e9c6360 fix(web): show session refusals in the async merge box and keep a single merge error alert · ermite

M internal/adapters/web/jstest/mr.test.mjs +12 -4


@@ -152,8 +152,10 @@ test('footer tabs: closed by default, toggle, switch, arrows, hash', () => {
152	152		test('footer: #mr-ck syncs the checks label; its click opens Checks without toggling', () => {
153	153		const text0 = { v: '' }; let writes = 0;
154	154		const label = { get textContent() { return text0.v; }, set textContent(v) { writes++; text0.v = v; } };
155		-	const summary = { title: '1/2 failed', textContent: ' 1/2 ', parentElement: {} };
156		-	const h = footerHarness({ summary });
	155	+	const bar = {};
	156	+	const summary = { title: '1/2 failed', textContent: ' 1/2 ', closest: (s) => s === '.mr-bar' ? bar : null };
	157	+	const extra = { summary };
	158	+	const h = footerHarness(extra);
157	159		let observed = null, callback = null;
158	160		globalThis.MutationObserver = class { constructor(fn) { callback = fn; } observe(target, opts) { observed = [target, opts]; } };
159	161		const nav = document.querySelector('[data-mr-tabs]');

@@ -161,8 +163,14 @@ test('footer: #mr-ck syncs the checks label; its click opens Checks without togg
161	163		try {
162	164		window.ermiteMR.panels();
163	165		assert.equal(label.textContent, '1/2 failed', 'initial label sync');
164		-	assert.equal(observed[0], summary.parentElement);
165		-	assert.deepEqual(observed[1], { childList: true }, 'only #mr-ck replacements wake the observer');
	166	+	assert.equal(observed[0], bar);
	167	+	assert.deepEqual(observed[1], { childList: true, subtree: true }, 'the stable bar observes action and badge replacements');
	168	+	// Replace #mr-actions, including its badge, then replace the badge alone.
	169	+	extra.summary = { title: 'checks running', textContent: '' }; callback();
	170	+	assert.equal(label.textContent, 'checks running');
	171	+	extra.summary = { title: 'checks passed', textContent: '' }; callback();
	172	+	assert.equal(label.textContent, 'checks passed');
	173	+	extra.summary = summary; callback();
166	174		const before = writes; callback(); callback();
167	175		assert.equal(writes, before, 'an unchanged label is not written');
168	176		summary.title = ''; callback();

 test('footer: #mr-ck syncs the checks label; its click opens Checks without toggling', () => {
   const text0 = { v: '' }; let writes = 0;
   const label = { get textContent() { return text0.v; }, set textContent(v) { writes++; text0.v = v; } };
-  const summary = { title: '1/2 failed', textContent: ' 1/2 ', parentElement: {} };
+  const bar = {};
-  const h = footerHarness({ summary });
+  const summary = { title: '1/2 failed', textContent: ' 1/2 ', closest: (s) => s === '.mr-bar' ? bar : null };
+  const extra = { summary };
+  const h = footerHarness(extra);
   let observed = null, callback = null;
   globalThis.MutationObserver = class { constructor(fn) { callback = fn; } observe(target, opts) { observed = [target, opts]; } };
   const nav = document.querySelector('[data-mr-tabs]');
   try {
     window.ermiteMR.panels();
     assert.equal(label.textContent, '1/2 failed', 'initial label sync');
-    assert.equal(observed[0], summary.parentElement);
+    assert.equal(observed[0], bar);
-    assert.deepEqual(observed[1], { childList: true }, 'only #mr-ck replacements wake the observer');
+    assert.deepEqual(observed[1], { childList: true, subtree: true }, 'the stable bar observes action and badge replacements');
+    // Replace #mr-actions, including its badge, then replace the badge alone.
+    extra.summary = { title: 'checks running', textContent: '' }; callback();
+    assert.equal(label.textContent, 'checks running');
+    extra.summary = { title: 'checks passed', textContent: '' }; callback();
+    assert.equal(label.textContent, 'checks passed');
+    extra.summary = summary; callback();
     const before = writes; callback(); callback();
     assert.equal(writes, before, 'an unchanged label is not written');
     summary.title = ''; callback();

M internal/adapters/web/mr.templ +4 -4


@@ -462,7 +462,7 @@ templ mrBar(p MRPage) {
462	462		<div class="diff-tools mr-bar" role="group" aria-label="Diff view and merge">
463	463		<span class="dim">{ plural(p.NFiles, "file", "files") } · <span class="plus">+{ itoa(p.Adds) }</span> <span class="minus">-{ itoa(p.Dels) }</span></span>
464	464		@diffViewMenu(p.DiffView)
465		-	@mrActions(p)
	465	+	@mrActions(p, false)
466	466		</div>
467	467		}
468	468

@@ -781,7 +781,7 @@ templ MRMergeChecks(c ChecksSummary) {
781	781		// MRStateFragment updates only state and actions, leaving review drafts alone.
782	782		templ MRStateFragment(p MRPage) {
783	783		@mrState(p)
784		-	@mrActions(p)
	784	+	@mrActions(p, true)
785	785		}
786	786
787	787		templ mrState(p MRPage) {

@@ -793,14 +793,14 @@ templ mrState(p MRPage) {
793	793		</dd>
794	794		}
795	795
796		-	templ mrActions(p MRPage) {
	796	+	templ mrActions(p MRPage, fragment bool) {
797	797		<div id="mr-actions" hx-swap-oob="true" class="mr-acts">
798	798		@MRChecksSum(p.ChecksSum)
799	799		if p.Box != nil {
800	800		@mergeMenu(p)
801	801		}
802	802		@moreMenu(p)
803		-	if p.MergeError != "" {
	803	+	if fragment && p.MergeError != "" {
804	804		<p class="d-err" role="alert">{ p.MergeError }</p>
805	805		}
806	806		</div>


@@ -462,7 +462,7 @@ templ mrBar(p MRPage) {
462		<div class="diff-tools mr-bar" role="group" aria-label="Diff view and merge">	462		<div class="diff-tools mr-bar" role="group" aria-label="Diff view and merge">
463		<span class="dim">{ plural(p.NFiles, "file", "files") } · <span class="plus">+{ itoa(p.Adds) }</span> <span class="minus">-{ itoa(p.Dels) }</span></span>	463		<span class="dim">{ plural(p.NFiles, "file", "files") } · <span class="plus">+{ itoa(p.Adds) }</span> <span class="minus">-{ itoa(p.Dels) }</span></span>
464		@diffViewMenu(p.DiffView)	464		@diffViewMenu(p.DiffView)
465	-	@mrActions(p)	465	+	@mrActions(p, false)
466		</div>	466		</div>
467		}	467		}
468			468

@@ -781,7 +781,7 @@ templ MRMergeChecks(c ChecksSummary) {
781		// MRStateFragment updates only state and actions, leaving review drafts alone.	781		// MRStateFragment updates only state and actions, leaving review drafts alone.
782		templ MRStateFragment(p MRPage) {	782		templ MRStateFragment(p MRPage) {
783		@mrState(p)	783		@mrState(p)
784	-	@mrActions(p)	784	+	@mrActions(p, true)
785		}	785		}
786			786
787		templ mrState(p MRPage) {	787		templ mrState(p MRPage) {

@@ -793,14 +793,14 @@ templ mrState(p MRPage) {
793		</dd>	793		</dd>
794		}	794		}
795			795
796	-	templ mrActions(p MRPage) {	796	+	templ mrActions(p MRPage, fragment bool) {
797		<div id="mr-actions" hx-swap-oob="true" class="mr-acts">	797		<div id="mr-actions" hx-swap-oob="true" class="mr-acts">
798		@MRChecksSum(p.ChecksSum)	798		@MRChecksSum(p.ChecksSum)
799		if p.Box != nil {	799		if p.Box != nil {
800		@mergeMenu(p)	800		@mergeMenu(p)
801		}	801		}
802		@moreMenu(p)	802		@moreMenu(p)
803	-	if p.MergeError != "" {	803	+	if fragment && p.MergeError != "" {
804		<p class="d-err" role="alert">{ p.MergeError }</p>	804		<p class="d-err" role="alert">{ p.MergeError }</p>
805		}	805		}
806		</div>	806		</div>

M internal/adapters/web/mr_async_test.go +39 -0


@@ -125,3 +125,42 @@ func TestAsyncMergeOtherFailures(t *testing.T) {
125	125		})
126	126		}
127	127		}
	128	+
	129	+	func TestMergeGateRefusalFragment(t *testing.T) {
	130	+	s, _ := newSessionServer(t, newSessions(t, "tok"), testPublicURL)
	131	+	for _, origin := range []string{testPublicURL, "https://other.example"} {
	132	+	for _, hx := range []bool{false, true} {
	133	+	r := httptest.NewRequest(http.MethodPost, "/demo/merge-requests/3/merge", strings.NewReader("mode=squash"))
	134	+	r.Header.Set("Origin", origin)
	135	+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	136	+	if hx {
	137	+	r.Header.Set("HX-Request", "true")
	138	+	}
	139	+	w := httptest.NewRecorder()
	140	+	s.ServeHTTP(w, r)
	141	+	assert.Equal(t, http.StatusForbidden, w.Code)
	142	+	if hx {
	143	+	assert.Contains(t, w.Body.String(), `hx-swap-oob="true"`)
	144	+	assert.Contains(t, w.Body.String(), `id="mr-actions"`)
	145	+	if origin == testPublicURL {
	146	+	assert.Contains(t, w.Body.String(), "your session has expired")
	147	+	} else {
	148	+	assert.Contains(t, w.Body.String(), "origin was not accepted")
	149	+	}
	150	+	} else {
	151	+	assert.NotContains(t, w.Body.String(), "hx-swap-oob")
	152	+	}
	153	+	}
	154	+	}
	155	+	}
	156	+
	157	+	func TestNonHXMergeRefusalHasOneAlert(t *testing.T) {
	158	+	s, svc := asyncMergeServer(t, domain.MRStateMerged)
	159	+	svc.EXPECT().CountOpen(mock.Anything, mock.Anything, mock.Anything).Return(0, nil)
	160	+	svc.EXPECT().Merge(mock.Anything, mock.Anything, mock.Anything, int64(3), mock.Anything).Return(ports.MergeResult{}, domain.ErrConflict).Once()
	161	+	r := autoMergeRequest("/demo/merge-requests/3/merge", "mode=squash")
	162	+	w := httptest.NewRecorder()
	163	+	s.mrAction(s.mrMerge)(w, r)
	164	+	assert.Equal(t, http.StatusConflict, w.Code)
	165	+	assert.Equal(t, 1, strings.Count(w.Body.String(), `role="alert"`))
	166	+	}


@@ -125,3 +125,42 @@ func TestAsyncMergeOtherFailures(t *testing.T) {
125	})	125		})
126	}	126		}
127	}	127		}
		128	+
		129	+	func TestMergeGateRefusalFragment(t *testing.T) {
		130	+	s, _ := newSessionServer(t, newSessions(t, "tok"), testPublicURL)
		131	+	for _, origin := range []string{testPublicURL, "https://other.example"} {
		132	+	for _, hx := range []bool{false, true} {
		133	+	r := httptest.NewRequest(http.MethodPost, "/demo/merge-requests/3/merge", strings.NewReader("mode=squash"))
		134	+	r.Header.Set("Origin", origin)
		135	+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
		136	+	if hx {
		137	+	r.Header.Set("HX-Request", "true")
		138	+	}
		139	+	w := httptest.NewRecorder()
		140	+	s.ServeHTTP(w, r)
		141	+	assert.Equal(t, http.StatusForbidden, w.Code)
		142	+	if hx {
		143	+	assert.Contains(t, w.Body.String(), `hx-swap-oob="true"`)
		144	+	assert.Contains(t, w.Body.String(), `id="mr-actions"`)
		145	+	if origin == testPublicURL {
		146	+	assert.Contains(t, w.Body.String(), "your session has expired")
		147	+	} else {
		148	+	assert.Contains(t, w.Body.String(), "origin was not accepted")
		149	+	}
		150	+	} else {
		151	+	assert.NotContains(t, w.Body.String(), "hx-swap-oob")
		152	+	}
		153	+	}
		154	+	}
		155	+	}
		156	+
		157	+	func TestNonHXMergeRefusalHasOneAlert(t *testing.T) {
		158	+	s, svc := asyncMergeServer(t, domain.MRStateMerged)
		159	+	svc.EXPECT().CountOpen(mock.Anything, mock.Anything, mock.Anything).Return(0, nil)
		160	+	svc.EXPECT().Merge(mock.Anything, mock.Anything, mock.Anything, int64(3), mock.Anything).Return(ports.MergeResult{}, domain.ErrConflict).Once()
		161	+	r := autoMergeRequest("/demo/merge-requests/3/merge", "mode=squash")
		162	+	w := httptest.NewRecorder()
		163	+	s.mrAction(s.mrMerge)(w, r)
		164	+	assert.Equal(t, http.StatusConflict, w.Code)
		165	+	assert.Equal(t, 1, strings.Count(w.Body.String(), `role="alert"`))
		166	+	}

M internal/adapters/web/mr_templ.go +4 -4 generated file: collapsed

load diff

M internal/adapters/web/session.go +12 -2


@@ -178,11 +178,11 @@ func (s Server) gate(w http.ResponseWriter, r http.Request) bool {
178	178		// Host header, which the client chooses. A missing header, "null" and any
179	179		// other origin are refused.
180	180		if r.Header.Get("Origin") != s.origin {
181		-	denyForbidden(w)
	181	+	s.denyMergeGate(w, r, "the request origin was not accepted. reload this page and try again.")
182	182		return false
183	183		}
184	184		if !SignedIn(r.Context()) && !s.anonymousPost(r) {
185		-	denyForbidden(w)
	185	+	s.denyMergeGate(w, r, "your session has expired. sign in again and reload.")
186	186		return false
187	187		}
188	188		return true

@@ -335,3 +335,13 @@ func (s *Server) loginRejectedPage() templ.Component {
335	335		return s.stateOnly("sign in", "404", "login link not valid",
336	336		"this link has expired, was already used, or never existed.", "run `ermite web login` for a new one.")
337	337		}
	338	+
	339	+	// denyMergeGate keeps gate refusals visible to the enhanced merge form.
	340	+	func (s Server) denyMergeGate(w http.ResponseWriter, r http.Request, message string) {
	341	+	if !isHXMerge(r) {
	342	+	denyForbidden(w)
	343	+	return
	344	+	}
	345	+	w.Header().Set("Cache-Control", "no-store")
	346	+	s.write(r.Context(), w, r, http.StatusForbidden, MRActionStatus(message, strings.TrimSuffix(r.URL.Path, "/merge")))
	347	+	}

 	// Host header, which the client chooses. A missing header, "null" and any
 	// other origin are refused.
 	if r.Header.Get("Origin") != s.origin {
-		denyForbidden(w)
+		s.denyMergeGate(w, r, "the request origin was not accepted. reload this page and try again.")
 		return false
 	}
 	if !SignedIn(r.Context()) && !s.anonymousPost(r) {
-		denyForbidden(w)
+		s.denyMergeGate(w, r, "your session has expired. sign in again and reload.")
 		return false
 	}
 	return true
 	return s.stateOnly("sign in", "404", "login link not valid",
 		"this link has expired, was already used, or never existed.", "run `ermite web login` for a new one.")
 }
+// denyMergeGate keeps gate refusals visible to the enhanced merge form.
+func (s *Server) denyMergeGate(w http.ResponseWriter, r *http.Request, message string) {
+	if !isHXMerge(r) {
+		denyForbidden(w)
+		return
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	s.write(r.Context(), w, r, http.StatusForbidden, MRActionStatus(message, strings.TrimSuffix(r.URL.Path, "/merge")))
+}