pika-git-inbox-1

Evidence

@@ -0,0 +1,11 @@
+UPDATE branch_inbox_states
+SET state = 'dismissed',
+    reason = 'branch_closed',
+    dismissed_at = COALESCE(dismissed_at, CURRENT_TIMESTAMP),
+    updated_at = CURRENT_TIMESTAMP
+WHERE state = 'inbox'
+  AND branch_id IN (
+      SELECT id
+      FROM branch_records
+      WHERE state != 'open'
+  );

Evidence

@@ rename from crates/pika-news/migrations/0019_ci_queue_state_and_target_health.sql
 rename to crates/pika-news/migrations/0020_ci_queue_state_and_target_health.sql

@@ -2496,8 +2576,13 @@ fn migrations() -> Vec<Migration> {
         Migration {
             version: 19,
-            name: "0019_ci_queue_state_and_target_health",
-            sql: include_str!("../migrations/0019_ci_queue_state_and_target_health.sql"),
+            name: "0019_dismiss_closed_branch_inbox",
+            sql: include_str!("../migrations/0019_dismiss_closed_branch_inbox.sql"),
+        },
+        Migration {
+            version: 20,
+            name: "0020_ci_queue_state_and_target_health",
+            sql: include_str!("../migrations/0020_ci_queue_state_and_target_health.sql"),

@@ -2371,6 +2394,17 @@ fn run_migrations(conn: &mut Connection) -> anyhow::Result<()> {
+        if migration.name == "0020_ci_queue_state_and_target_health"
+            && ci_queue_state_schema_present(conn)?
+        {
+            conn.execute(
+                "INSERT INTO _pika_news_migrations(version, name) VALUES (?1, ?2)",
+                params![migration.version, migration.name],
+            )
+            .with_context(|| format!("record pre-applied migration {}", migration.name))?;
+            continue;
+        }

Evidence

@@ -1421,6 +1421,29 @@ impl Store {
+    pub fn list_branch_inbox_allowlist_npubs(&self) -> anyhow::Result<Vec<String>> {
+        self.with_connection(|conn| {
+            let mut stmt = conn
+                .prepare(
+                    "SELECT npub
+                     FROM chat_allowlist
+                     WHERE active = 1 OR can_forge_write = 1
+                     ORDER BY npub ASC",
+                )
+                .context("prepare branch inbox allowlist query")?;
+
+            let rows = stmt
+                .query_map([], |row| row.get(0))
+                .context("query branch inbox allowlist")?;
+
+            let mut npubs = Vec::new();
+            for row in rows {
+                npubs.push(row.context("read branch inbox allowlist row")?);
+            }
+            Ok(npubs)
+        })
+    }

Evidence

@@ -191,7 +191,7 @@ fn branch_inbox_recipients(store: &Store, config: &Config) -> anyhow::Result<Vec
-    for npub in store.list_active_chat_allowlist_npubs()? {
+    for npub in store.list_branch_inbox_allowlist_npubs()? {

Evidence

@@ -4081,6 +4081,30 @@ fn require_chat_auth(
+fn require_inbox_auth(
+    auth: &AuthState,
+    headers: &axum::http::HeaderMap,
+    forge_mode: bool,
+) -> Result<String, axum::response::Response> {
+    let npub = require_auth(auth, headers)?;
+    let access = auth.access_for_npub(&npub);
+    let allowed = if forge_mode {
+        access.can_chat || access.can_forge_write
+    } else {
+        access.can_chat
+    };
+    if allowed {
+        Ok(npub)
+    } else {
+        Err((
+            StatusCode::FORBIDDEN,
+            Json(serde_json::json!({"error": "inbox access revoked"})),
+        )
+            .into_response())
+    }
+}

@@ -4404,14 +4449,14 @@ async fn api_inbox_list_handler(
-    let npub = match require_chat_auth(&state.auth, &headers) {
+    let forge_mode = state.config.effective_forge_repo().is_some();
+    let npub = match require_inbox_auth(&state.auth, &headers, forge_mode) {

@@ -4447,12 +4492,12 @@ async fn api_inbox_count_handler(
-    let npub = match require_chat_auth(&state.auth, &headers) {
+    let forge_mode = state.config.effective_forge_repo().is_some();
+    let npub = match require_inbox_auth(&state.auth, &headers, forge_mode) {

@@ -4488,12 +4533,12 @@ async fn api_inbox_dismiss_handler(
-    let npub = match require_chat_auth(&state.auth, &headers) {
+    let forge_mode = state.config.effective_forge_repo().is_some();
+    let npub = match require_inbox_auth(&state.auth, &headers, forge_mode) {

@@ -4534,12 +4579,12 @@ async fn api_inbox_neighbors_handler(
-    let npub = match require_chat_auth(&state.auth, &headers) {
+    let forge_mode = state.config.effective_forge_repo().is_some();
+    let npub = match require_inbox_auth(&state.auth, &headers, forge_mode) {

Evidence

@@ -4390,8 +4419,24 @@ async fn api_admin_allowlist_upsert_handler(
 fn should_backfill_managed_allowlist_entry(
     existing: Option<&ChatAllowlistEntry>,
     active: bool,
+    can_forge_write: bool,
+    forge_mode: bool,
 ) -> bool {
-    active && existing.map(|entry| !entry.active).unwrap_or(true)
+    let was_reviewable = existing
+        .map(|entry| {
+            if forge_mode {
+                entry.active || entry.can_forge_write
+            } else {
+                entry.active
+            }
+        })
+        .unwrap_or(false);
+    let is_reviewable = if forge_mode {
+        active || can_forge_write
+    } else {
+        active
+    };
+    is_reviewable && !was_reviewable
+}

@@ -4356,7 +4380,12 @@ async fn api_admin_allowlist_upsert_handler(
-        let backfilled = if should_backfill_managed_allowlist_entry(existing.as_ref(), active) {
+        let backfilled = if should_backfill_managed_allowlist_entry(
+            existing.as_ref(),
+            active,
+            can_forge_write,
+            forge_mode,
+        ) {

Evidence

@@ -203,7 +203,7 @@
-              if (!data.can_chat) {
+              if (!(data.can_chat || data.can_forge_write)) {

Evidence

@@ -2676,6 +2764,69 @@ mod tests {
+    #[test]
+    fn queue_state_migration_applies_after_legacy_version_19() {

@@ -5023,9 +5068,13 @@ mod tests {
-    fn managed_allowlist_backfills_only_for_new_active_entries() {
+    fn managed_allowlist_backfills_only_for_new_reviewable_entries() {

@@ -5037,23 +5086,100 @@ mod tests {
+    #[tokio::test]
+    async fn forge_only_writer_can_list_branch_inbox() {

@@ -306,10 +319,11 @@ mod tests {
-            3
+            4