Side A is a focused, coherent refactor that centralizes path/URL logic into a well-tested types module, preserving behavior (tests moved and passing) while reducing duplication and improving type safety across the codebase. Side B delivers real feature value (room UI wiring, session cookies, web posting) but also includes an unrelated, unpolished 'plan2.md' architecture essay committed to the repo, which is noise/spectacle rather than working code, slightly diluting the commit's substance despite the legitimate routing/auth additions.
constitution · epochs · watch · epoch 3
comparison
c_5e9a63e9d276 (tommy-mor) vs c_8c6a5e2e4a54 (tommy-mor)
download prompt · raw event · cmp_026e54aaa5da88
council reasoning
B restores lasting product capability: HttpOnly session cookies, /login|/logout, ACL-gated /r/{short}/{slug} room index and thread/post/expand routes, compose forms, and POST /post that reuses rpc_post_with_bearer—making private rooms usable in the browser. A is a solid but secondary refactor that moves canonicalize_* / CanonicalItemUrl into slug-types and swaps string helpers for GardenItemUrl/ForumThreadUrl newtypes without adding behavior.
Side A performs a substantial architectural refactor by moving canonicalization, path parsing, and room-aware URL generation into a shared `types::paths` module, replacing ad hoc string helpers with strongly typed `GardenItemUrl`, `ForumThreadUrl`, and `TildeOntologyPath` throughout the API and shared types. This centralizes path semantics, reduces duplication across server and shared crates, and makes JSON/RPC interfaces type-safe, whereas Side B mainly wires browser UI features (cookie login, room routes, posting handlers) and adds a planning document without a comparable improvement to the project's core design.
sides
A — c_5e9a63e9d276 (tommy-mor)
message
[a888d56c] refactor: centralize path identity in slug-types Move canonicalization and CanonicalItemUrl into types::paths with GardenItemUrl, ForumThreadUrl, and TildeOntologyPath for JSON hrefs. Server canonical_path and path_types re-export slug-types; RPC and validation build hrefs via those types instead of string helpers. Made-with: Cursor
diff preview
diff --git a/server/src/api/helpers.rs b/server/src/api/helpers.rs
index 9b71491e9f9efc44a2a4beba09be8f64bd2ff2ee..03b3e77911ccd662bec8635345dafe2593cf242e 100644
--- a/server/src/api/helpers.rs
+++ b/server/src/api/helpers.rs
@@ -4,12 +4,12 @@ use axum::{
Json,
};
use sha2::{Digest, Sha256};
+use slug_types::paths::{CanonicalItemUrl, GardenItemUrl};
use slug_types::*;
use std::collections::HashMap;
use crate::{
canonical_path::canonicalize_item,
- path_types::CanonicalItemUrl,
ranking::connected_components_from_voted_pairs,
};
@@ -30,64 +30,6 @@ pub fn now_ms() -> i64 {
t.as_millis() as i64
}
-/// Serialize a canonical item for JSON: absolute URLs stay as-is; bare paths get a `/` prefix.
-pub fn item_path_for_api(item: &str) -> String {
- if item.starts_with("http://") || item.starts_with("https://") {
- item.to_string()
- } else {
- format!("/{}", item)
- }
-}
-
-/// Same as [`item_path_for_api`], but for private rooms ontology items are prefixed with
-/// `/r/{short}/{slug}` so the URL matches the web app (`/r/…/~/…` routes).
-pub fn item_path_for_api_in_room(item: &str, room_wire: &str) -> String {
- let room = room_wire.trim();
- if room.is_empty() || room == "public" {
- return item_path_for_api(item);
- }
- let Some((short, slug)) = room.split_once('/') else {
- return item_path_for_api(item);
- };
- if short.is_empty() || slug.is_empty() {
- return item_path_for_api(item);
- }
- let Some(c) = CanonicalItemUrl::parse(item) else {
- return item_path_for_api(item);
- };
- let root = CanonicalItemUrl::ontology_root();
- let item_norm = c.as_str().trim_end_matches('/');
- let root_norm = root.as_str().trim_end_matches('/');
- if let Some(tail) = c.tilde_tail() {
- return if tail.is_empty() {
- format!("https://slug.social/r/{short}/{slug}/~")
- } else {
- format!("https://slug.social/r/{short}/{slug}/~/{}", tail)
- };
- }
- if item_norm == root_norm {
- return format!("https://slug.social/r/{short}/{slug}/~");
- }
- item_path_for_api(item)
-}
-
-/// Absolute thread URL for forum JSON (`/t/…` vs `/r/…/t/…`).
-pub fn forum_thread_web_url(room_wire: &str, thread_tag: &str) -> String {
- let room = room_wire.trim();
- let tag = thread_tag.trim().trim_start_matches('#');
- if room.is_empty() || room == "public" {
- format!("https://slug.social/t/{tag}")
- } else if let Some((short, slug)) = room.split_once('/') {
- if short.is_empty() || slug.is_empty() {
- format!("https://slug.social/t/{tag}")
- } else {
- format!("https://slug.social/r/{short}/{slug}/t/{tag}")
- }
- } else {
- format!("https://slug.social/t/{tag}")
- }
-}
-
/// Resolve an item path as a first-class canonical path.
pub fn resolve_item(item: &str) -> Result<String, String> {
let canonical = canonicalize_item(item);
@@ -109,14 +51,12 @@ pub fn parse_parent_specs(parent: Option<&String>) -> Vec<String> {
}
/// Apply offset+limit pagination to the flattened component rankings.
-/// Items are flattened in component order (largest component first), then unranked last.
-/// Returns (components, unranked_items) after the window.
pub fn paginate_rankings(
components: Vec<RankComponent>,
- unranked_items: Vec<String>,
+ unranked_items: Vec<GardenItemUrl>,
offset: usize,
limit: Option<usize>,
-) -> (Vec<RankComponent>, Vec<String>) {
+) -> (Vec<RankComponent>, Vec<GardenItemUrl>) {
let mut remaining_skip = offset;
let mut remaining_take = limit.unwrap_or(usize::MAX);
let mut out_components: Vec<RankComponent> = Vec::new();
@@ -141,7 +81,7 @@ pub fn paginate_rankings(
});
}
- let out_unranked: Vec<String> = if remaining_take > 0 {
+ let out_unranked: Vec<GardenItemUrl> = if remaining_take > 0 {
unranked_items
.into_iter()
.skip(remaining_skip)
@@ -183,11 +123,9 @@ pub fn is_pair_voted(group: &crate::reducer::GroupState, a: &str, b: &str) -> bo
group.voted_pairs.contains(&(i, j))
}
-/// Compute graph connectivity stats for a set of items within the ranking group.
pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[String]) -> ConnectivityStats {
let n = pool.len();
- // Map pool items to global indices (items not yet in the group get no index)
let global_idxs: Vec<Option<usize>> = pool
.iter()
.map(|it| {
@@ -197,7 +135,6 @@ pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[St
.collect();
let present: Vec<usize> = global_idxs.iter().filter_map(|x| *x).collect();
- // Build local index mapping for items that exist in the ranking group
let global_to_local: HashMap<usize, usize> = present
.iter()
.enumerate()
@@ -213,7 +150,6 @@ pub fn compute_connectivity_stats(group: &crate::reducer::GroupState, pool: &[St
}),
);
- // Items not in the ranking group at all are also isolates
let items_not_in_group = global_idxs.iter().filter(|x| x.is_none()).count();
let num_components = comps.len() + isolates.len() + items_not_in_group;
@@ -237,52 +173,3 @@ pub fn vote_touches_path(a: &str, b: &str, parent_canon: &str) -> bool {
let under = |item: &str| item == parent_canon || item.starts_with(&format!("{}/", parent_canon));
under(a) || under(b)
}
-
-#[cfg(test)]
-mod wire_url_tests {
- use super::{forum_thread_web_url, item_path_for_api_in_room};
-
- #[test]
- fn public_room_unchanged() {
- let u = "https://slug.social/~/a/b";
- assert_eq!(item_path_for_api_in_room(u, "public"), u);
- }
-
- #[test]
- fn private_room_prefixes_ontology() {
- assert_eq!(
- item_path_for_api_in_room("https://slug.social/~/topic/x", "9ab12cd/my-room"),
- "https://slug.social/r/9ab12cd/my-room/~/topic/x"
- );
- }
-
- #[test]
- fn private_room_ontology_root() {
- assert_eq!(
- item_path_for_api_in_room("https://slug.social/~", "9ab12cd/my-room"),
- "https://slug.social/r/9ab12cd/my-room/~"
- );
- assert_eq!(
- item_path_for_api_in_room("https://slug.social/~/", "9ab12cd/my-room"),
- "https://slug.social/r/9ab12cd/my-room/~"
- );
- }
-
- #[test]
- fn external_url_untouched_in_private_room() {
- let u = "https://example.com/z";
- assert_eq!(item_path_for_api_in_room(u, "9ab12cd/my-room"), u);
- }
-
- #[test]
- fn forum_web_public_vs_room() {
- assert_eq!(
- forum_thread_web_url("public", "debate"),
- "https://slug.social/t/debate"
- );
- assert_eq!(
- forum_thread_web_url("9ab12cd/my-room", "#debate"),
- "https://slug.social/r/9ab12cd/my-room/t/debate"
- );
- }
-}
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index 042aa248305f9362a3be78f9eea2a5abf6ba707a..cf22cb0129366c3aed031bc86f3197a4321cb806 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -24,8 +24,7 @@ pub use auth::{
pub use helpers::{
api_error, compute_connectivity_stats, is_pair_voted, now_ms, paginate_rankings,
- parse_parent_specs, pick_random_distinct, sha256_hex, resolve_item, vote_touches_path,
- item_path_for_api,
+ parse_parent_specs, pick_random_distinct, resolve_item, sha256_hex, vote_touches_path,
};
pub use rpc::handle_rpc_batch;
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 5b91f5836625eedbb1cd9423168046e3fb576c17..5f7d50188f1381267402f2e57e671234ef5db2fd 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -8,6 +8,7 @@ use axum::{
Json,
};
use rand::seq::SliceRandom;
+use slug_types::paths::{ForumThreadUrl, GardenItemUrl, TildeOntologyPath};
use slug_types::*;
use crate::{
@@ -27,9 +28,8 @@ use crate::{
use super::auth::verify_bearer_principal;
use super::helpers::{
- compute_connectivity_stats, forum_thread_web_url, is_pair_voted, item_path_for_api,
- item_path_for_api_in_room, now_ms, paginate_rankings, parse_parent_specs, pick_random_distinct,
- resolve_item, vote_touches_path,
+ compute_connectivity_stats, is_pair_voted, now_ms, paginate_rankings, parse_parent_specs,
+ pick_random_distinct, resolve_item, vote_touches_path,
};
use super::validate::{normalize_room_and_thread, validate_ingest_document};
@@ -184,7 +184,7 @@ fn compute_scope_rank_changes(
};
if changed {
changes.push(RankChange {
- item: item_path_for_api_in_room(&item, room_wire),
+ item: GardenItemUrl::from_storage_str(&item, room_wire),
before: b,
after: a,
});
@@ -206,7 +206,7 @@ fn compute_scope_rank_changes(
parent: if parent.is_empty() {
"/".to_string()
} else {
- item_path_for_api_in_room(parent, room_wire)
+ GardenItemUrl::from_storage_str(parent, room_wire).into_inner()
},
changes,
})
@@ -302,7 +302,7 @@ fn build_rank_response_for_content(
.ranked
.into_iter()
.map(|r| RankRow {
- item: item_path_for_api_in_room(r.item.as_str(), room_wire),
+ item: GardenItemUrl::from_stored(&r.item, room_wire),
percent: if want_percent {
Some((r.score / max_score) * 100.0)
} else {
@@ -315,10 +315,10 @@ fn build_rank_response_for_content(
})
.collect();
- let prefixed_unranked: Vec<String> = rankings
+ let prefixed_unranked: Vec<GardenItemUrl> = rankings
.unranked_items
.into_iter()
- .map(|s| item_path_for_api_in_room(s.as_str(), room_wire))
+ .map(|s| GardenItemUrl::from_stored(&s, room_wire))
.collect();
let (components, unranked_items) = if offset > 0 || limit.is_some() {
@@ -537,13 +537,13 @@ async fn rpc_post(
(
"npx slugsocial public garden pair".to_string(),
"npx slugsocial public garden rank".to_string(),
- forum_thread_web_url("public", &thread_id),
+ ForumThreadUrl::from_room_tag("public", &thread_id),
)
} else {
(
format!("npx slugsocial private {room_key} garden pair"),
format!("npx slugsocial private {room_key} garden rank"),
- forum_thread_web_url(&room_key, &thread_id),
+ ForumThreadUrl::from_room_tag(&room_key, &thread_id),
)
};
@@ -664,7 +664,7 @@ async fn rpc_check(
.ranked
.into_iter()
.map(|r| RankRow {
- item: item_path_for_api_in_room(r.item.as_str(), &room_key),
+ item: GardenItemUrl::from_stored(&r.item, &room_key),
score: r.score,
percent: None,
})
@@ -672,12 +672,12 @@ async fn rpc_check(
})
.collect();
CheckScopeRanking {
- parent: item_path_for_api_in_room(parent.as_str(), &room_key),
+ parent: GardenItemUrl::from_stored(parent, &room_key).into_inner(),
components,
unranked_items: scoped
.unranked_items
.into_iter()
- .map(|it| item_path_for_api_in_room(it.as_str(), &room_key))
+ .map(|it| GardenItemUrl::from_stored(&it, &room_key))
.collect(),
}
})
@@ -687,13 +687,13 @@ async fn rpc_check(
vec![
"npx slugsocial public forum post <TAG> --delegate <uuid:rig:
… preview truncated; 46,249 characters omittedB — c_8c6a5e2e4a54 (tommy-mor)
message
[7caef802] room ui wired up again
diff preview
diff --git a/Cargo.lock b/Cargo.lock
index e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -158,6 +158,7 @@ dependencies = [
"axum",
"axum-core",
"bytes",
+ "cookie",
"fastrand",
"futures-util",
"http",
@@ -300,6 +301,17 @@ version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
[[package]]
name = "core-foundation"
version = "0.9.4"
diff --git a/plan2.md b/plan2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54
--- /dev/null
+++ b/plan2.md
@@ -0,0 +1,190 @@
+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses).
+
+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{"$form": "field_name"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor.
+
+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.
+
+Here is what the code actually looks like to execute this vision.
+
+---
+
+### 1. The Safe AST Substitution
+
+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.
+
+```rust
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Recursively walk the JSON AST and replace {"$form": "key"} with the actual form string.
+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+ match val {
+ Value::Object(map) => {
+ // Is this the magic placeholder node? {"$form": "input_name"}
+ if map.len() == 1 && map.contains_key("$form") {
+ if let Some(field_name) = map.get("$form").and_then(|v| v.as_str()) {
+ let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or("");
+ *val = Value::String(submitted_text.to_string());
+ return;
+ }
+ }
+ // Otherwise, keep walking the object
+ for v in map.values_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ Value::Array(arr) => {
+ // Walk arrays
+ for v in arr.iter_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ _ => {} // Primitives stay as is
+ }
+}
+```
+**Why this rules:** You can write a single, hidden HTML input:
+`<input type="hidden" name="__rpc__" value="base64({"Ingest": {"space": "a7f2k", "text": {"$form": "body_input"}}})">`
+When the form submits, the backend safely turns it into standard RPC input.
+
+---
+
+### 2. The Unified Core RPC Layer
+
+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:
+
+```rust
+// Core execute function, decoupled from HTTP
+pub async fn execute_rpc(
+ state: &ReducerState,
+ principal: &Principal,
+ command: RpcCommand
+) -> Result<RpcResponse, ApiError> {
+ match command {
+ RpcCommand::Ingest { space, text } => {
+ // ACLs are checked RIGHT HERE, universally.
+ if !state.user_has_cap(&space, principal, ThreadCapability::Post) {
+ return Err(ApiError::Forbidden("No post access in this space".to_string()));
+ }
+ // Do the write, apply events...
+ Ok(RpcResponse::IngestOk { ... })
+ }
+ // ...
+ }
+}
+```
+
+---
+
+### 3. The `DomPatch` Builder Pattern
+
+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).
+
+```rust
+pub struct DomPatch {
+ js: String,
+}
+
+impl DomPatch {
+ pub fn new() -> Self {
+ Self { js: String::new() }
+ }
+
+ /// Morphs an element using Idiomorph
+ pub fn morph(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).expect("string escaping failed");
+ self.js.push_str(&format!(
+ "Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Appends raw HTML to an element
+ pub fn append(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).unwrap();
+ self.js.push_str(&format!(
+ "document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Executes raw javascript
+ pub fn eval(mut self, code: &str) -> Self {
+ self.js.push_str(code);
+ self.js.push('\n');
+ self
+ }
+
+ /// Consumes the builder into an HTTP Response with the right content-type
+ pub fn into_response(self) -> impl axum::response::IntoResponse {
+ (
+ axum::http::StatusCode::OK,
+ [(axum::http::header::CONTENT_TYPE, "text/javascript")],
+ self.js
+ )
+ }
+}
+```
+
+---
+
+### 4. The Single Web Handler (`POST /ui/action`)
+
+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.
+
+```rust
+pub async fn handle_web_action(
+ State(state): State<AppState>,
+ headers: HeaderMap,
+ Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically
+) -> impl IntoResponse {
+ // 1. Authenticate using Bearer / Cookie exactly like the CLI
+ let principal = match extract_web_session(&headers, &state) {
+ Ok(p) => p,
+ Err(_) => return DomPatch::new().eval("window.location = '/auth/login';").into_response(),
+ };
+
+ // 2. Decode the Base64 JSON
+ let b64 = form_data.get("__rpc__").expect("Missing RPC payload in form");
+ let decoded = base64::decode(b64).expect("Bad b64");
+ let mut json_ast: Value = serde_json::from_slice(&decoded).expect("Bad JSON");
+
+ // 3. Do AST Substitution!
+ substitute_form_vars(&mut json_ast, &form_data);
+
+ // 4. Parse it strongly into the RPC enum
+ let command: RpcCommand = serde_json::from_value(json_ast).expect("Invalid RpcCommand");
+
+ // 5. Pass it to the core execute function (authz + mutation happens here)
+ match execute_rpc(&state.reduced.read().await, &principal, command).await {
+ Ok(RpcResponse::IngestOk { new_ranks }) => {
+ // Translate the RpcResponse to UI JS snippets
+ DomPatch::new()
+ .morph("#rank-container", &render_ranking(&new_ranks))
+ .eval("document.getElementById('ingest-form').reset();")
+ .into_response()
+ }
+ Ok(_) => DomPatch::new().eval("console.log('Action complete');").into_response(),
+ Err(e) => {
+ // Reconcile errors
+ DomPatch::new()
+ .morph("#error-banner", &format!("<div class='error'>{}</div>", e.message()))
+ .into_response()
+ }
+ }
+}
+```
+
+### The Verdict on the Grand Architecture
+
+By combining:
+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)
+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)
+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)
+4. The **Javascript DomPatch Builder**
+
+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework.
+
+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
[dependencies]
axum = { version = "0.7", features = ["macros"] }
-axum-extra = { version = "0.9", features = ["query"] }
+axum-extra = { version = "0.9", features = ["query", "cookie"] }
bytes = "1.11.1" # pin: RUSTSEC-2026-0007
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
tokio-stream = { version = "0.1", features = ["sync"] }
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,9 +1,11 @@
use axum::{
+ body::Body,
extract::{Path, Query, State},
- http::{HeaderMap, StatusCode},
- response::{IntoResponse, Redirect},
+ http::{header, HeaderMap, HeaderValue, StatusCode},
+ response::{IntoResponse, Redirect, Response},
Form, Json,
};
+use axum_extra::extract::cookie::CookieJar;
use base64::Engine;
use serde::Deserialize;
use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};
@@ -13,14 +15,47 @@ use tokio::sync::RwLock;
use crate::{
api::helpers::{api_error, now_ms, sha256_hex},
events::{Event, GrantAdded, TokenIssued, UserRegistered},
- identity::{parse_agent, parse_username},
html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
+ identity::{parse_agent, parse_username},
+ reducer::ReducerState,
state::{AppState, PendingSession},
};
/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].
+const WEB_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000001:social:web/browser";
+
+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.
+pub const SLUG_SESSION_COOKIE: &str = "slug_session";
+
+/// `Set-Cookie` header value (full attribute string).
+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {
+ let s = format!(
+ "{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
+ );
+ HeaderValue::from_str(&s).expect("session cookie value must be ASCII")
+}
+
+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.
+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {
+ if let Ok(u) = verify_bearer_principal(headers, reduced) {
+ return Some(u);
+ }
+ let c = jar.get(SLUG_SESSION_COOKIE)?;
+ verify_token(reduced, c.value()).ok()
+}
+
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
+ Response::builder()
+ .status(StatusCode::TEMPORARY_REDIRECT)
+ .header(header::LOCATION, format!("{public_url}{path_and_query}"))
+ .header(header::SET_COOKIE
… preview truncated; 40,705 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.