feat: reply from mobile Filed (Closes #876)

tests/test_issue_api.py

@@ -2077,6 +2077,54 @@ async def test_assigned_issue_conversation_endpoint_is_authorized_bounded_and_no
     ]
 
 
+@pytest.mark.anyio
+async def test_filed_issue_author_can_read_and_reply_but_other_issues_stay_hidden(monkeypatch):
+    calls = []
+
+    async def authored(repository, number):
+        calls.append(("authored", repository, number))
+        return (repository, number) == ("stackchain/api", 8)
+
+    async def conversation(repository, number, page, limit):
+        calls.append(("conversation", repository, number, page, limit))
+        return {"comments": [{"id": 21}], "page": 2, "older_page": 1, "total": 21}
+
+    async def comment(repository, number, body):
+        calls.append(("comment", repository, number, body))
+        return {"id": 22, "author": "timmy", "body": body}
+
+    monkeypatch.setattr(main.gitea_proxy, "is_authored_issue", authored, raising=False)
+    monkeypatch.setattr(main.gitea_proxy, "issue_conversation_page", conversation)
+    monkeypatch.setattr(main.gitea_proxy, "comment_on_issue", comment)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        loaded = await client.get(
+            "/api/v1/repos/stackchain/api/issues/8/comments?access=filed&page=2&limit=20"
+        )
+        posted = await client.post(
+            "/api/v1/repos/stackchain/api/issues/8/comments?access=filed",
+            json={"body": "  One clarification  "},
+            headers={"Idempotency-Key": "filed-followup-876"},
+        )
+        hidden = await client.post(
+            "/api/v1/repos/private/secret/issues/8/comments?access=filed",
+            json={"body": "Do not post"},
+        )
+
+    assert loaded.status_code == 200
+    assert loaded.json()["older_page"] == 1
+    assert posted.status_code == 201
+    assert posted.json() == {"id": 22, "author": "timmy", "body": "One clarification"}
+    assert hidden.status_code == 404
+    assert calls == [
+        ("authored", "stackchain/api", 8),
+        ("conversation", "stackchain/api", 8, 2, 20),
+        ("authored", "stackchain/api", 8),
+        ("comment", "stackchain/api", 8, "One clarification"),
+        ("authored", "private/secret", 8),
+    ]
+
+
 @pytest.mark.anyio
 async def test_issue_detail_deadline_is_retryable_sanitized_and_cancels_work(monkeypatch):
     cancelled = asyncio.Event()

tests/test_my_work.py

@@ -1356,21 +1356,25 @@ const calls = [];
 
 
 @pytest.mark.anyio
-async def test_dashboard_opens_delegated_filings_as_read_only_issue_sheets():
+async def test_dashboard_opens_delegated_filings_with_follow_up_only_capabilities():
     html = await dashboard()
 
     assert "else if (item.kind === 'issue' || item.kind === 'filed') openIssueSheet(item, issueTrigger);" in html
     assert "const readOnly = issueController.readOnly(item);" in html
     assert "qs('#issue-sheet').classList.toggle('read-only', readOnly);" in html
-    assert "#issue-sheet.read-only .issue-comment-composer" in html
+    assert "#issue-sheet.read-only .issue-comment-composer" not in html
+    assert "#issue-sheet.read-only .issue-attachment-controls" in html
     assert "#issue-sheet.read-only #issue-planning" in html
     assert "#issue-sheet.read-only #issue-handoff" in html
     assert "#issue-sheet.read-only #release-issue" in html
     assert "#issue-sheet.read-only #close-issue" in html
     assert "#issue-sheet.read-only .detail-defer" in html
     assert "if (readOnly) paintIssueConversation(issueConversation.snapshot(), null);" in html
-    assert "qs('#load-older-issue-comments').hidden = true;" in html
-    assert "readOnly ? 'Filed issue ready · read-only'" in html
+    assert "if (readOnly) qs('#load-older-issue-comments').hidden = true;" not in html
+    assert "readOnly ? 'Filed issue ready · follow-up enabled'" in html
+    assert "paintIssueConversation(await issueConversation.loadOlder(), null)" in html
+    assert ".issue-comment-composer textarea" in html
+    assert ".issue-comment-composer button" in html
 
 
 @pytest.mark.anyio
@@ -1639,6 +1643,52 @@ Promise.all([
     ]
 
 
+def test_issue_sheet_uses_author_access_for_filed_conversation_and_follow_up():
+    script = f"""
+const createIssueSheet = require({json.dumps(str(ISSUE_SHEET))});
+const createConversationPager = require({json.dumps(str(ISSUE_SHEET.parent / "conversation.js"))});
+const calls = [];
+const controller = createIssueSheet({{
+  fetchJson: async (url, options={{}}) => {{
+    calls.push({{url, method:options.method || 'GET', key:options.headers?.['Idempotency-Key'] || ''}});
+    if (options.method === 'POST') return {{id:22, body:'Clarifying detail'}};
+    return {{comments:[], page:1, older_page:null, total:0}};
+  }},
+  storage:null,
+  createOperationId:() => 'filed-followup-876',
+  createConversationPager,
+}});
+const filed = {{kind:'filed',repository:'stackchain/api',number:18,is_filed:true,is_assigned:false}};
+const assigned = {{kind:'issue',repository:'stackchain/api',number:17,is_assigned:true}};
+const initial = {{comments:[], page:2, older_page:1, total:0}};
+Promise.all([
+  controller.conversation(filed, initial).loadOlder(),
+  controller.comment(filed, 'Clarifying detail'),
+  controller.conversation(assigned, initial).loadOlder(),
+]).then(() => process.stdout.write(JSON.stringify(calls)));
+"""
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+    assert json.loads(result.stdout) == [
+        {
+            "url": "api/v1/repos/stackchain/api/issues/18/comments?page=1&limit=20&access=filed",
+            "method": "GET",
+            "key": "",
+        },
+        {
+            "url": "api/v1/repos/stackchain/api/issues/18/comments?access=filed",
+            "method": "POST",
+            "key": "filed-followup-876",
+        },
+        {
+            "url": "api/v1/repos/stackchain/api/issues/17/comments?page=1&limit=20",
+            "method": "GET",
+            "key": "",
+        },
+    ]
+
+
 def test_issue_release_is_single_flight_and_requires_confirmed_unassignment():
     script = f"""
 const createIssueSheet = require({json.dumps(str(ISSUE_SHEET))});