fix(gitcafe): PR panel follows renumbered pull requests (#26079)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: juliusmarminge

packages/source-control-gitcafe/src/server/GitCafeApi.ts

@@ -13,6 +13,7 @@ import * as GitCafeCredentials from "./GitCafeCredentials.ts";
 import * as GitCafeHosts from "./gitCafeHosts.ts";
 
 const NO_REDIRECT: RequestInit = { redirect: "manual" };
+const MAX_REDIRECTS = 3;
 const TIMEOUT = Duration.seconds(30);
 
 export const GitCafeApiFailure = Schema.Literals([
@@ -85,6 +86,28 @@ const credentialFailure = (
       ? "unauthenticated"
       : "failed";
 
+const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+// 307 and 308 keep the method and body; the others only safely repeat a read.
+const METHOD_PRESERVING = new Set([307, 308]);
+
+const redirectTarget = (
+  method: string,
+  origin: string,
+  from: string,
+  response: { readonly status: number; readonly location: string | undefined },
+): string | null => {
+  if (!REDIRECTS.has(response.status) || response.location === undefined) return null;
+  if (method !== "GET" && !METHOD_PRESERVING.has(response.status)) return null;
+  const target = URL.parse(response.location, from);
+  return target !== null &&
+    target.origin === origin &&
+    target.username === "" &&
+    target.password === "" &&
+    target.pathname.startsWith("/api/")
+    ? target.href
+    : null;
+};
+
 /** @public */
 export const make = Effect.gen(function* () {
   const httpClient = yield* HttpClient.HttpClient;
@@ -122,30 +145,49 @@ export const make = Effect.gen(function* () {
           fail({ status: null, reason: credentialFailure(cause), detail: cause.message, cause }),
         ),
       );
-    const base = HttpClientRequest.make(input.method ?? "GET")(
-      `https://${host}/api${input.path}`,
-    ).pipe(
-      HttpClientRequest.bearerToken(Redacted.value(credential.token)),
-      HttpClientRequest.setHeaders({ accept: "application/json", "user-agent": "t3code" }),
-    );
-    const { status, text } = yield* Effect.gen(function* () {
-      const response = yield* httpClient
-        .execute(
-          input.body === undefined ? base : base.pipe(HttpClientRequest.bodyJsonUnsafe(input.body)),
-        )
-        .pipe(
-          // Client spans expose query strings containing branch names.
-          Effect.provideService(HttpClient.TracerDisabledWhen, () => true),
-          // GitCafe does not redirect; reject 3xx to protect bearer credentials.
-          Effect.provideService(FetchHttpClient.RequestInit, NO_REDIRECT),
-        );
-      return { status: response.status, text: yield* response.text };
-    }).pipe(
-      Effect.timeout(TIMEOUT),
-      Effect.mapError((cause) =>
-        fail({ status: null, reason: "failed", detail: "Could not reach GitCafe.", cause }),
-      ),
-    );
+    const origin = `https://${host}`;
+    const method = input.method ?? "GET";
+    const send = (url: string) => {
+      const base = HttpClientRequest.make(method)(url).pipe(
+        HttpClientRequest.bearerToken(Redacted.value(credential.token)),
+        HttpClientRequest.setHeaders({ accept: "application/json", "user-agent": "t3code" }),
+      );
+      return Effect.gen(function* () {
+        const response = yield* httpClient
+          .execute(
+            input.body === undefined
+              ? base
+              : base.pipe(HttpClientRequest.bodyJsonUnsafe(input.body)),
+          )
+          .pipe(
+            // Client spans expose query strings containing branch names.
+            Effect.provideService(HttpClient.TracerDisabledWhen, () => true),
+            // fetch would carry the bearer token to any redirect target.
+            Effect.provideService(FetchHttpClient.RequestInit, NO_REDIRECT),
+          );
+        return {
+          status: response.status,
+          location: response.headers.location,
+          text: yield* response.text,
+        };
+      }).pipe(
+        Effect.timeout(TIMEOUT),
+        Effect.mapError((cause) =>
+          fail({ status: null, reason: "failed", detail: "Could not reach GitCafe.", cause }),
+        ),
+      );
+    };
+    // A renumbered pull request (provisional number replaced by the synced GitHub one)
+    // answers with a redirect; follow it only within this host's API.
+    let url = `${origin}/api${input.path}`;
+    let response = yield* send(url);
+    for (let hop = 0; hop < MAX_REDIRECTS; hop++) {
+      const next = redirectTarget(method, origin, url, response);
+      if (next === null) break;
+      url = next;
+      response = yield* send(url);
+    }
+    const { status, text } = response;
     yield* Effect.annotateCurrentSpan({ "http.response.status_code": status });
     if (status >= 200 && status < 300) return text;
     // The source may hold a newer token than the one that was refused.

packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts

@@ -534,6 +534,41 @@ describe("GitCafePullRequestProvider", () => {
     );
   });
 
+  it.effect("follows a renumbered pull request's redirect only within the host's API", () =>
+    Effect.gen(function* () {
+      const moved = (location: string) =>
+        new Response(null, { status: 301, headers: { location } });
+      const renumbered = fakeGitCafe({
+        "GET /repos/owner/repo/pulls/7/stack": moved("/api/repos/owner/repo/pulls/8/stack"),
+        "GET /repos/owner/repo/pulls/8/stack": { stack: null },
+      });
+      yield* GitCafePullRequestProvider.make.pipe(
+        Effect.flatMap((provider) => provider.getChangeRequestStack!(target)),
+        Effect.provide(renumbered.layer),
+      );
+      assert.deepStrictEqual(
+        renumbered.sent.map((r) => `${r.host}${r.path}`),
+        ["git.cafe/repos/owner/repo/pulls/7/stack", "git.cafe/repos/owner/repo/pulls/8/stack"],
+      );
+
+      for (const location of [
+        "https://evil.example/api/repos/owner/repo/pulls/8/stack",
+        "//evil.example/api/repos/owner/repo/pulls/8/stack",
+        "https://staging.git.cafe/api/repos/owner/repo/pulls/8/stack",
+        "/repos/owner/repo/pulls/8/stack",
+      ]) {
+        const elsewhere = fakeGitCafe({ "GET /repos/owner/repo/pulls/7/stack": moved(location) });
+        const error = yield* GitCafePullRequestProvider.make.pipe(
+          Effect.flatMap((provider) => provider.getChangeRequestStack!(target)),
+          Effect.flip,
+          Effect.provide(elsewhere.layer),
+        );
+        assert.strictEqual(error.detail, "GitCafe answered HTTP 301.");
+        assert.strictEqual(elsewhere.sent.length, 1);
+      }
+    }),
+  );
+
   it.effect("reads the stack a pull request belongs to, with each open layer's head", () => {
     const { "GET /repos/owner/repo/pulls/6": _merged, ...routes } = stack([
       { number: 6, headOid: baseOid, state: "merged" },