steid

dce0bf3feat: browse a repository's files and history8d	1	//! Browsing a repository — the file tree, a single file, and the commit log.
	2	//!
	3	//! Four routes, all reading through [`browse_repo`] and [`repo_log`], so visibility is
	4	//! decided in one place: a repository invisible on its page is invisible here, and
	5	//! `Ok(None)` from either use case renders as the same 404 as a repository that was
	6	//! never created.
	7	//!
	8	//! The URL carries a `/-/` separator between the revision and the path
	9	//! (`/tree/{rev}/-/{path}`) because a ref may contain slashes, so a candidate split
	10	//! would cost a ref lookup — another `git` process — on every page. The separator is
	11	//! unambiguous by construction instead.
	12	//!
	13	//! One route serves both directories and files. Which one a path is, is git's answer,
	14	//! not the URL's, and a link that had to know would be wrong the moment a file became
	15	//! a directory.
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	16	//!
	17	//! A fifth route, `/raw/{rev}/-/{*path}`, serves a file's bytes verbatim. It is not a
	18	//! page: it hands back arbitrary bytes an untrusted person put in a repository, so its
	19	//! response headers are a security policy rather than a convenience — see
	20	//! [`raw_response`].
dce0bf3feat: browse a repository's files and history8d	21
	22	use std::time::{SystemTime, UNIX_EPOCH};
	23
	24	use topcoat::{
	25	Result,
	26	context::Cx,
	27	icon::{icon, iconify::iconify_icon},
	28	router::{
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	29	Body, Response, StatusCode,
dce0bf3feat: browse a repository's files and history8d	30	error::{RouterErrorExt, not_found},
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	31	header::{CONTENT_DISPOSITION, CONTENT_TYPE},
	32	page, path_param, route,
dce0bf3feat: browse a repository's files and history8d	33	},
979134bfeat: code reads as code, in classes rather than colours19h	34	view::{Unescaped, attributes, component, view},
dce0bf3feat: browse a repository's files and history8d	35	};
	36
	37	use crate::{
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	38	application::{
	39	Browsed, FileView, RepoView,
	40	browse::{RawFile, RefList, list_refs, read_raw_file},
	41	browse_repo, repo_log,
	42	},
dce0bf3feat: browse a repository's files and history8d	43	components::badge::{BadgeVariant, badge},
	44	domain::{CommitSummary, EntryKind, RefName, RepoPath, TreeEntry},
979134bfeat: code reads as code, in classes rather than colours19h	45	infrastructure::highlight::{Source, SourceLine, source_lines},
dce0bf3feat: browse a repository's files and history8d	46	};
	47
	48	use super::{
	49	context::{current_actor, memberships, orgs, queries, repos, server_error},
5d3dfa5feat: a global top bar, and pages choose their own width1d	50	layout::wide,
0aca94efeat: a repository is one place, and its landing page says what it is19h	51	repo::{Tab, clone_url_for, repo_for, repo_header},
dce0bf3feat: browse a repository's files and history8d	52	};
	53
	54	/// `{rev}` from the path, raw — validation is [`RefName`]'s job.
	55	#[path_param]
	56	struct Rev(str);
	57
	58	/// `{*path}` from the path: every remaining segment, as one string.
	59	#[path_param]
	60	struct Path(str);
	61
	62	/// The revision from the URL, or 404.
	63	///
	64	/// A malformed revision is a page that does not exist rather than a bad request — the
	65	/// same reasoning that 404s a malformed handle.
	66	fn rev_param(cx: &Cx) -> Result<RefName> {
	67	Ok(RefName::new(path_param::<Rev>(cx)).map_err(\|_\| not_found())?)
	68	}
	69
	70	/// The path from the URL, or 404. Same reasoning as [`rev_param`].
	71	fn path_arg(cx: &Cx) -> Result<RepoPath> {
	72	Ok(RepoPath::new(path_param::<Path>(cx)).map_err(\|_\| not_found())?)
	73	}
	74
	75	#[page("/{handle}/repos/{name}/tree/{rev}")]
	76	async fn tree_root_page(cx: &Cx) -> Result {
	77	let rev = rev_param(cx)?;
	78
	79	view! { browsing(rev: Some(rev), path: RepoPath::root()) }
	80	}
	81
	82	#[page("/{handle}/repos/{name}/tree/{rev}/-/{*path}")]
	83	async fn tree_path_page(cx: &Cx) -> Result {
	84	let rev = rev_param(cx)?;
	85	let path = path_arg(cx)?;
	86
	87	view! { browsing(rev: Some(rev), path: path) }
	88	}
	89
	90	#[page("/{handle}/repos/{name}/log")]
	91	async fn log_page(_cx: &Cx) -> Result {
	92	view! { history(rev: None) }
	93	}
	94
	95	#[page("/{handle}/repos/{name}/log/{rev}")]
	96	async fn log_rev_page(cx: &Cx) -> Result {
	97	let rev = rev_param(cx)?;
	98
	99	view! { history(rev: Some(rev)) }
	100	}
	101
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	102	/// A file's bytes, exactly as they are stored.
	103	///
	104	/// A route rather than a page: the response is a file, not a document, so no layout
	105	/// wraps it. `/-/` separates the revision from the path for the same reason the tree
	106	/// route does — both can contain slashes and they sit adjacent.
	107	///
	108	/// Authorized through [`read_raw_file`], which goes through the same `view_repo` every
	109	/// browse page does, so a private repository answers 404 here exactly as it does there.
	110	#[route(GET "/{handle}/repos/{name}/raw/{rev}/-/{*path}")]
	111	async fn raw_page(cx: &Cx) -> Result<Response<Body>> {
	112	let rev = rev_param(cx)?;
	113	let path = path_arg(cx)?;
	114	let repo = repo_for(cx).await?;
	115
	116	let raw = read_raw_file(
	117	&repo.handle,
	118	&repo.name,
	119	Some(&rev),
	120	&path,
	121	&current_actor(cx).await?,
	122	&orgs(cx),
	123	&memberships(cx),
	124	&repos(cx),
	125	&queries(cx),
	126	)
	127	.await
	128	.map_err(server_error)?
	129	.ok_or_not_found()?;
	130
	131	match raw {
	132	RawFile::Ready { name, content } => raw_response(&name, content),
	133	// The only case that is neither a file nor a 404. Its body is Steid's own text,
	134	// never the repository's, so it is the one raw response that may name a type.
	135	RawFile::TooLarge { size } => Response::builder()
	136	.status(StatusCode::PAYLOAD_TOO_LARGE)
	137	.header(CONTENT_TYPE, "text/plain; charset=utf-8")
	138	.header(NOSNIFF.0, NOSNIFF.1)
	139	.body(Body::from(format!(
	140	"This file is {}, which is larger than this instance serves raw. Clone the repository to read it.\n",
	141	size_of(size)
	142	)))
	143	.map_err(server_error),
	144	}
	145	}
	146
dce0bf3feat: browse a repository's files and history8d	147	/// Reads a path in a repository, or 404.
	148	///
	149	/// Shared with the repository page, which browses the default branch at the root.
	150	pub(super) async fn browsed_at(
	151	cx: &Cx,
	152	repo: &RepoView,
	153	rev: Option<&RefName>,
	154	path: &RepoPath,
	155	) -> Result<Browsed> {
	156	Ok(browse_repo(
	157	&repo.handle,
	158	&repo.name,
	159	rev,
	160	path,
	161	&current_actor(cx).await?,
	162	&orgs(cx),
	163	&memberships(cx),
	164	&repos(cx),
	165	&queries(cx),
	166	)
	167	.await
	168	.map_err(server_error)?
	169	.ok_or_not_found()?)
	170	}
	171
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	172	/// The branches and tags of a repository the viewer can already see, or 404.
	173	///
	174	/// One extra `git` process, ~14ms, on top of the two or three a browse already
	175	/// spends — see the Milestone 5 amendment to
	176	/// [0006](../../plans/decisions/0006-git-binary-behind-narrow-ports.md). Called only by
	177	/// the pages that show the switcher, and skipped for a repository with no commits,
	178	/// where there is nothing to list.
	179	async fn refs_for(cx: &Cx, repo: &RepoView) -> Result<RefList> {
	180	Ok(list_refs(
	181	&repo.handle,
	182	&repo.name,
	183	&current_actor(cx).await?,
	184	&orgs(cx),
	185	&memberships(cx),
	186	&repos(cx),
	187	&queries(cx),
	188	)
	189	.await
	190	.map_err(server_error)?
	191	.ok_or_not_found()?)
	192	}
	193
dce0bf3feat: browse a repository's files and history8d	194	/// The tree and blob pages, which differ only in what git found at the path.
	195	///
	196	/// A component rather than a plain function because `view!` needs the request context
	197	/// in scope, and a component is how a body of markup gets it — the same reason the
	198	/// layout is a layout.
	199	#[component]
	200	async fn browsing(cx: &Cx, rev: Option<RefName>, path: RepoPath) -> Result {
	201	let repo = repo_for(cx).await?;
	202	let browsed = browsed_at(cx, &repo, rev.as_ref(), &path).await?;
	203	let clone = clone_url_for(cx, &repo);
	204
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	205	// An empty repository has no refs, so the fork is not spent asking.
	206	let refs = match browsed {
	207	Browsed::Empty => RefList::default(),
	208	_ => refs_for(cx, &repo).await?,
	209	};
	210
	211	let at = browsed_rev(&browsed);
	212	let switch = Switch::Tree(&path);
	213	let handle = repo.handle.as_str();
	214	let name = repo.name.as_str();
	215	let known = RefName::new(at).is_ok_and(\|at\| refs.contains(&at));
	216	let branches = ref_links(handle, name, &refs.branches, at, &switch);
	217	let tags = ref_links(handle, name, &refs.tags, at, &switch);
	218
dce0bf3feat: browse a repository's files and history8d	219	view! {
5d3dfa5feat: a global top bar, and pages choose their own width1d	220	wide(
0aca94efeat: a repository is one place, and its landing page says what it is19h	221	repo_header(
5d3dfa5feat: a global top bar, and pages choose their own width1d	222	repo: &repo,
	223	rev: at,
0aca94efeat: a repository is one place, and its landing page says what it is19h	224	active: Tab::Code,
5d3dfa5feat: a global top bar, and pages choose their own width1d	225	rev_switcher(current: at, known: known, branches: &branches, tags: &tags)
	226	)
	227
	228	match &browsed {
0aca94efeat: a repository is one place, and its landing page says what it is19h	229	Browsed::Empty => empty_repo(url: clone.as_str()),
5d3dfa5feat: a global top bar, and pages choose their own width1d	230	Browsed::Directory { rev, path, entries } => directory(
	231	handle: repo.handle.as_str(),
	232	name: repo.name.as_str(),
	233	rev: rev,
	234	path: path,
	235	entries: entries,
	236	),
	237	Browsed::File { rev, path, file } => blob(
	238	handle: repo.handle.as_str(),
	239	name: repo.name.as_str(),
	240	rev: rev,
	241	path: path,
	242	file: file,
	243	),
	244	}
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	245	)
dce0bf3feat: browse a repository's files and history8d	246	}
	247	}
	248
	249	/// The commit log page. A component for the same reason as [`browsing`].
	250	#[component]
	251	async fn history(cx: &Cx, rev: Option<RefName>) -> Result {
	252	let repo = repo_for(cx).await?;
	253
	254	let log = repo_log(
	255	&repo.handle,
	256	&repo.name,
	257	rev.as_ref(),
	258	&current_actor(cx).await?,
	259	&orgs(cx),
	260	&memberships(cx),
	261	&repos(cx),
	262	&queries(cx),
	263	)
	264	.await
	265	.map_err(server_error)?
	266	.ok_or_not_found()?;
	267
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	268	let refs = refs_for(cx, &repo).await?;
	269	let at = rev.as_ref().map(RefName::as_str).unwrap_or_default();
	270	let handle = repo.handle.as_str();
	271	let name = repo.name.as_str();
	272	let known = RefName::new(at).is_ok_and(\|at\| refs.contains(&at));
	273	let branches = ref_links(handle, name, &refs.branches, at, &Switch::Log);
	274	let tags = ref_links(handle, name, &refs.tags, at, &Switch::Log);
	275
dce0bf3feat: browse a repository's files and history8d	276	view! {
5d3dfa5feat: a global top bar, and pages choose their own width1d	277	wide(
0aca94efeat: a repository is one place, and its landing page says what it is19h	278	repo_header(
5d3dfa5feat: a global top bar, and pages choose their own width1d	279	repo: &repo,
	280	rev: at,
0aca94efeat: a repository is one place, and its landing page says what it is19h	281	active: Tab::Commits,
5d3dfa5feat: a global top bar, and pages choose their own width1d	282	// At the default branch the URL names no revision and `repo_log` does not
	283	// report the one it resolved, so the switcher opens with nothing marked
	284	// current rather than guessing. Noted in `plans/current.md`.
	285	rev_switcher(current: at, known: known, branches: &branches, tags: &tags)
	286	)
	287	commit_log(commits: &log)
dce0bf3feat: browse a repository's files and history8d	288	)
	289	}
	290	}
	291
	292	/// The revision a browse landed on, for display. Empty when there is none.
0aca94efeat: a repository is one place, and its landing page says what it is19h	293	pub(super) fn browsed_rev(browsed: &Browsed) -> &str {
dce0bf3feat: browse a repository's files and history8d	294	match browsed {
	295	Browsed::Empty => "",
	296	Browsed::Directory { rev, .. } \| Browsed::File { rev, .. } => rev.as_str(),
	297	}
	298	}
	299
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	300	// --- Serving bytes ----------------------------------------------------------------
	301
	302	/// The header that stops a browser second-guessing a `Content-Type`.
	303	///
	304	/// A pair rather than a constant string so the name is written once; `http` has no
	305	/// constant for it.
	306	const NOSNIFF: (&str, &str) = ("x-content-type-options", "nosniff");
	307
	308	/// What a raw file is served as.
	309	///
	310	/// Never the file's own type, and never guessed from its extension. Steid serves
	311	/// repository contents from the same origin as the application, so a file the origin
	312	/// labels `text/html` runs as this site: it reads the session cookie, calls Steid's
	313	/// own endpoints as the viewer, and rewrites the page around it. Somebody pushing
	314	/// `evil.html` would then have stored XSS on every visitor who followed a link to it.
	315	/// The same holds for SVG (scriptable), XML, and anything a browser will render.
	316	///
	317	/// Today only the repository's owner can push, so the only person who could attack a
	318	/// viewer is the person whose site it is. Milestone 7 adds other users and this endpoint
	319	/// will outlive that assumption, so the policy is written for the world where the bytes
	320	/// are hostile.
	321	///
	322	/// Four headers, each closing a different door:
	323	///
	324	/// - `application/octet-stream` — a type no browser renders. Not `text/plain`, which
	325	/// is rendered, and which older browsers have been talked into sniffing as HTML.
	326	/// - `nosniff` — without it a browser is free to ignore the type above and decide from
	327	/// the content, which is exactly the guess this policy refuses to make.
	328	/// - `Content-Disposition: attachment` — the file is saved, not shown, so nothing it
	329	/// contains is ever parsed in this origin's context. It also stops a same-origin
	330	/// `<iframe>` from rendering it.
	331	/// - `Content-Security-Policy: default-src 'none'; sandbox` — belt and braces for the
	332	/// case where one of the above is wrong or unsupported. Nothing in the response may
	333	/// load, run, or navigate.
	334	///
	335	/// The cost is that a raw URL downloads rather than displays. That is the correct trade
	336	/// for a forge serving other people's bytes, and it is what `curl` wants anyway.
	337	fn raw_response(name: &str, content: Vec<u8>) -> Result<Response<Body>> {
	338	Response::builder()
	339	.header(CONTENT_TYPE, "application/octet-stream")
	340	.header(NOSNIFF.0, NOSNIFF.1)
	341	.header(CONTENT_DISPOSITION, disposition(name))
	342	.header("content-security-policy", "default-src 'none'; sandbox")
	343	.body(Body::from(content))
	344	.map_err(server_error)
	345	}
	346
	347	/// The `Content-Disposition` for a downloaded file.
	348	///
	349	/// Two filenames, per RFC 6266: a plain `filename` every client understands, and a
	350	/// `filename*` carrying the real name as percent-encoded UTF-8 for those that do. The
	351	/// plain one is reduced to characters that cannot end the quoted string or be read as a
	352	/// header of their own — a name is repository content, so a quote or a newline in it
	353	/// would otherwise be header injection.
	354	fn disposition(name: &str) -> String {
	355	let mut safe = String::with_capacity(name.len());
	356
	357	for char in name.chars() {
	358	match char {
	359	'A'..='Z' \| 'a'..='z' \| '0'..='9' \| '.' \| '-' \| '_' => safe.push(char),
	360	_ => safe.push('_'),
	361	}
	362	}
	363
	364	// A name reduced to nothing recognisable — punctuation, or a name written entirely
	365	// in a script the plain form cannot carry — downloads as `file` rather than as
	366	// `___`. The real name is still in `filename*` for anything that reads it.
	367	if !safe.chars().any(\|char\| char.is_ascii_alphanumeric()) {
	368	safe = "file".to_owned();
	369	}
	370
	371	format!(
	372	"attachment; filename=\"{safe}\"; filename*=UTF-8''{}",
	373	encode(name, false)
	374	)
	375	}
	376
dce0bf3feat: browse a repository's files and history8d	377	// --- URLs -------------------------------------------------------------------------
	378
	379	/// The URL for a path at a revision.
	380	///
	381	/// The revision is encoded whole, slashes included, so `feature/login` stays one
	382	/// segment and the `/-/` separator keeps its meaning. The path keeps its slashes,
	383	/// because they are segments.
	384	pub(super) fn tree_url(handle: &str, name: &str, rev: &RefName, path: &RepoPath) -> String {
	385	let encoded = encode(rev.as_str(), false);
	386
	387	if path.is_root() {
	388	format!("/{handle}/repos/{name}/tree/{encoded}")
	389	} else {
	390	format!(
	391	"/{handle}/repos/{name}/tree/{encoded}/-/{}",
	392	encode(path.as_str(), true)
	393	)
	394	}
	395	}
	396
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	397	/// The URL a file's bytes are served from.
	398	///
	399	/// Always has a path: there are no raw bytes for a directory, so the root has no raw
	400	/// URL and the `/-/` separator is unconditional.
	401	pub(super) fn raw_url(handle: &str, name: &str, rev: &RefName, path: &RepoPath) -> String {
	402	format!(
	403	"/{handle}/repos/{name}/raw/{}/-/{}",
	404	encode(rev.as_str(), false),
	405	encode(path.as_str(), true)
	406	)
	407	}
	408
dce0bf3feat: browse a repository's files and history8d	409	/// The commit log's URL, at a revision or at the default branch.
0aca94efeat: a repository is one place, and its landing page says what it is19h	410	pub(super) fn log_url(handle: &str, name: &str, rev: &str) -> String {
dce0bf3feat: browse a repository's files and history8d	411	if rev.is_empty() {
	412	format!("/{handle}/repos/{name}/log")
	413	} else {
	414	format!("/{handle}/repos/{name}/log/{}", encode(rev, false))
	415	}
	416	}
	417
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	418	// --- The revision switcher --------------------------------------------------------
	419
	420	/// Which page a switcher's links lead back to.
	421	///
	422	/// Switching branch keeps you where you are: the same path on the tree, the log on the
	423	/// log. A path that does not exist on the revision you picked lands on a 404, which is
	424	/// the honest answer — the alternative is silently sending you somewhere you did not
	425	/// ask for.
	426	enum Switch<'a> {
	427	Tree(&'a RepoPath),
	428	Log,
	429	}
	430
	431	/// One row of the switcher.
	432	struct RefLink {
	433	name: String,
	434	href: String,
	435	current: bool,
	436	}
	437
	438	fn ref_links(
	439	handle: &str,
	440	name: &str,
	441	refs: &[RefName],
	442	current: &str,
	443	switch: &Switch,
	444	) -> Vec<RefLink> {
	445	refs.iter()
	446	.map(\|git_ref\| RefLink {
	447	name: git_ref.to_string(),
	448	href: match switch {
	449	Switch::Tree(path) => tree_url(handle, name, git_ref, path),
	450	Switch::Log => log_url(handle, name, git_ref.as_str()),
	451	},
	452	current: git_ref.as_str() == current,
	453	})
	454	.collect()
	455	}
	456
	457	/// Whether a revision is an object id rather than a name.
	458	///
	459	/// A heuristic, and only used for display: the worst it can do is abbreviate a branch
	460	/// somebody named `deadbeef`.
	461	fn is_object_id(rev: &str) -> bool {
	462	rev.len() >= 7 && rev.len() <= 64 && rev.chars().all(\|char\| char.is_ascii_hexdigit())
	463	}
	464
	465	/// How the switcher labels the revision it is on.
	466	///
	467	/// A ref by its name; a commit browsed directly by its abbreviation, because forty
	468	/// characters of hex in a control reads as noise and is not a branch.
	469	fn rev_label(rev: &str, known: bool) -> String {
	470	if !known && is_object_id(rev) {
	471	rev[..7].to_owned()
	472	} else {
	473	rev.to_owned()
	474	}
	475	}
	476
dce0bf3feat: browse a repository's files and history8d	477	/// Percent-encodes a URL segment.
	478	///
	479	/// Hand-rolled rather than pulled in as a dependency: it is the unreserved set from
	480	/// RFC 3986 and nothing else. `keep_slash` is the difference between a path, whose
	481	/// slashes are structure, and a revision, whose slashes are part of its name.
	482	fn encode(value: &str, keep_slash: bool) -> String {
	483	let mut encoded = String::with_capacity(value.len());
	484
	485	for byte in value.bytes() {
	486	match byte {
	487	b'A'..=b'Z' \| b'a'..=b'z' \| b'0'..=b'9' \| b'-' \| b'_' \| b'.' \| b'~' => {
	488	encoded.push(byte as char);
	489	}
	490	b'/' if keep_slash => encoded.push('/'),
	491	other => encoded.push_str(&format!("%{other:02X}")),
	492	}
	493	}
	494
	495	encoded
	496	}
	497
	498	// --- Formatting -------------------------------------------------------------------
	499
	500	/// A file size, rounded for reading rather than for accounting.
	501	fn size_of(bytes: u64) -> String {
	502	const UNITS: [&str; 4] = ["KB", "MB", "GB", "TB"];
	503
	504	if bytes < 1024 {
	505	return format!("{bytes} B");
	506	}
	507
	508	let mut value = bytes as f64 / 1024.0;
	509	let mut unit = UNITS[0];
	510
	511	for next in &UNITS[1..] {
	512	if value < 1024.0 {
	513	break;
	514	}
	515
	516	value /= 1024.0;
	517	unit = next;
	518	}
	519
	520	format!("{value:.1} {unit}")
	521	}
	522
	523	/// How long ago something happened, in words.
	524	///
	525	/// A commit's timestamp comes from whoever made it, so it can sit in the future — a
	526	/// skewed clock, or a rewritten history. That reads as "just now" rather than as a
	527	/// negative duration.
ef23868feat: rebuild the profile page on flat navigation7d	528	pub(super) fn ago(time: SystemTime) -> String {
dce0bf3feat: browse a repository's files and history8d	529	let Ok(elapsed) = SystemTime::now().duration_since(time) else {
	530	return "just now".to_owned();
	531	};
	532
	533	let seconds = elapsed.as_secs();
	534
	535	let (count, unit) = match seconds {
	536	0..=59 => return "just now".to_owned(),
	537	60..=3599 => (seconds / 60, "minute"),
	538	3600..=86_399 => (seconds / 3600, "hour"),
	539	86_400..=2_591_999 => (seconds / 86_400, "day"),
	540	2_592_000..=31_535_999 => (seconds / 2_592_000, "month"),
	541	_ => (seconds / 31_536_000, "year"),
	542	};
	543
	544	if count == 1 {
	545	format!("1 {unit} ago")
	546	} else {
	547	format!("{count} {unit}s ago")
	548	}
	549	}
	550
	551	/// The exact time, for the tooltip behind [`ago`].
	552	fn timestamp(time: SystemTime) -> String {
	553	let seconds = time
	554	.duration_since(UNIX_EPOCH)
	555	.map(\|since\| since.as_secs() as i64)
	556	.unwrap_or(0);
	557
	558	let (year, month, day) = civil_from_days(seconds.div_euclid(86_400));
	559	let rest = seconds.rem_euclid(86_400);
	560
	561	format!(
	562	"{year:04}-{month:02}-{day:02} {:02}:{:02} UTC",
	563	rest / 3600,
	564	(rest % 3600) / 60
	565	)
	566	}
	567
	568	/// Days since the epoch to a calendar date, by Howard Hinnant's `civil_from_days`.
	569	///
	570	/// Written out rather than taken as a dependency: this is the whole of the date
	571	/// handling Steid needs, and a date library is a large thing to add for one function.
	572	fn civil_from_days(days: i64) -> (i64, u32, u32) {
	573	// Shift the epoch to 0000-03-01, which puts the leap day at the end of the year.
	574	let shifted = days + 719_468;
	575	let era = shifted.div_euclid(146_097);
	576	let day_of_era = shifted.rem_euclid(146_097);
	577
	578	let year_of_era =
	579	(day_of_era - day_of_era / 1460 + day_of_era / 36_524 - day_of_era / 146_096) / 365;
	580	let year = year_of_era + era * 400;
	581	let day_of_year = day_of_era - (365 * year_of_era + year_of_era / 4 - year_of_era / 100);
	582
	583	let shifted_month = (5 * day_of_year + 2) / 153;
	584	let day = (day_of_year - (153 * shifted_month + 2) / 5 + 1) as u32;
	585	let month = if shifted_month < 10 {
	586	shifted_month + 3
	587	} else {
	588	shifted_month - 9
	589	} as u32;
	590
	591	(if month <= 2 { year + 1 } else { year }, month, day)
	592	}
	593
	594	// --- Views ------------------------------------------------------------------------
	595
0aca94efeat: a repository is one place, and its landing page says what it is19h	596	/// The row above the file list on a repository's landing page.
dce0bf3feat: browse a repository's files and history8d	597	///
0aca94efeat: a repository is one place, and its landing page says what it is19h	598	/// The revision switcher, then what else the repository has. The counts are **plain
	599	/// text, not links**: `/{handle}/repos/{name}/branches` and `/tags` are the URLs they
	600	/// will get, and neither page exists yet — a dead link is worse than a number. The
	601	/// right of the row is deliberately empty; a code-search box lands there.
dce0bf3feat: browse a repository's files and history8d	602	#[component]
0aca94efeat: a repository is one place, and its landing page says what it is19h	603	pub(super) async fn repo_toolbar(
	604	handle: &str,
	605	name: &str,
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	606	rev: &str,
0aca94efeat: a repository is one place, and its landing page says what it is19h	607	path: &RepoPath,
	608	refs: &RefList,
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	609	) -> Result {
0aca94efeat: a repository is one place, and its landing page says what it is19h	610	let known = RefName::new(rev).is_ok_and(\|at\| refs.contains(&at));
	611	let switch = Switch::Tree(path);
	612	let branches = ref_links(handle, name, &refs.branches, rev, &switch);
	613	let tags = ref_links(handle, name, &refs.tags, rev, &switch);
dce0bf3feat: browse a repository's files and history8d	614
	615	view! {
0aca94efeat: a repository is one place, and its landing page says what it is19h	616	<div class="mb-2 flex flex-wrap items-center gap-x-3 gap-y-2">
	617	rev_switcher(current: rev, known: known, branches: &branches, tags: &tags)
	618	<span class="inline-flex items-center gap-1.5 text-xs text-muted-foreground">
	619	icon(data: iconify_icon!("feather:git-branch"), attrs: attributes! {
	620	class="size-3.5"
	621	})
	622	<span class="font-mono">(counted(refs.branches.len(), "branch", "branches"))</span>
	623	"·"
	624	<span class="font-mono">(counted(refs.tags.len(), "tag", "tags"))</span>
	625	</span>
	626	</div>
dce0bf3feat: browse a repository's files and history8d	627	}
	628	}
	629
0aca94efeat: a repository is one place, and its landing page says what it is19h	630	/// A count and the thing it counts, pluralised.
	631	fn counted(count: usize, one: &str, many: &str) -> String {
	632	format!("{count} {}", if count == 1 { one } else { many })
	633	}
	634
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	635	/// The branch and tag picker.
	636	///
	637	/// A `<details>` disclosure, so it opens and closes with no scripting — the rest of
	638	/// Steid works without JavaScript and a navigation control is the last place to start
	639	/// requiring it. Every entry is a plain link, so it is also the whole keyboard and
	640	/// screen-reader story for free.
	641	///
	642	/// Renders nothing at all when there is neither a revision nor a ref to offer, which is
	643	/// an empty repository.
	644	#[component]
	645	async fn rev_switcher(
	646	current: &str,
	647	known: bool,
	648	branches: &[RefLink],
	649	tags: &[RefLink],
	650	) -> Result {
	651	let label = rev_label(current, known);
	652	let empty = branches.is_empty() && tags.is_empty();
	653
	654	view! {
	655	if empty {
	656	// Nothing to switch to, so the control degrades to what it replaced: a
	657	// statement of where you are.
	658	if !current.is_empty() {
	659	<span class="inline-flex items-center gap-1.5 font-mono text-xs text-muted-foreground">
	660	icon(data: iconify_icon!("feather:git-branch"), attrs: attributes! {
	661	class="size-3.5"
	662	})
	663	(label)
	664	</span>
	665	}
	666	} else {
	667	<details class="group relative inline-block">
	668	<summary class="inline-flex cursor-pointer list-none items-center gap-1.5 rounded-lg border border-border px-2.5 py-1 font-mono text-xs text-muted-foreground hover:text-foreground [&::-webkit-details-marker]:hidden">
	669	icon(
	670	data: if known {
	671	iconify_icon!("feather:git-branch")
	672	} else {
	673	iconify_icon!("feather:git-commit")
	674	},
	675	attrs: attributes! { class="size-3.5" },
	676	)
	677	(if label.is_empty() { "Revision" } else { label.as_str() })
	678	icon(
	679	data: iconify_icon!("feather:chevron-down"),
	680	attrs: attributes! {
	681	class="size-3.5 transition-transform group-open:rotate-180"
	682	},
	683	)
	684	</summary>
	685
	686	<div class="absolute right-0 z-20 mt-1 max-h-80 w-64 overflow-y-auto rounded-lg border border-border bg-background p-1 shadow-lg">
	687	if !known && !current.is_empty() {
	688	<p class="px-2 py-1.5 font-mono text-xs text-muted-foreground">
	689	"At commit " (label)
	690	</p>
	691	}
	692
	693	ref_group(title: "Branches", links: branches)
	694	ref_group(title: "Tags", links: tags)
	695	</div>
	696	</details>
	697	}
	698	}
	699	}
	700
	701	/// One labelled section of the switcher, omitted entirely when it is empty.
	702	///
	703	/// The heading is what tells a branch from a tag; nothing else in the list does, and
	704	/// picking a tag when you meant a branch of the same name is a confusing way to end up
	705	/// on the wrong tree.
	706	#[component]
	707	async fn ref_group(title: &str, links: &[RefLink]) -> Result {
	708	view! {
	709	if !links.is_empty() {
	710	<p class="px-2 pt-1.5 pb-1 text-xs font-medium uppercase tracking-wider text-muted-foreground">
	711	(title)
	712	</p>
	713	<ul>
	714	for link in links {
	715	<li>
	716	<a
	717	href=(&link.href)
	718	class=(format!(
	719	"flex items-center gap-2 rounded-md px-2 py-1.5 font-mono text-sm hover:bg-foreground/5 {}",
	720	if link.current { "font-medium" } else { "" },
	721	))
	722	>
	723	<span class="truncate">(&link.name)</span>
	724	if link.current {
	725	<span class="ml-auto text-muted-foreground">
	726	icon(
	727	data: iconify_icon!("feather:check"),
	728	label: "Current",
	729	attrs: attributes! { class="size-3.5" },
	730	)
	731	</span>
	732	}
	733	</a>
	734	</li>
	735	}
	736	</ul>
	737	}
	738	}
	739	}
	740
dce0bf3feat: browse a repository's files and history8d	741	/// What a repository with no commits offers instead of a listing.
	742	///
	743	/// This is the state every freshly-created repository is in, so it is the first thing
	744	/// its owner sees — the snippet is the point of the page, not decoration.
	745	#[component]
	746	pub(super) async fn empty_repo(url: &str) -> Result {
	747	let push = format!("git remote add origin {url}\ngit branch -M main\ngit push -u origin main");
	748
	749	view! {
0aca94efeat: a repository is one place, and its landing page says what it is19h	750	<div class="rounded-lg border border-border px-4 py-5">
dce0bf3feat: browse a repository's files and history8d	751	<p class="text-sm text-muted-foreground">
	752	"This repository has no commits yet. Push one to see it here."
	753	</p>
	754	<p class="mt-4 text-xs font-medium uppercase tracking-wider text-muted-foreground">
	755	"Push an existing repository"
	756	</p>
0aca94efeat: a repository is one place, and its landing page says what it is19h	757	<pre class="mt-2 overflow-x-auto rounded-lg border border-border bg-surface px-4 py-3 font-mono text-sm">(push)</pre>
dce0bf3feat: browse a repository's files and history8d	758	</div>
	759	}
	760	}
	761
	762	/// The path you are at, with every ancestor linked.
	763	///
	764	/// The main way anyone moves around a tree: the last component is the current page and
	765	/// is deliberately not a link, so the trail reads as a position rather than a menu.
	766	#[component]
	767	async fn crumbs(handle: &str, name: &str, rev: &RefName, path: &RepoPath) -> Result {
	768	let parts: Vec<&str> = path.components().collect();
	769	let mut walked = RepoPath::root();
	770	let mut trail: Vec<(String, String)> = Vec::new();
	771
	772	for (index, part) in parts.iter().enumerate() {
	773	walked = walked.join(part);
	774
	775	let href = if index + 1 == parts.len() {
	776	String::new()
	777	} else {
	778	tree_url(handle, name, rev, &walked)
	779	};
	780
	781	trail.push(((*part).to_owned(), href));
	782	}
	783
	784	view! {
	785	<div class="flex flex-wrap items-center gap-1 font-mono text-sm">
	786	<a
	787	href=(tree_url(handle, name, rev, &RepoPath::root()))
	788	class="text-muted-foreground hover:text-foreground"
	789	>(name)</a>
	790
	791	for (part, href) in &trail {
	792	<span class="text-muted-foreground">"/"</span>
	793	match href.is_empty() {
	794	true => <span class="font-medium">(part)</span>,
	795	false => <a href=(href) class="text-muted-foreground hover:text-foreground">(part)</a>,
	796	}
	797	}
	798	</div>
	799	}
	800	}
	801
	802	/// A directory listing.
	803	///
	804	/// Entries arrive ordered by the use case — directories first, then case-insensitively
	805	/// by name — so nothing here re-sorts them.
	806	#[component]
	807	pub(super) async fn directory(
	808	handle: &str,
	809	name: &str,
	810	rev: &RefName,
	811	path: &RepoPath,
	812	entries: &[TreeEntry],
	813	) -> Result {
	814	view! {
	815	<div class="overflow-hidden rounded-lg border border-border">
	816	<div class="border-b border-border px-4 py-2.5">
	817	crumbs(handle: handle, name: name, rev: rev, path: path)
	818	</div>
	819
	820	if entries.is_empty() {
	821	<p class="px-4 py-6 text-center text-sm text-muted-foreground">
	822	"This directory is empty."
	823	</p>
	824	} else {
	825	<ul class="divide-y divide-border text-sm">
	826	match path.parent() {
	827	Some(parent) => <li class="px-4 py-2">
	828	<a
	829	href=(tree_url(handle, name, rev, &parent))
	830	class="inline-flex items-center gap-2 font-mono text-muted-foreground hover:text-foreground"
	831	>
	832	icon(data: iconify_icon!("feather:corner-left-up"), attrs: attributes! {
	833	class="size-4"
	834	})
	835	".."
	836	</a>
	837	</li>,
	838	None => "",
	839	}
	840
	841	for entry in entries {
	842	<li class="flex items-center gap-3 px-4 py-2">
	843	entry_row(
	844	handle: handle,
	845	name: name,
	846	rev: rev,
	847	path: path,
	848	entry: entry,
	849	)
	850	</li>
	851	}
	852	</ul>
	853	}
	854	</div>
	855	}
	856	}
	857
	858	/// One entry in a listing.
	859	///
	860	/// A symlink and a submodule are their own kinds, not files: a submodule is another
	861	/// repository Steid cannot look inside, so it is labelled and left unlinked rather
	862	/// than offered as a click that would 404.
	863	#[component]
	864	async fn entry_row(
	865	handle: &str,
	866	name: &str,
	867	rev: &RefName,
	868	path: &RepoPath,
	869	entry: &TreeEntry,
	870	) -> Result {
	871	let href = tree_url(handle, name, rev, &path.join(&entry.name));
	872	let linkable = entry.kind != EntryKind::Submodule;
	873
	874	view! {
	875	<span class="text-muted-foreground">
	876	match entry.kind {
	877	EntryKind::Tree => icon(
	878	data: iconify_icon!("feather:folder"),
	879	label: "Directory",
	880	attrs: attributes! { class="size-4" },
	881	),
	882	EntryKind::Blob => icon(
	883	data: iconify_icon!("feather:file"),
	884	label: "File",
	885	attrs: attributes! { class="size-4" },
	886	),
	887	EntryKind::Symlink => icon(
	888	data: iconify_icon!("feather:link-2"),
	889	label: "Symlink",
	890	attrs: attributes! { class="size-4" },
	891	),
	892	EntryKind::Submodule => icon(
	893	data: iconify_icon!("feather:package"),
	894	label: "Submodule",
	895	attrs: attributes! { class="size-4" },
	896	),
	897	}
	898	</span>
	899
	900	match linkable {
	901	true => <a
	902	href=(href)
	903	class=(if entry.kind.is_tree() {
	904	"font-mono font-medium hover:underline"
	905	} else {
	906	"font-mono hover:underline"
	907	})
	908	>(&entry.name)</a>,
	909	false => <span class="font-mono">(&entry.name)</span>,
	910	}
	911
	912	match entry.kind {
	913	EntryKind::Symlink => badge(variant: BadgeVariant::Outline, "symlink"),
	914	EntryKind::Submodule => badge(variant: BadgeVariant::Outline, "submodule"),
	915	_ => "",
	916	}
	917
	918	<span class="ml-auto font-mono text-xs text-muted-foreground">
	919	match entry.size {
	920	Some(size) => (size_of(size)),
	921	None if entry.kind == EntryKind::Submodule => (entry.id.short()),
	922	None => "",
	923	}
	924	</span>
	925	}
	926	}
	927
	928	/// A single file.
	929	///
	930	/// Three outcomes, all of them a page rather than an error: text, something that is not
	931	/// text, and something too big to be worth rendering. The last says how big, because
	932	/// that is the only useful thing left to say about it.
	933	#[component]
	934	pub(super) async fn blob(
	935	handle: &str,
	936	name: &str,
	937	rev: &RefName,
	938	path: &RepoPath,
	939	file: &FileView,
	940	) -> Result {
	941	view! {
	942	<div class="overflow-hidden rounded-lg border border-border">
	943	<div class="flex flex-wrap items-center justify-between gap-3 border-b border-border px-4 py-2.5">
	944	crumbs(handle: handle, name: name, rev: rev, path: path)
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	945	<span class="flex items-center gap-3 font-mono text-xs text-muted-foreground">
	946	(size_of(file.size))
	947	// The way out for anything the page cannot show — a binary, an
	948	// oversized file — and the URL to hand to `curl`.
	949	<a
	950	href=(raw_url(handle, name, rev, path))
	951	class="inline-flex items-center gap-1 hover:text-foreground"
	952	>
	953	icon(data: iconify_icon!("feather:download"), attrs: attributes! {
	954	class="size-3.5"
	955	})
	956	"Raw"
	957	</a>
	958	</span>
dce0bf3feat: browse a repository's files and history8d	959	</div>
	960
	961	match &file.text {
979134bfeat: code reads as code, in classes rather than colours19h	962	Some(text) => source(
	963	text: text.as_str(),
	964	file_name: path.file_name().unwrap_or_default(),
	965	),
dce0bf3feat: browse a repository's files and history8d	966	None if file.too_large => <p class="px-4 py-6 text-center text-sm text-muted-foreground">
	967	"This file is " (size_of(file.size)) ", which is too large to display. Clone the repository to read it."
	968	</p>,
	969	None => <p class="px-4 py-6 text-center text-sm text-muted-foreground">
	970	"This file cannot be displayed as text."
	971	</p>,
	972	}
	973	</div>
	974	}
	975	}
	976
	977	/// A file's contents, with line numbers.
	978	///
	979	/// A table rather than a `<pre>` with a gutter: the numbers stay put when the code
	980	/// scrolls sideways, and selecting the code does not drag the numbers along with it.
979134bfeat: code reads as code, in classes rather than colours19h	981	///
	982	/// Highlighting only ever changes what is inside the code cell — the rows, the
	983	/// numbers and the scroll container are the same whether a language was recognised or
	984	/// not, so nothing else on the page has to know.
dce0bf3feat: browse a repository's files and history8d	985	#[component]
979134bfeat: code reads as code, in classes rather than colours19h	986	async fn source(text: &str, file_name: &str) -> Result {
	987	let Source { lines, too_large } = source_lines(file_name, text);
	988
dce0bf3feat: browse a repository's files and history8d	989	view! {
979134bfeat: code reads as code, in classes rather than colours19h	990	if too_large {
	991	<p class="border-b border-border px-4 py-1.5 font-mono text-xs text-muted-foreground">
	992	"Too large to highlight — shown as plain text."
	993	</p>
	994	}
	995
dce0bf3feat: browse a repository's files and history8d	996	<div class="overflow-x-auto">
	997	<table class="w-full border-collapse font-mono text-xs leading-relaxed">
	998	<tbody>
979134bfeat: code reads as code, in classes rather than colours19h	999	for (index, line) in lines.into_iter().enumerate() {
dce0bf3feat: browse a repository's files and history8d	1000	<tr>
	1001	<td class="w-px select-none border-r border-border px-3 text-right align-top text-muted-foreground">
	1002	((index + 1).to_string())
	1003	</td>
	1004	<td class="whitespace-pre px-4 align-top">
979134bfeat: code reads as code, in classes rather than colours19h	1005	match line {
	1006	// Markup this codebase wrote: `highlight` escapes
	1007	// the source itself and emits nothing but spans.
	1008	SourceLine::Classed(html) => (Unescaped::new_unchecked(html)),
	1009	SourceLine::Plain(text) => (text),
	1010	}
dce0bf3feat: browse a repository's files and history8d	1011	</td>
	1012	</tr>
	1013	}
	1014	</tbody>
	1015	</table>
	1016	</div>
	1017	}
	1018	}
	1019
	1020	/// The commit log — the most recent commits, newest first, and no paging in v1.
	1021	#[component]
	1022	async fn commit_log(commits: &[CommitSummary]) -> Result {
	1023	view! {
	1024	if commits.is_empty() {
	1025	<p class="rounded-lg border border-border px-4 py-10 text-center text-sm text-muted-foreground">
	1026	"No commits yet."
	1027	</p>
	1028	} else {
	1029	<ul class="divide-y divide-border rounded-lg border border-border">
	1030	for commit in commits {
	1031	<li class="px-4 py-3">
	1032	<div class="flex items-baseline justify-between gap-4">
	1033	<p class="text-sm font-medium">(&commit.summary)</p>
	1034	<code class="shrink-0 font-mono text-xs text-muted-foreground">
	1035	(commit.id.short())
	1036	</code>
	1037	</div>
	1038	<p class="mt-1 text-xs text-muted-foreground">
	1039	(&commit.author_name)
	1040	" committed "
	1041	<span title=(timestamp(commit.committed_at))>(ago(commit.committed_at))</span>
	1042	</p>
	1043	</li>
	1044	}
	1045	</ul>
	1046	}
	1047	}
	1048	}
	1049
	1050	#[cfg(test)]
	1051	mod tests {
	1052	use std::time::Duration;
	1053
	1054	use super::*;
	1055
	1056	fn rev(value: &str) -> RefName {
	1057	RefName::new(value).expect("valid revision")
	1058	}
	1059
	1060	#[test]
	1061	fn a_root_tree_url_has_no_separator() {
	1062	assert_eq!(
	1063	tree_url("ada", "steid", &rev("main"), &RepoPath::root()),
	1064	"/ada/repos/steid/tree/main"
	1065	);
	1066	}
	1067
	1068	#[test]
	1069	fn a_path_follows_the_separator_with_its_slashes_intact() {
	1070	let path = RepoPath::new("src/domain/repo.rs").expect("valid");
	1071
	1072	assert_eq!(
	1073	tree_url("ada", "steid", &rev("main"), &path),
	1074	"/ada/repos/steid/tree/main/-/src/domain/repo.rs"
	1075	);
	1076	}
	1077
	1078	#[test]
	1079	fn a_revisions_slashes_are_encoded_so_it_stays_one_segment() {
	1080	// Otherwise `feature/login` would look like a revision plus a path, which is
	1081	// the ambiguity the separator exists to remove.
	1082	assert_eq!(
	1083	tree_url("ada", "steid", &rev("feature/login"), &RepoPath::root()),
	1084	"/ada/repos/steid/tree/feature%2Flogin"
	1085	);
	1086	}
	1087
	1088	#[test]
	1089	fn names_needing_escaping_are_encoded() {
	1090	let path = RepoPath::new("docs/a b#c.md").expect("valid");
	1091
	1092	assert_eq!(
	1093	tree_url("ada", "steid", &rev("main"), &path),
	1094	"/ada/repos/steid/tree/main/-/docs/a%20b%23c.md"
	1095	);
	1096	}
	1097
	1098	#[test]
	1099	fn the_log_url_is_the_default_branch_when_no_revision_is_named() {
	1100	assert_eq!(log_url("ada", "steid", ""), "/ada/repos/steid/log");
	1101	assert_eq!(
	1102	log_url("ada", "steid", "feature/login"),
	1103	"/ada/repos/steid/log/feature%2Flogin"
	1104	);
	1105	}
	1106
4ef3945feat: repository settings, README rendering, branch switcher, raw files7d	1107	#[test]
	1108	fn a_raw_url_always_carries_a_path() {
	1109	let path = RepoPath::new("src/main.rs").expect("valid");
	1110
	1111	assert_eq!(
	1112	raw_url("ada", "steid", &rev("main"), &path),
	1113	"/ada/repos/steid/raw/main/-/src/main.rs"
	1114	);
	1115	assert_eq!(
	1116	raw_url("ada", "steid", &rev("feature/login"), &path),
	1117	"/ada/repos/steid/raw/feature%2Flogin/-/src/main.rs"
	1118	);
	1119	}
	1120
	1121	#[test]
	1122	fn a_raw_response_carries_the_whole_policy() {
	1123	let response = raw_response("notes.txt", b"hello".to_vec()).expect("should build");
	1124	let header = \|name: &str\| {
	1125	response
	1126	.headers()
	1127	.get(name)
	1128	.and_then(\|value\| value.to_str().ok())
	1129	.unwrap_or_default()
	1130	.to_owned()
	1131	};
	1132
	1133	// Each of these is load-bearing on its own; see `raw_response`.
	1134	assert_eq!(header("content-type"), "application/octet-stream");
	1135	assert_eq!(header("x-content-type-options"), "nosniff");
	1136	assert!(header("content-disposition").starts_with("attachment;"));
	1137	assert_eq!(
	1138	header("content-security-policy"),
	1139	"default-src \'none\'; sandbox"
	1140	);
	1141	}
	1142
	1143	#[test]
	1144	fn a_disposition_carries_both_spellings_of_the_name() {
	1145	assert_eq!(
	1146	disposition("notes.txt"),
	1147	"attachment; filename=\"notes.txt\"; filename*=UTF-8\'\'notes.txt"
	1148	);
	1149	}
	1150
	1151	#[test]
	1152	fn a_disposition_cannot_be_escaped_by_a_filename() {
	1153	// A file name is repository content, so it is somebody else\'s input arriving
	1154	// in a header. A quote would end the quoted string and a newline would start a
	1155	// header of its own.
	1156	let hostile = disposition("a\"; x=1\r\nSet-Cookie: nope=1");
	1157
	1158	assert!(!hostile.contains('\r'));
	1159	assert!(!hostile.contains('\n'));
	1160	assert_eq!(hostile.matches('"').count(), 2);
	1161	}
	1162
	1163	#[test]
	1164	fn a_nameless_file_still_downloads_as_something() {
	1165	assert!(disposition("...").starts_with("attachment; filename=\"file\""));
	1166	}
	1167
	1168	#[test]
	1169	fn a_non_ascii_name_survives_in_the_extended_form() {
	1170	let value = disposition("日本語.txt");
	1171
	1172	// The plain form is reduced to what a header can carry safely; the real name
	1173	// rides along percent-encoded, which is what a modern client uses.
	1174	assert!(value.contains("filename=\"___.txt\""));
	1175	assert!(value.contains("filename*=UTF-8\'\'%E6%97%A5%E6%9C%AC%E8%AA%9E.txt"));
	1176	}
	1177
	1178	#[test]
	1179	fn the_switcher_marks_the_revision_it_is_on() {
	1180	let refs = [RefName::from_trusted("main"), RefName::from_trusted("next")];
	1181	let path = RepoPath::new("src").expect("valid");
	1182	let links = ref_links("ada", "steid", &refs, "next", &Switch::Tree(&path));
	1183
	1184	assert_eq!(links[0].href, "/ada/repos/steid/tree/main/-/src");
	1185	assert!(!links[0].current);
	1186	assert!(links[1].current);
	1187	}
	1188
	1189	#[test]
	1190	fn switching_from_the_log_stays_on_the_log() {
	1191	let refs = [RefName::from_trusted("v1.0")];
	1192	let links = ref_links("ada", "steid", &refs, "main", &Switch::Log);
	1193
	1194	assert_eq!(links[0].href, "/ada/repos/steid/log/v1.0");
	1195	}
	1196
	1197	#[test]
	1198	fn an_object_id_is_labelled_as_a_commit_rather_than_a_branch() {
	1199	let id = "0123456789abcdef0123456789abcdef01234567";
	1200
	1201	assert!(is_object_id(id));
	1202	assert_eq!(rev_label(id, false), "0123456");
	1203	// A branch that happens to look like hex is still shown by its name.
	1204	assert_eq!(rev_label("deadbeef", true), "deadbeef");
	1205	assert_eq!(rev_label("main", false), "main");
	1206	}
	1207
dce0bf3feat: browse a repository's files and history8d	1208	#[test]
	1209	fn sizes_read_as_sizes() {
	1210	assert_eq!(size_of(0), "0 B");
	1211	assert_eq!(size_of(999), "999 B");
	1212	assert_eq!(size_of(1024), "1.0 KB");
	1213	assert_eq!(size_of(1_048_576), "1.0 MB");
	1214	assert_eq!(size_of(1_572_864), "1.5 MB");
	1215	}
	1216
	1217	#[test]
	1218	fn elapsed_time_reads_as_words() {
	1219	let now = SystemTime::now();
	1220	let since = \|seconds\| ago(now - Duration::from_secs(seconds));
	1221
	1222	assert_eq!(since(5), "just now");
	1223	assert_eq!(since(60), "1 minute ago");
	1224	assert_eq!(since(7200), "2 hours ago");
	1225	assert_eq!(since(86_400 * 3), "3 days ago");
	1226	assert_eq!(since(86_400 * 400), "1 year ago");
	1227	}
	1228
	1229	#[test]
	1230	fn a_commit_from_the_future_reads_as_now_rather_than_as_a_negative() {
	1231	// A commit carries whoever made it's clock, so this happens.
	1232	assert_eq!(
	1233	ago(SystemTime::now() + Duration::from_secs(3600)),
	1234	"just now"
	1235	);
	1236	}
	1237
	1238	#[test]
	1239	fn timestamps_are_utc_calendar_dates() {
	1240	assert_eq!(
	1241	timestamp(UNIX_EPOCH + Duration::from_secs(0)),
	1242	"1970-01-01 00:00 UTC"
	1243	);
	1244	// 2026-08-29T12:34:00Z
	1245	assert_eq!(
	1246	timestamp(UNIX_EPOCH + Duration::from_secs(1_788_006_840)),
	1247	"2026-08-29 12:34 UTC"
	1248	);
	1249	// A leap day, which is what the calendar arithmetic exists to get right.
	1250	assert_eq!(
	1251	timestamp(UNIX_EPOCH + Duration::from_secs(1_709_164_800)),
	1252	"2024-02-29 00:00 UTC"
	1253	);
	1254	}
	1255	}