{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[8d5328d3] -theme\n\nSide A — unified diff (full patch):\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 82b2aa51d21ada1d0d849d3ddfc3a81e4241d861..e74e42e0f0ffc4224f5ef5421b486a5f35434999 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -73,11 +73,7 @@ pub async fn post_ui_html(\n ensure_partial_tree(&mut tree, &item);\n }\n let _ = state.ensure_node(&item).await;\n- let dest = if item.is_root() {\n- \"/\".to_string()\n- } else {\n- format!(\"/?item={}\", item.as_str())\n- };\n+ let dest = item.browse_href();\n JsBuilder::new()\n .raw(&format!(\n \"window.location.href={};\",\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex c973cb718ac74b95570dabea76e24459417790b9..a8353c6de0cd6d268219e552b7ca1ba4e3000585 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -1,13 +1,10 @@\n use axum::{\n body::Body,\n extract::{Path, State},\n- http::{header, HeaderValue, StatusCode, Uri},\n+ http::{header, StatusCode, Uri},\n response::{IntoResponse, Response},\n- Form,\n };\n-use axum_extra::extract::cookie::CookieJar;\n use maud::{html, Markup, DOCTYPE};\n-use serde::Deserialize;\n \n use crate::{\n form_template::template_json_compact,\n@@ -15,96 +12,25 @@ use crate::{\n path_types::ItemId,\n ranking::{top_bottom, RankedItem},\n reducer::{GroupState, NodeState},\n- state::{parse_item_param, AppState},\n+ state::AppState,\n ui_action::UI_RPC_FIELD,\n };\n \n-const THEME_DEFAULT_CSS: &str = include_str!(\"../../static/theme_default.css\");\n-const THEME_RETRO_CSS: &str = include_str!(\"../../static/theme_retro.css\");\n+const SORTER_CSS: &str = include_str!(\"../../static/sorter.css\");\n const SORTER_UI_JS: &str = include_str!(\"../../static/sorter_ui.js\");\n \n-pub const SORTER_THEME_COOKIE: &str = \"sorter-theme\";\n-\n-pub fn normalize_theme(raw: &str) -> &'static str {\n- match raw {\n- \"retro\" => \"retro\",\n- _ => \"default\",\n- }\n-}\n-\n-pub fn theme_from_jar(jar: &CookieJar) -> &'static str {\n- jar.get(SORTER_THEME_COOKIE)\n- .map(|c| normalize_theme(c.value()))\n- .unwrap_or(\"default\")\n-}\n-\n-pub fn theme_next_from_uri(uri: &Uri) -> String {\n- uri.path_and_query()\n- .map(|pq| pq.as_str().to_string())\n- .filter(|s| !s.is_empty())\n- .unwrap_or_else(|| \"/\".to_string())\n-}\n-\n-pub fn theme_cookie_header_value(theme: &str) -> HeaderValue {\n- let t = normalize_theme(theme);\n- let s = format!(\"{SORTER_THEME_COOKIE}={t}; Path=/; SameSite=Lax; Max-Age=31536000\");\n- HeaderValue::from_str(&s).expect(\"theme cookie must be ASCII\")\n-}\n-\n-fn sanitize_theme_next(next: Option<&str>) -> String {\n- let s = next.unwrap_or(\"/\").trim();\n- if s.starts_with('/') && !s.starts_with(\"//\") && s.len() < 8192 {\n- s.to_string()\n- } else {\n- \"/\".to_string()\n- }\n-}\n-\n-#[derive(Debug, Deserialize)]\n-pub struct ThemeForm {\n- theme: String,\n- next: Option,\n-}\n-\n-pub async fn post_theme(Form(form): Form) -> impl IntoResponse {\n- let theme = normalize_theme(&form.theme);\n- let next = sanitize_theme_next(form.next.as_deref());\n- let loc =\n- HeaderValue::try_from(next.as_str()).unwrap_or_else(|_| HeaderValue::from_static(\"/\"));\n- Response::builder()\n- .status(StatusCode::SEE_OTHER)\n- .header(header::LOCATION, loc)\n- .header(header::SET_COOKIE, theme_cookie_header_value(theme))\n- .body(Body::empty())\n- .expect(\"theme redirect response\")\n-}\n-\n pub async fn serve_static(Path(filename): Path) -> impl IntoResponse {\n- if filename == \"sorter_ui.js\" {\n- return Response::builder()\n- .status(StatusCode::OK)\n- .header(header::CONTENT_TYPE, \"text/javascript; charset=utf-8\")\n- .header(header::CACHE_CONTROL, \"public, max-age=3600\")\n- .body(SORTER_UI_JS.to_string())\n- .unwrap()\n- .into_response();\n- }\n-\n- let theme = filename\n- .strip_prefix(\"theme_\")\n- .and_then(|s| s.strip_suffix(\".css\"));\n-\n- let css = match theme {\n- Some(\"default\") => THEME_DEFAULT_CSS,\n- Some(\"retro\") => THEME_RETRO_CSS,\n+ let (content_type, body) = match filename.as_str() {\n+ \"sorter.css\" => (\"text/css; charset=utf-8\", SORTER_CSS),\n+ \"sorter_ui.js\" => (\"text/javascript; charset=utf-8\", SORTER_UI_JS),\n _ => return (StatusCode::NOT_FOUND, \"static file not found\").into_response(),\n };\n \n Response::builder()\n .status(StatusCode::OK)\n- .header(header::CONTENT_TYPE, \"text/css; charset=utf-8\")\n+ .header(header::CONTENT_TYPE, content_type)\n .header(header::CACHE_CONTROL, \"public, max-age=3600\")\n- .body(css.to_string())\n+ .body(body.to_string())\n .unwrap()\n .into_response()\n }\n@@ -162,8 +88,7 @@ fn asset_version() -> &'static str {\n V.get_or_init(|| {\n use std::hash::{Hash, Hasher};\n let mut h = std::collections::hash_map::DefaultHasher::new();\n- THEME_DEFAULT_CSS.hash(&mut h);\n- THEME_RETRO_CSS.hash(&mut h);\n+ SORTER_CSS.hash(&mut h);\n SORTER_UI_JS.hash(&mut h);\n format!(\"{:x}\", h.finish())\n })\n@@ -176,9 +101,9 @@ pub fn now_ms() -> i64 {\n t.as_millis() as i64\n }\n \n-fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str) -> Markup {\n+fn layout(title: &str, body: Markup, views: u64) -> Markup {\n let ver = asset_version();\n- let css_href = format!(\"/static/theme_{theme}.css?v={ver}\");\n+ let css_href = format!(\"/static/sorter.css?v={ver}\");\n let js_src = format!(\"/static/sorter_ui.js?v={ver}\");\n html! {\n (DOCTYPE)\n@@ -187,7 +112,7 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str)\n meta charset=\"utf-8\";\n meta name=\"viewport\" content=\"width=device-width, initial-scale=1\";\n title { (title) }\n- link rel=\"stylesheet\" href=(css_href) id=\"theme-stylesheet\";\n+ link rel=\"stylesheet\" href=(css_href);\n script src=\"https://unpkg.com/idiomorph@0.3.0/dist/idiomorph.min.js\" {}\n }\n body class=\"home\" {\n@@ -196,21 +121,6 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str)\n }\n div id=\"errors\" {}\n (body)\n- div id=\"controls\" {\n- a href=\"https://github.com/sortersocial/sorter2\" id=\"src-link\" { \"src\" }\n- form id=\"sorter-theme-form\" method=\"post\" action=\"/theme\" data-navigate=\"full\" {\n- input type=\"hidden\" name=\"next\" value=(theme_next);\n- select id=\"theme-select\" name=\"theme\" onchange=\"this.form.submit()\" aria-label=\"Theme\" {\n- @for (val, label) in [(\"default\", \"default\"), (\"retro\", \"retro\")] {\n- @if theme == val {\n- option value=(val) selected { (label) }\n- } @else {\n- option value=(val) { (label) }\n- }\n- }\n- }\n- }\n- }\n script src=(js_src) {}\n }\n }\n@@ -218,11 +128,7 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str)\n }\n \n fn item_href(id: &ItemId) -> String {\n- if id.is_root() {\n- \"/\".to_string()\n- } else {\n- format!(\"/?item={}\", id.as_str())\n- }\n+ id.browse_href()\n }\n \n fn segment_label(seg: &str) -> &str {\n@@ -361,39 +267,10 @@ pub fn vote_panel(parent: &ItemId) -> Markup {\n }\n \n \n-fn query_param(uri: &Uri, key: &str) -> Option {\n- let q = uri.query()?;\n- q.split('&').find_map(|pair| {\n- let mut it = pair.splitn(2, '=');\n- if it.next()? == key {\n- Some(it.next().unwrap_or(\"\").to_string())\n- } else {\n- None\n- }\n- })\n-}\n-\n-pub async fn home(\n- State(state): State,\n- jar: CookieJar,\n- uri: Uri,\n-) -> impl IntoResponse {\n+async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup {\n let path = uri.path().to_string();\n state.views.increment(path.clone());\n let views = state.views.get_views(&path);\n- let theme = theme_from_jar(&jar);\n- let theme_next = theme_next_from_uri(&uri);\n-\n- let item_raw = query_param(&uri, \"item\")\n- .or_else(|| query_param(&uri, \"sub\").map(|sub| {\n- if sub.is_empty() {\n- String::new()\n- } else {\n- format!(\"reddit.com/r/{sub}\")\n- }\n- }))\n- .unwrap_or_default();\n- let item = parse_item_param(&item_raw);\n \n let tree = state.tree.read().await;\n let empty_node = NodeState::default();\n@@ -408,5 +285,14 @@ pub async fn home(\n (vote_panel(&item))\n (ranking_panel(&item, group))\n };\n- layout(\"sorter2\", body, views, theme, &theme_next)\n+ layout(\"sorter2\", body, views)\n+}\n+\n+pub async fn home(State(state): State, uri: Uri) -> impl IntoResponse {\n+ item_page(state, uri, ItemId::root()).await\n+}\n+\n+pub async fn browse(State(state): State, uri: Uri) -> impl IntoResponse {\n+ let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());\n+ item_page(state, uri, item).await\n }\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 14e7cfbc38feb5d07aff859b64bce6e2ec45cf91..cd56743192919cf4dcea539b3d8873a21fb7e72b 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -30,9 +30,9 @@ pub fn create_app(state: AppState) -> Router {\n Router::new()\n .route(\"/healthz\", get(|| async { \"ok\" }))\n .route(\"/static/:filename\", get(crate::html::serve_static))\n+ .route(\"/~/*item_path\", get(crate::html::browse))\n .route(\"/\", get(crate::html::home))\n .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\n- .route(\"/theme\", post(crate::html::post_theme))\n .with_state(state)\n .layer(TraceLayer::new_for_http())\n }\ndiff --git a/server/src/path_types.rs b/server/src/path_types.rs\nindex b5c41444f7bcd4d8d289ed3af464bc3f14d0df99..12dce9888f5cd4e1a0974d12d6468368d0f775b9 100644\n--- a/server/src/path_types.rs\n+++ b/server/src/path_types.rs\n@@ -90,6 +90,50 @@ impl ItemId {\n paths\n }\n \n+ /// Full URL for the browser location bar after `/~/`.\n+ pub fn to_browse_url(&self) -> String {\n+ if self.is_root() {\n+ return String::new();\n+ }\n+ if self.as_str().contains(\"://\") {\n+ return self.as_str().to_string();\n+ }\n+ if self\n+ .segments()\n+ .first()\n+ .is_some_and(|s| s.contains('.'))\n+ {\n+ format!(\"https://{}\", self.as_str())\n+ } else {\n+ self.as_str().to_string()\n+ }\n+ }\n+\n+ /// App route, e.g. `/~/https://reddit.com/r/rust`.\n+ pub fn browse_href(&self) -> String {\n+ if self.is_root() {\n+ \"/\".to_string()\n+ } else {\n+ format!(\"/~/{}\", self.to_browse_url())\n+ }\n+ }\n+\n+ /// Parse the tail after `/~/` in a request path.\n+ pub fn from_browse_tail(tail: &str) -> ItemId {\n+ let raw = normalize_browse_tail(tail);\n+ if raw.is_empty() {\n+ return ItemId::root();\n+ }\n+ ItemId::from_url(&raw)\n+ .or_else(|| ItemId::parse(&raw))\n+ .unwrap_or_else(|| ItemId::opaque(raw))\n+ }\n+\n+ pub fn from_browse_uri(path: &str) -> Option {\n+ path.strip_prefix(\"/~/\")\n+ .map(ItemId::from_browse_tail)\n+ }\n+\n fn canonicalize(raw: &str) -> Option {\n let s = raw.trim();\n if s.is_empty() {\n@@ -155,6 +199,21 @@ fn normalize_host(host: &str) -> String {\n }\n }\n \n+fn normalize_browse_tail(tail: &str) -> String {\n+ let t = tail.trim();\n+ if t.is_empty() {\n+ return String::new();\n+ }\n+ // Some HTTP stacks collapse `https://` → `https:/` inside a path segment.\n+ if t.starts_with(\"https:/\") && !t.starts_with(\"https://\") {\n+ return format!(\"https://{}\", &t[7..]);\n+ }\n+ if t.starts_with(\"http:/\") && !t.starts_with(\"http://\") {\n+ return format!(\"http://{}\", &t[6..]);\n+ }\n+ t.to_string()\n+}\n+\n fn normalize_reddit_host_path(s: &str) -> String {\n let (host, path) = s.split_once('/').unwrap_or((s, \"\"));\n let host = normalize_host(host);\n@@ -252,4 +311,22 @@ mod tests {\n );\n assert!(ItemId::from_legacy_scope(\"\").is_root());\n }\n+\n+ #[test]\n+ fn browse_href_wraps_canonical_path() {\n+ let id = ItemId::parse(\"reddit.com/r/rust\").unwrap();\n+ assert_eq!(id.browse_href(), \"/~/https://reddit.com/r/rust\");\n+ }\n+\n+ #[test]\n+ fn from_browse_tail_parses_full_url() {\n+ let id = ItemId::from_browse_tail(\"https://reddit.com/r/AmITheAsshole\");\n+ assert_eq!(id.as_str(), \"reddit.com/r/amitheasshole\");\n+ }\n+\n+ #[test]\n+ fn from_browse_uri_strips_prefix() {\n+ let id = ItemId::from_browse_uri(\"/~/https://reddit.com/r/rust\").unwrap();\n+ assert_eq!(id.as_str(), \"reddit.com/r/rust\");\n+ }\n }\ndiff --git a/server/static/sorter_ui.js b/server/static/sorter_ui.js\nindex 9c475d8e076ba527aaf7a25c177d0d651bd46ca9..d9b016f197547f37ca4b2bcdd7ee6b673d0fb3f0 100644\n--- a/server/static/sorter_ui.js\n+++ b/server/static/sorter_ui.js\n@@ -24,7 +24,6 @@\n var f = e.target;\n if (!f || f.tagName !== 'FORM') return;\n if ((f.method || 'get').toLowerCase() !== 'post') return;\n- if (f.id === 'sorter-theme-form') return;\n if (f.getAttribute('data-navigate') === 'full') return;\n e.preventDefault();\n await postUiForm(f);\ndiff --git a/server/static/theme_default.css b/server/static/theme_default.css\ndeleted file mode 100644\nindex 1bf8ac7a25207336c019f93cd4119bd0e06229f0..0000000000000000000000000000000000000000\n--- a/server/static/theme_default.css\n+++ /dev/null\n@@ -1,186 +0,0 @@\n-:root {\n- --bg: #0f1115;\n- --fg: #e8eaed;\n- --muted: #9aa0a6;\n- --accent: #7cacf8;\n- --panel: #1a1d24;\n- --border: #2a2f3a;\n-}\n-\n-* {\n- box-sizing: border-box;\n-}\n-\n-body {\n- margin: 0;\n- font-family: system-ui, -apple-system, sans-serif;\n- background: var(--bg);\n- color: var(--fg);\n- line-height: 1.5;\n-}\n-\n-.muted {\n- color: var(--muted);\n-}\n-\n-.small {\n- font-size: 0.875rem;\n-}\n-\n-.view-meta {\n- position: fixed;\n- top: 0.5rem;\n- right: 0.5rem;\n- font-size: 0.75rem;\n-}\n-\n-#controls {\n- position: fixed;\n- bottom: 0;\n- left: 0;\n- right: 0;\n- display: flex;\n- gap: 1rem;\n- align-items: center;\n- padding: 0.75rem 1rem;\n- background: var(--panel);\n- border-top: 1px solid var(--border);\n- font-size: 0.875rem;\n-}\n-\n-#controls a {\n- color: var(--accent);\n-}\n-\n-.demo-panel {\n- max-width: 40rem;\n- margin: 4rem auto 6rem;\n- padding: 2rem;\n- background: var(--panel);\n- border: 1px solid var(--border);\n- border-radius: 8px;\n-}\n-\n-.demo-panel h1 {\n- margin-top: 0;\n-}\n-\n-.btn-primary {\n- background: var(--accent);\n- color: #0f1115;\n- border: none;\n- padding: 0.5rem 1rem;\n- border-radius: 4px;\n- font-size: 1rem;\n- cursor: pointer;\n-}\n-\n-.btn-primary:hover {\n- filter: brightness(1.1);\n-}\n-\n-code {\n- font-size: 0.85em;\n- background: var(--bg);\n- padding: 0.1em 0.35em;\n- border-radius: 3px;\n-}\n-\n-.vote-fields {\n- display: flex;\n- flex-direction: column;\n- gap: 0.75rem;\n- margin-bottom: 1rem;\n-}\n-\n-.vote-fields label {\n- display: flex;\n- flex-direction: column;\n- gap: 0.25rem;\n-}\n-\n-.vote-fields input {\n- padding: 0.4rem 0.5rem;\n- border: 1px solid var(--border);\n- border-radius: 4px;\n- background: var(--bg);\n- color: var(--fg);\n-}\n-\n-.rank-list {\n- margin: 0;\n- padding-left: 0;\n- list-style: none;\n-}\n-\n-.rank-list li {\n- margin-bottom: 0.35rem;\n-}\n-\n-.rank-num {\n- color: var(--muted);\n-}\n-\n-#parser-input {\n- width: 100%;\n- padding: 0.5rem;\n- border: 1px solid var(--border);\n- border-radius: 4px;\n- background: var(--bg);\n- color: var(--fg);\n- font-size: 1rem;\n- font-family: inherit;\n- resize: vertical;\n-}\n-\n-#parser-form .btn-primary {\n- margin-top: 0.5rem;\n-}\n-\n-.breadcrumbs {\n- font-size: 0.875rem;\n- margin-bottom: 1rem;\n- color: var(--muted);\n-}\n-\n-.breadcrumbs a {\n- color: var(--accent);\n- text-decoration: none;\n-}\n-\n-.breadcrumbs a:hover {\n- text-decoration: underline;\n-}\n-\n-.breadcrumbs .separator {\n- color: var(--muted);\n-}\n-\n-.rank-list a {\n- color: var(--accent);\n- text-decoration: none;\n-}\n-\n-.rank-list a:hover {\n- text-decoration: underline;\n-}\n-\n-.entity-card h2 {\n- margin-top: 0;\n-}\n-\n-.scope-name {\n- color: var(--accent);\n- font-weight: 600;\n-}\n-\n-.rank-heading {\n- margin: 0.75rem 0 0.25rem;\n- text-transform: uppercase;\n- letter-spacing: 0.04em;\n-}\n-\n-.rank-gap {\n- text-align: center;\n- margin: 0.25rem 0;\n-}\ndiff --git a/server/static/theme_retro.css b/server/static/theme_retro.css\ndeleted file mode 100644\nindex ceee99494b873a6e658857be97f02ee739db85e9..0000000000000000000000000000000000000000\n--- a/server/static/theme_retro.css\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-@import url(\"/static/theme_default.css\");\n-\n-:root {\n- --accent: #f4a261;\n-}\ndiff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs\nindex f7ac9c26bf9f9277ad5f5708603224c095165fb8..df7d9ab357531c5146d0b326c149fdaa6b531a4a 100644\n--- a/server/tests/integration_ui.rs\n+++ b/server/tests/integration_ui.rs\n@@ -70,6 +70,22 @@ async fn post_ui_record_vote_morphs_ranking_and_persists() {\n assert_eq!(ranked[0].item.as_str(), \"alpha\");\n }\n \n+#[tokio::test]\n+async fn browse_url_renders_subreddit_page() {\n+ let (addr, _tmp) = start_test_server().await;\n+ let client = reqwest::Client::new();\n+ let html = client\n+ .get(format!(\"http://{addr}/~/https://reddit.com/r/rust\"))\n+ .send()\n+ .await\n+ .unwrap()\n+ .text()\n+ .await\n+ .unwrap();\n+ assert!(html.contains(\"ranking-panel\"));\n+ assert!(html.contains(\"/~/https://reddit.com/r/rust\"));\n+}\n+\n #[tokio::test]\n async fn post_ui_parse_query_redirects_to_subreddit() {\n let (addr, _tmp) = start_test_server().await;\n@@ -93,5 +109,5 @@ async fn post_ui_parse_query_redirects_to_subreddit() {\n .unwrap();\n \n assert!(body.contains(\"window.location.href\"));\n- assert!(body.contains(\"/?item=reddit.com/r/rust\"));\n+ assert!(body.contains(\"/~/https://reddit.com/r/rust\"));\n }\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[c3cbcaa7] refactor\n\nSide B — unified diff (full patch):\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex b3631b06153d52f88348fef927e7a024b7b85ad6..cd556eb89e9dd8203eba6c8969ffd144db5d329d 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -71,6 +71,24 @@ pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &Reduce\n verify_token(reduced, c.value()).ok()\n }\n \n+/// Browser session: principal + bearer token string (same shape as CLI session cookie).\n+#[derive(Debug, Clone)]\n+pub struct WebSession {\n+ pub username: String,\n+ pub bearer: String,\n+}\n+\n+/// Resolve username and bearer together for `POST /ui` dispatch (one read of headers + jar).\n+pub fn resolve_web_session(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option {\n+ let username = optional_principal(headers, jar, reduced)?;\n+ let bearer = headers\n+ .get(header::AUTHORIZATION)\n+ .and_then(|v| v.to_str().ok())\n+ .and_then(|s| s.strip_prefix(\"Bearer \").map(|t| t.trim().to_string()))\n+ .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()))?;\n+ Some(WebSession { username, bearer })\n+}\n+\n fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str, jar: &CookieJar) -> Response {\n let mut res = Response::builder()\n .status(StatusCode::TEMPORARY_REDIRECT)\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex a986f706ea4b261cbaf004c02b4cf84184b41371..4e223a7460997c464706dca850281447bd754ed5 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -4,7 +4,6 @@ mod rpc;\n mod stream;\n mod validate;\n mod ui_html;\n-mod web_post;\n \n pub use auth::{\n get_join_invite,\n@@ -19,7 +18,9 @@ pub use auth::{\n get_web_login,\n get_logout,\n optional_principal,\n+ resolve_web_session,\n session_cookie_header_value,\n+ WebSession,\n SLUG_SESSION_COOKIE,\n };\n \n@@ -35,7 +36,6 @@ pub use stream::{get_html_stream, get_stream};\n pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};\n \n pub use ui_html::post_ui_html;\n-pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact};\n \n #[cfg(test)]\n mod tests {\ndiff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs\nindex 2b40a72059981d558768f73d189b991f3448c257..497f8fdd222a8ec7c3d76b0695e0352e973ca3ba 100644\n--- a/server/src/api/ui_html.rs\n+++ b/server/src/api/ui_html.rs\n@@ -1,25 +1,29 @@\n-//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes).\n+//! Single `POST /ui` entry: parse `__rpc__` → [`HtmlUiAction`], resolve [`WebSession`] once, dispatch.\n \n use axum::{\n- body::Body,\n+ body,\n extract::State,\n- http::{header, HeaderMap, StatusCode},\n+ http::{header, HeaderMap, HeaderValue, StatusCode},\n response::{IntoResponse, Response},\n Form,\n };\n use axum_extra::extract::cookie::CookieJar;\n+use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult};\n use std::collections::HashMap;\n \n use crate::{\n api::{\n- auth::optional_principal,\n- web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm},\n+ auth::{resolve_web_session, WebSession},\n+ handle_rpc_batch,\n+ rpc::{rpc_post_redact, rpc_post_with_bearer},\n },\n+ canonical_path::canonicalize_tag,\n html::{\n fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup,\n- parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder,\n- ThreadNav,\n+ parse_html_ui_from_form, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup,\n+ user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav,\n },\n+ reducer::{scope_from_room_wire, ScopeId},\n state::AppState,\n };\n \n@@ -34,6 +38,19 @@ pub async fn post_ui_html(\n Err(e) => return ui_js_warn(&e.to_string()).into_response(),\n };\n \n+ let reduced = state.reduced.read().await;\n+ let session = resolve_web_session(&headers, &jar, &reduced);\n+ drop(reduced);\n+\n+ dispatch_ui_action(&state, session.as_ref(), action).await\n+}\n+\n+/// All UI command logic: HTTP extractors stop above; this only sees [`AppState`], session, and [`HtmlUiAction`].\n+async fn dispatch_ui_action(\n+ state: &AppState,\n+ session: Option<&WebSession>,\n+ action: HtmlUiAction,\n+) -> Response {\n match action {\n HtmlUiAction::PostIngest {\n room,\n@@ -42,47 +59,87 @@ pub async fn post_ui_html(\n error_target,\n form_id,\n } => {\n- run_post_web_ingest(\n- &state,\n- &headers,\n- &jar,\n- WebPostForm {\n- room,\n- thread_tag,\n- text,\n- error_target,\n- form_id,\n- },\n- )\n- .await\n+ let Some(session) = session else {\n+ return js_redirect(\"/login\").into_response();\n+ };\n+ let room = room.trim().to_string();\n+ let thread_tag = thread_tag.trim().to_string();\n+ if text.trim().is_empty() {\n+ return form_js_error(\n+ error_target.as_ref(),\n+ \"empty post\",\n+ \"Write something in the text area (DSL / prose).\",\n+ )\n+ .into_response();\n+ }\n+ match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await {\n+ Ok(RpcResult::PostOk { .. }) => {\n+ post_success_response(\n+ state,\n+ &room,\n+ &thread_tag,\n+ error_target.as_ref(),\n+ form_id.as_ref(),\n+ Some(session.username.as_str()),\n+ )\n+ .await\n+ .into_response()\n+ }\n+ Ok(_) => form_js_error(\n+ error_target.as_ref(),\n+ \"unexpected response\",\n+ \"Post did not return PostOk.\",\n+ )\n+ .into_response(),\n+ Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or(\"\")).into_response(),\n+ }\n }\n HtmlUiAction::CheckIngest {\n room,\n thread_tag,\n text,\n error_target,\n- form_id,\n+ form_id: _,\n } => {\n- run_check_web_ingest(\n- &state,\n- &headers,\n- &jar,\n- WebPostForm {\n- room,\n- thread_tag,\n- text,\n- error_target,\n- form_id,\n- },\n- )\n- .await\n+ let Some(session) = session else {\n+ return js_redirect(\"/login\").into_response();\n+ };\n+ let room = room.trim().to_string();\n+ let thread_tag = canonicalize_tag(&thread_tag);\n+ if thread_tag.is_empty() {\n+ return form_js_error(\n+ error_target.as_ref(),\n+ \"missing thread tag\",\n+ \"Set a thread tag before posting.\",\n+ )\n+ .into_response();\n+ }\n+ if text.trim().is_empty() {\n+ return js_clear_errors(&form_error_target(error_target.as_ref())).into_response();\n+ }\n+ match rpc_check_with_bearer(state, &session.bearer, room, text.clone()).await {\n+ Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(error_target.as_ref())).into_response(),\n+ Ok(_) => form_js_error(error_target.as_ref(), \"unexpected response\", \"Check did not return CheckOk.\").into_response(),\n+ Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or(\"\")).into_response(),\n+ }\n }\n HtmlUiAction::RedactPost { post_id } => {\n- run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await\n+ let Some(session) = session else {\n+ return js_redirect(\"/login\").into_response();\n+ };\n+ let h = headers_from_bearer(&session.bearer);\n+ match rpc_post_redact(state, &h, post_id).await {\n+ Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(),\n+ Ok(_) => (StatusCode::BAD_REQUEST, \"unexpected response\").into_response(),\n+ Err((msg, hint)) => {\n+ let detail = hint.as_deref().unwrap_or(\"\");\n+ js_error(\"#errors\", &msg, detail).into_response()\n+ }\n+ }\n }\n HtmlUiAction::ExpandPublicNewThreadForm => {\n let reduced = state.reduced.read().await;\n- let user = optional_principal(&headers, &jar, &reduced);\n+ let user = session.map(|s| s.username.as_str());\n drop(reduced);\n let markup = if user.is_some() {\n fragment_public_new_thread_form(true)\n@@ -99,18 +156,18 @@ pub async fn post_ui_html(\n return ui_js_warn(\"missing room\").into_response();\n }\n let reduced = state.reduced.read().await;\n- let user = optional_principal(&headers, &jar, &reduced);\n+ let user = session.map(|s| s.username.as_str());\n if !reduced.rooms.contains(&room_wire) {\n drop(reduced);\n return ui_js_warn(\"room not found\").into_response();\n }\n- if !user_can_view_room(&reduced, &room_wire, user.as_deref()) {\n+ if !user_can_view_room(&reduced, &room_wire, user) {\n drop(reduced);\n return ui_js_warn(\"forbidden\").into_response();\n }\n- let can_post = user\n+ let can_post = session\n .as_ref()\n- .map(|u| user_can_post_room(&reduced, &room_wire, u))\n+ .map(|s| user_can_post_room(&reduced, &room_wire, &s.username))\n .unwrap_or(false);\n drop(reduced);\n let Some(nav) = ThreadNav::from_room_id(&room_wire) else {\n@@ -128,12 +185,195 @@ pub async fn post_ui_html(\n }\n }\n \n+fn headers_from_bearer(bearer: &str) -> HeaderMap {\n+ let mut headers = HeaderMap::new();\n+ if let Ok(hv) = HeaderValue::from_str(&format!(\"Bearer {bearer}\")) {\n+ headers.insert(header::AUTHORIZATION, hv);\n+ }\n+ headers\n+}\n+\n+fn post_redirect_location(room: &str, thread_tag: &str) -> String {\n+ let tag = canonicalize_tag(thread_tag);\n+ if room.trim() == \"public\" {\n+ format!(\"/t/{tag}\")\n+ } else {\n+ let room = room.trim();\n+ let Some((a, b)) = room.split_once('/') else {\n+ return \"/\".to_string();\n+ };\n+ format!(\"/r/{a}/{b}/t/{tag}\")\n+ }\n+}\n+\n+fn js_quote(s: &str) -> String {\n+ serde_json::to_string(s).expect(\"js string escaping must succeed\")\n+}\n+\n+fn js_redirect(to: &str) -> Response {\n+ let js = format!(\"window.location = {};\", js_quote(to));\n+ Response::builder()\n+ .status(StatusCode::OK)\n+ .header(header::CONTENT_TYPE, \"text/javascript; charset=utf-8\")\n+ .body(axum::body::Body::from(js))\n+ .unwrap()\n+}\n+\n+fn js_error(error_target: &str, title: &str, detail: &str) -> Response {\n+ let markup = maud::html! {\n+ div id=(error_target.trim_start_matches('#')) {\n+ p class=\"auth-error\" { (title) }\n+ @if !detail.is_empty() {\n+ pre class=\"muted\" { (detail) }\n+ }\n+ }\n+ };\n+ JsBuilder::new()\n+ .morph_selector(error_target, markup)\n+ .into_response()\n+}\n+\n+fn form_error_target(error_target: Option<&String>) -> String {\n+ error_target\n+ .map(|s| s.as_str())\n+ .filter(|s| !s.trim().is_empty())\n+ .map(|s| {\n+ if s.starts_with('#') {\n+ s.to_string()\n+ } else {\n+ format!(\"#{s}\")\n+ }\n+ })\n+ .unwrap_or_else(|| \"#errors\".to_string())\n+}\n+\n+fn form_js_error(error_target: Option<&String>, title: &str, detail: &str) -> Response {\n+ js_error(&form_error_target(error_target), title, detail)\n+}\n+\n+fn js_clear_errors(error_target: &str) -> Response {\n+ let markup = maud::html! {\n+ div id=(error_target.trim_start_matches('#')) {}\n+ };\n+ JsBuilder::new()\n+ .morph_selector(error_target, markup)\n+ .into_response()\n+}\n+\n+fn empty_error_markup(error_target: &str) -> maud::Markup {\n+ maud::html! {\n+ div id=(error_target.trim_start_matches('#')) {}\n+ }\n+}\n+\n+async fn rpc_check_with_bearer(\n+ state: &AppState,\n+ bearer_token: &str,\n+ room: String,\n+ text: String,\n+) -> Result)> {\n+ let mut headers = HeaderMap::new();\n+ let hv = HeaderValue::from_str(&format!(\"Bearer {bearer_token}\"))\n+ .map_err(|_| (\"invalid session token\".into(), None))?;\n+ headers.insert(header::AUTHORIZATION, hv);\n+\n+ let response = handle_rpc_batch(\n+ State(state.clone()),\n+ headers,\n+ axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])),\n+ )\n+ .await\n+ .into_response();\n+\n+ let status = response.status();\n+ if !status.is_success() {\n+ return Err((format!(\"rpc check http {}\", status), None));\n+ }\n+\n+ let body = body::to_bytes(response.into_body(), usize::MAX)\n+ .await\n+ .map_err(|e| (e.to_string(), None))?;\n+ let parsed: RpcBatchResponse =\n+ serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?;\n+ let line = parsed\n+ .results\n+ .into_iter()\n+ .next()\n+ .ok_or_else(|| (\"empty rpc check response\".to_string(), None))?;\n+ if line.ok {\n+ line.result\n+ .ok_or_else(|| (\"missing rpc check result\".to_string(), None))\n+ } else {\n+ Err((\n+ line.error.unwrap_or_else(|| \"check failed\".to_string()),\n+ line.hint,\n+ ))\n+ }\n+}\n+\n+async fn post_success_response(\n+ state: &AppState,\n+ room: &str,\n+ thread_tag: &str,\n+ error_target: Option<&String>,\n+ form_id: Option<&String>,\n+ viewer: Option<&str>,\n+) -> Response {\n+ let error_target = form_error_target(error_target);\n+ let room = room.trim().to_string();\n+ let thread_tag = canonicalize_tag(thread_tag);\n+ let thread_location = post_redirect_location(&room, &thread_tag);\n+ let form_id = form_id.map(|s| s.as_str()).unwrap_or(\"\");\n+ let scope = scope_from_room_wire(&room);\n+ let feed_markup = match &scope {\n+ ScopeId::Public => thread_feed_html(state).await,\n+ ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await,\n+ };\n+ let thread_markup = thread_feed_region_markup(\n+ state,\n+ match &scope {\n+ ScopeId::Public => None,\n+ ScopeId::Room(_) => Some(room.as_str()),\n+ },\n+ &thread_tag,\n+ viewer.as_deref(),\n+ )\n+ .await;\n+ let feed_selector = match &scope {\n+ ScopeId::Public => \"#thread-feed\",\n+ ScopeId::Room(_) => \"#room-thread-feed\",\n+ };\n+\n+ let builder = JsBuilder::new()\n+ .morph_selector(&error_target, empty_error_markup(&error_target))\n+ .morph_selector(feed_selector, feed_markup)\n+ .if_current_path_matches(&thread_location, |builder| {\n+ let builder = builder.morph_selector(\"#thread-feed-region\", thread_markup);\n+ let builder = if !form_id.trim().is_empty() {\n+ builder.qs(&format!(\"#{form_id}\")).reset()\n+ } else {\n+ builder\n+ };\n+ builder\n+ })\n+ .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location));\n+\n+ builder.into_response()\n+}\n+\n+async fn redact_success_response(state: &AppState) -> Response {\n+ let feed_markup = thread_feed_html(state).await;\n+ JsBuilder::new()\n+ .morph_selector(\"#thread-feed\", feed_markup)\n+ .into_response()\n+}\n+\n fn ui_js_warn(msg: &str) -> Response {\n use crate::html::js_string_literal;\n let js = format!(\"console.warn({});\", js_string_literal(msg));\n Response::builder()\n .status(StatusCode::OK)\n .header(header::CONTENT_TYPE, \"text/javascript; charset=utf-8\")\n- .body(Body::from(js))\n+ .body(axum::body::Body::from(js))\n .unwrap()\n }\ndiff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs\ndeleted file mode 100644\nindex 265025f41ff1548d05b2d2d5d84202245388053f..0000000000000000000000000000000000000000\n--- a/server/src/api/web_post.rs\n+++ /dev/null\n@@ -1,362 +0,0 @@\n-use axum::{\n- body,\n- extract::State,\n- http::{header, HeaderMap, HeaderValue, StatusCode},\n- response::{IntoResponse, Response},\n- Form,\n-};\n-use axum_extra::extract::cookie::CookieJar;\n-use serde::Deserialize;\n-use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult};\n-\n-use crate::{\n- api::{\n- auth::{optional_principal, SLUG_SESSION_COOKIE},\n- handle_rpc_batch,\n- rpc::{rpc_post_redact, rpc_post_with_bearer},\n- },\n- canonical_path::canonicalize_tag,\n- html::{thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, JsBuilder},\n- reducer::{scope_from_room_wire, ScopeId},\n- state::AppState,\n-};\n-\n-#[derive(Debug, Deserialize)]\n-pub struct WebPostForm {\n- pub room: String,\n- pub thread_tag: String,\n- pub text: String,\n- #[serde(default)]\n- pub error_target: Option,\n- #[serde(default)]\n- pub form_id: Option,\n-}\n-\n-#[derive(Debug, Deserialize)]\n-pub struct WebRedactForm {\n- pub post_id: String,\n-}\n-\n-fn post_redirect_location(room: &str, thread_tag: &str) -> String {\n- let tag = canonicalize_tag(thread_tag);\n- if room.trim() == \"public\" {\n- format!(\"/t/{tag}\")\n- } else {\n- let room = room.trim();\n- let Some((a, b)) = room.split_once('/') else {\n- return \"/\".to_string();\n- };\n- format!(\"/r/{a}/{b}/t/{tag}\")\n- }\n-}\n-\n-fn js_quote(s: &str) -> String {\n- serde_json::to_string(s).expect(\"js string escaping must succeed\")\n-}\n-\n-fn js_redirect(to: &str) -> Response {\n- let js = format!(\"window.location = {};\", js_quote(to));\n- Response::builder()\n- .status(StatusCode::OK)\n- .header(header::CONTENT_TYPE, \"text/javascript; charset=utf-8\")\n- .body(axum::body::Body::from(js))\n- .unwrap()\n-}\n-\n-fn js_error(error_target: &str, title: &str, detail: &str) -> Response {\n- let markup = maud::html! {\n- div id=(error_target.trim_start_matches('#')) {\n- p class=\"auth-error\" { (title) }\n- @if !detail.is_empty() {\n- pre class=\"muted\" { (detail) }\n- }\n- }\n- };\n- JsBuilder::new()\n- .morph_selector(error_target, markup)\n- .into_response()\n-}\n-\n-fn form_error_target(form: &WebPostForm) -> String {\n- form.error_target\n- .as_deref()\n- .filter(|s| !s.trim().is_empty())\n- .map(|s| {\n- if s.starts_with('#') {\n- s.to_string()\n- } else {\n- format!(\"#{s}\")\n- }\n- })\n- .unwrap_or_else(|| \"#errors\".to_string())\n-}\n-\n-fn form_js_error(form: &WebPostForm, title: &str, detail: &str) -> Response {\n- js_error(&form_error_target(form), title, detail)\n-}\n-\n-fn js_clear_errors(error_target: &str) -> Response {\n- let markup = maud::html! {\n- div id=(error_target.trim_start_matches('#')) {}\n- };\n- JsBuilder::new()\n- .morph_selector(error_target, markup)\n- .into_response()\n-}\n-\n-fn empty_error_markup(error_target: &str) -> maud::Markup {\n- maud::html! {\n- div id=(error_target.trim_start_matches('#')) {}\n- }\n-}\n-\n-async fn rpc_check_with_bearer(\n- state: &AppState,\n- bearer_token: &str,\n- room: String,\n- text: String,\n-) -> Result)> {\n- let mut headers = HeaderMap::new();\n- let hv = HeaderValue::from_str(&format!(\"Bearer {bearer_token}\"))\n- .map_err(|_| (\"invalid session token\".into(), None))?;\n- headers.insert(header::AUTHORIZATION, hv);\n-\n- let response = handle_rpc_batch(\n- State(state.clone()),\n- headers,\n- axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])),\n- )\n- .await\n- .into_response();\n-\n- let status = response.status();\n- if !status.is_success() {\n- return Err((format!(\"rpc check http {}\", status), None));\n- }\n-\n- let body = body::to_bytes(response.into_body(), usize::MAX)\n- .await\n- .map_err(|e| (e.to_string(), None))?;\n- let parsed: RpcBatchResponse =\n- serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?;\n- let line = parsed\n- .results\n- .into_iter()\n- .next()\n- .ok_or_else(|| (\"empty rpc check response\".to_string(), None))?;\n- if line.ok {\n- line.result\n- .ok_or_else(|| (\"missing rpc check result\".to_string(), None))\n- } else {\n- Err((\n- line.error.unwrap_or_else(|| \"check failed\".to_string()),\n- line.hint,\n- ))\n- }\n-}\n-\n-fn post_success_response<'a>(\n- state: &'a AppState,\n- form: &'a WebPostForm,\n- headers: &'a HeaderMap,\n- jar: &'a CookieJar,\n-) -> impl std::future::Future + 'a {\n- async move {\n- let error_target = form_error_target(form);\n- let room = form.room.trim().to_string();\n- let thread_tag = canonicalize_tag(&form.thread_tag);\n- let thread_location = post_redirect_location(&room, &thread_tag);\n- let form_id = form.form_id.as_deref().unwrap_or_default();\n- let scope = scope_from_room_wire(&room);\n- let viewer = {\n- let reduced = state.reduced.read().await;\n- optional_principal(headers, jar, &reduced)\n- };\n- let feed_markup = match &scope {\n- ScopeId::Public => thread_feed_html(state).await,\n- ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await,\n- };\n- let thread_markup = thread_feed_region_markup(\n- state,\n- match &scope {\n- ScopeId::Public => None,\n- ScopeId::Room(_) => Some(room.as_str()),\n- },\n- &thread_tag,\n- viewer.as_deref(),\n- )\n- .await;\n- let feed_selector = match &scope {\n- ScopeId::Public => \"#thread-feed\",\n- ScopeId::Room(_) => \"#room-thread-feed\",\n- };\n-\n- let builder = JsBuilder::new()\n- .morph_selector(&error_target, empty_error_markup(&error_target))\n- .morph_selector(feed_selector, feed_markup)\n- .if_current_path_matches(&thread_location, |builder| {\n- let builder = builder.morph_selector(\"#thread-feed-region\", thread_markup);\n- let builder = if !form_id.trim().is_empty() {\n- builder.qs(&format!(\"#{form_id}\")).reset()\n- } else {\n- builder\n- };\n- builder\n- })\n- .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location));\n-\n- builder.into_response()\n- }\n-}\n-\n-async fn redact_success_response(state: &AppState) -> Response {\n- let feed_markup = thread_feed_html(state).await;\n- JsBuilder::new()\n- .morph_selector(\"#thread-feed\", feed_markup)\n- .into_response()\n-}\n-\n-pub async fn post_web_redact(\n- State(state): State,\n- headers: HeaderMap,\n- jar: CookieJar,\n- Form(form): Form,\n-) -> impl IntoResponse {\n- run_post_web_redact(&state, &headers, &jar, form).await\n-}\n-\n-/// Shared with [`crate::api::ui_html::post_ui_html`].\n-pub(crate) async fn run_post_web_redact(\n- state: &AppState,\n- headers: &HeaderMap,\n- jar: &CookieJar,\n- form: WebRedactForm,\n-) -> Response {\n- let reduced = state.reduced.read().await;\n- let Some(_username) = optional_principal(headers, jar, &reduced) else {\n- drop(reduced);\n- return js_redirect(\"/login\").into_response();\n- };\n- drop(reduced);\n-\n- let bearer = headers\n- .get(axum::http::header::AUTHORIZATION)\n- .and_then(|v| v.to_str().ok())\n- .and_then(|s| s.strip_prefix(\"Bearer \").map(|t| t.trim().to_string()))\n- .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));\n-\n- let Some(_bearer) = bearer else {\n- return js_redirect(\"/login\").into_response();\n- };\n-\n- match rpc_post_redact(state, headers, form.post_id).await {\n- Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(),\n- Ok(_) => (StatusCode::BAD_REQUEST, \"unexpected response\").into_response(),\n- Err((msg, hint)) => {\n- let detail = hint.as_deref().unwrap_or(\"\");\n- js_error(\"#errors\", &msg, detail).into_response()\n- }\n- }\n-}\n-\n-pub async fn post_web_ingest(\n- State(state): State,\n- headers: HeaderMap,\n- jar: CookieJar,\n- Form(form): Form,\n-) -> impl IntoResponse {\n- run_post_web_ingest(&state, &headers, &jar, form).await\n-}\n-\n-/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).\n-pub(crate) async fn run_post_web_ingest(\n- state: &AppState,\n- headers: &HeaderMap,\n- jar: &CookieJar,\n- form: WebPostForm,\n-) -> Response {\n- let reduced = state.reduced.read().await;\n- let Some(_username) = optional_principal(headers, jar, &reduced) else {\n- drop(reduced);\n- return js_redirect(\"/login\").into_response();\n- };\n-\n- let bearer = headers\n- .get(axum::http::header::AUTHORIZATION)\n- .and_then(|v| v.to_str().ok())\n- .and_then(|s| s.strip_prefix(\"Bearer \").map(|t| t.trim().to_string()))\n- .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));\n-\n- drop(reduced);\n-\n- let Some(bearer) = bearer else {\n- return js_redirect(\"/login\").into_response();\n- };\n-\n- let room = form.room.trim().to_string();\n- let thread_tag = form.thread_tag.trim().to_string();\n- let text = form.text.clone();\n-\n- if text.trim().is_empty() {\n- return form_js_error(&form, \"empty post\", \"Write something in the text area (DSL / prose).\")\n- .into_response();\n- }\n-\n- match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await {\n- Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar)\n- .await\n- .into_response(),\n- Ok(_) => form_js_error(&form, \"unexpected response\", \"Post did not return PostOk.\").into_response(),\n- Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or(\"\")).into_response(),\n- }\n-}\n-\n-pub async fn check_web_ingest(\n- State(state): State,\n- headers: HeaderMap,\n- jar: CookieJar,\n- Form(form): Form,\n-) -> impl IntoResponse {\n- run_check_web_ingest(&state, &headers, &jar, form).await\n-}\n-\n-/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).\n-pub(crate) async fn run_check_web_ingest(\n- state: &AppState,\n- headers: &HeaderMap,\n- jar: &CookieJar,\n- form: WebPostForm,\n-) -> Response {\n- let reduced = state.reduced.read().await;\n- let Some(_username) = optional_principal(headers, jar, &reduced) else {\n- drop(reduced);\n- return js_redirect(\"/login\").into_response();\n- };\n-\n- let bearer = headers\n- .get(axum::http::header::AUTHORIZATION)\n- .and_then(|v| v.to_str().ok())\n- .and_then(|s| s.strip_prefix(\"Bearer \").map(|t| t.trim().to_string()))\n- .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()));\n- drop(reduced);\n-\n- let Some(bearer) = bearer else {\n- return js_redirect(\"/login\").into_response();\n- };\n-\n- let room = form.room.trim().to_string();\n- let thread_tag = canonicalize_tag(&form.thread_tag);\n- if thread_tag.is_empty() {\n- return form_js_error(&form, \"missing thread tag\", \"Set a thread tag before posting.\").into_response();\n- }\n-\n- if form.text.trim().is_empty() {\n- return js_clear_errors(&form_error_target(&form)).into_response();\n- }\n-\n- match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await {\n- Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(),\n- Ok(_) => form_js_error(&form, \"unexpected response\", \"Check did not return CheckOk.\").into_response(),\n- Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or(\"\")).into_response(),\n- }\n-}\ndiff --git a/server/src/html/forum.rs b/server/src/html/forum.rs\nindex b1c037f3dd93c7bb96d6624cab6019228432c501..a173e7aea7a81c7cfab5f2f6a5549e0db560fb2b 100644\n--- a/server/src/html/forum.rs\n+++ b/server/src/html/forum.rs\n@@ -17,6 +17,7 @@ use crate::{\n state::AppState,\n timeago,\n };\n+use serde_json::json;\n \n use super::ui_action::{HtmlUiAction, UI_RPC_FIELD};\n \n@@ -182,8 +183,8 @@ fn post_header_row(\n div class=\"ingest-header-row\" {\n (meta)\n @if show_delete {\n- form class=\"post-delete-form\" method=\"POST\" action=\"/post/redact\" {\n- input type=\"hidden\" name=\"post_id\" value=(ing.id);\n+ form class=\"post-delete-form\" method=\"POST\" action=\"/ui\" {\n+ input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::RedactPost { post_id: ing.id.clone() }).unwrap());\n button type=\"submit\" class=\"post-delete-btn\" { \"delete\" }\n }\n }\n@@ -427,13 +428,28 @@ fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup {\n if !show {\n return html! {};\n }\n+ let rpc_post = template_json_compact(&json!({\n+ \"action\": \"post_ingest\",\n+ \"room\": nav.room_wire,\n+ \"thread_tag\": thread_tag,\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"thread-compose-errors\",\n+ \"form_id\": \"thread-compose-form\",\n+ }))\n+ .unwrap();\n+ let rpc_check = template_json_compact(&json!({\n+ \"action\": \"check_ingest\",\n+ \"room\": nav.room_wire,\n+ \"thread_tag\": thread_tag,\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"thread-compose-errors\",\n+ \"form_id\": \"thread-compose-form\",\n+ }))\n+ .unwrap();\n html! {\n section class=\"compose\" id=\"thread-compose\" {\n- form id=\"thread-compose-form\" method=\"POST\" action=\"/post\" data-check-action=\"/post/check\" {\n- input type=\"hidden\" name=\"room\" value=(nav.room_wire.clone());\n- input type=\"hidden\" name=\"thread_tag\" value=(thread_tag);\n- input type=\"hidden\" name=\"error_target\" value=\"thread-compose-errors\";\n- input type=\"hidden\" name=\"form_id\" value=\"thread-compose-form\";\n+ form id=\"thread-compose-form\" method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(rpc_check) {\n+ input type=\"hidden\" name=(UI_RPC_FIELD) value=(rpc_post);\n textarea name=\"text\" rows=\"5\" cols=\"80\" placeholder=\"prose or ~/items and votes…\" {}\n p {\n button type=\"submit\" { \"post\" }\n@@ -463,10 +479,22 @@ fn new_thread_form_public(show: bool) -> Markup {\n h3 { \"new public thread\" }\n p class=\"muted\" { \"Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL.\" }\n div id=\"public-new-thread-errors\" {}\n- form id=\"public-new-thread-form\" method=\"POST\" action=\"/post\" data-check-action=\"/post/check\" {\n- input type=\"hidden\" name=\"room\" value=\"public\";\n- input type=\"hidden\" name=\"error_target\" value=\"public-new-thread-errors\";\n- input type=\"hidden\" name=\"form_id\" value=\"public-new-thread-form\";\n+ form id=\"public-new-thread-form\" method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(template_json_compact(&json!({\n+ \"action\": \"check_ingest\",\n+ \"room\": \"public\",\n+ \"thread_tag\": {\"$form\": \"thread_tag\"},\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"public-new-thread-errors\",\n+ \"form_id\": \"public-new-thread-form\",\n+ })).unwrap()) {\n+ input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({\n+ \"action\": \"post_ingest\",\n+ \"room\": \"public\",\n+ \"thread_tag\": {\"$form\": \"thread_tag\"},\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"public-new-thread-errors\",\n+ \"form_id\": \"public-new-thread-form\",\n+ })).unwrap());\n label for=\"new-thread-tag\" { \"thread tag\" }\n input type=\"text\" id=\"new-thread-tag\" name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" placeholder=\"my-topic\";\n label for=\"new-thread-text\" { \"text\" }\n@@ -946,10 +974,22 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup {\n section class=\"compose\" id=\"room-new-thread-compose\" hidden {\n h3 { \"new thread in this room\" }\n div id=\"room-new-thread-errors\" {}\n- form id=\"room-new-thread-form\" method=\"POST\" action=\"/post\" data-check-action=\"/post/check\" {\n- input type=\"hidden\" name=\"room\" value=(nav.room_wire.clone());\n- input type=\"hidden\" name=\"error_target\" value=\"room-new-thread-errors\";\n- input type=\"hidden\" name=\"form_id\" value=\"room-new-thread-form\";\n+ form id=\"room-new-thread-form\" method=\"POST\" action=\"/ui\" data-check-action=\"/ui\" data-check-rpc=(template_json_compact(&json!({\n+ \"action\": \"check_ingest\",\n+ \"room\": nav.room_wire,\n+ \"thread_tag\": {\"$form\": \"thread_tag\"},\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"room-new-thread-errors\",\n+ \"form_id\": \"room-new-thread-form\",\n+ })).unwrap()) {\n+ input type=\"hidden\" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({\n+ \"action\": \"post_ingest\",\n+ \"room\": nav.room_wire,\n+ \"thread_tag\": {\"$form\": \"thread_tag\"},\n+ \"text\": {\"$form\": \"text\"},\n+ \"error_target\": \"room-new-thread-errors\",\n+ \"form_id\": \"room-new-thread-form\",\n+ })).unwrap());\n label for=\"room-new-tag\" { \"thread tag\" }\n input type=\"text\" id=\"room-new-tag\" name=\"thread_tag\" pattern=\"[a-z0-9_\\\\-]{1,64}\" required;\n textarea name=\"text\" rows=\"4\" placeholder=\"First post body…\" required {}\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex a4fd2dd60ac283f7eb9b2e64522501b21d1e27e9..63f723804be511af80b5c13e792109754b606fce 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -373,9 +373,14 @@ script { (maud::PreEscaped(r#\"\n async function runFormCheck(form) {\n const action = form.getAttribute('data-check-action');\n if (!action) return;\n+ const fd = new URLSearchParams(new FormData(form));\n+ const checkRpc = form.getAttribute('data-check-rpc');\n+ if (checkRpc) {\n+ fd.set('__rpc__', checkRpc);\n+ }\n const resp = await fetch(action, {\n method: 'POST',\n- body: new URLSearchParams(new FormData(form)),\n+ body: fd,\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n credentials: 'same-origin',\n });\ndiff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs\nindex 3bc69ecbb7e16a59d2d393b2d59f9cd3fedb12b1..73180737db8ba8d16fb7b42b790e44d2d7b796f5 100644\n--- a/server/src/html/ui_action.rs\n+++ b/server/src/html/ui_action.rs\n@@ -14,7 +14,7 @@ pub const UI_RPC_FIELD: &str = \"__rpc__\";\n #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]\n #[serde(tag = \"action\", rename_all = \"snake_case\")]\n pub enum HtmlUiAction {\n- /// Same semantics as `POST /post` (forum ingest).\n+ /// Forum ingest via `POST /ui`.\n PostIngest {\n room: String,\n thread_tag: String,\n@@ -24,7 +24,7 @@ pub enum HtmlUiAction {\n #[serde(default)]\n form_id: Option,\n },\n- /// Same as `POST /post/check`.\n+ /// DSL check / validation via `POST /ui`.\n CheckIngest {\n room: String,\n thread_tag: String,\n@@ -34,7 +34,7 @@ pub enum HtmlUiAction {\n #[serde(default)]\n form_id: Option,\n },\n- /// Same as `POST /post/redact`.\n+ /// Author redacts own post via `POST /ui`.\n RedactPost {\n post_id: String,\n },\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 5f5b6b0f01b29350c7415e5801ec5caa74f0b452..c28c2335d23080671e71155ea3fb023f9b8d98c4 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -31,9 +31,6 @@ pub fn create_app(state: AppState) -> Router {\n .route(\"/\", get(crate::html::home))\n .route(\"/login\", get(api::get_web_login))\n .route(\"/logout\", get(api::get_logout))\n- .route(\"/post\", post(api::post_web_ingest))\n- .route(\"/post/redact\", post(api::post_web_redact))\n- .route(\"/post/check\", post(api::check_web_ingest))\n .route(\"/ui\", post(api::post_ui_html))\n .route(\"/theme\", post(crate::html::post_theme))\n .route(\"/sse\", get(api::get_html_stream))\n@@ -64,6 +61,7 @@ pub fn create_app(state: AppState) -> Router {\n )\n .route(\"/t/:tag/:index\", get(crate::html::thread_post_view))\n .route(\"/t/:tag\", get(crate::html::thread_view))\n+ // TODO DELETE THESE AND USE __RPC__ PATTERN\n .route(\n \"/r/:room_short/:room_slug/t/:thread_tag/:index/expand\",\n get(crate::html::room_thread_post_expand),\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex d86de2dd446516807a3c8a607aa88787d1b136b0..831722430d6b41308e3f03d485cd62f887ace799 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -21,6 +21,30 @@ fn test_bearer() -> String {\n format!(\"slug_{token_id}_{secret}\")\n }\n \n+/// Compact JSON for `POST /ui` (`HtmlUiAction::PostIngest`).\n+fn ui_post_ingest_rpc(room: &str, thread_tag: &str, text: &str) -> String {\n+ serde_json::json!({\n+ \"action\": \"post_ingest\",\n+ \"room\": room,\n+ \"thread_tag\": thread_tag,\n+ \"text\": text,\n+ })\n+ .to_string()\n+}\n+\n+/// Compact JSON for `POST /ui` (`HtmlUiAction::CheckIngest`).\n+fn ui_check_ingest_rpc(room: &str, thread_tag: &str, text: &str, error_target: &str) -> String {\n+ serde_json::json!({\n+ \"action\": \"check_ingest\",\n+ \"room\": room,\n+ \"thread_tag\": thread_tag,\n+ \"text\": text,\n+ \"error_target\": error_target,\n+ \"form_id\": \"thread-compose-form\",\n+ })\n+ .to_string()\n+}\n+\n /// `commands` is a JSON array of RPC commands (`RpcBatch` is a transparent `Vec`).\n async fn rpc_batch(\n client: &reqwest::Client,\n@@ -343,14 +367,11 @@ async fn test_private_room_thread_urls_use_t_segment() {\n .to_string();\n let (room_short, room_slug) = room_id.split_once('/').unwrap();\n \n+ let rpc = ui_post_ingest_rpc(&room_id, \"main-thread\", \"private post via web\");\n let post = client\n- .post(format!(\"http://{addr}/post\"))\n+ .post(format!(\"http://{addr}/ui\"))\n .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n- .form(&[\n- (\"room\", room_id.as_str()),\n- (\"thread_tag\", \"main-thread\"),\n- (\"text\", \"private post via web\"),\n- ])\n+ .form(&[(\"__rpc__\", rpc.as_str())])\n .send()\n .await\n .unwrap();\n@@ -404,14 +425,15 @@ async fn test_private_room_post_links_use_private_garden_routes() {\n .to_string();\n let (room_short, room_slug) = room_id.split_once('/').unwrap();\n \n+ let rpc = ui_post_ingest_rpc(\n+ &room_id,\n+ \"garden-thread\",\n+ \"~/secret/item {classified}\\n~/secret/other {other body}\\n~/secret/item 3:1 ~/secret/other {because}\\n\",\n+ );\n let post = client\n- .post(format!(\"http://{addr}/post\"))\n+ .post(format!(\"http://{addr}/ui\"))\n .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n- .form(&[\n- (\"room\", room_id.as_str()),\n- (\"thread_tag\", \"garden-thread\"),\n- (\"text\", \"~/secret/item {classified}\\n~/secret/other {other body}\\n~/secret/item 3:1 ~/secret/other {because}\\n\"),\n- ])\n+ .form(&[(\"__rpc__\", rpc.as_str())])\n .send()\n .await\n .unwrap();\n@@ -449,15 +471,11 @@ async fn test_post_check_returns_targeted_js_error_for_missing_thread_tag() {\n .unwrap();\n let bearer = test_bearer();\n \n+ let rpc = ui_check_ingest_rpc(\"public\", \"\", \"hello\", \"thread-compose-errors\");\n let resp = client\n- .post(format!(\"http://{addr}/post/check\"))\n+ .post(format!(\"http://{addr}/ui\"))\n .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n- .form(&[\n- (\"room\", \"public\"),\n- (\"thread_tag\", \"\"),\n- (\"text\", \"hello\"),\n- (\"error_target\", \"thread-compose-errors\"),\n- ])\n+ .form(&[(\"__rpc__\", rpc.as_str())])\n .send()\n .await\n .unwrap();\n@@ -553,14 +571,11 @@ async fn test_sse_stream_emits_evalable_js_after_post() {\n .unwrap();\n assert!(sse_resp.status().is_success());\n \n+ let rpc = ui_post_ingest_rpc(&room_id, \"live-thread\", \"hello over sse\");\n let _post = client\n- .post(format!(\"http://{addr}/post\"))\n+ .post(format!(\"http://{addr}/ui\"))\n .header(\"Authorization\", format!(\"Bearer {bearer}\"))\n- .form(&[\n- (\"room\", room_id.as_str()),\n- (\"thread_tag\", \"live-thread\"),\n- (\"text\", \"hello over sse\"),\n- ])\n+ .form(&[(\"__rpc__\", rpc.as_str())])\n .send()\n .await\n .unwrap();\ndiff --git a/test/walkthrough_fixture.clj b/test/walkthrough_fixture.clj\nindex ec7914464b1a0389e40c5be53af59cf8ed82b09e..4b814822029c913e38151ca53848d1c64fb58373 100644\n--- a/test/walkthrough_fixture.clj\n+++ b/test/walkthrough_fixture.clj\n@@ -52,22 +52,28 @@\n \"~/secret/item {classified}\\n\"\n \"~/secret/other {secondary}\\n\"\n \"~/secret/item 3:1 ~/secret/other {because}\\n\")\n+ rpc (json/generate-string\n+ {:action \"post_ingest\"\n+ :room room-id\n+ :thread_tag \"walkthrough-thread\"\n+ :text wall-text})\n post-resp (oauth/http-post-form\n- (str base-url \"/post\")\n- {:room room-id\n- :thread_tag \"walkthrough-thread\"\n- :text wall-text}\n+ (str base-url \"/ui\")\n+ {:__rpc__ rpc}\n :headers {\"Authorization\" (str \"Bearer \" alice-token)})]\n (assert! (= 200 (:status post-resp)) \"seed post must succeed\"))\n (let [bob-reply (str \"Bob here — reply with another long block so the thread has multiple cards.\\n\\n\"\n \"Paragraph two: repeating slugs ~/secret/item and ~/secret/other for cross-post link styling. \"\n \"If everything wraps cleanly, monospace pre + serif body (in craft theme) should still feel readable.\\n\\n\"\n \"More overflow: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\\n\")\n+ bob-rpc (json/generate-string\n+ {:action \"post_ingest\"\n+ :room room-id\n+ :thread_tag \"walkthrough-thread\"\n+ :text bob-reply})\n bob-post (oauth/http-post-form\n- (str base-url \"/post\")\n- {:room room-id\n- :thread_tag \"walkthrough-thread\"\n- :text bob-reply}\n+ (str base-url \"/ui\")\n+ {:__rpc__ bob-rpc}\n :headers {\"Authorization\" (str \"Bearer \" bob-token)})]\n (assert! (= 200 (:status bob-post)) \"seed reply post must succeed\"))\n {:users {:alice {:token alice-token}\n","role":"user"}],"model":"~x-ai/grok-latest"}