{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[00be3a29] invite system\n\nSide A — unified diff (full patch):\ndiff --git a/bb.edn b/bb.edn\nindex 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644\n--- a/bb.edn\n+++ b/bb.edn\n@@ -47,14 +47,16 @@\n \"RUST_LOG\" \"info\"})})))}\n \n test\n- {:doc \"Full test suite: integration + auth + grants\"\n+ {:doc \"Full test suite: integration + auth + grants + invites\"\n :requires ([test.integration :as integration]\n [test.auth :as auth]\n- [test.grants :as grants])\n+ [test.grants :as grants]\n+ [test.invites :as invites])\n :task (do\n (integration/integration)\n (auth/auth-test)\n- (grants/grants-test))}\n+ (grants/grants-test)\n+ (invites/invites-test))}\n \n perf\n {:doc \"Performance test: concurrent HTTP requests to detect blocking I/O\"\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -105,6 +105,23 @@ enum ScopedCmd {\n #[arg(long)]\n json: bool,\n },\n+\n+ /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.\n+ InviteLink {\n+ /// Comma-separated: view, post, vote, add_item, manage\n+ #[arg(long = \"caps\", value_delimiter = ',')]\n+ caps: Vec,\n+ #[arg(long, default_value_t = 1)]\n+ uses: usize,\n+ #[arg(long)]\n+ json: bool,\n+ },\n+\n+ /// List principals granted access in this room (requires View or Manage)\n+ Audit {\n+ #[arg(long)]\n+ json: bool,\n+ },\n }\n \n #[derive(Subcommand, Debug)]\n@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {\n .duration_since(std::time::UNIX_EPOCH)\n .unwrap_or_default()\n .as_millis() as i64;\n- if resp.total > resp.posts.len() {\n- let end = resp.offset + resp.posts.len();\n- eprintln!(\"# showing {}-{} of {} posts (--offset N --limit N to paginate)\", resp.offset, end.saturating_sub(1), resp.total);\n+ if resp.total > resp.items.len() {\n+ let end = resp.offset + resp.items.len();\n+ eprintln!(\n+ \"# showing {}-{} of {} rows (--offset N --limit N to paginate)\",\n+ resp.offset,\n+ end.saturating_sub(1),\n+ resp.total\n+ );\n }\n- for (i, post) in resp.posts.iter().enumerate() {\n- let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);\n- let body = &post.body.trim();\n- println!(\"\", post.index, timeago);\n- println!(\"{}\", body);\n- println!(\"\");\n- if i + 1 < resp.posts.len() {\n+ for (i, item) in resp.items.iter().enumerate() {\n+ match item {\n+ ThreadItem::Post {\n+ index,\n+ ts,\n+ body,\n+ ..\n+ } => {\n+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+ let body = body.trim();\n+ println!(\"\", index, timeago);\n+ println!(\"{}\", body);\n+ println!(\"\");\n+ }\n+ ThreadItem::System { ts, text } => {\n+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);\n+ println!(\"{}\", timeago, text.trim());\n+ }\n+ }\n+ if i + 1 < resp.items.len() {\n println!();\n println!();\n }\n@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {\n }\n }\n },\n+ ScopedCmd::InviteLink { caps, uses, json } => {\n+ let caps: Vec = caps\n+ .into_iter()\n+ .flat_map(|s| {\n+ s.split(',')\n+ .map(|p| p.trim().to_lowercase())\n+ .filter(|p| !p.is_empty())\n+ .collect::>()\n+ })\n+ .collect();\n+ if caps.is_empty() {\n+ return Err(anyhow!(\"--caps is required (e.g. --caps view,post,vote)\"));\n+ }\n+ let bearer = effective_bearer().ok_or_else(|| {\n+ anyhow!(\n+ \"no bearer token: run `slugsocial identity start --rig --model ` \\\n+ then `slugsocial identity poll `, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+ )\n+ })?;\n+ let batch = send_rpc(\n+ &client,\n+ base,\n+ Some(&bearer),\n+ vec![RpcCommand::RoomMintInvite {\n+ room: room.to_string(),\n+ capabilities: caps,\n+ max_uses: uses,\n+ }],\n+ )\n+ .await?;\n+ match rpc_line_ok(&batch.results[0])? {\n+ RpcResult::RoomInviteMinted {\n+ invite_url,\n+ expires_at_ms,\n+ max_uses,\n+ } => {\n+ if json {\n+ println!(\n+ \"{}\",\n+ serde_json::to_string_pretty(&serde_json::json!({\n+ \"invite_url\": invite_url,\n+ \"expires_at_ms\": expires_at_ms,\n+ \"max_uses\": max_uses,\n+ }))?\n+ );\n+ } else {\n+ println!(\"{invite_url}\");\n+ println!(\"(Expires in 24 hours. Max uses: {max_uses})\");\n+ }\n+ }\n+ _ => return Err(anyhow!(\"unexpected RPC result\")),\n+ }\n+ }\n+ ScopedCmd::Audit { json } => {\n+ let bearer = effective_bearer().ok_or_else(|| {\n+ anyhow!(\n+ \"no bearer token: run `slugsocial identity start --rig --model ` \\\n+ then `slugsocial identity poll `, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token\"\n+ )\n+ })?;\n+ let batch = send_rpc(\n+ &client,\n+ base,\n+ Some(&bearer),\n+ vec![RpcCommand::RoomAudit {\n+ room: room.to_string(),\n+ }],\n+ )\n+ .await?;\n+ match rpc_line_ok(&batch.results[0])? {\n+ RpcResult::RoomAudit(resp) => {\n+ if json {\n+ println!(\"{}\", serde_json::to_string_pretty(&resp)?);\n+ } else {\n+ println!(\"room {}\", resp.room);\n+ if resp.grants.is_empty() {\n+ println!(\"(no grants recorded)\");\n+ } else {\n+ let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);\n+ for g in &resp.grants {\n+ let caps = g.capabilities.join(\", \");\n+ println!(\"{: return Err(anyhow!(\"unexpected RPC result\")),\n+ }\n+ }\n ScopedCmd::Check { file, json } => {\n let mut text = String::new();\n match file {\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -12,12 +12,61 @@ use tokio::sync::RwLock;\n \n use crate::{\n api::helpers::{api_error, now_ms, sha256_hex},\n- events::{Event, TokenIssued, UserRegistered},\n+ events::{Event, GrantAdded, TokenIssued, UserRegistered},\n identity::{parse_agent, parse_username},\n html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n state::{AppState, PendingSession},\n };\n \n+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).\n+const INVITE_BROWSER_AGENT: &str = \"00000000-0000-0000-0000-000000000000:invite:web/join\";\n+\n+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {\n+ let now = now_ms();\n+ let ga = {\n+ let mut invites = state.invites.write().await;\n+ let Some(inv) = invites.get_mut(invite_token) else {\n+ return Err(\"invite not found\".into());\n+ };\n+ if now > inv.expires_at_ms {\n+ invites.remove(invite_token);\n+ return Err(\"invite expired\".into());\n+ }\n+ if inv.current_uses >= inv.max_uses {\n+ return Err(\"invite exhausted\".into());\n+ }\n+ inv.current_uses += 1;\n+ Event::GrantAdded(GrantAdded {\n+ ts: now,\n+ room_id: inv.room_id.clone(),\n+ username: grantee_username.to_string(),\n+ capabilities: inv.capabilities.clone(),\n+ granted_by: inv.inviter.clone(),\n+ })\n+ };\n+\n+ match state.event_log.append(&ga).await {\n+ Ok(()) => {\n+ let mut reduced = state.reduced.write().await;\n+ reduced.apply_event(ga);\n+ let mut invites = state.invites.write().await;\n+ if let Some(inv) = invites.get(invite_token) {\n+ if inv.current_uses >= inv.max_uses {\n+ invites.remove(invite_token);\n+ }\n+ }\n+ Ok(())\n+ }\n+ Err(e) => {\n+ let mut invites = state.invites.write().await;\n+ if let Some(inv) = invites.get_mut(invite_token) {\n+ inv.current_uses = inv.current_uses.saturating_sub(1);\n+ }\n+ Err(format!(\"{e}\"))\n+ }\n+ }\n+}\n+\n fn pending_sessions(state: &AppState) -> Arc>> {\n state.pending_sessions.clone()\n }\n@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {\n pub session: String,\n }\n \n+pub async fn get_join_invite(Path(token): Path, State(state): State) -> impl IntoResponse {\n+ let token = token.trim().to_string();\n+ if token.is_empty() {\n+ return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+ }\n+ let now = now_ms();\n+ let valid = {\n+ let invites = state.invites.read().await;\n+ match invites.get(&token) {\n+ None => false,\n+ Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,\n+ }\n+ };\n+ if !valid {\n+ return api_error(StatusCode::NOT_FOUND, \"invite invalid or expired\", None).into_response();\n+ }\n+\n+ let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n+ let s = PendingSession {\n+ agent: INVITE_BROWSER_AGENT.to_string(),\n+ created_ts: now_ms(),\n+ provider: None,\n+ provider_id: None,\n+ redeem_invite: Some(token),\n+ complete: None,\n+ };\n+ state.pending_sessions.write().await.insert(session.clone(), s);\n+\n+ let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+ Redirect::temporary(&format!(\n+ \"{public_url}/auth/login?session={}\",\n+ urlencoding::encode(&session)\n+ ))\n+ .into_response()\n+}\n+\n pub async fn get_auth_login(Query(q): Query, State(state): State) -> impl IntoResponse {\n // Redirect to Google auth endpoint.\n let sessions = pending_sessions(&state);\n@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n s.provider = Some(\"google\".to_string());\n s.provider_id = Some(sub.clone());\n if let Some(username) = existing {\n+ let invite_tok = s.redeem_invite.clone();\n let (bearer, token_event) = issue_token_for_user(&username);\n // append token event\n let ev = Event::TokenIssued(token_event);\n@@ -215,6 +301,11 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n let mut reduced = reduced_arc.write().await;\n reduced.apply_event(ev);\n }\n+ if let Some(tok) = invite_tok {\n+ if let Err(e) = apply_invite_redemption(&state, &tok, &username).await {\n+ tracing::warn!(error = %e, \"invite redemption skipped after oauth\");\n+ }\n+ }\n s.complete = Some((username, bearer));\n return Redirect::temporary(&format!(\"{public_url}/auth/complete\")).into_response();\n }\n@@ -310,6 +401,16 @@ pub async fn post_choose_username(\n reduced.apply_event(ti_ev.clone());\n }\n \n+ // Redeem invite (if any) before marking the session complete.\n+ if let Some(tok) = {\n+ let sessions_read = sessions.read().await;\n+ sessions_read.get(&form.session).and_then(|s| s.redeem_invite.clone())\n+ } {\n+ if let Err(e) = apply_invite_redemption(&state, &tok, &canon_user).await {\n+ tracing::warn!(error = %e, \"invite redemption skipped after registration\");\n+ }\n+ }\n+\n // Mark complete for polling.\n {\n let mut sessions_write = sessions.write().await;\n@@ -339,6 +440,7 @@ pub async fn post_pending_session(\n created_ts: now_ms(),\n provider: None,\n provider_id: None,\n+ redeem_invite: None,\n complete: None,\n };\n let sessions = pending_sessions(&state);\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex a1ea432932cdca0e42dc7377f0a25075fd5644c0..cb031aecebad1107dfa2898a98fb6084b28ba6e9 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -4,6 +4,7 @@ mod rpc;\n mod validate;\n \n pub use auth::{\n+ get_join_invite,\n get_pending_session,\n get_whoami,\n post_pending_session,\ndiff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs\nindex 11a76ed7a02aae588edadb7a87a43660f5669d9e..f6bbc3df71909a2da7403cd46fe4ea6ca130c692 100644\n--- a/server/src/api/rpc.rs\n+++ b/server/src/api/rpc.rs\n@@ -13,12 +13,14 @@ use slug_types::*;\n use crate::{\n canonical_path::{canonicalize_item, canonicalize_tag},\n dsl,\n- events::{AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility},\n+ events::{\n+ AgentBound, Event, GrantAdded, Ingest, RoomCreated, ThreadCapability, ThreadVisibility,\n+ },\n identity::{parse_agent, parse_username},\n path_types::CanonicalItemUrl,\n ranking::{connected_components_from_voted_pairs, ranked_items_subset},\n reducer::{scope_from_room_wire, ReducerState, ScopeId},\n- state::AppState,\n+ state::{AppState, InviteState},\n };\n \n use super::auth::verify_bearer_principal;\n@@ -142,6 +144,27 @@ fn gen_short_id() -> String {\n (0..7).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect()\n }\n \n+fn gen_invite_token() -> String {\n+ use rand::Rng;\n+ const ALPHABET: &[u8] = b\"0123456789abcdefghijklmnopqrstuvwxyz\";\n+ let mut rng = rand::thread_rng();\n+ let tail: String = (0..16).map(|_| ALPHABET[rng.gen_range(0..ALPHABET.len())] as char).collect();\n+ format!(\"inv_{tail}\")\n+}\n+\n+const INVITE_TTL_MS: i64 = 86_400_000;\n+\n+fn capability_wire(c: ThreadCapability) -> String {\n+ match c {\n+ ThreadCapability::View => \"view\",\n+ ThreadCapability::Post => \"post\",\n+ ThreadCapability::Vote => \"vote\",\n+ ThreadCapability::AddItem => \"add_item\",\n+ ThreadCapability::Manage => \"manage\",\n+ }\n+ .to_string()\n+}\n+\n fn build_rank_response_for_content(\n content: &crate::reducer::ContentState,\n parent: Option<&str>,\n@@ -512,7 +535,7 @@ fn rpc_forum_thread_detail(\n None => Err((\"post not found\".into(), None)),\n Some((idx, ing)) => Ok(ThreadDetailResponse {\n thread: format!(\"#{}\", tag),\n- posts: vec![PostRow {\n+ items: vec![ThreadItem::Post {\n id: ing.id.clone(),\n index: idx,\n ts: ing.ts,\n@@ -543,7 +566,7 @@ fn rpc_forum_thread_detail(\n \n let total = filtered.len();\n const MAX_BODY: usize = 2000;\n- let posts: Vec = filtered\n+ let items: Vec = filtered\n .into_iter()\n .skip(offset)\n .take(limit)\n@@ -553,7 +576,7 @@ fn rpc_forum_thread_detail(\n } else {\n (ing.raw.clone(), false)\n };\n- PostRow {\n+ ThreadItem::Post {\n id: ing.id.clone(),\n index: idx,\n ts: ing.ts,\n@@ -566,7 +589,7 @@ fn rpc_forum_thread_detail(\n \n Ok(ThreadDetailResponse {\n thread: format!(\"#{}\", tag),\n- posts,\n+ items,\n total,\n offset,\n })\n@@ -1007,7 +1030,7 @@ pub async fn handle_rpc_batch(\n RpcCommand::RoomGrant {\n room,\n username,\n- capability,\n+ capabilities,\n } => {\n let principal = {\n let reduced = state.reduced.read().await;\n@@ -1022,6 +1045,8 @@ pub async fn handle_rpc_batch(\n };\n if !can_manage {\n line_err(\"requires Manage capability\", None)\n+ } else if capabilities.is_empty() {\n+ line_err(\"capabilities must not be empty\", None)\n } else {\n match parse_username(&username) {\n Err(msg) => line_err(\"invalid username\", Some(msg)),\n@@ -1033,14 +1058,18 @@ pub async fn handle_rpc_batch(\n if !user_exists {\n line_err(format!(\"user @{target} not found\"), None)\n } else {\n- match parse_capability(&capability) {\n+ let caps: Result, String> = capabilities\n+ .iter()\n+ .map(|c| parse_capability(c.trim()))\n+ .collect();\n+ match caps {\n Err(msg) => line_err(msg, None),\n- Ok(cap) => {\n+ Ok(caps) => {\n let ga_ev = Event::GrantAdded(GrantAdded {\n ts: now_ms(),\n room_id: room,\n username: target,\n- capabilities: vec![cap],\n+ capabilities: caps,\n granted_by: principal,\n });\n if let Err(e) = state.event_log.append(&ga_ev).await {\n@@ -1059,6 +1088,114 @@ pub async fn handle_rpc_batch(\n }\n }\n }\n+ RpcCommand::RoomMintInvite {\n+ room,\n+ capabilities,\n+ max_uses,\n+ } => {\n+ let principal = {\n+ let reduced = state.reduced.read().await;\n+ verify_bearer_principal(&headers, &*reduced)\n+ };\n+ match principal {\n+ Err((_, m)) => line_err(m, None),\n+ Ok(principal) => {\n+ let can_manage = {\n+ let reduced = state.reduced.read().await;\n+ reduced.user_has_cap(&room, &principal, ThreadCapability::Manage)\n+ };\n+ if !can_manage {\n+ line_err(\"requires Manage capability\", None)\n+ } else if capabilities.is_empty() {\n+ line_err(\"capabilities must not be empty\", None)\n+ } else {\n+ match capabilities\n+ .iter()\n+ .map(|c| parse_capability(c.trim()))\n+ .collect::, String>>()\n+ {\n+ Err(msg) => line_err(msg, None),\n+ Ok(caps) => {\n+ let max_uses = max_uses.max(1).min(100_000);\n+ let now = now_ms();\n+ let expires_at_ms = now + INVITE_TTL_MS;\n+ let token = loop {\n+ let t = gen_invite_token();\n+ let taken = {\n+ let invites = state.invites.read().await;\n+ invites.contains_key(&t)\n+ };\n+ if !taken {\n+ break t;\n+ }\n+ };\n+ let inv = InviteState {\n+ room_id: room.clone(),\n+ capabilities: caps,\n+ expires_at_ms,\n+ max_uses,\n+ current_uses: 0,\n+ inviter: principal,\n+ };\n+ state.invites.write().await.insert(token.clone(), inv);\n+ let public_url = std::env::var(\"SLUG_PUBLIC_URL\")\n+ .unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n+ let invite_url = format!(\"{public_url}/join/{token}\");\n+ line_ok(RpcResult::RoomInviteMinted {\n+ invite_url,\n+ expires_at_ms: Some(expires_at_ms),\n+ max_uses,\n+ })\n+ }\n+ }\n+ }\n+ }\n+ }\n+ }\n+ RpcCommand::RoomAudit { room } => {\n+ let principal = {\n+ let reduced = state.reduced.read().await;\n+ verify_bearer_principal(&headers, &*reduced)\n+ };\n+ match principal {\n+ Err((_, m)) => line_err(m, None),\n+ Ok(principal) => {\n+ let reduced = state.reduced.read().await;\n+ if !reduced.rooms.contains_key(&room) {\n+ line_err(\"unknown room\", None)\n+ } else {\n+ let can_audit = reduced.user_has_cap(&room, &principal, ThreadCapability::View)\n+ || reduced.user_has_cap(&room, &principal, ThreadCapability::Manage);\n+ if !can_audit {\n+ line_err(\"requires View or Manage capability\", None)\n+ } else {\n+ let grants: Vec = reduced\n+ .grants\n+ .get(&room)\n+ .map(|m| {\n+ let mut v: Vec = m\n+ .iter()\n+ .map(|(username, caps)| {\n+ let mut c: Vec =\n+ caps.iter().copied().map(capability_wire).collect();\n+ c.sort();\n+ RoomAuditEntry {\n+ username: username.clone(),\n+ capabilities: c,\n+ }\n+ })\n+ .collect();\n+ v.sort_by(|a, b| a.username.cmp(&b.username));\n+ v\n+ })\n+ .unwrap_or_default();\n+ line_ok(RpcResult::RoomAudit(RoomAuditResponse { room, grants }))\n+ }\n+ }\n+ }\n+ }\n+ }\n+ RpcCommand::RoomRevoke { .. } => line_err(\"RoomRevoke is not implemented yet\", None),\n RpcCommand::GetGlobalRank {\n room,\n limit,\ndiff --git a/server/src/events.rs b/server/src/events.rs\nindex 125005d89ade7b22c9b6d997f0ed81781df5e7ec..9e60f2c218f5c871a93e855e415dd984e3a017c5 100644\n--- a/server/src/events.rs\n+++ b/server/src/events.rs\n@@ -26,6 +26,8 @@ pub enum Event {\n RoomCreated(RoomCreated),\n GrantAdded(GrantAdded),\n GrantRevoked(GrantRevoked),\n+ InviteMinted(InviteMinted),\n+ InviteRedeemed(InviteRedeemed),\n /// Ingest of a DSL+prose body. Identity and routing live in event metadata.\n Ingest(Ingest),\n }\n@@ -82,6 +84,25 @@ pub struct GrantRevoked {\n pub revoked_by: String,\n }\n \n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteMinted {\n+ pub ts: i64,\n+ pub token: String,\n+ pub room_id: String,\n+ pub capabilities: Vec,\n+ pub inviter: String,\n+ pub max_uses: u32,\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ pub expires_ts_ms: Option,\n+}\n+\n+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n+pub struct InviteRedeemed {\n+ pub ts: i64,\n+ pub token: String,\n+ pub username: String,\n+}\n+\n #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n pub struct Ingest {\n /// Unix timestamp in milliseconds.\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex d00b56d909e1fabd1d122d054dd02785e13e0bd8..bf2f73d4d0f26a357961e88c52c3b4f72626af81 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -27,6 +27,7 @@ pub fn create_app(state: AppState) -> Router {\n Router::new()\n .route(\"/healthz\", axum::routing::get(|| async { \"ok\" }))\n .route(\"/static/:filename\", axum::routing::get(crate::html::serve_theme_css))\n+ .route(\"/join/:token\", axum::routing::get(api::get_join_invite))\n .route(\"/auth/login\", axum::routing::get(api::get_auth_login))\n .route(\"/auth/callback\", axum::routing::get(api::get_auth_callback))\n .route(\"/auth/complete\", axum::routing::get(api::get_auth_complete))\ndiff --git a/server/src/reducer.rs b/server/src/reducer.rs\nindex 118cb19f4df4a083df2878ca7a1424f3d63de851..5190d0a7ee3d545a786a68fef483322aafdce7f9 100644\n--- a/server/src/reducer.rs\n+++ b/server/src/reducer.rs\n@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet, VecDeque};\n use serde::{Deserialize, Serialize};\n \n use crate::canonical_path::canonicalize_tag;\n-use crate::events::{Event, Ingest, ThreadCapability};\n+use crate::events::{Event, Ingest, ThreadCapability, ThreadVisibility};\n use crate::path_types::CanonicalItemUrl;\n \n #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]\n@@ -156,6 +156,41 @@ pub struct RoomState {\n pub visibility: crate::events::ThreadVisibility,\n }\n \n+/// Durable invite link state (from [`crate::events::InviteMinted`] / [`crate::events::InviteRedeemed`]).\n+#[derive(Debug, Clone)]\n+pub struct ActiveInviteState {\n+ pub room_id: String,\n+ pub capabilities: HashSet,\n+ pub inviter: String,\n+ pub uses_remaining: u32,\n+ pub expires_ts_ms: Option,\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum RoomTimelineKind {\n+ RoomCreated {\n+ owner: String,\n+ slug: String,\n+ visibility: ThreadVisibility,\n+ },\n+ GrantAdded {\n+ username: String,\n+ granted_by: String,\n+ capabilities: Vec,\n+ },\n+ GrantRevoked {\n+ username: String,\n+ revoked_by: String,\n+ capabilities: Vec,\n+ },\n+}\n+\n+#[derive(Clone, Debug)]\n+pub struct RoomTimelineEntry {\n+ pub ts: i64,\n+ pub kind: RoomTimelineKind,\n+}\n+\n #[derive(Debug, Clone)]\n pub struct ForumThreadState {\n pub last_activity_ts: i64,\n@@ -210,6 +245,10 @@ pub struct ReducerState {\n pub ingests_ordered: Vec,\n /// room_id → username → capabilities\n pub grants: HashMap>>,\n+ /// room_id → chronological room admin lines (for thread UI).\n+ pub room_timeline: HashMap>,\n+ /// Invite token → active invite (absent when fully consumed or never minted).\n+ pub invites: HashMap,\n }\n \n impl ReducerState {\n@@ -225,6 +264,20 @@ impl ReducerState {\n .unwrap_or(false)\n }\n \n+ /// Invite link is present, not expired, and has uses left.\n+ pub fn invite_token_active(&self, token: &str, now_ms: i64) -> Option<&ActiveInviteState> {\n+ let inv = self.invites.get(token)?;\n+ if inv.uses_remaining == 0 {\n+ return None;\n+ }\n+ if let Some(exp) = inv.expires_ts_ms {\n+ if now_ms > exp {\n+ return None;\n+ }\n+ }\n+ Some(inv)\n+ }\n+\n pub fn content_for_scope_mut(&mut self, scope: ScopeId) -> &mut ContentState {\n self.content.entry(scope).or_default()\n }\n@@ -356,6 +409,17 @@ impl ReducerState {\n visibility: rc.visibility,\n },\n );\n+ self.room_timeline\n+ .entry(rc.room_id.clone())\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: rc.ts,\n+ kind: RoomTimelineKind::RoomCreated {\n+ owner: rc.owner.clone(),\n+ slug: rc.slug.clone(),\n+ visibility: rc.visibility,\n+ },\n+ });\n }\n Event::Ingest(mut ing) => {\n ing.thread_tag = canonicalize_tag(&ing.thread_tag);\n@@ -525,18 +589,31 @@ impl ReducerState {\n nav!(self.actor_last_post_ts, keypath(ing.principal.clone()), setval(ing.ts));\n }\n Event::GrantAdded(ga) => {\n+ let room_id = ga.room_id.clone();\n let caps = self.grants\n .entry(ga.room_id)\n .or_default()\n- .entry(ga.username)\n+ .entry(ga.username.clone())\n .or_default();\n- for cap in ga.capabilities {\n+ for cap in ga.capabilities.iter().copied() {\n caps.insert(cap);\n }\n+ self.room_timeline\n+ .entry(room_id)\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: ga.ts,\n+ kind: RoomTimelineKind::GrantAdded {\n+ username: ga.username.clone(),\n+ granted_by: ga.granted_by.clone(),\n+ capabilities: ga.capabilities.clone(),\n+ },\n+ });\n }\n Event::GrantRevoked(gr) => {\n+ let room_id = gr.room_id.clone();\n if let Some(room_grants) = self.grants.get_mut(&gr.room_id) {\n- let username = gr.username;\n+ let username = gr.username.clone();\n if let Some(caps) = room_grants.get_mut(&username) {\n for cap in &gr.capabilities {\n caps.remove(cap);\n@@ -549,6 +626,37 @@ impl ReducerState {\n self.grants.remove(&gr.room_id);\n }\n }\n+ self.room_timeline\n+ .entry(room_id)\n+ .or_default()\n+ .push(RoomTimelineEntry {\n+ ts: gr.ts,\n+ kind: RoomTimelineKind::GrantRevoked {\n+ username: gr.username.clone(),\n+ revoked_by: gr.revoked_by.clone(),\n+ capabilities: gr.capabilities.clone(),\n+ },\n+ });\n+ }\n+ Event::InviteMinted(im) => {\n+ self.invites.insert(\n+ im.token.clone(),\n+ ActiveInviteState {\n+ room_id: im.room_id.clone(),\n+ capabilities: im.capabilities.iter().copied().collect(),\n+ inviter: im.inviter.clone(),\n+ uses_remaining: im.max_uses,\n+ expires_ts_ms: im.expires_ts_ms,\n+ },\n+ );\n+ }\n+ Event::InviteRedeemed(ir) => {\n+ if let Some(inv) = self.invites.get_mut(&ir.token) {\n+ inv.uses_remaining = inv.uses_remaining.saturating_sub(1);\n+ if inv.uses_remaining == 0 {\n+ self.invites.remove(&ir.token);\n+ }\n+ }\n }\n }\n }\n@@ -570,6 +678,8 @@ impl Default for ReducerState {\n actor_last_post_ts: HashMap::new(),\n ingests_ordered: Vec::new(),\n grants: HashMap::new(),\n+ room_timeline: HashMap::new(),\n+ invites: HashMap::new(),\n }\n }\n }\ndiff --git a/server/src/state.rs b/server/src/state.rs\nindex b1ff2330903780cbe0cdf35964cb166eb2423d7d..628fd5921b34ba53ac0ca6b6fd33957ca09129b9 100644\n--- a/server/src/state.rs\n+++ b/server/src/state.rs\n@@ -1,8 +1,20 @@\n+use std::collections::HashMap;\n use std::sync::Arc;\n \n use tokio::sync::{broadcast, RwLock};\n \n-use crate::{event_log::EventLog, reducer::ReducerState};\n+use crate::{event_log::EventLog, events::ThreadCapability, reducer::ReducerState};\n+\n+/// Ephemeral invite link (24h TTL, in-memory only; not written to the event log).\n+#[derive(Debug, Clone)]\n+pub struct InviteState {\n+ pub room_id: String,\n+ pub capabilities: Vec,\n+ pub expires_at_ms: i64,\n+ pub max_uses: usize,\n+ pub current_uses: usize,\n+ pub inviter: String,\n+}\n \n #[derive(Debug, Clone)]\n pub struct PendingSession {\n@@ -10,6 +22,8 @@ pub struct PendingSession {\n pub created_ts: i64,\n pub provider: Option,\n pub provider_id: Option,\n+ /// When set, successful OAuth completion redeems this invite token and appends [`crate::events::GrantAdded`].\n+ pub redeem_invite: Option,\n pub complete: Option<(String /*username*/, String /*bearer*/ )>,\n }\n \n@@ -42,7 +56,9 @@ pub struct AppState {\n pub cfg: Arc,\n pub event_log: Arc,\n pub reduced: Arc>,\n- pub pending_sessions: Arc>>,\n+ pub pending_sessions: Arc>>,\n+ /// Ephemeral invite tokens (`inv_…`) until expiry or exhaustion.\n+ pub invites: Arc>>,\n /// Broadcast channel for SSE live-streaming. Capacity = 64 events.\n pub stream_tx: broadcast::Sender,\n /// Broadcast channel for web SSE HTML fragments (poem pattern). Capacity = 64.\n@@ -58,7 +74,8 @@ impl AppState {\n cfg: Arc::new(cfg),\n event_log: Arc::new(event_log),\n reduced: Arc::new(RwLock::new(ReducerState::default())),\n- pending_sessions: Arc::new(RwLock::new(std::collections::HashMap::new())),\n+ pending_sessions: Arc::new(RwLock::new(HashMap::new())),\n+ invites: Arc::new(RwLock::new(HashMap::new())),\n stream_tx,\n html_tx,\n }\ndiff --git a/server/src/timeline.rs b/server/src/timeline.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..251158943ab36d3015268e35f6bdd01c3f42ab3b\n--- /dev/null\n+++ b/server/src/timeline.rs\n@@ -0,0 +1,153 @@\n+//! Room admin lines merged into forum thread views.\n+\n+use crate::{\n+ canonical_path::canonicalize_tag,\n+ reducer::{ReducerState, RoomTimelineEntry, RoomTimelineKind},\n+};\n+\n+fn cap_label(c: crate::events::ThreadCapability) -> &'static str {\n+ use crate::events::ThreadCapability::*;\n+ match c {\n+ View => \"view\",\n+ Post => \"post\",\n+ Vote => \"vote\",\n+ AddItem => \"add_item\",\n+ Manage => \"manage\",\n+ }\n+}\n+\n+fn caps_list(caps: &[crate::events::ThreadCapability]) -> String {\n+ let mut v: Vec<_> = caps.iter().map(|c| cap_label(*c)).collect();\n+ v.sort();\n+ v.join(\", \")\n+}\n+\n+/// Human-readable system line for the thread feed.\n+pub fn format_room_timeline_entry(e: &RoomTimelineEntry) -> String {\n+ match &e.kind {\n+ RoomTimelineKind::RoomCreated {\n+ owner,\n+ slug,\n+ visibility,\n+ } => {\n+ let vis = match visibility {\n+ crate::events::ThreadVisibility::Public => \"public\",\n+ crate::events::ThreadVisibility::Private => \"private\",\n+ };\n+ format!(\"@{owner} created room #{slug} ({vis})\")\n+ }\n+ RoomTimelineKind::GrantAdded {\n+ username,\n+ granted_by,\n+ capabilities,\n+ } => {\n+ format!(\n+ \"@{granted_by} granted @{} {}\",\n+ username,\n+ caps_list(capabilities)\n+ )\n+ }\n+ RoomTimelineKind::GrantRevoked {\n+ username,\n+ revoked_by,\n+ capabilities,\n+ } => {\n+ format!(\n+ \"@{revoked_by} revoked @{} {}\",\n+ username,\n+ caps_list(capabilities)\n+ )\n+ }\n+ }\n+}\n+\n+#[derive(Clone, Debug)]\n+pub enum MergedThreadRow {\n+ System { ts: i64, text: String },\n+ Post {\n+ index: usize,\n+ id: String,\n+ ts: i64,\n+ principal: String,\n+ raw: String,\n+ },\n+}\n+\n+/// Merge room admin lines with thread ingests for one room + tag. Oldest first.\n+/// `actor_prefix` filters posts only (system lines always included).\n+pub fn merge_thread_rows(\n+ reduced: &ReducerState,\n+ room_wire: &str,\n+ thread_tag: &str,\n+ since: Option,\n+ before: Option,\n+ actor_prefix: &str,\n+) -> Vec {\n+ let scope = crate::reducer::scope_from_room_wire(room_wire);\n+ let tag = canonicalize_tag(thread_tag);\n+ let key = (scope.clone(), tag.clone());\n+\n+ let mut rows: Vec = Vec::new();\n+\n+ if let Some(entries) = reduced.room_timeline.get(room_wire.trim()) {\n+ for e in entries {\n+ if since.map_or(true, |s| e.ts >= s) && before.map_or(true, |b| e.ts < b) {\n+ rows.push(MergedThreadRow::System {\n+ ts: e.ts,\n+ text: format_room_timeline_entry(e),\n+ });\n+ }\n+ }\n+ }\n+\n+ let all_ids: Vec = reduced\n+ .ingests_by_scope_thread\n+ .get(&key)\n+ .map(|q| q.iter().rev().cloned().collect())\n+ .unwrap_or_default();\n+\n+ for (idx, id) in all_ids.into_iter().enumerate() {\n+ let Some(ing) = reduced.ingests_by_id.get(&id) else {\n+ continue;\n+ };\n+ if since.map_or(true, |s| ing.ts >= s) && before.map_or(true, |b| ing.ts < b) {\n+ if !actor_prefix.is_empty()\n+ && !ing\n+ .principal\n+ .to_lowercase()\n+ .starts_with(actor_prefix)\n+ {\n+ continue;\n+ }\n+ rows.push(MergedThreadRow::Post {\n+ index: idx,\n+ id: ing.id.clone(),\n+ ts: ing.ts,\n+ principal: ing.principal.clone(),\n+ raw: ing.raw.clone(),\n+ });\n+ }\n+ }\n+\n+ rows.sort_by(|a, b| {\n+ let ta = match a {\n+ MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+ };\n+ let tb = match b {\n+ MergedThreadRow::System { ts, .. } | MergedThreadRow::Post { ts, .. } => *ts,\n+ };\n+ ta.cmp(&tb)\n+ });\n+ rows\n+}\n+\n+/// Public forum thread (`room_wire == \"public\"`): same merge (timeline usually empty).\n+pub fn merge_public_thread_rows(\n+ reduced: &ReducerState,\n+ thread_tag: &str,\n+ since: Option,\n+ before: Option,\n+ actor_prefix: &str,\n+) -> Vec {\n+ merge_thread_rows(reduced, \"public\", thread_tag, since, before, actor_prefix)\n+}\ndiff --git a/test/grants.bb b/test/grants.bb\nindex 10ef0f08ce1c3945e5f1634314e6aebcf6810cd2..4ded5ce92576cdea653cce0ba8a751be4374731a 100644\n--- a/test/grants.bb\n+++ b/test/grants.bb\n@@ -105,7 +105,7 @@\n ;; Alice grants bob View only.\n (println \"\\nalice grants bob View only…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"view\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"view\"]}}])))\n \"grant View RPC ok\")\n \n (println \"\\nbob (View only) tries to post prose…\")\n@@ -117,7 +117,7 @@\n ;; Alice grants bob Post.\n (println \"\\nalice grants bob Post…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"post\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"post\"]}}])))\n \"grant Post RPC ok\")\n \n (println \"\\nbob (View + Post) posts prose…\")\n@@ -143,7 +143,7 @@\n ;; Alice grants bob Vote.\n (println \"\\nalice grants bob Vote…\")\n (assert! (rpc-line-ok? (:parsed (rpc-batch! base-url alice-token\n- [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capability\" \"vote\"}}])))\n+ [{\"RoomGrant\" {\"room\" room-id \"username\" \"bob\" \"capabilities\" [\"vote\"]}}])))\n \"grant Vote RPC ok\")\n \n (println \"\\nbob (View + Post + Vote) votes…\")\ndiff --git a/test/invites.bb b/test/invites.bb\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f72b1e630a6856174cdef11eb977e2f81b16e551\n--- /dev/null\n+++ b/test/invites.bb\n@@ -0,0 +1,150 @@\n+(ns test.invites\n+ \"Ephemeral invite links: mint via RPC, GET /join → pending session + OAuth, redemption → GrantAdded,\n+ RoomAudit, post succeeds, second GET /join returns 404 when max_uses exhausted.\"\n+ (:require [babashka.fs :as fs]\n+ [cheshire.core :as json]\n+ [clojure.string :as str]\n+ [test.common :as common]\n+ [test.oauth :as oauth]))\n+\n+(def ^:private counts (atom {:pass 0 :fail 0}))\n+\n+(defn- assert! [pred msg]\n+ (common/test-assert! counts pred msg))\n+\n+(defn- bearer [token] {\"Authorization\" (str \"Bearer \" token)})\n+\n+(defn- rpc-batch! [base-url token cmds]\n+ (let [resp (oauth/http-post-json (str base-url \"/api/v0/rpc\") cmds :headers (bearer token))]\n+ {:status (:status resp)\n+ :parsed (json/parse-string (:body resp) false)}))\n+\n+(defn- rpc-line-ok? [parsed]\n+ (true? (get-in parsed [\"results\" 0 \"ok\"])))\n+\n+(defn- session-from-login-location [loc]\n+ (when loc\n+ (let [qpart (if (str/includes? loc \"?\")\n+ (-> loc (str/split #\"\\?\" 2) second)\n+ \"\")\n+ qpart (if (str/includes? qpart \"#\")\n+ (-> qpart (str/split #\"#\" 2) first)\n+ qpart)\n+ m (oauth/parse-query qpart)]\n+ (some-> (get m :session) str))))\n+\n+(defn- invite-token-from-url [invite-url]\n+ (second (re-find #\"/join/(inv_[^/?#]+)\" (str invite-url))))\n+\n+(defn- register-user! [base-url session-agent username]\n+ (oauth/complete-registration! base-url\n+ :agent session-agent\n+ :username username\n+ :assert! (fn [pred msg] (assert! pred msg))))\n+\n+(defn- ingest! [base-url token room thread delegate text]\n+ (rpc-batch! base-url token\n+ [{\"Post\" {\"room\" room\n+ \"thread_tag\" thread\n+ \"delegate\" delegate\n+ \"text\" text\n+ \"return_rank_diff\" false}}]))\n+\n+(defn invites-test [& _args]\n+ (println \"\\n━━━ ephemeral invite + audit integration check ━━━\\n\")\n+ (reset! counts {:pass 0 :fail 0})\n+\n+ (println \"building server binary…\")\n+ (common/letlocals\n+ (bind build (common/run-cargo-build-release! [\"slugsocial-server\"]))\n+ (assert! (zero? (:exit build)) \"cargo build succeeds\")\n+ (bind server-bin \"target/release/slugsocial-server\")\n+\n+ (bind tmp-dir (str (fs/create-temp-dir {:prefix \"slug-invites-\"})))\n+ (bind slug-port (common/pick-port))\n+ (bind google-port (common/pick-port))\n+ (bind base-url (str \"http://127.0.0.1:\" slug-port))\n+ (bind google-url (str \"http://127.0.0.1:\" google-port))\n+\n+ (bind !server (atom nil))\n+ (bind !google (atom nil))\n+\n+ (bind server-env (common/slug-server-env tmp-dir base-url google-url slug-port))\n+ (try\n+ (println (str \"starting mock google on :\" google-port))\n+ (reset! !google (oauth/start-mock-google google-port\n+ :google-users [\"google-user-alice\" \"google-user-bob\"]))\n+\n+ (println (str \"starting server on :\" slug-port))\n+ (reset! !server (common/start-server server-bin server-env))\n+ (assert! (common/wait-for-server base-url 10000) \"server responds to /healthz\")\n+\n+ (println \"\\nregistering alice…\")\n+ (let [alice-token (register-user! base-url\n+ \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n+ \"alice\")\n+\n+ _ (println \"\\nalice creates private room…\")\n+ create (rpc-batch! base-url alice-token\n+ [{\"RoomCreate\" {\"slug\" \"invite-demo\" \"visibility\" \"private\"}}])\n+ _ (assert! (= 200 (:status create)) \"room create HTTP 200\")\n+ _ (assert! (rpc-line-ok? (:parsed create)) \"room create RPC ok\")\n+ room-id (get-in (:parsed create) [\"results\" 0 \"result\" \"RoomCreated\" \"room_id\"])\n+ _ (assert! (some? room-id) \"room_id present\")\n+\n+ _ (println \"\\nalice mints invite (view,post,vote uses=1)…\")\n+ mint (rpc-batch! base-url alice-token\n+ [{\"RoomMintInvite\" {\"room\" room-id\n+ \"capabilities\" [\"view\" \"post\" \"vote\"]\n+ \"max_uses\" 1}}])\n+ _ (assert! (= 200 (:status mint)) \"mint HTTP 200\")\n+ _ (assert! (rpc-line-ok? (:parsed mint)) \"mint RPC ok\")\n+ invite-url (get-in (:parsed mint) [\"results\" 0 \"result\" \"RoomInviteMinted\" \"invite_url\"])\n+ inv-tok (invite-token-from-url invite-url)\n+ _ (assert! (some? inv-tok) \"invite token parsed from URL\")\n+\n+ _ (println \"\\nGET /join/:token (expect redirect + session)…\")\n+ join-resp (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+ _ (assert! (contains? #{302 307} (:status join-resp))\n+ (str \"join returns redirect (got status \" (:status join-resp) \")\"))\n+ sess (session-from-login-location (:location join-resp))\n+ _ (assert! (and (some? sess) (str/starts-with? sess \"p_\")) \"Location carries session=p_…\")\n+\n+ _ (println \"\\nbob completes OAuth via invite session…\")\n+ bob-token (oauth/complete-pending-session! base-url sess \"bob\"\n+ :assert! (fn [pred msg] (assert! pred msg)))\n+\n+ _ (println \"\\nalice runs RoomAudit…\")\n+ audit (rpc-batch! base-url alice-token [{\"RoomAudit\" {\"room\" room-id}}])\n+ _ (assert! (rpc-line-ok? (:parsed audit)) \"audit RPC ok\")\n+ grants (get-in (:parsed audit) [\"results\" 0 \"result\" \"RoomAudit\" \"grants\"])\n+ bob-entry (first (filter #(= \"bob\" (get % \"username\")) grants))\n+ _ (assert! (some? bob-entry) \"audit lists bob\")\n+ bob-caps (set (get bob-entry \"capabilities\"))\n+ _ (assert! (= bob-caps #{\"view\" \"post\" \"vote\"}) \"bob has view, post, vote\")\n+\n+ _ (println \"\\nbob posts prose to private room…\")\n+ _ (assert! (rpc-line-ok? (:parsed (ingest! base-url bob-token room-id \"main\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"Hello via invite link.\")))\n+ \"bob post succeeds\")\n+\n+ _ (println \"\\nsecond GET /join (invite exhausted → 404)…\")\n+ join2 (oauth/http-get-no-redirect (str base-url \"/join/\" inv-tok))\n+ _ (assert! (= 404 (:status join2)) \"exhausted invite returns 404\")]\n+\n+ (println \"\\ninvite lifecycle OK.\"))\n+\n+ (finally\n+ (when-some [s @!server] (common/kill-server s))\n+ (when-some [g @!google] ((:stop-fn g)))\n+ (fs/delete-tree tmp-dir)))\n+\n+ (bind {pass :pass fail :fail} @counts)\n+ (if (zero? fail)\n+ (println (str \"\\n\" common/ansi-green \"━━━ \" pass \" invite checks passed ━━━\" common/ansi-reset \"\\n\"))\n+ (do (println (str \"\\n\" common/ansi-red \"━━━ \" fail \" invite checks FAILED ━━━\" common/ansi-reset \"\\n\"))\n+ (System/exit 1)))))\n+\n+(when (= *file* (System/getProperty \"babashka.file\"))\n+ (invites-test))\ndiff --git a/test/oauth.bb b/test/oauth.bb\nindex b69459acd17c23c023170d8dd93fe45bb49c8d88..efb3f3e66346ffde81bf9622d75c3a6ec89f8db2 100644\n--- a/test/oauth.bb\n+++ b/test/oauth.bb\n@@ -21,6 +21,21 @@\n resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn http-get-no-redirect\n+ \"GET without following redirects; returns `:location` from the first `Location` header when present.\"\n+ [url & {:keys [headers]}]\n+ (let [client (-> (java.net.http.HttpClient/newBuilder)\n+ (.followRedirects java.net.http.HttpClient$Redirect/NEVER)\n+ (.connectTimeout connect-timeout)\n+ (.build))\n+ b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n+ (doseq [[k v] (or headers {})]\n+ (.header b k v))\n+ (let [req (-> b (.timeout request-timeout) (.GET) (.build))\n+ resp (.send client req (java.net.http.HttpResponse$BodyHandlers/ofString))\n+ loc (first (get (.map (.headers resp)) \"location\"))]\n+ {:status (.statusCode resp) :body (.body resp) :location loc})))\n+\n (defn http-post-json [url data & {:keys [headers]}]\n (let [body (json/generate-string data)\n b (java.net.http.HttpRequest/newBuilder (java.net.URI/create url))]\n@@ -50,6 +65,35 @@\n resp (.send (http-client) req (java.net.http.HttpResponse$BodyHandlers/ofString))]\n {:status (.statusCode resp) :body (.body resp) :headers (.map (.headers resp))})))\n \n+(defn complete-pending-session!\n+ \"Finish OAuth for an existing pending session id (e.g. created by `GET /join/inv_…`). Returns bearer token.\"\n+ [base-url session-id username & {:keys [assert!]}]\n+ (let [check! (fn [pred msg resp]\n+ (if assert!\n+ (assert! pred msg)\n+ (when-not pred\n+ (throw (ex-info msg {:resp resp})))))]\n+ (let [enc (java.net.URLEncoder/encode session-id \"UTF-8\")\n+ login-url (str base-url \"/auth/login?session=\" enc)\n+ login-get (http-get login-url)]\n+ (check! (= 200 (:status login-get))\n+ (str \"oauth redirect chain for session \" session-id)\n+ login-get)\n+ (let [choose (http-post-form (str base-url \"/auth/choose-username\")\n+ {:session session-id :username username})]\n+ (check! (= 200 (:status choose))\n+ (str \"choose-username for \" username \" returns 200\")\n+ choose)\n+ (let [poll (http-get (str base-url \"/api/v0/pending-session/\" session-id))]\n+ (check! (= 200 (:status poll))\n+ (str \"pending-session poll returns 200\")\n+ poll)\n+ (let [poll-json (json/parse-string (:body poll) true)]\n+ (check! (:complete poll-json)\n+ (str \"pending session complete for \" username)\n+ poll)\n+ (:token poll-json)))))))\n+\n (defn parse-query [s]\n (into {}\n (for [part (str/split (or s \"\") #\"&\")\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex a715fe5639f4a3a7bfedcc706b5fb312b98c9ac5..98c66a00fd27803ef6f75b5ac478ff2eb762d771 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -123,13 +123,32 @@ pub struct PathDetailResponse {\n #[derive(Debug, Serialize, Deserialize)]\n pub struct ThreadDetailResponse {\n pub thread: String,\n- pub posts: Vec,\n- /// Total posts in this thread.\n+ /// Chronological page: prose posts and room system lines, oldest first within the window.\n+ pub items: Vec,\n+ /// Total rows (posts + system lines) in this thread after filters.\n pub total: usize,\n- /// Chronological offset of the first post in this page.\n+ /// Offset into the merged chronological list.\n pub offset: usize,\n }\n \n+/// One row in a thread timeline: a normal post or a room system line.\n+#[derive(Debug, Serialize, Deserialize)]\n+#[serde(tag = \"kind\", rename_all = \"snake_case\")]\n+pub enum ThreadItem {\n+ Post {\n+ id: String,\n+ index: usize,\n+ ts: i64,\n+ actor: String,\n+ body: String,\n+ truncated: bool,\n+ },\n+ System {\n+ ts: i64,\n+ text: String,\n+ },\n+}\n+\n /// One post in a thread. Full body, no snippet.\n #[derive(Debug, Serialize, Deserialize)]\n pub struct PostRow {\n@@ -224,6 +243,23 @@ pub struct FeedPost {\n // RPC batch API (`POST /api/v0/rpc`)\n // ---------------------------------------------------------------------------\n \n+fn default_invite_max_uses() -> usize {\n+ 1\n+}\n+\n+/// One principal's capabilities in a private room (from [`RpcCommand::RoomAudit`]).\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditEntry {\n+ pub username: String,\n+ pub capabilities: Vec,\n+}\n+\n+#[derive(Debug, Serialize, Deserialize)]\n+pub struct RoomAuditResponse {\n+ pub room: String,\n+ pub grants: Vec,\n+}\n+\n #[derive(Debug, Serialize, Deserialize)]\n #[serde(transparent)]\n pub struct RpcBatch(pub Vec);\n@@ -287,10 +323,27 @@ pub enum RpcCommand {\n visibility: Option,\n },\n RoomGrant {\n+ room: String,\n+ username: String,\n+ /// Capability names: `view`, `post`, `vote`, `add_item`, `manage`.\n+ capabilities: Vec,\n+ },\n+ RoomRevoke {\n room: String,\n username: String,\n capability: String,\n },\n+ /// Mint a shareable invite link (24h TTL, stored in memory only until redeemed or expiry).\n+ RoomMintInvite {\n+ room: String,\n+ capabilities: Vec,\n+ #[serde(default = \"default_invite_max_uses\")]\n+ max_uses: usize,\n+ },\n+ /// List principals granted access in a room (requires View or Manage).\n+ RoomAudit {\n+ room: String,\n+ },\n GetGlobalRank {\n room: String,\n #[serde(default)]\n@@ -361,6 +414,13 @@ pub enum RpcResult {\n RoomCreated {\n room_id: String,\n },\n+ RoomInviteMinted {\n+ invite_url: String,\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ expires_at_ms: Option,\n+ max_uses: usize,\n+ },\n+ RoomAudit(RoomAuditResponse),\n GrantOk {},\n GlobalRank(GlobalRankResponse),\n Pair(PairResponse),\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor \n\nSide B — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n form_template::template_json_compact,\n html::layout,\n state::AppState,\n- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+ storage_schema::{\n+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+ },\n ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n #[serde(default)]\n pub return_to: Option,\n+ #[serde(default)]\n+ pub error: Option,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n #[serde(default)]\n pub return_to: Option,\n #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n let mut out = Vec::new();\n+ let enc = urlencoding::encode(return_to);\n if oauth::GitHubConfig::from_env(base_url).is_some() {\n out.push((\n- \"GitHub\",\n- format!(\n- \"/auth/github?return_to={}\",\n- urlencoding::encode(return_to)\n- ),\n+ \"github\",\n+ oauth::provider_label(\"github\"),\n+ format!(\"/auth/github?return_to={enc}\"),\n+ ));\n+ }\n+ if oauth::RedditConfig::from_env(base_url).is_some() {\n+ out.push((\n+ \"reddit\",\n+ oauth::provider_label(\"reddit\"),\n+ format!(\"/auth/reddit?return_to={enc}\"),\n ));\n }\n out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+ match code {\n+ Some(\"oauth_taken\") => {\n+ Some(\"that OAuth account is already linked to a different sorter2 account\")\n+ }\n+ Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+ _ => None,\n+ }\n+}\n+\n+fn signed_out_body(\n+ providers: &[(&str, &str, String)],\n+ error: Option<&str>,\n+) -> Markup {\n html! {\n main class=\"panel login-page\" {\n section class=\"login-section\" {\n h1 { \"sign in\" }\n- p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+ p class=\"muted\" {\n+ \"link an OAuth account to create your identity, then claim an alias to vote\"\n+ }\n+ @if let Some(msg) = login_error_message(error) {\n+ p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+ }\n @if providers.is_empty() {\n p class=\"muted\" {\n- \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+ \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n }\n } @else {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in providers {\n li {\n a href=(href) class=\"btn-primary oauth-provider\"\n- data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n- (format!(\"Continue with {name}\"))\n+ data-testid=(format!(\"oauth-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n actor: &session::SessionActor,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ // Provider keys already linked to this UUID (private).\n+ linked: &[String],\n+ // Providers available to link: not yet attached.\n+ unlinkable: &[(&str, &str, String)],\n claim_forms: Markup,\n ) -> Markup {\n let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n (claim_forms)\n }\n \n- @if !providers.is_empty() {\n- section class=\"login-section\" {\n- h2 { \"linked sign-in\" }\n- p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+ section class=\"login-section\" {\n+ h2 { \"linked sign-in\" }\n+ p class=\"muted small\" {\n+ \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+ }\n+ @if linked.is_empty() {\n+ p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+ } @else {\n+ ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+ @for key in linked {\n+ li data-testid=(format!(\"linked-{key}\")) {\n+ (oauth::provider_label(key))\n+ }\n+ }\n+ }\n+ }\n+ @if !unlinkable.is_empty() {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in unlinkable {\n li {\n a href=(href) class=\"btn-secondary oauth-provider\"\n- data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n- (format!(\"Re-link {name}\"))\n+ data-testid=(format!(\"oauth-link-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n session: Option<&session::SessionActor>,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ linked: &[String],\n+ providers: &[(&str, &str, String)],\n claim_forms: Option,\n+ error: Option<&str>,\n ) -> Markup {\n match (session, claim_forms) {\n- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n- _ => signed_out_body(providers),\n+ (Some(actor), Some(forms)) => {\n+ let unlinkable: Vec<_> = providers\n+ .iter()\n+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+ .cloned()\n+ .collect();\n+ account_body(actor, aliases, linked, &unlinkable, forms)\n+ }\n+ _ => signed_out_body(providers, error),\n }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n .as_ref()\n .map(|s| alias_list(db, &s.uuid))\n .unwrap_or_default();\n+ let linked = session\n+ .as_ref()\n+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+ .unwrap_or_default();\n let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n } else {\n \"login · sorter2\"\n },\n- login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+ login_body(\n+ session.as_ref(),\n+ &aliases,\n+ &linked,\n+ &providers,\n+ claim_forms,\n+ query.error.as_deref(),\n+ ),\n state.views.get_views(\"/login\"),\n session\n .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n let db = state.projection_store.db();\n let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n if session::session_has_pseudonym(&session) {\n- // Already onboarded — manage aliases on the account page.\n return Ok(Redirect::to(\"/login\").into_response());\n }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n State(state): State,\n jar: CookieJar,\n- Query(query): Query,\n+ Query(query): Query,\n ) -> Result {\n let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n } else {\n None\n };\n- let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+ let jar = jar\n+ .add(session::oauth_state_cookie_value(&state_token))\n+ .add(session::auth_return_cookie_value(&return_to));\n+ Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+ let state_token = session::new_oauth_state();\n+ let mock_user = if config::mock_oauth_allowed() {\n+ query.mock_user.as_deref()\n+ } else {\n+ None\n+ };\n+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n let jar = jar\n .add(session::oauth_state_cookie_value(&state_token))\n .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n state: &AppState,\n jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n let db = state.projection_store.db();\n let return_to = return_from_query_or_jar(&jar, None);\n \n- let uuid = match oauth_link_owner(db, provider, &provider_id)\n- .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n- {\n- Some(existing) => existing,\n- None => {\n+ let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let session_uuid = session::session_id_from_jar(&jar)\n+ .as_deref()\n+ .and_then(|id| session::load_valid_session(db, id))\n+ .map(|s| s.uuid);\n+ let linking_while_logged_in = session_uuid.is_some();\n+\n+ let uuid = match (session_uuid, existing_owner) {\n+ (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+ (Some(_), Some(_)) => {\n+ return Ok((\n+ jar.add(session::clear_oauth_state_cookie()),\n+ \"/login?error=oauth_taken\".into(),\n+ ));\n+ }\n+ (Some(session_uuid), None) => {\n+ let ts = now_ms();\n+ state\n+ .append_identity_events(vec![Event::OauthLinked {\n+ uuid: session_uuid.clone(),\n+ provider: provider.to_string(),\n+ provider_id,\n+ ts,\n+ }])\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"oauth link append failed\");\n+ StatusCode::INTERNAL_SERVER_ERROR\n+ })?;\n+ session_uuid\n+ }\n+ (None, Some(owner)) => owner,\n+ (None, None) => {\n let uuid = new_actor_uuid();\n let ts = now_ms();\n state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n \"/login/alias?return_to={}\",\n urlencoding::encode(&return_to)\n )\n+ } else if linking_while_logged_in {\n+ // Additional link while already in an account → stay on account page.\n+ \"/login\".to_string()\n } else {\n return_to\n };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n .build()\n .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n- let token = oauth::exchange_code(&client, &cfg, &query.code)\n+ let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github oauth token exchange failed\");\n StatusCode::BAD_GATEWAY\n })?;\n- let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+ let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github user fetch failed\");\n StatusCode::BAD_GATEWAY\n })?;\n \n- let provider = \"github\";\n- let provider_id = oauth::provider_id(&user);\n- let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+ Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+ let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+ if expected_state != query.state {\n+ return Err(StatusCode::BAD_REQUEST);\n+ }\n+\n+ let client = Client::builder()\n+ .timeout(std::time::Duration::from_secs(15))\n+ .build()\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+ let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit user fetch failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+ default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n let mut url = format!(\n \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n client: &Client,\n cfg: &GitHubConfig,\n code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n return Err(format!(\"github token HTTP {}\", resp.status()));\n }\n \n- let body: TokenResponse = resp\n+ let body: GitHubTokenResponse = resp\n .json()\n .await\n .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n client: &Client,\n api_base: &str,\n access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+ pub client_id: String,\n+ pub client_secret: String,\n+ pub redirect_uri: String,\n+ /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+ pub authorize_base: String,\n+ /// Host for `POST /api/v1/access_token`.\n+ pub token_base: String,\n+ /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+ pub api_base: String,\n+ pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+ std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+ .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+ .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+ pub fn from_env(base_url: &str) -> Option {\n+ let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+ .ok()?;\n+ let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+ .ok()?;\n+ if client_id.is_empty() || client_secret.is_empty() {\n+ return None;\n+ }\n+ let base = base_url.trim_end_matches('/');\n+ Some(Self {\n+ client_id,\n+ client_secret,\n+ redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+ authorize_base: reddit_authorize_base(),\n+ token_base: reddit_oauth_token_base(),\n+ api_base: reddit_oauth_api_base(),\n+ user_agent: default_user_agent(),\n+ })\n+ }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+ access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+ /// Stable id (`t2_…`); never use `name` as identity.\n+ pub id: String,\n+ pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+ let mut url = format!(\n+ \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+ cfg.authorize_base.trim_end_matches('/'),\n+ urlencoding::encode(&cfg.client_id),\n+ urlencoding::encode(state),\n+ urlencoding::encode(&cfg.redirect_uri),\n+ );\n+ if let Some(user) = mock_user {\n+ url.push_str(\"&mock_user=\");\n+ url.push_str(&urlencoding::encode(user));\n+ }\n+ url\n+}\n+\n+pub async fn reddit_exchange_code(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ code: &str,\n+) -> Result {\n+ let resp = client\n+ .post(format!(\n+ \"{}/api/v1/access_token\",\n+ cfg.token_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+ .form(&[\n+ (\"grant_type\", \"authorization_code\"),\n+ (\"code\", code),\n+ (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+ ])\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ let status = resp.status();\n+ let body = resp.text().await.unwrap_or_default();\n+ return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+ }\n+\n+ let body: RedditTokenResponse = resp\n+ .json()\n+ .await\n+ .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+ Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ access_token: &str,\n+) -> Result {\n+ let resp = client\n+ .get(format!(\n+ \"{}/api/v1/me\",\n+ cfg.api_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .bearer_auth(access_token)\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+ }\n+\n+ resp.json()\n+ .await\n+ .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+ user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result {\n let trimmed = raw.trim();\n if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result {\n pub fn sanitize_pseudonym(login: &str) -> String {\n validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+ match provider {\n+ \"github\" => \"GitHub\",\n+ \"reddit\" => \"Reddit\",\n+ _ => \"OAuth\",\n+ }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n .route(\"/login/alias\", get(crate::auth::alias_page))\n .route(\"/auth/github\", get(crate::auth::github_start))\n .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+ .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+ .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n .route(\"/auth/logout\", post(crate::auth::logout))\n .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n event_log::EventLogError,\n events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n let db = projection_store.db();\n let mut batch = db.batch();\n let mut last_seq = 0u64;\n+ // Weight reads must see earlier writes in this same batch.\n+ let mut pending_weights: HashMap = HashMap::new();\n \n for record in records {\n match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n ensure_path_writes(&mut batch, &parsed);\n }\n Event::PrincipalCreated { uuid, .. } => {\n+ pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n batch.write(\n Store::root()\n .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n }\n } else {\n batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n- let current = Store::root()\n- .user_weights()\n- .key(&uuid.clone())\n- .get(db)\n- .map_err(|e| EventLogError::Apply(e.to_string()))?\n+ let current = pending_weights\n+ .get(uuid)\n+ .copied()\n+ .or_else(|| {\n+ Store::root()\n+ .user_weights()\n+ .key(&uuid.clone())\n+ .get(db)\n+ .ok()\n+ .flatten()\n+ })\n .unwrap_or(BASE_TRUST_WEIGHT);\n+ let next = trust_weight_after_link(current);\n+ pending_weights.insert(uuid.clone(), next);\n batch.write(\n Store::root()\n .user_weights()\n .key(&uuid.clone())\n- .set(&trust_weight_after_link(current)),\n+ .set(&next),\n );\n }\n }\n@@ -205,6 +218,15 @@ mod tests {\n ),\n record(\n 3,\n+ Event::OauthLinked {\n+ uuid: uuid.into(),\n+ provider: \"reddit\".into(),\n+ provider_id: \"t2_abc\".into(),\n+ ts,\n+ },\n+ ),\n+ record(\n+ 4,\n Event::PseudonymClaimed {\n uuid: uuid.into(),\n pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n Some(uuid.to_string())\n );\n+ assert_eq!(\n+ crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+ vec![\"github\".to_string(), \"reddit\".to_string()]\n+ );\n assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n- assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+ assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n let aliases = Store::root()\n .user_pseudonyms()\n .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result> {\n+ let mut providers = Vec::new();\n+ for (key, owner) in Store::root().oauth_links().iter(db)? {\n+ if owner != uuid {\n+ continue;\n+ }\n+ let Some((provider, _)) = key.split_once(':') else {\n+ continue;\n+ };\n+ if !providers.iter().any(|p| p == provider) {\n+ providers.push(provider.to_string());\n+ }\n+ }\n+ providers.sort();\n+ Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+ ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+ \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n- \"REDDIT_CLIENT_ID\" \"\"\n- \"REDDIT_CLIENT_SECRET\" \"\"\n- \"REDDIT_APP_ID\" \"\"\n- \"REDDIT_APP_SECRET\" \"\"}))\n+ \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n- \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+ \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n (:require [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+ \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+ [raw]\n (let [s (or raw \"1002:newbie\")\n [id login] (str/split s #\":\" 2)]\n- {:id (Long/parseLong id)\n- :login (or login \"newbie\")}))\n+ {:id id\n+ :login (or login \"newbie\")\n+ :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n (.sendResponseHeaders ex 302 -1)\n (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n (let [body (slurp (.getInputStream ex))]\n- (query-param body \"code\")))\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n (when (str/starts-with? token \"mock:\")\n (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ mock-user (query-param query \"mock_user\")\n+ user (parse-mock-user mock-user)\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n- \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+ \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n [port]\n (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n handler\n@@ -53,28 +67,45 @@\n (handle [^HttpExchange exchange]\n (let [uri (.getRequestURI exchange)\n path (.getPath uri)\n- query (.getQuery uri)]\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n (cond\n+ ;; GitHub authorize\n (str/ends-with? path \"/login/oauth/authorize\")\n- (let [redirect-uri (query-param query \"redirect_uri\")\n- state (query-param query \"state\")\n- mock-user (query-param query \"mock_user\")\n- user (parse-mock-user mock-user)\n- code (str \"mock:\" (:id user) \":\" (:login user))\n- loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n- \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n- (send-redirect exchange loc))\n+ (authorize-redirect exchange query)\n+\n+ ;; Reddit authorize\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (authorize-redirect exchange query)\n \n- (str/ends-with? path \"/login/oauth/access_token\")\n- (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+ ;; GitHub token\n+ (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+ (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+ ;; Reddit token (client_credentials for import + authorization_code for login)\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ ;; GitHub user\n (= path \"/user\")\n (let [token (bearer-token exchange)\n- user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+ user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n (send-json exchange 200\n (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+ ;; Reddit /api/v1/me\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [token (bearer-token exchange)\n+ user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n :else\n (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n- \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+ \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n (:require [clojure.java.io :as io]\n [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n- [java.net InetSocketAddress]))\n+ [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n ([] (fixtures-dir (System/getProperty \"user.dir\")))\n ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+ (when query\n+ (some (fn [pair]\n+ (let [[k v] (str/split pair \"=\" 2)]\n+ (when (= k key)\n+ (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+ (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+ (let [s (or raw \"t2_test:redditor\")\n+ [id login] (str/split s #\":\" 2)]\n+ {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+ (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+ (.sendResponseHeaders ex status (alength body))\n+ (doto (.getResponseBody ex)\n+ (.write body)\n+ (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+ (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+ (.set (.getResponseHeaders ex) \"Location\" location)\n+ (.sendResponseHeaders ex 302 -1)\n+ (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+ (let [body (slurp (.getInputStream ex))]\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+ (some-> (.getRequestHeaders ex)\n+ (.getFirst \"Authorization\")\n+ (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+ (when (str/starts-with? token \"mock:\")\n+ (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n handler\n (proxy [HttpHandler] []\n (handle [^HttpExchange exchange]\n- ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n- (let [path (.getPath (.getRequestURI exchange))\n- body (if (str/includes? path \"/about\")\n- about\n- listing)]\n- (.sendResponseHeaders exchange 200 (alength body))\n- (let [out (.getResponseBody exchange)]\n- (.write out body)\n- (.close out)))))]\n+ (let [uri (.getRequestURI exchange)\n+ path (.getPath uri)\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n+ (cond\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ user (parse-mock-user (query-param query \"mock_user\"))\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc))\n+\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [user (or (parse-token-user (bearer-token exchange))\n+ {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+ ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n+ :else\n+ (let [body (if (str/includes? path \"/about\") about listing)]\n+ (send-bytes exchange 200 body \"application/json\"))))))]\n (.createContext server \"/\" handler)\n (.setExecutor server nil)\n (.start server)\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}