Repository navigation
feat: star and save commits from the API - #550
Merged
xHeaven merged 2 commits intoOct 19, 2026
Merged
Conversation
Adds POST and DELETE /api/v1/commits/{commit}/star for signed requests. They use the web's CreateCommitStar and DeleteCommitStar actions, so starring twice or unstarring a commit that isn't starred is fine, and the author gets the same grouped star notification. Both answer with the commit as GET /api/v1/commits/{commit} shows it, with the new stars_count and starred.
The user may star any commit they may see but their own, like on the web, which answers their own with a 403 and the web's message. A commit they may not see, including one across a block, or a deleted one, is a 404 like on GET /api/v1/commits/{commit}. The web answers 403 there and lets anyone unstar any commit, but the API sends the commit back, so unstarring needs a commit the user may see too. Muting someone doesn't stop starring their commits, as on the web.
Starring and unstarring share the web's limit of 60 a minute, answered with rate_limited like the API's other limits.
Adds PUT and DELETE /api/v1/commits/{commit}/bookmark and GET /api/v1/saved for signed requests. Saving uses the web's CreateBookmark and DeleteBookmark actions with the same rules: the user may save any commit they may see, saving twice keeps one save, and unsaving something that isn't saved is fine. A commit they may not see, or a deleted one, is a 404. Both answer with the commit as GET /api/v1/commits/{commit} shows it, with the new is_saved.
GET /api/v1/saved lists the user's own saves through the web's SavedCommitsQuery, last saved first, 20 at a time with a cursor like the other lists. Saved replies come with the parent the user may see, or its tombstone, and every saved commit with the reply preview the web shows. Commits across a block drop out of the list, as on the web.
Saving and unsaving share the web's limit of 60 a minute, answered with rate_limited.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets the mobile app star and save commits, and list the user's saved commits. It follows #130, which added the signed API. This is one of a few small PRs for the endpoints the app (NativePHP/dev-null-app) uses on top of it.
Endpoints
All of them take signed requests only.
POST /api/v1/commits/{id}/star200with the commit asGET /api/v1/commits/{id}shows it, with the newstars_countandstarredDELETE /api/v1/commits/{id}/starPUT /api/v1/commits/{id}/bookmark200with the commit, with the newis_savedDELETE /api/v1/commits/{id}/bookmarkGET /api/v1/savedStarring uses the web's
CreateCommitStarandDeleteCommitStar, so the author gets the same grouped notification, and starring twice or unstarring something that isn't starred is fine. Starring your own commit is a403with the web's message.Saving uses the web's
CreateBookmarkandDeleteBookmarkwith the same rules. Saving is aPUTbecause saving twice keeps one save.A commit the user may not see, including one across a block, or a deleted one, is a
404for all four writes, the same asGET /api/v1/commits/{id}. Stars and saves keep the web's limits of 60 a minute each, answered withrate_limited.GET /api/v1/savedgoes through the web'sSavedCommitsQuery. Saved replies come with the parent the user may see, or its tombstone, and every saved commit has the reply preview the web shows. Commits across a block drop out of the list, as on the web.Worth checking
The web lets anyone unstar any commit, and answers
403for a commit they can't see. The API answers with the commit, so here unstarring needs a commit the user may see, and one they can't see is a404.The Pastéis PR (#557) adds
pasteis_countto every signed commit. Whichever of the two merges second needs'pasteis_count' => 0added to the saved commit's fields inBookmarkControllerTest.Testing
Everything CI runs passes on this branch locally: Pint, Rector, the JS lint, PHPStan, tsc, type coverage, and all 2,997 tests at 100% coverage.
The app's star button and its Saved tab (NativePHP/dev-null-app#5) have been running against these endpoints on a phone.