hanna/fabrica

feat(web): issue/PR dependencies and stacked PRs

3ffdeed · hanna committed on 2026-07-25

Add a dependency graph between issues and PRs (migration 0008 +
issue_dependencies): an item can be blocked by others and, transitively,
block others. The issue and PR views gain a "Blocked by" / "Blocks" sidebar
section with add-by-number and remove for writers; because issues and PRs
share the table, a PR can depend on another PR (stacked PRs). A PR with any
open dependency shows a blocked notice and is refused server-side at merge.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +36 −0

crates/store/src/issues.rs +122 −0

crates/web/src/issues.rs +151 −0

crates/web/src/lib.rs +2 −0

crates/web/src/pulls.rs +36 −4

crates/web/src/tests.rs +76 −0

migrations/postgres/0008_issue_dependencies.sql +10 −0

migrations/sqlite/0008_issue_dependencies.sql +10 −0

+  }
+}
+/* Issue/PR dependency lists in the sidebar. */
+.dep-list {
+  list-style: none;
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  margin-bottom: 0.5rem;
+}
+.dep-row {
+  display: flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-size: 0.9em;
+}
+.dep-row > a {
+  flex: 1;
+  min-width: 0;
+  color: var(--fb-fg);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.dep-row .icon-btn {
+  width: 1.5rem;
+  height: 1.5rem;
+  flex: none;
+}
+.dep-add {
+  display: flex;
+  gap: 0.4rem;
+}
+.dep-add input {
+  flex: 1;
+  min-width: 0;
+}
 /* Pagination controls for long lists. */
 .pagination {
   display: flex;

         Ok(row.as_ref().map(|r| self.map_issue(r)).transpose()?)
+    }
+    /// Fetch an issue or PR by repo and number, of either kind (for dependency
+    /// references, which cross issues and PRs).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn issue_by_number_any(
+        &self,
+        repo_id: &str,
+        number: i64,
+    ) -> Result<Option<Issue>, StoreError> {
+        let sql = format!("SELECT {ISSUE_COLUMNS} FROM issues WHERE repo_id = $1 AND number = $2");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(repo_id)
+            .bind(number)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_issue(r)).transpose()?)
+    }
     /// Fetch an issue/PR by id.
     ///
     /// # Errors
         Ok(())
+    }
+    // ---- Dependencies ----
+    /// Record that `issue_id` is blocked by `depends_on_id` (idempotent).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn add_dependency(
+        &self,
+        issue_id: &str,
+        depends_on_id: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query(
+            "INSERT INTO issue_dependencies (issue_id, depends_on_id, created_at) \
+             VALUES ($1, $2, $3) ON CONFLICT (issue_id, depends_on_id) DO NOTHING",
+        )
+        .bind(issue_id)
+        .bind(depends_on_id)
+        .bind(now_ms())
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+    /// Remove a dependency edge.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn remove_dependency(
+        &self,
+        issue_id: &str,
+        depends_on_id: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query("DELETE FROM issue_dependencies WHERE issue_id = $1 AND depends_on_id = $2")
+            .bind(issue_id)
+            .bind(depends_on_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    /// The issues/PRs that `issue_id` is blocked by (its dependencies).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn dependencies_of(&self, issue_id: &str) -> Result<Vec<Issue>, StoreError> {
+        self.related_issues(
+            "SELECT i.id, i.repo_id, i.number, i.author_id, i.title, i.body, i.state, \
+                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at \
+             FROM issue_dependencies d JOIN issues i ON i.id = d.depends_on_id \
+             WHERE d.issue_id = $1 ORDER BY i.number ASC",
+            issue_id,
+        )
+        .await
+    }
+    /// The issues/PRs blocked by `issue_id` (its dependents).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn dependents_of(&self, issue_id: &str) -> Result<Vec<Issue>, StoreError> {
+        self.related_issues(
+            "SELECT i.id, i.repo_id, i.number, i.author_id, i.title, i.body, i.state, \
+                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at \
+             FROM issue_dependencies d JOIN issues i ON i.id = d.issue_id \
+             WHERE d.depends_on_id = $1 ORDER BY i.number ASC",
+            issue_id,
+        )
+        .await
+    }
+    /// Count `issue_id`'s dependencies that are still open (i.e. blocking it).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn open_dependency_count(&self, issue_id: &str) -> Result<i64, StoreError> {
+        let row = sqlx::query(
+            "SELECT COUNT(*) AS n FROM issue_dependencies d JOIN issues i ON i.id = d.depends_on_id \
+             WHERE d.issue_id = $1 AND i.state = 'open'",
+        )
+        .bind(issue_id)
+        .fetch_one(&self.pool)
+        .await?;
+        Ok(row.try_get("n")?)
+    }
+    /// Run a dependency join query bound to one issue id and map the rows.
+    async fn related_issues(&self, sql: &str, issue_id: &str) -> Result<Vec<Issue>, StoreError> {
+        let rows = sqlx::query(AssertSqlSafe(sql.to_string()))
+            .bind(issue_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(|r| self.map_issue(r))
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
     /// Map an `issues` row (selected via [`ISSUE_COLUMNS`]) to an [`Issue`].
     fn map_issue(&self, row: &AnyRow) -> Result<Issue, sqlx::Error> {
         Ok(Issue {

         Some(id) => Some(username(state, id).await),
         None => None,
     };
+    let deps = state.store.dependencies_of(&issue.id).await?;
+    let dependents = state.store.dependents_of(&issue.id).await?;
     let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
     let is_author = viewer.as_ref().is_some_and(|v| v.id == issue.author_id);
                             (label_form(&issue, &repo_labels, &issue_labels, &csrf))
+                        }
+                    }
+                    (deps_section(&issue, &ctx, &deps, &dependents, &csrf, can_write))
+                }
+            }
+        }
+    }
+}
+/// The dependencies sidebar section: "Blocked by" (with add/remove for writers)
+/// and "Blocks" (read-only). Shared by the issue and PR views.
+pub(crate) fn deps_section(
+    issue: &Issue,
+    ctx: &RepoCtx,
+    deps: &[Issue],
+    dependents: &[Issue],
+    csrf: &str,
+    can_write: bool,
+) -> Markup {
+    let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
+    let row = |dep: &Issue, removable: bool| {
+        let seg = if dep.is_pull { "pulls" } else { "issues" };
+        html! {
+            li class="dep-row" {
+                (state_icon(dep.state, dep.is_pull))
+                a href=(format!("{base}/-/{seg}/{}", dep.number)) {
+                    span class="muted mono" { "#" (dep.number) } " " (dep.title)
+                }
+                @if removable && can_write {
+                    form method="post" action=(format!("/issue/{}/deps/remove", issue.id)) class="dep-remove" {
+                        input type="hidden" name="_csrf" value=(csrf);
+                        input type="hidden" name="depends_on" value=(dep.id);
+                        button class="icon-btn" type="submit" aria-label="Remove dependency" { (icon(Icon::X)) }
+                    }
+                }
+            }
+        }
+    };
+    html! {
+        section {
+            h3 { "Blocked by" }
+            @if deps.is_empty() {
+                p class="muted" { "Nothing" }
+            } @else {
+                ul class="dep-list" { @for d in deps { (row(d, true)) } }
+            }
+            @if can_write {
+                form method="post" action=(format!("/issue/{}/deps/add", issue.id)) class="side-form dep-add" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    input type="number" name="number" min="1" placeholder="#123" aria-label="Depends on number" required;
+                    button class="btn" type="submit" { "Add" }
+                }
+            }
+            @if !dependents.is_empty() {
+                h3 { "Blocks" }
+                ul class="dep-list" { @for d in dependents { (row(d, false)) } }
+            }
+        }
+    }
+}
 /// Resolve a username for display, falling back to the id.
 pub(crate) async fn username(state: &AppState, user_id: &str) -> String {
     state
     respond_redirect(result)
+}
+/// Add-dependency form: the number of the blocking issue/PR.
+#[derive(Debug, Deserialize)]
+pub struct DepAddForm {
+    /// The number of the issue/PR this one depends on.
+    #[serde(default)]
+    number: i64,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /issue/{id}/deps/add` — mark this issue/PR blocked by another (Write).
+pub async fn deps_add(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<DepAddForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Write {
+            return Err(AppError::Forbidden);
+        }
+        // Resolve the referenced number within the same repo (issue or PR).
+        let target = state
+            .store
+            .issue_by_number_any(&repo.id, form.number)
+            .await?
+            .ok_or_else(|| AppError::BadRequest(format!("No issue or PR #{}.", form.number)))?;
+        if target.id == issue.id {
+            return Err(AppError::BadRequest(
+                "An item cannot depend on itself.".to_string(),
+            ));
+        }
+        state.store.add_dependency(&issue.id, &target.id).await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Remove-dependency form: the depended-on issue id.
+#[derive(Debug, Deserialize)]
+pub struct DepRemoveForm {
+    /// The `issues` id this one no longer depends on.
+    #[serde(default)]
+    depends_on: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /issue/{id}/deps/remove` — drop a dependency edge (Write).
+pub async fn deps_remove(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<DepRemoveForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Write {
+            return Err(AppError::Forbidden);
+        }
+        state
+            .store
+            .remove_dependency(&issue.id, &form.depends_on)
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
 /// Redirect on success, render the error otherwise.
 pub(crate) fn respond_redirect(result: AppResult<String>) -> Response {
     match result {

         .route("/issue/{id}/state", post(issues::set_state))
         .route("/issue/{id}/assignee", post(issues::set_assignee))
         .route("/issue/{id}/labels", post(issues::set_labels))
+        .route("/issue/{id}/deps/add", post(issues::deps_add))
+        .route("/issue/{id}/deps/remove", post(issues::deps_remove))
         .route("/pull-new/{repo_id}", post(pulls::create))
         .route("/pull/{id}/merge", post(pulls::merge))
         .route("/healthz", get(serve_assets::healthz))

 use crate::diff;
 use crate::error::{AppError, AppResult};
 use crate::issues::{
-    Kind, access_for, assignee_form, comment_card, issue_url, label_form, repo_of_issue,
+    Kind, access_for, assignee_form, comment_card, deps_section, issue_url, label_form,
-    respond_redirect, state_badge, state_button, username,
+    repo_of_issue, respond_redirect, state_badge, state_button, username,
 };
 use crate::layout::page;
 use crate::pages::build_chrome;
         commits,
         files,
         mergeable,
+        deps,
+        dependents,
+        blocked,
     } = gather(state, &ctx, &issue, &pr, can_write).await?;
     let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
                     @for (c, cauthor) in &comment_rows {
                         (comment_card(cauthor, &c.body, c.created_at))
+                    }
-                    (merge_panel(&issue, &pr, mergeable, &csrf))
+                    (merge_panel(&issue, &pr, mergeable, blocked, &csrf))
                     @if can_write {
                         div class="card comment-form" {
                             form method="post" action=(format!("/issue/{}/comment", issue.id)) {
                             (label_form(&issue, &repo_labels, &issue_labels, &csrf))
+                        }
+                    }
+                    (deps_section(&issue, &ctx, &deps, &dependents, &csrf, can_write))
+                }
+            }
             @if issue.state == model::IssueState::Open {
     files: Vec<crate::diff::RenderedFile>,
     /// Mergeability, computed only for an open PR the viewer can merge.
     mergeable: Option<git::merge::Mergeability>,
+    /// The issues/PRs this PR is blocked by.
+    deps: Vec<model::Issue>,
+    /// The issues/PRs blocked by this PR.
+    dependents: Vec<model::Issue>,
+    /// Whether any dependency is still open (blocking the merge).
+    blocked: bool,
+}
 /// Load the comments, labels, assignee, diff, and mergeability for the PR view.
     } else {
         None
     };
+    let deps = state.store.dependencies_of(&issue.id).await?;
+    let dependents = state.store.dependents_of(&issue.id).await?;
+    let blocked = deps.iter().any(|d| d.state == model::IssueState::Open);
     Ok(Loaded {
         author,
         comment_rows,
         commits,
         files,
         mergeable,
+        deps,
+        dependents,
+        blocked,
     })
+}
     state_badge(issue.state, true)
+}
-/// The merge panel: shows mergeability and, when clean, the strategy buttons.
+/// The merge panel: shows mergeability and, when clean and unblocked, the
+/// strategy buttons. Open dependencies block the merge.
 fn merge_panel(
     issue: &model::Issue,
     pr: &model::PullRequest,
     mergeable: Option<git::merge::Mergeability>,
+    blocked: bool,
     csrf: &str,
 ) -> Markup {
     use git::merge::Mergeability;
     if issue.state != model::IssueState::Open {
         return html! {};
+    }
+    // A merge is blocked until every dependency is closed.
+    if blocked && mergeable.is_some() {
+        return html! {
+            div class="card merge-panel conflicts" {
+                p { "This pull request is blocked by open dependencies and cannot be merged yet." }
+            }
+        };
+    }
     match mergeable {
         None => html! {},
         Some(Mergeability::AlreadyMerged) => html! {
                 "This pull request is already closed.".to_string(),
             ));
+        }
+        // Refuse to merge while any dependency is still open.
+        if state.store.open_dependency_count(&issue.id).await? > 0 {
+            return Err(AppError::BadRequest(
+                "This pull request is blocked by open dependencies.".to_string(),
+            ));
+        }
         let strategy = git::merge::MergeStrategy::from_token(&form.strategy);
         let sha = run_merge(&state, &repo, &pr, &user, strategy, &issue).await?;

+}
 #[tokio::test]
+async fn issue_dependencies_block_and_unblock() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id.clone(),
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    // #1 will depend on #2.
+    let one = state
+        .store
+        .create_issue(&repo.id, &ada.id, "feature", "", false)
+        .await
+        .unwrap();
+    let two = state
+        .store
+        .create_issue(&repo.id, &ada.id, "prerequisite", "", false)
+        .await
+        .unwrap();
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // Add the dependency: #1 depends on #2.
+    let req = Request::builder()
+        .method("POST")
+        .uri(format!("/issue/{}/deps/add", one.id))
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::from(format!("number=2&_csrf={token}")))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert_eq!(
+        state.store.open_dependency_count(&one.id).await.unwrap(),
+,
+        "one open blocker"
+    );
+    // #1's view lists the blocker; #2's view lists what it blocks.
+    let res = app
+        .clone()
+        .oneshot(get("/ada/proj/-/issues/1"))
+        .await
+        .unwrap();
+    let html = body_string(res).await;
+    assert!(html.contains("Blocked by"), "blocked-by section");
+    assert!(html.contains("prerequisite"), "blocker listed");
+    // Closing #2 clears the block.
+    state
+        .store
+        .set_issue_state(&two.id, model::IssueState::Closed)
+        .await
+        .unwrap();
+    assert_eq!(
+        state.store.open_dependency_count(&one.id).await.unwrap(),
+,
+        "no open blockers once closed"
+    );
+}
+#[tokio::test]
 async fn issues_404_when_disabled() {
     let (state, app) = app().await;
     let ada = state.store.user_by_username("ada").await.unwrap().unwrap();

+-- Dependencies between issues/PRs: `issue_id` is blocked by `depends_on_id`.
+-- The reverse direction ("blocks") is read by querying depends_on_id. Works
+-- across issues and PRs uniformly (both live in `issues`), so PRs can be stacked.
+CREATE TABLE issue_dependencies (
+    issue_id      TEXT NOT NULL REFERENCES issues(id) ON DELETE CASCADE,
+    depends_on_id TEXT NOT NULL REFERENCES issues(id) ON DELETE CASCADE,
+    created_at    BIGINT NOT NULL,
+    PRIMARY KEY (issue_id, depends_on_id)
+);
+CREATE INDEX idx_issue_deps_depends_on ON issue_dependencies (depends_on_id);