Side B implements substantial, working end-to-end functionality: cookie-based web sessions, room-scoped thread navigation, a unified web posting form wired to the existing RPC layer, and access-control checks for private rooms, all integrated into the router. Side A adds a genuinely useful background Reddit-fetch worker with rate-limiting and OAuth plus tests, but it includes unrelated scratch content (a speculative 'plan2.md' chat transcript in B is noise, but A's diff is cleaner overall); still, B's changes wire up more real, load-bearing UI/auth functionality that the app will depend on going forward, despite the plan2.md clutter.
constitution · epochs · watch · epoch 3
comparison
c_c124c217f89c (tommy-mor) vs c_8c6a5e2e4a54 (tommy-mor)
download prompt · raw event · cmp_7d7223799c3ee0
council reasoning
B delivers lasting core product value by wiring browser sessions (HttpOnly slug_session cookies, /login|/logout, optional_principal), a real /post web ingest path reuse of RPC, and full private-room UI (ThreadNav scoping, /r/... room/thread/post/expand routes, grant checks, compose forms, home room list). A is a solid specialized feature (RedditBroker worker, OAuth, rate-limit/backoff, JSON parsers + tests replacing a stub) but narrower and less foundational than making multi-room forum usable in the browser; B’s plan2.md is pure noise and does not change the ranking.
Side A replaces a Reddit import placeholder with a working background fetch system: it adds a broker/worker, OAuth support, rate-limit handling, URL mapping, JSON parsing into EntityData, and integrates lazy fetching into state and page browsing. Side B delivers substantial UI wiring for browser sessions, room pages, posting, and routing, but it is primarily application interface expansion, while Side A establishes a reusable backend integration with deduplication, caching, and tests that adds enduring infrastructure.
sides
A — c_c124c217f89c (tommy-mor)
message
[8d8230d1] reddit
diff preview
diff --git a/.gitignore b/.gitignore
index 4c7073f9fac0c30fd2050d79a60ef447af58ebeb..ada462e900d24a3a6d08165d158c80f79c35a5a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
data/
repomix-output.xml
dev-data/
+.env
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 7906a8547d56b8e6a48ef59c37aa82a8510fdee9..4677fedcb45292eebebe7e9cf6ce2f5738f18ddf 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -16,6 +16,7 @@ tower = "0.5"
tower-http = { version = "0.5", features = ["trace"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+reqwest = { version = "0.12", features = ["json"] }
[dev-dependencies]
reqwest = { version = "0.12", features = ["json"] }
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 2864407ed6e8ec284a1dc663acf1805534566b62..df6505021d9f446c2b453e20e3eb3cf696a111f9 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -272,5 +272,16 @@ pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse
pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {
let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());
+ if item.as_str().starts_with("reddit.com") {
+ let needs_fetch = {
+ let tree = state.tree.read().await;
+ tree.get(&item)
+ .map(|n| n.data.is_none())
+ .unwrap_or(true)
+ };
+ if needs_fetch {
+ state.reddit.request_fetch(item.clone());
+ }
+ }
item_page(state, uri, item).await
}
diff --git a/server/src/reddit.rs b/server/src/reddit.rs
index d203dca09245daf869b3aa942898447700ae69fb..90053ad03b1d7c8e94f325dd4ee64c2b4f7da900 100644
--- a/server/src/reddit.rs
+++ b/server/src/reddit.rs
@@ -1,4 +1,12 @@
-//! Reddit API import (async, decoupled from UI request path).
+//! Reddit API import via a single background worker (rate limits, dedup, backoff).
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use reqwest::{header, Client, StatusCode};
+use serde::Deserialize;
+use tokio::sync::{mpsc, RwLock};
use crate::{
path_types::ItemId,
@@ -10,12 +18,401 @@ pub fn ensure_partial_tree(tree: &mut GlobalTree, id: &ItemId) {
tree.ensure_path(id);
}
-/// Placeholder for Reddit JSON import. Returns entity data when implemented.
-pub async fn fetch_reddit_entity(_id: &ItemId) -> Option<EntityData> {
- None
+pub struct RedditCommand {
+ pub id: ItemId,
+}
+
+#[derive(Clone)]
+pub struct RedditBroker {
+ tx: mpsc::Sender<RedditCommand>,
+}
+
+#[derive(Clone)]
+struct RedditCredentials {
+ client_id: String,
+ client_secret: String,
+}
+
+struct OAuthToken {
+ access_token: String,
+ expires_at: Instant,
+}
+
+impl RedditBroker {
+ pub fn spawn(tree: Arc<RwLock<GlobalTree>>, user_agent: &str) -> Self {
+ let (tx, rx) = mpsc::channel(100);
+
+ let mut headers = header::HeaderMap::new();
+ headers.insert(
+ header::USER_AGENT,
+ header::HeaderValue::from_str(user_agent).expect("valid user agent"),
+ );
+
+ let client = Client::builder()
+ .default_headers(headers)
+ .timeout(Duration::from_secs(15))
+ .build()
+ .expect("reqwest client");
+
+ let creds = RedditCredentials::from_env();
+ tokio::spawn(reddit_worker(rx, tree, client, creds));
+
+ Self { tx }
+ }
+
+ /// Fire-and-forget: queue a fetch; worker updates the tree when done.
+ pub fn request_fetch(&self, id: ItemId) {
+ let _ = self.tx.try_send(RedditCommand { id });
+ }
+}
+
+impl RedditCredentials {
+ fn from_env() -> Option<Self> {
+ let client_id = std::env::var("REDDIT_CLIENT_ID").ok()?;
+ let client_secret = std::env::var("REDDIT_CLIENT_SECRET").ok()?;
+ if client_id.is_empty() || client_secret.is_empty() {
+ return None;
+ }
+ Some(Self {
+ client_id,
+ client_secret,
+ })
+ }
+}
+
+pub fn default_user_agent() -> String {
+ std::env::var("REDDIT_USER_AGENT").unwrap_or_else(|_| {
+ "web:sorter2.social:v0.0.1 (by /u/sorter2)".to_string()
+ })
}
-/// Apply fetched entity data to a node (called from async worker).
-pub fn apply_entity(tree: &mut GlobalTree, id: &ItemId, data: EntityData) {
- tree.set_entity_data(id, data);
+async fn reddit_worker(
+ mut rx: mpsc::Receiver<RedditCommand>,
+ tree: Arc<RwLock<GlobalTree>>,
+ client: Client,
+ creds: Option<RedditCredentials>,
+) {
+ let mut in_flight = HashSet::new();
+ let mut recently_fetched: HashMap<ItemId, Instant> = HashMap::new();
+ let mut current_delay = Duration::from_secs(1);
+ let mut oauth: Option<OAuthToken> = None;
+ let cache_ttl = Duration::from_secs(300);
+
+ while let Some(cmd) = rx.recv().await {
+ let now = Instant::now();
+ recently_fetched.retain(|_, t| now.duration_since(*t) < cache_ttl);
+
+ if in_flight.contains(&cmd.id) || recently_fetched.contains_key(&cmd.id) {
+ continue;
+ }
+
+ in_flight.insert(cmd.id.clone());
+ let fetch_id = cmd.id.clone();
+
+ tokio::time::sleep(current_delay).await;
+
+ if let Some(c) = &creds {
+ oauth = ensure_oauth_token(&client, c, oauth.take()).await;
+ }
+
+ let token = oauth.as_ref().map(|t| t.access_token.as_str());
+ let use_oauth = token.is_some();
+
+ match do_fetch(&client, &fetch_id, use_oauth, token).await {
+ Ok(FetchOutcome::Entity(data)) => {
+ let mut w = tree.write().await;
+ w.set_entity_data(&fetch_id, data);
+ recently_fetched.insert(fetch_id.clone(), Instant::now());
+ current_delay = Duration::from_millis(600);
+ }
+ Ok(FetchOutcome::NotFound) => {
+ recently_fetched.insert(fetch_id.clone(), Instant::now());
+ }
+ Ok(FetchOutcome::RateLimited { reset_secs }) => {
+ let wait = Duration::from_secs(reset_secs.max(1));
+ tracing::warn!(
+ "Reddit rate limit for {}; sleeping {}s",
+ fetch_id,
+ wait.as_secs()
+ );
+ tokio::time::sleep(wait).await;
+ current_delay = (current_delay * 2).min(Duration::from_secs(60));
+ }
+ Err(e) => {
+ tracing::warn!("Reddit fetch failed for {}: {}", fetch_id, e);
+ current_delay = (current_delay * 2).min(Duration::from_secs(60));
+ }
+ }
+
+ in_flight.remove(&fetch_id);
+ }
+}
+
+enum FetchOutcome {
+ Entity(EntityData),
+ NotFound,
+ RateLimited { reset_secs: u64 },
+}
+
+async fn ensure_oauth_token(
+ client: &Client,
+ creds: &RedditCredentials,
+ existing: Option<OAuthToken>,
+) -> Option<OAuthToken> {
+ if let Some(t) = existing {
+ if Instant::now() < t.expires_at - Duration::from_secs(60) {
+ return Some(t);
+ }
+ }
+
+ let resp = client
+ .post("https://www.reddit.com/api/v1/access_token")
+ .basic_auth(&creds.client_id, Some(&creds.client_secret))
+ .form(&[("grant_type", "client_credentials")])
+ .send()
+ .await;
+
+ let resp = match resp {
+ Ok(r) => r,
+ Err(e) => {
+ tracing::warn!("Reddit OAuth token request failed: {e}");
+ return None;
+ }
+ };
+
+ if !resp.status().is_success() {
+ tracing::warn!("Reddit OAuth token HTTP {}", resp.status());
+ return None;
+ }
+
+ #[derive(Deserialize)]
+ struct TokenResponse {
+ access_token: String,
+ expires_in: u64,
+ }
+
+ let body: TokenResponse = match resp.json().await {
+ Ok(b) => b,
+ Err(e) => {
+ tracing::warn!("Reddit OAuth token parse failed: {e}");
+ return None;
+ }
+ };
+
+ Some(OAuthToken {
+ access_token: body.access_token,
+ expires_at: Instant::now() + Duration::from_secs(body.expires_in),
+ })
+}
+
+async fn do_fetch(
+ client: &Client,
+ id: &ItemId,
+ use_oauth: bool,
+ bearer: Option<&str>,
+) -> Result<FetchOutcome, String> {
+ let url = map_item_to_reddit_api(id, use_oauth);
+ if url.is_empty() {
+ return Ok(FetchOutcome::NotFound);
+ }
+
+ let mut req = client.get(&url);
+ if let Some(token) = bearer {
+ req = req.bearer_auth(token);
+ }
+
+ let resp = req.send().await.map_err(|e| e.to_string())?;
+
+ if resp.status() == StatusCode::TOO_MANY_REQUESTS {
+ let reset = rate_limit_reset_secs(&resp);
+ return Ok(FetchOutcome::RateLimited { reset_secs: reset });
+ }
+
+ if resp.status() == StatusCode::SERVICE_UNAVAILABLE {
+ return Err("Reddit unavailable (503)".to_string());
+ }
+
+ if !resp.status().is_success() {
+ return Ok(FetchOutcome::NotFound);
+ }
+
+ if rate_limit_remaining(&resp) == Some(0) {
+ let reset = rate_limit_reset_secs(&resp);
+ return Ok(FetchOutcome::RateLimited { reset_secs: reset });
+ }
+
+ let bytes = resp.bytes().await.map_err(|e| e.to_string())?;
+ Ok(parse_reddit_json(id, &bytes)
+ .map(FetchOutcome::Entity)
+ .unwrap_or(FetchOutcome::NotFound))
+}
+
+fn rate_limit_remaining(resp: &reqwest::Response) -> Option<u64> {
+ resp.headers()
+ .get("x-ratelimit-remaining")
+ .and_then(|v| v.to_str().ok())
+ .and_then(|s| s.parse::<f64>().ok())
+ .map(|f| f.floor() as u64)
+}
+
+fn rate_limit_reset_secs(resp: &reqwest::Response) -> u64 {
+ resp.headers()
+ .get("x-ratelimit-reset")
+ .and_then(|v| v.to_str().ok())
+ .and_then(|s| s.parse::<f64>().ok())
+ .map(|f| f.ceil() as u64)
+ .unwrap_or(5)
+}
+
+/// Map canonical item id to Reddit JSON API URL.
+pub fn map_item_to_reddit_api(id: &ItemId, oauth: bool) -> String {
+ let path = id.as_str();
+ if !path.starts_with("reddit.com/") && path != "reddit.com" {
+ return String::new();
+ }
+
+ let base = if oauth {
+ "https://oauth.reddit.com"
+ } else {
+ "https://www.reddit.com"
+ };
+
+ let segments: Vec<&str> = path.split('/').collect();
+
+ if let Some(i) = segments.iter().position(|&p| p == "comments") {
+ if segments.len() > i + 1 {
+ let api_path = segments[1..=i + 1].join("/");
+ return format!("{base}/{api_path}.json?raw_json=1");
+ }
+ }
+
+ if segments.len() == 3 && segments[1] == "r" {
+ return format!("{base}/r/{}/about.json?raw_json=1", segments[2]);
+ }
+
+ String::new()
+}
+
+fn parse_reddit_json(id: &ItemId, bytes: &[u8]) -> Option<EntityData> {
+ let v: serde_json::Value = serde_json::from_slice(bytes).ok()?;
+ let segments: Vec<&str> = id.as_str().split('/').collect();
+
+ if segments.iter().any(|&p| p == "comments") {
+ parse_post_listing(&v)
+ } else {
+ parse_subreddit_about(&v)
+ }
+}
+
+fn parse_subreddit_about(v: &serde_json::Value) -> Option<EntityData> {
+ let data = v.get("data")?;
+ let title = data
+ .get("title")
+ .or_else(|| data.get("display_name"))
+ .and_then(|t| t.as_str())?
+ .to_string();
+ let body_html = data
+ .get("public_description_html")
+ .or_else(|| data.get("public_description"))
+ .and_then(|t| t.as_str())
+ .map(|s| s.to_string());
+ let thumb_url = data
+ .get("icon_img")
+ .or_else(|| data.get("community_icon"))
+ .and_then(|t| t.as_str())
+ .filter(|s| !s.is_empty())
+ .map(|s| s.to_string());
+
+ Some(EntityData {
+ title,
+ author: None,
+ body_html,
+ thumb_url,
+ })
+}
+
+fn parse_post_listing(v:
… preview truncated; 4,570 characters omittedB — c_8c6a5e2e4a54 (tommy-mor)
message
[7caef802] room ui wired up again
diff preview
diff --git a/Cargo.lock b/Cargo.lock
index e31485f28717993a13e1c4caf7be15b43a97573e..8be6ff8677700ce0a56d4a53b221e25c2bb70507 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -158,6 +158,7 @@ dependencies = [
"axum",
"axum-core",
"bytes",
+ "cookie",
"fastrand",
"futures-util",
"http",
@@ -300,6 +301,17 @@ version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
[[package]]
name = "core-foundation"
version = "0.9.4"
diff --git a/plan2.md b/plan2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1587cbe558eb0a98fbce78566bf5f93b18100e54
--- /dev/null
+++ b/plan2.md
@@ -0,0 +1,190 @@
+This is a phenomenal synthesis. You stripped away the exact parts of `evaleval` that don't scale to a multi-tenant web application (string-splicing `eval` and in-memory nonce OCAP tracking) and kept the parts that make development lightning fast (embedded declarative payloads, single endpoint routing, and Javascript AST responses).
+
+You are entirely right about the **AST substitution in Rust**. Walking a `serde_json::Value` tree to find `{"$form": "field_name"}` and swapping the node for a String isn't a hack—in Rust, it’s just a completely standard recursive enum visitor.
+
+Let’s lock in this exact architecture. It is cohesive, secure, and incredibly ergonomic.
+
+Here is what the code actually looks like to execute this vision.
+
+---
+
+### 1. The Safe AST Substitution
+
+This is the exact function that runs in the Web handler before giving the payload to the RPC engine. Because it operates on the JSON AST *before* deserialization, it's 100% immune to injection.
+
+```rust
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Recursively walk the JSON AST and replace {"$form": "key"} with the actual form string.
+fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+ match val {
+ Value::Object(map) => {
+ // Is this the magic placeholder node? {"$form": "input_name"}
+ if map.len() == 1 && map.contains_key("$form") {
+ if let Some(field_name) = map.get("$form").and_then(|v| v.as_str()) {
+ let submitted_text = form_data.get(field_name).map(|s| s.as_str()).unwrap_or("");
+ *val = Value::String(submitted_text.to_string());
+ return;
+ }
+ }
+ // Otherwise, keep walking the object
+ for v in map.values_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ Value::Array(arr) => {
+ // Walk arrays
+ for v in arr.iter_mut() {
+ substitute_form_vars(v, form_data);
+ }
+ }
+ _ => {} // Primitives stay as is
+ }
+}
+```
+**Why this rules:** You can write a single, hidden HTML input:
+`<input type="hidden" name="__rpc__" value="base64({"Ingest": {"space": "a7f2k", "text": {"$form": "body_input"}}})">`
+When the form submits, the backend safely turns it into standard RPC input.
+
+---
+
+### 2. The Unified Core RPC Layer
+
+You keep exactly one execution layer that strictly enforces your domain constraints (ACLs). Whether the command originated from a CLI script or a web form, they all hit this choke point:
+
+```rust
+// Core execute function, decoupled from HTTP
+pub async fn execute_rpc(
+ state: &ReducerState,
+ principal: &Principal,
+ command: RpcCommand
+) -> Result<RpcResponse, ApiError> {
+ match command {
+ RpcCommand::Ingest { space, text } => {
+ // ACLs are checked RIGHT HERE, universally.
+ if !state.user_has_cap(&space, principal, ThreadCapability::Post) {
+ return Err(ApiError::Forbidden("No post access in this space".to_string()));
+ }
+ // Do the write, apply events...
+ Ok(RpcResponse::IngestOk { ... })
+ }
+ // ...
+ }
+}
+```
+
+---
+
+### 3. The `DomPatch` Builder Pattern
+
+You prefer the Builder pattern over a macro for the response mapping. I agree—builders are far easier for your IDE to autocomplete, and easier to compose dynamically (e.g., iterating over a list of items to append).
+
+```rust
+pub struct DomPatch {
+ js: String,
+}
+
+impl DomPatch {
+ pub fn new() -> Self {
+ Self { js: String::new() }
+ }
+
+ /// Morphs an element using Idiomorph
+ pub fn morph(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).expect("string escaping failed");
+ self.js.push_str(&format!(
+ "Idiomorph.morph(document.querySelector('{}'), {}, {{morphStyle: 'innerHTML'}});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Appends raw HTML to an element
+ pub fn append(mut self, selector: &str, html: &str) -> Self {
+ let safe_html = serde_json::to_string(html).unwrap();
+ self.js.push_str(&format!(
+ "document.querySelector('{}')?.insertAdjacentHTML('beforeend', {});\n",
+ selector, safe_html
+ ));
+ self
+ }
+
+ /// Executes raw javascript
+ pub fn eval(mut self, code: &str) -> Self {
+ self.js.push_str(code);
+ self.js.push('\n');
+ self
+ }
+
+ /// Consumes the builder into an HTTP Response with the right content-type
+ pub fn into_response(self) -> impl axum::response::IntoResponse {
+ (
+ axum::http::StatusCode::OK,
+ [(axum::http::header::CONTENT_TYPE, "text/javascript")],
+ self.js
+ )
+ }
+}
+```
+
+---
+
+### 4. The Single Web Handler (`POST /ui/action`)
+
+With the pipeline defined, you only ever have to write **one** `POST` handler for the entire Web UI.
+
+```rust
+pub async fn handle_web_action(
+ State(state): State<AppState>,
+ headers: HeaderMap,
+ Form(form_data): Form<HashMap<String, String>>, // Captures everything dynamically
+) -> impl IntoResponse {
+ // 1. Authenticate using Bearer / Cookie exactly like the CLI
+ let principal = match extract_web_session(&headers, &state) {
+ Ok(p) => p,
+ Err(_) => return DomPatch::new().eval("window.location = '/auth/login';").into_response(),
+ };
+
+ // 2. Decode the Base64 JSON
+ let b64 = form_data.get("__rpc__").expect("Missing RPC payload in form");
+ let decoded = base64::decode(b64).expect("Bad b64");
+ let mut json_ast: Value = serde_json::from_slice(&decoded).expect("Bad JSON");
+
+ // 3. Do AST Substitution!
+ substitute_form_vars(&mut json_ast, &form_data);
+
+ // 4. Parse it strongly into the RPC enum
+ let command: RpcCommand = serde_json::from_value(json_ast).expect("Invalid RpcCommand");
+
+ // 5. Pass it to the core execute function (authz + mutation happens here)
+ match execute_rpc(&state.reduced.read().await, &principal, command).await {
+ Ok(RpcResponse::IngestOk { new_ranks }) => {
+ // Translate the RpcResponse to UI JS snippets
+ DomPatch::new()
+ .morph("#rank-container", &render_ranking(&new_ranks))
+ .eval("document.getElementById('ingest-form').reset();")
+ .into_response()
+ }
+ Ok(_) => DomPatch::new().eval("console.log('Action complete');").into_response(),
+ Err(e) => {
+ // Reconcile errors
+ DomPatch::new()
+ .morph("#error-banner", &format!("<div class='error'>{}</div>", e.message()))
+ .into_response()
+ }
+ }
+}
+```
+
+### The Verdict on the Grand Architecture
+
+By combining:
+1. The **Domain-Driven Asymmetry** (Spaces contain Gardens & Threads)
+2. The **Core RPC Logic** (1 executor, `Vec<RpcCommand>`, strict ACL checks)
+3. The **Single Web Form Controller** (b64 embedded, `substitute_form_vars()`)
+4. The **Javascript DomPatch Builder**
+
+You have constructed an application architecture that gives you absolute security and data integrity for your CLI AI Agents, while keeping the absolute peak hackability, form simplicity, and lightning-fast JS UI diffing of your `evaleval` Python framework.
+
+I'm sold. It is clean, it is uniquely fitted to the mechanics of Rust (`serde`, `enums`), and it solves the URL routing fatigue problem beautifully. This is the exact way to build `slug.social` v2.
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index d527f86532c2856e29f9c6265e54c7235fdf0a8c..18c45777d662b71dc309e1daa4ddb2944da9759d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT"
[dependencies]
axum = { version = "0.7", features = ["macros"] }
-axum-extra = { version = "0.9", features = ["query"] }
+axum-extra = { version = "0.9", features = ["query", "cookie"] }
bytes = "1.11.1" # pin: RUSTSEC-2026-0007
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs", "io-util"] }
tokio-stream = { version = "0.1", features = ["sync"] }
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index b45ba39419c84af8bf2333fc9b7d47e98525c45f..2524a3ffcb5ea9ef6259cb9bb0bf12119bd840d2 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,9 +1,11 @@
use axum::{
+ body::Body,
extract::{Path, Query, State},
- http::{HeaderMap, StatusCode},
- response::{IntoResponse, Redirect},
+ http::{header, HeaderMap, HeaderValue, StatusCode},
+ response::{IntoResponse, Redirect, Response},
Form, Json,
};
+use axum_extra::extract::cookie::CookieJar;
use base64::Engine;
use serde::Deserialize;
use slug_types::{PendingSessionPollResponse, PendingSessionStartRequest, PendingSessionStartResponse, WhoamiResponse};
@@ -13,14 +15,47 @@ use tokio::sync::RwLock;
use crate::{
api::helpers::{api_error, now_ms, sha256_hex},
events::{Event, GrantAdded, TokenIssued, UserRegistered},
- identity::{parse_agent, parse_username},
html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
+ identity::{parse_agent, parse_username},
+ reducer::ReducerState,
state::{AppState, PendingSession},
};
/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+/// Agent id for `/login` browser OAuth (no CLI); must pass [`parse_agent`].
+const WEB_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000001:social:web/browser";
+
+/// HttpOnly cookie storing the same `slug_*` bearer string the CLI uses.
+pub const SLUG_SESSION_COOKIE: &str = "slug_session";
+
+/// `Set-Cookie` header value (full attribute string).
+pub fn session_cookie_header_value(bearer: &str) -> HeaderValue {
+ let s = format!(
+ "{SLUG_SESSION_COOKIE}={bearer}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000"
+ );
+ HeaderValue::from_str(&s).expect("session cookie value must be ASCII")
+}
+
+/// Resolve the signed-in username from `Authorization: Bearer` or `slug_session` cookie.
+pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option<String> {
+ if let Ok(u) = verify_bearer_principal(headers, reduced) {
+ return Some(u);
+ }
+ let c = jar.get(SLUG_SESSION_COOKIE)?;
+ verify_token(reduced, c.value()).ok()
+}
+
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
+ Response::builder()
+ .status(StatusCode::TEMPORARY_REDIRECT)
+ .header(header::LOCATION, format!("{public_url}{path_and_query}"))
+ .header(header::SET_COOKIE
… preview truncated; 40,705 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.