mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-10-07 16:19:09 +00:00
a09b1c3bb6
Port six upstream commits onto dev:
- c03a6be7 (already ported): keep plan guidance high-level
- 546042a4: add workflow approval UI with diff preview, approval URLs,
web review links, and polling for approval status during active runs
- 216cf181: remove workflow token elevation; approved pushes pass
through directly without proxy token rewriting
- 3dbc0282: preserve plan redirects after login by accepting relative
same-origin redirect_to values and rejecting blocked paths
- bb104d93: submit plan comments with cmd+enter
- 90cb6caa: terse Slack replies, shared content via save_plan outside
plan mode (PLAN_STATUS_SHARED), reject shared-content mutations
Refs: #135
75 lines
2.9 KiB
Python
75 lines
2.9 KiB
Python
"""REST API for approving workflow-file pushes."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException
|
|
|
|
from .oauth import require_same_origin_for_mutations, require_session
|
|
from .plan_api import _dispatch_followup, _thread_metadata
|
|
from .thread_api import _thread_is_readable, _user_owns_thread
|
|
from .workflow_approval import (
|
|
decide_workflow_push_approval,
|
|
get_workflow_push_approvals,
|
|
workflow_push_approval_responses,
|
|
)
|
|
|
|
workflow_approval_router = APIRouter(
|
|
prefix="/dashboard/api/workflow-approval",
|
|
tags=["workflow-approval"],
|
|
dependencies=[Depends(require_same_origin_for_mutations)],
|
|
)
|
|
_SESSION_DEP = Depends(require_session)
|
|
|
|
|
|
@workflow_approval_router.get("/{thread_id}")
|
|
async def list_workflow_push_approvals(
|
|
thread_id: str, session: dict[str, Any] = _SESSION_DEP
|
|
) -> dict[str, Any]:
|
|
metadata = await _thread_metadata(thread_id)
|
|
if not _thread_is_readable(metadata):
|
|
raise HTTPException(404, "thread not found")
|
|
is_owner = _user_owns_thread(metadata, session["sub"], session.get("email"))
|
|
approvals = await get_workflow_push_approvals(thread_id)
|
|
return {
|
|
"threadId": thread_id,
|
|
"isOwner": is_owner,
|
|
"approvals": workflow_push_approval_responses(approvals),
|
|
}
|
|
|
|
|
|
@workflow_approval_router.post("/{thread_id}/{fingerprint}/approve")
|
|
async def approve_workflow_push(
|
|
thread_id: str, fingerprint: str, session: dict[str, Any] = _SESSION_DEP
|
|
) -> dict[str, Any]:
|
|
metadata = await _thread_metadata(thread_id)
|
|
if not _user_owns_thread(metadata, session["sub"], session.get("email")):
|
|
raise HTTPException(403, "only the thread owner can approve workflow pushes")
|
|
record = await decide_workflow_push_approval(
|
|
thread_id, fingerprint, approved=True, actor=session["sub"]
|
|
)
|
|
if record is None:
|
|
raise HTTPException(404, "workflow push approval not found")
|
|
await _dispatch_followup(
|
|
thread_id,
|
|
metadata,
|
|
"The workflow-file push approval was approved. Retry the blocked git push now; do not alter workflow files before pushing.",
|
|
plan_mode=False,
|
|
)
|
|
return {"status": "approved", "fingerprint": fingerprint}
|
|
|
|
|
|
@workflow_approval_router.post("/{thread_id}/{fingerprint}/reject")
|
|
async def reject_workflow_push(
|
|
thread_id: str, fingerprint: str, session: dict[str, Any] = _SESSION_DEP
|
|
) -> dict[str, Any]:
|
|
metadata = await _thread_metadata(thread_id)
|
|
if not _user_owns_thread(metadata, session["sub"], session.get("email")):
|
|
raise HTTPException(403, "only the thread owner can reject workflow pushes")
|
|
record = await decide_workflow_push_approval(
|
|
thread_id, fingerprint, approved=False, actor=session["sub"]
|
|
)
|
|
if record is None:
|
|
raise HTTPException(404, "workflow push approval not found")
|
|
return {"status": "rejected", "fingerprint": fingerprint}
|