582b620 refactor(web): read and write through the ports instead of in-process Connect clients · ermite

M .hexcheck.yaml +0 -1


@@ -65,7 +65,6 @@ rules:
65		mocking:	65	mocking:
66		generatedMockPaths:	66	generatedMockPaths:
67		- internal/ports/mocks/**	67	- internal/ports/mocks/**
68	-	- internal/adapters/web/mocks/**
69		generatedMockNamePatterns:	68	generatedMockNamePatterns:
70		- '{{Interface}}'	69	- '{{Interface}}'
71		allow:	70	allow:

M .mockery.yml +1 -12

@@ -1,5 +1,4 @@
1	-	# Mocks of the ports, generated in internal/ports/mocks, and of the generated	1	+	# Mocks of the ports, generated in internal/ports/mocks. Regenerate with:
2	-	# Connect clients the web adapter calls. Regenerate with:
3		# go generate ./internal/ports	2		# go generate ./internal/ports
4		template: testify	3		template: testify
5		_anchors:	4		_anchors:

@@ -12,13 +11,3 @@ _anchors:
12		packages:	11		packages:
13		bnema.dev/ermite/internal/ports:	12		bnema.dev/ermite/internal/ports:
14		config: *mocks	13		config: *mocks
15	-	bnema.dev/ermite-api/gen/ermite/ermiteconnect:
16	-	config:
17	-	include-auto-generated: true
18	-	dir: internal/adapters/web/mocks
19	-	pkgname: mocks
20	-	filename: "{{.InterfaceName}}.go"
21	-	structname: "{{.InterfaceName}}"
22	-	interfaces:
23	-	GitServiceClient:
24	-	RepoServiceClient:

M README.md +1 -0


@@ -104,6 +104,7 @@ go test ./...
104		104
105	- `internal/usecase` imports only `internal/domain` and `internal/ports`.	105		- `internal/usecase` imports only `internal/domain` and `internal/ports`.
106	- Adapters import `internal/domain`, `internal/ports` and the shared `internal/clientlimit`; never a use case, `internal/app` or another adapter.	106		- Adapters import `internal/domain`, `internal/ports` and the shared `internal/clientlimit`; never a use case, `internal/app` or another adapter.
		107	+	- The web adapter, like the API and Git over HTTP, calls the use cases through `internal/ports` with the principal of the request (anonymous, or the owner with a valid session); it never imports the generated API code.
107	- `internal/ports` imports only `internal/domain`; `internal/domain` imports nothing from the module.	108		- `internal/ports` imports only `internal/domain`; `internal/domain` imports nothing from the module.
108	- `internal/config` (environment parsing) is used by `internal/app` only.	109		- `internal/config` (environment parsing) is used by `internal/app` only.
109		110

M internal/adapters/githttp/handler.go +2 -0


@@ -182,6 +182,7 @@ func parseRoute(r *http.Request) (route, int) {
182	}	182		}
183		183
184	// ServeHTTP implements http.Handler.	184		// ServeHTTP implements http.Handler.
		185	+	//
185	//hexcheck:ignore suspicious-business-logic-in-adapter transport orchestration: the authorization decisions are the use cases'	186		//hexcheck:ignore suspicious-business-logic-in-adapter transport orchestration: the authorization decisions are the use cases'
186	func (h Handler) ServeHTTP(w http.ResponseWriter, r http.Request) {	187		func (h Handler) ServeHTTP(w http.ResponseWriter, r http.Request) {
187	var rt route	188		var rt route

@@ -374,6 +375,7 @@ func (h *Handler) acquire(ctx context.Context, w http.ResponseWriter, rt route,
374	}	375		}
375		376
376	// serveBackend runs git http-backend for an authorized request.	377		// serveBackend runs git http-backend for an authorized request.
		378	+	//
377	//hexcheck:ignore suspicious-business-logic-in-adapter process and CGI plumbing: no business rule is decided here	379		//hexcheck:ignore suspicious-business-logic-in-adapter process and CGI plumbing: no business rule is decided here
378	func (h Handler) serveBackend(w http.ResponseWriter, r http.Request, rt route, name domain.RepoName, p domain.Principal, client string) {	380		func (h Handler) serveBackend(w http.ResponseWriter, r http.Request, rt route, name domain.RepoName, p domain.Principal, client string) {
379	ctx := r.Context()	381		ctx := r.Context()

M internal/adapters/githttp/hooks.go +1 -0


@@ -175,6 +175,7 @@ func (s *HookServer) Close(ctx context.Context) {
175	}	175		}
176		176
177	// handle serves one connection: one request line, one reply line.	177		// handle serves one connection: one request line, one reply line.
		178	+	//
178	//hexcheck:ignore suspicious-business-logic-in-adapter hook protocol dispatch: the decisions are the use cases'	179		//hexcheck:ignore suspicious-business-logic-in-adapter hook protocol dispatch: the decisions are the use cases'
179	func (s *HookServer) handle(ctx context.Context, conn net.Conn) {	180		func (s *HookServer) handle(ctx context.Context, conn net.Conn) {
180	log := zerowrap.FromCtx(ctx)	181		log := zerowrap.FromCtx(ctx)

M internal/adapters/rpc/api.go +3 -4

 // Package rpc serves the ermite API contract (bnema.dev/ermite-api) with
 // ConnectRPC: handlers that map the messages of the contract to the use cases
 // of usecase and back, the interceptor that authenticates callers, and the error
-// mapping. The same handlers serve remote clients over HTTP and the web in
+// mapping.
-// process (see InProcessClient).
 package rpc
 import (
 // it under /-/api/ and strips the prefix.
 func (a *API) Handler() http.Handler { return a.handler }
-// caller returns the principal the interceptor (or the in-process caller)
+// caller returns the principal the interceptor put in ctx; anonymous when
-// put in ctx; anonymous when there is none.
+// there is none.
 func caller(ctx context.Context) domain.Principal {
 	p, _ := domain.PrincipalFromContext(ctx)
 	return p

M internal/adapters/rpc/errors.go +2 -13

 	case errors.Is(err, domain.ErrResourceExhausted):
 		return connect.CodeResourceExhausted, true
 	}
-	for _, invalid := range invalidErrors {
+	if domain.IsInvalid(err) {
-		if errors.Is(err, invalid) {
+		return connect.CodeInvalidArgument, true
-			return connect.CodeInvalidArgument, true
-		}
 	}
 	return 0, false
 }
-// invalidErrors are the domain errors that mean the request was malformed.
-var invalidErrors = []error{
-	domain.ErrInvalid, domain.ErrInvalidName, domain.ErrInvalidVisibility,
-	domain.ErrInvalidScope, domain.ErrInvalidToken,
-	domain.ErrInvalidObjectID, domain.ErrInvalidRevision, domain.ErrInvalidPath,
-	domain.ErrInvalidPageToken, domain.ErrInvalidPageSize, domain.ErrInvalidRefKind,
-	domain.ErrNotDirectory, domain.ErrNotFile, domain.ErrInvalidText,
-}
 // addFieldDetail attaches the fields a request was rejected for as a
 // BadRequest detail, when err carries them.
 func addFieldDetail(ce *connect.Error, err error) {

D internal/adapters/rpc/inprocess.go +0 -131

@@ -1,131 +0,0 @@
1	-	// SPDX-License-Identifier: AGPL-3.0-or-later
2	-
3	-	package rpc
4	-
5	-	import (
6	-	"context"
7	-	"io"
8	-	"net/http"
9	-	"sync"
10	-
11	-	"bnema.dev/ermite/internal/domain"
12	-	)
13	-
14	-	// inProcessHost is the host of the URLs of in-process calls. The name is
15	-	// never resolved.
16	-	const inProcessHost = "ermite.invalid"
17	-
18	-	// InProcessURL is the base URL to give to the generated Connect clients that
19	-	// use InProcessClient.
20	-	const InProcessURL = "http://" + inProcessHost
21	-
22	-	// InProcessClient returns an HTTP client whose requests are served by the
23	-	// handlers of the API in this process: no socket, no network hop. Build the
24	-	// generated Connect clients on it:
25	-	//
26	-	// hc := api.InProcessClient()
27	-	// repos := ermiteconnect.NewRepoServiceClient(hc, rpc.InProcessURL)
28	-	//
29	-	// The caller is the principal found in the context of each call
30	-	// (domain.ContextWithPrincipal), anonymous when there is none; the
31	-	// Authorization header is ignored. This is the identity of the web (P5):
32	-	// anonymous for visitors, the owner for a session. Only code in this process
33	-	// can put the marker that makes the interceptor trust it.
34	-	// Unary and server-streaming calls work, with all the codecs; the request
35	-	// log and the error mapping are those of remote calls.
36	-	func (a API) InProcessClient() http.Client {
37	-	return &http.Client{Transport: inProcessTransport{h: a.handler}}
38	-	}
39	-
40	-	type inProcessTransport struct{ h http.Handler }
41	-
42	-	// inProcessKey marks the context of a call made through InProcessClient. It is
43	-	// unexported, so that nothing outside this package, and nothing that comes
44	-	// from the network, can make the interceptor trust a principal.
45	-	type inProcessKey struct{}
46	-
47	-	func inProcess(ctx context.Context) bool {
48	-	_, ok := ctx.Value(inProcessKey{}).(struct{})
49	-	return ok
50	-	}
51	-
52	-	// RoundTrip serves req with the handler in a goroutine, and returns once the
53	-	// handler wrote its status. The body of the response is a pipe the handler
54	-	// writes to, so that streams are delivered as they are sent.
55	-	func (t inProcessTransport) RoundTrip(req http.Request) (http.Response, error) {
56	-	ctx := req.Context()
57	-	p, ok := domain.PrincipalFromContext(ctx)
58	-	if !ok {
59	-	p = domain.Anonymous()
60	-	}
61	-	sreq := req.Clone(context.WithValue(domain.ContextWithPrincipal(ctx, p), inProcessKey{}, struct{}{}))
62	-	sreq.RemoteAddr = "in-process"
63	-	sreq.RequestURI = req.URL.RequestURI()
64	-	if sreq.Body == nil {
65	-	sreq.Body = http.NoBody
66	-	}
67	-	sreq.Header.Del("Authorization")
68	-
69	-	pr, pw := io.Pipe()
70	-	w := &pipeResponse{header: http.Header{}, pw: pw, ready: make(chan struct{})}
71	-	go func() {
72	-	defer func() {
73	-	if r := recover(); r != nil {
74	-	w.writeHeader(http.StatusInternalServerError)
75	-	_ = pw.CloseWithError(io.ErrUnexpectedEOF)
76	-	}
77	-	}()
78	-	t.h.ServeHTTP(w, sreq)
79	-	w.writeHeader(http.StatusOK) // a handler that wrote nothing
80	-	_ = pw.Close()
81	-	}()
82	-
83	-	select {
84	-	case <-w.ready:
85	-	case <-ctx.Done():
86	-	_ = pr.CloseWithError(ctx.Err())
87	-	return nil, ctx.Err()
88	-	}
89	-	return &http.Response{
90	-	Status: http.StatusText(w.status),
91	-	StatusCode: w.status,
92	-	Proto: "HTTP/1.1",
93	-	ProtoMajor: 1,
94	-	ProtoMinor: 1,
95	-	Header: w.sent,
96	-	Body: pr,
97	-	ContentLength: -1,
98	-	Request: req,
99	-	}, nil
100	-	}
101	-
102	-	// pipeResponse is the http.ResponseWriter of an in-process call.
103	-	type pipeResponse struct {
104	-	header http.Header
105	-	pw *io.PipeWriter
106	-
107	-	once sync.Once
108	-	ready chan struct{}
109	-	status int
110	-	sent http.Header // header as of WriteHeader
111	-	}
112	-
113	-	func (w *pipeResponse) Header() http.Header { return w.header }
114	-
115	-	func (w *pipeResponse) WriteHeader(code int) { w.writeHeader(code) }
116	-
117	-	func (w *pipeResponse) writeHeader(code int) {
118	-	w.once.Do(func() {
119	-	w.status, w.sent = code, w.header.Clone()
120	-	close(w.ready)
121	-	})
122	-	}
123	-
124	-	func (w *pipeResponse) Write(b []byte) (int, error) {
125	-	w.writeHeader(http.StatusOK)
126	-	return w.pw.Write(b)
127	-	}
128	-
129	-	// Flush implements http.Flusher, which streaming handlers require: the pipe
130	-	// delivers every write at once, there is nothing to flush but the header.
131	-	func (w *pipeResponse) Flush() { w.writeHeader(http.StatusOK) }

M internal/adapters/rpc/interceptor.go +4 -22

 // limiter; a client that used up its failures gets resource_exhausted (429 on
 // the Connect protocol) whatever it presents, like on the Git routes.
 //
-// A call made through InProcessClient is trusted with the principal its
+// A principal in the context of a network request, say one put there by a
-// context carries: that is how the web calls the handlers in process. What
+// server's base context, is ignored and the request is authenticated from its
-// marks it is a value only the in-process transport can put in the context
+// headers.
-// (see inProcessKey); a principal in the context of a network request, say one
-// put there by a server's base context, is ignored and the request is
-// authenticated from its headers.
 type interceptor struct {
 	auth    ports.AuthService
 	limiter ports.FailureLimiter
 // authenticate returns the context to run the call in.
 func (i *interceptor) authenticate(ctx context.Context, procedure, peerAddr string, h http.Header) (context.Context, error) {
-	if inProcess(ctx) {
-		if _, ok := domain.PrincipalFromContext(ctx); ok {
-			return ctx, nil
-		}
-	}
 	// Whatever the context carried, the caller is anonymous until proven
 	// otherwise.
 	ctx = domain.ContextWithPrincipal(ctx, domain.Anonymous())
 type clientKey struct{}
-// ContextWithClient attributes the in-process calls made with ctx to the
-// client at addr (clientlimit.ClientAddr of the browser's request), so that
-// the per-client limits of the API, such as the event streams one, apply to
-// each visitor of the web rather than to the web as a whole. A network call
-// is always attributed to its own peer: the interceptor overwrites it.
-func ContextWithClient(ctx context.Context, addr string) context.Context {
-	return context.WithValue(ctx, clientKey{}, clientlimit.Key(addr))
-}
 // clientFromContext returns the normalized address of the client of a call:
-// its peer for a network call, the one given to ContextWithClient for an
+// its peer, empty when there is none.
-// in-process call, empty when there is none.
 func clientFromContext(ctx context.Context) string {
 	c, _ := ctx.Value(clientKey{}).(string)
 	return c

M internal/adapters/web/blob.go +33 -38

 import (
 	"context"
+	"errors"
 	"fmt"
 	"html/template"
+	"io"
 	"net/http"
 	"path"
 	"strings"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
 	"github.com/bnema/zerowrap"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 const (
 	DirHref  string
 }
-// blobStream is an open GetBlob stream whose first message has been read.
+// blobStream is an open file: its metadata and the content, read on demand.
 type blobStream struct {
-	stream *connect.ServerStreamForClient[pb.GetBlobResponse]
+	body io.ReadCloser
-	info   *pb.BlobInfo
+	info domain.BlobInfo
-	// buf holds the content already received and not yet handed out.
+	// buf holds the content already read and not yet handed out.
 	buf []byte
+	// eof is true once body has nothing more.
+	eof bool
 }
-// openBlob starts the stream of a file and reads its metadata.
+// openBlob opens a file of the repository.
-func (s *Server) openBlob(ctx context.Context, repo string, t target) (*blobStream, error) {
+func (s *Server) openBlob(ctx context.Context, repo domain.RepoName, t target) (*blobStream, error) {
-	if t.path == "" {
+	info, body, err := s.openBlobAt(ctx, repo, t.rev, t.path)
-		return nil, errNotFound
-	}
-	st, err := s.cfg.Git.GetBlob(ctx, connect.NewRequest(&pb.GetBlobRequest{Repo: repo, Revision: t.rev, Path: t.path}))
 	if err != nil {
 		return nil, err
 	}
-	if !st.Receive() {
+	return &blobStream{body: body, info: info}, nil
-		err := st.Err()
-		_ = st.Close()
-		if err == nil {
-			err = errNotFound
-		}
-		return nil, err
-	}
-	m := st.Msg()
-	return &blobStream{stream: st, info: m.GetInfo(), buf: append([]byte(nil), m.GetChunk()...)}, nil
 }
-func (b *blobStream) close() { _ = b.stream.Close() }
+func (b *blobStream) close() { _ = b.body.Close() }
-// fill reads from the stream until buf holds n bytes or the content ends.
+// fill reads until buf holds n bytes or the content ends.
 func (b *blobStream) fill(n int) error {
+	if b.eof || len(b.buf) >= n {
+		return nil
+	}
 	// One allocation for the whole content, not the doublings of append.
 	if cap(b.buf) < n {
 		b.buf = append(make([]byte, 0, n), b.buf...)
 	}
-	for len(b.buf) < n && b.stream.Receive() {
+	m, err := io.ReadFull(b.body, b.buf[len(b.buf):n])
-		b.buf = append(b.buf, b.stream.Msg().GetChunk()...)
+	b.buf = b.buf[:len(b.buf)+m]
+	if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+		b.eof = true
+		return nil
 	}
-	return b.stream.Err()
+	return err
 }
 // image types: the only images the pages show and raw serves as images.
 	if !ok {
 		return nil, 0, errNotFound
 	}
-	b, err := s.openBlob(ctx, d.name(), t)
+	b, err := s.openBlob(ctx, d.repo.Name, t)
 	if err != nil {
 		return nil, 0, err
 	}
 	if dir == "." {
 		dir = ""
 	}
-	size := b.info.GetSize()
+	size := b.info.Size
 	p := BlobPage{
 		Name:     visibleText(name),
 		RawHref:  repoHref(d.name(), "raw", t.name, t.path),
 		DirHref:  repoHref(d.name(), "tree", t.name, dir),
 		Facts:    []Fact{{Key: "size", Val: humanSize(size)}},
 	}
-	typ := b.info.GetMediaType()
+	typ := b.info.MediaType
 	lang := ""
 	// An image is recognised by its bytes, whatever Git's text rule says.
 	switch {
 	case img != "":
 		p.Image, typ = true, img
-	case b.info.GetBinary():
+	case b.info.Binary:
 		p.Notice = fmt.Sprintf("binary file (%s, %s): not shown. use raw.", typ, humanSize(size))
 	case size > maxCodeBytes:
 		p.Notice = fmt.Sprintf("file too large to show (%s, the limit is %s). use raw.", humanSize(size), humanSize(maxCodeBytes))
 	}
 	p.Facts = append(p.Facts, Fact{Key: "type", Val: lang})
-	if last := s.lastChange(ctx, d.name(), t); last != nil {
+	if last := s.lastChange(ctx, d.repo.Name, t); last != nil {
 		p.Last = last
 	}
 // lastChange is the latest commit that touched the path, nil when it cannot
 // be found (the page does not depend on it).
-func (s *Server) lastChange(ctx context.Context, repo string, t target) *CommitRow {
+func (s *Server) lastChange(ctx context.Context, repo domain.RepoName, t target) *CommitRow {
-	res, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+	res, err := s.commitList(ctx, repo, t.rev, t.path, 1, "")
-		Repo: repo, Revision: t.rev, Path: t.path, PageSize: 1,
+	if err != nil || len(res.Commits) != 1 {
-	}))
-	if err != nil || len(res.Msg.GetCommits()) != 1 {
 		return nil
 	}
-	row := commitRow(repo, res.Msg.GetCommits()[0], s.cfg.Now())
+	row := commitRow(repo.String(), res.Commits[0], s.cfg.Now())
 	return &row
 }

A internal/adapters/web/browse.go +71 -0

@@ -0,0 +1,71 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package web
	4	+
	5	+	import (
	6	+	"context"
	7	+	"io"
	8	+
	9	+	"bnema.dev/ermite/internal/domain"
	10	+	"bnema.dev/ermite/internal/ports"
	11	+	)
	12	+
	13	+	// The reads of the pages go through BrowseService as the caller of the
	14	+	// request. The revisions and paths the URLs carry are text: they are parsed
	15	+	// here, and one the domain refuses is an invalid argument, which the pages
	16	+	// answer like a missing one (fail).
	17	+
	18	+	// commitList reads a page of the history that starts at rev, limited to path
	19	+	// when it is not empty.
	20	+	func (s *Server) commitList(ctx context.Context, repo domain.RepoName, rev, path string, size int, token string) (ports.HistoryPage, error) {
	21	+	r, err := domain.ParseRevision(rev)
	22	+	if err != nil {
	23	+	return ports.HistoryPage{}, err
	24	+	}
	25	+	p, err := domain.ParseTreePath(path)
	26	+	if err != nil {
	27	+	return ports.HistoryPage{}, err
	28	+	}
	29	+	return s.cfg.Browse.ListCommits(ctx, principal(ctx), repo, ports.ListCommitsParams{
	30	+	Revision: r, Path: p, PageSize: size, PageToken: token,
	31	+	})
	32	+	}
	33	+
	34	+	// getTree lists the directory path of the commit rev.
	35	+	func (s *Server) getTree(ctx context.Context, repo domain.RepoName, rev, path string, lastCommit bool) (domain.Tree, error) {
	36	+	r, err := domain.ParseRevision(rev)
	37	+	if err != nil {
	38	+	return domain.Tree{}, err
	39	+	}
	40	+	p, err := domain.ParseTreePath(path)
	41	+	if err != nil {
	42	+	return domain.Tree{}, err
	43	+	}
	44	+	return s.cfg.Browse.GetTree(ctx, principal(ctx), repo, r, p, lastCommit)
	45	+	}
	46	+
	47	+	// getCommit reads a commit with its diff.
	48	+	func (s *Server) getCommit(ctx context.Context, repo domain.RepoName, rev string) (domain.CommitDetail, error) {
	49	+	r, err := domain.ParseRevision(rev)
	50	+	if err != nil {
	51	+	return domain.CommitDetail{}, err
	52	+	}
	53	+	return s.cfg.Browse.GetCommit(ctx, principal(ctx), repo, r)
	54	+	}
	55	+
	56	+	// openBlobAt opens the file path of the commit rev. The caller closes the
	57	+	// body.
	58	+	func (s *Server) openBlobAt(ctx context.Context, repo domain.RepoName, rev, path string) (domain.BlobInfo, io.ReadCloser, error) {
	59	+	r, err := domain.ParseRevision(rev)
	60	+	if err != nil {
	61	+	return domain.BlobInfo{}, nil, err
	62	+	}
	63	+	if path == "" {
	64	+	return domain.BlobInfo{}, nil, errNotFound
	65	+	}
	66	+	p, err := domain.ParseTreePath(path)
	67	+	if err != nil {
	68	+	return domain.BlobInfo{}, nil, err
	69	+	}
	70	+	return s.cfg.Browse.OpenBlob(ctx, principal(ctx), repo, r, p)
	71	+	}

M internal/adapters/web/commit.go +38 -39

 	"strings"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // bothViewsLines is the largest diff, in lines, that is sent in both the
 // commit shows a commit: its message, its totals, the changed files and the
 // diff against the first parent. ?view=split selects the split layout.
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter builds the commit page from the use case results; no rule is decided here
 func (s *Server) commit(ctx context.Context, r *http.Request) (templ.Component, int, error) {
 	sha := r.PathValue("sha")
 	if !isCommitID(sha) {
 	if err != nil {
 		return nil, 0, err
 	}
-	res, err := s.cfg.Git.GetCommit(ctx, connect.NewRequest(&pb.GetCommitRequest{Repo: d.name(), Revision: sha}))
+	res, err := s.getCommit(ctx, d.repo.Name, sha)
 	if err != nil {
 		return nil, 0, err
 	}
-	c := res.Msg.GetCommit()
+	c := res.Commit
-	if c == nil {
+	cid := c.ID.String()
-		return nil, 0, errNotFound
-	}
-	stats := res.Msg.GetStats()
 	now := s.cfg.Now()
 	p := CommitPage{
-		SHA: c.GetId(), Short: short(c.GetId()),
+		SHA: cid, Short: short(cid),
-		Subject: visibleText(c.GetSummary()), Body: commitBody(c),
+		Subject: visibleText(c.Summary), Body: commitBody(c),
-		Author: person(c.GetAuthor(), now),
+		Author: person(c.Author, now),
-		Merge:  len(c.GetParentIds()) > 1,
+		Merge:  len(c.Parents) > 1,
-		Root:   len(c.GetParentIds()) == 0,
+		Root:   len(c.Parents) == 0,
-		NFiles: int(stats.GetFilesChanged()),
+		NFiles: res.Stats.FilesChanged,
-		Adds:   int(stats.GetAdditions()),
+		Adds:   res.Stats.Additions,
-		Dels:   int(stats.GetDeletions()),
+		Dels:   res.Stats.Deletions,
-		Files:  diffFiles(res.Msg.GetDiff().GetFiles()),
+		Files:  diffFiles(res.Diff.Files),
 	}
-	if cm := person(c.GetCommitter(), now); cm != p.Author || c.GetCommitter().GetEmail() != c.GetAuthor().GetEmail() {
+	if cm := person(c.Committer, now); cm != p.Author || c.Committer.Email != c.Author.Email {
 		p.Committer = &cm
 	}
-	for _, id := range c.GetParentIds() {
+	for _, pid := range c.Parents {
+		id := pid.String()
 		p.Parents = append(p.Parents, Link{Label: short(id), Href: repoHref(d.name(), "commit", id)})
 	}
 	for _, b := range d.branches {
-		if b.GetCommitId() == c.GetId() {
+		if b.CommitID.String() == cid {
-			p.Refs = append(p.Refs, b.GetShortName())
+			p.Refs = append(p.Refs, b.ShortName)
 		}
 	}
 	for _, t := range d.tags {
-		if t.GetCommitId() == c.GetId() {
+		if t.CommitID.String() == cid {
-			p.Refs = append(p.Refs, "tag: "+t.GetShortName())
+			p.Refs = append(p.Refs, "tag: "+t.ShortName)
 		}
 	}
-	p.Note = diffNote(res.Msg.GetDiff(), len(p.Files), p.NFiles)
+	p.Note = diffNote(res.Diff, len(p.Files), p.NFiles)
 	lines, invisible := diffLines(p.Files)
 	p.Invisible = invisible
-	base := repoHref(d.name(), "commit", c.GetId())
+	base := repoHref(d.name(), "commit", cid)
 	p.DiffView = newDiffView(r, lines, base+"?view=unified", base+"?view=split")
 	l := s.repoLayout(ctx, d, "commits")
 	l.Title = p.Short + " " + p.Subject + " · " + d.name() + " · " + s.instance
-	pinRef(&l, target{rev: c.GetId(), name: p.Short, detached: true})
+	pinRef(&l, target{rev: cid, name: p.Short, detached: true})
 	history := repoHref(d.name())
 	if d.head != nil {
-		history = repoHref(d.name(), "commits", d.head.GetShortName())
+		history = repoHref(d.name(), "commits", d.head.ShortName)
 	}
 	l.Crumbs = []Crumb{
 		{Label: d.name(), Href: repoHref(d.name())},
 }
 // person converts a signature.
-func person(s *pb.Signature, now time.Time) Person {
+func person(s domain.Signature, now time.Time) Person {
-	p := Person{Name: visibleText(s.GetName())}
+	p := Person{Name: visibleText(s.Name)}
-	p.When, p.WhenAt = whenOf(now, s.GetTime())
+	p.When, p.WhenAt = whenOf(now, s.Time)
-	if t := s.GetTime(); t.IsValid() {
+	if !s.Time.IsZero() {
-		p.Abs = absolute(t.AsTime())
+		p.Abs = absolute(s.Time)
 	}
 	return p
 }
 // commitBody is the message without its first line, for display.
-func commitBody(c *pb.Commit) string {
+func commitBody(c domain.Commit) string {
-	msg := strings.ReplaceAll(c.GetMessage(), "\r\n", "\n")
+	msg := strings.ReplaceAll(c.Message, "\r\n", "\n")
 	_, body, _ := strings.Cut(msg, "\n")
 	return messageText(strings.TrimSpace(body))
 }
 // diffNote says what is missing from an incomplete diff, "" for a complete one.
-func diffNote(d *pb.Diff, shown, total int) string {
+func diffNote(d domain.Diff, shown, total int) string {
-	if !d.GetTruncated() {
+	if !d.Truncated {
 		return ""
 	}
 	var parts []string
 		parts = append(parts, plural(total-shown, "file is", "files are")+" not listed")
 	}
 	cut := 0
-	for _, f := range d.GetFiles() {
+	for _, f := range d.Files {
-		if f.GetTruncated() {
+		if f.Truncated {
 			cut++
 		}
 	}

M internal/adapters/web/commits.go +13 -16

 	"net/url"
 	"path"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // commitsPerPage is how many commits one page of history lists.
 }
 // commits lists the history of a ref, newest first, a page at a time, with
-// an optional path to limit it to. The page token of the API travels in the
+// an optional path to limit it to. The page token of the use case travels in the
 // "page" query parameter.
 func (s *Server) commits(ctx context.Context, r *http.Request) (templ.Component, int, error) {
 	d, err := s.loadRepo(ctx, r.PathValue("repo"))
 		return nil, 0, errNotFound
 	}
 	token := r.URL.Query().Get("page")
-	res, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+	res, err := s.commitList(ctx, d.repo.Name, sel.rev, sel.path, commitsPerPage, token)
-		Repo: d.name(), Revision: sel.rev, Path: sel.path, PageSize: commitsPerPage, PageToken: token,
-	}))
 	if err != nil {
 		return nil, 0, err
 	}
-	cs := res.Msg.GetCommits()
+	cs := res.Commits
 	if len(cs) == 0 && token == "" && sel.path != "" {
 		// Git answers an empty history for a path that never existed.
 		return nil, 0, errNotFound
 	p := CommitsPage{Ref: sel.name, Path: visibleText(sel.path), Count: len(cs)}
 	base := repoHref(d.name(), "commits", sel.name, sel.path)
-	if t := res.Msg.GetNextPageToken(); t != "" {
+	if t := res.NextPageToken; t != "" {
 		p.Older = base + "?page=" + url.QueryEscape(t)
 	}
 	if token != "" {
 }
 // fillDays groups the commits of a page by day and lists the refs among them.
-func (s *Server) fillDays(p *CommitsPage, d *repoData, cs []*pb.Commit) {
+func (s *Server) fillDays(p *CommitsPage, d *repoData, cs []domain.Commit) {
 	now := s.cfg.Now()
 	branchesAt, tagsAt := namesAt(d.branches), namesAt(d.tags)
 	for i, c := range cs {
 		row := commitRow(d.name(), c, now)
 		row.ID, row.Cursor = "c-"+row.Short, i == 0
-		row.Branches, row.Tags = branchesAt[c.GetId()], tagsAt[c.GetId()]
+		row.Branches, row.Tags = branchesAt[c.ID.String()], tagsAt[c.ID.String()]
 		day := "unknown date"
-		if t := c.GetCommitter().GetTime(); t.IsValid() {
+		if t := c.Committer.Time; !t.IsZero() {
-			day = t.AsTime().UTC().Format("2006-01-02")
+			day = t.UTC().Format("2006-01-02")
 		}
 		if n := len(p.Days); n == 0 || p.Days[n-1].Day != day {
 			p.Days = append(p.Days, DayGroup{Day: day})
 	if dir == "." {
 		dir = ""
 	}
-	tree, err := s.cfg.Git.GetTree(ctx, connect.NewRequest(&pb.GetTreeRequest{Repo: d.name(), Revision: sel.rev, Path: dir}))
+	tree, err := s.getTree(ctx, d.repo.Name, sel.rev, dir, false)
 	if err != nil {
 		return nil
 	}
-	for _, e := range tree.Msg.GetEntries() {
+	for _, e := range tree.Entries {
-		if e.GetPath() != sel.path {
+		if e.Path != sel.path {
 			continue
 		}
-		if e.GetKind() == pb.EntryKind_ENTRY_KIND_DIRECTORY {
+		if e.Kind == domain.EntryDirectory {
 			return &Link{Label: "open", Href: repoHref(d.name(), "tree", sel.name, sel.path)}
 		}
 		return &Link{Label: "open", Href: repoHref(d.name(), "blob", sel.name, sel.path)}

M internal/adapters/web/commits_test.go +19 -12

 import (
 	"errors"
-	"net/http"
 	"testing"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
+	"bnema.dev/ermite/internal/ports"
+	"bnema.dev/ermite/internal/ports/mocks"
 )
 func TestIsCommitID(t *testing.T) {
 // branch other than the default one, or none for a commit.
 func TestPinRefMarksCurrent(t *testing.T) {
 	t.Parallel()
-	b, tag := pb.RefKind_REF_KIND_BRANCH, pb.RefKind_REF_KIND_TAG
+	b, tag := domain.RefKindBranch, domain.RefKindTag
+	name, err := domain.ParseRepoName("demo")
+	require.NoError(t, err)
 	d := &repoData{
-		repo:     &pb.Repo{Name: "demo", DefaultBranch: "main"},
+		repo:     ports.RepoView{Repo: domain.Repo{Name: name}, DefaultBranch: "main"},
-		branches: []*pb.Ref{ref(b, "main"), ref(b, "side")},
+		branches: []domain.Ref{ref(b, "main"), ref(b, "side")},
-		tags:     []*pb.Ref{ref(tag, "v1")},
+		tags:     []domain.Ref{ref(tag, "v1")},
 	}
-	d.head = d.branches[0]
+	d.head = &d.branches[0]
+	// The list of the other repositories is not reachable: the layout does
+	// without it.
+	repos := mocks.NewRepoService(t)
+	repos.EXPECT().ListPage(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(ports.RepoPage{}, errors.New("no list"))
 	s, err := New(Config{
-		Repos: failing{err: errors.New("no list")}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
+		Repos: repos, Browse: mocks.NewBrowseService(t),
 		PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
 	})
 	require.NoError(t, err)
 		heads, tags []string
 		ref, short  string
 	}{
-		{"", []string{"main"}, nil, "main", "c-main"},
+		{"", []string{"main"}, nil, "main", short(commitOf("main").String())},
-		{"v1", nil, []string{"v1"}, "v1", "c-v1"},
+		{"v1", nil, []string{"v1"}, "v1", short(commitOf("v1").String())},
-		{"side", []string{"side"}, nil, "side", "c-side"},
+		{"side", []string{"side"}, nil, "side", short(commitOf("side").String())},
 		{"abcdef0123", nil, nil, "detached", "abcdef0"},
 	} {
 		tg, ok := d.locate(tt.rest)

M internal/adapters/web/compare.go +43 -43

 	"net/http"
 	"slices"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // compareDepth bounds the commits read on each side to find where a branch
 // own diff is then the whole change). Otherwise it lists the commits, which
 // link to their own diffs, and says the whole diff comes with the merge
 // request.
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter builds the compare page from the use case results; the merge rules are the use case's
 func (s *Server) compare(ctx context.Context, r *http.Request) (templ.Component, int, error) {
 	d, err := s.loadRepo(ctx, r.PathValue("repo"))
 	if err != nil {
 	if !ok || rest != "" || d.head == nil {
 		return nil, 0, errNotFound
 	}
-	tgt := d.head
+	tgt := *d.head
 	name := d.name()
 	p := ComparePage{
-		Source: visibleText(src.GetShortName()), Target: visibleText(tgt.GetShortName()),
+		Source: visibleText(src.ShortName), Target: visibleText(tgt.ShortName),
-		SourceHref: repoHref(name, "tree", src.GetShortName()), TargetHref: repoHref(name, "tree", tgt.GetShortName()),
+		SourceHref: repoHref(name, "tree", src.ShortName), TargetHref: repoHref(name, "tree", tgt.ShortName),
 		CLI: Clone{ID: "cli-create", Lines: []string{
-			"ermite mr create " + shellWord(name) + " --source " + shellWord(src.GetShortName()) + " --title <title>",
+			"ermite mr create " + shellWord(name) + " --source " + shellWord(src.ShortName) + " --title <title>",
 		}},
 	}
-	same := src.GetShortName() == tgt.GetShortName()
+	same := src.ShortName == tgt.ShortName
-	var ahead []*pb.Commit
+	var ahead []domain.Commit
 	exact, behind := false, false
 	if same {
 		p.Note = "this is the default branch: there is nothing to compare it with."
 		p.AheadText = "0 commits"
 	} else {
-		ahead, exact, behind, err = s.commitsAhead(ctx, name, src.GetCommitId(), tgt.GetCommitId())
+		ahead, exact, behind, err = s.commitsAhead(ctx, d.repo.Name, src.CommitID.String(), tgt.CommitID.String())
 		if err != nil {
 			return nil, 0, err
 		}
 	// The exact diff: one commit on top of the tip of the target.
 	if exact && !behind && len(ahead) == 1 {
-		res, err := s.cfg.Git.GetCommit(ctx, connect.NewRequest(&pb.GetCommitRequest{Repo: name, Revision: ahead[0].GetId()}))
+		res, err := s.getCommit(ctx, d.repo.Name, ahead[0].ID.String())
 		if err != nil {
 			return nil, 0, err
 		}
 		p.HasDiff = true
-		p.Files = diffFiles(res.Msg.GetDiff().GetFiles())
+		p.Files = diffFiles(res.Diff.Files)
-		p.NFiles, p.Adds, p.Dels = int(res.Msg.GetStats().GetFilesChanged()), int(res.Msg.GetStats().GetAdditions()), int(res.Msg.GetStats().GetDeletions())
+		p.NFiles, p.Adds, p.Dels = res.Stats.FilesChanged, res.Stats.Additions, res.Stats.Deletions
-		if n := diffNote(res.Msg.GetDiff(), len(p.Files), p.NFiles); n != "" {
+		if n := diffNote(res.Diff, len(p.Files), p.NFiles); n != "" {
 			p.Note = n
 		}
 		lines, invisible := diffLines(p.Files)
 		p.Invisible = invisible
-		self := repoHref(name, "compare", src.GetShortName())
+		self := repoHref(name, "compare", src.ShortName)
 		p.DiffView = newDiffView(r, lines, self+"?view=unified", self+"?view=split")
 	} else if len(ahead) > 1 && exact {
 		if p.Note == "" {
 	}
 	// An open request for the same pair, or the form to open one.
-	var existing *pb.MergeRequest
+	var existing *domain.MergeRequest
 	if !same {
-		existing, err = s.openRequestFor(ctx, name, src.GetShortName(), tgt.GetShortName())
+		existing, err = s.openRequestFor(ctx, d.repo.Name, src.ShortName, tgt.ShortName)
 		if err != nil {
 			return nil, 0, err
 		}
 	}
 	switch {
 	case existing != nil:
-		p.Existing = &Link{Label: "!" + itoa(int(existing.GetNumber())) + " " + visibleText(existing.GetTitle()), Href: mrHref(name, existing.GetNumber())}
+		p.Existing = &Link{Label: "!" + itoa(int(existing.Number)) + " " + visibleText(existing.Title.String()), Href: mrHref(name, existing.Number)}
 	case SignedIn(ctx) && !same && len(ahead) > 0:
 		title := ""
 		if len(ahead) == 1 {
-			title = ahead[0].GetSummary()
+			title = ahead[0].Summary
 		} else {
-			title = ahead[len(ahead)-1].GetSummary()
+			title = ahead[len(ahead)-1].Summary
 		}
 		p.Create = &CreateForm{
-			Action: mrBase(name), Source: src.GetShortName(), Target: tgt.GetShortName(),
+			Action: mrBase(name), Source: src.ShortName, Target: tgt.ShortName,
 			Title: cutRunes(title, 120),
 		}
 	}
 	l := s.repoLayout(ctx, d, "merge-requests")
 	l.Title = "compare " + p.Source + " · " + name + " · " + s.instance
-	pinRef(&l, target{rev: src.GetCommitId(), name: src.GetShortName()})
+	pinRef(&l, target{rev: src.CommitID.String(), name: src.ShortName})
 	l.Crumbs[0].Current = false
 	l.Crumbs = append(l.Crumbs,
 		Crumb{Label: "merge requests", Href: mrBase(name)},
 // first. exact is false when the walk gave up before finding where the source
 // meets the target. behind is true when the target has commits the source
 // lacks (the tip of the target is not an ancestor of the source).
-func (s *Server) commitsAhead(ctx context.Context, repo, srcTip, tgtTip string) (ahead []*pb.Commit, exact, behind bool, err error) {
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter walks the history pages the use case returns to find where the branch left its target; the page needs it, the forge decides nothing
+func (s *Server) commitsAhead(ctx context.Context, repo domain.RepoName, srcTip, tgtTip string) (ahead []domain.Commit, exact, behind bool, err error) {
 	if srcTip == tgtTip {
 		return nil, true, false, nil
 	}
 	onTarget := map[string]bool{}
 	tokenT := ""
 	for len(onTarget) < compareDepth {
-		res, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+		res, err := s.commitList(ctx, repo, tgtTip, "", pageSize, tokenT)
-			Repo: repo, Revision: tgtTip, PageSize: pageSize, PageToken: tokenT,
-		}))
 		if err != nil {
 			return nil, false, false, err
 		}
-		for _, c := range res.Msg.GetCommits() {
+		for _, c := range res.Commits {
-			onTarget[c.GetId()] = true
+			onTarget[c.ID.String()] = true
 		}
-		if tokenT = res.Msg.GetNextPageToken(); tokenT == "" {
+		if tokenT = res.NextPageToken; tokenT == "" {
 			break
 		}
 	}
 	token := ""
 	for n := 0; n < compareDepth; {
-		res, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+		res, err := s.commitList(ctx, repo, srcTip, "", pageSize, token)
-			Repo: repo, Revision: srcTip, PageSize: pageSize, PageToken: token,
-		}))
 		if err != nil {
 			return nil, false, false, err
 		}
-		for _, c := range res.Msg.GetCommits() {
+		for _, c := range res.Commits {
 			n++
-			if onTarget[c.GetId()] {
+			if onTarget[c.ID.String()] {
 				// The first commit of the source that the target has: where the
 				// branch left it. The target moved on when this is not its tip.
-				return ahead, true, c.GetId() != tgtTip, nil
+				return ahead, true, c.ID.String() != tgtTip, nil
 			}
 			ahead = append(ahead, c)
 		}
-		if token = res.Msg.GetNextPageToken(); token == "" {
+		if token = res.NextPageToken; token == "" {
 			// The whole history of the source is ahead: no common history.
 			return ahead, true, true, nil
 		}
 	}
-	return ahead, false, !slices.ContainsFunc(ahead, func(c *pb.Commit) bool { return c.GetId() == tgtTip }), nil
+	return ahead, false, !slices.ContainsFunc(ahead, func(c domain.Commit) bool { return c.ID.String() == tgtTip }), nil
 }
 // openRequestFor finds the open merge request with this source and target.
-func (s *Server) openRequestFor(ctx context.Context, repo, source, target string) (*pb.MergeRequest, error) {
+func (s *Server) openRequestFor(ctx context.Context, repo domain.RepoName, source, target string) (*domain.MergeRequest, error) {
 	token := ""
 	for range maxOpenPages {
-		res, err := s.cfg.MergeRequests.ListMergeRequests(ctx, connect.NewRequest(&pb.ListMergeRequestsRequest{
+		res, err := s.cfg.MergeRequests.List(ctx, principal(ctx), repo, ports.ListMergeRequestsParams{
-			Repo: repo, State: pb.MergeRequestState_MERGE_REQUEST_STATE_OPEN, PageSize: pageSize, PageToken: token,
+			State: domain.MRStateOpen, PageSize: pageSize, PageToken: token,
-		}))
+		})
 		if err != nil {
 			return nil, err
 		}
-		for _, m := range res.Msg.GetMergeRequests() {
+		for i := range res.MergeRequests {
-			if m.GetSourceBranch() == source && m.GetTargetBranch() == target {
+			if m := &res.MergeRequests[i]; m.Source == source && m.Target == target {
 				return m, nil
 			}
 		}
-		if token = res.Msg.GetNextPageToken(); token == "" {
+		if token = res.NextPageToken; token == "" {
 			break
 		}
 	}

M internal/adapters/web/compress_test.go +3 -8

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
+	"bnema.dev/ermite/internal/ports/mocks"
 )
 func TestAcceptsGzip(t *testing.T) {
 func newBareServer(t *testing.T) *Server {
 	t.Helper()
-	srv, err := New(Config{
+	return newTestServer(t, Config{Repos: reposFailing(t, errors.New("x")), Browse: mocks.NewBrowseService(t)})
-		Repos: failing{err: errors.New("x")}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
-		PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
-	})
-	require.NoError(t, err)
-	return srv
 }
 func gunzip(t *testing.T, b []byte) string {
 // The event stream is never compressed, even for a client that accepts gzip.
 func TestEventsNotCompressed(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{})}
+	f := &watchProbe{release: make(chan struct{})}
 	ts := eventsServer(t, f, 20*time.Millisecond, 0)
 	resp, _ := open(t, ts, "topic=home", map[string]string{"Accept-Encoding": "gzip"})
 	require.Equal(t, http.StatusOK, resp.StatusCode)

M internal/adapters/web/diff.go +50 -50


@@ -13,7 +13,7 @@ import (
13			13
14		"github.com/a-h/templ"	14		"github.com/a-h/templ"
15			15
16	-	pb "bnema.dev/ermite-api/gen/ermite"	16	+	"bnema.dev/ermite/internal/domain"
17		)	17		)
18			18
19		// Seg is a piece of a line of code: plain text, or the visible marker of an	19		// Seg is a piece of a line of code: plain text, or the visible marker of an

@@ -101,11 +101,11 @@ type DiffFile struct {
101		Hunks []DiffHunk	101		Hunks []DiffHunk
102		}	102		}
103			103
104	-	func lineNumber(n int32) string {	104	+	func lineNumber(n int) string {
105		if n <= 0 {	105		if n <= 0 {
106		return ""	106		return ""
107		}	107		}
108	-	return itoa(int(n))	108	+	return itoa(n)
109		}	109		}
110			110
111		// segments splits a line of code into plain text and markers. One trailing	111		// segments splits a line of code into plain text and markers. One trailing

@@ -197,79 +197,79 @@ func changeBar(add, del, most int) Bar {
197		}	197		}
198			198
199		// statusLetter is the one-letter status of a file.	199		// statusLetter is the one-letter status of a file.
200	-	func statusLetter(s pb.FileStatus) string {	200	+	func statusLetter(s domain.FileStatus) string {
201		switch s {	201		switch s {
202	-	case pb.FileStatus_FILE_STATUS_ADDED:	202	+	case domain.FileAdded:
203		return "A"	203		return "A"
204	-	case pb.FileStatus_FILE_STATUS_DELETED:	204	+	case domain.FileDeleted:
205		return "D"	205		return "D"
206	-	case pb.FileStatus_FILE_STATUS_RENAMED:	206	+	case domain.FileRenamed:
207		return "R"	207		return "R"
208	-	case pb.FileStatus_FILE_STATUS_COPIED:	208	+	case domain.FileCopied:
209		return "C"	209		return "C"
210	-	case pb.FileStatus_FILE_STATUS_TYPE_CHANGED:	210	+	case domain.FileTypeChanged:
211		return "T"	211		return "T"
212		}	212		}
213		return "M"	213		return "M"
214		}	214		}
215			215
216		// hunkHeader is the "@@ -a,b +c,d @@ context" line of a hunk.	216		// hunkHeader is the "@@ -a,b +c,d @@ context" line of a hunk.
217	-	func hunkHeader(h *pb.Hunk) string {	217	+	func hunkHeader(h domain.Hunk) string {
218	-	s := fmt.Sprintf("@@ -%d,%d +%d,%d @@", h.GetOldStart(), h.GetOldLines(), h.GetNewStart(), h.GetNewLines())	218	+	s := fmt.Sprintf("@@ -%d,%d +%d,%d @@", h.OldStart, h.OldLines, h.NewStart, h.NewLines)
219	-	if t := h.GetHeader(); t != "" {	219	+	if t := h.Header; t != "" {
220		s += " " + visibleText(strings.TrimSpace(t))	220		s += " " + visibleText(strings.TrimSpace(t))
221		}	221		}
222		return s	222		return s
223		}	223		}
224			224
225	-	// diffLine converts a line of the API.	225	+	// diffLine converts a line of a hunk.
226	-	func diffLine(l *pb.Line) DiffLine {	226	+	func diffLine(l domain.Line) DiffLine {
227	-	dl := DiffLine{Segs: segments(l.GetText()), NoEOL: l.GetNoNewlineAtEof(), oldN: int(l.GetOldNumber()), newN: int(l.GetNewNumber())}	227	+	dl := DiffLine{Segs: segments(l.Text), NoEOL: l.NoNewlineAtEOF, oldN: l.OldNumber, newN: l.NewNumber}
228	-	switch l.GetKind() {	228	+	switch l.Kind {
229	-	case pb.LineKind_LINE_KIND_ADDITION:	229	+	case domain.LineAddition:
230	-	dl.Kind, dl.Mark, dl.New = "add", "+", lineNumber(l.GetNewNumber())	230	+	dl.Kind, dl.Mark, dl.New = "add", "+", lineNumber(l.NewNumber)
231	-	case pb.LineKind_LINE_KIND_DELETION:	231	+	case domain.LineDeletion:
232	-	dl.Kind, dl.Mark, dl.Old = "del", "-", lineNumber(l.GetOldNumber())	232	+	dl.Kind, dl.Mark, dl.Old = "del", "-", lineNumber(l.OldNumber)
233		default:	233		default:
234		dl.Kind, dl.Mark = "ctx", " "	234		dl.Kind, dl.Mark = "ctx", " "
235	-	dl.Old, dl.New = lineNumber(l.GetOldNumber()), lineNumber(l.GetNewNumber())	235	+	dl.Old, dl.New = lineNumber(l.OldNumber), lineNumber(l.NewNumber)
236		}	236		}
237		return dl	237		return dl
238		}	238		}
239			239
240		// diffFiles converts the files of a diff for the page.	240		// diffFiles converts the files of a diff for the page.
241	-	func diffFiles(files []*pb.FileDiff) []DiffFile {	241	+	func diffFiles(files []domain.FileDiff) []DiffFile {
242		most := 0	242		most := 0
243		for _, f := range files {	243		for _, f := range files {
244	-	most = max(most, int(f.GetAdditions()+f.GetDeletions()))	244	+	most = max(most, f.Additions+f.Deletions)
245		}	245		}
246		out := make([]DiffFile, 0, len(files))	246		out := make([]DiffFile, 0, len(files))
247		for i, f := range files {	247		for i, f := range files {
248		df := DiffFile{	248		df := DiffFile{
249	-	ID: "f" + itoa(i+1), Status: statusLetter(f.GetStatus()),	249	+	ID: "f" + itoa(i+1), Status: statusLetter(f.Status),
250	-	Add: int(f.GetAdditions()), Del: int(f.GetDeletions()),	250	+	Add: f.Additions, Del: f.Deletions,
251	-	Bar: changeBar(int(f.GetAdditions()), int(f.GetDeletions()), most),	251	+	Bar: changeBar(f.Additions, f.Deletions, most),
252		// A file that is shown in full opens; a file with nothing to read	252		// A file that is shown in full opens; a file with nothing to read
253		// (binary, truncated) stays closed under its note.	253		// (binary, truncated) stays closed under its note.
254	-	Open: len(f.GetHunks()) > 0 && !f.GetTruncated(),	254	+	Open: len(f.Hunks) > 0 && !f.Truncated,
255		}	255		}
256	-	df.Key = f.GetNewPath()	256	+	df.Key = f.NewPath
257	-	switch f.GetStatus() {	257	+	switch f.Status {
258	-	case pb.FileStatus_FILE_STATUS_DELETED:	258	+	case domain.FileDeleted:
259	-	df.Key = f.GetOldPath()	259	+	df.Key = f.OldPath
260	-	df.Path = visibleText(f.GetOldPath())	260	+	df.Path = visibleText(f.OldPath)
261	-	case pb.FileStatus_FILE_STATUS_RENAMED, pb.FileStatus_FILE_STATUS_COPIED:	261	+	case domain.FileRenamed, domain.FileCopied:
262	-	df.Path = visibleText(f.GetOldPath()) + " → " + visibleText(f.GetNewPath())	262	+	df.Path = visibleText(f.OldPath) + " → " + visibleText(f.NewPath)
263		default:	263		default:
264	-	df.Path = visibleText(f.GetNewPath())	264	+	df.Path = visibleText(f.NewPath)
265		}	265		}
266		df.Note = fileNote(f)	266		df.Note = fileNote(f)
267	-	if f.GetBinary() {	267	+	if f.Binary {
268		df.Bar = Bar{Rest: "bin"}	268		df.Bar = Bar{Rest: "bin"}
269		}	269		}
270	-	for _, h := range f.GetHunks() {	270	+	for _, h := range f.Hunks {
271		dh := DiffHunk{Header: hunkHeader(h)}	271		dh := DiffHunk{Header: hunkHeader(h)}
272	-	for _, l := range h.GetLines() {	272	+	for _, l := range h.Lines {
273		dh.Lines = append(dh.Lines, diffLine(l))	273		dh.Lines = append(dh.Lines, diffLine(l))
274		}	274		}
275		dh.Split = pairLines(dh.Lines)	275		dh.Split = pairLines(dh.Lines)

@@ -282,23 +282,23 @@ func diffFiles(files []*pb.FileDiff) []DiffFile {
282			282
283		// fileNote says what the hunks cannot: the kind of change when there is no	283		// fileNote says what the hunks cannot: the kind of change when there is no
284		// text to show, the mode change, the similarity of a rename.	284		// text to show, the mode change, the similarity of a rename.
285	-	func fileNote(f *pb.FileDiff) string {	285	+	func fileNote(f domain.FileDiff) string {
286		var parts []string	286		var parts []string
287		switch {	287		switch {
288	-	case f.GetBinary():	288	+	case f.Binary:
289		parts = append(parts, "binary file: no text diff")	289		parts = append(parts, "binary file: no text diff")
290	-	case f.GetTruncated():	290	+	case f.Truncated:
291	-	parts = append(parts, fmt.Sprintf("diff too large to show (%d lines changed): collapsed", f.GetAdditions()+f.GetDeletions()))	291	+	parts = append(parts, fmt.Sprintf("diff too large to show (%d lines changed): collapsed", f.Additions+f.Deletions))
292		}	292		}
293	-	if f.GetOldMode() != 0 && f.GetNewMode() != 0 && f.GetOldMode() != f.GetNewMode() {	293	+	if f.OldMode != 0 && f.NewMode != 0 && f.OldMode != f.NewMode {
294	-	parts = append(parts, fmt.Sprintf("mode %06o → %06o", f.GetOldMode(), f.GetNewMode()))	294	+	parts = append(parts, fmt.Sprintf("mode %06o → %06o", f.OldMode, f.NewMode))
295		}	295		}
296	-	switch f.GetStatus() {	296	+	switch f.Status {
297	-	case pb.FileStatus_FILE_STATUS_RENAMED:	297	+	case domain.FileRenamed:
298	-	parts = append(parts, fmt.Sprintf("renamed, %d%% similar", f.GetSimilarity()))	298	+	parts = append(parts, fmt.Sprintf("renamed, %d%% similar", f.Similarity))
299	-	case pb.FileStatus_FILE_STATUS_COPIED:	299	+	case domain.FileCopied:
300	-	parts = append(parts, fmt.Sprintf("copied, %d%% similar", f.GetSimilarity()))	300	+	parts = append(parts, fmt.Sprintf("copied, %d%% similar", f.Similarity))
301	-	case pb.FileStatus_FILE_STATUS_TYPE_CHANGED:	301	+	case domain.FileTypeChanged:
302		parts = append(parts, "type changed")	302		parts = append(parts, "type changed")
303		}	303		}
304		return strings.Join(parts, " · ")	304		return strings.Join(parts, " · ")

M internal/adapters/web/diff_test.go +36 -16

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // Trojan Source (ADR 0017): direction controls, zero-width and control
 	assert.Equal(t, "l1\nl<U+200B>2", messageText("l1\r\nl\u200b2\n\n"))
 }
-func line(kind pb.LineKind, oldN, newN int32, text string) *pb.Line {
+func line(kind domain.LineKind, oldN, newN int, text string) domain.Line {
-	return &pb.Line{Kind: kind, OldNumber: oldN, NewNumber: newN, Text: text}
+	return domain.Line{Kind: kind, OldNumber: oldN, NewNumber: newN, Text: text}
 }
 // The split view lines a run of deletions up with the additions after it;
 // opposite side.
 func TestPairLines(t *testing.T) {
 	t.Parallel()
-	ctx, add, del := pb.LineKind_LINE_KIND_CONTEXT, pb.LineKind_LINE_KIND_ADDITION, pb.LineKind_LINE_KIND_DELETION
+	ctx, add, del := domain.LineContext, domain.LineAddition, domain.LineDeletion
 	var ls []DiffLine
-	for _, l := range []*pb.Line{
+	for _, l := range []domain.Line{
 		line(ctx, 1, 1, "c"),
 		line(del, 2, 0, "d1"), line(del, 3, 0, "d2"), line(del, 4, 0, "d3"),
 		line(add, 0, 2, "a1"),
 func TestFileNotes(t *testing.T) {
 	t.Parallel()
-	assert.Equal(t, "binary file: no text diff", fileNote(&pb.FileDiff{Binary: true, Status: pb.FileStatus_FILE_STATUS_MODIFIED}))
+	tests := []struct {
-	assert.Equal(t, "mode 100644 → 100755", fileNote(&pb.FileDiff{Status: pb.FileStatus_FILE_STATUS_MODIFIED, OldMode: 0o100644, NewMode: 0o100755}))
+		name string
-	assert.Empty(t, fileNote(&pb.FileDiff{Status: pb.FileStatus_FILE_STATUS_ADDED, NewMode: 0o100644}), "an added file has no mode change")
+		file domain.FileDiff
-	assert.Equal(t, "renamed, 90% similar", fileNote(&pb.FileDiff{Status: pb.FileStatus_FILE_STATUS_RENAMED, Similarity: 90, OldMode: 0o100644, NewMode: 0o100644}))
+		want string // a substring; empty means no note at all
-	assert.Contains(t, fileNote(&pb.FileDiff{Truncated: true, Additions: 2500}), "too large")
+		eq   bool   // want is the whole note
+	}{
+		{"binary", domain.FileDiff{Binary: true, Status: domain.FileModified}, "binary file: no text diff", true},
+		{"mode change", domain.FileDiff{Status: domain.FileModified, OldMode: 0o100644, NewMode: 0o100755}, "mode 100644 → 100755", true},
+		{"an added file has no mode change", domain.FileDiff{Status: domain.FileAdded, NewMode: 0o100644}, "", true},
+		{"rename", domain.FileDiff{Status: domain.FileRenamed, Similarity: 90, OldMode: 0o100644, NewMode: 0o100644}, "renamed, 90% similar", true},
+		{"copy", domain.FileDiff{Status: domain.FileCopied, Similarity: 80}, "copied, 80% similar", true},
+		{"type change", domain.FileDiff{Status: domain.FileTypeChanged}, "type changed", true},
+		{"truncated", domain.FileDiff{Truncated: true, Additions: 2500}, "too large", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got := fileNote(tt.file)
+			if tt.eq {
+				assert.Equal(t, tt.want, got)
+				return
+			}
+			assert.Contains(t, got, tt.want)
+		})
+	}
 }
 func TestDiffFilesPaths(t *testing.T) {
 	t.Parallel()
-	fs := diffFiles([]*pb.FileDiff{
+	fs := diffFiles([]domain.FileDiff{
-		{Status: pb.FileStatus_FILE_STATUS_ADDED, NewPath: "a.go", Additions: 1, Hunks: []*pb.Hunk{{Lines: []*pb.Line{line(pb.LineKind_LINE_KIND_ADDITION, 0, 1, "x")}}}},
+		{Status: domain.FileAdded, NewPath: "a.go", Additions: 1, Hunks: []domain.Hunk{{Lines: []domain.Line{line(domain.LineAddition, 0, 1, "x")}}}},
-		{Status: pb.FileStatus_FILE_STATUS_DELETED, OldPath: "b.go", Deletions: 1},
+		{Status: domain.FileDeleted, OldPath: "b.go", Deletions: 1},
-		{Status: pb.FileStatus_FILE_STATUS_RENAMED, OldPath: "c\u202e.go", NewPath: "d.go"},
+		{Status: domain.FileRenamed, OldPath: "c\u202e.go", NewPath: "d.go"},
-		{Status: pb.FileStatus_FILE_STATUS_MODIFIED, NewPath: "big.go", Truncated: true, Additions: 3000},
+		{Status: domain.FileModified, NewPath: "big.go", Truncated: true, Additions: 3000},
 	})
 	assert.Equal(t, "a.go", fs[0].Path)
 	assert.True(t, fs[0].Open)
 func TestCodeLine(t *testing.T) {
 	t.Parallel()
 	var b strings.Builder
-	ln := diffLine(&pb.Line{Kind: pb.LineKind_LINE_KIND_ADDITION, NewNumber: 1, Text: "a <b> \u202e c  d", NoNewlineAtEof: true})
+	ln := diffLine(domain.Line{Kind: domain.LineAddition, NewNumber: 1, Text: "a <b> \u202e c  d", NoNewlineAtEOF: true})
 	require.NoError(t, codeLine(ln).Render(context.Background(), &b))
 	assert.Equal(t, `a &lt;b&gt; <span class="inv" title="invisible character">&lt;U+202E&gt;</span> c  d`+
 		`<span class="eol" title="no newline at end of file">`+noEOL+`</span>`, b.String())

M internal/adapters/web/errors_test.go +141 -48


@@ -6,41 +6,27 @@ import (
6		"bytes"	6		"bytes"
7		"context"	7		"context"
8		"errors"	8		"errors"
			9	+	"fmt"
9		"net/http"	10		"net/http"
10		"net/http/httptest"	11		"net/http/httptest"
11		"regexp"	12		"regexp"
12		"testing"	13		"testing"
13			14
14	-	"connectrpc.com/connect"
15		"github.com/bnema/zerowrap"	15		"github.com/bnema/zerowrap"
16		"github.com/stretchr/testify/assert"	16		"github.com/stretchr/testify/assert"
			17	+	"github.com/stretchr/testify/mock"
17		"github.com/stretchr/testify/require"	18		"github.com/stretchr/testify/require"
18			19
19	-	pb "bnema.dev/ermite-api/gen/ermite"	20	+	"bnema.dev/ermite/internal/domain"
20	-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"	21	+	"bnema.dev/ermite/internal/ports"
			22	+	"bnema.dev/ermite/internal/ports/mocks"
21		)	23		)
22			24
23	-	// failing is a repository client that fails every call with err.	25	+	// serve asks the web for path while every read of a repository fails with err,
24	-	type failing struct {	26	+	// and returns the answer and what was logged.
25	-	ermiteconnect.RepoServiceClient
26	-	err error
27	-	}
28	-
29	-	func (f failing) ListRepos(context.Context, connect.Request[pb.ListReposRequest]) (connect.Response[pb.ListReposResponse], error) {
30	-	return nil, f.err
31	-	}
32	-
33	-	func (f failing) GetRepo(context.Context, connect.Request[pb.GetRepoRequest]) (connect.Response[pb.GetRepoResponse], error) {
34	-	return nil, f.err
35	-	}
36	-
37		func serve(t testing.T, err error, path string) (httptest.ResponseRecorder, string) {	27		func serve(t testing.T, err error, path string) (httptest.ResponseRecorder, string) {
38		t.Helper()	28		t.Helper()
39	-	srv, nerr := New(Config{	29	+	srv := newTestServer(t, Config{Repos: reposFailing(t, err), Browse: mocks.NewBrowseService(t)})
40	-	Repos: failing{err: err}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
41	-	PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
42	-	})
43	-	require.NoError(t, nerr)
44		var logs bytes.Buffer	30		var logs bytes.Buffer
45		ctx := zerowrap.WithCtx(context.Background(), zerowrap.New(zerowrap.Config{Level: "debug", Format: "json", Output: &logs}))	31		ctx := zerowrap.WithCtx(context.Background(), zerowrap.New(zerowrap.Config{Level: "debug", Format: "json", Output: &logs}))
46		rec := httptest.NewRecorder()	32		rec := httptest.NewRecorder()

@@ -48,39 +34,146 @@ func serve(t testing.T, err error, path string) (httptest.ResponseRecorder, st
48		return rec, logs.String()	34		return rec, logs.String()
49		}	35		}
50			36
51	-	// Errors of the API: not found (and an invalid name) are the 404 page, any	37	+	// Errors of the use cases: not found (and an invalid name) are the 404 page, a
52	-	// other is the 500 page with an id that the log carries.	38	+	// visitor that left gets nothing, any other is the 500 page with an id that
			39	+	// the log carries.
53		func TestErrorPages(t *testing.T) {	40		func TestErrorPages(t *testing.T) {
54		t.Parallel()	41		t.Parallel()
55	-	rec, logs := serve(t, connect.NewError(connect.CodeNotFound, errors.New("repository not found")), "/gone")	42	+	tests := []struct {
56	-	assert.Equal(t, http.StatusNotFound, rec.Code)	43	+	name string
57	-	assert.Contains(t, rec.Body.String(), "not found")	44	+	err error
58	-	assert.Empty(t, logs, "a 404 is not an error")	45	+	path string
			46	+	want int
			47	+	}{
			48	+	{"not found", fmt.Errorf("repository: %w", domain.ErrNotFound), "/gone", http.StatusNotFound},
			49	+	{"invalid repository name", domain.ErrInvalidName, "/Bad", http.StatusNotFound},
			50	+	{"invalid argument", domain.ErrInvalid, "/demo", http.StatusNotFound},
			51	+	{"invalid page token", domain.ErrInvalidPageToken, "/demo", http.StatusNotFound},
			52	+	{"invalid revision", domain.ErrInvalidRevision, "/demo", http.StatusNotFound},
			53	+	{"invalid path", domain.ErrInvalidPath, "/demo", http.StatusNotFound},
			54	+	{"internal", errors.New("dial tcp 10.0.0.5: kv exploded"), "/demo", http.StatusInternalServerError},
			55	+	{"internal on the home page", errors.New("kv exploded on the list"), "/", http.StatusInternalServerError},
			56	+	{"forbidden is not a page of its own", domain.ErrForbidden, "/demo", http.StatusInternalServerError},
			57	+	{"resource exhausted", domain.ErrResourceExhausted, "/demo", http.StatusInternalServerError},
			58	+	{"deadline", context.DeadlineExceeded, "/demo", http.StatusInternalServerError},
			59	+	}
			60	+	for _, tt := range tests {
			61	+	t.Run(tt.name, func(t *testing.T) {
			62	+	t.Parallel()
			63	+	rec, logs := serve(t, tt.err, tt.path)
			64	+	assert.Equal(t, tt.want, rec.Code)
			65	+	if tt.want == http.StatusNotFound {
			66	+	assert.Contains(t, rec.Body.String(), "not found")
			67	+	assert.NotContains(t, rec.Body.String(), tt.err.Error(), "the cause stays out of the page")
			68	+	assert.Empty(t, logs, "a 404 is not an error")
			69	+	return
			70	+	}
			71	+	assert.Equal(t, "no-cache", rec.Header().Get("Cache-Control"))
			72	+	assert.Contains(t, rec.Body.String(), "internal error")
			73	+	assert.NotContains(t, rec.Body.String(), tt.err.Error(), "the cause stays in the log")
			74	+	m := regexp.MustCompile(`request id: ([0-9a-f]{8})`).FindStringSubmatch(rec.Body.String())
			75	+	require.Len(t, m, 2, "the page shows a request id")
			76	+	assert.Contains(t, logs, m[1], "the log carries the same id")
			77	+	assert.Contains(t, logs, tt.err.Error())
			78	+	})
			79	+	}
			80	+	}
59			81
60	-	rec, _ = serve(t, connect.NewError(connect.CodeInvalidArgument, errors.New("bad name")), "/Bad")	82	+	// A visitor that left gets no page at all.
61	-	assert.Equal(t, http.StatusNotFound, rec.Code)	83	+	func TestCanceledRequestGetsNoPage(t *testing.T) {
62	-	assert.NotContains(t, rec.Body.String(), "bad name")	84	+	t.Parallel()
			85	+	srv := newTestServer(t, Config{Repos: reposFailing(t, context.Canceled), Browse: mocks.NewBrowseService(t)})
			86	+	rec := httptest.NewRecorder()
			87	+	srv.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/demo", nil))
			88	+	assert.Equal(t, http.StatusOK, rec.Code, "nothing was written")
			89	+	assert.Empty(t, rec.Body.String())
			90	+	}
			91	+
			92	+	// The caller of every use case call is the principal of the request: anonymous
			93	+	// without a valid session, the owner with one. A private repository is as
			94	+	// missing for the first as one that does not exist (the 404 page, never a 403).
			95	+	func TestUseCasesGetThePrincipalOfTheRequest(t *testing.T) {
			96	+	t.Parallel()
			97	+	const token = "tok"
			98	+	tests := []struct {
			99	+	name string
			100	+	cookie string
			101	+	want domain.Principal
			102	+	}{
			103	+	{"no cookie is anonymous", "", domain.Anonymous()},
			104	+	{"an invalid session is anonymous", "bad", domain.Anonymous()},
			105	+	{"a valid session is the owner", token, domain.Owner()},
			106	+	}
			107	+	for _, tt := range tests {
			108	+	t.Run(tt.name, func(t *testing.T) {
			109	+	t.Parallel()
			110	+	repos := mocks.NewRepoService(t)
			111	+	// The use case answers with the principal it was given: only the
			112	+	// owner sees the private repository.
			113	+	repos.EXPECT().Get(mock.Anything, tt.want, repoName(t, "secret")).RunAndReturn(
			114	+	func(_ context.Context, p domain.Principal, name domain.RepoName) (domain.Repo, error) {
			115	+	if !p.IsRoot() {
			116	+	return domain.Repo{}, domain.ErrNotFound
			117	+	}
			118	+	return domain.Repo{Name: name, Visibility: domain.VisibilityPrivate}, nil
			119	+	}).Once()
			120	+	if tt.want.IsOwner() {
			121	+	repos.EXPECT().View(mock.Anything, mock.Anything).Return(publicRepo(t, "secret"), nil).Once()
			122	+	repos.EXPECT().ListPage(mock.Anything, tt.want, mock.Anything, mock.Anything).Return(ports.RepoPage{}, nil).Once()
			123	+	}
			124	+	browse := mocks.NewBrowseService(t)
			125	+	if tt.want.IsOwner() {
			126	+	browse.EXPECT().ListRefs(mock.Anything, tt.want, repoName(t, "secret"), mock.Anything).Return(ports.RefPage{}, nil).Once()
			127	+	}
			128	+	srv := newTestServer(t, Config{Repos: repos, Browse: browse, Sessions: newSessions(t, token), Limiter: &countingLimiter{}})
			129	+
			130	+	req := httptest.NewRequest(http.MethodGet, "/secret/refs", nil)
			131	+	if tt.cookie != "" {
			132	+	req.AddCookie(&http.Cookie{Name: CookieName, Value: tt.cookie})
			133	+	}
			134	+	rec := httptest.NewRecorder()
			135	+	srv.ServeHTTP(rec, req)
63			136
64	-	secret := "dial tcp 10.0.0.5: kv exploded"	137	+	if tt.want.IsOwner() {
65	-	rec, logs = serve(t, connect.NewError(connect.CodeInternal, errors.New(secret)), "/demo")	138	+	assert.Equal(t, http.StatusOK, rec.Code)
66	-	assert.Equal(t, http.StatusInternalServerError, rec.Code)	139	+	return
67	-	assert.Equal(t, "no-cache", rec.Header().Get("Cache-Control"))	140	+	}
68	-	assert.Contains(t, rec.Body.String(), "internal error")	141	+	assert.Equal(t, http.StatusNotFound, rec.Code, "a private repository is a missing one")
69	-	assert.NotContains(t, rec.Body.String(), secret, "the cause stays in the log")	142	+	assert.Contains(t, rec.Body.String(), "not found")
70	-	m := regexp.MustCompile(`request id: ([0-9a-f]{8})`).FindStringSubmatch(rec.Body.String())	143	+	})
71	-	require.Len(t, m, 2, "the page shows a request id")	144	+	}
72	-	assert.Contains(t, logs, m[1], "the log carries the same id")	145	+	}
73	-	assert.Contains(t, logs, "kv exploded")	146	+
			147	+	// A request that arrives with a principal in its context is anonymous anyway:
			148	+	// only a valid session makes the owner.
			149	+	func TestRequestContextCannotSetThePrincipal(t *testing.T) {
			150	+	t.Parallel()
			151	+	repos := mocks.NewRepoService(t)
			152	+	repos.EXPECT().Get(mock.Anything, domain.Anonymous(), repoName(t, "secret")).Return(domain.Repo{}, domain.ErrNotFound).Once()
			153	+	srv := newTestServer(t, Config{Repos: repos, Browse: mocks.NewBrowseService(t)})
74			154
75	-	rec, _ = serve(t, connect.NewError(connect.CodeInternal, errors.New("x")), "/")	155	+	ctx := domain.ContextWithPrincipal(context.Background(), domain.Root())
76	-	assert.Equal(t, http.StatusInternalServerError, rec.Code, "the home page too")	156	+	rec := httptest.NewRecorder()
			157	+	srv.ServeHTTP(rec, httptest.NewRequestWithContext(ctx, http.MethodGet, "/secret", nil))
			158	+	assert.Equal(t, http.StatusNotFound, rec.Code)
77		}	159		}
78			160
79		func TestNewValidates(t *testing.T) {	161		func TestNewValidates(t *testing.T) {
80		t.Parallel()	162		t.Parallel()
81	-	_, err := New(Config{PublicURL: "https://forge.example"})	163	+	tests := []struct {
82	-	assert.Error(t, err, "clients are required")	164	+	name string
83	-	git := ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://x.invalid")	165	+	cfg Config
84	-	_, err = New(Config{Repos: failing{}, Git: git, PublicURL: "not a url"})	166	+	}{
85	-	assert.Error(t, err)	167	+	{"use cases are required", Config{PublicURL: testPublicURL}},
			168	+	{"browse is required", Config{Repos: mocks.NewRepoService(t), PublicURL: testPublicURL}},
			169	+	{"repos are required", Config{Browse: mocks.NewBrowseService(t), PublicURL: testPublicURL}},
			170	+	{"the public URL must be one", Config{Repos: mocks.NewRepoService(t), Browse: mocks.NewBrowseService(t), PublicURL: "not a url"}},
			171	+	}
			172	+	for _, tt := range tests {
			173	+	t.Run(tt.name, func(t *testing.T) {
			174	+	t.Parallel()
			175	+	_, err := New(tt.cfg)
			176	+	assert.Error(t, err)
			177	+	})
			178	+	}
86		}	179		}

M internal/adapters/web/events.go +58 -44

 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/bnema/zerowrap"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/clientlimit"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // Live updates. A page that can change under the eyes of its reader opens
 // GET /-/events (the Live component of the hint badge). The handler follows
-// EventService.Watch as the visitor of the request and turns each event into
+// EventService.Watch as the principal of the request and turns each event into
 // the HTML fragments the page shows, sent as Server-Sent Events:
 //
 //	GET /-/events?topic=home
 const DefaultHeartbeat = 25 * time.Second
 const (
-	// startGrace is how long the handler waits after the Watch call answered
-	// for an early failure (too many watchers) before it commits to 200: the
-	// Connect protocol reports it in the stream, after the headers.
-	startGrace = 100 * time.Millisecond
 	// writeWindow bounds one write to the visitor, whatever the write timeout
 	// of the server is.
 	writeWindow = 30 * time.Second
 	if repo != "" {
 		// A repository the visitor cannot see is a missing one (AC2).
 		cctx, ccancel := context.WithTimeout(ctx, requestTimeout)
-		_, err := s.cfg.Repos.GetRepo(cctx, connect.NewRequest(&pb.GetRepoRequest{Repo: repo}))
+		err := s.canSee(cctx, repo)
 		ccancel()
 		if err != nil {
 			s.denyEvents(ctx, w, err)
 		}
 	}
-	stream, err := s.cfg.Events.Watch(ctx, connect.NewRequest(&pb.WatchRequest{
+	// The watch runs in a goroutine and hands each event to this one through
+	// an unbuffered channel: a visitor that reads slowly holds the watch in
+	// its send, falls behind the buffer of the use case, and gets a gap.
+	msgs := make(chan recvd)
+	started := make(chan struct{})
+	var startOnce sync.Once
+	start := func() { startOnce.Do(func() { close(started) }) }
+	finished := make(chan struct{})
+	params := ports.WatchParams{
 		Topics: []string{topic}, ResumeAfter: r.Header.Get("Last-Event-ID"),
-	}))
+		// The visitor is the client of the watch, for the limit per client.
-	if err != nil {
+		Client: clientlimit.Key(clientlimit.ClientAddr(r, s.cfg.TrustedProxies)),
-		s.denyEvents(ctx, w, err)
+		Ready:  start,
-		return
 	}
-	// Wait for the answer of the API, which comes once the watch is registered
-	// (or refused), then read the stream from a goroutine.
-	_ = stream.ResponseHeader()
-	msgs := make(chan recvd)
-	done := make(chan struct{})
 	go func() {
-		defer close(done)
+		defer close(finished)
 		defer close(msgs)
-		for stream.Receive() {
+		err := s.cfg.Events.Watch(ctx, principal(ctx), params, func(we ports.WatchEvent) error {
+			start()
 			select {
-			case msgs <- recvd{ev: stream.Msg().GetEvent()}:
+			case msgs <- recvd{ev: we}:
+				return nil
 			case <-ctx.Done():
-				return
+				return ctx.Err()
 			}
-		}
+		})
-		if err := stream.Err(); err != nil {
+		if err != nil && ctx.Err() == nil {
 			select {
 			case msgs <- recvd{err: err}:
 			case <-ctx.Done():
 	}()
 	defer func() {
 		cancel()
-		_ = stream.Close()
+		<-finished
-		<-done
 	}()
+	// The watch is registered (or refused, which ends it before): only then
+	// does the answer commit to 200.
 	var first *recvd
-	grace := time.NewTimer(startGrace)
 	select {
+	case <-started:
 	case m, open := <-msgs:
-		grace.Stop()
 		if !open {
 			return // the server is stopping
 		}
+		if m.err != nil {
+			s.denyEvents(ctx, w, m.err)
+			return
+		}
 		first = &m
-	case <-grace.C:
 	case <-ctx.Done():
-		grace.Stop()
-		return
-	}
-	if first != nil && first.err != nil {
-		s.denyEvents(ctx, w, first.err)
 		return
 	}
 	st := &liveStream{s: s, repo: repo, view: q.Get("view"), ref: q.Get("ref"), head: q.Get("head"), n: q.Get("n")}
 	handle := func(m recvd) bool {
 		if m.err != nil {
-			if ctx.Err() == nil && connect.CodeOf(m.err) != connect.CodeCanceled {
+			if ctx.Err() == nil && !errors.Is(m.err, context.Canceled) {
 				log.Debug().Err(m.err).Str("topic", topic).Msg("event stream ended")
 			}
 			return false
 		}
+		if !liveEvent(m.ev) {
+			return true // nothing to show, not even an id to resume after
+		}
 		// An owner's stream ends when the session does, before it sends
 		// anything more: an event can carry what only the owner may see, and
 		// waiting for the next heartbeat would leave a window.
 			log.Warn().Err(err).Str("topic", topic).Msg("render live fragment")
 			frags = gap
 		}
-		return out.send(m.ev.GetId(), frags) == nil
+		return out.send(m.ev.ID, frags) == nil
 	}
 	if first != nil && !handle(*first) {
 		return
 // recvd is a message of the Watch stream, or how it failed.
 type recvd struct {
-	ev  *pb.Event
+	ev  ports.WatchEvent
 	err error
 }
+// canSee checks that the caller of the request may see the repository named in
+// a topic: one it may not is as missing as one that does not exist.
+func (s *Server) canSee(ctx context.Context, rawName string) error {
+	name, err := domain.ParseRepoName(rawName)
+	if err != nil {
+		return err
+	}
+	_, err = s.cfg.Repos.Get(ctx, principal(ctx), name)
+	return err
+}
 // denyStream answers a request that gets no stream.
 func denyStream(w http.ResponseWriter, status int, msg string) {
 	w.Header().Set("Cache-Control", "no-store")
 	http.Error(w, msg, status)
 }
-// denyEvents maps an error of the API, before the stream started, to a
+// denyEvents maps an error of a use case, before the stream started, to a
 // status. Not found and invalid are 404 whatever the reason: a private
 // repository is a missing one.
 func (s *Server) denyEvents(ctx context.Context, w http.ResponseWriter, err error) {
-	switch code := connect.CodeOf(err); {
+	switch {
-	case code == connect.CodeNotFound, code == connect.CodeInvalidArgument:
+	case errors.Is(err, context.Canceled):
+		// The visitor is gone.
+	case errors.Is(err, domain.ErrNotFound), domain.IsInvalid(err):
 		denyStream(w, http.StatusNotFound, "not found")
-	case code == connect.CodeResourceExhausted:
+	case errors.Is(err, domain.ErrResourceExhausted):
 		w.Header().Set("Retry-After", strconv.Itoa(retryAfter))
 		denyStream(w, http.StatusServiceUnavailable, "too many event streams, retry later")
-	case code == connect.CodeUnauthenticated:
+	case errors.Is(err, domain.ErrUnauthenticated):
 		denyStream(w, http.StatusUnauthorized, "unauthorized")
-	case errors.Is(err, context.Canceled), code == connect.CodeCanceled:
-		// The visitor is gone.
 	default:
 		log := zerowrap.FromCtx(ctx)
 		log.Error().Err(err).Msg("open event stream")

M internal/adapters/web/events_test.go +110 -82

 	"bufio"
 	"context"
 	"errors"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
 	"bnema.dev/ermite/internal/ports"
 	"bnema.dev/ermite/internal/ports/mocks"
 )
 	assert.Equal(t, "100+ new commits — reload", newCommits("100+", 2))
 }
-// fakeEvents is an EventService whose behaviour a test sets.
+// watchProbe drives the generated EventService mock: what the watch does, and
-type fakeEvents struct {
+// a record of the principal and the parameters of the watches it was asked for.
-	ermiteconnect.UnimplementedEventServiceHandler
+type watchProbe struct {
 	err     error
-	events  []*pb.Event
+	events  []ports.WatchEvent
 	opened  atomic.Int32
 	closed  atomic.Int32
-	resume  atomic.Value
+	resume  atomic.Value // string: ResumeAfter of the last watch
+	topics  atomic.Value // []string: Topics of the last watch
+	client  atomic.Value // string: Client of the last watch
+	who     atomic.Value // domain.Principal: caller of the last watch
 	release chan struct{}
-	push    chan *pb.Event // events sent on demand, after the fixed ones
+	push    chan ports.WatchEvent // events sent on demand, after the fixed ones
 }
-func (f *fakeEvents) Watch(ctx context.Context, req *connect.Request[pb.WatchRequest], st *connect.ServerStream[pb.WatchResponse]) error {
+// service is the EventService the web watches: the mock, answering with the
+// probe.
+func (f *watchProbe) service(t testing.TB) *mocks.EventService {
+	t.Helper()
+	m := mocks.NewEventService(t)
+	m.EXPECT().Watch(mock.Anything, mock.Anything, mock.Anything, mock.Anything).RunAndReturn(f.run).Maybe()
+	return m
+}
+func (f *watchProbe) run(ctx context.Context, p domain.Principal, params ports.WatchParams, send func(ports.WatchEvent) error) error {
 	f.opened.Add(1)
 	defer f.closed.Add(1)
-	f.resume.Store(req.Msg.GetResumeAfter())
+	f.resume.Store(params.ResumeAfter)
+	f.topics.Store(params.Topics)
+	f.client.Store(params.Client)
+	f.who.Store(p)
 	if f.err != nil {
 		return f.err
 	}
-	_ = st.Send(nil)
+	if params.Ready != nil {
+		params.Ready()
+	}
 	for _, ev := range f.events {
-		if err := st.Send(&pb.WatchResponse{Event: ev}); err != nil {
+		if err := send(ev); err != nil {
 			return err
 		}
 	}
 		case <-f.release:
 			return nil
 		case ev := <-f.push:
-			if err := st.Send(&pb.WatchResponse{Event: ev}); err != nil {
+			if err := send(ev); err != nil {
 				return err
 			}
 		}
 	}
 }
-// repoOK answers every GetRepo with a public repository.
+// eventsServer serves the web on a fake EventService, with a write timeout
-type repoOK struct {
+// shorter than the heartbeat, like a server that sets one.
-	ermiteconnect.UnimplementedRepoServiceHandler
+func eventsServer(t *testing.T, f *watchProbe, beat time.Duration, writeTimeout time.Duration) *httptest.Server {
-}
-func (repoOK) GetRepo(_ context.Context, req *connect.Request[pb.GetRepoRequest]) (*connect.Response[pb.GetRepoResponse], error) {
-	return connect.NewResponse(&pb.GetRepoResponse{Repo: &pb.Repo{Name: req.Msg.GetRepo(), DefaultBranch: "main"}}), nil
-}
-// eventsServer serves the web on a fake API, with a write timeout shorter
-// than the heartbeat, like a server that sets one.
-func eventsServer(t *testing.T, f *fakeEvents, beat time.Duration, writeTimeout time.Duration) *httptest.Server {
 	t.Helper()
 	return eventsServerWith(t, f, beat, writeTimeout, nil)
 }
 // eventsServerWith is eventsServer with sessions, when sess is not nil.
-func eventsServerWith(t *testing.T, f *fakeEvents, beat time.Duration, writeTimeout time.Duration, sess ports.WebSessionService) *httptest.Server {
+func eventsServerWith(t *testing.T, f *watchProbe, beat time.Duration, writeTimeout time.Duration, sess ports.WebSessionService) *httptest.Server {
 	t.Helper()
-	api := http.NewServeMux()
+	srv := newTestServer(t, Config{
-	api.Handle(ermiteconnect.NewEventServiceHandler(f))
+		Repos:     reposServing(t, publicRepo(t, "x")),
-	api.Handle(ermiteconnect.NewRepoServiceHandler(repoOK{}))
+		Browse:    mocks.NewBrowseService(t),
-	backend := httptest.NewServer(api)
+		Events:    f.service(t),
-	t.Cleanup(backend.Close)
-	srv, err := New(Config{
-		Repos:     ermiteconnect.NewRepoServiceClient(backend.Client(), backend.URL),
-		Git:       ermiteconnect.NewGitServiceClient(backend.Client(), backend.URL),
-		Events:    ermiteconnect.NewEventServiceClient(backend.Client(), backend.URL),
-		PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
 		Heartbeat: beat, Sessions: sess, Limiter: limiterFor(sess),
 	})
-	require.NoError(t, err)
 	ts := httptest.NewUnstartedServer(srv)
 	ts.Config.WriteTimeout = writeTimeout
 	ts.Start()
 // server does not end it.
 func TestEventsHeartbeatSurvivesWriteTimeout(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{})}
+	f := &watchProbe{release: make(chan struct{})}
 	ts := eventsServer(t, f, 40*time.Millisecond, 100*time.Millisecond)
 	resp, cancel := open(t, ts, "topic=home", nil)
 	require.Equal(t, http.StatusOK, resp.StatusCode)
 // Last-Event-ID header is the resume point; a Gap becomes a gap event.
 func TestEventsStreamsEventsAndResumes(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{}), events: []*pb.Event{
+	f := &watchProbe{release: make(chan struct{}), events: []ports.WatchEvent{
-		{Id: "b-7", Kind: &pb.Event_Pushed{Pushed: &pb.Pushed{Repo: "x"}}},
+		{ID: "b-7", Event: domain.PushEvent{Repo: repoName(t, "x")}},
-		{Kind: &pb.Event_Gap{Gap: &pb.Gap{}}},
+		{Gap: true},
 	}}
 	ts := eventsServer(t, f, time.Hour, 0)
 	resp, _ := open(t, ts, "topic=repo:x&view=summary", map[string]string{"Last-Event-ID": "b-6"})
 	assert.Contains(t, lines, "id: b-7", "an event with nothing to show keeps its id")
 	assert.Contains(t, lines, "event: gap")
 	assert.Equal(t, "b-6", f.resume.Load())
+	assert.Equal(t, []string{"repo:x"}, f.topics.Load())
+	assert.Equal(t, domain.Anonymous(), f.who.Load(), "a visitor watches as anonymous")
+	assert.NotEmpty(t, f.client.Load(), "the watch is attributed to the address of the visitor")
 }
-// Too many watchers is a 503 the browser can retry, not a stream.
+// Too many watchers is a 503 the browser can retry, not a stream; what the
-func TestEventsResourceExhausted(t *testing.T) {
+// watch is refused for decides the status.
+func TestEventsRefusals(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{err: connect.NewError(connect.CodeResourceExhausted, errors.New("too many watchers"))}
+	tests := []struct {
-	ts := eventsServer(t, f, time.Hour, 0)
+		name       string
-	resp, _ := open(t, ts, "topic=home", nil)
+		err        error
-	assert.Equal(t, http.StatusServiceUnavailable, resp.StatusCode)
+		want       int
-	assert.NotEmpty(t, resp.Header.Get("Retry-After"))
+		retryAfter bool
-	assert.NotContains(t, resp.Header.Get("Content-Type"), "event-stream")
+	}{
+		{"resource exhausted", fmt.Errorf("%w: too many watchers", domain.ErrResourceExhausted), http.StatusServiceUnavailable, true},
+		{"not found", domain.ErrNotFound, http.StatusNotFound, false},
+		{"invalid", domain.ErrInvalid, http.StatusNotFound, false},
+		{"unauthenticated", domain.ErrUnauthenticated, http.StatusUnauthorized, false},
+		{"internal", errors.New("boom"), http.StatusInternalServerError, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ts := eventsServer(t, &watchProbe{err: tt.err}, time.Hour, 0)
+			resp, _ := open(t, ts, "topic=home", nil)
+			assert.Equal(t, tt.want, resp.StatusCode)
+			assert.Equal(t, tt.retryAfter, resp.Header.Get("Retry-After") != "")
+			assert.NotContains(t, resp.Header.Get("Content-Type"), "event-stream")
+			assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"))
+		})
+	}
+}
-	f.err = connect.NewError(connect.CodeNotFound, errors.New("x"))
+// The topic of a repository the visitor cannot see is refused before any
-	resp, _ = open(t, ts, "topic=home", nil)
+// watch is opened: a private repository is a missing one.
-	assert.Equal(t, http.StatusNotFound, resp.StatusCode)
+func TestEventsPrivateRepositoryTopic(t *testing.T) {
-	f.err = errors.New("boom")
+	t.Parallel()
-	resp, _ = open(t, ts, "topic=home", nil)
+	f := &watchProbe{release: make(chan struct{})}
-	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
+	srv := newTestServer(t, Config{
+		Repos: reposServing(t, publicRepo(t, "pub")), Browse: mocks.NewBrowseService(t), Events: f.service(t),
+	})
+	ts := httptest.NewServer(srv)
+	t.Cleanup(ts.Close)
+	for _, query := range []string{"topic=repo:secret", "topic=repo:Bad"} {
+		resp, _ := open(t, ts, query, nil)
+		assert.Equal(t, http.StatusNotFound, resp.StatusCode, query)
+	}
+	assert.Zero(t, f.opened.Load(), "no watch was opened for them")
+}
+// The owner's stream is the owner's: the watch is opened as the owner.
+func TestEventsOwnerWatchesAsOwner(t *testing.T) {
+	t.Parallel()
+	f := &watchProbe{release: make(chan struct{})}
+	sess, _ := newRevocable(t, "tok")
+	ts := eventsServerWith(t, f, time.Hour, 0, sess)
+	resp, _ := open(t, ts, "topic=home", map[string]string{"Cookie": CookieName + "=tok"})
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, domain.Owner(), f.who.Load())
 }
 // The handler returns, and the watch it opened ends, when the visitor goes
 // away or the API ends the stream.
 func TestEventsNoLeak(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{})}
+	f := &watchProbe{release: make(chan struct{})}
 	ts := eventsServer(t, f, time.Hour, 0)
 	resp, cancel := open(t, ts, "topic=home", nil)
 	require.Eventually(t, func() bool { return f.closed.Load() == 2 }, 5*time.Second, time.Millisecond)
 }
-func TestEventsOffWithoutClient(t *testing.T) {
+func TestEventsOffWithoutEventService(t *testing.T) {
 	t.Parallel()
-	srv, err := New(Config{
+	srv := newTestServer(t, Config{Repos: mocks.NewRepoService(t), Browse: mocks.NewBrowseService(t)})
-		Repos:     ermiteconnect.NewRepoServiceClient(http.DefaultClient, "http://x.invalid"),
-		Git:       ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://x.invalid"),
-		PublicURL: "https://forge.example",
-	})
-	require.NoError(t, err)
 	rec := httptest.NewRecorder()
 	srv.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/-/events?topic=home", nil))
 	assert.Equal(t, http.StatusNotFound, rec.Code)
 // and marks depend on it. The commits page shows a branch, not the default.
 func TestRepoUpdatedReloadsSummaryAndRefs(t *testing.T) {
 	t.Parallel()
-	api := http.NewServeMux()
+	srv := newTestServer(t, Config{Repos: reposServing(t, publicRepo(t, "x")), Browse: mocks.NewBrowseService(t)})
-	api.Handle(ermiteconnect.NewRepoServiceHandler(repoOK{}))
-	backend := httptest.NewServer(api)
-	t.Cleanup(backend.Close)
-	srv, err := New(Config{
-		Repos:     ermiteconnect.NewRepoServiceClient(backend.Client(), backend.URL),
-		Git:       ermiteconnect.NewGitServiceClient(backend.Client(), backend.URL),
-		PublicURL: "https://forge.example",
-	})
-	require.NoError(t, err)
-	ev := &pb.Event{Kind: &pb.Event_RepoUpdated{RepoUpdated: &pb.RepoUpdated{Repo: &pb.Repo{Name: "x"}}}}
+	ev := ports.WatchEvent{Event: domain.RepoUpdated{Repo: repoName(t, "x")}}
 	for view, wantGap := range map[string]bool{"summary": true, "refs": true, "commits": false} {
 		ls := &liveStream{s: srv, repo: "x", view: view}
 		got, err := ls.render(t.Context(), ev)
 // and the stream ends.
 func TestEventsOwnerStreamEndsBeforeNextEvent(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{}), push: make(chan *pb.Event)}
+	f := &watchProbe{release: make(chan struct{}), push: make(chan ports.WatchEvent)}
 	sess, ended := newRevocable(t, "tok")
 	ts := eventsServerWith(t, f, time.Hour, 0, sess) // no heartbeat in the test
 	resp, cancel := open(t, ts, "topic=home", map[string]string{"Cookie": CookieName + "=tok"})
 	// The stream is up; a first event goes through while the session lives.
 	require.Equal(t, ": connected", line())
 	line()
-	f.push <- &pb.Event{Id: "b-1", Kind: &pb.Event_Gap{Gap: &pb.Gap{}}}
+	f.push <- ports.WatchEvent{ID: "b-1", Gap: true}
 	var seen []string
 	for l := line(); l != "data: gap"; l = line() {
 		seen = append(seen, l)
 	// Signed out everywhere: the next event is not sent, the stream ends.
 	ended.Store(true)
 	select {
-	case f.push <- &pb.Event{Id: "b-2", Kind: &pb.Event_Gap{Gap: &pb.Gap{}}}:
+	case f.push <- ports.WatchEvent{ID: "b-2", Gap: true}:
 	case <-time.After(5 * time.Second):
 		t.Fatal("the event was not delivered to the web")
 	}
 // A visitor's stream does not depend on sessions: events keep flowing.
 func TestEventsVisitorStreamIgnoresSessions(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{}), push: make(chan *pb.Event)}
+	f := &watchProbe{release: make(chan struct{}), push: make(chan ports.WatchEvent)}
 	sess, ended := newRevocable(t, "tok")
 	ended.Store(true)
 	ts := eventsServerWith(t, f, time.Hour, 0, sess)
 	resp, _ := open(t, ts, "topic=home", nil)
 	require.Equal(t, http.StatusOK, resp.StatusCode)
-	f.push <- &pb.Event{Id: "b-1", Kind: &pb.Event_Gap{Gap: &pb.Gap{}}}
+	f.push <- ports.WatchEvent{ID: "b-1", Gap: true}
 	sc := bufio.NewScanner(resp.Body)
 	found := false
 	for sc.Scan() {
 // say the answer must not be stored and varies on the cookie.
 func TestEventsInvalidCookieStream(t *testing.T) {
 	t.Parallel()
-	f := &fakeEvents{release: make(chan struct{})}
+	f := &watchProbe{release: make(chan struct{})}
 	ts := eventsServerWith(t, f, time.Hour, 0, newSessions(t, "tok"))
 	resp, _ := open(t, ts, "topic=home", map[string]string{"Cookie": CookieName + "=bad"})
 	require.Equal(t, http.StatusOK, resp.StatusCode)

M internal/adapters/web/fanout_test.go +42 -41


@@ -10,13 +10,13 @@ import (
10		"testing"	10		"testing"
11		"testing/synctest"	11		"testing/synctest"
12			12
13	-	"connectrpc.com/connect"
14		"github.com/stretchr/testify/assert"	13		"github.com/stretchr/testify/assert"
15		"github.com/stretchr/testify/mock"	14		"github.com/stretchr/testify/mock"
16		"github.com/stretchr/testify/require"	15		"github.com/stretchr/testify/require"
17			16
18	-	pb "bnema.dev/ermite-api/gen/ermite"	17	+	"bnema.dev/ermite/internal/domain"
19	-	"bnema.dev/ermite/internal/adapters/web/mocks"	18	+	"bnema.dev/ermite/internal/ports"
			19	+	"bnema.dev/ermite/internal/ports/mocks"
20		)	20		)
21			21
22		func frag(s string) []fragment { return []fragment{{event: "refs-list", html: s}} }	22		func frag(s string) []fragment { return []fragment{{event: "refs-list", html: s}} }

@@ -137,58 +137,59 @@ func TestFanoutIsBounded(t *testing.T) {
137		}	137		}
138			138
139		// refsMocks is a web server over mocks that expect the refs fragment to load	139		// refsMocks is a web server over mocks that expect the refs fragment to load
140	-	// the repository and its refs repos times, and to ask for a commit commits	140	+	// the repository and its refs once per build of each class of watcher
141	-	// times.	141	+	// (anonymous, owner), asking the use cases as that class's principal, and to
142	-	func refsMocks(t testing.T, repos, commits int) Server {	142	+	// ask for a commit once per build when commits is set.
			143	+	func refsMocks(t testing.T, anonymous, owner int, commits bool) Server {
143		t.Helper()	144		t.Helper()
144	-	api := mocks.NewRepoServiceClient(t)	145	+	const id = "0123456789abcdef0123456789abcdef01234567"
145	-	git := mocks.NewGitServiceClient(t)	146	+	repos := mocks.NewRepoService(t)
146	-	api.EXPECT().GetRepo(mock.Anything, mock.Anything).RunAndReturn(	147	+	browse := mocks.NewBrowseService(t)
147	-	func(_ context.Context, req connect.Request[pb.GetRepoRequest]) (connect.Response[pb.GetRepoResponse], error) {	148	+	for _, class := range []struct {
148	-	return connect.NewResponse(&pb.GetRepoResponse{Repo: &pb.Repo{Name: req.Msg.GetRepo(), DefaultBranch: "main"}}), nil	149	+	p domain.Principal
149	-	}).Times(repos)	150	+	builds int
150	-	id := "0123456789abcdef0123456789abcdef01234567"	151	+	}{{domain.Anonymous(), anonymous}, {domain.Owner(), owner}} {
151	-	git.EXPECT().ListRefs(mock.Anything, mock.MatchedBy(func(req *connect.Request[pb.ListRefsRequest]) bool {	152	+	p, builds := class.p, class.builds
152	-	return req.Msg.GetPageSize() == maxRefs // the refs are asked in one page	153	+	if builds == 0 {
153	-	})).RunAndReturn(func(context.Context, connect.Request[pb.ListRefsRequest]) (connect.Response[pb.ListRefsResponse], error) {	154	+	continue
154	-	return connect.NewResponse(&pb.ListRefsResponse{Refs: []*pb.Ref{	155	+	}
155	-	{Name: "refs/heads/main", ShortName: "main", Kind: pb.RefKind_REF_KIND_BRANCH, CommitId: id},	156	+	repos.EXPECT().Get(mock.Anything, p, repoName(t, "x")).Return(publicRepo(t, "x").Repo, nil).Times(builds)
156	-	{Name: "refs/tags/v1", ShortName: "v1", Kind: pb.RefKind_REF_KIND_TAG, CommitId: id},	157	+	browse.EXPECT().ListRefs(mock.Anything, p, repoName(t, "x"), mock.MatchedBy(func(params ports.ListRefsParams) bool {
157	-	}}), nil	158	+	return params.PageSize == maxRefs // the refs are asked in one page
158	-	}).Times(repos)	159	+	})).Return(ports.RefPage{Refs: []domain.Ref{
159	-	if commits > 0 {	160	+	{Name: "refs/heads/main", ShortName: "main", Kind: domain.RefKindBranch, CommitID: objectID(t, id)},
160	-	git.EXPECT().ListCommits(mock.Anything, mock.Anything).RunAndReturn(	161	+	{Name: "refs/tags/v1", ShortName: "v1", Kind: domain.RefKindTag, CommitID: objectID(t, id)},
161	-	func(_ context.Context, req connect.Request[pb.ListCommitsRequest]) (connect.Response[pb.ListCommitsResponse], error) {	162	+	}}, nil).Times(builds)
162	-	return connect.NewResponse(&pb.ListCommitsResponse{Commits: []*pb.Commit{{Id: req.Msg.GetRevision(), Summary: "subject"}}}), nil	163	+	if commits {
163	-	}).Times(commits)	164	+	browse.EXPECT().ListCommits(mock.Anything, p, repoName(t, "x"), mock.Anything).RunAndReturn(
			165	+	func(_ context.Context, _ domain.Principal, _ domain.RepoName, params ports.ListCommitsParams) (ports.HistoryPage, error) {
			166	+	return ports.HistoryPage{Commits: []domain.Commit{{ID: objectID(t, params.Revision.String()), Summary: "subject"}}}, nil
			167	+	}).Times(builds)
			168	+	}
164		}	169		}
165	-	s, err := New(Config{	170	+	repos.EXPECT().View(mock.Anything, mock.Anything).Return(publicRepo(t, "x"), nil).Times(anonymous + owner)
166	-	Repos: api, Git: git,	171	+	return newTestServer(t, Config{Repos: repos, Browse: browse})
167	-	PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
168	-	})
169	-	require.NoError(t, err)
170	-	return s
171		}	172		}
172			173
173		// A push is rendered once for the watchers of the same class, and the owner	174		// A push is rendered once for the watchers of the same class, and the owner
174		// and the anonymous visitors never share what was built.	175		// and the anonymous visitors never share what was built.
175		func TestLiveRefsSharesAPushBetweenWatchers(t *testing.T) {	176		func TestLiveRefsSharesAPushBetweenWatchers(t *testing.T) {
176		t.Parallel()	177		t.Parallel()
177	-	owner := context.WithValue(context.Background(), signedInKey{}, struct{}{})	178	+	owner := domain.ContextWithPrincipal(context.WithValue(context.Background(), signedInKey{}, struct{}{}), domain.Owner())
178		anon := context.Background()	179		anon := context.Background()
179			180
180		for _, tt := range []struct {	181		for _, tt := range []struct {
181	-	name string	182	+	name string
182	-	ctxs []context.Context	183	+	ctxs []context.Context
183	-	builds int // loads of the repository and refs, and ListCommits calls: one per class	184	+	anonymous, mine int // builds: one per class
184		}{	185		}{
185	-	{"five anonymous watchers", []context.Context{anon, anon, anon, anon, anon}, 1},	186	+	{"five anonymous watchers", []context.Context{anon, anon, anon, anon, anon}, 1, 0},
186	-	{"owner and anonymous", []context.Context{anon, owner, anon, owner}, 2},	187	+	{"owner and anonymous", []context.Context{anon, owner, anon, owner}, 1, 1},
187		} {	188		} {
188		t.Run(tt.name, func(t *testing.T) {	189		t.Run(tt.name, func(t *testing.T) {
189		t.Parallel()	190		t.Parallel()
190	-	s := refsMocks(t, tt.builds, tt.builds)	191	+	s := refsMocks(t, tt.anonymous, tt.mine, true)
191	-	ev := &pb.Event{Id: "b-1", Kind: &pb.Event_Pushed{Pushed: &pb.Pushed{Repo: "x"}}}	192	+	ev := ports.WatchEvent{ID: "b-1", Event: domain.PushEvent{Repo: repoName(t, "x")}}
192		for _, ctx := range tt.ctxs {	193		for _, ctx := range tt.ctxs {
193		st := &liveStream{s: s, repo: "x", view: "refs"}	194		st := &liveStream{s: s, repo: "x", view: "refs"}
194		frags, err := st.render(ctx, ev)	195		frags, err := st.render(ctx, ev)

@@ -204,7 +205,7 @@ func TestLiveRefsSharesAPushBetweenWatchers(t *testing.T) {
204		// The refs are asked in one page of up to maxRefs (the mock only answers that).	205		// The refs are asked in one page of up to maxRefs (the mock only answers that).
205		func TestLoadRepoAsksTheRefsInOnePage(t *testing.T) {	206		func TestLoadRepoAsksTheRefsInOnePage(t *testing.T) {
206		t.Parallel()	207		t.Parallel()
207	-	s := refsMocks(t, 1, 0)	208	+	s := refsMocks(t, 1, 0, false)
208		d, err := s.loadRepo(context.Background(), "x")	209		d, err := s.loadRepo(context.Background(), "x")
209		require.NoError(t, err)	210		require.NoError(t, err)
210		assert.Len(t, d.branches, 1)	211		assert.Len(t, d.branches, 1)

M internal/adapters/web/fragments.go +91 -59

 	"sync"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // liveStream turns the events of Watch into the fragments one page shows.
 var gap = []fragment{{event: "gap", html: "gap"}}
+// liveEvent reports whether the event of a watch is one the pages follow: a
+// gap, or one of the events of the forge. The use case may send others, which
+// no page shows and no stream carries, not even their id.
+func liveEvent(we ports.WatchEvent) bool {
+	if we.Gap {
+		return true
+	}
+	switch we.Event.(type) {
+	case domain.RepoCreated, domain.RepoUpdated, domain.RepoDeleted, domain.PushEvent,
+		domain.MergeRequestOpened, domain.MergeRequestMerged, domain.MergeRequestClosed, domain.CommentAdded:
+		return true
+	}
+	return false
+}
 // render returns the fragments for an event, none when it changes nothing on
 // the page.
-func (l *liveStream) render(ctx context.Context, ev *pb.Event) ([]fragment, error) {
+func (l *liveStream) render(ctx context.Context, we ports.WatchEvent) ([]fragment, error) {
-	if ev == nil {
+	if we.Gap {
-		return nil, nil
-	}
-	if ev.GetGap() != nil {
 		return gap, nil
 	}
+	if we.Event == nil {
+		return nil, nil
+	}
 	if l.repo == "" {
-		return l.home(ctx, ev)
+		return l.home(ctx, we)
 	}
-	return l.repoPage(ctx, ev)
+	return l.repoPage(ctx, we)
+}
+// repoByName reads a repository as the caller of the request. A name that is
+// not valid is a repository that is not there.
+func (l *liveStream) repoByName(ctx context.Context, rawName string) (ports.RepoView, error) {
+	name, err := domain.ParseRepoName(rawName)
+	if err != nil {
+		return ports.RepoView{}, domain.ErrNotFound
+	}
+	return l.s.repoView(ctx, name)
 }
 // home upserts the row of the repository an event is about. The row is read
-// again from the API as the visitor of the stream, so a repository that was
+// again from the use case as the principal of the stream, so a repository
-// deleted or that the visitor can no longer see (public to private) removes
+// that was deleted or that the visitor can no longer see (public to private)
-// the row, and the stream never carries more than the list shows.
+// removes the row, and the stream never carries more than the list shows.
-func (l *liveStream) home(ctx context.Context, ev *pb.Event) ([]fragment, error) {
+func (l *liveStream) home(ctx context.Context, we ports.WatchEvent) ([]fragment, error) {
 	var name string
 	fresh := false
-	switch k := ev.GetKind().(type) {
+	switch ev := we.Event.(type) {
-	case *pb.Event_RepoDeleted:
+	case domain.RepoDeleted:
-		return l.gone(ctx, k.RepoDeleted.GetRepo())
+		return l.gone(ctx, ev.Repo.String())
-	case *pb.Event_RepoCreated:
+	case domain.RepoCreated:
-		name = k.RepoCreated.GetRepo().GetName()
+		name = ev.Repo.String()
-	case *pb.Event_RepoUpdated:
+	case domain.RepoUpdated:
-		name = k.RepoUpdated.GetRepo().GetName()
+		name = ev.Repo.String()
-	case *pb.Event_Pushed:
+	case domain.PushEvent:
-		name, fresh = k.Pushed.GetRepo(), true
+		name, fresh = ev.Repo.String(), true
 	default:
 		return nil, nil
 	}
-	res, err := l.s.cfg.Repos.GetRepo(ctx, connect.NewRequest(&pb.GetRepoRequest{Repo: name}))
+	view, err := l.repoByName(ctx, name)
 	switch {
-	case connect.CodeOf(err) == connect.CodeNotFound:
+	case errors.Is(err, domain.ErrNotFound):
 		return l.gone(ctx, name)
 	case err != nil:
 		return nil, err
 	}
-	row := homeRow(res.Msg.GetRepo(), l.s.cfg.Now(), false)
+	row := homeRow(view, l.s.cfg.Now(), false)
 	row.Fresh = fresh
 	f, err := renderFragment(ctx, "home-list", HomeRowView(row))
 	return []fragment{f}, err
 }
 // repoPage handles the events of the topic of one repository.
-func (l *liveStream) repoPage(ctx context.Context, ev *pb.Event) ([]fragment, error) {
+func (l *liveStream) repoPage(ctx context.Context, we ports.WatchEvent) ([]fragment, error) {
-	switch k := ev.GetKind().(type) {
+	switch ev := we.Event.(type) {
-	case *pb.Event_RepoDeleted, *pb.Event_RepoCreated:
+	case domain.RepoDeleted, domain.RepoCreated:
 		// Gone, or a new repository under the same name: whatever the page
 		// shows is not true any more.
 		return gap, nil
-	case *pb.Event_RepoUpdated:
+	case domain.RepoUpdated:
-		_, err := l.s.cfg.Repos.GetRepo(ctx, connect.NewRequest(&pb.GetRepoRequest{Repo: l.repo}))
+		_, err := l.repoByName(ctx, l.repo)
 		switch {
-		case connect.CodeOf(err) == connect.CodeNotFound:
+		case errors.Is(err, domain.ErrNotFound):
 			return gap, nil // no longer visible
 		case err != nil:
 			return nil, err
 			return gap, nil // the description, the default branch
 		}
 		return nil, nil
-	case *pb.Event_MergeRequestOpened:
+	case domain.MergeRequestOpened:
-		return l.mrNotice(ctx, k.MergeRequestOpened.GetMergeRequest().GetNumber(), "a merge request was opened — reload")
+		return l.mrNotice(ctx, ev.MergeRequest.Number, "a merge request was opened — reload")
-	case *pb.Event_MergeRequestMerged:
+	case domain.MergeRequestMerged:
-		return l.mrNotice(ctx, k.MergeRequestMerged.GetMergeRequest().GetNumber(), "this merge request was merged — reload")
+		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request was merged — reload")
-	case *pb.Event_MergeRequestClosed:
+	case domain.MergeRequestClosed:
-		return l.mrNotice(ctx, k.MergeRequestClosed.GetMergeRequest().GetNumber(), "this merge request was closed — reload")
+		return l.mrNotice(ctx, ev.MergeRequest.Number, "this merge request was closed — reload")
-	case *pb.Event_CommentAdded:
+	case domain.CommentAdded:
-		return l.mrNotice(ctx, k.CommentAdded.GetNumber(), "a comment was added — reload")
+		return l.mrNotice(ctx, ev.Number, "a comment was added — reload")
-	case *pb.Event_Pushed:
+	case domain.PushEvent:
 		switch l.view {
 		case "mr":
-			return l.mrPushed(ctx, k.Pushed)
+			return l.mrPushed(ctx, ev)
 		case "mrs":
 			return nil, nil
 		}
 		switch l.view {
 		case "refs":
-			return l.refs(ctx, ev.GetId())
+			return l.refs(ctx, we.ID)
 		case "commits":
-			return l.banner(ctx, k.Pushed)
+			return l.banner(ctx, ev)
 		}
 		return l.lastPush(ctx)
 	}
 // lastPush is the "last push" fact of the summary.
 func (l *liveStream) lastPush(ctx context.Context) ([]fragment, error) {
-	res, err := l.s.cfg.Repos.GetRepo(ctx, connect.NewRequest(&pb.GetRepoRequest{Repo: l.repo}))
+	view, err := l.repoByName(ctx, l.repo)
 	if err != nil {
 		return nil, err
 	}
-	f, err := renderFragment(ctx, "repo-last-push", FactValue(lastPushFact(res.Msg.GetRepo(), l.s.cfg.Now())))
+	f, err := renderFragment(ctx, "repo-last-push", FactValue(lastPushFact(view, l.s.cfg.Now())))
 	return []fragment{f}, err
 }
 // banner tells the commits page how many commits its branch got since the
 // head it lists.
-func (l *liveStream) banner(ctx context.Context, p *pb.Pushed) ([]fragment, error) {
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter counts the commits of a page for the banner text; display only
+func (l *liveStream) banner(ctx context.Context, p domain.PushEvent) ([]fragment, error) {
 	if l.ref == "" || !isFullID(l.head) {
 		return nil, nil
 	}
 	tip, touched := "", false
-	for _, u := range p.GetRefUpdates() {
+	for _, u := range p.Updates {
-		if u.GetRef() == "refs/heads/"+l.ref {
+		if u.Ref == "refs/heads/"+l.ref {
-			tip, touched = u.GetNewId(), true
+			tip, touched = u.New, true
+			if u.IsDelete() {
+				tip = ""
+			}
 		}
 	}
 	switch {
 	}
 	text := ""
 	if tip != l.head {
-		res, err := l.s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+		name, err := domain.ParseRepoName(l.repo)
-			Repo: l.repo, Revision: tip, PageSize: pageSize,
+		if err != nil {
-		}))
+			return nil, err
+		}
+		res, err := l.s.commitList(ctx, name, tip, "", pageSize, "")
 		if err != nil {
 			return nil, err
 		}
 		// ordered by date, not as "head..tip", so commits that are not new may
 		// be counted before the head is met. And one page of the log being
 		// all that is read, "100+" cannot be told from a rewritten branch
-		// whose old head is further back: the API has no "is ancestor".
+		// whose old head is further back: the use cases have no "is ancestor".
 		n, found := 0, false
-		for _, c := range res.Msg.GetCommits() {
+		for _, c := range res.Commits {
-			if c.GetId() == l.head {
+			if c.ID.String() == l.head {
 				found = true
 				break
 			}
 		switch {
 		case found:
 			text = newCommits(strconv.Itoa(n), n)
-		case res.Msg.GetNextPageToken() != "":
+		case res.NextPageToken != "":
 			text = newCommits(strconv.Itoa(n)+"+", 2)
 		default:
 			text = "the branch was rewritten — reload"
 }
 // mrPushed announces a push to the source branch of the merge request shown.
-func (l *liveStream) mrPushed(ctx context.Context, p *pb.Pushed) ([]fragment, error) {
+func (l *liveStream) mrPushed(ctx context.Context, p domain.PushEvent) ([]fragment, error) {
 	if l.ref == "" {
 		return nil, nil
 	}
-	for _, u := range p.GetRefUpdates() {
+	for _, u := range p.Updates {
-		if u.GetRef() == "refs/heads/"+l.ref {
+		if u.Ref == "refs/heads/"+l.ref {
 			n, err := strconv.ParseInt(l.n, 10, 64)
 			if err != nil {
 				return nil, nil

A internal/adapters/web/helpers_test.go +110 -0

@@ -0,0 +1,110 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package web
	4	+
	5	+	import (
	6	+	"context"
	7	+	"testing"
	8	+
	9	+	"github.com/stretchr/testify/mock"
	10	+	"github.com/stretchr/testify/require"
	11	+
	12	+	"bnema.dev/ermite/internal/domain"
	13	+	"bnema.dev/ermite/internal/ports"
	14	+	"bnema.dev/ermite/internal/ports/mocks"
	15	+	)
	16	+
	17	+	// testPublicURL and testSourceURL are the instance of the servers the tests
	18	+	// build.
	19	+	const (
	20	+	testPublicURL = "https://forge.example"
	21	+	testSourceURL = "https://forge.example/ermite"
	22	+	)
	23	+
	24	+	// repoName parses a repository name the test knows is valid.
	25	+	func repoName(t testing.TB, s string) domain.RepoName {
	26	+	t.Helper()
	27	+	n, err := domain.ParseRepoName(s)
	28	+	require.NoError(t, err)
	29	+	return n
	30	+	}
	31	+
	32	+	// objectID parses a commit id the test knows is valid.
	33	+	func objectID(t testing.TB, s string) domain.ObjectID {
	34	+	t.Helper()
	35	+	id, err := domain.ParseObjectID(s)
	36	+	require.NoError(t, err)
	37	+	return id
	38	+	}
	39	+
	40	+	// publicRepo is the repository the use cases of the tests answer with:
	41	+	// public, with main as its default branch.
	42	+	func publicRepo(t testing.TB, name string) ports.RepoView {
	43	+	t.Helper()
	44	+	return ports.RepoView{
	45	+	Repo: domain.Repo{Name: repoName(t, name), Visibility: domain.VisibilityPublic, Settings: domain.DefaultRepoSettings()},
	46	+	DefaultBranch: "main",
	47	+	}
	48	+	}
	49	+
	50	+	// reposFailing is a RepoService whose reads fail with err, whatever they ask.
	51	+	func reposFailing(t testing.TB, err error) *mocks.RepoService {
	52	+	t.Helper()
	53	+	m := mocks.NewRepoService(t)
	54	+	m.EXPECT().Get(mock.Anything, mock.Anything, mock.Anything).Return(domain.Repo{}, err).Maybe()
	55	+	m.EXPECT().ListPage(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(ports.RepoPage{}, err).Maybe()
	56	+	return m
	57	+	}
	58	+
	59	+	// reposServing is a RepoService that knows the repositories, by name, as seen
	60	+	// by every caller.
	61	+	func reposServing(t testing.TB, views ...ports.RepoView) *mocks.RepoService {
	62	+	t.Helper()
	63	+	m := mocks.NewRepoService(t)
	64	+	byName := map[string]ports.RepoView{}
	65	+	for _, v := range views {
	66	+	byName[v.Name.String()] = v
	67	+	}
	68	+	m.EXPECT().Get(mock.Anything, mock.Anything, mock.Anything).RunAndReturn(
	69	+	func(_ context.Context, _ domain.Principal, name domain.RepoName) (domain.Repo, error) {
	70	+	v, ok := byName[name.String()]
	71	+	if !ok {
	72	+	return domain.Repo{}, domain.ErrNotFound
	73	+	}
	74	+	return v.Repo, nil
	75	+	}).Maybe()
	76	+	m.EXPECT().View(mock.Anything, mock.Anything).RunAndReturn(
	77	+	func(_ context.Context, r domain.Repo) (ports.RepoView, error) {
	78	+	v, ok := byName[r.Name.String()]
	79	+	if !ok {
	80	+	return ports.RepoView{}, domain.ErrNotFound
	81	+	}
	82	+	return v, nil
	83	+	}).Maybe()
	84	+	m.EXPECT().ListPage(mock.Anything, mock.Anything, mock.Anything, mock.Anything).RunAndReturn(
	85	+	func(context.Context, domain.Principal, int, string) (ports.RepoPage, error) {
	86	+	var page ports.RepoPage
	87	+	for _, v := range views {
	88	+	page.Repos = append(page.Repos, v.Repo)
	89	+	}
	90	+	return page, nil
	91	+	}).Maybe()
	92	+	return m
	93	+	}
	94	+
	95	+	// newTestServer builds a Server from cfg, with the instance filled in.
	96	+	func newTestServer(t testing.TB, cfg Config) *Server {
	97	+	t.Helper()
	98	+	if cfg.PublicURL == "" {
	99	+	cfg.PublicURL = testPublicURL
	100	+	}
	101	+	if cfg.SourceURL == "" {
	102	+	cfg.SourceURL = testSourceURL
	103	+	}
	104	+	if cfg.Version == "" {
	105	+	cfg.Version = "v1"
	106	+	}
	107	+	srv, err := New(cfg)
	108	+	require.NoError(t, err)
	109	+	return srv
	110	+	}

M internal/adapters/web/highlight_test.go +5 -5


@@ -11,7 +11,7 @@ import (
11		"github.com/stretchr/testify/assert"	11		"github.com/stretchr/testify/assert"
12		"github.com/stretchr/testify/require"	12		"github.com/stretchr/testify/require"
13			13
14	-	pb "bnema.dev/ermite-api/gen/ermite"	14	+	"bnema.dev/ermite/internal/domain"
15		)	15		)
16			16
17		func TestHighlightLines(t *testing.T) {	17		func TestHighlightLines(t *testing.T) {

@@ -141,12 +141,12 @@ func TestSniffImage(t *testing.T) {
141			141
142		func TestLocate(t *testing.T) {	142		func TestLocate(t *testing.T) {
143		t.Parallel()	143		t.Parallel()
144	-	b, tag := pb.RefKind_REF_KIND_BRANCH, pb.RefKind_REF_KIND_TAG	144	+	b, tag := domain.RefKindBranch, domain.RefKindTag
145		d := &repoData{	145		d := &repoData{
146	-	branches: []*pb.Ref{ref(b, "main"), ref(b, "feature/x")},	146	+	branches: []domain.Ref{ref(b, "main"), ref(b, "feature/x")},
147	-	tags: []*pb.Ref{ref(tag, "v1/rc")},	147	+	tags: []domain.Ref{ref(tag, "v1/rc")},
148		}	148		}
149	-	d.head = d.branches[0]	149	+	d.head = &d.branches[0]
150		for _, tt := range []struct {	150		for _, tt := range []struct {
151		in, name, path string	151		in, name, path string
152		detached, ok bool	152		detached, ok bool

M internal/adapters/web/home.go +31 -26

 	"strings"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/ports"
 )
 // maxRepos bounds the repositories one page lists.
 const maxRepos = 1000
-// pageSize is the page size asked from the commit lists: the largest the API
+// pageSize is the page size asked from the commit lists: the largest the use
-// accepts for them.
+// case accepts for them.
 const pageSize = 100
 // listRepos reads the repositories the visitor may see, ordered by name.
 // Every page of ListRepos scans the whole repository list and reads the HEAD
 // of each repository of the page, so the list is asked in one page of up to
-// maxRepos: one scan in the common case, whatever the API cap is (a lower
+// maxRepos: one scan in the common case, whatever the cap of the use case is
-// one only means more pages, followed by their token).
+// (a lower one only means more pages, followed by their token).
-func (s *Server) listRepos(ctx context.Context) ([]*pb.Repo, error) {
+func (s *Server) listRepos(ctx context.Context) ([]ports.RepoView, error) {
-	var repos []*pb.Repo
+	var repos []ports.RepoView
 	token := ""
 	for len(repos) < maxRepos {
-		res, err := s.cfg.Repos.ListRepos(ctx, connect.NewRequest(&pb.ListReposRequest{PageSize: maxRepos, PageToken: token}))
+		page, err := s.cfg.Repos.ListPage(ctx, principal(ctx), maxRepos, token)
 		if err != nil {
 			return nil, err
 		}
-		repos = append(repos, res.Msg.GetRepos()...)
+		for _, repo := range page.Repos {
-		if token = res.Msg.GetNextPageToken(); token == "" {
+			view, err := s.cfg.Repos.View(ctx, repo)
+			if err != nil {
+				return nil, err
+			}
+			repos = append(repos, view)
+		}
+		if token = page.NextPageToken; token == "" {
 			break
 		}
 	}
 }
 // sortRepos orders repos by the column key; ties keep the order by name.
-func sortRepos(repos []*pb.Repo, key string, desc bool) {
+func sortRepos(repos []ports.RepoView, key string, desc bool) {
-	less := func(a, b *pb.Repo) bool {
+	less := func(a, b ports.RepoView) bool {
 		switch key {
 		case "desc":
-			return strings.ToLower(a.GetDescription()) < strings.ToLower(b.GetDescription())
+			return strings.ToLower(a.Description) < strings.ToLower(b.Description)
 		case "branch":
-			return a.GetDefaultBranch() < b.GetDefaultBranch()
+			return a.DefaultBranch < b.DefaultBranch
 		case "push":
-			return a.GetPushedAt().AsTime().Before(b.GetPushedAt().AsTime())
+			return a.PushedAt.Before(b.PushedAt)
 		}
-		return a.GetName() < b.GetName()
+		return a.Name.String() < b.Name.String()
 	}
 	sort.SliceStable(repos, func(i, j int) bool {
 		if desc {
 }
 // homeRow is the row of a repository in the home list.
-func homeRow(r *pb.Repo, now time.Time, cursor bool) HomeRow {
+func homeRow(r ports.RepoView, now time.Time, cursor bool) HomeRow {
+	name := r.Name.String()
 	row := HomeRow{
-		ID: "repo-" + r.GetName(), Name: r.GetName(), Href: repoHref(r.GetName()),
+		ID: "repo-" + name, Name: name, Href: repoHref(name),
-		Desc: r.GetDescription(), Pushed: "never", Branch: r.GetDefaultBranch(), Cursor: cursor,
+		Desc: r.Description, Pushed: "never", Branch: r.DefaultBranch, Cursor: cursor,
 	}
-	if r.GetPushedAt().IsValid() && r.GetPushedAt().GetSeconds() != 0 {
+	if !r.PushedAt.IsZero() {
-		t := r.GetPushedAt().AsTime()
+		row.Pushed, row.PushedAt = ago(now, r.PushedAt), rfc3339(r.PushedAt)
-		row.Pushed, row.PushedAt = ago(now, t), rfc3339(t)
 	}
 	return row
 }
 // repoCmds are the repositories as targets of the ":" command line, but the
 // one being viewed.
-func repoCmds(repos []*pb.Repo, except string) []CmdItem {
+func repoCmds(repos []ports.RepoView, except string) []CmdItem {
 	var out []CmdItem
 	for _, r := range repos {
-		if r.GetName() != except {
+		if name := r.Name.String(); name != except {
-			out = append(out, CmdItem{Kind: "repo", Label: r.GetName(), Href: repoHref(r.GetName())})
+			out = append(out, CmdItem{Kind: "repo", Label: name, Href: repoHref(name)})
 		}
 	}
 	return out

D internal/adapters/web/mocks/GitServiceClient.go +0 -457

@@ -1,457 +0,0 @@
1	-	// Code generated by mockery; DO NOT EDIT.
2	-	// github.com/vektra/mockery
3	-	// template: testify
4	-
5	-	package mocks
6	-
7	-	import (
8	-	"context"
9	-
10	-	"bnema.dev/ermite-api/gen/ermite"
11	-	"connectrpc.com/connect"
12	-	mock "github.com/stretchr/testify/mock"
13	-	)
14	-
15	-	// NewGitServiceClient creates a new instance of GitServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
16	-	// The first argument is typically a *testing.T value.
17	-	func NewGitServiceClient(t interface {
18	-	mock.TestingT
19	-	Cleanup(func())
20	-	}) *GitServiceClient {
21	-	if helper, ok := t.(interface{ Helper() }); ok {
22	-	helper.Helper()
23	-	}
24	-
25	-	mock := &GitServiceClient{}
26	-	mock.Mock.Test(t)
27	-
28	-	t.Cleanup(func() {
29	-	if helper, ok := t.(interface{ Helper() }); ok {
30	-	helper.Helper()
31	-	}
32	-	mock.AssertExpectations(t)
33	-	})
34	-
35	-	return mock
36	-	}
37	-
38	-	// GitServiceClient is an autogenerated mock type for the GitServiceClient type
39	-	type GitServiceClient struct {
40	-	mock.Mock
41	-	}
42	-
43	-	type GitServiceClient_Expecter struct {
44	-	mock *mock.Mock
45	-	}
46	-
47	-	func (_m GitServiceClient) EXPECT() GitServiceClient_Expecter {
48	-	return &GitServiceClient_Expecter{mock: &_m.Mock}
49	-	}
50	-
51	-	// GetBlob provides a mock function for the type GitServiceClient
52	-	func (_mock GitServiceClient) GetBlob(context1 context.Context, request connect.Request[ermite.GetBlobRequest]) (*connect.ServerStreamForClient[ermite.GetBlobResponse], error) {
53	-	ret := _mock.Called(context1, request)
54	-
55	-	if len(ret) == 0 {
56	-	panic("no return value specified for GetBlob")
57	-	}
58	-
59	-	var r0 *connect.ServerStreamForClient[ermite.GetBlobResponse]
60	-	var r1 error
61	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetBlobRequest]) (connect.ServerStreamForClient[ermite.GetBlobResponse], error)); ok {
62	-	return returnFunc(context1, request)
63	-	}
64	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetBlobRequest]) connect.ServerStreamForClient[ermite.GetBlobResponse]); ok {
65	-	r0 = returnFunc(context1, request)
66	-	} else {
67	-	if ret.Get(0) != nil {
68	-	r0 = ret.Get(0).(*connect.ServerStreamForClient[ermite.GetBlobResponse])
69	-	}
70	-	}
71	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.GetBlobRequest]) error); ok {
72	-	r1 = returnFunc(context1, request)
73	-	} else {
74	-	r1 = ret.Error(1)
75	-	}
76	-	return r0, r1
77	-	}
78	-
79	-	// GitServiceClient_GetBlob_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetBlob'
80	-	type GitServiceClient_GetBlob_Call struct {
81	-	*mock.Call
82	-	}
83	-
84	-	// GetBlob is a helper method to define mock.On call
85	-	// - context1 context.Context
86	-	// - request *connect.Request[ermite.GetBlobRequest]
87	-	func (_e GitServiceClient_Expecter) GetBlob(context1 any, request any) GitServiceClient_GetBlob_Call {
88	-	return &GitServiceClient_GetBlob_Call{Call: _e.mock.On("GetBlob", context1, request)}
89	-	}
90	-
91	-	func (_c GitServiceClient_GetBlob_Call) Run(run func(context1 context.Context, request connect.Request[ermite.GetBlobRequest])) *GitServiceClient_GetBlob_Call {
92	-	_c.Call.Run(func(args mock.Arguments) {
93	-	var arg0 context.Context
94	-	if args[0] != nil {
95	-	arg0 = args[0].(context.Context)
96	-	}
97	-	var arg1 *connect.Request[ermite.GetBlobRequest]
98	-	if args[1] != nil {
99	-	arg1 = args[1].(*connect.Request[ermite.GetBlobRequest])
100	-	}
101	-	run(
102	-	arg0,
103	-	arg1,
104	-	)
105	-	})
106	-	return _c
107	-	}
108	-
109	-	func (_c GitServiceClient_GetBlob_Call) Return(serverStreamForClient connect.ServerStreamForClient[ermite.GetBlobResponse], err error) *GitServiceClient_GetBlob_Call {
110	-	_c.Call.Return(serverStreamForClient, err)
111	-	return _c
112	-	}
113	-
114	-	func (_c GitServiceClient_GetBlob_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.GetBlobRequest]) (connect.ServerStreamForClient[ermite.GetBlobResponse], error)) GitServiceClient_GetBlob_Call {
115	-	_c.Call.Return(run)
116	-	return _c
117	-	}
118	-
119	-	// GetCommit provides a mock function for the type GitServiceClient
120	-	func (_mock GitServiceClient) GetCommit(context1 context.Context, request connect.Request[ermite.GetCommitRequest]) (*connect.Response[ermite.GetCommitResponse], error) {
121	-	ret := _mock.Called(context1, request)
122	-
123	-	if len(ret) == 0 {
124	-	panic("no return value specified for GetCommit")
125	-	}
126	-
127	-	var r0 *connect.Response[ermite.GetCommitResponse]
128	-	var r1 error
129	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetCommitRequest]) (connect.Response[ermite.GetCommitResponse], error)); ok {
130	-	return returnFunc(context1, request)
131	-	}
132	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetCommitRequest]) connect.Response[ermite.GetCommitResponse]); ok {
133	-	r0 = returnFunc(context1, request)
134	-	} else {
135	-	if ret.Get(0) != nil {
136	-	r0 = ret.Get(0).(*connect.Response[ermite.GetCommitResponse])
137	-	}
138	-	}
139	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.GetCommitRequest]) error); ok {
140	-	r1 = returnFunc(context1, request)
141	-	} else {
142	-	r1 = ret.Error(1)
143	-	}
144	-	return r0, r1
145	-	}
146	-
147	-	// GitServiceClient_GetCommit_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetCommit'
148	-	type GitServiceClient_GetCommit_Call struct {
149	-	*mock.Call
150	-	}
151	-
152	-	// GetCommit is a helper method to define mock.On call
153	-	// - context1 context.Context
154	-	// - request *connect.Request[ermite.GetCommitRequest]
155	-	func (_e GitServiceClient_Expecter) GetCommit(context1 any, request any) GitServiceClient_GetCommit_Call {
156	-	return &GitServiceClient_GetCommit_Call{Call: _e.mock.On("GetCommit", context1, request)}
157	-	}
158	-
159	-	func (_c GitServiceClient_GetCommit_Call) Run(run func(context1 context.Context, request connect.Request[ermite.GetCommitRequest])) *GitServiceClient_GetCommit_Call {
160	-	_c.Call.Run(func(args mock.Arguments) {
161	-	var arg0 context.Context
162	-	if args[0] != nil {
163	-	arg0 = args[0].(context.Context)
164	-	}
165	-	var arg1 *connect.Request[ermite.GetCommitRequest]
166	-	if args[1] != nil {
167	-	arg1 = args[1].(*connect.Request[ermite.GetCommitRequest])
168	-	}
169	-	run(
170	-	arg0,
171	-	arg1,
172	-	)
173	-	})
174	-	return _c
175	-	}
176	-
177	-	func (_c GitServiceClient_GetCommit_Call) Return(response connect.Response[ermite.GetCommitResponse], err error) *GitServiceClient_GetCommit_Call {
178	-	_c.Call.Return(response, err)
179	-	return _c
180	-	}
181	-
182	-	func (_c GitServiceClient_GetCommit_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.GetCommitRequest]) (connect.Response[ermite.GetCommitResponse], error)) GitServiceClient_GetCommit_Call {
183	-	_c.Call.Return(run)
184	-	return _c
185	-	}
186	-
187	-	// GetTree provides a mock function for the type GitServiceClient
188	-	func (_mock GitServiceClient) GetTree(context1 context.Context, request connect.Request[ermite.GetTreeRequest]) (*connect.Response[ermite.GetTreeResponse], error) {
189	-	ret := _mock.Called(context1, request)
190	-
191	-	if len(ret) == 0 {
192	-	panic("no return value specified for GetTree")
193	-	}
194	-
195	-	var r0 *connect.Response[ermite.GetTreeResponse]
196	-	var r1 error
197	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetTreeRequest]) (connect.Response[ermite.GetTreeResponse], error)); ok {
198	-	return returnFunc(context1, request)
199	-	}
200	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetTreeRequest]) connect.Response[ermite.GetTreeResponse]); ok {
201	-	r0 = returnFunc(context1, request)
202	-	} else {
203	-	if ret.Get(0) != nil {
204	-	r0 = ret.Get(0).(*connect.Response[ermite.GetTreeResponse])
205	-	}
206	-	}
207	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.GetTreeRequest]) error); ok {
208	-	r1 = returnFunc(context1, request)
209	-	} else {
210	-	r1 = ret.Error(1)
211	-	}
212	-	return r0, r1
213	-	}
214	-
215	-	// GitServiceClient_GetTree_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTree'
216	-	type GitServiceClient_GetTree_Call struct {
217	-	*mock.Call
218	-	}
219	-
220	-	// GetTree is a helper method to define mock.On call
221	-	// - context1 context.Context
222	-	// - request *connect.Request[ermite.GetTreeRequest]
223	-	func (_e GitServiceClient_Expecter) GetTree(context1 any, request any) GitServiceClient_GetTree_Call {
224	-	return &GitServiceClient_GetTree_Call{Call: _e.mock.On("GetTree", context1, request)}
225	-	}
226	-
227	-	func (_c GitServiceClient_GetTree_Call) Run(run func(context1 context.Context, request connect.Request[ermite.GetTreeRequest])) *GitServiceClient_GetTree_Call {
228	-	_c.Call.Run(func(args mock.Arguments) {
229	-	var arg0 context.Context
230	-	if args[0] != nil {
231	-	arg0 = args[0].(context.Context)
232	-	}
233	-	var arg1 *connect.Request[ermite.GetTreeRequest]
234	-	if args[1] != nil {
235	-	arg1 = args[1].(*connect.Request[ermite.GetTreeRequest])
236	-	}
237	-	run(
238	-	arg0,
239	-	arg1,
240	-	)
241	-	})
242	-	return _c
243	-	}
244	-
245	-	func (_c GitServiceClient_GetTree_Call) Return(response connect.Response[ermite.GetTreeResponse], err error) *GitServiceClient_GetTree_Call {
246	-	_c.Call.Return(response, err)
247	-	return _c
248	-	}
249	-
250	-	func (_c GitServiceClient_GetTree_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.GetTreeRequest]) (connect.Response[ermite.GetTreeResponse], error)) GitServiceClient_GetTree_Call {
251	-	_c.Call.Return(run)
252	-	return _c
253	-	}
254	-
255	-	// ListCommits provides a mock function for the type GitServiceClient
256	-	func (_mock GitServiceClient) ListCommits(context1 context.Context, request connect.Request[ermite.ListCommitsRequest]) (*connect.Response[ermite.ListCommitsResponse], error) {
257	-	ret := _mock.Called(context1, request)
258	-
259	-	if len(ret) == 0 {
260	-	panic("no return value specified for ListCommits")
261	-	}
262	-
263	-	var r0 *connect.Response[ermite.ListCommitsResponse]
264	-	var r1 error
265	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListCommitsRequest]) (connect.Response[ermite.ListCommitsResponse], error)); ok {
266	-	return returnFunc(context1, request)
267	-	}
268	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListCommitsRequest]) connect.Response[ermite.ListCommitsResponse]); ok {
269	-	r0 = returnFunc(context1, request)
270	-	} else {
271	-	if ret.Get(0) != nil {
272	-	r0 = ret.Get(0).(*connect.Response[ermite.ListCommitsResponse])
273	-	}
274	-	}
275	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.ListCommitsRequest]) error); ok {
276	-	r1 = returnFunc(context1, request)
277	-	} else {
278	-	r1 = ret.Error(1)
279	-	}
280	-	return r0, r1
281	-	}
282	-
283	-	// GitServiceClient_ListCommits_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListCommits'
284	-	type GitServiceClient_ListCommits_Call struct {
285	-	*mock.Call
286	-	}
287	-
288	-	// ListCommits is a helper method to define mock.On call
289	-	// - context1 context.Context
290	-	// - request *connect.Request[ermite.ListCommitsRequest]
291	-	func (_e GitServiceClient_Expecter) ListCommits(context1 any, request any) GitServiceClient_ListCommits_Call {
292	-	return &GitServiceClient_ListCommits_Call{Call: _e.mock.On("ListCommits", context1, request)}
293	-	}
294	-
295	-	func (_c GitServiceClient_ListCommits_Call) Run(run func(context1 context.Context, request connect.Request[ermite.ListCommitsRequest])) *GitServiceClient_ListCommits_Call {
296	-	_c.Call.Run(func(args mock.Arguments) {
297	-	var arg0 context.Context
298	-	if args[0] != nil {
299	-	arg0 = args[0].(context.Context)
300	-	}
301	-	var arg1 *connect.Request[ermite.ListCommitsRequest]
302	-	if args[1] != nil {
303	-	arg1 = args[1].(*connect.Request[ermite.ListCommitsRequest])
304	-	}
305	-	run(
306	-	arg0,
307	-	arg1,
308	-	)
309	-	})
310	-	return _c
311	-	}
312	-
313	-	func (_c GitServiceClient_ListCommits_Call) Return(response connect.Response[ermite.ListCommitsResponse], err error) *GitServiceClient_ListCommits_Call {
314	-	_c.Call.Return(response, err)
315	-	return _c
316	-	}
317	-
318	-	func (_c GitServiceClient_ListCommits_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.ListCommitsRequest]) (connect.Response[ermite.ListCommitsResponse], error)) GitServiceClient_ListCommits_Call {
319	-	_c.Call.Return(run)
320	-	return _c
321	-	}
322	-
323	-	// ListRefs provides a mock function for the type GitServiceClient
324	-	func (_mock GitServiceClient) ListRefs(context1 context.Context, request connect.Request[ermite.ListRefsRequest]) (*connect.Response[ermite.ListRefsResponse], error) {
325	-	ret := _mock.Called(context1, request)
326	-
327	-	if len(ret) == 0 {
328	-	panic("no return value specified for ListRefs")
329	-	}
330	-
331	-	var r0 *connect.Response[ermite.ListRefsResponse]
332	-	var r1 error
333	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListRefsRequest]) (connect.Response[ermite.ListRefsResponse], error)); ok {
334	-	return returnFunc(context1, request)
335	-	}
336	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListRefsRequest]) connect.Response[ermite.ListRefsResponse]); ok {
337	-	r0 = returnFunc(context1, request)
338	-	} else {
339	-	if ret.Get(0) != nil {
340	-	r0 = ret.Get(0).(*connect.Response[ermite.ListRefsResponse])
341	-	}
342	-	}
343	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.ListRefsRequest]) error); ok {
344	-	r1 = returnFunc(context1, request)
345	-	} else {
346	-	r1 = ret.Error(1)
347	-	}
348	-	return r0, r1
349	-	}
350	-
351	-	// GitServiceClient_ListRefs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListRefs'
352	-	type GitServiceClient_ListRefs_Call struct {
353	-	*mock.Call
354	-	}
355	-
356	-	// ListRefs is a helper method to define mock.On call
357	-	// - context1 context.Context
358	-	// - request *connect.Request[ermite.ListRefsRequest]
359	-	func (_e GitServiceClient_Expecter) ListRefs(context1 any, request any) GitServiceClient_ListRefs_Call {
360	-	return &GitServiceClient_ListRefs_Call{Call: _e.mock.On("ListRefs", context1, request)}
361	-	}
362	-
363	-	func (_c GitServiceClient_ListRefs_Call) Run(run func(context1 context.Context, request connect.Request[ermite.ListRefsRequest])) *GitServiceClient_ListRefs_Call {
364	-	_c.Call.Run(func(args mock.Arguments) {
365	-	var arg0 context.Context
366	-	if args[0] != nil {
367	-	arg0 = args[0].(context.Context)
368	-	}
369	-	var arg1 *connect.Request[ermite.ListRefsRequest]
370	-	if args[1] != nil {
371	-	arg1 = args[1].(*connect.Request[ermite.ListRefsRequest])
372	-	}
373	-	run(
374	-	arg0,
375	-	arg1,
376	-	)
377	-	})
378	-	return _c
379	-	}
380	-
381	-	func (_c GitServiceClient_ListRefs_Call) Return(response connect.Response[ermite.ListRefsResponse], err error) *GitServiceClient_ListRefs_Call {
382	-	_c.Call.Return(response, err)
383	-	return _c
384	-	}
385	-
386	-	func (_c GitServiceClient_ListRefs_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.ListRefsRequest]) (connect.Response[ermite.ListRefsResponse], error)) GitServiceClient_ListRefs_Call {
387	-	_c.Call.Return(run)
388	-	return _c
389	-	}
390	-
391	-	// ResolveRevision provides a mock function for the type GitServiceClient
392	-	func (_mock GitServiceClient) ResolveRevision(context1 context.Context, request connect.Request[ermite.ResolveRevisionRequest]) (*connect.Response[ermite.ResolveRevisionResponse], error) {
393	-	ret := _mock.Called(context1, request)
394	-
395	-	if len(ret) == 0 {
396	-	panic("no return value specified for ResolveRevision")
397	-	}
398	-
399	-	var r0 *connect.Response[ermite.ResolveRevisionResponse]
400	-	var r1 error
401	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ResolveRevisionRequest]) (connect.Response[ermite.ResolveRevisionResponse], error)); ok {
402	-	return returnFunc(context1, request)
403	-	}
404	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ResolveRevisionRequest]) connect.Response[ermite.ResolveRevisionResponse]); ok {
405	-	r0 = returnFunc(context1, request)
406	-	} else {
407	-	if ret.Get(0) != nil {
408	-	r0 = ret.Get(0).(*connect.Response[ermite.ResolveRevisionResponse])
409	-	}
410	-	}
411	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.ResolveRevisionRequest]) error); ok {
412	-	r1 = returnFunc(context1, request)
413	-	} else {
414	-	r1 = ret.Error(1)
415	-	}
416	-	return r0, r1
417	-	}
418	-
419	-	// GitServiceClient_ResolveRevision_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ResolveRevision'
420	-	type GitServiceClient_ResolveRevision_Call struct {
421	-	*mock.Call
422	-	}
423	-
424	-	// ResolveRevision is a helper method to define mock.On call
425	-	// - context1 context.Context
426	-	// - request *connect.Request[ermite.ResolveRevisionRequest]
427	-	func (_e GitServiceClient_Expecter) ResolveRevision(context1 any, request any) GitServiceClient_ResolveRevision_Call {
428	-	return &GitServiceClient_ResolveRevision_Call{Call: _e.mock.On("ResolveRevision", context1, request)}
429	-	}
430	-
431	-	func (_c GitServiceClient_ResolveRevision_Call) Run(run func(context1 context.Context, request connect.Request[ermite.ResolveRevisionRequest])) *GitServiceClient_ResolveRevision_Call {
432	-	_c.Call.Run(func(args mock.Arguments) {
433	-	var arg0 context.Context
434	-	if args[0] != nil {
435	-	arg0 = args[0].(context.Context)
436	-	}
437	-	var arg1 *connect.Request[ermite.ResolveRevisionRequest]
438	-	if args[1] != nil {
439	-	arg1 = args[1].(*connect.Request[ermite.ResolveRevisionRequest])
440	-	}
441	-	run(
442	-	arg0,
443	-	arg1,
444	-	)
445	-	})
446	-	return _c
447	-	}
448	-
449	-	func (_c GitServiceClient_ResolveRevision_Call) Return(response connect.Response[ermite.ResolveRevisionResponse], err error) *GitServiceClient_ResolveRevision_Call {
450	-	_c.Call.Return(response, err)
451	-	return _c
452	-	}
453	-
454	-	func (_c GitServiceClient_ResolveRevision_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.ResolveRevisionRequest]) (connect.Response[ermite.ResolveRevisionResponse], error)) GitServiceClient_ResolveRevision_Call {
455	-	_c.Call.Return(run)
456	-	return _c
457	-	}

D internal/adapters/web/mocks/RepoServiceClient.go +0 -389

@@ -1,389 +0,0 @@
1	-	// Code generated by mockery; DO NOT EDIT.
2	-	// github.com/vektra/mockery
3	-	// template: testify
4	-
5	-	package mocks
6	-
7	-	import (
8	-	"context"
9	-
10	-	"bnema.dev/ermite-api/gen/ermite"
11	-	"connectrpc.com/connect"
12	-	mock "github.com/stretchr/testify/mock"
13	-	)
14	-
15	-	// NewRepoServiceClient creates a new instance of RepoServiceClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
16	-	// The first argument is typically a *testing.T value.
17	-	func NewRepoServiceClient(t interface {
18	-	mock.TestingT
19	-	Cleanup(func())
20	-	}) *RepoServiceClient {
21	-	if helper, ok := t.(interface{ Helper() }); ok {
22	-	helper.Helper()
23	-	}
24	-
25	-	mock := &RepoServiceClient{}
26	-	mock.Mock.Test(t)
27	-
28	-	t.Cleanup(func() {
29	-	if helper, ok := t.(interface{ Helper() }); ok {
30	-	helper.Helper()
31	-	}
32	-	mock.AssertExpectations(t)
33	-	})
34	-
35	-	return mock
36	-	}
37	-
38	-	// RepoServiceClient is an autogenerated mock type for the RepoServiceClient type
39	-	type RepoServiceClient struct {
40	-	mock.Mock
41	-	}
42	-
43	-	type RepoServiceClient_Expecter struct {
44	-	mock *mock.Mock
45	-	}
46	-
47	-	func (_m RepoServiceClient) EXPECT() RepoServiceClient_Expecter {
48	-	return &RepoServiceClient_Expecter{mock: &_m.Mock}
49	-	}
50	-
51	-	// CreateRepo provides a mock function for the type RepoServiceClient
52	-	func (_mock RepoServiceClient) CreateRepo(context1 context.Context, request connect.Request[ermite.CreateRepoRequest]) (*connect.Response[ermite.CreateRepoResponse], error) {
53	-	ret := _mock.Called(context1, request)
54	-
55	-	if len(ret) == 0 {
56	-	panic("no return value specified for CreateRepo")
57	-	}
58	-
59	-	var r0 *connect.Response[ermite.CreateRepoResponse]
60	-	var r1 error
61	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.CreateRepoRequest]) (connect.Response[ermite.CreateRepoResponse], error)); ok {
62	-	return returnFunc(context1, request)
63	-	}
64	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.CreateRepoRequest]) connect.Response[ermite.CreateRepoResponse]); ok {
65	-	r0 = returnFunc(context1, request)
66	-	} else {
67	-	if ret.Get(0) != nil {
68	-	r0 = ret.Get(0).(*connect.Response[ermite.CreateRepoResponse])
69	-	}
70	-	}
71	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.CreateRepoRequest]) error); ok {
72	-	r1 = returnFunc(context1, request)
73	-	} else {
74	-	r1 = ret.Error(1)
75	-	}
76	-	return r0, r1
77	-	}
78	-
79	-	// RepoServiceClient_CreateRepo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CreateRepo'
80	-	type RepoServiceClient_CreateRepo_Call struct {
81	-	*mock.Call
82	-	}
83	-
84	-	// CreateRepo is a helper method to define mock.On call
85	-	// - context1 context.Context
86	-	// - request *connect.Request[ermite.CreateRepoRequest]
87	-	func (_e RepoServiceClient_Expecter) CreateRepo(context1 any, request any) RepoServiceClient_CreateRepo_Call {
88	-	return &RepoServiceClient_CreateRepo_Call{Call: _e.mock.On("CreateRepo", context1, request)}
89	-	}
90	-
91	-	func (_c RepoServiceClient_CreateRepo_Call) Run(run func(context1 context.Context, request connect.Request[ermite.CreateRepoRequest])) *RepoServiceClient_CreateRepo_Call {
92	-	_c.Call.Run(func(args mock.Arguments) {
93	-	var arg0 context.Context
94	-	if args[0] != nil {
95	-	arg0 = args[0].(context.Context)
96	-	}
97	-	var arg1 *connect.Request[ermite.CreateRepoRequest]
98	-	if args[1] != nil {
99	-	arg1 = args[1].(*connect.Request[ermite.CreateRepoRequest])
100	-	}
101	-	run(
102	-	arg0,
103	-	arg1,
104	-	)
105	-	})
106	-	return _c
107	-	}
108	-
109	-	func (_c RepoServiceClient_CreateRepo_Call) Return(response connect.Response[ermite.CreateRepoResponse], err error) *RepoServiceClient_CreateRepo_Call {
110	-	_c.Call.Return(response, err)
111	-	return _c
112	-	}
113	-
114	-	func (_c RepoServiceClient_CreateRepo_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.CreateRepoRequest]) (connect.Response[ermite.CreateRepoResponse], error)) RepoServiceClient_CreateRepo_Call {
115	-	_c.Call.Return(run)
116	-	return _c
117	-	}
118	-
119	-	// DeleteRepo provides a mock function for the type RepoServiceClient
120	-	func (_mock RepoServiceClient) DeleteRepo(context1 context.Context, request connect.Request[ermite.DeleteRepoRequest]) (*connect.Response[ermite.DeleteRepoResponse], error) {
121	-	ret := _mock.Called(context1, request)
122	-
123	-	if len(ret) == 0 {
124	-	panic("no return value specified for DeleteRepo")
125	-	}
126	-
127	-	var r0 *connect.Response[ermite.DeleteRepoResponse]
128	-	var r1 error
129	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.DeleteRepoRequest]) (connect.Response[ermite.DeleteRepoResponse], error)); ok {
130	-	return returnFunc(context1, request)
131	-	}
132	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.DeleteRepoRequest]) connect.Response[ermite.DeleteRepoResponse]); ok {
133	-	r0 = returnFunc(context1, request)
134	-	} else {
135	-	if ret.Get(0) != nil {
136	-	r0 = ret.Get(0).(*connect.Response[ermite.DeleteRepoResponse])
137	-	}
138	-	}
139	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.DeleteRepoRequest]) error); ok {
140	-	r1 = returnFunc(context1, request)
141	-	} else {
142	-	r1 = ret.Error(1)
143	-	}
144	-	return r0, r1
145	-	}
146	-
147	-	// RepoServiceClient_DeleteRepo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteRepo'
148	-	type RepoServiceClient_DeleteRepo_Call struct {
149	-	*mock.Call
150	-	}
151	-
152	-	// DeleteRepo is a helper method to define mock.On call
153	-	// - context1 context.Context
154	-	// - request *connect.Request[ermite.DeleteRepoRequest]
155	-	func (_e RepoServiceClient_Expecter) DeleteRepo(context1 any, request any) RepoServiceClient_DeleteRepo_Call {
156	-	return &RepoServiceClient_DeleteRepo_Call{Call: _e.mock.On("DeleteRepo", context1, request)}
157	-	}
158	-
159	-	func (_c RepoServiceClient_DeleteRepo_Call) Run(run func(context1 context.Context, request connect.Request[ermite.DeleteRepoRequest])) *RepoServiceClient_DeleteRepo_Call {
160	-	_c.Call.Run(func(args mock.Arguments) {
161	-	var arg0 context.Context
162	-	if args[0] != nil {
163	-	arg0 = args[0].(context.Context)
164	-	}
165	-	var arg1 *connect.Request[ermite.DeleteRepoRequest]
166	-	if args[1] != nil {
167	-	arg1 = args[1].(*connect.Request[ermite.DeleteRepoRequest])
168	-	}
169	-	run(
170	-	arg0,
171	-	arg1,
172	-	)
173	-	})
174	-	return _c
175	-	}
176	-
177	-	func (_c RepoServiceClient_DeleteRepo_Call) Return(response connect.Response[ermite.DeleteRepoResponse], err error) *RepoServiceClient_DeleteRepo_Call {
178	-	_c.Call.Return(response, err)
179	-	return _c
180	-	}
181	-
182	-	func (_c RepoServiceClient_DeleteRepo_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.DeleteRepoRequest]) (connect.Response[ermite.DeleteRepoResponse], error)) RepoServiceClient_DeleteRepo_Call {
183	-	_c.Call.Return(run)
184	-	return _c
185	-	}
186	-
187	-	// GetRepo provides a mock function for the type RepoServiceClient
188	-	func (_mock RepoServiceClient) GetRepo(context1 context.Context, request connect.Request[ermite.GetRepoRequest]) (*connect.Response[ermite.GetRepoResponse], error) {
189	-	ret := _mock.Called(context1, request)
190	-
191	-	if len(ret) == 0 {
192	-	panic("no return value specified for GetRepo")
193	-	}
194	-
195	-	var r0 *connect.Response[ermite.GetRepoResponse]
196	-	var r1 error
197	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetRepoRequest]) (connect.Response[ermite.GetRepoResponse], error)); ok {
198	-	return returnFunc(context1, request)
199	-	}
200	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.GetRepoRequest]) connect.Response[ermite.GetRepoResponse]); ok {
201	-	r0 = returnFunc(context1, request)
202	-	} else {
203	-	if ret.Get(0) != nil {
204	-	r0 = ret.Get(0).(*connect.Response[ermite.GetRepoResponse])
205	-	}
206	-	}
207	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.GetRepoRequest]) error); ok {
208	-	r1 = returnFunc(context1, request)
209	-	} else {
210	-	r1 = ret.Error(1)
211	-	}
212	-	return r0, r1
213	-	}
214	-
215	-	// RepoServiceClient_GetRepo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetRepo'
216	-	type RepoServiceClient_GetRepo_Call struct {
217	-	*mock.Call
218	-	}
219	-
220	-	// GetRepo is a helper method to define mock.On call
221	-	// - context1 context.Context
222	-	// - request *connect.Request[ermite.GetRepoRequest]
223	-	func (_e RepoServiceClient_Expecter) GetRepo(context1 any, request any) RepoServiceClient_GetRepo_Call {
224	-	return &RepoServiceClient_GetRepo_Call{Call: _e.mock.On("GetRepo", context1, request)}
225	-	}
226	-
227	-	func (_c RepoServiceClient_GetRepo_Call) Run(run func(context1 context.Context, request connect.Request[ermite.GetRepoRequest])) *RepoServiceClient_GetRepo_Call {
228	-	_c.Call.Run(func(args mock.Arguments) {
229	-	var arg0 context.Context
230	-	if args[0] != nil {
231	-	arg0 = args[0].(context.Context)
232	-	}
233	-	var arg1 *connect.Request[ermite.GetRepoRequest]
234	-	if args[1] != nil {
235	-	arg1 = args[1].(*connect.Request[ermite.GetRepoRequest])
236	-	}
237	-	run(
238	-	arg0,
239	-	arg1,
240	-	)
241	-	})
242	-	return _c
243	-	}
244	-
245	-	func (_c RepoServiceClient_GetRepo_Call) Return(response connect.Response[ermite.GetRepoResponse], err error) *RepoServiceClient_GetRepo_Call {
246	-	_c.Call.Return(response, err)
247	-	return _c
248	-	}
249	-
250	-	func (_c RepoServiceClient_GetRepo_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.GetRepoRequest]) (connect.Response[ermite.GetRepoResponse], error)) RepoServiceClient_GetRepo_Call {
251	-	_c.Call.Return(run)
252	-	return _c
253	-	}
254	-
255	-	// ListRepos provides a mock function for the type RepoServiceClient
256	-	func (_mock RepoServiceClient) ListRepos(context1 context.Context, request connect.Request[ermite.ListReposRequest]) (*connect.Response[ermite.ListReposResponse], error) {
257	-	ret := _mock.Called(context1, request)
258	-
259	-	if len(ret) == 0 {
260	-	panic("no return value specified for ListRepos")
261	-	}
262	-
263	-	var r0 *connect.Response[ermite.ListReposResponse]
264	-	var r1 error
265	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListReposRequest]) (connect.Response[ermite.ListReposResponse], error)); ok {
266	-	return returnFunc(context1, request)
267	-	}
268	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.ListReposRequest]) connect.Response[ermite.ListReposResponse]); ok {
269	-	r0 = returnFunc(context1, request)
270	-	} else {
271	-	if ret.Get(0) != nil {
272	-	r0 = ret.Get(0).(*connect.Response[ermite.ListReposResponse])
273	-	}
274	-	}
275	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.ListReposRequest]) error); ok {
276	-	r1 = returnFunc(context1, request)
277	-	} else {
278	-	r1 = ret.Error(1)
279	-	}
280	-	return r0, r1
281	-	}
282	-
283	-	// RepoServiceClient_ListRepos_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListRepos'
284	-	type RepoServiceClient_ListRepos_Call struct {
285	-	*mock.Call
286	-	}
287	-
288	-	// ListRepos is a helper method to define mock.On call
289	-	// - context1 context.Context
290	-	// - request *connect.Request[ermite.ListReposRequest]
291	-	func (_e RepoServiceClient_Expecter) ListRepos(context1 any, request any) RepoServiceClient_ListRepos_Call {
292	-	return &RepoServiceClient_ListRepos_Call{Call: _e.mock.On("ListRepos", context1, request)}
293	-	}
294	-
295	-	func (_c RepoServiceClient_ListRepos_Call) Run(run func(context1 context.Context, request connect.Request[ermite.ListReposRequest])) *RepoServiceClient_ListRepos_Call {
296	-	_c.Call.Run(func(args mock.Arguments) {
297	-	var arg0 context.Context
298	-	if args[0] != nil {
299	-	arg0 = args[0].(context.Context)
300	-	}
301	-	var arg1 *connect.Request[ermite.ListReposRequest]
302	-	if args[1] != nil {
303	-	arg1 = args[1].(*connect.Request[ermite.ListReposRequest])
304	-	}
305	-	run(
306	-	arg0,
307	-	arg1,
308	-	)
309	-	})
310	-	return _c
311	-	}
312	-
313	-	func (_c RepoServiceClient_ListRepos_Call) Return(response connect.Response[ermite.ListReposResponse], err error) *RepoServiceClient_ListRepos_Call {
314	-	_c.Call.Return(response, err)
315	-	return _c
316	-	}
317	-
318	-	func (_c RepoServiceClient_ListRepos_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.ListReposRequest]) (connect.Response[ermite.ListReposResponse], error)) RepoServiceClient_ListRepos_Call {
319	-	_c.Call.Return(run)
320	-	return _c
321	-	}
322	-
323	-	// UpdateRepo provides a mock function for the type RepoServiceClient
324	-	func (_mock RepoServiceClient) UpdateRepo(context1 context.Context, request connect.Request[ermite.UpdateRepoRequest]) (*connect.Response[ermite.UpdateRepoResponse], error) {
325	-	ret := _mock.Called(context1, request)
326	-
327	-	if len(ret) == 0 {
328	-	panic("no return value specified for UpdateRepo")
329	-	}
330	-
331	-	var r0 *connect.Response[ermite.UpdateRepoResponse]
332	-	var r1 error
333	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.UpdateRepoRequest]) (connect.Response[ermite.UpdateRepoResponse], error)); ok {
334	-	return returnFunc(context1, request)
335	-	}
336	-	if returnFunc, ok := ret.Get(0).(func(context.Context, connect.Request[ermite.UpdateRepoRequest]) connect.Response[ermite.UpdateRepoResponse]); ok {
337	-	r0 = returnFunc(context1, request)
338	-	} else {
339	-	if ret.Get(0) != nil {
340	-	r0 = ret.Get(0).(*connect.Response[ermite.UpdateRepoResponse])
341	-	}
342	-	}
343	-	if returnFunc, ok := ret.Get(1).(func(context.Context, *connect.Request[ermite.UpdateRepoRequest]) error); ok {
344	-	r1 = returnFunc(context1, request)
345	-	} else {
346	-	r1 = ret.Error(1)
347	-	}
348	-	return r0, r1
349	-	}
350	-
351	-	// RepoServiceClient_UpdateRepo_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UpdateRepo'
352	-	type RepoServiceClient_UpdateRepo_Call struct {
353	-	*mock.Call
354	-	}
355	-
356	-	// UpdateRepo is a helper method to define mock.On call
357	-	// - context1 context.Context
358	-	// - request *connect.Request[ermite.UpdateRepoRequest]
359	-	func (_e RepoServiceClient_Expecter) UpdateRepo(context1 any, request any) RepoServiceClient_UpdateRepo_Call {
360	-	return &RepoServiceClient_UpdateRepo_Call{Call: _e.mock.On("UpdateRepo", context1, request)}
361	-	}
362	-
363	-	func (_c RepoServiceClient_UpdateRepo_Call) Run(run func(context1 context.Context, request connect.Request[ermite.UpdateRepoRequest])) *RepoServiceClient_UpdateRepo_Call {
364	-	_c.Call.Run(func(args mock.Arguments) {
365	-	var arg0 context.Context
366	-	if args[0] != nil {
367	-	arg0 = args[0].(context.Context)
368	-	}
369	-	var arg1 *connect.Request[ermite.UpdateRepoRequest]
370	-	if args[1] != nil {
371	-	arg1 = args[1].(*connect.Request[ermite.UpdateRepoRequest])
372	-	}
373	-	run(
374	-	arg0,
375	-	arg1,
376	-	)
377	-	})
378	-	return _c
379	-	}
380	-
381	-	func (_c RepoServiceClient_UpdateRepo_Call) Return(response connect.Response[ermite.UpdateRepoResponse], err error) *RepoServiceClient_UpdateRepo_Call {
382	-	_c.Call.Return(response, err)
383	-	return _c
384	-	}
385	-
386	-	func (_c RepoServiceClient_UpdateRepo_Call) RunAndReturn(run func(context1 context.Context, request connect.Request[ermite.UpdateRepoRequest]) (connect.Response[ermite.UpdateRepoResponse], error)) RepoServiceClient_UpdateRepo_Call {
387	-	_c.Call.Return(run)
388	-	return _c
389	-	}

M internal/adapters/web/mr.go +111 -116

 	"strconv"
 	"strings"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // The merge request pages (ADR 0017). They read through MergeRequestService
-// and GitService as the visitor of the request: anonymous sees the merge
+// and BrowseService as the visitor of the request: anonymous sees the merge
 // requests of public repositories, the signed-in owner those of every
 // repository, and only the owner gets the forms (mr_post.go handles them).
 //
 const (
 	// mrPerPage is how many decided merge requests a page of the list shows,
-	// at least; pages of the API are read whole.
+	// at least; pages of the use case are read whole.
 	mrPerPage = 50
-	// maxMRPages bounds the API pages one list page reads.
+	// maxMRPages bounds the pages of the use case one list page reads.
 	maxMRPages = 20
 	// maxOpenPages bounds the pages read for the open merge requests, which
 	// the first list page shows in full.
 	return n, nil
 }
-func stateName(s pb.MergeRequestState) string {
+func stateName(s domain.MRState) string {
 	switch s {
-	case pb.MergeRequestState_MERGE_REQUEST_STATE_OPEN:
+	case domain.MRStateOpen:
 		return "open"
-	case pb.MergeRequestState_MERGE_REQUEST_STATE_MERGED:
+	case domain.MRStateMerged:
 		return "merged"
-	case pb.MergeRequestState_MERGE_REQUEST_STATE_CLOSED:
+	case domain.MRStateClosed:
 		return "closed"
 	}
 	return "unknown"
 }
-func modeName(m pb.MergeMode) string {
+func modeName(m domain.MergeMode) string {
 	switch m {
-	case pb.MergeMode_MERGE_MODE_FAST_FORWARD:
+	case domain.MergeModeFastForward:
 		return "fast-forward"
-	case pb.MergeMode_MERGE_MODE_SQUASH:
+	case domain.MergeModeSquash:
 		return "squash"
 	}
 	return ""
 }
 // mrRow converts a merge request of a listing.
-func (s *Server) mrRow(repo string, m *pb.MergeRequest) MRRow {
+func (s *Server) mrRow(repo string, m domain.MergeRequest) MRRow {
 	row := MRRow{
-		Number: "!" + strconv.FormatInt(m.GetNumber(), 10), Href: mrHref(repo, m.GetNumber()),
+		Number: "!" + strconv.FormatInt(m.Number, 10), Href: mrHref(repo, m.Number),
-		Title: visibleText(m.GetTitle()), State: stateName(m.GetState()),
+		Title: visibleText(m.Title.String()), State: stateName(m.State),
-		Branches: visibleText(m.GetSourceBranch()) + " → " + visibleText(m.GetTargetBranch()),
+		Branches: visibleText(m.Source) + " → " + visibleText(m.Target),
-		Author:   visibleText(m.GetAuthor()),
+		Author:   visibleText(m.Author),
 	}
-	ts := m.GetUpdatedAt()
+	ts := m.UpdatedAt
-	if !ts.IsValid() {
+	if ts.IsZero() {
-		ts = m.GetCreatedAt()
+		ts = m.CreatedAt
 	}
 	row.When, row.WhenAt = whenOf(s.cfg.Now(), ts)
 	return row
 // mrList lists the merge requests: the open ones, then the merged and closed
 // ones, a page at a time. The decided ones are paged with the page token of
-// the API in "page"; the open ones show on the first page only.
+// the use case in "page"; the open ones show on the first page only.
 func (s *Server) mrList(ctx context.Context, r *http.Request) (templ.Component, int, error) {
 	d, err := s.loadRepo(ctx, r.PathValue("repo"))
 	if err != nil {
 		return nil, 0, err
 	}
 	token := r.URL.Query().Get("page")
-	p := MRListPage{Default: visibleText(d.repo.GetDefaultBranch())}
+	p := MRListPage{Default: visibleText(d.repo.DefaultBranch)}
 	p.CLI = Clone{ID: "cli-new", Lines: []string{"ermite mr create " + shellWord(d.name()) + " --source <branch> --title <title>"}}
 	base := mrBase(d.name())
 	if token == "" {
 		tok := ""
 		for i := 0; i < maxOpenPages; i++ {
-			res, err := s.cfg.MergeRequests.ListMergeRequests(ctx, connect.NewRequest(&pb.ListMergeRequestsRequest{
+			res, err := s.cfg.MergeRequests.List(ctx, principal(ctx), d.repo.Name, ports.ListMergeRequestsParams{
-				Repo: d.name(), State: pb.MergeRequestState_MERGE_REQUEST_STATE_OPEN, PageSize: pageSize, PageToken: tok,
+				State: domain.MRStateOpen, PageSize: pageSize, PageToken: tok,
-			}))
+			})
 			if err != nil {
 				return nil, 0, err
 			}
-			for _, m := range res.Msg.GetMergeRequests() {
+			for _, m := range res.MergeRequests {
 				p.Open = append(p.Open, s.mrRow(d.name(), m))
 			}
-			if tok = res.Msg.GetNextPageToken(); tok == "" {
+			if tok = res.NextPageToken; tok == "" {
 				break
 			}
 		}
 	tok := token
 	for i := 0; i < maxMRPages; i++ {
-		res, err := s.cfg.MergeRequests.ListMergeRequests(ctx, connect.NewRequest(&pb.ListMergeRequestsRequest{
+		res, err := s.cfg.MergeRequests.List(ctx, principal(ctx), d.repo.Name, ports.ListMergeRequestsParams{
-			Repo: d.name(), PageSize: pageSize, PageToken: tok,
+			PageSize: pageSize, PageToken: tok,
-		}))
+		})
 		if err != nil {
 			return nil, 0, err
 		}
-		for _, m := range res.Msg.GetMergeRequests() {
+		for _, m := range res.MergeRequests {
-			if m.GetState() != pb.MergeRequestState_MERGE_REQUEST_STATE_OPEN {
+			if m.State != domain.MRStateOpen {
 				p.Done = append(p.Done, s.mrRow(d.name(), m))
 			}
 		}
-		tok = res.Msg.GetNextPageToken()
+		tok = res.NextPageToken
 		if tok == "" || len(p.Done) >= mrPerPage {
 			break
 		}
 		p.Done[0].Cursor = true
 	}
 	for _, b := range d.branches {
-		if b.GetShortName() == d.repo.GetDefaultBranch() || len(p.Branches) >= railBranches {
+		if b.ShortName == d.repo.DefaultBranch || len(p.Branches) >= railBranches {
 			continue
 		}
-		p.Branches = append(p.Branches, BranchLink{Name: visibleText(b.GetShortName()), Href: repoHref(d.name(), "compare", b.GetShortName())})
+		p.Branches = append(p.Branches, BranchLink{Name: visibleText(b.ShortName), Href: repoHref(d.name(), "compare", b.ShortName)})
 	}
 	l := s.repoLayout(ctx, d, "merge-requests")
 	return s.mrPage(ctx, r, true)
 }
+//hexcheck:ignore suspicious-business-logic-in-adapter builds the merge request page from the use case results; no rule is decided here
 func (s *Server) mrPage(ctx context.Context, r *http.Request, since bool) (templ.Component, int, error) {
 	n, err := mrNumber(r)
 	if err != nil {
 	if err != nil {
 		return nil, 0, err
 	}
-	res, err := s.cfg.MergeRequests.GetMergeRequest(ctx, connect.NewRequest(&pb.GetMergeRequestRequest{
+	res, err := s.cfg.MergeRequests.Get(ctx, principal(ctx), d.repo.Name, n, since)
-		Repo: d.name(), Number: n, SinceLastRead: since,
-	}))
 	if err != nil {
 		return nil, 0, err
 	}
-	m := res.Msg.GetMergeRequest()
+	m := res.MergeRequest
-	if m == nil {
-		return nil, 0, errNotFound
-	}
 	now := s.cfg.Now()
 	signed := SignedIn(ctx)
-	open := m.GetState() == pb.MergeRequestState_MERGE_REQUEST_STATE_OPEN
+	open := m.State == domain.MRStateOpen
-	head := m.GetHeadId()
+	head := m.HeadID.String()
 	self := mrHref(d.name(), n)
 	if since {
 		self = mrHref(d.name(), n, "since")
 	}
 	p := MRPage{
-		Number: "!" + strconv.FormatInt(n, 10), Title: visibleText(m.GetTitle()),
+		Number: "!" + strconv.FormatInt(n, 10), Title: visibleText(m.Title.String()),
-		State: stateName(m.GetState()), Open: open, Signed: signed,
+		State: stateName(m.State), Open: open, Signed: signed,
-		Source: visibleText(m.GetSourceBranch()), Target: visibleText(m.GetTargetBranch()),
+		Source: visibleText(m.Source), Target: visibleText(m.Target),
-		Author: visibleText(m.GetAuthor()),
+		Author: visibleText(m.Author),
-		Desc:   plainParts(m.GetDescription()),
+		Desc:   plainParts(m.Description.String()),
 		Head:   head, HeadShort: short(head),
-		NFiles: int(res.Msg.GetStats().GetFilesChanged()),
+		NFiles: res.Stats.FilesChanged,
-		Adds:   int(res.Msg.GetStats().GetAdditions()),
+		Adds:   res.Stats.Additions,
-		Dels:   int(res.Msg.GetStats().GetDeletions()),
+		Dels:   res.Stats.Deletions,
-		Files:  diffFiles(res.Msg.GetDiff().GetFiles()),
+		Files:  diffFiles(res.Diff.Files),
 	}
 	p.Opened.Name = p.Author
-	p.Opened.When, p.Opened.WhenAt = whenOf(now, m.GetCreatedAt())
+	p.Opened.When, p.Opened.WhenAt = whenOf(now, m.CreatedAt)
-	if t := m.GetCreatedAt(); t.IsValid() {
+	if !m.CreatedAt.IsZero() {
-		p.Opened.Abs = absolute(t.AsTime())
+		p.Opened.Abs = absolute(m.CreatedAt)
 	}
-	p.Updated, p.UpdatedAt = whenOf(now, m.GetUpdatedAt())
+	p.Updated, p.UpdatedAt = whenOf(now, m.UpdatedAt)
 	for _, b := range d.branches {
-		switch b.GetShortName() {
+		switch b.ShortName {
-		case m.GetSourceBranch():
+		case m.Source:
-			p.SourceHref = repoHref(d.name(), "tree", b.GetShortName())
+			p.SourceHref = repoHref(d.name(), "tree", b.ShortName)
-		case m.GetTargetBranch():
+		case m.Target:
-			p.TargetHref = repoHref(d.name(), "tree", b.GetShortName())
+			p.TargetHref = repoHref(d.name(), "tree", b.ShortName)
 		}
 	}
-	if m.GetState() == pb.MergeRequestState_MERGE_REQUEST_STATE_MERGED && m.GetMergedCommitId() != "" {
+	if m.State == domain.MRStateMerged && !m.MergedCommitID.IsZero() {
-		p.MergedShort = short(m.GetMergedCommitId())
+		p.MergedShort = short(m.MergedCommitID.String())
-		p.MergedHref = repoHref(d.name(), "commit", m.GetMergedCommitId())
+		p.MergedHref = repoHref(d.name(), "commit", m.MergedCommitID.String())
-		p.MergeMode = modeName(m.GetMergeMode())
+		p.MergeMode = modeName(m.MergeMode)
 	}
-	if st := d.repo.GetSettings(); st != nil {
+	for _, mode := range d.repo.Settings.AllowedMergeModes {
-		for _, mode := range st.GetAllowedMergeModes() {
+		if name := modeName(mode); name != "" {
-			if name := modeName(mode); name != "" {
+			p.Modes = append(p.Modes, name)
-				p.Modes = append(p.Modes, name)
-			}
 		}
-		p.ChecksBlock = st.GetFailingChecksBlock()
 	}
-	p.Note = diffNote(res.Msg.GetDiff(), len(p.Files), p.NFiles)
+	p.ChecksBlock = d.repo.Settings.FailingChecksBlock
+	p.Note = diffNote(res.Diff, len(p.Files), p.NFiles)
 	// The commits of the request, newest first.
-	for _, c := range res.Msg.GetCommits() {
+	for _, c := range res.Commits {
 		row := commitRow(d.name(), c, now)
 		p.Commits = append(p.Commits, MRCommit{
 			Short: row.Short, Href: row.CHref, Subject: row.Subject, Author: row.Author, When: row.When, WhenAt: row.WhenAt,
 		})
 	}
-	lastRead := res.Msg.GetLastReadId()
+	lastRead := res.LastReadID.String()
 	if signed && lastRead != "" {
 		// The commits are newest first: those before the last read head are new.
 		// A head that is not among them (the branch was rewritten) marks none.
-		for i, c := range res.Msg.GetCommits() {
+		for i, c := range res.Commits {
-			if c.GetId() != lastRead {
+			if c.ID.String() != lastRead {
 				continue
 			}
 			for j := 0; j < i; j++ {
 			}
 		}
 	}
-	if res.Msg.GetCommitsTruncated() {
+	if res.CommitsTruncated {
 		p.CommitsNote = "the branch has more commits than the " + itoa(len(p.Commits)) + " listed."
 	}
 		switch {
 		case lastRead == "":
 			p.SinceNote = "nothing was marked read yet: this is the whole change."
-		case res.Msg.GetLastReadLost():
+		case res.LastReadLost:
 			p.SinceNote = "the commit you last read (" + short(lastRead) + ") is gone, the branch was rewritten: this is the whole change, review it again."
 		case len(p.Files) == 0:
 			p.SinceNote = "nothing changed since " + short(lastRead) + "."
 	if canWrite {
 		on = parseOn(r.URL.Query().Get("on"))
 	}
-	s.placeComments(&p, d.name(), n, res.Msg.GetComments(), head, !since, canWrite, on)
+	s.placeComments(&p, d.name(), n, res.Comments, head, !since, canWrite, on)
 	lines, invisible := diffLines(p.Files)
 	p.Invisible = invisible
 	p.DiffView = newDiffView(r, lines, self+"?view=unified", self+"?view=split")
 	if signed && open {
-		p.Box = s.mergeBox(d, n, m.GetSourceBranch(), head, lastRead)
+		p.Box = s.mergeBox(d, n, m.Source, head, lastRead)
 	}
 	if canWrite {
 		p.GeneralForm = &CommentForm{
 	l := s.repoLayout(ctx, d, "merge-requests")
 	l.Title = p.Number + " " + p.Title + " · " + d.name() + " · " + s.instance
 	if head != "" {
-		pinRef(&l, target{rev: head, name: m.GetSourceBranch()})
+		pinRef(&l, target{rev: head, name: m.Source})
-		if !d.hasBranch(m.GetSourceBranch()) {
+		if !d.hasBranch(m.Source) {
 			pinRef(&l, target{rev: head, name: short(head), detached: true})
 		}
 	}
 		l.Crumbs = append(l.Crumbs, Crumb{Label: "since", Current: true})
 	}
 	p.Live = true
-	l.Live, l.LiveURL = true, liveURL("repo:"+d.name(), "view=mr&n="+strconv.FormatInt(n, 10)+"&ref="+url.QueryEscape(m.GetSourceBranch()))
+	l.Live, l.LiveURL = true, liveURL("repo:"+d.name(), "view=mr&n="+strconv.FormatInt(n, 10)+"&ref="+url.QueryEscape(m.Source))
 	l.HasRail = true
 	return MergeRequest(l, p), http.StatusOK, nil
 }
 // hasBranch tells whether the repository has the branch.
 func (d *repoData) hasBranch(name string) bool {
 	for _, b := range d.branches {
-		if b.GetShortName() == name {
+		if b.ShortName == name {
 			return true
 		}
 	}
 		MergeAction: mrHref(d.name(), n, "merge"), CloseAction: mrHref(d.name(), n, "close"),
 		ReadAction: mrHref(d.name(), n, "read"), Head: head, HeadGone: head == "",
 		CanMarkRead:     head != "" && head != lastRead,
-		CanDeleteBranch: source != d.repo.GetDefaultBranch(),
+		CanDeleteBranch: source != d.repo.DefaultBranch,
 	}
 	ff, sq := false, false
-	if st := d.repo.GetSettings(); st != nil {
+	for _, mode := range d.repo.Settings.AllowedMergeModes {
-		for _, mode := range st.GetAllowedMergeModes() {
+		switch mode {
-			switch mode {
+		case domain.MergeModeFastForward:
-			case pb.MergeMode_MERGE_MODE_FAST_FORWARD:
+			ff = true
-				ff = true
+			b.Modes = append(b.Modes, ModeOption{Value: "fast-forward", Label: "fast-forward"})
-				b.Modes = append(b.Modes, ModeOption{Value: "fast-forward", Label: "fast-forward"})
+		case domain.MergeModeSquash:
-			case pb.MergeMode_MERGE_MODE_SQUASH:
+			sq = true
-				sq = true
+			b.Modes = append(b.Modes, ModeOption{Value: "squash", Label: "squash (one signed commit)"})
-				b.Modes = append(b.Modes, ModeOption{Value: "squash", Label: "squash (one signed commit)"})
-			}
 		}
 	}
 	if head != "" {
 // the target, so a page that shows another diff (since the last read) lists
 // them all below, with their line. A reader who can write gets the line numbers
 // as links to the form of their line; on designates the line whose form shows.
-func (s *Server) placeComments(p *MRPage, repo string, n int64, comments []*pb.Comment, head string, inline, canWrite bool, on *lineRef) {
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter places comments under the lines of the diff shown; display only
+func (s *Server) placeComments(p *MRPage, repo string, n int64, comments []domain.Comment, head string, inline, canWrite bool, on *lineRef) {
 	now := s.cfg.Now()
 	self := mrHref(repo, n)
 	resolveAction := func(id string) string { return mrHref(repo, n, "comments", id, "resolve") }
 	type lineKey struct {
 		path string
-		side pb.DiffSide
+		side domain.DiffSide
 		line int
 	}
 	index := map[lineKey]*DiffLine{}
 			for li := range f.Hunks[hi].Lines {
 				ln := &f.Hunks[hi].Lines[li]
 				if ln.oldN > 0 && ln.Kind != "add" {
-					index[lineKey{f.Key, pb.DiffSide_DIFF_SIDE_OLD, ln.oldN}] = ln
+					index[lineKey{f.Key, domain.SideOld, ln.oldN}] = ln
 					if linkable {
 						ln.OldHref = self + "?on=old:" + itoa(ln.oldN) + ":" + url.QueryEscape(f.Key) + "#" + f.ID
 					}
 				}
 				if ln.newN > 0 && ln.Kind != "del" {
-					index[lineKey{f.Key, pb.DiffSide_DIFF_SIDE_NEW, ln.newN}] = ln
+					index[lineKey{f.Key, domain.SideNew, ln.newN}] = ln
 					if linkable {
 						ln.NewHref = self + "?on=new:" + itoa(ln.newN) + ":" + url.QueryEscape(f.Key) + "#" + f.ID
 					}
 			}
 		}
 	}
-	find := func(path string, side pb.DiffSide, line int) *DiffLine {
+	find := func(path string, side domain.DiffSide, line int) *DiffLine {
 		if !inline {
 			return nil
 		}
 	}
 	for _, c := range comments {
+		cid := strconv.FormatInt(c.ID, 10)
 		v := CommentView{
-			ID: c.GetId(), Author: visibleText(c.GetAuthor()),
+			ID: cid, Author: visibleText(c.Author),
-			Parts: plainParts(c.GetText()), Resolved: c.GetResolved(),
+			Parts: plainParts(c.Text.String()), Resolved: c.Resolved,
-			Outdated: c.GetCommitId() != "" && c.GetCommitId() != head,
+			Outdated: !c.CommitID.IsZero() && c.CommitID.String() != head,
 		}
-		v.When, v.WhenAt = whenOf(now, c.GetCreatedAt())
+		v.When, v.WhenAt = whenOf(now, c.CreatedAt)
-		if t := c.GetCreatedAt(); t.IsValid() {
+		if !c.CreatedAt.IsZero() {
-			v.Abs = absolute(t.AsTime())
+			v.Abs = absolute(c.CreatedAt)
 		}
 		p.NComments++
-		if !c.GetResolved() {
+		if !c.Resolved {
 			p.NUnresolved++
 		}
-		general := c.GetPath() == ""
+		general := c.Path == ""
 		var ln *DiffLine
 		if !general {
-			ln = find(c.GetPath(), c.GetSide(), int(c.GetLine()))
+			ln = find(c.Path, c.Side, c.Line)
 			if ln == nil {
 				side := "new"
-				if c.GetSide() == pb.DiffSide_DIFF_SIDE_OLD {
+				if c.Side == domain.SideOld {
 					side = "old"
 				}
-				v.Where = visibleText(c.GetPath()) + ":" + itoa(int(c.GetLine())) + " (" + side + ")"
+				v.Where = visibleText(c.Path) + ":" + itoa(c.Line) + " (" + side + ")"
 			}
 		}
 		if canWrite {
-			v.Resolve = &ResolveForm{Action: resolveAction(c.GetId()), Value: !c.GetResolved(), Label: "Resolve"}
+			v.Resolve = &ResolveForm{Action: resolveAction(cid), Value: !c.Resolved, Label: "Resolve"}
-			if c.GetResolved() {
+			if c.Resolved {
 				v.Resolve.Label = "Unresolve"
 			}
 		}
 	}
 	if on != nil {
-		side := pb.DiffSide_DIFF_SIDE_NEW
+		side := domain.SideNew
 		if on.side == "old" {
-			side = pb.DiffSide_DIFF_SIDE_OLD
+			side = domain.SideOld
 		}
 		if ln := find(on.path, side, on.line); ln != nil {
 			ln.Form = &CommentForm{

M internal/adapters/web/mr_post.go +139 -71

 import (
 	"context"
 	"errors"
-	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
-	"connectrpc.com/connect"
 	"github.com/bnema/zerowrap"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // The writes of the merge request pages. Each is a POST that passed the gate
-// (an Origin of this site and the owner's session), calls the API as the
+// (an Origin of this site and the owner's session), calls the use case as the
 // owner, and answers 303 to the page that shows the result, with
-// "Cache-Control: no-store". A request the API refuses is answered with a
+// "Cache-Control: no-store". A request the use case refuses is answered with a
-// state page that says why, in the words of the API for the rules the owner
+// state page that says why, in the words of the use case for the rules the
-// can fix (a text rule, a moved branch, a full merge request), and without
+// owner can fix (a text rule, a moved branch, a full merge request), and
-// detail for anything else.
+// without detail for anything else.
 // maxFormBytes bounds the body of a form: a description of 8,000 characters is
 // at most 32,000 bytes.
 	http.Redirect(w, r, to, http.StatusSeeOther)
 }
-// mrAction wraps a POST handler: it bounds the API calls, reads the form and
+// mrAction wraps a POST handler: it bounds the use case calls, reads the form
-// maps the error of the API to a page.
+// and maps the error of the use case to a page.
 func (s *Server) mrAction(h func(ctx context.Context, r *http.Request) (to string, back string, err error)) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), requestTimeout)
 // actionFailed answers a refused action.
 func (s *Server) actionFailed(ctx context.Context, w http.ResponseWriter, r *http.Request, err error, back string) {
-	msg := ""
+	// The words of the use case, for the rules the owner can fix.
-	var ce *connect.Error
+	msg := err.Error()
-	if errors.As(err, &ce) {
+	// The order is that of the API's mapping of the domain errors to codes
-		msg = ce.Message()
+	// (rpc.codeOf), so that a web action answers what the API would.
-	}
+	switch {
-	switch code := connect.CodeOf(err); {
+	case errors.Is(err, context.Canceled):
-	case code == connect.CodeNotFound:
+		// The browser is gone.
+	case errors.Is(err, domain.ErrNotFound):
 		w.Header().Set("Cache-Control", "no-store")
 		s.write(ctx, w, r, http.StatusNotFound, s.notFoundPage())
-	case code == connect.CodeInvalidArgument:
+	case errors.Is(err, domain.ErrAlreadyExists):
-		s.reject(ctx, w, r, http.StatusBadRequest, "not accepted", rule(msg, "the server refused what was sent."), back)
-	case code == connect.CodeFailedPrecondition, code == connect.CodeAborted:
-		s.reject(ctx, w, r, http.StatusConflict, "not possible now", rule(msg, "the merge request is not in a state that allows this."), back)
-	case code == connect.CodeAlreadyExists:
 		s.reject(ctx, w, r, http.StatusConflict, "already there", rule(msg, "this already exists."), back)
-	case code == connect.CodeResourceExhausted:
+	case errors.Is(err, domain.ErrUnauthenticated), errors.Is(err, domain.ErrForbidden), errors.Is(err, domain.ErrRejected):
-		s.reject(ctx, w, r, http.StatusConflict, "limit reached", rule(msg, "a limit of the merge request is reached."), back)
-	case code == connect.CodePermissionDenied, code == connect.CodeUnauthenticated:
 		s.reject(ctx, w, r, http.StatusForbidden, "forbidden", "the session is not allowed to do this.", back)
-	case errors.Is(err, context.Canceled), code == connect.CodeCanceled:
+	case errors.Is(err, domain.ErrPreconditionFailed), errors.Is(err, domain.ErrConflict):
-		// The browser is gone.
+		s.reject(ctx, w, r, http.StatusConflict, "not possible now", rule(msg, "the merge request is not in a state that allows this."), back)
+	case errors.Is(err, domain.ErrResourceExhausted):
+		s.reject(ctx, w, r, http.StatusConflict, "limit reached", rule(msg, "a limit of the merge request is reached."), back)
+	case domain.IsInvalid(err):
+		s.reject(ctx, w, r, http.StatusBadRequest, "not accepted", rule(msg, "the server refused what was sent."), back)
 	default:
-		id := requestID()
+		s.internalFailure(ctx, w, r, err)
-		log := zerowrap.FromCtx(ctx)
-		log.Error().Err(err).Str("request_id", id).Str("path", logPath(r.URL.Path)).Msg("web action failed")
-		w.Header().Set("Cache-Control", "no-store")
-		s.write(ctx, w, r, http.StatusInternalServerError, s.errorPage(id))
 	}
 }
-// rule is a message of the API fit to show: the invisible characters marked,
+// internalFailure answers a failure of an action that is not the owner's to
+// fix: the 500 page with an id, and the cause in the log.
+func (s *Server) internalFailure(ctx context.Context, w http.ResponseWriter, r *http.Request, err error) {
+	id := requestID()
+	log := zerowrap.FromCtx(ctx)
+	log.Error().Err(err).Str("request_id", id).Str("path", logPath(r.URL.Path)).Msg("web action failed")
+	w.Header().Set("Cache-Control", "no-store")
+	s.write(ctx, w, r, http.StatusInternalServerError, s.errorPage(id))
+}
+// rule is a message of the use case fit to show: the invisible characters marked,
 // bounded, and a fallback for an empty one.
 func rule(msg, fallback string) string {
 	msg = strings.TrimSpace(visibleText(msg))
 	repo := r.PathValue("repo")
 	source := r.PostFormValue("source")
 	back := repoHref(repo, "compare", source)
-	res, err := s.cfg.MergeRequests.CreateMergeRequest(ctx, connect.NewRequest(&pb.CreateMergeRequestRequest{
+	name, err := domain.ParseRepoName(repo)
-		Repo: repo, Title: r.PostFormValue("title"), Description: normalizeNewlines(r.PostFormValue("description")),
+	if err != nil {
-		SourceBranch: source, TargetBranch: r.PostFormValue("target"),
+		return "", back, err
-	}))
+	}
+	mr, err := s.cfg.MergeRequests.Create(ctx, principal(ctx), name, ports.CreateMergeRequestParams{
+		Title: r.PostFormValue("title"), Description: normalizeNewlines(r.PostFormValue("description")),
+		Source: source, Target: r.PostFormValue("target"),
+	})
 	if err != nil {
 		return "", back, err
 	}
-	return mrHref(repo, res.Msg.GetMergeRequest().GetNumber()), back, nil
+	return mrHref(repo, mr.Number), back, nil
 }
+// formError is a form the server refuses before asking a use case: it matches
+// domain.ErrInvalid and says just what is wrong.
+type formError string
+func (e formError) Error() string { return string(e) }
+func (formError) Unwrap() error { return domain.ErrInvalid }
 // mrComment is POST /<repo>/merge-requests/<n>/comments: a general comment, or
 // one on a line (path, line and side).
 func (s *Server) mrComment(ctx context.Context, r *http.Request) (string, string, error) {
 	repo := r.PathValue("repo")
 	n, err := number(r)
 	if err != nil {
-		return "", "", connect.NewError(connect.CodeNotFound, err)
+		return "", "", err
 	}
 	back := mrHref(repo, n)
-	req := &pb.AddCommentRequest{Repo: repo, Number: n, Text: normalizeNewlines(r.PostFormValue("text")), Path: r.PostFormValue("path")}
+	params := ports.AddCommentParams{Text: normalizeNewlines(r.PostFormValue("text")), Path: r.PostFormValue("path")}
-	if req.Path != "" || r.PostFormValue("line") != "" || r.PostFormValue("side") != "" {
+	if params.Path != "" || r.PostFormValue("line") != "" || r.PostFormValue("side") != "" {
 		line, err := strconv.ParseInt(r.PostFormValue("line"), 10, 32)
 		if err != nil {
-			return "", back, connect.NewError(connect.CodeInvalidArgument, errors.New("line is not a number"))
+			return "", back, formError("line is not a number")
 		}
-		req.Line = int32(line)
+		params.Line = int(line)
 		switch r.PostFormValue("side") {
 		case "new":
-			req.Side = pb.DiffSide_DIFF_SIDE_NEW
+			params.Side = domain.SideNew
 		case "old":
-			req.Side = pb.DiffSide_DIFF_SIDE_OLD
+			params.Side = domain.SideOld
 		default:
-			return "", back, connect.NewError(connect.CodeInvalidArgument, errors.New("side must be new or old"))
+			return "", back, formError("side must be new or old")
 		}
 	}
-	res, err := s.cfg.MergeRequests.AddComment(ctx, connect.NewRequest(req))
+	name, err := domain.ParseRepoName(repo)
 	if err != nil {
 		return "", back, err
 	}
-	return back + "#c" + res.Msg.GetComment().GetId(), back, nil
+	c, err := s.cfg.MergeRequests.AddComment(ctx, principal(ctx), name, n, params)
+	if err != nil {
+		return "", back, err
+	}
+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, nil
 }
 // mrResolve is POST /<repo>/merge-requests/<n>/comments/<id>/resolve.
 //
-//hexcheck:ignore suspicious-business-logic-in-adapter reads two form fields into an API call; the state of the comment is decided by the API
+//hexcheck:ignore suspicious-business-logic-in-adapter reads two form fields into a use case call; the state of the comment is decided by the use case
 func (s *Server) mrResolve(ctx context.Context, r *http.Request) (string, string, error) {
 	repo := r.PathValue("repo")
 	n, err := number(r)
 	if err != nil {
-		return "", "", connect.NewError(connect.CodeNotFound, err)
+		return "", "", err
 	}
 	back := mrHref(repo, n)
 	resolved, err := formBool(r.PostFormValue("resolved"))
 	if err != nil {
-		return "", back, connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("resolved: %w", err))
+		return "", back, formError("resolved: " + err.Error())
 	}
-	res, err := s.cfg.MergeRequests.ResolveComment(ctx, connect.NewRequest(&pb.ResolveCommentRequest{
+	name, err := domain.ParseRepoName(repo)
-		Repo: repo, Number: n, CommentId: r.PathValue("id"), Resolved: resolved,
-	}))
 	if err != nil {
 		return "", back, err
 	}
-	return back + "#c" + res.Msg.GetComment().GetId(), back, nil
+	// An id this server never issued is 0: the use case answers not found,
+	// after the repository and the scope were checked, as for any unknown
+	// comment.
+	c, err := s.cfg.MergeRequests.ResolveComment(ctx, principal(ctx), name, n, commentID(r.PathValue("id")), resolved)
+	if err != nil {
+		return "", back, err
+	}
+	return back + "#c" + strconv.FormatInt(c.ID, 10), back, nil
+}
+// commentID parses the id of a comment in a path: a positive decimal number,
+// written without sign or leading zeros. Anything else is 0, which names no
+// comment.
+func commentID(s string) int64 {
+	n, err := strconv.ParseInt(s, 10, 64)
+	if err != nil || n < 1 || strconv.FormatInt(n, 10) != s {
+		return 0
+	}
+	return n
+}
+// headID parses a commit id of a form; the empty string is the zero id.
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter parses a form field into the domain id and names the field in the error; no rule is decided here
+func headID(s string) (domain.ObjectID, error) {
+	if s == "" {
+		return domain.ObjectID{}, nil
+	}
+	var v domain.Violations
+	id, err := domain.ParseObjectID(s)
+	if err != nil {
+		v.Add("head_id", "is not a full commit id")
+	}
+	return id, v.Err()
 }
 // mrClose is POST /<repo>/merge-requests/<n>/close.
 	repo := r.PathValue("repo")
 	n, err := number(r)
 	if err != nil {
-		return "", "", connect.NewError(connect.CodeNotFound, err)
+		return "", "", err
 	}
 	back := mrHref(repo, n)
-	if _, err := s.cfg.MergeRequests.CloseMergeRequest(ctx, connect.NewRequest(&pb.CloseMergeRequestRequest{Repo: repo, Number: n})); err != nil {
+	name, err := domain.ParseRepoName(repo)
+	if err != nil {
+		return "", back, err
+	}
+	if _, err := s.cfg.MergeRequests.Close(ctx, principal(ctx), name, n); err != nil {
 		return "", back, err
 	}
 	return back, back, nil
 	repo := r.PathValue("repo")
 	n, err := number(r)
 	if err != nil {
-		return "", "", connect.NewError(connect.CodeNotFound, err)
+		return "", "", err
 	}
 	back := mrHref(repo, n)
-	var mode pb.MergeMode
+	var mode domain.MergeMode
 	switch r.PostFormValue("mode") {
 	case "fast-forward":
-		mode = pb.MergeMode_MERGE_MODE_FAST_FORWARD
+		mode = domain.MergeModeFastForward
 	case "squash":
-		mode = pb.MergeMode_MERGE_MODE_SQUASH
+		mode = domain.MergeModeSquash
 	default:
-		return "", back, connect.NewError(connect.CodeInvalidArgument, errors.New("mode must be fast-forward or squash"))
+		return "", back, formError("mode must be fast-forward or squash")
 	}
-	if _, err := s.cfg.MergeRequests.MergeMergeRequest(ctx, connect.NewRequest(&pb.MergeMergeRequestRequest{
+	name, err := domain.ParseRepoName(repo)
-		Repo: repo, Number: n, Mode: mode, HeadId: r.PostFormValue("head_id"),
+	if err != nil {
-		DeleteSourceBranch: r.PostFormValue("delete_branch") == "1",
+		return "", back, err
-	})); err != nil {
+	}
+	head, err := headID(r.PostFormValue("head_id"))
+	if err != nil {
+		return "", back, err
+	}
+	if _, err := s.cfg.MergeRequests.Merge(ctx, principal(ctx), name, n, ports.MergeParams{
+		Mode: mode, HeadID: head, DeleteSource: r.PostFormValue("delete_branch") == "1",
+	}); err != nil {
 		return "", back, err
 	}
 	return back, back, nil
 	repo := r.PathValue("repo")
 	n, err := number(r)
 	if err != nil {
-		return "", "", connect.NewError(connect.CodeNotFound, err)
+		return "", "", err
 	}
 	back := mrHref(repo, n)
-	if _, err := s.cfg.MergeRequests.MarkRead(ctx, connect.NewRequest(&pb.MarkReadRequest{
+	name, err := domain.ParseRepoName(repo)
-		Repo: repo, Number: n, HeadId: r.PostFormValue("head_id"),
+	if err != nil {
-	})); err != nil {
+		return "", back, err
+	}
+	head, err := headID(r.PostFormValue("head_id"))
+	if err != nil {
+		return "", back, err
+	}
+	if _, err := s.cfg.MergeRequests.MarkRead(ctx, principal(ctx), name, n, head); err != nil {
 		return "", back, err
 	}
 	return back, back, nil
 }
 // normalizeNewlines turns the CRLF of a browser textarea into LF, the line
-// break the API stores.
+// break the use case stores.
 func normalizeNewlines(s string) string {
 	return strings.ReplaceAll(s, "\r\n", "\n")
 }

M internal/adapters/web/raw.go +37 -18

 import (
 	"context"
+	"errors"
+	"io"
 	"mime"
 	"net/http"
 	"path"
 	"time"
 	"github.com/bnema/zerowrap"
+	"bnema.dev/ermite/internal/domain"
 )
 // rawTimeout bounds the stream of one file to the visitor.
 const rawTimeout = 5 * time.Minute
+// rawChunkSize is the size of the writes that stream a file to the visitor.
+const rawChunkSize = 64 << 10
 // rawCSP makes a raw file inert if a browser opens it as a document: it can
 // load nothing and run nothing, whatever it contains.
 const rawCSP = "default-src 'none'; sandbox"
 // image types (by their bytes, never SVG) as images, and anything else as an
 // attachment of unknown type. A file is never served as HTML or SVG, so what
 // a repository holds cannot run in the origin of the forge.
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter streams a file the use case opened; the headers are about the response, no rule is decided here
 func (s *Server) raw(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), rawTimeout)
 	defer cancel()
 	h.Set("Content-Type", typ)
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("Content-Security-Policy", rawCSP)
-	h.Set("Content-Length", strconv.FormatInt(b.info.GetSize(), 10))
+	h.Set("Content-Length", strconv.FormatInt(b.info.Size, 10))
 	if attach {
 		name := path.Base(t.path)
 		cd := mime.FormatMediaType("attachment", map[string]string{"filename": name})
 		}
 		h.Set("Content-Disposition", cd)
 	}
-	if etag := b.info.GetId(); etag != "" {
+	if etag := b.info.ID.String(); etag != "" {
 		h.Set("ETag", `"`+etag+`"`)
 	}
 	// Revalidated every time, even at a full commit id: a repository can turn
 	// private, and a shared cache must not keep serving its files (AC2). The
-	// ETag spares the body: the blob id comes with the first message of
+	// ETag spares the body: the blob id comes with the metadata, before the
-	// the stream, and a match ends the answer there. No cheaper call gives the
+	// content, and a match ends the answer there. No cheaper call gives the
 	// id of the blob at a path: a tree listing of its directory costs more
 	// than opening a small file.
 	cacheHeaders(ctx, h, "no-cache", sessionCache)
 		return
 	}
 	b.buf = nil
-	for b.stream.Receive() {
+	if b.eof {
-		if _, err := w.Write(b.stream.Msg().GetChunk()); err != nil {
+		return
+	}
+	chunk := make([]byte, rawChunkSize)
+	for {
+		n, rerr := b.body.Read(chunk)
+		if n > 0 {
+			if _, err := w.Write(chunk[:n]); err != nil {
+				return
+			}
+		}
+		if errors.Is(rerr, io.EOF) {
 			return
 		}
-	}
+		if rerr != nil {
-	if err := b.stream.Err(); err != nil {
+			// Headers are gone: all that is left is to cut the answer short,
-		// Headers are gone: all that is left is to cut the answer short, so
+			// so that the client sees it is incomplete.
-		// that the client sees it is incomplete.
+			log := zerowrap.FromCtx(ctx)
-		log := zerowrap.FromCtx(ctx)
+			log.Error().Err(rerr).Str("repo", repo.String()).Str("path", logPath(r.URL.Path)).Msg("raw stream failed")
-		log.Error().Err(err).Str("repo", repo).Str("path", logPath(r.URL.Path)).Msg("raw stream failed")
+			panic(http.ErrAbortHandler)
-		panic(http.ErrAbortHandler)
+		}
 	}
 }
 // rawTarget finds the file a raw URL designates and the name of its repository.
-func (s *Server) rawTarget(ctx context.Context, r *http.Request) (target, string, error) {
+func (s *Server) rawTarget(ctx context.Context, r *http.Request) (target, domain.RepoName, error) {
 	d, err := s.loadRepo(ctx, r.PathValue("repo"))
 	if err != nil {
-		return target{}, "", err
+		return target{}, domain.RepoName{}, err
 	}
 	t, ok := d.locate(r.PathValue("rest"))
 	if !ok || t.path == "" {
-		return target{}, "", errNotFound
+		return target{}, domain.RepoName{}, errNotFound
 	}
-	return t, d.name(), nil
+	return t, d.repo.Name, nil
 }
 // rawType is the Content-Type of a file and whether it is an attachment.
 	if img := sniffImage(b.buf); img != "" {
 		return img, false
 	}
-	if !b.info.GetBinary() {
+	if !b.info.Binary {
 		return "text/plain; charset=utf-8", false
 	}
 	return "application/octet-stream", true

M internal/adapters/web/raw_test.go +33 -44


@@ -4,39 +4,50 @@ package web
4			4
5		import (	5		import (
6		"context"	6		"context"
			7	+	"io"
7		"net/http"	8		"net/http"
8		"net/http/httptest"	9		"net/http/httptest"
			10	+	"strings"
9		"testing"	11		"testing"
10			12
11	-	"connectrpc.com/connect"
12		"github.com/stretchr/testify/assert"	13		"github.com/stretchr/testify/assert"
13		"github.com/stretchr/testify/mock"	14		"github.com/stretchr/testify/mock"
14	-	"github.com/stretchr/testify/require"
15			15
16	-	pb "bnema.dev/ermite-api/gen/ermite"	16	+	"bnema.dev/ermite/internal/domain"
17	-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"	17	+	"bnema.dev/ermite/internal/ports"
18	-	"bnema.dev/ermite/internal/adapters/web/mocks"	18	+	"bnema.dev/ermite/internal/ports/mocks"
19		)	19		)
20			20
21	-	const blobID = "0123456789abcdef0123456789abcdef01234567"	21	+	const (
22	-		22	+	blobID = "0123456789abcdef0123456789abcdef01234567"
23	-	// blobAPI serves one text file, the only call raw makes besides the refs.	23	+	mainTip = "c0ffee0c0ffee0c0ffee0c0ffee0c0ffee0c0ffe"
24	-	type blobAPI struct {	24	+	blobBody = "hello"
25	-	ermiteconnect.UnimplementedGitServiceHandler	25	+	)
26	-	}
27			26
28	-	func (blobAPI) GetBlob(_ context.Context, req connect.Request[pb.GetBlobRequest], st *connect.ServerStream[pb.GetBlobResponse]) error {	27	+	// rawBrowse serves one text file, the only call raw makes besides the refs.
29	-	if req.Msg.GetPath() != "docs/a.txt" {	28	+	func rawBrowse(t testing.T) mocks.BrowseService {
30	-	return connect.NewError(connect.CodeNotFound, assert.AnError)	29	+	t.Helper()
31	-	}	30	+	browse := mocks.NewBrowseService(t)
32	-	return st.Send(&pb.GetBlobResponse{	31	+	browse.EXPECT().ListRefs(mock.Anything, domain.Anonymous(), repoName(t, "r"), mock.Anything).Return(ports.RefPage{
33	-	Info: &pb.BlobInfo{Id: blobID, Path: "docs/a.txt", Size: 5, MediaType: "text/plain"},	32	+	Refs: []domain.Ref{{
34	-	Chunk: []byte("hello"),	33	+	Name: "refs/heads/main", ShortName: "main", Kind: domain.RefKindBranch,
35	-	})	34	+	ID: objectID(t, mainTip), CommitID: objectID(t, mainTip),
			35	+	}},
			36	+	}, nil).Maybe()
			37	+	browse.EXPECT().OpenBlob(mock.Anything, domain.Anonymous(), repoName(t, "r"), mock.Anything, mock.Anything).RunAndReturn(
			38	+	func(_ context.Context, _ domain.Principal, _ domain.RepoName, rev domain.Revision, path domain.TreePath) (domain.BlobInfo, io.ReadCloser, error) {
			39	+	if path.String() != "docs/a.txt" \|\| rev.String() != mainTip {
			40	+	return domain.BlobInfo{}, nil, domain.ErrNotFound
			41	+	}
			42	+	return domain.BlobInfo{ID: objectID(t, blobID), Path: "docs/a.txt", Size: int64(len(blobBody)), MediaType: "text/plain"},
			43	+	io.NopCloser(strings.NewReader(blobBody)), nil
			44	+	}).Maybe()
			45	+	return browse
36		}	46		}
37			47
38		// A revalidation of an unchanged file ends with a 304 and no body. The blob is	48		// A revalidation of an unchanged file ends with a 304 and no body. The blob is
39	-	// opened in every case: its id is only known from the stream.	49	+	// opened in every case: its id is only known from the metadata the use case
			50	+	// returns with the content.
40		func TestRawRevalidation(t *testing.T) {	51		func TestRawRevalidation(t *testing.T) {
41		t.Parallel()	52		t.Parallel()
42		tests := []struct {	53		tests := []struct {

@@ -58,19 +69,8 @@ func TestRawRevalidation(t *testing.T) {
58		for _, tt := range tests {	69		for _, tt := range tests {
59		t.Run(tt.name, func(t *testing.T) {	70		t.Run(tt.name, func(t *testing.T) {
60		t.Parallel()	71		t.Parallel()
61	-	repos := mocks.NewRepoServiceClient(t)	72	+	repos := reposServing(t, publicRepo(t, "r"))
62	-	repos.EXPECT().GetRepo(mock.Anything, mock.Anything).	73	+	srv := newTestServer(t, Config{Repos: repos, Browse: rawBrowse(t)})
63	-	Return(connect.NewResponse(&pb.GetRepoResponse{Repo: &pb.Repo{Name: "r", DefaultBranch: "main"}}), nil)
64	-	mux := http.NewServeMux()
65	-	mux.Handle(ermiteconnect.NewGitServiceHandler(&refsGit{}))
66	-	backend := httptest.NewServer(mux)
67	-	t.Cleanup(backend.Close)
68	-
69	-	srv, err := New(Config{
70	-	Repos: repos, Git: ermiteconnect.NewGitServiceClient(backend.Client(), backend.URL),
71	-	PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
72	-	})
73	-	require.NoError(t, err)
74		req := httptest.NewRequest(tt.method, tt.url, nil)	74		req := httptest.NewRequest(tt.method, tt.url, nil)
75		if tt.ifNone != "" {	75		if tt.ifNone != "" {
76		req.Header.Set("If-None-Match", tt.ifNone)	76		req.Header.Set("If-None-Match", tt.ifNone)

@@ -93,14 +93,3 @@ func TestRawRevalidation(t *testing.T) {
93		})	93		})
94		}	94		}
95		}	95		}
96	-
97	-	// refsGit adds the refs of the repository to blobAPI.
98	-	type refsGit struct {
99	-	blobAPI
100	-	}
101	-
102	-	func (g refsGit) ListRefs(context.Context, connect.Request[pb.ListRefsRequest]) (*connect.Response[pb.ListRefsResponse], error) {
103	-	return connect.NewResponse(&pb.ListRefsResponse{Refs: []*pb.Ref{
104	-	{Name: "refs/heads/main", ShortName: "main", Kind: pb.RefKind_REF_KIND_BRANCH, CommitId: "c0ffee0"},
105	-	}}), nil
106	-	}

M internal/adapters/web/refs.go +19 -17

 	"net/url"
 	"strings"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // resolveRef finds the ref a URL path starts with and the path that follows.
 // that is the short name of a branch or tag wins. A branch wins over a tag of
 // the same name. rest has no leading slash and is "" when the path is the ref
 // alone. ok is false when no ref matches; the caller may then try a commit id.
-func resolveRef(refs []*pb.Ref, p string) (ref *pb.Ref, rest string, ok bool) {
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter finds the ref a URL path starts with; URL routing, no rule is decided here
+func resolveRef(refs []domain.Ref, p string) (ref domain.Ref, rest string, ok bool) {
 	names := refsByName(refs)
 	p = strings.Trim(p, "/")
 	for end := len(p); end > 0; end = strings.LastIndex(p[:end], "/") {
 			return r, strings.TrimPrefix(p[end:], "/"), true
 		}
 	}
-	return nil, "", false
+	return domain.Ref{}, "", false
 }
 // refsByName indexes the branches and tags by short name. A branch wins over
 // a tag of the same name.
-func refsByName(refs []*pb.Ref) map[string]*pb.Ref {
+func refsByName(refs []domain.Ref) map[string]domain.Ref {
-	names := make(map[string]*pb.Ref, len(refs))
+	names := make(map[string]domain.Ref, len(refs))
 	for _, r := range refs {
-		k := r.GetKind()
+		k := r.Kind
-		if k != pb.RefKind_REF_KIND_BRANCH && k != pb.RefKind_REF_KIND_TAG {
+		if k != domain.RefKindBranch && k != domain.RefKindTag {
 			continue
 		}
-		cur, dup := names[r.GetShortName()]
+		cur, dup := names[r.ShortName]
-		if !dup || cur.GetKind() != pb.RefKind_REF_KIND_BRANCH {
+		if !dup || cur.Kind != domain.RefKindBranch {
-			names[r.GetShortName()] = r
+			names[r.ShortName] = r
 		}
 	}
 	return names
 // target is what the URL of a tree, blob, raw or commits page designates: a
 // commit, the name it was reached by, and a path in its tree.
 type target struct {
-	// rev is what the API is asked for: the id of the commit of a ref, or
+	// rev is what the use cases are asked for: the id of the commit of a ref,
-	// the commit id of the URL itself.
+	// or the commit id of the URL itself.
 	rev string
 	// name is how the URL spells the ref: a branch or a tag, or the commit id
 	// when detached.
 // longest prefix of the path that is the short name of a branch or a tag
 // (names may contain "/"); a branch wins over a tag of the same name. An
 // empty rest designates the head of the repository. Whether the commit or
-// the path exists is for the API to say.
+// the path exists is for the use cases to say.
 func (d *repoData) locate(rest string) (target, bool) {
 	rest = strings.Trim(rest, "/")
 	if rest == "" {
 		if d.head == nil {
 			return target{}, false
 		}
-		return target{rev: d.head.GetCommitId(), name: d.head.GetShortName()}, true
+		return target{rev: d.head.CommitID.String(), name: d.head.ShortName}, true
 	}
-	if ref, p, ok := resolveRef(d.allRefs(), rest); ok && ref.GetCommitId() != "" {
+	if ref, p, ok := resolveRef(d.allRefs(), rest); ok && !ref.CommitID.IsZero() {
-		return target{rev: ref.GetCommitId(), name: ref.GetShortName(), path: p}, true
+		return target{rev: ref.CommitID.String(), name: ref.ShortName, path: p}, true
 	}
 	first, p, _ := strings.Cut(rest, "/")
 	if isCommitID(first) {
 		return false
 	}
 	for _, b := range d.branches {
-		if b.GetShortName() == t.name && b.GetCommitId() == t.rev {
+		if b.ShortName == t.name && b.CommitID.String() == t.rev {
 			return true
 		}
 	}

M internal/adapters/web/refs_test.go +26 -12

 package web
 import (
+	"crypto/sha1" // #nosec G505 -- ids for tests
+	"encoding/hex"
 	"testing"
 	"github.com/stretchr/testify/assert"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
-func ref(kind pb.RefKind, short string) *pb.Ref {
+// commitOf is a commit id derived from a name, so that two refs of one name
-	return &pb.Ref{Name: "refs/x/" + short, ShortName: short, Kind: kind, CommitId: "c-" + short}
+// share their commit.
+func commitOf(name string) domain.ObjectID {
+	sum := sha1.Sum([]byte(name)) // #nosec G401 -- an id for a test, not a hash for security
+	id, err := domain.ParseObjectID(hex.EncodeToString(sum[:]))
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+func ref(kind domain.RefKind, short string) domain.Ref {
+	id := commitOf(short)
+	return domain.Ref{Name: "refs/x/" + short, ShortName: short, Kind: kind, ID: id, CommitID: id}
 }
 // AC3: a ref with slashes is found by the longest matching prefix.
 func TestResolveRef(t *testing.T) {
 	t.Parallel()
-	b, tag := pb.RefKind_REF_KIND_BRANCH, pb.RefKind_REF_KIND_TAG
+	b, tag := domain.RefKindBranch, domain.RefKindTag
-	refs := []*pb.Ref{
+	refs := []domain.Ref{
 		ref(b, "main"), ref(b, "feature"), ref(b, "feature/x"), ref(b, "feature/x/y"), ref(tag, "v1/rc"),
-		ref(pb.RefKind_REF_KIND_HEAD, "main"), ref(tag, "main"),
+		ref(domain.RefKindHead, "main"), ref(tag, "main"),
 	}
 	tests := []struct {
 		path, ref, rest string
-		kind            pb.RefKind
+		kind            domain.RefKind
 		ok              bool
 	}{
 		{"main", "main", "", b, true},
 		{"feature/other", "feature", "other", b, true},
 		{"/feature/x/", "feature/x", "", b, true},
 		{"v1/rc/README", "v1/rc", "README", tag, true},
-		{"v1/README", "", "", 0, false},
+		{"v1/README", "", "", "", false},
-		{"nope/main", "", "", 0, false},
+		{"nope/main", "", "", "", false},
-		{"", "", "", 0, false},
+		{"", "", "", "", false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.path, func(t *testing.T) {
 			if !ok {
 				return
 			}
-			assert.Equal(t, tt.ref, r.GetShortName())
+			assert.Equal(t, tt.ref, r.ShortName)
-			assert.Equal(t, tt.kind, r.GetKind(), "a branch wins over a tag of the same name")
+			assert.Equal(t, tt.kind, r.Kind, "a branch wins over a tag of the same name")
 			assert.Equal(t, tt.rest, rest)
 		})
 	}

M internal/adapters/web/refspage.go +16 -15

 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // refs lists the branches and the tags of a repository with the commit each
 // refsPage is the content of the refs page, which the live updates of the
 // page render again.
 func (s *Server) refsPage(ctx context.Context, d *repoData) RefsPage {
-	commits := s.commitsOf(ctx, d.name(), d.allRefs())
+	commits := s.commitsOf(ctx, d.repo.Name, d.allRefs())
-	def := d.repo.GetDefaultBranch()
+	def := d.repo.DefaultBranch
 	p := RefsPage{Default: def}
-	branches := append([]*pb.Ref(nil), d.branches...)
+	branches := append([]domain.Ref(nil), d.branches...)
 	sort.SliceStable(branches, func(i, j int) bool {
-		a, b := branches[i].GetShortName() == def, branches[j].GetShortName() == def
+		a, b := branches[i].ShortName == def, branches[j].ShortName == def
 		return a && !b
 	})
 	for i, b := range branches {
-		p.Branches = append(p.Branches, s.refRow(d, b, commits, b.GetShortName() == def, i == 0))
+		p.Branches = append(p.Branches, s.refRow(d, b, commits, b.ShortName == def, i == 0))
 	}
-	tags := append([]*pb.Ref(nil), d.tags...)
+	tags := append([]domain.Ref(nil), d.tags...)
 	sort.SliceStable(tags, func(i, j int) bool {
-		return commits[tags[i].GetCommitId()].at > commits[tags[j].GetCommitId()].at
+		return commits[tags[i].CommitID.String()].at > commits[tags[j].CommitID.String()].at
 	})
 	for i, t := range tags {
 		p.Tags = append(p.Tags, s.refRow(d, t, commits, false, len(p.Branches) == 0 && i == 0))
 	}
 	if len(tags) > 0 {
-		p.Latest = tags[0].GetShortName()
+		p.Latest = tags[0].ShortName
 	}
 	if d.cut {
 		p.Note = "this repository has more refs than are listed here."
 	return p
 }
-func (s *Server) refRow(d *repoData, r *pb.Ref, commits map[string]refCommit, isDefault, cursor bool) RefRow {
+func (s *Server) refRow(d *repoData, r domain.Ref, commits map[string]refCommit, isDefault, cursor bool) RefRow {
-	c := commits[r.GetCommitId()]
+	id := r.CommitID.String()
+	c := commits[id]
 	row := RefRow{
-		Name: r.GetShortName(), Href: repoHref(d.name(), "tree", r.GetShortName()),
+		Name: r.ShortName, Href: repoHref(d.name(), "tree", r.ShortName),
-		Short: short(r.GetCommitId()), Subject: c.subject, When: c.when, WhenAt: c.whenAt,
+		Short: short(id), Subject: c.subject, When: c.when, WhenAt: c.whenAt,
 		Default: isDefault, Cursor: cursor,
 	}
-	if r.GetCommitId() != "" {
+	if id != "" {
-		row.CHref = repoHref(d.name(), "commit", r.GetCommitId())
+		row.CHref = repoHref(d.name(), "commit", id)
 	}
 	return row
 }

M internal/adapters/web/repo.go +83 -55

 	"sync"
 	"time"
-	"connectrpc.com/connect"
+	"bnema.dev/ermite/internal/domain"
-	"google.golang.org/protobuf/types/known/timestamppb"
+	"bnema.dev/ermite/internal/ports"
-	pb "bnema.dev/ermite-api/gen/ermite"
 )
 // maxRefs bounds the refs one page reads. A repository with more has its
 // repoData is what the pages of one repository start from: its metadata and
 // its refs, read once per request.
 type repoData struct {
-	repo     *pb.Repo
+	repo     ports.RepoView
-	branches []*pb.Ref
+	branches []domain.Ref
-	tags     []*pb.Ref
+	tags     []domain.Ref
 	// cut is true when the repository has more refs than maxRefs.
 	cut bool
 	// head is the branch the repository opens on: its default branch, or the
 	// first one when the default does not exist. nil for an empty repository.
-	head *pb.Ref
+	head *domain.Ref
+}
+// repoView reads a repository as the caller of the request may see it, with
+// the Git state of its summary. A missing or private repository is
+// domain.ErrNotFound.
+func (s *Server) repoView(ctx context.Context, name domain.RepoName) (ports.RepoView, error) {
+	repo, err := s.cfg.Repos.Get(ctx, principal(ctx), name)
+	if err != nil {
+		return ports.RepoView{}, err
+	}
+	view, err := s.cfg.Repos.View(ctx, repo)
+	if err != nil {
+		return ports.RepoView{}, err
+	}
+	if view.Settings.IsZero() {
+		view.Settings = domain.DefaultRepoSettings()
+	}
+	return view, nil
 }
 // loadRepo reads a repository and its refs. A missing, private or invalidly
-// named repository is a not_found / invalid_argument error of the API, which
+// named repository is a domain.ErrNotFound / invalid name error, which the
-// the caller turns into the 404 page.
+// caller turns into the 404 page.
-func (s *Server) loadRepo(ctx context.Context, name string) (*repoData, error) {
+func (s *Server) loadRepo(ctx context.Context, rawName string) (*repoData, error) {
-	res, err := s.cfg.Repos.GetRepo(ctx, connect.NewRequest(&pb.GetRepoRequest{Repo: name}))
+	name, err := domain.ParseRepoName(rawName)
+	if err != nil {
+		return nil, err
+	}
+	view, err := s.repoView(ctx, name)
 	if err != nil {
 		return nil, err
 	}
-	d := &repoData{repo: res.Msg.GetRepo()}
+	d := &repoData{repo: view}
 	// Each page of ListRefs runs the whole for-each-ref again: the refs are
-	// asked in one page of up to maxRefs (the API lowers it to its cap, and
+	// asked in one page of up to maxRefs (the use case lowers it to its cap,
-	// the token then leads to the rest).
+	// and the token then leads to the rest).
 	token, n := "", 0
 	for {
-		page, err := s.cfg.Git.ListRefs(ctx, connect.NewRequest(&pb.ListRefsRequest{
+		page, err := s.cfg.Browse.ListRefs(ctx, principal(ctx), name, ports.ListRefsParams{
-			Repo: name, PageSize: maxRefs, PageToken: token,
+			Kinds:    []domain.RefKind{domain.RefKindBranch, domain.RefKindTag},
-			Kinds: []pb.RefKind{pb.RefKind_REF_KIND_BRANCH, pb.RefKind_REF_KIND_TAG},
+			PageSize: maxRefs, PageToken: token,
-		}))
+		})
 		if err != nil {
 			return nil, err
 		}
-		for _, r := range page.Msg.GetRefs() {
+		for _, r := range page.Refs {
-			switch r.GetKind() {
+			switch r.Kind {
-			case pb.RefKind_REF_KIND_BRANCH:
+			case domain.RefKindBranch:
 				d.branches = append(d.branches, r)
-			case pb.RefKind_REF_KIND_TAG:
+			case domain.RefKindTag:
 				d.tags = append(d.tags, r)
 			}
 			n++
 		}
-		if token = page.Msg.GetNextPageToken(); token == "" {
+		if token = page.NextPageToken; token == "" {
 			break
 		}
 		if n >= maxRefs {
 			break
 		}
 	}
-	for _, b := range d.branches {
+	for i := range d.branches {
-		if b.GetShortName() == d.repo.GetDefaultBranch() {
+		if d.branches[i].ShortName == d.repo.DefaultBranch {
-			d.head = b
+			d.head = &d.branches[i]
 		}
 	}
 	if d.head == nil && len(d.branches) > 0 {
-		d.head = d.branches[0]
+		d.head = &d.branches[0]
 	}
 	return d, nil
 }
 // allRefs is the branches then the tags.
-func (d *repoData) allRefs() []*pb.Ref {
+func (d *repoData) allRefs() []domain.Ref {
-	return append(append([]*pb.Ref(nil), d.branches...), d.tags...)
+	return append(append([]domain.Ref(nil), d.branches...), d.tags...)
 }
 // name is the repository name.
-func (d *repoData) name() string { return d.repo.GetName() }
+func (d *repoData) name() string { return d.repo.Name.String() }
 // layout is the Layout of the pages of a repository: the sections, the ref
 // switcher on the head ref and the ":" targets. The caller sets the title,
 func (s *Server) repoLayout(ctx context.Context, d *repoData, section string) Layout {
 	l := s.base()
 	l.Repo = d.name()
-	def := d.repo.GetDefaultBranch()
+	def := d.repo.DefaultBranch
 	if d.head != nil {
-		def = d.head.GetShortName()
+		def = d.head.ShortName
 		l.Ref, l.RefPath = def, def
-		l.SHA, l.Short = d.head.GetCommitId(), short(d.head.GetCommitId())
+		l.SHA, l.Short = d.head.CommitID.String(), short(d.head.CommitID.String())
 	}
 	mk := func(key, label, href, id string) Section {
 		return Section{Key: key, Label: label, Href: href, Current: section == id}
 	}
 	if l.Ref != "" {
 		for _, b := range d.branches {
-			it := RefItem{Name: b.GetShortName(), Href: repoHref(d.name(), "tree", b.GetShortName()), Current: b == d.head}
+			it := RefItem{Name: b.ShortName, Href: repoHref(d.name(), "tree", b.ShortName), Current: b.ShortName == d.head.ShortName}
 			l.Heads = append(l.Heads, it)
 			l.Cmd = append(l.Cmd, CmdItem{Kind: "branch", Label: it.Name, Href: it.Href})
 		}
 		for _, t := range d.tags {
-			it := RefItem{Name: t.GetShortName(), Href: repoHref(d.name(), "tree", t.GetShortName())}
+			it := RefItem{Name: t.ShortName, Href: repoHref(d.name(), "tree", t.ShortName)}
 			l.Tags = append(l.Tags, it)
 			l.Cmd = append(l.Cmd, CmdItem{Kind: "tag", Label: it.Name, Href: it.Href})
 		}
 // commitsOf reads the head commit of each ref, a few at a time. A ref whose
 // commit cannot be read (a tag on a tree, say) has no entry.
-func (s *Server) commitsOf(ctx context.Context, repo string, refs []*pb.Ref) map[string]refCommit {
+func (s *Server) commitsOf(ctx context.Context, repo domain.RepoName, refs []domain.Ref) map[string]refCommit {
 	const workers = 8
 	var (
 		mu  sync.Mutex
 	)
 	now := s.cfg.Now()
 	for _, r := range refs {
-		id := r.GetCommitId()
+		if r.CommitID.IsZero() {
-		if id == "" {
 			continue
 		}
+		id := r.CommitID.String()
 		mu.Lock()
 		_, done := out[id]
 		if !done {
 		go func() {
 			defer func() { <-sem; wg.Done() }()
 			// By id, not by name: a branch and a tag may share a name.
-			res, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{Repo: repo, Revision: id, PageSize: 1}))
+			res, err := s.commitList(ctx, repo, id, "", 1, "")
 			var rc refCommit
-			if err == nil && len(res.Msg.GetCommits()) == 1 {
+			if err == nil && len(res.Commits) == 1 {
-				row := commitRow(repo, res.Msg.GetCommits()[0], now)
+				row := commitRow(repo.String(), res.Commits[0], now)
 				rc.short, rc.subject, rc.when, rc.whenAt = row.Short, row.Subject, row.When, row.WhenAt
-				rc.at = res.Msg.GetCommits()[0].GetCommitter().GetTime().GetSeconds()
+				rc.at = unixSeconds(res.Commits[0].Committer.Time)
 			}
 			mu.Lock()
 			out[id] = rc
 }
 // whenOf is the relative and the machine form of a time; both are "" when
-// the time is unknown.
+// the time is unknown (the zero time).
-func whenOf(now time.Time, ts *timestamppb.Timestamp) (when, at string) {
+func whenOf(now time.Time, t time.Time) (when, at string) {
-	if !ts.IsValid() {
+	if t.IsZero() {
 		return "", ""
 	}
-	return ago(now, ts.AsTime()), rfc3339(ts.AsTime())
+	return ago(now, t), rfc3339(t)
+}
+// unixSeconds is the Unix time of t in seconds, 0 for the zero time.
+func unixSeconds(t time.Time) int64 {
+	if t.IsZero() {
+		return 0
+	}
+	return t.Unix()
 }
 // commitRow is the row every list of commits starts from: the short id, the
 // subject, the author and the date of the committer, all fit to display. The
 // caller adds what is specific to its list.
-func commitRow(repo string, c *pb.Commit, now time.Time) CommitRow {
+func commitRow(repo string, c domain.Commit, now time.Time) CommitRow {
 	row := CommitRow{
-		Short: short(c.GetId()), Subject: visibleText(c.GetSummary()),
+		Short: short(c.ID.String()), Subject: visibleText(c.Summary),
-		CHref:  repoHref(repo, "commit", c.GetId()),
+		CHref:  repoHref(repo, "commit", c.ID.String()),
-		Author: visibleText(c.GetAuthor().GetName()), Merge: len(c.GetParentIds()) > 1,
+		Author: visibleText(c.Author.Name), Merge: len(c.Parents) > 1,
 	}
-	row.When, row.WhenAt = whenOf(now, c.GetCommitter().GetTime())
+	row.When, row.WhenAt = whenOf(now, c.Committer.Time)
 	return row
 }
 // namesAt maps commit ids to the names of the refs that designate them.
-func namesAt(refs []*pb.Ref) map[string][]string {
+func namesAt(refs []domain.Ref) map[string][]string {
 	m := map[string][]string{}
 	for _, r := range refs {
-		m[r.GetCommitId()] = append(m[r.GetCommitId()], r.GetShortName())
+		m[r.CommitID.String()] = append(m[r.CommitID.String()], r.ShortName)
 	}
 	for _, v := range m {
 		sort.Strings(v)
 	l.Title = d.name() + " · " + s.instance
 	l.Sections = nil
 	l.Cmd = slices.DeleteFunc(l.Cmd, func(c CmdItem) bool { return c.Kind == "section" })
-	branch := d.repo.GetDefaultBranch()
+	branch := d.repo.DefaultBranch
 	return l, StatePage{
 		Code: "empty", Title: d.name() + " is empty",
 		Lines: []string{"no commits yet. push a branch to create one."},

M internal/adapters/web/session.go +15 -2

 	"github.com/bnema/zerowrap"
 	"bnema.dev/ermite/internal/clientlimit"
+	"bnema.dev/ermite/internal/domain"
 	"bnema.dev/ermite/internal/ports"
 )
 // State changes are POST only and pass one gate (ServeHTTP): an Origin equal to
 // the origin of the public URL, and a valid session, except the login POST,
 // which needs the link instead. The routes read the cookie and never the
-// Authorization header; the API does the opposite.
+// Authorization header; the API does the opposite, it reads the header and no cookie.
 // CookieName is the session cookie. The __Host- prefix makes browsers accept
 // it only with Secure, Path=/ and no Domain, and refuse it from a sibling
 		varyCookie(h)
 		return r
 	}
-	return r.WithContext(context.WithValue(owner, signedInKey{}, struct{}{}))
+	ctx = domain.ContextWithPrincipal(ctx, owner)
+	return r.WithContext(context.WithValue(ctx, signedInKey{}, struct{}{}))
+}
+// principal is the caller of the request, the one every use case call carries:
+// the owner when the request has a valid session (withSession), anonymous
+// otherwise.
+func principal(ctx context.Context) domain.Principal {
+	p, ok := domain.PrincipalFromContext(ctx)
+	if !ok {
+		return domain.Anonymous()
+	}
+	return p
 }
 // sessionStillValid checks again the cookie a long-lived request started

M internal/adapters/web/session_test.go +21 -21

 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
+	"bnema.dev/ermite/internal/domain"
 	"bnema.dev/ermite/internal/ports"
 	"bnema.dev/ermite/internal/ports/mocks"
 )
 	}
 	m := mocks.NewWebSessionService(t)
 	m.EXPECT().Verify(mock.Anything, mock.Anything).RunAndReturn(
-		func(ctx context.Context, token string) (context.Context, bool, error) {
+		func(_ context.Context, token string) (domain.Principal, bool, error) {
 			ok, err := verify(token)
-			return ctx, ok, err
+			if !ok || err != nil {
+				return domain.Anonymous(), false, err
+			}
+			return domain.Owner(), true, nil
 		}).Maybe()
 	return m
 }
 func newSessionServer(t *testing.T, sess ports.WebSessionService, publicURL string) (*Server, *countingLimiter) {
 	t.Helper()
 	lim := &countingLimiter{}
-	srv, err := New(Config{
+	srv := newTestServer(t, Config{
-		Repos: failing{err: errors.New("x")}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
+		Repos: reposFailing(t, errors.New("x")), Browse: mocks.NewBrowseService(t),
-		PublicURL: publicURL, SourceURL: "https://forge.example/ermite", Version: "v1",
+		PublicURL: publicURL, Sessions: sess, Limiter: lim,
-		Sessions: sess, Limiter: lim,
 	})
-	require.NoError(t, err)
 	return srv, lim
 }
 	t.Parallel()
 	sess := newVerifier(t, "tok", nil) // no Login is expected until the last request
 	lim := &countingLimiter{}
-	srv, err := New(Config{
+	srv := newTestServer(t, Config{
-		Repos: failing{err: errors.New("x")}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
+		Repos: reposFailing(t, errors.New("x")), Browse: mocks.NewBrowseService(t),
-		MergeRequests: ermiteconnect.NewMergeRequestServiceClient(http.DefaultClient, "http://unused.invalid"),
+		MergeRequests: mocks.NewMergeRequestService(t),
-		PublicURL:     "https://forge.example", Sessions: sess, Limiter: lim,
+		Sessions:      sess, Limiter: lim,
 	})
-	require.NoError(t, err)
 	post := func(target, cookie string) int {
 		req := httptest.NewRequest(http.MethodPost, target, nil)
 		req.Header.Set("Origin", "https://forge.example")
 	rec := httptest.NewRecorder()
 	r := srv.withSession(rec, req)
 	assert.False(t, SignedIn(r.Context()))
+	assert.Equal(t, domain.Anonymous(), principal(r.Context()))
 	assert.Empty(t, rec.Header().Values("Set-Cookie"))
 	srv, _ = newSessionServer(t, newSessions(t, "tok"), "https://forge.example")
 	req = httptest.NewRequest(http.MethodGet, "/", nil)
 	req.AddCookie(&http.Cookie{Name: CookieName, Value: "tok"})
-	assert.True(t, SignedIn(srv.withSession(httptest.NewRecorder(), req).Context()))
+	r = srv.withSession(httptest.NewRecorder(), req)
+	assert.True(t, SignedIn(r.Context()))
+	assert.Equal(t, domain.Owner(), principal(r.Context()), "a valid session is the owner")
+	assert.Equal(t, domain.Anonymous(), principal(context.Background()), "no principal is anonymous")
 }
 // GO-006: the answer to a request with an invalid cookie is not cached and
 // Without sessions configured there is no login route and no cookie is read.
 func TestNoSessionsNoRoutes(t *testing.T) {
 	t.Parallel()
-	srv, err := New(Config{
+	srv := newTestServer(t, Config{Repos: reposFailing(t, errors.New("x")), Browse: mocks.NewBrowseService(t)})
-		Repos: failing{err: errors.New("x")}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
-		PublicURL: "https://forge.example", SourceURL: "https://forge.example/ermite", Version: "v1",
-	})
-	require.NoError(t, err)
 	rec := httptest.NewRecorder()
 	srv.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/-/login/"+strings.Repeat("a", 43), nil))
 	assert.Equal(t, 404, rec.Code)
-	_, err = New(Config{
+	_, err := New(Config{
-		Repos: failing{}, Git: ermiteconnect.NewGitServiceClient(http.DefaultClient, "http://unused.invalid"),
+		Repos: reposFailing(t, errors.New("x")), Browse: mocks.NewBrowseService(t),
 		PublicURL: "https://forge.example", Sessions: mocks.NewWebSessionService(t),
 	})
 	assert.Error(t, err, "sessions need a limiter")

M internal/adapters/web/summary.go +53 -52

 	"fmt"
 	"html"
 	"html/template"
+	"io"
 	"net/http"
 	"strings"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
 	"github.com/bnema/zerowrap"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
+	"bnema.dev/ermite/internal/ports"
 )
 // maxReadmeBytes is the largest README that is rendered in the page; a
 		l, st := s.emptyState(ctx, d)
 		return State(l, st), http.StatusOK, nil
 	}
-	ref := d.head.GetShortName()
+	ref := d.head.ShortName
 	now := s.cfg.Now()
 	p := SummaryPage{
 		Clone:   Clone{ID: "clone-" + d.name(), Lines: []string{"git clone " + s.cloneURL(d.name())}},
 	}
-	commits, err := s.cfg.Git.ListCommits(ctx, connect.NewRequest(&pb.ListCommitsRequest{
+	commits, err := s.commitList(ctx, d.repo.Name, d.head.CommitID.String(), "", recentCommits, "")
-		Repo: d.name(), Revision: d.head.GetCommitId(), PageSize: recentCommits,
-	}))
 	if err != nil {
 		return nil, 0, err
 	}
 	branchesAt, tagsAt := namesAt(d.branches), namesAt(d.tags)
-	for i, c := range commits.Msg.GetCommits() {
+	for i, c := range commits.Commits {
+		id := c.ID.String()
 		row := commitRow(d.name(), c, now)
-		row.Branches, row.Tags, row.Cursor = branchesAt[c.GetId()], tagsAt[c.GetId()], i == 0
+		row.Branches, row.Tags, row.Cursor = branchesAt[id], tagsAt[id], i == 0
 		p.Recent = append(p.Recent, row)
 	}
 	l.Title = d.name() + " · " + s.instance
 	l.Live, l.LiveURL = true, liveURL("repo:"+d.name(), "view=summary")
 	l.HasRail = true
-	l.Lede = d.repo.GetDescription()
+	l.Lede = d.repo.Description
 	return Summary(l, p), http.StatusOK, nil
 }
 	}
 	lt := &LatestTag{Count: n, RefsHref: repoHref(d.name(), "refs")}
 	if n <= maxTagDates {
-		if name, c := latestTag(d.tags, s.commitsOf(ctx, d.name(), d.tags)); name != "" {
+		if name, c := latestTag(d.tags, s.commitsOf(ctx, d.repo.Name, d.tags)); name != "" {
 			lt.Name, lt.Href = name, repoHref(d.name(), "tree", name)
 			lt.Subject, lt.When, lt.WhenAt = c.subject, c.when, c.whenAt
 		}
 func (s *Server) facts(d *repoData, now time.Time) []Fact {
 	fs := []Fact{
 		lastPushFact(d.repo, now),
-		{Key: "branch", Val: d.head.GetShortName() + " · " + plural(len(d.branches), "branch", "branches")},
+		{Key: "branch", Val: d.head.ShortName + " · " + plural(len(d.branches), "branch", "branches")},
 	}
-	if c := d.repo.GetCreatedAt(); c.IsValid() {
+	if c := d.repo.CreatedAt; !c.IsZero() {
-		fs = append(fs, Fact{Key: "created", Val: absolute(c.AsTime()), Time: rfc3339(c.AsTime())})
+		fs = append(fs, Fact{Key: "created", Val: absolute(c), Time: rfc3339(c)})
 	}
 	return fs
 }
 // lastPushFact is the "last push" fact of a repository; the live updates
 // render it again.
-func lastPushFact(r *pb.Repo, now time.Time) Fact {
+func lastPushFact(r ports.RepoView, now time.Time) Fact {
-	last := Fact{Key: "last push", Val: "never", ID: "last-push-" + r.GetName()}
+	last := Fact{Key: "last push", Val: "never", ID: "last-push-" + r.Name.String()}
-	if t := r.GetPushedAt(); t.IsValid() && t.GetSeconds() != 0 {
+	if t := r.PushedAt; !t.IsZero() {
-		last.Val = ago(now, t.AsTime()) + " · " + absolute(t.AsTime())
+		last.Val = ago(now, t) + " · " + absolute(t)
-		last.Time = rfc3339(t.AsTime())
+		last.Time = rfc3339(t)
 	}
 	return last
 }
 // latestTag is the tag whose commit is the newest.
-func latestTag(tags []*pb.Ref, commits map[string]refCommit) (string, refCommit) {
+func latestTag(tags []domain.Ref, commits map[string]refCommit) (string, refCommit) {
 	var name string
 	var best refCommit
 	for _, t := range tags {
-		c, ok := commits[t.GetCommitId()]
+		c, ok := commits[t.CommitID.String()]
 		if ok && c.short != "" && (name == "" || c.at > best.at) {
-			name, best = t.GetShortName(), c
+			name, best = t.ShortName, c
 		}
 	}
 	return name, best
 // readme finds the README at the root of the tree of the head commit, reads
 // it and renders it. It is nil when the repository has none. Rendering
-// problems degrade to plain text; only API failures are errors.
+// problems degrade to plain text; only use case failures are errors.
 func (s *Server) readme(ctx context.Context, d *repoData, ref string) (*renderedReadme, error) {
-	tree, err := s.cfg.Git.GetTree(ctx, connect.NewRequest(&pb.GetTreeRequest{Repo: d.name(), Revision: d.head.GetCommitId()}))
+	rev := d.head.CommitID.String()
+	tree, err := s.getTree(ctx, d.repo.Name, rev, "", false)
 	if err != nil {
 		return nil, err
 	}
-	return s.readmeIn(ctx, d.name(), d.head.GetCommitId(), ref, "", tree.Msg.GetEntries())
+	return s.readmeIn(ctx, d.repo.Name, rev, ref, "", tree.Entries)
 }
 // readmeIn picks the README among the entries of the directory dir ("" for
 // the root) of the commit rev, reads it and renders it. Links in it are
 // relative to dir, on the ref ref. It is nil when the directory has none.
-func (s *Server) readmeIn(ctx context.Context, repo, rev, ref, dir string, entries []*pb.TreeEntry) (*renderedReadme, error) {
+//
-	var best *pb.TreeEntry
+//hexcheck:ignore suspicious-business-logic-in-adapter picks the README among the entries of a directory to show; display only
+func (s *Server) readmeIn(ctx context.Context, repo domain.RepoName, rev, ref, dir string, entries []domain.TreeEntry) (*renderedReadme, error) {
+	var best *domain.TreeEntry
 	rank := len(readmeNames)
-	for _, e := range entries {
+	for i := range entries {
-		if e.GetKind() != pb.EntryKind_ENTRY_KIND_FILE && e.GetKind() != pb.EntryKind_ENTRY_KIND_EXECUTABLE {
+		e := &entries[i]
+		if e.Kind != domain.EntryFile && e.Kind != domain.EntryExecutable {
 			continue
 		}
 		for i, n := range readmeNames {
-			if i < rank && strings.EqualFold(e.GetName(), n) {
+			if i < rank && strings.EqualFold(e.Name, n) {
 				best, rank = e, i
 			}
 		}
 	if best == nil {
 		return nil, nil
 	}
-	rd := &Readme{Name: best.GetName()}
+	rd := &Readme{Name: best.Name}
-	if best.GetSize() > maxReadmeBytes {
+	if best.Size > maxReadmeBytes {
-		rd.Note = best.GetName() + " is too large to show here (" + humanSize(best.GetSize()) + ")."
+		rd.Note = best.Name + " is too large to show here (" + humanSize(best.Size) + ")."
 		return &renderedReadme{readme: rd}, nil
 	}
-	body, binary, err := s.readBlob(ctx, repo, rev, best.GetPath(), maxReadmeBytes)
+	body, binary, err := s.readBlob(ctx, repo, rev, best.Path, maxReadmeBytes)
 	if err != nil {
 		return nil, err
 	}
 	if binary {
-		rd.Note = best.GetName() + " is not text."
+		rd.Note = best.Name + " is not text."
 		return &renderedReadme{readme: rd}, nil
 	}
-	name := strings.ToLower(best.GetName())
+	name := strings.ToLower(best.Name)
 	if strings.HasSuffix(name, ".md") || strings.HasSuffix(name, ".markdown") {
-		h, outline, err := s.md.render(body, repo, ref, dir)
+		h, outline, err := s.md.render(body, repo.String(), ref, dir)
 		if err == nil {
 			rd.HTML = h
 			return &renderedReadme{readme: rd, outline: outline}, nil
 		}
 		log := zerowrap.FromCtx(ctx)
-		log.Warn().Err(err).Str("repo", repo).Msg("render README, showing plain text")
+		log.Warn().Err(err).Str("repo", repo.String()).Msg("render README, showing plain text")
 	}
 	rd.HTML = template.HTML("<pre>" + html.EscapeString(string(body)) + "</pre>") // #nosec G203 -- escaped
 	return &renderedReadme{readme: rd}, nil
 }
-// readBlob reads a file through the GetBlob stream, at most limit bytes. It
+// readBlob reads a file, at most limit bytes. It reports a binary file
-// reports a binary file without its content.
+// without its content.
-func (s *Server) readBlob(ctx context.Context, repo, rev, path string, limit int64) (body []byte, binary bool, err error) {
+func (s *Server) readBlob(ctx context.Context, repo domain.RepoName, rev, path string, limit int64) (body []byte, binary bool, err error) {
-	stream, err := s.cfg.Git.GetBlob(ctx, connect.NewRequest(&pb.GetBlobRequest{Repo: repo, Revision: rev, Path: path}))
+	info, rc, err := s.openBlobAt(ctx, repo, rev, path)
 	if err != nil {
 		return nil, false, err
 	}
-	defer func() { _ = stream.Close() }()
+	defer func() { _ = rc.Close() }()
-	for stream.Receive() {
+	if info.Binary {
-		m := stream.Msg()
+		return nil, true, nil
-		if m.GetInfo().GetBinary() {
-			return nil, true, nil
-		}
-		body = append(body, m.GetChunk()...)
-		if int64(len(body)) > limit {
-			return body[:limit], false, nil
-		}
 	}
-	if err := stream.Err(); err != nil {
+	body, err = io.ReadAll(io.LimitReader(rc, limit+1))
+	if err != nil {
 		return nil, false, err
 	}
+	if int64(len(body)) > limit {
+		return body[:limit], false, nil
+	}
 	return body, false, nil
 }

M internal/adapters/web/tree.go +19 -20

 	"context"
 	"net/http"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
-	pb "bnema.dev/ermite-api/gen/ermite"
+	"bnema.dev/ermite/internal/domain"
 )
 // maxFileTargets bounds the files of a directory offered in the ":" list.
 // tree lists a directory of a ref, with the last commit of each entry, and
 // renders the README of the directory below.
+//
+//hexcheck:ignore suspicious-business-logic-in-adapter builds the directory page from the use case results; no rule is decided here
 func (s *Server) tree(ctx context.Context, r *http.Request) (templ.Component, int, error) {
 	d, err := s.loadRepo(ctx, r.PathValue("repo"))
 	if err != nil {
 	if !ok {
 		return nil, 0, errNotFound
 	}
-	res, err := s.cfg.Git.GetTree(ctx, connect.NewRequest(&pb.GetTreeRequest{
+	res, err := s.getTree(ctx, d.repo.Name, t.rev, t.path, true)
-		Repo: d.name(), Revision: t.rev, Path: t.path, IncludeLastCommit: true,
-	}))
 	if err != nil {
 		return nil, 0, err
 	}
-	entries := res.Msg.GetEntries()
+	entries := res.Entries
 	now := s.cfg.Now()
 	p := TreePage{}
 	l := s.repoLayout(ctx, d, "tree")
 	for i, e := range entries {
-		row := TreeRow{Glyph: "·", Name: visibleText(e.GetName()), Size: humanSize(e.GetSize()), Cursor: i == 0}
+		row := TreeRow{Glyph: "·", Name: visibleText(e.Name), Size: humanSize(e.Size), Cursor: i == 0}
-		switch e.GetKind() {
+		switch e.Kind {
-		case pb.EntryKind_ENTRY_KIND_DIRECTORY:
+		case domain.EntryDirectory:
 			row.Glyph, row.Name, row.Size = "▾", row.Name+"/", "-"
-			row.Href = repoHref(d.name(), "tree", t.name, e.GetPath())
+			row.Href = repoHref(d.name(), "tree", t.name, e.Path)
-		case pb.EntryKind_ENTRY_KIND_SYMLINK:
+		case domain.EntrySymlink:
 			row.Glyph = "@"
-			row.Href = repoHref(d.name(), "blob", t.name, e.GetPath())
+			row.Href = repoHref(d.name(), "blob", t.name, e.Path)
-		case pb.EntryKind_ENTRY_KIND_SUBMODULE:
+		case domain.EntrySubmodule:
 			row.Glyph, row.Size = "+", "-"
 		default:
-			row.Href = repoHref(d.name(), "blob", t.name, e.GetPath())
+			row.Href = repoHref(d.name(), "blob", t.name, e.Path)
 			if len(l.Cmd) < maxFileTargets {
-				l.Cmd = append(l.Cmd, CmdItem{Kind: "file", Label: visibleText(e.GetPath()), Href: row.Href})
+				l.Cmd = append(l.Cmd, CmdItem{Kind: "file", Label: visibleText(e.Path), Href: row.Href})
 			}
 		}
-		if c := e.GetLastCommit(); c != nil {
+		if c := e.LastCommit; c != nil {
-			last := commitRow(d.name(), c, now)
+			last := commitRow(d.name(), *c, now)
 			row.Subject, row.Author, row.CHref, row.When, row.WhenAt = last.Subject, last.Author, last.CHref, last.When, last.WhenAt
 		}
 		p.Rows = append(p.Rows, row)
 	}
-	if res.Msg.GetTruncated() {
+	if res.Truncated {
 		p.Notes = append(p.Notes, "this directory has more entries than are listed here: the first "+itoa(len(entries))+" are shown.")
 	}
-	if res.Msg.GetLastCommitsTruncated() {
+	if res.LastCommitsOmitted {
 		p.Notes = append(p.Notes, "the last commit is shown for the first entries only.")
 	}
-	rd, err := s.readmeIn(ctx, d.name(), res.Msg.GetCommitId(), t.name, t.path, entries)
+	rd, err := s.readmeIn(ctx, d.repo.Name, res.CommitID.String(), t.name, t.path, entries)
 	if err != nil {
 		return nil, 0, err
 	}

M internal/adapters/web/view.go +1 -1


@@ -5,7 +5,7 @@ package web
5		import "html/template"	5		import "html/template"
6			6
7		// View models handed to the templ components. Components only loop and	7		// View models handed to the templ components. Components only loop and
8	-	// branch on these; the handlers build them from the API messages.	8	+	// branch on these; the handlers build them from the use case results.
9			9
10		// Crumb is one segment of the path in the header.	10		// Crumb is one segment of the path in the header.
11		type Crumb struct {	11		type Crumb struct {

M internal/adapters/web/web.go +37 -32

 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Package web is the HTML front of ermite: the pages of the read-only
-// showcase, rendered with templ from the data of the ermite API.
+// showcase, rendered with templ from the data of the use cases.
 //
-// The package is a client of the API like any other. It talks to the
+// Like every other inbound adapter, the package reads and writes through the
-// generated ermite-api Connect clients, which internal/app binds in process to the
+// use case interfaces of package ports (ADR 0024), never through the API. The
-// handlers of the rpc adapter (ADR 0020), and it knows nothing of the use
+// caller of every use case call is passed explicitly: the principal of the
-// cases or the domain. Who the visitor is comes with the request context, set
+// request, which is anonymous unless the request carries a valid owner session
-// by the middleware internal/app puts in front of the handler: anonymous in P5. The
+// (ServeHTTP sets it in the context, principal reads it). The use cases then
-// API then shows public repositories only; a private repository is
+// show public repositories only to an anonymous caller; a private repository
-// indistinguishable from a missing one, here as everywhere.
+// is indistinguishable from a missing one (domain.ErrNotFound), here as
+// everywhere.
 //
 // Adding a page: a handler on Server, a route in routes, a templ page in
 // pages.templ and its view model in view.go.
 	"strings"
 	"time"
-	"connectrpc.com/connect"
 	"github.com/a-h/templ"
 	"github.com/bnema/zerowrap"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
+	"bnema.dev/ermite/internal/domain"
 	"bnema.dev/ermite/internal/ports"
 )
 // over this one.
 var Patterns = []string{"/"}
-// requestTimeout bounds the API calls that build one page.
+// requestTimeout bounds the use case calls that build one page.
 const requestTimeout = 30 * time.Second
 // Config configures a Server.
 type Config struct {
-	// Repos and Git are the API clients the pages are built from.
+	// Repos and Browse are the use cases the pages are built from.
-	Repos ermiteconnect.RepoServiceClient
+	Repos  ports.RepoService
-	Git   ermiteconnect.GitServiceClient
+	Browse ports.BrowseService
-	// MergeRequests is the client of the merge request pages (ADR 0017).
+	// MergeRequests serves the merge request pages (ADR 0017). Without it
-	// Without it there are no such pages, nor section for them.
+	// there are no such pages, nor section for them. Leave it unset rather
-	MergeRequests ermiteconnect.MergeRequestServiceClient
+	// than assigning a typed nil pointer.
-	// Events is the client of the event stream behind /-/events. Without
+	MergeRequests ports.MergeRequestService
-	// it the pages are not live and the route answers 404.
+	// Events is the source of the event stream behind /-/events. Without
-	Events ermiteconnect.EventServiceClient
+	// it the pages are not live and the route answers 404. Leave it unset
+	// rather than assigning a typed nil pointer.
+	Events ports.EventService
 	// Heartbeat is how often an idle event stream gets a comment line;
 	// DefaultHeartbeat when zero.
 	Heartbeat time.Duration
 // New builds the web handler.
 func New(cfg Config) (*Server, error) {
-	if cfg.Repos == nil || cfg.Git == nil {
+	if cfg.Repos == nil || cfg.Browse == nil {
-		return nil, errors.New("web: the repository and Git API clients are required")
+		return nil, errors.New("web: the repository and browse use cases are required")
 	}
 	u, err := url.Parse(cfg.PublicURL)
 	if err != nil || u.Host == "" {
 // ServeHTTP implements http.Handler.
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Whatever the context carried, the caller is anonymous until a valid
+	// session says otherwise (withSession).
+	r = r.WithContext(domain.ContextWithPrincipal(r.Context(), domain.Anonymous()))
 	r = s.withSession(w, r)
 	if !s.gate(w, r) {
 		return
 // error, which becomes the 404 or 500 page.
 type handler func(ctx context.Context, r *http.Request) (templ.Component, int, error)
-// page adapts a handler: it bounds the API calls, renders the component into
+// page adapts a handler: it bounds the use case calls, renders the component into
 // a buffer (so that a failure never leaves half a page), and maps errors to
 // the state pages.
 func (s *Server) page(h handler) http.HandlerFunc {
 	}
 }
-// fail answers an error of the API: not found (and a name or revision the
+// fail answers an error of a use case: not found (and a name or revision the
-// API refuses, which no page can show either) gives the 404 page, a visitor
+// use case refuses, which no page can show either) gives the 404 page, a
-// that left gives nothing, anything else gives the 500 page with an id to
+// visitor that left gives nothing, anything else gives the 500 page with an id
-// find the cause in the log.
+// to find the cause in the log.
 func (s *Server) fail(ctx context.Context, w http.ResponseWriter, r *http.Request, err error) {
-	switch code := connect.CodeOf(err); {
+	switch {
-	case errors.Is(err, errNotFound), code == connect.CodeNotFound, code == connect.CodeInvalidArgument:
+	case errors.Is(err, domain.ErrNotFound), domain.IsInvalid(err):
 		s.write(ctx, w, r, http.StatusNotFound, s.notFoundPage())
-	case errors.Is(err, context.Canceled), code == connect.CodeCanceled:
+	case errors.Is(err, context.Canceled):
 		// The client is gone; there is nobody to answer.
 	default:
 		id := requestID()
 }
 // errNotFound is returned by handlers for a resource that does not exist
-// although the API did not say so (a ref or a path that is not there).
+// although the use case did not say so (a ref or a path that is not there).
-var errNotFound = errors.New("not found")
+var errNotFound = domain.ErrNotFound
 // requestID is a short random id, shown on the 500 page and logged.
 func requestID() string {

M internal/app/api_test.go +1 -70


@@ -765,77 +765,8 @@ func TestDeleteRepoMovesToTrash(t *testing.T) {
765		assert.Equal(t, "not_found", codeName(err), "no commit of the deleted repository survives in a reader process")	765		assert.Equal(t, "not_found", codeName(err), "no commit of the deleted repository survives in a reader process")
766		}	766		}
767			767
768	-	// TestInProcessClient: the handlers answer calls made in the process with a
769	-	// principal in the context, with no HTTP authentication, and refuse to be
770	-	// fooled by an Authorization header.
771	-	func TestInProcessClient(t *testing.T) {
772	-	h := newHarness(t, harnessOpts{})
773	-	h.seed("pub", domain.VisibilityPublic, "README.md")
774	-	h.seed("priv", domain.VisibilityPrivate, "README.md")
775	-	c := newClientsOn(h.forge.API.InProcessClient(), rpc.InProcessURL)
776	-	list := func(ctx context.Context) []string {
777	-	resp, err := c.repo.ListRepos(ctx, connect.NewRequest(&pb.ListReposRequest{}))
778	-	require.NoError(t, err)
779	-	var out []string
780	-	for _, r := range resp.Msg.GetRepos() {
781	-	out = append(out, r.GetName())
782	-	}
783	-	return out
784	-	}
785	-
786	-	assert.Equal(t, []string{"pub"}, list(h.ctx), "no principal in the context is anonymous")
787	-	assert.Equal(t, []string{"pub"}, list(domain.ContextWithPrincipal(h.ctx, domain.Anonymous())))
788	-	owner := domain.ContextWithPrincipal(h.ctx, domain.Root())
789	-	assert.Equal(t, []string{"priv", "pub"}, list(owner))
790	-
791	-	// Mutations and streams work the same way.
792	-	_, err := c.repo.CreateRepo(owner, connect.NewRequest(&pb.CreateRepoRequest{Name: "web-made"}))
793	-	require.NoError(t, err)
794	-	_, err = c.repo.CreateRepo(h.ctx, connect.NewRequest(&pb.CreateRepoRequest{Name: "denied"}))
795	-	assert.Equal(t, "unauthenticated", codeName(err))
796	-	msgs, err := readBlob(owner, c, &pb.GetBlobRequest{Repo: "priv", Path: "README.md"})
797	-	require.NoError(t, err)
798	-	assert.Equal(t, "content of README.md\n", string(msgs[0].GetChunk()))
799	-	_, err = readBlob(h.ctx, c, &pb.GetBlobRequest{Repo: "priv", Path: "README.md"})
800	-	assert.Equal(t, "not_found", codeName(err))
801	-
802	-	wctx, cancel := context.WithCancel(owner)
803	-	defer cancel()
804	-	st, err := c.event.Watch(wctx, connect.NewRequest(&pb.WatchRequest{Topics: []string{"repo:web-made"}}))
805	-	require.NoError(t, err)
806	-	got := make(chan *pb.Event, 1)
807	-	go func() {
808	-	if st.Receive() {
809	-	got <- st.Msg().GetEvent()
810	-	}
811	-	}()
812	-	require.Eventually(t, func() bool { return h.forge.EventLog.Watchers() == 1 }, 5*time.Second, time.Millisecond)
813	-	_, err = c.repo.UpdateRepo(owner, connect.NewRequest(&pb.UpdateRepoRequest{
814	-	Repo: "web-made", Description: "d", UpdateMask: &fieldmaskpb.FieldMask{Paths: []string{"description"}},
815	-	}))
816	-	require.NoError(t, err)
817	-	select {
818	-	case ev := <-got:
819	-	assert.Equal(t, "d", ev.GetRepoUpdated().GetRepo().GetDescription())
820	-	case <-time.After(10 * time.Second):
821	-	t.Fatal("no event through the in-process client")
822	-	}
823	-
824	-	// An Authorization header does not give a principal in process.
825	-	hc := h.forge.API.InProcessClient()
826	-	req, _ := http.NewRequestWithContext(h.ctx, http.MethodPost, rpc.InProcessURL+"/ermite.RepoService/ListRepos", strings.NewReader("{}"))
827	-	req.Header.Set("Content-Type", "application/json")
828	-	req.Header.Set("Authorization", "Bearer "+adminToken)
829	-	resp, err := hc.Do(req)
830	-	require.NoError(t, err)
831	-	body, _ := io.ReadAll(resp.Body)
832	-	_ = resp.Body.Close()
833	-	assert.NotContains(t, string(body), `"priv"`)
834	-	}
835	-
836		// A principal in the base context of the HTTP server does not authenticate	768		// A principal in the base context of the HTTP server does not authenticate
837	-	// requests: only the in-process transport can mark a context as trusted, and	769	+	// requests: requests from the network are judged by their headers.
838	-	// requests from the network are judged by their headers.
839		func TestNetworkRequestsIgnoreAPrincipalInTheContext(t *testing.T) {	770		func TestNetworkRequestsIgnoreAPrincipalInTheContext(t *testing.T) {
840		h := newHarness(t, harnessOpts{})	771		h := newHarness(t, harnessOpts{})
841		h.seed("pub", domain.VisibilityPublic, "README.md")	772		h.seed("pub", domain.VisibilityPublic, "README.md")

M internal/app/events_test.go +7 -6

 	"google.golang.org/protobuf/types/known/fieldmaskpb"
 	pb "bnema.dev/ermite-api/gen/ermite"
-	"bnema.dev/ermite/internal/adapters/rpc"
 	"bnema.dev/ermite/internal/domain"
 	"bnema.dev/ermite/internal/ports"
 	"bnema.dev/ermite/internal/usecase"
 	require.Eventually(t, func() bool { return h.forge.EventLog.Watchers() == usecase.MaxWatchersPerClient }, 5*time.Second, time.Millisecond)
 	assert.Equal(t, "resource_exhausted", codeName(watchErr(h.ctx, api)))
 	// A stream of another client address is not affected (the harness trusts
-	// the loopback proxy only when configured: use the in-process caller).
+	// the loopback proxy only when configured: ask the use case directly).
-	inProc := newClientsOn(h.forge.API.InProcessClient(), rpc.InProcessURL)
+	ctx, cancel := context.WithCancel(h.ctx)
-	ctx, cancel := context.WithCancel(domain.ContextWithPrincipal(h.ctx, domain.Root()))
 	defer cancel()
-	st, err := inProc.event.Watch(ctx, connect.NewRequest(&pb.WatchRequest{}))
+	registered := false
+	err := h.forge.EventLog.Watch(ctx, domain.Root(), ports.WatchParams{
+		Client: "another-client", Ready: func() { registered = true; cancel() },
+	}, func(ports.WatchEvent) error { return nil })
 	require.NoError(t, err)
-	_ = st.Close()
+	assert.True(t, registered, "a watch of another client address is registered")
 }
 // sentinel proves that nothing reached the stream since the last event it

M internal/app/forge.go +1 -1


@@ -241,7 +241,7 @@ func newForge(ctx context.Context, cfg config.Config, opts options) (_ *forge, e
241		}	241		}
242		warnSessionsNeedHTTPS(ctx, cfg.PublicURL)	242		warnSessionsNeedHTTPS(ctx, cfg.PublicURL)
243		warnSharedClientKey(ctx, cfg.TrustedProxies, githttp.DefaultMaxPerClient)	243		warnSharedClientKey(ctx, cfg.TrustedProxies, githttp.DefaultMaxPerClient)
244	-	site, err := newWeb(cfg, f.API, f.Sessions, limiter)	244	+	site, err := newWeb(cfg, f, limiter)
245		if err != nil {	245		if err != nil {
246		return nil, fmt.Errorf("web: %w", err)	246		return nil, fmt.Errorf("web: %w", err)
247		}	247		}

M internal/app/web.go +17 -36

 	"github.com/bnema/zerowrap"
-	"bnema.dev/ermite-api/gen/ermite/ermiteconnect"
 	"bnema.dev/ermite/internal/adapters/httpserver"
-	"bnema.dev/ermite/internal/adapters/rpc"
 	"bnema.dev/ermite/internal/adapters/web"
 	"bnema.dev/ermite/internal/clientlimit"
 	"bnema.dev/ermite/internal/config"
 	"bnema.dev/ermite/internal/usecase"
 )
-// newWeb builds the web pages on the API of this process: the generated
+// newWeb builds the web pages on the use cases of this process, through the
-// Connect clients are bound to the handlers of api, with no socket (ADR 0020).
+// ports (ADR 0020), like the API and Git over HTTP.
 //
 // The owner's session cookie turns a request into the owner's (web.Server
-// checks it with sessions); every other request is anonymous.
+// checks it with sessions); every other request is anonymous. The web passes
-func newWeb(cfg config.Config, api *rpc.API, sessions *usecase.Sessions, limiter *clientlimit.Limiter) (http.Handler, error) {
+// the principal of the request to each use case call itself.
-	hc := api.InProcessClient()
+func newWeb(cfg config.Config, f *forge, limiter *clientlimit.Limiter) (http.Handler, error) {
-	srv, err := web.New(web.Config{
+	return web.New(web.Config{
-		Repos:         ermiteconnect.NewRepoServiceClient(hc, rpc.InProcessURL),
+		Repos:         f.Repos,
-		Git:           ermiteconnect.NewGitServiceClient(hc, rpc.InProcessURL),
+		Browse:        f.Browse,
-		MergeRequests: ermiteconnect.NewMergeRequestServiceClient(hc, rpc.InProcessURL),
+		MergeRequests: f.MergeRequests,
-		Events:        ermiteconnect.NewEventServiceClient(hc, rpc.InProcessURL),
+		Events:        f.EventLog,
 		PublicURL:     cfg.PublicURL,
 		SourceURL:     cfg.SourceURL,
 		Version:       serverVersion(),
-		Sessions:       webSessions{sessions},
+		Sessions:       webSessions{f.Sessions},
 		Limiter:        limiter,
 		TrustedProxies: cfg.TrustedProxies,
 	})
-	if err != nil {
-		return nil, err
-	}
-	return asPrincipal(domain.Anonymous(), cfg.TrustedProxies, srv), nil
 }
 // sessionsNeedHTTPS reports whether browser sign-in cannot work on this public
 }
 // webSessions adapts the session use cases to ports.WebSessionService: a valid
-// token gives the context of the owner, whose principal the API calls of the
+// token gives the owner, the principal the web passes to the use cases for
-// page carry (rpc.API.InProcessClient).
+// that request.
 type webSessions struct{ *usecase.Sessions }
 var _ ports.WebSessionService = webSessions{}
 	return token, lifetime, nil
 }
-func (s webSessions) Verify(ctx context.Context, token string) (context.Context, bool, error) {
+func (s webSessions) Verify(ctx context.Context, token string) (domain.Principal, bool, error) {
 	p, err := s.Sessions.Verify(ctx, token)
 	if errors.Is(err, domain.ErrUnauthenticated) {
-		return ctx, false, nil
+		return domain.Anonymous(), false, nil
 	}
 	if err != nil {
-		return ctx, false, err
+		return domain.Anonymous(), false, err
 	}
-	return domain.ContextWithPrincipal(ctx, p), true, nil
+	return p, true, nil
-}
-// asPrincipal runs next with p as the caller of every request, attributed to
-// the browser's address: the API calls the web makes carry both
-// (rpc.API.InProcessClient), so the per-client limits of the API count each
-// visitor. Browsers are anonymous; web.Server replaces the principal with the
-// owner's when the request carries a valid session.
-func asPrincipal(p domain.Principal, trusted []netip.Prefix, next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ctx := domain.ContextWithPrincipal(r.Context(), p)
-		ctx = rpc.ContextWithClient(ctx, clientlimit.ClientAddr(r, trusted))
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
 }
 // webRoutes mounts the web on the patterns it serves.

M internal/app/web_session_test.go +15 -7

 	assert.NotContains(t, logs, string(key))
 }
-// The owner principal is what the API sees from a signed-in page, and is
+// The owner principal is what the use cases see from a signed-in page, and is
-// labelled "owner".
+// labelled "owner": the use case logs it with a write the page made.
 func TestWebOwnerIsLabelledInLogs(t *testing.T) {
-	c := newCLIHarness(t)
+	r := newMRRepo(t, domain.VisibilityPublic)
-	c.seed("secret", domain.VisibilityPrivate, "notes.txt")
+	token := r.signIn(t)
-	token := c.signIn(t)
+	r.cli(t, adminToken, "mr", "create", "proj", "--source", "feat/search", "--title", "Add search").ok(t)
-	browser{c.harness}.get("/secret", as(token))
+	b := browser{r.harness}
-	assert.Contains(t, c.logs.String(), `"principal":"owner"`)
+	res := b.form("/proj/merge-requests/1/comments", token, url.Values{"text": {"from the page"}})
+	require.Equal(t, http.StatusSeeOther, res.status, res.body)
+	var line string
+	for _, l := range strings.Split(r.logs.String(), "\n") {
+		if strings.Contains(l, `"comment added"`) {
+			line = l
+		}
+	}
+	assert.Contains(t, line, `"principal":"owner"`)
 }
 // GO-004: a Secure cookie is kept by browsers only from https (or a loopback

M internal/boundary/boundary_test.go +67 -7


@@ -20,6 +20,10 @@ import (
20			20
21		const modulePath = "bnema.dev/ermite"	21		const modulePath = "bnema.dev/ermite"
22			22
			23	+	// apiGenPath is the generated code of the API contract (protobuf and Connect),
			24	+	// a module of its own.
			25	+	const apiGenPath = "bnema.dev/ermite-api/gen"
			26	+
23		// moduleRoot is the module root relative to this package's directory.	27		// moduleRoot is the module root relative to this package's directory.
24		const moduleRoot = "../.."	28		const moduleRoot = "../.."
25			29

@@ -48,7 +52,8 @@ const (
48		// - internal/usecase holds the use cases: domain and ports only.	52		// - internal/usecase holds the use cases: domain and ports only.
49		// - adapters implement ports and never import use cases or app; the	53		// - adapters implement ports and never import use cases or app; the
50		// per-package rule in packageImportDenied also keeps them from importing	54		// per-package rule in packageImportDenied also keeps them from importing
51	-	// each other.	55	+	// each other, and keeps the web adapter off the generated API code: like
			56	+	// every other adapter it reads and writes through the ports (ADR 0020).
52		// - internal/clientlimit is infrastructure shared by the HTTP adapters.	57		// - internal/clientlimit is infrastructure shared by the HTTP adapters.
53		// - internal/config parses the environment into plain values.	58		// - internal/config parses the environment into plain values.
54		var productionDependencies = map[packageLayer]map[packageLayer]bool{	59		var productionDependencies = map[packageLayer]map[packageLayer]bool{

@@ -78,6 +83,33 @@ func TestImportBoundaries(t *testing.T) {
78		}	83		}
79		}	84		}
80			85
			86	+	// The generated API code is outside the module: the walk would skip it. The
			87	+	// web adapter may not import it in production code, whichever package of it.
			88	+	func TestWebAdapterRejectsAPIGeneratedCode(t *testing.T) {
			89	+	tests := []struct {
			90	+	name, source, target string
			91	+	testFile bool
			92	+	want bool
			93	+	}{
			94	+	{"web messages", modulePath + "/internal/adapters/web", apiGenPath + "/ermite", false, false},
			95	+	{"web connect", modulePath + "/internal/adapters/web", apiGenPath + "/ermite/ermiteconnect", false, false},
			96	+	{"web subpackage", modulePath + "/internal/adapters/web/sub", apiGenPath + "/ermite", false, false},
			97	+	{"web test file", modulePath + "/internal/adapters/web", apiGenPath + "/ermite", true, true},
			98	+	{"rpc adapter", modulePath + "/internal/adapters/rpc", apiGenPath + "/ermite", false, true},
			99	+	{"client adapter", modulePath + "/internal/adapters/client", apiGenPath + "/ermite/ermiteconnect", false, true},
			100	+	{"other module of the API", modulePath + "/internal/adapters/web", "bnema.dev/ermite-api/other", false, true},
			101	+	{"web other external package", modulePath + "/internal/adapters/web", "github.com/a-h/templ", false, true},
			102	+	{"a package whose name only starts alike", modulePath + "/internal/adapters/web", apiGenPath + "x/y", false, true},
			103	+	}
			104	+	for _, tt := range tests {
			105	+	t.Run(tt.name, func(t *testing.T) {
			106	+	if got := !externalImportDenied(tt.source, tt.target, tt.testFile); got != tt.want {
			107	+	t.Fatalf("externalImportDenied(%q, %q, test=%t) = %t, want %t", tt.source, tt.target, tt.testFile, !got, !tt.want)
			108	+	}
			109	+	})
			110	+	}
			111	+	}
			112	+
81		func TestImportBoundaryFixtures(t *testing.T) {	113		func TestImportBoundaryFixtures(t *testing.T) {
82		p := func(s string) string { return modulePath + "/" + s }	114		p := func(s string) string { return modulePath + "/" + s }
83		tests := []struct {	115		tests := []struct {

@@ -106,8 +138,12 @@ func TestImportBoundaryFixtures(t *testing.T) {
106		{"adapter accepts domain", p("internal/adapters/rpc"), p("internal/domain"), false, true},	138		{"adapter accepts domain", p("internal/adapters/rpc"), p("internal/domain"), false, true},
107		{"adapter accepts clientlimit", p("internal/adapters/githttp"), p("internal/clientlimit"), false, true},	139		{"adapter accepts clientlimit", p("internal/adapters/githttp"), p("internal/clientlimit"), false, true},
108		{"adapter accepts own subpackage", p("internal/adapters/web/sub"), p("internal/adapters/web"), false, true},	140		{"adapter accepts own subpackage", p("internal/adapters/web/sub"), p("internal/adapters/web"), false, true},
109	-	{"adapter production rejects generated mocks", p("internal/adapters/web"), p("internal/adapters/web/mocks"), false, false},	141	+	{"adapter accepts generated", p("internal/adapters/rpc"), p("gen/ermite"), false, true},
110	-	{"adapter test may import generated mocks", p("internal/adapters/web"), p("internal/adapters/web/mocks"), true, true},	142	+	{"web rejects generated", p("internal/adapters/web"), p("gen/ermite"), false, false},
			143	+	{"web rejects generated connect", p("internal/adapters/web"), p("gen/ermite/ermiteconnect"), false, false},
			144	+	{"web subpackage rejects generated", p("internal/adapters/web/sub"), p("gen/ermite"), false, false},
			145	+	{"web test may import ports mocks", p("internal/adapters/web"), p("internal/ports/mocks"), true, true},
			146	+	{"web production rejects ports mocks", p("internal/adapters/web"), p("internal/ports/mocks"), false, false},
111		{"adapter rejects usecase", p("internal/adapters/rpc"), p("internal/usecase"), false, false},	147		{"adapter rejects usecase", p("internal/adapters/rpc"), p("internal/usecase"), false, false},
112		{"adapter rejects app", p("internal/adapters/rpc"), p("internal/app"), false, false},	148		{"adapter rejects app", p("internal/adapters/rpc"), p("internal/app"), false, false},
113		{"adapter rejects config", p("internal/adapters/rpc"), p("internal/config"), false, false},	149		{"adapter rejects config", p("internal/adapters/rpc"), p("internal/config"), false, false},

@@ -176,7 +212,14 @@ func inspectRepositoryDependencies(t *testing.T) ([]string, map[string]struct{})
176		testFile := strings.HasSuffix(path, "_test.go")	212		testFile := strings.HasSuffix(path, "_test.go")
177		for _, spec := range file.Imports {	213		for _, spec := range file.Imports {
178		target, err := strconv.Unquote(spec.Path.Value)	214		target, err := strconv.Unquote(spec.Path.Value)
179	-	if err != nil \|\| (target != modulePath && !strings.HasPrefix(target, modulePath+"/")) {	215	+	if err != nil {
			216	+	continue
			217	+	}
			218	+	if externalImportDenied(source, target, testFile) {
			219	+	violations = append(violations, fmt.Sprintf("%s: %s may not import %s", rel, source, target))
			220	+	continue
			221	+	}
			222	+	if target != modulePath && !strings.HasPrefix(target, modulePath+"/") {
180		continue	223		continue
181		}	224		}
182		allowed, err := dependencyAllowed(source, target, testFile)	225		allowed, err := dependencyAllowed(source, target, testFile)

@@ -218,14 +261,31 @@ func dependencyAllowed(source, target string, testFile bool) (bool, error) {
218		return productionDependencies[sourceLayer][targetLayer], nil	261		return productionDependencies[sourceLayer][targetLayer], nil
219		}	262		}
220			263
			264	+	// externalImportDenied reports whether a file of package source may not import
			265	+	// target, a package outside the module. The only such rule: the production
			266	+	// code of the web adapter does not import the generated API code
			267	+	// (apiGenPath), so that it goes through the ports. Test files are exempt, like
			268	+	// for every rule here.
			269	+	func externalImportDenied(source, target string, testFile bool) bool {
			270	+	if testFile \|\| !under(target, apiGenPath) {
			271	+	return false
			272	+	}
			273	+	return under(source, modulePath+"/internal/adapters/web")
			274	+	}
			275	+
221		// packageImportDenied narrows the layer rules to packages: an adapter may	276		// packageImportDenied narrows the layer rules to packages: an adapter may
222	-	// import only packages under its own directory (its mocks, for instance),	277	+	// import only packages under its own directory, never a sibling adapter; and
223	-	// never a sibling adapter.	278	+	// the web adapter may not import the generated API code at all (protobuf,
			279	+	// Connect): it goes through the ports, as the other adapters that serve the
			280	+	// use cases do.
224		func packageImportDenied(source, target string) bool {	281		func packageImportDenied(source, target string) bool {
225		const adapters = modulePath + "/internal/adapters/"	282		const adapters = modulePath + "/internal/adapters/"
226		if strings.HasPrefix(source, adapters) && strings.HasPrefix(target, adapters) {	283		if strings.HasPrefix(source, adapters) && strings.HasPrefix(target, adapters) {
227		return adapterRoot(source) != adapterRoot(target)	284		return adapterRoot(source) != adapterRoot(target)
228		}	285		}
			286	+	if strings.HasPrefix(source, adapters) && adapterRoot(source) == "web" {
			287	+	return under(target, modulePath+"/gen")
			288	+	}
229		return false	289		return false
230		}	290		}
231			291

@@ -253,7 +313,7 @@ func classifyPackage(path string) (packageLayer, error) {
253		return layerApp, nil	313		return layerApp, nil
254		case under(path, p("internal/usecase")):	314		case under(path, p("internal/usecase")):
255		return layerUsecase, nil	315		return layerUsecase, nil
256	-	case path == p("internal/ports/mocks"), under(path, p("internal/adapters/web/mocks")), under(path, p("internal/readertest")):	316	+	case path == p("internal/ports/mocks"), under(path, p("internal/readertest")):
257		return layerTestSupport, nil	317		return layerTestSupport, nil
258		case under(path, p("internal/adapters")):	318		case under(path, p("internal/adapters")):
259		return layerAdapter, nil	319		return layerAdapter, nil

M internal/domain/errors.go +22 -0


@@ -37,3 +37,25 @@ var (
37	// the number of event watchers; the caller may retry later.	37		// the number of event watchers; the caller may retry later.
38	ErrResourceExhausted = errors.New("resource exhausted")	38		ErrResourceExhausted = errors.New("resource exhausted")
39	)	39		)
		40	+
		41	+	// invalidErrors are the errors that mean a request was malformed.
		42	+	var invalidErrors = []error{
		43	+	ErrInvalid, ErrInvalidName, ErrInvalidVisibility,
		44	+	ErrInvalidScope, ErrInvalidToken,
		45	+	ErrInvalidObjectID, ErrInvalidRevision, ErrInvalidPath,
		46	+	ErrInvalidPageToken, ErrInvalidPageSize, ErrInvalidRefKind,
		47	+	ErrNotDirectory, ErrNotFile, ErrInvalidText,
		48	+	}
		49	+
		50	+	// IsInvalid reports whether err means that the request was malformed: an
		51	+	// invalid name, revision, path, page token, text, and the like. The adapters
		52	+	// answer all of them alike (invalid_argument on the API, the 404 page on the
		53	+	// web).
		54	+	func IsInvalid(err error) bool {
		55	+	for _, invalid := range invalidErrors {
		56	+	if errors.Is(err, invalid) {
		57	+	return true
		58	+	}
		59	+	}
		60	+	return false
		61	+	}

A internal/domain/errors_test.go +42 -0

@@ -0,0 +1,42 @@
	1	+	// SPDX-License-Identifier: AGPL-3.0-or-later
	2	+
	3	+	package domain
	4	+
	5	+	import (
	6	+	"errors"
	7	+	"fmt"
	8	+	"testing"
	9	+
	10	+	"github.com/stretchr/testify/assert"
	11	+	)
	12	+
	13	+	func TestIsInvalid(t *testing.T) {
	14	+	t.Parallel()
	15	+	var named *InvalidNameError
	16	+	_, parseErr := ParseRepoName("Bad Name")
	17	+	assert.ErrorAs(t, parseErr, &named)
	18	+
	19	+	tests := []struct {
	20	+	name string
	21	+	err error
	22	+	want bool
	23	+	}{
	24	+	{"nil", nil, false},
	25	+	{"invalid", ErrInvalid, true},
	26	+	{"wrapped invalid", fmt.Errorf("x: %w", ErrInvalidRevision), true},
	27	+	{"invalid name from the parser", parseErr, true},
	28	+	{"invalid fields", &InvalidFieldsError{Fields: []FieldViolation{{Field: "title", Reason: "is empty"}}}, true},
	29	+	{"page token", ErrInvalidPageToken, true},
	30	+	{"not a file", ErrNotFile, true},
	31	+	{"invalid text", ErrInvalidText, true},
	32	+	{"not found is not invalid", ErrNotFound, false},
	33	+	{"forbidden is not invalid", ErrForbidden, false},
	34	+	{"other", errors.New("boom"), false},
	35	+	}
	36	+	for _, tt := range tests {
	37	+	t.Run(tt.name, func(t *testing.T) {
	38	+	t.Parallel()
	39	+	assert.Equal(t, tt.want, IsInvalid(tt.err))
	40	+	})
	41	+	}
	42	+	}

M internal/ports/mocks/WebSessionService.go +8 -9

 	"context"
 	"time"
+	"bnema.dev/ermite/internal/domain"
 	mock "github.com/stretchr/testify/mock"
 )
 }
 // Verify provides a mock function for the type WebSessionService
-func (_mock *WebSessionService) Verify(ctx context.Context, token string) (context.Context, bool, error) {
+func (_mock *WebSessionService) Verify(ctx context.Context, token string) (domain.Principal, bool, error) {
 	ret := _mock.Called(ctx, token)
 	if len(ret) == 0 {
 		panic("no return value specified for Verify")
 	}
-	var r0 context.Context
+	var r0 domain.Principal
 	var r1 bool
 	var r2 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string) (context.Context, bool, error)); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) (domain.Principal, bool, error)); ok {
 		return returnFunc(ctx, token)
 	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string) context.Context); ok {
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) domain.Principal); ok {
 		r0 = returnFunc(ctx, token)
 	} else {
-		if ret.Get(0) != nil {
+		r0 = ret.Get(0).(domain.Principal)
-			r0 = ret.Get(0).(context.Context)
-		}
 	}
 	if returnFunc, ok := ret.Get(1).(func(context.Context, string) bool); ok {
 		r1 = returnFunc(ctx, token)
 	return _c
 }
-func (_c *WebSessionService_Verify_Call) Return(owner context.Context, ok bool, err error) *WebSessionService_Verify_Call {
+func (_c *WebSessionService_Verify_Call) Return(owner domain.Principal, ok bool, err error) *WebSessionService_Verify_Call {
 	_c.Call.Return(owner, ok, err)
 	return _c
 }
-func (_c *WebSessionService_Verify_Call) RunAndReturn(run func(ctx context.Context, token string) (context.Context, bool, error)) *WebSessionService_Verify_Call {
+func (_c *WebSessionService_Verify_Call) RunAndReturn(run func(ctx context.Context, token string) (domain.Principal, bool, error)) *WebSessionService_Verify_Call {
 	_c.Call.Return(run)
 	return _c
 }

M internal/ports/services.go +5 -5


@@ -109,11 +109,11 @@ type WebSessionService interface {
109		// Login uses the link and returns the session token and how long it	109		// Login uses the link and returns the session token and how long it
110		// lasts, or ErrLinkRejected.	110		// lasts, or ErrLinkRejected.
111		Login(ctx context.Context, nonce string) (token string, lifetime time.Duration, err error)	111		Login(ctx context.Context, nonce string) (token string, lifetime time.Duration, err error)
112	-	// Verify checks a session token. When it is valid it returns the context	112	+	// Verify checks a session token. When it is valid it returns the owner,
113	-	// to serve the request with, which carries the owner as the caller of the	113	+	// the principal the web passes to the use cases for that request; when it
114	-	// API; when it is not, ok is false and err nil. An error means the check	114	+	// is not, ok is false and err nil. An error means the check could not be
115	-	// could not be made (the request then runs as anonymous).	115	+	// made (the request then runs as anonymous).
116	-	Verify(ctx context.Context, token string) (owner context.Context, ok bool, err error)	116	+	Verify(ctx context.Context, token string) (owner domain.Principal, ok bool, err error)
117		}	117		}
118			118
119		// PushService opens a repository for a push: it is domain.ErrUnauthenticated	119		// PushService opens a repository for a push: it is domain.ErrUnauthenticated