hanna/fabrica

feat(web): pull requests — compare, diff, conversation, and merge

f2d1b78 · hanna committed on 2026-07-25

Add the pulls store methods (create_pull with shared numbering + refs,
pull_by_issue, mark_pull_merged closing the issue atomically) and the web
pulls module: a Pulls tab (per-repo toggle) reusing the issue list, a branch-
compare form, and a PR view with the conversation thread, a three-dot commits/
diff (via git merge-base + commits_between), and a merge panel. Merging runs
git::merge on the blocking pool, attributes the commit to the acting user, and
records the result. Conversation mutations reuse the /issue/{id}/* routes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +2 −0

assets/base.css +53 −0

crates/git/src/repo.rs +45 −0

crates/store/src/issues.rs +140 −1

crates/web/Cargo.toml +2 −0

crates/web/src/issues.rs +30 −10

crates/web/src/lib.rs +3 −0

crates/web/src/pulls.rs +587 −0

crates/web/src/repo.rs +62 −0

crates/web/src/tests.rs +206 −0

  "config",
  "flate2",
  "git",
+ "git2",
  "grep",
  "highlight",
  "mail",
  "serde",
  "serde_json",
  "store",
+ "tempfile",
  "thiserror 2.0.19",
  "time",
  "tokio",

   color: var(--fb-danger);
   border-color: var(--fb-danger);
+}
+.badge-state-merged {
+  color: var(--fb-accent);
+  border-color: var(--fb-accent);
+}
+/* Pull requests: compare form, merge panel, and change list. */
+.compare-refs {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin-bottom: 1rem;
+}
+.compare-refs label {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+}
+.compare-refs select {
+  width: auto;
+}
+.compare-arrow {
+  font-size: 1.25rem;
+  color: var(--fb-muted);
+}
+.merge-panel {
+  border-left: 3px solid var(--fb-border);
+}
+.merge-panel.clean {
+  border-left-color: var(--fb-success);
+}
+.merge-panel.conflicts {
+  border-left-color: var(--fb-danger);
+}
+.merge-panel.merged {
+  border-left-color: var(--fb-accent);
+}
+.merge-form {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  margin-top: 0.5rem;
+}
+.merge-form select {
+  width: auto;
+}
+.pr-changes {
+  margin-top: 1.5rem;
+}
+.pr-commits {
+  margin-bottom: 1rem;
+}
 .issue-header {
   margin-bottom: 1rem;
   padding-bottom: 0.75rem;

         Ok(out)
+    }
+    /// The best common ancestor of two commits (the merge base), or `None` if they
+    /// have unrelated histories.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`GitError::Libgit2`] on a lookup failure.
+    pub fn merge_base(&self, a: &Oid, b: &Oid) -> Result<Option<Oid>, GitError> {
+        let a = git2::Oid::from_str(a.as_str())?;
+        let b = git2::Oid::from_str(b.as_str())?;
+        match self.inner.merge_base(a, b) {
+            Ok(oid) => Ok(Some(oid_of(oid))),
+            Err(e) if e.code() == git2::ErrorCode::NotFound => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+    /// The commits reachable from `head` but not `base`, newest first — the commits
+    /// a pull request would contribute. Capped at `limit`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`GitError::Libgit2`] on a revwalk failure.
+    pub fn commits_between(
+        &self,
+        base: &Oid,
+        head: &Oid,
+        limit: usize,
+    ) -> Result<Vec<CommitSummary>, GitError> {
+        let base = git2::Oid::from_str(base.as_str())?;
+        let head = git2::Oid::from_str(head.as_str())?;
+        let mut walk = self.inner.revwalk()?;
+        walk.set_sorting(Sort::TIME)?;
+        walk.push(head)?;
+        walk.hide(base)?;
+        let mut out = Vec::with_capacity(limit.min(64));
+        for oid in walk {
+            let commit = self.inner.find_commit(oid?)?;
+            out.push(commit_summary(&commit));
+            if out.len() >= limit {
+                break;
+            }
+        }
+        Ok(out)
+    }
     /// Fetch a single commit in full.
     ///
     /// # Errors

 //! Issues and pull requests (shared `issues` table), comments, and issue labels.
-use model::{Comment, Issue, IssueState, Label};
+use model::{Comment, Issue, IssueState, Label, PullRequest};
 use sqlx::any::AnyRow;
 use sqlx::{AssertSqlSafe, Row};
         Ok(())
+    }
+    // ---- Pull requests ----
+    /// Open a pull request: allocate the shared number, insert the `issues` row
+    /// (`is_pull = true`), and record its base/head refs, all in one transaction.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn create_pull(
+        &self,
+        repo_id: &str,
+        author_id: &str,
+        title: &str,
+        body: &str,
+        base_ref: &str,
+        head_ref: &str,
+    ) -> Result<Issue, StoreError> {
+        let mut tx = self.pool.begin().await?;
+        let row = sqlx::query("SELECT next_iid FROM repos WHERE id = $1")
+            .bind(repo_id)
+            .fetch_one(&mut *tx)
+            .await?;
+        let number: i64 = row.try_get("next_iid")?;
+        sqlx::query("UPDATE repos SET next_iid = $1 WHERE id = $2")
+            .bind(number + 1)
+            .bind(repo_id)
+            .execute(&mut *tx)
+            .await?;
+        let now = now_ms();
+        let issue = Issue {
+            id: new_id(),
+            repo_id: repo_id.to_string(),
+            number,
+            author_id: author_id.to_string(),
+            title: title.to_string(),
+            body: body.to_string(),
+            state: IssueState::Open,
+            is_pull: true,
+            assignee_id: None,
+            created_at: now,
+            updated_at: now,
+            closed_at: None,
+        };
+        sqlx::query(
+            "INSERT INTO issues \
+             (id, repo_id, number, author_id, title, body, state, is_pull, assignee_id, \
+              created_at, updated_at, closed_at) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
+        )
+        .bind(&issue.id)
+        .bind(&issue.repo_id)
+        .bind(issue.number)
+        .bind(&issue.author_id)
+        .bind(&issue.title)
+        .bind(&issue.body)
+        .bind(issue.state.as_str())
+        .bind(issue.is_pull)
+        .bind(&issue.assignee_id)
+        .bind(issue.created_at)
+        .bind(issue.updated_at)
+        .bind(issue.closed_at)
+        .execute(&mut *tx)
+        .await?;
+        sqlx::query("INSERT INTO pull_requests (issue_id, base_ref, head_ref) VALUES ($1, $2, $3)")
+            .bind(&issue.id)
+            .bind(base_ref)
+            .bind(head_ref)
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        Ok(issue)
+    }
+    /// Fetch the pull-request row for an issue id, if it is a PR.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn pull_by_issue(&self, issue_id: &str) -> Result<Option<PullRequest>, StoreError> {
+        let row = sqlx::query(
+            "SELECT issue_id, base_ref, head_ref, merged_at, merged_by, merge_sha, merge_strategy \
+             FROM pull_requests WHERE issue_id = $1",
+        )
+        .bind(issue_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(|r| {
+            Ok(PullRequest {
+                issue_id: r.try_get("issue_id")?,
+                base_ref: r.try_get("base_ref")?,
+                head_ref: r.try_get("head_ref")?,
+                merged_at: r.try_get("merged_at")?,
+                merged_by: r.try_get("merged_by")?,
+                merge_sha: r.try_get("merge_sha")?,
+                merge_strategy: r.try_get("merge_strategy")?,
+            })
+        })
+        .transpose()
+        .map_err(|e: sqlx::Error| e.into())
+    }
+    /// Record a merge: stamp the pull-request row and close the issue, atomically.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn mark_pull_merged(
+        &self,
+        issue_id: &str,
+        merged_by: &str,
+        merge_sha: &str,
+        strategy: &str,
+    ) -> Result<(), StoreError> {
+        let now = now_ms();
+        let mut tx = self.pool.begin().await?;
+        sqlx::query(
+            "UPDATE pull_requests \
+             SET merged_at = $1, merged_by = $2, merge_sha = $3, merge_strategy = $4 \
+             WHERE issue_id = $5",
+        )
+        .bind(now)
+        .bind(merged_by)
+        .bind(merge_sha)
+        .bind(strategy)
+        .bind(issue_id)
+        .execute(&mut *tx)
+        .await?;
+        sqlx::query(
+            "UPDATE issues SET state = 'closed', closed_at = $1, updated_at = $1 WHERE id = $2",
+        )
+        .bind(now)
+        .bind(issue_id)
+        .execute(&mut *tx)
+        .await?;
+        tx.commit().await?;
+        Ok(())
+    }
     /// Map an `issues` row (selected via [`ISSUE_COLUMNS`]) to an [`Issue`].
     fn map_issue(&self, row: &AnyRow) -> Result<Issue, sqlx::Error> {
         Ok(Issue {

 [dev-dependencies]
 tower = { workspace = true, features = ["util"] }
+tempfile = { workspace = true }
+git2 = { workspace = true }
 [lints]
 workspace = true

             tab: Tab::Issues,
+        }
+    }
+    /// The pull-requests kind.
+    pub(crate) fn pulls() -> Self {
+        Self {
+            is_pull: true,
+            seg: "pulls",
+            noun: "pull request",
+            tab: Tab::Pulls,
+        }
+    }
+}
 /// `GET …/-/issues` — the issue list with open/closed tabs.
 // ---- shared render helpers ----
 /// A single comment card (also used for the issue body).
-fn comment_card(author: &str, body: &str, created_at: i64) -> Markup {
+pub(crate) fn comment_card(author: &str, body: &str, created_at: i64) -> Markup {
     html! {
         div class="card comment" {
             div class="comment-head muted" {
+}
 /// The open/closed state badge.
-fn state_badge(st: IssueState, is_pull: bool) -> Markup {
+pub(crate) fn state_badge(st: IssueState, is_pull: bool) -> Markup {
     let (class, label) = match st {
         IssueState::Open => ("badge badge-state-open", "Open"),
         IssueState::Closed => ("badge badge-state-closed", "Closed"),
+}
 /// The close/reopen button (posts to the state endpoint).
-fn state_button(issue: &Issue, csrf: &str, kind: Kind) -> Markup {
+pub(crate) fn state_button(issue: &Issue, csrf: &str, kind: Kind) -> Markup {
     let (target, label) = match issue.state {
         IssueState::Open => ("closed", format!("Close {}", kind.noun)),
         IssueState::Closed => ("open", format!("Reopen {}", kind.noun)),
+}
 /// The assignee select form (owner + collaborators).
-async fn assignee_form(issue: &Issue, ctx: &RepoCtx, state: &AppState, csrf: &str) -> Markup {
+pub(crate) async fn assignee_form(
+    issue: &Issue,
+    ctx: &RepoCtx,
+    state: &AppState,
+    csrf: &str,
+) -> Markup {
     let mut options: Vec<(String, String)> =
         vec![(ctx.owner.id.clone(), ctx.owner.username.clone())];
     if let Ok(collabs) = state.store.list_collaborators(&ctx.repo.id).await {
+}
 /// The label-toggle form: checkboxes for each repo label.
-fn label_form(issue: &Issue, repo_labels: &[Label], applied: &[Label], csrf: &str) -> Markup {
+pub(crate) fn label_form(
+    issue: &Issue,
+    repo_labels: &[Label],
+    applied: &[Label],
+    csrf: &str,
+) -> Markup {
     let is_on = |id: &str| applied.iter().any(|l| l.id == id);
     html! {
         form method="post" action=(format!("/issue/{}/labels", issue.id)) class="side-form label-picker" {
+}
 /// Resolve a username for display, falling back to the id.
-async fn username(state: &AppState, user_id: &str) -> String {
+pub(crate) async fn username(state: &AppState, user_id: &str) -> String {
     state
         .store
         .user_by_id(user_id)
 // ---- POST handlers (fixed-prefix routes, keyed by id) ----
 /// Load an issue's repo and the viewer's access to it.
-async fn repo_of_issue(
+pub(crate) async fn repo_of_issue(
     state: &AppState,
     viewer: Option<&User>,
     issue: &Issue,
+}
 /// Compute the viewer's access to a repo.
-async fn access_for(
+pub(crate) async fn access_for(
     state: &AppState,
     viewer: Option<&User>,
     repo: &model::Repo,
+}
 /// The path to an issue/PR.
-async fn issue_url(state: &AppState, repo: &model::Repo, issue: &Issue) -> String {
+pub(crate) async fn issue_url(state: &AppState, repo: &model::Repo, issue: &Issue) -> String {
     let owner = username(state, &repo.owner_id).await;
     let seg = if issue.is_pull { "pulls" } else { "issues" };
     format!("/{owner}/{}/-/{seg}/{}", repo.path, issue.number)
+}
 /// Redirect on success, render the error otherwise.
-fn respond_redirect(result: AppResult<String>) -> Response {
+pub(crate) fn respond_redirect(result: AppResult<String>) -> Response {
     match result {
         Ok(dest) => Redirect::to(&dest).into_response(),
         Err(err) => err.into_response(),

 mod layout;
 mod markdown;
 mod pages;
+mod pulls;
 mod repo;
 mod search;
 #[path = "serve.rs"]
         .route("/issue/{id}/state", post(issues::set_state))
         .route("/issue/{id}/assignee", post(issues::set_assignee))
         .route("/issue/{id}/labels", post(issues::set_labels))
+        .route("/pull-new/{repo_id}", post(pulls::create))
+        .route("/pull/{id}/merge", post(pulls::merge))
         .route("/healthz", get(serve_assets::healthz))
         .route("/version", get(serve_assets::version))
         .route("/theme.css", get(serve_assets::theme_default))

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Pull requests: open (branch compare), view (conversation + commits + diff),
+//! and merge.
+//!
+//! PRs share the `issues` table and much rendering with [`crate::issues`] — the
+//! conversation thread, state button, assignee, and labels are the same helpers,
+//! and comment/state/assignee/label mutations reuse the `/issue/{id}/…` routes.
+//! What is PR-specific lives here: the compare form, the three-dot diff, and the
+//! server-side merge, which shells out through [`git::merge`].
+use std::path::PathBuf;
+use axum::extract::{Path, State};
+use axum::http::{HeaderMap, Uri};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::cookie::CookieJar;
+use maud::{Markup, html};
+use model::User;
+use serde::Deserialize;
+use crate::AppState;
+use crate::diff;
+use crate::error::{AppError, AppResult};
+use crate::issues::{
+    Kind, access_for, assignee_form, comment_card, issue_url, label_form, repo_of_issue,
+    respond_redirect, state_badge, state_button, username,
+};
+use crate::layout::page;
+use crate::pages::build_chrome;
+use crate::repo::{RepoCtx, Tab, branch_names, label_chip, repo_header};
+use crate::session::{MaybeUser, verify_csrf};
+/// `GET …/-/pulls/new` — the branch-compare form for opening a pull request.
+pub(crate) async fn new_form(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+) -> AppResult<Response> {
+    if !ctx.repo.pulls_enabled {
+        return Err(AppError::NotFound);
+    }
+    if viewer.is_none() {
+        return Ok(Redirect::to("/login").into_response());
+    }
+    let branches = branch_names(state, &ctx.repo.id).await;
+    // Pre-select the base/head from the query when arriving from a branch view.
+    let q = compare_query(uri);
+    let base_sel = q.0.unwrap_or_else(|| ctx.repo.default_branch.clone());
+    let head_sel = q.1.unwrap_or_default();
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Pulls, &ctx.repo.default_branch, &branches))
+        h2 { "New pull request" }
+        div class="card" {
+            form method="post" action=(format!("/pull-new/{}", ctx.repo.id)) {
+                input type="hidden" name="_csrf" value=(chrome.csrf);
+                div class="compare-refs" {
+                    label { "Base "
+                        select name="base_ref" aria-label="Base branch" {
+                            @for b in &branches {
+                                option value=(b) selected[*b == base_sel] { (b) }
+                            }
+                        }
+                    }
+                    span class="compare-arrow" { "←" }
+                    label { "Compare "
+                        select name="head_ref" aria-label="Compare branch" {
+                            @for b in &branches {
+                                option value=(b) selected[*b == head_sel] { (b) }
+                            }
+                        }
+                    }
+                }
+                label for="title" { "Title" }
+                input type="text" id="title" name="title" required autofocus;
+                label for="body" { "Description" }
+                textarea id="body" name="body" rows="6" placeholder="Markdown supported" {}
+                button class="btn btn-primary" type="submit" { "Create pull request" }
+            }
+        }
+    };
+    let title = format!(
+        "New pull request · {}/{}",
+        ctx.owner.username, ctx.repo.path
+    );
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// `GET …/-/pulls/{n}` — a pull request: conversation, commits, and diff.
+pub(crate) async fn view(
+    state: &AppState,
+    viewer: Option<User>,
+    jar: CookieJar,
+    uri: &Uri,
+    ctx: RepoCtx,
+    number: i64,
+) -> AppResult<Response> {
+    if !ctx.repo.pulls_enabled {
+        return Err(AppError::NotFound);
+    }
+    let issue = state
+        .store
+        .issue_by_number(&ctx.repo.id, number, true)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    let pr = state
+        .store
+        .pull_by_issue(&issue.id)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    let can_write = viewer.is_some() && ctx.access >= auth::Access::Write;
+    let is_author = viewer.as_ref().is_some_and(|v| v.id == issue.author_id);
+    let branches = branch_names(state, &ctx.repo.id).await;
+    let Loaded {
+        author,
+        comment_rows,
+        issue_labels,
+        repo_labels,
+        assignee,
+        commits,
+        files,
+        mergeable,
+    } = gather(state, &ctx, &issue, &pr, can_write).await?;
+    let (jar, chrome) = build_chrome(state, jar, viewer, uri.path().to_string());
+    let csrf = chrome.csrf.clone();
+    let body = html! {
+        (repo_header(state, &ctx, Tab::Pulls, &ctx.repo.default_branch, &branches))
+        div class="issue-view" {
+            header class="issue-header" {
+                h1 { (issue.title) " " span class="muted" { "#" (issue.number) } }
+                div class="issue-sub" {
+                    (pr_state_badge(&issue, &pr))
+                    span class="muted" {
+                        " " (author) " wants to merge "
+                        code { (pr.head_ref) } " into " code { (pr.base_ref) }
+                    }
+                }
+            }
+            div class="issue-main" {
+                article class="issue-thread" {
+                    (comment_card(&author, &issue.body, issue.created_at))
+                    @for (c, cauthor) in &comment_rows {
+                        (comment_card(cauthor, &c.body, c.created_at))
+                    }
+                    (merge_panel(&issue, &pr, mergeable, &csrf))
+                    @if can_write {
+                        div class="card comment-form" {
+                            form method="post" action=(format!("/issue/{}/comment", issue.id)) {
+                                input type="hidden" name="_csrf" value=(csrf);
+                                textarea name="body" rows="4" placeholder="Leave a comment (markdown)" required {}
+                                div class="comment-actions" {
+                                    @if can_write || is_author {
+                                        (state_button(&issue, &csrf, Kind::pulls()))
+                                    }
+                                    button class="btn btn-primary" type="submit" { "Comment" }
+                                }
+                            }
+                        }
+                    }
+                }
+                aside class="issue-side" {
+                    section {
+                        h3 { "Assignee" }
+                        @if let Some(a) = &assignee { p { (a) } } @else { p class="muted" { "No one" } }
+                        @if can_write { (assignee_form(&issue, &ctx, state, &csrf).await) }
+                    }
+                    section {
+                        h3 { "Labels" }
+                        @if issue_labels.is_empty() { p class="muted" { "None" } }
+                        @else { div class="label-set" { @for l in &issue_labels { (label_chip(l)) } } }
+                        @if can_write && !repo_labels.is_empty() {
+                            (label_form(&issue, &repo_labels, &issue_labels, &csrf))
+                        }
+                    }
+                }
+            }
+            @if issue.state == model::IssueState::Open {
+                (pr_changes(&commits, &files))
+            }
+        }
+    };
+    let title = format!("{} · {}/{}", issue.title, ctx.owner.username, ctx.repo.path);
+    Ok((jar, page(&chrome, &title, body)).into_response())
+}
+/// Everything the PR view needs beyond the issue/PR rows themselves.
+struct Loaded {
+    /// The author's display name.
+    author: String,
+    /// Each comment paired with its author's name.
+    comment_rows: Vec<(model::Comment, String)>,
+    /// Labels applied to this PR.
+    issue_labels: Vec<model::Label>,
+    /// All labels defined on the repo (for the picker).
+    repo_labels: Vec<model::Label>,
+    /// The assignee's name, if any.
+    assignee: Option<String>,
+    /// The commits the PR contributes (empty once closed).
+    commits: Vec<git::CommitSummary>,
+    /// The rendered three-dot diff (empty once closed).
+    files: Vec<crate::diff::RenderedFile>,
+    /// Mergeability, computed only for an open PR the viewer can merge.
+    mergeable: Option<git::merge::Mergeability>,
+}
+/// Load the comments, labels, assignee, diff, and mergeability for the PR view.
+async fn gather(
+    state: &AppState,
+    ctx: &RepoCtx,
+    issue: &model::Issue,
+    pr: &model::PullRequest,
+    can_write: bool,
+) -> AppResult<Loaded> {
+    let author = username(state, &issue.author_id).await;
+    let comments = state.store.list_comments(&issue.id).await?;
+    let mut comment_rows = Vec::with_capacity(comments.len());
+    for c in comments {
+        let name = username(state, &c.author_id).await;
+        comment_rows.push((c, name));
+    }
+    let issue_labels = state.store.issue_labels(&issue.id).await?;
+    let repo_labels = state.store.list_labels(&ctx.repo.id).await?;
+    let assignee = match &issue.assignee_id {
+        Some(id) => Some(username(state, id).await),
+        None => None,
+    };
+    let open = issue.state == model::IssueState::Open;
+    // Three-dot commits/diff; best-effort so a deleted branch does not 500.
+    let (commits, files) = if open {
+        crate::repo::load_range_diff(state, &ctx.repo.id, &pr.base_ref, &pr.head_ref)
+            .await
+            .unwrap_or_default()
+    } else {
+        (Vec::new(), Vec::new())
+    };
+    let mergeable = if open && pr.merged_at.is_none() && can_write {
+        analyze(state, &ctx.repo.id, &pr.base_ref, &pr.head_ref).await
+    } else {
+        None
+    };
+    Ok(Loaded {
+        author,
+        comment_rows,
+        issue_labels,
+        repo_labels,
+        assignee,
+        commits,
+        files,
+        mergeable,
+    })
+}
+// ---- render helpers ----
+/// The commits + diff a pull request contributes.
+fn pr_changes(commits: &[git::CommitSummary], files: &[crate::diff::RenderedFile]) -> Markup {
+    let (adds, dels) = files.iter().fold((0, 0), |(a, d), f| {
+        let (fa, fd) = f.stats();
+        (a + fa, d + fd)
+    });
+    html! {
+        section class="pr-changes" {
+            h2 { (commits.len()) " commits · " (files.len()) " files changed "
+                span class="muted" {
+                    span style="color:var(--fb-diff-add-fg)" { "+" (adds) }
+                    " "
+                    span style="color:var(--fb-diff-del-fg)" { "−" (dels) }
+                }
+            }
+            @if !commits.is_empty() {
+                ul class="entry-list card pr-commits" {
+                    @for c in commits {
+                        li class="entry-row" {
+                            div class="entry-row-body" {
+                                span class="entry-row-title" { (c.summary) }
+                                div class="entry-row-meta muted mono" { (c.oid.short()) }
+                            }
+                        }
+                    }
+                }
+            }
+            @for (i, f) in files.iter().enumerate() {
+                details open id=(format!("file-{i}")) class="diff-file" {
+                    summary {
+                        @let (fa, fd) = f.stats();
+                        span class="mono" { (f.path()) }
+                        " " span class="muted" { "+" (fa) " −" (fd) }
+                    }
+                    @if f.diff.is_binary {
+                        p class="muted" style="padding:0.5rem" { "Binary file not shown." }
+                    } @else if f.diff.hunks.is_empty() {
+                        p class="muted" style="padding:0.5rem" { "No textual changes." }
+                    } @else {
+                        (diff::unified(f, None))
+                    }
+                }
+            }
+        }
+    }
+}
+/// The state badge for a PR, distinguishing a merged PR from a plain closed one.
+fn pr_state_badge(issue: &model::Issue, pr: &model::PullRequest) -> Markup {
+    if pr.merged_at.is_some() {
+        return html! { span class="badge badge-state-merged" { "Merged" } };
+    }
+    state_badge(issue.state, true)
+}
+/// The merge panel: shows mergeability and, when clean, the strategy buttons.
+fn merge_panel(
+    issue: &model::Issue,
+    pr: &model::PullRequest,
+    mergeable: Option<git::merge::Mergeability>,
+    csrf: &str,
+) -> Markup {
+    use git::merge::Mergeability;
+    if let Some(sha) = &pr.merge_sha {
+        return html! {
+            div class="card merge-panel merged" {
+                p { "This pull request was merged" }
+                @if let Some(s) = &pr.merge_strategy { " " span class="muted" { "(" (s) ")" } }
+                p class="mono muted" { (sha) }
+            }
+        };
+    }
+    if issue.state != model::IssueState::Open {
+        return html! {};
+    }
+    match mergeable {
+        None => html! {},
+        Some(Mergeability::AlreadyMerged) => html! {
+            div class="card merge-panel" {
+                p class="muted" { "The base branch already contains these commits — nothing to merge." }
+            }
+        },
+        Some(Mergeability::Conflicts) => html! {
+            div class="card merge-panel conflicts" {
+                p { "This branch has conflicts that must be resolved before it can be merged." }
+            }
+        },
+        Some(Mergeability::Clean) => html! {
+            div class="card merge-panel clean" {
+                p { "This branch has no conflicts with the base branch." }
+                form method="post" action=(format!("/pull/{}/merge", issue.id)) class="merge-form" {
+                    input type="hidden" name="_csrf" value=(csrf);
+                    label for="strategy" { "Method " }
+                    select id="strategy" name="strategy" {
+                        option value="merge" { "Create a merge commit" }
+                        option value="squash" { "Squash and merge" }
+                        option value="rebase" { "Rebase and merge" }
+                    }
+                    button class="btn btn-primary" type="submit" { "Merge pull request" }
+                }
+            }
+        },
+    }
+}
+/// Run the (blocking) mergeability analysis on the blocking pool.
+async fn analyze(
+    state: &AppState,
+    repo_id: &str,
+    base_ref: &str,
+    head_ref: &str,
+) -> Option<git::merge::Mergeability> {
+    let binary = state.config.git.binary.clone();
+    let home = state.config.storage.data_dir.join("tmp");
+    let repo_path = git::repo_path(&state.config.storage.repo_dir, repo_id).ok()?;
+    let base = base_ref.to_string();
+    let head = head_ref.to_string();
+    tokio::task::spawn_blocking(move || {
+        git::merge::analyze(&binary, &repo_path, &home, &base, &head).ok()
+    })
+    .await
+    .ok()
+    .flatten()
+}
+// ---- POST handlers ----
+/// `?base_ref=&head_ref=` for pre-filling the compare form.
+fn compare_query(uri: &Uri) -> (Option<String>, Option<String>) {
+    let mut base = None;
+    let mut head = None;
+    if let Some(q) = uri.query() {
+        for (k, v) in url::form_urlencoded::parse(q.as_bytes()) {
+            match k.as_ref() {
+                "base_ref" => base = Some(v.into_owned()),
+                "head_ref" => head = Some(v.into_owned()),
+                _ => {}
+            }
+        }
+    }
+    (base, head)
+}
+/// New-pull-request form fields.
+#[derive(Debug, Deserialize)]
+pub struct NewPullForm {
+    /// The base branch (merged into).
+    #[serde(default)]
+    base_ref: String,
+    /// The head branch (source of the changes).
+    #[serde(default)]
+    head_ref: String,
+    /// Title.
+    #[serde(default)]
+    title: String,
+    /// Markdown body.
+    #[serde(default)]
+    body: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /pull-new/{repo_id}` — open a pull request.
+pub async fn create(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(repo_id): Path<String>,
+    axum::Form(form): axum::Form<NewPullForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let repo = state
+            .store
+            .repo_by_id(&repo_id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        if !repo.pulls_enabled {
+            return Err(AppError::NotFound);
+        }
+        // Read access is enough to open a PR.
+        if access_for(&state, Some(&user), &repo).await? < auth::Access::Read {
+            return Err(AppError::NotFound);
+        }
+        let title = form.title.trim();
+        let base = form.base_ref.trim();
+        let head = form.head_ref.trim();
+        if title.is_empty() {
+            return Err(AppError::BadRequest("A title is required.".to_string()));
+        }
+        if base.is_empty() || head.is_empty() || base == head {
+            return Err(AppError::BadRequest(
+                "Choose two different branches to compare.".to_string(),
+            ));
+        }
+        // Both refs must exist.
+        let names = branch_names(&state, &repo.id).await;
+        if !names.iter().any(|b| b == base) || !names.iter().any(|b| b == head) {
+            return Err(AppError::BadRequest("Unknown branch.".to_string()));
+        }
+        let issue = state
+            .store
+            .create_pull(&repo.id, &user.id, title, form.body.trim(), base, head)
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Merge form: the chosen strategy.
+#[derive(Debug, Deserialize)]
+pub struct MergeForm {
+    /// `merge` | `squash` | `rebase`.
+    #[serde(default)]
+    strategy: String,
+    /// CSRF token.
+    #[serde(rename = "_csrf")]
+    csrf: String,
+}
+/// `POST /pull/{id}/merge` — merge a pull request (Write access).
+pub async fn merge(
+    State(state): State<AppState>,
+    MaybeUser(viewer): MaybeUser,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    axum::Form(form): axum::Form<MergeForm>,
+) -> Response {
+    if verify_csrf(&jar, &headers, Some(&form.csrf)).is_err() {
+        return AppError::Forbidden.into_response();
+    }
+    let result = async {
+        let user = viewer.ok_or(AppError::Forbidden)?;
+        let issue = state
+            .store
+            .issue_by_id(&id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        if !issue.is_pull {
+            return Err(AppError::NotFound);
+        }
+        let (repo, access) = repo_of_issue(&state, Some(&user), &issue).await?;
+        if access < auth::Access::Write {
+            return Err(AppError::Forbidden);
+        }
+        let pr = state
+            .store
+            .pull_by_issue(&issue.id)
+            .await?
+            .ok_or(AppError::NotFound)?;
+        if pr.merged_at.is_some() || issue.state != model::IssueState::Open {
+            return Err(AppError::BadRequest(
+                "This pull request is already closed.".to_string(),
+            ));
+        }
+        let strategy = git::merge::MergeStrategy::from_token(&form.strategy);
+        let sha = run_merge(&state, &repo, &pr, &user, strategy, &issue).await?;
+        state
+            .store
+            .mark_pull_merged(&issue.id, &user.id, &sha, strategy.as_str())
+            .await?;
+        Ok::<String, AppError>(issue_url(&state, &repo, &issue).await)
+    }
+    .await;
+    respond_redirect(result)
+}
+/// Run the blocking server-side merge on the blocking pool.
+async fn run_merge(
+    state: &AppState,
+    repo: &model::Repo,
+    pr: &model::PullRequest,
+    user: &User,
+    strategy: git::merge::MergeStrategy,
+    issue: &model::Issue,
+) -> AppResult<String> {
+    let binary = state.config.git.binary.clone();
+    let home: PathBuf = state.config.storage.data_dir.join("tmp");
+    let repo_path = git::repo_path(&state.config.storage.repo_dir, &repo.id)?;
+    let workdir = home.join(format!("merge-{}", issue.id));
+    let base = pr.base_ref.clone();
+    let head = pr.head_ref.clone();
+    let name = user
+        .display_name
+        .clone()
+        .unwrap_or_else(|| user.username.clone());
+    let email = user.email.clone();
+    let message = format!("Merge pull request #{} — {}", issue.number, issue.title);
+    let sha = tokio::task::spawn_blocking(move || {
+        let req = git::merge::MergeRequest {
+            binary: &binary,
+            repo_path: &repo_path,
+            workdir: &workdir,
+            base_branch: &base,
+            head_ref: &head,
+            strategy,
+            message: &message,
+            identity: git::merge::MergeIdentity {
+                home: &home,
+                name: &name,
+                email: &email,
+            },
+        };
+        git::merge::merge(&req)
+    })
+    .await
+    .map_err(AppError::internal)?;
+    sha.map_err(|e| match e {
+        git::GitError::MergeConflict => {
+            AppError::BadRequest("The branch could not be merged cleanly.".to_string())
+        }
+        other => AppError::from(other),
+    })
+}

                 },
+            }
+        }
+        "pulls" => {
+            let kind = crate::issues::Kind::pulls();
+            match rest {
+                "" => {
+                    let closed = uri.query().is_some_and(|q| q.contains("state=closed"));
+                    crate::issues::list(state, viewer, jar, uri, ctx, kind, closed).await
+                }
+                "new" => crate::pulls::new_form(state, viewer, jar, uri, ctx).await,
+                n => match n.parse::<i64>() {
+                    Ok(num) => crate::pulls::view(state, viewer, jar, uri, ctx, num).await,
+                    Err(_) => Err(AppError::NotFound),
+                },
+            }
+        }
         "settings" => repo_settings_view(state, viewer, jar, uri, ctx).await,
         // Reserved `runs` slot returns 404 until built.
         _ => Err(AppError::NotFound),
     .await
+}
+/// The commits and rendered diff a pull request contributes: the head-only
+/// commit list (newest first) and the three-dot diff (merge-base → head).
+pub(crate) type RangeDiff = (Vec<git::CommitSummary>, Vec<RenderedFile>);
+/// Load a pull request's commits and diff. `base` and `head` are branch names (or
+/// revs); the diff is three-dot (against their merge base) so unrelated base
+/// commits do not appear as changes.
+pub(crate) async fn load_range_diff(
+    state: &AppState,
+    repo_id: &str,
+    base: &str,
+    head: &str,
+) -> AppResult<RangeDiff> {
+    let context_lines = state.config.ui.diff_context_lines;
+    let base = base.to_string();
+    let head = head.to_string();
+    git_read(state, repo_id, move |repo| {
+        let base_oid = repo.resolve_ref(&base)?.oid;
+        let head_oid = repo.resolve_ref(&head)?.oid;
+        // Three-dot: diff from the merge base, so only the head's own work shows.
+        let merge_base = repo.merge_base(&base_oid, &head_oid)?.unwrap_or(base_oid);
+        let commits = repo.commits_between(&merge_base, &head_oid, 200)?;
+        let diffs = repo.diff(
+            Some(&merge_base),
+            &head_oid,
+            git::DiffOpts { context_lines },
+        )?;
+        let head_rev = git::Resolved {
+            oid: head_oid.clone(),
+            kind: git::RefKind::Commit,
+            name: head.clone(),
+        };
+        let base_rev = git::Resolved {
+            oid: merge_base.clone(),
+            kind: git::RefKind::Commit,
+            name: merge_base.to_string(),
+        };
+        let rendered = diffs
+            .files
+            .into_iter()
+            .map(|file| render_one_file(repo, &head_rev, Some(&base_rev), file))
+            .collect();
+        Ok((commits, rendered))
+    })
+    .await
+}
 /// Build a [`RenderedFile`] for one diff entry, highlighting each side as a whole
 /// document.
 fn render_one_file(

     assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+/// Build an app whose storage lives under a temp dir, so real bare repositories
+/// can be created on disk — needed for pull-request diffs and merges. The temp
+/// dir is returned so it outlives the test.
+async fn app_with_git() -> (AppState, Router, tempfile::TempDir) {
+    let store = Store::connect("sqlite::memory:", 1).await.unwrap();
+    store.migrate().await.unwrap();
+    let hash = auth::hash_password("secret12", auth::HashParams::default()).unwrap();
+    store
+        .create_user(NewUser {
+            username: "ada".to_string(),
+            email: "ada@example.com".to_string(),
+            display_name: Some("Ada".to_string()),
+            password_hash: Some(hash),
+            is_admin: false,
+            must_change_password: false,
+        })
+        .await
+        .unwrap();
+    let dir = tempfile::tempdir().unwrap();
+    let mut config = Config::default();
+    config.instance.name = "Forge".to_string();
+    config.auth.cookie_secure = false;
+    config.storage.repo_dir = dir.path().join("repos");
+    config.storage.data_dir = dir.path().to_path_buf();
+    std::fs::create_dir_all(config.storage.data_dir.join("tmp")).unwrap();
+    let state = AppState::build(Arc::new(config), store, "test-secret".to_string()).unwrap();
+    let router = crate::build_router(state.clone());
+    (state, router, dir)
+}
+/// Commit `files` onto `branch` in a bare repo via libgit2, returning the new oid.
+fn seed_commit(
+    raw: &git2::Repository,
+    branch: &str,
+    parents: &[git2::Oid],
+    files: &[(&str, &str)],
+    message: &str,
+    t: i64,
+) -> git2::Oid {
+    let mut root = raw.treebuilder(None).unwrap();
+    for (name, content) in files {
+        let blob = raw.blob(content.as_bytes()).unwrap();
+        root.insert(name, blob, 0o100_644).unwrap();
+    }
+    let tree = raw.find_tree(root.write().unwrap()).unwrap();
+    let sig = git2::Signature::new("Ada", "ada@example.com", &git2::Time::new(t, 0)).unwrap();
+    let parent_commits: Vec<_> = parents
+        .iter()
+        .map(|p| raw.find_commit(*p).unwrap())
+        .collect();
+    let parent_refs: Vec<&git2::Commit> = parent_commits.iter().collect();
+    raw.commit(
+        Some(&format!("refs/heads/{branch}")),
+        &sig,
+        &sig,
+        message,
+        &tree,
+        &parent_refs,
+    )
+    .unwrap()
+}
+#[tokio::test]
+async fn pull_request_create_view_and_merge() {
+    // Merge shells out to `git`; skip cleanly where it is absent.
+    if std::process::Command::new("git")
+        .arg("--version")
+        .output()
+        .is_err()
+    {
+        return;
+    }
+    let (state, app, _dir) = app_with_git().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "proj".to_string(),
+            path: "proj".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    // Create the bare repo on disk with a mergeable feature branch.
+    let hook = state.config.storage.data_dir.join("fabrica");
+    git::create_bare(&state.config.storage.repo_dir, &repo.id, "main", &hook).unwrap();
+    let path = git::repo_path(&state.config.storage.repo_dir, &repo.id).unwrap();
+    let raw = git2::Repository::open_bare(&path).unwrap();
+    let base = seed_commit(&raw, "main", &[], &[("README.md", "hello\n")], "init", 1);
+    seed_commit(
+        &raw,
+        "feature",
+        &[base],
+        &[("README.md", "hello\n"), ("feature.txt", "new\n")],
+        "add feature",
+,
+    );
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    // Open a pull request comparing feature → main.
+    let req = Request::builder()
+        .method("POST")
+        .uri(format!("/pull-new/{}", repo.id))
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::from(format!(
+            "base_ref=main&head_ref=feature&title=Add+feature&body=please&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert_eq!(
+        res.headers().get(header::LOCATION).unwrap(),
+        "/ada/proj/-/pulls/1"
+    );
+    // The PR page shows the compare summary, the diff, and a clean merge panel.
+    let req = Request::builder()
+        .uri("/ada/proj/-/pulls/1")
+        .header(header::COOKIE, cookie.clone())
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("wants to merge"), "compare summary shown");
+    assert!(html.contains("feature.txt"), "diff lists the new file");
+    assert!(html.contains("Merge pull request"), "merge button shown");
+    // Merge it (default merge-commit strategy).
+    let issue = state
+        .store
+        .issue_by_number(&repo.id, 1, true)
+        .await
+        .unwrap()
+        .unwrap();
+    let req = Request::builder()
+        .method("POST")
+        .uri(format!("/pull/{}/merge", issue.id))
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!("strategy=merge&_csrf={token}")))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    // The PR is now merged and closed, and main carries the feature file.
+    let pr = state.store.pull_by_issue(&issue.id).await.unwrap().unwrap();
+    assert!(pr.merged_at.is_some(), "merge recorded");
+    assert!(pr.merge_sha.is_some(), "merge sha stored");
+    let closed = state.store.issue_by_id(&issue.id).await.unwrap().unwrap();
+    assert_eq!(closed.state, model::IssueState::Closed, "PR auto-closed");
+    let main_tip = raw
+        .find_reference("refs/heads/main")
+        .unwrap()
+        .peel_to_commit()
+        .unwrap();
+    assert!(
+        main_tip.tree().unwrap().get_name("feature.txt").is_some(),
+        "main now contains the merged file"
+    );
+    assert_eq!(main_tip.parent_count(), 2, "a merge commit");
+}
+#[tokio::test]
+async fn pulls_404_when_disabled() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "nopr".to_string(),
+            path: "nopr".to_string(),
+            description: None,
+            visibility: model::Visibility::Public,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    state
+        .store
+        .set_feature_enabled(&repo.id, "pulls", false)
+        .await
+        .unwrap();
+    let res = app.oneshot(get("/ada/nopr/-/pulls")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
 #[tokio::test]
 async fn settings_requires_authentication() {
     let (_state, app) = app().await;