Gitea-Tools/webui/request_views.py

"""HTML views for the operator request surface (#643).

The form is deliberately a *preview* form. It has no initiate button, because
initiating requires a confirmed POST to ``/api/v1/requests/apply`` and a stray
form submission must not be able to produce one by accident.

Nothing rendered here is trusted input: every interpolated value is escaped,
and the page renders only values the service already produced rather than
echoing a raw request body back.
"""

from __future__ import annotations

import html
import json
from typing import Any

from webui.layout import render_page
from webui.request_service import (
    REQUESTABLE_ROLES,
    WORK_KINDS,
    RequestError,
    RequestPreview,
)

REQUESTS_PATH = "/requests"
PREVIEW_API_PATH = "/api/v1/requests/preview"
APPLY_API_PATH = "/api/v1/requests/apply"


def _escape(text: Any) -> str:
    return html.escape(str(text if text is not None else ""), quote=True)


REQUEST_PAGE_STYLES = """
<style>
  .request-form { display: grid; gap: 0.75rem; max-width: 44rem; }
  .request-form label { display: grid; gap: 0.25rem; font-size: 0.9rem; }
  .request-check { margin: 0.35rem 0; }
  .request-check .verdict-ok { color: var(--accent); }
  .request-check .verdict-fail { color: #d14; }
  .request-prohibited code { margin-right: 0.4rem; }
</style>
"""


def _options(values: tuple[str, ...], selected: Any) -> str:
    return "".join(
        f"<option value='{_escape(value)}'"
        + (" selected" if selected == value else "")
        + f">{_escape(value)}</option>"
        for value in values
    )


def _form(values: dict[str, Any] | None = None) -> str:
    current = dict(values or {})
    number = current.get("work_number")
    return (
        f"<form class='request-form' method='post' action='{REQUESTS_PATH}'>"
        "<label>Desired role<select name='desired_role'>"
        f"{_options(REQUESTABLE_ROLES, current.get('desired_role'))}"
        "</select></label>"
        "<label>Work kind<select name='work_kind'>"
        f"{_options(WORK_KINDS, current.get('work_kind'))}"
        "</select></label>"
        "<label>Issue or PR number"
        "<input type='number' name='work_number' min='1' required "
        f"value='{_escape(number) if number else ''}'></label>"
        "<label>Intent summary"
        "<input type='text' name='intent_summary' maxlength='500' required "
        f"value='{_escape(current.get('intent_summary'))}'></label>"
        "<label>Expected head SHA <span class='muted'>(PR work only)</span>"
        "<input type='text' name='expected_head_sha' "
        f"value='{_escape(current.get('expected_head_sha'))}'></label>"
        "<button type='submit' class='copy-btn'>Preview request</button>"
        "<p class='muted meta'>Preview is read-only and creates no assignment. "
        f"Initiating requires a confirmed POST to <code>{APPLY_API_PATH}</code>."
        "</p>"
        "</form>"
    )


def _checks_block(preview: RequestPreview) -> str:
    rows = []
    for check in preview.checks:
        verdict = "PASS" if check.ok else "FAIL"
        css = "verdict-ok" if check.ok else "verdict-fail"
        rows.append(
            "<li class='request-check'>"
            f"<span class='{css}'><strong>{verdict}</strong></span> "
            f"<code>{_escape(check.name)}</code> — {_escape(check.detail)} "
            f"<span class='muted meta'>({_escape(check.reason_code)})</span>"
            "</li>"
        )
    return "<ul>" + "".join(rows) + "</ul>"


def _preview_block(preview: RequestPreview) -> str:
    verdict = "AUTHORIZED" if preview.authorized else "DENIED"
    prohibited = "".join(
        f"<code>{_escape(action)}</code>" for action in preview.prohibited_actions
    )
    request = preview.request
    evidence = json.dumps(preview.allocator_evidence, indent=2, default=str)
    return (
        "<h3>Intent preview</h3>"
        f"<p><strong>{verdict}</strong> — {_escape(preview.detail)}</p>"
        "<p class='meta'>"
        f"Role <code>{_escape(request.desired_role)}</code> · "
        f"{_escape(request.work_kind)} <code>{_escape(request.display_ref)}</code>"
        f" · profile <code>{_escape(preview.required_profile)}</code> · "
        f"namespace <code>{_escape(preview.required_namespace)}</code> · "
        f"permission <code>{_escape(preview.required_permission)}</code>"
        "</p>"
        f"<p>Intent: {_escape(request.intent_summary)}</p>"
        f"{_checks_block(preview)}"
        f"<p><strong>Next safe action:</strong> "
        f"{_escape(preview.next_safe_action)}</p>"
        "<p class='request-prohibited'><strong>Prohibited for this role:</strong> "
        + (prohibited or "<span class='muted'>none declared</span>")
        + "</p>"
        "<p class='muted meta'>Correlation id "
        f"<code>{_escape(preview.correlation_id)}</code></p>"
        "<details><summary>Allocator evidence</summary>"
        f"<pre class='prompt-text'>{_escape(evidence)}</pre>"
        "</details>"
    )


def _error_block(error: RequestError) -> str:
    field = (
        f"<p class='meta'>Field: <code>{_escape(error.field_name)}</code></p>"
        if error.field_name
        else ""
    )
    return (
        "<h3>Request rejected</h3>"
        f"<p><strong>{_escape(error.reason_code)}</strong> — "
        f"{_escape(error.detail)}</p>{field}"
    )


def render_requests_page(
    *,
    preview: RequestPreview | None = None,
    error: RequestError | None = None,
    submitted: dict[str, Any] | None = None,
) -> str:
    """Render the request form, plus a preview or rejection when one exists."""
    body = (
        "<h2>Requests</h2>"
        "<p>Submit a work request — desired role, issue or PR, and intent — "
        "and see whether it would be authorized before anything is reserved. "
        "Initiation goes through the allocator (#600/#613); this console never "
        "self-selects work, never approves, and never merges.</p>"
        + _form(submitted)
        + (_error_block(error) if error is not None else "")
        + (_preview_block(preview) if preview is not None else "")
        + f"<p class='meta'><a href='{PREVIEW_API_PATH}'>Preview API</a> · "
        "<a href='/api/console/security-model'>RBAC model</a></p>"
        + REQUEST_PAGE_STYLES
    )
    return render_page(title="Requests", body_html=body)