You are a constitutional council ranking individual git commits for ownership allocation. Compare these two commits. Decide which contributed more lasting value to the project. Judge substance, not spectacle: - Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise. - Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one. - Do not favor a side merely because its patch is longer or noisier. - Weight what the change does for the project, not the contributor's name. Return ONLY a JSON object: {"winner": "A" or "B", "ratio": "N:M", "explanation": "..."} The explanation must cite concrete differences in the patches (1-3 sentences). Side A — contributor: tommy-mor Side A — commit message: [8f6be6d0] Add copy button for garden rankings (markdown clipboard) (#168) * Add garden ranking markdown copy button via POST /ui Introduce HtmlUiAction::CopyGardenRank that rebuilds the visible child ranking and returns JsBuilder clipboard JS (fetch → eval), matching CopyThread. Place a copy control on garden ranking headings; clipboard text is a concise markdown numbered list with unranked bullets. Co-authored-by: tommy * Fix paren balance in garden ranking copy browser test Co-authored-by: tommy --------- Co-authored-by: Cursor Agent Side A — unified diff (full patch): diff --git a/agents.md b/agents.md index 7d6fea5791f7c95677e17e8975a14df83f998fd6..1dc989e4b23071f2eef69f2479c9a1ca2bd04b32 100644 --- a/agents.md +++ b/agents.md @@ -40,6 +40,8 @@ Strict **CSP** that blocks `eval` would break the current app. Other projects ma - **Non-morph `POST /ui` responses:** **`SetGardenPin`** returns **`303 See Other`** and **`Set-Cookie`** (same as **`POST /theme`**). Garden pin/unpin is a normal **`
`** — browser navigation applies cookies reliably (see **`test/browser_garden_pin.clj`**). Each **`__rpc__`** payload includes **`form_action: "/ui"`**; **`post_ui_html`** rejects mismatches to bind tokens to the UI endpoint. +- **`CopyGardenRank`:** Browser copy control on garden ranking headings. Returns **`text/javascript`** via **`JsBuilder::clipboard_write_text_and_label_btn`** (same **`fetch` → `eval`** loop as **`CopyThread`**). Payload includes **`room`**, **`parent_path`**, **`depth`**, **`copy_btn_id`**, and optional **`external_hosts`** (for **`/-/`** host-root indexes). Clipboard text is a concise markdown numbered list of display paths (plus unranked bullets). + - **`VoteComparePost`:** On success returns **`text/javascript`** that **morphs** **`#vote-edge-history-region`** (recomputed **`
    `** — ratios match **`left`/`right`** query order, bullets, sorted by strength toward **`left`** then newer) and **`.vote-compare-nav`** (fresh next-pair link). The compare **`GET`** page uses **`layout_full_bleed_chromeless`** (no breadcrumbs, no **`#controls`**, no **`slug-pin-hud`**; **`view-vote-compare-fullscreen`** full-width **`body`**). **`__rpc__`** carries **`form_action: "/ui"`**; **`thread_tag`** and ratio fields come from the same form as **`$form`** holes. **Guests** on a shared pair see the compose UI with **`post vote`** as a link to **`/login?next=`** (class **`vote-compare-login-cta`**); after OAuth / username selection they return to that matchup. An unauthenticated **`VoteComparePost`** (forged/stale form) still JS-redirects to the same **`/login?next=`** target. - **`ThreadGraduate` / `GraduateThread`:** Private-room forum threads with **Manage** can be published to the public site under the same tag. The writer replays non-redacted ingests into **`room: public`** (chronological order), then appends a durable **`ThreadGraduated`** marker. Graduated private threads show a banner linking to public **`/t/:tag`**, block further private posts, and cannot be graduated twice. CLI: **`npx slugsocial private forum graduate `**; RPC: **`ThreadGraduate`**. diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index b4a0c9e87e462050bd52728e49e0d6781bf1cfc8..611956d0a46062b49ce350be176e4be139312ff0 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -24,9 +24,9 @@ use crate::{ external_resolver_status_markup, fragment_new_thread_slot, login_to_post_hint_markup, parse_html_ui_from_form, room_members_section_markup, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, thread_ui_collapse_redacted_post, - thread_ui_copy_thread, - thread_ui_expand_post_full, thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room, - user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav, + garden_ui_copy_rank, thread_ui_copy_thread, thread_ui_expand_post_full, + thread_ui_expand_redacted_post, ui_js_warn, user_can_post_room, user_can_view_room, + HtmlUiAction, JsBuilder, ThreadNav, }, reducer::{scope_from_room_wire, ScopeId}, state::AppState, @@ -575,6 +575,25 @@ async fn dispatch_ui_action( let viewer = session.map(|s| s.username.as_str()); thread_ui_copy_thread(state, &room, &thread_tag, ©_btn_id, viewer).await } + HtmlUiAction::CopyGardenRank { + room, + parent_path, + depth, + copy_btn_id, + external_hosts, + } => { + let viewer = session.map(|s| s.username.as_str()); + garden_ui_copy_rank( + state, + &room, + &parent_path, + depth, + ©_btn_id, + external_hosts, + viewer, + ) + .await + } HtmlUiAction::GraduateThread { room, thread_tag } => { let Some(session) = session else { return js_redirect("/login").into_response(); diff --git a/server/src/html/garden/copy.rs b/server/src/html/garden/copy.rs new file mode 100644 index 0000000000000000000000000000000000000000..271ea87c34c99e23ab1b0d8572632fdc41380b78 --- /dev/null +++ b/server/src/html/garden/copy.rs @@ -0,0 +1,199 @@ +//! Copy garden rankings to the clipboard as concise markdown (POST /ui + JsBuilder eval). + +use crate::form_template::template_json_compact; +use crate::html::forum::ThreadNav; +use crate::html::js_string_literal; +use crate::html::ui_action::HtmlUiAction; +use crate::html::{JsBuilder, ui_js_warn}; +use crate::path_types::ItemId; +use crate::reducer::scope_from_room_wire; +use crate::scope_rank::{ + build_children_rankings, build_rankings_for_item_set, external_root_host_items, + resolve_scope_recursive, ChildrenRankings, +}; +use crate::state::AppState; +use maud::{html, Markup}; + +use super::access::user_can_view_room; +use super::item::item_display_path; +use crate::reducer::{ContentState, ScopeId}; + +const COPY_BTN_ID: &str = "garden-rank-copy"; + +/// `POST /ui` + `__rpc__` from an inline button; response body is `eval`'d (same as forum copy). +fn garden_ui_fetch_onclick(rpc_compact_json: &str) -> String { + format!( + "fetch('/ui',{{method:'POST',headers:{{'Content-Type':'application/x-www-form-urlencoded'}},body:new URLSearchParams({{__rpc__:{}}}).toString(),credentials:'same-origin'}}).then(r=>r.text()).then(eval);return false", + js_string_literal(rpc_compact_json) + ) +} + +/// Concise markdown for ranked child groups (numbered lists + unranked bullets). +pub(crate) fn format_garden_rank_markdown(rankings: &ChildrenRankings) -> String { + let mut out = String::new(); + let multi = rankings.component_rankings.len() > 1; + for (ci, comp) in rankings.component_rankings.iter().enumerate() { + if ci > 0 { + out.push('\n'); + } + if multi { + out.push_str(&format!("### ordering {}\n\n", ci + 1)); + } + for (i, r) in comp.ranked.iter().enumerate() { + out.push_str(&format!( + "{}. {}\n", + i + 1, + item_display_path(r.item.as_str()) + )); + } + } + if !rankings.unranked_items.is_empty() { + if !out.is_empty() { + out.push('\n'); + } + for name in &rankings.unranked_items { + out.push_str(&format!("- {}\n", item_display_path(name.as_str()))); + } + } + out +} + +fn rankings_for_copy( + state_content: &crate::reducer::ContentState, + parent_path: &str, + depth: usize, + external_hosts: bool, +) -> ChildrenRankings { + if external_hosts { + let hosts = external_root_host_items(state_content); + return build_rankings_for_item_set(state_content, &hosts); + } + let parent = ItemId::parse(parent_path.trim()) + .unwrap_or_else(|| ItemId::ontology_root()) + .normalized_storage(); + let depth = depth.clamp(1, 5); + if depth > 1 { + let items = resolve_scope_recursive(state_content, &[parent.as_str().to_string()], depth); + build_rankings_for_item_set(state_content, &items) + } else { + build_children_rankings(state_content, &parent) + } +} + +pub(crate) async fn garden_ui_copy_rank( + state: &AppState, + room: &str, + parent_path: &str, + depth: usize, + copy_btn_id: &str, + external_hosts: bool, + viewer: Option<&str>, +) -> axum::response::Response { + let room = room.trim(); + let scope = scope_from_room_wire(room); + if let ScopeId::Room(ref rid) = scope { + let reduced = state.reduced.read().await; + if !user_can_view_room(&reduced, rid, viewer) { + return ui_js_warn("forbidden"); + } + } + + let reduced = state.reduced.read().await; + let empty = ContentState::default(); + let content = match &scope { + ScopeId::Public => reduced.public(), + ScopeId::Room(_) => reduced.content_for_scope(&scope).unwrap_or(&empty), + }; + let rankings = rankings_for_copy(content, parent_path, depth, external_hosts); + let text = format_garden_rank_markdown(&rankings); + drop(reduced); + + if text.is_empty() { + return ui_js_warn("nothing to copy"); + } + + JsBuilder::new() + .clipboard_write_text_and_label_btn(&text, copy_btn_id, "copied") + .into_response() +} + +pub(super) fn garden_rank_copy_button_markup( + nav: &ThreadNav, + parent_path: &str, + depth: usize, + external_hosts: bool, +) -> Markup { + let rpc = template_json_compact(&HtmlUiAction::CopyGardenRank { + room: nav.room_wire.clone(), + parent_path: parent_path.to_string(), + depth, + copy_btn_id: COPY_BTN_ID.to_string(), + external_hosts, + }) + .expect("CopyGardenRank serializes"); + html! { + button type="button" id=(COPY_BTN_ID) class="post-nav-btn ont-rank-copy-btn" title="Copy ranking as markdown" + onclick=(garden_ui_fetch_onclick(&rpc)) { + "copy" + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::path_types::ItemId; + use crate::ranking::RankedItem; + use crate::scope_rank::ScopedComponent; + + #[test] + fn markdown_single_component_and_unranked() { + let rankings = ChildrenRankings { + component_rankings: vec![ScopedComponent { + pairs: 1, + ranked: vec![ + RankedItem { + item: ItemId::parse("~/a").unwrap(), + score: 0.9, + }, + RankedItem { + item: ItemId::parse("~/b").unwrap(), + score: 0.1, + }, + ], + }], + unranked_items: vec![ItemId::parse("~/c").unwrap()], + }; + assert_eq!( + format_garden_rank_markdown(&rankings), + "1. ~/a\n2. ~/b\n\n- ~/c\n" + ); + } + + #[test] + fn markdown_multi_component_headers() { + let rankings = ChildrenRankings { + component_rankings: vec![ + ScopedComponent { + pairs: 1, + ranked: vec![RankedItem { + item: ItemId::parse("~/a").unwrap(), + score: 1.0, + }], + }, + ScopedComponent { + pairs: 1, + ranked: vec![RankedItem { + item: ItemId::parse("~/b").unwrap(), + score: 1.0, + }], + }, + ], + unranked_items: vec![], + }; + assert_eq!( + format_garden_rank_markdown(&rankings), + "### ordering 1\n\n1. ~/a\n\n### ordering 2\n\n1. ~/b\n" + ); + } +} diff --git a/server/src/html/garden/mod.rs b/server/src/html/garden/mod.rs index ee8696727e5473fe1fa913b8a7b9f3cb9c32d12f..69012a2c1d069e47fa611d63d3bd2a329fd6255d 100644 --- a/server/src/html/garden/mod.rs +++ b/server/src/html/garden/mod.rs @@ -2,6 +2,7 @@ mod access; mod browse; +mod copy; mod external; mod item; mod item_page; @@ -13,6 +14,7 @@ mod vote; #[cfg(test)] mod tests; +pub(crate) use copy::garden_ui_copy_rank; pub(crate) use external::external_resolver_status_markup; pub(crate) use pin::{encode_pin_cookie_value, GARDEN_PIN_COOKIE}; pub(crate) use vote::vote_compare_post_success_js; diff --git a/server/src/html/garden/render.rs b/server/src/html/garden/render.rs index ca546693ecb2bb9ae5fb370f02b860c943f604b9..eed80e807d77e6b4eeeb0c3f38d6372e91ad2852 100644 --- a/server/src/html/garden/render.rs +++ b/server/src/html/garden/render.rs @@ -25,6 +25,7 @@ use crate::{ use super::{ access::content_for_garden_view, browse::{garden_layout_meta, scoped_bc_path_for, GardenBrowsePath}, + copy::garden_rank_copy_button_markup, external::{external_frame_allowed, external_source_href, github_resolver_controls}, item::{child_depth_from_uri, item_code_label, item_display_path, item_href}, item_page::{build_item_page_view_model, sibling_nav_markup}, @@ -196,6 +197,15 @@ pub(super) async fn render_scope_view( " " span class="muted" { (format!("(depth {})", model.child_depth)) } } + @if total_children > 0 { + " " + (garden_rank_copy_button_markup( + &nav, + &item_display_path(&model.item), + model.child_depth, + false, + )) + } @if total_children >= 2 { " " a class="ont-vote-children-btn" href=(vote_pool_href(&nav, &model.item)) { diff --git a/server/src/html/garden/routes.rs b/server/src/html/garden/routes.rs index 8a0499576d9093dbac0fffa1cf2ed88187e14acb..31b61355b1ec75645d405e16ab6abf8205c66380 100644 --- a/server/src/html/garden/routes.rs +++ b/server/src/html/garden/routes.rs @@ -28,6 +28,7 @@ use crate::{ use super::{ access::{content_for_garden_view, room_not_found_page, room_scope_has_garden_content, user_can_view_room}, browse::{GardenBrowsePath, scoped_bc_path_external}, + copy::garden_rank_copy_button_markup, item::{item_display_path, item_href}, render::render_scope_view, }; @@ -52,7 +53,13 @@ pub async fn garden_index( html! { @let root_path = OntologyPath::root(); nav class="breadcrumb" { (bc_path(&root_path)) } - h2 { "paths" } + h2 { + "paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "~/", 1, false)) + } + } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no items yet" } } @else { @@ -137,7 +144,13 @@ pub async fn external_garden_index( "view-ontology view-ontology-light", html! { nav class="breadcrumb" { (bc_path_external(&ext_path)) } - h2 { "external paths" } + h2 { + "external paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "", 1, true)) + } + } p class="muted" { "Items outside slug.social use the " code { "-/" } " prefix followed by the full " code { "https://…" } " URL (legacy " code { "-/host/path" } " still works)." } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no external items indexed yet" } @@ -272,7 +285,13 @@ pub async fn room_external_garden_index( "view-ontology view-ontology-light", html! { nav class="breadcrumb" { (scoped_bc_path_external(&ext_path, &nav)) } - h2 { "external paths" } + h2 { + "external paths" + @if !(child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty()) { + " " + (garden_rank_copy_button_markup(&nav, "", 1, true)) + } + } @if child_rankings.component_rankings.is_empty() && child_rankings.unranked_items.is_empty() { p class="muted" { "no external items indexed yet" } } @else { diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index d7014fc7f934e5b0c7fb47ebf00cb4ef50d306c2..645d54f2e117ba901e02ed958ada6ff69a78ae34 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -37,8 +37,8 @@ pub(crate) use forum::{ user_can_post_room, user_can_view_room, }; pub(crate) use garden::{ - encode_pin_cookie_value, external_resolver_status_markup, vote_compare_post_success_js, - GARDEN_PIN_COOKIE, + encode_pin_cookie_value, external_resolver_status_markup, garden_ui_copy_rank, + vote_compare_post_success_js, GARDEN_PIN_COOKIE, }; pub use garden::{ external_garden_index, external_ontology_path, garden_index, ontology_path, diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs index 5cf3168fb74e7654215cd9ff8942c6ed63fd0002..7dc3db062954370b5504fc311c0ab24bab569f80 100644 --- a/server/src/html/ui_action.rs +++ b/server/src/html/ui_action.rs @@ -118,6 +118,18 @@ pub enum HtmlUiAction { thread_tag: String, copy_btn_id: String, }, + /// Copy garden child ranking as a concise markdown list to the clipboard. + CopyGardenRank { + room: String, + /// Parent item path (storage or display). Ignored when `external_hosts` is true. + parent_path: String, + #[serde(default = "default_garden_rank_depth")] + depth: usize, + copy_btn_id: String, + /// When true, copy rankings for external host roots (`/-/` index), not parent children. + #[serde(default)] + external_hosts: bool, + }, /// Publish a private-room thread to the public forum (Manage only). GraduateThread { room: String, @@ -125,6 +137,10 @@ pub enum HtmlUiAction { }, } +fn default_garden_rank_depth() -> usize { + 1 +} + #[derive(Debug, Error)] pub enum HtmlUiParseError { #[error("missing __rpc__ field")] @@ -272,4 +288,57 @@ mod tests { } ); } + + #[test] + fn copy_garden_rank_round_trip() { + let template = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/topic", + "depth": 2, + "copy_btn_id": "garden-rank-copy", + }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!( + a, + HtmlUiAction::CopyGardenRank { + room: "public".into(), + parent_path: "~/topic".into(), + depth: 2, + copy_btn_id: "garden-rank-copy".into(), + external_hosts: false, + } + ); + } + + #[test] + fn copy_garden_rank_defaults_depth_and_external_hosts() { + let template = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/", + "copy_btn_id": "garden-rank-copy", + }); + let mut form = HashMap::new(); + form.insert( + UI_RPC_FIELD.to_string(), + serde_json::to_string(&template).unwrap(), + ); + let a = parse_html_ui_from_form(&form).unwrap(); + assert_eq!( + a, + HtmlUiAction::CopyGardenRank { + room: "public".into(), + parent_path: "~/".into(), + depth: 1, + copy_btn_id: "garden-rank-copy".into(), + external_hosts: false, + } + ); + } } diff --git a/server/tests/integration_ui.rs b/server/tests/integration_ui.rs index d242abff5769cc704b3c8070d7456e5788c31a45..6b1475b773106a2dd3f326475c9fb4cc727f6b4b 100644 --- a/server/tests/integration_ui.rs +++ b/server/tests/integration_ui.rs @@ -490,3 +490,71 @@ async fn test_vote_compare_post_rejects_over_max_ratio() { ); } +#[tokio::test] +async fn test_copy_garden_rank_returns_clipboard_js_with_markdown() { + let (addr, _tmp, _log, _handle) = create_test_server().await; + let client = reqwest::Client::new(); + let bearer = test_bearer(); + + let seed = rpc_batch( + &client, + addr, + Some(&bearer), + serde_json::json!([{ + "Post": { + "room": "public", + "thread_tag": "copy-rank-ui", + "text": "# copy-rank-ui\n\n~/copy-a {a}\n~/copy-b {b}\n~/copy-c {c}\n{vote}\n~/copy-a 2:1 ~/copy-b\n", + "return_rank_diff": false + } + }]), + ) + .await; + assert_eq!(seed["results"][0]["ok"], true, "seed: {:?}", seed); + + let page = client + .get(format!("http://{addr}/~")) + .send() + .await + .unwrap(); + assert!(page.status().is_success()); + let html = page.text().await.unwrap(); + assert!( + html.contains("id=\"garden-rank-copy\"") && html.contains("copy_garden_rank"), + "garden index should include copy button + action payload" + ); + + let rpc = serde_json::json!({ + "action": "copy_garden_rank", + "room": "public", + "parent_path": "~/", + "depth": 1, + "copy_btn_id": "garden-rank-copy", + }) + .to_string(); + let resp = client + .post(format!("http://{addr}/ui")) + .header("Authorization", format!("Bearer {bearer}")) + .form(&[("__rpc__", rpc.as_str())]) + .send() + .await + .unwrap(); + assert_eq!(resp.status(), reqwest::StatusCode::OK); + assert_eq!( + resp.headers() + .get(reqwest::header::CONTENT_TYPE) + .and_then(|v| v.to_str().ok()), + Some("text/javascript; charset=utf-8") + ); + let js = resp.text().await.unwrap(); + assert!( + js.contains("navigator.clipboard.writeText") && js.contains("garden-rank-copy"), + "expected clipboard JsBuilder snippet, got: {js}" + ); + assert!( + js.contains("1. ~/copy-a") && js.contains("2. ~/copy-b") && js.contains("- ~/copy-c"), + "expected concise markdown ranking in clipboard payload, got: {js}" + ); + assert!(js.contains("\"copied\""), "expected button label flip to copied"); +} + diff --git a/test/browser_public_garden.clj b/test/browser_public_garden.clj index 5dd49f1f70c870e25a2a9f5348f0bdb85647e897..8ceb532c664f9fc3d6f66a451e5ea5eaa1671007 100644 --- a/test/browser_public_garden.clj +++ b/test/browser_public_garden.clj @@ -73,6 +73,7 @@ (core/with-playwright [pw] (core/with-browser [browser (core/launch-chromium pw {:headless true :channel "chrome"})] (core/with-context [ctx (core/new-context browser)] + (core/context-grant-permissions! ctx ["clipboard-read" "clipboard-write"]) (core/with-page [pg (core/new-page-from-context ctx)] (page/navigate pg (str base-url "/login")) (is (wait-for-text pg "body" "@alice" 15000) "alice session after login") @@ -84,7 +85,12 @@ (is (wait-for-text pg "body" "~/br-pub-b" 10000) "ranked list shows ~/br-pub-b") (is (wait-for-text pg "body" "unranked" 10000) "unranked section present") (is (wait-for-text pg "body" "~/br-pub-c" 10000) - "unranked list shows ~/br-pub-c")))))) + "unranked list shows ~/br-pub-c") + (is (wait-for-text pg "#garden-rank-copy" "copy" 5000) + "garden ranking copy button visible") + (locator/click (page/locator pg "#garden-rank-copy")) + (is (wait-for-text pg "#garden-rank-copy" "copied" 10000) + "copy button flips to copied after POST /ui eval")))))) (finally (when-some [s @!server] (common/kill-server s)) Side B — contributor: tommy-mor Side B — commit message: [c3cbcaa7] refactor Side B — unified diff (full patch): diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs index b3631b06153d52f88348fef927e7a024b7b85ad6..cd556eb89e9dd8203eba6c8969ffd144db5d329d 100644 --- a/server/src/api/auth.rs +++ b/server/src/api/auth.rs @@ -71,6 +71,24 @@ pub fn optional_principal(headers: &HeaderMap, jar: &CookieJar, reduced: &Reduce verify_token(reduced, c.value()).ok() } +/// Browser session: principal + bearer token string (same shape as CLI session cookie). +#[derive(Debug, Clone)] +pub struct WebSession { + pub username: String, + pub bearer: String, +} + +/// Resolve username and bearer together for `POST /ui` dispatch (one read of headers + jar). +pub fn resolve_web_session(headers: &HeaderMap, jar: &CookieJar, reduced: &ReducerState) -> Option { + let username = optional_principal(headers, jar, reduced)?; + let bearer = headers + .get(header::AUTHORIZATION) + .and_then(|v| v.to_str().ok()) + .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) + .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string()))?; + Some(WebSession { username, bearer }) +} + fn redirect_with_session_cookie(public_url: &str, path_and_query: &str, bearer: &str, jar: &CookieJar) -> Response { let mut res = Response::builder() .status(StatusCode::TEMPORARY_REDIRECT) diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs index a986f706ea4b261cbaf004c02b4cf84184b41371..4e223a7460997c464706dca850281447bd754ed5 100644 --- a/server/src/api/mod.rs +++ b/server/src/api/mod.rs @@ -4,7 +4,6 @@ mod rpc; mod stream; mod validate; mod ui_html; -mod web_post; pub use auth::{ get_join_invite, @@ -19,7 +18,9 @@ pub use auth::{ get_web_login, get_logout, optional_principal, + resolve_web_session, session_cookie_header_value, + WebSession, SLUG_SESSION_COOKIE, }; @@ -35,7 +36,6 @@ pub use stream::{get_html_stream, get_stream}; pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest}; pub use ui_html::post_ui_html; -pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact}; #[cfg(test)] mod tests { diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs index 2b40a72059981d558768f73d189b991f3448c257..497f8fdd222a8ec7c3d76b0695e0352e973ca3ba 100644 --- a/server/src/api/ui_html.rs +++ b/server/src/api/ui_html.rs @@ -1,25 +1,29 @@ -//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes). +//! Single `POST /ui` entry: parse `__rpc__` → [`HtmlUiAction`], resolve [`WebSession`] once, dispatch. use axum::{ - body::Body, + body, extract::State, - http::{header, HeaderMap, StatusCode}, + http::{header, HeaderMap, HeaderValue, StatusCode}, response::{IntoResponse, Response}, Form, }; use axum_extra::extract::cookie::CookieJar; +use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; use std::collections::HashMap; use crate::{ api::{ - auth::optional_principal, - web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm}, + auth::{resolve_web_session, WebSession}, + handle_rpc_batch, + rpc::{rpc_post_redact, rpc_post_with_bearer}, }, + canonical_path::canonicalize_tag, html::{ fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup, - parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, - ThreadNav, + parse_html_ui_from_form, thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, + user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder, ThreadNav, }, + reducer::{scope_from_room_wire, ScopeId}, state::AppState, }; @@ -34,6 +38,19 @@ pub async fn post_ui_html( Err(e) => return ui_js_warn(&e.to_string()).into_response(), }; + let reduced = state.reduced.read().await; + let session = resolve_web_session(&headers, &jar, &reduced); + drop(reduced); + + dispatch_ui_action(&state, session.as_ref(), action).await +} + +/// All UI command logic: HTTP extractors stop above; this only sees [`AppState`], session, and [`HtmlUiAction`]. +async fn dispatch_ui_action( + state: &AppState, + session: Option<&WebSession>, + action: HtmlUiAction, +) -> Response { match action { HtmlUiAction::PostIngest { room, @@ -42,47 +59,87 @@ pub async fn post_ui_html( error_target, form_id, } => { - run_post_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = thread_tag.trim().to_string(); + if text.trim().is_empty() { + return form_js_error( + error_target.as_ref(), + "empty post", + "Write something in the text area (DSL / prose).", + ) + .into_response(); + } + match rpc_post_with_bearer(state, &session.bearer, room.clone(), thread_tag.clone(), text).await { + Ok(RpcResult::PostOk { .. }) => { + post_success_response( + state, + &room, + &thread_tag, + error_target.as_ref(), + form_id.as_ref(), + Some(session.username.as_str()), + ) + .await + .into_response() + } + Ok(_) => form_js_error( + error_target.as_ref(), + "unexpected response", + "Post did not return PostOk.", + ) + .into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::CheckIngest { room, thread_tag, text, error_target, - form_id, + form_id: _, } => { - run_check_web_ingest( - &state, - &headers, - &jar, - WebPostForm { - room, - thread_tag, - text, - error_target, - form_id, - }, - ) - .await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(&thread_tag); + if thread_tag.is_empty() { + return form_js_error( + error_target.as_ref(), + "missing thread tag", + "Set a thread tag before posting.", + ) + .into_response(); + } + if text.trim().is_empty() { + return js_clear_errors(&form_error_target(error_target.as_ref())).into_response(); + } + match rpc_check_with_bearer(state, &session.bearer, room, text.clone()).await { + Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(error_target.as_ref())).into_response(), + Ok(_) => form_js_error(error_target.as_ref(), "unexpected response", "Check did not return CheckOk.").into_response(), + Err((msg, hint)) => form_js_error(error_target.as_ref(), &msg, hint.as_deref().unwrap_or("")).into_response(), + } } HtmlUiAction::RedactPost { post_id } => { - run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await + let Some(session) = session else { + return js_redirect("/login").into_response(); + }; + let h = headers_from_bearer(&session.bearer); + match rpc_post_redact(state, &h, post_id).await { + Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), + Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), + Err((msg, hint)) => { + let detail = hint.as_deref().unwrap_or(""); + js_error("#errors", &msg, detail).into_response() + } + } } HtmlUiAction::ExpandPublicNewThreadForm => { let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); drop(reduced); let markup = if user.is_some() { fragment_public_new_thread_form(true) @@ -99,18 +156,18 @@ pub async fn post_ui_html( return ui_js_warn("missing room").into_response(); } let reduced = state.reduced.read().await; - let user = optional_principal(&headers, &jar, &reduced); + let user = session.map(|s| s.username.as_str()); if !reduced.rooms.contains(&room_wire) { drop(reduced); return ui_js_warn("room not found").into_response(); } - if !user_can_view_room(&reduced, &room_wire, user.as_deref()) { + if !user_can_view_room(&reduced, &room_wire, user) { drop(reduced); return ui_js_warn("forbidden").into_response(); } - let can_post = user + let can_post = session .as_ref() - .map(|u| user_can_post_room(&reduced, &room_wire, u)) + .map(|s| user_can_post_room(&reduced, &room_wire, &s.username)) .unwrap_or(false); drop(reduced); let Some(nav) = ThreadNav::from_room_id(&room_wire) else { @@ -128,12 +185,195 @@ pub async fn post_ui_html( } } +fn headers_from_bearer(bearer: &str) -> HeaderMap { + let mut headers = HeaderMap::new(); + if let Ok(hv) = HeaderValue::from_str(&format!("Bearer {bearer}")) { + headers.insert(header::AUTHORIZATION, hv); + } + headers +} + +fn post_redirect_location(room: &str, thread_tag: &str) -> String { + let tag = canonicalize_tag(thread_tag); + if room.trim() == "public" { + format!("/t/{tag}") + } else { + let room = room.trim(); + let Some((a, b)) = room.split_once('/') else { + return "/".to_string(); + }; + format!("/r/{a}/{b}/t/{tag}") + } +} + +fn js_quote(s: &str) -> String { + serde_json::to_string(s).expect("js string escaping must succeed") +} + +fn js_redirect(to: &str) -> Response { + let js = format!("window.location = {};", js_quote(to)); + Response::builder() + .status(StatusCode::OK) + .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") + .body(axum::body::Body::from(js)) + .unwrap() +} + +fn js_error(error_target: &str, title: &str, detail: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) { + p class="auth-error" { (title) } + @if !detail.is_empty() { + pre class="muted" { (detail) } + } + } + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn form_error_target(error_target: Option<&String>) -> String { + error_target + .map(|s| s.as_str()) + .filter(|s| !s.trim().is_empty()) + .map(|s| { + if s.starts_with('#') { + s.to_string() + } else { + format!("#{s}") + } + }) + .unwrap_or_else(|| "#errors".to_string()) +} + +fn form_js_error(error_target: Option<&String>, title: &str, detail: &str) -> Response { + js_error(&form_error_target(error_target), title, detail) +} + +fn js_clear_errors(error_target: &str) -> Response { + let markup = maud::html! { + div id=(error_target.trim_start_matches('#')) {} + }; + JsBuilder::new() + .morph_selector(error_target, markup) + .into_response() +} + +fn empty_error_markup(error_target: &str) -> maud::Markup { + maud::html! { + div id=(error_target.trim_start_matches('#')) {} + } +} + +async fn rpc_check_with_bearer( + state: &AppState, + bearer_token: &str, + room: String, + text: String, +) -> Result)> { + let mut headers = HeaderMap::new(); + let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) + .map_err(|_| ("invalid session token".into(), None))?; + headers.insert(header::AUTHORIZATION, hv); + + let response = handle_rpc_batch( + State(state.clone()), + headers, + axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), + ) + .await + .into_response(); + + let status = response.status(); + if !status.is_success() { + return Err((format!("rpc check http {}", status), None)); + } + + let body = body::to_bytes(response.into_body(), usize::MAX) + .await + .map_err(|e| (e.to_string(), None))?; + let parsed: RpcBatchResponse = + serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; + let line = parsed + .results + .into_iter() + .next() + .ok_or_else(|| ("empty rpc check response".to_string(), None))?; + if line.ok { + line.result + .ok_or_else(|| ("missing rpc check result".to_string(), None)) + } else { + Err(( + line.error.unwrap_or_else(|| "check failed".to_string()), + line.hint, + )) + } +} + +async fn post_success_response( + state: &AppState, + room: &str, + thread_tag: &str, + error_target: Option<&String>, + form_id: Option<&String>, + viewer: Option<&str>, +) -> Response { + let error_target = form_error_target(error_target); + let room = room.trim().to_string(); + let thread_tag = canonicalize_tag(thread_tag); + let thread_location = post_redirect_location(&room, &thread_tag); + let form_id = form_id.map(|s| s.as_str()).unwrap_or(""); + let scope = scope_from_room_wire(&room); + let feed_markup = match &scope { + ScopeId::Public => thread_feed_html(state).await, + ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, + }; + let thread_markup = thread_feed_region_markup( + state, + match &scope { + ScopeId::Public => None, + ScopeId::Room(_) => Some(room.as_str()), + }, + &thread_tag, + viewer.as_deref(), + ) + .await; + let feed_selector = match &scope { + ScopeId::Public => "#thread-feed", + ScopeId::Room(_) => "#room-thread-feed", + }; + + let builder = JsBuilder::new() + .morph_selector(&error_target, empty_error_markup(&error_target)) + .morph_selector(feed_selector, feed_markup) + .if_current_path_matches(&thread_location, |builder| { + let builder = builder.morph_selector("#thread-feed-region", thread_markup); + let builder = if !form_id.trim().is_empty() { + builder.qs(&format!("#{form_id}")).reset() + } else { + builder + }; + builder + }) + .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); + + builder.into_response() +} + +async fn redact_success_response(state: &AppState) -> Response { + let feed_markup = thread_feed_html(state).await; + JsBuilder::new() + .morph_selector("#thread-feed", feed_markup) + .into_response() +} + fn ui_js_warn(msg: &str) -> Response { use crate::html::js_string_literal; let js = format!("console.warn({});", js_string_literal(msg)); Response::builder() .status(StatusCode::OK) .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(Body::from(js)) + .body(axum::body::Body::from(js)) .unwrap() } diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs deleted file mode 100644 index 265025f41ff1548d05b2d2d5d84202245388053f..0000000000000000000000000000000000000000 --- a/server/src/api/web_post.rs +++ /dev/null @@ -1,362 +0,0 @@ -use axum::{ - body, - extract::State, - http::{header, HeaderMap, HeaderValue, StatusCode}, - response::{IntoResponse, Response}, - Form, -}; -use axum_extra::extract::cookie::CookieJar; -use serde::Deserialize; -use slug_types::{RpcBatch, RpcBatchResponse, RpcCommand, RpcResult}; - -use crate::{ - api::{ - auth::{optional_principal, SLUG_SESSION_COOKIE}, - handle_rpc_batch, - rpc::{rpc_post_redact, rpc_post_with_bearer}, - }, - canonical_path::canonicalize_tag, - html::{thread_feed_html, thread_feed_html_for_room, thread_feed_region_markup, JsBuilder}, - reducer::{scope_from_room_wire, ScopeId}, - state::AppState, -}; - -#[derive(Debug, Deserialize)] -pub struct WebPostForm { - pub room: String, - pub thread_tag: String, - pub text: String, - #[serde(default)] - pub error_target: Option, - #[serde(default)] - pub form_id: Option, -} - -#[derive(Debug, Deserialize)] -pub struct WebRedactForm { - pub post_id: String, -} - -fn post_redirect_location(room: &str, thread_tag: &str) -> String { - let tag = canonicalize_tag(thread_tag); - if room.trim() == "public" { - format!("/t/{tag}") - } else { - let room = room.trim(); - let Some((a, b)) = room.split_once('/') else { - return "/".to_string(); - }; - format!("/r/{a}/{b}/t/{tag}") - } -} - -fn js_quote(s: &str) -> String { - serde_json::to_string(s).expect("js string escaping must succeed") -} - -fn js_redirect(to: &str) -> Response { - let js = format!("window.location = {};", js_quote(to)); - Response::builder() - .status(StatusCode::OK) - .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8") - .body(axum::body::Body::from(js)) - .unwrap() -} - -fn js_error(error_target: &str, title: &str, detail: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) { - p class="auth-error" { (title) } - @if !detail.is_empty() { - pre class="muted" { (detail) } - } - } - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn form_error_target(form: &WebPostForm) -> String { - form.error_target - .as_deref() - .filter(|s| !s.trim().is_empty()) - .map(|s| { - if s.starts_with('#') { - s.to_string() - } else { - format!("#{s}") - } - }) - .unwrap_or_else(|| "#errors".to_string()) -} - -fn form_js_error(form: &WebPostForm, title: &str, detail: &str) -> Response { - js_error(&form_error_target(form), title, detail) -} - -fn js_clear_errors(error_target: &str) -> Response { - let markup = maud::html! { - div id=(error_target.trim_start_matches('#')) {} - }; - JsBuilder::new() - .morph_selector(error_target, markup) - .into_response() -} - -fn empty_error_markup(error_target: &str) -> maud::Markup { - maud::html! { - div id=(error_target.trim_start_matches('#')) {} - } -} - -async fn rpc_check_with_bearer( - state: &AppState, - bearer_token: &str, - room: String, - text: String, -) -> Result)> { - let mut headers = HeaderMap::new(); - let hv = HeaderValue::from_str(&format!("Bearer {bearer_token}")) - .map_err(|_| ("invalid session token".into(), None))?; - headers.insert(header::AUTHORIZATION, hv); - - let response = handle_rpc_batch( - State(state.clone()), - headers, - axum::Json(RpcBatch(vec![RpcCommand::Check { room, text }])), - ) - .await - .into_response(); - - let status = response.status(); - if !status.is_success() { - return Err((format!("rpc check http {}", status), None)); - } - - let body = body::to_bytes(response.into_body(), usize::MAX) - .await - .map_err(|e| (e.to_string(), None))?; - let parsed: RpcBatchResponse = - serde_json::from_slice(&body).map_err(|e| (e.to_string(), None))?; - let line = parsed - .results - .into_iter() - .next() - .ok_or_else(|| ("empty rpc check response".to_string(), None))?; - if line.ok { - line.result - .ok_or_else(|| ("missing rpc check result".to_string(), None)) - } else { - Err(( - line.error.unwrap_or_else(|| "check failed".to_string()), - line.hint, - )) - } -} - -fn post_success_response<'a>( - state: &'a AppState, - form: &'a WebPostForm, - headers: &'a HeaderMap, - jar: &'a CookieJar, -) -> impl std::future::Future + 'a { - async move { - let error_target = form_error_target(form); - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - let thread_location = post_redirect_location(&room, &thread_tag); - let form_id = form.form_id.as_deref().unwrap_or_default(); - let scope = scope_from_room_wire(&room); - let viewer = { - let reduced = state.reduced.read().await; - optional_principal(headers, jar, &reduced) - }; - let feed_markup = match &scope { - ScopeId::Public => thread_feed_html(state).await, - ScopeId::Room(_) => thread_feed_html_for_room(state, &room).await, - }; - let thread_markup = thread_feed_region_markup( - state, - match &scope { - ScopeId::Public => None, - ScopeId::Room(_) => Some(room.as_str()), - }, - &thread_tag, - viewer.as_deref(), - ) - .await; - let feed_selector = match &scope { - ScopeId::Public => "#thread-feed", - ScopeId::Room(_) => "#room-thread-feed", - }; - - let builder = JsBuilder::new() - .morph_selector(&error_target, empty_error_markup(&error_target)) - .morph_selector(feed_selector, feed_markup) - .if_current_path_matches(&thread_location, |builder| { - let builder = builder.morph_selector("#thread-feed-region", thread_markup); - let builder = if !form_id.trim().is_empty() { - builder.qs(&format!("#{form_id}")).reset() - } else { - builder - }; - builder - }) - .if_current_path_not_matches(&thread_location, |builder| builder.redirect(&thread_location)); - - builder.into_response() - } -} - -async fn redact_success_response(state: &AppState) -> Response { - let feed_markup = thread_feed_html(state).await; - JsBuilder::new() - .morph_selector("#thread-feed", feed_markup) - .into_response() -} - -pub async fn post_web_redact( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_redact(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`]. -pub(crate) async fn run_post_web_redact( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebRedactForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - drop(reduced); - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - let Some(_bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - match rpc_post_redact(state, headers, form.post_id).await { - Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(), - Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(), - Err((msg, hint)) => { - let detail = hint.as_deref().unwrap_or(""); - js_error("#errors", &msg, detail).into_response() - } - } -} - -pub async fn post_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_post_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_post_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = form.thread_tag.trim().to_string(); - let text = form.text.clone(); - - if text.trim().is_empty() { - return form_js_error(&form, "empty post", "Write something in the text area (DSL / prose).") - .into_response(); - } - - match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await { - Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar) - .await - .into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} - -pub async fn check_web_ingest( - State(state): State, - headers: HeaderMap, - jar: CookieJar, - Form(form): Form, -) -> impl IntoResponse { - run_check_web_ingest(&state, &headers, &jar, form).await -} - -/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`). -pub(crate) async fn run_check_web_ingest( - state: &AppState, - headers: &HeaderMap, - jar: &CookieJar, - form: WebPostForm, -) -> Response { - let reduced = state.reduced.read().await; - let Some(_username) = optional_principal(headers, jar, &reduced) else { - drop(reduced); - return js_redirect("/login").into_response(); - }; - - let bearer = headers - .get(axum::http::header::AUTHORIZATION) - .and_then(|v| v.to_str().ok()) - .and_then(|s| s.strip_prefix("Bearer ").map(|t| t.trim().to_string())) - .or_else(|| jar.get(SLUG_SESSION_COOKIE).map(|c| c.value().to_string())); - drop(reduced); - - let Some(bearer) = bearer else { - return js_redirect("/login").into_response(); - }; - - let room = form.room.trim().to_string(); - let thread_tag = canonicalize_tag(&form.thread_tag); - if thread_tag.is_empty() { - return form_js_error(&form, "missing thread tag", "Set a thread tag before posting.").into_response(); - } - - if form.text.trim().is_empty() { - return js_clear_errors(&form_error_target(&form)).into_response(); - } - - match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await { - Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(), - Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(), - Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(), - } -} diff --git a/server/src/html/forum.rs b/server/src/html/forum.rs index b1c037f3dd93c7bb96d6624cab6019228432c501..a173e7aea7a81c7cfab5f2f6a5549e0db560fb2b 100644 --- a/server/src/html/forum.rs +++ b/server/src/html/forum.rs @@ -17,6 +17,7 @@ use crate::{ state::AppState, timeago, }; +use serde_json::json; use super::ui_action::{HtmlUiAction, UI_RPC_FIELD}; @@ -182,8 +183,8 @@ fn post_header_row( div class="ingest-header-row" { (meta) @if show_delete { - form class="post-delete-form" method="POST" action="/post/redact" { - input type="hidden" name="post_id" value=(ing.id); + form class="post-delete-form" method="POST" action="/ui" { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&HtmlUiAction::RedactPost { post_id: ing.id.clone() }).unwrap()); button type="submit" class="post-delete-btn" { "delete" } } } @@ -427,13 +428,28 @@ fn compose_form(nav: &ThreadNav, thread_tag: &str, show: bool) -> Markup { if !show { return html! {}; } + let rpc_post = template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); + let rpc_check = template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": thread_tag, + "text": {"$form": "text"}, + "error_target": "thread-compose-errors", + "form_id": "thread-compose-form", + })) + .unwrap(); html! { section class="compose" id="thread-compose" { - form id="thread-compose-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="thread_tag" value=(thread_tag); - input type="hidden" name="error_target" value="thread-compose-errors"; - input type="hidden" name="form_id" value="thread-compose-form"; + form id="thread-compose-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(rpc_check) { + input type="hidden" name=(UI_RPC_FIELD) value=(rpc_post); textarea name="text" rows="5" cols="80" placeholder="prose or ~/items and votes…" {} p { button type="submit" { "post" } @@ -463,10 +479,22 @@ fn new_thread_form_public(show: bool) -> Markup { h3 { "new public thread" } p class="muted" { "Set thread tag and body. Example: start with a title line or use the CLI-shaped DSL." } div id="public-new-thread-errors" {} - form id="public-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value="public"; - input type="hidden" name="error_target" value="public-new-thread-errors"; - input type="hidden" name="form_id" value="public-new-thread-form"; + form id="public-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": "public", + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "public-new-thread-errors", + "form_id": "public-new-thread-form", + })).unwrap()); label for="new-thread-tag" { "thread tag" } input type="text" id="new-thread-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" placeholder="my-topic"; label for="new-thread-text" { "text" } @@ -946,10 +974,22 @@ fn new_thread_form_for_room(nav: &ThreadNav, show: bool) -> Markup { section class="compose" id="room-new-thread-compose" hidden { h3 { "new thread in this room" } div id="room-new-thread-errors" {} - form id="room-new-thread-form" method="POST" action="/post" data-check-action="/post/check" { - input type="hidden" name="room" value=(nav.room_wire.clone()); - input type="hidden" name="error_target" value="room-new-thread-errors"; - input type="hidden" name="form_id" value="room-new-thread-form"; + form id="room-new-thread-form" method="POST" action="/ui" data-check-action="/ui" data-check-rpc=(template_json_compact(&json!({ + "action": "check_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()) { + input type="hidden" name=(UI_RPC_FIELD) value=(template_json_compact(&json!({ + "action": "post_ingest", + "room": nav.room_wire, + "thread_tag": {"$form": "thread_tag"}, + "text": {"$form": "text"}, + "error_target": "room-new-thread-errors", + "form_id": "room-new-thread-form", + })).unwrap()); label for="room-new-tag" { "thread tag" } input type="text" id="room-new-tag" name="thread_tag" pattern="[a-z0-9_\\-]{1,64}" required; textarea name="text" rows="4" placeholder="First post body…" required {} diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs index a4fd2dd60ac283f7eb9b2e64522501b21d1e27e9..63f723804be511af80b5c13e792109754b606fce 100644 --- a/server/src/html/mod.rs +++ b/server/src/html/mod.rs @@ -373,9 +373,14 @@ script { (maud::PreEscaped(r#" async function runFormCheck(form) { const action = form.getAttribute('data-check-action'); if (!action) return; + const fd = new URLSearchParams(new FormData(form)); + const checkRpc = form.getAttribute('data-check-rpc'); + if (checkRpc) { + fd.set('__rpc__', checkRpc); + } const resp = await fetch(action, { method: 'POST', - body: new URLSearchParams(new FormData(form)), + body: fd, headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, credentials: 'same-origin', }); diff --git a/server/src/html/ui_action.rs b/server/src/html/ui_action.rs index 3bc69ecbb7e16a59d2d393b2d59f9cd3fedb12b1..73180737db8ba8d16fb7b42b790e44d2d7b796f5 100644 --- a/server/src/html/ui_action.rs +++ b/server/src/html/ui_action.rs @@ -14,7 +14,7 @@ pub const UI_RPC_FIELD: &str = "__rpc__"; #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)] #[serde(tag = "action", rename_all = "snake_case")] pub enum HtmlUiAction { - /// Same semantics as `POST /post` (forum ingest). + /// Forum ingest via `POST /ui`. PostIngest { room: String, thread_tag: String, @@ -24,7 +24,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/check`. + /// DSL check / validation via `POST /ui`. CheckIngest { room: String, thread_tag: String, @@ -34,7 +34,7 @@ pub enum HtmlUiAction { #[serde(default)] form_id: Option, }, - /// Same as `POST /post/redact`. + /// Author redacts own post via `POST /ui`. RedactPost { post_id: String, }, diff --git a/server/src/lib.rs b/server/src/lib.rs index 5f5b6b0f01b29350c7415e5801ec5caa74f0b452..c28c2335d23080671e71155ea3fb023f9b8d98c4 100644 --- a/server/src/lib.rs +++ b/server/src/lib.rs @@ -31,9 +31,6 @@ pub fn create_app(state: AppState) -> Router { .route("/", get(crate::html::home)) .route("/login", get(api::get_web_login)) .route("/logout", get(api::get_logout)) - .route("/post", post(api::post_web_ingest)) - .route("/post/redact", post(api::post_web_redact)) - .route("/post/check", post(api::check_web_ingest)) .route("/ui", post(api::post_ui_html)) .route("/theme", post(crate::html::post_theme)) .route("/sse", get(api::get_html_stream)) @@ -64,6 +61,7 @@ pub fn create_app(state: AppState) -> Router { ) .route("/t/:tag/:index", get(crate::html::thread_post_view)) .route("/t/:tag", get(crate::html::thread_view)) + // TODO DELETE THESE AND USE __RPC__ PATTERN .route( "/r/:room_short/:room_slug/t/:thread_tag/:index/expand", get(crate::html::room_thread_post_expand), diff --git a/server/tests/integration.rs b/server/tests/integration.rs index d86de2dd446516807a3c8a607aa88787d1b136b0..831722430d6b41308e3f03d485cd62f887ace799 100644 --- a/server/tests/integration.rs +++ b/server/tests/integration.rs @@ -21,6 +21,30 @@ fn test_bearer() -> String { format!("slug_{token_id}_{secret}") } +/// Compact JSON for `POST /ui` (`HtmlUiAction::PostIngest`). +fn ui_post_ingest_rpc(room: &str, thread_tag: &str, text: &str) -> String { + serde_json::json!({ + "action": "post_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + }) + .to_string() +} + +/// Compact JSON for `POST /ui` (`HtmlUiAction::CheckIngest`). +fn ui_check_ingest_rpc(room: &str, thread_tag: &str, text: &str, error_target: &str) -> String { + serde_json::json!({ + "action": "check_ingest", + "room": room, + "thread_tag": thread_tag, + "text": text, + "error_target": error_target, + "form_id": "thread-compose-form", + }) + .to_string() +} + /// `commands` is a JSON array of RPC commands (`RpcBatch` is a transparent `Vec`). async fn rpc_batch( client: &reqwest::Client, @@ -343,14 +367,11 @@ async fn test_private_room_thread_urls_use_t_segment() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc(&room_id, "main-thread", "private post via web"); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "main-thread"), - ("text", "private post via web"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -404,14 +425,15 @@ async fn test_private_room_post_links_use_private_garden_routes() { .to_string(); let (room_short, room_slug) = room_id.split_once('/').unwrap(); + let rpc = ui_post_ingest_rpc( + &room_id, + "garden-thread", + "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n", + ); let post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "garden-thread"), - ("text", "~/secret/item {classified}\n~/secret/other {other body}\n~/secret/item 3:1 ~/secret/other {because}\n"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -449,15 +471,11 @@ async fn test_post_check_returns_targeted_js_error_for_missing_thread_tag() { .unwrap(); let bearer = test_bearer(); + let rpc = ui_check_ingest_rpc("public", "", "hello", "thread-compose-errors"); let resp = client - .post(format!("http://{addr}/post/check")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", "public"), - ("thread_tag", ""), - ("text", "hello"), - ("error_target", "thread-compose-errors"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); @@ -553,14 +571,11 @@ async fn test_sse_stream_emits_evalable_js_after_post() { .unwrap(); assert!(sse_resp.status().is_success()); + let rpc = ui_post_ingest_rpc(&room_id, "live-thread", "hello over sse"); let _post = client - .post(format!("http://{addr}/post")) + .post(format!("http://{addr}/ui")) .header("Authorization", format!("Bearer {bearer}")) - .form(&[ - ("room", room_id.as_str()), - ("thread_tag", "live-thread"), - ("text", "hello over sse"), - ]) + .form(&[("__rpc__", rpc.as_str())]) .send() .await .unwrap(); diff --git a/test/walkthrough_fixture.clj b/test/walkthrough_fixture.clj index ec7914464b1a0389e40c5be53af59cf8ed82b09e..4b814822029c913e38151ca53848d1c64fb58373 100644 --- a/test/walkthrough_fixture.clj +++ b/test/walkthrough_fixture.clj @@ -52,22 +52,28 @@ "~/secret/item {classified}\n" "~/secret/other {secondary}\n" "~/secret/item 3:1 ~/secret/other {because}\n") + rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text wall-text}) post-resp (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text wall-text} + (str base-url "/ui") + {:__rpc__ rpc} :headers {"Authorization" (str "Bearer " alice-token)})] (assert! (= 200 (:status post-resp)) "seed post must succeed")) (let [bob-reply (str "Bob here — reply with another long block so the thread has multiple cards.\n\n" "Paragraph two: repeating slugs ~/secret/item and ~/secret/other for cross-post link styling. " "If everything wraps cleanly, monospace pre + serif body (in craft theme) should still feel readable.\n\n" "More overflow: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n") + bob-rpc (json/generate-string + {:action "post_ingest" + :room room-id + :thread_tag "walkthrough-thread" + :text bob-reply}) bob-post (oauth/http-post-form - (str base-url "/post") - {:room room-id - :thread_tag "walkthrough-thread" - :text bob-reply} + (str base-url "/ui") + {:__rpc__ bob-rpc} :headers {"Authorization" (str "Bearer " bob-token)})] (assert! (= 200 (:status bob-post)) "seed reply post must succeed")) {:users {:alice {:token alice-token}