end

  end

  @doc "One active namespace by slug or alias, or `nil` when no such namespace exists."

  def get_namespace_by_slug(slug) when is_binary(slug) do

    get_namespace_by_slug!(slug)

  rescue

    Ecto.NoResultsError -> nil

  end

  @doc """

  Creates a repository in an already-resolved namespace of either kind.

  `create_user_repository/3` and `create_organization_repository/4` each name

  one kind because the GitHub-compatible route they serve names one kind. This

  one takes whichever namespace resolving an owner produced, so the caller does

  not have to know the kind before it asks.

  A user namespace that belongs to somebody else is refused here as well as at

  resolution. The check costs one comparison and closes the gap between the

  two callers this function will eventually have.

  """

  def create_namespace_repository(

        %User{} = user,

        %Namespace{} = namespace,

        attrs,

        idempotency_key

      )

      when is_map(attrs) and is_binary(idempotency_key) do

    if namespace.kind == "user" and namespace.owner_user_id != user.id do

      {:error, :namespace_not_allowed}

    else

      create_repository_transaction(

        user,

        namespace,

        attrs,

        nil,

        "create",

        "empty",

        idempotency_key

      )

    end

  end

  def create_user_repository(%User{} = user, attrs, idempotency_key)

      when is_map(attrs) and is_binary(idempotency_key) do

    with {:ok, namespace} <- ensure_user_namespace(user) do

  alias OpenAgents.{Accounts, GitHub, GitHubOAuth, Repositories}

  alias OpenAgents.Accounts.User

  alias OpenAgents.Repositories.Namespace

  @maximum_organization_pages 10

    end

  end

  @doc """

  Resolves one named owner to a namespace the caller may create repositories in.

  An owner is either a personal namespace or an organization, and the name

  alone does not say which. Deciding here is what lets a client pass along the

  owner it was given instead of guessing at the kind and picking a route on

  the guess.

  The caller's own login resolves without asking GitHub: the token already

  authenticates that identity, so a personal repository does not depend on a

  retained GitHub token the way an organization repository does. Another

  person's namespace is refused outright rather than asked about, because

  GitHub cannot answer "is this login an organization you administer" for a

  login that is a person.

  """

  def authorized_namespace(%User{} = user, requested_slug) when is_binary(requested_slug) do

    if own_login?(user, requested_slug) do

      Repositories.ensure_user_namespace(user)

    else

      user_id = user.id

      case Repositories.get_namespace_by_slug(requested_slug) do

        %Namespace{kind: "user", owner_user_id: ^user_id} = namespace ->

          {:ok, namespace}

        %Namespace{kind: "user"} ->

          {:error, :namespace_not_allowed}

        _absent_or_organization ->

          authorized_organization(user, requested_slug)

      end

    end

  end

  defp own_login?(%User{github_login: login}, requested_slug) when is_binary(login),

    do: String.downcase(login) == String.downcase(requested_slug)

  defp own_login?(_user, _requested_slug), do: false

  def authorized_organization(%User{} = user, requested_slug) when is_binary(requested_slug) do

    with {:ok, token} <- retained_token(user),

         {:ok, membership} <- find_organization_membership(token, requested_slug, 1),

        {:required_bearer, :milestone, :envelope},

      "patch /api/v1/repos/:owner/:repo/projectsV2/:project_number/items/:item_id" =>

        {:required_bearer, :project, :envelope},

      "post /api/v1/repos" => {:required_bearer, :repository, :legacy},

      "post /api/v1/orgs/:org/repos" => {:required_bearer, :repository, :legacy},

      "post /api/v1/orgs/:org/repos/imports" => {:required_bearer, :repository, :legacy},

      "post /api/v1/repos/:owner/:repo/pulls" => {:required_bearer, :pull_request, :legacy},

  alias OpenAgents.Repositories.GitHubProjection

  alias OpenAgentsWeb.RepositoryJSON

  @doc """

  Creates a repository under a named owner of either kind.

  `POST /api/v1/user/repos` and `POST /api/v1/orgs/{org}/repos` make the caller

  choose a route by the kind of owner, and a caller handed `OWNER/NAME` knows

  only that an owner was named. Guessing the kind from the shape of the

  argument sends a personal namespace to the organization route. This route

  takes the owner as a parameter and resolves the kind here, so no client has

  to guess.

  `owner` defaults to the authenticated login. Everything else — the

  idempotency key, the attributes, the response — matches the two routes it

  stands in for.

  """

  def create(conn, params) do

    user = conn.assigns.current_user

    with {:ok, idempotency_key} <- idempotency_key(conn),

         {:ok, attrs} <- repository_attrs(params),

         {:ok, owner} <- requested_owner(params, user),

         {:ok, namespace} <- GitHubProjection.authorized_namespace(user, owner),

         {:ok, repository, replay_state} <-

           Repositories.create_namespace_repository(user, namespace, attrs, idempotency_key) do

      render_repository(conn, repository, user, replay_state)

    else

      {:error, reason} -> render_error(conn, reason)

    end

  end

  def create_user(conn, params) do

    with {:ok, idempotency_key} <- idempotency_key(conn),

         {:ok, attrs} <- repository_attrs(params),

    end

  end

  defp requested_owner(%{"owner" => owner}, _user) when is_binary(owner) do

    case namespace_key(owner) do

      {:ok, _key} -> {:ok, owner}

      {:error, _reason} -> {:error, :invalid_repository}

    end

  end

  defp requested_owner(%{"owner" => _owner}, _user), do: {:error, :invalid_repository}

  defp requested_owner(_params, %{github_login: login}) when is_binary(login),

    do: {:ok, login}

  defp requested_owner(_params, _user), do: {:error, :namespace_not_allowed}

  defp idempotency_key(conn) do

    case get_req_header(conn, "idempotency-key") do

      [key] when byte_size(key) in 1..200 ->

    get "/user", ForgeUserController, :show

    get "/user/repos", RepositoryController, :index

    post "/repos", RepositoryController, :create

    post "/user/repos", RepositoryController, :create_user

    post "/orgs/:org/repos", RepositoryController, :create_organization

    delete "/repos/:owner/:repo", RepositoryController, :delete

  "idempotency": {

    "header": "Idempotency-Key",

    "required_for": [

      "POST /api/v1/repos",

      "POST /api/v1/user/repos",

      "POST /api/v1/orgs/{org}/repos",

      "POST /api/v1/user/repos/imports",

  },

  "endpoints": {

    "get_authenticated_user": "GET /api/v1/user",

    "create_repository": "POST /api/v1/repos",

    "create_user_repository": "POST /api/v1/user/repos",

    "create_organization_repository": "POST /api/v1/orgs/{org}/repos",

    "import_user_repository": "POST /api/v1/user/repos/imports",

```text

GET    /api/v1/user

GET    /api/v1/user/repos

POST   /api/v1/repos

POST   /api/v1/user/repos

POST   /api/v1/orgs/:org/repos

GET    /api/v1/repos/:owner/:repo

GET    /api/v1/repository-imports/:id

```

`POST /api/v1/repos` takes an `owner` field and resolves it here, so a caller

that was handed `OWNER/NAME` does not have to decide whether `OWNER` is a

person or an organization before it picks a route. Omit `owner` and the

repository lands in your own namespace. `POST /api/v1/user/repos` and

`POST /api/v1/orgs/:org/repos` stay as the GitHub-compatible spellings.

Repository writes require an `Idempotency-Key` header. The published

[`openagents.repositories.v1` contract](/api/contracts/repositories-v1.json)

defines request authority, lifecycle states, pagination, and stable error

      assert Projects.get_project_by_number!(repository(), project.number)

    end

    test "a public repository's board refuses a non-member's PATCH and DELETE" do

      # A public repository is the case the private-repository tests cannot

      # reach: the outsider can see the board, so a 404 here has to come from

      # write authority rather than from visibility. Without that separation, a

      # delete route with no authorization check would still pass the private

      # tests.

      owner = github_user("project-public-owner", "publius")

      repository =

        repository_with_member_fixture(owner, %{

          owner: "PublicProjectOrg",

          name: "public-projects",

          visibility: "public"

        })

      {:ok, project} =

        Projects.create_project(repository, %{"title" => "Public roadmap"}, owner)

      {:ok, project} = Projects.update_project(project, %{"archived" => true}, owner)

      path = ~p"/api/v1/repos/PublicProjectOrg/public-projects/projectsV2/#{project.number}"

      list_path = ~p"/api/v1/repos/PublicProjectOrg/public-projects/projectsV2?archived=true"

      mallory = put_forge_api_token(build_conn(), "project-public-outsider", "mallory")

      # The outsider really can read the board. The refusal below is therefore

      # about writing, not about seeing.

      assert %{"projects" => before_write} =

               mallory |> get(list_path) |> json_response(200)

      assert Enum.map(before_write, & &1["number"]) == [project.number]

      assert json_response(get(mallory, path), 200)["title"] == "Public roadmap"

      assert mallory |> patch(path, %{title: "Mine now"}) |> api_error_code(404) == "not_found"

      assert mallory |> delete(path) |> api_error_code(404) == "not_found"

      assert %{"projects" => after_write} =

               mallory |> get(list_path) |> json_response(200)

      assert Enum.map(after_write, & &1["number"]) == [project.number]

      assert Projects.get_project_by_number!(repository, project.number).title == "Public roadmap"

    end

    test "an archived project stays out of the default list and returns on request", %{

      conn: conn

    } do

             |> json_response(422)

  end

  test "POST /api/v1/repos creates under a named personal owner", %{conn: conn} do

    user = github_user("repository-api-owner-route-self", "namedowner")

    response =

      conn

      |> authorize(user)

      |> put_req_header("idempotency-key", "owner-route-self")

      |> post(~p"/api/v1/repos", %{owner: "namedowner", name: "Named-Thing", private: true})

    assert %{"full_name" => "namedowner/named-thing", "owner" => owner} =

             json_response(response, 202)

    assert owner["login"] == "namedowner"

    assert Repositories.get_by_path!("namedowner", "named-thing")

  end

  test "POST /api/v1/repos matches a named personal owner without regard to case", %{conn: conn} do

    user = github_user("repository-api-owner-route-case", "MixedCaseOwner")

    assert %{"full_name" => "MixedCaseOwner/cased"} =

             conn

             |> authorize(user)

             |> put_req_header("idempotency-key", "owner-route-case")

             |> post(~p"/api/v1/repos", %{owner: "mixedcaseowner", name: "cased"})

             |> json_response(202)

    assert Repositories.get_by_path!("mixedcaseowner", "cased")

  end

  test "POST /api/v1/repos without an owner uses the caller's own namespace", %{conn: conn} do

    user = github_user("repository-api-owner-route-default", "defaultowner")

    assert %{"full_name" => "defaultowner/implied"} =

             conn

             |> authorize(user)

             |> put_req_header("idempotency-key", "owner-route-default")

             |> post(~p"/api/v1/repos", %{name: "implied"})

             |> json_response(202)

  end

  test "POST /api/v1/repos refuses another person's namespace", %{conn: conn} do

    caller = github_user("repository-api-owner-route-caller", "intruder")

    stranger = github_user("repository-api-owner-route-stranger", "bystander")

    # The stranger's namespace has to exist for the refusal to be about

    # authority rather than about an unknown name.

    assert {:ok, _namespace} = Repositories.ensure_user_namespace(stranger)

    assert %{"code" => "namespace_not_allowed"} =

             conn

             |> authorize(caller)

             |> put_req_header("idempotency-key", "owner-route-stranger")

             |> post(~p"/api/v1/repos", %{owner: "bystander", name: "not-yours"})

             |> json_response(403)

    assert_raise Ecto.NoResultsError, fn ->

      Repositories.get_by_path!("bystander", "not-yours")

    end

  end

  test "POST /api/v1/repos rejects an owner that is not a namespace name", %{conn: conn} do

    user = github_user("repository-api-owner-route-invalid", "shapeowner")

    assert %{"code" => "invalid_repository"} =

             conn

             |> authorize(user)

             |> put_req_header("idempotency-key", "owner-route-invalid")

             |> post(~p"/api/v1/repos", %{owner: "shape owner/nested", name: "wrong"})

             |> json_response(422)

  end

  test "POST /api/v1/repos requires a bearer token" do

    assert build_conn()

           |> put_req_header("idempotency-key", "owner-route-anonymous")

           |> post(~p"/api/v1/repos", %{owner: "anyone", name: "anything"})

           |> response(401)

  end

  test "DELETE /api/v1/repos/:owner/:repo removes an owned repository and its storage", %{

    conn: conn

  } do