hanna/fabrica

feat(web): issues — list, create, view, comment, label, assign, close

f06e6d1 · hanna committed on 2026-07-25

Add the issues store module (create with shared per-repo numbering, list by
state with open/closed counts, state/assignee/labels, comments) and the web
issues module: an Issues repo tab (per-repo toggle), open/closed list, new
form, and an issue view with markdown body/comments, a comment box, close/
reopen, an assignee select, and a scoped-label picker. Mutations post to
fixed /issue-new/{repo} and /issue/{id}/* prefixes with CSRF + access checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +1 −0

assets/base.css +136 −3

crates/store/src/issues.rs +407 −0

crates/store/src/lib.rs +2 −0

crates/web/Cargo.toml +1 −0

crates/web/src/icons.rs +6 −0

crates/web/src/issues.rs +687 −0

crates/web/src/lib.rs +7 −0

crates/web/src/repo.rs +29 −7

crates/web/src/tests.rs +92 −0

  "tower-http",
  "tracing",
  "tracing-subscriber",
+ "url",
+]
 [[package]]

   flex: none;
+}
+/* ---- Issues & pull requests ---- */
+.issues-head {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 1rem;
+  flex-wrap: wrap;
+  margin-bottom: 0.5rem;
+}
+.issues-head .subnav {
+  margin: 0;
+  justify-content: flex-start;
+}
+.state-open {
+  color: var(--fb-success);
+  display: inline-flex;
+}
+.state-closed {
+  color: var(--fb-danger);
+  display: inline-flex;
+}
+.issue-title-row {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+.badge-state-open {
+  color: var(--fb-success);
+  border-color: var(--fb-success);
+}
+.badge-state-closed {
+  color: var(--fb-danger);
+  border-color: var(--fb-danger);
+}
+.issue-header {
+  margin-bottom: 1rem;
+  padding-bottom: 0.75rem;
+  border-bottom: 1px solid var(--fb-border);
+}
+.issue-header h1 {
+  margin: 0;
+}
+.issue-sub {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+.issue-main {
+  display: flex;
+  gap: 1.5rem;
+  align-items: flex-start;
+}
+.issue-thread {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+.issue-side {
+  flex: none;
+  width: 16rem;
+}
+.issue-side section {
+  margin-bottom: 1.25rem;
+  padding-bottom: 1rem;
+  border-bottom: 1px solid var(--fb-border);
+}
+.issue-side h3 {
+  font-size: 0.9rem;
+  margin-bottom: 0.5rem;
+}
+.comment {
+  padding: 0;
+  overflow: hidden;
+}
+.comment-head {
+  padding: 0.5rem 0.85rem;
+  border-bottom: 1px solid var(--fb-border);
+  font-size: 0.9em;
+}
+.comment-body {
+  padding: 0.85rem;
+}
+.comment-form textarea {
+  margin-bottom: 0.5rem;
+}
+.comment-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+  align-items: center;
+}
+.inline-form {
+  display: inline;
+}
+.side-form {
+  margin-top: 0.5rem;
+  display: flex;
+  gap: 0.4rem;
+  align-items: stretch;
+  flex-wrap: wrap;
+}
+.side-form select {
+  flex: 1;
+}
+.label-set {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+}
+.label-picker {
+  flex-direction: column;
+  align-items: stretch;
+}
+.label-picker .checkbox {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+  margin: 0.15rem 0;
+}
+.label-swatch {
+  width: 0.8rem;
+  height: 0.8rem;
+  border-radius: 3px;
+  background: var(--label-color, #888);
+  display: inline-block;
+  flex: none;
+}
 /* Repo settings danger zone. */
 .danger-zone {
   border-color: var(--fb-danger);
     display: block;
     overflow-x: auto;
+  }
-  /* Stack the profile and dashboard columns on narrow screens. */
+  /* Stack the profile, dashboard, and issue columns on narrow screens. */
   .profile-layout,
-  .dashboard {
+  .dashboard,
+  .issue-main {
     flex-direction: column;
+  }
   .profile-sidebar,
-  .dashboard-side {
+  .dashboard-side,
+  .issue-side {
     width: 100%;
+  }
+}

 mod groups;
 mod invites;
+mod issues;
 mod keys;
 mod labels;
 mod repos;
 use sqlx::migrate::Migrator;
 pub use crate::invites::NewInvite;
+pub use crate::issues::StateCounts;
 pub use crate::keys::NewKey;
 pub use crate::repos::{Collaborator, NewRepo};
 pub use crate::sessions::NewSession;

 time = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+url = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }

     Folder,
     File,
     GitBranch,
+    Issue,
+    GitPull,
     History,
     ChevronDown,
     Search,
             Icon::GitBranch => {
                 r#"<path d="M15 6a9 9 0 0 0-9 9V3"/><circle cx="18" cy="6" r="3"/><circle cx="6" cy="18" r="3"/>"#
+            }
+            Icon::Issue => r#"<circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="1"/>"#,
+            Icon::GitPull => {
+                r#"<circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M13 6h3a2 2 0 0 1 2 2v7"/><line x1="6" x2="6" y1="9" y2="21"/>"#
+            }
             Icon::History => {
                 r#"<path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/><path d="M12 7v5l4 2"/>"#
+            }

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Issues and pull requests (shared `issues` table), comments, and issue labels.
+use model::{Comment, Issue, IssueState, Label};
+use sqlx::any::AnyRow;
+use sqlx::{AssertSqlSafe, Row};
+use crate::{Store, StoreError, new_id, now_ms};
+/// The columns of `issues` in a fixed order.
+const ISSUE_COLUMNS: &str = "id, repo_id, number, author_id, title, body, state, is_pull, \
+     assignee_id, created_at, updated_at, closed_at";
+/// Open/closed counts for a repo's issues or PRs.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct StateCounts {
+    /// Number of open items.
+    pub open: i64,
+    /// Number of closed items.
+    pub closed: i64,
+}
+impl Store {
+    /// Create an issue or PR, allocating the next per-repo number atomically.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn create_issue(
+        &self,
+        repo_id: &str,
+        author_id: &str,
+        title: &str,
+        body: &str,
+        is_pull: bool,
+    ) -> Result<Issue, StoreError> {
+        let mut tx = self.pool.begin().await?;
+        // Allocate the shared number: read then bump inside the transaction.
+        let row = sqlx::query("SELECT next_iid FROM repos WHERE id = $1")
+            .bind(repo_id)
+            .fetch_one(&mut *tx)
+            .await?;
+        let number: i64 = row.try_get("next_iid")?;
+        sqlx::query("UPDATE repos SET next_iid = $1 WHERE id = $2")
+            .bind(number + 1)
+            .bind(repo_id)
+            .execute(&mut *tx)
+            .await?;
+        let now = now_ms();
+        let issue = Issue {
+            id: new_id(),
+            repo_id: repo_id.to_string(),
+            number,
+            author_id: author_id.to_string(),
+            title: title.to_string(),
+            body: body.to_string(),
+            state: IssueState::Open,
+            is_pull,
+            assignee_id: None,
+            created_at: now,
+            updated_at: now,
+            closed_at: None,
+        };
+        let sql = "INSERT INTO issues \
+             (id, repo_id, number, author_id, title, body, state, is_pull, assignee_id, \
+              created_at, updated_at, closed_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)";
+        sqlx::query(sql)
+            .bind(&issue.id)
+            .bind(&issue.repo_id)
+            .bind(issue.number)
+            .bind(&issue.author_id)
+            .bind(&issue.title)
+            .bind(&issue.body)
+            .bind(issue.state.as_str())
+            .bind(issue.is_pull)
+            .bind(&issue.assignee_id)
+            .bind(issue.created_at)
+            .bind(issue.updated_at)
+            .bind(issue.closed_at)
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        Ok(issue)
+    }
+    /// Fetch an issue/PR by repo and number, filtered by kind.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn issue_by_number(
+        &self,
+        repo_id: &str,
+        number: i64,
+        is_pull: bool,
+    ) -> Result<Option<Issue>, StoreError> {
+        let sql = format!(
+            "SELECT {ISSUE_COLUMNS} FROM issues WHERE repo_id = $1 AND number = $2 AND is_pull = $3"
+        );
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(repo_id)
+            .bind(number)
+            .bind(is_pull)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_issue(r)).transpose()?)
+    }
+    /// Fetch an issue/PR by id.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn issue_by_id(&self, id: &str) -> Result<Option<Issue>, StoreError> {
+        let sql = format!("SELECT {ISSUE_COLUMNS} FROM issues WHERE id = $1");
+        let row = sqlx::query(AssertSqlSafe(sql))
+            .bind(id)
+            .fetch_optional(&self.pool)
+            .await?;
+        Ok(row.as_ref().map(|r| self.map_issue(r)).transpose()?)
+    }
+    /// List a repo's issues or PRs, optionally filtered by state, newest first.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_issues(
+        &self,
+        repo_id: &str,
+        is_pull: bool,
+        state: Option<IssueState>,
+    ) -> Result<Vec<Issue>, StoreError> {
+        let base = format!(
+            "SELECT {ISSUE_COLUMNS} FROM issues WHERE repo_id = $1 AND is_pull = $2{} \
+             ORDER BY number DESC",
+            if state.is_some() {
+                " AND state = $3"
+            } else {
+                ""
+            }
+        );
+        let mut query = sqlx::query(AssertSqlSafe(base)).bind(repo_id).bind(is_pull);
+        if let Some(s) = state {
+            query = query.bind(s.as_str());
+        }
+        let rows = query.fetch_all(&self.pool).await?;
+        rows.iter()
+            .map(|r| self.map_issue(r))
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Open/closed counts for a repo's issues or PRs.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn issue_counts(
+        &self,
+        repo_id: &str,
+        is_pull: bool,
+    ) -> Result<StateCounts, StoreError> {
+        let sql = "SELECT state, COUNT(*) AS n FROM issues \
+             WHERE repo_id = $1 AND is_pull = $2 GROUP BY state";
+        let rows = sqlx::query(sql)
+            .bind(repo_id)
+            .bind(is_pull)
+            .fetch_all(&self.pool)
+            .await?;
+        let mut counts = StateCounts::default();
+        for row in &rows {
+            let state: String = row.try_get("state")?;
+            let n: i64 = row.try_get("n")?;
+            if state == "closed" {
+                counts.closed = n;
+            } else {
+                counts.open = n;
+            }
+        }
+        Ok(counts)
+    }
+    /// Set an issue/PR's open/closed state (stamping/clearing `closed_at`).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_issue_state(&self, id: &str, state: IssueState) -> Result<bool, StoreError> {
+        let now = now_ms();
+        let closed_at = matches!(state, IssueState::Closed).then_some(now);
+        let updated = sqlx::query(
+            "UPDATE issues SET state = $1, closed_at = $2, updated_at = $3 WHERE id = $4",
+        )
+        .bind(state.as_str())
+        .bind(closed_at)
+        .bind(now)
+        .bind(id)
+        .execute(&self.pool)
+        .await?
+        .rows_affected();
+        Ok(updated > 0)
+    }
+    /// Set (or clear) an issue/PR's assignee.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_issue_assignee(
+        &self,
+        id: &str,
+        assignee_id: Option<&str>,
+    ) -> Result<bool, StoreError> {
+        let updated =
+            sqlx::query("UPDATE issues SET assignee_id = $1, updated_at = $2 WHERE id = $3")
+                .bind(assignee_id)
+                .bind(now_ms())
+                .bind(id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        Ok(updated > 0)
+    }
+    /// Edit an issue/PR's title and body.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn update_issue(
+        &self,
+        id: &str,
+        title: &str,
+        body: &str,
+    ) -> Result<bool, StoreError> {
+        let updated =
+            sqlx::query("UPDATE issues SET title = $1, body = $2, updated_at = $3 WHERE id = $4")
+                .bind(title)
+                .bind(body)
+                .bind(now_ms())
+                .bind(id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        Ok(updated > 0)
+    }
+    // ---- Comments ----
+    /// Add a comment to an issue/PR.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn add_comment(
+        &self,
+        issue_id: &str,
+        author_id: &str,
+        body: &str,
+    ) -> Result<Comment, StoreError> {
+        let now = now_ms();
+        let comment = Comment {
+            id: new_id(),
+            issue_id: issue_id.to_string(),
+            author_id: author_id.to_string(),
+            body: body.to_string(),
+            created_at: now,
+            updated_at: now,
+        };
+        sqlx::query(
+            "INSERT INTO comments (id, issue_id, author_id, body, created_at, updated_at) \
+             VALUES ($1, $2, $3, $4, $5, $6)",
+        )
+        .bind(&comment.id)
+        .bind(&comment.issue_id)
+        .bind(&comment.author_id)
+        .bind(&comment.body)
+        .bind(comment.created_at)
+        .bind(comment.updated_at)
+        .execute(&self.pool)
+        .await?;
+        // Touch the issue so its "updated" reflects the new activity.
+        let _ = sqlx::query("UPDATE issues SET updated_at = $1 WHERE id = $2")
+            .bind(now)
+            .bind(issue_id)
+            .execute(&self.pool)
+            .await;
+        Ok(comment)
+    }
+    /// List an issue/PR's comments oldest-first.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_comments(&self, issue_id: &str) -> Result<Vec<Comment>, StoreError> {
+        let rows = sqlx::query(
+            "SELECT id, issue_id, author_id, body, created_at, updated_at FROM comments \
+             WHERE issue_id = $1 ORDER BY created_at ASC",
+        )
+        .bind(issue_id)
+        .fetch_all(&self.pool)
+        .await?;
+        rows.iter()
+            .map(|r| {
+                Ok(Comment {
+                    id: r.try_get("id")?,
+                    issue_id: r.try_get("issue_id")?,
+                    author_id: r.try_get("author_id")?,
+                    body: r.try_get("body")?,
+                    created_at: r.try_get("created_at")?,
+                    updated_at: r.try_get("updated_at")?,
+                })
+            })
+            .collect::<Result<_, sqlx::Error>>()
+            .map_err(Into::into)
+    }
+    // ---- Issue labels ----
+    /// The labels applied to an issue/PR.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn issue_labels(&self, issue_id: &str) -> Result<Vec<Label>, StoreError> {
+        let sql = "SELECT l.id, l.repo_id, l.name, l.color, l.description, l.created_at \
+             FROM issue_labels il JOIN labels l ON l.id = il.label_id \
+             WHERE il.issue_id = $1 ORDER BY l.name_lower ASC";
+        let rows = sqlx::query(sql)
+            .bind(issue_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(|r| {
+                Ok(Label {
+                    id: r.try_get("id")?,
+                    repo_id: r.try_get("repo_id")?,
+                    name: r.try_get("name")?,
+                    color: r.try_get("color")?,
+                    description: r.try_get("description")?,
+                    created_at: r.try_get("created_at")?,
+                })
+            })
+            .collect::<Result<_, sqlx::Error>>()
+            .map_err(Into::into)
+    }
+    /// Add a label to an issue/PR (idempotent).
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn add_issue_label(&self, issue_id: &str, label_id: &str) -> Result<(), StoreError> {
+        sqlx::query(
+            "INSERT INTO issue_labels (issue_id, label_id) VALUES ($1, $2) \
+             ON CONFLICT (issue_id, label_id) DO NOTHING",
+        )
+        .bind(issue_id)
+        .bind(label_id)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+    /// Remove a label from an issue/PR.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn remove_issue_label(
+        &self,
+        issue_id: &str,
+        label_id: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query("DELETE FROM issue_labels WHERE issue_id = $1 AND label_id = $2")
+            .bind(issue_id)
+            .bind(label_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+    /// Map an `issues` row (selected via [`ISSUE_COLUMNS`]) to an [`Issue`].
+    fn map_issue(&self, row: &AnyRow) -> Result<Issue, sqlx::Error> {
+        Ok(Issue {
+            id: row.try_get("id")?,
+            repo_id: row.try_get("repo_id")?,
+            number: row.try_get("number")?,
+            author_id: row.try_get("author_id")?,
+            title: row.try_get("title")?,
+            body: row.try_get("body")?,
+            state: IssueState::from_token(&row.try_get::<String, _>("state")?),
+            is_pull: self.get_bool(row, "is_pull")?,
+            assignee_id: row.try_get("assignee_id")?,
+            created_at: row.try_get("created_at")?,
+            updated_at: row.try_get("updated_at")?,
+            closed_at: row.try_get("closed_at")?,
+        })
+    }
+}

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Issues: list, create, view, comment, label, assign, and open/close.
+//!
+//! Pull requests share the underlying `issues` table and much of this rendering;
+//! the PR-specific views live in [`crate::pulls`].
+use axum::Form;
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderMap, Uri};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+use maud::{Markup, html};
+use model::{Issue, IssueState, Label, User};
+use serde::Deserialize;
+use crate::AppState;
+use crate::error::{AppError, AppResult};
+use crate::icons::{Icon, icon};
+use crate::layout::page;
+use crate::markdown;
+use crate::pages::build_chrome;
+use crate::repo::{RepoCtx, Tab, css_color, label_chip, repo_header};
+use crate::session::{MaybeUser, verify_csrf};
+/// Whether these views are for issues or pull requests. Keeps the shared
+/// rendering parameterized so pulls can reuse it.
+#[derive(Clone, Copy)]
+pub(crate) struct Kind {
+    /// True for pull requests.
+    pub is_pull: bool,
+    /// URL segment (`issues` | `pulls`).
+    pub seg: &'static str,
+    /// Human noun (`issue` | `pull request`).
+    pub noun: &'static str,
+    /// The active repo tab.
+    pub tab: Tab,
+}
+impl Kind {
+    /// The issues kind.
+    pub(crate) fn issues() -> Self {
+        Self {
+            is_pull: false,
+            seg: "issues",
+            noun: "issue",
+            tab: Tab::Issues,
+        }
+    }
+}
+/// `GET …/-/issues` — the issue list with open/closed tabs.
+pub(crate) async fn list(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    kind: Kind,
+    show_closed: bool,
+) -> AppResult<Response> {
+    if (kind.is_pull && !ctx.repo.pulls_enabled) || (!kind.is_pull && !ctx.repo.issues_enabled) {
+        return Err(AppError::NotFound);
+    }
+    let filter = if show_closed {
+        IssueState::Closed
+    } else {
+        IssueState::Open
+    };
+    let items = state
+        .store
+        .list_issues(&ctx.repo.id, kind.is_pull, Some(filter))
+        .await?;
+    let counts = state.store.issue_counts(&ctx.repo.id, kind.is_pull).await?;
+    // Resolve author usernames and each item's labels.
+    let mut rows = Vec::with_capacity(items.len());
+    for issue in &items {
+        let author = username(state, &issue.author_id).await;
+        let labels = state.store.issue_labels(&issue.id).await?;
+        rows.push((issue, author, labels));
+    }
+    let base = format!("/{}/{}", ctx.owner.username, ctx.repo.path);
+    let branches = crate::repo::branch_names(state, &ctx.repo.id).await;
+    let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
+    let body = html! {
+        (repo_header(state, &ctx, kind.tab, &ctx.repo.default_branch, &branches))
+        div class="issues-head" {
+            nav class="subnav" aria-label=(kind.noun) {
+                a href=(format!("{base}/-/{}?state=open", kind.seg))
+                  aria-current=[(!show_closed).then_some("page")] {
+                    (icon(Icon::Issue)) span { (counts.open) " Open" }
+                }
+                a href=(format!("{base}/-/{}?state=closed", kind.seg))
+                  aria-current=[show_closed.then_some("page")] {
+                    span { (counts.closed) " Closed" }
+                }
+            }
+            @if can_write {
+                a class="btn btn-primary" href=(format!("{base}/-/{}/new", kind.seg)) {
+                    (icon(Icon::Plus)) span { "New " (kind.noun) }
+                }
+            }
+        }
+        @if rows.is_empty() {
+            div class="card" { p class="muted" {
+                "No " (if show_closed { "closed" } else { "open" }) " " (kind.noun) "s."
+            } }
+        } @else {
+            ul class="entry-list card issue-list" {
+                @for (issue, author, labels) in &rows {
+                    li class="entry-row" {
+                        div class="entry-row-body" {
+                            div class="issue-title-row" {
+                                (state_icon(issue.state, kind.is_pull))
+                                a class="entry-row-title" href=(format!("{base}/-/{}/{}", kind.seg, issue.number)) {
+                                    (issue.title)
+                                }
+                                @for l in labels { (label_chip(l)) }
+                            }
+                            div class="entry-row-meta muted" {
+                                "#" (issue.number) " · opened by " (author)
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    };
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let title = format!("{}/{}: {}s", ctx.owner.username, ctx.repo.path, kind.noun);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// `GET …/-/issues/new` — the new-issue form.
+pub(crate) async fn new_form(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    kind: Kind,
+) -> AppResult<Response> {
+    if (kind.is_pull && !ctx.repo.pulls_enabled) || (!kind.is_pull && !ctx.repo.issues_enabled) {
+        return Err(AppError::NotFound);
+    }
+    // Opening an issue requires Read (the resolve already guaranteed it) and a
+    // signed-in viewer.
+    if viewer.is_none() {
+        return Ok(Redirect::to("/login").into_response());
+    }
+    let branches = crate::repo::branch_names(state, &ctx.repo.id).await;
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let body = html! {
+        (repo_header(state, &ctx, kind.tab, &ctx.repo.default_branch, &branches))
+        h2 { "New " (kind.noun) }
+        div class="card" {
+            form method="post" action=(format!("/issue-new/{}?is_pull={}", ctx.repo.id, kind.is_pull)) {
+                input type="hidden" name="_csrf" value=(chrome.csrf);
+                label for="title" { "Title" }
+                input type="text" id="title" name="title" required autofocus;
+                label for="body" { "Description" }
+                textarea id="body" name="body" rows="8" placeholder="Markdown supported" {}
+                button class="btn btn-primary" type="submit" { "Create " (kind.noun) }
+            }
+        }
+    };
+    let title = format!(
+        "New {} · {}/{}",
+        kind.noun, ctx.owner.username, ctx.repo.path
+    );
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// `GET …/-/issues/{n}` — a single issue with comments and controls.
+pub(crate) async fn view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    kind: Kind,
+    number: i64,
+) -> AppResult<Response> {
+    if (kind.is_pull && !ctx.repo.pulls_enabled) || (!kind.is_pull && !ctx.repo.issues_enabled) {
+        return Err(AppError::NotFound);
+    }
+    let issue = state
+        .store
+        .issue_by_number(&ctx.repo.id, number, kind.is_pull)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    let author = username(state, &issue.author_id).await;
+    let comments = state.store.list_comments(&issue.id).await?;
+    let issue_labels = state.store.issue_labels(&issue.id).await?;
+    let repo_labels = state.store.list_labels(&ctx.repo.id).await?;
+    let assignee = match &issue.assignee_id {
+        Some(id) => Some(username(state, id).await),
+        None => None,
+    };
+    let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
+    let is_author = viewer.as_ref().is_some_and(|v| v.id == issue.author_id);
+    let branches = crate::repo::branch_names(state, &ctx.repo.id).await;
+    let mut comment_rows = Vec::with_capacity(comments.len());
+    for c in &comments {
+        comment_rows.push((c, username(state, &c.author_id).await));
+    }
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let csrf = chrome.csrf.clone();
+    let body = html! {
+        (repo_header(state, &ctx, kind.tab, &ctx.repo.default_branch, &branches))
+        div class="issue-view" {
+            header class="issue-header" {
+                h1 { (issue.title) " " span class="muted" { "#" (issue.number) } }
+                div class="issue-sub" {
+                    (state_badge(issue.state, kind.is_pull))
+                    span class="muted" { " " (author) " opened this " (kind.noun) }
+                }
+            }
+            div class="issue-main" {
+                article class="issue-thread" {
+                    (comment_card(&author, &issue.body, issue.created_at))
+                    @for (c, cauthor) in &comment_rows {
+                        (comment_card(cauthor, &c.body, c.created_at))
+                    }
+                    @if can_write {
+                        div class="card comment-form" {
+                            form method="post" action=(format!("/issue/{}/comment", issue.id)) {
+                                input type="hidden" name="_csrf" value=(csrf);
+                                textarea name="body" rows="4" placeholder="Leave a comment (markdown)" required {}
+                                div class="comment-actions" {
+                                    @if can_write || is_author {
+                                        (state_button(&issue, &csrf, kind))
+                                    }
+                                    button class="btn btn-primary" type="submit" { "Comment" }
+                                }
+                            }
+                        }
+                    }
+                }
+                aside class="issue-side" {
+                    section {
+                        h3 { "Assignee" }
+                        @if let Some(a) = &assignee { p { (a) } } @else { p class="muted" { "No one" } }
+                        @if can_write {
+                            (assignee_form(&issue, &ctx, state, &csrf).await)
+                        }
+                    }
+                    section {
+                        h3 { "Labels" }
+                        @if issue_labels.is_empty() { p class="muted" { "None" } }
+                        @else { div class="label-set" { @for l in &issue_labels { (label_chip(l)) } } }
+                        @if can_write && !repo_labels.is_empty() {
+                            (label_form(&issue, &repo_labels, &issue_labels, &csrf))
+                        }
+                    }
+                }
+            }
+        }
+    };
+    let title = format!("{} · {}/{}", issue.title, ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+// ---- shared render helpers ----
+/// A single comment card (also used for the issue body).
+fn comment_card(author: &str, body: &str, created_at: i64) -> Markup {
+    html! {
+        div class="card comment" {
+            div class="comment-head muted" {
+                strong { (author) }
+                span { " commented " (crate::activity::fmt_relative(created_at, crate::now_ms())) }
+            }
+            div class="comment-body markdown" { (markdown::render(body)) }
+        }
+    }
+}
+/// The open/closed state icon.
+fn state_icon(st: IssueState, is_pull: bool) -> Markup {
+    let glyph = if is_pull { Icon::GitPull } else { Icon::Issue };
+    let class = if st == IssueState::Open {
+        "state-open"
+    } else {
+        "state-closed"
+    };
+    html! { span class=(class) { (icon(glyph)) } }
+}
+/// The open/closed state badge.
+fn state_badge(st: IssueState, is_pull: bool) -> Markup {
+    let (class, label) = match st {
+        IssueState::Open => ("badge badge-state-open", "Open"),
+        IssueState::Closed => ("badge badge-state-closed", "Closed"),
+    };
+    html! {
+        span class=(class) {
+            (state_icon(st, is_pull)) " " (label)
+        }
+    }
+}
+/// The close/reopen button (posts to the state endpoint).
+fn state_button(issue: &Issue, csrf: &str, kind: Kind) -> Markup {
+    let (target, label) = match issue.state {
+        IssueState::Open => ("closed", format!("Close {}", kind.noun)),
+        IssueState::Closed => ("open", format!("Reopen {}", kind.noun)),
+    };
+    html! {
+        form method="post" action=(format!("/issue/{}/state", issue.id)) class="inline-form" {
+            input type="hidden" name="_csrf" value=(csrf);
+            input type="hidden" name="state" value=(target);
+            button class="btn" type="submit" { (label) }
+        }
+    }
+}
+/// The assignee select form (owner + collaborators).
+async fn assignee_form(issue: &Issue, ctx: &RepoCtx, state: &AppState, csrf: &str) -> Markup {
+    let mut options: Vec<(String, String)> =
+        vec![(ctx.owner.id.clone(), ctx.owner.username.clone())];
+    if let Ok(collabs) = state.store.list_collaborators(&ctx.repo.id).await {
+        for c in collabs {
+            options.push((c.user_id, c.username));
+        }
+    }
+    html! {
+        form method="post" action=(format!("/issue/{}/assignee", issue.id)) class="side-form" {
+            input type="hidden" name="_csrf" value=(csrf);
+            select name="assignee_id" aria-label="Assignee" {
+                option value="" selected[issue.assignee_id.is_none()] { "No one" }
+                @for (id, name) in &options {
+                    option value=(id) selected[issue.assignee_id.as_deref() == Some(id.as_str())] { (name) }
+                }
+            }
+            button class="btn" type="submit" { "Set" }
+        }
+    }
+}
+/// The label-toggle form: checkboxes for each repo label.
+fn label_form(issue: &Issue, repo_labels: &[Label], applied: &[Label], csrf: &str) -> Markup {
+    let is_on = |id: &str| applied.iter().any(|l| l.id == id);
+    html! {
+        form method="post" action=(format!("/issue/{}/labels", issue.id)) class="side-form label-picker" {
+            input type="hidden" name="_csrf" value=(csrf);
+            @for l in repo_labels {
+                label class="checkbox" {
+                    input type="checkbox" name="label" value=(l.id) checked[is_on(&l.id)];
+                    " " span class="label-swatch" style=(format!("--label-color: {}", css_color(&l.color))) {}
+                    " " (l.name)
+                }
+            }
+            button class="btn" type="submit" { "Apply labels" }
+        }
+    }
+}
+/// Resolve a username for display, falling back to the id.
+async fn username(state: &AppState, user_id: &str) -> String {
+    state
+        .store
+        .user_by_id(user_id)
+        .await
+        .ok()
+        .flatten()
+        .map_or_else(|| user_id.to_string(), |u| u.username)
+}
+// ---- POST handlers (fixed-prefix routes, keyed by id) ----
+/// Load an issue's repo and the viewer's access to it.
+async fn repo_of_issue(
+    state: &AppState,
+    viewer: Option<&User>,
+    issue: &Issue,
+) -> AppResult<(model::Repo, auth::Access)> {
+    let repo = state
+        .store
+        .repo_by_id(&issue.repo_id)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    let access = access_for(state, viewer, &repo).await?;
+    Ok((repo, access))
+}
+/// Compute the viewer's access to a repo.
+async fn access_for(
+    state: &AppState,
+    viewer: Option<&User>,
+    repo: &model::Repo,
+) -> AppResult<auth::Access> {
+    let viewer_id = viewer.map(|u| auth::Viewer {
+        id: u.id.clone(),
+        is_admin: u.is_admin,
+    });
+    let collab = match viewer {
+        Some(u) => state
+            .store
+            .collaborator_permission(&repo.id, &u.id)
+            .await?
+            .and_then(|p| auth::Permission::parse(&p)),
+        None => None,
+    };
+    Ok(auth::access(
+        viewer_id.as_ref(),
+        repo,
+        collab,
+        state.config.instance.allow_anonymous,
+    ))
+}
+/// The path to an issue/PR.
+async fn issue_url(state: &AppState, repo: &model::Repo, issue: &Issue) -> String {
+    let owner = username(state, &repo.owner_id).await;
+    let seg = if issue.is_pull { "pulls" } else { "issues" };
+    format!("/{owner}/{}/-/{seg}/{}", repo.path, issue.number)
+}
+/// New-issue form fields + a query flag for `is_pull`.
+#[derive(Debug, Deserialize)]
+pub struct NewIssueForm {
+    /// Title.
+    #[serde(default)]
+    title: String,
+    /// Markdown body.
+    #[serde(default)]
+    body: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `?is_pull=` query for the create endpoint.
+#[derive(Debug, Default, Deserialize)]
+pub struct CreateQuery {
+    /// Whether the new item is a pull request.
+    #[serde(default)]
+    is_pull: bool,
+}
+/// `POST /issue-new/{repo_id}` — create an issue (PRs use their own flow).
+pub async fn create(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(repo_id): Path<String>,
+    Query(q): Query<CreateQuery>,
+    Form(form): Form<NewIssueForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let repo = state
+            .store
+            .repo_by_id(&repo_id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        if q.is_pull || !repo.issues_enabled {
+            return Err(AppError::NotFound);
+        }
+        // Read access is enough to open an issue.
+        if access_for(&state, Some(&user), &repo).await? < auth::Access::Read {
+            return Err(AppError::NotFound);
+        }
+        let title = form.title.trim();
+        if title.is_empty() {
+            return Err(AppError::BadRequest("A title is required.".to_string()));
+        }
+        let issue = state
+            .store
+            .create_issue(&repo.id, &user.id, title, form.body.trim(), false)
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Comment form.
+#[derive(Debug, Deserialize)]
+pub struct CommentForm {
+    /// Markdown body.
+    #[serde(default)]
+    body: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /issue/{id}/comment` — add a comment.
+pub async fn comment(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<CommentForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Read {
+            return Err(AppError::NotFound);
+        }
+        let body = form.body.trim();
+        if !body.is_empty() {
+            state.store.add_comment(&issue.id, &user.id, body).await?;
+        }
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// State-change form.
+#[derive(Debug, Deserialize)]
+pub struct StateForm {
+    /// `open` | `closed`.
+    #[serde(default)]
+    state: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /issue/{id}/state` — open/close (author or Write).
+pub async fn set_state(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<StateForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        let allowed = access >= auth::Access::Write || user.id == issue.author_id;
+        if !allowed {
+            return Err(AppError::Forbidden);
+        }
+        state
+            .store
+            .set_issue_state(&issue.id, IssueState::from_token(&form.state))
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Assignee form.
+#[derive(Debug, Deserialize)]
+pub struct AssigneeForm {
+    /// The assignee user id (empty clears it).
+    #[serde(default)]
+    assignee_id: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /issue/{id}/assignee` — set/clear the assignee (Write).
+pub async fn set_assignee(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Form(form): Form<AssigneeForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Write {
+            return Err(AppError::Forbidden);
+        }
+        let assignee = form.assignee_id.trim();
+        state
+            .store
+            .set_issue_assignee(&issue.id, (!assignee.is_empty()).then_some(assignee))
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// `POST /issue/{id}/labels` — replace the applied labels (Write). Scoped labels
+/// are kept mutually exclusive within their scope by the checkbox set itself.
+pub async fn set_labels(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    body: axum::body::Bytes,
+) -> Response {
+    // Parse the repeated `label` fields and `_csrf` from the urlencoded body
+    // (serde_urlencoded has no sequence support).
+    let mut chosen: Vec<String> = Vec::new();
+    let mut csrf = String::new();
+    for (k, v) in url::form_urlencoded::parse(&body) {
+        match k.as_ref() {
+            "label" => chosen.push(v.into_owned()),
+            "_csrf" => csrf = v.into_owned(),
+            _ => {}
+        }
+    }
+    if verify_csrf(&jar, &headers, Some(&csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Write {
+            return Err(AppError::Forbidden);
+        }
+        // Only accept labels that belong to this repo.
+        let repo_labels = state.store.list_labels(&repo.id).await?;
+        let valid: std::collections::HashSet<&str> =
+            repo_labels.iter().map(|l| l.id.as_str()).collect();
+        let applied = state.store.issue_labels(&issue.id).await?;
+        // Remove those unchecked, add those newly checked.
+        for l in &applied {
+            if !chosen.iter().any(|c| c == &l.id) {
+                state.store.remove_issue_label(&issue.id, &l.id).await?;
+            }
+        }
+        for c in &chosen {
+            if valid.contains(c.as_str()) && !applied.iter().any(|l| &l.id == c) {
+                state.store.add_issue_label(&issue.id, c).await?;
+            }
+        }
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Redirect on success, render the error otherwise.
+fn respond_redirect(result: AppResult<String>) -> Response {
+    match result {
+        Ok(dest) => Redirect::to(&dest).into_response(),
+        Err(err) => err.into_response(),
+    }
+}

 mod error;
 mod git_http;
 mod icons;
+mod issues;
 mod layout;
 mod markdown;
 mod pages;
             "/repo-settings/{id}/labels/delete",
             post(repo::settings_label_delete),
+        )
+        // Issue/PR mutations: fixed prefixes so they never hit the repo catch-all.
+        .route("/issue-new/{repo_id}", post(issues::create))
+        .route("/issue/{id}/comment", post(issues::comment))
+        .route("/issue/{id}/state", post(issues::set_state))
+        .route("/issue/{id}/assignee", post(issues::set_assignee))
+        .route("/issue/{id}/labels", post(issues::set_labels))
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

 /// Which repo tab is active, for highlighting.
 #[derive(Clone, Copy, PartialEq, Eq)]
-enum Tab {
+pub(crate) enum Tab {
     Code,
+    Issues,
+    Pulls,
     Commits,
     Branches,
     Tags,
 /// The local branch names for the switcher, empty on any error (an empty repo or
 /// a failed read simply yields no dropdown).
-async fn branch_names(state: &AppState, repo_id: &str) -> Vec<String> {
+pub(crate) async fn branch_names(state: &AppState, repo_id: &str) -> Vec<String> {
     git_read(state, repo_id, git::Repo::branch_names)
         .await
         .unwrap_or_default()
 ///
 /// Denied access to an existing private repo returns `Err(NotFound)` — identical
 /// to a missing repo, so private existence never leaks.
-async fn resolve(
+pub(crate) async fn resolve(
     state: &AppState,
     owner_name: &str,
     repo_path: &str,
             let raw_query = dq.q.clone().unwrap_or_default();
             crate::search::in_repo(state, viewer, jar, uri, &ctx, &raw_query, header).await
+        }
+        "issues" => {
+            let kind = crate::issues::Kind::issues();
+            match rest {
+                "" => {
+                    let closed = uri.query().is_some_and(|q| q.contains("state=closed"));
+                    crate::issues::list(state, viewer, jar, uri, ctx, kind, closed).await
+                }
+                "new" => crate::issues::new_form(state, viewer, jar, uri, ctx, kind).await,
+                n => match n.parse::<i64>() {
+                    Ok(num) => crate::issues::view(state, viewer, jar, uri, ctx, kind, num).await,
+                    Err(_) => Err(AppError::NotFound),
+                },
+            }
+        }
         "settings" => repo_settings_view(state, viewer, jar, uri, ctx).await,
         // Reserved `runs` slot returns 404 until built.
         _ => Err(AppError::NotFound),
+}
 /// A coloured label chip.
-fn label_chip(label: &model::Label) -> Markup {
+pub(crate) fn label_chip(label: &model::Label) -> Markup {
     html! {
         span class="label-chip" style=(format!("--label-color: {}", css_color(&label.color))) {
             (label.name)
+}
 /// Sanitize a stored colour for inline CSS: only `#` + up to 8 hex digits.
-fn css_color(color: &str) -> String {
+pub(crate) fn css_color(color: &str) -> String {
     let hex: String = color
         .trim_start_matches('#')
         .chars()
 /// The repo sub-header: slug, description, and a tab strip sharing its line with
 /// the branch switcher and clone menu.
-fn repo_header(
+pub(crate) fn repo_header(
     state: &AppState,
     ctx: &RepoCtx,
     active: Tab,
             div class="repo-nav" {
                 nav class="tabs repo-tabs" {
                     (tab(Tab::Code, "Code", Icon::File, base.clone()))
+                    @if ctx.repo.issues_enabled {
+                        (tab(Tab::Issues, "Issues", Icon::Issue, format!("{base}/-/issues")))
+                    }
+                    @if ctx.repo.pulls_enabled {
+                        (tab(Tab::Pulls, "Pull requests", Icon::GitPull, format!("{base}/-/pulls")))
+                    }
                     (tab(Tab::Commits, "Commits", Icon::History, format!("{base}/-/commits/{rev}")))
                     (tab(Tab::Branches, "Branches", Icon::GitBranch, format!("{base}/-/branches")))
                     (tab(Tab::Tags, "Tags", Icon::Box, format!("{base}/-/tags")))
+}
 /// Format an epoch-millisecond timestamp as a `YYYY-MM-DD` date.
-fn fmt_date(ms: i64) -> String {
+pub(crate) fn fmt_date(ms: i64) -> String {
     let secs = ms.div_euclid(1000);
     match time::OffsetDateTime::from_unix_timestamp(secs) {
         Ok(dt) => format!(

+}
 #[tokio::test]
+async fn issues_open_create_and_view() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Private,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // The issues list renders for the owner with a New button.
+    let req = Request::builder()
+        .uri("/ada/proj/-/issues")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    assert!(body_string(res).await.contains("New issue"));
+    // Create an issue.
+    let req = Request::builder()
+        .method("POST")
+        .uri(format!("/issue-new/{}", repo.id))
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::from(format!(
+            "title=First+bug&body=It+is+broken&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert_eq!(
+        res.headers().get(header::LOCATION).unwrap(),
+        "/ada/proj/-/issues/1"
+    );
+    // View it.
+    let req = Request::builder()
+        .uri("/ada/proj/-/issues/1")
+        .header(header::COOKIE, cookie)
+        .body(Body::empty())
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("First bug"), "issue title shown");
+    assert!(html.contains("#1"), "issue number shown");
+}
+#[tokio::test]
+async fn issues_404_when_disabled() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "noissues".to_string(),
+            path: "noissues".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    state
+        .store
+        .set_feature_enabled(&repo.id, "issues", false)
+        .await
+        .unwrap();
+    let res = app.oneshot(get("/ada/noissues/-/issues")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+#[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;
     let res = app.oneshot(get("/settings")).await.unwrap();