hanna/fabrica

feat(web): repository browsing — tree, blob, branches, tags, commits

3befe49 · hanna committed on 2026-07-25

Add the repo views over the git read layer. Variable-length repo paths
resolve through a single /{owner}/{*rest} catch-all that splits on the
GitLab /-/ separator; access is checked once via auth::access, and no
access to a private repo renders 404 (never 403) so existence never
leaks. libgit2 reads run on the blocking pool, opened per operation.

- User page and group listings; repo home renders the root tree plus a
  sanitized (comrak + ammonia) README.
- Tree browsing with breadcrumbs; blob view with line-number anchors and
  syntax highlighting (honouring the .gitattributes language override);
  raw endpoint served as text/plain (nosniff) or the real image type.
- Branches (ahead/behind), tags, and a commit list with Verified/
  Unverified signature badges verified against all registered keys.

Repo sub-header with tabs and an HTTPS clone URL. Store gains
collaborator_permission and all_keys. Verified end-to-end against a live
server with a pushed repo; 17 handler tests incl. the private-repo-404
invariant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +225 −0

Cargo.toml +3 −0

assets/base.css +87 −0

crates/store/src/keys.rs +17 −0

crates/store/src/repos.rs +21 −0

crates/web/Cargo.toml +2 −0

crates/web/src/lib.rs +5 −0

crates/web/src/markdown.rs +50 −0

crates/web/src/pages.rs +1 −1

crates/web/src/repo.rs +885 −0

crates/web/src/tests.rs +31 −1

 rust-embed = "8"
 mime_guess = "2"
 time = "0.3"
+# Markdown rendering (GFM) + HTML sanitization for READMEs and comments.
+comrak = { version = "0.54", default-features = false }
+ammonia = "4"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }

   color: var(--fb-fg-muted);
+}
+/* ---- Repo views ---- */
+.repo-head {
+  border-bottom: 1px solid var(--fb-border);
+  padding-bottom: 0.75rem;
+  margin-bottom: 1rem;
+}
+.repo-slug {
+  font-size: 1.4rem;
+  font-weight: 400;
+}
+.repo-slug a {
+  color: var(--fb-accent);
+}
+.repo-tabs {
+  margin: 0.5rem 0;
+}
+.ref-row,
+.clone-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+  margin-top: 0.5rem;
+}
+.clone-row input {
+  max-width: 30rem;
+  font-family: var(--fb-font-mono);
+  font-size: 0.85em;
+}
+.breadcrumb {
+  margin-bottom: 0.75rem;
+  font-family: var(--fb-font-mono);
+}
+table.tree td {
+  padding: 0.3rem 0.6rem;
+  border-bottom: 1px solid var(--fb-border);
+}
+.tree-icon {
+  width: 1.5rem;
+  text-align: center;
+}
+.blob-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 0.5rem 0.75rem;
+  background: var(--fb-bg-raised);
+  border: 1px solid var(--fb-border);
+  border-bottom: none;
+  border-radius: var(--fb-radius) var(--fb-radius) 0 0;
+}
+.blob-header .btn {
+  padding: 0.2rem 0.5rem;
+}
+table.blob {
+  width: 100%;
+  border-collapse: collapse;
+  border: 1px solid var(--fb-border);
+  border-radius: 0 0 var(--fb-radius) var(--fb-radius);
+  font-family: var(--fb-font-mono);
+  font-size: 0.85rem;
+  background: var(--fb-bg-inset);
+  overflow-x: auto;
+}
+table.blob td.lineno {
+  width: 1%;
+  min-width: 3rem;
+  text-align: right;
+  padding: 0 0.75rem;
+  color: var(--fb-fg-muted);
+  user-select: none;
+  vertical-align: top;
+}
+table.blob td.lineno a {
+  color: inherit;
+}
+table.blob td.code-line {
+  padding: 0 0.75rem;
+  white-space: pre;
+  tab-size: 4;
+}
+table.blob tr:target {
+  background: var(--fb-diff-add-bg);
+}
 /* ---- Footer ---- */
 .footer {
   max-width: 76rem;

             .map_err(Into::into)
+    }
+    /// Every registered key on the instance, for signature verification (the
+    /// signer may be any registered user).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn all_keys(&self) -> Result<Vec<Key>, StoreError> {
+        let sql = format!("SELECT {KEY_COLUMNS} FROM keys");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(map_key)
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
     /// Fetch a user's key by its 1-based ordinal, or `None`.
     ///
     /// # Errors

         Ok(deleted > 0)
+    }
+    /// The viewer's collaborator permission on a repo (`read`|`write`|`admin`), or
+    /// `None` if they are not an explicit collaborator. Feeds [`auth::access`].
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn collaborator_permission(
+        &self,
+        repo_id: &str,
+        user_id: &str,
+    ) -> Result<Option<String>, StoreError> {
+        let row = sqlx::query(
+            "SELECT permission FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2",
+        )
+        .bind(repo_id)
+        .bind(user_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        Ok(row.as_ref().map(|r| r.try_get("permission")).transpose()?)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {

 tower-http = { workspace = true }
 rust-embed = { workspace = true }
 mime_guess = { workspace = true }
+comrak = { workspace = true }
+ammonia = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 [[package]]
+name = "ammonia"
+version = "4.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
+dependencies = [
+ "cssparser",
+ "html5ever",
+ "maplit",
+ "url",
+]
+[[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "caseless"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6fd507454086c8edfd769ca6ada439193cdb209c7681712ef6275cccbfe5d8"
+dependencies = [
+ "unicode-normalization",
+]
+[[package]]
 name = "cast5"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 [[package]]
+name = "comrak"
+version = "0.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d5910408554659ed848ff469e67ec83b30f179e72cec286cfdae64d1616f466"
+dependencies = [
+ "caseless",
+ "entities",
+ "finl_unicode",
+ "jetscii",
+ "phf",
+ "phf_codegen",
+ "rustc-hash",
+ "smallvec",
+ "typed-arena",
+]
+[[package]]
 name = "concurrent-queue"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "cssparser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+dependencies = [
+ "dtoa-short",
+ "itoa",
+ "smallvec",
+]
+[[package]]
 name = "ctr"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+[[package]]
 name = "eax"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 [[package]]
+name = "entities"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5320ae4c3782150d900b79807611a59a99fc9a1d61d686faafc24b93fc8d7ca"
+[[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
+name = "finl_unicode"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
+[[package]]
 name = "flate2"
 version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "html5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+[[package]]
 name = "http"
 version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 [[package]]
+name = "jetscii"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"
+[[package]]
 name = "jobserver"
 version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+[[package]]
+name = "markup5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+[[package]]
 name = "matchers"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+[[package]]
 name = "nom"
 version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_shared",
+ "serde",
+]
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+[[package]]
 name = "pin-project-lite"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+[[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+[[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 [[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+[[package]]
 name = "slab"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+[[package]]
 name = "stringprep"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+[[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
+]
 [[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+[[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 name = "web"
 version = "0.1.0"
 dependencies = [
+ "ammonia",
  "auth",
  "axum",
  "axum-extra",
+ "comrak",
  "config",
  "git",
  "highlight",
+]
 [[package]]
+name = "web_atoms"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "075474b12bcb3d2e3d4546580e9de478eeeead668a1761e2a8860c836b7ef297"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+[[package]]
 name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"

 mod assets;
 mod error;
 mod layout;
+mod markdown;
 mod pages;
+mod repo;
 #[path = "serve.rs"]
 mod serve_assets;
 mod session;
         .route("/theme.css", get(serve_assets::theme_default))
         .route("/theme/{file}", get(serve_assets::theme_named))
         .route("/assets/{*path}", get(serve_assets::assets))
+        // Repository browsing. Variable-length paths split on `/-/` in the handler.
+        .route("/{owner}", get(repo::user_page))
+        .route("/{owner}/{*rest}", get(repo::dispatch))
         .layer(
             ServiceBuilder::new()
                 .layer(SetRequestIdLayer::new(

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Markdown rendering for READMEs.
+//!
+//! `comrak` with the GFM extensions renders the source; `ammonia` then sanitizes
+//! the result, stripping raw HTML and any scripting so a README can never inject
+//! markup into the page. Relative-link rewriting and fenced-code highlighting are
+//! deferred to the polish phase.
+use maud::{Markup, PreEscaped};
+/// Render `source` markdown to sanitized HTML, ready to splice into a page.
+#[must_use]
+pub fn render(source: &str) -> Markup {
+    let mut options = comrak::Options::default();
+    options.extension.table = true;
+    options.extension.strikethrough = true;
+    options.extension.tasklist = true;
+    options.extension.autolink = true;
+    options.extension.footnotes = true;
+    let unsafe_html = comrak::markdown_to_html(source, &options);
+    let safe = ammonia::clean(&unsafe_html);
+    PreEscaped(safe)
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn renders_gfm_and_strips_scripts() {
+        let html =
+            render("# Title\n\n- [x] done\n\n<script>alert(1)</script>\n\n`code`").into_string();
+        assert!(html.contains("<h1>"));
+        assert!(html.contains("<code>code</code>"));
+        assert!(
+            !html.contains("<script"),
+            "scripts must be stripped: {html}"
+        );
+    }
+    #[test]
+    fn renders_tables() {
+        let html = render("| a | b |\n| - | - |\n| 1 | 2 |").into_string();
+        assert!(html.contains("<table>"));
+    }
+}

 /// Assemble the page chrome, ensuring the CSRF cookie and resolving the active
 /// theme from the visitor's cookie (falling back to the instance default).
-fn build_chrome(
+pub(crate) fn build_chrome(
     state: &AppState,
     jar: CookieJar,
     user: Option<User>,

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Repository browsing: the user page, repo home (README/tree), tree and blob
+//! views, raw content, branches, tags, and the commit list.
+//!
+//! Group nesting makes repo paths variable-length, so `/{owner}/{*rest}` is a
+//! single catch-all that splits `rest` on the GitLab `/-/` separator: everything
+//! before is the repo (or group) path, everything after is the view. Access is
+//! resolved once through [`auth::access`]; no access to a private repo renders
+//! `404`, never `403`, so existence never leaks.
+use std::path::Path as FsPath;
+use axum::extract::{Path, State};
+use axum::http::{Uri, header};
+use axum::response::{IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use maud::{Markup, html};
+use model::{Repo, User};
+use crate::AppState;
+use crate::error::{AppError, AppResult};
+use crate::layout::page;
+use crate::markdown;
+use crate::pages::build_chrome;
+use crate::session::MaybeUser;
+/// The candidate README filenames, in lookup order.
+const README_NAMES: &[&str] = &["README.md", "README", "readme.md", "README.txt"];
+/// Which repo tab is active, for highlighting.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Tab {
+    Code,
+    Branches,
+    Tags,
+    Search,
+}
+/// A resolved repository plus the viewer's access to it.
+struct RepoCtx {
+    owner: User,
+    repo: Repo,
+    /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
+    /// in later phases; every browse view here requires only `Read`.
+    #[allow(dead_code)]
+    access: auth::Access,
+}
+/// Run a blocking libgit2 read for a repo on the blocking pool, opening the repo
+/// per operation (§3.7 threading).
+async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
+where
+    F: FnOnce(&git::Repo) -> Result<T, git::GitError> + Send + 'static,
+    T: Send + 'static,
+{
+    let repo_dir = state.config.storage.repo_dir.clone();
+    let repo_id = repo_id.to_string();
+    tokio::task::spawn_blocking(move || {
+        let path = git::repo_path(&repo_dir, &repo_id)?;
+        let repo = git::Repo::open_path(&path)?;
+        f(&repo)
+    })
+    .await
+    .map_err(AppError::internal)?
+    .map_err(AppError::from)
+}
+/// Resolve `(owner, path)` to a repo and check access, or `Ok(None)` if the owner
+/// or repo does not exist (so the caller can try a group listing).
+///
+/// Denied access to an existing private repo returns `Err(NotFound)` — identical
+/// to a missing repo, so private existence never leaks.
+async fn resolve(
+    state: &AppState,
+    owner_name: &str,
+    repo_path: &str,
+    viewer: Option<&User>,
+) -> AppResult<Option<RepoCtx>> {
+    let Some(owner) = state.store.user_by_username(owner_name).await? else {
+        return Ok(None);
+    };
+    let Some(repo) = state.store.repo_by_owner_path(&owner.id, repo_path).await? else {
+        return Ok(None);
+    };
+    let viewer_id = viewer.map(|u| auth::Viewer {
+        id: u.id.clone(),
+        is_admin: u.is_admin,
+    });
+    let collaborator = match viewer {
+        Some(u) => state
+            .store
+            .collaborator_permission(&repo.id, &u.id)
+            .await?
+            .and_then(|p| auth::Permission::parse(&p)),
+        None => None,
+    };
+    let access = auth::access(
+        viewer_id.as_ref(),
+        &repo,
+        collaborator,
+        state.config.instance.allow_anonymous,
+    );
+    if access == auth::Access::None {
+        return Err(AppError::NotFound);
+    }
+    Ok(Some(RepoCtx {
+        owner,
+        repo,
+        access,
+    }))
+}
+/// `GET /{owner}` — the user's page: their groups and repositories the viewer can
+/// see.
+pub async fn user_page(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+    Path(owner_name): Path<String>,
+) -> AppResult<Response> {
+    let Some(owner) = state.store.user_by_username(&owner_name).await? else {
+        return Err(AppError::NotFound);
+    };
+    let repos = visible_repos(&state, &owner, viewer.as_ref()).await?;
+    let groups = state.store.groups_by_owner(&owner.id).await?;
+    let (jar, chrome) = build_chrome(&state, jar, viewer.clone(), uri.path().to_string());
+    let body = html! {
+        h1 { (owner.username) }
+        @if !groups.is_empty() {
+            section {
+                h2 { "Groups" }
+                ul class="repo-list" {
+                    @for group in &groups {
+                        li { a href={ "/" (owner.username) "/" (group.path) } { (group.path) } }
+                    }
+                }
+            }
+        }
+        section {
+            h2 { "Repositories" }
+            (repo_list(&owner.username, &repos))
+        }
+    };
+    Ok((jar, page(&chrome, &owner.username, body)).into_response())
+}
+/// `GET /{owner}/{*rest}` — dispatch a repo path and view.
+pub async fn dispatch(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    uri: Uri,
+    Path((owner_name, rest)): Path<(String, String)>,
+) -> AppResult<Response> {
+    if let Some((repo_path, view)) = rest.split_once("/-/") {
+        let ctx = resolve(&state, &owner_name, repo_path, viewer.as_ref())
+            .await?
+            .ok_or(AppError::NotFound)?;
+        dispatch_view(&state, viewer, jar, &uri, ctx, view).await
+    } else {
+        match resolve(&state, &owner_name, &rest, viewer.as_ref()).await? {
+            Some(ctx) => repo_home(&state, viewer, jar, &uri, ctx).await,
+            None => group_listing(&state, viewer, jar, &uri, &owner_name, &rest).await,
+        }
+    }
+}
+/// Dispatch the portion after `/-/`.
+async fn dispatch_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    view: &str,
+) -> AppResult<Response> {
+    let (kind, rest) = view.split_once('/').unwrap_or((view, ""));
+    match kind {
+        "tree" => tree_view(state, viewer, jar, uri, ctx, rest).await,
+        "blob" => blob_view(state, viewer, jar, uri, ctx, rest, false).await,
+        "raw" => raw_view(state, ctx, rest).await,
+        "commits" => commits_view(state, viewer, jar, uri, ctx, rest).await,
+        "branches" => branches_view(state, viewer, jar, uri, ctx).await,
+        "tags" => tags_view(state, viewer, jar, uri, ctx).await,
+        // `commit` (single-commit diff) lands with the commit-view phase; the
+        // reserved `runs`/`search`/`settings` slots return 404 until built.
+        _ => Err(AppError::NotFound),
+    }
+}
+/// Split `"{ref}/{path..}"` into the ref (first segment) and the remaining path.
+/// Branch names containing slashes resolve to their first segment only — a known
+/// MVP limitation.
+fn split_ref_path(rest: &str) -> (String, String) {
+    match rest.split_once('/') {
+        Some((r, p)) => (r.to_string(), p.to_string()),
+        None => (rest.to_string(), String::new()),
+    }
+}
+/// The reference to browse, defaulting to the repo's default branch when none is
+/// given in the URL.
+fn ref_or_default(repo: &Repo, given: &str) -> String {
+    if given.is_empty() {
+        repo.default_branch.clone()
+    } else {
+        given.to_string()
+    }
+}
+// ---- Repo home ----
+async fn repo_home(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+) -> AppResult<Response> {
+    let rev_name = ctx.repo.default_branch.clone();
+    // Resolve the default branch; an unborn HEAD means an empty repo.
+    let resolved = git_read(state, &ctx.repo.id, {
+        let rev_name = rev_name.clone();
+        move |repo| repo.resolve_ref(&rev_name)
+    })
+    .await;
+    let body = match resolved {
+        Err(_) => empty_repo_body(state, &ctx),
+        Ok(rev) => {
+            let entries = git_read(state, &ctx.repo.id, {
+                let rev = rev.clone();
+                move |repo| repo.tree_entries(&rev, FsPath::new(""))
+            })
+            .await?;
+            let readme = load_readme(state, &ctx.repo.id, &rev, &entries).await;
+            html! {
+                (repo_header(state, &ctx, Tab::Code, &rev_name))
+                (tree_table(&ctx.owner.username, &ctx.repo.path, &rev_name, "", &entries))
+                @if let Some(rendered) = readme {
+                    div class="card" style="margin-top:1rem" { (rendered) }
+                }
+            }
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// Find and render the first matching README in the root tree.
+async fn load_readme(
+    state: &AppState,
+    repo_id: &str,
+    rev: &git::Resolved,
+    entries: &[git::TreeEntry],
+) -> Option<Markup> {
+    let name = README_NAMES.iter().find(|candidate| {
+        entries
+            .iter()
+            .any(|e| e.kind == git::EntryKind::File && e.name.eq_ignore_ascii_case(candidate))
+    })?;
+    let name = (*name).to_string();
+    let blob = git_read(state, repo_id, {
+        let rev = rev.clone();
+        let name = name.clone();
+        move |repo| repo.blob(&rev, FsPath::new(&name))
+    })
+    .await
+    .ok()?;
+    if blob.is_binary {
+        return None;
+    }
+    let text = String::from_utf8_lossy(&blob.content);
+    Some(markdown::render(&text))
+}
+/// The "empty repository" landing with clone instructions.
+fn empty_repo_body(state: &AppState, ctx: &RepoCtx) -> Markup {
+    html! {
+        (repo_header(state, ctx, Tab::Code, &ctx.repo.default_branch))
+        div class="card" {
+            h2 { "This repository is empty" }
+            p class="muted" { "Push a commit to get started:" }
+            pre class="code" {
+                (clone_https(state, ctx)) "\n"
+            }
+        }
+    }
+}
+// ---- Tree view ----
+async fn tree_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    rest: &str,
+) -> AppResult<Response> {
+    let (rev_name, path) = split_ref_path(rest);
+    let rev_name = ref_or_default(&ctx.repo, &rev_name);
+    let rev = git_read(state, &ctx.repo.id, {
+        let rev_name = rev_name.clone();
+        move |repo| repo.resolve_ref(&rev_name)
+    })
+    .await?;
+    let entries = git_read(state, &ctx.repo.id, {
+        let rev = rev.clone();
+        let path = path.clone();
+        move |repo| repo.tree_entries(&rev, FsPath::new(&path))
+    })
+    .await?;
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Code, &rev_name))
+        (breadcrumb(&ctx.owner.username, &ctx.repo.path, &rev_name, &path))
+        (tree_table(&ctx.owner.username, &ctx.repo.path, &rev_name, &path, &entries))
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: {path}", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Blob view ----
+async fn blob_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    rest: &str,
+    _raw: bool,
+) -> AppResult<Response> {
+    let (rev_name, path) = split_ref_path(rest);
+    let rev_name = ref_or_default(&ctx.repo, &rev_name);
+    if path.is_empty() {
+        return Err(AppError::NotFound);
+    }
+    let rev = git_read(state, &ctx.repo.id, {
+        let rev_name = rev_name.clone();
+        move |repo| repo.resolve_ref(&rev_name)
+    })
+    .await?;
+    // Read the blob and resolve any attribute language override in one pass.
+    let (blob, attr_lang) = git_read(state, &ctx.repo.id, {
+        let rev = rev.clone();
+        let path = path.clone();
+        move |repo| {
+            let blob = repo.blob(&rev, FsPath::new(&path))?;
+            let attrs = repo.attributes_set(&rev.oid).ok();
+            let lang = attrs.and_then(|set| set.attributes(&path).language().map(str::to_string));
+            Ok((blob, lang))
+        }
+    })
+    .await?;
+    let content_body = render_blob(&ctx, &rev_name, &path, &blob, attr_lang.as_deref());
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Code, &rev_name))
+        (breadcrumb(&ctx.owner.username, &ctx.repo.path, &rev_name, &path))
+        (content_body)
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: {path}", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// Render a blob: highlighted code with line anchors, an inline image, or a
+/// binary notice.
+fn render_blob(
+    ctx: &RepoCtx,
+    rev_name: &str,
+    path: &str,
+    blob: &git::Blob,
+    attr_lang: Option<&str>,
+) -> Markup {
+    let raw_url = format!(
+        "/{}/{}/-/raw/{rev_name}/{path}",
+        ctx.owner.username, ctx.repo.path
+    );
+    let filename = path.rsplit('/').next().unwrap_or(path);
+    html! {
+        div class="blob-header" {
+            span class="muted" { (blob.size) " bytes" }
+            span { a class="btn" href=(raw_url) { "Raw" }
+                   button class="btn" type="button" data-clipboard=(raw_url) { "Copy path" } }
+        }
+        @if is_image(filename) {
+            p { img src=(raw_url) alt=(filename) style="max-width:100%"; }
+        } @else if blob.is_binary {
+            div class="card" {
+                p class="muted" { "Binary file not shown." }
+                p { a class="btn" href=(raw_url) { "Download" } }
+            }
+        } @else {
+            (highlighted_code(FsPath::new(path), &blob.content, attr_lang))
+        }
+    }
+}
+/// Render highlighted code as a line-numbered table with `#L{n}` anchors.
+fn highlighted_code(path: &FsPath, content: &[u8], attr_lang: Option<&str>) -> Markup {
+    let highlighted = highlight::highlight(path, content, attr_lang);
+    html! {
+        table class="blob" {
+            tbody {
+                @for (i, line) in highlighted.lines.iter().enumerate() {
+                    @let n = i + 1;
+                    tr id={ "L" (n) } {
+                        td class="lineno" { a href={ "#L" (n) } { (n) } }
+                        td class="code-line" {
+                            @for span in &line.spans {
+                                @match span.class {
+                                    Some(class) => { span class=(class) { (span.text) } }
+                                    None => { (span.text) }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+// ---- Raw ----
+async fn raw_view(state: &AppState, ctx: RepoCtx, rest: &str) -> AppResult<Response> {
+    let (rev_name, path) = split_ref_path(rest);
+    let rev_name = ref_or_default(&ctx.repo, &rev_name);
+    if path.is_empty() {
+        return Err(AppError::NotFound);
+    }
+    let rev = git_read(state, &ctx.repo.id, {
+        let rev_name = rev_name.clone();
+        move |repo| repo.resolve_ref(&rev_name)
+    })
+    .await?;
+    let blob = git_read(state, &ctx.repo.id, {
+        let rev = rev.clone();
+        let path = path.clone();
+        move |repo| repo.blob(&rev, FsPath::new(&path))
+    })
+    .await?;
+    let filename = path.rsplit('/').next().unwrap_or(&path);
+    // Serve images with their real type; everything else as text/plain to prevent
+    // a stored-HTML blob from being interpreted as markup. `nosniff` reinforces it.
+    let content_type = if is_image(filename) {
+        mime_guess::from_path(filename)
+            .first_raw()
+            .unwrap_or("application/octet-stream")
+    } else if blob.is_binary {
+        "application/octet-stream"
+    } else {
+        "text/plain; charset=utf-8"
+    };
+    Ok((
+        [
+            (header::CONTENT_TYPE, content_type),
+            (header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
+            (header::CONTENT_DISPOSITION, "inline"),
+        ],
+        blob.content,
+    )
+        .into_response())
+}
+// ---- Branches ----
+async fn branches_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+) -> AppResult<Response> {
+    let branches = git_read(state, &ctx.repo.id, git::Repo::branches).await?;
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Branches, &ctx.repo.default_branch))
+        h2 { "Branches" }
+        table class="list" {
+            thead { tr { th { "Branch" } th { "Ahead" } th { "Behind" } th { "Updated" } } }
+            tbody {
+                @for b in &branches {
+                    tr {
+                        td {
+                            a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/tree/" (b.name) } { (b.name) }
+                            @if b.is_default { " " span class="badge" { "default" } }
+                        }
+                        td { @if b.ahead > 0 { span style="color:var(--fb-success)" { (b.ahead) } } @else { "0" } }
+                        td { (b.behind) }
+                        td class="muted" { (b.tip.author.name) " · " (fmt_date(b.tip.author.time_ms)) }
+                    }
+                }
+            }
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: branches", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Tags ----
+async fn tags_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+) -> AppResult<Response> {
+    let tags = git_read(state, &ctx.repo.id, git::Repo::tags).await?;
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Tags, &ctx.repo.default_branch))
+        h2 { "Tags" }
+        table class="list" {
+            thead { tr { th { "Tag" } th { "Commit" } th { "Kind" } } }
+            tbody {
+                @for t in &tags {
+                    tr {
+                        td { a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/tree/" (t.name) } { (t.name) } }
+                        td class="mono" { (t.oid.short()) }
+                        td { (if t.annotated { "annotated" } else { "lightweight" }) }
+                    }
+                }
+            }
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: tags", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Commit list ----
+async fn commits_view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    rest: &str,
+) -> AppResult<Response> {
+    let rev_name = ref_or_default(&ctx.repo, rest);
+    let rev = git_read(state, &ctx.repo.id, {
+        let rev_name = rev_name.clone();
+        move |repo| repo.resolve_ref(&rev_name)
+    })
+    .await?;
+    let commits = git_read(state, &ctx.repo.id, {
+        let rev = rev.clone();
+        move |repo| repo.commits(&rev, None, git::Page::first(50))
+    })
+    .await?;
+    // Verify signatures against all registered keys (bounded to this page's rows).
+    let keys = signing_keys(state.store.all_keys().await?);
+    let states = git_read(state, &ctx.repo.id, {
+        let oids: Vec<git::Oid> = commits.iter().map(|c| c.oid.clone()).collect();
+        move |repo| {
+            Ok(oids
+                .iter()
+                .map(|o| repo.signature_state(o, &keys))
+                .collect::<Vec<_>>())
+        }
+    })
+    .await?;
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Code, &rev_name))
+        h2 { "Commits" }
+        ul class="repo-list" {
+            @for (commit, sig) in commits.iter().zip(states.iter()) {
+                li {
+                    div class="name" {
+                        a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/commit/" (commit.oid) } {
+                            (commit.summary)
+                        }
+                        " " (signature_badge(sig))
+                    }
+                    p class="muted" {
+                        span class="mono" { (commit.oid.short()) }
+                        " · " (commit.author.name) " · " (fmt_date(commit.author.time_ms))
+                    }
+                }
+            }
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: commits", ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Group listing ----
+async fn group_listing(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    owner_name: &str,
+    group_path: &str,
+) -> AppResult<Response> {
+    let Some(owner) = state.store.user_by_username(owner_name).await? else {
+        return Err(AppError::NotFound);
+    };
+    let Some(group) = state
+        .store
+        .group_by_owner_path(&owner.id, group_path)
+        .await?
+    else {
+        return Err(AppError::NotFound);
+    };
+    let all_groups = state.store.groups_by_owner(&owner.id).await?;
+    let prefix = format!("{group_path}/");
+    let subgroups: Vec<_> = all_groups
+        .iter()
+        .filter(|g| g.path.starts_with(&prefix) && !g.path[prefix.len()..].contains('/'))
+        .collect();
+    let repos: Vec<Repo> = visible_repos(state, &owner, viewer.as_ref())
+        .await?
+        .into_iter()
+        .filter(|r| r.path.starts_with(&prefix) && !r.path[prefix.len()..].contains('/'))
+        .collect();
+    let body = html! {
+        h1 { (owner.username) "/" (group.path) }
+        @if !subgroups.is_empty() {
+            section { h2 { "Subgroups" }
+                ul class="repo-list" {
+                    @for g in &subgroups { li { a href={ "/" (owner.username) "/" (g.path) } { (g.path) } } }
+                }
+            }
+        }
+        section { h2 { "Repositories" } (repo_list(&owner.username, &repos)) }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}", owner.username, group.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- Shared components ----
+/// The repos of `owner` the viewer may see: all of them for the owner/admin, else
+/// the public ones.
+async fn visible_repos(
+    state: &AppState,
+    owner: &User,
+    viewer: Option<&User>,
+) -> AppResult<Vec<Repo>> {
+    let repos = state.store.repos_by_owner(&owner.id).await?;
+    let is_owner_or_admin = viewer.is_some_and(|v| v.id == owner.id || v.is_admin);
+    if is_owner_or_admin {
+        return Ok(repos);
+    }
+    // Non-owners: public repos plus any where they are a collaborator.
+    let mut out = Vec::new();
+    for repo in repos {
+        let allowed = !repo.is_private && state.config.instance.allow_anonymous;
+        let collab = match viewer {
+            Some(v) => state
+                .store
+                .collaborator_permission(&repo.id, &v.id)
+                .await?
+                .is_some(),
+            None => false,
+        };
+        if allowed || collab {
+            out.push(repo);
+        }
+    }
+    Ok(out)
+}
+/// Render a list of repositories as links.
+fn repo_list(owner: &str, repos: &[Repo]) -> Markup {
+    html! {
+        @if repos.is_empty() {
+            p class="muted" { "No repositories." }
+        } @else {
+            ul class="repo-list" {
+                @for repo in repos {
+                    li {
+                        div class="name" {
+                            a href={ "/" (owner) "/" (repo.path) } { (repo.path) }
+                            @if repo.is_private { " " span class="badge badge-private" { "private" } }
+                        }
+                        @if let Some(desc) = &repo.description { p class="muted" { (desc) } }
+                    }
+                }
+            }
+        }
+    }
+}
+/// The repo sub-header: slug, tabs, and clone URLs.
+fn repo_header(state: &AppState, ctx: &RepoCtx, active: Tab, rev: &str) -> Markup {
+    let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
+    let tab = |t: Tab, label: &str, href: String| {
+        html! {
+            a href=(href) aria-current=[(active == t).then_some("page")] { (label) }
+        }
+    };
+    html! {
+        div class="repo-head" {
+            h1 class="repo-slug" {
+                a href={ "/" (ctx.owner.username) } { (ctx.owner.username) } "/"
+                a href=(base) { (ctx.repo.name) }
+                @if ctx.repo.is_private { " " span class="badge badge-private" { "private" } }
+            }
+            @if let Some(desc) = &ctx.repo.description { p class="muted" { (desc) } }
+            nav class="tabs repo-tabs" {
+                (tab(Tab::Code, "Code", base.clone()))
+                (tab(Tab::Branches, "Branches", format!("{base}/-/branches")))
+                (tab(Tab::Tags, "Tags", format!("{base}/-/tags")))
+                (tab(Tab::Search, "Search", format!("{base}/-/search")))
+            }
+            div class="ref-row" {
+                // Current ref, linking to the branch picker.
+                a class="badge" href=(format!("{base}/-/branches")) { (rev) }
+                a href=(format!("{base}/-/commits/{rev}")) { "Commits" }
+            }
+            div class="clone-row" {
+                input type="text" readonly value=(clone_https(state, ctx))
+                      aria-label="HTTPS clone URL";
+                button class="btn" type="button" data-clipboard=(clone_https(state, ctx)) { "Copy" }
+            }
+        }
+    }
+}
+/// The HTTPS clone URL.
+fn clone_https(state: &AppState, ctx: &RepoCtx) -> String {
+    format!(
+        "{}/{}/{}.git",
+        state.config.instance.url.trim_end_matches('/'),
+        ctx.owner.username,
+        ctx.repo.path
+    )
+}
+/// A path breadcrumb for tree/blob views.
+fn breadcrumb(owner: &str, repo_path: &str, rev: &str, path: &str) -> Markup {
+    let root = format!("/{owner}/{repo_path}/-/tree/{rev}");
+    // Precompute each crumb's (label, cumulative href) before rendering.
+    let mut acc = String::new();
+    let crumbs: Vec<(String, String)> = path
+        .split('/')
+        .filter(|s| !s.is_empty())
+        .map(|segment| {
+            if acc.is_empty() {
+                acc.push_str(segment);
+            } else {
+                acc.push('/');
+                acc.push_str(segment);
+            }
+            (segment.to_string(), format!("{root}/{acc}"))
+        })
+        .collect();
+    html! {
+        nav class="breadcrumb" {
+            a href=(root) { (repo_path) }
+            @for (label, href) in &crumbs {
+                " / " a href=(href) { (label) }
+            }
+        }
+    }
+}
+/// A tree listing table.
+fn tree_table(
+    owner: &str,
+    repo_path: &str,
+    rev: &str,
+    dir: &str,
+    entries: &[git::TreeEntry],
+) -> Markup {
+    let href = |name: &str, kind: git::EntryKind| {
+        let sub = if dir.is_empty() {
+            name.to_string()
+        } else {
+            format!("{dir}/{name}")
+        };
+        let view = match kind {
+            git::EntryKind::Directory => "tree",
+            _ => "blob",
+        };
+        format!("/{owner}/{repo_path}/-/{view}/{rev}/{sub}")
+    };
+    html! {
+        table class="list tree" {
+            tbody {
+                @for entry in entries {
+                    tr {
+                        td class="tree-icon" { (entry_icon(entry.kind)) }
+                        td { a href=(href(&entry.name, entry.kind)) { (entry.name) } }
+                    }
+                }
+            }
+        }
+    }
+}
+/// An icon glyph for a tree entry kind.
+fn entry_icon(kind: git::EntryKind) -> &'static str {
+    match kind {
+        git::EntryKind::Directory => "📁",
+        git::EntryKind::Submodule => "📦",
+        git::EntryKind::Symlink => "🔗",
+        git::EntryKind::File => "📄",
+    }
+}
+/// A signature badge (green Verified / amber Unverified) with a descriptive title.
+fn signature_badge(state: &git::SignatureState) -> Markup {
+    match state {
+        git::SignatureState::Verified { fingerprint, .. } => html! {
+            span class="badge badge-verified" title={ "Verified: " (fingerprint) } { "Verified" }
+        },
+        git::SignatureState::Unsigned => html! {
+            span class="badge badge-unverified" title="This commit is not signed" { "Unverified" }
+        },
+        git::SignatureState::UnknownKey { fingerprint, .. } => html! {
+            span class="badge badge-unverified"
+                 title={ "Signed by an unrecognized key " (fingerprint) } { "Unverified" }
+        },
+        git::SignatureState::Invalid { reason, .. } => html! {
+            span class="badge badge-unverified"
+                 title={ "Signature could not be verified: " (reason) } { "Unverified" }
+        },
+    }
+}
+/// Map registered keys to the verification input type.
+fn signing_keys(keys: Vec<model::Key>) -> Vec<git::SigningKey> {
+    keys.into_iter()
+        .map(|k| git::SigningKey {
+            user_id: k.user_id,
+            key_id: k.id,
+            kind: k.kind,
+            fingerprint: k.fingerprint,
+            public_key: k.public_key,
+        })
+        .collect()
+}
+/// Whether a filename is a browser-renderable image.
+fn is_image(filename: &str) -> bool {
+    matches!(
+        filename
+            .rsplit('.')
+            .next()
+            .map(str::to_ascii_lowercase)
+            .as_deref(),
+        Some("png" | "jpg" | "jpeg" | "gif" | "webp" | "svg" | "ico" | "bmp")
+    )
+}
+/// Format an epoch-millisecond timestamp as a `YYYY-MM-DD` date.
+fn fmt_date(ms: i64) -> String {
+    let secs = ms.div_euclid(1000);
+    match time::OffsetDateTime::from_unix_timestamp(secs) {
+        Ok(dt) => format!(
+            "{:04}-{:02}-{:02}",
+            dt.year(),
+            u8::from(dt.month()),
+            dt.day()
+        ),
+        Err(_) => "—".to_string(),
+    }
+}

 use axum::body::Body;
 use axum::http::{Request, StatusCode, header};
 use config::Config;
-use store::{NewUser, Store};
+use store::{NewRepo, NewUser, Store};
 use tower::ServiceExt as _;
 use crate::AppState;
     let res = app.oneshot(get("/settings/theme?name=nope")).await.unwrap();
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+}
+#[tokio::test]
+async fn private_repo_is_404_for_anonymous() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "secret".to_string(),
+            path: "secret".to_string(),
+            description: None,
+            is_private: true,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    // Access is denied before any git read, so existence never leaks: 404, not 403.
+    let res = app.oneshot(get("/ada/secret")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+#[tokio::test]
+async fn unknown_owner_is_404() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/nobody")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}