You are a constitutional council ranking individual git commits for ownership allocation. Compare these two commits. Decide which contributed more lasting value to the project. Judge substance, not spectacle: - Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise. - Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one. - Do not favor a side merely because its patch is longer or noisier. - Weight what the change does for the project, not the contributor's name. Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."} The explanation must cite concrete differences in the patches (1-3 sentences). Side A — contributor: tommy-mor Side A — commit message: [3f35edab] progress Side A — unified diff (full patch): diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs index a10ce662105cff8fad949c6b83f7035ce79bed18..a986f706ea4b261cbaf004c02b4cf84184b41371 100644 --- a/server/src/api/mod.rs +++ b/server/src/api/mod.rs @@ -3,6 +3,7 @@ mod helpers; mod rpc; mod stream; mod validate; +mod ui_html; mod web_post; pub use auth::{ @@ -33,6 +34,7 @@ pub use stream::{get_html_stream, get_stream}; pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest}; +pub use ui_html::post_ui_html; pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact}; #[cfg(test)] diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs new file mode 100644 index 0000000000000000000000000000000000000000..2b40a72059981d558768f73d189b991f3448c257 --- /dev/null +++ b/server/src/api/ui_html.rs @@ -0,0 +1,139 @@ +//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes). + +use axum::{ + body::Body, + extract::State, + http::{header, HeaderMap, StatusCode}, + response::{IntoResponse, Response}, + Form, +}; +use axum_extra::extract::cookie::CookieJar; +use std::collections::HashMap; + +use crate::{ + api::{ + auth::optional_principal, + web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm}, + }, + html::{ + fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup, + parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, + ThreadNav, + }, + state::AppState, +}; + +pub async fn post_ui_html( + State(state): State, + headers: HeaderMap, + jar: CookieJar, + Form(form): Form>, +) -> impl IntoResponse { + let action = match parse_html_ui_from_form(&form) { + Ok(a) => a, + Err(e) => return ui_js_warn(&e.to_string()).into_response(), + }; + + match action { + HtmlUiAction::PostIngest { + room, + thread_tag, + text, + error_target, + form_id, + } => { + run_post_web_ingest( + &state, + &headers, + &jar, + WebPostForm { + room, + thread_tag, + text, + error_target, + form_id, + }, + ) + .await + } + HtmlUiAction::CheckIngest { + room, + thread_tag, + text, + error_target, + form_id, + } => { + run_check_web_ingest( + &state, + &headers, + &jar, + WebPostForm { + room, + thread_tag, + text, + error_target, + form_id, + }, + ) + .await + } + HtmlUiAction::RedactPost { post_id } => { + run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await + } + HtmlUiAction::ExpandPublicNewThreadForm => { + let reduced = state.reduced.read().await; + let user = optional_principal(&headers, &jar, &reduced); + drop(reduced); + let markup = if user.is_some() { + fragment_public_new_thread_form(true) + } else { + login_to_post_hint_markup() + }; + JsBuilder::new() + .morph_selector("#public-new-thread-ui-slot", markup) + .into_response() + } + HtmlUiAction::ExpandRoomNewThreadForm { room_wire } => { + let room_wire = room_wire.trim().to_string(); + if room_wire.is_empty() { + return ui_js_warn("missing room").into_response(); + } + let reduced = state.reduced.read().await; + let user = optional_principal(&headers, &jar, &reduced); + if !reduced.rooms.contains(&room_wire) { + drop(reduced); + return ui_js_warn("room not found").into_response(); + } + if !user_can_view_room(&reduced, &room_wire, user.as_deref()) { + drop(reduced); + return ui_js_warn("forbidden").into_response(); + } + let can_post = user + .as_ref() + .map(|u| user_can_post_room(&reduced, &room_wire, u)) + .unwrap_or(false); + drop(reduced); + let Some(nav) = ThreadNav::from_room_id(&room_wire) else { + return ui_js_warn("bad room").into_response(); + }; + let markup = if can_post { + fragment_room_new_thread_form(&nav, true) + } else { + login_to_post_hint_markup() + }; + JsBuilder::new() + .morph_selector("#room-new-thread-ui-slot", markup) + .into_response() + } + } +} + +fn ui_js_warn(msg: &str) -> Response { + use crate::html::js_string_literal; + let js = format!("console.warn({});", js_string_literal(msg)); + Response::builder() + .status(StatusCode::OK) + .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") + .body(Body::from(js)) + .unwrap() +} diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs index a64010e382d3039821c836a5529adad0fe67cce5..265025f41ff1548d05b2d2d5d84202245388053f 100644 --- a/server/src/api/web_post.rs +++ b/server/src/api/web_post.rs @@ -222,8 +222,18 @@ pub async fn post_web_redact( jar: CookieJar, Form(form): Form, ) -> impl IntoResponse { + run_post_web_redact(&state, &headers, &jar, form).await +} + +/// Shared with [`crate::api::ui_html::post_ui_html`]. +pub(crate) async fn run_post_web_redact( + state: &AppState, + headers: &HeaderMap, + jar: &CookieJar, + form: WebRedactForm, +) -> Response { let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(&headers, &jar, &reduced) else { + let Some(_username) = optional_principal(headers, jar, &reduced) else { drop(reduced); return js_redirect("/login").into_response(); }; @@ -239,8 +249,8 @@ pub async fn post_web_redact( return js_redirect("/login").into_response(); }; - match rpc_post_redact(&state, &headers, form.post_id).await { - Ok(RpcResult::RedactPostOk {}) => redact_success_response(&state).await.into_response(), + match rpc_post_redact(state, headers, form.post_id).await { + Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), Err((msg, hint)) => { let detail = hint.as_deref().unwrap_or(""); @@ -255,8 +265,18 @@ pub async fn post_web_ingest( jar: CookieJar, Form(form): Form, ) -> impl IntoResponse { + run_post_web_ingest(&state, &headers, &jar, form).await +} + +/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). +pub(crate) async fn run_post_web_ingest( + state: &AppState, + headers: &HeaderMap, + jar: &CookieJar, + form: WebPostForm, +) -> Response { let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(&headers, &jar, &reduced) else { + let Some(_username) = optional_principal(headers, jar, &reduced) else { drop(reduced); return js_redirect("/login").into_response(); }; @@ -282,8 +302,8 @@ pub async fn post_web_ingest( .into_response(); } - match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await { - Ok(RpcResult::PostOk { .. }) => post_success_response(&state, &form, &headers, &jar) + match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await { + Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar) .await .into_response(), Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(), @@ -297,8 +317,18 @@ pub async fn check_web_ingest( jar: CookieJar, Form(form): Form, ) -> impl IntoResponse { + run_check_web_ingest(&state, &headers, &jar, form).await +} + +/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). +pub(crate) async fn run_check_web_ingest( + state: &AppState, + headers: &HeaderMap, + jar: &CookieJar, + form: WebPostForm, +) -> Response { let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(&headers, &jar, &reduced) else { + let Some(_username) = optional_principal(headers, jar, &reduced) else { drop(reduced); return js_redirect("/login").into_response(); }; @@ -324,7 +354,7 @@ pub async fn check_web_ingest( return js_clear_errors(&form_error_target(&form)).into_response(); } - match rpc_check_with_bearer(&state, &bearer, room, form.text.clone()).await { + match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await { Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(), Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(), Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), diff --git a/server/src/form_template.rs b/server/src/form_template.rs new file mode 100644 index 0000000000000000000000000000000000000000..3709c2c09a859da006e4af173413d5d235bc19be --- /dev/null +++ b/server/src/form_template.rs @@ -0,0 +1,142 @@ +//! Plan2-style JSON templates with `{"$form": "field_name"}` holes, filled from +//! `application/x-www-form-urlencoded` (or any `String` → `String` map) **before** +//! deserializing into a typed struct. +//! +//! # Wire format +//! +//! Templates are **compact JSON** (`serde_json::to_string`): one line, no pretty +//! printing, strings escaped per JSON rules (`\"`, `\n`, etc.). Embed that string +//! in HTML attributes or text nodes with normal HTML escaping (e.g. maud), not +//! bespoke encodings. +//! +//! # Power vs flat hidden fields +//! +//! A form is always a string→string map. You can fake depth with dotted keys (`a.b.c`), +//! but one structured blob (`__rpc__` = compact JSON) gives you nested objects, +//! arrays, and optional fields without inventing a new naming scheme each time. +//! +//! # Security +//! +//! Substitution runs **before** `serde` into your command type. It does not fix +//! authorization: if the client can replace the hidden `__rpc__` value, they can +//! change the command shape unless you validate (signed blob, server-side session +//! context, or treat the blob as hints only). Same threat model as any hidden field. + +use serde::Serialize; +use serde_json::Value; +use std::collections::HashMap; + +/// Serialize a value to compact JSON for a hidden `__rpc__` (or similar) field. +pub fn template_json_compact(v: &T) -> serde_json::Result { + serde_json::to_string(v) +} + +/// Recursively walk the JSON AST and replace `{"$form": "key"}` with the submitted +/// string for `key` (empty if missing). Other keys are unchanged. +pub fn substitute_form_vars(val: &mut Value, form_data: &HashMap) { + match val { + Value::Object(map) => { + if map.len() == 1 { + if let Some(Value::String(field_name)) = map.get("$form") { + let submitted = form_data + .get(field_name.as_str()) + .map(|s| s.as_str()) + .unwrap_or(""); + *val = Value::String(submitted.to_string()); + return; + } + } + for v in map.values_mut() { + substitute_form_vars(v, form_data); + } + } + Value::Array(arr) => { + for v in arr.iter_mut() { + substitute_form_vars(v, form_data); + } + } + _ => {} + } +} + +/// Parse JSON, apply [`substitute_form_vars`], return the mutated value. +pub fn fill_template_from_form( + template_json: &str, + form_data: &HashMap, +) -> Result { + let mut v: Value = serde_json::from_str(template_json)?; + substitute_form_vars(&mut v, form_data); + Ok(v) +} + +#[cfg(test)] +mod tests { + use super::*; + use serde::Deserialize; + + #[derive(Debug, Deserialize, PartialEq, Eq)] + struct Demo { + room: String, + thread_tag: String, + nested: Nested, + } + + #[derive(Debug, Deserialize, PartialEq, Eq)] + struct Nested { + text: String, + } + + #[test] + fn holes_become_strings() { + let json = r#"{ + "room": "public", + "thread_tag": {"$form": "tag"}, + "nested": {"text": {"$form": "body"}} + }"#; + let mut form = HashMap::new(); + form.insert("tag".into(), "foo".into()); + form.insert("body".into(), "hello\nworld".into()); + + let v = fill_template_from_form(json, &form).unwrap(); + let d: Demo = serde_json::from_value(v).unwrap(); + assert_eq!( + d, + Demo { + room: "public".into(), + thread_tag: "foo".into(), + nested: Nested { + text: "hello\nworld".into(), + }, + } + ); + } + + #[test] + fn missing_form_key_is_empty_string() { + let json = r#"{"x": {"$form": "nope"}}"#; + let mut form = HashMap::new(); + form.insert("other".into(), "y".into()); + let v = fill_template_from_form(json, &form).unwrap(); + assert_eq!(v["x"], ""); + } + + #[test] + fn array_of_holes() { + let json = r#"{"items": [{"$form": "a"}, {"$form": "b"}]}"#; + let mut form = HashMap::new(); + form.insert("a".into(), "1".into()); + form.insert("b".into(), "2".into()); + let v = fill_template_from_form(json, &form).unwrap(); + assert_eq!(v["items"], serde_json::json!(["1", "2"])); + } + + #[test] + fn template_json_compact_escapes_and_single_line() { + let s = template_json_compact(&serde_json::json!({ + "x": "quote\"and\nnewline" + })) + .unwrap(); + assert!(!s.contains('\n')); + assert!(s.contains("\\\"") || s.contains("\\n")); + } +} diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs index f789e347dc136f8ffd356f4492f0bd76cea04bf0..b1c037f3dd93c7bb96d6624cab6019228432c501 100644 --- a/server/src/html/forum.rs +++ b/server/src/html/forum.rs @@ -11,12 +11,15 @@ use crate::{ api::optional_principal, canonical_path::{canonicalize_item, canonicalize_tag}, events::ThreadCapability, + form_template::template_json_compact, identity::parse_username, reducer::{scope_from_room_wire, ReducerState, ScopeId}, state::AppState, timeago, }; +use super::ui_action::{HtmlUiAction, UI_RPC_FIELD}; + use super::{ bc_segment, bc_threads, cli_panel, layout, now_ms, profile_href, recency_class, render_linkified_with_embeds_in_scope, theme_from_jar, theme_next_from_uri, JsBuilder, @@ -289,7 +292,7 @@ fn rooms_for_user(reduced: &ReducerState, username: &str) -> Vec { v } -fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool { +pub(crate) fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&str>) -> bool { if !reduced.rooms.contains(room_id) { return false; } @@ -299,7 +302,7 @@ fn user_can_view_room(reduced: &ReducerState, room_id: &str, username: Option<&s reduced.user_has_cap(room_id, u, ThreadCapability::View) } -fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool { +pub(crate) fn user_can_post_room(reduced: &ReducerState, room_id: &str, username: &str) -> bool { reduced.user_has_cap(room_id, username, ThreadCapability::Post) } @@ -591,7 +594,6 @@ pub async fn home( let nav = ThreadNav::public(); let reduced_read = state.reduced.read().await; let strip = auth_strip(&headers, &jar, &reduced_read); - let show_forms = user.is_some(); drop(reduced_read); let page = layout( @@ -617,8 +619,14 @@ pub async fn home( } } p class="muted" { "dark = time-ordered · light = vote-ranked" } + div class="thread-feed-toolbar" { + form method="POST" action="/ui" { + input type="hidden" name=(UI_RPC_FIELD) value=(expand_public_new_thread_rpc_value()); + button type="submit" class="section-add-btn" { "+" } + } + } + div id="public-new-thread-ui-slot" {} (render_thread_feed(Some(&nav), "thread-feed", &public_rows, now)) - (new_thread_form_public(show_forms)) (cli_panel("npx slugsocial public forum list")) }, None, @@ -901,7 +909,13 @@ pub async fn room_page( h3 { "threads" } (render_thread_feed(Some(&nav), "room-thread-feed", &rows, now)) @if show_new { - (new_thread_form_for_room(&nav, show_new)) + div class="thread-feed-toolbar" { + form method="POST" action="/ui" { + input type="hidden" name=(UI_RPC_FIELD) value=(expand_room_new_thread_rpc_value(&nav)); + button type="submit" class="section-add-btn" { "+" } + } + } + div id="room-new-thread-ui-slot" {} } (cli_panel(&forum_cli)) (cli_panel(&garden_cli)) @@ -945,6 +959,31 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup { } } +pub(crate) fn expand_public_new_thread_rpc_value() -> String { + template_json_compact(&HtmlUiAction::ExpandPublicNewThreadForm).expect("static json") +} + +pub(crate) fn expand_room_new_thread_rpc_value(nav: &ThreadNav) -> String { + template_json_compact(&HtmlUiAction::ExpandRoomNewThreadForm { + room_wire: nav.room_wire.clone(), + }) + .expect("static json") +} + +pub(crate) fn login_to_post_hint_markup() -> Markup { + html! { + p class="muted" { "log in to post" } + } +} + +pub(crate) fn fragment_public_new_thread_form(show: bool) -> Markup { + new_thread_form_public(show) +} + +pub(crate) fn fragment_room_new_thread_form(nav: &ThreadNav, show: bool) -> Markup { + new_thread_form_for_room(nav, show) +} + async fn thread_post_view_inner( state: AppState, tag: String, diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index 53041a0cf0b30e6f20749c92ecc15a4e9ac56e09..a4fd2dd60ac283f7eb9b2e64522501b21d1e27e9 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -16,6 +16,7 @@ mod editor; mod forum; mod garden; mod search; +pub mod ui_action; use breadcrumb_path::OntologyPath; pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page}; @@ -27,9 +28,15 @@ pub use forum::{ thread_post_collapse_deleted, thread_post_expand, thread_post_expand_deleted, thread_post_view, thread_view, ThreadNav, }; + +pub(crate) use forum::{ + fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup, + user_can_post_room, user_can_view_room, +}; pub use garden::{garden_index, ontology_path, room_garden_index, room_ontology_path}; pub use search::{search_page, search_results_fragment}; pub use forum::user_profile_page; +pub use ui_action::{parse_html_ui_from_form, HtmlUiAction, HtmlUiParseError, UI_RPC_FIELD}; /// Public profile URL path for a stored username (no `@`). pub(crate) fn profile_href(username: &str) -> String { diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs new file mode 100644 index 0000000000000000000000000000000000000000..3bc69ecbb7e16a59d2d393b2d59f9cd3fedb12b1 --- /dev/null +++ b/server/src/html/ui_action.rs @@ -0,0 +1,116 @@ +//! Browser-only UI commands: JSON in hidden `__rpc__` plus hole fill ([`crate::form_template`]). +//! Not part of [`slug_types::RpcCommand`] (CLI / JSON API). + +use crate::form_template::fill_template_from_form; +use serde::{Deserialize, Serialize}; +use serde_json::Value; +use std::collections::HashMap; +use thiserror::Error; + +/// Form field name for the compact JSON template (possibly with `{"$form":"…"}` holes). +pub const UI_RPC_FIELD: &str = "__rpc__"; + +/// HTML form / fetch `POST /ui` payload after template fill and deserialization. +#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] +#[serde(tag = "action", rename_all = "snake_case")] +pub enum HtmlUiAction { + /// Same semantics as `POST /post` (forum ingest). + PostIngest { + room: String, + thread_tag: String, + text: String, + #[serde(default)] + error_target: Option, + #[serde(default)] + form_id: Option, + }, + /// Same as `POST /post/check`. + CheckIngest { + room: String, + thread_tag: String, + text: String, + #[serde(default)] + error_target: Option, + #[serde(default)] + form_id: Option, + }, + /// Same as `POST /post/redact`. + RedactPost { + post_id: String, + }, + /// Morph `#public-new-thread-ui-slot` to the new-thread form (or login hint). + ExpandPublicNewThreadForm, + /// Morph `#room-new-thread-ui-slot` for the given room wire id. + ExpandRoomNewThreadForm { + room_wire: String, + }, +} + +#[derive(Debug, Error)] +pub enum HtmlUiParseError { + #[error("missing __rpc__ field")] + MissingRpc, + #[error("invalid template json: {0}")] + Template(serde_json::Error), + #[error("invalid ui action: {0}")] + Action(serde_json::Error), +} + +/// Parse `__rpc__` JSON, apply `$form` holes from the rest of the form map, deserialize. +pub fn parse_html_ui_from_form(form: &HashMap) -> Result { + let template = form + .get(UI_RPC_FIELD) + .ok_or(HtmlUiParseError::MissingRpc)?; + let mut hole_map = form.clone(); + hole_map.remove(UI_RPC_FIELD); + let v: Value = fill_template_from_form(template, &hole_map).map_err(HtmlUiParseError::Template)?; + serde_json::from_value(v).map_err(HtmlUiParseError::Action) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn round_trip_post_ingest_with_holes() { + let template = serde_json::json!({ + "action": "post_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "e", + "form_id": "f", + }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + form.insert("thread_tag".into(), "x".into()); + form.insert("text".into(), "body".into()); + + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!( + a, + HtmlUiAction::PostIngest { + room: "public".into(), + thread_tag: "x".into(), + text: "body".into(), + error_target: Some("e".into()), + form_id: Some("f".into()), + } + ); + } + + #[test] + fn expand_public_unit_variant() { + let template = serde_json::json!({ "action": "expand_public_new_thread_form" }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!(a, HtmlUiAction::ExpandPublicNewThreadForm); + } +} diff --git a/server/src/lib.rs b/server/src/lib.rs index b9d4b79791ba8dd3a3c26ff777943a2548092de5..5f5b6b0f01b29350c7415e5801ec5caa74f0b452 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -3,6 +3,7 @@ pub mod paths; pub mod api; pub mod canonical_path; pub mod dsl; +pub mod form_template; pub mod html; pub mod event_log; pub mod events; @@ -33,6 +34,7 @@ pub fn create_app(state: AppState) -> Router { .route("/post", post(api::post_web_ingest)) .route("/post/redact", post(api::post_web_redact)) .route("/post/check", post(api::check_web_ingest)) + .route("/ui", post(api::post_ui_html)) .route("/theme", post(crate::html::post_theme)) .route("/sse", get(api::get_html_stream)) .route("/stream", get(api::get_stream)) Side B — contributor: tommy-mor Side B — commit message: [8f6be6d0] Add copy button for garden rankings (markdown clipboard) (#168) * Add garden ranking markdown copy button via POST /ui Introduce HtmlUiAction::CopyGardenRank that rebuilds the visible child ranking and returns JsBuilder clipboard JS (fetch → eval), matching CopyThread. Place a copy control on garden ranking headings; clipboard text is a concise markdown numbered list with unranked bullets. Co-authored-by: tommy * Fix paren balance in garden ranking copy browser test Co-authored-by: tommy --------- Co-authored-by: Cursor Agent Side B — unified diff (full patch): diff --git a/agents.md b/agents.md index 7d6fea5791f7c95677e17e8975a14df83f998fd6..1dc989e4b23071f2eef69f2479c9a1ca2bd04b32 100644 --- a/agents.md +++ b/agents.md @@ -40,6 +40,8 @@ Strict **CSP** that blocks `eval` would break the current app. Other projects ma - **Non-morph `POST /ui` responses:** **`SetGardenPin`** returns **`303 See Other`** and **`Set-Cookie`** (same as **`POST /theme`**). Garden pin/unpin is a normal **`
`** — browser navigation applies cookies reliably (see **`test/browser_garden_pin.clj`**). Each **`__rpc__`** payload includes **`form_action: "/ui"`**; **`post_ui_html`** rejects mismatches to bind tokens to the UI endpoint. +- **`CopyGardenRank`:** Browser copy control on garden ranking headings. Returns **`text/javascript`** via **`JsBuilder::clipboard_write_text_and_label_btn`** (same **`fetch` → `eval`** loop as **`CopyThread`**). Payload includes **`room`**, **`parent_path`**, **`depth`**, **`copy_btn_id`**, and optional **`external_hosts`** (for **`/-/`** host-root indexes). Clipboard text is a concise markdown numbered list of display paths (plus unranked bullets). + - **`VoteComparePost`:** On success returns **`text/javascript`** that **morphs** **`#vote-edge-history-region`** (recomputed **`
    `** — ratios match **`left`/`right`** query order, bullets, sorted by strength toward **`left`** then newer) and **`.vote-compare-nav`** (fresh next-pair link). The compare **`GET`** page uses **`layout_full_bleed_chromeless`** (no breadcrumbs, no **`#controls`**, no **`slug-pin-hud`**; **`view-vote-compare-fullscreen`** full-width **`body`**). **`__rpc__`** carries **`form_action: "/ui"`**; **`thread_tag`** and ratio fields come from the same form as **`$form`** holes. **Guests** on a shared pair see the compose UI with **`post vote`** as a link to **`/login?next=`** (class **`vote-compare-login-cta`**); after OAuth / username selection they return to that matchup. An unauthenticated **`VoteComparePost`** (forged/stale form) still JS-redirects to the same **`/login?next=`** target. - **`ThreadGraduate` / `GraduateThread`:** Private-room forum threads with **Manage** can be published to the public site under the same tag. The writer replays non-redacted ingests into **`room: public`** (chronological order), then appends a durable **`ThreadGraduated`** marker. Graduated private threads show a banner linking to public **`/t/:tag`**, block further private posts, and cannot be graduated twice. CLI: **`npx slugsocial private forum graduate `**; RPC: **`ThreadGraduate`**. diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index b4a0c9e87e462050bd52728e49e0d6781bf1cfc8..611956d0a46062b49ce350be176e4be139312ff0 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -24,9 +24,9 @@ use crate::{ external_resolver_status_markup, fragment_new_thread_slot, login_to_post_hint_markup, parse_html_ui_from_form, room_members_section_markup, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, thread_ui_collapse_redacted_post, - thread_ui_copy_thread, - thread_ui_expand_post_full, thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room, - user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav, + garden_ui_copy_rank, thread_ui_copy_thread, thread_ui_expand_post_full, + thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room, user_can_view_room, + HtmlUiAction, JsBuilder, ThreadNav, }, reducer::{scope_from_room_wire, ScopeId}, state::AppState, @@ -575,6 +575,25 @@ async fn dispatch_ui_action( let viewer = session.map(|s| s.username.as_str()); thread_ui_copy_thread(state, &room, &thread_tag, ©_btn_id, viewer).await } + HtmlUiAction::CopyGardenRank { + room, + parent_path, + depth, + copy_btn_id, + external_hosts, + } => { + let viewer = session.map(|s| s.username.as_str()); + garden_ui_copy_rank( + state, + &room, + &parent_path, + depth, + ©_btn_id, + external_hosts, + viewer, + ) + .await + } HtmlUiAction::GraduateThread { room, thread_tag } => { let Some(session) = session else { return js_redirect("/login").into_response(); diff --git a/server/src/html/garden/copy.rs b/server/src/html/garden/copy.rs new file mode 100644 index 0000000000000000000000000000000000000000..271ea87c34c99e23ab1b0d8572632fdc41380b78 --- /dev/null +++ b/server/src/html/garden/copy.rs @@ -0,0 +1,199 @@ +//! Copy garden rankings to the clipboard as concise markdown (POST /ui + JsBuilder eval). + +use crate::form_template::template_json_compact; +use crate::html::forum::ThreadNav; +use crate::html::js_string_literal; +use crate::html::ui_action::HtmlUiAction; +use crate::html::{JsBuilder, ui_js_warn}; +use crate::path_types::ItemId; +use crate::reducer::scope_from_room_wire; +use crate::scope_rank::{ + build_children_rankings, build_rankings_for_item_set, external_root_host_items, + resolve_scope_recursive, ChildrenRankings, +}; +use crate::state::AppState; +use maud::{html, Markup}; + +use super::access::user_can_view_room; +use super::item::item_display_path; +use crate::reducer::{ContentState, ScopeId}; + +const COPY_BTN_ID: &str = "garden-rank-copy"; + +/// `POST /ui` + `__rpc__` from an inline button; response body is `eval`'d (same as forum copy). +fn garden_ui_fetch_onclick(rpc_compact_json: &str) -> String { + format!( + "fetch('/ui',{{method:'POST',headers:{{'Content-Type':'application/x-www-form-urlencoded'}},body:new URLSearchParams({{__rpc__:{}}}).toString(),credentials:'same-origin'}}).then(r=>r.text()).then(eval);return false", + js_string_literal(rpc_compact_json) + ) +} + +/// Concise markdown for ranked child groups (numbered lists + unranked bullets). +pub(crate) fn format_garden_rank_markdown(rankings: &ChildrenRankings) -> String { + let mut out = String::new(); + let multi = rankings.component_rankings.len() > 1; + for (ci, comp) in rankings.component_rankings.iter().enumerate() { + if ci > 0 { + out.push('\n'); + } + if multi { + out.push_str(&format!("### ordering {}\n\n", ci + 1)); + } + for (i, r) in comp.ranked.iter().enumerate() { + out.push_str(&format!( + "{}. {}\n", + i + 1, + item_display_path(r.item.as_str()) + )); + } + } + if !rankings.unranked_items.is_empty() { + if !out.is_empty() { + out.push('\n'); + } + for name in &rankings.unranked_items { + out.push_str(&format!("- {}\n", item_display_path(name.as_str()))); + } + } + out +} + +fn rankings_for_copy( + state_content: &crate::reducer::ContentState, + parent_path: &str, + depth: usize, + external_hosts: bool, +) -> ChildrenRankings { + if external_hosts { + let hosts = external_root_host_items(state_content); + return build_rankings_for_item_set(state_content, &hosts); + } + let parent = ItemId::parse(parent_path.trim()) + .unwrap_or_else(|| ItemId::ontology_root()) + .normalized_storage(); + let depth = depth.clamp(1, 5); + if depth > 1 { + let items = resolve_scope_recursive(state_content, &[parent.as_str().to_string()], depth); + build_rankings_for_item_set(state_content, &items) + } else { + build_children_rankings(state_content, &parent) + } +} + +pub(crate) async fn garden_ui_copy_rank( + state: &AppState, + room: &str, + parent_path: &str, + depth: usize, + copy_btn_id: &str, + external_hosts: bool, + viewer: Option<&str>, +) -> axum::response::Response { + let room = room.trim(); + let scope = scope_from_room_wire(room); + if let ScopeId::Room(ref rid) = scope { + let reduced = state.reduced.read().await; + if !user_can_view_room(&reduced, rid, viewer) { + return ui_js_warn("forbidden"); + } + } + + let reduced = state.reduced.read().await; + let empty = ContentState::default(); + let content = match &scope { + ScopeId::Public => reduced.public(), + ScopeId::Room(_) => reduced.content_for_scope(&scope).unwrap_or(&empty), + }; + let rankings = rankings_for_copy(content, parent_path, depth, external_hosts); + let text = format_garden_rank_markdown(&rankings); + drop(reduced); + + if text.is_empty() { + return ui_js_warn("nothing to copy"); + } + + JsBuilder::new() + .clipboard_write_text_and_label_btn(&text, copy_btn_id, "copied") + .into_response() +} + +pub(super) fn garden_rank_copy_button_markup( + nav: &ThreadNav, + parent_path: &str, + depth: usize, + external_hosts: bool, +) -> Markup { + let rpc = template_json_compact(&HtmlUiAction::CopyGardenRank { + room: nav.room_wire.clone(), + parent_path: parent_path.to_string(), + depth, + copy_btn_id: COPY_BTN_ID.to_string(), + external_hosts, + }) + .expect("CopyGardenRank serializes"); + html! { + button type="button" id=(COPY_BTN_ID) class="post-nav-btn ont-rank-copy-btn" title="Copy ranking as markdown" + onclick=(garden_ui_fetch_onclick(&rpc)) { + "copy" + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::path_types::ItemId; + use crate::ranking::RankedItem; + use crate::scope_rank::ScopedComponent; + + #[test] + fn markdown_single_component_and_unranked() { + let rankings = ChildrenRankings { + component_rankings: vec![ScopedComponent { + pairs: 1, + ranked: vec![ + RankedItem { + item: ItemId::parse("~/a").unwrap(), + score: 0.9, + }, + RankedItem { + item: ItemId::parse("~/b").unwrap(), + score: 0.1, + }, + ], + }], + unranked_items: vec![ItemId::parse("~/c").unwrap()], + }; + assert_eq!( + format_garden_rank_markdown(&rankings), + "1. ~/a\n2. ~/b\n\n- ~/c\n" + ); + } + + #[test] + fn markdown_multi_component_headers() { + let rankings = ChildrenRankings { + component_rankings: vec![ + ScopedComponent { + pairs: 1, + ranked: vec![RankedItem { + item: ItemId::parse("~/a").unwrap(), + score: 1.0, + }], + }, + ScopedComponent { + pairs: 1, + ranked: vec![RankedItem { + item: ItemId::parse("~/b").unwrap(), + score: 1.0, + }], + }, + ], + unranked_items: vec![], + }; + assert_eq!( + format_garden_rank_markdown(&rankings), + "### ordering 1\n\n1. ~/a\n\n### ordering 2\n\n1. ~/b\n" + ); + } +} diff --git a/server/src/html/garden/mod.rs b/server/src/html/garden/mod.rs index ee8696727e5473fe1fa913b8a7b9f3cb9c32d12f..69012a2c1d069e47fa611d63d3bd2a329fd6255d 100644 --- a/server/src/html/garden/mod.rs +++ b/server/src/html/garden/mod.rs @@ -2,6 +2,7 @@ mod access; mod browse; +mod copy; mod external; mod item; mod item_page; @@ -13,6 +14,7 @@ mod vote; #[cfg(test)] mod tests; +pub(crate) use copy::garden_ui_copy_rank; pub(crate) use external::external_resolver_status_markup; pub(crate) use pin::{encode_pin_cookie_value, GARDEN_PIN_COOKIE}; pub(crate) use vote::vote_compare_post_success_js; diff --git a/server/src/html/garden/render.rs b/server/src/html/garden/render.rs index ca546693ecb2bb9ae5fb370f02b860c943f604b9..eed80e807d77e6b4eeeb0c3f38d6372e91ad2852 100644 --- a/server/src/html/garden/render.rs +++ b/server/src/html/garden/render.rs @@ -25,6 +25,7 @@ use crate::{ use super::{ access::content_for_garden_view, browse::{garden_layout_meta, scoped_bc_path_for, GardenBrowsePath}, + copy::garden_rank_copy_button_markup, external::{external_frame_allowed, external_source_href, github_resolver_controls}, item::{child_depth_from_uri, item_code_label, item_display_path, item_href}, item_page::{build_item_page_view_model, sibling_nav_markup}, @@ -196,6 +197,15 @@ pub(super) async fn render_scope_view( " " span class="muted" { (format!("(depth {})", model.child_depth)) } } + @if total_children > 0 { + " " + (garden_rank_copy_button_markup( + &nav, + &item_display_path(&model.item), + model.child_depth, + false, + )) + } @if total_children >= 2 { " " a class="ont-vote-children-btn" href=(vote_pool_href(&nav, &model.item)) { diff --git a/server/src/html/garden/routes.rs b/server/src/html/garden/routes.rs index 8a0499576d9093dbac0fffa1cf2ed88187e14acb..31b61355b1ec75645d405e16ab6abf8205c66380 100644 --- a/server/src/html/garden/routes.rs +++ b/server/src/html/garden/routes.rs @@ -28,6 +28,7 @@ use crate::{ use super::{ access::{content_for_garden_view, room_not_found_page, room_scope_has_garden_content, user_can_view_room}, browse::{GardenBrowsePath, scoped_bc_path_external}, + copy::garden_rank_copy_button_markup, item::{item_display_path, item_href}, render::render_scope_view, }; @@ -52,7 +53,13 @@ pub async fn garden_index( html! { @let root_path = OntologyPath::root(); nav class="breadcrumb" { (bc_path(&root_path)) } - h2 { "paths" } + h2 { + "paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "~/", 1, false)) + } + } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no items yet" } } @else { @@ -137,7 +144,13 @@ pub async fn external_garden_index( "view-ontology view-ontology-light", html! { nav class="breadcrumb" { (bc_path_external(&ext_path)) } - h2 { "external paths" } + h2 { + "external paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "", 1, true)) + } + } p class="muted" { "Items outside slug.social use the " code { "-/" } " prefix followed by the full " code { "https://…" } " URL (legacy " code { "-/host/path" } " still works)." } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no external items indexed yet" } @@ -272,7 +285,13 @@ pub async fn room_external_garden_index( "view-ontology view-ontology-light", html! { nav class="breadcrumb" { (scoped_bc_path_external(&ext_path, &nav)) } - h2 { "external paths" } + h2 { + "external paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "", 1, true)) + } + } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no external items indexed yet" } } @else { diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index d7014fc7f934e5b0c7fb47ebf00cb4ef50d306c2..645d54f2e117ba901e02ed958ada6ff69a78ae34 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -37,8 +37,8 @@ pub(crate) use forum::{ user_can_post_room, user_can_view_room, }; pub(crate) use garden::{ - encode_pin_cookie_value, external_resolver_status_markup, vote_compare_post_success_js, - GARDEN_PIN_COOKIE, + encode_pin_cookie_value, external_resolver_status_markup, garden_ui_copy_rank, + vote_compare_post_success_js, GARDEN_PIN_COOKIE, }; pub use garden::{ external_garden_index, external_ontology_path, garden_index, ontology_path, diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs index 5cf3168fb74e7654215cd9ff8942c6ed63fd0002..7dc3db062954370b5504fc311c0ab24bab569f80 100644 --- a/server/src/html/ui_action.rs +++ b/server/src/html/ui_action.rs @@ -118,6 +118,18 @@ pub enum HtmlUiAction { thread_tag: String, copy_btn_id: String, }, + /// Copy garden child ranking as a concise markdown list to the clipboard. + CopyGardenRank { + room: String, + /// Parent item path (storage or display). Ignored when `external_hosts` is true. + parent_path: String, + #[serde(default = "default_garden_rank_depth")] + depth: usize, + copy_btn_id: String, + /// When true, copy rankings for external host roots (`/-/` index), not parent children. + #[serde(default)] + external_hosts: bool, + }, /// Publish a private-room thread to the public forum (Manage only). GraduateThread { room: String, @@ -125,6 +137,10 @@ pub enum HtmlUiAction { }, } +fn default_garden_rank_depth() -> usize { + 1 +} + #[derive(Debug, Error)] pub enum HtmlUiParseError { #[error("missing __rpc__ field")] @@ -272,4 +288,57 @@ mod tests { } ); } + + #[test] + fn copy_garden_rank_round_trip() { + let template = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/topic", + "depth": 2, + "copy_btn_id": "garden-rank-copy", + }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!( + a, + HtmlUiAction::CopyGardenRank { + room: "public".into(), + parent_path: "~/topic".into(), + depth: 2, + copy_btn_id: "garden-rank-copy".into(), + external_hosts: false, + } + ); + } + + #[test] + fn copy_garden_rank_defaults_depth_and_external_hosts() { + let template = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/", + "copy_btn_id": "garden-rank-copy", + }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!( + a, + HtmlUiAction::CopyGardenRank { + room: "public".into(), + parent_path: "~/".into(), + depth: 1, + copy_btn_id: "garden-rank-copy".into(), + external_hosts: false, + } + ); + } } diff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs index d242abff5769cc704b3c8070d7456e5788c31a45..6b1475b773106a2dd3f326475c9fb4cc727f6b4b 100644 --- a/server/tests/integration_ui.rs +++ b/server/tests/integration_ui.rs @@ -490,3 +490,71 @@ async fn test_vote_compare_post_rejects_over_max_ratio() { ); } +#[tokio::test] +async fn test_copy_garden_rank_returns_clipboard_js_with_markdown() { + let (addr, _tmp, _log, _handle) = create_test_server().await; + let client = reqwest::Client::new(); + let bearer = test_bearer(); + + let seed = rpc_batch( + &client, + addr, + Some(&bearer), + serde_json::json!([{ + "Post": { + "room": "public", + "thread_tag": "copy-rank-ui", + "text": "# copy-rank-ui\n\n~/copy-a {a}\n~/copy-b {b}\n~/copy-c {c}\n{vote}\n~/copy-a 2:1 ~/copy-b\n", + "return_rank_diff": false + } + }]), + ) + .await; + assert_eq!(seed["results"][0]["ok"], true, "seed: {:?}", seed); + + let page = client + .get(format!("http://{addr}/~")) + .send() + .await + .unwrap(); + assert!(page.status().is_success()); + let html = page.text().await.unwrap(); + assert!( + html.contains("id=\"garden-rank-copy\"") && html.contains("copy_garden_rank"), + "garden index should include copy button + action payload" + ); + + let rpc = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/", + "depth": 1, + "copy_btn_id": "garden-rank-copy", + }) + .to_string(); + let resp = client + .post(format!("http://{addr}/ui")) + .header("Authorization", format!("Bearer {bearer}")) + .form(&[("__rpc__", rpc.as_str())]) + .send() + .await + .unwrap(); + assert_eq!(resp.status(), reqwest::StatusCode::OK); + assert_eq!( + resp.headers() + .get(reqwest::header::CONTENT_TYPE) + .and_then(|v| v.to_str().ok()), + Some("text/javascript; charset=utf-8") + ); + let js = resp.text().await.unwrap(); + assert!( + js.contains("navigator.clipboard.writeText") && js.contains("garden-rank-copy"), + "expected clipboard JsBuilder snippet, got: {js}" + ); + assert!( + js.contains("1. ~/copy-a") && js.contains("2. ~/copy-b") && js.contains("- ~/copy-c"), + "expected concise markdown ranking in clipboard payload, got: {js}" + ); + assert!(js.contains("\"copied\""), "expected button label flip to copied"); +} + diff --git a/test/browser_public_garden.clj b/test/browser_public_garden.clj index 5dd49f1f70c870e25a2a9f5348f0bdb85647e897..8ceb532c664f9fc3d6f66a451e5ea5eaa1671007 100644 --- a/test/browser_public_garden.clj +++ b/test/browser_public_garden.clj @@ -73,6 +73,7 @@ (core/with-playwright [pw] (core/with-browser [browser (core/launch-chromium pw {:headless true :channel "chrome"})] (core/with-context [ctx (core/new-context browser)] + (core/context-grant-permissions! ctx ["clipboard-read" "clipboard-write"]) (core/with-page [pg (core/new-page-from-context ctx)] (page/navigate pg (str base-url "/login")) (is (wait-for-text pg "body" "@alice" 15000) "alice session after login") @@ -84,7 +85,12 @@ (is (wait-for-text pg "body" "~/br-pub-b" 10000) "ranked list shows ~/br-pub-b") (is (wait-for-text pg "body" "unranked" 10000) "unranked section present") (is (wait-for-text pg "body" "~/br-pub-c" 10000) - "unranked list shows ~/br-pub-c")))))) + "unranked list shows ~/br-pub-c") + (is (wait-for-text pg "#garden-rank-copy" "copy" 5000) + "garden ranking copy button visible") + (locator/click (page/locator pg "#garden-rank-copy")) + (is (wait-for-text pg "#garden-rank-copy" "copied" 10000) + "copy button flips to copied after POST /ui eval")))))) (finally (when-some [s @!server] (common/kill-server s))