repositories permit anonymous Git reads. Private reads and every write require

an admitted repository principal, and read-only members cannot push.

Amended 2026-08-21 (workspace-wide issue and project lists): who may read a

repository is one composable predicate, `OpenAgents.Repositories.readable_by/2`

— public and `ready`, or a membership in a reading role — and every surface

that lists or resolves a repository composes it rather than restating the

join. Reading across repositories obeys the same rule as reading one: the

workspace-wide lists at `/issues` and `/projects` join their tables to that

predicate, so no filter, search term, or page number they accept can surface a

row from a repository the reader could not open directly. The duplicate that

`list_visible_repositories/1` held had already lost the `ready` half and

disagreed with the paged read about the same repository; there is one copy now.

Evidence: `OpenAgents.Repositories`, `OpenAgents.Repositories.Provisioner`,

`OpenAgents.Repositories.Importer`, `OpenAgents.Forge.GitHTTP`,

`test/openagents/repository_lifecycle_test.exs`,

`test/openagents/repositories/provisioner_test.exs`,

`test/openagents_web/controllers/repository_controller_test.exs`, and

`test/openagents_web/controllers/repository_controller_test.exs`,

`test/openagents/issues_workspace_test.exs`,

`test/openagents_web/live/issue_workspace_live_test.exs`,

`test/openagents_web/live/project_workspace_live_test.exs`, and

`test/openagents/forge/git_http_test.exs`.

### REPOSITORY-002 — Development pushes go to the forge, never to the mirror

| RELEASE-005 | `test/openagents/forge/relup_deployment_test.exs`, `test/openagents/forge/relup_node_test.exs`, `test/openagents/release/appup_test.exs`, `test/openagents/cluster/code_change_test.exs`, `test/openagents/forge/rolling_replacement_test.exs` |

| STATUS-001 | `test/openagents/network_status_test.exs`, `test/openagents_web/live/network_status_live_test.exs` |

| TRANSPARENCY-001 | `test/openagents/forge/visibility_test.exs`, `test/openagents/forge/browse_test.exs`, `test/openagents_web/live/code_live_test.exs` |

| REPOSITORY-001 | `test/openagents/repository_lifecycle_test.exs`, `test/openagents/repositories/provisioner_test.exs`, `test/openagents_web/controllers/repository_controller_test.exs`, `test/openagents/forge/git_http_test.exs` |

| REPOSITORY-001 | `test/openagents/repository_lifecycle_test.exs`, `test/openagents/repositories/provisioner_test.exs`, `test/openagents_web/controllers/repository_controller_test.exs`, `test/openagents/issues_workspace_test.exs`, `test/openagents_web/live/issue_workspace_live_test.exs`, `test/openagents_web/live/project_workspace_live_test.exs`, `test/openagents/forge/git_http_test.exs` |

| REPOSITORY-002 | `ops/ci/push-remote-check.sh`, `ops/dev/install-push-guard.sh`, `test/openagents/push_remote_contract_test.exs` |

    text-overflow: ellipsis;

  }

  /* Only a cross-repository list draws this. There, which repository a row is

     in is as load-bearing as its number, so it takes a fixed width inside the

     scan column and forms a column of its own rather than sitting at the

     trailing edge, which drops. The full path is on the element's title, for

     the long name that clips. */

  .issue-row__repository {

    width: 6.5rem;

    overflow: hidden;

    color: var(--text-dim);

    font-size: 0.75rem;

    white-space: nowrap;

    text-overflow: ellipsis;

  }

  .issue-row__title {

    min-width: 0;

    flex: 1;

    .issue-row__chips {

      display: inline-flex;

    }

    .issue-row__repository {

      width: 10rem;

    }

  }

  .issue-card {

    # be a query each time. Defaults to false, so a user loaded by any other

    # path is treated as new rather than accidentally grandfathered.

    field :agent_surfaces?, :boolean, virtual: true, default: false

    field :sidebar_repository_path, :string, virtual: true

    has_one :storage_owner, OpenAgents.Conversations.Visitor

          public_leaderboard_opted_out: boolean(),

          browser_key_hash: binary() | nil,

          agent_surfaces?: boolean(),

          sidebar_repository_path: String.t() | nil,

          inserted_at: DateTime.t(),

          updated_at: DateTime.t()

        }

  def parse_page(_page), do: 1

  @doc """

  One page of the issues `user` can read, across every repository, with the

  unpaginated total.

  The workspace-wide counterpart to `list_issues_page/2`. Where that one is

  handed a repository the caller has already authorized, this one authorizes

  as it reads: the issue table is joined to `Repositories.readable_by/2`, the

  single predicate every repository surface composes, so an issue in a private

  repository the reader has no membership in cannot reach the query's result

  no matter what the options say.

  Supported options: `:state`, `:assignee`, `:author`, `:q`, and `:page`.

  Rows come back with their repository preloaded, because a cross-repository

  list has to say which repository each row belongs to.

  """

  def list_visible_issues_page(%User{} = user, opts \\ []) when is_list(opts) do

    page = max(parse_page(opts[:page]), 1)

    query = visible_issue_query(user, opts)

    total = Repo.aggregate(query, :count)

    issues =

      query

      |> order_by([issue], desc: issue.inserted_at, desc: issue.id)

      |> limit(@issues_per_page)

      |> offset(^((page - 1) * @issues_per_page))

      |> Repo.all()

      |> Repo.preload(repository: :namespace)

    {issues, total}

  end

  @doc "How many issues `user` can read across every repository, filtered."

  def count_visible_issues(%User{} = user, opts \\ []) when is_list(opts),

    do: user |> visible_issue_query(opts) |> Repo.aggregate(:count)

  # The readable-repository set arrives as a subquery rather than as extra

  # joins on this query, so the membership left join keeps its own bindings and

  # the filter chain below still sees the issue as binding zero.

  defp visible_issue_query(user, opts) do

    readable = from(repository in Repositories.readable_by(Repository, user), select: repository)

    from(issue in Issue,

      as: :issue,

      join: repository in subquery(readable),

      on: repository.id == issue.repository_id

    )

    |> apply_issue_filters(opts)

    |> maybe_filter_author(Keyword.get(opts, :author))

  end

  # Every list surface shares one filter chain so a page, a count, and an

  # unpaginated read can never disagree about what matches.

  defp issue_query(repository_id, opts) do

    from(issue in Issue, as: :issue)

    |> where([issue], issue.repository_id == ^repository_id)

    |> apply_issue_filters(opts)

  end

  defp apply_issue_filters(query, opts) do

    query

    |> maybe_filter_state(Keyword.get(opts, :state, "open"))

    |> maybe_filter_label(Keyword.get(opts, :label))

    |> maybe_filter_assignee(Keyword.get(opts, :assignee))

    )

  end

  # "Opened by me" has two honest answers. An issue filed here carries a

  # durable author link; an issue imported from GitHub carries only the login

  # in its user snapshot, because the account that opened it may not exist

  # here. Either one is the reader having opened it, so the filter takes both.

  defp maybe_filter_author(query, nil), do: query

  defp maybe_filter_author(query, %User{id: user_id, github_login: login}) do

    login_key = String.downcase(login)

    where(

      query,

      [issue],

      issue.author_user_id == ^user_id or

        fragment("lower(? ->> 'login')", issue.user) == ^login_key

    )

  end

  defp maybe_filter_milestone(query, nil), do: query

  defp maybe_filter_milestone(query, ""), do: query

    )

  end

  @projects_per_page 25

  @doc "How many projects one workspace-wide page shows."

  def per_page, do: @projects_per_page

  @doc """

  One page of the projects `user` can read, across every repository, with the

  unpaginated total.

  Authorization is the same predicate the repository surfaces compose,

  `Repositories.readable_by/2`, joined in as a subquery rather than restated

  here, so a project in a repository the reader has no membership in cannot

  appear.

  Supported options: `:state`, `:owner`, and `:page`. Rows come back with their

  repository preloaded, because a project's board lives at a repository path.

  """

  def list_visible_projects_page(%User{} = user, opts \\ []) when is_list(opts) do

    page = max(parse_page(opts[:page]), 1)

    query = visible_project_query(user, opts)

    total = Repo.aggregate(query, :count)

    projects =

      query

      |> order_by([project], desc: project.inserted_at, desc: project.id)

      |> limit(@projects_per_page)

      |> offset(^((page - 1) * @projects_per_page))

      |> Repo.all()

      |> Repo.preload(repository: :namespace)

    {projects, total}

  end

  @doc "How many projects `user` can read across every repository, filtered."

  def count_visible_projects(%User{} = user, opts \\ []) when is_list(opts),

    do: user |> visible_project_query(opts) |> Repo.aggregate(:count)

  @doc "Clamps a reader-supplied page number into the bounded range."

  def parse_page(page), do: OpenAgents.Issues.parse_page(page)

  defp visible_project_query(user, opts) do

    readable = from(repository in Repositories.readable_by(Repository, user), select: repository)

    from(project in Project,

      join: repository in subquery(readable),

      on: repository.id == project.repository_id

    )

    |> maybe_filter_project_state(Keyword.get(opts, :state, "open"))

    |> maybe_filter_project_owner(Keyword.get(opts, :owner))

  end

  defp maybe_filter_project_state(query, "all"), do: query

  defp maybe_filter_project_state(query, state), do: where(query, state: ^state)

  # As with issues, a project created here carries a durable owner link while

  # one that arrived with only a login carries the login.

  defp maybe_filter_project_owner(query, nil), do: query

  defp maybe_filter_project_owner(query, %User{id: user_id, github_login: login}) do

    login_key = String.downcase(login)

    where(

      query,

      [project],

      project.owner_user_id == ^user_id or fragment("lower(?)", project.owner) == ^login_key

    )

  end

  def get_project!(id), do: get_project!(Repositories.initial_repository!(), id)

  def get_project!(%Repository{id: repository_id}, id) do

    )

  end

  def get_visible_by_path!(owner, name, nil), do: get_public_by_path!(owner, name)

  def get_visible_by_path!(owner, name, %User{id: user_id}) do

  def get_visible_by_path!(owner, name, user) do

    owner_key = String.downcase(owner)

    name_key = String.downcase(name)

    Repo.one!(

      from repository in repository_path_query(owner_key, name_key),

        left_join: membership in Membership,

        on: membership.repository_id == repository.id and membership.user_id == ^user_id,

        where:

          (repository.visibility == "public" and repository.lifecycle_state == "ready") or

            (not is_nil(membership.user_id) and

               membership.role in ^~w(owner maintainer contributor viewer))

    )

    owner_key

    |> repository_path_query(name_key)

    |> readable_by(user)

    |> Repo.one!()

  end

  @doc """

  Narrows a repository query to the repositories `user` may read.

  One predicate, composed by every surface that lists or resolves a repository,

  so a new surface cannot arrive at a looser rule by rewriting the join from

  memory. Reading is public on a repository that is both public and

  provisioned; anything else needs a membership in a reading role. `nil` is an

  anonymous visitor, who sees only the public half.

  It composes into a query that already carries joins and preloads: the

  membership join is appended, so the caller's own bindings keep their

  positions.

  """

  def readable_by(query, user)

  def readable_by(query, nil) do

    from repository in query,

      where: repository.visibility == "public" and repository.lifecycle_state == "ready"

  end

  def readable_by(query, %User{id: user_id}) do

    from repository in query,

      left_join: reader in Membership,

      on: reader.repository_id == repository.id and reader.user_id == ^user_id,

      where:

        (repository.visibility == "public" and repository.lifecycle_state == "ready") or

          (not is_nil(reader.user_id) and reader.role in ^@all_roles)

  end

  def get_writable_by_path!(owner, name, %User{id: user_id}) do

    end

  end

  def list_visible_repositories(%User{id: user_id}) do

  def list_visible_repositories(%User{} = user) do

    Repo.all(

      from repository in Repository,

      from repository in readable_by(Repository, user),

        join: namespace in assoc(repository, :namespace),

        left_join: membership in Membership,

        on: membership.repository_id == repository.id and membership.user_id == ^user_id,

        where:

          repository.visibility == "public" or

            (not is_nil(membership.user_id) and

               membership.role in ^~w(owner maintainer contributor viewer)),

        order_by: [asc: namespace.slug_key, asc: repository.name_key, asc: repository.id],

        preload: [namespace: namespace]

    )

  end

  @doc "Returns the first repository path in the user's workspace, or `nil`."

  def sidebar_repository_path(%User{id: user_id}) do

    case Repo.one(

           from repository in Repository,

             join: namespace in assoc(repository, :namespace),

             join: membership in Membership,

             on:

               membership.repository_id == repository.id and membership.user_id == ^user_id and

                 membership.role in ^~w(owner maintainer contributor viewer),

             order_by: [asc: namespace.slug_key, asc: repository.name_key, asc: repository.id],

             limit: 1,

             select: {namespace.slug, repository.name}

         ) do

      {owner, name} -> "/#{owner}/#{name}"

      nil -> nil

    end

  end

  @doc """

  Whether `user` can read any repository at all.

  What a workspace-wide list asks to tell an empty page from an empty

  workspace: "no open issues" and "no repositories yet" want different words

  and different next steps, and only this distinguishes them.

  """

  def any_visible_repository?(user), do: Repo.exists?(readable_by(Repository, user))

  @doc "Delete a repository owned by `user`, including its durable and node-local Git data."

  def delete_owned_repository(owner, name, %User{} = user, options \\ [])

  end

  def list_visible_repositories_page(

        %User{id: user_id},

        %User{} = user,

        per_page,

        after_cursor,

        namespace_key \\ nil

      )

      when per_page in 1..100 do

    query =

      from repository in Repository,

      from repository in readable_by(Repository, user),

        join: namespace in assoc(repository, :namespace),

        left_join: membership in Membership,

        on: membership.repository_id == repository.id and membership.user_id == ^user_id,

        where:

          (repository.visibility == "public" and repository.lifecycle_state == "ready") or

            (not is_nil(membership.user_id) and

               membership.role in ^~w(owner maintainer contributor viewer)),

        as: :namespace,

        order_by: [asc: namespace.slug_key, asc: repository.name_key, asc: repository.id],

        preload: [namespace: namespace]

  than the whole page. Returns `nil` rather than raising, because a repository

  can stop being visible between the broadcast and the read.

  """

  def get_visible_repository(id, user)

  def get_visible_repository(id, nil) when is_binary(id) do

    visible_repository(

      from repository in Repository,

        join: namespace in assoc(repository, :namespace),

        where: repository.id == ^id,

        where: repository.visibility == "public" and repository.lifecycle_state == "ready",

        preload: [namespace: namespace]

    )

  end

  def get_visible_repository(id, %User{id: user_id}) when is_binary(id) do

  def get_visible_repository(id, user) when is_binary(id) do

    visible_repository(

      from repository in Repository,

      from repository in readable_by(Repository, user),

        join: namespace in assoc(repository, :namespace),

        left_join: membership in Membership,

        on: membership.repository_id == repository.id and membership.user_id == ^user_id,

        where: repository.id == ^id,

        where:

          (repository.visibility == "public" and repository.lifecycle_state == "ready") or

            (not is_nil(membership.user_id) and

               membership.role in ^~w(owner maintainer contributor viewer)),

        preload: [namespace: namespace]

    )

  end

  defp apply_namespace_filter(query, nil), do: query

  defp apply_namespace_filter(query, namespace_key) when is_binary(namespace_key) do

    from [repository, namespace, membership] in query,

      where: namespace.slug_key == ^namespace_key

    where(query, [namespace: namespace], namespace.slug_key == ^namespace_key)

  end

  def get_import_for_user!(id, %User{id: user_id}) do

  defp apply_repository_cursor(query, nil), do: query

  defp apply_repository_cursor(query, {owner_key, name_key, id}) do

    from [repository, namespace, _membership] in query,

      where:

        namespace.slug_key > ^owner_key or

          (namespace.slug_key == ^owner_key and repository.name_key > ^name_key) or

          (namespace.slug_key == ^owner_key and repository.name_key == ^name_key and

             repository.id > ^id)

    where(

      query,

      [repository, namespace: namespace],

      namespace.slug_key > ^owner_key or

        (namespace.slug_key == ^owner_key and repository.name_key > ^name_key) or

        (namespace.slug_key == ^owner_key and repository.name_key == ^name_key and

           repository.id > ^id)

    )

  end

  defp normalize_repository_attrs(attrs) do

  attr :status_label, :string, required: true

  attr :progress, :integer, default: nil

  attr :priority, :atom, values: @priorities, default: :none

  # Which repository the issue is in. A list drawn from one repository already

  # knows, and leaves this `nil`; a list drawn across several is unreadable

  # without it, so it joins the scan column rather than the trailing edge,

  # which drops by width.

  attr :repository, :string, default: nil, doc: "`owner/name`, for a cross-repository list"

  attr :labels, :list, default: [], doc: "`[%{name: String.t(), tone: atom()}]`"

  attr :project, :string, default: nil

  attr :due, :string, default: nil, doc: "already formatted; overdue is the caller's judgement"

    <div class={["issue-row", @class]} data-selected={@selected} {@rest}>

      <span class="issue-row__scan">

        <.issue_priority level={@priority} />

        <span :if={@repository} class="issue-row__repository" title={@repository}>

          {@repository}

        </span>

        <span class="issue-row__identifier">{@identifier}</span>

        {render_slot(@state)}

        <.issue_status

defmodule OpenAgentsWeb.Components.IssuePresentation do

  @moduledoc """

  How an `%OpenAgents.Issues.Issue{}` is drawn as a row, in one place.

  `OpenAgentsWeb.UI.Circle.issue_row/1` takes plain maps and atoms on purpose,

  so it can be rendered from a schema, an API payload, or a literal in a test.

  That leaves a translation layer — which state category a close reason maps

  to, which assignee of several the face shows, how an author with no account

  is named — and there is exactly one right answer to each. This module owns

  those answers so the repository list and the workspace-wide list cannot

  drift apart, and so a third list would inherit them rather than restate

  them.

  It renders the row and nothing else. Who may change an issue's state or its

  assignees is the caller's question: a caller with the authority passes

  controls through the `:state` and `:people` slots, and a caller without it

  passes none and gets the static glyphs.

  """

  use Phoenix.Component

  alias OpenAgents.Issues.Issue

  alias OpenAgentsWeb.UI.Circle

  attr :id, :string, required: true

  attr :issue, Issue, required: true

  attr :navigate, :any, required: true, doc: "where the title goes"

  attr :repository, :string,

    default: nil,

    doc: "`owner/name`; set it on a cross-repository list, leave it off within one"

  slot :state, doc: "a control that changes the issue's state, for a caller who may"

  slot :people, doc: "a control that changes the issue's assignees, for a caller who may"

  def issue_row(assigns) do

    ~H"""

    <Circle.issue_row

      id={@id}

      identifier={"##{@issue.number}"}

      repository={@repository}

      title={@issue.title}

      navigate={@navigate}

      status_category={category(@issue)}

      status_label={status_label(@issue)}

      labels={labels(@issue)}

      assignee={assignee(@issue)}

      created={"opened #{relative(@issue.inserted_at)} ago"}

      author={author(@issue)}

      comments={@issue.comments}

    >

      <:state :if={@state != []}>{render_slot(@state)}</:state>

      <:people :if={@people != []}>{render_slot(@people)}</:people>

    </Circle.issue_row>

    """

  end

  @doc """

  GitHub's two states, and nothing invented on top of them.

  `not_planned` is the one close reason with a distinct reading, so it takes

  the cancelled glyph; every other close is a completion.

  """

  def category(%{state: "closed", state_reason: "not_planned"}), do: :canceled

  def category(%{state: "closed"}), do: :completed

  def category(_issue), do: :unstarted

  @doc "The word beside the glyph, for assistive technology and for a label."

  def status_label(%{state: "closed", state_reason: "not_planned"}), do: "Closed as not planned"

  def status_label(%{state: "closed"}), do: "Closed"

  def status_label(_issue), do: "Open"

  @doc """

  The states a triaging member may choose between.

  `duplicate` is rendered when it arrives from the API but is not offered: the

  menu has nowhere to record which issue it duplicates, and a duplicate that

  does not say of what is worse than a plain close.

  """

  def state_options do

    [

      {"Open", "open", nil},

      {"Closed as completed", "closed", "completed"},

      {"Closed as not planned", "closed", "not_planned"}

    ]

  end

  @doc "The close reason a menu should show as selected, defaulted like GitHub."

  def close_reason(%{state: "closed", state_reason: reason}), do: reason || "completed"

  def close_reason(_issue), do: nil

  @doc "Whether `login` is among the issue's assignees."

  def assigned?(issue, login), do: Enum.any?(issue.assignees || [], &(&1["login"] == login))

  @doc """

  The issue's labels, as the row wants them.

  A label carries a colour on GitHub; the row takes a tone from our ladder

  rather than that hex, so the list stays in one palette.

  """

  def labels(%{labels: labels}) when is_list(labels) do

    Enum.map(labels, fn label ->

      %{name: label["name"] || label[:name] || "label", tone: :neutral}

    end)

  end

  def labels(_issue), do: []

  @doc """

  The assignee the row's face shows.

  GitHub issues carry many assignees; the row shows the first, which is the one

  GitHub itself treats as `assignee`.

  """

  def assignee(%{assignees: [first | _rest]}) when is_map(first) do

    %{

      name: first["login"] || first[:login],

      src: first["avatar_url"] || first[:avatar_url],

      presence: :none

    }

  end

  def assignee(_issue), do: nil

  @doc """

  Who opened the issue.

  GitHub prints this beside when. An issue whose author is gone still has a

  history, so it says so rather than showing a blank.

  """

  def author(%{user: %{} = user}), do: user["login"] || user[:login] || "anonymous"

  def author(_issue), do: "anonymous"

  @doc "How long ago, coarsely: minutes, then hours, then days."

  def relative(nil), do: nil

  def relative(at) do

    at = if is_struct(at, NaiveDateTime), do: DateTime.from_naive!(at, "Etc/UTC"), else: at

    case DateTime.diff(DateTime.utc_now(), at, :second) do

      s when s < 3_600 -> "#{max(div(s, 60), 1)}m"

      s when s < 86_400 -> "#{div(s, 3_600)}h"

      s -> "#{div(s, 86_400)}d"

    end

  end

  @doc "The `owner/name` a cross-repository row shows, from a preloaded issue."

  def repository_path(%{repository: %{owner: owner, name: name}}), do: "#{owner}/#{name}"

  def repository_path(_issue), do: nil

end

  slot :extra, doc: "rows contributed by the current page"

  defp sidebar(assigns) do

    assigns =

      assigns

      |> assign(:agent_surfaces?, agent_surfaces?(assigns[:current_scope]))

      |> assign(:repository_path, assigns.current_scope.sidebar_repository_path)

    assigns = assign(assigns, :agent_surfaces?, agent_surfaces?(assigns[:current_scope]))

    ~H"""

    <aside id="sidebar" class="sidebar" aria-hidden="true">

          icon="branch"

          patchable={false}

        />

        <%!-- Global, and unconditional. These rows used to address whichever

        repository the current page named, falling back to the first repository

        in the reader's workspace alphabetically, so the same row led somewhere

        different depending on where it was clicked from — and vanished

        entirely for an account with no membership. A row in the app's own

        navigation has to mean one thing everywhere, so it addresses everything

        the reader can see. The repository-scoped lists keep their place in the

        repository's own tabs, which is where a repository-scoped nav

        belongs. --%>

        <Layouts.sidebar_link path={~p"/issues"} label="Issues" icon="bug" patchable={false} />

        <Layouts.sidebar_link

          :if={@repository_path}

          path={@repository_path <> "/issues"}

          label="Issues"

          icon="bug"

          patchable={false}

        />

        <Layouts.sidebar_link

          :if={@repository_path}

          path={@repository_path <> "/projects"}

          path={~p"/projects"}

          label="Projects"

          icon="folder"

          patchable={false}

  alias OpenAgents.Labels

  alias OpenAgents.Milestones

  alias OpenAgents.Repositories

  alias OpenAgentsWeb.Components.IssuePresentation

  alias OpenAgentsWeb.OG

  alias OpenAgentsWeb.UI.Circle

      </.empty>

      <div :if={@issues_count > 0} id="issues" phx-update="stream" class="issue-list">

        <Circle.issue_row

        <IssuePresentation.issue_row

          :for={{id, issue} <- @streams.issues}

          id={id}

          identifier={"##{issue.number}"}

          title={issue.title}

          issue={issue}

          navigate={~p"/#{@owner}/#{@repo}/issues/#{issue.number}"}

          status_category={category(issue)}

          status_label={status_label(issue)}

          labels={labels(issue)}

          assignee={assignee(issue)}

          created={"opened #{relative(issue.inserted_at)} ago"}

          author={author(issue)}

          comments={issue.comments}

        >

          <:state :if={@can_write}>

            <Circle.field_menu

                <Circle.issue_state state={issue.state} reason={issue.state_reason} />

              </:trigger>

              <Circle.field_menu_item

                :for={{label, state, reason} <- state_options()}

                :for={{label, state, reason} <- IssuePresentation.state_options()}

                label={label}

                mode={:choice}

                selected={issue.state == state and close_reason(issue) == reason}

                selected={issue.state == state and IssuePresentation.close_reason(issue) == reason}

                closes={"row-state-#{issue.id}"}

                on_select={JS.push("set_state", value: %{id: issue.id, state: state, reason: reason})}

              >

            >

              <:trigger>

                <Circle.assignee

                  name={assignee(issue) && assignee(issue)[:name]}

                  src={assignee(issue) && assignee(issue)[:src]}

                  name={IssuePresentation.assignee(issue)[:name]}

                  src={IssuePresentation.assignee(issue)[:src]}

                />

              </:trigger>

              <Circle.field_menu_item

                :for={user <- @assignable}

                label={user.github_login}

                selected={assigned?(issue, user.github_login)}

                selected={IssuePresentation.assigned?(issue, user.github_login)}

                on_select={

                  JS.push("toggle_assignee", value: %{id: issue.id, login: user.github_login})

                }

              </Circle.field_menu_item>

            </Circle.field_menu>

          </:people>

        </Circle.issue_row>

        </IssuePresentation.issue_row>

      </div>

      <nav :if={@total_count > Issues.per_page()} class="issue-pagination" aria-label="Pages">

    </Layouts.app>

    """

  end

  # GitHub's two states, and nothing invented on top of them. `not_planned` is

  # the one close reason with a distinct reading, so it takes the cancelled

  # glyph; every other close is a completion.

  defp category(%{state: "closed", state_reason: "not_planned"}), do: :canceled

  defp category(%{state: "closed"}), do: :completed

  defp category(_issue), do: :unstarted

  defp status_label(%{state: "closed", state_reason: "not_planned"}), do: "Closed as not planned"

  defp status_label(%{state: "closed"}), do: "Closed"

  defp status_label(_issue), do: "Open"

  # `duplicate` is rendered when it arrives from the API but is not offered:

  # the menu has nowhere to record which issue it duplicates, and a duplicate

  # that does not say of what is worse than a plain close.

  defp state_options do

    [

      {"Open", "open", nil},

      {"Closed as completed", "closed", "completed"},

      {"Closed as not planned", "closed", "not_planned"}

    ]

  end

  defp close_reason(%{state: "closed", state_reason: reason}), do: reason || "completed"

  defp close_reason(_issue), do: nil

  defp assigned?(issue, login), do: Enum.any?(issue.assignees || [], &(&1["login"] == login))

  # A label carries a colour on GitHub; the row takes a tone from our ladder

  # rather than that hex, so the list stays in one palette.

  defp labels(%{labels: labels}) when is_list(labels) do

    Enum.map(labels, fn label ->

      %{name: label["name"] || label[:name] || "label", tone: :neutral}

    end)

  end

  defp labels(_issue), do: []

  # GitHub issues carry many assignees; the row shows the first, which is the

  # one GitHub itself treats as `assignee`.

  defp assignee(%{assignees: [first | _rest]}) when is_map(first) do

    %{

      name: first["login"] || first[:login],

      src: first["avatar_url"] || first[:avatar_url],

      presence: :none

    }

  end

  defp assignee(_issue), do: nil

  # GitHub prints who opened an issue beside when. An issue whose author is

  # gone still has a history, so it says so rather than showing a blank.

  defp author(%{user: %{} = user}), do: user["login"] || user[:login] || "anonymous"

  defp author(_issue), do: "anonymous"

  defp relative(nil), do: nil

  defp relative(at) do

    at = if is_struct(at, NaiveDateTime), do: DateTime.from_naive!(at, "Etc/UTC"), else: at

    case DateTime.diff(DateTime.utc_now(), at, :second) do

      s when s < 3_600 -> "#{max(div(s, 60), 1)}m"

      s when s < 86_400 -> "#{div(s, 3_600)}h"

      s -> "#{div(s, 86_400)}d"

    end

  end

end

defmodule OpenAgentsWeb.IssueWorkspaceLive do

  @moduledoc """

  Every issue you can read, across every repository.

  The sidebar's **Issues** row points here. It used to point at a repository —

  whichever one the page you were on named, or, on a page that named none, the

  first repository in your workspace alphabetically — so the same row led

  somewhere different depending on where you clicked it from, and disappeared

  for an account with no membership. A row in the app's own navigation has to

  mean one thing everywhere. `/:owner/:repo/issues` still exists and is

  unchanged; it is reached from the repository's own tabs, which is where a

  repository-scoped list belongs.

  ## What it opens on

  Open issues in every repository you can read, newest first.

  GitHub's global issue list opens on **assigned to you**, and that is the

  right default there because on GitHub an assignee is how work is handed

  over. It is the wrong default here. Issues on this forge arrive mostly by

  import and through the API, and most of them carry no assignee at all, so

  opening on "assigned to you" would show almost every account an empty page

  and hide the thing they came to see. A default that hides the answer is

  worse than one that shows more than you asked for. Assigned and opened-by

  are one control away, and both are honest once the data supports them.

  ## Authorization

  Every read goes through `OpenAgents.Issues.list_visible_issues_page/2`,

  which joins the issue table to `OpenAgents.Repositories.readable_by/2` — the

  one predicate every repository surface composes. There is no second rule

  here to fall out of step with the first, and no filter this view offers can

  widen the set: filters narrow an already-authorized query.

  This view is read-only. Changing an issue's state or its assignees needs a

  writable membership in that issue's repository, which is a different

  question for every row on the page, so triage stays on the repository's own

  list where the answer is settled once.

  ## Bound

  One page is `OpenAgents.Issues.per_page/0` rows — 25 — and the page number

  is clamped to 10,000 by `OpenAgents.Issues.parse_page/1`, so the deepest

  reachable offset is fixed no matter what the query string says. Nothing here

  loads an unbounded list.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Issues

  alias OpenAgents.Repositories

  alias OpenAgentsWeb.Components.IssuePresentation

  alias OpenAgentsWeb.UI.Circle

  @involvements [

    {"Everyone", "all"},

    {"Assigned to you", "assigned"},

    {"Opened by you", "created"}

  ]

  def mount(_params, _session, socket) do

    {:ok,

     socket

     |> assign(:current_scope, socket.assigns[:current_scope])

     |> assign(:involvements, @involvements)

     |> assign(

       :any_repository?,

       Repositories.any_visible_repository?(socket.assigns.current_user)

     )}

  end

  def handle_params(params, _url, socket) do

    filters = read_filters(params)

    {:noreply,

     socket

     |> assign(:state, normalize_state(params["state"]))

     |> assign(:page, Issues.parse_page(params["page"]))

     |> assign(:filters, filters)

     |> assign(:filter_form, to_form(filters, as: :filter))

     |> load()}

  end

  # One form drives every filter, so one change event carries the complete

  # desired set and patching replaces it wholesale.

  def handle_event("filter", params, socket) do

    filters = %{

      "involvement" => normalize_involvement(params["involvement"]),

      "q" => blank_to_nil(params["q"])

    }

    {:noreply, push_patch(socket, to: issues_path(filters, %{"state" => socket.assigns.state}))}

  end

  def handle_event(_unsupported_event, _params, socket) do

    {:noreply, put_flash(socket, :error, "That action is not available here.")}

  end

  defp read_filters(params) do

    %{

      "involvement" => normalize_involvement(params["involvement"]),

      "q" => blank_to_nil(params["q"])

    }

  end

  # A hand-edited query string cannot smuggle an option into the context call:

  # anything unrecognized becomes the default.

  defp normalize_involvement(involvement) when involvement in ~w(assigned created),

    do: involvement

  defp normalize_involvement(_involvement), do: "all"

  defp normalize_state("closed"), do: "closed"

  defp normalize_state("all"), do: "all"

  defp normalize_state(_state), do: "open"

  defp blank_to_nil(""), do: nil

  defp blank_to_nil(value), do: value

  defp issues_path(filters, extra) do

    query =

      filters

      |> Map.merge(extra)

      |> Enum.reject(fn {_key, value} -> value in [nil, "", "all"] end)

      |> Map.new()

    ~p"/issues?#{query}"

  end

  defp load(socket) do

    user = socket.assigns.current_user

    %{filters: filters, state: state, page: page} = socket.assigns

    opts = involvement_opts(user, filters["involvement"]) ++ [q: filters["q"]]

    count_opts = Keyword.put(opts, :page, 1)

    {issues, total} =

      Issues.list_visible_issues_page(user, opts ++ [state: state, page: page])

    socket

    |> assign(:open_count, Issues.count_visible_issues(user, count_opts ++ [state: "open"]))

    |> assign(:closed_count, Issues.count_visible_issues(user, count_opts ++ [state: "closed"]))

    |> assign(:total_count, total)

    |> assign(:issues_count, length(issues))

    |> stream(:issues, issues, reset: true)

  end

  # The view's involvement words become the context's own options. "Assigned"

  # reads the assignee snapshot by login; "opened by" matches either the

  # durable author link or an imported login.

  defp involvement_opts(user, "assigned"), do: [assignee: user.github_login]

  defp involvement_opts(user, "created"), do: [author: user]

  defp involvement_opts(_user, _all), do: []

  def render(assigns) do

    ~H"""

    <Layouts.app

      flash={@flash}

      sidebar_sections={assigns[:sidebar_sections]}

      current_scope={@current_scope}

      title="Issues"

      subtitle="Across every repository you can read"

      wide

    >

      <Circle.issue_toolbar>

        <:leading>

          <Circle.view_tabs>

            <:tab

              label={"#{@open_count} Open"}

              patch={issues_path(@filters, %{"state" => "open"})}

              selected={@state == "open"}

            />

            <:tab

              label={"#{@closed_count} Closed"}

              patch={issues_path(@filters, %{"state" => "closed"})}

              selected={@state == "closed"}

            />

          </Circle.view_tabs>

        </:leading>

        <:actions>

          <.link navigate={~p"/repositories"} class="btn" data-variant="ghost" data-size="sm">

            <.icon name="branch" /> Repositories

          </.link>

        </:actions>

      </Circle.issue_toolbar>

      <div class="issue-filters">