hanna/fabrica

feat(web): repository browsing — tree, blob, branches, tags, commits

3befe49 · hanna committed on 2026-07-25

Add the repo views over the git read layer. Variable-length repo paths
resolve through a single /{owner}/{*rest} catch-all that splits on the
GitLab /-/ separator; access is checked once via auth::access, and no
access to a private repo renders 404 (never 403) so existence never
leaks. libgit2 reads run on the blocking pool, opened per operation.

- User page and group listings; repo home renders the root tree plus a
  sanitized (comrak + ammonia) README.
- Tree browsing with breadcrumbs; blob view with line-number anchors and
  syntax highlighting (honouring the .gitattributes language override);
  raw endpoint served as text/plain (nosniff) or the real image type.
- Branches (ahead/behind), tags, and a commit list with Verified/
  Unverified signature badges verified against all registered keys.

Repo sub-header with tabs and an HTTPS clone URL. Store gains
collaborator_permission and all_keys. Verified end-to-end against a live
server with a pushed repo; 17 handler tests incl. the private-repo-404
invariant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +225 −0

Cargo.toml +3 −0

assets/base.css +87 −0

crates/store/src/keys.rs +17 −0

crates/store/src/repos.rs +21 −0

crates/web/Cargo.toml +2 −0

crates/web/src/lib.rs +5 −0

crates/web/src/markdown.rs +50 −0

crates/web/src/pages.rs +1 −1

crates/web/src/repo.rs +885 −0

crates/web/src/tests.rs +31 −1

@@ @@ -141,6 +141,9 @@ tower-http = { version = "0.6", features = [ @@
 rust-embed = "8"
 mime_guess = "2"
 time = "0.3"
 # Markdown rendering (GFM) + HTML sanitization for READMEs and comments.
 comrak = { version = "0.54", default-features = false }
 ammonia = "4"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }

@@ @@ -358,6 +358,93 @@ pre.code { @@
   color: var(--fb-fg-muted);
+}
 /* ---- Repo views ---- */
 .repo-head {
   border-bottom: 1px solid var(--fb-border);
   padding-bottom: 0.75rem;
   margin-bottom: 1rem;
+}
 .repo-slug {
   font-size: 1.4rem;
   font-weight: 400;
+}
 .repo-slug a {
   color: var(--fb-accent);
+}
 .repo-tabs {
   margin: 0.5rem 0;
+}
 .ref-row,
 .clone-row {
   display: flex;
   gap: 0.5rem;
   align-items: center;
   margin-top: 0.5rem;
+}
 .clone-row input {
   max-width: 30rem;
   font-family: var(--fb-font-mono);
   font-size: 0.85em;
+}
 .breadcrumb {
   margin-bottom: 0.75rem;
   font-family: var(--fb-font-mono);
+}
 table.tree td {
   padding: 0.3rem 0.6rem;
   border-bottom: 1px solid var(--fb-border);
+}
 .tree-icon {
   width: 1.5rem;
   text-align: center;
+}
 .blob-header {
   display: flex;
   justify-content: space-between;
   align-items: center;
   padding: 0.5rem 0.75rem;
   background: var(--fb-bg-raised);
   border: 1px solid var(--fb-border);
   border-bottom: none;
   border-radius: var(--fb-radius) var(--fb-radius) 0 0;
+}
 .blob-header .btn {
   padding: 0.2rem 0.5rem;
+}
 table.blob {
   width: 100%;
   border-collapse: collapse;
   border: 1px solid var(--fb-border);
   border-radius: 0 0 var(--fb-radius) var(--fb-radius);
   font-family: var(--fb-font-mono);
   font-size: 0.85rem;
   background: var(--fb-bg-inset);
   overflow-x: auto;
+}
 table.blob td.lineno {
   width: 1%;
   min-width: 3rem;
   text-align: right;
   padding: 0 0.75rem;
   color: var(--fb-fg-muted);
   user-select: none;
   vertical-align: top;
+}
 table.blob td.lineno a {
   color: inherit;
+}
 table.blob td.code-line {
   padding: 0 0.75rem;
   white-space: pre;
   tab-size: 4;
+}
 table.blob tr:target {
   background: var(--fb-diff-add-bg);
+}
 /* ---- Footer ---- */
 .footer {
   max-width: 76rem;

@@ @@ -100,6 +100,23 @@ impl Store { @@
             .map_err(Into::into)
+    }
     /// Every registered key on the instance, for signature verification (the
     /// signer may be any registered user).
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn all_keys(&self) -> Result<Vec<Key>, StoreError> {
         let sql = format!("SELECT {KEY_COLUMNS} FROM keys");
         let rows = sqlx::query(AssertSqlSafe(sql))
             .fetch_all(&self.pool)
             .await?;
         rows.iter()
             .map(map_key)
             .collect::<Result<_, _>>()
             .map_err(Into::into)
+    }
     /// Fetch a user's key by its 1-based ordinal, or `None`.
     ///
     /// # Errors

@@ @@ -198,6 +198,27 @@ impl Store { @@
         Ok(deleted > 0)
+    }
     /// The viewer's collaborator permission on a repo (`read`|`write`|`admin`), or
     /// `None` if they are not an explicit collaborator. Feeds [`auth::access`].
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn collaborator_permission(
         &self,
         repo_id: &str,
         user_id: &str,
     ) -> Result<Option<String>, StoreError> {
         let row = sqlx::query(
             "SELECT permission FROM repo_collaborators WHERE repo_id = $1 AND user_id = $2",
+        )
         .bind(repo_id)
         .bind(user_id)
         .fetch_optional(&self.pool)
         .await?;
         Ok(row.as_ref().map(|r| r.try_get("permission")).transpose()?)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {

@@ @@ -24,6 +24,8 @@ tower = { workspace = true } @@
 tower-http = { workspace = true }
 rust-embed = { workspace = true }
 mime_guess = { workspace = true }
 comrak = { workspace = true }
 ammonia = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 [[package]]
 name = "ammonia"
 version = "4.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
 dependencies = [
  "cssparser",
  "html5ever",
  "maplit",
  "url",
+]
 [[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -465,6 +477,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "caseless"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b6fd507454086c8edfd769ca6ada439193cdb209c7681712ef6275cccbfe5d8"
 dependencies = [
  "unicode-normalization",
+]
 [[package]]
 name = "cast5"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 [[package]]
 name = "comrak"
 version = "0.54.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d5910408554659ed848ff469e67ec83b30f179e72cec286cfdae64d1616f466"
 dependencies = [
  "caseless",
  "entities",
  "finl_unicode",
  "jetscii",
  "phf",
  "phf_codegen",
  "rustc-hash",
  "smallvec",
  "typed-arena",
+]
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -813,6 +851,17 @@ dependencies = [ @@
+]
 [[package]]
 name = "cssparser"
 version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
 dependencies = [
  "dtoa-short",
  "itoa",
  "smallvec",
+]
 [[package]]
 name = "ctr"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1059,6 +1108,21 @@ dependencies = [ @@
+]
 [[package]]
 name = "dtoa"
 version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
 [[package]]
 name = "dtoa-short"
 version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
 dependencies = [
  "dtoa",
+]
 [[package]]
 name = "eax"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 [[package]]
 name = "entities"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5320ae4c3782150d900b79807611a59a99fc9a1d61d686faafc24b93fc8d7ca"
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "finl_unicode"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
 [[package]]
 name = "flate2"
 version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1598,6 +1674,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "html5ever"
 version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
 dependencies = [
  "log",
  "markup5ever",
+]
 [[package]]
 name = "http"
 version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 [[package]]
 name = "jetscii"
 version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"
 [[package]]
 name = "jobserver"
 version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2040,6 +2132,23 @@ dependencies = [ @@
+]
 [[package]]
 name = "maplit"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
 [[package]]
 name = "markup5ever"
 version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
 dependencies = [
  "log",
  "tendril",
  "web_atoms",
+]
 [[package]]
 name = "matchers"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2183,6 +2292,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 [[package]]
 name = "nom"
 version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2533,6 +2648,45 @@ dependencies = [ @@
+]
 [[package]]
 name = "phf"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
  "phf_shared",
  "serde",
+]
 [[package]]
 name = "phf_codegen"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
 dependencies = [
  "phf_generator",
  "phf_shared",
+]
 [[package]]
 name = "phf_generator"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
 dependencies = [
  "fastrand",
  "phf_shared",
+]
 [[package]]
 name = "phf_shared"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
  "siphasher",
+]
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2608,6 +2762,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "precomputed-hash"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 [[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2888,6 +3048,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 [[package]]
 name = "siphasher"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 [[package]]
 name = "slab"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -3497,6 +3669,30 @@ dependencies = [ @@
+]
 [[package]]
 name = "string_cache"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
  "phf_shared",
  "precomputed-hash",
+]
 [[package]]
 name = "string_cache_codegen"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
 dependencies = [
  "phf_generator",
  "phf_shared",
  "proc-macro2",
  "quote",
+]
 [[package]]
 name = "stringprep"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -3584,6 +3780,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "tendril"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
 dependencies = [
  "new_debug_unreachable",
+]
 [[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -3954,6 +4159,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "typed-arena"
 version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
 [[package]]
 name = "typenum"
 version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4166,9 +4377,11 @@ dependencies = [ @@
 name = "web"
 version = "0.1.0"
 dependencies = [
  "ammonia",
  "auth",
  "axum",
  "axum-extra",
  "comrak",
  "config",
  "git",
  "highlight",
@@ @@ -4200,6 +4413,18 @@ dependencies = [ @@
+]
 [[package]]
 name = "web_atoms"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "075474b12bcb3d2e3d4546580e9de478eeeead668a1761e2a8860c836b7ef297"
 dependencies = [
  "phf",
  "phf_codegen",
  "string_cache",
  "string_cache_codegen",
+]
 [[package]]
 name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"

@@ @@ -13,7 +13,9 @@ @@
 mod assets;
 mod error;
 mod layout;
 mod markdown;
 mod pages;
 mod repo;
 #[path = "serve.rs"]
 mod serve_assets;
 mod session;
@@ @@ -114,6 +116,9 @@ pub fn build_router(state: AppState) -> Router { @@
         .route("/theme.css", get(serve_assets::theme_default))
         .route("/theme/{file}", get(serve_assets::theme_named))
         .route("/assets/{*path}", get(serve_assets::assets))
         // Repository browsing. Variable-length paths split on `/-/` in the handler.
         .route("/{owner}", get(repo::user_page))
         .route("/{owner}/{*rest}", get(repo::dispatch))
         .layer(
             ServiceBuilder::new()
                 .layer(SetRequestIdLayer::new(

@@ @@ -0,0 +1,50 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Markdown rendering for READMEs.
 //!
 //! `comrak` with the GFM extensions renders the source; `ammonia` then sanitizes
 //! the result, stripping raw HTML and any scripting so a README can never inject
 //! markup into the page. Relative-link rewriting and fenced-code highlighting are
 //! deferred to the polish phase.
 use maud::{Markup, PreEscaped};
 /// Render `source` markdown to sanitized HTML, ready to splice into a page.
 #[must_use]
 pub fn render(source: &str) -> Markup {
     let mut options = comrak::Options::default();
     options.extension.table = true;
     options.extension.strikethrough = true;
     options.extension.tasklist = true;
     options.extension.autolink = true;
     options.extension.footnotes = true;
     let unsafe_html = comrak::markdown_to_html(source, &options);
     let safe = ammonia::clean(&unsafe_html);
     PreEscaped(safe)
+}
 #[cfg(test)]
 mod tests {
     use super::*;
     #[test]
     fn renders_gfm_and_strips_scripts() {
         let html =
             render("# Title\n\n- [x] done\n\n<script>alert(1)</script>\n\n`code`").into_string();
         assert!(html.contains("<h1>"));
         assert!(html.contains("<code>code</code>"));
         assert!(
             !html.contains("<script"),
             "scripts must be stripped: {html}"
         );
+    }
     #[test]
     fn renders_tables() {
         let html = render("| a | b |\n| - | - |\n| 1 | 2 |").into_string();
         assert!(html.contains("<table>"));
+    }
+}

@@ @@ -26,7 +26,7 @@ use crate::session::{ @@
 /// Assemble the page chrome, ensuring the CSRF cookie and resolving the active
 /// theme from the visitor's cookie (falling back to the instance default).
 fn build_chrome(
 pub(crate) fn build_chrome(
     state: &AppState,
     jar: CookieJar,
     user: Option<User>,

@@ @@ -0,0 +1,885 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Repository browsing: the user page, repo home (README/tree), tree and blob
 //! views, raw content, branches, tags, and the commit list.
 //!
 //! Group nesting makes repo paths variable-length, so `/{owner}/{*rest}` is a
 //! single catch-all that splits `rest` on the GitLab `/-/` separator: everything
 //! before is the repo (or group) path, everything after is the view. Access is
 //! resolved once through [`auth::access`]; no access to a private repo renders
 //! `404`, never `403`, so existence never leaks.
 use std::path::Path as FsPath;
 use axum::extract::{Path, State};
 use axum::http::{Uri, header};
 use axum::response::{IntoResponse, Response};
 use axum_extra::extract::cookie::CookieJar;
 use maud::{Markup, html};
 use model::{Repo, User};
 use crate::AppState;
 use crate::error::{AppError, AppResult};
 use crate::layout::page;
 use crate::markdown;
 use crate::pages::build_chrome;
 use crate::session::MaybeUser;
 /// The candidate README filenames, in lookup order.
 const README_NAMES: &[&str] = &["README.md", "README", "readme.md", "README.txt"];
 /// Which repo tab is active, for highlighting.
 #[derive(Clone, Copy, PartialEq, Eq)]
 enum Tab {
     Code,
     Branches,
     Tags,
     Search,
+}
 /// A resolved repository plus the viewer's access to it.
 struct RepoCtx {
     owner: User,
     repo: Repo,
     /// The viewer's access level. Reserved for gating mutation UI (settings, edit)
     /// in later phases; every browse view here requires only `Read`.
     #[allow(dead_code)]
     access: auth::Access,
+}
 /// Run a blocking libgit2 read for a repo on the blocking pool, opening the repo
 /// per operation (§3.7 threading).
 async fn git_read<T, F>(state: &AppState, repo_id: &str, f: F) -> AppResult<T>
 where
     F: FnOnce(&git::Repo) -> Result<T, git::GitError> + Send + 'static,
     T: Send + 'static,
+{
     let repo_dir = state.config.storage.repo_dir.clone();
     let repo_id = repo_id.to_string();
     tokio::task::spawn_blocking(move || {
         let path = git::repo_path(&repo_dir, &repo_id)?;
         let repo = git::Repo::open_path(&path)?;
         f(&repo)
     })
     .await
     .map_err(AppError::internal)?
     .map_err(AppError::from)
+}
 /// Resolve `(owner, path)` to a repo and check access, or `Ok(None)` if the owner
 /// or repo does not exist (so the caller can try a group listing).
 ///
 /// Denied access to an existing private repo returns `Err(NotFound)` — identical
 /// to a missing repo, so private existence never leaks.
 async fn resolve(
     state: &AppState,
     owner_name: &str,
     repo_path: &str,
     viewer: Option<&User>,
 ) -> AppResult<Option<RepoCtx>> {
     let Some(owner) = state.store.user_by_username(owner_name).await? else {
         return Ok(None);
     };
     let Some(repo) = state.store.repo_by_owner_path(&owner.id, repo_path).await? else {
         return Ok(None);
     };
     let viewer_id = viewer.map(|u| auth::Viewer {
         id: u.id.clone(),
         is_admin: u.is_admin,
     });
     let collaborator = match viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .await?
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
     };
     let access = auth::access(
         viewer_id.as_ref(),
         &repo,
         collaborator,
         state.config.instance.allow_anonymous,
     );
     if access == auth::Access::None {
         return Err(AppError::NotFound);
+    }
     Ok(Some(RepoCtx {
         owner,
         repo,
         access,
     }))
+}
 /// `GET /{owner}` — the user's page: their groups and repositories the viewer can
 /// see.
 pub async fn user_page(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     uri: Uri,
     Path(owner_name): Path<String>,
 ) -> AppResult<Response> {
     let Some(owner) = state.store.user_by_username(&owner_name).await? else {
         return Err(AppError::NotFound);
     };
     let repos = visible_repos(&state, &owner, viewer.as_ref()).await?;
     let groups = state.store.groups_by_owner(&owner.id).await?;
     let (jar, chrome) = build_chrome(&state, jar, viewer.clone(), uri.path().to_string());
     let body = html! {
         h1 { (owner.username) }
         @if !groups.is_empty() {
             section {
                 h2 { "Groups" }
                 ul class="repo-list" {
                     @for group in &groups {
                         li { a href={ "/" (owner.username) "/" (group.path) } { (group.path) } }
+                    }
+                }
+            }
+        }
         section {
             h2 { "Repositories" }
             (repo_list(&owner.username, &repos))
+        }
     };
     Ok((jar, page(&chrome, &owner.username, body)).into_response())
+}
 /// `GET /{owner}/{*rest}` — dispatch a repo path and view.
 pub async fn dispatch(
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     uri: Uri,
     Path((owner_name, rest)): Path<(String, String)>,
 ) -> AppResult<Response> {
     if let Some((repo_path, view)) = rest.split_once("/-/") {
         let ctx = resolve(&state, &owner_name, repo_path, viewer.as_ref())
             .await?
             .ok_or(AppError::NotFound)?;
         dispatch_view(&state, viewer, jar, &uri, ctx, view).await
     } else {
         match resolve(&state, &owner_name, &rest, viewer.as_ref()).await? {
             Some(ctx) => repo_home(&state, viewer, jar, &uri, ctx).await,
             None => group_listing(&state, viewer, jar, &uri, &owner_name, &rest).await,
+        }
+    }
+}
 /// Dispatch the portion after `/-/`.
 async fn dispatch_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
     view: &str,
 ) -> AppResult<Response> {
     let (kind, rest) = view.split_once('/').unwrap_or((view, ""));
     match kind {
         "tree" => tree_view(state, viewer, jar, uri, ctx, rest).await,
         "blob" => blob_view(state, viewer, jar, uri, ctx, rest, false).await,
         "raw" => raw_view(state, ctx, rest).await,
         "commits" => commits_view(state, viewer, jar, uri, ctx, rest).await,
         "branches" => branches_view(state, viewer, jar, uri, ctx).await,
         "tags" => tags_view(state, viewer, jar, uri, ctx).await,
         // `commit` (single-commit diff) lands with the commit-view phase; the
         // reserved `runs`/`search`/`settings` slots return 404 until built.
         _ => Err(AppError::NotFound),
+    }
+}
 /// Split `"{ref}/{path..}"` into the ref (first segment) and the remaining path.
 /// Branch names containing slashes resolve to their first segment only — a known
 /// MVP limitation.
 fn split_ref_path(rest: &str) -> (String, String) {
     match rest.split_once('/') {
         Some((r, p)) => (r.to_string(), p.to_string()),
         None => (rest.to_string(), String::new()),
+    }
+}
 /// The reference to browse, defaulting to the repo's default branch when none is
 /// given in the URL.
 fn ref_or_default(repo: &Repo, given: &str) -> String {
     if given.is_empty() {
         repo.default_branch.clone()
     } else {
         given.to_string()
+    }
+}
 // ---- Repo home ----
 async fn repo_home(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     let rev_name = ctx.repo.default_branch.clone();
     // Resolve the default branch; an unborn HEAD means an empty repo.
     let resolved = git_read(state, &ctx.repo.id, {
         let rev_name = rev_name.clone();
         move |repo| repo.resolve_ref(&rev_name)
     })
     .await;
     let body = match resolved {
         Err(_) => empty_repo_body(state, &ctx),
         Ok(rev) => {
             let entries = git_read(state, &ctx.repo.id, {
                 let rev = rev.clone();
                 move |repo| repo.tree_entries(&rev, FsPath::new(""))
             })
             .await?;
             let readme = load_readme(state, &ctx.repo.id, &rev, &entries).await;
             html! {
                 (repo_header(state, &ctx, Tab::Code, &rev_name))
                 (tree_table(&ctx.owner.username, &ctx.repo.path, &rev_name, "", &entries))
                 @if let Some(rendered) = readme {
                     div class="card" style="margin-top:1rem" { (rendered) }
+                }
+            }
+        }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 /// Find and render the first matching README in the root tree.
 async fn load_readme(
     state: &AppState,
     repo_id: &str,
     rev: &git::Resolved,
     entries: &[git::TreeEntry],
 ) -> Option<Markup> {
     let name = README_NAMES.iter().find(|candidate| {
         entries
             .iter()
             .any(|e| e.kind == git::EntryKind::File && e.name.eq_ignore_ascii_case(candidate))
     })?;
     let name = (*name).to_string();
     let blob = git_read(state, repo_id, {
         let rev = rev.clone();
         let name = name.clone();
         move |repo| repo.blob(&rev, FsPath::new(&name))
     })
     .await
     .ok()?;
     if blob.is_binary {
         return None;
+    }
     let text = String::from_utf8_lossy(&blob.content);
     Some(markdown::render(&text))
+}
 /// The "empty repository" landing with clone instructions.
 fn empty_repo_body(state: &AppState, ctx: &RepoCtx) -> Markup {
     html! {
         (repo_header(state, ctx, Tab::Code, &ctx.repo.default_branch))
         div class="card" {
             h2 { "This repository is empty" }
             p class="muted" { "Push a commit to get started:" }
             pre class="code" {
                 (clone_https(state, ctx)) "\n"
+            }
+        }
+    }
+}
 // ---- Tree view ----
 async fn tree_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
     rest: &str,
 ) -> AppResult<Response> {
     let (rev_name, path) = split_ref_path(rest);
     let rev_name = ref_or_default(&ctx.repo, &rev_name);
     let rev = git_read(state, &ctx.repo.id, {
         let rev_name = rev_name.clone();
         move |repo| repo.resolve_ref(&rev_name)
     })
     .await?;
     let entries = git_read(state, &ctx.repo.id, {
         let rev = rev.clone();
         let path = path.clone();
         move |repo| repo.tree_entries(&rev, FsPath::new(&path))
     })
     .await?;
     let body = html! {
         (repo_header(state, &ctx, Tab::Code, &rev_name))
         (breadcrumb(&ctx.owner.username, &ctx.repo.path, &rev_name, &path))
         (tree_table(&ctx.owner.username, &ctx.repo.path, &rev_name, &path, &entries))
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}: {path}", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Blob view ----
 async fn blob_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
     rest: &str,
     _raw: bool,
 ) -> AppResult<Response> {
     let (rev_name, path) = split_ref_path(rest);
     let rev_name = ref_or_default(&ctx.repo, &rev_name);
     if path.is_empty() {
         return Err(AppError::NotFound);
+    }
     let rev = git_read(state, &ctx.repo.id, {
         let rev_name = rev_name.clone();
         move |repo| repo.resolve_ref(&rev_name)
     })
     .await?;
     // Read the blob and resolve any attribute language override in one pass.
     let (blob, attr_lang) = git_read(state, &ctx.repo.id, {
         let rev = rev.clone();
         let path = path.clone();
         move |repo| {
             let blob = repo.blob(&rev, FsPath::new(&path))?;
             let attrs = repo.attributes_set(&rev.oid).ok();
             let lang = attrs.and_then(|set| set.attributes(&path).language().map(str::to_string));
             Ok((blob, lang))
+        }
     })
     .await?;
     let content_body = render_blob(&ctx, &rev_name, &path, &blob, attr_lang.as_deref());
     let body = html! {
         (repo_header(state, &ctx, Tab::Code, &rev_name))
         (breadcrumb(&ctx.owner.username, &ctx.repo.path, &rev_name, &path))
         (content_body)
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}: {path}", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 /// Render a blob: highlighted code with line anchors, an inline image, or a
 /// binary notice.
 fn render_blob(
     ctx: &RepoCtx,
     rev_name: &str,
     path: &str,
     blob: &git::Blob,
     attr_lang: Option<&str>,
 ) -> Markup {
     let raw_url = format!(
         "/{}/{}/-/raw/{rev_name}/{path}",
         ctx.owner.username, ctx.repo.path
     );
     let filename = path.rsplit('/').next().unwrap_or(path);
     html! {
         div class="blob-header" {
             span class="muted" { (blob.size) " bytes" }
             span { a class="btn" href=(raw_url) { "Raw" }
                    button class="btn" type="button" data-clipboard=(raw_url) { "Copy path" } }
+        }
         @if is_image(filename) {
             p { img src=(raw_url) alt=(filename) style="max-width:100%"; }
         } @else if blob.is_binary {
             div class="card" {
                 p class="muted" { "Binary file not shown." }
                 p { a class="btn" href=(raw_url) { "Download" } }
+            }
         } @else {
             (highlighted_code(FsPath::new(path), &blob.content, attr_lang))
+        }
+    }
+}
 /// Render highlighted code as a line-numbered table with `#L{n}` anchors.
 fn highlighted_code(path: &FsPath, content: &[u8], attr_lang: Option<&str>) -> Markup {
     let highlighted = highlight::highlight(path, content, attr_lang);
     html! {
         table class="blob" {
             tbody {
                 @for (i, line) in highlighted.lines.iter().enumerate() {
                     @let n = i + 1;
                     tr id={ "L" (n) } {
                         td class="lineno" { a href={ "#L" (n) } { (n) } }
                         td class="code-line" {
                             @for span in &line.spans {
                                 @match span.class {
                                     Some(class) => { span class=(class) { (span.text) } }
                                     None => { (span.text) }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
 // ---- Raw ----
 async fn raw_view(state: &AppState, ctx: RepoCtx, rest: &str) -> AppResult<Response> {
     let (rev_name, path) = split_ref_path(rest);
     let rev_name = ref_or_default(&ctx.repo, &rev_name);
     if path.is_empty() {
         return Err(AppError::NotFound);
+    }
     let rev = git_read(state, &ctx.repo.id, {
         let rev_name = rev_name.clone();
         move |repo| repo.resolve_ref(&rev_name)
     })
     .await?;
     let blob = git_read(state, &ctx.repo.id, {
         let rev = rev.clone();
         let path = path.clone();
         move |repo| repo.blob(&rev, FsPath::new(&path))
     })
     .await?;
     let filename = path.rsplit('/').next().unwrap_or(&path);
     // Serve images with their real type; everything else as text/plain to prevent
     // a stored-HTML blob from being interpreted as markup. `nosniff` reinforces it.
     let content_type = if is_image(filename) {
         mime_guess::from_path(filename)
             .first_raw()
             .unwrap_or("application/octet-stream")
     } else if blob.is_binary {
         "application/octet-stream"
     } else {
         "text/plain; charset=utf-8"
     };
     Ok((
+        [
             (header::CONTENT_TYPE, content_type),
             (header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
             (header::CONTENT_DISPOSITION, "inline"),
         ],
         blob.content,
+    )
         .into_response())
+}
 // ---- Branches ----
 async fn branches_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     let branches = git_read(state, &ctx.repo.id, git::Repo::branches).await?;
     let body = html! {
         (repo_header(state, &ctx, Tab::Branches, &ctx.repo.default_branch))
         h2 { "Branches" }
         table class="list" {
             thead { tr { th { "Branch" } th { "Ahead" } th { "Behind" } th { "Updated" } } }
             tbody {
                 @for b in &branches {
                     tr {
                         td {
                             a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/tree/" (b.name) } { (b.name) }
                             @if b.is_default { " " span class="badge" { "default" } }
+                        }
                         td { @if b.ahead > 0 { span style="color:var(--fb-success)" { (b.ahead) } } @else { "0" } }
                         td { (b.behind) }
                         td class="muted" { (b.tip.author.name) " · " (fmt_date(b.tip.author.time_ms)) }
+                    }
+                }
+            }
+        }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}: branches", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Tags ----
 async fn tags_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
 ) -> AppResult<Response> {
     let tags = git_read(state, &ctx.repo.id, git::Repo::tags).await?;
     let body = html! {
         (repo_header(state, &ctx, Tab::Tags, &ctx.repo.default_branch))
         h2 { "Tags" }
         table class="list" {
             thead { tr { th { "Tag" } th { "Commit" } th { "Kind" } } }
             tbody {
                 @for t in &tags {
                     tr {
                         td { a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/tree/" (t.name) } { (t.name) } }
                         td class="mono" { (t.oid.short()) }
                         td { (if t.annotated { "annotated" } else { "lightweight" }) }
+                    }
+                }
+            }
+        }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}: tags", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Commit list ----
 async fn commits_view(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     ctx: RepoCtx,
     rest: &str,
 ) -> AppResult<Response> {
     let rev_name = ref_or_default(&ctx.repo, rest);
     let rev = git_read(state, &ctx.repo.id, {
         let rev_name = rev_name.clone();
         move |repo| repo.resolve_ref(&rev_name)
     })
     .await?;
     let commits = git_read(state, &ctx.repo.id, {
         let rev = rev.clone();
         move |repo| repo.commits(&rev, None, git::Page::first(50))
     })
     .await?;
     // Verify signatures against all registered keys (bounded to this page's rows).
     let keys = signing_keys(state.store.all_keys().await?);
     let states = git_read(state, &ctx.repo.id, {
         let oids: Vec<git::Oid> = commits.iter().map(|c| c.oid.clone()).collect();
         move |repo| {
             Ok(oids
                 .iter()
                 .map(|o| repo.signature_state(o, &keys))
                 .collect::<Vec<_>>())
+        }
     })
     .await?;
     let body = html! {
         (repo_header(state, &ctx, Tab::Code, &rev_name))
         h2 { "Commits" }
         ul class="repo-list" {
             @for (commit, sig) in commits.iter().zip(states.iter()) {
                 li {
                     div class="name" {
                         a href={ "/" (ctx.owner.username) "/" (ctx.repo.path) "/-/commit/" (commit.oid) } {
                             (commit.summary)
+                        }
                         " " (signature_badge(sig))
+                    }
                     p class="muted" {
                         span class="mono" { (commit.oid.short()) }
                         " · " (commit.author.name) " · " (fmt_date(commit.author.time_ms))
+                    }
+                }
+            }
+        }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}: commits", ctx.owner.username, ctx.repo.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Group listing ----
 async fn group_listing(
     state: &AppState,
     viewer: Option<User>,
     jar: CookieJar,
     uri: &Uri,
     owner_name: &str,
     group_path: &str,
 ) -> AppResult<Response> {
     let Some(owner) = state.store.user_by_username(owner_name).await? else {
         return Err(AppError::NotFound);
     };
     let Some(group) = state
         .store
         .group_by_owner_path(&owner.id, group_path)
         .await?
     else {
         return Err(AppError::NotFound);
     };
     let all_groups = state.store.groups_by_owner(&owner.id).await?;
     let prefix = format!("{group_path}/");
     let subgroups: Vec<_> = all_groups
         .iter()
         .filter(|g| g.path.starts_with(&prefix) && !g.path[prefix.len()..].contains('/'))
         .collect();
     let repos: Vec<Repo> = visible_repos(state, &owner, viewer.as_ref())
         .await?
         .into_iter()
         .filter(|r| r.path.starts_with(&prefix) && !r.path[prefix.len()..].contains('/'))
         .collect();
     let body = html! {
         h1 { (owner.username) "/" (group.path) }
         @if !subgroups.is_empty() {
             section { h2 { "Subgroups" }
                 ul class="repo-list" {
                     @for g in &subgroups { li { a href={ "/" (owner.username) "/" (g.path) } { (g.path) } } }
+                }
+            }
+        }
         section { h2 { "Repositories" } (repo_list(&owner.username, &repos)) }
     };
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
     let title = format!("{}/{}", owner.username, group.path);
     Ok((jar, page(&chrome, &title, body)).into_response())
+}
 // ---- Shared components ----
 /// The repos of `owner` the viewer may see: all of them for the owner/admin, else
 /// the public ones.
 async fn visible_repos(
     state: &AppState,
     owner: &User,
     viewer: Option<&User>,
 ) -> AppResult<Vec<Repo>> {
     let repos = state.store.repos_by_owner(&owner.id).await?;
     let is_owner_or_admin = viewer.is_some_and(|v| v.id == owner.id || v.is_admin);
     if is_owner_or_admin {
         return Ok(repos);
+    }
     // Non-owners: public repos plus any where they are a collaborator.
     let mut out = Vec::new();
     for repo in repos {
         let allowed = !repo.is_private && state.config.instance.allow_anonymous;
         let collab = match viewer {
             Some(v) => state
                 .store
                 .collaborator_permission(&repo.id, &v.id)
                 .await?
                 .is_some(),
             None => false,
         };
         if allowed || collab {
             out.push(repo);
+        }
+    }
     Ok(out)
+}
 /// Render a list of repositories as links.
 fn repo_list(owner: &str, repos: &[Repo]) -> Markup {
     html! {
         @if repos.is_empty() {
             p class="muted" { "No repositories." }
         } @else {
             ul class="repo-list" {
                 @for repo in repos {
                     li {
                         div class="name" {
                             a href={ "/" (owner) "/" (repo.path) } { (repo.path) }
                             @if repo.is_private { " " span class="badge badge-private" { "private" } }
+                        }
                         @if let Some(desc) = &repo.description { p class="muted" { (desc) } }
+                    }
+                }
+            }
+        }
+    }
+}
 /// The repo sub-header: slug, tabs, and clone URLs.
 fn repo_header(state: &AppState, ctx: &RepoCtx, active: Tab, rev: &str) -> Markup {
     let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
     let tab = |t: Tab, label: &str, href: String| {
         html! {
             a href=(href) aria-current=[(active == t).then_some("page")] { (label) }
+        }
     };
     html! {
         div class="repo-head" {
             h1 class="repo-slug" {
                 a href={ "/" (ctx.owner.username) } { (ctx.owner.username) } "/"
                 a href=(base) { (ctx.repo.name) }
                 @if ctx.repo.is_private { " " span class="badge badge-private" { "private" } }
+            }
             @if let Some(desc) = &ctx.repo.description { p class="muted" { (desc) } }
             nav class="tabs repo-tabs" {
                 (tab(Tab::Code, "Code", base.clone()))
                 (tab(Tab::Branches, "Branches", format!("{base}/-/branches")))
                 (tab(Tab::Tags, "Tags", format!("{base}/-/tags")))
                 (tab(Tab::Search, "Search", format!("{base}/-/search")))
+            }
             div class="ref-row" {
                 // Current ref, linking to the branch picker.
                 a class="badge" href=(format!("{base}/-/branches")) { (rev) }
                 a href=(format!("{base}/-/commits/{rev}")) { "Commits" }
+            }
             div class="clone-row" {
                 input type="text" readonly value=(clone_https(state, ctx))
                       aria-label="HTTPS clone URL";
                 button class="btn" type="button" data-clipboard=(clone_https(state, ctx)) { "Copy" }
+            }
+        }
+    }
+}
 /// The HTTPS clone URL.
 fn clone_https(state: &AppState, ctx: &RepoCtx) -> String {
     format!(
         "{}/{}/{}.git",
         state.config.instance.url.trim_end_matches('/'),
         ctx.owner.username,
         ctx.repo.path
+    )
+}
 /// A path breadcrumb for tree/blob views.
 fn breadcrumb(owner: &str, repo_path: &str, rev: &str, path: &str) -> Markup {
     let root = format!("/{owner}/{repo_path}/-/tree/{rev}");
     // Precompute each crumb's (label, cumulative href) before rendering.
     let mut acc = String::new();
     let crumbs: Vec<(String, String)> = path
         .split('/')
         .filter(|s| !s.is_empty())
         .map(|segment| {
             if acc.is_empty() {
                 acc.push_str(segment);
             } else {
                 acc.push('/');
                 acc.push_str(segment);
+            }
             (segment.to_string(), format!("{root}/{acc}"))
         })
         .collect();
     html! {
         nav class="breadcrumb" {
             a href=(root) { (repo_path) }
             @for (label, href) in &crumbs {
                 " / " a href=(href) { (label) }
+            }
+        }
+    }
+}
 /// A tree listing table.
 fn tree_table(
     owner: &str,
     repo_path: &str,
     rev: &str,
     dir: &str,
     entries: &[git::TreeEntry],
 ) -> Markup {
     let href = |name: &str, kind: git::EntryKind| {
         let sub = if dir.is_empty() {
             name.to_string()
         } else {
             format!("{dir}/{name}")
         };
         let view = match kind {
             git::EntryKind::Directory => "tree",
             _ => "blob",
         };
         format!("/{owner}/{repo_path}/-/{view}/{rev}/{sub}")
     };
     html! {
         table class="list tree" {
             tbody {
                 @for entry in entries {
                     tr {
                         td class="tree-icon" { (entry_icon(entry.kind)) }
                         td { a href=(href(&entry.name, entry.kind)) { (entry.name) } }
+                    }
+                }
+            }
+        }
+    }
+}
 /// An icon glyph for a tree entry kind.
 fn entry_icon(kind: git::EntryKind) -> &'static str {
     match kind {
         git::EntryKind::Directory => "📁",
         git::EntryKind::Submodule => "📦",
         git::EntryKind::Symlink => "🔗",
         git::EntryKind::File => "📄",
+    }
+}
 /// A signature badge (green Verified / amber Unverified) with a descriptive title.
 fn signature_badge(state: &git::SignatureState) -> Markup {
     match state {
         git::SignatureState::Verified { fingerprint, .. } => html! {
             span class="badge badge-verified" title={ "Verified: " (fingerprint) } { "Verified" }
         },
         git::SignatureState::Unsigned => html! {
             span class="badge badge-unverified" title="This commit is not signed" { "Unverified" }
         },
         git::SignatureState::UnknownKey { fingerprint, .. } => html! {
             span class="badge badge-unverified"
                  title={ "Signed by an unrecognized key " (fingerprint) } { "Unverified" }
         },
         git::SignatureState::Invalid { reason, .. } => html! {
             span class="badge badge-unverified"
                  title={ "Signature could not be verified: " (reason) } { "Unverified" }
         },
+    }
+}
 /// Map registered keys to the verification input type.
 fn signing_keys(keys: Vec<model::Key>) -> Vec<git::SigningKey> {
     keys.into_iter()
         .map(|k| git::SigningKey {
             user_id: k.user_id,
             key_id: k.id,
             kind: k.kind,
             fingerprint: k.fingerprint,
             public_key: k.public_key,
         })
         .collect()
+}
 /// Whether a filename is a browser-renderable image.
 fn is_image(filename: &str) -> bool {
     matches!(
         filename
             .rsplit('.')
             .next()
             .map(str::to_ascii_lowercase)
             .as_deref(),
         Some("png" | "jpg" | "jpeg" | "gif" | "webp" | "svg" | "ico" | "bmp")
+    )
+}
 /// Format an epoch-millisecond timestamp as a `YYYY-MM-DD` date.
 fn fmt_date(ms: i64) -> String {
     let secs = ms.div_euclid(1000);
     match time::OffsetDateTime::from_unix_timestamp(secs) {
         Ok(dt) => format!(
             "{:04}-{:02}-{:02}",
             dt.year(),
             u8::from(dt.month()),
             dt.day()
         ),
         Err(_) => "—".to_string(),
+    }
+}

@@ @@ -14,7 +14,7 @@ use axum::Router; @@
 use axum::body::Body;
 use axum::http::{Request, StatusCode, header};
 use config::Config;
 use store::{NewUser, Store};
 use store::{NewRepo, NewUser, Store};
 use tower::ServiceExt as _;
 use crate::AppState;
@@ @@ -236,3 +236,33 @@ async fn unknown_theme_is_rejected() { @@
     let res = app.oneshot(get("/settings/theme?name=nope")).await.unwrap();
     assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+}
 #[tokio::test]
 async fn private_repo_is_404_for_anonymous() {
     let (state, app) = app().await;
     let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
     state
         .store
         .create_repo(NewRepo {
             owner_id: ada.id,
             group_id: None,
             name: "secret".to_string(),
             path: "secret".to_string(),
             description: None,
             is_private: true,
             default_branch: "main".to_string(),
         })
         .await
         .unwrap();
     // Access is denied before any git read, so existence never leaks: 404, not 403.
     let res = app.oneshot(get("/ada/secret")).await.unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
 #[tokio::test]
 async fn unknown_owner_is_404() {
     let (_state, app) = app().await;
     let res = app.oneshot(get("/nobody")).await.unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}