2 files changed, 317 insertions, 3 deletions

diff --git a/src/git/handlers.rs b/src/git/handlers.rs
index 27bec76..73f72f3 100644
--- a/src/git/handlers.rs
+++ b/src/git/handlers.rs
@@ -13,6 +13,9 @@ use super::authorization::{
 };
 use super::protocol::{GitService, PktLine};
 use super::subprocess::GitSubprocess;
+use super::{try_set_head_if_available};
+
+use crate::nostr::events::RepositoryState;
 
 /// Handle GET /info/refs?service=git-{upload,receive}-pack
 ///
@@ -163,6 +166,9 @@ pub struct PushAuthParams {
 /// This includes GRASP authorization validation according to GRASP-01:
 /// "MUST accept pushes via this service that match the latest repo state announcement
 /// on the relay, respecting the recursive maintainer set."
+///
+/// Also per GRASP-01: "MUST set repository HEAD per repository state announcement
+/// as soon as the git data related to that branch has been received."
 pub async fn handle_receive_pack(
     repo_path: PathBuf,
     request_body: Bytes,
@@ -174,14 +180,17 @@ pub async fn handle_receive_pack(
         return Err(GitError::RepositoryNotFound);
     }
 
+    // Keep track of state for HEAD setting after push
+    let mut authorized_state: Option<RepositoryState> = None;
+
     // GRASP Authorization Check
-    if let Some(params) = auth_params {
+    if let Some(ref params) = auth_params {
         info!(
             "Authorizing push for {}/{} via {}",
             params.owner_npub, params.identifier, params.relay_url
         );
 
-        match authorize_push(&params, &request_body).await {
+        match authorize_push(params, &request_body).await {
             Ok(auth_result) => {
                 if !auth_result.authorized {
                     warn!(
@@ -196,6 +205,8 @@ pub async fn handle_receive_pack(
                     params.identifier,
                     auth_result.maintainers.len()
                 );
+                // Save the state for HEAD setting after push
+                authorized_state = auth_result.state;
             }
             Err(e) => {
                 warn!(
@@ -246,6 +257,38 @@ pub async fn handle_receive_pack(
         return Err(GitError::GitFailed(status.code()));
     }
 
+    // GRASP-01: Set HEAD after git data is received
+    // "MUST set repository HEAD per repository state announcement
+    // as soon as the git data related to that branch has been received."
+    if let Some(state) = authorized_state {
+        if let Some(head_ref) = &state.head {
+            if let Some(branch_name) = state.get_head_branch() {
+                if let Some(commit) = state.get_branch_commit(branch_name) {
+                    match try_set_head_if_available(&repo_path, head_ref, commit) {
+                        Ok(true) => {
+                            info!(
+                                "Set HEAD to {} after push to {:?}",
+                                head_ref, repo_path
+                            );
+                        }
+                        Ok(false) => {
+                            debug!(
+                                "HEAD commit {} not found after push, HEAD not updated",
+                                commit
+                            );
+                        }
+                        Err(e) => {
+                            warn!(
+                                "Failed to set HEAD after push: {}",
+                                e
+                            );
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     Ok(Response::builder()
         .status(StatusCode::OK)
         .header("content-type", GitService::ReceivePack.result_content_type())
diff --git a/src/git/mod.rs b/src/git/mod.rs
index 81ff277..076e211 100644
--- a/src/git/mod.rs
+++ b/src/git/mod.rs
@@ -22,7 +22,9 @@ pub mod handlers;
 pub mod protocol;
 pub mod subprocess;
 
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use tracing::{debug, info};
 
 /// Parse a Git repository path from URL components
 ///
@@ -44,6 +46,130 @@ pub fn resolve_repo_path(git_data_path: &str, npub: &str, identifier: &str) -> P
         .join(format!("{}.git", identifier))
 }
 
+/// Check if a commit exists in the repository
+///
+/// # Arguments
+/// * `repo_path` - Path to the bare git repository
+/// * `commit_hash` - The commit hash to check
+///
+/// # Returns
+/// True if the commit exists in the repository, false otherwise
+pub fn commit_exists(repo_path: &Path, commit_hash: &str) -> bool {
+    let output = Command::new("git")
+        .args(["cat-file", "-t", commit_hash])
+        .current_dir(repo_path)
+        .output();
+
+    match output {
+        Ok(result) => {
+            if result.status.success() {
+                let obj_type = String::from_utf8_lossy(&result.stdout);
+                // Object exists and is a commit
+                obj_type.trim() == "commit"
+            } else {
+                false
+            }
+        }
+        Err(_) => false,
+    }
+}
+
+/// Set the repository HEAD to point to a branch
+///
+/// This updates the HEAD symbolic ref to point to the specified branch.
+/// Per GRASP-01: "MUST set repository HEAD per repository state announcement
+/// as soon as the git data related to that branch has been received."
+///
+/// # Arguments
+/// * `repo_path` - Path to the bare git repository
+/// * `head_ref` - The ref to set HEAD to (e.g., "refs/heads/main")
+///
+/// # Returns
+/// Ok(()) if successful, Err with error message otherwise
+pub fn set_repository_head(repo_path: &Path, head_ref: &str) -> Result<(), String> {
+    // Validate the ref format
+    if !head_ref.starts_with("refs/heads/") {
+        return Err(format!("Invalid HEAD ref: {} (must start with refs/heads/)", head_ref));
+    }
+
+    debug!("Setting HEAD to {} in {}", head_ref, repo_path.display());
+
+    let output = Command::new("git")
+        .args(["symbolic-ref", "HEAD", head_ref])
+        .current_dir(repo_path)
+        .output()
+        .map_err(|e| format!("Failed to execute git symbolic-ref: {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(format!("git symbolic-ref failed: {}", stderr));
+    }
+
+    info!("Updated HEAD to {} in {}", head_ref, repo_path.display());
+    Ok(())
+}
+
+/// Try to set repository HEAD from a repository state event
+///
+/// This function checks if the HEAD branch's commit is available in the repository
+/// and sets HEAD if it is. This should be called:
+/// 1. When a repository state event is received (in case git data already exists)
+/// 2. After git data is received (in case a state event was already received)
+///
+/// # Arguments
+/// * `repo_path` - Path to the bare git repository
+/// * `head_ref` - The ref to set HEAD to (e.g., "refs/heads/main")
+/// * `head_commit` - The commit hash that the HEAD branch should point to
+///
+/// # Returns
+/// Ok(true) if HEAD was set, Ok(false) if commit not yet available, Err on failure
+pub fn try_set_head_if_available(
+    repo_path: &Path,
+    head_ref: &str,
+    head_commit: &str,
+) -> Result<bool, String> {
+    // Check if repository exists
+    if !repo_path.exists() {
+        debug!("Repository not found at {}, cannot set HEAD", repo_path.display());
+        return Ok(false);
+    }
+
+    // Check if the commit exists in the repository
+    if !commit_exists(repo_path, head_commit) {
+        debug!(
+            "Commit {} not found in {}, HEAD not set yet",
+            head_commit,
+            repo_path.display()
+        );
+        return Ok(false);
+    }
+
+    // Commit exists, set HEAD
+    set_repository_head(repo_path, head_ref)?;
+    Ok(true)
+}
+
+/// Get the current HEAD ref from a repository
+///
+/// # Arguments
+/// * `repo_path` - Path to the bare git repository
+///
+/// # Returns
+/// The current HEAD ref (e.g., "refs/heads/main") or None if not set
+pub fn get_repository_head(repo_path: &Path) -> Option<String> {
+    let output = Command::new("git")
+        .args(["symbolic-ref", "HEAD"])
+        .current_dir(repo_path)
+        .output()
+        .ok()?;
+
+    if output.status.success() {
+        Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
+    } else {
+        None
+    }
+}
+
 /// Extract npub and identifier from a Git URL path
 ///
 /// Parses paths like `/<npub>/<identifier>.git/info/refs`
@@ -77,6 +203,83 @@ pub fn parse_git_url(path: &str) -> Option<(&str, &str, &str)> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    /// Create a test bare repository with optional commits
+    fn create_test_repo() -> (TempDir, PathBuf) {
+        let temp_dir = TempDir::new().unwrap();
+        let repo_path = temp_dir.path().join("test.git");
+        
+        // Initialize bare repository
+        Command::new("git")
+            .args(["init", "--bare", repo_path.to_str().unwrap()])
+            .output()
+            .unwrap();
+        
+        (temp_dir, repo_path)
+    }
+
+    /// Create a test repository with a commit on a branch
+    fn create_test_repo_with_commit() -> (TempDir, PathBuf, String) {
+        let temp_dir = TempDir::new().unwrap();
+        let work_dir = temp_dir.path().join("work");
+        let bare_repo = temp_dir.path().join("test.git");
+        
+        // Initialize bare repository
+        Command::new("git")
+            .args(["init", "--bare", bare_repo.to_str().unwrap()])
+            .output()
+            .unwrap();
+        
+        // Clone to working directory
+        Command::new("git")
+            .args(["clone", bare_repo.to_str().unwrap(), work_dir.to_str().unwrap()])
+            .output()
+            .unwrap();
+        
+        // Configure git for commits
+        Command::new("git")
+            .args(["config", "user.email", "test@test.com"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        Command::new("git")
+            .args(["config", "user.name", "Test"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        
+        // Create a file and commit
+        fs::write(work_dir.join("README.md"), "# Test").unwrap();
+        Command::new("git")
+            .args(["add", "README.md"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        Command::new("git")
+            .args(["commit", "-m", "Initial commit"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        
+        // Get commit hash
+        let output = Command::new("git")
+            .args(["rev-parse", "HEAD"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        let commit_hash = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        
+        // Push to bare repo
+        Command::new("git")
+            .args(["push", "origin", "master"])
+            .current_dir(&work_dir)
+            .output()
+            .unwrap();
+        
+        (temp_dir, bare_repo, commit_hash)
+    }
 
     #[test]
     fn test_resolve_repo_path() {
@@ -125,4 +328,72 @@ mod tests {
         assert!(parse_git_url("/npub1abc").is_none());
         assert!(parse_git_url("/npub1abc/repo").is_none());
     }
+
+    #[test]
+    fn test_commit_exists_nonexistent() {
+        let (_temp_dir, repo_path) = create_test_repo();
+        assert!(!commit_exists(&repo_path, "deadbeef1234567890abcdef1234567890abcdef"));
+    }
+
+    #[test]
+    fn test_commit_exists_with_commit() {
+        let (_temp_dir, repo_path, commit_hash) = create_test_repo_with_commit();
+        assert!(commit_exists(&repo_path, &commit_hash));
+    }
+
+    #[test]
+    fn test_set_repository_head() {
+        let (_temp_dir, repo_path, _commit_hash) = create_test_repo_with_commit();
+        
+        // Default HEAD might be refs/heads/master
+        let result = set_repository_head(&repo_path, "refs/heads/main");
+        assert!(result.is_ok());
+        
+        let head = get_repository_head(&repo_path);
+        assert_eq!(head, Some("refs/heads/main".to_string()));
+    }
+
+    #[test]
+    fn test_set_repository_head_invalid_ref() {
+        let (_temp_dir, repo_path) = create_test_repo();
+        
+        // Invalid ref format should fail
+        let result = set_repository_head(&repo_path, "main");
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("must start with refs/heads/"));
+    }
+
+    #[test]
+    fn test_try_set_head_if_available_commit_missing() {
+        let (_temp_dir, repo_path) = create_test_repo();
+        
+        let result = try_set_head_if_available(
+            &repo_path,
+            "refs/heads/main",
+            "deadbeef1234567890abcdef1234567890abcdef",
+        );
+        
+        // Should return Ok(false) - commit not found
+        assert!(result.is_ok());
+        assert!(!result.unwrap());
+    }
+
+    #[test]
+    fn test_try_set_head_if_available_success() {
+        let (_temp_dir, repo_path, commit_hash) = create_test_repo_with_commit();
+        
+        let result = try_set_head_if_available(
+            &repo_path,
+            "refs/heads/main",
+            &commit_hash,
+        );
+        
+        // Should return Ok(true) - HEAD was set
+        assert!(result.is_ok());
+        assert!(result.unwrap());
+        
+        // Verify HEAD was set
+        let head = get_repository_head(&repo_path);
+        assert_eq!(head, Some("refs/heads/main".to_string()));
+    }
 }
\ No newline at end of file