Commit `467699a1ed`

467699a1ed1e29f30e110aa41eefc8c1d59138a0

parent: bc49092e23

Verified · cmc ci/build: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-04 00:06 UTC

web: form actions answer by exit code

The action handlers discarded a command's exit code and redirected
with the message whatever the cause, so an issue that does not exist
came back as the page with a note in the URL. runControlCode keeps
the code, and done finishes the action by it: the 404 page for
not-found, and back to the page with the message for anything else,
since a refusal is feedback on the page a person was looking at,
whether a merge gate, a permission they lack, or a field they got
wrong. Twelve handlers converted.

Closes #106

Layout: unified · split

e2e/webwrites_test.go +6

 		t.Fatalf("repo created past the quota from the web: exit %d, want 3", code)
 	}
+	// A form action on an issue that does not exist is the 404 page, not a
+	// redirect carrying a message (#106).
+	if status, _ := browserPost(t, browser, inst.base()+"/alice/first/issues/999/state", url.Values{"action": {"close"}}); status != 404 {
+		t.Fatalf("closing a missing issue from the web: %d, want 404", status)
+	}
 	// An archived repository refuses a comment from the web as it does
 	// over ssh.
 	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "archive", "alice/first"); code != 0 {

internal/httpd/control.go +35 −4

 // ViaAPI is set, which refuses SSHOnly commands: anything whose input is a
 // credential (secrets, mirror tokens, session minting) stays on SSH.
 func (s *Server) runControl(u store.User, argv []string) (out string, msg string, ok bool) {
+	out, msg, code := s.runControlCode(u, argv)
+	return out, msg, code == protocol.ExitOK
+}
+// runControlCode is runControl with the exit code, for handlers that
+// answer a form: not-found and denied deserve their own statuses rather
+// than a redirect carrying the message (#106).
+func (s *Server) runControlCode(u store.User, argv []string) (out string, msg string, code int) {
 	var stdout, stderr bytes.Buffer
 	ctx := &control.Ctx{
 		User:   u,
 		Stderr: &stderr,
 		ViaAPI: true,
 	}
-	code := control.Dispatch(ctx, argv)
+	code = control.Dispatch(ctx, argv)
 	m := strings.TrimSpace(stderr.String())
 	if m == "" {
 		m = strings.TrimSpace(stdout.String())
 	}
-	return stdout.String(), m, code == protocol.ExitOK
+	return stdout.String(), m, code
+}
+// done finishes a form action by exit code: back to the page on success,
+// the 404 page when the thing does not exist, and back to the page with
+// the message for anything else. A refusal is feedback on the page a
+// person was looking at, whether it is a merge gate, a permission they
+// lack, or a field they got wrong; only a thing that does not exist has
+// no page to go back to.
+func (s *Server) done(w http.ResponseWriter, r *http.Request, code int, msg string,
+	redirect func(http.ResponseWriter, *http.Request, string)) {
+	switch code {
+	case protocol.ExitOK:
+		redirect(w, r, "")
+	case protocol.ExitNotFound:
+		s.notFound(w, r)
+	default:
+		redirect(w, r, msg)
+	}
 }
 // runControlStdin is runControl for the handful of commands whose input
 // tokens and mirror credentials remain SSHOnly and are refused by the
 // dispatcher.
 func (s *Server) runControlStdin(u store.User, argv []string, stdin string) (msg string, ok bool) {
+	msg, code := s.runControlStdinCode(u, argv, stdin)
+	return msg, code == protocol.ExitOK
+}
+func (s *Server) runControlStdinCode(u store.User, argv []string, stdin string) (msg string, code int) {
 	var stdout, stderr bytes.Buffer
 	ctx := &control.Ctx{
 		User:   u,
 		Stderr: &stderr,
 		ViaAPI: true,
 	}
-	code := control.Dispatch(ctx, argv)
+	code = control.Dispatch(ctx, argv)
 	m := strings.TrimSpace(stderr.String())
 	if m == "" {
 		m = strings.TrimSpace(stdout.String())
 	}
-	return m, code == protocol.ExitOK
+	return m, code
 }
 // runControlInto runs a command in JSON mode and decodes its data into

internal/httpd/issueactions.go +8 −20

 	if r.FormValue("action") == "reopen" {
 		verb = "reopen"
 	}
-	_, msg, ok := s.runControl(u, issueArgs(r, verb))
+	_, msg, code := s.runControlCode(u, issueArgs(r, verb))
-	if ok {
+	s.done(w, r, code, msg, s.issueRedirect)
-		msg = ""
-	}
-	s.issueRedirect(w, r, msg)
 }
 // fieldArgs turns a space-separated form value into repeated flags, the
 		s.issueRedirect(w, r, "name at least one label")
 		return
 	}
-	_, msg, ok := s.runControl(u, issueArgs(r, "label", args...))
+	_, msg, code := s.runControlCode(u, issueArgs(r, "label", args...))
-	if ok {
+	s.done(w, r, code, msg, s.issueRedirect)
-		msg = ""
-	}
-	s.issueRedirect(w, r, msg)
 }
 func (s *Server) issueAssignSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 		s.issueRedirect(w, r, "name at least one person")
 		return
 	}
-	_, msg, ok := s.runControl(u, issueArgs(r, "assign", args...))
+	_, msg, code := s.runControlCode(u, issueArgs(r, "assign", args...))
-	if ok {
+	s.done(w, r, code, msg, s.issueRedirect)
-		msg = ""
-	}
-	s.issueRedirect(w, r, msg)
 }
 func (s *Server) issueMilestoneSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 	if title == "" {
 		title = "none"
 	}
-	_, msg, ok := s.runControl(u, issueArgs(r, "milestone", title))
+	_, msg, code := s.runControlCode(u, issueArgs(r, "milestone", title))
-	if ok {
+	s.done(w, r, code, msg, s.issueRedirect)
-		msg = ""
-	}
-	s.issueRedirect(w, r, msg)
 }

internal/httpd/mractions.go +12 −30

 		s.mrRedirect(w, r, "pick approve, request changes, or comment")
 		return
 	}
-	_, msg, ok := s.runControl(u, mrArgs(r, "review", flag))
+	_, msg, code := s.runControlCode(u, mrArgs(r, "review", flag))
-	if ok {
+	s.done(w, r, code, msg, s.mrRedirect)
-		msg = ""
-	}
-	s.mrRedirect(w, r, msg)
 }
 func (s *Server) mrMergeSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 	if st := strings.TrimSpace(r.FormValue("strategy")); st != "" && st != "auto" {
 		args = append(args, "--strategy", st)
 	}
-	_, msg, ok := s.runControl(u, mrArgs(r, "merge", args...))
+	_, msg, code := s.runControlCode(u, mrArgs(r, "merge", args...))
-	if ok {
+	s.done(w, r, code, msg, s.mrRedirect)
-		msg = ""
-	}
-	s.mrRedirect(w, r, msg)
 }
 func (s *Server) mrCloseSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
-	_, msg, ok := s.runControl(u, mrArgs(r, "close"))
+	_, msg, code := s.runControlCode(u, mrArgs(r, "close"))
-	if ok {
+	s.done(w, r, code, msg, s.mrRedirect)
-		msg = ""
-	}
-	s.mrRedirect(w, r, msg)
 }
 // mrDiffCommentSubmit opens a review thread on a diff line, or replies to
 			extra = append(extra, "--old")
 		}
 	}
-	msg, ok := s.runControlStdin(u, mrArgs(r, "diff-comment", append(extra, "--file", "-")...), body)
+	msg, code := s.runControlStdinCode(u, mrArgs(r, "diff-comment", append(extra, "--file", "-")...), body)
-	if ok {
+	s.done(w, r, code, msg, s.mrDiffRedirect)
-		msg = ""
-	}
-	s.mrDiffRedirect(w, r, msg)
 }
 // mrRetargetSubmit moves the merge request onto another branch.
 		s.mrRedirect(w, r, "pick a branch to retarget onto")
 		return
 	}
-	_, msg, ok := s.runControl(u, mrArgs(r, "retarget", target))
+	_, msg, code := s.runControlCode(u, mrArgs(r, "retarget", target))
-	if ok {
+	s.done(w, r, code, msg, s.mrRedirect)
-		msg = ""
-	}
-	s.mrRedirect(w, r, msg)
 }
 // mrThreadSubmit resolves or reopens one review thread.
 		s.mrRedirect(w, r, "bad thread id")
 		return
 	}
-	_, msg, ok := s.runControl(u, mrArgs(r, verb, id))
+	_, msg, code := s.runControlCode(u, mrArgs(r, verb, id))
-	if ok {
+	s.done(w, r, code, msg, s.mrRedirect)
-		msg = ""
-	}
-	s.mrRedirect(w, r, msg)
 }
 // mrNewPage is the create form: branches to choose from, plus whatever

internal/httpd/releaseactions.go +4 −10

 	if notes != "" || verb == "edit" {
 		argv = append(argv, "--notes", notes)
 	}
-	_, msg, ok := s.runControl(u, argv)
+	_, msg, code := s.runControlCode(u, argv)
-	if ok {
+	s.done(w, r, code, msg, func(w http.ResponseWriter, r *http.Request, msg string) { s.backTo(w, r, "releases", msg) })
-		msg = ""
-	}
-	s.backTo(w, r, "releases", msg)
 }
 func (s *Server) buildTriggerSubmit(w http.ResponseWriter, r *http.Request, u store.User) {
 		s.backTo(w, r, "builds", "pick a job")
 		return
 	}
-	_, msg, ok := s.runControl(u, []string{"build", "trigger", repo, job})
+	_, msg, code := s.runControlCode(u, []string{"build", "trigger", repo, job})
-	if ok {
+	s.done(w, r, code, msg, func(w http.ResponseWriter, r *http.Request, msg string) { s.backTo(w, r, "builds", msg) })
-		msg = ""
-	}
-	s.backTo(w, r, "builds", msg)
 }

Commit 467699a1ed

Commit `467699a1ed`