src/webhook.rs

use async_recursion::async_recursion;
use futures::StreamExt;
use html_escape;
use hyper::{Body, Request, Response, StatusCode};
use itertools::Itertools;
use regex::RegexBuilder;
use ring::hmac;
use rocksdb::DB;
use serde::{Deserialize, Serialize};
use snafu::{OptionExt, ResultExt};
use std::{collections::HashMap, sync::Arc, time::Duration};
use tokio::{sync::Mutex, time::delay_for};

use crate::{
	companion::*, config::MainConfig, error::*, github::*,
	github_bot::GithubBot, rebase::*, utils::parse_bot_comment_from_text,
	vanity_service, CommentCommand, MergeAllowedOutcome, MergeCancelOutcome,
	MergeCommentCommand, Result, Status, WEBHOOK_PARSING_ERROR_TEMPLATE,
};

pub struct AppState {
	pub db: DB,
	pub github_bot: GithubBot,
	pub config: MainConfig,
}

#[derive(Debug, Serialize, Deserialize, Clone)]
#[repr(C)]
pub struct Dependency {
	pub sha: String,
	pub owner: String,
	pub repo: String,
	pub number: i64,
	pub html_url: String,
}
#[derive(Debug, Serialize, Deserialize, Clone)]
#[repr(C)]
pub struct MergeRequest {
	pub sha: String,
	pub was_updated: bool,
	pub owner: String,
	pub repo: String,
	pub number: i64,
	pub html_url: String,
	pub requested_by: String,
	pub dependencies: Option<Vec<Dependency>>,
}

fn verify(
	secret: &[u8],
	msg: &[u8],
	signature: &[u8],
) -> Result<(), ring::error::Unspecified> {
	let key = hmac::Key::new(hmac::HMAC_SHA1_FOR_LEGACY_USE_ONLY, secret);
	hmac::verify(&key, msg, signature)
}

/// Receive a webhook and state object, acquire lock on state object.
pub async fn webhook(
	req: Request<Body>,
	state: Arc<Mutex<AppState>>,
) -> Result<Response<Body>> {
	if req.uri().path() == "/webhook" {
		// lock here to prevent double merge requests being sent (which often happens when checks
		// complete because we receive redundant status hooks).
		let state = &*state.lock().await;
		let sig = req
			.headers()
			.get("x-hub-signature")
			.context(Message {
				msg: "Missing x-hub-signature".to_owned(),
			})?
			.to_str()
			.ok()
			.context(Message {
				msg: "Error parsing x-hub-signature".to_owned(),
			})?
			.to_string();

		log::info!("Lock acquired for {:?}", sig);
		if let Some((merge_cancel_outcome, err)) =
			match webhook_inner(req, state).await {
				Ok((merge_cancel_outcome, result)) => match result {
					Ok(_) => None,
					Err(err) => Some((merge_cancel_outcome, err)),
				},
				Err(err) => Some((MergeCancelOutcome::WasNotCancelled, err)),
			} {
			handle_error(merge_cancel_outcome, err, state).await
		};
		log::info!("Will release lock for {:?}", sig);

		Response::builder()
			.status(StatusCode::OK)
			.body(Body::from(""))
			.ok()
			.context(Message {
				msg: "Error building response".to_owned(),
			})
	} else if req.uri().path() == "/health" {
		Response::builder()
			.status(StatusCode::OK)
			.body(Body::from("OK"))
			.ok()
			.context(Message {
				msg: "Healthcheck".to_owned(),
			})
	} else {
		Response::builder()
			.status(StatusCode::NOT_FOUND)
			.body(Body::from("Not found."))
			.ok()
			.context(Message {
				msg: "Error building response".to_owned(),
			})
	}
}

pub async fn webhook_inner(
	mut req: Request<Body>,
	state: &AppState,
) -> Result<(MergeCancelOutcome, Result<()>)> {
	let mut msg_bytes = vec![];
	while let Some(item) = req.body_mut().next().await {
		msg_bytes.extend_from_slice(&item.ok().context(Message {
			msg: "Error getting bytes from request body".to_owned(),
		})?);
	}

	let sig = req
		.headers()
		.get("x-hub-signature")
		.context(Message {
			msg: "Missing x-hub-signature".to_string(),
		})?
		.to_str()
		.ok()
		.context(Message {
			msg: "Error parsing x-hub-signature".to_owned(),
		})?
		.replace("sha1=", "");
	let sig_bytes = base16::decode(sig.as_bytes()).ok().context(Message {
		msg: "Error decoding x-hub-signature".to_owned(),
	})?;

	let AppState { config, .. } = state;

	verify(
		config.webhook_secret.trim().as_bytes(),
		&msg_bytes,
		&sig_bytes,
	)
	.ok()
	.context(Message {
		msg: "Validation signature does not match".to_owned(),
	})?;

	log::info!("Parsing payload {}", String::from_utf8_lossy(&msg_bytes));
	match serde_json::from_slice::<Payload>(&msg_bytes) {
		Ok(payload) => Ok(handle_payload(payload, state).await),
		Err(err) => {
			// If this comment was originated from a Bot, then acting on it might make the bot
			// to respond to itself recursively, as happened on
			// https://github.com/paritytech/substrate/pull/8409. Therefore we'll only act on
			// this error if it's known for sure it has been initiated only by a User comment.
			let pr_details = serde_json::from_slice::<
				DetectUserCommentPullRequest,
			>(&msg_bytes)
			.ok()
			.map(|detected| detected.get_issue_details())
			.flatten();

			if let Some(pr_details) = pr_details {
				Err(Error::Message {
					msg: format!(
						WEBHOOK_PARSING_ERROR_TEMPLATE!(),
						err.to_string(),
						String::from_utf8_lossy(&msg_bytes)
					),
				}
				.map_issue(pr_details))
			} else {
				log::info!("Ignoring payload parsing error",);
				Ok((MergeCancelOutcome::ShaNotFound, Ok(())))
			}
		}
	}
}

pub async fn handle_payload(
	payload: Payload,
	state: &AppState,
) -> (MergeCancelOutcome, Result<()>) {
	let (result, sha) = match payload {
		Payload::IssueComment {
			action: IssueCommentAction::Unknown,
			..
		} => (Ok(()), None),
		Payload::IssueComment {
			action: IssueCommentAction::Created,
			comment,
			issue,
		} => match comment {
			Comment {
				ref body,
				user: Some(User {
					ref login,
					ref type_field,
				}),
				..
			} => match type_field {
				Some(UserType::Bot) => (Ok(()), None),
				_ => match &issue {
					WebhookIssueComment {
						number,
						html_url,
						repository_url,
						pull_request: Some(_),
					} => {
						let (sha, result) = handle_comment(
							body,
							login,
							*number,
							html_url,
							repository_url,
							state,
						)
						.await;
						(
							result.map_err(|err| match err {
								Error::WithIssue { .. } => err,
								err => {
									if let Some(details) =
										issue.get_issue_details()
									{
										err.map_issue(details)
									} else {
										err
									}
								}
							}),
							sha,
						)
					}
					_ => (Ok(()), None),
				},
			},
			_ => (Ok(()), None),
		},
		Payload::CommitStatus { sha, state: status } => (
			match status {
				StatusState::Pending => Ok(()),
				_ => checks_and_status(state, &sha).await,
			},
			Some(sha),
		),
		Payload::CheckRun {
			check_run: CheckRun {
				status,
				head_sha: sha,
				..
			},
			..
		} => (
			match status {
				CheckRunStatus::Completed => {
					checks_and_status(state, &sha).await
				}
				_ => Ok(()),
			},
			Some(sha),
		),
		Payload::WorkflowJob {
			workflow_job: WorkflowJob {
				head_sha: sha,
				conclusion,
			},
			..
		} => (
			if conclusion.is_some() {
				checks_and_status(state, &sha).await
			} else {
				Ok(())
			},
			Some(sha),
		),
	};

	// From this point onwards we'll clean the SHA from the database if this is a error which stops
	// the merge process

	// Without the SHA we'll not be able to fetch the database for more context, so exit early
	let sha = match sha {
		Some(sha) => sha,
		None => return (MergeCancelOutcome::ShaNotFound, result),
	};

	// If it's not an error then don't bother with going further
	let err = match result {
		Ok(_) => return (MergeCancelOutcome::WasNotCancelled, Ok(())),
		Err(err) => err,
	};

	// If this error does not interrupt the merge process, then don't bother with going further
	if !err.stops_merge_attempt() {
		log::info!(
			"SHA {} did not have its merge attempt stopped because error does not stop the merge attempt {:?}",
			sha,
			err
		);
		return (MergeCancelOutcome::WasNotCancelled, Err(err));
	};

	log::info!(
		"SHA {} will have its merge attempt stopped due to {:?}",
		sha,
		err
	);

	match state.db.get(sha.as_bytes()) {
		Ok(Some(bytes)) => {
			match bincode::deserialize::<MergeRequest>(&bytes).context(Bincode)
			{
				Ok(mr) => {
					let merge_cancel_outcome = match cleanup_pr(
						state,
						&sha,
						&mr.owner,
						&mr.repo,
						mr.number,
						&PullRequestCleanupReason::Cancelled,
					)
					.await
					{
						Ok(_) => {
							log::info!(
								"Merge of {} (sha {}) was cancelled due to {:?}",
								&mr.html_url,
								sha,
								err
							);
							MergeCancelOutcome::WasCancelled
						}
						Err(err) => {
							log::error!(
									"Failed to cancel merge of {} (sha {}) in handle_payload due to {:?}",
									&mr.html_url,
									sha,
									err
								);
							MergeCancelOutcome::WasNotCancelled
						}
					};

					let err = match err {
						Error::WithIssue { .. } => err,
						err => err.map_issue((mr.owner, mr.repo, mr.number)),
					};

					(merge_cancel_outcome, Err(err))
				}
				Err(db_err) => {
					log::error!(
						"Failed to parse {} from the database due to {:?}",
						&sha,
						db_err
					);
					(MergeCancelOutcome::WasNotCancelled, Err(err))
				}
			}
		}
		Ok(None) => (MergeCancelOutcome::ShaNotFound, Err(err)),
		Err(db_err) => {
			log::info!(
				"Failed to fetch {} from the database due to {:?}",
				sha,
				db_err
			);
			(MergeCancelOutcome::WasNotCancelled, Err(err))
		}
	}
}

pub async fn get_latest_statuses_state(
	github_bot: &GithubBot,
	owner: &str,
	repo: &str,
	commit_sha: &str,
	html_url: &str,
) -> Result<Status> {
	let status = github_bot.status(owner, repo, commit_sha).await?;
	log::info!("{} statuses: {:?}", html_url, status);

	// Since Github only considers the latest instance of each status, we should abide by the same
	// rule. Each instance is uniquely identified by "context".
	let mut latest_statuses: HashMap<String, (i64, StatusState)> =
		HashMap::new();
	for s in status.statuses {
		if s.description
			.as_ref()
			.map(|description| {
				match serde_json::from_str::<vanity_service::JobInformation>(
					description,
				) {
					Ok(info) => info.build_allow_failure.unwrap_or(false),
					_ => false,
				}
			})
			.unwrap_or(false)
		{
			continue;
		}

		if latest_statuses
			.get(&s.context)
			.map(|(prev_id, _)| prev_id < &s.id)
			.unwrap_or(true)
		{
			latest_statuses.insert(s.context, (s.id, s.state));
		}
	}
	log::info!("{} latest_statuses: {:?}", html_url, latest_statuses);

	Ok(
		if latest_statuses
			.values()
			.all(|(_, state)| *state == StatusState::Success)
		{
			log::info!("{} has success status", html_url);
			Status::Success
		} else if latest_statuses
			.values()
			.any(|(_, state)| *state == StatusState::Pending)
		{
			log::info!("{} has pending status", html_url);
			Status::Pending
		} else {
			log::info!("{} has failed status", html_url);
			Status::Failure
		},
	)
}

pub async fn get_latest_checks_state(
	github_bot: &GithubBot,
	owner: &str,
	repo_name: &str,
	commit_sha: &str,
	html_url: &str,
) -> Result<Status> {
	let checks = github_bot.check_runs(owner, repo_name, commit_sha).await?;
	log::info!("{} checks: {:?}", html_url, checks);

	// Since Github only considers the latest instance of each check, we should abide by the same
	// rule. Each instance is uniquely identified by "name".
	let mut latest_checks: HashMap<
		String,
		(i64, CheckRunStatus, Option<CheckRunConclusion>),
	> = HashMap::new();
	for c in checks.check_runs {
		if latest_checks
			.get(&c.name)
			.map(|(prev_id, _, _)| prev_id < &c.id)
			.unwrap_or(true)
		{
			latest_checks.insert(c.name, (c.id, c.status, c.conclusion));
		}
	}
	log::info!("{} latest_checks,: {:?}", html_url, latest_checks);

	Ok(
		if latest_checks.values().all(|(_, _, conclusion)| {
			*conclusion == Some(CheckRunConclusion::Success)
		}) {
			log::info!("{} has successful checks", html_url);
			Status::Success
		} else if latest_checks
			.values()
			.all(|(_, status, _)| *status == CheckRunStatus::Completed)
		{
			log::info!("{} has unsuccessful checks", html_url);
			Status::Failure
		} else {
			log::info!("{} has pending checks", html_url);
			Status::Pending
		},
	)
}

/// Act on a status' outcome to decide on whether a PR relating to this SHA is ready to be merged
#[async_recursion]
async fn checks_and_status(state: &AppState, sha: &str) -> Result<()> {
	let AppState { db, github_bot, .. } = state;

	log::info!("Checking for statuses of {}", sha);

	let mr: MergeRequest = match db.get(sha.as_bytes()).context(Db)? {
		Some(bytes) => bincode::deserialize(&bytes).context(Bincode)?,
		None => return Ok(()),
	};
	let pr = github_bot
		.pull_request(&mr.owner, &mr.repo, mr.number)
		.await?;
	log::info!(
		"Deserialized merge request for {} (sha {}): {:?}",
		pr.html_url,
		sha,
		mr
	);

	match async {
		if cleanup_merged_pr(state, &pr).await? {
			return Ok(());
		}

		if mr.sha != pr.head.sha {
			return Err(Error::HeadChanged {
				expected: sha.to_string(),
				actual: pr.head.sha.to_owned(),
			});
		}

		if !ready_to_merge(github_bot, &pr).await? {
			log::info!("{} is not ready", pr.html_url);
			return Ok(());
		}

		check_merge_is_allowed(state, &pr, &mr.requested_by, None, &[]).await?;

		if let Some(dependencies) = &mr.dependencies {
			let mut shas_to_exclude = Vec::with_capacity(dependencies.len());
			shas_to_exclude.push(sha.to_owned());
			for dependency in dependencies {
				let dependency_pr = github_bot
					.pull_request(
						&dependency.owner,
						&dependency.repo,
						dependency.number,
					)
					.await?;
				if dependency_pr.head.sha != dependency.sha {
					return Err(Error::Message {
						msg: format!(
							"Dependency {} 's HEAD SHA changed from {} to {}. Aborting.",
							dependency.html_url,
							dependency.sha,
							dependency_pr.head.sha
						),
					});
				}

				if dependency_pr.merged {
					log::info!(
						"Dependency {} of PR {} was merged, cleaning it",
						dependency_pr.html_url,
						pr.html_url
					);
					cleanup_pr(
						state,
						&dependency_pr.head.sha,
						&dependency.owner,
						&dependency.repo,
						dependency.number,
						&PullRequestCleanupReason::AfterMerge,
					)
					.await?;
					shas_to_exclude.push((&dependency_pr.head.sha).to_owned());
				} else {
					log::info!(
						"Giving up on merging {} because its dependency {} has not been merged yet",
						pr.html_url,
						dependency.html_url
					);
					return Ok(());
				};
			}
		}

		log::info!("Updating companion {} before merge", pr.html_url);
		update_then_merge(
			state,
			&mr,
			&WaitToMergeMessage::None,
			// No need to register the MR again: we already know it is registered because
			// it was fetched from the database at the start
			false,
			// We have checked that all dependencies are ready by this point
			true,
		)
		.await?;

		Ok(())
	}
	.await
	{
		Ok(_) | Err(Error::MergeFailureWillBeSolvedLater { .. }) => Ok(()),
		Err(err) => Err(err.map_issue((
			pr.base.repo.owner.login,
			pr.base.repo.name,
			pr.number,
		))),
	}
}

pub async fn handle_dependents_after_merge(
	state: &AppState,
	pr: &PullRequest,
	requested_by: &str,
) -> Result<()> {
	let AppState {
		github_bot,
		db,
		config,
		..
	} = state;

	log::info!("Handling dependents of {}", pr.html_url);

	let mut updated_dependents: Vec<(String, MergeRequest)> = vec![];
	let dependents = github_bot
		.resolve_pr_dependents(config, pr, requested_by, &[])
		.await?;
	if let Some(dependents) = dependents {
		for dependent in dependents {
			let depends_on_another_pr = dependent
				.dependencies
				.as_ref()
				.map(|dependencies| {
					dependencies
						.iter()
						.any(|dependency| dependency.repo != pr.base.repo.name)
				})
				.unwrap_or(false);
			match update_then_merge(
				state,
				&dependent,
				&WaitToMergeMessage::Default,
				// This is the start of the dependency chain, therefore the dependents
				// should always be registered to the database
				// TODO: perhaps merge the dependencies if this dependent already exists in
				// the database
				true,
				!depends_on_another_pr,
			)
			.await
			{
				Ok(updated_sha) => {
					if let Some(updated_sha) = updated_sha {
						updated_dependents.push((updated_sha, dependent))
					}
				}
				Err(err) => {
					let _ = cleanup_pr(
						state,
						&dependent.sha,
						&dependent.owner,
						&dependent.repo,
						dependent.number,
						&PullRequestCleanupReason::Error,
					)
					.await;
					handle_error(MergeCancelOutcome::WasCancelled, err, state)
						.await;
				}
			}
		}
	}

	let mut mrs_to_check = HashMap::new();
	let iter = db.iterator(rocksdb::IteratorMode::Start);
	for (key, value) in iter {
		match bincode::deserialize::<MergeRequest>(&value).context(Bincode) {
			Ok(mut dependent_dependent) => {
				let mut should_include = false;
				let mut record_was_updated = false;
				dependent_dependent.dependencies =
					if let Some(mut dependencies) =
						dependent_dependent.dependencies
					{
						for dependency in dependencies.iter_mut() {
							for (updated_sha, dependent) in &updated_dependents
							{
								if dependency.owner == dependent.owner
									&& dependency.repo == dependent.repo
									&& dependency.number == dependent.number
								{
									record_was_updated = true;
									log::info!(
										"Updating {} 's dependency on {} to SHA {}",
										dependent_dependent.html_url,
										dependent.html_url,
										updated_sha,
									);
									dependency.sha = updated_sha.clone();
								}
							}
							if dependency.owner == pr.base.repo.owner.login
								&& dependency.repo == pr.base.repo.name
								&& dependency.number == pr.number
							{
								should_include = true;
							}
						}
						Some(dependencies)
					} else {
						None
					};
				if record_was_updated {
					let bytes = bincode::serialize(&dependent_dependent)
						.context(Bincode)?;
					if let Err(err) = db.put(&key, bytes).context(Db) {
						log::error!(
							"Failed to update a dependent to {:?} due to {:?}",
							dependent_dependent,
							err
						);
					} else {
						mrs_to_check.insert(key, dependent_dependent);
					}
				} else if should_include {
					mrs_to_check.insert(key, dependent_dependent);
				}
			}
			Err(err) => {
				log::error!(
					"Failed to deserialize {} during cleanup_pr due to {:?}",
					String::from_utf8_lossy(&key),
					err
				);
			}
		};
	}

	for dependent in mrs_to_check.into_values() {
		if let Err(err) = checks_and_status(state, &dependent.sha).await {
			let _ = cleanup_pr(
				state,
				&dependent.sha,
				&dependent.owner,
				&dependent.repo,
				dependent.number,
				&PullRequestCleanupReason::Error,
			)
			.await;
			handle_error(MergeCancelOutcome::WasCancelled, err, state).await;
		}
	}

	Ok(())
}

async fn handle_command(
	state: &AppState,
	cmd: &CommentCommand,
	pr: &PullRequest,
	requested_by: &str,
) -> Result<()> {
	let AppState { github_bot, .. } = state;

	match cmd {
		// This command marks the start of the chain of merges. The PR where the
		// command was received will act as the starting point for resolving further
		// dependencies.
		CommentCommand::Merge(cmd) => {
			let mr = MergeRequest {
				sha: (&pr.head.sha).into(),
				owner: (&pr.base.repo.owner.login).into(),
				repo: (&pr.base.repo.name).into(),
				number: pr.number,
				html_url: (&pr.html_url).into(),
				requested_by: requested_by.into(),
				// Set "was_updated" from the start so that this branch will not be updated
				// It's important for it not to be updated because the command issuer has
				// trusted the current commit, but not the ones coming after it (some
				// malicious actor might want to sneak in changes after the command starts).
				was_updated: true,
				// This is the starting point of the merge chain, hence why always no
				// dependencies are registered for it upfront
				dependencies: None,
			};

			check_merge_is_allowed(state, pr, requested_by, None, &[]).await?;

			match cmd {
				MergeCommentCommand::Normal => {
					if ready_to_merge(github_bot, pr).await? {
						match merge(state, pr, requested_by, None).await? {
							// If the merge failure will be solved later, then register the PR in the database so that
							// it'll eventually resume processing when later statuses arrive
							Err(Error::MergeFailureWillBeSolvedLater {
								msg,
							}) => {
								let msg = format!(
									"This PR cannot be merged **at the moment** due to: {}\n\nprocessbot expects that the problem will be solved automatically later and so the auto-merge process will be started. You can simply wait for now.\n\n",
									msg
								);
								wait_to_merge(
									state,
									&mr,
									&WaitToMergeMessage::Custom(&msg),
								)
								.await?;
								return Err(
									Error::MergeFailureWillBeSolvedLater {
										msg,
									},
								);
							}
							Err(e) => return Err(e),
							_ => (),
						}
					} else {
						wait_to_merge(state, &mr, &WaitToMergeMessage::Default)
							.await?;
						return Ok(());
					}
				}
				MergeCommentCommand::Force => {
					match merge(state, pr, requested_by, None).await? {
						// Even if the merge failure can be solved later, it does not matter because `merge force` is
						// supposed to be immediate. We should give up here and yield the error message.
						Err(Error::MergeFailureWillBeSolvedLater { msg }) => {
							return Err(Error::Message { msg })
						}
						Err(e) => return Err(e),
						_ => (),
					}
				}
			}

			handle_dependents_after_merge(state, pr, requested_by).await
		}
		CommentCommand::CancelMerge => {
			log::info!("Deleting merge request for {}", pr.html_url);

			cleanup_pr(
				state,
				&pr.head.sha,
				&pr.base.repo.owner.login,
				&pr.base.repo.name,
				pr.number,
				&PullRequestCleanupReason::Cancelled,
			)
			.await?;

			if let Err(err) = github_bot
				.create_issue_comment(
					&pr.base.repo.owner.login,
					&pr.base.repo.name,
					pr.number,
					"Merge cancelled.",
				)
				.await
			{
				log::error!(
					"Failed to post comment on {} due to {}",
					pr.html_url,
					err
				);
			}

			Ok(())
		}
		CommentCommand::Rebase => {
			if let Err(err) = github_bot
				.create_issue_comment(
					&pr.base.repo.owner.login,
					&pr.base.repo.name,
					pr.number,
					"Rebasing",
				)
				.await
			{
				log::error!(
					"Failed to post comment on {} due to {}",
					pr.html_url,
					err
				);
			}

			rebase(
				github_bot,
				&pr.base.repo.owner.login,
				&pr.base.repo.name,
				&pr.head.repo.owner.login,
				&pr.head.repo.name,
				&pr.head.ref_field,
			)
			.await
		}
	}
}

/// Parse bot commands in pull request comments. Commands are listed in README.md.
/// The first member of the returned tuple is the relevant commit SHA to invalidate from the
/// database in case of errors.
/// The second member of the returned tuple is the result of handling the parsed command.
async fn handle_comment(
	body: &str,
	requested_by: &str,
	number: i64,
	html_url: &str,
	repo_url: &str,
	state: &AppState,
) -> (Option<String>, Result<()>) {
	let cmd = match parse_bot_comment_from_text(body) {
		Some(cmd) => cmd,
		None => return (None, Ok(())),
	};
	log::info!("{:?} requested by {} in {}", cmd, requested_by, html_url);

	let AppState {
		github_bot, config, ..
	} = state;

	let (owner, repo, pr) = match async {
		let owner = owner_from_html_url(html_url).context(Message {
			msg: format!("Failed parsing owner in url: {}", html_url),
		})?;

		let repo = repo_url.rsplit('/').next().context(Message {
			msg: format!("Failed parsing repo name in url: {}", repo_url),
		})?;

		if !config.disable_org_check {
			github_bot.org_member(owner, requested_by).await?;
		}

		if let CommentCommand::Merge(_) = cmd {
			// We've noticed the bot failing for no human-discernable reason when, for instance, it
			// complained that the pull request was not mergeable when, in fact, it seemed to be, if one
			// were to guess what the state of the Github API was at the time the response was received with
			// "second" precision. For the lack of insight onto the Github Servers, it's assumed that those
			// failures happened because the Github API did not update fast enough and therefore the state
			// was invalid when the request happened, but it got cleared shortly after (possibly
			// microseconds after, hence why it is not discernable at "second" resolution).
			// As a workaround we'll wait for long enough so that Github hopefully has time to update the
			// API and make our merges succeed. A proper workaround would also entail retrying every X
			// seconds for recoverable errors such as "required statuses are missing or pending".
			delay_for(Duration::from_millis(config.merge_command_delay)).await;
		};

		let pr = github_bot.pull_request(owner, repo, number).await?;

		Ok((owner, repo, pr))
	}
	.await
	{
		Ok(value) => value,
		Err(err) => return (None, Err(err)),
	};

	let result = handle_command(state, &cmd, &pr, requested_by)
		.await
		.map_err(|err| {
			err.map_issue((owner.to_owned(), repo.to_owned(), number))
		});

	let sha = match cmd {
		CommentCommand::Merge(_) => Some(pr.head.sha),
		_ => None,
	};

	(sha, result)
}

/// Check if the pull request is mergeable and is able to meet the approval criteria.
/// Errors related to core-devs and substrateteamleads API requests are not propagated as actual
/// errors because the merge might succeed regardless of them, thus it does not make sense to fail
/// this scenario completely if those request fail for some reason.
pub async fn check_merge_is_allowed(
	state: &AppState,
	pr: &PullRequest,
	requested_by: &str,
	min_approvals_required: Option<usize>,
	companion_reference_trail: &[CompanionReferenceTrailItem],
) -> Result<MergeAllowedOutcome> {
	let AppState {
		github_bot, config, ..
	} = state;

	if let Some(min_approvals_required) = &min_approvals_required {
		log::info!(
			"Attempting to reach minimum number of approvals {}",
			min_approvals_required
		);
	} else if pr.mergeable.unwrap_or(false) {
		log::info!("{} is mergeable", pr.html_url);
	} else {
		log::info!("{} is not mergeable", pr.html_url);
	}

	if !pr.mergeable.unwrap_or(false) && min_approvals_required.is_none() {
		return Err(Error::Message {
			msg: format!("Github API says {} is not mergeable", pr.html_url),
		});
	}

	check_all_companions_are_mergeable(
		state,
		pr,
		requested_by,
		companion_reference_trail,
	)
	.await?;

	let min_approvals = if config.disable_org_check {
		0
	} else {
		match min_approvals_required {
			Some(min_approvals_required) => min_approvals_required,
			None => match pr.base.repo.name.as_str() {
				// TODO have this be based on the repository's settings from the API
				// (https://github.com/paritytech/parity-processbot/issues/319)
				"substrate" => 2,
				_ => 1,
			},
		}
	};

	// Consider only the latest relevant review submitted per user
	let latest_reviews = {
		let reviews = github_bot.reviews(&pr.url).await?;
		let mut latest_reviews = HashMap::new();
		for review in reviews {
			// Do not consider states such as "Commented" as having invalidated a previous
			// approval. Note: this assumes approvals are not invalidated on comments or
			// pushes.
			if review
				.state
				.as_ref()
				.map(|state| {
					*state == ReviewState::Approved
						|| *state == ReviewState::ChangesRequested
				})
				.unwrap_or(false)
			{
				if let Some(user) = review.user.as_ref() {
					if latest_reviews
						.get(&user.login)
						.map(|(prev_id, _)| *prev_id < review.id)
						.unwrap_or(true)
					{
						let user_login = (&user.login).to_owned();
						latest_reviews.insert(user_login, (review.id, review));
					}
				}
			}
		}
		latest_reviews
	};

	let approved_reviews = latest_reviews
		.values()
		.filter_map(|(_, review)| {
			if review.state == Some(ReviewState::Approved) {
				Some(review)
			} else {
				None
			}
		})
		.collect::<Vec<_>>();

	let mut errors: Vec<String> = Vec::new();

	let team_leads = if config.disable_org_check {
		vec![]
	} else {
		github_bot
			.team_members(&pr.base.repo.owner.login, &config.team_leads_team)
			.await
			.unwrap_or_else(|e| {
				let msg = format!(
					"Error getting {}: `{}`",
					&config.team_leads_team, e
				);
				log::error!("{}", msg);
				errors.push(msg);
				vec![]
			})
	};
	let team_lead_approvals = approved_reviews
		.iter()
		.filter(|review| {
			team_leads.iter().any(|team_lead| {
				review
					.user
					.as_ref()
					.map(|user| user.login == team_lead.login)
					.unwrap_or(false)
			})
		})
		.count();

	let core_devs = if config.disable_org_check {
		vec![]
	} else {
		github_bot
			.team_members(&pr.base.repo.owner.login, &config.core_devs_team)
			.await
			.unwrap_or_else(|e| {
				let msg = format!(
					"Error getting {}: `{}`",
					&config.core_devs_team, e
				);
				log::error!("{}", msg);
				errors.push(msg);
				vec![]
			})
	};
	let core_dev_approvals = approved_reviews
		.iter()
		.filter(|review| {
			core_devs.iter().any(|core_dev| {
				review
					.user
					.as_ref()
					.map(|user| user.login == core_dev.login)
					.unwrap_or(false)
			})
		})
		.count();

	let relevant_approvals_count = if core_dev_approvals > team_lead_approvals {
		core_dev_approvals
	} else {
		team_lead_approvals
	};

	let relevant_approvals_count =
		if team_leads.iter().any(|lead| lead.login == requested_by) {
			log::info!("{} merge requested by a team lead.", pr.html_url);
			Ok(relevant_approvals_count)
		} else {
			let core_approved = core_dev_approvals >= min_approvals;
			let leads_approved = team_lead_approvals >= 1;

			if core_approved || leads_approved {
				log::info!("{} has core or team lead approval.", pr.html_url);
				Ok(relevant_approvals_count)
			} else {
				Err(Error::Approval {
					errors,
					html_url: (&pr.html_url).to_owned(),
				})
			}
		}?;

	if relevant_approvals_count >= min_approvals {
		return Ok(MergeAllowedOutcome::Allowed);
	}

	let has_bot_approved = approved_reviews.iter().any(|review| {
		review
			.user
			.as_ref()
			.map(|user| {
				user.type_field
					.as_ref()
					.map(|type_field| *type_field == UserType::Bot)
					.unwrap_or(false)
			})
			.unwrap_or(false)
	});

	// If the bot has already approved, then approving again will not make a
	// difference.
	if has_bot_approved
	// If the bot's approval is not enough to reach the minimum, then don't bother with approving
		|| relevant_approvals_count + 1 != min_approvals
	{
		return Ok(MergeAllowedOutcome::Disallowed(format!(
			"It's not possible to meet the minimal approval count of {} in {}",
			min_approvals, pr.html_url
		)));
	}

	let role = if team_leads
		.iter()
		.any(|team_lead| team_lead.login == requested_by)
	{
		"a team lead".to_string()
	} else {
		return Ok(MergeAllowedOutcome::Disallowed(format!(
			"@{} 's approval is not enough to make {} mergeable by processbot's rules",
			requested_by, pr.html_url
		)));
	};

	Ok(MergeAllowedOutcome::GrantApprovalForRole(role))
}

pub async fn ready_to_merge(
	github_bot: &GithubBot,
	pr: &PullRequest,
) -> Result<bool> {
	match get_latest_statuses_state(
		github_bot,
		&pr.base.repo.owner.login,
		&pr.base.repo.name,
		&pr.head.sha,
		&pr.html_url,
	)
	.await?
	{
		Status::Success => {
			match get_latest_checks_state(
				github_bot,
				&pr.base.repo.owner.login,
				&pr.base.repo.name,
				&pr.head.sha,
				&pr.html_url,
			)
			.await?
			{
				Status::Success => Ok(true),
				Status::Failure => Err(Error::ChecksFailed {
					commit_sha: pr.head.sha.to_owned(),
				}),
				_ => Ok(false),
			}
		}
		Status::Failure => Err(Error::ChecksFailed {
			commit_sha: pr.head.sha.to_owned(),
		}),
		_ => Ok(false),
	}
}

async fn register_merge_request(
	state: &AppState,
	mr: &MergeRequest,
) -> Result<()> {
	let AppState { db, .. } = state;
	let MergeRequest { sha, .. } = mr;
	log::info!("Registering merge request (sha: {}): {:?}", sha, mr);
	let bytes = bincode::serialize(mr).context(Bincode)?;
	db.put(sha.as_bytes(), bytes).context(Db)
}

pub enum WaitToMergeMessage<'a> {
	Custom(&'a str),
	Default,
	None,
}
/// Create a merge request, add it to the database, and post a comment stating the merge is
/// pending.
pub async fn wait_to_merge(
	state: &AppState,
	mr: &MergeRequest,
	msg: &WaitToMergeMessage<'_>,
) -> Result<()> {
	register_merge_request(state, mr).await?;

	let AppState { github_bot, .. } = state;

	let MergeRequest {
		owner,
		repo,
		number,
		..
	} = mr;

	let msg = match msg {
		WaitToMergeMessage::Custom(msg) => msg,
		WaitToMergeMessage::Default => "Waiting for commit status.",
		WaitToMergeMessage::None => return Ok(()),
	};

	let post_comment_result = github_bot
		.create_issue_comment(owner, repo, *number, msg)
		.await;
	if let Err(err) = post_comment_result {
		log::error!("Error posting comment: {}", err);
	}

	Ok(())
}

pub async fn cleanup_merged_pr(
	state: &AppState,
	pr: &PullRequest,
) -> Result<bool> {
	if !pr.merged {
		return Ok(false);
	}

	cleanup_pr(
		state,
		&pr.head.sha,
		&pr.base.repo.owner.login,
		&pr.base.repo.name,
		pr.number,
		&PullRequestCleanupReason::AfterMerge,
	)
	.await
	.map(|_| true)
}

pub enum PullRequestCleanupReason<'a> {
	AfterMerge,
	AfterSHAUpdate(&'a String),
	Cancelled,
	Error,
}

// Removes a pull request from the database (e.g. when it has been merged) and
// executes side-effects related to the kind of trigger for this function
pub async fn cleanup_pr(
	state: &AppState,
	key_to_guarantee_deleted: &str,
	owner: &str,
	repo: &str,
	number: i64,
	reason: &PullRequestCleanupReason<'_>,
) -> Result<()> {
	let AppState { db, .. } = state;

	let mut related_dependents = HashMap::new();

	let iter = db.iterator(rocksdb::IteratorMode::Start);
	'to_next_db_item: for (key, value) in iter {
		match bincode::deserialize::<MergeRequest>(&value).context(Bincode) {
			Ok(mr) => {
				if mr.owner == owner && mr.repo == repo && mr.number == number {
					log::info!(
						"Cleaning up {:?} due to key {} of {}/{}/pull/{}",
						mr,
						key_to_guarantee_deleted,
						owner,
						repo,
						number
					);

					if let Err(err) = db.delete(&key) {
						log::error!(
							"Failed to delete {} during cleanup_pr due to {:?}",
							String::from_utf8_lossy(&key),
							err
						);
					}
				}

				if let Some(dependencies) = &mr.dependencies {
					for dependency in dependencies.iter() {
						if dependency.owner == owner
							&& dependency.repo == repo && dependency.number
							== number
						{
							related_dependents.insert((&mr.sha).clone(), mr);
							continue 'to_next_db_item;
						}
					}
				}
			}
			Err(err) => {
				log::error!(
					"Failed to deserialize {} during cleanup_pr due to {:?}",
					String::from_utf8_lossy(&key),
					err
				);
			}
		}
	}

	// Sanity-check: the key should have actually been deleted
	if db.get(key_to_guarantee_deleted).context(Db)?.is_some() {
		return Err(Error::Message {
			msg: format!(
				"Key {} was not deleted from the database",
				key_to_guarantee_deleted
			),
		});
	}

	struct CleanedUpPullRequest {
		pub owner: String,
		pub repo: String,
		pub key_to_guarantee_deleted: String,
		pub number: i64,
	}
	lazy_static::lazy_static! {
		static ref CLEANUP_PR_RECURSION_PREVENTION: parking_lot::Mutex<Vec<CleanedUpPullRequest>> = {
			parking_lot::Mutex::new(vec![])
		};
	}
	// Prevent mutual recursion since the side-effects might end up calling this
	// function again. We want to trigger the further side-effects at most once for
	// each pull request.
	{
		log::info!("Acquiring cleanup_pr's recursion prevention lock");
		let mut cleaned_up_prs = CLEANUP_PR_RECURSION_PREVENTION.lock();
		for pr in &*cleaned_up_prs {
			if pr.owner == owner
				&& pr.repo == repo
				&& pr.number == number
				&& pr.key_to_guarantee_deleted == key_to_guarantee_deleted
			{
				log::info!(
					"Skipping side-effects of {}/{}/pull/{} (key {}) because they have already been processed",
					owner,
					repo,
					number,
					key_to_guarantee_deleted
				);
				return Ok(());
			}
		}
		cleaned_up_prs.push(CleanedUpPullRequest {
			owner: owner.into(),
			repo: repo.into(),
			key_to_guarantee_deleted: key_to_guarantee_deleted.into(),
			number,
		});
		log::info!("Releasing cleanup_pr's recursion prevention lock");
	}

	log::info!(
		"Related dependents of {}/{}/pull/{} (key {}): {:?}",
		owner,
		repo,
		number,
		key_to_guarantee_deleted,
		related_dependents
	);

	match reason {
		PullRequestCleanupReason::Error
		| PullRequestCleanupReason::Cancelled => {
			for dependent in related_dependents.values() {
				let _ = cleanup_pr(
					state,
					&dependent.sha,
					&dependent.owner,
					&dependent.repo,
					dependent.number,
					reason,
				);
			}
		}
		PullRequestCleanupReason::AfterSHAUpdate(updated_sha) => {
			for mut dependent in related_dependents.into_values() {
				let mut was_updated = false;
				dependent.dependencies =
					if let Some(mut dependencies) = dependent.dependencies {
						for dependency in dependencies.iter_mut() {
							if dependency.owner == owner
								&& dependency.repo == repo && dependency.number
								== number
							{
								was_updated = true;
								log::info!(
									"Dependency of {} on {}/{}/pull/{} was updated to SHA {}",
									dependent.html_url,
									owner,
									repo,
									number,
									updated_sha
								);
								dependency.sha = updated_sha.to_string();
							}
						}
						Some(dependencies)
					} else {
						None
					};

				if was_updated {
					let bytes =
						bincode::serialize(&dependent).context(Bincode)?;
					if let Err(err) =
						db.put(dependent.sha.as_bytes(), bytes).context(Db)
					{
						log::error!(
							"Failed to update a dependent to {:?} while cleaning up {}/{}/pull/{} due to {:?}",
							dependent,
							owner,
							repo,
							number,
							err
					);
					}
				}
			}
		}
		PullRequestCleanupReason::AfterMerge => {}
	}

	log::info!("Cleaning up cleanup_pr recursion prevention lock's entries");
	CLEANUP_PR_RECURSION_PREVENTION.lock().clear();

	Ok(())
}

/// This function might recursively call itself when attempting to solve a recoverable merge error.
#[async_recursion]
pub async fn merge(
	state: &AppState,
	pr: &PullRequest,
	requested_by: &str,
	created_approval_id: Option<i64>,
) -> Result<Result<()>> {
	if cleanup_merged_pr(state, pr).await? {
		return Ok(Ok(()));
	}

	let AppState { github_bot, .. } = state;

	if let Err(err) = async {
		let err = match github_bot
			.merge_pull_request(
				&pr.base.repo.owner.login,
				&pr.base.repo.name,
				pr.number,
				&pr.head.sha,
			)
			.await
		{
			Ok(_) => {
				log::info!("{} merged successfully.", pr.html_url);
				// Merge succeeded! Now clean it from the database
				if let Err(err) = cleanup_pr(
					state,
					&pr.head.sha,
					&pr.base.repo.owner.login,
					&pr.base.repo.name,
					pr.number,
					&PullRequestCleanupReason::AfterMerge
				).await {
					log::error!("Failed to cleanup PR on the database after merge: {}", err);
				};
				return Ok(());
			}
			Err(err) => err,
		};

		let msg = match err {
			Error::Response {
				ref status,
				ref body,
			} if *status == StatusCode::METHOD_NOT_ALLOWED => {
				match body.get("message") {
					Some(msg) => match msg.as_str() {
						Some(msg) => msg,
						None => {
							log::error!("Expected \"message\" of Github API merge failure response to be a string");
							return Err(err);
						},
					},
					None => {
						log::error!("Expected \"message\" of Github API merge failure response to be available");
						return Err(err);
					},
				}
			}
			_ => return Err(err),
		};

		// Matches the following
		// - "Required status check ... is {pending,expected}."
		// - "... required status checks have not succeeded: ... {pending,expected}."
		let missing_status_matcher = RegexBuilder::new(
			r"required\s+status\s+.*(pending|expected)",
		)
		.case_insensitive(true)
		.build()
		.unwrap();

		if missing_status_matcher
			.find(&msg.to_string())
			.is_some()
		{
			// This problem will be solved automatically when all the required statuses are delivered, thus
			// it can be ignored here
			log::info!(
				"Ignoring merge failure due to pending required status; message: {}",
				msg
			);
			return Err(Error::MergeFailureWillBeSolvedLater { msg: msg.to_string() });
		}

		// From this point onwards we'll attempt to recover from "Missing N approvals case"

		// If the bot has already approved once, the missing approval can't be fulfilled by going
		// further, so exit early.
		if created_approval_id.is_some() {
			log::info!("Failed to recover from merge error even after granting the bot approval");
			return Err(Error::Message { msg: msg.to_string() })
		}

		let min_approvals_required = {
			// Matches the following
			// - "At least N approving reviews are required by reviewers with write access."
			let insufficient_approval_quota_matcher =
				RegexBuilder::new(r"([[:digit:]]+).*approving\s+reviews?\s+(is|are)\s+required")
					.case_insensitive(true)
					.build()
					.unwrap();

			match insufficient_approval_quota_matcher.captures(&msg.to_string()) {
				Some(matches) => matches
					.get(1)
					.unwrap()
					.as_str()
					.parse::<usize>()
					.unwrap(),
				None => return Err(Error::Message { msg: msg.to_string() })
			}
		};

		let review = match check_merge_is_allowed(
			state,
			pr,
			requested_by,
			Some(min_approvals_required),
			&[]
		)
		.await {
			Ok(MergeAllowedOutcome::Allowed) => None,
			Ok(MergeAllowedOutcome::GrantApprovalForRole(role)) => {
				if let Err(err) = github_bot
					.create_issue_comment(
						&pr.base.repo.owner.login,
						&pr.base.repo.name,
						pr.number,
						&format!(
							"Bot will approve on the behalf of @{}, since they are {}, in an attempt to reach the minimum approval count",
							requested_by,
							role,
						),
					)
					.await
				{
					log::error!("Failed to post comment on bot approval of {} due to {}", pr.html_url, err);
				}

				match github_bot.approve_merge_request(
					&pr.base.repo.owner.login,
					&pr.base.repo.name,
					pr.number
				).await {
					Ok(review) => Some(review.id),
					Err(err) => {
						log::error!(
							"Failed to create a review for approving the merge request {} due to {:?}",
							pr.html_url,
							err
						);
						return Err(Error::Message { msg: msg.to_string() });
					}
				}
			},
			Ok(MergeAllowedOutcome::Disallowed(msg)) => {
				return Err(Error::Message { msg });
			},
			Err(err) => {
				log::info!("Failed to get requested role for approval of {} due to {}", pr.html_url, err);
				return Err(Error::Message { msg: msg.to_string() });
			}
		};

		merge(
			state,
			pr,
			requested_by,
			review,
		).await??;

		Ok(())
	}
	.await
	{
		if let Some(approval_id) = created_approval_id {
			if let Err(clear_err) = github_bot
				.clear_merge_request_approval(
					&pr.base.repo.owner.login,
					&pr.base.repo.name,
					pr.number,
					approval_id,
				)
				.await
			{
				log::error!(
					"Failed to cleanup a bot review in {} due to {}",
					pr.html_url,
					clear_err
				)
			}
		}
		return Err(err);
	}

	Ok(Ok(()))
}

fn get_troubleshoot_msg(state: &AppState) -> String {
	let AppState { config, .. } = state;
	format!(
		"Merge failed. Check out the [criteria for merge](https://github.com/paritytech/parity-processbot#criteria-for-merge). If you're not meeting the approval count, check if the approvers are team members of {} or {}.",
		&config.team_leads_team,
		&config.core_devs_team,
	)
}

fn display_errors_along_the_way(errors: Vec<String>) -> String {
	format!(
		"The following errors **might** have affected the outcome of this attempt:\n{}",
		errors.iter().map(|e| format!("- {}", e)).join("\n")
	)
}

fn format_error(state: &AppState, err: Error) -> String {
	match err {
		Error::Approval { errors, html_url } => format!(
			"Approval criteria was not satisfied in {}.\n\n{}\n\n{}",
			html_url,
			display_errors_along_the_way(errors),
			get_troubleshoot_msg(state)
		),
		Error::Response {
			ref body,
			ref status,
		} => format!(
			"Response error (status {}): <pre><code>{}</code></pre>",
			status,
			html_escape::encode_safe(&body.to_string())
		),
		_ => format!("{}", err),
	}
}

pub async fn handle_error(
	merge_cancel_outcome: MergeCancelOutcome,
	err: Error,
	state: &AppState,
) {
	log::info!("handle_error: {}", err);
	match err {
		Error::MergeFailureWillBeSolvedLater { .. } => (),
		err => {
			if let Error::WithIssue {
				source,
				issue: (owner, repo, number),
				..
			} = err
			{
				match *source {
					Error::MergeFailureWillBeSolvedLater { .. } => (),
					err => {
						let msg = {
							let description = format_error(state, err);
							let caption = match merge_cancel_outcome {
								MergeCancelOutcome::ShaNotFound  => "",
								MergeCancelOutcome::WasCancelled => "Merge cancelled due to error.",
								MergeCancelOutcome::WasNotCancelled => "Some error happened, but the merge was not cancelled (likely due to a bug).",
							};
							format!("{} Error: {}", caption, description)
						};
						if let Err(comment_post_err) = state
							.github_bot
							.create_issue_comment(&owner, &repo, number, &msg)
							.await
						{
							log::error!(
								"Error posting comment: {}",
								comment_post_err
							);
						}
					}
				}
			}
		}
	}
}