end

  end

  # An upstream mirror is one-way by construction. There is no push to the

  # upstream it names, so accepting a push here would produce a copy that

  # claims an origin it has silently diverged from — worse than a copy that

  # will not move.

  #

  # The refusal sits on the Git plane rather than in a controller because this

  # is where a push actually lands: `advertise/4` and `receive_pack/3` are the

  # only two callers, both reach it through this clause, and the clause is

  # ahead of every principal. An operator token, a paired computer's grant,

  # and an assignment credential are refused the same way an account is, so

  # there is no principal for which the mirror is writable.

  defp authorize(_conn, %{upstream_url: upstream_url}, :write) when is_binary(upstream_url) do

    {:error, 403,

     "this repository is an upstream mirror of #{upstream_url} and accepts no pushes. " <>

       "A mirror is one-way: it carries the upstream's history and its license, " <>

       "and nothing here can be pushed back to the upstream. " <>

       "Create your own repository if you want to push."}

  end

  defp authorize(conn, repository, :write) do

    case conn.assigns[:forge_principal] do

      nil ->

       [{"www-authenticate", ~s(Basic realm="openagents-forge")}]}

  defp send_git_error(conn, {:error, status, message}) do

    conn |> send_resp(status, message) |> halt()

    conn |> put_resp_content_type("text/plain") |> send_resp(status, message) |> halt()

  end

  defp send_git_error(conn, {:error, %OpenAgents.Forge.SyncError{}}) do

         "archived" => repository["archived"] == true,

         "default_branch" => bounded_string(default_branch, 255),

         "language" => bounded_string(repository["language"], 60),

         "license" => bounded_string(license_spdx_id(repository["license"]), 60),

         "pushed_at" => bounded_string(repository["pushed_at"], 32),

         "size_kb" => bounded_size(repository["size"]),

         "permissions" => permissions,

  defp project_repository(_body), do: {:error, :github_response_invalid}

  # GitHub answers `null` for a repository with no license file, and a

  # `spdx_id` of `NOASSERTION` for one whose license it could not identify.

  # Both are "no license this projection can name", and both must stay

  # distinguishable from a real identifier downstream, so neither is

  # smuggled through as a string here.

  defp license_spdx_id(%{"spdx_id" => spdx_id})

       when is_binary(spdx_id) and spdx_id != "" and spdx_id != "NOASSERTION",

       do: spdx_id

  defp license_spdx_id(_license), do: nil

  defp project_organization_membership(%{

         "state" => "active",

         "role" => role,

    end

  end

  @doc """

  Bring in a public repository this account does not own, as an upstream

  mirror in the account's own namespace.

  This is not the import gate relaxed. `create_user_import/4` still refuses a

  source owned by anyone else, because an import claims the snapshot as this

  account's own repository and says nothing about where it came from. A mirror

  makes the opposite claim: it names the upstream on every surface that shows

  it, carries the upstream's license or records that there is none, and

  refuses every push, because there is no path back to the upstream and a

  copy that silently diverges from the source it names is worse than one that

  will not move.

  The source must be public. A private repository this account can read

  through its own GitHub grant is not something the forge may republish under

  a mirror's provenance, so `:source_repository_not_public` refuses it before

  any row exists.

  """

  def create_user_mirror(%User{} = user, source, attrs, idempotency_key)

      when is_map(source) and is_map(attrs) and is_binary(idempotency_key) do

    with {:ok, namespace} <- ensure_user_namespace(user),

         {:ok, mirror} <- mirror_provenance(source) do

      create_repository_transaction(

        user,

        namespace,

        attrs,

        source,

        "github_mirror",

        "github_import",

        idempotency_key,

        mirror

      )

    end

  end

  @doc "Bring in a public repository as an upstream mirror in an organization namespace."

  def create_organization_mirror(

        %User{} = user,

        %Namespace{kind: "organization"} = namespace,

        source,

        attrs,

        idempotency_key

      )

      when is_map(source) and is_map(attrs) and is_binary(idempotency_key) do

    with {:ok, mirror} <- mirror_provenance(source) do

      create_repository_transaction(

        user,

        namespace,

        attrs,

        source,

        "github_mirror",

        "github_import",

        idempotency_key,

        mirror

      )

    end

  end

  @doc """

  Whether this repository is an upstream mirror.

  One predicate, so the Git plane, the API projection, and the page all decide

  mirror-ness the same way and a fifth reader cannot invent a sixth rule.

  """

  def mirror?(%Repository{} = repository), do: Repository.mirror?(repository)

  defp mirror_provenance(source) do

    full_name = fetch_attr!(source, :source_full_name)

    license = fetch_attr(source, :source_license)

    cond do

      fetch_attr(source, :source_public) != true ->

        {:error, :source_repository_not_public}

      not is_binary(full_name) ->

        {:error, :invalid_import}

      true ->

        {:ok, {"https://github.com/" <> full_name, normalize_license(license)}}

    end

  end

  # An upstream with no license is not an upstream whose license is unknown.

  # GitHub answers `null` for a repository with no license file and

  # `NOASSERTION` for one whose license it cannot identify; both become the

  # literal "none", which the surfaces render as a statement rather than a

  # blank.

  defp normalize_license(license)

       when is_binary(license) and license != "" and license != "NOASSERTION",

       do: String.slice(license, 0, 60)

  defp normalize_license(_license), do: "none"

  defp repository_creation_changeset(repository, attrs, namespace, user_id, kind, nil),

    do: Repository.creation_changeset(repository, attrs, namespace, user_id, kind)

  defp repository_creation_changeset(

         repository,

         attrs,

         namespace,

         user_id,

         _kind,

         {upstream_url, license}

       ),

       do:

         Repository.mirror_creation_changeset(

           repository,

           attrs,

           namespace,

           user_id,

           upstream_url,

           license

         )

  def list_visible_repositories(%User{} = user) do

    Repo.all(

      from repository in readable_by(Repository, user),

         source,

         operation,

         provisioning_kind,

         idempotency_key

         idempotency_key,

         mirror \\ nil

       ) do

    normalized_request = %{

      namespace_id: namespace.id,

      repository: normalize_repository_attrs(attrs),

      source: normalize_source(source)

      source: normalize_source(source),

      mirror: mirror

    }

    request_digest = digest(normalized_request)

              operation,

              provisioning_kind,

              idempotency_key,

              request_digest

              request_digest,

              normalized_request.mirror

            )

        end

      end)

         operation,

         provisioning_kind,

         idempotency_key,

         request_digest

         request_digest,

         mirror

       ) do

    lock_and_validate_quota!(namespace.id)

    repository =

      %Repository{}

      |> Repository.creation_changeset(attrs, namespace, user.id, provisioning_kind)

      |> repository_creation_changeset(attrs, namespace, user.id, provisioning_kind, mirror)

      |> Repo.insert!()

    Audit.record!("repository.created", {:user, user.id}, "repository", repository.id,

        created_import

      end

    # The outbox names the executor, not the caller's intent. A mirror and an

    # import are copied by the same provisioning path, so both queue

    # `github_import` here while the idempotency record keeps them apart: one

    # key must never replay an import as a mirror or the reverse.

    outbox =

      %ProvisioningOutbox{}

      |> ProvisioningOutbox.changeset(

        repository.id,

        repository_import && repository_import.id,

        operation

        outbox_operation(provisioning_kind)

      )

      |> Repo.insert!()

    end

  end

  defp replay_result(request, "github_import") do

  defp outbox_operation("empty"), do: "create"

  defp outbox_operation("github_import"), do: "github_import"

  defp replay_result(request, operation) when operation in ["github_import", "github_mirror"] do

    repository =

      Repository

      |> Repo.get!(request.repository_id)

         source_ref_digest: references["digest"],

         source_head_sha: refs["refs/heads/#{default_branch}"],

         source_refs: refs,

         source_uses_lfs: lfs_warning?

         source_uses_lfs: lfs_warning?,

         source_public: repository["private"] == false,

         source_license: repository["license"]

       }, repository}

    else

      {:error, :github_token_missing} -> {:error, :github_connection_required}

         :ok <-

           import_stage(repository, repository_import, "fetch_source", fn ->

             fetch_source(

               repository,

               source_repository,

               source_url,

               credential,

    end

  end

  defp fetch_source(source_repository, source_url, credential, temporary_directory, options) do

  defp fetch_source(

         repository,

         source_repository,

         source_url,

         credential,

         temporary_directory,

         options

       ) do

    with {:ok, environment} <- credential_environment(credential, temporary_directory) do

      git_runner = Keyword.get(options, :git_runner, &Repos.git/3)

      args = [

        "-c",

        "credential.helper=",

        "fetch",

        "--force",

        "--prune",

        "--depth=1",

        "--no-tags",

        "--no-recurse-submodules",

        source_url,

        "+refs/heads/*:refs/heads/*",

        "+refs/tags/*:refs/tags/*"

      ]

      args =

        [

          "-c",

          "credential.helper=",

          "fetch",

          "--force",

          "--prune"

        ] ++

          depth_arguments(repository) ++

          [

            "--no-tags",

            "--no-recurse-submodules",

            source_url,

            "+refs/heads/*:refs/heads/*",

            "+refs/tags/*:refs/tags/*"

          ]

      case git_runner.(source_repository, args, env: environment) do

        {_output, 0} ->

    end

  end

  # An owned import takes the tip and states its boundary; the account can push

  # the rest of the history it already has. A mirror has no such recourse: no

  # push reaches it, and there is no path back to the upstream, so a boundary

  # here would be permanent and every clone of the mirror would carry it. The

  # copy is therefore full, and `shallow_boundaries/1` then records the empty

  # boundary set the fetch actually produced rather than assuming it.

  #

  # Both branches record what happened. Neither leaves the WAL silent about

  # its boundary, which is the failure #179 found.

  defp depth_arguments(%Repository{upstream_url: url}) when is_binary(url), do: []

  defp depth_arguments(_repository), do: ["--depth=1"]

  defp credential_environment(nil, _temporary_directory),

    do: {:ok, [{"GIT_TERMINAL_PROMPT", "0"}]}

    field :provision_error_code, :string

    field :storage_key, :string

    field :ready_at, :utc_datetime_usec

    field :upstream_url, :string

    field :upstream_license, :string

    belongs_to :namespace, OpenAgents.Repositories.Namespace

    belongs_to :created_by_user, OpenAgents.Accounts.User

    |> check_constraint(:lifecycle_state, name: :repositories_lifecycle_state_check)

    |> check_constraint(:provisioning_kind, name: :repositories_provisioning_kind_check)

    |> check_constraint(:ready_at, name: :repositories_ready_state_check)

    |> check_constraint(:upstream_url, name: :repositories_upstream_mirror_check)

  end

  def creation_changeset(repository, attrs, namespace, created_by_user_id, provisioning_kind) do

    |> put_change(:created_by_user_id, created_by_user_id)

  end

  @doc """

  Build an upstream mirror: a repository whose content comes from a public

  source this forge does not own.

  The upstream fields are deliberately absent from `changeset/2`'s `cast`

  list and are written only here, through `put_change/3`. Caller-supplied

  attributes therefore cannot make a repository claim an upstream, and the

  ordinary import path cannot produce a mirror however its attributes are

  shaped. A mirror exists only because a caller asked this function for one.

  `license` is the upstream's SPDX identifier, or the literal `"none"` when

  the upstream publishes no license. `nil` is not accepted: the database

  constraint pairs the two columns, and a mirror that says nothing about its

  license is exactly the state this refuses to represent.

  """

  def mirror_creation_changeset(

        repository,

        attrs,

        namespace,

        created_by_user_id,

        upstream_url,

        license

      )

      when is_binary(upstream_url) and is_binary(license) do

    repository

    |> creation_changeset(attrs, namespace, created_by_user_id, "github_import")

    |> put_change(:upstream_url, upstream_url)

    |> put_change(:upstream_license, license)

    |> validate_length(:upstream_url, min: 12, max: 500)

    |> validate_format(:upstream_url, ~r{\Ahttps://[a-z0-9.-]+/[^\s]+\z})

    |> validate_length(:upstream_license, min: 1, max: 60)

  end

  @doc "Whether this repository is an upstream mirror rather than an owned repository."

  def mirror?(%__MODULE__{upstream_url: url}), do: is_binary(url)

  defp normalize_creation_name(attrs) do

    case Map.get(attrs, :name, Map.get(attrs, "name")) do

      name when is_binary(name) ->

defmodule OpenAgentsWeb.RepositoryImportController do

  @moduledoc "Accepts and reports one-time GitHub repository imports."

  @moduledoc """

  Accepts and reports one-time GitHub repository copies.

  Two kinds arrive here and they are not the same claim. An **import** copies a

  repository this account owns and becomes this account's own repository. An

  **upstream mirror** (`"mirror": true`) copies a public repository this

  account does not own, names the upstream, carries its license, and refuses

  every push.

  Which one you get is never inferred. A foreign source owner without

  `"mirror": true` is still refused, and the refusal names the source owner

  and the field that would admit it, because becoming a mirror is a decision

  the caller makes rather than one this controller makes for them.

  """

  use OpenAgentsWeb, :controller

  def create_user(conn, params) do

    with {:ok, idempotency_key} <- idempotency_key(conn),

         {:ok, full_name} <- source_repository(params),

         {:ok, mirror?} <- mirror_requested(params),

         {:ok, source, github_repository} <-

           GitHubProjection.import_source(conn.assigns.current_user, full_name),

         {:ok, attrs} <- import_attrs(params, github_repository),

         {:ok, repository, repository_import, replay_state} <-

           Repositories.create_user_import(

           create_user_copy(

             mirror?,

             conn.assigns.current_user,

             source,

             attrs,

           ) do

      render_import(conn, repository, repository_import, replay_state)

    else

      {:error, reason} -> render_error(conn, reason)

      {:error, reason} -> render_error(conn, reason, params)

    end

  end

  defp create_user_copy(true, user, source, attrs, idempotency_key),

    do: Repositories.create_user_mirror(user, source, attrs, idempotency_key)

  defp create_user_copy(false, user, source, attrs, idempotency_key),

    do: Repositories.create_user_import(user, source, attrs, idempotency_key)

  defp create_organization_copy(true, user, namespace, source, attrs, idempotency_key),

    do: Repositories.create_organization_mirror(user, namespace, source, attrs, idempotency_key)

  defp create_organization_copy(false, user, namespace, source, attrs, idempotency_key),

    do: Repositories.create_organization_import(user, namespace, source, attrs, idempotency_key)

  defp mirror_requested(%{"mirror" => mirror}) when is_boolean(mirror), do: {:ok, mirror}

  defp mirror_requested(%{"mirror" => _invalid}), do: {:error, :invalid_import}

  defp mirror_requested(_params), do: {:ok, false}

  def create_organization(conn, %{"org" => org} = params) do

    with {:ok, idempotency_key} <- idempotency_key(conn),

         {:ok, namespace} <-

           GitHubProjection.authorized_organization(conn.assigns.current_user, org),

         {:ok, full_name} <- source_repository(params),

         {:ok, mirror?} <- mirror_requested(params),

         {:ok, source, github_repository} <-

           GitHubProjection.import_source(conn.assigns.current_user, full_name),

         {:ok, attrs} <- import_attrs(params, github_repository),

         {:ok, repository, repository_import, replay_state} <-

           Repositories.create_organization_import(

           create_organization_copy(

             mirror?,

             conn.assigns.current_user,

             namespace,

             source,

           ) do

      render_import(conn, repository, repository_import, replay_state)

    else

      {:error, reason} -> render_error(conn, reason)

      {:error, reason} -> render_error(conn, reason, params)

    end

  end

      "import" => RepositoryImportJSON.import(repository_import)

    })

  rescue

    Ecto.NoResultsError -> render_error(conn, :not_found)

    Ecto.NoResultsError -> render_error(conn, :not_found, %{})

  end

  defp render_import(conn, repository, repository_import, replay_state) do

    end

  end

  defp render_error(conn, :not_found),

    do: error(conn, :not_found, "not_found", "Repository import not found")

  # The refusal used to say "Source namespace is not eligible", which names

  # nothing: the caller cannot tell whether the destination namespace or the

  # source owner failed, and the destination is usually their own account. The

  # source owner is what failed, so the source owner is what the message says,

  # along with the one field that admits a public repository owned by someone

  # else.

  defp render_error(conn, :source_namespace_mismatch, params) do

    error(

      conn,

      :forbidden,

      "source_namespace_mismatch",

      "The source repository #{source_name(params)} is owned by another GitHub account, " <>

        "so it cannot be imported as your own repository. " <>

        "If it is public, send \"mirror\": true to bring it in as an upstream mirror, " <>

        "which names the upstream, carries its license, and accepts no pushes.",

      %{"source" => source_name(params), "destination" => "eligible"}

    )

  end

  defp render_error(conn, :source_repository_not_public, params),

    do:

      error(

        conn,

        :forbidden,

        "source_repository_not_public",

        "The source repository #{source_name(params)} is not public, " <>

          "so it cannot be brought in as an upstream mirror.",

        %{"source" => source_name(params)}

      )

  defp render_error(conn, :source_namespace_mismatch),

    do: error(conn, :forbidden, "source_namespace_mismatch", "Source namespace is not eligible")

  defp render_error(conn, :not_found, _params),

    do: error(conn, :not_found, "not_found", "Repository import not found")

  defp render_error(conn, :namespace_not_allowed),

  defp render_error(conn, :namespace_not_allowed, _params),

    do: error(conn, :forbidden, "namespace_not_allowed", "Namespace is not eligible")

  defp render_error(conn, :github_connection_required),

  defp render_error(conn, :github_connection_required, _params),

    do: error(conn, :forbidden, "github_connection_required", "Connect GitHub before importing")

  defp render_error(conn, :github_scope_required),

  defp render_error(conn, :github_scope_required, _params),

    do: error(conn, :forbidden, "github_scope_required", "Reconnect GitHub with required access")

  defp render_error(conn, :source_repository_not_accessible),

  defp render_error(conn, :source_repository_not_accessible, _params),

    do: error(conn, :forbidden, "source_repository_not_accessible", "Source is not accessible")

  defp render_error(conn, :idempotency_conflict),

  defp render_error(conn, :idempotency_conflict, _params),

    do: error(conn, :conflict, "idempotency_conflict", "The idempotency key is already in use")

  defp render_error(conn, :repository_quota_exceeded),

  defp render_error(conn, :repository_quota_exceeded, _params),

    do:

      error(

        conn,

        "The namespace repository quota is exhausted"

      )

  defp render_error(conn, :invalid_idempotency_key),

  defp render_error(conn, :invalid_idempotency_key, _params),

    do: error(conn, :bad_request, "invalid_idempotency_key", "Provide one Idempotency-Key header")

  defp render_error(conn, %Ecto.Changeset{}),

  defp render_error(conn, %Ecto.Changeset{}, _params),

    do: error(conn, :unprocessable_entity, "invalid_import", "Repository import is invalid")

  defp render_error(conn, reason)

  defp render_error(conn, reason, _params)

       when reason in [

              :github_unavailable,

              :github_request_failed,

            ],

       do: error(conn, :service_unavailable, "github_unavailable", "GitHub is unavailable")

  defp render_error(conn, _reason),

  defp render_error(conn, _reason, _params),

    do: error(conn, :unprocessable_entity, "invalid_import", "Repository import is invalid")

  defp error(conn, status, code, message) do

    conn

    |> put_status(status)

    |> put_resp_header("cache-control", "no-store")

    |> json(%{

  defp source_name(%{"source" => %{"repository" => full_name}}) when is_binary(full_name),

    do: bounded_source_name(full_name)

  defp source_name(_params), do: "requested by this call"

  defp bounded_source_name(full_name) do

    full_name

    |> String.replace(~r/[^A-Za-z0-9._\/-]/, "")

    |> String.slice(0, 140)

  end

  defp error(conn, status, code, message, failed \\ nil) do

    body = %{

      "code" => code,

      "message" => message,

      "request_id" => List.first(get_resp_header(conn, "x-request-id"))

    })

    }

    conn

    |> put_status(status)

    |> put_resp_header("cache-control", "no-store")

    |> json(if failed, do: Map.put(body, "failed", failed), else: body)

  end

  defp base_url(conn) do

      "clone_url" => base_url <> "/#{owner}/#{repository.name}.git",

      "html_url" => base_url <> "/#{owner}/#{repository.name}",

      "permissions" => permissions,

      "mirror" => Repository.mirror?(repository),

      "upstream" => upstream(repository),

      "created_at" => DateTime.to_iso8601(repository.inserted_at),

      "updated_at" => DateTime.to_iso8601(repository.updated_at)

    }

  end

  # A mirror names its upstream in the response body, not only in the

  # database. `"mirror" => false` and `"upstream" => nil` are published for

  # every owned repository too, so a reader learns the distinction exists

  # from any repository rather than only from a mirror.

  #

  # `"license"` here is what the upstream published at the moment the copy was

  # taken, or the literal `"none"`. It is a record of the upstream's terms,

  # never a claim about the copy.

  defp upstream(%Repository{upstream_url: nil}), do: nil

  defp upstream(%Repository{} = repository) do

    %{

      "url" => repository.upstream_url,

      "license" => repository.upstream_license,

      "direction" => "one_way",

      "accepts_pushes" => false

    }

  end

  # `"push"` is a claim about what the Git plane will accept, so a mirror

  # reports `false` for every role. An owner who reads `true` here and then

  # has the push refused has been told two different things by one system.

  def permissions(repository, role) do

    %{

      "admin" => role in ~w(owner maintainer),

      "push" => role in ~w(owner maintainer contributor),

      "push" => role in ~w(owner maintainer contributor) and not Repository.mirror?(repository),

      "pull" => repository.visibility == "public" or not is_nil(role)

    }

  end

     |> assign(:page_title, "#{repository.name} · code")

     |> assign(:repository, repository)

     |> assign(:repository_import, repository.repository_import)

     |> assign(:mirror?, Repositories.mirror?(repository))

     |> assign(:repo, repository.name)

     |> assign(:owner, repository.namespace.slug)

     |> assign(:base, base)

    end

  end

  # "none" is the recorded absence of a license, not a missing value, and it

  # is rendered as a sentence rather than as the bare token the database holds.

  defp upstream_license_label(%{upstream_license: "none"}), do: "No license found upstream"

  defp upstream_license_label(%{upstream_license: license}), do: license

  defp short(sha), do: String.slice(sha, 0, 12)

  # The tab carries a count only when there is something to count, the way the

          </.card>

          <:about>

            <.repo_about description={@repository.description}>

            <.repo_about

              description={@repository.description}

              license={if @mirror?, do: upstream_license_label(@repository)}

            >

              <%!-- The file that is actually there, under the name it actually

              has. A fixed `README.md` is a guess, and a repository whose readme

              is named anything else gets a rail link to a 404. --%>

            <%!-- REPOSITORY-001: an import freezes one authorized ref map and

            schedules no later synchronization. Keep that provenance beside

            the repository metadata instead of interrupting the code tree. --%>

            <%!-- REPOSITORY-001: a mirror is not an owned repository, and the

            page says so where a reader is looking at the repository rather

            than only in the API. The upstream is named, its license travels

            or its absence is stated, and the one-way rule is written down

            beside the clone URL that would otherwise imply a push. --%>

            <section

              :if={@mirror?}

              id="repo-upstream-mirror"

              class="repo-import-provenance"

              aria-labelledby="repo-upstream-mirror-title"

            >

              <h2 id="repo-upstream-mirror-title">Upstream mirror</h2>

              <dl>

                <div>

                  <dt>Upstream</dt>

                  <dd>

                    <.link href={@repository.upstream_url} rel="noopener nofollow">

                      {@repository.upstream_url}

                    </.link>

                  </dd>

                </div>

                <div>

                  <dt>Upstream license</dt>

                  <dd>{upstream_license_label(@repository)}</dd>

                </div>

                <div :if={@repository_import && @repository_import.source_head_sha}>

                  <dt>Snapshot</dt>

                  <dd><code>{short(@repository_import.source_head_sha)}</code></dd>

                </div>

                <div :if={@repository_import}>

                  <dt>State</dt>

                  <dd>{@repository_import.state}</dd>

                </div>

              </dl>

              <p>

                OpenAgents does not own this repository. It is a one-way copy of the

                upstream above, taken once, and it accepts no pushes. Contribute

                to the upstream instead.

              </p>

            </section>

            <section

              :if={@repository_import}

              :if={@repository_import && not @mirror?}

              id="repo-import-provenance"

              class="repo-import-provenance"

              aria-labelledby="repo-import-provenance-title"

          <span class="font-normal text-muted-foreground">{@repository.namespace.slug}/</span>{@repository.name}

        </.link>

        <.badge variant={:dim}>{@repository.visibility}</.badge>

        <%!-- A mirror in a list of owned repositories is the easiest place to

        misread one for the other, so the row says which it is. --%>

        <.badge :if={@repository.upstream_url} id={"#{@id}-mirror"} variant={:dim}>

          upstream mirror

        </.badge>

        <.badge :if={@repository.lifecycle_state != "ready"} variant={state_variant(@repository)}>

          {@repository.lifecycle_state}

        </.badge>

        <span :if={@source} aria-hidden="true">·</span>

        <%!-- REPOSITORY-001: the snapshot was copied once and is never

        resynchronized, so the row says so rather than implying a mirror. --%>

        <span :if={@source} id={"#{@id}-provenance"} data-source={@source}>

        <span

          :if={@source && @repository.upstream_url}

          id={"#{@id}-provenance"}

          data-source={@source}

        >

          One-way mirror of <code class="text-foreground">{@repository.upstream_url}</code>,

          licensed {@repository.upstream_license}

        </span>

        <span

          :if={@source && is_nil(@repository.upstream_url)}

          id={"#{@id}-provenance"}

          data-source={@source}

        >

          Imported once from GitHub, from <code class="text-foreground">{@source}</code>

        </span>

      </div>

    20260824032226,

    20260824035934,

    20260824040140,

    20260824042729

    20260824042729,

    20260824043735

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AddUpstreamMirrorToRepositories do

  use Ecto.Migration

  # An upstream mirror is a repository whose content comes from a public

  # source this forge does not own. `upstream_url` names that source and is

  # the whole distinction: NULL is an owned repository, non-NULL is a mirror.

  #

  # `upstream_license` travels with it, and the check constraint is why a

  # mirror can never be silent about its license: the two columns are NULL

  # together or set together, so recording an upstream without recording what

  # it is licensed under is not a representable state. An upstream that

  # publishes no license records the literal "none", which is a statement

  # rather than an omission.

  def change do

    alter table(:repositories) do

      add :upstream_url, :string

      add :upstream_license, :string

    end

    create constraint(:repositories, :repositories_upstream_mirror_check,

             check: "(upstream_url IS NULL) = (upstream_license IS NULL)"

           )

    create index(:repositories, [:upstream_url], where: "upstream_url IS NOT NULL")

  end

end

    sh!(machine_clone, "git", ["push", "origin", "HEAD:main"])

  end

  test "an upstream mirror serves a complete clone and refuses every push", %{

    base: base,

    port: port,

    token: token,

    user: user

  } do

    source = Path.join(base, "walgit-source")

    File.mkdir_p!(source)

    sh!(source, "git", ["init", "--initial-branch=main"])

    sh!(source, "git", ["config", "user.email", "test@example.com"])

    sh!(source, "git", ["config", "user.name", "Upstream"])

    Enum.each(1..3, fn index ->

      File.write!(Path.join(source, "README.md"), "revision #{index}\n")

      sh!(source, "git", ["add", "README.md"])

      sh!(source, "git", ["commit", "-m", "Revision #{index}"])

    end)

    head = source |> sh!("git", ["rev-parse", "HEAD"]) |> String.trim()

    refs = %{"refs/heads/main" => head}

    {:ok, mirror, _import, :created} =

      Repositories.create_user_mirror(

        user,

        %{

          source_repository_id: 909,

          source_owner_id: 777_777,

          source_full_name: "tobi/walgit",

          source_default_branch: "main",

          source_ref_digest: ref_digest(source, refs),

          source_head_sha: head,

          source_refs: refs,

          source_uses_lfs: false,

          source_public: true,

          source_license: "MIT"

        },

        %{name: "walgit", visibility: "public", default_branch: "main"},

        "git-http-mirror-key"

      )

    :ok = OpenAgents.Repositories.Importer.import(mirror, source_url: source)

    mirror

    |> Ecto.Changeset.change(lifecycle_state: "ready", ready_at: DateTime.utc_now())

    |> Repo.update!()

    mirror_url = "http://x:#{token}@127.0.0.1:#{port}/git-http-owner/walgit.git"

    # A mirror is still a forge repository: EXIT-004 holds for it. The clone

    # walks to the root because the copy was taken whole, so no boundary can

    # abort the transfer.

    clone = Path.join(base, "walgit-clone")

    sh!(base, "git", ["clone", mirror_url, clone])

    assert String.trim(sh!(clone, "git", ["rev-list", "--count", "HEAD"])) == "3"

    # `sh!/3` flunks on a nonzero exit, so this asserts fsck succeeded; the

    # refutations catch the dangling and missing objects fsck reports while

    # still exiting zero.

    fsck = sh!(clone, "git", ["fsck", "--full"])

    refute fsck =~ "missing"

    refute fsck =~ "broken"

    sh!(clone, "git", ["config", "user.email", "test@example.com"])

    sh!(clone, "git", ["config", "user.name", "Forge Test"])

    File.write!(Path.join(clone, "local.txt"), "local\n")

    sh!(clone, "git", ["add", "local.txt"])

    sh!(clone, "git", ["commit", "-m", "Local commit"])

    {output, status} =

      System.cmd("git", ["-c", "credential.helper=", "push", "origin", "HEAD:main"],

        cd: clone,

        stderr_to_stdout: true

      )

    assert status != 0

    assert output =~ "403"

    # The git client stops at the ref advertisement, so a refusal that lived

    # only there would look complete while `POST /git-receive-pack` stayed

    # open. Both are asserted, against the same account whose token clones the

    # repository fine.

    advertisement =

      Req.get!(

        "http://127.0.0.1:#{port}/git-http-owner/walgit.git/info/refs?service=git-receive-pack",

        auth: {:basic, "x:#{token}"},

        retry: false

      )

    assert advertisement.status == 403

    assert advertisement.body =~ "upstream mirror of https://github.com/tobi/walgit"

    assert advertisement.body =~ "accepts no pushes"

    receive_pack =

      Req.post!(

        "http://127.0.0.1:#{port}/git-http-owner/walgit.git/git-receive-pack",

        auth: {:basic, "x:#{token}"},

        headers: [{"content-type", "application/x-git-receive-pack-request"}],

        body: "0000",

        retry: false

      )

    assert receive_pack.status == 403

    assert receive_pack.body =~ "upstream mirror of https://github.com/tobi/walgit"

    # Nothing moved: the mirror still holds exactly what the upstream had.

    assert Repos.refs(mirror.storage_key) == refs

  end

  defp ref_digest(source, refs) do

    refs

    |> Enum.sort_by(&elem(&1, 0))

    |> Enum.map_join("\n", fn {name, sha} ->

      object_type = source |> sh!("git", ["cat-file", "-t", sha]) |> String.trim()

      Enum.join([name, object_type, sha], "\0")

    end)

    |> then(&:crypto.hash(:sha256, &1))

    |> Base.encode16(case: :lower)

  end

  test "the legacy initial repository path remains available", %{

    base: base,

    port: port,

defmodule OpenAgents.Repositories.UpstreamMirrorTest do

  @moduledoc """

  An upstream mirror: a repository whose content comes from a public source

  this forge does not own.

  Four properties, and each is proved against the mechanism rather than

  against a message. The upstream is recorded; the license travels or its

  absence is recorded; the ordinary import path cannot produce a mirror

  however its attributes are shaped; and the copy carries whole history, so a

  clone of it walks to the root and passes `git fsck --full` (#179, EXIT-004).

  """

  use OpenAgents.DataCase, async: false

  import OpenAgents.AccountsFixtures

  alias Ecto.Adapters.SQL

  alias OpenAgents.Forge.{Repos, Sync, WAL}

  alias OpenAgents.Repositories

  alias OpenAgents.Repositories.{Importer, Repository}

  setup do

    root =

      Path.join(

        System.tmp_dir!(),

        "upstream-mirror-#{System.unique_integer([:positive, :monotonic])}"

      )

    previous_data = Application.get_env(:openagents, :forge_data_dir)

    previous_wal = Application.get_env(:openagents, :forge_wal_dir)

    previous_adapter = Application.get_env(:openagents, :forge_wal_adapter)

    Application.put_env(:openagents, :forge_data_dir, Path.join(root, "data"))

    Application.put_env(:openagents, :forge_wal_dir, Path.join(root, "wal"))

    Application.put_env(:openagents, :forge_wal_adapter, OpenAgents.Forge.WAL.Local)

    on_exit(fn ->

      restore_env(:forge_data_dir, previous_data)

      restore_env(:forge_wal_dir, previous_wal)

      restore_env(:forge_wal_adapter, previous_adapter)

      File.rm_rf!(root)

    end)

    %{root: root}

  end