feat: add mobile review readiness inspector (#121)

tests/test_gitea_work_search.py

@@ -53,6 +53,29 @@ async def test_pull_requests_merge_assignment_and_review_responsibilities(monkey
     assert pulls[1]["work_reasons"] == ["review_requested"]
 
 
+@pytest.mark.anyio
+async def test_requested_review_guard_matches_repository_number_and_reason(monkeypatch):
+    async def pulls():
+        return [
+            {
+                "number": 7,
+                "repository": {"full_name": "stackchain/api"},
+                "work_reasons": ["review_requested"],
+            },
+            {
+                "number": 8,
+                "repository": {"full_name": "stackchain/api"},
+                "work_reasons": ["assigned_to_me"],
+            },
+        ]
+
+    monkeypatch.setattr(gitea_proxy, "pull_requests", pulls)
+
+    assert await gitea_proxy.is_requested_review("stackchain/api", 7) is True
+    assert await gitea_proxy.is_requested_review("stackchain/api", 8) is False
+    assert await gitea_proxy.is_requested_review("stackchain/private", 7) is False
+
+
 @pytest.mark.anyio
 async def test_context_preserves_repository_and_update_time_for_cross_repo_work(monkeypatch):
     async def user():
@@ -106,3 +129,47 @@ async def test_context_preserves_repository_and_update_time_for_cross_repo_work(
         "assigned_to_me",
         "review_requested",
     ]
+
+
+@pytest.mark.anyio
+async def test_pull_review_detail_combines_pr_files_status_and_reviews(monkeypatch):
+    requested_paths = []
+
+    async def fake_fetch(path):
+        requested_paths.append(path)
+        if path.endswith("/pulls/7"):
+            return {
+                "title": "Review API",
+                "body": "Please check the retry flow.",
+                "html_url": "https://forge.example/stackchain/api/pulls/7",
+                "user": {"login": "alex"},
+                "head": {"sha": "abc123"},
+            }
+        if path.endswith("/files"):
+            return [
+                {"filename": "src/api.py", "status": "modified", "additions": 8, "deletions": 2},
+                None,
+            ]
+        if "/commits/abc123/status" in path:
+            return {"state": "success"}
+        return [
+            {"user": {"login": "sam"}, "state": "APPROVED", "body": "Looks good"},
+            "malformed",
+        ]
+
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    detail = await gitea_proxy.pull_review_detail("stackchain/api", 7)
+
+    assert requested_paths == [
+        "repos/stackchain/api/pulls/7",
+        "repos/stackchain/api/pulls/7/files",
+        "repos/stackchain/api/commits/abc123/status",
+        "repos/stackchain/api/pulls/7/reviews",
+    ]
+    assert detail["author"] == "alex"
+    assert detail["ci_state"] == "success"
+    assert detail["files"][0]["filename"] == "src/api.py"
+    assert detail["reviews"][0]["state"] == "APPROVED"
+    assert len(detail["files"]) == 1
+    assert len(detail["reviews"]) == 1

tests/test_my_work.py

@@ -8,6 +8,7 @@ from src.views import dashboard
 
 
 MY_WORK = Path(__file__).parents[1] / "frontend" / "my-work.js"
+REVIEW_SHEET = Path(__file__).parents[1] / "frontend" / "review-sheet.js"
 
 
 def test_my_work_queue_prioritizes_labels_then_reviews_and_keeps_repo_identity():
@@ -143,3 +144,55 @@ async def test_mobile_filters_wrap_show_counts_and_persist_for_the_session():
     assert 'data-work-count="review"' in html
     assert 'sessionStorage.getItem(WORK_FILTER_KEY)' in html
     assert 'sessionStorage.setItem(WORK_FILTER_KEY, selectedWorkFilter)' in html
+
+
+def test_review_controller_loads_encoded_cross_repo_detail_path():
+    script = f"""
+const createReviewController = require({json.dumps(str(REVIEW_SHEET))});
+let request;
+const controller = createReviewController({{ fetchJson: async (url, options) => {{
+  request = {{ url, accept: options.headers.Accept }};
+  return {{ title: 'Review API' }};
+}} }});
+controller.load({{ repository: 'stackchain/api', number: 7 }}).then(detail =>
+  process.stdout.write(JSON.stringify({{ request, title: detail.title }}))
+);
+"""
+
+    result = subprocess.run(
+        ["node", "-e", script], check=True, capture_output=True, text=True
+    )
+
+    assert json.loads(result.stdout) == {
+        "request": {
+            "url": "api/v1/repos/stackchain/api/pulls/7/review",
+            "accept": "application/json",
+        },
+        "title": "Review API",
+    }
+
+
+@pytest.mark.anyio
+async def test_review_requests_open_an_accessible_mobile_detail_sheet():
+    html = await dashboard()
+
+    assert 'id="review-sheet"' in html
+    assert 'role="dialog"' in html and 'aria-modal="true"' in html
+    assert 'id="review-sheet-status"' in html and 'aria-live="polite"' in html
+    assert 'id="open-review-gitea"' in html and 'rel="noopener noreferrer"' in html
+    assert '<script src="static/review-sheet.js"></script>' in html
+    assert '@media (max-width: 600px)' in html
+    assert '.review-sheet-panel' in html and 'width:100%' in html
+    assert '.review-action' in html and 'min-height:44px' in html
+
+
+@pytest.mark.anyio
+async def test_review_sheet_loads_details_and_preserves_safe_gitea_handoff():
+    html = await dashboard()
+
+    assert 'data-review-index' in html
+    assert "reviewController.load(selectedReview)" in html
+    assert "review-files" in html
+    assert "review-history" in html
+    assert "open-review-gitea" in html
+    assert "reviewController.submit" not in html

tests/test_review_api.py

@@ -0,0 +1,61 @@
+import httpx
+import pytest
+
+from src import main
+
+
+@pytest.mark.anyio
+async def test_review_detail_endpoint_returns_normalized_no_store_payload(monkeypatch):
+    async def requested(repository, number):
+        return (repository, number) == ("stackchain/api", 7)
+
+    async def detail(repository, number):
+        assert (repository, number) == ("stackchain/api", 7)
+        return {
+            "repository": repository,
+            "number": number,
+            "title": "Review API",
+            "body": "Check retries",
+            "url": "https://forge.example/stackchain/api/pulls/7",
+            "author": "alex",
+            "ci_state": "success",
+            "files": [{"filename": "src/api.py", "status": "modified", "additions": 8, "deletions": 2}],
+            "reviews": [{"user": {"login": "sam"}, "state": "APPROVED", "body": "Good"}],
+        }
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    monkeypatch.setattr(main, "pull_review_detail", detail)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/repos/stackchain/api/pulls/7/review")
+
+    assert response.status_code == 200
+    assert response.headers["cache-control"] == "no-store"
+    assert response.json()["files"][0]["filename"] == "src/api.py"
+
+
+@pytest.mark.anyio
+async def test_review_detail_rejects_pulls_not_requested_from_service_user(monkeypatch):
+    async def requested(repository, number):
+        return False
+
+    monkeypatch.setattr(main, "is_requested_review", requested)
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.get("/api/v1/repos/private/secret/pulls/9/review")
+
+    assert response.status_code == 404
+    assert response.headers["cache-control"] == "no-store"
+
+
+@pytest.mark.anyio
+async def test_public_review_endpoint_does_not_expose_service_token_mutations():
+    transport = httpx.ASGITransport(app=main.app)
+    async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+        response = await client.post(
+            "/api/v1/repos/stackchain/api/pulls/7/review",
+            json={"action": "approve"},
+        )
+
+    assert response.status_code == 405
+