{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[15e1037a] url stuff\n\nSide A — unified diff (full patch):\ndiff --git a/server/src/url_rules/graph.rs b/server/src/url_rules/graph.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..f7ac0f9a551a1727cb2f9294778c283b9885b147\n--- /dev/null\n+++ b/server/src/url_rules/graph.rs\n@@ -0,0 +1,831 @@\n+//! Semantic URL graph: DFA traversal on host + path, query in context, generic fallback.\n+\n+use std::collections::HashMap;\n+use std::sync::OnceLock;\n+\n+use url::Url;\n+\n+use super::graph_builder::GraphBuilder;\n+use super::parse::{normalize_match_host, strip_tracking_query, UrlParts};\n+\n+#[derive(Debug, Clone, Default)]\n+pub struct Context {\n+ pub vars: HashMap,\n+ pub query: HashMap,\n+}\n+\n+pub type CanonicalFn = fn(&Context) -> Option;\n+\n+#[derive(Clone, Copy)]\n+pub enum EdgePattern {\n+ Literal(&'static str),\n+ Variable(&'static str),\n+ /// Absorb any trailing segment without leaving this node (e.g. post title slug).\n+ AbsorbAny,\n+ /// Absorb segment when `cond(seg)` (e.g. subreddit listing suffix).\n+ AbsorbIf(fn(&str) -> bool),\n+}\n+\n+pub struct Edge {\n+ pub pattern: EdgePattern,\n+ pub target: &'static str,\n+}\n+\n+pub struct Node {\n+ pub edges: Vec,\n+ pub canonical: CanonicalFn,\n+ pub parent: Option<&'static str>,\n+}\n+\n+impl Node {\n+ pub(crate) fn empty() -> Self {\n+ Self {\n+ edges: Vec::new(),\n+ canonical: |_| None,\n+ parent: None,\n+ }\n+ }\n+}\n+\n+pub struct Graph {\n+ pub nodes: HashMap<&'static str, Node>,\n+}\n+\n+static GRAPH: OnceLock = OnceLock::new();\n+\n+pub fn graph() -> &'static Graph {\n+ GRAPH.get_or_init(build_graph)\n+}\n+\n+impl Graph {\n+ pub fn resolve_canonical(&self, parts: &UrlParts) -> Option {\n+ let mut query = parts.query.clone();\n+ strip_tracking_query(&mut query);\n+ let mut ctx = Context {\n+ vars: HashMap::new(),\n+ query,\n+ };\n+\n+ if let Some(node_id) = self.traverse(parts, &mut ctx) {\n+ if let Some(canon) = (self.nodes.get(node_id)?.canonical)(&ctx) {\n+ return Some(canon);\n+ }\n+ }\n+ Some(generic_canonical(parts))\n+ }\n+\n+ pub fn breadcrumbs(&self, parts: &UrlParts) -> Vec {\n+ let mut query = parts.query.clone();\n+ strip_tracking_query(&mut query);\n+ let mut ctx = Context {\n+ vars: HashMap::new(),\n+ query,\n+ };\n+\n+ if let Some(mut node_id) = self.traverse(parts, &mut ctx) {\n+ let mut paths = Vec::new();\n+ loop {\n+ let node = match self.nodes.get(node_id) {\n+ Some(n) => n,\n+ None => break,\n+ };\n+ if let Some(url) = (node.canonical)(&ctx) {\n+ if paths.last() != Some(&url) {\n+ paths.push(url);\n+ }\n+ }\n+ match node.parent {\n+ Some(p) => node_id = p,\n+ None => break,\n+ }\n+ }\n+ paths.reverse();\n+ if !paths.is_empty() {\n+ return paths;\n+ }\n+ }\n+ generic_breadcrumbs(parts)\n+ }\n+\n+ fn traverse(&self, parts: &UrlParts, ctx: &mut Context) -> Option<&'static str> {\n+ let host = parts.match_host();\n+ let mut node_id = match host.as_str() {\n+ \"reddit.com\" => \"reddit_root\",\n+ \"youtube.com\" => \"youtube_root\",\n+ \"youtu.be\" => \"youtu_be_entry\",\n+ _ => return None,\n+ };\n+\n+ let segs: Vec<&str> = parts.path_segments.iter().map(String::as_str).collect();\n+ let mut i = 0;\n+ while i < segs.len() {\n+ let seg = segs[i];\n+ match self.follow_edge(node_id, seg, ctx) {\n+ Ok(next) => {\n+ node_id = next;\n+ i += 1;\n+ }\n+ Err(()) => {\n+ if self.try_absorb(node_id, seg) {\n+ i += 1;\n+ continue;\n+ }\n+ return None;\n+ }\n+ }\n+ }\n+ Some(node_id)\n+ }\n+\n+ fn follow_edge(\n+ &self,\n+ node_id: &'static str,\n+ seg: &str,\n+ ctx: &mut Context,\n+ ) -> Result<&'static str, ()> {\n+ let node = self.nodes.get(node_id).ok_or(())?;\n+ for edge in &node.edges {\n+ match edge.pattern {\n+ EdgePattern::Literal(lit) if lit == seg => return Ok(edge.target),\n+ EdgePattern::Variable(name) => {\n+ ctx.vars.insert(name.to_string(), seg.to_string());\n+ return Ok(edge.target);\n+ }\n+ EdgePattern::AbsorbAny\n+ | EdgePattern::AbsorbIf(_)\n+ | EdgePattern::Literal(_)\n+ | EdgePattern::Variable(_) => {}\n+ }\n+ }\n+ Err(())\n+ }\n+\n+ fn try_absorb(&self, node_id: &'static str, seg: &str) -> bool {\n+ let node = match self.nodes.get(node_id) {\n+ Some(n) => n,\n+ None => return false,\n+ };\n+ for edge in &node.edges {\n+ match edge.pattern {\n+ EdgePattern::AbsorbAny => return true,\n+ EdgePattern::AbsorbIf(cond) if cond(seg) => return true,\n+ EdgePattern::AbsorbIf(_) | EdgePattern::Literal(_) | EdgePattern::Variable(_) => {}\n+ }\n+ }\n+ false\n+ }\n+\n+ /// Test hook: terminal graph node and captured context after traversal.\n+ #[cfg(test)]\n+ pub fn traverse_terminal(&self, parts: &UrlParts) -> Option<(&'static str, Context)> {\n+ let mut query = parts.query.clone();\n+ strip_tracking_query(&mut query);\n+ let mut ctx = Context {\n+ vars: HashMap::new(),\n+ query,\n+ };\n+ let node = self.traverse(parts, &mut ctx)?;\n+ Some((node, ctx))\n+ }\n+}\n+\n+fn is_reddit_listing_suffix(seg: &str) -> bool {\n+ matches!(seg, \"hot\" | \"top\" | \"new\" | \"rising\" | \"controversial\")\n+}\n+\n+/// Percent-encode a path or query fragment so `&`, `?`, etc. cannot break URL structure.\n+fn enc(s: &str) -> String {\n+ urlencoding::encode(s).into_owned()\n+}\n+\n+// --- Canonical formatters ---\n+\n+fn canon_reddit_root(_: &Context) -> Option {\n+ Some(\"https://reddit.com\".to_string())\n+}\n+\n+fn canon_reddit_r_hub(_: &Context) -> Option {\n+ Some(\"https://reddit.com/r\".to_string())\n+}\n+\n+fn canon_reddit_subreddit(ctx: &Context) -> Option {\n+ let sub = ctx.vars.get(\"subreddit\")?;\n+ Some(format!(\n+ \"https://reddit.com/r/{}\",\n+ enc(&sub.to_ascii_lowercase())\n+ ))\n+}\n+\n+fn canon_reddit_post(ctx: &Context) -> Option {\n+ let sub = ctx.vars.get(\"subreddit\")?.to_ascii_lowercase();\n+ let id = ctx.vars.get(\"post_id\")?;\n+ Some(format!(\n+ \"https://reddit.com/r/{}/comments/{}\",\n+ enc(&sub),\n+ enc(id)\n+ ))\n+}\n+\n+fn canon_youtube_root(_: &Context) -> Option {\n+ Some(\"https://youtube.com\".to_string())\n+}\n+\n+fn canon_youtube_watch(ctx: &Context) -> Option {\n+ let v = ctx\n+ .query\n+ .get(\"v\")\n+ .or_else(|| ctx.vars.get(\"video_id\"))?;\n+ Some(format!(\"https://youtube.com/watch?v={}\", enc(v)))\n+}\n+\n+fn canon_youtu_be(ctx: &Context) -> Option {\n+ let v = ctx.vars.get(\"vid_id\")?;\n+ Some(format!(\"https://youtube.com/watch?v={}\", enc(v)))\n+}\n+\n+pub fn build_graph() -> Graph {\n+ GraphBuilder::new()\n+ .node(\"reddit_root\")\n+ .canonical(canon_reddit_root)\n+ .edge(EdgePattern::Literal(\"r\"), \"reddit_r_hub\")\n+ .node(\"reddit_r_hub\")\n+ .parent(\"reddit_root\")\n+ .canonical(canon_reddit_r_hub)\n+ .edge(EdgePattern::Variable(\"subreddit\"), \"reddit_subreddit\")\n+ .node(\"reddit_subreddit\")\n+ .parent(\"reddit_r_hub\")\n+ .canonical(canon_reddit_subreddit)\n+ .edge(\n+ EdgePattern::AbsorbIf(is_reddit_listing_suffix),\n+ \"reddit_subreddit\",\n+ )\n+ .edge(EdgePattern::Literal(\"comments\"), \"reddit_comments_gate\")\n+ .node(\"reddit_comments_gate\")\n+ .parent(\"reddit_subreddit\")\n+ .canonical(canon_reddit_subreddit)\n+ .edge(EdgePattern::Variable(\"post_id\"), \"reddit_post\")\n+ .node(\"reddit_post\")\n+ .parent(\"reddit_subreddit\")\n+ .canonical(canon_reddit_post)\n+ .edge(EdgePattern::AbsorbAny, \"reddit_post\")\n+ .node(\"youtube_root\")\n+ .canonical(canon_youtube_root)\n+ .edge(EdgePattern::Literal(\"watch\"), \"youtube_watch\")\n+ .edge(EdgePattern::Literal(\"shorts\"), \"youtube_shorts_gate\")\n+ .node(\"youtube_watch\")\n+ .parent(\"youtube_root\")\n+ .canonical(canon_youtube_watch)\n+ .node(\"youtube_shorts_gate\")\n+ .parent(\"youtube_root\")\n+ .canonical(canon_youtube_root)\n+ .edge(EdgePattern::Variable(\"video_id\"), \"youtube_watch\")\n+ .node(\"youtu_be_entry\")\n+ .canonical(canon_youtube_root)\n+ .edge(EdgePattern::Variable(\"vid_id\"), \"youtu_be_video\")\n+ .node(\"youtu_be_video\")\n+ .parent(\"youtube_root\")\n+ .canonical(canon_youtu_be)\n+ .build()\n+}\n+\n+// --- Generic internet fallback ---\n+\n+pub fn generic_canonical(parts: &UrlParts) -> String {\n+ let host = normalize_match_host(&parts.host);\n+ let path_segments: Vec = parts.path_segments.clone();\n+ let mut query = parts.query.clone();\n+ strip_tracking_query(&mut query);\n+\n+ let mut url = if path_segments.is_empty() {\n+ Url::parse(&format!(\"https://{host}\"))\n+ .unwrap_or_else(|_| Url::parse(\"https://invalid\").unwrap())\n+ } else {\n+ let path = format!(\"/{}\", path_segments.join(\"/\"));\n+ Url::parse(&format!(\"https://{host}{path}\"))\n+ .unwrap_or_else(|_| Url::parse(\"https://invalid\").unwrap())\n+ };\n+\n+ if !query.is_empty() {\n+ let mut pairs: Vec<_> = query.iter().collect();\n+ pairs.sort_by(|a, b| a.0.cmp(b.0));\n+ url.query_pairs_mut().clear();\n+ for (k, v) in pairs {\n+ url.query_pairs_mut().append_pair(k, v);\n+ }\n+ }\n+\n+ let mut s = url.to_string();\n+ if path_segments.is_empty() {\n+ s = s.trim_end_matches('/').to_string();\n+ }\n+ s\n+}\n+\n+pub fn generic_breadcrumbs(parts: &UrlParts) -> Vec {\n+ let host = normalize_match_host(&parts.host);\n+ let n = parts.path_segments.len();\n+ let mut out = Vec::new();\n+\n+ let base = generic_canonical(&UrlParts {\n+ scheme: \"https\".to_string(),\n+ host: host.clone(),\n+ path_segments: vec![],\n+ query: HashMap::new(),\n+ });\n+ out.push(base);\n+\n+ for i in 0..n {\n+ let segs: Vec = parts.path_segments[..=i].to_vec();\n+ let url = generic_canonical(&UrlParts {\n+ scheme: \"https\".to_string(),\n+ host: host.clone(),\n+ path_segments: segs,\n+ query: HashMap::new(),\n+ });\n+ if out.last() != Some(&url) {\n+ out.push(url);\n+ }\n+ }\n+ out\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+ use super::*;\n+ use crate::url_rules::parse::test_parts;\n+\n+ fn g() -> &'static Graph {\n+ graph()\n+ }\n+\n+ fn canon(parts: &UrlParts) -> String {\n+ g().resolve_canonical(parts).unwrap()\n+ }\n+\n+ fn crumbs(parts: &UrlParts) -> Vec {\n+ g().breadcrumbs(parts)\n+ }\n+\n+ fn terminal(parts: &UrlParts) -> Option<&'static str> {\n+ g().traverse_terminal(parts).map(|(n, _)| n)\n+ }\n+\n+ fn vars(parts: &UrlParts) -> HashMap {\n+ g().traverse_terminal(parts)\n+ .map(|(_, c)| c.vars)\n+ .unwrap_or_default()\n+ }\n+\n+ #[test]\n+ fn youtu_be_malicious_segment_encoded_not_injected() {\n+ let p = test_parts(\"youtu.be\", &[\"abc&t=1\"], &[]);\n+ assert_eq!(canon(&p), \"https://youtube.com/watch?v=abc%26t%3D1\");\n+ assert!(!canon(&p).contains(\"abc&t=1\"));\n+ }\n+\n+ #[test]\n+ fn youtube_query_v_encoded() {\n+ let p = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"a&b=c\")]);\n+ assert_eq!(canon(&p), \"https://youtube.com/watch?v=a%26b%3Dc\");\n+ }\n+\n+ #[test]\n+ fn absorb_patterns_live_on_edges_not_in_engine() {\n+ let g = build_graph();\n+ let sub = g.nodes.get(\"reddit_subreddit\").unwrap();\n+ assert!(sub\n+ .edges\n+ .iter()\n+ .any(|e| matches!(e.pattern, EdgePattern::AbsorbIf(_))));\n+ let post = g.nodes.get(\"reddit_post\").unwrap();\n+ assert!(post\n+ .edges\n+ .iter()\n+ .any(|e| matches!(e.pattern, EdgePattern::AbsorbAny)));\n+ }\n+\n+ #[test]\n+ fn builder_rejects_missing_parent() {\n+ let result = std::panic::catch_unwind(|| {\n+ GraphBuilder::new()\n+ .node(\"orphan\")\n+ .parent(\"nonexistent_parent\")\n+ .build();\n+ });\n+ assert!(result.is_err());\n+ }\n+\n+ #[test]\n+ fn generic_canonical_forces_https_and_strips_www() {\n+ let p = test_parts(\"www.example.com\", &[\"blog\", \"post\"], &[]);\n+ assert_eq!(canon(&p), \"https://example.com/blog/post\");\n+ }\n+\n+ #[test]\n+ fn generic_canonical_sorts_query_keys() {\n+ let p = test_parts(\"example.com\", &[\"search\"], &[(\"q\", \"rust\"), (\"page\", \"2\")]);\n+ assert_eq!(canon(&p), \"https://example.com/search?page=2&q=rust\");\n+ }\n+\n+ #[test]\n+ fn generic_canonical_strips_tracking_from_query() {\n+ let p = test_parts(\n+ \"news.ycombinator.com\",\n+ &[\"item\"],\n+ &[(\"id\", \"1\"), (\"utm_medium\", \"social\")],\n+ );\n+ assert_eq!(canon(&p), \"https://news.ycombinator.com/item?id=1\");\n+ }\n+\n+ #[test]\n+ fn generic_breadcrumbs_cumulative_path() {\n+ let p = test_parts(\"paulgraham.com\", &[\"articles\", \"lisp.html\"], &[]);\n+ assert_eq!(\n+ crumbs(&p),\n+ vec![\n+ \"https://paulgraham.com\",\n+ \"https://paulgraham.com/articles\",\n+ \"https://paulgraham.com/articles/lisp.html\"\n+ ]\n+ );\n+ }\n+\n+ #[test]\n+ fn generic_breadcrumbs_domain_only() {\n+ let p = test_parts(\"example.com\", &[], &[]);\n+ assert_eq!(crumbs(&p), vec![\"https://example.com\"]);\n+ }\n+\n+ #[test]\n+ fn unknown_host_uses_generic_not_graph() {\n+ let p = test_parts(\"hackernews.com\", &[\"item\", \"123\"], &[]);\n+ assert_eq!(terminal(&p), None);\n+ assert_eq!(canon(&p), \"https://hackernews.com/item/123\");\n+ }\n+\n+ #[test]\n+ fn traverse_captures_subreddit_variable() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"Rust\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_subreddit\"));\n+ assert_eq!(vars(&p).get(\"subreddit\").map(String::as_str), Some(\"Rust\"));\n+ }\n+\n+ #[test]\n+ fn traverse_captures_post_id() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"aww\", \"comments\", \"abc123\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_post\"));\n+ assert_eq!(vars(&p).get(\"post_id\").map(String::as_str), Some(\"abc123\"));\n+ }\n+\n+ #[test]\n+ fn traverse_absorbs_listing_suffix_stays_on_subreddit() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"rust\", \"hot\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_subreddit\"));\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust\");\n+ }\n+\n+ #[test]\n+ fn traverse_absorbs_all_listing_suffixes() {\n+ for suffix in [\"hot\", \"top\", \"new\", \"rising\", \"controversial\"] {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"test\", suffix], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_subreddit\"), \"suffix {suffix}\");\n+ assert_eq!(canon(&p), \"https://reddit.com/r/test\", \"suffix {suffix}\");\n+ }\n+ }\n+\n+ #[test]\n+ fn traverse_absorbs_post_title_slug() {\n+ let p = test_parts(\n+ \"reddit.com\",\n+ &[\"r\", \"rust\", \"comments\", \"aaa\", \"my_great_post_title\"],\n+ &[],\n+ );\n+ assert_eq!(terminal(&p), Some(\"reddit_post\"));\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust/comments/aaa\");\n+ }\n+\n+ #[test]\n+ fn traverse_unknown_segment_falls_back_to_generic() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"rust\", \"wiki\", \"faq\"], &[]);\n+ assert_eq!(terminal(&p), None);\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust/wiki/faq\");\n+ }\n+\n+ #[test]\n+ fn traverse_youtube_watch_requires_v_in_query() {\n+ let p = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"xyz\")]);\n+ assert_eq!(terminal(&p), Some(\"youtube_watch\"));\n+ }\n+\n+ #[test]\n+ fn traverse_youtu_be_captures_vid_id() {\n+ let p = test_parts(\"youtu.be\", &[\"dQw4w9WgXcQ\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"youtu_be_video\"));\n+ assert_eq!(vars(&p).get(\"vid_id\").map(String::as_str), Some(\"dQw4w9WgXcQ\"));\n+ }\n+\n+ #[test]\n+ fn traverse_shorts_sets_video_id_var() {\n+ let p = test_parts(\"youtube.com\", &[\"shorts\", \"abc99\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"youtube_watch\"));\n+ assert_eq!(vars(&p).get(\"video_id\").map(String::as_str), Some(\"abc99\"));\n+ }\n+\n+ #[test]\n+ fn reddit_domain_canonical() {\n+ let p = test_parts(\"reddit.com\", &[], &[]);\n+ assert_eq!(canon(&p), \"https://reddit.com\");\n+ }\n+\n+ #[test]\n+ fn reddit_r_hub_canonical() {\n+ let p = test_parts(\"reddit.com\", &[\"r\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_r_hub\"));\n+ assert_eq!(canon(&p), \"https://reddit.com/r\");\n+ }\n+\n+ #[test]\n+ fn reddit_subreddit_lowercases_name() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"AmITheAsshole\"], &[]);\n+ assert_eq!(canon(&p), \"https://reddit.com/r/amitheasshole\");\n+ }\n+\n+ #[test]\n+ fn reddit_host_aliases_old_new_www() {\n+ for host in [\"old.reddit.com\", \"new.reddit.com\", \"www.reddit.com\"] {\n+ let p = test_parts(host, &[\"r\", \"rust\"], &[]);\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust\", \"host {host}\");\n+ }\n+ }\n+\n+ #[test]\n+ fn reddit_post_strips_slug_and_query() {\n+ let p = test_parts(\n+ \"old.reddit.com\",\n+ &[\"r\", \"Rust\", \"comments\", \"1abc\", \"title_slug_here\"],\n+ &[(\"sort\", \"new\")],\n+ );\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust/comments/1abc\");\n+ }\n+\n+ #[test]\n+ fn reddit_post_multiple_slugs_absorbed() {\n+ let p = test_parts(\n+ \"reddit.com\",\n+ &[\"r\", \"x\", \"comments\", \"id1\", \"slug1\", \"extra\"],\n+ &[],\n+ );\n+ assert_eq!(canon(&p), \"https://reddit.com/r/x/comments/id1\");\n+ }\n+\n+ #[test]\n+ fn reddit_listing_with_query_only() {\n+ let p = test_parts(\"www.reddit.com\", &[\"r\", \"programming\"], &[(\"sort\", \"top\")]);\n+ assert_eq!(canon(&p), \"https://reddit.com/r/programming\");\n+ }\n+\n+ #[test]\n+ fn reddit_subreddit_breadcrumbs_include_r_hub() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"movies\"], &[]);\n+ assert_eq!(\n+ crumbs(&p),\n+ vec![\n+ \"https://reddit.com\",\n+ \"https://reddit.com/r\",\n+ \"https://reddit.com/r/movies\"\n+ ]\n+ );\n+ }\n+\n+ #[test]\n+ fn reddit_post_breadcrumbs_skip_comments_node() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"aww\", \"comments\", \"1trnvdl\"], &[]);\n+ let c = crumbs(&p);\n+ assert!(!c.iter().any(|u| u.ends_with(\"/comments\")));\n+ assert_eq!(\n+ c.last().map(String::as_str),\n+ Some(\"https://reddit.com/r/aww/comments/1trnvdl\")\n+ );\n+ assert!(c.contains(&\"https://reddit.com/r/aww\".to_string()));\n+ }\n+\n+ #[test]\n+ fn reddit_post_parent_is_subreddit_not_comments() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"aww\", \"comments\", \"1trnvdl\"], &[]);\n+ let c = crumbs(&p);\n+ let parent = c.get(c.len() - 2).unwrap();\n+ assert_eq!(parent, \"https://reddit.com/r/aww\");\n+ }\n+\n+ #[test]\n+ fn reddit_domain_parent_is_none_in_breadcrumb_chain() {\n+ let p = test_parts(\"reddit.com\", &[], &[]);\n+ assert_eq!(crumbs(&p), vec![\"https://reddit.com\"]);\n+ }\n+\n+ #[test]\n+ fn youtube_watch_canonical_uses_v_only() {\n+ let p = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"abc\"), (\"t\", \"99\")]);\n+ assert_eq!(canon(&p), \"https://youtube.com/watch?v=abc\");\n+ }\n+\n+ #[test]\n+ fn youtube_query_order_independent() {\n+ let a = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"abc\"), (\"t\", \"4\")]);\n+ let b = test_parts(\"youtube.com\", &[\"watch\"], &[(\"t\", \"4\"), (\"v\", \"abc\")]);\n+ assert_eq!(canon(&a), canon(&b));\n+ }\n+\n+ #[test]\n+ fn youtube_host_aliases() {\n+ for host in [\"www.youtube.com\", \"m.youtube.com\"] {\n+ let p = test_parts(host, &[\"watch\"], &[(\"v\", \"x\")]);\n+ assert_eq!(canon(&p), \"https://youtube.com/watch?v=x\", \"host {host}\");\n+ }\n+ }\n+\n+ #[test]\n+ fn youtube_shorts_canonical_matches_watch() {\n+ let shorts = test_parts(\"youtube.com\", &[\"shorts\", \"vid123\"], &[]);\n+ let watch = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"vid123\")]);\n+ assert_eq!(canon(&shorts), canon(&watch));\n+ assert_eq!(canon(&shorts), \"https://youtube.com/watch?v=vid123\");\n+ }\n+\n+ #[test]\n+ fn youtu_be_matches_youtube_watch() {\n+ let be = test_parts(\"youtu.be\", &[\"dQw4w9WgXcQ\"], &[]);\n+ let watch = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"dQw4w9WgXcQ\")]);\n+ assert_eq!(canon(&be), canon(&watch));\n+ }\n+\n+ #[test]\n+ fn youtube_breadcrumbs_domain_then_watch() {\n+ let p = test_parts(\"youtube.com\", &[\"watch\"], &[(\"v\", \"abc\")]);\n+ assert_eq!(\n+ crumbs(&p),\n+ vec![\"https://youtube.com\", \"https://youtube.com/watch?v=abc\"]\n+ );\n+ }\n+\n+ #[test]\n+ fn youtu_be_breadcrumbs_include_youtube_domain() {\n+ let p = test_parts(\"youtu.be\", &[\"abc\"], &[]);\n+ let c = crumbs(&p);\n+ assert_eq!(c.first().map(String::as_str), Some(\"https://youtube.com\"));\n+ assert_eq!(\n+ c.last().map(String::as_str),\n+ Some(\"https://youtube.com/watch?v=abc\")\n+ );\n+ }\n+\n+ #[test]\n+ fn parsed_urls_match_hand_built_parts() {\n+ let raw = \"https://www.reddit.com/r/rust/comments/aaa/title/?utm=x\";\n+ let parsed = UrlParts::parse(raw).unwrap();\n+ let hand = test_parts(\n+ \"www.reddit.com\",\n+ &[\"r\", \"rust\", \"comments\", \"aaa\", \"title\"],\n+ &[(\"utm\", \"x\")],\n+ );\n+ assert_eq!(canon(&parsed), canon(&hand));\n+ }\n+\n+ #[test]\n+ fn equivalence_cluster_youtube_formats() {\n+ let urls = [\n+ \"https://youtu.be/abc123\",\n+ \"https://www.youtube.com/watch?v=abc123\",\n+ \"https://youtube.com/watch?v=abc123&t=1\",\n+ \"https://m.youtube.com/watch?t=1&v=abc123\",\n+ ];\n+ let canonical: Vec<_> = urls\n+ .iter()\n+ .map(|u| canon(&UrlParts::parse(u).unwrap()))\n+ .collect();\n+ assert!(canonical.iter().all(|c| *c == \"https://youtube.com/watch?v=abc123\"));\n+ }\n+\n+ #[test]\n+ fn equivalence_cluster_reddit_post_formats() {\n+ let urls = [\n+ \"https://old.reddit.com/r/Rust/comments/aaa/slug/\",\n+ \"reddit.com/r/rust/comments/aaa/other_slug\",\n+ \"https://reddit.com/r/RUST/comments/aaa\",\n+ ];\n+ let canonical: Vec<_> = urls\n+ .iter()\n+ .map(|u| canon(&UrlParts::parse(u).unwrap()))\n+ .collect();\n+ assert!(\n+ canonical\n+ .iter()\n+ .all(|c| *c == \"https://reddit.com/r/rust/comments/aaa\")\n+ );\n+ }\n+\n+ #[test]\n+ fn graph_nodes_all_have_valid_parent_links() {\n+ let g = build_graph();\n+ for (id, node) in &g.nodes {\n+ if let Some(parent) = node.parent {\n+ assert!(g.nodes.contains_key(parent), \"node {id} parent {parent}\");\n+ }\n+ }\n+ }\n+\n+ #[test]\n+ fn graph_terminal_canonical_always_succeeds_for_reddit_paths() {\n+ let cases: &[(&[&str], &str)] = &[\n+ (&[\"r\", \"rust\"], \"https://reddit.com/r/rust\"),\n+ (\n+ &[\"r\", \"rust\", \"comments\", \"x\"],\n+ \"https://reddit.com/r/rust/comments/x\",\n+ ),\n+ ];\n+ for (segs, want) in cases {\n+ let p = test_parts(\"reddit.com\", segs, &[]);\n+ assert_eq!(canon(&p), *want);\n+ }\n+ }\n+\n+ #[test]\n+ fn breadcrumb_parent_walk_matches_parent_url_semantics() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"aww\", \"comments\", \"id1\"], &[]);\n+ let c = crumbs(&p);\n+ assert_eq!(c.len(), 4);\n+ assert_eq!(\n+ c.get(c.len() - 2).map(String::as_str),\n+ Some(\"https://reddit.com/r/aww\")\n+ );\n+ }\n+\n+ #[test]\n+ fn youtube_watch_without_v_falls_back_to_generic() {\n+ let p = test_parts(\"youtube.com\", &[\"watch\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"youtube_watch\"));\n+ assert_eq!(canon(&p), \"https://youtube.com/watch\");\n+ }\n+\n+ #[test]\n+ fn reddit_only_comments_path_stops_at_gate() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"rust\", \"comments\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_comments_gate\"));\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust\");\n+ }\n+\n+ #[test]\n+ fn generic_deep_path_many_segments() {\n+ let segs: Vec<&str> = (0..10)\n+ .map(|i| match i {\n+ 0 => \"a\",\n+ 1 => \"b\",\n+ 2 => \"c\",\n+ 3 => \"d\",\n+ 4 => \"e\",\n+ 5 => \"f\",\n+ 6 => \"g\",\n+ 7 => \"h\",\n+ 8 => \"i\",\n+ _ => \"j\",\n+ })\n+ .collect();\n+ let p = test_parts(\"site.com\", &segs, &[]);\n+ assert_eq!(crumbs(&p).len(), 11);\n+ }\n+\n+ #[test]\n+ fn traverse_literal_r_required_for_subreddit() {\n+ let p = test_parts(\"reddit.com\", &[\"rust\"], &[]);\n+ assert_eq!(terminal(&p), None);\n+ }\n+\n+ #[test]\n+ fn http_scheme_upgraded_via_generic_fallback_host() {\n+ let parsed = UrlParts::parse(\"http://example.com/page\").unwrap();\n+ assert_eq!(canon(&parsed), \"https://example.com/page\");\n+ }\n+\n+ #[test]\n+ fn each_graph_node_canonical_is_invokable() {\n+ let g = build_graph();\n+ let empty = Context::default();\n+ for (id, node) in &g.nodes {\n+ let _ = (node.canonical)(&empty);\n+ let _ = id;\n+ }\n+ }\n+\n+ #[test]\n+ fn reddit_double_listing_suffix_both_absorbed() {\n+ let p = test_parts(\"reddit.com\", &[\"r\", \"rust\", \"hot\", \"new\"], &[]);\n+ assert_eq!(terminal(&p), Some(\"reddit_subreddit\"));\n+ assert_eq!(canon(&p), \"https://reddit.com/r/rust\");\n+ }\n+\n+ #[test]\n+ fn youtu_be_empty_path_stays_at_entry() {\n+ let p = test_parts(\"youtu.be\", &[], &[]);\n+ assert_eq!(terminal(&p), Some(\"youtu_be_entry\"));\n+ }\n+}\ndiff --git a/server/src/url_rules/graph_builder.rs b/server/src/url_rules/graph_builder.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..243204ad5ca514fff459057956080cacb5bf38e2\n--- /dev/null\n+++ b/server/src/url_rules/graph_builder.rs\n@@ -0,0 +1,73 @@\n+//! Declarative construction of the URL graph with build-time link validation.\n+\n+use std::collections::HashMap;\n+\n+use super::graph::{CanonicalFn, Edge, EdgePattern, Graph, Node};\n+\n+pub struct GraphBuilder {\n+ nodes: HashMap<&'static str, Node>,\n+ current: Option<&'static str>,\n+}\n+\n+impl GraphBuilder {\n+ pub fn new() -> Self {\n+ Self {\n+ nodes: HashMap::new(),\n+ current: None,\n+ }\n+ }\n+\n+ pub fn node(mut self, id: &'static str) -> Self {\n+ self.nodes.entry(id).or_insert_with(Node::empty);\n+ self.current = Some(id);\n+ self\n+ }\n+\n+ pub fn canonical(mut self, f: CanonicalFn) -> Self {\n+ let id = self.current.expect(\"canonical() without node()\");\n+ self.nodes.get_mut(id).expect(\"node missing\").canonical = f;\n+ self\n+ }\n+\n+ pub fn parent(mut self, parent_id: &'static str) -> Self {\n+ let id = self.current.expect(\"parent() without node()\");\n+ self.nodes.get_mut(id).expect(\"node missing\").parent = Some(parent_id);\n+ self\n+ }\n+\n+ pub fn edge(mut self, pattern: EdgePattern, target: &'static str) -> Self {\n+ let id = self.current.expect(\"edge() without node()\");\n+ self.nodes\n+ .get_mut(id)\n+ .expect(\"node missing\")\n+ .edges\n+ .push(Edge { pattern, target });\n+ self\n+ }\n+\n+ pub fn build(self) -> Graph {\n+ for (id, node) in &self.nodes {\n+ if let Some(parent) = node.parent {\n+ assert!(\n+ self.nodes.contains_key(parent),\n+ \"node {id}: parent {parent} does not exist\"\n+ );\n+ }\n+ for edge in &node.edges {\n+ if !matches!(\n+ edge.pattern,\n+ EdgePattern::AbsorbAny | EdgePattern::AbsorbIf(_)\n+ ) {\n+ assert!(\n+ self.nodes.contains_key(edge.target),\n+ \"node {id}: edge target {} does not exist\",\n+ edge.target\n+ );\n+ }\n+ }\n+ }\n+ Graph {\n+ nodes: self.nodes,\n+ }\n+ }\n+}\ndiff --git a/server/src/url_rules/mod.rs b/server/src/url_rules/mod.rs\nindex 9e1445346ce77a49dd6a7e7713bf9c57aef353cc..ba4ac662acc7bd4d50ee34613eb7eb6fccbfb17b 100644\n--- a/server/src/url_rules/mod.rs\n+++ b/server/src/url_rules/mod.rs\n@@ -1,6 +1,7 @@\n //! URL canonicalization and hierarchy via a semantic graph (DFA + generic fallback).\n \n mod graph;\n+mod graph_builder;\n mod parse;\n mod registry;\n \ndiff --git a/server/src/url_rules/parse.rs b/server/src/url_rules/parse.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..19d0c82feb718817168b8b445fcbfa39cf6aa6ba\n--- /dev/null\n+++ b/server/src/url_rules/parse.rs\n@@ -0,0 +1,169 @@\n+//! Parse raw strings into host, path segments, and query (order-independent).\n+\n+use std::collections::HashMap;\n+\n+use url::Url;\n+\n+#[derive(Debug, Clone)]\n+pub struct UrlParts {\n+ pub scheme: String,\n+ pub host: String,\n+ pub path_segments: Vec,\n+ pub query: HashMap,\n+}\n+\n+impl UrlParts {\n+ pub fn parse(raw: &str) -> Option {\n+ let trimmed = raw.trim();\n+ if trimmed.is_empty() {\n+ return None;\n+ }\n+\n+ let with_scheme = if trimmed.contains(\"://\") {\n+ trimmed.to_string()\n+ } else if trimmed.starts_with(\"r/\") || trimmed.starts_with(\"/r/\") {\n+ let rest = trimmed.trim_start_matches('/').trim_start_matches(\"r/\");\n+ format!(\"https://reddit.com/r/{rest}\")\n+ } else if trimmed.contains('.') && !trimmed.starts_with('/') {\n+ format!(\"https://{trimmed}\")\n+ } else {\n+ trimmed.to_string()\n+ };\n+\n+ let url = Url::parse(&with_scheme).ok()?;\n+ let host = url.host_str()?.to_string();\n+ let path_segments: Vec = url\n+ .path_segments()\n+ .map(|segs| segs.filter(|s| !s.is_empty()).map(str::to_string).collect())\n+ .unwrap_or_default();\n+\n+ let mut query = HashMap::new();\n+ for (k, v) in url.query_pairs() {\n+ query.insert(k.into_owned(), v.into_owned());\n+ }\n+\n+ Some(Self {\n+ scheme: url.scheme().to_string(),\n+ path_segments,\n+ query,\n+ host,\n+ })\n+ }\n+\n+ /// Host normalized for graph entry matching (lowercase, aliases).\n+ pub fn match_host(&self) -> String {\n+ normalize_match_host(&self.host)\n+ }\n+}\n+\n+pub fn normalize_match_host(host: &str) -> String {\n+ let h = host\n+ .strip_prefix(\"www.\")\n+ .unwrap_or(host)\n+ .to_ascii_lowercase();\n+ match h.as_str() {\n+ \"old.reddit.com\" | \"new.reddit.com\" => \"reddit.com\".to_string(),\n+ \"m.youtube.com\" => \"youtube.com\".to_string(),\n+ _ => h,\n+ }\n+}\n+\n+pub fn strip_tracking_query(query: &mut HashMap) {\n+ query.retain(|k, _| {\n+ let lower = k.to_ascii_lowercase();\n+ !(lower.starts_with(\"utm_\")\n+ || matches!(\n+ lower.as_str(),\n+ \"fbclid\" | \"gclid\" | \"ref\" | \"ref_src\" | \"ref_source\" | \"mc_cid\" | \"mc_eid\"\n+ ))\n+ });\n+}\n+\n+#[cfg(test)]\n+pub(crate) fn test_parts(host: &str, segs: &[&str], query: &[(&str, &str)]) -> UrlParts {\n+ UrlParts {\n+ scheme: \"https\".to_string(),\n+ host: host.to_string(),\n+ path_segments: segs.iter().map(|s| (*s).to_string()).collect(),\n+ query: query\n+ .iter()\n+ .map(|(k, v)| (k.to_string(), v.to_string()))\n+ .collect(),\n+ }\n+}\n+\n+#[cfg(test)]\n+mod tests {\n+ use super::*;\n+\n+ #[test]\n+ fn parse_full_url_splits_host_path_query() {\n+ let p = UrlParts::parse(\"https://www.youtube.com/watch?v=abc&t=4\").unwrap();\n+ assert_eq!(p.host, \"www.youtube.com\");\n+ assert_eq!(p.path_segments, vec![\"watch\"]);\n+ assert_eq!(p.query.get(\"v\").map(String::as_str), Some(\"abc\"));\n+ assert_eq!(p.query.get(\"t\").map(String::as_str), Some(\"4\"));\n+ }\n+\n+ #[test]\n+ fn parse_r_shortcut_expands_to_reddit() {\n+ let p = UrlParts::parse(\"r/rust\").unwrap();\n+ assert_eq!(p.match_host(), \"reddit.com\");\n+ assert_eq!(p.path_segments, vec![\"r\", \"rust\"]);\n+ }\n+\n+ #[test]\n+ fn parse_slash_r_shortcut() {\n+ let p = UrlParts::parse(\"/r/aww\").unwrap();\n+ assert_eq!(p.path_segments, vec![\"r\", \"aww\"]);\n+ }\n+\n+ #[test]\n+ fn parse_schemeless_host_path() {\n+ let p = UrlParts::parse(\"reddit.com/r/rust/comments/aaa/slug\").unwrap();\n+ assert_eq!(p.match_host(), \"reddit.com\");\n+ assert_eq!(\n+ p.path_segments,\n+ vec![\"r\", \"rust\", \"comments\", \"aaa\", \"slug\"]\n+ );\n+ }\n+\n+ #[test]\n+ fn parse_empty_returns_none() {\n+ assert!(UrlParts::parse(\"\").is_none());\n+ assert!(UrlParts::parse(\" \").is_none());\n+ }\n+\n+ #[test]\n+ fn normalize_match_host_reddit_aliases() {\n+ assert_eq!(normalize_match_host(\"old.reddit.com\"), \"reddit.com\");\n+ assert_eq!(normalize_match_host(\"NEW.reddit.com\"), \"reddit.com\");\n+ assert_eq!(normalize_match_host(\"www.reddit.com\"), \"reddit.com\");\n+ }\n+\n+ #[test]\n+ fn normalize_match_host_youtube_aliases() {\n+ assert_eq!(normalize_match_host(\"m.youtube.com\"), \"youtube.com\");\n+ assert_eq!(normalize_match_host(\"www.youtube.com\"), \"youtube.com\");\n+ }\n+\n+ #[test]\n+ fn strip_tracking_query_removes_known_params() {\n+ let mut q = HashMap::from([\n+ (\"v\".into(), \"1\".into()),\n+ (\"utm_source\".into(), \"x\".into()),\n+ (\"fbclid\".into(), \"y\".into()),\n+ (\"ref\".into(), \"z\".into()),\n+ ]);\n+ strip_tracking_query(&mut q);\n+ assert_eq!(q.len(), 1);\n+ assert_eq!(q.get(\"v\").map(String::as_str), Some(\"1\"));\n+ }\n+\n+ #[test]\n+ fn strip_tracking_query_utm_prefix() {\n+ let mut q = HashMap::from([(\"utm_campaign\".into(), \"email\".into())]);\n+ strip_tracking_query(&mut q);\n+ assert!(q.is_empty());\n+ }\n+}\ndiff --git a/server/src/url_rules/registry_tests.rs b/server/src/url_rules/registry_tests.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..7b76b550f808f590e011469fdae02adf603b43d2\n--- /dev/null\n+++ b/server/src/url_rules/registry_tests.rs\n@@ -0,0 +1,195 @@\n+//! End-to-end tests for the public registry API (`canonicalize_raw`, breadcrumbs, parent).\n+\n+use super::registry::{\n+ canonicalize_raw, looks_like_url, navigable_breadcrumbs, parent_url, resolve_id,\n+};\n+\n+fn canon(raw: &str) -> String {\n+ canonicalize_raw(raw).unwrap().canonical\n+}\n+\n+#[test]\n+fn looks_like_url_positive_cases() {\n+ for raw in [\n+ \"https://reddit.com/r/rust\",\n+ \"r/rust\",\n+ \"/r/aww\",\n+ \"reddit.com/r/x\",\n+ \"www.example.com/path\",\n+ \"youtu.be/abc\",\n+ ] {\n+ assert!(looks_like_url(raw), \"{raw}\");\n+ }\n+}\n+\n+#[test]\n+fn looks_like_url_negative_cases() {\n+ for raw in [\"alpha\", \"beta\", \"\", \"hello world\", \"no-dots\"] {\n+ assert!(!looks_like_url(raw), \"{raw}\");\n+ }\n+}\n+\n+#[test]\n+fn resolve_id_matches_canonicalize_raw() {\n+ let raw = \"https://youtu.be/xyz\";\n+ assert_eq!(\n+ resolve_id(raw).as_deref(),\n+ Some(canon(raw).as_str())\n+ );\n+}\n+\n+#[test]\n+fn canonicalize_empty_returns_none() {\n+ assert!(canonicalize_raw(\"\").is_none());\n+}\n+\n+#[test]\n+fn alias_when_slug_stripped() {\n+ let r = canonicalize_raw(\n+ \"https://reddit.com/r/rust/comments/aaa/very_long_title_slug\",\n+ )\n+ .unwrap();\n+ assert_eq!(r.canonical, \"https://reddit.com/r/rust/comments/aaa\");\n+ assert!(r.alias_of.is_some());\n+}\n+\n+#[test]\n+fn alias_none_when_already_canonical() {\n+ let raw = \"https://reddit.com/r/rust\";\n+ let r = canonicalize_raw(raw).unwrap();\n+ assert_eq!(r.canonical, raw);\n+ assert!(r.alias_of.is_none());\n+}\n+\n+#[test]\n+fn parent_url_subreddit_under_r_hub() {\n+ assert_eq!(\n+ parent_url(\"https://reddit.com/r/movies\").as_deref(),\n+ Some(\"https://reddit.com/r\")\n+ );\n+}\n+\n+#[test]\n+fn parent_url_domain_has_none() {\n+ assert_eq!(parent_url(\"https://reddit.com\").as_deref(), None);\n+}\n+\n+#[test]\n+fn parent_url_generic_site() {\n+ assert_eq!(\n+ parent_url(\"https://example.com/a/b\").as_deref(),\n+ Some(\"https://example.com/a\")\n+ );\n+}\n+\n+#[test]\n+fn breadcrumbs_from_canonical_string_roundtrip() {\n+ let id = \"https://reddit.com/r/golang/comments/abc123\";\n+ let crumbs = navigable_breadcrumbs(id);\n+ assert_eq!(crumbs.last().map(String::as_str), Some(id));\n+}\n+\n+// --- Table: Reddit raw URLs → canonical ---\n+\n+#[test]\n+fn reddit_canonical_matrix() {\n+ let cases: &[(&str, &str)] = &[\n+ (\"r/rust\", \"https://reddit.com/r/rust\"),\n+ (\"/r/aww\", \"https://reddit.com/r/aww\"),\n+ (\"https://reddit.com/r/rust\", \"https://reddit.com/r/rust\"),\n+ (\n+ \"https://www.reddit.com/r/programming/new\",\n+ \"https://reddit.com/r/programming\",\n+ ),\n+ (\n+ \"https://old.reddit.com/r/test/comments/xyz/slug/\",\n+ \"https://reddit.com/r/test/comments/xyz\",\n+ ),\n+ (\n+ \"reddit.com/r/Movies/comments/abc/Title_Case_Slug\",\n+ \"https://reddit.com/r/movies/comments/abc\",\n+ ),\n+ ];\n+ for (raw, want) in cases {\n+ assert_eq!(canon(raw), *want, \"raw={raw}\");\n+ }\n+}\n+\n+// --- Table: YouTube raw URLs → canonical ---\n+\n+#[test]\n+fn youtube_canonical_matrix() {\n+ let cases: &[(&str, &str)] = &[\n+ (\n+ \"https://youtube.com/watch?v=abc\",\n+ \"https://youtube.com/watch?v=abc\",\n+ ),\n+ (\n+ \"https://www.youtube.com/watch?v=abc&t=1&feature=share\",\n+ \"https://youtube.com/watch?v=abc\",\n+ ),\n+ (\"https://youtu.be/abc\", \"https://youtube.com/watch?v=abc\"),\n+ (\n+ \"https://youtube.com/shorts/abc\",\n+ \"https://youtube.com/watch?v=abc\",\n+ ),\n+ ];\n+ for (raw, want) in cases {\n+ assert_eq!(canon(raw), *want, \"raw={raw}\");\n+ }\n+}\n+\n+// --- Table: generic sites ---\n+\n+#[test]\n+fn generic_canonical_matrix() {\n+ let cases: &[(&str, &str)] = &[\n+ (\n+ \"https://news.ycombinator.com/item?id=38472\",\n+ \"https://news.ycombinator.com/item?id=38472\",\n+ ),\n+ (\n+ \"https://www.github.com/rust-lang/rust/issues/1?utm_source=x\",\n+ \"https://github.com/rust-lang/rust/issues/1\",\n+ ),\n+ (\"https://example.com\", \"https://example.com\"),\n+ ];\n+ for (raw, want) in cases {\n+ assert_eq!(canon(raw), *want, \"raw={raw}\");\n+ }\n+}\n+\n+// --- Phantom /comments/ regression (sorter2-specific) ---\n+\n+#[test]\n+fn phantom_comments_not_in_breadcrumbs_for_post() {\n+ let crumbs = navigable_breadcrumbs(\"https://reddit.com/r/rust/comments/aaa\");\n+ assert!(!crumbs.iter().any(|c| c.ends_with(\"/comments\")));\n+}\n+\n+#[test]\n+fn phantom_comments_not_sibling_of_subreddit_in_breadcrumb_chain() {\n+ let crumbs = navigable_breadcrumbs(\"https://reddit.com/r/rust/comments/aaa\");\n+ let subs: Vec<_> = crumbs\n+ .iter()\n+ .filter(|c| c.contains(\"/r/rust\") && !c.contains(\"/comments/\"))\n+ .collect();\n+ assert_eq!(subs, vec![\"https://reddit.com/r/rust\"]);\n+}\n+\n+// --- Distinct items must stay distinct ---\n+\n+#[test]\n+fn different_posts_different_canonical() {\n+ let a = canon(\"https://reddit.com/r/rust/comments/aaa\");\n+ let b = canon(\"https://reddit.com/r/rust/comments/bbb\");\n+ assert_ne!(a, b);\n+}\n+\n+#[test]\n+fn different_subreddits_different_canonical() {\n+ assert_ne!(\n+ canon(\"https://reddit.com/r/rust\"),\n+ canon(\"https://reddit.com/r/golang\")\n+ );\n+}\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity.\n\nOAuth providers only attach to a session UUID (first link creates the\nprincipal); linked providers stay private on the account page.\n\nCo-authored-by: Cursor \n\nSide B — unified diff (full patch):\ndiff --git a/AGENTS.md b/AGENTS.md\nindex 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):\n - `SORTER2_DATA_DIR` — default `./data` (created on startup)\n - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`\n - `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)\n-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)\n-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)\n+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)\n+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)\n+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)\n+\n+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.\n \n Health check: `GET /healthz` → `ok`.\n \ndiff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs\nindex 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644\n--- a/server/src/auth/mod.rs\n+++ b/server/src/auth/mod.rs\n@@ -1,4 +1,8 @@\n-//! GitHub OAuth login, session cookies, and vote actor resolution.\n+//! OAuth linking, session cookies, and vote actor resolution.\n+//!\n+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID\n+//! (first link creates the principal; later links attach while logged in).\n+//! Which providers are linked is private to the account owner.\n \n pub mod config;\n pub mod identity;\n@@ -22,7 +26,9 @@ use crate::{\n form_template::template_json_compact,\n html::layout,\n state::AppState,\n- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},\n+ storage_schema::{\n+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,\n+ },\n ui_action::UI_RPC_FIELD,\n };\n \n@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {\n pub struct LoginQuery {\n #[serde(default)]\n pub return_to: Option,\n+ #[serde(default)]\n+ pub error: Option,\n }\n \n #[derive(Debug, Deserialize)]\n-pub struct GitHubStartQuery {\n+pub struct OAuthStartQuery {\n #[serde(default)]\n pub return_to: Option,\n #[serde(default)]\n@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {\n .unwrap_or_else(|| \"/\".to_string())\n }\n \n-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {\n+/// Available OAuth link targets: `(provider_key, label, start_href)`.\n+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {\n let mut out = Vec::new();\n+ let enc = urlencoding::encode(return_to);\n if oauth::GitHubConfig::from_env(base_url).is_some() {\n out.push((\n- \"GitHub\",\n- format!(\n- \"/auth/github?return_to={}\",\n- urlencoding::encode(return_to)\n- ),\n+ \"github\",\n+ oauth::provider_label(\"github\"),\n+ format!(\"/auth/github?return_to={enc}\"),\n+ ));\n+ }\n+ if oauth::RedditConfig::from_env(base_url).is_some() {\n+ out.push((\n+ \"reddit\",\n+ oauth::provider_label(\"reddit\"),\n+ format!(\"/auth/reddit?return_to={enc}\"),\n ));\n }\n out\n@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result Markup {\n+fn login_error_message(code: Option<&str>) -> Option<&'static str> {\n+ match code {\n+ Some(\"oauth_taken\") => {\n+ Some(\"that OAuth account is already linked to a different sorter2 account\")\n+ }\n+ Some(\"oauth_failed\") => Some(\"OAuth failed — try again\"),\n+ _ => None,\n+ }\n+}\n+\n+fn signed_out_body(\n+ providers: &[(&str, &str, String)],\n+ error: Option<&str>,\n+) -> Markup {\n html! {\n main class=\"panel login-page\" {\n section class=\"login-section\" {\n h1 { \"sign in\" }\n- p class=\"muted\" { \"link an account to vote under a lasting alias\" }\n+ p class=\"muted\" {\n+ \"link an OAuth account to create your identity, then claim an alias to vote\"\n+ }\n+ @if let Some(msg) = login_error_message(error) {\n+ p class=\"alias-bad\" data-testid=\"login-error\" { (msg) }\n+ }\n @if providers.is_empty() {\n p class=\"muted\" {\n- \"OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.\"\n+ \"OAuth is not configured. Set GitHub and/or Reddit client credentials.\"\n }\n } @else {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in providers {\n li {\n a href=(href) class=\"btn-primary oauth-provider\"\n- data-testid=(format!(\"oauth-{}\", name.to_lowercase())) {\n- (format!(\"Continue with {name}\"))\n+ data-testid=(format!(\"oauth-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {\n fn account_body(\n actor: &session::SessionActor,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ // Provider keys already linked to this UUID (private).\n+ linked: &[String],\n+ // Providers available to link: not yet attached.\n+ unlinkable: &[(&str, &str, String)],\n claim_forms: Markup,\n ) -> Markup {\n let current = actor.pseudonym.trim();\n@@ -212,16 +248,29 @@ fn account_body(\n (claim_forms)\n }\n \n- @if !providers.is_empty() {\n- section class=\"login-section\" {\n- h2 { \"linked sign-in\" }\n- p class=\"muted small\" { \"sign in again with the same provider to return to this account\" }\n+ section class=\"login-section\" {\n+ h2 { \"linked sign-in\" }\n+ p class=\"muted small\" {\n+ \"private to you — linking more providers raises trust weight without publishing which accounts you use\"\n+ }\n+ @if linked.is_empty() {\n+ p class=\"muted\" data-testid=\"linked-providers-empty\" { \"none yet\" }\n+ } @else {\n+ ul class=\"linked-provider-list\" data-testid=\"linked-providers\" {\n+ @for key in linked {\n+ li data-testid=(format!(\"linked-{key}\")) {\n+ (oauth::provider_label(key))\n+ }\n+ }\n+ }\n+ }\n+ @if !unlinkable.is_empty() {\n ul class=\"oauth-provider-list\" {\n- @for (name, href) in providers {\n+ @for (key, label, href) in unlinkable {\n li {\n a href=(href) class=\"btn-secondary oauth-provider\"\n- data-testid=(format!(\"oauth-relink-{}\", name.to_lowercase())) {\n- (format!(\"Re-link {name}\"))\n+ data-testid=(format!(\"oauth-link-{key}\")) {\n+ (format!(\"Link {label}\"))\n }\n }\n }\n@@ -243,12 +292,21 @@ fn account_body(\n fn login_body(\n session: Option<&session::SessionActor>,\n aliases: &[String],\n- providers: &[(&str, String)],\n+ linked: &[String],\n+ providers: &[(&str, &str, String)],\n claim_forms: Option,\n+ error: Option<&str>,\n ) -> Markup {\n match (session, claim_forms) {\n- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),\n- _ => signed_out_body(providers),\n+ (Some(actor), Some(forms)) => {\n+ let unlinkable: Vec<_> = providers\n+ .iter()\n+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))\n+ .cloned()\n+ .collect();\n+ account_body(actor, aliases, linked, &unlinkable, forms)\n+ }\n+ _ => signed_out_body(providers, error),\n }\n }\n \n@@ -268,6 +326,10 @@ pub async fn login_page(\n .as_ref()\n .map(|s| alias_list(db, &s.uuid))\n .unwrap_or_default();\n+ let linked = session\n+ .as_ref()\n+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())\n+ .unwrap_or_default();\n let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);\n \n let claim_forms = if session.is_some() {\n@@ -282,7 +344,14 @@ pub async fn login_page(\n } else {\n \"login · sorter2\"\n },\n- login_body(session.as_ref(), &aliases, &providers, claim_forms),\n+ login_body(\n+ session.as_ref(),\n+ &aliases,\n+ &linked,\n+ &providers,\n+ claim_forms,\n+ query.error.as_deref(),\n+ ),\n state.views.get_views(\"/login\"),\n session\n .as_ref()\n@@ -302,7 +371,6 @@ pub async fn alias_page(\n let db = state.projection_store.db();\n let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;\n if session::session_has_pseudonym(&session) {\n- // Already onboarded — manage aliases on the account page.\n return Ok(Redirect::to(\"/login\").into_response());\n }\n \n@@ -331,7 +399,7 @@ pub async fn alias_page(\n pub async fn github_start(\n State(state): State,\n jar: CookieJar,\n- Query(query): Query,\n+ Query(query): Query,\n ) -> Result {\n let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))\n .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n@@ -342,7 +410,28 @@ pub async fn github_start(\n } else {\n None\n };\n- let url = oauth::authorize_url(&cfg, &state_token, mock_user);\n+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);\n+ let jar = jar\n+ .add(session::oauth_state_cookie_value(&state_token))\n+ .add(session::auth_return_cookie_value(&return_to));\n+ Ok((jar, Redirect::temporary(&url)).into_response())\n+}\n+\n+pub async fn reddit_start(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());\n+ let state_token = session::new_oauth_state();\n+ let mock_user = if config::mock_oauth_allowed() {\n+ query.mock_user.as_deref()\n+ } else {\n+ None\n+ };\n+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);\n let jar = jar\n .add(session::oauth_state_cookie_value(&state_token))\n .add(session::auth_return_cookie_value(&return_to));\n@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {\n pub state: String,\n }\n \n+/// Link `provider:provider_id` to a UUID.\n+///\n+/// - Logged in + new provider → attach to session UUID\n+/// - Logged in + already ours → no-op\n+/// - Logged in + owned by someone else → conflict\n+/// - Logged out + known link → resume that UUID\n+/// - Logged out + unknown → create principal + first link\n async fn finish_oauth_login(\n state: &AppState,\n jar: CookieJar,\n@@ -364,11 +460,41 @@ async fn finish_oauth_login(\n let db = state.projection_store.db();\n let return_to = return_from_query_or_jar(&jar, None);\n \n- let uuid = match oauth_link_owner(db, provider, &provider_id)\n- .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?\n- {\n- Some(existing) => existing,\n- None => {\n+ let existing_owner = oauth_link_owner(db, provider, &provider_id)\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let session_uuid = session::session_id_from_jar(&jar)\n+ .as_deref()\n+ .and_then(|id| session::load_valid_session(db, id))\n+ .map(|s| s.uuid);\n+ let linking_while_logged_in = session_uuid.is_some();\n+\n+ let uuid = match (session_uuid, existing_owner) {\n+ (Some(session_uuid), Some(owner)) if owner == session_uuid => session_uuid,\n+ (Some(_), Some(_)) => {\n+ return Ok((\n+ jar.add(session::clear_oauth_state_cookie()),\n+ \"/login?error=oauth_taken\".into(),\n+ ));\n+ }\n+ (Some(session_uuid), None) => {\n+ let ts = now_ms();\n+ state\n+ .append_identity_events(vec![Event::OauthLinked {\n+ uuid: session_uuid.clone(),\n+ provider: provider.to_string(),\n+ provider_id,\n+ ts,\n+ }])\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"oauth link append failed\");\n+ StatusCode::INTERNAL_SERVER_ERROR\n+ })?;\n+ session_uuid\n+ }\n+ (None, Some(owner)) => owner,\n+ (None, None) => {\n let uuid = new_actor_uuid();\n let ts = now_ms();\n state\n@@ -409,6 +535,9 @@ async fn finish_oauth_login(\n \"/login/alias?return_to={}\",\n urlencoding::encode(&return_to)\n )\n+ } else if linking_while_logged_in {\n+ // Additional link while already in an account → stay on account page.\n+ \"/login\".to_string()\n } else {\n return_to\n };\n@@ -434,22 +563,57 @@ pub async fn github_callback(\n .build()\n .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n \n- let token = oauth::exchange_code(&client, &cfg, &query.code)\n+ let token = oauth::github_exchange_code(&client, &cfg, &query.code)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github oauth token exchange failed\");\n StatusCode::BAD_GATEWAY\n })?;\n- let user = oauth::fetch_user(&client, &cfg.api_base, &token)\n+ let user = oauth::github_fetch_user(&client, &cfg.api_base, &token)\n .await\n .map_err(|e| {\n tracing::warn!(err = %e, \"github user fetch failed\");\n StatusCode::BAD_GATEWAY\n })?;\n \n- let provider = \"github\";\n- let provider_id = oauth::provider_id(&user);\n- let (jar, dest) = finish_oauth_login(&state, jar, provider, provider_id).await?;\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"github\", oauth::github_provider_id(&user)).await?;\n+ Ok((jar, Redirect::to(&dest)).into_response())\n+}\n+\n+pub async fn reddit_callback(\n+ State(state): State,\n+ jar: CookieJar,\n+ Query(query): Query,\n+) -> Result {\n+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))\n+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;\n+\n+ let expected_state = session::oauth_state_from_jar(&jar).ok_or(StatusCode::BAD_REQUEST)?;\n+ if expected_state != query.state {\n+ return Err(StatusCode::BAD_REQUEST);\n+ }\n+\n+ let client = Client::builder()\n+ .timeout(std::time::Duration::from_secs(15))\n+ .build()\n+ .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;\n+\n+ let token = oauth::reddit_exchange_code(&client, &cfg, &query.code)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit oauth token exchange failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+ let user = oauth::reddit_fetch_user(&client, &cfg, &token)\n+ .await\n+ .map_err(|e| {\n+ tracing::warn!(err = %e, \"reddit user fetch failed\");\n+ StatusCode::BAD_GATEWAY\n+ })?;\n+\n+ let (jar, dest) =\n+ finish_oauth_login(&state, jar, \"reddit\", oauth::reddit_provider_id(&user)).await?;\n Ok((jar, Redirect::to(&dest)).into_response())\n }\n \ndiff --git a/server/src/auth/oauth.rs b/server/src/auth/oauth.rs\nindex b80078fee0c5acd905b9125d29454e46c4e0d066..369b1527d9032cf312a07819279e0f988ef4a36e 100644\n--- a/server/src/auth/oauth.rs\n+++ b/server/src/auth/oauth.rs\n@@ -1,8 +1,15 @@\n-//! GitHub OAuth (raw reqwest, same style as reddit.rs).\n+//! OAuth providers (GitHub + Reddit). Provider accounts only *link* to a UUID;\n+//! the UUID is the canonical identity. Which providers are linked is private.\n \n use reqwest::Client;\n use serde::Deserialize;\n \n+use crate::reddit::{\n+ default_user_agent, reddit_oauth_api_base, reddit_oauth_token_base,\n+};\n+\n+// ── GitHub ──────────────────────────────────────────────────────────────────\n+\n #[derive(Debug, Clone)]\n pub struct GitHubConfig {\n pub client_id: String,\n@@ -40,7 +47,7 @@ impl GitHubConfig {\n }\n \n #[derive(Debug, Deserialize)]\n-struct TokenResponse {\n+struct GitHubTokenResponse {\n access_token: String,\n }\n \n@@ -50,7 +57,7 @@ pub struct GitHubUser {\n pub login: String,\n }\n \n-pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n+pub fn github_authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -> String {\n let mut url = format!(\n \"{}/login/oauth/authorize?client_id={}&redirect_uri={}&scope=read:user&state={}\",\n cfg.oauth_base.trim_end_matches('/'),\n@@ -65,7 +72,7 @@ pub fn authorize_url(cfg: &GitHubConfig, state: &str, mock_user: Option<&str>) -\n url\n }\n \n-pub async fn exchange_code(\n+pub async fn github_exchange_code(\n client: &Client,\n cfg: &GitHubConfig,\n code: &str,\n@@ -90,14 +97,14 @@ pub async fn exchange_code(\n return Err(format!(\"github token HTTP {}\", resp.status()));\n }\n \n- let body: TokenResponse = resp\n+ let body: GitHubTokenResponse = resp\n .json()\n .await\n .map_err(|e| format!(\"github token parse failed: {e}\"))?;\n Ok(body.access_token)\n }\n \n-pub async fn fetch_user(\n+pub async fn github_fetch_user(\n client: &Client,\n api_base: &str,\n access_token: &str,\n@@ -120,10 +127,149 @@ pub async fn fetch_user(\n .map_err(|e| format!(\"github user parse failed: {e}\"))\n }\n \n-pub fn provider_id(user: &GitHubUser) -> String {\n+pub fn github_provider_id(user: &GitHubUser) -> String {\n user.id.to_string()\n }\n \n+// ── Reddit ──────────────────────────────────────────────────────────────────\n+\n+#[derive(Debug, Clone)]\n+pub struct RedditConfig {\n+ pub client_id: String,\n+ pub client_secret: String,\n+ pub redirect_uri: String,\n+ /// Host for `/api/v1/authorize` (www.reddit.com in production).\n+ pub authorize_base: String,\n+ /// Host for `POST /api/v1/access_token`.\n+ pub token_base: String,\n+ /// Host for bearer `GET /api/v1/me` (oauth.reddit.com).\n+ pub api_base: String,\n+ pub user_agent: String,\n+}\n+\n+/// Authorize page base; defaults to the same host as token POSTs.\n+pub fn reddit_authorize_base() -> String {\n+ std::env::var(\"REDDIT_OAUTH_AUTHORIZE_BASE\")\n+ .or_else(|_| std::env::var(\"REDDIT_OAUTH_BASE\"))\n+ .unwrap_or_else(|_| \"https://www.reddit.com\".into())\n+}\n+\n+impl RedditConfig {\n+ pub fn from_env(base_url: &str) -> Option {\n+ let client_id = std::env::var(\"REDDIT_CLIENT_ID\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_ID\"))\n+ .ok()?;\n+ let client_secret = std::env::var(\"REDDIT_CLIENT_SECRET\")\n+ .or_else(|_| std::env::var(\"REDDIT_APP_SECRET\"))\n+ .ok()?;\n+ if client_id.is_empty() || client_secret.is_empty() {\n+ return None;\n+ }\n+ let base = base_url.trim_end_matches('/');\n+ Some(Self {\n+ client_id,\n+ client_secret,\n+ redirect_uri: format!(\"{base}/auth/reddit/callback\"),\n+ authorize_base: reddit_authorize_base(),\n+ token_base: reddit_oauth_token_base(),\n+ api_base: reddit_oauth_api_base(),\n+ user_agent: default_user_agent(),\n+ })\n+ }\n+}\n+\n+#[derive(Debug, Deserialize)]\n+struct RedditTokenResponse {\n+ access_token: String,\n+}\n+\n+#[derive(Debug, Deserialize)]\n+pub struct RedditUser {\n+ /// Stable id (`t2_…`); never use `name` as identity.\n+ pub id: String,\n+ pub name: String,\n+}\n+\n+pub fn reddit_authorize_url(cfg: &RedditConfig, state: &str, mock_user: Option<&str>) -> String {\n+ let mut url = format!(\n+ \"{}/api/v1/authorize?client_id={}&response_type=code&state={}&redirect_uri={}&duration=temporary&scope=identity\",\n+ cfg.authorize_base.trim_end_matches('/'),\n+ urlencoding::encode(&cfg.client_id),\n+ urlencoding::encode(state),\n+ urlencoding::encode(&cfg.redirect_uri),\n+ );\n+ if let Some(user) = mock_user {\n+ url.push_str(\"&mock_user=\");\n+ url.push_str(&urlencoding::encode(user));\n+ }\n+ url\n+}\n+\n+pub async fn reddit_exchange_code(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ code: &str,\n+) -> Result {\n+ let resp = client\n+ .post(format!(\n+ \"{}/api/v1/access_token\",\n+ cfg.token_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .basic_auth(&cfg.client_id, Some(&cfg.client_secret))\n+ .form(&[\n+ (\"grant_type\", \"authorization_code\"),\n+ (\"code\", code),\n+ (\"redirect_uri\", cfg.redirect_uri.as_str()),\n+ ])\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit token request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ let status = resp.status();\n+ let body = resp.text().await.unwrap_or_default();\n+ return Err(format!(\"reddit token HTTP {status}: {body}\"));\n+ }\n+\n+ let body: RedditTokenResponse = resp\n+ .json()\n+ .await\n+ .map_err(|e| format!(\"reddit token parse failed: {e}\"))?;\n+ Ok(body.access_token)\n+}\n+\n+pub async fn reddit_fetch_user(\n+ client: &Client,\n+ cfg: &RedditConfig,\n+ access_token: &str,\n+) -> Result {\n+ let resp = client\n+ .get(format!(\n+ \"{}/api/v1/me\",\n+ cfg.api_base.trim_end_matches('/')\n+ ))\n+ .header(\"User-Agent\", &cfg.user_agent)\n+ .bearer_auth(access_token)\n+ .send()\n+ .await\n+ .map_err(|e| format!(\"reddit user request failed: {e}\"))?;\n+\n+ if !resp.status().is_success() {\n+ return Err(format!(\"reddit user HTTP {}\", resp.status()));\n+ }\n+\n+ resp.json()\n+ .await\n+ .map_err(|e| format!(\"reddit user parse failed: {e}\"))\n+}\n+\n+pub fn reddit_provider_id(user: &RedditUser) -> String {\n+ user.id.clone()\n+}\n+\n+// ── Shared helpers ──────────────────────────────────────────────────────────\n+\n pub fn validate_pseudonym(raw: &str) -> Result {\n let trimmed = raw.trim();\n if trimmed.is_empty() {\n@@ -144,3 +290,12 @@ pub fn validate_pseudonym(raw: &str) -> Result {\n pub fn sanitize_pseudonym(login: &str) -> String {\n validate_pseudonym(login).unwrap_or_else(|_| \"user\".to_string())\n }\n+\n+/// Display name for a provider key (`github` → `GitHub`). Never show provider ids.\n+pub fn provider_label(provider: &str) -> &'static str {\n+ match provider {\n+ \"github\" => \"GitHub\",\n+ \"reddit\" => \"Reddit\",\n+ _ => \"OAuth\",\n+ }\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 84f2565b105fb302241b949af64bd5e49916eab2..0d948af1457504fdbd34d0b14261f65ac58da0ec 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -47,6 +47,8 @@ pub fn create_app(state: AppState) -> Router {\n .route(\"/login/alias\", get(crate::auth::alias_page))\n .route(\"/auth/github\", get(crate::auth::github_start))\n .route(\"/auth/github/callback\", get(crate::auth::github_callback))\n+ .route(\"/auth/reddit\", get(crate::auth::reddit_start))\n+ .route(\"/auth/reddit/callback\", get(crate::auth::reddit_callback))\n .route(\"/auth/logout\", post(crate::auth::logout))\n .route(\"/auth/switch\", post(crate::auth::switch_pseudonym))\n .route(\"/ui\", post(crate::api::ui_html::post_ui_html))\ndiff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs\nindex 4fb4b48ee0a53b7f673fae0c9731eed5acc33332..f50458c2ff3c447a3cfd28adb298e6883a2da4e9 100644\n--- a/server/src/projection_apply.rs\n+++ b/server/src/projection_apply.rs\n@@ -4,6 +4,8 @@\n //! child links, recent-vote appends) plus a cursor advance, all committed in\n //! one atomic `DisableWal` batch.\n \n+use std::collections::HashMap;\n+\n use crate::{\n event_log::EventLogError,\n events::{Event, EventRecord},\n@@ -44,6 +46,8 @@ pub fn apply_records(\n let db = projection_store.db();\n let mut batch = db.batch();\n let mut last_seq = 0u64;\n+ // Weight reads must see earlier writes in this same batch.\n+ let mut pending_weights: HashMap = HashMap::new();\n \n for record in records {\n match &record.event {\n@@ -85,6 +89,7 @@ pub fn apply_records(\n ensure_path_writes(&mut batch, &parsed);\n }\n Event::PrincipalCreated { uuid, .. } => {\n+ pending_weights.insert(uuid.clone(), BASE_TRUST_WEIGHT);\n batch.write(\n Store::root()\n .user_weights()\n@@ -112,17 +117,25 @@ pub fn apply_records(\n }\n } else {\n batch.write(Store::root().oauth_links().key(&link_key).set(uuid));\n- let current = Store::root()\n- .user_weights()\n- .key(&uuid.clone())\n- .get(db)\n- .map_err(|e| EventLogError::Apply(e.to_string()))?\n+ let current = pending_weights\n+ .get(uuid)\n+ .copied()\n+ .or_else(|| {\n+ Store::root()\n+ .user_weights()\n+ .key(&uuid.clone())\n+ .get(db)\n+ .ok()\n+ .flatten()\n+ })\n .unwrap_or(BASE_TRUST_WEIGHT);\n+ let next = trust_weight_after_link(current);\n+ pending_weights.insert(uuid.clone(), next);\n batch.write(\n Store::root()\n .user_weights()\n .key(&uuid.clone())\n- .set(&trust_weight_after_link(current)),\n+ .set(&next),\n );\n }\n }\n@@ -205,6 +218,15 @@ mod tests {\n ),\n record(\n 3,\n+ Event::OauthLinked {\n+ uuid: uuid.into(),\n+ provider: \"reddit\".into(),\n+ provider_id: \"t2_abc\".into(),\n+ ts,\n+ },\n+ ),\n+ record(\n+ 4,\n Event::PseudonymClaimed {\n uuid: uuid.into(),\n pseudonym: \"octocat\".into(),\n@@ -219,8 +241,12 @@ mod tests {\n oauth_link_owner(store.db(), \"github\", \"42\").unwrap(),\n Some(uuid.to_string())\n );\n+ assert_eq!(\n+ crate::storage_schema::linked_providers_for_uuid(store.db(), uuid).unwrap(),\n+ vec![\"github\".to_string(), \"reddit\".to_string()]\n+ );\n assert_eq!(resolve_actor_uuid(store.db(), \"octocat\").unwrap(), uuid);\n- assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 1.5);\n+ assert_eq!(user_trust_weight(store.db(), uuid).unwrap(), 2.0);\n let aliases = Store::root()\n .user_pseudonyms()\n .key(&uuid.to_string())\ndiff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs\nindex b942810afd96d3bf01b7765718303a39be4ef8d2..dac6f8e6080e3f5683c24dbb8861f5a981d456c4 100644\n--- a/server/src/storage_schema.rs\n+++ b/server/src/storage_schema.rs\n@@ -103,6 +103,25 @@ pub fn oauth_link_owner(db: &Db, provider: &str, provider_id: &str) -> durable::\n .get(db)\n }\n \n+/// Provider names linked to a UUID (`github`, `reddit`, …). Private — for the\n+/// account owner's page only; never expose which providers are linked publicly.\n+pub fn linked_providers_for_uuid(db: &Db, uuid: &str) -> durable::Result> {\n+ let mut providers = Vec::new();\n+ for (key, owner) in Store::root().oauth_links().iter(db)? {\n+ if owner != uuid {\n+ continue;\n+ }\n+ let Some((provider, _)) = key.split_once(':') else {\n+ continue;\n+ };\n+ if !providers.iter().any(|p| p == provider) {\n+ providers.push(provider.to_string());\n+ }\n+ }\n+ providers.sort();\n+ Ok(providers)\n+}\n+\n pub const RECENT_VOTES_CAP: u64 = 200;\n \n fn id_key(id: &ItemId) -> String {\ndiff --git a/test/support/harness.clj b/test/support/harness.clj\nindex 4505ece5aa193e826ca61c52f1467d252080d66b..741024aab1d14269e225791189633287980ae2e4 100644\n--- a/test/support/harness.clj\n+++ b/test/support/harness.clj\n@@ -48,12 +48,15 @@\n \"GITHUB_CLIENT_SECRET\" \"test-secret\"\n \"GITHUB_OAUTH_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n \"GITHUB_API_BASE\" (str \"http://127.0.0.1:\" oauth-port)\n+ ;; Reddit import fixtures + Reddit OAuth on reddit-port.\n \"REDDIT_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_CLIENT_ID\" \"test-reddit\"\n+ \"REDDIT_CLIENT_SECRET\" \"test-reddit-secret\"\n \"REDDIT_OAUTH_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n- \"REDDIT_CLIENT_ID\" \"\"\n- \"REDDIT_CLIENT_SECRET\" \"\"\n- \"REDDIT_APP_ID\" \"\"\n- \"REDDIT_APP_SECRET\" \"\"}))\n+ \"REDDIT_OAUTH_AUTHORIZE_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_TOKEN_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_OAUTH_API_BASE\" (str \"http://127.0.0.1:\" reddit-port)\n+ \"REDDIT_USER_AGENT\" \"web:sorter2-test:v0 (by /u/test)\"}))\n \n (defn with-auth-servers\n \"Start mock Reddit + mock OAuth + release sorter2-server.\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 909d7a7be8b159ea54a122d69c46af3db3318118..5ba7e9be3cf6d2226648e9609a09ed45f306930f 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -1,5 +1,5 @@\n (ns test.support.mock-oauth\n- \"In-process HTTP stub for GitHub OAuth (authorize, token, /user).\"\n+ \"In-process HTTP stub for GitHub + Reddit OAuth (authorize, token, user).\"\n (:require [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n [java.net InetSocketAddress URLDecoder]))\n@@ -12,11 +12,14 @@\n (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n (str/split query #\"&\"))))\n \n-(defn- parse-mock-user [raw]\n+(defn- parse-mock-user\n+ \"GitHub-style `id:login` (numeric id). Reddit-style `t2_xxx:name`.\"\n+ [raw]\n (let [s (or raw \"1002:newbie\")\n [id login] (str/split s #\":\" 2)]\n- {:id (Long/parseLong id)\n- :login (or login \"newbie\")}))\n+ {:id id\n+ :login (or login \"newbie\")\n+ :numeric? (re-matches #\"\\d+\" id)}))\n \n (defn- send-json [^HttpExchange ex status body]\n (let [bytes (.getBytes body \"UTF-8\")]\n@@ -31,9 +34,10 @@\n (.sendResponseHeaders ex 302 -1)\n (.close (.getResponseBody ex)))\n \n-(defn- read-form-code [^HttpExchange ex]\n+(defn- read-form [^HttpExchange ex]\n (let [body (slurp (.getInputStream ex))]\n- (query-param body \"code\")))\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n \n (defn- bearer-token [^HttpExchange ex]\n (some-> (.getRequestHeaders ex)\n@@ -44,8 +48,18 @@\n (when (str/starts-with? token \"mock:\")\n (parse-mock-user (subs token 5))))\n \n+(defn- authorize-redirect [exchange query]\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ mock-user (query-param query \"mock_user\")\n+ user (parse-mock-user mock-user)\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc)))\n+\n (defn start-mock-oauth\n- \"Start mock GitHub OAuth on `port`. Returns a zero-arg `stop` function.\"\n+ \"Start mock GitHub + Reddit OAuth on `port`. Returns a zero-arg `stop` function.\"\n [port]\n (let [server (HttpServer/create (InetSocketAddress. \"127.0.0.1\" port) 0)\n handler\n@@ -53,28 +67,45 @@\n (handle [^HttpExchange exchange]\n (let [uri (.getRequestURI exchange)\n path (.getPath uri)\n- query (.getQuery uri)]\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n (cond\n+ ;; GitHub authorize\n (str/ends-with? path \"/login/oauth/authorize\")\n- (let [redirect-uri (query-param query \"redirect_uri\")\n- state (query-param query \"state\")\n- mock-user (query-param query \"mock_user\")\n- user (parse-mock-user mock-user)\n- code (str \"mock:\" (:id user) \":\" (:login user))\n- loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n- \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n- (send-redirect exchange loc))\n+ (authorize-redirect exchange query)\n+\n+ ;; Reddit authorize\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (authorize-redirect exchange query)\n \n- (str/ends-with? path \"/login/oauth/access_token\")\n- (let [code (or (read-form-code exchange) \"mock:1002:newbie\")]\n+ ;; GitHub token\n+ (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+ (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n+ ;; Reddit token (client_credentials for import + authorization_code for login)\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ ;; GitHub user\n (= path \"/user\")\n (let [token (bearer-token exchange)\n- user (or (parse-token-user token) {:id 1002 :login \"newbie\"})]\n+ user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n (send-json exchange 200\n (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n+ ;; Reddit /api/v1/me\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [token (bearer-token exchange)\n+ user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n :else\n (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n (.createContext server \"/\" handler)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex 5efa92db3e1f79b8f423a2f1adcbda959123c1ad..a630cf0938722193e9af88382d60e777ff371be4 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -1,14 +1,56 @@\n (ns test.support.mock-reddit\n- \"In-process HTTP stub for Reddit API fixtures (`test/fixtures/reddit/`).\"\n+ \"In-process HTTP stub for Reddit API fixtures + OAuth login endpoints.\"\n (:require [clojure.java.io :as io]\n [clojure.string :as str])\n (:import [com.sun.net.httpserver HttpServer HttpHandler HttpExchange]\n- [java.net InetSocketAddress]))\n+ [java.net InetSocketAddress URLDecoder]))\n \n (defn fixtures-dir\n ([] (fixtures-dir (System/getProperty \"user.dir\")))\n ([root] (str root \"/test/fixtures/reddit\")))\n \n+(defn- query-param [query key]\n+ (when query\n+ (some (fn [pair]\n+ (let [[k v] (str/split pair \"=\" 2)]\n+ (when (= k key)\n+ (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n+ (str/split query #\"&\"))))\n+\n+(defn- parse-mock-user [raw]\n+ (let [s (or raw \"t2_test:redditor\")\n+ [id login] (str/split s #\":\" 2)]\n+ {:id id :login (or login \"redditor\")}))\n+\n+(defn- send-bytes [^HttpExchange ex status ^bytes body content-type]\n+ (.set (.getResponseHeaders ex) \"Content-Type\" content-type)\n+ (.sendResponseHeaders ex status (alength body))\n+ (doto (.getResponseBody ex)\n+ (.write body)\n+ (.close)))\n+\n+(defn- send-json [^HttpExchange ex status body]\n+ (send-bytes ex status (.getBytes body \"UTF-8\") \"application/json\"))\n+\n+(defn- send-redirect [^HttpExchange ex location]\n+ (.set (.getResponseHeaders ex) \"Location\" location)\n+ (.sendResponseHeaders ex 302 -1)\n+ (.close (.getResponseBody ex)))\n+\n+(defn- read-form [^HttpExchange ex]\n+ (let [body (slurp (.getInputStream ex))]\n+ {:code (query-param body \"code\")\n+ :grant (query-param body \"grant_type\")}))\n+\n+(defn- bearer-token [^HttpExchange ex]\n+ (some-> (.getRequestHeaders ex)\n+ (.getFirst \"Authorization\")\n+ (str/replace #\"^[Bb]earer \" \"\")))\n+\n+(defn- parse-token-user [token]\n+ (when (str/starts-with? token \"mock:\")\n+ (parse-mock-user (subs token 5))))\n+\n (defn start-mock-reddit\n \"Start a mock Reddit API on `port`. Returns a zero-arg `stop` function.\"\n ([port] (start-mock-reddit port (fixtures-dir)))\n@@ -19,15 +61,38 @@\n handler\n (proxy [HttpHandler] []\n (handle [^HttpExchange exchange]\n- ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n- (let [path (.getPath (.getRequestURI exchange))\n- body (if (str/includes? path \"/about\")\n- about\n- listing)]\n- (.sendResponseHeaders exchange 200 (alength body))\n- (let [out (.getResponseBody exchange)]\n- (.write out body)\n- (.close out)))))]\n+ (let [uri (.getRequestURI exchange)\n+ path (.getPath uri)\n+ query (.getQuery uri)\n+ method (.getRequestMethod exchange)]\n+ (cond\n+ (str/ends-with? path \"/api/v1/authorize\")\n+ (let [redirect-uri (query-param query \"redirect_uri\")\n+ state (query-param query \"state\")\n+ user (parse-mock-user (query-param query \"mock_user\"))\n+ code (str \"mock:\" (:id user) \":\" (:login user))\n+ loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n+ \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+ (send-redirect exchange loc))\n+\n+ (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+ (let [form (read-form exchange)\n+ grant (or (:grant form) \"\")\n+ code (or (:code form) \"mock:t2_test:redditor\")]\n+ (if (= grant \"client_credentials\")\n+ (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+ (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+\n+ (str/ends-with? path \"/api/v1/me\")\n+ (let [user (or (parse-token-user (bearer-token exchange))\n+ {:id \"t2_test\" :login \"redditor\"})]\n+ (send-json exchange 200\n+ (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+\n+ ;; `/r//about.json` → subreddit entity; `/r/.json` → listing.\n+ :else\n+ (let [body (if (str/includes? path \"/about\") about listing)]\n+ (send-bytes exchange 200 body \"application/json\"))))))]\n (.createContext server \"/\" handler)\n (.setExecutor server nil)\n (.start server)\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}