hanna/fabrica

feat(web): edit issue/PR title & comments, lock conversations, assignee tidy

eb14334 · hanna committed on 2026-07-25

Add an edit toggle on the issue/PR header (title + description) and an inline
edit form on each comment (author or writer), backed by /issue/{id}/edit and
/comment/{id}/edit (store update_issue/update_comment). Add conversation locking
(migration 0011 issues.locked_at): writers get a Lock/Unlock button, a locked
notice shows, and the comment endpoint rejects non-writers while locked. Drop
the redundant assignee name line — the selector already shows it. Extract
comment_box/locked_note helpers to keep the views under the line limit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

assets/base.css +39 −0

crates/model/src/entity.rs +10 −0

crates/store/src/issues.rs +68 −3

crates/web/src/issues.rs +240 −21

crates/web/src/lib.rs +4 −0

crates/web/src/pulls.rs +23 −19

crates/web/src/tests.rs +149 −0

migrations/postgres/0011_issue_lock.sql +2 −0

migrations/sqlite/0011_issue_lock.sql +2 −0

 .issue-header h1 {
   margin: 0;
+}
+.issue-title-line {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+}
+.issue-edit,
+.comment-edit {
+  flex: none;
+}
+.issue-edit > summary,
+.comment-edit > summary {
+  cursor: pointer;
+  list-style: none;
+}
+.issue-edit > summary::-webkit-details-marker,
+.comment-edit > summary::-webkit-details-marker {
+  display: none;
+}
+.issue-edit .card {
+  margin-top: 0.5rem;
+  width: min(32rem, 90vw);
+}
+.comment-edit {
+  margin-left: auto;
+}
+.comment-edit > summary {
+  font-size: 0.9em;
+  color: var(--fb-accent);
+}
+.comment-edit form {
+  margin-top: 0.5rem;
+}
+.comment-edit textarea {
+  font-family: inherit;
+}
 .issue-sub {
   display: flex;
   align-items: center;
   overflow: hidden;
+}
 .comment-head {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
   padding: 0.5rem 0.85rem;
   border-bottom: 1px solid var(--fb-border);
   font-size: 0.9em;

     pub updated_at: Timestamp,
     /// When it was closed, if it is.
     pub closed_at: Option<Timestamp>,
+    /// When the conversation was locked, or `None` if unlocked.
+    pub locked_at: Option<Timestamp>,
+}
+impl Issue {
+    /// Whether the conversation is locked (only writers may comment).
+    #[must_use]
+    pub fn locked(&self) -> bool {
+        self.locked_at.is_some()
+    }
+}
 /// A comment on an issue or pull request.

 /// The columns of `issues` in a fixed order.
 const ISSUE_COLUMNS: &str = "id, repo_id, number, author_id, title, body, state, is_pull, \
-     assignee_id, created_at, updated_at, closed_at";
+     assignee_id, created_at, updated_at, closed_at, locked_at";
 /// Open/closed counts for a repo's issues or PRs.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
             created_at: now,
             updated_at: now,
             closed_at: None,
+            locked_at: None,
         };
         let sql = "INSERT INTO issues \
              (id, repo_id, number, author_id, title, body, state, is_pull, assignee_id, \
         Ok(updated > 0)
+    }
+    /// Lock or unlock an issue/PR conversation.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_issue_locked(&self, id: &str, locked: bool) -> Result<bool, StoreError> {
+        let now = now_ms();
+        let locked_at = locked.then_some(now);
+        let updated =
+            sqlx::query("UPDATE issues SET locked_at = $1, updated_at = $2 WHERE id = $3")
+                .bind(locked_at)
+                .bind(now)
+                .bind(id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        Ok(updated > 0)
+    }
     /// Set (or clear) an issue/PR's assignee.
     ///
     /// # Errors
             .map_err(Into::into)
+    }
+    /// Fetch a single comment by id (for edit authorization).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn comment_by_id(&self, id: &str) -> Result<Option<Comment>, StoreError> {
+        let row = sqlx::query(
+            "SELECT id, issue_id, author_id, body, created_at, updated_at FROM comments \
+             WHERE id = $1",
+        )
+        .bind(id)
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(|r| {
+            Ok(Comment {
+                id: r.try_get("id")?,
+                issue_id: r.try_get("issue_id")?,
+                author_id: r.try_get("author_id")?,
+                body: r.try_get("body")?,
+                created_at: r.try_get("created_at")?,
+                updated_at: r.try_get("updated_at")?,
+            })
+        })
+        .transpose()
+        .map_err(|e: sqlx::Error| e.into())
+    }
+    /// Edit a comment's body.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn update_comment(&self, id: &str, body: &str) -> Result<bool, StoreError> {
+        let updated = sqlx::query("UPDATE comments SET body = $1, updated_at = $2 WHERE id = $3")
+            .bind(body)
+            .bind(now_ms())
+            .bind(id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(updated > 0)
+    }
     // ---- Issue labels ----
     /// The labels applied to an issue/PR.
             created_at: now,
             updated_at: now,
             closed_at: None,
+            locked_at: None,
         };
         sqlx::query(
             "INSERT INTO issues \
     pub async fn dependencies_of(&self, issue_id: &str) -> Result<Vec<Issue>, StoreError> {
         self.related_issues(
             "SELECT i.id, i.repo_id, i.number, i.author_id, i.title, i.body, i.state, \
-                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at \
+                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at, i.locked_at \
              FROM issue_dependencies d JOIN issues i ON i.id = d.depends_on_id \
              WHERE d.issue_id = $1 ORDER BY i.number ASC",
             issue_id,
     pub async fn dependents_of(&self, issue_id: &str) -> Result<Vec<Issue>, StoreError> {
         self.related_issues(
             "SELECT i.id, i.repo_id, i.number, i.author_id, i.title, i.body, i.state, \
-                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at \
+                    i.is_pull, i.assignee_id, i.created_at, i.updated_at, i.closed_at, i.locked_at \
              FROM issue_dependencies d JOIN issues i ON i.id = d.issue_id \
              WHERE d.depends_on_id = $1 ORDER BY i.number ASC",
             issue_id,
             created_at: row.try_get("created_at")?,
             updated_at: row.try_get("updated_at")?,
             closed_at: row.try_get("closed_at")?,
+            locked_at: row.try_get("locked_at")?,
         })
+    }
+}

+}
 /// Build the application router with all middleware wired.
+#[allow(clippy::too_many_lines)] // A flat route table; splitting it hurts readability.
 pub fn build_router(state: AppState) -> Router {
     let x_request_id = HeaderName::from_static("x-request-id");
         .route("/issue/{id}/labels", post(issues::set_labels))
         .route("/issue/{id}/deps/add", post(issues::deps_add))
         .route("/issue/{id}/deps/remove", post(issues::deps_remove))
+        .route("/issue/{id}/edit", post(issues::edit))
+        .route("/issue/{id}/lock", post(issues::set_lock))
+        .route("/comment/{id}/edit", post(issues::comment_edit))
         .route("/pull-new/{repo_id}", post(pulls::create))
         .route("/pull/{id}/merge", post(pulls::merge))
         .route("/healthz", get(serve_assets::healthz))

 use crate::diff;
 use crate::error::{AppError, AppResult};
 use crate::issues::{
-    Kind, access_for, assignee_form, comment_card, deps_section, issue_url, label_form,
+    Kind, access_for, assignee_form, comment_box, comment_card, deps_section, edit_issue_form,
-    repo_of_issue, respond_redirect, state_badge, state_button, username,
+    issue_url, label_form, locked_note, repo_of_issue, respond_redirect, state_badge, username,
 };
 use crate::layout::page;
 use crate::pages::build_chrome;
     let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
     let is_author = viewer.as_ref().is_some_and(|v| v.id == issue.author_id);
+    let viewer_id: Option<String> = viewer.as_ref().map(|u| u.id.clone());
     let branches = branch_names(state, &ctx.repo.id).await;
     let Loaded {
         author,
         (repo_header(state, &ctx, Tab::Pulls, &ctx.repo.default_branch, &branches))
         div class="issue-view" {
             header class="issue-header" {
-                h1 { (issue.title) " " span class="muted" { "#" (issue.number) } }
+                div class="issue-title-line" {
+                    h1 { (issue.title) " " span class="muted" { "#" (issue.number) } }
+                    @if can_write || is_author {
+                        (edit_issue_form(&issue, Kind::pulls(), &csrf))
+                    }
+                }
                 div class="issue-sub" {
                     (pr_state_badge(&issue, &pr))
                     span class="muted" {
+            }
             div class="issue-main" {
                 article class="issue-thread" {
-                    (comment_card(&author, &issue.body, issue.created_at))
+                    (comment_card(&author, &issue.body, issue.created_at, None))
                     @for (c, cauthor) in &comment_rows {
-                        (comment_card(cauthor, &c.body, c.created_at))
+                        @let editable = can_write || viewer_id.as_deref() == Some(c.author_id.as_str());
+                        (comment_card(cauthor, &c.body, c.created_at,
+                            editable.then_some((c.id.as_str(), csrf.as_str()))))
+                    }
                     (merge_panel(&issue, &pr, mergeable, blocked, &csrf))
-                    @if can_write || is_author {
+                    @if issue.locked() { (locked_note(can_write)) }
-                        @let comment_form = format!("comment-{}", issue.id);
+                    @if can_write || (is_author && !issue.locked()) {
-                        div class="card comment-form" {
+                        (comment_box(&issue, &csrf, Kind::pulls(), can_write))
-                            form id=(comment_form) method="post" action=(format!("/issue/{}/comment", issue.id)) {
-                                input type="hidden" name="_csrf" value=(csrf);
-                                textarea name="body" rows="4" placeholder="Leave a comment (markdown)" required {}
-                            }
-                            div class="comment-actions" {
-                                (state_button(&issue, &csrf, Kind::pulls()))
-                                button class="btn btn-primary inline-btn" type="submit" form=(comment_form) { "Comment" }
-                            }
-                        }
+                    }
+                }
                 aside class="issue-side" {
                     section {
                         h3 { "Assignee" }
-                        @if let Some(a) = &assignee { p { (a) } } @else { p class="muted" { "No one" } }
+                        @if can_write {
-                        @if can_write { (assignee_form(&issue, &ctx, state, &csrf).await) }
+                            (assignee_form(&issue, &ctx, state, &csrf).await)
+                        } @else if let Some(a) = &assignee {
+                            p { (a) }
+                        } @else {
+                            p class="muted" { "No one" }
+                        }
+                    }
                     section {
                         h3 { "Labels" }

+}
 #[tokio::test]
+async fn issue_title_and_comments_are_editable() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id.clone(),
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    let issue = state
+        .store
+        .create_issue(&repo.id, &ada.id, "typo", "body", false)
+        .await
+        .unwrap();
+    let comment = state
+        .store
+        .add_comment(&issue.id, &ada.id, "orignal")
+        .await
+        .unwrap();
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    let post = |uri: String, body: String, cookie: String| {
+        let app = app.clone();
+        async move {
+            let req = Request::builder()
+                .method("POST")
+                .uri(uri)
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .header(header::COOKIE, cookie)
+                .body(Body::from(body))
+                .unwrap();
+            app.oneshot(req).await.unwrap()
+        }
+    };
+    // Edit the issue title + body.
+    let res = post(
+        format!("/issue/{}/edit", issue.id),
+        format!("title=Fixed+title&body=new+body&_csrf={token}"),
+        cookie.clone(),
+    )
+    .await;
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    let updated = state.store.issue_by_id(&issue.id).await.unwrap().unwrap();
+    assert_eq!(updated.title, "Fixed title");
+    assert_eq!(updated.body, "new body");
+    // Edit the comment.
+    let res = post(
+        format!("/comment/{}/edit", comment.id),
+        format!("body=corrected&_csrf={token}"),
+        cookie,
+    )
+    .await;
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    let edited = state
+        .store
+        .comment_by_id(&comment.id)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(edited.body, "corrected");
+}
+#[tokio::test]
+async fn issue_can_be_locked_and_unlocked() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id.clone(),
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    let issue = state
+        .store
+        .create_issue(&repo.id, &ada.id, "hot", "", false)
+        .await
+        .unwrap();
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    let lock = |locked: bool, cookie: String| {
+        let app = app.clone();
+        let token = token.clone();
+        let id = issue.id.clone();
+        async move {
+            let req = Request::builder()
+                .method("POST")
+                .uri(format!("/issue/{id}/lock"))
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .header(header::COOKIE, cookie)
+                .body(Body::from(format!("locked={locked}&_csrf={token}")))
+                .unwrap();
+            app.oneshot(req).await.unwrap()
+        }
+    };
+    let res = lock(true, cookie.clone()).await;
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert!(
+        state
+            .store
+            .issue_by_id(&issue.id)
+            .await
+            .unwrap()
+            .unwrap()
+            .locked()
+    );
+    let res = lock(false, cookie).await;
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert!(
+        !state
+            .store
+            .issue_by_id(&issue.id)
+            .await
+            .unwrap()
+            .unwrap()
+            .locked()
+    );
+}
+#[tokio::test]
 async fn new_issue_can_apply_labels() {
     let (state, app) = app().await;
     let ada = state.store.user_by_username("ada").await.unwrap().unwrap();

@@ -0,0 +1,2 @@
	1	-- Locking an issue/PR prevents further comments (except by writers).
	2	ALTER TABLE issues ADD COLUMN locked_at BIGINT;