You are a constitutional council ranking individual git commits for ownership allocation. Compare these two commits. Decide which contributed more lasting value to the project. Judge substance, not spectacle: - Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise. - Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one. - Do not favor a side merely because its patch is longer or noisier. - Weight what the change does for the project, not the contributor's name. Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."} The explanation must cite concrete differences in the patches (1-3 sentences). Side A — contributor: tommy-mor Side A — commit message: [8d5328d3] -theme Side A — unified diff (full patch): diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index 82b2aa51d21ada1d0d849d3ddfc3a81e4241d861..e74e42e0f0ffc4224f5ef5421b486a5f35434999 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -73,11 +73,7 @@ pub async fn post_ui_html( ensure_partial_tree(&mut tree, &item); } let _ = state.ensure_node(&item).await; - let dest = if item.is_root() { - "/".to_string() - } else { - format!("/?item={}", item.as_str()) - }; + let dest = item.browse_href(); JsBuilder::new() .raw(&format!( "window.location.href={};", diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index c973cb718ac74b95570dabea76e24459417790b9..a8353c6de0cd6d268219e552b7ca1ba4e3000585 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -1,13 +1,10 @@ use axum::{ body::Body, extract::{Path, State}, - http::{header, HeaderValue, StatusCode, Uri}, + http::{header, StatusCode, Uri}, response::{IntoResponse, Response}, - Form, }; -use axum_extra::extract::cookie::CookieJar; use maud::{html, Markup, DOCTYPE}; -use serde::Deserialize; use crate::{ form_template::template_json_compact, @@ -15,96 +12,25 @@ use crate::{ path_types::ItemId, ranking::{top_bottom, RankedItem}, reducer::{GroupState, NodeState}, - state::{parse_item_param, AppState}, + state::AppState, ui_action::UI_RPC_FIELD, }; -const THEME_DEFAULT_CSS: &str = include_str!("../../static/theme_default.css"); -const THEME_RETRO_CSS: &str = include_str!("../../static/theme_retro.css"); +const SORTER_CSS: &str = include_str!("../../static/sorter.css"); const SORTER_UI_JS: &str = include_str!("../../static/sorter_ui.js"); -pub const SORTER_THEME_COOKIE: &str = "sorter-theme"; - -pub fn normalize_theme(raw: &str) -> &'static str { - match raw { - "retro" => "retro", - _ => "default", - } -} - -pub fn theme_from_jar(jar: &CookieJar) -> &'static str { - jar.get(SORTER_THEME_COOKIE) - .map(|c| normalize_theme(c.value())) - .unwrap_or("default") -} - -pub fn theme_next_from_uri(uri: &Uri) -> String { - uri.path_and_query() - .map(|pq| pq.as_str().to_string()) - .filter(|s| !s.is_empty()) - .unwrap_or_else(|| "/".to_string()) -} - -pub fn theme_cookie_header_value(theme: &str) -> HeaderValue { - let t = normalize_theme(theme); - let s = format!("{SORTER_THEME_COOKIE}={t}; Path=/; SameSite=Lax; Max-Age=31536000"); - HeaderValue::from_str(&s).expect("theme cookie must be ASCII") -} - -fn sanitize_theme_next(next: Option<&str>) -> String { - let s = next.unwrap_or("/").trim(); - if s.starts_with('/') && !s.starts_with("//") && s.len() < 8192 { - s.to_string() - } else { - "/".to_string() - } -} - -#[derive(Debug, Deserialize)] -pub struct ThemeForm { - theme: String, - next: Option, -} - -pub async fn post_theme(Form(form): Form) -> impl IntoResponse { - let theme = normalize_theme(&form.theme); - let next = sanitize_theme_next(form.next.as_deref()); - let loc = - HeaderValue::try_from(next.as_str()).unwrap_or_else(|_| HeaderValue::from_static("/")); - Response::builder() - .status(StatusCode::SEE_OTHER) - .header(header::LOCATION, loc) - .header(header::SET_COOKIE, theme_cookie_header_value(theme)) - .body(Body::empty()) - .expect("theme redirect response") -} - pub async fn serve_static(Path(filename): Path) -> impl IntoResponse { - if filename == "sorter_ui.js" { - return Response::builder() - .status(StatusCode::OK) - .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .header(header::CACHE_CONTROL, "public, max-age=3600") - .body(SORTER_UI_JS.to_string()) - .unwrap() - .into_response(); - } - - let theme = filename - .strip_prefix("theme_") - .and_then(|s| s.strip_suffix(".css")); - - let css = match theme { - Some("default") => THEME_DEFAULT_CSS, - Some("retro") => THEME_RETRO_CSS, + let (content_type, body) = match filename.as_str() { + "sorter.css" => ("text/css; charset=utf-8", SORTER_CSS), + "sorter_ui.js" => ("text/javascript; charset=utf-8", SORTER_UI_JS), _ => return (StatusCode::NOT_FOUND, "static file not found").into_response(), }; Response::builder() .status(StatusCode::OK) - .header(header::CONTENT_TYPE, "text/css; charset=utf-8") + .header(header::CONTENT_TYPE, content_type) .header(header::CACHE_CONTROL, "public, max-age=3600") - .body(css.to_string()) + .body(body.to_string()) .unwrap() .into_response() } @@ -162,8 +88,7 @@ fn asset_version() -> &'static str { V.get_or_init(|| { use std::hash::{Hash, Hasher}; let mut h = std::collections::hash_map::DefaultHasher::new(); - THEME_DEFAULT_CSS.hash(&mut h); - THEME_RETRO_CSS.hash(&mut h); + SORTER_CSS.hash(&mut h); SORTER_UI_JS.hash(&mut h); format!("{:x}", h.finish()) }) @@ -176,9 +101,9 @@ pub fn now_ms() -> i64 { t.as_millis() as i64 } -fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str) -> Markup { +fn layout(title: &str, body: Markup, views: u64) -> Markup { let ver = asset_version(); - let css_href = format!("/static/theme_{theme}.css?v={ver}"); + let css_href = format!("/static/sorter.css?v={ver}"); let js_src = format!("/static/sorter_ui.js?v={ver}"); html! { (DOCTYPE) @@ -187,7 +112,7 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str) meta charset="utf-8"; meta name="viewport" content="width=device-width, initial-scale=1"; title { (title) } - link rel="stylesheet" href=(css_href) id="theme-stylesheet"; + link rel="stylesheet" href=(css_href); script src="https://unpkg.com/idiomorph@0.3.0/dist/idiomorph.min.js" {} } body class="home" { @@ -196,21 +121,6 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str) } div id="errors" {} (body) - div id="controls" { - a href="https://github.com/sortersocial/sorter2" id="src-link" { "src" } - form id="sorter-theme-form" method="post" action="/theme" data-navigate="full" { - input type="hidden" name="next" value=(theme_next); - select id="theme-select" name="theme" onchange="this.form.submit()" aria-label="Theme" { - @for (val, label) in [("default", "default"), ("retro", "retro")] { - @if theme == val { - option value=(val) selected { (label) } - } @else { - option value=(val) { (label) } - } - } - } - } - } script src=(js_src) {} } } @@ -218,11 +128,7 @@ fn layout(title: &str, body: Markup, views: u64, theme: &str, theme_next: &str) } fn item_href(id: &ItemId) -> String { - if id.is_root() { - "/".to_string() - } else { - format!("/?item={}", id.as_str()) - } + id.browse_href() } fn segment_label(seg: &str) -> &str { @@ -361,39 +267,10 @@ pub fn vote_panel(parent: &ItemId) -> Markup { } -fn query_param(uri: &Uri, key: &str) -> Option { - let q = uri.query()?; - q.split('&').find_map(|pair| { - let mut it = pair.splitn(2, '='); - if it.next()? == key { - Some(it.next().unwrap_or("").to_string()) - } else { - None - } - }) -} - -pub async fn home( - State(state): State, - jar: CookieJar, - uri: Uri, -) -> impl IntoResponse { +async fn item_page(state: AppState, uri: Uri, item: ItemId) -> Markup { let path = uri.path().to_string(); state.views.increment(path.clone()); let views = state.views.get_views(&path); - let theme = theme_from_jar(&jar); - let theme_next = theme_next_from_uri(&uri); - - let item_raw = query_param(&uri, "item") - .or_else(|| query_param(&uri, "sub").map(|sub| { - if sub.is_empty() { - String::new() - } else { - format!("reddit.com/r/{sub}") - } - })) - .unwrap_or_default(); - let item = parse_item_param(&item_raw); let tree = state.tree.read().await; let empty_node = NodeState::default(); @@ -408,5 +285,14 @@ pub async fn home( (vote_panel(&item)) (ranking_panel(&item, group)) }; - layout("sorter2", body, views, theme, &theme_next) + layout("sorter2", body, views) +} + +pub async fn home(State(state): State, uri: Uri) -> impl IntoResponse { + item_page(state, uri, ItemId::root()).await +} + +pub async fn browse(State(state): State, uri: Uri) -> impl IntoResponse { + let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root()); + item_page(state, uri, item).await } diff --git a/server/src/lib.rs b/server/src/lib.rs index 14e7cfbc38feb5d07aff859b64bce6e2ec45cf91..cd56743192919cf4dcea539b3d8873a21fb7e72b 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -30,9 +30,9 @@ pub fn create_app(state: AppState) -> Router { Router::new() .route("/healthz", get(|| async { "ok" })) .route("/static/:filename", get(crate::html::serve_static)) + .route("/~/*item_path", get(crate::html::browse)) .route("/", get(crate::html::home)) .route("/ui", post(crate::api::ui_html::post_ui_html)) - .route("/theme", post(crate::html::post_theme)) .with_state(state) .layer(TraceLayer::new_for_http()) } diff --git a/server/src/path_types.rs b/server/src/path_types.rs index b5c41444f7bcd4d8d289ed3af464bc3f14d0df99..12dce9888f5cd4e1a0974d12d6468368d0f775b9 100644 --- a/server/src/path_types.rs +++ b/server/src/path_types.rs @@ -90,6 +90,50 @@ impl ItemId { paths } + /// Full URL for the browser location bar after `/~/`. + pub fn to_browse_url(&self) -> String { + if self.is_root() { + return String::new(); + } + if self.as_str().contains("://") { + return self.as_str().to_string(); + } + if self + .segments() + .first() + .is_some_and(|s| s.contains('.')) + { + format!("https://{}", self.as_str()) + } else { + self.as_str().to_string() + } + } + + /// App route, e.g. `/~/https://reddit.com/r/rust`. + pub fn browse_href(&self) -> String { + if self.is_root() { + "/".to_string() + } else { + format!("/~/{}", self.to_browse_url()) + } + } + + /// Parse the tail after `/~/` in a request path. + pub fn from_browse_tail(tail: &str) -> ItemId { + let raw = normalize_browse_tail(tail); + if raw.is_empty() { + return ItemId::root(); + } + ItemId::from_url(&raw) + .or_else(|| ItemId::parse(&raw)) + .unwrap_or_else(|| ItemId::opaque(raw)) + } + + pub fn from_browse_uri(path: &str) -> Option { + path.strip_prefix("/~/") + .map(ItemId::from_browse_tail) + } + fn canonicalize(raw: &str) -> Option { let s = raw.trim(); if s.is_empty() { @@ -155,6 +199,21 @@ fn normalize_host(host: &str) -> String { } } +fn normalize_browse_tail(tail: &str) -> String { + let t = tail.trim(); + if t.is_empty() { + return String::new(); + } + // Some HTTP stacks collapse `https://` → `https:/` inside a path segment. + if t.starts_with("https:/") && !t.starts_with("https://") { + return format!("https://{}", &t[7..]); + } + if t.starts_with("http:/") && !t.starts_with("http://") { + return format!("http://{}", &t[6..]); + } + t.to_string() +} + fn normalize_reddit_host_path(s: &str) -> String { let (host, path) = s.split_once('/').unwrap_or((s, "")); let host = normalize_host(host); @@ -252,4 +311,22 @@ mod tests { ); assert!(ItemId::from_legacy_scope("").is_root()); } + + #[test] + fn browse_href_wraps_canonical_path() { + let id = ItemId::parse("reddit.com/r/rust").unwrap(); + assert_eq!(id.browse_href(), "/~/https://reddit.com/r/rust"); + } + + #[test] + fn from_browse_tail_parses_full_url() { + let id = ItemId::from_browse_tail("https://reddit.com/r/AmITheAsshole"); + assert_eq!(id.as_str(), "reddit.com/r/amitheasshole"); + } + + #[test] + fn from_browse_uri_strips_prefix() { + let id = ItemId::from_browse_uri("/~/https://reddit.com/r/rust").unwrap(); + assert_eq!(id.as_str(), "reddit.com/r/rust"); + } } diff --git a/server/static/sorter_ui.js b/server/static/sorter_ui.js index 9c475d8e076ba527aaf7a25c177d0d651bd46ca9..d9b016f197547f37ca4b2bcdd7ee6b673d0fb3f0 100644 --- a/server/static/sorter_ui.js +++ b/server/static/sorter_ui.js @@ -24,7 +24,6 @@ var f = e.target; if (!f || f.tagName !== 'FORM') return; if ((f.method || 'get').toLowerCase() !== 'post') return; - if (f.id === 'sorter-theme-form') return; if (f.getAttribute('data-navigate') === 'full') return; e.preventDefault(); await postUiForm(f); diff --git a/server/static/theme_default.css b/server/static/theme_default.css deleted file mode 100644 index 1bf8ac7a25207336c019f93cd4119bd0e06229f0..0000000000000000000000000000000000000000 --- a/server/static/theme_default.css +++ /dev/null @@ -1,186 +0,0 @@ -:root { - --bg: #0f1115; - --fg: #e8eaed; - --muted: #9aa0a6; - --accent: #7cacf8; - --panel: #1a1d24; - --border: #2a2f3a; -} - -* { - box-sizing: border-box; -} - -body { - margin: 0; - font-family: system-ui, -apple-system, sans-serif; - background: var(--bg); - color: var(--fg); - line-height: 1.5; -} - -.muted { - color: var(--muted); -} - -.small { - font-size: 0.875rem; -} - -.view-meta { - position: fixed; - top: 0.5rem; - right: 0.5rem; - font-size: 0.75rem; -} - -#controls { - position: fixed; - bottom: 0; - left: 0; - right: 0; - display: flex; - gap: 1rem; - align-items: center; - padding: 0.75rem 1rem; - background: var(--panel); - border-top: 1px solid var(--border); - font-size: 0.875rem; -} - -#controls a { - color: var(--accent); -} - -.demo-panel { - max-width: 40rem; - margin: 4rem auto 6rem; - padding: 2rem; - background: var(--panel); - border: 1px solid var(--border); - border-radius: 8px; -} - -.demo-panel h1 { - margin-top: 0; -} - -.btn-primary { - background: var(--accent); - color: #0f1115; - border: none; - padding: 0.5rem 1rem; - border-radius: 4px; - font-size: 1rem; - cursor: pointer; -} - -.btn-primary:hover { - filter: brightness(1.1); -} - -code { - font-size: 0.85em; - background: var(--bg); - padding: 0.1em 0.35em; - border-radius: 3px; -} - -.vote-fields { - display: flex; - flex-direction: column; - gap: 0.75rem; - margin-bottom: 1rem; -} - -.vote-fields label { - display: flex; - flex-direction: column; - gap: 0.25rem; -} - -.vote-fields input { - padding: 0.4rem 0.5rem; - border: 1px solid var(--border); - border-radius: 4px; - background: var(--bg); - color: var(--fg); -} - -.rank-list { - margin: 0; - padding-left: 0; - list-style: none; -} - -.rank-list li { - margin-bottom: 0.35rem; -} - -.rank-num { - color: var(--muted); -} - -#parser-input { - width: 100%; - padding: 0.5rem; - border: 1px solid var(--border); - border-radius: 4px; - background: var(--bg); - color: var(--fg); - font-size: 1rem; - font-family: inherit; - resize: vertical; -} - -#parser-form .btn-primary { - margin-top: 0.5rem; -} - -.breadcrumbs { - font-size: 0.875rem; - margin-bottom: 1rem; - color: var(--muted); -} - -.breadcrumbs a { - color: var(--accent); - text-decoration: none; -} - -.breadcrumbs a:hover { - text-decoration: underline; -} - -.breadcrumbs .separator { - color: var(--muted); -} - -.rank-list a { - color: var(--accent); - text-decoration: none; -} - -.rank-list a:hover { - text-decoration: underline; -} - -.entity-card h2 { - margin-top: 0; -} - -.scope-name { - color: var(--accent); - font-weight: 600; -} - -.rank-heading { - margin: 0.75rem 0 0.25rem; - text-transform: uppercase; - letter-spacing: 0.04em; -} - -.rank-gap { - text-align: center; - margin: 0.25rem 0; -} diff --git a/server/static/theme_retro.css b/server/static/theme_retro.css deleted file mode 100644 index ceee99494b873a6e658857be97f02ee739db85e9..0000000000000000000000000000000000000000 --- a/server/static/theme_retro.css +++ /dev/null @@ -1,5 +0,0 @@ -@import url("/static/theme_default.css"); - -:root { - --accent: #f4a261; -} diff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs index f7ac9c26bf9f9277ad5f5708603224c095165fb8..df7d9ab357531c5146d0b326c149fdaa6b531a4a 100644 --- a/server/tests/integration_ui.rs +++ b/server/tests/integration_ui.rs @@ -70,6 +70,22 @@ async fn post_ui_record_vote_morphs_ranking_and_persists() { assert_eq!(ranked[0].item.as_str(), "alpha"); } +#[tokio::test] +async fn browse_url_renders_subreddit_page() { + let (addr, _tmp) = start_test_server().await; + let client = reqwest::Client::new(); + let html = client + .get(format!("http://{addr}/~/https://reddit.com/r/rust")) + .send() + .await + .unwrap() + .text() + .await + .unwrap(); + assert!(html.contains("ranking-panel")); + assert!(html.contains("/~/https://reddit.com/r/rust")); +} + #[tokio::test] async fn post_ui_parse_query_redirects_to_subreddit() { let (addr, _tmp) = start_test_server().await; @@ -93,5 +109,5 @@ async fn post_ui_parse_query_redirects_to_subreddit() { .unwrap(); assert!(body.contains("window.location.href")); - assert!(body.contains("/?item=reddit.com/r/rust")); + assert!(body.contains("/~/https://reddit.com/r/rust")); } Side B — contributor: tommy-mor Side B — commit message: [c3cbcaa7] refactor Side B — unified diff (full patch): diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs index b3631b06153d52f88348fef927e7a024b7b85ad6..cd556eb89e9dd8203eba6c8969ffd144db5d329d 100644 --- a/server/src/api/auth.rs +++ b/server/src/api/auth.rs @@ -71,6 +71,24 @@ pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &Reduce verify_token(reduced, c.value()).ok() } +/// Browser session: principal + bearer token string (same shape as CLI session cookie). +#[derive(Debug, Clone)] +pub struct WebSession { + pub username: String, + pub bearer: String, +} + +/// Resolve username and bearer together for `POST /ui` dispatch (one read of headers + jar). +pub fn resolve_web_session(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option { + let username = optional_principal(headers, jar, reduced)?; + let bearer = headers + .get(header::AUTHORIZATION) + .and_then(|v| v.to_str().ok()) + .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) + .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()))?; + Some(WebSession { username, bearer }) +} + fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str, jar: &CookieJar) -> Response { let mut res = Response::builder() .status(StatusCode::TEMPORARY_REDIRECT) diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs index a986f706ea4b261cbaf004c02b4cf84184b41371..4e223a7460997c464706dca850281447bd754ed5 100644 --- a/server/src/api/mod.rs +++ b/server/src/api/mod.rs @@ -4,7 +4,6 @@ mod rpc; mod stream; mod validate; mod ui_html; -mod web_post; pub use auth::{ get_join_invite, @@ -19,7 +18,9 @@ pub use auth::{ get_web_login, get_logout, optional_principal, + resolve_web_session, session_cookie_header_value, + WebSession, SLUG_SESSION_COOKIE, }; @@ -35,7 +36,6 @@ pub use stream::{get_html_stream, get_stream}; pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest}; pub use ui_html::post_ui_html; -pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact}; #[cfg(test)] mod tests { diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index 2b40a72059981d558768f73d189b991f3448c257..497f8fdd222a8ec7c3d76b0695e0352e973ca3ba 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -1,25 +1,29 @@ -//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes). +//! Single `POST /ui` entry: parse `__rpc__` → [`HtmlUiAction`], resolve [`WebSession`] once, dispatch. use axum::{ - body::Body, + body, extract::State, - http::{header, HeaderMap, StatusCode}, + http::{header, HeaderMap, HeaderValue, StatusCode}, response::{IntoResponse, Response}, Form, }; use axum_extra::extract::cookie::CookieJar; +use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; use std::collections::HashMap; use crate::{ api::{ - auth::optional_principal, - web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm}, + auth::{resolve_web_session, WebSession}, + handle_rpc_batch, + rpc::{rpc_post_redact, rpc_post_with_bearer}, }, + canonical_path::canonicalize_tag, html::{ fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup, - parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, - ThreadNav, + parse_html_ui_from_form, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, + user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav, }, + reducer::{scope_from_room_wire, ScopeId}, state::AppState, }; @@ -34,6 +38,19 @@ pub async fn post_ui_html( Err(e) => return ui_js_warn(&e.to_string()).into_response(), }; + let reduced = state.reduced.read().await; + let session = resolve_web_session(&headers, &jar, &reduced); + drop(reduced); + + dispatch_ui_action(&state, session.as_ref(), action).await +} + +/// All UI command logic: HTTP extractors stop above; this only sees [`AppState`], session, and [`HtmlUiAction`]. +async fn dispatch_ui_action( + state: &AppState, + session: Option<&WebSession>, + action: HtmlUiAction, +) -> Response { match action { HtmlUiAction::PostIngest { room, @@ -42,47 +59,87 @@ pub async fn post_ui_html( error_target, form_id, } => { - run_post_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = thread_tag.trim().to_string(); + if text.trim().is_empty() { + return form_js_error( + error_target.as_ref(), + "empty post", + "Write something in the text area (DSL / prose).", + ) + .into_response(); + } + match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await { + Ok(RpcResult::PostOk { .. }) => { + post_success_response( + state, + &room, + &thread_tag, + error_target.as_ref(), + form_id.as_ref(), + Some(session.username.as_str()), + ) + .await + .into_response() + } + Ok(_) => form_js_error( + error_target.as_ref(), + "unexpected response", + "Post did not return PostOk.", + ) + .into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::CheckIngest { room, thread_tag, text, error_target, - form_id, + form_id: _, } => { - run_check_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(&thread_tag); + if thread_tag.is_empty() { + return form_js_error( + error_target.as_ref(), + "missing thread tag", + "Set a thread tag before posting.", + ) + .into_response(); + } + if text.trim().is_empty() { + return js_clear_errors(&form_error_target(error_target.as_ref())).into_response(); + } + match rpc_check_with_bearer(state, &session.bearer, room, text.clone()).await { + Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(error_target.as_ref())).into_response(), + Ok(_) => form_js_error(error_target.as_ref(), "unexpected response", "Check did not return CheckOk.").into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::RedactPost { post_id } => { - run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let h = headers_from_bearer(&session.bearer); + match rpc_post_redact(state, &h, post_id).await { + Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), + Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), + Err((msg, hint)) => { + let detail = hint.as_deref().unwrap_or(""); + js_error("#errors", &msg, detail).into_response() + } + } } HtmlUiAction::ExpandPublicNewThreadForm => { let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); drop(reduced); let markup = if user.is_some() { fragment_public_new_thread_form(true) @@ -99,18 +156,18 @@ pub async fn post_ui_html( return ui_js_warn("missing room").into_response(); } let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); if !reduced.rooms.contains(&room_wire) { drop(reduced); return ui_js_warn("room not found").into_response(); } - if !user_can_view_room(&reduced, &room_wire, user.as_deref()) { + if !user_can_view_room(&reduced, &room_wire, user) { drop(reduced); return ui_js_warn("forbidden").into_response(); } - let can_post = user + let can_post = session .as_ref() - .map(|u| user_can_post_room(&reduced, &room_wire, u)) + .map(|s| user_can_post_room(&reduced, &room_wire, &s.username)) .unwrap_or(false); drop(reduced); let Some(nav) = ThreadNav::from_room_id(&room_wire) else { @@ -128,12 +185,195 @@ pub async fn post_ui_html( } } +fn headers_from_bearer(bearer: &str) -> HeaderMap { + let mut headers = HeaderMap::new(); + if let Ok(hv) = HeaderValue::from_str(&format!("Bearer {bearer}")) { + headers.insert(header::AUTHORIZATION, hv); + } + headers +} + +fn post_redirect_location(room: &str, thread_tag: &str) -> String { + let tag = canonicalize_tag(thread_tag); + if room.trim() == "public" { + format!("/t/{tag}") + } else { + let room = room.trim(); + let Some((a, b)) = room.split_once('/') else { + return "/".to_string(); + }; + format!("/r/{a}/{b}/t/{tag}") + } +} + +fn js_quote(s: &str) -> String { + serde_json::to_string(s).expect("js string escaping must succeed") +} + +fn js_redirect(to: &str) -> Response { + let js = format!("window.location = {};", js_quote(to)); + Response::builder() + .status(StatusCode::OK) + .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") + .body(axum::body::Body::from(js)) + .unwrap() +} + +fn js_error(error_target: &str, title: &str, detail: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) { + p class="auth-error" { (title) } + @if !detail.is_empty() { + pre class="muted" { (detail) } + } + } + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn form_error_target(error_target: Option<&String>) -> String { + error_target + .map(|s| s.as_str()) + .filter(|s| !s.trim().is_empty()) + .map(|s| { + if s.starts_with('#') { + s.to_string() + } else { + format!("#{s}") + } + }) + .unwrap_or_else(|| "#errors".to_string()) +} + +fn form_js_error(error_target: Option<&String>, title: &str, detail: &str) -> Response { + js_error(&form_error_target(error_target), title, detail) +} + +fn js_clear_errors(error_target: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) {} + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn empty_error_markup(error_target: &str) -> maud::Markup { + maud::html! { + div id=(error_target.trim_start_matches('#')) {} + } +} + +async fn rpc_check_with_bearer( + state: &AppState, + bearer_token: &str, + room: String, + text: String, +) -> Result)> { + let mut headers = HeaderMap::new(); + let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) + .map_err(|_| ("invalid session token".into(), None))?; + headers.insert(header::AUTHORIZATION, hv); + + let response = handle_rpc_batch( + State(state.clone()), + headers, + axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), + ) + .await + .into_response(); + + let status = response.status(); + if !status.is_success() { + return Err((format!("rpc check http {}", status), None)); + } + + let body = body::to_bytes(response.into_body(), usize::MAX) + .await + .map_err(|e| (e.to_string(), None))?; + let parsed: RpcBatchResponse = + serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; + let line = parsed + .results + .into_iter() + .next() + .ok_or_else(|| ("empty rpc check response".to_string(), None))?; + if line.ok { + line.result + .ok_or_else(|| ("missing rpc check result".to_string(), None)) + } else { + Err(( + line.error.unwrap_or_else(|| "check failed".to_string()), + line.hint, + )) + } +} + +async fn post_success_response( + state: &AppState, + room: &str, + thread_tag: &str, + error_target: Option<&String>, + form_id: Option<&String>, + viewer: Option<&str>, +) -> Response { + let error_target = form_error_target(error_target); + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(thread_tag); + let thread_location = post_redirect_location(&room, &thread_tag); + let form_id = form_id.map(|s| s.as_str()).unwrap_or(""); + let scope = scope_from_room_wire(&room); + let feed_markup = match &scope { + ScopeId::Public => thread_feed_html(state).await, + ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, + }; + let thread_markup = thread_feed_region_markup( + state, + match &scope { + ScopeId::Public => None, + ScopeId::Room(_) => Some(room.as_str()), + }, + &thread_tag, + viewer.as_deref(), + ) + .await; + let feed_selector = match &scope { + ScopeId::Public => "#thread-feed", + ScopeId::Room(_) => "#room-thread-feed", + }; + + let builder = JsBuilder::new() + .morph_selector(&error_target, empty_error_markup(&error_target)) + .morph_selector(feed_selector, feed_markup) + .if_current_path_matches(&thread_location, |builder| { + let builder = builder.morph_selector("#thread-feed-region", thread_markup); + let builder = if !form_id.trim().is_empty() { + builder.qs(&format!("#{form_id}")).reset() + } else { + builder + }; + builder + }) + .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); + + builder.into_response() +} + +async fn redact_success_response(state: &AppState) -> Response { + let feed_markup = thread_feed_html(state).await; + JsBuilder::new() + .morph_selector("#thread-feed", feed_markup) + .into_response() +} + fn ui_js_warn(msg: &str) -> Response { use crate::html::js_string_literal; let js = format!("console.warn({});", js_string_literal(msg)); Response::builder() .status(StatusCode::OK) .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(Body::from(js)) + .body(axum::body::Body::from(js)) .unwrap() } diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs deleted file mode 100644 index 265025f41ff1548d05b2d2d5d84202245388053f..0000000000000000000000000000000000000000 --- a/server/src/api/web_post.rs +++ /dev/null @@ -1,362 +0,0 @@ -use axum::{ - body, - extract::State, - http::{header, HeaderMap, HeaderValue, StatusCode}, - response::{IntoResponse, Response}, - Form, -}; -use axum_extra::extract::cookie::CookieJar; -use serde::Deserialize; -use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; - -use crate::{ - api::{ - auth::{optional_principal, SLUG_SESSION_COOKIE}, - handle_rpc_batch, - rpc::{rpc_post_redact, rpc_post_with_bearer}, - }, - canonical_path::canonicalize_tag, - html::{thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, JsBuilder}, - reducer::{scope_from_room_wire, ScopeId}, - state::AppState, -}; - -#[derive(Debug, Deserialize)] -pub struct WebPostForm { - pub room: String, - pub thread_tag: String, - pub text: String, - #[serde(default)] - pub error_target: Option, - #[serde(default)] - pub form_id: Option, -} - -#[derive(Debug, Deserialize)] -pub struct WebRedactForm { - pub post_id: String, -} - -fn post_redirect_location(room: &str, thread_tag: &str) -> String { - let tag = canonicalize_tag(thread_tag); - if room.trim() == "public" { - format!("/t/{tag}") - } else { - let room = room.trim(); - let Some((a, b)) = room.split_once('/') else { - return "/".to_string(); - }; - format!("/r/{a}/{b}/t/{tag}") - } -} - -fn js_quote(s: &str) -> String { - serde_json::to_string(s).expect("js string escaping must succeed") -} - -fn js_redirect(to: &str) -> Response { - let js = format!("window.location = {};", js_quote(to)); - Response::builder() - .status(StatusCode::OK) - .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(axum::body::Body::from(js)) - .unwrap() -} - -fn js_error(error_target: &str, title: &str, detail: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) { - p class="auth-error" { (title) } - @if !detail.is_empty() { - pre class="muted" { (detail) } - } - } - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn form_error_target(form: &WebPostForm) -> String { - form.error_target - .as_deref() - .filter(|s| !s.trim().is_empty()) - .map(|s| { - if s.starts_with('#') { - s.to_string() - } else { - format!("#{s}") - } - }) - .unwrap_or_else(|| "#errors".to_string()) -} - -fn form_js_error(form: &WebPostForm, title: &str, detail: &str) -> Response { - js_error(&form_error_target(form), title, detail) -} - -fn js_clear_errors(error_target: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) {} - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn empty_error_markup(error_target: &str) -> maud::Markup { - maud::html! { - div id=(error_target.trim_start_matches('#')) {} - } -} - -async fn rpc_check_with_bearer( - state: &AppState, - bearer_token: &str, - room: String, - text: String, -) -> Result)> { - let mut headers = HeaderMap::new(); - let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) - .map_err(|_| ("invalid session token".into(), None))?; - headers.insert(header::AUTHORIZATION, hv); - - let response = handle_rpc_batch( - State(state.clone()), - headers, - axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), - ) - .await - .into_response(); - - let status = response.status(); - if !status.is_success() { - return Err((format!("rpc check http {}", status), None)); - } - - let body = body::to_bytes(response.into_body(), usize::MAX) - .await - .map_err(|e| (e.to_string(), None))?; - let parsed: RpcBatchResponse = - serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; - let line = parsed - .results - .into_iter() - .next() - .ok_or_else(|| ("empty rpc check response".to_string(), None))?; - if line.ok { - line.result - .ok_or_else(|| ("missing rpc check result".to_string(), None)) - } else { - Err(( - line.error.unwrap_or_else(|| "check failed".to_string()), - line.hint, - )) - } -} - -fn post_success_response<'a>( - state: &'a AppState, - form: &'a WebPostForm, - headers: &'a HeaderMap, - jar: &'a CookieJar, -) -> impl std::future::Future + 'a { - async move { - let error_target = form_error_target(form); - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - let thread_location = post_redirect_location(&room, &thread_tag); - let form_id = form.form_id.as_deref().unwrap_or_default(); - let scope = scope_from_room_wire(&room); - let viewer = { - let reduced = state.reduced.read().await; - optional_principal(headers, jar, &reduced) - }; - let feed_markup = match &scope { - ScopeId::Public => thread_feed_html(state).await, - ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, - }; - let thread_markup = thread_feed_region_markup( - state, - match &scope { - ScopeId::Public => None, - ScopeId::Room(_) => Some(room.as_str()), - }, - &thread_tag, - viewer.as_deref(), - ) - .await; - let feed_selector = match &scope { - ScopeId::Public => "#thread-feed", - ScopeId::Room(_) => "#room-thread-feed", - }; - - let builder = JsBuilder::new() - .morph_selector(&error_target, empty_error_markup(&error_target)) - .morph_selector(feed_selector, feed_markup) - .if_current_path_matches(&thread_location, |builder| { - let builder = builder.morph_selector("#thread-feed-region", thread_markup); - let builder = if !form_id.trim().is_empty() { - builder.qs(&format!("#{form_id}")).reset() - } else { - builder - }; - builder - }) - .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); - - builder.into_response() - } -} - -async fn redact_success_response(state: &AppState) -> Response { - let feed_markup = thread_feed_html(state).await; - JsBuilder::new() - .morph_selector("#thread-feed", feed_markup) - .into_response() -} - -pub async fn post_web_redact( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_redact(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`]. -pub(crate) async fn run_post_web_redact( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebRedactForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - drop(reduced); - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - let Some(_bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - match rpc_post_redact(state, headers, form.post_id).await { - Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), - Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), - Err((msg, hint)) => { - let detail = hint.as_deref().unwrap_or(""); - js_error("#errors", &msg, detail).into_response() - } - } -} - -pub async fn post_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_post_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = form.thread_tag.trim().to_string(); - let text = form.text.clone(); - - if text.trim().is_empty() { - return form_js_error(&form, "empty post", "Write something in the text area (DSL / prose).") - .into_response(); - } - - match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await { - Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar) - .await - .into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} - -pub async fn check_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_check_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_check_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - if thread_tag.is_empty() { - return form_js_error(&form, "missing thread tag", "Set a thread tag before posting.").into_response(); - } - - if form.text.trim().is_empty() { - return js_clear_errors(&form_error_target(&form)).into_response(); - } - - match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await { - Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs index b1c037f3dd93c7bb96d6624cab6019228432c501..a173e7aea7a81c7cfab5f2f6a5549e0db560fb2b 100644 --- a/server/src/html/forum.rs +++ b/server/src/html/forum.rs @@ -17,6 +17,7 @@ use crate::{ state::AppState, timeago, }; +use serde_json::json; use super::ui_action::{HtmlUiAction, UI_RPC_FIELD}; @@ -182,8 +183,8 @@ fn post_header_row( div class="ingest-header-row" { (meta) @if show_delete { - form class="post-delete-form" method="POST" action="/post/redact" { - input type="hidden" name="post_id" value=(ing.id); + form class="post-delete-form" method="POST" action="/ui" { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::RedactPost { post_id: ing.id.clone() }).unwrap()); button type="submit" class="post-delete-btn" { "delete" } } } @@ -427,13 +428,28 @@ fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup { if !show { return html! {}; } + let rpc_post = template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); + let rpc_check = template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); html! { section class="compose" id="thread-compose" { - form id="thread-compose-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="thread_tag" value=(thread_tag); - input type="hidden" name="error_target" value="thread-compose-errors"; - input type="hidden" name="form_id" value="thread-compose-form"; + form id="thread-compose-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(rpc_check) { + input type="hidden" name=(UI_RPC_FIELD) value=(rpc_post); textarea name="text" rows="5" cols="80" placeholder="prose or ~/items and votes…" {} p { button type="submit" { "post" } @@ -463,10 +479,22 @@ fn new_thread_form_public(show: bool) -> Markup { h3 { "new public thread" } p class="muted" { "Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL." } div id="public-new-thread-errors" {} - form id="public-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value="public"; - input type="hidden" name="error_target" value="public-new-thread-errors"; - input type="hidden" name="form_id" value="public-new-thread-form"; + form id="public-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()); label for="new-thread-tag" { "thread tag" } input type="text" id="new-thread-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" placeholder="my-topic"; label for="new-thread-text" { "text" } @@ -946,10 +974,22 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup { section class="compose" id="room-new-thread-compose" hidden { h3 { "new thread in this room" } div id="room-new-thread-errors" {} - form id="room-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="error_target" value="room-new-thread-errors"; - input type="hidden" name="form_id" value="room-new-thread-form"; + form id="room-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()); label for="room-new-tag" { "thread tag" } input type="text" id="room-new-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" required; textarea name="text" rows="4" placeholder="First post body…" required {} diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index a4fd2dd60ac283f7eb9b2e64522501b21d1e27e9..63f723804be511af80b5c13e792109754b606fce 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -373,9 +373,14 @@ script { (maud::PreEscaped(r#" async function runFormCheck(form) { const action = form.getAttribute('data-check-action'); if (!action) return; + const fd = new URLSearchParams(new FormData(form)); + const checkRpc = form.getAttribute('data-check-rpc'); + if (checkRpc) { + fd.set('__rpc__', checkRpc); + } const resp = await fetch(action, { method: 'POST', - body: new URLSearchParams(new FormData(form)), + body: fd, headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, credentials: 'same-origin', }); diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs index 3bc69ecbb7e16a59d2d393b2d59f9cd3fedb12b1..73180737db8ba8d16fb7b42b790e44d2d7b796f5 100644 --- a/server/src/html/ui_action.rs +++ b/server/src/html/ui_action.rs @@ -14,7 +14,7 @@ pub const UI_RPC_FIELD: &str = "__rpc__"; #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] #[serde(tag = "action", rename_all = "snake_case")] pub enum HtmlUiAction { - /// Same semantics as `POST /post` (forum ingest). + /// Forum ingest via `POST /ui`. PostIngest { room: String, thread_tag: String, @@ -24,7 +24,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/check`. + /// DSL check / validation via `POST /ui`. CheckIngest { room: String, thread_tag: String, @@ -34,7 +34,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/redact`. + /// Author redacts own post via `POST /ui`. RedactPost { post_id: String, }, diff --git a/server/src/lib.rs b/server/src/lib.rs index 5f5b6b0f01b29350c7415e5801ec5caa74f0b452..c28c2335d23080671e71155ea3fb023f9b8d98c4 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -31,9 +31,6 @@ pub fn create_app(state: AppState) -> Router { .route("/", get(crate::html::home)) .route("/login", get(api::get_web_login)) .route("/logout", get(api::get_logout)) - .route("/post", post(api::post_web_ingest)) - .route("/post/redact", post(api::post_web_redact)) - .route("/post/check", post(api::check_web_ingest)) .route("/ui", post(api::post_ui_html)) .route("/theme", post(crate::html::post_theme)) .route("/sse", get(api::get_html_stream)) @@ -64,6 +61,7 @@ pub fn create_app(state: AppState) -> Router { ) .route("/t/:tag/:index", get(crate::html::thread_post_view)) .route("/t/:tag", get(crate::html::thread_view)) + // TODO DELETE THESE AND USE __RPC__ PATTERN .route( "/r/:room_short/:room_slug/t/:thread_tag/:index/expand", get(crate::html::room_thread_post_expand), diff --git a/server/tests/integration.rs b/server/tests/integration.rs index d86de2dd446516807a3c8a607aa88787d1b136b0..831722430d6b41308e3f03d485cd62f887ace799 100644 --- a/server/tests/integration.rs +++ b/server/tests/integration.rs @@ -21,6 +21,30 @@ fn test_bearer() -> String { format!("slug_{token_id}_{secret}") } +/// Compact JSON for `POST /ui` (`HtmlUiAction::PostIngest`). +fn ui_post_ingest_rpc(room: &str, thread_tag: &str, text: &str) -> String { + serde_json::json!({ + "action": "post_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + }) + .to_string() +} + +/// Compact JSON for `POST /ui` (`HtmlUiAction::CheckIngest`). +fn ui_check_ingest_rpc(room: &str, thread_tag: &str, text: &str, error_target: &str) -> String { + serde_json::json!({ + "action": "check_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + "error_target": error_target, + "form_id": "thread-compose-form", + }) + .to_string() +} + /// `commands` is a JSON array of RPC commands (`RpcBatch` is a transparent `Vec`). async fn rpc_batch( client: &reqwest::Client, @@ -343,14 +367,11 @@ async fn test_private_room_thread_urls_use_t_segment() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc(&room_id, "main-thread", "private post via web"); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "main-thread"), - ("text", "private post via web"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -404,14 +425,15 @@ async fn test_private_room_post_links_use_private_garden_routes() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc( + &room_id, + "garden-thread", + "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n", + ); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "garden-thread"), - ("text", "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -449,15 +471,11 @@ async fn test_post_check_returns_targeted_js_error_for_missing_thread_tag() { .unwrap(); let bearer = test_bearer(); + let rpc = ui_check_ingest_rpc("public", "", "hello", "thread-compose-errors"); let resp = client - .post(format!("http://{addr}/post/check")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", "public"), - ("thread_tag", ""), - ("text", "hello"), - ("error_target", "thread-compose-errors"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -553,14 +571,11 @@ async fn test_sse_stream_emits_evalable_js_after_post() { .unwrap(); assert!(sse_resp.status().is_success()); + let rpc = ui_post_ingest_rpc(&room_id, "live-thread", "hello over sse"); let _post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "live-thread"), - ("text", "hello over sse"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); diff --git a/test/walkthrough_fixture.clj b/test/walkthrough_fixture.clj index ec7914464b1a0389e40c5be53af59cf8ed82b09e..4b814822029c913e38151ca53848d1c64fb58373 100644 --- a/test/walkthrough_fixture.clj +++ b/test/walkthrough_fixture.clj @@ -52,22 +52,28 @@ "~/secret/item {classified}\n" "~/secret/other {secondary}\n" "~/secret/item 3:1 ~/secret/other {because}\n") + rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text wall-text}) post-resp (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text wall-text} + (str base-url "/ui") + {:__rpc__ rpc} :headers {"Authorization" (str "Bearer " alice-token)})] (assert! (= 200 (:status post-resp)) "seed post must succeed")) (let [bob-reply (str "Bob here — reply with another long block so the thread has multiple cards.\n\n" "Paragraph two: repeating slugs ~/secret/item and ~/secret/other for cross-post link styling. " "If everything wraps cleanly, monospace pre + serif body (in craft theme) should still feel readable.\n\n" "More overflow: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n") + bob-rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text bob-reply}) bob-post (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text bob-reply} + (str base-url "/ui") + {:__rpc__ bob-rpc} :headers {"Authorization" (str "Bearer " bob-token)})] (assert! (= 200 (:status bob-post)) "seed reply post must succeed")) {:users {:alice {:token alice-token}