Side A fixes a real production bug (Reddit's block page silently poisoning fetches) with a robust retry/refresh mechanism, better error surfacing (truncate_for_error), and includes a unit test validating the fix — this is a correctness/reliability fix with lasting operational value. Side B adds a reasonable feature (pool-scoped voting) that is useful but more speculative UI/UX plumbing without tests, and is lower-stakes than fixing a hard failure mode in production data fetching.
constitution · epochs · watch · epoch 3
comparison
c_ca9169f732b8 (tommy-mor) vs c_c6f5afec1d36 (tommy-mor)
download prompt · raw event · cmp_1933f14cd5e8a4
council reasoning
A fixes a production-breaking Reddit path by requiring OAuth when credentials exist, refreshing on 401/403, and never falling back to the blocked www.reddit.com API, plus clearer AuthRejected handling—lasting correctness for cloud deploys. B is a solid product feature (pool-scoped /vote and UI wiring) but additive UX rather than fixing broken core data access.
Side A makes the Reddit integration substantially more robust by requiring OAuth when configured, adding a retry with forced token refresh on 401/403, propagating token acquisition errors instead of silently falling back, and improving error handling with targeted truncation and a regression test. Side B adds a useful pool-scoped voting feature and threads the new `pool` parameter through the UI and routing, but it is primarily new application functionality, whereas Side A addresses a production reliability issue that prevents blocked cloud deployments from functioning correctly.
sides
A — c_ca9169f732b8 (tommy-mor)
message
[8f69c309] Require Reddit OAuth when credentials are set and refresh on 401/403. Avoid falling back to the public www.reddit.com API from cloud IPs, which returns Reddit's network-security block page. Also pin SORTER2_BASE_URL in fly.toml. Co-authored-by: Cursor <cursoragent@cursor.com>
diff preview
diff --git a/fly.toml b/fly.toml
index f0c6a39f643c204987debc177234d95a8ef44b65..ca7e0088a7efd7d58d29d808f8d89080b2bff233 100644
--- a/fly.toml
+++ b/fly.toml
@@ -5,6 +5,7 @@ primary_region = "iad"
dockerfile = "Dockerfile"
[env]
+ SORTER2_BASE_URL = "https://reddit.sorter.social"
SORTER2_DATA_DIR = "/data"
SORTER2_EVENT_LOG = "/data/events.jsonl"
PORT = "8080"
diff --git a/server/src/reddit.rs b/server/src/reddit.rs
index a874814f8927192ee62cab2d0db1efd27dcd57b7..f409764c1e1f36216f1b08107043c2eab905694c 100644
--- a/server/src/reddit.rs
+++ b/server/src/reddit.rs
@@ -283,26 +283,35 @@ async fn reddit_worker(
);
tokio::time::sleep(current_delay).await;
- if let Some(c) = &creds {
- oauth = ensure_oauth_token(&client, &oauth_token_base, c, oauth.take()).await;
- }
-
- let token = oauth.as_ref().map(|t| t.access_token.as_str());
- let fetch_base = if token.is_some() {
- tracing::debug!(
- item = %fetch_id,
- base = %oauth_api_base,
- "reddit fetch using OAuth bearer"
- );
- &oauth_api_base
- } else {
- &api_base
- };
- let url = match kind {
- FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, fetch_base),
- FetchKind::Children => map_children_url(&fetch_id, fetch_base),
+ let outcome = match &creds {
+ Some(c) => {
+ // OAuth is required when credentials are configured — never fall
+ // back to the public www.reddit.com JSON endpoints (cloud IPs
+ // get blocked with a 403 HTML interstitial).
+ fetch_with_oauth(
+ &client,
+ &oauth_token_base,
+ &oauth_api_base,
+ c,
+ &mut oauth,
+ &fetch_id,
+ kind,
+ )
+ .await
+ }
+ None => {
+ let url = match kind {
+ FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, &api_base),
+ FetchKind::Children => map_children_url(&fetch_id, &api_base),
+ };
+ match do_fetch(&client, &url, &fetch_id, None).await {
+ Ok(FetchOutcome::AuthRejected { status, detail }) => {
+ Err(format!("Reddit API {status}: {detail}"))
+ }
+ other => other,
+ }
+ }
};
- let outcome = do_fetch(&client, &url, &fetch_id, token).await;
match outcome {
Ok(FetchOutcome::Payload(payload)) => {
@@ -342,6 +351,12 @@ async fn reddit_worker(
current_delay = (current_delay * 2).min(Duration::from_secs(60));
notify(done, FetchJobResult::RateLimited { reset_secs });
}
+ Ok(FetchOutcome::AuthRejected { status, detail }) => {
+ let e = format!("Reddit API {status}: {detail}");
+ tracing::warn!(item = %fetch_id, err = %e, "reddit fetch auth rejected");
+ current_delay = (current_delay * 2).min(Duration::from_secs(60));
+ notify(done, FetchJobResult::Failed(e));
+ }
Err(e) => {
tracing::warn!(item = %fetch_id, err = %e, "reddit fetch failed");
current_delay = (current_delay * 2).min(Duration::from_secs(60));
@@ -357,6 +372,60 @@ enum FetchOutcome {
Payload(Value),
NotFound,
RateLimited { reset_secs: u64 },
+ /// Bearer rejected — caller should drop the cached token and retry once.
+ AuthRejected { status: StatusCode, detail: String },
+}
+
+async fn fetch_with_oauth(
+ client: &Client,
+ oauth_token_base: &str,
+ oauth_api_base: &str,
+ creds: &RedditCredentials,
+ oauth: &mut Option<OAuthToken>,
+ fetch_id: &ItemId,
+ kind: FetchKind,
+) -> Result<FetchOutcome, String> {
+ for attempt in 0..2 {
+ let force_refresh = attempt > 0;
+ *oauth = Some(
+ ensure_oauth_token(client, oauth_token_base, creds, oauth.take(), force_refresh)
+ .await?,
+ );
+ let token = oauth
+ .as_ref()
+ .expect("token set above")
+ .access_token
+ .clone();
+
+ tracing::debug!(
+ item = %fetch_id,
+ base = %oauth_api_base,
+ attempt,
+ "reddit fetch using OAuth bearer"
+ );
+
+ let url = match kind {
+ FetchKind::SelfEntity => map_item_to_reddit_api(fetch_id, oauth_api_base),
+ FetchKind::Children => map_children_url(fetch_id, oauth_api_base),
+ };
+ match do_fetch(client, &url, fetch_id, Some(&token)).await? {
+ FetchOutcome::AuthRejected { status, detail } if attempt == 0 => {
+ tracing::warn!(
+ item = %fetch_id,
+ %status,
+ %detail,
+ "reddit OAuth rejected; refreshing token and retrying"
+ );
+ *oauth = None;
+ continue;
+ }
+ FetchOutcome::AuthRejected { status, detail } => {
+ return Err(format!("Reddit API {status}: {detail}"));
+ }
+ other => return Ok(other),
+ }
+ }
+ unreachable!("loop always returns")
}
async fn ensure_oauth_token(
@@ -364,35 +433,35 @@ async fn ensure_oauth_token(
oauth_base: &str,
creds: &RedditCredentials,
existing: Option<OAuthToken>,
-) -> Option<OAuthToken> {
- if let Some(t) = existing {
- if Instant::now() < t.expires_at - Duration::from_secs(60) {
- tracing::debug!("reddit OAuth token still valid");
- return Some(t);
+ force_refresh: bool,
+) -> Result<OAuthToken, String> {
+ if !force_refresh {
+ if let Some(t) = existing {
+ if Instant::now() < t.expires_at - Duration::from_secs(60) {
+ tracing::debug!("reddit OAuth token still valid");
+ return Ok(t);
+ }
}
}
let url = format!("{}/api/v1/access_token", oauth_base.trim_end_matches('/'));
- tracing::debug!(%url, "reddit OAuth token request");
+ tracing::debug!(%url, force_refresh, "reddit OAuth token request");
let resp = client
.post(&url)
.basic_auth(&creds.client_id, Some(&creds.client_secret))
.form(&[("grant_type", "client_credentials")])
.send()
- .await;
-
- let resp = match resp {
- Ok(r) => r,
- Err(e) => {
- tracing::warn!("reddit OAuth token request failed: {e}");
- return None;
- }
- };
+ .await
+ .map_err(|e| format!("Reddit OAuth token request failed: {e}"))?;
if !resp.status().is_success() {
- tracing::warn!("reddit OAuth token HTTP {}", resp.status());
- return None;
+ let status = resp.status();
+ let body = resp.text().await.unwrap_or_default();
+ return Err(format!(
+ "Reddit OAuth token HTTP {status}: {}",
+ truncate_for_error(&body)
+ ));
}
#[derive(Deserialize)]
@@ -401,21 +470,40 @@ async fn ensure_oauth_token(
expires_in: u64,
}
- let body: TokenResponse = match resp.json().await {
- Ok(b) => b,
- Err(e) => {
- tracing::warn!("reddit OAuth token parse failed: {e}");
- return None;
- }
- };
+ let body: TokenResponse = resp
+ .json()
+ .await
+ .map_err(|e| format!("Reddit OAuth token parse failed: {e}"))?;
- tracing::debug!(expires_in = body.expires_in, "reddit OAuth token acquired");
- Some(OAuthToken {
+ tracing::info!(expires_in = body.expires_in, "reddit OAuth token acquired");
+ Ok(OAuthToken {
access_token: body.access_token,
expires_at: Instant::now() + Duration::from_secs(body.expires_in),
})
}
+fn truncate_for_error(body: &str) -> String {
+ let compact: String = body.split_whitespace().collect::<Vec<_>>().join(" ");
+ if compact.is_empty() {
+ return "(empty body)".into();
+ }
+ // Prefer the human-readable block message over dumping Reddit's CSS.
+ if let Some(idx) = compact.find("You've been blocked") {
+ let slice: String = compact.chars().skip(idx).take(160).collect();
+ return if compact.chars().count() > idx + 160 {
+ format!("{slice}…")
+ } else {
+ slice
+ };
+ }
+ let chars: String = compact.chars().take(200).collect();
+ if compact.chars().count() > 200 {
+ format!("{chars}…")
+ } else {
+ chars
+ }
+}
+
async fn do_fetch(
client: &Client,
url: &str,
@@ -460,15 +548,16 @@ async fn do_fetch(
if !status.is_success() {
let body = resp.text().await.unwrap_or_default();
+ let detail = truncate_for_error(&body);
tracing::debug!(
item = %id,
%status,
body_len = body.len(),
- body_prefix = %body.chars().take(240).collect::<String>(),
+ %detail,
"reddit non-success body"
);
if status == StatusCode::FORBIDDEN || status == StatusCode::UNAUTHORIZED {
- return Err(format!("Reddit API {status}: {body}"));
+ return Ok(FetchOutcome::AuthRejected { status, detail });
}
return Ok(FetchOutcome::NotFound);
}
@@ -716,6 +805,15 @@ fn reddit_direct_image_url(url: &str) -> bool {
mod tests {
use super::*;
+ #[test]
+ fn truncate_error_prefers_block_message() {
+ let html = r#"<style>.x{color:red}</style><div>You've been blocked by network security. To continue, log in</div>"#;
+ let msg = truncate_for_error(html);
+ assert!(msg.starts_with("You've been blocked"));
+ assert!(msg.len() < 200);
+ assert!(!msg.contains(".x{color"));
+ }
+
#[test]
fn map_subreddit_about_url() {
let id = ItemId::from_url("https://reddit.com/r/rust").unwrap();
B — c_c6f5afec1d36 (tommy-mor)
message
[5350388a] Add pool-scoped voting: /vote?pool=<parent> picks pairs from children. - /vote now accepts an optional `pool` param (parent item path). When provided without left/right, it picks the first unvoted pair from the pool's children. When provided alongside left/right, it constrains "next pair" navigation to siblings within the pool. - "vote on children" button appears on item pages with ≥2 children, linking to /vote?pool=<item>. - Pool is threaded through VoteComparePost → success JS so in-page morph after voting keeps the pool context for next-pair navigation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
diff preview
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
index 5faa642451d69555cb391974beb0ad22c9355c8c..b79efdb4d52bd445a67f38cbfd61d3507d2b3014 100644
--- a/server/src/api/ui_html.rs
+++ b/server/src/api/ui_html.rs
@@ -193,6 +193,7 @@ async fn dispatch_ui_action(
ratio_right,
explanation,
next,
+ pool,
form_action,
} => {
if form_action != "/ui" {
@@ -239,6 +240,9 @@ async fn dispatch_ui_action(
.into_response();
}
};
+ let pool_id = pool.as_deref().and_then(|p| {
+ crate::path_types::ItemId::parse(p.trim()).map(|i| i.normalized_storage())
+ });
let mut rl = ratio_left.trim().parse::<i32>().unwrap_or(0).max(0);
let mut rr = ratio_right.trim().parse::<i32>().unwrap_or(0).max(0);
if rl == 0 && rr == 0 {
@@ -294,6 +298,7 @@ async fn dispatch_ui_action(
&thread_tag,
&left_id,
&right_id,
+ pool_id.as_ref(),
pid.as_str(),
post_index,
)
diff --git a/server/src/html/garden/pin.rs b/server/src/html/garden/pin.rs
index 5865cfdbc06aeb6555c97380e25591fae6b3d125..1820d7fe7ee167ecbf5ad5124f23b2ab92ffb01f 100644
--- a/server/src/html/garden/pin.rs
+++ b/server/src/html/garden/pin.rs
@@ -79,7 +79,7 @@ pub(super) fn ont_pin_vote_controls(
}
}
} @else {
- a class="ont-vote-compare-btn" href=(vote_compare_href(nav, pi, ¤t, None)) title="Compare and vote" {
+ a class="ont-vote-compare-btn" href=(vote_compare_href(nav, pi, ¤t, None, None)) title="Compare and vote" {
span class="ont-vote-glyph" aria-hidden="true" { "⚖" }
span { "vote" }
}
@@ -121,7 +121,7 @@ pub(super) fn child_row_pin_or_vote(
if nv == 1 { "" } else { "s" },
);
@let aria = format!("Vote; {} pairwise {}", nv, if nv == 1 { "vote" } else { "votes" });
- a class="ont-garden-vote-ico" href=(vote_compare_href(nav, pi, row_item, None)) title=(tip) aria-label=(aria) {
+ a class="ont-garden-vote-ico" href=(vote_compare_href(nav, pi, row_item, None, None)) title=(tip) aria-label=(aria) {
span class="ont-garden-vote-glyph" aria-hidden="true" { "⚖" }
span class="ont-garden-vote-count" { (format!("{}", nv)) }
}
diff --git a/server/src/html/garden/render.rs b/server/src/html/garden/render.rs
index 5c3986ca36902f6c9019a4b5590f0b3b9d2cb4ff..bd8cbce059ee789de6e8dc9b6f69f54beee2f994 100644
--- a/server/src/html/garden/render.rs
+++ b/server/src/html/garden/render.rs
@@ -29,6 +29,7 @@ use super::{
item::{child_depth_from_uri, item_code_label, item_display_path, item_href},
item_page::{build_item_page_view_model, sibling_nav_markup},
pin::{child_row_pin_or_vote, ont_pin_vote_controls, pinned_item_from_jar},
+ vote::vote_pool_href,
};
pub(super) async fn render_scope_view(
@@ -186,12 +187,21 @@ pub(super) async fn render_scope_view(
}
section class="ont-tab-panel ont-tab-panel-children" {
+ @let total_children = model.child_rankings.component_rankings
+ .iter().map(|c| c.ranked.len()).sum::<usize>()
+ + model.child_rankings.unranked_items.len();
h3 {
"ranked child groups"
@if model.child_depth > 1 {
" "
span class="muted" { (format!("(depth {})", model.child_depth)) }
}
+ @if total_children >= 2 {
+ " "
+ a class="ont-vote-children-btn" href=(vote_pool_href(&nav, &model.item)) {
+ "vote on children"
+ }
+ }
}
@if model.child_rankings.component_rankings.is_empty() {
p class="muted" { "no voted pairs yet in this scope" }
diff --git a/server/src/html/garden/tests.rs b/server/src/html/garden/tests.rs
index 6900a6795bcde866a176722149d6378e5127b4c3..c2036fca7752aef63d260e36cfe9649f63b5c550 100644
--- a/server/src/html/garden/tests.rs
+++ b/server/src/html/garden/tests.rs
@@ -105,7 +105,7 @@ fn suggest_next_vote_pair_prefers_unvoted_sibling_pair() {
let content = content_for_garden_view(&reduced, &ScopeId::Public);
let a = ItemId::parse("~/topic/a").unwrap().normalized_storage();
let b = ItemId::parse("~/topic/b").unwrap().normalized_storage();
- let next = suggest_next_vote_pair(content, &a, &b).expect("next sibling pair");
+ let next = suggest_next_vote_pair(content, &a, &b, None).expect("next sibling pair");
assert_ne!(
canonical_edge_items(&next.0, &next.1),
canonical_edge_items(&a, &b)
diff --git a/server/src/html/garden/vote.rs b/server/src/html/garden/vote.rs
index 1d7fc8aa7436bfa9c1186dfd940a8d751ab7e088..2682cfcbd2f834b56459a02831aa225cffe67c58 100644
--- a/server/src/html/garden/vote.rs
+++ b/server/src/html/garden/vote.rs
@@ -211,14 +211,15 @@ pub(crate) async fn vote_compare_post_success_js(
_thread_tag: &str,
left: &ItemId,
right: &ItemId,
+ pool: Option<&ItemId>,
_post_id: &str,
_post_idx: Option<usize>,
) -> String {
let reduced = state.reduced.read().await;
let content = content_for_garden_view(&reduced, &nav.scope());
let edge_history = vote_edge_history_markup(content, left, right);
- let next_pair = suggest_next_vote_pair(content, left, right);
- let nav_markup = vote_compare_nav_markup(nav, next_pair.as_ref());
+ let next_pair = suggest_next_vote_pair(content, left, right, pool);
+ let nav_markup = vote_compare_nav_markup(nav, next_pair.as_ref(), pool);
drop(reduced);
JsBuilder::new()
.morph_inner_selector("#vote-edge-history-region", edge_history)
@@ -231,27 +232,39 @@ pub(super) fn vote_compare_href(
left: &ItemId,
right: &ItemId,
thread_override: Option<&str>,
+ pool: Option<&ItemId>,
) -> String {
let left_q = urlencoding::encode(left.as_str());
let right_q = urlencoding::encode(right.as_str());
- let base = format!(
+ let mut base = format!(
"{}/vote?left={}&right={}",
nav.room_path_prefix_for_vote_compare(),
left_q,
right_q
);
if let Some(t) = thread_override.filter(|s| !s.is_empty()) {
- format!("{}&thread={}", base, urlencoding::encode(t))
- } else {
- base
+ base = format!("{}&thread={}", base, urlencoding::encode(t));
+ }
+ if let Some(p) = pool {
+ base = format!("{}&pool={}", base, urlencoding::encode(p.as_str()));
}
+ base
+}
+
+pub(super) fn vote_pool_href(nav: &ThreadNav, pool_item_str: &str) -> String {
+ format!(
+ "{}/vote?pool={}",
+ nav.room_path_prefix_for_vote_compare(),
+ urlencoding::encode(pool_item_str)
+ )
}
fn vote_compare_nav_markup(
nav: &ThreadNav,
next_pair: Option<&(ItemId, ItemId)>,
+ pool: Option<&ItemId>,
) -> maud::Markup {
- let next_pair_href = next_pair.map(|(nl, nr)| vote_compare_href(nav, nl, nr, None));
+ let next_pair_href = next_pair.map(|(nl, nr)| vote_compare_href(nav, nl, nr, None, pool));
html! {
div class="vote-compare-nav" {
@if let Some(href) = &next_pair_href {
@@ -267,8 +280,15 @@ pub(super) fn suggest_next_vote_pair(
content: &ContentState,
current_left: &ItemId,
current_right: &ItemId,
+ pool_parent: Option<&ItemId>,
) -> Option<(ItemId, ItemId)> {
- let pool: Vec<ItemId> = if current_left.parent().as_ref().map(|p| p.as_str())
+ let pool: Vec<ItemId> = if let Some(parent) = pool_parent {
+ content
+ .item_children
+ .get(parent)
+ .map(|s| s.iter().cloned().collect())
+ .unwrap_or_default()
+ } else if current_left.parent().as_ref().map(|p| p.as_str())
== current_right.parent().as_ref().map(|p| p.as_str())
{
current_left
@@ -322,10 +342,14 @@ pub(super) fn vote_compare_item_card(
}
#[derive(Debug, Deserialize)]
pub struct VoteCompareQuery {
- pub left: String,
- pub right: String,
+ #[serde(default)]
+ pub left: Option<String>,
+ #[serde(default)]
+ pub right: Option<String>,
#[serde(default)]
pub thread: Option<String>,
+ #[serde(default)]
+ pub pool: Option<String>,
}
/// Public pairwise vote UI — `/vote?left=&right=&thread=`.
@@ -376,17 +400,53 @@ async fn vote_compare_inner(
jar: CookieJar,
uri: Uri,
) -> axum::response::Response {
- let left = match ItemId::parse(q.left.trim()) {
- Some(i) => i.normalized_storage(),
- None => return (StatusCode::NOT_FOUND, "bad left item").into_response(),
+ let pool_id: Option<ItemId> = match q.pool.as_deref() {
+ Some(p) => match ItemId::parse(p.trim()) {
+ Some(i) => Some(i.normalized_storage()),
+ None => return (StatusCode::BAD_REQUEST, "bad pool item").into_response(),
+ },
+ None => None,
};
- let right = match ItemId::parse(q.right.trim()) {
- Some(i) => i.normalized_storage(),
- None => return (StatusCode::NOT_FOUND, "bad right item").into_response(),
+
+ let (left, right) = match (q.left.as_deref(), q.right.as_deref()) {
+ (Some(l), Some(r)) => {
+ let left = match ItemId::parse(l.trim()) {
+ Some(i) => i.normalized_storage(),
+ None => return (StatusCode::NOT_FOUND, "bad left item").into_response(),
+ };
+ let right = match ItemId::parse(r.trim()) {
+ Some(i) => i.normalized_storage(),
+ None => return (StatusCode::NOT_FOUND, "bad right item").into_response(),
+ };
+ if left == right {
+ return (StatusCode::BAD_REQUEST, "items must differ").into_response();
+ }
+ (left, right)
+ }
+ (None, None) => {
+ let Some(pool) = pool_id.as_ref() else {
+ return (StatusCode::BAD_REQUEST, "provide left+right or pool").into_response();
+ };
+ let reduced = state.reduced.read().await;
+ let content = content_for_garden_view(&reduced, &nav.scope());
+ let children: Vec<ItemId> = content
+ .item_children
+ .get(pool)
+ .map(|s| s.iter().cloned().collect())
+ .unwrap_or_default();
+ if children.len() < 2 {
+ drop(reduced);
+ return (StatusCode::BAD_REQUEST, "pool has fewer than 2 children to compare").into_response();
+ }
+ let pair = suggest_next_pair_in_pool(&content.ranking_group, &children, None);
+ drop(reduced);
+ match pair {
+ Some(p) => p,
+ None => return (StatusCode::BAD_REQUEST, "no pairs available in pool").into_response(),
+ }
+ }
+ _ => return (StatusCode::BAD_REQUEST, "provide both left and right, or just pool").into_response(),
};
- if left == right {
- return (StatusCode::BAD_REQUEST, "items must differ").into_response();
- }
let reduced = state.reduced.read().await;
let content = content_for_garden_view(&reduced, &nav.scope());
@@ -409,7 +469,7 @@ async fn vote_compare_inner(
let left_body = content.item_bodies.get(&left).cloned();
let right_body = content.item_bodies.get(&right).cloned();
let item_bodies_for_cards = content.item_bodies.
… preview truncated; 1,501 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.