Add a secure repository Prompts review surface and prompt metadata API

Hop-State: A_06FN6MRSHG4B64ZV13086G8 Hop-Proposal: R_06FN6MQDE14FFNR65H1D28G Hop-Task: T_06FN6J8ECE1Z9XQ5PQ3Z3D8 Hop-Attempt: AT_06FN6J8ECC1SC794JMZ0TF8
2026-07-11 15:36:22 -07:00
parent c0c1161107
commit fee4f6dd31
15 changed files with 709 additions and 8 deletions
@@ -78,3 +78,33 @@ func (c *Client) Repository(ctx context.Context, owner, name string) (Repository
 	}
 	return repo, nil
 }
+
+// ViewerCanReadRepository checks a browser's existing Gitea session before
+// returning prompt data. Prompts may contain sensitive intent, so the Hop API
+// must never turn a private repository into a public metadata feed.
+func (c *Client) ViewerCanReadRepository(ctx context.Context, cookie, owner, name string) (bool, error) {
+	if strings.TrimSpace(cookie) == "" {
+		return false, nil
+	}
+	u := c.baseURL.JoinPath("api", "v1", "repos", owner, name)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return false, err
+	}
+	req.Header.Set("Cookie", cookie)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return false, fmt.Errorf("check viewer repository access: %w", err)
+	}
+	defer resp.Body.Close()
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return true, nil
+	case http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound:
+		return false, nil
+	default:
+		return false, fmt.Errorf("gitea viewer repository check returned %s", resp.Status)
+	}
+}
@@ -42,3 +42,41 @@ func TestRepositoryRequiresToken(t *testing.T) {
 		t.Fatalf("error = %v, want %v", err, ErrTokenNotConfigured)
 	}
 }
+
+func TestViewerCanReadRepositoryForwardsSessionCookie(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/hop/private" {
+			t.Fatalf("path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
+			t.Fatalf("cookie = %q", got)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	client, err := NewClient(server.URL, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	allowed, err := client.ViewerCanReadRepository(context.Background(), "i_like_gitea=session", "hop", "private")
+	if err != nil || !allowed {
+		t.Fatalf("allowed = %t, err = %v", allowed, err)
+	}
+}
+
+func TestViewerCannotReadMissingRepository(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer server.Close()
+
+	client, err := NewClient(server.URL, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	allowed, err := client.ViewerCanReadRepository(context.Background(), "i_like_gitea=session", "hop", "missing")
+	if err != nil || allowed {
+		t.Fatalf("allowed = %t, err = %v", allowed, err)
+	}
+}
@@ -21,6 +21,7 @@ const maxWebhookBody = 2 << 20

 type giteaClient interface {
 	Repository(context.Context, string, string) (gitea.Repository, error)
+	ViewerCanReadRepository(context.Context, string, string, string) (bool, error)
 }

 type server struct {
@@ -38,10 +39,90 @@ func New(data store.Store, client giteaClient, adminToken, webhookSecret string,
 	mux.HandleFunc("GET /readyz", s.ready)
 	mux.Handle("GET /api/v1/repositories", s.requireAdmin(http.HandlerFunc(s.listRepositories)))
 	mux.Handle("POST /api/v1/repositories/link", s.requireAdmin(http.HandlerFunc(s.linkRepository)))
+	mux.Handle("GET /api/v1/prompts", http.HandlerFunc(s.listPrompts))
+	mux.Handle("POST /api/v1/repositories/{owner}/{name}/prompts", s.requireAdmin(http.HandlerFunc(s.createPrompt)))
 	mux.HandleFunc("POST /api/v1/gitea/webhooks", s.giteaWebhook)
 	return requestLogger(logger, mux)
 }

+func (s *server) listPrompts(w http.ResponseWriter, r *http.Request) {
+	owner, name := strings.TrimSpace(r.URL.Query().Get("owner")), strings.TrimSpace(r.URL.Query().Get("repo"))
+	if !validSlug(owner) || !validSlug(name) {
+		writeError(w, http.StatusBadRequest, "owner and repo are required")
+		return
+	}
+	allowed, err := s.gitea.ViewerCanReadRepository(r.Context(), r.Header.Get("Cookie"), owner, name)
+	if err != nil {
+		s.logger.Error("check prompt viewer access", "owner", owner, "name", name, "error", err)
+		writeError(w, http.StatusBadGateway, "could not verify repository access")
+		return
+	}
+	if !allowed {
+		writeError(w, http.StatusUnauthorized, "sign in to view this repository's prompts")
+		return
+	}
+	prompts, err := s.store.ListPrompts(r.Context(), owner, name, 100)
+	if err != nil {
+		s.logger.Error("list prompts", "owner", owner, "name", name, "error", err)
+		writeError(w, http.StatusInternalServerError, "could not list prompts")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"prompts": prompts})
+}
+
+func (s *server) createPrompt(w http.ResponseWriter, r *http.Request) {
+	owner, name := r.PathValue("owner"), r.PathValue("name")
+	if !validSlug(owner) || !validSlug(name) {
+		writeError(w, http.StatusBadRequest, "owner and name are required")
+		return
+	}
+	var input struct {
+		TaskID          string          `json:"task_id"`
+		AttemptID       string          `json:"attempt_id"`
+		StateID         string          `json:"state_id"`
+		Prompt          string          `json:"prompt"`
+		AgentName       string          `json:"agent_name"`
+		AgentModel      string          `json:"agent_model"`
+		Status          string          `json:"status"`
+		ResponseSummary string          `json:"response_summary"`
+		Metadata        json.RawMessage `json:"metadata"`
+		CompletedAt     *time.Time      `json:"completed_at"`
+	}
+	if err := decodeJSON(w, r, &input); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	input.Prompt = strings.TrimSpace(input.Prompt)
+	if input.Prompt == "" || len(input.Prompt) > 32<<10 {
+		writeError(w, http.StatusBadRequest, "prompt is required and must be at most 32 KiB")
+		return
+	}
+	if input.Status == "" {
+		input.Status = "running"
+	}
+	switch input.Status {
+	case "running", "completed", "failed", "cancelled":
+	default:
+		writeError(w, http.StatusBadRequest, "invalid prompt status")
+		return
+	}
+	if len(input.Metadata) > 16<<10 || (len(input.Metadata) > 0 && !json.Valid(input.Metadata)) {
+		writeError(w, http.StatusBadRequest, "metadata must be valid JSON and at most 16 KiB")
+		return
+	}
+	saved, err := s.store.CreatePrompt(r.Context(), store.CreatePromptInput{
+		Owner: owner, Repository: name, TaskID: input.TaskID, AttemptID: input.AttemptID, StateID: input.StateID,
+		Prompt: input.Prompt, AgentName: input.AgentName, AgentModel: input.AgentModel, Status: input.Status,
+		ResponseSummary: input.ResponseSummary, Metadata: input.Metadata, CompletedAt: input.CompletedAt,
+	})
+	if err != nil {
+		s.logger.Error("create prompt", "owner", owner, "name", name, "error", err)
+		writeError(w, http.StatusInternalServerError, "could not create prompt")
+		return
+	}
+	writeJSON(w, http.StatusCreated, saved)
+}
+
 func (s *server) health(w http.ResponseWriter, _ *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
@@ -19,6 +19,7 @@ import (

 type fakeStore struct {
 	repositories []store.Repository
+	prompts      []store.Prompt
 	delivery     store.WebhookDelivery
 	duplicate    bool
 }
@@ -32,19 +33,31 @@ func (f *fakeStore) UpsertRepository(_ context.Context, repository gitea.Reposit
 	f.repositories = append(f.repositories, saved)
 	return saved, nil
 }
+func (f *fakeStore) ListPrompts(context.Context, string, string, int) ([]store.Prompt, error) {
+	return f.prompts, nil
+}
+func (f *fakeStore) CreatePrompt(_ context.Context, input store.CreatePromptInput) (store.Prompt, error) {
+	prompt := store.Prompt{ID: "PM_TEST", Prompt: input.Prompt, Status: input.Status, AgentName: input.AgentName, AgentModel: input.AgentModel, Metadata: input.Metadata}
+	f.prompts = append(f.prompts, prompt)
+	return prompt, nil
+}
 func (f *fakeStore) RecordWebhook(_ context.Context, delivery store.WebhookDelivery) (bool, error) {
 	f.delivery = delivery
 	return f.duplicate, nil
 }

 type fakeGitea struct {
-	repository gitea.Repository
-	err        error
+	repository    gitea.Repository
+	err           error
+	viewerAllowed bool
 }

 func (f fakeGitea) Repository(context.Context, string, string) (gitea.Repository, error) {
 	return f.repository, f.err
 }
+func (f fakeGitea) ViewerCanReadRepository(context.Context, string, string, string) (bool, error) {
+	return f.viewerAllowed, f.err
+}

 func testServer(data store.Store, client giteaClient) http.Handler {
 	return New(data, client, "admin-secret", "webhook-secret", slog.New(slog.NewTextHandler(io.Discard, nil)))
@@ -114,3 +127,43 @@ func TestWebhookRejectsInvalidSignature(t *testing.T) {
 		t.Fatalf("status = %d, want %d", response.Code, http.StatusUnauthorized)
 	}
 }
+
+func TestListPromptsRequiresGiteaSession(t *testing.T) {
+	data := &fakeStore{prompts: []store.Prompt{{ID: "PM_TEST", Prompt: "Ship the prompt view", Status: "completed"}}}
+	handler := testServer(data, fakeGitea{viewerAllowed: true})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/prompts?owner=hop&repo=demo", nil)
+	req.Header.Set("Cookie", "i_like_gitea=session")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusOK, response.Body.String())
+	}
+	if !bytes.Contains(response.Body.Bytes(), []byte("Ship the prompt view")) {
+		t.Fatalf("prompt missing from response: %s", response.Body.String())
+	}
+}
+
+func TestListPromptsRejectsUnauthenticatedViewer(t *testing.T) {
+	handler := testServer(&fakeStore{}, fakeGitea{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/prompts?owner=hop&repo=demo", nil)
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusUnauthorized, response.Body.String())
+	}
+}
+
+func TestCreatePrompt(t *testing.T) {
+	data := &fakeStore{}
+	handler := testServer(data, fakeGitea{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"prompt":"Ship the prompt view","agent_name":"codex","status":"completed","metadata":{"duration_ms":1200}}`))
+	req.Header.Set("Authorization", "Bearer admin-secret")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusCreated, response.Body.String())
+	}
+	if len(data.prompts) != 1 || data.prompts[0].Prompt != "Ship the prompt view" {
+		t.Fatalf("prompt not created: %#v", data.prompts)
+	}
+}
@@ -9,6 +9,14 @@ import (
 var encoding = base32.NewEncoding("0123456789ABCDEFGHJKMNPQRSTVWXYZ").WithPadding(base32.NoPadding)

 func Repository() (string, error) {
+	return newID("RP_")
+}
+
+func Prompt() (string, error) {
+	return newID("PM_")
+}
+
+func newID(prefix string) (string, error) {
 	value := make([]byte, 16)
 	milliseconds := uint64(time.Now().UnixMilli())
 	value[0] = byte(milliseconds >> 40)
@@ -20,5 +28,5 @@ func Repository() (string, error) {
 	if _, err := rand.Read(value[6:]); err != nil {
 		return "", err
 	}
-	return "RP_" + encoding.EncodeToString(value), nil
+	return prefix + encoding.EncodeToString(value), nil
 }
@@ -21,3 +21,13 @@ func TestRepository(t *testing.T) {
 		t.Fatal("generated duplicate IDs")
 	}
 }
+
+func TestPrompt(t *testing.T) {
+	id, err := Prompt()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(id, "PM_") || len(id) != 29 {
+		t.Fatalf("unexpected prompt ID %q", id)
+	}
+}
@@ -0,0 +1,17 @@
+CREATE TABLE prompts (
+    id text PRIMARY KEY,
+    repository_id text NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
+    task_id text NOT NULL DEFAULT '',
+    attempt_id text NOT NULL DEFAULT '',
+    state_id text NOT NULL DEFAULT '',
+    prompt text NOT NULL,
+    agent_name text NOT NULL DEFAULT '',
+    agent_model text NOT NULL DEFAULT '',
+    status text NOT NULL DEFAULT 'running' CHECK (status IN ('running', 'completed', 'failed', 'cancelled')),
+    response_summary text NOT NULL DEFAULT '',
+    metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    completed_at timestamptz
+);
+
+CREATE INDEX prompts_repository_created_at_idx ON prompts (repository_id, created_at DESC);
@@ -3,6 +3,7 @@ package store
 import (
 	"context"
 	"embed"
+	"encoding/json"
 	"fmt"
 	"sort"
 	"time"
@@ -37,10 +38,42 @@ type WebhookDelivery struct {
 	Repository    *gitea.Repository
 }

+type Prompt struct {
+	ID              string          `json:"id"`
+	TaskID          string          `json:"task_id,omitempty"`
+	AttemptID       string          `json:"attempt_id,omitempty"`
+	StateID         string          `json:"state_id,omitempty"`
+	Prompt          string          `json:"prompt"`
+	AgentName       string          `json:"agent_name,omitempty"`
+	AgentModel      string          `json:"agent_model,omitempty"`
+	Status          string          `json:"status"`
+	ResponseSummary string          `json:"response_summary,omitempty"`
+	Metadata        json.RawMessage `json:"metadata"`
+	CreatedAt       time.Time       `json:"created_at"`
+	CompletedAt     *time.Time      `json:"completed_at,omitempty"`
+}
+
+type CreatePromptInput struct {
+	Owner           string
+	Repository      string
+	TaskID          string
+	AttemptID       string
+	StateID         string
+	Prompt          string
+	AgentName       string
+	AgentModel      string
+	Status          string
+	ResponseSummary string
+	Metadata        json.RawMessage
+	CompletedAt     *time.Time
+}
+
 type Store interface {
 	Ping(context.Context) error
 	ListRepositories(context.Context) ([]Repository, error)
 	UpsertRepository(context.Context, gitea.Repository) (Repository, error)
+	ListPrompts(context.Context, string, string, int) ([]Prompt, error)
+	CreatePrompt(context.Context, CreatePromptInput) (Prompt, error)
 	RecordWebhook(context.Context, WebhookDelivery) (bool, error)
 }

@@ -129,6 +162,53 @@ func (p *Postgres) UpsertRepository(ctx context.Context, repository gitea.Reposi
 	return upsertRepository(ctx, p.pool, id, repository)
 }

+func (p *Postgres) ListPrompts(ctx context.Context, owner, name string, limit int) ([]Prompt, error) {
+	rows, err := p.pool.Query(ctx, `
+		SELECT p.id, p.task_id, p.attempt_id, p.state_id, p.prompt, p.agent_name, p.agent_model,
+			p.status, p.response_summary, p.metadata, p.created_at, p.completed_at
+		FROM prompts p
+		JOIN repositories r ON r.id = p.repository_id
+		WHERE r.owner=$1 AND r.name=$2
+		ORDER BY p.created_at DESC
+		LIMIT $3`, owner, name, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	prompts := make([]Prompt, 0)
+	for rows.Next() {
+		var prompt Prompt
+		if err := rows.Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt); err != nil {
+			return nil, err
+		}
+		prompts = append(prompts, prompt)
+	}
+	return prompts, rows.Err()
+}
+
+func (p *Postgres) CreatePrompt(ctx context.Context, input CreatePromptInput) (Prompt, error) {
+	id, err := ids.Prompt()
+	if err != nil {
+		return Prompt{}, err
+	}
+	metadata := input.Metadata
+	if len(metadata) == 0 {
+		metadata = json.RawMessage(`{}`)
+	}
+	var prompt Prompt
+	err = p.pool.QueryRow(ctx, `
+		INSERT INTO prompts (id, repository_id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, completed_at)
+		SELECT $1, r.id, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13
+		FROM repositories r WHERE r.owner=$2 AND r.name=$3
+		RETURNING id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, created_at, completed_at`,
+		id, input.Owner, input.Repository, input.TaskID, input.AttemptID, input.StateID, input.Prompt, input.AgentName, input.AgentModel, input.Status, input.ResponseSummary, metadata, input.CompletedAt,
+	).Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt)
+	if err != nil {
+		return Prompt{}, err
+	}
+	return prompt, nil
+}
+
 type querier interface {
 	QueryRow(context.Context, string, ...any) pgx.Row
 }