From 4aff44c42e863adc6165b93269a6aa6bd3c549de Mon Sep 17 00:00:00 2001
From: Louis Garman <75728+leg100@users.noreply.github.com>
Date: Wed, 26 Apr 2023 19:40:17 +0100
Subject: [PATCH] feat: queue destroy plan in UI (#410)

---
 auth/team_web_test.go                         |   6 +-
 http/html/static/css/main.css                 |   3 +
 .../templates/content/workspace_edit.tmpl     |   7 ++
 http/html/test_helpers.go                     |  15 ---
 integration/connect_repo_e2e_test.go          |   7 +-
 integration/github_pr_test.go                 |   7 +-
 integration/module_e2e_test.go                |   5 +-
 integration/start_run_ui_test.go              |  68 ++++++++---
 integration/test_helpers.go                   |   8 --
 integration/ui_actions.go                     |   4 +-
 integration/webhook_test.go                   |   3 +-
 organization/web_test.go                      |   3 +-
 run/starter.go                                |  52 ++++++--
 run/starter_test.go                           |   4 +-
 run/test_helpers.go                           |  75 ++++++++++++
 run/web.go                                    |  20 +---
 run/web_test.go                               | 112 ++----------------
 testutils/html.go                             |  15 ++-
 workspace/web.go                              |   2 +
 19 files changed, 226 insertions(+), 190 deletions(-)
 delete mode 100644 http/html/test_helpers.go

diff --git a/auth/team_web_test.go b/auth/team_web_test.go
index e8d57010d..2581c5157 100644
--- a/auth/team_web_test.go
+++ b/auth/team_web_test.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/leg100/otf"
-	"github.com/leg100/otf/http/html"
 	"github.com/leg100/otf/http/html/paths"
+	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -64,7 +64,7 @@ func TestTeam_WebHandlers(t *testing.T) {
 		r := httptest.NewRequest("GET", q, nil)
 		w := httptest.NewRecorder()
 		app.updateTeam(w, r)
-		html.AssertRedirect(t, w, paths.Team(team.ID))
+		testutils.AssertRedirect(t, w, paths.Team(team.ID))
 	})
 
 	t.Run("list", func(t *testing.T) {
@@ -89,7 +89,7 @@ func TestTeam_WebHandlers(t *testing.T) {
 		r := httptest.NewRequest("POST", q, nil)
 		w := httptest.NewRecorder()
 		app.deleteTeam(w, r)
-		html.AssertRedirect(t, w, paths.Teams("acme-org"))
+		testutils.AssertRedirect(t, w, paths.Teams("acme-org"))
 	})
 }
 
diff --git a/http/html/static/css/main.css b/http/html/static/css/main.css
index 299b5362b..1e43e26c5 100644
--- a/http/html/static/css/main.css
+++ b/http/html/static/css/main.css
@@ -331,6 +331,9 @@ a.show-underline {
   display: flex;
   flex-direction: column;
   gap: 1em;
+  /* Add some white space between bottom of content and footer otherwise it
+   * looks wierd */
+  margin-bottom: 5em;
 }
 
 /* center content e.g. the login prompt */
diff --git a/http/html/static/templates/content/workspace_edit.tmpl b/http/html/static/templates/content/workspace_edit.tmpl
index ddd3ee9da..715f9c10f 100644
--- a/http/html/static/templates/content/workspace_edit.tmpl
+++ b/http/html/static/templates/content/workspace_edit.tmpl
@@ -17,6 +17,7 @@
   {{ $canDelete := $.CurrentUser.CanAccessWorkspace .DeleteWorkspaceAction .Policy }}
   {{ $canSetPermission := $.CurrentUser.CanAccessWorkspace .SetWorkspacePermissionAction .Policy }}
   {{ $canUnsetPermission := $.CurrentUser.CanAccessWorkspace .UnsetWorkspacePermissionAction .Policy }}
+  {{ $canCreateRun := $.CurrentUser.CanAccessWorkspace .CreateRunAction .Policy }}
   <div>
     {{ with .Workspace.Connection }}
       <form action="{{ disconnectWorkspacePath $.Workspace.ID }}" method="POST">
@@ -139,6 +140,12 @@
     </div>
     <div class="permissions-container">
       <h3>Advanced</h3>
+      <form action="{{ startRunWorkspacePath .Workspace.ID }}" method="POST">
+        <button id="queue-destroy-plan-button" class="delete" {{ insufficient $canCreateRun }} onclick="return confirm('This will destroy all infrastructure in this workspace. Please confirm.')">
+          Queue destroy plan
+        </button>
+        <input name="strategy" value="destroy-all" type="hidden">
+      </form>
       <form action="{{ deleteWorkspacePath .Workspace.ID }}" method="POST">
         <button id="delete-workspace-button" class="delete" {{ insufficient $canDelete }} onclick="return confirm('Are you sure you want to delete?')">
           Delete workspace
diff --git a/http/html/test_helpers.go b/http/html/test_helpers.go
deleted file mode 100644
index c7d62c8a7..000000000
--- a/http/html/test_helpers.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package html
-
-import (
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func AssertRedirect(t *testing.T, w *httptest.ResponseRecorder, path string) {
-	if assert.Equal(t, 302, w.Code, w.Body.String()) {
-		redirect, _ := w.Result().Location()
-		assert.Equal(t, path, redirect.Path)
-	}
-}
diff --git a/integration/connect_repo_e2e_test.go b/integration/connect_repo_e2e_test.go
index a47c816f1..40432a09a 100644
--- a/integration/connect_repo_e2e_test.go
+++ b/integration/connect_repo_e2e_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/chromedp/chromedp"
 	"github.com/leg100/otf/cloud"
 	"github.com/leg100/otf/github"
+	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -20,7 +21,7 @@ func TestConnectRepoE2E(t *testing.T) {
 	repo := cloud.NewTestRepo()
 	daemon := setup(t, nil,
 		github.WithRepo(repo),
-		github.WithArchive(readFile(t, "../testdata/github.tar.gz")),
+		github.WithArchive(testutils.ReadFile(t, "../testdata/github.tar.gz")),
 	)
 	user, ctx := daemon.createUserCtx(t, ctx)
 	org := daemon.createOrganization(t, ctx)
@@ -33,7 +34,7 @@ func TestConnectRepoE2E(t *testing.T) {
 		connectWorkspaceTasks(t, daemon.Hostname(), org.Name, "my-test-workspace"),
 		// we can now start a run via the web ui, which'll retrieve the tarball from
 		// the fake github server
-		startRunTasks(t, daemon.Hostname(), org.Name, "my-test-workspace"),
+		startRunTasks(t, daemon.Hostname(), org.Name, "my-test-workspace", "plan-and-apply"),
 	})
 	require.NoError(t, err)
 
@@ -42,7 +43,7 @@ func TestConnectRepoE2E(t *testing.T) {
 	// should trigger a run on the workspace.
 
 	// generate and send push event
-	push := readFile(t, "fixtures/github_push.json")
+	push := testutils.ReadFile(t, "fixtures/github_push.json")
 	daemon.SendEvent(t, github.PushEvent, push)
 
 	// commit-triggered run should appear as latest run on workspace
diff --git a/integration/github_pr_test.go b/integration/github_pr_test.go
index 868b31601..35a8892f7 100644
--- a/integration/github_pr_test.go
+++ b/integration/github_pr_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/leg100/otf"
 	"github.com/leg100/otf/cloud"
 	"github.com/leg100/otf/github"
+	"github.com/leg100/otf/testutils"
 	"github.com/leg100/otf/workspace"
 	"github.com/stretchr/testify/require"
 )
@@ -20,7 +21,7 @@ func TestIntegration_GithubPR(t *testing.T) {
 	repo := cloud.NewTestRepo()
 	daemon := setup(t, nil,
 		github.WithRepo(repo),
-		github.WithArchive(readFile(t, "../testdata/github.tar.gz")),
+		github.WithArchive(testutils.ReadFile(t, "../testdata/github.tar.gz")),
 	)
 
 	// create workspace connected to github repo
@@ -36,7 +37,7 @@ func TestIntegration_GithubPR(t *testing.T) {
 	require.NoError(t, err)
 
 	// a pull request is opened on github which triggers an event
-	push := readFile(t, "./fixtures/github_pull_opened.json")
+	push := testutils.ReadFile(t, "./fixtures/github_pull_opened.json")
 	daemon.SendEvent(t, github.PullRequest, push)
 
 	// github should receive three pending status updates followed by a final
@@ -49,7 +50,7 @@ func TestIntegration_GithubPR(t *testing.T) {
 	require.Equal(t, "planned: +2/~0/−0", got.GetDescription())
 
 	// the pull request is updated with another commit
-	update := readFile(t, "./fixtures/github_pull_update.json")
+	update := testutils.ReadFile(t, "./fixtures/github_pull_update.json")
 	daemon.SendEvent(t, github.PullRequest, update)
 
 	// github should receive three pending status updates followed by a final
diff --git a/integration/module_e2e_test.go b/integration/module_e2e_test.go
index 69721bf19..791293966 100644
--- a/integration/module_e2e_test.go
+++ b/integration/module_e2e_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/chromedp/chromedp"
 	"github.com/leg100/otf/cloud"
 	"github.com/leg100/otf/github"
+	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -23,7 +24,7 @@ func TestModuleE2E(t *testing.T) {
 	svc := setup(t, nil,
 		github.WithRepo(repo),
 		github.WithRefs("tags/v0.0.1", "tags/v0.0.2", "tags/v0.1.0"),
-		github.WithArchive(readFile(t, "./fixtures/github.module.tar.gz")),
+		github.WithArchive(testutils.ReadFile(t, "./fixtures/github.module.tar.gz")),
 	)
 	user, ctx := svc.createUserCtx(t, ctx)
 	org := svc.createOrganization(t, ctx)
@@ -66,7 +67,7 @@ func TestModuleE2E(t *testing.T) {
 	// should trigger a module version to be published.
 
 	// generate and send push tag event for v1.0.0
-	pushTpl := readFile(t, "fixtures/github_push_tag.json")
+	pushTpl := testutils.ReadFile(t, "fixtures/github_push_tag.json")
 	push := fmt.Sprintf(string(pushTpl), "v1.0.0", repo)
 	svc.SendEvent(t, github.PushEvent, []byte(push))
 
diff --git a/integration/start_run_ui_test.go b/integration/start_run_ui_test.go
index d019b4f61..d55e6d2f2 100644
--- a/integration/start_run_ui_test.go
+++ b/integration/start_run_ui_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/chromedp/chromedp"
+	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -13,29 +14,60 @@ func TestStartRunUI(t *testing.T) {
 	t.Parallel()
 
 	svc := setup(t, nil)
+
 	user, ctx := svc.createUserCtx(t, ctx)
-	org := svc.createOrganization(t, ctx)
-	root := newRootModule(t, svc.Hostname(), org.Name, "my-test-workspace")
+	ws := svc.createWorkspace(t, ctx, nil)
+	cv := svc.createConfigurationVersion(t, ctx, ws)
+	tarball := testutils.ReadFile(t, "./testdata/root.tar.gz")
+	svc.UploadConfig(ctx, cv.ID, tarball)
 
-	// in browser, create workspace
+	// now we have a config version, start a run with the plan-and-apply
+	// strategy
 	browser := createBrowserCtx(t)
-	err := chromedp.Run(browser,
+	err := chromedp.Run(browser, chromedp.Tasks{
 		newSession(t, ctx, svc.Hostname(), user.Username, svc.Secret),
-		createWorkspace(t, svc.Hostname(), org.Name, "my-test-workspace"),
-	)
+		startRunTasks(t, svc.Hostname(), ws.Organization, ws.Name, "plan-and-apply"),
+	})
 	require.NoError(t, err)
 
-	//
-	// start run UI functionality requires an existing config version, so
-	// create one first by running a plan via the CLI
-	//
-
-	// terraform init
-	svc.tfcli(t, ctx, "init", root)
-	out := svc.tfcli(t, ctx, "plan", root)
-	require.Contains(t, out, "Plan: 1 to add, 0 to change, 0 to destroy.")
-
-	// now we have a config version, start a run via the browser
-	err = chromedp.Run(browser, startRunTasks(t, svc.Hostname(), org.Name, "my-test-workspace"))
+	// now destroy resources with the destroy-all strategy
+	okDialog(t, browser)
+	err = chromedp.Run(browser, chromedp.Tasks{
+		// go to workspace page
+		chromedp.Navigate(workspaceURL(svc.Hostname(), ws.Organization, ws.Name)),
+		screenshot(t),
+		// navigate to workspace settings
+		chromedp.Click(`//a[text()='settings']`, chromedp.NodeVisible),
+		screenshot(t),
+		// click 'queue destroy plan' button
+		chromedp.Click(`//button[@id='queue-destroy-plan-button']`, chromedp.BySearch),
+		screenshot(t),
+		// confirm plan begins and ends
+		chromedp.WaitReady(`body`),
+		chromedp.WaitReady(`//*[@id='tailed-plan-logs']//text()[contains(.,'Initializing the backend')]`, chromedp.BySearch),
+		screenshot(t),
+		chromedp.WaitReady(`#plan-status.phase-status-finished`),
+		screenshot(t),
+		// wait for run to enter planned state
+		chromedp.WaitReady(`//*[@id='run-status']//*[normalize-space(text())='planned']`, chromedp.BySearch),
+		screenshot(t),
+		// run widget should show plan summary
+		matchRegex(t, `//div[@class='item']//div[@class='resource-summary']`, `\+[0-9]+ \~[0-9]+ \-[0-9]+`),
+		screenshot(t),
+		// run widget should show discard button
+		chromedp.WaitReady(`//button[@id='run-discard-button']`, chromedp.BySearch),
+		screenshot(t),
+		// click 'confirm & apply' button once it becomes visible
+		chromedp.Click(`//button[text()='apply']`, chromedp.NodeVisible, chromedp.BySearch),
+		screenshot(t),
+		// confirm apply begins and ends
+		chromedp.WaitReady(`//*[@id='tailed-apply-logs']//text()[contains(.,'Initializing the backend')]`, chromedp.BySearch),
+		chromedp.WaitReady(`#apply-status.phase-status-finished`),
+		// confirm run ends in applied state
+		chromedp.WaitReady(`//*[@id='run-status']//*[normalize-space(text())='applied']`, chromedp.BySearch),
+		// run widget should show apply summary
+		matchRegex(t, `//div[@class='item']//div[@class='resource-summary']`, `\+[0-9]+ \~[0-9]+ \-[0-9]+`),
+		screenshot(t),
+	})
 	require.NoError(t, err)
 }
diff --git a/integration/test_helpers.go b/integration/test_helpers.go
index ace28cbce..cf4233e5c 100644
--- a/integration/test_helpers.go
+++ b/integration/test_helpers.go
@@ -86,11 +86,3 @@ resource "null_resource" "e2e" {}
 
 	return root
 }
-
-func readFile(t *testing.T, path string) []byte {
-	t.Helper()
-
-	contents, err := os.ReadFile(path)
-	require.NoError(t, err)
-	return contents
-}
diff --git a/integration/ui_actions.go b/integration/ui_actions.go
index 1e24d1f7e..a83047b39 100644
--- a/integration/ui_actions.go
+++ b/integration/ui_actions.go
@@ -161,13 +161,13 @@ func createGithubVCSProviderTasks(t *testing.T, hostname, org, name string) chro
 }
 
 // startRunTasks starts a run via the UI
-func startRunTasks(t *testing.T, hostname, organization string, workspaceName string) chromedp.Tasks {
+func startRunTasks(t *testing.T, hostname, organization, workspaceName, strategy string) chromedp.Tasks {
 	return []chromedp.Action{
 		// go to workspace page
 		chromedp.Navigate(workspaceURL(hostname, organization, workspaceName)),
 		screenshot(t),
 		// select strategy for run
-		chromedp.SetValue(`//select[@id="start-run-strategy"]`, "plan-and-apply", chromedp.BySearch),
+		chromedp.SetValue(`//select[@id="start-run-strategy"]`, strategy, chromedp.BySearch),
 		screenshot(t),
 		// confirm plan begins and ends
 		chromedp.WaitReady(`body`),
diff --git a/integration/webhook_test.go b/integration/webhook_test.go
index e67ca967a..53823b257 100644
--- a/integration/webhook_test.go
+++ b/integration/webhook_test.go
@@ -6,6 +6,7 @@ import (
 	"github.com/chromedp/chromedp"
 	"github.com/leg100/otf/cloud"
 	"github.com/leg100/otf/github"
+	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/require"
 )
 
@@ -28,7 +29,7 @@ func TestWebhook(t *testing.T) {
 	svc := setup(t, nil,
 		github.WithRepo(repo),
 		github.WithRefs("tags/v0.0.1", "tags/v0.0.2", "tags/v0.1.0"),
-		github.WithArchive(readFile(t, "../testdata/github.tar.gz")),
+		github.WithArchive(testutils.ReadFile(t, "../testdata/github.tar.gz")),
 	)
 	user, ctx := svc.createUserCtx(t, ctx)
 	org := svc.createOrganization(t, ctx)
diff --git a/organization/web_test.go b/organization/web_test.go
index 4e853b441..2a85aeb94 100644
--- a/organization/web_test.go
+++ b/organization/web_test.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/antchfx/htmlquery"
 	"github.com/leg100/otf"
-	"github.com/leg100/otf/http/html"
 	"github.com/leg100/otf/http/html/paths"
 	"github.com/leg100/otf/testutils"
 	"github.com/stretchr/testify/assert"
@@ -106,5 +105,5 @@ func TestWeb_DeleteHandler(t *testing.T) {
 	r := httptest.NewRequest("POST", "/?name=acme-corp", nil)
 	w := httptest.NewRecorder()
 	svc.delete(w, r)
-	html.AssertRedirect(t, w, paths.Organizations())
+	testutils.AssertRedirect(t, w, paths.Organizations())
 }
diff --git a/run/starter.go b/run/starter.go
index 80b50ae19..2362b0146 100644
--- a/run/starter.go
+++ b/run/starter.go
@@ -10,22 +10,51 @@ import (
 	"github.com/leg100/otf/configversion"
 )
 
-// starter starts a run triggered via the UI (whereas the terraform CLI takes
-// care of calling all the API endpoints to start a run itself).
-type starter struct {
-	ConfigurationVersionService
-	WorkspaceService
-	VCSProviderService
-	RunService
-}
+const (
+	planOnly     runStrategy = "plan-only"
+	planAndApply runStrategy = "plan-and-apply"
+	destroyAll   runStrategy = "destroy-all"
+)
+
+type (
+	// starter starts a run triggered via the UI (whereas the terraform CLI takes
+	// care of calling all the API endpoints to start a run itself).
+	starter struct {
+		ConfigurationVersionService
+		WorkspaceService
+		VCSProviderService
+		RunService
+	}
+
+	runStrategy string
+)
+
+func (rs *starter) startRun(ctx context.Context, workspaceID string, strategy runStrategy) (*Run, error) {
+	var (
+		speculative bool
+		destroy     bool
+	)
+
+	switch strategy {
+	case planOnly:
+		speculative = true
+	case planAndApply:
+		speculative = false
+	case destroyAll:
+		destroy = true
+	default:
+		return nil, fmt.Errorf("invalid strategy: %s", strategy)
+	}
 
-func (rs *starter) startRun(ctx context.Context, workspaceID string, opts configversion.ConfigurationVersionCreateOptions) (*Run, error) {
 	ws, err := rs.GetWorkspace(ctx, workspaceID)
 	if err != nil {
 		return nil, err
 	}
 
 	var cv *configversion.ConfigurationVersion
+	configOptions := configversion.ConfigurationVersionCreateOptions{
+		Speculative: &speculative,
+	}
 	if ws.Connection != nil {
 		client, err := rs.GetVCSClient(ctx, ws.Connection.VCSProviderID)
 		if err != nil {
@@ -43,7 +72,7 @@ func (rs *starter) startRun(ctx context.Context, workspaceID string, opts config
 		if err != nil {
 			return nil, fmt.Errorf("retrieving repository tarball: %w", err)
 		}
-		cv, err = rs.CreateConfigurationVersion(ctx, ws.ID, opts)
+		cv, err = rs.CreateConfigurationVersion(ctx, ws.ID, configOptions)
 		if err != nil {
 			return nil, err
 		}
@@ -58,7 +87,7 @@ func (rs *starter) startRun(ctx context.Context, workspaceID string, opts config
 			}
 			return nil, err
 		}
-		cv, err = rs.CloneConfigurationVersion(ctx, latest.ID, opts)
+		cv, err = rs.CloneConfigurationVersion(ctx, latest.ID, configOptions)
 		if err != nil {
 			return nil, err
 		}
@@ -66,5 +95,6 @@ func (rs *starter) startRun(ctx context.Context, workspaceID string, opts config
 
 	return rs.CreateRun(ctx, workspaceID, RunCreateOptions{
 		ConfigurationVersionID: otf.String(cv.ID),
+		IsDestroy:              &destroy,
 	})
 }
diff --git a/run/starter_test.go b/run/starter_test.go
index b360fd1a0..c59039edc 100644
--- a/run/starter_test.go
+++ b/run/starter_test.go
@@ -26,7 +26,7 @@ func TestStartRun(t *testing.T) {
 			cv:        cv,
 		})
 
-		got, err := starter.startRun(ctx, ws.ID, configversion.ConfigurationVersionCreateOptions{})
+		got, err := starter.startRun(ctx, ws.ID, planOnly)
 		require.NoError(t, err)
 		assert.Equal(t, want, got)
 	})
@@ -43,7 +43,7 @@ func TestStartRun(t *testing.T) {
 			provider:  provider,
 		})
 
-		got, err := starter.startRun(ctx, ws.ID, configversion.ConfigurationVersionCreateOptions{})
+		got, err := starter.startRun(ctx, ws.ID, planOnly)
 		require.NoError(t, err)
 		assert.Equal(t, want, got)
 	})
diff --git a/run/test_helpers.go b/run/test_helpers.go
index b6ed34a9a..fdf2340d7 100644
--- a/run/test_helpers.go
+++ b/run/test_helpers.go
@@ -2,8 +2,12 @@ package run
 
 import (
 	"context"
+	"testing"
 
 	"github.com/leg100/otf"
+	"github.com/leg100/otf/http/html"
+	"github.com/leg100/otf/workspace"
+	"github.com/stretchr/testify/require"
 )
 
 type fakeSubscriber struct {
@@ -15,3 +19,74 @@ type fakeSubscriber struct {
 func (f *fakeSubscriber) Subscribe(context.Context, string) (<-chan otf.Event, error) {
 	return f.ch, nil
 }
+
+type (
+	fakeWebServices struct {
+		runs []*Run
+		ws   *workspace.Workspace
+
+		RunService
+		WorkspaceService
+	}
+
+	fakeWebServiceOption func(*fakeWebServices)
+)
+
+func withWorkspace(workspace *workspace.Workspace) fakeWebServiceOption {
+	return func(svc *fakeWebServices) {
+		svc.ws = workspace
+	}
+}
+
+func withRuns(runs ...*Run) fakeWebServiceOption {
+	return func(svc *fakeWebServices) {
+		svc.runs = runs
+	}
+}
+
+func newTestWebHandlers(t *testing.T, opts ...fakeWebServiceOption) *webHandlers {
+	renderer, err := html.NewRenderer(false)
+	require.NoError(t, err)
+
+	var svc fakeWebServices
+	for _, fn := range opts {
+		fn(&svc)
+	}
+
+	return &webHandlers{
+		Renderer:         renderer,
+		WorkspaceService: &svc,
+		logsdb:           &svc,
+		starter:          &svc,
+		svc:              &svc,
+	}
+}
+
+func (f *fakeWebServices) GetWorkspaceByName(context.Context, string, string) (*workspace.Workspace, error) {
+	return f.ws, nil
+}
+
+func (f *fakeWebServices) GetWorkspace(context.Context, string) (*workspace.Workspace, error) {
+	return f.ws, nil
+}
+
+func (f *fakeWebServices) ListRuns(ctx context.Context, opts RunListOptions) (*RunList, error) {
+	return &RunList{
+		Items:      f.runs,
+		Pagination: otf.NewPagination(opts.ListOptions, len(f.runs)),
+	}, nil
+}
+
+func (f *fakeWebServices) GetLogs(context.Context, string, otf.PhaseType) ([]byte, error) {
+	return nil, nil
+}
+
+func (f *fakeWebServices) Cancel(ctx context.Context, runID string) (*Run, error) { return nil, nil }
+
+func (f *fakeWebServices) GetRun(ctx context.Context, runID string) (*Run, error) {
+	return f.runs[0], nil
+}
+
+func (f *fakeWebServices) startRun(ctx context.Context, workspaceID string, strategy runStrategy) (*Run, error) {
+	return f.runs[0], nil
+}
diff --git a/run/web.go b/run/web.go
index bbc503ca6..8573ffa20 100644
--- a/run/web.go
+++ b/run/web.go
@@ -9,7 +9,6 @@ import (
 	"github.com/go-logr/logr"
 	"github.com/gorilla/mux"
 	"github.com/leg100/otf"
-	"github.com/leg100/otf/configversion"
 	"github.com/leg100/otf/http/decode"
 	"github.com/leg100/otf/http/html"
 	"github.com/leg100/otf/http/html/paths"
@@ -29,7 +28,7 @@ type (
 	}
 
 	runStarter interface {
-		startRun(ctx context.Context, workspaceID string, opts configversion.ConfigurationVersionCreateOptions) (*Run, error)
+		startRun(ctx context.Context, workspaceID string, strategy runStrategy) (*Run, error)
 	}
 
 	logsdb interface {
@@ -223,26 +222,15 @@ func (h *webHandlers) discard(w http.ResponseWriter, r *http.Request) {
 
 func (h *webHandlers) startRun(w http.ResponseWriter, r *http.Request) {
 	var params struct {
-		WorkspaceID string `schema:"workspace_id,required"`
-		Strategy    string `schema:"strategy,required"`
+		WorkspaceID string      `schema:"workspace_id,required"`
+		Strategy    runStrategy `schema:"strategy,required"`
 	}
 	if err := decode.All(&params, r); err != nil {
 		html.Error(w, err.Error(), http.StatusUnprocessableEntity)
 		return
 	}
 
-	var opts configversion.ConfigurationVersionCreateOptions
-	switch params.Strategy {
-	case "plan-only":
-		opts.Speculative = otf.Bool(true)
-	case "plan-and-apply":
-		opts.Speculative = otf.Bool(false)
-	default:
-		html.Error(w, "invalid strategy", http.StatusUnprocessableEntity)
-		return
-	}
-
-	run, err := h.starter.startRun(r.Context(), params.WorkspaceID, opts)
+	run, err := h.starter.startRun(r.Context(), params.WorkspaceID, params.Strategy)
 	if err != nil {
 		html.FlashError(w, err.Error())
 		http.Redirect(w, r, paths.Workspace(params.WorkspaceID), http.StatusFound)
diff --git a/run/web_test.go b/run/web_test.go
index 9da7d9dc3..55face2f2 100644
--- a/run/web_test.go
+++ b/run/web_test.go
@@ -1,17 +1,13 @@
 package run
 
 import (
-	"context"
 	"net/http/httptest"
 	"testing"
 
-	"github.com/leg100/otf"
-	"github.com/leg100/otf/configversion"
-	"github.com/leg100/otf/http/html"
 	"github.com/leg100/otf/http/html/paths"
+	"github.com/leg100/otf/testutils"
 	"github.com/leg100/otf/workspace"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestListRunsHandler(t *testing.T) {
@@ -72,106 +68,16 @@ func TestRuns_CancelHandler(t *testing.T) {
 	r := httptest.NewRequest("POST", "/?run_id=run-123", nil)
 	w := httptest.NewRecorder()
 	h.cancel(w, r)
-	if assert.Equal(t, 302, w.Code) {
-		redirect, _ := w.Result().Location()
-		assert.Equal(t, paths.Runs("ws-1"), redirect.Path)
-	}
+	testutils.AssertRedirect(t, w, paths.Runs("ws-1"))
 }
 
 func TestWebHandlers_StartRun(t *testing.T) {
-	tests := []struct {
-		strategy        string
-		wantSpeculative bool
-	}{
-		{"plan-only", true},
-		{"plan-and-apply", false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.strategy, func(t *testing.T) {
-			run := &Run{ID: "run-1"}
-			h := newTestWebHandlers(t, withRuns(run))
+	run := &Run{ID: "run-1"}
+	h := newTestWebHandlers(t, withRuns(run))
 
-			q := "/?workspace_id=run-123&strategy=" + tt.strategy
-			r := httptest.NewRequest("POST", q, nil)
-			w := httptest.NewRecorder()
-			h.startRun(w, r)
-			if assert.Equal(t, 302, w.Code) {
-				redirect, _ := w.Result().Location()
-				assert.Equal(t, paths.Run("run-1"), redirect.Path)
-			}
-			assert.Equal(t, tt.wantSpeculative, run.Speculative)
-		})
-	}
-}
-
-type (
-	fakeWebServices struct {
-		runs []*Run
-		ws   *workspace.Workspace
-
-		RunService
-		WorkspaceService
-	}
-
-	fakeWebServiceOption func(*fakeWebServices)
-)
-
-func withWorkspace(workspace *workspace.Workspace) fakeWebServiceOption {
-	return func(svc *fakeWebServices) {
-		svc.ws = workspace
-	}
-}
-
-func withRuns(runs ...*Run) fakeWebServiceOption {
-	return func(svc *fakeWebServices) {
-		svc.runs = runs
-	}
-}
-
-func newTestWebHandlers(t *testing.T, opts ...fakeWebServiceOption) *webHandlers {
-	renderer, err := html.NewRenderer(false)
-	require.NoError(t, err)
-
-	var svc fakeWebServices
-	for _, fn := range opts {
-		fn(&svc)
-	}
-
-	return &webHandlers{
-		Renderer:         renderer,
-		WorkspaceService: &svc,
-		logsdb:           &svc,
-		starter:          &svc,
-		svc:              &svc,
-	}
-}
-
-func (f *fakeWebServices) GetWorkspaceByName(context.Context, string, string) (*workspace.Workspace, error) {
-	return f.ws, nil
-}
-
-func (f *fakeWebServices) GetWorkspace(context.Context, string) (*workspace.Workspace, error) {
-	return f.ws, nil
-}
-
-func (f *fakeWebServices) ListRuns(ctx context.Context, opts RunListOptions) (*RunList, error) {
-	return &RunList{
-		Items:      f.runs,
-		Pagination: otf.NewPagination(opts.ListOptions, len(f.runs)),
-	}, nil
-}
-
-func (f *fakeWebServices) GetLogs(context.Context, string, otf.PhaseType) ([]byte, error) {
-	return nil, nil
-}
-
-func (f *fakeWebServices) Cancel(ctx context.Context, runID string) (*Run, error) { return nil, nil }
-
-func (f *fakeWebServices) GetRun(ctx context.Context, runID string) (*Run, error) {
-	return f.runs[0], nil
-}
-
-func (f *fakeWebServices) startRun(ctx context.Context, workspaceID string, opts configversion.ConfigurationVersionCreateOptions) (*Run, error) {
-	f.runs[0].Speculative = *opts.Speculative
-	return f.runs[0], nil
+	q := "/?workspace_id=run-123&strategy=plan-only"
+	r := httptest.NewRequest("POST", q, nil)
+	w := httptest.NewRecorder()
+	h.startRun(w, r)
+	testutils.AssertRedirect(t, w, paths.Run("run-1"))
 }
diff --git a/testutils/html.go b/testutils/html.go
index 4bfc93295..a2893851c 100644
--- a/testutils/html.go
+++ b/testutils/html.go
@@ -1,6 +1,12 @@
 package testutils
 
-import "golang.org/x/net/html"
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/html"
+)
 
 func AttrMap(node *html.Node) map[string]string {
 	m := make(map[string]string, len(node.Attr))
@@ -9,3 +15,10 @@ func AttrMap(node *html.Node) map[string]string {
 	}
 	return m
 }
+
+func AssertRedirect(t *testing.T, w *httptest.ResponseRecorder, path string) {
+	if assert.Equal(t, 302, w.Code, w.Body.String()) {
+		redirect, _ := w.Result().Location()
+		assert.Equal(t, path, redirect.Path)
+	}
+}
diff --git a/workspace/web.go b/workspace/web.go
index fb295f593..465d50c09 100644
--- a/workspace/web.go
+++ b/workspace/web.go
@@ -241,6 +241,7 @@ func (h *webHandlers) editWorkspace(w http.ResponseWriter, r *http.Request) {
 		DeleteWorkspaceAction          rbac.Action
 		SetWorkspacePermissionAction   rbac.Action
 		UnsetWorkspacePermissionAction rbac.Action
+		CreateRunAction                rbac.Action
 	}{
 		WorkspacePage: NewPage(r, "edit | "+workspace.ID, workspace),
 		Policy:        policy,
@@ -256,6 +257,7 @@ func (h *webHandlers) editWorkspace(w http.ResponseWriter, r *http.Request) {
 		DeleteWorkspaceAction:          rbac.DeleteWorkspaceAction,
 		SetWorkspacePermissionAction:   rbac.SetWorkspacePermissionAction,
 		UnsetWorkspacePermissionAction: rbac.UnsetWorkspacePermissionAction,
+		CreateRunAction:                rbac.CreateRunAction,
 	})
 }