Merge pull request #403 from nazarli-shabnam/fix/cache-clear-activity-feed

Fix/cache clear activity feed

Author: nazarli-shabnam

apps/api/src/repositories/job_repo.py

@@ -30,6 +30,10 @@ def list_jobs(db: Session, limit: int = 50) -> list[dict]:
     ]
 
 
+def get_job(db: Session, job_id: int) -> Job | None:
+    return db.query(Job).filter(Job.id == job_id).one_or_none()
+
+
 def list_recent_by_type(db: Session, job_type: str, limit: int = 20) -> list[dict]:
     rows = (
         db.query(Job)

apps/api/src/routers/github.py

@@ -217,7 +217,14 @@ def org_events(
     # call site instead of baking the check into the shared repository function.
     installation = installation_repo.get_for_org(db, org_id=ctx.org.id, account_login=org_login)
     if installation is not None and installation.installation_id is not None:
-        return _fetch_events_from_repo_events(db, org_login, ctx.org.tenant_id, payload.per_page)
+        from_db = _fetch_events_from_repo_events(db, org_login, ctx.org.tenant_id, payload.per_page)
+        if from_db.events:
+            return from_db
+        # repo_events is empty for this tenant. That normally means the GitHub App isn't
+        # subscribed to the push/pull_request/issues/release/create webhooks yet (see
+        # docs/self-hosting.md), or the one-time install backfill has aged out. Rather
+        # than show a permanently blank feed, fall through to the live-GitHub read below
+        # -- resolve_org_token already prefers the installation token.
 
     client_token = payload.token.get_secret_value() if payload.token else None
     try:

apps/api/src/routers/jobs.py

@@ -1,14 +1,39 @@
-from fastapi import APIRouter, Depends
+import json
+
+from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
-from src.core.auth import UserOut, require_workspace_admin
+from src.core.auth import UserOut, require_auth, require_workspace_admin
 from src.core.db import get_db
 from src.repositories import job_repo
 from src.schemas.job import JobOut
 
 router = APIRouter()
 
+# Job types a non-admin caller is allowed to poll by id, and which record the enqueuing
+# user's email in their payload (`actor`) so we can scope the read to its owner.
+_SELF_READABLE_JOB_TYPES = {"github.clear_actions_cache"}
+
 
 @router.get("", response_model=list[JobOut])
 def jobs(db: Session = Depends(get_db), _user: UserOut = Depends(require_workspace_admin)):
     return job_repo.list_jobs(db)
+
+
+@router.get("/{job_id}", response_model=JobOut)
+def job(job_id: int, db: Session = Depends(get_db), user: UserOut = Depends(require_auth)):
+    # The cache-clear panel polls this to show a queued job's real terminal status
+    # (done/failed) instead of claiming success the moment it's enqueued. The `jobs` table
+    # has no owner/tenant column, so to avoid cross-tenant id enumeration this is scoped to
+    # the job's own `actor` (the email of the user who enqueued it) and to job types that
+    # record one. Anything else 404s -- workspace admins use the list endpoint above.
+    row = job_repo.get_job(db, job_id)
+    if row is None or row.job_type not in _SELF_READABLE_JOB_TYPES:
+        raise HTTPException(status_code=404, detail="Unknown job")
+    try:
+        actor = json.loads(row.payload or "{}").get("actor")
+    except (ValueError, TypeError):
+        actor = None
+    if actor != user.email:
+        raise HTTPException(status_code=404, detail="Unknown job")
+    return row

apps/api/src/routers/webhooks.py

@@ -3,7 +3,7 @@
   POST /webhooks/github   verifies X-Hub-Signature-256, then handles installation
                            lifecycle events to keep github_installations in sync, and
                            durably queues a bounded set of event types (issue #191/S3)
-                           for a future event-processor fleet (S4, not built yet).
+                           for the event-processor fleet (S4, apps/worker/src/event_consumer.py).
 """
 
 import hashlib

apps/api/tests/test_github_events.py

@@ -401,6 +401,23 @@ def test_events_falls_back_to_live_github_when_the_installation_has_no_installat
     assert resp.json()["events"][0]["actor"] == "alice"
 
 
+def test_events_fall_back_to_live_github_when_installation_connected_but_repo_events_empty(
+    events_client, db, acme_org_with_installation
+):
+    # An App-connected org whose repo_events table is still empty (webhooks not yet
+    # subscribed, or the install-time backfill aged out). Instead of a permanently blank
+    # feed, org_events must fall through to the live-GitHub read.
+    with patch("src.routers.github.GitHubClient") as mock_client:
+        mock_client.return_value.request.return_value = [_PUSH_EVENT]
+        resp = events_client.post(
+            "/github/orgs/acme/events", json={"token": "ghp_testtoken123456789012345678901234"}
+        )
+
+    assert resp.status_code == 200
+    mock_client.assert_called_once()
+    assert resp.json()["events"][0]["actor"] == "alice"
+
+
 def test_events_falls_back_to_live_github_when_no_installation_is_connected(events_client, acme_org):
     # acme_org (no installation fixture) -- confirms the hybrid still uses the unchanged
     # live-GitHub path for a legacy PAT-only org, not an empty feed.

apps/api/tests/test_owner_only_routes.py

@@ -43,6 +43,48 @@ def test_jobs_non_owner_forbidden(db):
     assert resp.status_code == 403
 
 
+def test_single_clear_job_readable_by_the_user_who_enqueued_it(db):
+    # GET /jobs/{id} is only require_auth (the cache-clear panel polls it), but scoped to
+    # the job's own `actor` -- a non-workspace-admin who enqueued the clear can read it.
+    db.execute(
+        text(
+            "INSERT INTO jobs (id, job_type, payload, status, result) VALUES "
+            "(9991, 'github.clear_actions_cache', '{\"actor\": \"member@example.com\"}', "
+            "'done', '{\"ok\": true, \"deleted\": 2}')"
+        )
+    )
+    resp = _client(jobs_router, db, _NON_OWNER, prefix="/jobs").get("/jobs/9991")
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "done"
+
+
+def test_single_job_hidden_from_a_different_user(db):
+    db.execute(
+        text(
+            "INSERT INTO jobs (id, job_type, payload, status) VALUES "
+            "(9992, 'github.clear_actions_cache', '{\"actor\": \"someone-else@example.com\"}', 'done')"
+        )
+    )
+    resp = _client(jobs_router, db, _NON_OWNER, prefix="/jobs").get("/jobs/9992")
+    assert resp.status_code == 404
+
+
+def test_single_job_of_a_non_self_readable_type_is_404(db):
+    db.execute(
+        text(
+            "INSERT INTO jobs (id, job_type, payload, status) VALUES "
+            "(9993, 'github.backfill_repo_events', '{\"actor\": \"member@example.com\"}', 'done')"
+        )
+    )
+    resp = _client(jobs_router, db, _NON_OWNER, prefix="/jobs").get("/jobs/9993")
+    assert resp.status_code == 404
+
+
+def test_single_job_unknown_id_is_404(db):
+    resp = _client(jobs_router, db, _NON_OWNER, prefix="/jobs").get("/jobs/424242")
+    assert resp.status_code == 404
+
+
 # ── audit ─────────────────────────────────────────────────────────────────────
 
 def test_audit_owner_ok(db):

apps/ui/app/activity/page.tsx

@@ -1,6 +1,6 @@
 "use client"
 
-import { useEffect, useState } from "react"
+import { useEffect } from "react"
 import Link from "next/link"
 import { useQuery } from "@tanstack/react-query"
 import { PageHeader } from "@/components/page-header"
@@ -18,25 +18,6 @@ import { useActiveScope } from "@/lib/active-scope"
 const EVENTS_REFRESH_SECONDS = 30
 const HEATMAP_COLOR_SCALE = [CHART_COLORS.grid, "#1d4ed8", "#3b82f6", "#60a5fa", "#93c5fd"]
 
-// Isolated into its own component so the 1s tick only re-renders this small chip,
-// not the whole page (and the feed/job lists below it).
-function RefreshCountdown({ resetKey, seconds }: { resetKey: number; seconds: number }) {
-  const [remaining, setRemaining] = useState(seconds)
-
-  useEffect(() => {
-    setRemaining(seconds)
-  }, [resetKey, seconds])
-
-  useEffect(() => {
-    const interval = setInterval(() => {
-      setRemaining((r) => (r > 0 ? r - 1 : 0))
-    }, 1000)
-    return () => clearInterval(interval)
-  }, [])
-
-  return <span className="stat-chip">refreshes in {remaining}s</span>
-}
-
 export default function ActivityPage() {
   // Marks all cockpit-sourced events as read so the sidebar's unread badge
   // clears once the user has actually looked at this page.
@@ -78,10 +59,6 @@ export default function ActivityPage() {
     refetchInterval: EVENTS_REFRESH_SECONDS * 1000,
   })
 
-  // Reset the countdown on either a successful fetch OR a failed one, so it always
-  // tracks the real refetchInterval cadence instead of sticking at 0 after an error.
-  const lastAttemptAt = Math.max(eventsQuery.dataUpdatedAt, eventsQuery.errorUpdatedAt)
-
   // Heatmap data rides on the personal cockpit endpoint (commit_heatmap_52w) --
   // that endpoint is personal-scoped (no OrgMembership needed), unlike the
   // org-scoped failed-runs/release-timeline calls below, but the same resolved
@@ -127,7 +104,7 @@ export default function ActivityPage() {
         <div className="lg:col-span-2 card">
           <div className="px-4 py-3 border-b border-border flex items-center justify-between gap-3">
             <span className="section-label">Activity Feed</span>
-            {hasOrg && <RefreshCountdown resetKey={lastAttemptAt} seconds={EVENTS_REFRESH_SECONDS} />}
+            {hasOrg && <span className="stat-chip">auto-refreshes every {EVENTS_REFRESH_SECONDS}s</span>}
           </div>
           {!hasOrg ? (
             <EmptyStateNoAccount bare />