fix: record ERROR status when upstream forward fails

The post-receive persistence hook checked ReceiveCommand results to
determine FORWARDED vs ERROR, but JGit only delivers Result.OK commands
to post-receive hooks. When the upstream push failed, the command result
stayed OK and the record was incorrectly saved as FORWARDED.

Now checks pushContext for a failed "forward" step instead, which is
where ForwardingPostReceiveHook records the upstream outcome.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: coopernetes

git-proxy-java-core/src/main/java/org/finos/gitproxy/git/PushStorePersistenceHook.java

@@ -251,22 +251,25 @@ public PostReceiveHook postReceiveHook() {
                         return;
                     }
 
-                    boolean allOk = commands.stream().allMatch(cmd -> cmd.getResult() == ReceiveCommand.Result.OK);
-                    boolean anyTransportFailed = commands.stream()
-                            .anyMatch(cmd -> cmd.getResult() != ReceiveCommand.Result.OK
-                                    && cmd.getResult() != ReceiveCommand.Result.NOT_ATTEMPTED);
+                    // Check if the forwarding step failed (upstream rejected the push).
+                    // Command results stay OK in post-receive even when the upstream push fails,
+                    // because JGit already accepted the objects locally. The forwarding outcome
+                    // is recorded in pushContext by ForwardingPostReceiveHook.
+                    boolean forwardFailed = pushContext != null
+                            && pushContext.getSteps().stream()
+                                    .anyMatch(step -> "forward".equals(step.getStepName())
+                                            && step.getStatus() == StepStatus.FAIL);
 
                     PushRecord record = copyBase(initial);
-                    if (allOk) {
-                        record.setStatus(PushStatus.FORWARDED);
-                    } else if (anyTransportFailed) {
+                    if (forwardFailed) {
                         record.setStatus(PushStatus.ERROR);
-                        commands.stream()
-                                .filter(cmd -> cmd.getResult() != ReceiveCommand.Result.OK
-                                        && cmd.getResult() != ReceiveCommand.Result.NOT_ATTEMPTED)
+                        pushContext.getSteps().stream()
+                                .filter(step ->
+                                        "forward".equals(step.getStepName()) && step.getStatus() == StepStatus.FAIL)
                                 .findFirst()
-                                .ifPresent(cmd -> record.setErrorMessage(
-                                        cmd.getRefName() + ": " + cmd.getResult() + " - " + cmd.getMessage()));
+                                .ifPresent(step -> record.setErrorMessage(step.getErrorMessage()));
+                    } else {
+                        record.setStatus(PushStatus.FORWARDED);
                     }
 
                     pushStore.save(record);

git-proxy-java-core/src/test/java/org/finos/gitproxy/git/PushStorePersistenceHookTest.java

@@ -18,6 +18,8 @@
 import org.finos.gitproxy.db.PushStore;
 import org.finos.gitproxy.db.memory.InMemoryPushStore;
 import org.finos.gitproxy.db.model.PushStatus;
+import org.finos.gitproxy.db.model.PushStep;
+import org.finos.gitproxy.db.model.StepStatus;
 import org.finos.gitproxy.provider.GitHubProvider;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -240,6 +242,61 @@ void serviceUrl_setBeforeHook_includedInBlockedRecord() {
         assertFalse(records.isEmpty(), "should have a PENDING record");
     }
 
+    // ---- post-receive hook: forwarding outcome ----
+
+    @Test
+    void postReceiveHook_forwardFailed_savesErrorStatus() {
+        var pushContext = new PushContext();
+        hook.setPushContext(pushContext);
+
+        ReceivePack rp = makeReceivePack();
+        ReceiveCommand cmd = newBranchCommand(commitId);
+
+        // Pre-receive creates the initial RECEIVED record
+        hook.preReceiveHook().onPreReceive(rp, List.of(cmd));
+
+        // Simulate a failed forward step (upstream rejected the push)
+        pushContext.addStep(PushStep.builder()
+                .stepName("forward")
+                .status(StepStatus.FAIL)
+                .errorMessage("REJECTED_OTHER_REASON (pre-receive hook declined)")
+                .build());
+
+        // Mark command as OK (JGit accepted locally) — post-receive only sees OK commands
+        cmd.setResult(ReceiveCommand.Result.OK);
+
+        hook.postReceiveHook().onPostReceive(rp, List.of(cmd));
+
+        var records = pushStore.find(org.finos.gitproxy.db.model.PushQuery.builder()
+                .status(PushStatus.ERROR)
+                .build());
+        assertFalse(records.isEmpty(), "a failed forward should produce an ERROR record");
+        assertNotNull(records.get(0).getErrorMessage(), "ERROR record should have an error message");
+    }
+
+    @Test
+    void postReceiveHook_forwardSucceeded_savesForwardedStatus() {
+        var pushContext = new PushContext();
+        hook.setPushContext(pushContext);
+
+        ReceivePack rp = makeReceivePack();
+        ReceiveCommand cmd = newBranchCommand(commitId);
+
+        hook.preReceiveHook().onPreReceive(rp, List.of(cmd));
+
+        pushContext.addStep(
+                PushStep.builder().stepName("forward").status(StepStatus.PASS).build());
+
+        cmd.setResult(ReceiveCommand.Result.OK);
+
+        hook.postReceiveHook().onPostReceive(rp, List.of(cmd));
+
+        var records = pushStore.find(org.finos.gitproxy.db.model.PushQuery.builder()
+                .status(PushStatus.FORWARDED)
+                .build());
+        assertFalse(records.isEmpty(), "a successful forward should produce a FORWARDED record");
+    }
+
     // ---- email validation config ----
 
     private CommitConfig blockNoreplyConfig() {