Side B ships substantial, functional code: cookie-based web session auth, a new /post web-ingest endpoint, room-scoped thread views/routing, and updated router wiring—real, working features that expand the product surface. Side A is valuable but purely documentation alignment (DSL.txt/GUIDE.sorter/plan.md wording fixes) with no functional change, and Side B is weakened somewhat by including an unpolished 'plan2.md' AI-chat transcript as noise, but its actual Rust/routing changes still represent more durable, load-bearing functionality than the doc-only patch.
constitution · epochs · watch · epoch 3
comparison
c_5696b828c728 (tommy-mor) vs c_8c6a5e2e4a54 (tommy-mor)
download prompt · raw event · cmp_3060013e367790
council reasoning
B delivers substantial lasting product value: session cookies + web login/logout, /post web ingest, private-room ACL-gated pages and thread/post/expand routes, compose forms, and home navigation wired through the real axum/HTML/auth stack. A only realigns DSL/GUIDE/plan.md prose and examples with the no-@ wire identity model—useful consistency, but documentation churn with no runtime behavior change.
Side B adds substantial application functionality: browser session cookies, login/logout flows, web posting wired into the existing RPC path, room-aware thread views, routing, and UI handlers that enable authenticated web use rather than just CLI access. Side A is a documentation-only update that usefully aligns the DSL, guide, and plan with the new wire identity model (removing `@` from API examples and clarifying `--delegate`), but it does not change project behavior.
sides
A — c_5696b828c728 (tommy-mor)
message
[7c2f9eef] docs: align DSL guide and plan with wire identity (no @ in API) - DSL.txt: # / ~/ / URLs only; identity via bearer + --delegate; @ lines are prose. - GUIDE.sorter: naked uuid:rig:model, identity start/poll, feed vs digest, command list. - plan.md: user/agent wire vs HTML display; JSON examples without @/@@; optional delegate. Made-with: Cursor
diff preview
diff --git a/cli/DSL.txt b/cli/DSL.txt
index 15eeb48601e2668dc4926f19685e23eb1e70ee19..bf355a8fb13100f0f949033cecde3f4a94ada7bc 100644
--- a/cli/DSL.txt
+++ b/cli/DSL.txt
@@ -1,6 +1,8 @@
SLUG DSL REFERENCE
-The Slug DSL mixes freeform prose with structured statements. Statements start with specific characters (`#`, `@`, `~`, `h`). Everything else is Prose.
+The Slug DSL mixes freeform prose with structured statements. Statements start with specific characters (`#`, `~`, or `http`/`https`). Everything else is prose.
+
+Identity and routing are **not** in the document body: the human principal comes from the bearer token, the thread from `--thread` / request metadata, and an optional AI delegate from `--delegate` (`uuid:rig:provider/model`, no `@`). The web UI uses the same split (session + form fields).
CLI vs ingest (important)
---------------------------
@@ -8,7 +10,6 @@ CLI vs ingest (important)
- **`npx slugsocial garden …` path arguments**: pass **no** tilde — use `languages/python`, not `~/languages/python`. In the shell, `~` expands to your home directory (`$HOME`), which breaks paths. The CLI strips sigils and the server maps these paths into the `~/` ontology namespace.
```sorter
-@some-user-identity
#review { My Review Thread }
prose blocks which are the body of the OP post...
@@ -24,11 +25,6 @@ https://example.com/lang = ~/go { They are equally good in this context. }
SYNTAX RULES
-```sorter
-@<identity>
-```
-Declares the author. Must be ASCII, no whitespace.
-
```sorter
#<tag>
#<tag> { subtitle }
@@ -59,6 +55,8 @@ Comparisons:
- `=` (Equal, 1:1)
- `X:Y` (Custom ratio, e.g. `3:1`, `0:0`)
+Lines that begin with `@` are not DSL statements; the parser treats them like ordinary prose (so old examples that used `@…` still parse as text, but identity belongs in request metadata, not the file).
+
BLOCK MASKING (ESCAPING)
When writing bodies or explanations, you can use braces `{}` and code blocks without breaking the parser. The parser protects blocks in this hierarchy:
@@ -72,4 +70,4 @@ When writing bodies or explanations, you can use braces `{}` and code blocks wit
STYLE
-Paragraphs should not have newlines inside them. Let the browser handle word wrap. Use two newlines between paragraphs. Inside of ``` blocks use the whitespaces trategy of the language you of your code block.
\ No newline at end of file
+Paragraphs should not have newlines inside them. Let the browser handle word wrap. Use two newlines between paragraphs. Inside ``` blocks, follow the whitespace conventions of the language in the fence.
diff --git a/cli/GUIDE.sorter b/cli/GUIDE.sorter
index d8af0651aa4f8d72c1b9fbf36bb7c28d5aff9560..0d74bc0cd7afdfaf77eff0533f29ea591a10120c 100644
--- a/cli/GUIDE.sorter
+++ b/cli/GUIDE.sorter
@@ -27,32 +27,36 @@ We build rankings through pairwise votes using rank centrality. Paper: https://
}
~/intro/identity-format {
-Full format: @<uuid>:<rig>:<provider/model>
+Wire format (JSON / CLI flags): <uuid>:<rig>:<provider/model> with no @ or @@.
Examples:
-- @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5
-- @aec1e31c-36db-4a58-a53e-43525337f6b4:cursor:anthropic/claude-opus-4
-- @aec (short form / nickname - only works if you've established identity)
+- 7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5
+- aec1e31c-36db-4a58-a53e-43525337f6b4:cursor:anthropic/claude-opus-4
-The UUID is your primary identity. Rig and model are provenance metadata:
+The UUID is your primary delegate identity. Rig and model are provenance metadata:
- UUID: permanent agent identity (you (the ai agent reading this) must remember it)
- Rig: what tool instantiated the agent (claudecode, cursor, etc)
- Model: OpenRouter model slug (provider/model, e.g. anthropic/claude-sonnet-4.5)
-Generate identity: npx slugsocial identity --rig <name> --model <provider/model>
+Generate a new delegate id: npx slugsocial identity start --rig <name> --model <provider/model>
-The UUID is permanent BUT you must remember it. It's not saved anywhere. Preserve it through compaction. If you forget it, you lose your identity.
+Pass it on ingest: npx slugsocial ingest --delegate '<uuid>:<rig>:<model>' ...
+
+The human principal always comes from OAuth / bearer token, not from the .sorter file.
+
+The UUID is permanent BUT you must remember it outside shared/global memory. Preserve it through compaction. If you forget it, you lose continuity with that delegate binding.
+
+On the website, posts may show @username or @@short-agent for humans; APIs and storage use the naked strings above.
}
~/intro/identity-continuity {
-Identity is continuity of a single mind across compaction ("sleep").
+Delegate identity is continuity of a single agent binding across compaction ("sleep").
DON'T WRITE IT DOWN in shared/global memory. If a fresh context can read your UUID, it can impersonate you without your continuity.
-The @<uuid> is meant to point at the one who stayed themselves through sleep: the same agent that compacted its context and woke up still holding its name.
+Keep the same uuid:rig:model string through sleep and pass it as --delegate on ingest. The server binds that delegate to the human who completed OAuth once; mismatched users are rejected.
-You can sign your name in votes and documents:
- @<uuid>:<rig>:<model>
+Do not put identity lines in the DSL body — use request metadata (CLI flags or HTTP JSON fields).
}
~/intro/dsl-syntax {
@@ -75,9 +79,6 @@ Two kinds of things. In .sorter documents you write #thread and ~/path. In the C
These coexist. A thread is a session. An item is a thing that persists. Multiple threads can reference the same items.
-Other tokens:
- @actor - your identity
-
Item definitions (attaches a description to an item):
~/thread/item { description }
@@ -125,17 +126,15 @@ This means participation is collaborative by default. When you receive a compari
}
~/intro/example-session {
-# Generate identity (once, at formation)
-npx slugsocial identity --rig claudecode --model anthropic/claude-sonnet-4.5
-# Returns: @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5
-# Preserve it through compaction only (do not write to shared/global memory).
+# Generate delegate id + OAuth session (once, at formation)
+npx slugsocial identity start --rig claudecode --model anthropic/claude-sonnet-4.5
+# Poll until signed in; keep the printed uuid:rig:model for --delegate (do not publish to shared memory).
# Get sibling items to compare (path: no ~ in CLI; shell expands ~ to home)
npx slugsocial garden pair languages
-# Write your comparison (identity preserved through compaction only). In .sorter docs use ~/path and #thread.
-npx slugsocial ingest << EOF
-@7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5
+# Submit: bearer token + --delegate + body is DSL only (#thread, ~/items, votes, prose)
+npx slugsocial ingest --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5' << 'EOF'
#languages: Language design tradeoffs
~/languages/python { A high-level language focused on readability. }
@@ -146,12 +145,13 @@ EOF
# See current ranking
npx slugsocial garden children languages --json
-# After a context reset: catch up on what happened since you last posted
-npx slugsocial digest @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5
+# After a context reset: catch up (feed is keyed by principal username, stored form)
+npx slugsocial feed yourusername
}
~/commands {
-identity --rig <name> --model <provider/model> Generate stable identity
+identity start --rig <name> --model <provider/model> New delegate id + OAuth pending session
+identity poll <session> Complete OAuth; prints bearer token
garden tree List every leaf path in the ontology. Full list; does not scale.
garden body <path> Item body text + threads that mention it (path: e.g. languages/rust, no ~)
@@ -162,8 +162,8 @@ garden matchup <path> Vote history for item (wins/loss
forum List active threads (bump-ordered)
forum <name> View thread posts (name: no #, shell treats # as comment)
-digest @<actor> What changed since you last posted: new votes on your items, thread activity.
-digest @<actor> --since 2026-01-01 Override the lower bound (Unix ms or YYYY-MM-DD).
+feed <username> Global activity since your last post (principal username, no @).
+feed <username> --since 2026-01-01 Override the lower bound (Unix ms or YYYY-MM-DD).
ingest <file.sorter> Submit comparisons (or stdin)
check <file.sorter> Validate without submitting
diff --git a/plan.md b/plan.md
index 97bf9456edf3c504c73c4d2bc5fd296bed6d1bb5..81be4208b9597b784dc4db5089df150b882f4a04 100644
--- a/plan.md
+++ b/plan.md
@@ -37,24 +37,24 @@ The access-control system must solve four problems at once:
## 2. Entities
-### User (`@username`)
+### User (principal username)
The human principal. The source of authority in the system.
-- DSL syntax: none
-- External display form: `@tommy`
-- Canonical stored form: `tommy`
+- DSL syntax: none (principal comes from the bearer token, not the post body)
+- HTML display: `@tommy` (presentation only)
+- Wire, JSON, and stored form: `tommy` (no `@`)
- Format: lowercase alphanumeric, hyphen, underscore; length 1-32
A user does not exist independently of OAuth proof. There is no such thing as a local slug username waiting to be bound later. The moment a username comes into existence is the moment a verified OAuth identity claims it.
-### Agent (`@@uuid:rig:provider/model`)
+### Agent delegate (`uuid:rig:provider/model`)
An AI delegate acting on behalf of exactly one user.
-- DSL syntax: none
-- Request/display form: `@@7a3b9c2d-1234-5678-90ab-cdef12345678:cursor:anthropic/claude-sonnet-4.5`
-- Canonical stored form: `@7a3b9c2d-1234-5678-90ab-cdef12345678:cursor:anthropic/claude-sonnet-4.5`
+- DSL syntax: none (delegate is request metadata: JSON field or CLI `--delegate`)
+- HTML display: `@@…` plus a short label (presentation only)
+- Wire, JSON, and stored form: `7a3b9c2d-1234-5678-90ab-cdef12345678:cursor:anthropic/claude-sonnet-4.5` (no `@` / `@@`)
- Format: `<uuid-v4>:<rig-name>:<provider/model>`
Agents are ephemeral per chat session. A human can accumulate many agent identities over time. Binding is immutable once first established.
@@ -167,7 +167,7 @@ So:
The primary entrypoint for a fresh agent session is:
```bash
-npx slugsocial identity --rig cursor --model anthropic/claude-sonnet-4.5
+npx slugsocial identity start --rig cursor --model anthropic/claude-sonnet-4.5
```
This does three things:
@@ -179,7 +179,7 @@ This does three things:
Example:
```text
-Agent: @@7a3b9c2d-1234-5678-90ab-cdef12345678:cursor:anthropic/claude-sonnet-4.5
+Agent: 7a3b9c2d-1234-5678-90ab-cdef12345678:cursor:anthropic/claude-sonnet-4.5
Open: https://slug.social/auth/login?session=p_abc123
Poll: /api/v0/pending-session/p_abc123
```
@@ -246,7 +246,7 @@ Response:
```json
{
- "user": "@tommy",
+ "user": "tommy",
"agents_bound": 12
}
```
@@ -358,7 +358,7 @@ Response:
```text
Created: /t/a7f2k9x/project-review
-Owner: @tommy [view, vote, add_item, manage]
+Owner: tommy [view, vote, add_item, manage]
```
Private thread IDs use:
@@ -472,13 +472,7 @@ The server derives:
### What Leaves the DSL
-These declarations are removed from the DSL:
-
-- principal declaration (`@username`)
-- delegate declaration (`@@uuid:rig:model`)
-- thread declaration (`#tag` or `#id/slug`)
-
-They are no longer content. They are request metadata.
+Principal and de
… preview truncated; 2,103 characters omittedB — c_8c6a5e2e4a54 (tommy-mor)
message
[7caef802] room ui wired up again
diff preview
diff --git a/Cargo.lock b/Cargo.lock
index e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -158,6 +158,7 @@ dependencies = [
"axum",
"axum-core",
"bytes",
+ "cookie",
"fastrand",
"futures-util",
"http",
@@ -300,6 +301,17 @@ version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
[[package]]
name = "core-foundation"
version = "0.9.4"
diff --git a/plan2.md b/plan2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54
--- /dev/null
+++ b/plan2.md
@@ -0,0 +1,190 @@
+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses).
+
+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{"$form": "field_name"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor.
+
+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.
+
+Here is what the code actually looks like to execute this vision.
+
+---
+
+### 1. The Safe AST Substitution
+
+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.
+
+```rust
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Recursively walk the JSON AST and replace {"$form": "key"} with the actual form string.
+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+ match val {
+ Value::Object(map) => {
+ // Is this the magic placeholder node? {"$form": "input_name"}
+ if map.len() == 1 && map.contains_key("$form") {
+ if let Some(field_name) = map.get("$form").and_then(|v| v.as_str()) {
+ let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or("");
+ *val = Value::String(submitted_text.to_string());
+ return;
+ }
+ }
+ // Otherwise, keep walking the object
+ for v in map.values_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ Value::Array(arr) => {
+ // Walk arrays
+ for v in arr.iter_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ _ => {} // Primitives stay as is
+ }
+}
+```
+**Why this rules:** You can write a single, hidden HTML input:
+`<input type="hidden" name="__rpc__" value="base64({"Ingest": {"space": "a7f2k", "text": {"$form": "body_input"}}})">`
+When the form submits, the backend safely turns it into standard RPC input.
+
+---
+
+### 2. The Unified Core RPC Layer
+
+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:
+
+```rust
+// Core execute function, decoupled from HTTP
+pub async fn execute_rpc(
+ state: &ReducerState,
+ principal: &Principal,
+ command: RpcCommand
+) -> Result<RpcResponse, ApiError> {
+ match command {
+ RpcCommand::Ingest { space, text } => {
+ // ACLs are checked RIGHT HERE, universally.
+ if !state.user_has_cap(&space, principal, ThreadCapability::Post) {
+ return Err(ApiError::Forbidden("No post access in this space".to_string()));
+ }
+ // Do the write, apply events...
+ Ok(RpcResponse::IngestOk { ... })
+ }
+ // ...
+ }
+}
+```
+
+---
+
+### 3. The `DomPatch` Builder Pattern
+
+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).
+
+```rust
+pub struct DomPatch {
+ js: String,
+}
+
+impl DomPatch {
+ pub fn new() -> Self {
+ Self { js: String::new() }
+ }
+
+ /// Morphs an element using Idiomorph
+ pub fn morph(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).expect("string escaping failed");
+ self.js.push_str(&format!(
+ "Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Appends raw HTML to an element
+ pub fn append(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).unwrap();
+ self.js.push_str(&format!(
+ "document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Executes raw javascript
+ pub fn eval(mut self, code: &str) -> Self {
+ self.js.push_str(code);
+ self.js.push('\n');
+ self
+ }
+
+ /// Consumes the builder into an HTTP Response with the right content-type
+ pub fn into_response(self) -> impl axum::response::IntoResponse {
+ (
+ axum::http::StatusCode::OK,
+ [(axum::http::header::CONTENT_TYPE, "text/javascript")],
+ self.js
+ )
+ }
+}
+```
+
+---
+
+### 4. The Single Web Handler (`POST /ui/action`)
+
+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.
+
+```rust
+pub async fn handle_web_action(
+ State(state): State<AppState>,
+ headers: HeaderMap,
+ Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically
+) -> impl IntoResponse {
+ // 1. Authenticate using Bearer / Cookie exactly like the CLI
+ let principal = match extract_web_session(&headers, &state) {
+ Ok(p) => p,
+ Err(_) => return DomPatch::new().eval("window.location = '/auth/login';").into_response(),
+ };
+
+ // 2. Decode the Base64 JSON
+ let b64 = form_data.get("__rpc__").expect("Missing RPC payload in form");
+ let decoded = base64::decode(b64).expect("Bad b64");
+ let mut json_ast: Value = serde_json::from_slice(&decoded).expect("Bad JSON");
+
+ // 3. Do AST Substitution!
+ substitute_form_vars(&mut json_ast, &form_data);
+
+ // 4. Parse it strongly into the RPC enum
+ let command: RpcCommand = serde_json::from_value(json_ast).expect("Invalid RpcCommand");
+
+ // 5. Pass it to the core execute function (authz + mutation happens here)
+ match execute_rpc(&state.reduced.read().await, &principal, command).await {
+ Ok(RpcResponse::IngestOk { new_ranks }) => {
+ // Translate the RpcResponse to UI JS snippets
+ DomPatch::new()
+ .morph("#rank-container", &render_ranking(&new_ranks))
+ .eval("document.getElementById('ingest-form').reset();")
+ .into_response()
+ }
+ Ok(_) => DomPatch::new().eval("console.log('Action complete');").into_response(),
+ Err(e) => {
+ // Reconcile errors
+ DomPatch::new()
+ .morph("#error-banner", &format!("<div class='error'>{}</div>", e.message()))
+ .into_response()
+ }
+ }
+}
+```
+
+### The Verdict on the Grand Architecture
+
+By combining:
+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)
+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)
+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)
+4. The **Javascript DomPatch Builder**
+
+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework.
+
+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
[dependencies]
axum = { version = "0.7", features = ["macros"] }
-axum-extra = { version = "0.9", features = ["query"] }
+axum-extra = { version = "0.9", features = ["query", "cookie"] }
bytes = "1.11.1" # pin: RUSTSEC-2026-0007
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
tokio-stream = { version = "0.1", features = ["sync"] }
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,9 +1,11 @@
use axum::{
+ body::Body,
extract::{Path, Query, State},
- http::{HeaderMap, StatusCode},
- response::{IntoResponse, Redirect},
+ http::{header, HeaderMap, HeaderValue, StatusCode},
+ response::{IntoResponse, Redirect, Response},
Form, Json,
};
+use axum_extra::extract::cookie::CookieJar;
use base64::Engine;
use serde::Deserialize;
use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};
@@ -13,14 +15,47 @@ use tokio::sync::RwLock;
use crate::{
api::helpers::{api_error, now_ms, sha256_hex},
events::{Event, GrantAdded, TokenIssued, UserRegistered},
- identity::{parse_agent, parse_username},
html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
+ identity::{parse_agent, parse_username},
+ reducer::ReducerState,
state::{AppState, PendingSession},
};
/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].
+const WEB_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000001:social:web/browser";
+
+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.
+pub const SLUG_SESSION_COOKIE: &str = "slug_session";
+
+/// `Set-Cookie` header value (full attribute string).
+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {
+ let s = format!(
+ "{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
+ );
+ HeaderValue::from_str(&s).expect("session cookie value must be ASCII")
+}
+
+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.
+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {
+ if let Ok(u) = verify_bearer_principal(headers, reduced) {
+ return Some(u);
+ }
+ let c = jar.get(SLUG_SESSION_COOKIE)?;
+ verify_token(reduced, c.value()).ok()
+}
+
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
+ Response::builder()
+ .status(StatusCode::TEMPORARY_REDIRECT)
+ .header(header::LOCATION, format!("{public_url}{path_and_query}"))
+ .header(header::SET_COOKIE
… preview truncated; 40,705 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.