B fixes a real production bug (Reddit OAuth fallback causing hard 403 blocks from cloud IPs), adding proper retry-on-401/403 logic, better error truncation, and a config fix (SORTER2_BASE_URL), with a targeted test. A is a substantial but purely cosmetic/UX feature (theme switcher moved to a form-based cookie approach plus room-scoped URL prefixing) that adds real value but is less critical than fixing broken external API integration.
constitution · epochs · watch · epoch 3
comparison
c_3f420a1f5aa1 (tommy-mor) vs c_ca9169f732b8 (tommy-mor)
download prompt · raw event · cmp_a0e6a619ba535b
council reasoning
A delivers lasting product infrastructure: cookie-backed server-rendered themes (POST /theme, layout/auth propagation so login does not drop theme) plus private-room wire URL helpers (`item_path_for_api_in_room`, `forum_thread_web_url`) wired through RPC with tests. B is a critical but narrower production fix—force OAuth when credentials exist, AuthRejected + one refresh on 401/403, and pin SORTER2_BASE_URL—so Reddit cloud fetches stop falling back to blocked www endpoints.
Side A adds a durable cross-cutting feature by introducing server-backed theme persistence (cookie handling, POST /theme, layout integration, preserving the theme across authentication) and systematically propagating room-aware URLs through RPC responses with helper functions and tests. Side B fixes an important Reddit integration issue by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but it is a narrower subsystem-specific reliability improvement compared with A's broader architectural enhancements.
sides
A — c_3f420a1f5aa1 (tommy-mor)
message
[2fe70b0e] themes
diff preview
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index 559db65de14c6157690ffbf18eca0cf65b0a5202..b3631b06153d52f88348fef927e7a024b7b85ad6 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -1,7 +1,7 @@
use axum::{
body::Body,
extract::{Path, Query, State},
- http::{header, HeaderMap, HeaderValue, StatusCode},
+ http::{header, HeaderMap, HeaderValue, StatusCode, Uri},
response::{IntoResponse, Redirect, Response},
Form, Json,
};
@@ -17,7 +17,7 @@ use crate::{
events::{Event, GrantAdded, TokenIssued, UserRegistered},
html::{
auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment,
- choose_username_page, JsBuilder,
+ choose_username_page, theme_cookie_header_from_jar, theme_from_jar, theme_next_from_uri, JsBuilder,
},
identity::{parse_agent, parse_username},
reducer::ReducerState,
@@ -48,15 +48,17 @@ fn js_form_error_fragment(session: &str, error: &str) -> Response {
.into_response()
}
-fn js_signed_in_fragment(bearer: &str) -> Response {
+fn js_signed_in_fragment(bearer: &str, jar: &CookieJar) -> Response {
let mut response = JsBuilder::new()
.id("choose-username-form")
.morph_inner(auth_signed_in_fragment())
.redirect("/auth/complete")
.into_response();
- response
- .headers_mut()
- .insert(header::SET_COOKIE, session_cookie_header_value(bearer));
+ let headers = response.headers_mut();
+ headers.append(header::SET_COOKIE, session_cookie_header_value(bearer));
+ if let Some(theme) = theme_cookie_header_from_jar(jar) {
+ headers.append(header::SET_COOKIE, theme);
+ }
response
}
@@ -69,13 +71,18 @@ pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &Reduce
verify_token(reduced, c.value()).ok()
}
-fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str) -> Response {
- Response::builder()
+fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str, jar: &CookieJar) -> Response {
+ let mut res = Response::builder()
.status(StatusCode::TEMPORARY_REDIRECT)
.header(header::LOCATION, format!("{public_url}{path_and_query}"))
- .header(header::SET_COOKIE, session_cookie_header_value(bearer))
.body(Body::empty())
- .unwrap()
+ .unwrap();
+ let headers = res.headers_mut();
+ headers.append(header::SET_COOKIE, session_cookie_header_value(bearer));
+ if let Some(theme) = theme_cookie_header_from_jar(jar) {
+ headers.append(header::SET_COOKIE, theme);
+ }
+ res
}
async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
@@ -286,7 +293,11 @@ pub struct AuthCallbackQuery {
pub state: String,
}
-pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state): State<AppState>) -> impl IntoResponse {
+pub async fn get_auth_callback(
+ Query(q): Query<AuthCallbackQuery>,
+ State(state): State<AppState>,
+ jar: CookieJar,
+) -> impl IntoResponse {
let sessions = pending_sessions(&state);
{
let sessions_read = sessions.read().await;
@@ -365,7 +376,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
}
let cookie_bearer = bearer.clone();
s.complete = Some((username, bearer));
- return redirect_with_session_cookie(&public_url, "/", &cookie_bearer).into_response();
+ return redirect_with_session_cookie(&public_url, "/", &cookie_bearer, &jar).into_response();
}
}
@@ -378,14 +389,20 @@ pub struct ChooseUsernameQuery {
pub error: Option<String>,
}
-pub async fn get_choose_username(Query(q): Query<ChooseUsernameQuery>, State(state): State<AppState>) -> impl IntoResponse {
+pub async fn get_choose_username(
+ Query(q): Query<ChooseUsernameQuery>,
+ State(state): State<AppState>,
+ jar: CookieJar,
+ uri: Uri,
+) -> impl IntoResponse {
let sessions = pending_sessions(&state);
let sessions_read = sessions.read().await;
if !sessions_read.contains_key(&q.session) {
return api_error(StatusCode::NOT_FOUND, "unknown session", None).into_response();
}
drop(sessions_read);
- choose_username_page(&q.session, q.error.as_deref()).into_response()
+ let next = theme_next_from_uri(&uri);
+ choose_username_page(&q.session, q.error.as_deref(), theme_from_jar(&jar), &next).into_response()
}
#[derive(Debug, Deserialize)]
@@ -396,6 +413,7 @@ pub struct ChooseUsernameForm {
pub async fn post_choose_username(
State(state): State<AppState>,
+ jar: CookieJar,
Form(form): Form<ChooseUsernameForm>,
) -> impl IntoResponse {
let canon_user = match parse_username(&form.username) {
@@ -477,7 +495,7 @@ pub async fn post_choose_username(
s.complete = Some((canon_user.clone(), bearer.clone()));
}
- js_signed_in_fragment(&bearer).into_response()
+ js_signed_in_fragment(&bearer, &jar).into_response()
}
/// Start a browser-only OAuth flow (no CLI polling). Sets session cookie on success.
@@ -569,8 +587,9 @@ pub async fn get_pending_session(
.into_response()
}
-pub async fn get_auth_complete() -> impl IntoResponse {
- auth_complete_page()
+pub async fn get_auth_complete(jar: CookieJar, uri: Uri) -> impl IntoResponse {
+ let next = theme_next_from_uri(&uri);
+ auth_complete_page(theme_from_jar(&jar), &next).into_response()
}
pub async fn get_whoami(State(state): State<AppState>, headers: HeaderMap) -> impl IntoResponse {
diff --git a/server/src/api/helpers.rs b/server/src/api/helpers.rs
index 81e2a55fa3abb8609b4099f91a989480336e11eb..9b71491e9f9efc44a2a4beba09be8f64bd2ff2ee 100644
--- a/server/src/api/helpers.rs
+++ b/server/src/api/helpers.rs
@@ -39,6 +39,55 @@ pub fn item_path_for_api(item: &str) -> String {
}
}
+/// Same as [`item_path_for_api`], but for private rooms ontology items are prefixed with
+/// `/r/{short}/{slug}` so the URL matches the web app (`/r/…/~/…` routes).
+pub fn item_path_for_api_in_room(item: &str, room_wire: &str) -> String {
+ let room = room_wire.trim();
+ if room.is_empty() || room == "public" {
+ return item_path_for_api(item);
+ }
+ let Some((short, slug)) = room.split_once('/') else {
+ return item_path_for_api(item);
+ };
+ if short.is_empty() || slug.is_empty() {
+ return item_path_for_api(item);
+ }
+ let Some(c) = CanonicalItemUrl::parse(item) else {
+ return item_path_for_api(item);
+ };
+ let root = CanonicalItemUrl::ontology_root();
+ let item_norm = c.as_str().trim_end_matches('/');
+ let root_norm = root.as_str().trim_end_matches('/');
+ if let Some(tail) = c.tilde_tail() {
+ return if tail.is_empty() {
+ format!("https://slug.social/r/{short}/{slug}/~")
+ } else {
+ format!("https://slug.social/r/{short}/{slug}/~/{}", tail)
+ };
+ }
+ if item_norm == root_norm {
+ return format!("https://slug.social/r/{short}/{slug}/~");
+ }
+ item_path_for_api(item)
+}
+
+/// Absolute thread URL for forum JSON (`/t/…` vs `/r/…/t/…`).
+pub fn forum_thread_web_url(room_wire: &str, thread_tag: &str) -> String {
+ let room = room_wire.trim();
+ let tag = thread_tag.trim().trim_start_matches('#');
+ if room.is_empty() || room == "public" {
+ format!("https://slug.social/t/{tag}")
+ } else if let Some((short, slug)) = room.split_once('/') {
+ if short.is_empty() || slug.is_empty() {
+ format!("https://slug.social/t/{tag}")
+ } else {
+ format!("https://slug.social/r/{short}/{slug}/t/{tag}")
+ }
+ } else {
+ format!("https://slug.social/t/{tag}")
+ }
+}
+
/// Resolve an item path as a first-class canonical path.
pub fn resolve_item(item: &str) -> Result<String, String> {
let canonical = canonicalize_item(item);
@@ -188,3 +237,52 @@ pub fn vote_touches_path(a: &str, b: &str, parent_canon: &str) -> bool {
let under = |item: &str| item == parent_canon || item.starts_with(&format!("{}/", parent_canon));
under(a) || under(b)
}
+
+#[cfg(test)]
+mod wire_url_tests {
+ use super::{forum_thread_web_url, item_path_for_api_in_room};
+
+ #[test]
+ fn public_room_unchanged() {
+ let u = "https://slug.social/~/a/b";
+ assert_eq!(item_path_for_api_in_room(u, "public"), u);
+ }
+
+ #[test]
+ fn private_room_prefixes_ontology() {
+ assert_eq!(
+ item_path_for_api_in_room("https://slug.social/~/topic/x", "9ab12cd/my-room"),
+ "https://slug.social/r/9ab12cd/my-room/~/topic/x"
+ );
+ }
+
+ #[test]
+ fn private_room_ontology_root() {
+ assert_eq!(
+ item_path_for_api_in_room("https://slug.social/~", "9ab12cd/my-room"),
+ "https://slug.social/r/9ab12cd/my-room/~"
+ );
+ assert_eq!(
+ item_path_for_api_in_room("https://slug.social/~/", "9ab12cd/my-room"),
+ "https://slug.social/r/9ab12cd/my-room/~"
+ );
+ }
+
+ #[test]
+ fn external_url_untouched_in_private_room() {
+ let u = "https://example.com/z";
+ assert_eq!(item_path_for_api_in_room(u, "9ab12cd/my-room"), u);
+ }
+
+ #[test]
+ fn forum_web_public_vs_room() {
+ assert_eq!(
+ forum_thread_web_url("public", "debate"),
+ "https://slug.social/t/debate"
+ );
+ assert_eq!(
+ forum_thread_web_url("9ab12cd/my-room", "#debate"),
+ "https://slug.social/r/9ab12cd/my-room/t/debate"
+ );
+ }
+}
diff --git a/server/src/api/rpc.rs b/server/src/api/rpc.rs
index 31f5fcfb4eaf4df0a9cbac532dd3dedfe3611810..5b91f5836625eedbb1cd9423168046e3fb576c17 100644
--- a/server/src/api/rpc.rs
+++ b/server/src/api/rpc.rs
@@ -27,8 +27,9 @@ use crate::{
use super::auth::verify_bearer_principal;
use super::helpers::{
- compute_connectivity_stats, is_pair_voted, item_path_for_api, now_ms, paginate_rankings,
- parse_parent_specs, pick_random_distinct, resolve_item, vote_touches_path,
+ compute_connectivity_stats, forum_thread_web_url, is_pair_voted, item_path_for_api,
+ item_path_for_api_in_room, now_ms, paginate_rankings, parse_parent_specs, pick_random_distinct,
+ resolve_item, vote_touches_path,
};
use super::validate::{normalize_room_and_thread, validate_ingest_document};
@@ -148,6 +149,7 @@ fn compute_scope_rank_changes(
parent: &str,
before: &crate::scope_rank::ChildrenRankings,
after: &crate::scope_rank::ChildrenRankings,
+ room_wire: &str,
) -> Option<ScopeRankChanges> {
fn build_positions(rankings: &crate::scope_rank::ChildrenRankings) -> HashMap<String, Option<RankPosition>> {
let mut map = HashMap::new();
@@ -182,7 +184,7 @@ fn compute_scope_rank_changes(
};
if changed {
changes.push(RankChange {
- item: item_path_for_api(&item),
+ item: item_path_for_api_in_room(&item, room_wire),
before: b,
after: a,
});
@@ -204,7 +206,7 @@ fn compute_scope_rank_changes(
parent: if parent.is_empty() {
"/".to_string()
} else {
- item_path_for_api(parent)
+ item_path_for_api_in_room(parent, room_wire)
},
changes,
})
@@ -256,6 +258,7 @@ fn build_rank_response_for_content(
offset: usize,
limit: Option<usize>,
want_percent: bool,
+ room_wire: &str,
) -> Result<RankResponse, RpcErr> {
let parent_owned = parent.map(|s| s.to_string());
let specs = parse_parent_specs(parent_owned.as_ref());
@@ -299,7 +302,7 @@ fn build_rank_response_for_content(
.ranked
.into_iter()
.map(|r| RankRow {
-
… preview truncated; 42,928 characters omittedB — c_ca9169f732b8 (tommy-mor)
message
[8f69c309] Require Reddit OAuth when credentials are set and refresh on 401/403. Avoid falling back to the public www.reddit.com API from cloud IPs, which returns Reddit's network-security block page. Also pin SORTER2_BASE_URL in fly.toml. Co-authored-by: Cursor <cursoragent@cursor.com>
diff preview
diff --git a/fly.toml b/fly.toml
index f0c6a39f643c204987debc177234d95a8ef44b65..ca7e0088a7efd7d58d29d808f8d89080b2bff233 100644
--- a/fly.toml
+++ b/fly.toml
@@ -5,6 +5,7 @@ primary_region = "iad"
dockerfile = "Dockerfile"
[env]
+ SORTER2_BASE_URL = "https://reddit.sorter.social"
SORTER2_DATA_DIR = "/data"
SORTER2_EVENT_LOG = "/data/events.jsonl"
PORT = "8080"
diff --git a/server/src/reddit.rs b/server/src/reddit.rs
index a874814f8927192ee62cab2d0db1efd27dcd57b7..f409764c1e1f36216f1b08107043c2eab905694c 100644
--- a/server/src/reddit.rs
+++ b/server/src/reddit.rs
@@ -283,26 +283,35 @@ async fn reddit_worker(
);
tokio::time::sleep(current_delay).await;
- if let Some(c) = &creds {
- oauth = ensure_oauth_token(&client, &oauth_token_base, c, oauth.take()).await;
- }
-
- let token = oauth.as_ref().map(|t| t.access_token.as_str());
- let fetch_base = if token.is_some() {
- tracing::debug!(
- item = %fetch_id,
- base = %oauth_api_base,
- "reddit fetch using OAuth bearer"
- );
- &oauth_api_base
- } else {
- &api_base
- };
- let url = match kind {
- FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, fetch_base),
- FetchKind::Children => map_children_url(&fetch_id, fetch_base),
+ let outcome = match &creds {
+ Some(c) => {
+ // OAuth is required when credentials are configured — never fall
+ // back to the public www.reddit.com JSON endpoints (cloud IPs
+ // get blocked with a 403 HTML interstitial).
+ fetch_with_oauth(
+ &client,
+ &oauth_token_base,
+ &oauth_api_base,
+ c,
+ &mut oauth,
+ &fetch_id,
+ kind,
+ )
+ .await
+ }
+ None => {
+ let url = match kind {
+ FetchKind::SelfEntity => map_item_to_reddit_api(&fetch_id, &api_base),
+ FetchKind::Children => map_children_url(&fetch_id, &api_base),
+ };
+ match do_fetch(&client, &url, &fetch_id, None).await {
+ Ok(FetchOutcome::AuthRejected { status, detail }) => {
+ Err(format!("Reddit API {status}: {detail}"))
+ }
+ other => other,
+ }
+ }
};
- let outcome = do_fetch(&client, &url, &fetch_id, token).await;
match outcome {
Ok(FetchOutcome::Payload(payload)) => {
@@ -342,6 +351,12 @@ async fn reddit_worker(
current_delay = (current_delay * 2).min(Duration::from_secs(60));
notify(done, FetchJobResult::RateLimited { reset_secs });
}
+ Ok(FetchOutcome::AuthRejected { status, detail }) => {
+ let e = format!("Reddit API {status}: {detail}");
+ tracing::warn!(item = %fetch_id, err = %e, "reddit fetch auth rejected");
+ current_delay = (current_delay * 2).min(Duration::from_secs(60));
+ notify(done, FetchJobResult::Failed(e));
+ }
Err(e) => {
tracing::warn!(item = %fetch_id, err = %e, "reddit fetch failed");
current_delay = (current_delay * 2).min(Duration::from_secs(60));
@@ -357,6 +372,60 @@ enum FetchOutcome {
Payload(Value),
NotFound,
RateLimited { reset_secs: u64 },
+ /// Bearer rejected — caller should drop the cached token and retry once.
+ AuthRejected { status: StatusCode, detail: String },
+}
+
+async fn fetch_with_oauth(
+ client: &Client,
+ oauth_token_base: &str,
+ oauth_api_base: &str,
+ creds: &RedditCredentials,
+ oauth: &mut Option<OAuthToken>,
+ fetch_id: &ItemId,
+ kind: FetchKind,
+) -> Result<FetchOutcome, String> {
+ for attempt in 0..2 {
+ let force_refresh = attempt > 0;
+ *oauth = Some(
+ ensure_oauth_token(client, oauth_token_base, creds, oauth.take(), force_refresh)
+ .await?,
+ );
+ let token = oauth
+ .as_ref()
+ .expect("token set above")
+ .access_token
+ .clone();
+
+ tracing::debug!(
+ item = %fetch_id,
+ base = %oauth_api_base,
+ attempt,
+ "reddit fetch using OAuth bearer"
+ );
+
+ let url = match kind {
+ FetchKind::SelfEntity => map_item_to_reddit_api(fetch_id, oauth_api_base),
+ FetchKind::Children => map_children_url(fetch_id, oauth_api_base),
+ };
+ match do_fetch(client, &url, fetch_id, Some(&token)).await? {
+ FetchOutcome::AuthRejected { status, detail } if attempt == 0 => {
+ tracing::warn!(
+ item = %fetch_id,
+ %status,
+ %detail,
+ "reddit OAuth rejected; refreshing token and retrying"
+ );
+ *oauth = None;
+ continue;
+ }
+ FetchOutcome::AuthRejected { status, detail } => {
+ return Err(format!("Reddit API {status}: {detail}"));
+ }
+ other => return Ok(other),
+ }
+ }
+ unreachable!("loop always returns")
}
async fn ensure_oauth_token(
@@ -364,35 +433,35 @@ async fn ensure_oauth_token(
oauth_base: &str,
creds: &RedditCredentials,
existing: Option<OAuthToken>,
-) -> Option<OAuthToken> {
- if let Some(t) = existing {
- if Instant::now() < t.expires_at - Duration::from_secs(60) {
- tracing::debug!("reddit OAuth token still valid");
- return Some(t);
+ force_refresh: bool,
+) -> Result<OAuthToken, String> {
+ if !force_refresh {
+ if let Some(t) = existing {
+ if Instant::now() < t.expires_at - Duration::from_secs(60) {
+ tracing::debug!("reddit OAuth token still valid");
+ return Ok(t);
+ }
}
}
let url = format!("{}/api/v1/access_token", oauth_base.trim_end_matches('/'));
- tracing::debug!(%url, "reddit OAuth token request");
+ tracing::debug!(%url, force_refresh, "reddit OAuth token request");
let resp = client
.post(&url)
.basic_auth(&creds.client_id, Some(&creds.client_secret))
.form(&[("grant_type", "client_credentials")])
.send()
- .await;
-
- let resp = match resp {
- Ok(r) => r,
- Err(e) => {
- tracing::warn!("reddit OAuth token request failed: {e}");
- return None;
- }
- };
+ .await
+ .map_err(|e| format!("Reddit OAuth token request failed: {e}"))?;
if !resp.status().is_success() {
- tracing::warn!("reddit OAuth token HTTP {}", resp.status());
- return None;
+ let status = resp.status();
+ let body = resp.text().await.unwrap_or_default();
+ return Err(format!(
+ "Reddit OAuth token HTTP {status}: {}",
+ truncate_for_error(&body)
+ ));
}
#[derive(Deserialize)]
@@ -401,21 +470,40 @@ async fn ensure_oauth_token(
expires_in: u64,
}
- let body: TokenResponse = match resp.json().await {
- Ok(b) => b,
- Err(e) => {
- tracing::warn!("reddit OAuth token parse failed: {e}");
- return None;
- }
- };
+ let body: TokenResponse = resp
+ .json()
+ .await
+ .map_err(|e| format!("Reddit OAuth token parse failed: {e}"))?;
- tracing::debug!(expires_in = body.expires_in, "reddit OAuth token acquired");
- Some(OAuthToken {
+ tracing::info!(expires_in = body.expires_in, "reddit OAuth token acquired");
+ Ok(OAuthToken {
access_token: body.access_token,
expires_at: Instant::now() + Duration::from_secs(body.expires_in),
})
}
+fn truncate_for_error(body: &str) -> String {
+ let compact: String = body.split_whitespace().collect::<Vec<_>>().join(" ");
+ if compact.is_empty() {
+ return "(empty body)".into();
+ }
+ // Prefer the human-readable block message over dumping Reddit's CSS.
+ if let Some(idx) = compact.find("You've been blocked") {
+ let slice: String = compact.chars().skip(idx).take(160).collect();
+ return if compact.chars().count() > idx + 160 {
+ format!("{slice}…")
+ } else {
+ slice
+ };
+ }
+ let chars: String = compact.chars().take(200).collect();
+ if compact.chars().count() > 200 {
+ format!("{chars}…")
+ } else {
+ chars
+ }
+}
+
async fn do_fetch(
client: &Client,
url: &str,
@@ -460,15 +548,16 @@ async fn do_fetch(
if !status.is_success() {
let body = resp.text().await.unwrap_or_default();
+ let detail = truncate_for_error(&body);
tracing::debug!(
item = %id,
%status,
body_len = body.len(),
- body_prefix = %body.chars().take(240).collect::<String>(),
+ %detail,
"reddit non-success body"
);
if status == StatusCode::FORBIDDEN || status == StatusCode::UNAUTHORIZED {
- return Err(format!("Reddit API {status}: {body}"));
+ return Ok(FetchOutcome::AuthRejected { status, detail });
}
return Ok(FetchOutcome::NotFound);
}
@@ -716,6 +805,15 @@ fn reddit_direct_image_url(url: &str) -> bool {
mod tests {
use super::*;
+ #[test]
+ fn truncate_error_prefers_block_message() {
+ let html = r#"<style>.x{color:red}</style><div>You've been blocked by network security. To continue, log in</div>"#;
+ let msg = truncate_for_error(html);
+ assert!(msg.starts_with("You've been blocked"));
+ assert!(msg.len() < 200);
+ assert!(!msg.contains(".x{color"));
+ }
+
#[test]
fn map_subreddit_about_url() {
let id = ItemId::from_url("https://reddit.com/r/rust").unwrap();
Hardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.