feat(pull-requests): manage GitHub maintainer edits

apps/mobile/src/components/ui/AndroidScreenHeader.tsx

@@ -21,6 +21,7 @@ export interface AndroidHeaderAction {
   readonly disabled?: boolean;
   readonly loading?: boolean;
   readonly selected?: boolean;
+  readonly subtitle?: string;
   readonly destructive?: boolean;
   readonly overflowOnly?: boolean;
 }
@@ -178,10 +179,11 @@ export function AndroidScreenHeader(props: {
                   actions={overflowActions.map((action, index) => ({
                     id: String(index),
                     title: action.accessibilityLabel,
+                    subtitle: action.subtitle,
+                    state: action.selected ? "on" : undefined,
                     attributes: {
                       disabled: Boolean(action.disabled),
                       destructive: action.destructive,
-                      state: action.selected ? "on" : undefined,
                     },
                   }))}
                   onPressAction={({ nativeEvent }) =>

apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx

@@ -111,6 +111,7 @@ import {
   PullRequestReadStatus,
 } from "./PullRequestPresentation";
 import { usePullRequestFilesSection } from "./PullRequestFiles";
+import { usePullRequestMaintainerEdits } from "./usePullRequestMaintainerEdits";
 import { PullRequestDescription } from "./PullRequestDescription";
 import { PullRequestMediaVisibleContext } from "./PullRequestMedia";
 import { PullRequestMarkdownRepository } from "./PullRequestMarkdown";
@@ -416,6 +417,7 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
   const terminology = sourceControlClients.get(identity?.provider).changeRequest;
   const permissions = usePullRequestPermissions(params, pr);
   const action = usePullRequestAction(params, pr);
+  const maintainerEdits = usePullRequestMaintainerEdits(params, pr);
   const showsDeleteBranch = pr !== null && canPerformPullRequestAction(pr, "delete-branch");
   const confirmDeleteBranch = () =>
     pr &&
@@ -517,6 +519,19 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
                     },
                   ]
                 : []),
+              ...(maintainerEdits.visible
+                ? [
+                    {
+                      accessibilityLabel: "Allow edits from maintainers",
+                      icon: "pencil" as const,
+                      selected: maintainerEdits.value,
+                      disabled: maintainerEdits.saving,
+                      subtitle: maintainerEdits.subtitle,
+                      overflowOnly: true,
+                      onPress: maintainerEdits.toggle,
+                    },
+                  ]
+                : []),
               ...(identity
                 ? [
                     {
@@ -597,6 +612,17 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
                 <Toolbar.Label>Edit description</Toolbar.Label>
               </Toolbar.MenuAction>
             ) : null}
+            {maintainerEdits.visible ? (
+              <Toolbar.MenuAction
+                icon="pencil"
+                isOn={maintainerEdits.value}
+                disabled={maintainerEdits.saving}
+                subtitle={maintainerEdits.subtitle}
+                onPress={maintainerEdits.toggle}
+              >
+                <Toolbar.Label>Allow edits from maintainers</Toolbar.Label>
+              </Toolbar.MenuAction>
+            ) : null}
             {identity ? (
               <Toolbar.MenuAction
                 icon="arrow.up.right"

apps/mobile/src/features/pull-requests/usePullRequestMaintainerEdits.ts

@@ -0,0 +1,65 @@
+import { useAtomRefresh } from "@effect/atom-react";
+import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
+import type { PullRequestDetail } from "@t3tools/contracts";
+import { AsyncResult } from "effect/reactivity";
+import { useRef, useState } from "react";
+import * as Dialog from "../../components/ui/Dialog";
+import { composerPullRequests } from "../../state/pull-requests";
+import { useAtomCommand } from "../../state/use-atom-command";
+import { pullRequestTarget, type PullRequestParams } from "./usePullRequestDiff";
+import { usePullRequestPermissions } from "./usePullRequestPermissions";
+
+export function usePullRequestMaintainerEdits(
+  params: PullRequestParams,
+  pr: PullRequestDetail | null,
+) {
+  const target = pullRequestTarget(params);
+  const permissions = usePullRequestPermissions(params, pr);
+  const update = useAtomCommand(composerPullRequests.update, { reportFailure: false });
+  const refreshDetail = useAtomRefresh(composerPullRequests.detail(target));
+  const pending = useRef(false);
+  const [saving, setSaving] = useState(false);
+  const [choice, setChoice] = useState<{
+    readonly url: string;
+    readonly observed: boolean | undefined;
+    readonly value: boolean;
+  } | null>(null);
+  const observed = pr?.maintainerCanModify;
+  // A choice ends at the first host value that differs from the one it was made against, so a
+  // later change made elsewhere is never masked by it.
+  if (choice !== null && !saving && (choice.url !== pr?.url || choice.observed !== observed)) {
+    setChoice(null);
+  }
+  const value = choice !== null && choice.url === pr?.url ? choice.value : observed === true;
+  const save = async (next: boolean) => {
+    if (pending.current || pr === null || !permissions.canEditMaintainerEdits) return;
+    pending.current = true;
+    setSaving(true);
+    setChoice({ url: pr.url, observed, value: next });
+    const response = await update({
+      ...target,
+      input: { ...target.input, maintainerCanModify: next },
+    });
+    pending.current = false;
+    setSaving(false);
+    if (AsyncResult.isFailure(response)) {
+      setChoice(null);
+      const cause = squashAtomCommandFailure(response);
+      Dialog.alert(
+        "Could not save maintainer access",
+        cause instanceof Error ? cause.message : "Try again.",
+      );
+      return;
+    }
+    refreshDetail();
+  };
+  return {
+    visible: permissions.canEditMaintainerEdits,
+    value,
+    saving,
+    subtitle: saving
+      ? "Saving…"
+      : "Maintainers can push to this branch and may get access to fork workflow secrets.",
+    toggle: () => void save(!value),
+  };
+}

apps/mobile/src/features/pull-requests/usePullRequestPermissions.ts

@@ -2,6 +2,7 @@ import { useAtomValue } from "@effect/atom-react";
 import {
   canEditPullRequestChangeRequest,
   canEditPullRequestComment,
+  canEditPullRequestMaintainerEdits,
 } from "@t3tools/client-runtime/pull-request-editing";
 import type { PullRequestComment, PullRequestDetail } from "@t3tools/contracts";
 import { usePullRequestConnected } from "./usePullRequestConnected";
@@ -49,6 +50,8 @@ export function usePullRequestPermissions(params: PullRequestParams, pr: PullReq
     canWrite: connected && canWrite,
     canEditChangeRequest:
       connected && canUpdate && pr !== null && canEditPullRequestChangeRequest(pr),
+    canEditMaintainerEdits:
+      connected && canUpdate && pr !== null && canEditPullRequestMaintainerEdits(pr),
     canEditComment: (comment: Pick<PullRequestComment, "author" | "canEdit" | "kind">) =>
       connected && canUpdateComment && pr !== null && canEditPullRequestComment(pr, comment),
     canReact: connected && canSetReaction && pr?.capabilities.reactions === true,

apps/server/src/pullRequest/PullRequestService.test.ts

@@ -116,6 +116,65 @@ function hostedChangeRequest(body: string, additions = 1) {
   };
 }
 
+it.effect("reads maintainer edits and changes them through the update command", () =>
+  Effect.gen(function* () {
+    let enabled = true;
+    const provider = fakePullRequestProvider(SourceControlProviderKind.make("github"), {
+      getChangeRequest: () =>
+        Effect.succeed({ ...hostedChangeRequest("Body"), maintainerCanModify: enabled }),
+      updateChangeRequest: (input) =>
+        Effect.sync(() => {
+          assert.strictEqual(input.title, undefined);
+          assert.strictEqual(input.body, undefined);
+          enabled = input.maintainerCanModify!;
+        }),
+    });
+    const service = yield* makeService({
+      projects: [project({ id: "p1", title: "web", workspaceRoot: "/w", repository: "acme/web" })],
+      providers: [
+        {
+          ...provider,
+          capabilities: {
+            ...provider.capabilities,
+            edit: { changeRequest: true, comment: true, maintainerEdits: true },
+          },
+        },
+      ],
+    });
+    const ref = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
+    assert.strictEqual((yield* service.detail(ref)).maintainerCanModify, true);
+    yield* service.update({ ...ref, maintainerCanModify: false });
+    assert.strictEqual((yield* service.detail(ref)).maintainerCanModify, false);
+  }),
+);
+
+it.effect("refuses maintainer edits on a host without the capability", () =>
+  Effect.gen(function* () {
+    let writes = 0;
+    const service = yield* makeService({
+      projects: [project({ id: "p1", title: "web", workspaceRoot: "/w", repository: "acme/web" })],
+      providers: [
+        fakePullRequestProvider(SourceControlProviderKind.make("github"), {
+          updateChangeRequest: () =>
+            Effect.sync(() => {
+              writes += 1;
+            }),
+        }),
+      ],
+    });
+    const result = yield* service
+      .update({
+        projectId: "p1" as ProjectId,
+        repository: "acme/web",
+        number: 1,
+        maintainerCanModify: false,
+      })
+      .pipe(Effect.flip);
+    assert.strictEqual(result._tag, "PullRequestOperationError");
+    assert.strictEqual(writes, 0);
+  }),
+);
+
 it.effect("does not wait for an in-flight detail read to display a preview", () =>
   Effect.gen(function* () {
     const detailStarted = yield* Deferred.make<void>();

apps/server/src/pullRequest/PullRequestService.ts

@@ -1753,6 +1753,9 @@ export const make = Effect.gen(function* () {
             ...(changeRequest.autoMergeMethod === undefined
               ? {}
               : { autoMergeMethod: changeRequest.autoMergeMethod }),
+            ...(changeRequest.maintainerCanModify === undefined
+              ? {}
+              : { maintainerCanModify: changeRequest.maintainerCanModify }),
             ...(changeRequest.workflowApprovalsRequired === undefined
               ? {}
               : { workflowApprovalsRequired: changeRequest.workflowApprovalsRequired }),
@@ -2138,7 +2141,22 @@ export const make = Effect.gen(function* () {
             }),
           );
         }
-        if (input.title === undefined && input.body === undefined) {
+        if (
+          input.maintainerCanModify !== undefined &&
+          project.api.capabilities.edit?.maintainerEdits !== true
+        ) {
+          return Effect.fail(
+            new PullRequestOperationError({
+              operation: "update",
+              detail: "This host does not support maintainer edits.",
+            }),
+          );
+        }
+        if (
+          input.title === undefined &&
+          input.body === undefined &&
+          input.maintainerCanModify === undefined
+        ) {
           return Effect.fail(
             new PullRequestOperationError({
               operation: "update",
@@ -2151,6 +2169,9 @@ export const make = Effect.gen(function* () {
           repository: project.repository,
           host: project.host,
           number: input.number,
+          ...(input.maintainerCanModify === undefined
+            ? {}
+            : { maintainerCanModify: input.maintainerCanModify }),
           ...(input.title === undefined ? {} : { title: input.title }),
           ...(input.body === undefined ? {} : { body: input.body }),
         }).pipe(Effect.mapError(toPullRequestError("update")));