trusty-mpm 1.7.4

//! CLI-side, project-aware GitHub identity resolution for every `gh`
//! subprocess `tm` spawns (#1265, project-aware since #2184).
//!
//! Why: the precedence engine (`config_dir` > `token_env` > `account`, plus
//! `GH_HOST`) now lives in the library (`trusty_mpm::core::gh_identity`) so
//! the daemon's managed-spawn path can share it (#2184). This module is the
//! remaining CLI-specific glue: it detects the ACTIVE project (by matching
//! the current directory's git origin remote against `config.projects`),
//! applies the #2184 project-over-global precedence via
//! [`trusty_mpm::core::gh_identity::select_github_config`], and folds the
//! typed [`GhIdentityError`] into `anyhow` (binary code uses `anyhow`, per
//! this workspace's error-handling convention).
//!
//! What: [`load_gh_env`] is the one-line entry point every `tm issue`/`tm
//! ticket`/`tm watch` call site already uses; it is now project-aware with NO
//! call-site changes required. [`resolve_project_aware`] is the pure,
//! directly-testable core (config + a pre-detected origin URL in, `GhEnv`
//! out) that `load_gh_env` wraps with real cwd/git detection.
//!
//! Test: `resolve_project_aware_*` in the inline `tests` module exercise the
//! project-match precedence hermetically (no real `gh`/git needed); the
//! underlying precedence chain itself is tested in
//! `trusty_mpm::core::gh_identity`.
//!
//! #2081/#3312: when the resolved `GithubConfig` pairs a `config_dir` with an
//! `account` (documented intent — see `account_with_config_dir_is_ok` in the
//! library's `gh_identity` tests), [`resolve_project_aware`] also verifies
//! (and self-heals) the ACTIVE account inside that isolated directory via
//! [`trusty_mpm::core::gh_account::ensure_gh_account_in_dir`] before
//! returning — this is the enforcement mechanism added in #2081 that had no
//! production call site until #3312. A project with no `account` paired with
//! its `config_dir` sees no behaviour change (enforcement never fires).

use trusty_mpm::core::gh_identity::{GhEnv, GhIdentityError, select_github_config};
use trusty_mpm::core::trusty_tools_config::TrustyToolsConfig;
use trusty_mpm::project::record::repo_url_matches;

// Re-exported for the existing CLI call sites (`clone_url` is used by
// `commands::watch`; `effective_host`/`resolve_gh_env` are exercised via the
// library's own test suite but kept reachable here for any future CLI need).
pub(crate) use trusty_mpm::core::gh_identity::clone_url;

/// Resolve an optional [`trusty_mpm::core::trusty_tools_config::GithubConfig`]
/// into a [`GhEnv`], surfacing the typed [`GhIdentityError`] as `anyhow` for
/// binary call sites.
///
/// Why: production call sites use `anyhow::Result`; folding the typed error
/// into `anyhow` here keeps those sites a one-liner.
/// What: delegates to [`trusty_mpm::core::gh_identity::resolve_gh_env`].
/// Test: covered transitively by `resolve_project_aware_*` and the library's
/// own `resolve_*` tests.
fn resolve_gh_env_anyhow(
    config: Option<&trusty_mpm::core::trusty_tools_config::GithubConfig>,
) -> anyhow::Result<GhEnv> {
    trusty_mpm::core::gh_identity::resolve_gh_env(config)
        .map_err(|e: GhIdentityError| anyhow::anyhow!(e))
}

/// Resolve the [`GhEnv`] for `origin_url` against a loaded [`TrustyToolsConfig`]
/// (#2184) — the pure, hermetically-testable core of [`load_gh_env`].
///
/// Why: separating the "which config wins" decision from the real cwd/git
/// detection lets the project-over-global precedence be asserted without a
/// real git repo on disk.
/// What: when `origin_url` is `Some` and matches (via [`repo_url_matches`]) a
/// `config.projects` entry with its own `github:` binding, that binding wins
/// outright; otherwise falls back to the global `config.github`; with no
/// match (or no `origin_url`) resolution is purely global — matching
/// pre-#2184 behaviour exactly.
/// Test: `resolve_project_aware_project_binding_wins`,
/// `resolve_project_aware_falls_back_to_global`,
/// `resolve_project_aware_no_origin_uses_global`,
/// `resolve_project_aware_enforces_paired_account`,
/// `resolve_project_aware_skips_enforcement_when_account_unset`.
pub(crate) fn resolve_project_aware(
    config: &TrustyToolsConfig,
    origin_url: Option<&str>,
) -> anyhow::Result<GhEnv> {
    let project_github = origin_url
        .and_then(|url| {
            config
                .projects
                .iter()
                .find(|p| repo_url_matches(&p.repo_url, url))
        })
        .and_then(|p| p.github.as_ref());
    let selected = select_github_config(project_github, config.github.as_ref());

    // #2081/#3312: verify (and self-heal) the active account inside the
    // resolved `config_dir` BEFORE this identity is used for any real `gh`
    // call, when the project pairs `config_dir` with an explicit `account`.
    // A project that never configures `account` alongside `config_dir` sees
    // no behaviour change here.
    if let Some(target) = trusty_mpm::core::gh_account::configured_account_pair(selected) {
        // #5849: enforce on the project's configured host, not an assumed one.
        trusty_mpm::core::gh_account::ensure_gh_account_in_dir(
            &target.account,
            &target.config_dir,
            &target.host,
        )?;
    }

    resolve_gh_env_anyhow(selected)
}

/// Convenience wrapper: load trusty-mpm config, detect the active project from
/// the current directory's git origin remote, and resolve the active [`GhEnv`].
///
/// Why: every `tm` entry point that spawns `gh` needs the same "load config →
/// detect project → resolve `github:` section → GhEnv" sequence; centralising
/// it keeps the call sites to one line and the behaviour identical across
/// `ticket`/`watch`/`issue`.
/// What: [`load_gh_env_for`] against the process's current directory.
/// Test: `resolve_project_aware_*` cover the resolution logic; this function
/// is thin wiring over real cwd detection.
pub(crate) fn load_gh_env() -> anyhow::Result<GhEnv> {
    match std::env::current_dir() {
        Ok(cwd) => load_gh_env_for(&cwd),
        Err(_) => load_gh_env_for(std::path::Path::new(".")),
    }
}

/// [`load_gh_env`] against an EXPLICIT directory (#8233 review, HIGH).
///
/// Why: the bare-`tm` in-place relaunch runs inside a managed pane whose session
/// has its own workspace, and that workspace — not the shell's current
/// directory — is the project whose `github:` binding the relaunched `claude`
/// must inherit. Before #8233 it inherited the identity from the pane's shell
/// environment, which the spawn had exported there by sourcing a temp file; the
/// launch spec now delivers the environment to `claude` alone, so the pane shell
/// no longer holds it and this path has to resolve it again from config.
/// What: [`load_gh_env`]'s body, with `dir` in place of the process cwd.
/// Test: `resolve_project_aware_*` cover the resolution; the in-place
/// application is covered by
/// `inplace_exec_command_carries_the_pinned_gh_identity`.
pub(crate) fn load_gh_env_for(dir: &std::path::Path) -> anyhow::Result<GhEnv> {
    let config = TrustyToolsConfig::load();
    // #4734: still best-effort, but a git failure is logged instead of passing
    // silently as "this directory has no origin remote".
    let origin_url = trusty_mpm::daemon::managed_routes::inproject::get_origin_url(dir)
        .inspect_err(|e| tracing::warn!("cannot read git origin remote for gh identity: {e}"))
        .ok()
        .flatten();
    let env = resolve_project_aware(&config, origin_url.as_deref())?;
    if !env.is_empty() {
        // Names only — never the resolved token VALUE (which `vars()` may hold).
        let names: Vec<&str> = env.vars().iter().map(|(k, _)| k.as_str()).collect();
        tracing::debug!(overrides = ?names, "applying per-project GitHub identity binding to gh calls");
    }
    Ok(env)
}

#[cfg(test)]
mod tests {
    use super::*;
    use trusty_mpm::core::trusty_tools_config::{GithubConfig, ProjectConfig};

    fn project(repo_url: &str, github: Option<GithubConfig>) -> ProjectConfig {
        ProjectConfig {
            name: "p".into(),
            repo_url: repo_url.into(),
            default_branch: None,
            stack_hint: None,
            tags: None,
            description: None,
            gh_user: None,
            gh_account: None,
            github,
            commit_name: None,
            commit_email: None,
            untracked_sync: None,
            worktree: None,
        }
    }

    fn gh(config_dir: &str) -> GithubConfig {
        GithubConfig {
            config_dir: Some(config_dir.into()),
            token_env: None,
            account: None,
            host: None,
        }
    }

    /// Build a `TrustyToolsConfig` carrying only the fields these tests set.
    ///
    /// Why (#5204): `TrustyToolsConfig` is `#[non_exhaustive]` so that adding a
    /// settings field stays non-breaking. A binary target is a separate crate
    /// from the lib, so it cannot use a struct literal — this is the
    /// build-then-assign shape every out-of-crate consumer must use.
    /// What: `Default` with `github` and `projects` overridden.
    /// Test: used by every `resolve_project_aware_*` test below.
    fn cfg_of(github: Option<GithubConfig>, projects: Vec<ProjectConfig>) -> TrustyToolsConfig {
        let mut c = TrustyToolsConfig::default();
        c.github = github;
        c.projects = projects;
        c
    }

    /// Why: a matched project's own `github:` binding must win over the
    /// global one — the #2184 precedence this module adds.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_project_binding_wins() {
        let config = cfg_of(
            Some(gh("/cfg/global")),
            vec![project(
                "https://github.com/acme/widget",
                Some(gh("/cfg/project")),
            )],
        );
        let env =
            resolve_project_aware(&config, Some("https://github.com/acme/widget.git")).expect("ok");
        assert_eq!(
            env.vars(),
            &[("GH_CONFIG_DIR".to_string(), "/cfg/project".to_string())]
        );
    }

    /// Why: a project match with no `github:` binding of its own must fall
    /// back to the global tier.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_falls_back_to_global() {
        let config = cfg_of(
            Some(gh("/cfg/global")),
            vec![project("https://github.com/acme/widget", None)],
        );
        let env =
            resolve_project_aware(&config, Some("https://github.com/acme/widget")).expect("ok");
        assert_eq!(
            env.vars(),
            &[("GH_CONFIG_DIR".to_string(), "/cfg/global".to_string())]
        );
    }

    /// Why: with no detected origin (e.g. `tm` run outside a git repo), and no
    /// declared project therefore matches — resolution must be purely global,
    /// matching pre-#2184 behaviour exactly.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_no_origin_uses_global() {
        let config = cfg_of(Some(gh("/cfg/global")), Vec::new());
        let env = resolve_project_aware(&config, None).expect("ok");
        assert_eq!(
            env.vars(),
            &[("GH_CONFIG_DIR".to_string(), "/cfg/global".to_string())]
        );
    }

    /// Why: a detected origin that matches NO declared project, with no
    /// global binding either, must resolve to a fully ambient (empty) env —
    /// the no-regression guarantee for projects with no #2184/#1265 config.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_no_match_no_global_is_ambient() {
        let config = TrustyToolsConfig::default();
        let env =
            resolve_project_aware(&config, Some("https://github.com/someone/else")).expect("ok");
        assert!(env.is_empty());
    }

    // ── #2081/#3312: enforcement wiring ───────────────────────────────────
    //
    // #7059: `trusty_mpm::core::gh_scoped_stub` answers the scoped `gh` calls
    // in-process. These tests used a fake `gh` shell script on the
    // process-global `PATH`, which a sibling test's `PATH` restore could remove
    // mid-run — the real `gh` then answered and the 5 s enforcement ceiling
    // turned into a flake.

    use trusty_mpm::core::gh_scoped_stub::GhScopedStub;

    // Serialises PATH mutation across the tests below — cargo runs unit tests
    // in parallel and env vars are process-global. #7996: this used to be a
    // module-local `static ENV_LOCK`, which serialised only these three tests
    // while `test_support::tmux_session` execs a bare `tmux` the OS resolves
    // through the very `$PATH` they rewrite. The binary target's one PATH
    // regime now lives in `test_support`, where both sides can reach it.
    fn fake_gh_lock() -> std::sync::MutexGuard<'static, ()> {
        crate::test_support::lock_path_env()
    }

    /// #7996, inverted into an assertion: the PATH override these tests install
    /// and the tmux fixture's spawn seam must contend on ONE mutex, or the
    /// fixture can still exec while `$PATH` is mid-rewrite.
    /// Test: itself.
    #[test]
    fn gh_path_override_and_the_tmux_fixture_share_one_lock() {
        let _g = fake_gh_lock();
        assert!(
            crate::test_support::path_env_mutex().try_lock().is_err(),
            "`fake_gh_lock` must hold the same mutex `test_support::lock_path_env` hands \
             the tmux fixture (#7996)"
        );
    }

    /// Remove any ambient `GH_TOKEN`/`GITHUB_TOKEN`, returning them to restore.
    ///
    /// #5849: an ambient token makes `ensure_gh_account_in_dir` refuse, so a
    /// shell or CI job that exports one would otherwise decide these outcomes.
    /// Keys are spelled as literals (never a loop variable) so
    /// `env_isolation_tests`' rule-1 source scan can read what these write.
    type AmbientTokens = (Option<std::ffi::OsString>, Option<std::ffi::OsString>);

    fn strip_ambient_tokens() -> AmbientTokens {
        let prior = (
            std::env::var_os("GH_TOKEN"),
            std::env::var_os("GITHUB_TOKEN"),
        );
        // SAFETY: guarded by `fake_gh_lock` in every caller.
        unsafe {
            std::env::remove_var("GH_TOKEN");
            std::env::remove_var("GITHUB_TOKEN");
        }
        prior
    }

    fn restore_ambient_tokens(prior: AmbientTokens) {
        // SAFETY: guarded by `fake_gh_lock` in every caller.
        unsafe {
            match prior.0 {
                Some(v) => std::env::set_var("GH_TOKEN", v),
                None => std::env::remove_var("GH_TOKEN"),
            }
            match prior.1 {
                Some(v) => std::env::set_var("GITHUB_TOKEN", v),
                None => std::env::remove_var("GITHUB_TOKEN"),
            }
        }
    }

    /// Why (#3312): a project whose resolved `github:` binding pairs
    /// `config_dir` with `account` must have that account VERIFIED (and
    /// corrected, since the stub here starts with the wrong account active)
    /// before `resolve_project_aware` returns — proving the CLI path
    /// (`tm ticket`/`tm issue`/`tm watch`, via `load_gh_env`) now actually
    /// enforces #2081 rather than merely documenting it in config.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_enforces_paired_account() {
        let _g = fake_gh_lock();
        let config_dir = tempfile::tempdir().expect("config tempdir");
        let (stub, _stub) = GhScopedStub::logged_in_as("wrong-account").install();
        let prior_tokens = strip_ambient_tokens();

        let mut cfg = gh(&config_dir.path().display().to_string());
        cfg.account = Some("bobmatnyc".to_string());
        let config = cfg_of(Some(cfg), Vec::new());
        let result = resolve_project_aware(&config, None);

        restore_ambient_tokens(prior_tokens);
        assert!(result.is_ok(), "expected self-heal to succeed: {result:?}");
        assert_eq!(
            stub.active_account(),
            "bobmatnyc",
            "the switch must have taken effect"
        );
    }

    /// Why (#3312): when the enforced switch itself fails (the expected
    /// account was never logged in under this project's isolated
    /// `GH_CONFIG_DIR`), `resolve_project_aware` — and therefore every `tm
    /// ticket`/`tm issue`/`tm watch` invocation via `load_gh_env` — must
    /// hard-fail rather than silently proceed with the wrong `gh` identity.
    /// This is the causal proof: pre-#3312, NOTHING called this enforcement,
    /// so this exact mismatched-account scenario would have resolved `Ok`
    /// and every subsequent `gh` call in the command would have silently run
    /// as the wrong account.
    /// Test: itself.
    #[test]
    fn resolve_project_aware_fails_closed_on_switch_failure() {
        let _g = fake_gh_lock();
        let config_dir = tempfile::tempdir().expect("config tempdir");
        let (_stub_handle, _stub) = GhScopedStub::logged_in_as("wrong-account")
            .with_failing_switch()
            .install();
        let prior_tokens = strip_ambient_tokens();

        let mut cfg = gh(&config_dir.path().display().to_string());
        cfg.account = Some("bobmatnyc".to_string());
        let config = cfg_of(Some(cfg), Vec::new());
        let result = resolve_project_aware(&config, None);

        restore_ambient_tokens(prior_tokens);
        let err = result.expect_err("mismatched account with a failed switch must be an Err");
        assert!(err.to_string().contains("bobmatnyc"), "err: {err}");
    }

    /// Why (#3312): a project that pairs `config_dir` with NO `account` (the
    /// pre-#3312, still-supported shape) must see NO enforcement at all —
    /// proven by scripting every scoped `gh` answer to fail, then asserting
    /// resolution still succeeds (which is only possible if `gh` was never
    /// invoked).
    /// Test: itself.
    #[test]
    fn resolve_project_aware_skips_enforcement_when_account_unset() {
        let _g = fake_gh_lock();
        let config_dir = tempfile::tempdir().expect("config tempdir");
        let (_stub_handle, _stub) = GhScopedStub::logged_in_as("irrelevant")
            .with_failing_api()
            .with_failing_switch()
            .install();

        let config = cfg_of(
            Some(gh(&config_dir.path().display().to_string())),
            Vec::new(),
        );
        let result = resolve_project_aware(&config, None);

        assert!(
            result.is_ok(),
            "no account paired with config_dir must skip enforcement entirely: {result:?}"
        );
    }
}