diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs index b3631b06153d52f88348fef927e7a024b7b85ad6..cd556eb89e9dd8203eba6c8969ffd144db5d329d 100644 --- a/server/src/api/auth.rs +++ b/server/src/api/auth.rs @@ -71,6 +71,24 @@ pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &Reduce verify_token(reduced, c.value()).ok() } +/// Browser session: principal + bearer token string (same shape as CLI session cookie). +#[derive(Debug, Clone)] +pub struct WebSession { + pub username: String, + pub bearer: String, +} + +/// Resolve username and bearer together for `POST /ui` dispatch (one read of headers + jar). +pub fn resolve_web_session(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option { + let username = optional_principal(headers, jar, reduced)?; + let bearer = headers + .get(header::AUTHORIZATION) + .and_then(|v| v.to_str().ok()) + .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) + .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()))?; + Some(WebSession { username, bearer }) +} + fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str, jar: &CookieJar) -> Response { let mut res = Response::builder() .status(StatusCode::TEMPORARY_REDIRECT) diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs index a986f706ea4b261cbaf004c02b4cf84184b41371..4e223a7460997c464706dca850281447bd754ed5 100644 --- a/server/src/api/mod.rs +++ b/server/src/api/mod.rs @@ -4,7 +4,6 @@ mod rpc; mod stream; mod validate; mod ui_html; -mod web_post; pub use auth::{ get_join_invite, @@ -19,7 +18,9 @@ pub use auth::{ get_web_login, get_logout, optional_principal, + resolve_web_session, session_cookie_header_value, + WebSession, SLUG_SESSION_COOKIE, }; @@ -35,7 +36,6 @@ pub use stream::{get_html_stream, get_stream}; pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest}; pub use ui_html::post_ui_html; -pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact}; #[cfg(test)] mod tests { diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index 2b40a72059981d558768f73d189b991f3448c257..497f8fdd222a8ec7c3d76b0695e0352e973ca3ba 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -1,25 +1,29 @@ -//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes). +//! Single `POST /ui` entry: parse `__rpc__` → [`HtmlUiAction`], resolve [`WebSession`] once, dispatch. use axum::{ - body::Body, + body, extract::State, - http::{header, HeaderMap, StatusCode}, + http::{header, HeaderMap, HeaderValue, StatusCode}, response::{IntoResponse, Response}, Form, }; use axum_extra::extract::cookie::CookieJar; +use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; use std::collections::HashMap; use crate::{ api::{ - auth::optional_principal, - web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm}, + auth::{resolve_web_session, WebSession}, + handle_rpc_batch, + rpc::{rpc_post_redact, rpc_post_with_bearer}, }, + canonical_path::canonicalize_tag, html::{ fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup, - parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, - ThreadNav, + parse_html_ui_from_form, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, + user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav, }, + reducer::{scope_from_room_wire, ScopeId}, state::AppState, }; @@ -34,6 +38,19 @@ pub async fn post_ui_html( Err(e) => return ui_js_warn(&e.to_string()).into_response(), }; + let reduced = state.reduced.read().await; + let session = resolve_web_session(&headers, &jar, &reduced); + drop(reduced); + + dispatch_ui_action(&state, session.as_ref(), action).await +} + +/// All UI command logic: HTTP extractors stop above; this only sees [`AppState`], session, and [`HtmlUiAction`]. +async fn dispatch_ui_action( + state: &AppState, + session: Option<&WebSession>, + action: HtmlUiAction, +) -> Response { match action { HtmlUiAction::PostIngest { room, @@ -42,47 +59,87 @@ pub async fn post_ui_html( error_target, form_id, } => { - run_post_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = thread_tag.trim().to_string(); + if text.trim().is_empty() { + return form_js_error( + error_target.as_ref(), + "empty post", + "Write something in the text area (DSL / prose).", + ) + .into_response(); + } + match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await { + Ok(RpcResult::PostOk { .. }) => { + post_success_response( + state, + &room, + &thread_tag, + error_target.as_ref(), + form_id.as_ref(), + Some(session.username.as_str()), + ) + .await + .into_response() + } + Ok(_) => form_js_error( + error_target.as_ref(), + "unexpected response", + "Post did not return PostOk.", + ) + .into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::CheckIngest { room, thread_tag, text, error_target, - form_id, + form_id: _, } => { - run_check_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(&thread_tag); + if thread_tag.is_empty() { + return form_js_error( + error_target.as_ref(), + "missing thread tag", + "Set a thread tag before posting.", + ) + .into_response(); + } + if text.trim().is_empty() { + return js_clear_errors(&form_error_target(error_target.as_ref())).into_response(); + } + match rpc_check_with_bearer(state, &session.bearer, room, text.clone()).await { + Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(error_target.as_ref())).into_response(), + Ok(_) => form_js_error(error_target.as_ref(), "unexpected response", "Check did not return CheckOk.").into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::RedactPost { post_id } => { - run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let h = headers_from_bearer(&session.bearer); + match rpc_post_redact(state, &h, post_id).await { + Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), + Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), + Err((msg, hint)) => { + let detail = hint.as_deref().unwrap_or(""); + js_error("#errors", &msg, detail).into_response() + } + } } HtmlUiAction::ExpandPublicNewThreadForm => { let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); drop(reduced); let markup = if user.is_some() { fragment_public_new_thread_form(true) @@ -99,18 +156,18 @@ pub async fn post_ui_html( return ui_js_warn("missing room").into_response(); } let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); if !reduced.rooms.contains(&room_wire) { drop(reduced); return ui_js_warn("room not found").into_response(); } - if !user_can_view_room(&reduced, &room_wire, user.as_deref()) { + if !user_can_view_room(&reduced, &room_wire, user) { drop(reduced); return ui_js_warn("forbidden").into_response(); } - let can_post = user + let can_post = session .as_ref() - .map(|u| user_can_post_room(&reduced, &room_wire, u)) + .map(|s| user_can_post_room(&reduced, &room_wire, &s.username)) .unwrap_or(false); drop(reduced); let Some(nav) = ThreadNav::from_room_id(&room_wire) else { @@ -128,12 +185,195 @@ pub async fn post_ui_html( } } +fn headers_from_bearer(bearer: &str) -> HeaderMap { + let mut headers = HeaderMap::new(); + if let Ok(hv) = HeaderValue::from_str(&format!("Bearer {bearer}")) { + headers.insert(header::AUTHORIZATION, hv); + } + headers +} + +fn post_redirect_location(room: &str, thread_tag: &str) -> String { + let tag = canonicalize_tag(thread_tag); + if room.trim() == "public" { + format!("/t/{tag}") + } else { + let room = room.trim(); + let Some((a, b)) = room.split_once('/') else { + return "/".to_string(); + }; + format!("/r/{a}/{b}/t/{tag}") + } +} + +fn js_quote(s: &str) -> String { + serde_json::to_string(s).expect("js string escaping must succeed") +} + +fn js_redirect(to: &str) -> Response { + let js = format!("window.location = {};", js_quote(to)); + Response::builder() + .status(StatusCode::OK) + .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") + .body(axum::body::Body::from(js)) + .unwrap() +} + +fn js_error(error_target: &str, title: &str, detail: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) { + p class="auth-error" { (title) } + @if !detail.is_empty() { + pre class="muted" { (detail) } + } + } + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn form_error_target(error_target: Option<&String>) -> String { + error_target + .map(|s| s.as_str()) + .filter(|s| !s.trim().is_empty()) + .map(|s| { + if s.starts_with('#') { + s.to_string() + } else { + format!("#{s}") + } + }) + .unwrap_or_else(|| "#errors".to_string()) +} + +fn form_js_error(error_target: Option<&String>, title: &str, detail: &str) -> Response { + js_error(&form_error_target(error_target), title, detail) +} + +fn js_clear_errors(error_target: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) {} + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn empty_error_markup(error_target: &str) -> maud::Markup { + maud::html! { + div id=(error_target.trim_start_matches('#')) {} + } +} + +async fn rpc_check_with_bearer( + state: &AppState, + bearer_token: &str, + room: String, + text: String, +) -> Result)> { + let mut headers = HeaderMap::new(); + let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) + .map_err(|_| ("invalid session token".into(), None))?; + headers.insert(header::AUTHORIZATION, hv); + + let response = handle_rpc_batch( + State(state.clone()), + headers, + axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), + ) + .await + .into_response(); + + let status = response.status(); + if !status.is_success() { + return Err((format!("rpc check http {}", status), None)); + } + + let body = body::to_bytes(response.into_body(), usize::MAX) + .await + .map_err(|e| (e.to_string(), None))?; + let parsed: RpcBatchResponse = + serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; + let line = parsed + .results + .into_iter() + .next() + .ok_or_else(|| ("empty rpc check response".to_string(), None))?; + if line.ok { + line.result + .ok_or_else(|| ("missing rpc check result".to_string(), None)) + } else { + Err(( + line.error.unwrap_or_else(|| "check failed".to_string()), + line.hint, + )) + } +} + +async fn post_success_response( + state: &AppState, + room: &str, + thread_tag: &str, + error_target: Option<&String>, + form_id: Option<&String>, + viewer: Option<&str>, +) -> Response { + let error_target = form_error_target(error_target); + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(thread_tag); + let thread_location = post_redirect_location(&room, &thread_tag); + let form_id = form_id.map(|s| s.as_str()).unwrap_or(""); + let scope = scope_from_room_wire(&room); + let feed_markup = match &scope { + ScopeId::Public => thread_feed_html(state).await, + ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, + }; + let thread_markup = thread_feed_region_markup( + state, + match &scope { + ScopeId::Public => None, + ScopeId::Room(_) => Some(room.as_str()), + }, + &thread_tag, + viewer.as_deref(), + ) + .await; + let feed_selector = match &scope { + ScopeId::Public => "#thread-feed", + ScopeId::Room(_) => "#room-thread-feed", + }; + + let builder = JsBuilder::new() + .morph_selector(&error_target, empty_error_markup(&error_target)) + .morph_selector(feed_selector, feed_markup) + .if_current_path_matches(&thread_location, |builder| { + let builder = builder.morph_selector("#thread-feed-region", thread_markup); + let builder = if !form_id.trim().is_empty() { + builder.qs(&format!("#{form_id}")).reset() + } else { + builder + }; + builder + }) + .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); + + builder.into_response() +} + +async fn redact_success_response(state: &AppState) -> Response { + let feed_markup = thread_feed_html(state).await; + JsBuilder::new() + .morph_selector("#thread-feed", feed_markup) + .into_response() +} + fn ui_js_warn(msg: &str) -> Response { use crate::html::js_string_literal; let js = format!("console.warn({});", js_string_literal(msg)); Response::builder() .status(StatusCode::OK) .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(Body::from(js)) + .body(axum::body::Body::from(js)) .unwrap() } diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs deleted file mode 100644 index 265025f41ff1548d05b2d2d5d84202245388053f..0000000000000000000000000000000000000000 --- a/server/src/api/web_post.rs +++ /dev/null @@ -1,362 +0,0 @@ -use axum::{ - body, - extract::State, - http::{header, HeaderMap, HeaderValue, StatusCode}, - response::{IntoResponse, Response}, - Form, -}; -use axum_extra::extract::cookie::CookieJar; -use serde::Deserialize; -use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; - -use crate::{ - api::{ - auth::{optional_principal, SLUG_SESSION_COOKIE}, - handle_rpc_batch, - rpc::{rpc_post_redact, rpc_post_with_bearer}, - }, - canonical_path::canonicalize_tag, - html::{thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, JsBuilder}, - reducer::{scope_from_room_wire, ScopeId}, - state::AppState, -}; - -#[derive(Debug, Deserialize)] -pub struct WebPostForm { - pub room: String, - pub thread_tag: String, - pub text: String, - #[serde(default)] - pub error_target: Option, - #[serde(default)] - pub form_id: Option, -} - -#[derive(Debug, Deserialize)] -pub struct WebRedactForm { - pub post_id: String, -} - -fn post_redirect_location(room: &str, thread_tag: &str) -> String { - let tag = canonicalize_tag(thread_tag); - if room.trim() == "public" { - format!("/t/{tag}") - } else { - let room = room.trim(); - let Some((a, b)) = room.split_once('/') else { - return "/".to_string(); - }; - format!("/r/{a}/{b}/t/{tag}") - } -} - -fn js_quote(s: &str) -> String { - serde_json::to_string(s).expect("js string escaping must succeed") -} - -fn js_redirect(to: &str) -> Response { - let js = format!("window.location = {};", js_quote(to)); - Response::builder() - .status(StatusCode::OK) - .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(axum::body::Body::from(js)) - .unwrap() -} - -fn js_error(error_target: &str, title: &str, detail: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) { - p class="auth-error" { (title) } - @if !detail.is_empty() { - pre class="muted" { (detail) } - } - } - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn form_error_target(form: &WebPostForm) -> String { - form.error_target - .as_deref() - .filter(|s| !s.trim().is_empty()) - .map(|s| { - if s.starts_with('#') { - s.to_string() - } else { - format!("#{s}") - } - }) - .unwrap_or_else(|| "#errors".to_string()) -} - -fn form_js_error(form: &WebPostForm, title: &str, detail: &str) -> Response { - js_error(&form_error_target(form), title, detail) -} - -fn js_clear_errors(error_target: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) {} - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn empty_error_markup(error_target: &str) -> maud::Markup { - maud::html! { - div id=(error_target.trim_start_matches('#')) {} - } -} - -async fn rpc_check_with_bearer( - state: &AppState, - bearer_token: &str, - room: String, - text: String, -) -> Result)> { - let mut headers = HeaderMap::new(); - let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) - .map_err(|_| ("invalid session token".into(), None))?; - headers.insert(header::AUTHORIZATION, hv); - - let response = handle_rpc_batch( - State(state.clone()), - headers, - axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), - ) - .await - .into_response(); - - let status = response.status(); - if !status.is_success() { - return Err((format!("rpc check http {}", status), None)); - } - - let body = body::to_bytes(response.into_body(), usize::MAX) - .await - .map_err(|e| (e.to_string(), None))?; - let parsed: RpcBatchResponse = - serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; - let line = parsed - .results - .into_iter() - .next() - .ok_or_else(|| ("empty rpc check response".to_string(), None))?; - if line.ok { - line.result - .ok_or_else(|| ("missing rpc check result".to_string(), None)) - } else { - Err(( - line.error.unwrap_or_else(|| "check failed".to_string()), - line.hint, - )) - } -} - -fn post_success_response<'a>( - state: &'a AppState, - form: &'a WebPostForm, - headers: &'a HeaderMap, - jar: &'a CookieJar, -) -> impl std::future::Future + 'a { - async move { - let error_target = form_error_target(form); - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - let thread_location = post_redirect_location(&room, &thread_tag); - let form_id = form.form_id.as_deref().unwrap_or_default(); - let scope = scope_from_room_wire(&room); - let viewer = { - let reduced = state.reduced.read().await; - optional_principal(headers, jar, &reduced) - }; - let feed_markup = match &scope { - ScopeId::Public => thread_feed_html(state).await, - ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, - }; - let thread_markup = thread_feed_region_markup( - state, - match &scope { - ScopeId::Public => None, - ScopeId::Room(_) => Some(room.as_str()), - }, - &thread_tag, - viewer.as_deref(), - ) - .await; - let feed_selector = match &scope { - ScopeId::Public => "#thread-feed", - ScopeId::Room(_) => "#room-thread-feed", - }; - - let builder = JsBuilder::new() - .morph_selector(&error_target, empty_error_markup(&error_target)) - .morph_selector(feed_selector, feed_markup) - .if_current_path_matches(&thread_location, |builder| { - let builder = builder.morph_selector("#thread-feed-region", thread_markup); - let builder = if !form_id.trim().is_empty() { - builder.qs(&format!("#{form_id}")).reset() - } else { - builder - }; - builder - }) - .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); - - builder.into_response() - } -} - -async fn redact_success_response(state: &AppState) -> Response { - let feed_markup = thread_feed_html(state).await; - JsBuilder::new() - .morph_selector("#thread-feed", feed_markup) - .into_response() -} - -pub async fn post_web_redact( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_redact(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`]. -pub(crate) async fn run_post_web_redact( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebRedactForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - drop(reduced); - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - let Some(_bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - match rpc_post_redact(state, headers, form.post_id).await { - Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), - Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), - Err((msg, hint)) => { - let detail = hint.as_deref().unwrap_or(""); - js_error("#errors", &msg, detail).into_response() - } - } -} - -pub async fn post_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_post_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = form.thread_tag.trim().to_string(); - let text = form.text.clone(); - - if text.trim().is_empty() { - return form_js_error(&form, "empty post", "Write something in the text area (DSL / prose).") - .into_response(); - } - - match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await { - Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar) - .await - .into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} - -pub async fn check_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_check_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_check_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - if thread_tag.is_empty() { - return form_js_error(&form, "missing thread tag", "Set a thread tag before posting.").into_response(); - } - - if form.text.trim().is_empty() { - return js_clear_errors(&form_error_target(&form)).into_response(); - } - - match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await { - Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs index b1c037f3dd93c7bb96d6624cab6019228432c501..a173e7aea7a81c7cfab5f2f6a5549e0db560fb2b 100644 --- a/server/src/html/forum.rs +++ b/server/src/html/forum.rs @@ -17,6 +17,7 @@ use crate::{ state::AppState, timeago, }; +use serde_json::json; use super::ui_action::{HtmlUiAction, UI_RPC_FIELD}; @@ -182,8 +183,8 @@ fn post_header_row( div class="ingest-header-row" { (meta) @if show_delete { - form class="post-delete-form" method="POST" action="/post/redact" { - input type="hidden" name="post_id" value=(ing.id); + form class="post-delete-form" method="POST" action="/ui" { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::RedactPost { post_id: ing.id.clone() }).unwrap()); button type="submit" class="post-delete-btn" { "delete" } } } @@ -427,13 +428,28 @@ fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup { if !show { return html! {}; } + let rpc_post = template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); + let rpc_check = template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); html! { section class="compose" id="thread-compose" { - form id="thread-compose-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="thread_tag" value=(thread_tag); - input type="hidden" name="error_target" value="thread-compose-errors"; - input type="hidden" name="form_id" value="thread-compose-form"; + form id="thread-compose-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(rpc_check) { + input type="hidden" name=(UI_RPC_FIELD) value=(rpc_post); textarea name="text" rows="5" cols="80" placeholder="prose or ~/items and votes…" {} p { button type="submit" { "post" } @@ -463,10 +479,22 @@ fn new_thread_form_public(show: bool) -> Markup { h3 { "new public thread" } p class="muted" { "Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL." } div id="public-new-thread-errors" {} - form id="public-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value="public"; - input type="hidden" name="error_target" value="public-new-thread-errors"; - input type="hidden" name="form_id" value="public-new-thread-form"; + form id="public-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()); label for="new-thread-tag" { "thread tag" } input type="text" id="new-thread-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" placeholder="my-topic"; label for="new-thread-text" { "text" } @@ -946,10 +974,22 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup { section class="compose" id="room-new-thread-compose" hidden { h3 { "new thread in this room" } div id="room-new-thread-errors" {} - form id="room-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="error_target" value="room-new-thread-errors"; - input type="hidden" name="form_id" value="room-new-thread-form"; + form id="room-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()); label for="room-new-tag" { "thread tag" } input type="text" id="room-new-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" required; textarea name="text" rows="4" placeholder="First post body…" required {} diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index a4fd2dd60ac283f7eb9b2e64522501b21d1e27e9..63f723804be511af80b5c13e792109754b606fce 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -373,9 +373,14 @@ script { (maud::PreEscaped(r#" async function runFormCheck(form) { const action = form.getAttribute('data-check-action'); if (!action) return; + const fd = new URLSearchParams(new FormData(form)); + const checkRpc = form.getAttribute('data-check-rpc'); + if (checkRpc) { + fd.set('__rpc__', checkRpc); + } const resp = await fetch(action, { method: 'POST', - body: new URLSearchParams(new FormData(form)), + body: fd, headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, credentials: 'same-origin', }); diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs index 3bc69ecbb7e16a59d2d393b2d59f9cd3fedb12b1..73180737db8ba8d16fb7b42b790e44d2d7b796f5 100644 --- a/server/src/html/ui_action.rs +++ b/server/src/html/ui_action.rs @@ -14,7 +14,7 @@ pub const UI_RPC_FIELD: &str = "__rpc__"; #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] #[serde(tag = "action", rename_all = "snake_case")] pub enum HtmlUiAction { - /// Same semantics as `POST /post` (forum ingest). + /// Forum ingest via `POST /ui`. PostIngest { room: String, thread_tag: String, @@ -24,7 +24,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/check`. + /// DSL check / validation via `POST /ui`. CheckIngest { room: String, thread_tag: String, @@ -34,7 +34,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/redact`. + /// Author redacts own post via `POST /ui`. RedactPost { post_id: String, }, diff --git a/server/src/lib.rs b/server/src/lib.rs index 5f5b6b0f01b29350c7415e5801ec5caa74f0b452..c28c2335d23080671e71155ea3fb023f9b8d98c4 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -31,9 +31,6 @@ pub fn create_app(state: AppState) -> Router { .route("/", get(crate::html::home)) .route("/login", get(api::get_web_login)) .route("/logout", get(api::get_logout)) - .route("/post", post(api::post_web_ingest)) - .route("/post/redact", post(api::post_web_redact)) - .route("/post/check", post(api::check_web_ingest)) .route("/ui", post(api::post_ui_html)) .route("/theme", post(crate::html::post_theme)) .route("/sse", get(api::get_html_stream)) @@ -64,6 +61,7 @@ pub fn create_app(state: AppState) -> Router { ) .route("/t/:tag/:index", get(crate::html::thread_post_view)) .route("/t/:tag", get(crate::html::thread_view)) + // TODO DELETE THESE AND USE __RPC__ PATTERN .route( "/r/:room_short/:room_slug/t/:thread_tag/:index/expand", get(crate::html::room_thread_post_expand), diff --git a/server/tests/integration.rs b/server/tests/integration.rs index d86de2dd446516807a3c8a607aa88787d1b136b0..831722430d6b41308e3f03d485cd62f887ace799 100644 --- a/server/tests/integration.rs +++ b/server/tests/integration.rs @@ -21,6 +21,30 @@ fn test_bearer() -> String { format!("slug_{token_id}_{secret}") } +/// Compact JSON for `POST /ui` (`HtmlUiAction::PostIngest`). +fn ui_post_ingest_rpc(room: &str, thread_tag: &str, text: &str) -> String { + serde_json::json!({ + "action": "post_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + }) + .to_string() +} + +/// Compact JSON for `POST /ui` (`HtmlUiAction::CheckIngest`). +fn ui_check_ingest_rpc(room: &str, thread_tag: &str, text: &str, error_target: &str) -> String { + serde_json::json!({ + "action": "check_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + "error_target": error_target, + "form_id": "thread-compose-form", + }) + .to_string() +} + /// `commands` is a JSON array of RPC commands (`RpcBatch` is a transparent `Vec`). async fn rpc_batch( client: &reqwest::Client, @@ -343,14 +367,11 @@ async fn test_private_room_thread_urls_use_t_segment() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc(&room_id, "main-thread", "private post via web"); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "main-thread"), - ("text", "private post via web"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -404,14 +425,15 @@ async fn test_private_room_post_links_use_private_garden_routes() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc( + &room_id, + "garden-thread", + "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n", + ); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "garden-thread"), - ("text", "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -449,15 +471,11 @@ async fn test_post_check_returns_targeted_js_error_for_missing_thread_tag() { .unwrap(); let bearer = test_bearer(); + let rpc = ui_check_ingest_rpc("public", "", "hello", "thread-compose-errors"); let resp = client - .post(format!("http://{addr}/post/check")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", "public"), - ("thread_tag", ""), - ("text", "hello"), - ("error_target", "thread-compose-errors"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -553,14 +571,11 @@ async fn test_sse_stream_emits_evalable_js_after_post() { .unwrap(); assert!(sse_resp.status().is_success()); + let rpc = ui_post_ingest_rpc(&room_id, "live-thread", "hello over sse"); let _post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "live-thread"), - ("text", "hello over sse"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); diff --git a/test/walkthrough_fixture.clj b/test/walkthrough_fixture.clj index ec7914464b1a0389e40c5be53af59cf8ed82b09e..4b814822029c913e38151ca53848d1c64fb58373 100644 --- a/test/walkthrough_fixture.clj +++ b/test/walkthrough_fixture.clj @@ -52,22 +52,28 @@ "~/secret/item {classified}\n" "~/secret/other {secondary}\n" "~/secret/item 3:1 ~/secret/other {because}\n") + rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text wall-text}) post-resp (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text wall-text} + (str base-url "/ui") + {:__rpc__ rpc} :headers {"Authorization" (str "Bearer " alice-token)})] (assert! (= 200 (:status post-resp)) "seed post must succeed")) (let [bob-reply (str "Bob here — reply with another long block so the thread has multiple cards.\n\n" "Paragraph two: repeating slugs ~/secret/item and ~/secret/other for cross-post link styling. " "If everything wraps cleanly, monospace pre + serif body (in craft theme) should still feel readable.\n\n" "More overflow: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n") + bob-rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text bob-reply}) bob-post (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text bob-reply} + (str base-url "/ui") + {:__rpc__ bob-rpc} :headers {"Authorization" (str "Bearer " bob-token)})] (assert! (= 200 (:status bob-post)) "seed reply post must succeed")) {:users {:alice {:token alice-token}