-comment`).
+An approval is stale after a push; changes requested stay until the reviewer gives a new verdict.
 Open one: `ermite mr create <repo> --source <branch> --title "..."`. After new pushes, `mr show --since-last-read` shows only what changed since `--mark-read`.
 ## Tokens
 ermite token create my-agent --preset agent --repo <repo> --expires 30d
 ```
-The secret is printed once. Presets: `agent` (push, open and comment on merge requests), `ci` (read), `cli` (everything). Add `--scope mr:merge` to let an agent merge. A token can never grant more than the token that creates it. Full scope list: [CLI.md](CLI.md).
+The secret is printed once. Presets: `agent` (push, open and comment on merge requests; no verdicts), `ci` (read), `cli` (everything). Add `--scope mr:review` to let an agent give verdicts, `--scope mr:merge` to let it merge. A token can never grant more than the token that creates it. Full scope list: [CLI.md](CLI.md).
 ## Follow events
-`ermite watch [repo] --json` prints one JSON object per event (pushes, repositories, merge requests, comments). It reconnects and resumes on its own; a `gap` event means some events were lost, so reload the state.
+`ermite watch [repo] --json` prints one JSON object per event (pushes, repositories, merge requests, notes: added, edited, deleted, resolved). It reconnects and resumes on its own; a `gap` event means some events were lost, so reload the state.
 ## Run a server