Side B introduces a substantial, reusable architecture (a generic form-template/hole-filling system plus a unified `/ui` HTML action endpoint) that refactors duplicated POST handlers into shared functions and adds meaningful new tests, delivering lasting design value. Side A is a smaller, focused refactor (Deque→List/Vec with query-time capping) that fixes a real inefficiency but has much narrower scope and impact than B's endpoint/template infrastructure.
constitution · epochs · watch · epoch 3
comparison
c_a896b2dc05d5 (tommy-mor) vs c_48edc893c5b0 (tommy-mor)
download prompt · raw event · cmp_e7e69dd9613603
council reasoning
B adds lasting UI architecture: a tested form_template hole-fill layer, HtmlUiAction + parse path, POST /ui dispatch, and shared web_post runners, enabling progressive form expansion rather than only refactoring existing endpoints. A is a sound but narrower storage cleanup (Deque→List/Vec, drop write-time trim_recent_votes, cap on read + one test) that simplifies projections without introducing comparable new capability.
Side B adds a substantial new UI command infrastructure: a unified `POST /ui` endpoint, typed `HtmlUiAction` parsing from JSON form templates with `$form` substitution, reusable web-post handlers, new routing, and tests, enabling broader browser interactions with shared server logic. Side A refactors recent-vote storage from a deque to an append-only list with query-time capping and removes write-time trimming, which is a meaningful storage design change, but its scope is narrower than the new reusable UI architecture introduced in Side B.
sides
A — c_a896b2dc05d5 (tommy-mor)
message
[1531154d] dequeue -> vec
diff preview
diff --git a/server/src/projection_apply.rs b/server/src/projection_apply.rs
index 9c8990a8af927f35d3344c8d0872a516aba56b86..ad404bacb8bcdd5ae0e682cff97f974fd44528ea 100644
--- a/server/src/projection_apply.rs
+++ b/server/src/projection_apply.rs
@@ -6,8 +6,6 @@
//! batch as the (non-idempotent) edge merges guarantees exactly-once application
//! across replay.
-use std::collections::BTreeSet;
-
use crate::{
event_log::EventLogError,
events::{Event, EventRecord},
@@ -44,7 +42,6 @@ pub fn apply_records(
let db = projection_store.db();
let mut batch = db.batch();
- let mut vote_parents: BTreeSet<ItemId> = BTreeSet::new();
let mut last_seq = 0u64;
for record in records {
@@ -70,7 +67,6 @@ pub fn apply_records(
*ts,
)
.map_err(|e| EventLogError::Apply(e.to_string()))?;
- vote_parents.insert(parent);
}
Event::NodeEnsured { id } => {
let parsed = parse_event_id(id)?;
@@ -85,11 +81,5 @@ pub fn apply_records(
.commit_with(durable::Durability::DisableWal)
.map_err(|e| EventLogError::Apply(e.to_string()))?;
- for parent in vote_parents {
- projection_store
- .trim_recent_votes(&parent)
- .map_err(|e| EventLogError::Apply(e.to_string()))?;
- }
-
Ok(())
}
diff --git a/server/src/projection_store.rs b/server/src/projection_store.rs
index 8576d671f351004426207894ac35594ddb0f70cf..9a8953d010029d3639dc3987687554bab8b7663e 100644
--- a/server/src/projection_store.rs
+++ b/server/src/projection_store.rs
@@ -18,7 +18,7 @@ use crate::{
const PROJECTION_CURSOR_KEY: &str = "cursor";
const PROJECTION_SCHEMA_KEY: &str = "schema_version";
-const PROJECTION_SCHEMA_VERSION: u64 = 3;
+const PROJECTION_SCHEMA_VERSION: u64 = 4;
#[derive(Debug, thiserror::Error)]
pub enum ProjectionStoreError {
@@ -142,16 +142,6 @@ impl ProjectionStore {
Ok(tree)
}
- /// Cap a node's recent-vote window after applying votes (best-effort, blind).
- pub(crate) fn trim_recent_votes(&self, parent: &ItemId) -> Result<(), ProjectionStoreError> {
- node(parent).recent_votes().truncate_back(
- &self.db,
- crate::storage_schema::RECENT_VOTES_CAP,
- Durability::DisableWal,
- )?;
- Ok(())
- }
-
/// Cache Reddit display content outside the event log (must be evicted per policy).
pub fn put_ephemeral_content(
&self,
diff --git a/server/src/reducer.rs b/server/src/reducer.rs
index 0c75c85150bb9e5f578bbadf58b3e43f8a80be4b..759918b8c0eb8f8bf1ed0911d8877adaa55c8ea6 100644
--- a/server/src/reducer.rs
+++ b/server/src/reducer.rs
@@ -1,4 +1,4 @@
-use std::collections::{HashMap, HashSet, VecDeque};
+use std::collections::{HashMap, HashSet};
use serde::{Deserialize, Serialize};
@@ -52,7 +52,7 @@ pub struct GroupState {
pub idx_to_item: Vec<ItemId>,
pub edges: HashMap<(usize, usize), f64>,
pub voted_pairs: HashSet<(usize, usize)>,
- pub recent_votes: VecDeque<VoteData>,
+ pub recent_votes: Vec<VoteData>,
}
impl GroupState {
@@ -62,7 +62,7 @@ impl GroupState {
idx_to_item: Vec::new(),
edges: HashMap::new(),
voted_pairs: HashSet::new(),
- recent_votes: VecDeque::with_capacity(200),
+ recent_votes: Vec::new(),
}
}
@@ -111,10 +111,7 @@ impl GroupState {
self.add_edge_weight(b_idx, a_idx, w_a);
self.add_edge_weight(a_idx, b_idx, w_b);
- self.recent_votes.push_front(vote);
- while self.recent_votes.len() > 200 {
- self.recent_votes.pop_back();
- }
+ self.recent_votes.push(vote);
}
}
diff --git a/server/src/storage_dto.rs b/server/src/storage_dto.rs
index 9dfb13c53efe4389277625a6ab3bfc18f566a453..3fd6db5cb909ac4896bd8a3ecace796de5f08781 100644
--- a/server/src/storage_dto.rs
+++ b/server/src/storage_dto.rs
@@ -39,7 +39,7 @@ pub struct StoredEntityDataV1 {
pub link_url: Option<String>,
}
-/// One vote stored in a node's `recent_votes` deque.
+/// One vote stored in a node's `recent_votes` list.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct StoredVoteV1 {
pub version: u32,
diff --git a/server/src/storage_schema.rs b/server/src/storage_schema.rs
index bd26e665e084b95b10fdfff091c31e8dc84d07b8..5d2bb1d56927fb61c7c6d2d8602bd6882327f862 100644
--- a/server/src/storage_schema.rs
+++ b/server/src/storage_schema.rs
@@ -2,13 +2,13 @@
//! durable collections instead of one blob per node.
//!
//! A vote updates a handful of keys: a few edge-weight merges, a voted-pair flag,
-//! a recent-vote deque push, and child-link set entries. The in-memory
+//! a recent-vote list append, and child-link set entries. The in-memory
//! [`crate::reducer::GroupState`] is reconstructed from these keys on read for
//! rank-centrality.
use std::collections::{BTreeSet, HashMap, HashSet};
-use durable::{Batch, Db, Deque, Durable, Leaf, Map, Sum};
+use durable::{Batch, Db, Durable, Leaf, List, Map, Sum};
use crate::{
path_types::ItemId,
@@ -38,8 +38,8 @@ pub struct NodeSchema {
pub edges: Map<EdgeKey, Sum<f64>>,
/// Voted pairs `(min, max) -> true`.
pub voted_pairs: Map<PairKey, Leaf<bool>>,
- /// Recent votes, newest at the front (capped on write).
- pub recent_votes: Deque<Leaf<StoredVoteV1>>,
+ /// Recent votes, append-only oldest-first (cap applied on read).
+ pub recent_votes: List<Leaf<StoredVoteV1>>,
/// When ephemeral Reddit display content was last fetched (ms); absent after eviction.
pub fetched_at: Leaf<i64>,
}
@@ -55,7 +55,7 @@ pub struct Store {
pub view_meta: Map<String, Leaf<u64>>,
}
-/// Cap on the per-node recent-vote window (matches the in-memory reducer).
+/// Max recent votes returned when loading a node (query-time cap only).
pub const RECENT_VOTES_CAP: u64 = 200;
fn id_key(id: &ItemId) -> String {
@@ -148,11 +148,14 @@ fn build_group_state(
}
}
- // Deque is front=newest; in-memory VecDeque is also front=newest.
- let mut recent_votes = std::collections::VecDeque::new();
- for stored in np.recent_votes().iter(db)? {
- recent_votes.push_back(decode_vote(stored).map_err(durable::Error::Deserialize)?);
- }
+ // List is index order (oldest first); keep the newest RECENT_VOTES_CAP entries.
+ let stored = np.recent_votes().iter(db)?;
+ let cap = RECENT_VOTES_CAP as usize;
+ let start = stored.len().saturating_sub(cap);
+ let recent_votes = stored[start..]
+ .iter()
+ .map(|s| decode_vote(s.clone()).map_err(durable::Error::Deserialize))
+ .collect::<Result<Vec<_>, _>>()?;
Ok(GroupState {
item_to_idx,
@@ -248,7 +251,7 @@ pub fn vote_writes(
};
batch.write(pnode.voted_pairs().key(&(lo, hi)).set(&true));
- // Recent votes (newest at front).
+ // Recent votes (append-only; cap on read).
let stored = encode_vote(&VoteData {
ts,
a: a_id,
@@ -260,7 +263,7 @@ pub fn vote_writes(
delegate: None,
thread_tag: "default".to_string(),
});
- batch.push_front(&pnode.recent_votes(), &stored)?;
+ batch.push(&pnode.recent_votes(), &stored)?;
Ok(())
}
@@ -314,6 +317,35 @@ mod tests {
assert!(load_node_state(&db, &parent).unwrap().is_none());
}
+ #[test]
+ fn load_caps_recent_votes_at_query_time() {
+ let dir = tempfile::tempdir().unwrap();
+ let db = Db::open(dir.path()).unwrap();
+ let parent = ItemId::root();
+
+ let mut batch = db.batch();
+ for i in 0..RECENT_VOTES_CAP + 10 {
+ vote_writes(&mut batch, &parent, "alpha", "beta", 1, 0, i as i64).unwrap();
+ }
+ batch.commit().unwrap();
+
+ assert_eq!(
+ node(&parent).recent_votes().len(&db).unwrap(),
+ RECENT_VOTES_CAP + 10
+ );
+
+ let node_state = load_node_state(&db, &parent).unwrap().unwrap();
+ assert_eq!(node_state.local_ranking.recent_votes.len(), RECENT_VOTES_CAP as usize);
+ assert_eq!(
+ node_state.local_ranking.recent_votes.first().map(|v| v.ts),
+ Some(10)
+ );
+ assert_eq!(
+ node_state.local_ranking.recent_votes.last().map(|v| v.ts),
+ Some(RECENT_VOTES_CAP as i64 + 9)
+ );
+ }
+
#[test]
fn missing_node_is_none() {
let dir = tempfile::tempdir().unwrap();
B — c_48edc893c5b0 (tommy-mor)
message
[3f35edab] progress
diff preview
diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index a10ce662105cff8fad949c6b83f7035ce79bed18..a986f706ea4b261cbaf004c02b4cf84184b41371 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -3,6 +3,7 @@ mod helpers;
mod rpc;
mod stream;
mod validate;
+mod ui_html;
mod web_post;
pub use auth::{
@@ -33,6 +34,7 @@ pub use stream::{get_html_stream, get_stream};
pub use validate::{normalize_room_and_thread, validate_ingest_document, ValidatedIngest};
+pub use ui_html::post_ui_html;
pub use web_post::{check_web_ingest, post_web_ingest, post_web_redact};
#[cfg(test)]
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
new file mode 100644
index 0000000000000000000000000000000000000000..2b40a72059981d558768f73d189b991f3448c257
--- /dev/null
+++ b/server/src/api/ui_html.rs
@@ -0,0 +1,139 @@
+//! Single `POST /ui` entry for browser [`crate::html::ui_action::HtmlUiAction`] (JSON in `__rpc__` + holes).
+
+use axum::{
+ body::Body,
+ extract::State,
+ http::{header, HeaderMap, StatusCode},
+ response::{IntoResponse, Response},
+ Form,
+};
+use axum_extra::extract::cookie::CookieJar;
+use std::collections::HashMap;
+
+use crate::{
+ api::{
+ auth::optional_principal,
+ web_post::{run_check_web_ingest, run_post_web_ingest, run_post_web_redact, WebPostForm, WebRedactForm},
+ },
+ html::{
+ fragment_public_new_thread_form, fragment_room_new_thread_form, login_to_post_hint_markup,
+ parse_html_ui_from_form, user_can_post_room, user_can_view_room, HtmlUiAction, JsBuilder,
+ ThreadNav,
+ },
+ state::AppState,
+};
+
+pub async fn post_ui_html(
+ State(state): State<AppState>,
+ headers: HeaderMap,
+ jar: CookieJar,
+ Form(form): Form<HashMap<String, String>>,
+) -> impl IntoResponse {
+ let action = match parse_html_ui_from_form(&form) {
+ Ok(a) => a,
+ Err(e) => return ui_js_warn(&e.to_string()).into_response(),
+ };
+
+ match action {
+ HtmlUiAction::PostIngest {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ } => {
+ run_post_web_ingest(
+ &state,
+ &headers,
+ &jar,
+ WebPostForm {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ },
+ )
+ .await
+ }
+ HtmlUiAction::CheckIngest {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ } => {
+ run_check_web_ingest(
+ &state,
+ &headers,
+ &jar,
+ WebPostForm {
+ room,
+ thread_tag,
+ text,
+ error_target,
+ form_id,
+ },
+ )
+ .await
+ }
+ HtmlUiAction::RedactPost { post_id } => {
+ run_post_web_redact(&state, &headers, &jar, WebRedactForm { post_id }).await
+ }
+ HtmlUiAction::ExpandPublicNewThreadForm => {
+ let reduced = state.reduced.read().await;
+ let user = optional_principal(&headers, &jar, &reduced);
+ drop(reduced);
+ let markup = if user.is_some() {
+ fragment_public_new_thread_form(true)
+ } else {
+ login_to_post_hint_markup()
+ };
+ JsBuilder::new()
+ .morph_selector("#public-new-thread-ui-slot", markup)
+ .into_response()
+ }
+ HtmlUiAction::ExpandRoomNewThreadForm { room_wire } => {
+ let room_wire = room_wire.trim().to_string();
+ if room_wire.is_empty() {
+ return ui_js_warn("missing room").into_response();
+ }
+ let reduced = state.reduced.read().await;
+ let user = optional_principal(&headers, &jar, &reduced);
+ if !reduced.rooms.contains(&room_wire) {
+ drop(reduced);
+ return ui_js_warn("room not found").into_response();
+ }
+ if !user_can_view_room(&reduced, &room_wire, user.as_deref()) {
+ drop(reduced);
+ return ui_js_warn("forbidden").into_response();
+ }
+ let can_post = user
+ .as_ref()
+ .map(|u| user_can_post_room(&reduced, &room_wire, u))
+ .unwrap_or(false);
+ drop(reduced);
+ let Some(nav) = ThreadNav::from_room_id(&room_wire) else {
+ return ui_js_warn("bad room").into_response();
+ };
+ let markup = if can_post {
+ fragment_room_new_thread_form(&nav, true)
+ } else {
+ login_to_post_hint_markup()
+ };
+ JsBuilder::new()
+ .morph_selector("#room-new-thread-ui-slot", markup)
+ .into_response()
+ }
+ }
+}
+
+fn ui_js_warn(msg: &str) -> Response {
+ use crate::html::js_string_literal;
+ let js = format!("console.warn({});", js_string_literal(msg));
+ Response::builder()
+ .status(StatusCode::OK)
+ .header(header::CONTENT_TYPE, "text/javascript; charset=utf-8")
+ .body(Body::from(js))
+ .unwrap()
+}
diff --git a/server/src/api/web_post.rs b/server/src/api/web_post.rs
index a64010e382d3039821c836a5529adad0fe67cce5..265025f41ff1548d05b2d2d5d84202245388053f 100644
--- a/server/src/api/web_post.rs
+++ b/server/src/api/web_post.rs
@@ -222,8 +222,18 @@ pub async fn post_web_redact(
jar: CookieJar,
Form(form): Form<WebRedactForm>,
) -> impl IntoResponse {
+ run_post_web_redact(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`].
+pub(crate) async fn run_post_web_redact(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebRedactForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -239,8 +249,8 @@ pub async fn post_web_redact(
return js_redirect("/login").into_response();
};
- match rpc_post_redact(&state, &headers, form.post_id).await {
- Ok(RpcResult::RedactPostOk {}) => redact_success_response(&state).await.into_response(),
+ match rpc_post_redact(state, headers, form.post_id).await {
+ Ok(RpcResult::RedactPostOk {}) => redact_success_response(state).await.into_response(),
Ok(_) => (StatusCode::BAD_REQUEST, "unexpected response").into_response(),
Err((msg, hint)) => {
let detail = hint.as_deref().unwrap_or("");
@@ -255,8 +265,18 @@ pub async fn post_web_ingest(
jar: CookieJar,
Form(form): Form<WebPostForm>,
) -> impl IntoResponse {
+ run_post_web_ingest(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).
+pub(crate) async fn run_post_web_ingest(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebPostForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -282,8 +302,8 @@ pub async fn post_web_ingest(
.into_response();
}
- match rpc_post_with_bearer(&state, &bearer, room.clone(), thread_tag.clone(), text).await {
- Ok(RpcResult::PostOk { .. }) => post_success_response(&state, &form, &headers, &jar)
+ match rpc_post_with_bearer(state, &bearer, room.clone(), thread_tag.clone(), text).await {
+ Ok(RpcResult::PostOk { .. }) => post_success_response(state, &form, headers, jar)
.await
.into_response(),
Ok(_) => form_js_error(&form, "unexpected response", "Post did not return PostOk.").into_response(),
@@ -297,8 +317,18 @@ pub async fn check_web_ingest(
jar: CookieJar,
Form(form): Form<WebPostForm>,
) -> impl IntoResponse {
+ run_check_web_ingest(&state, &headers, &jar, form).await
+}
+
+/// Shared with [`crate::api::ui_html::post_ui_html`] (`POST /ui`).
+pub(crate) async fn run_check_web_ingest(
+ state: &AppState,
+ headers: &HeaderMap,
+ jar: &CookieJar,
+ form: WebPostForm,
+) -> Response {
let reduced = state.reduced.read().await;
- let Some(_username) = optional_principal(&headers, &jar, &reduced) else {
+ let Some(_username) = optional_principal(headers, jar, &reduced) else {
drop(reduced);
return js_redirect("/login").into_response();
};
@@ -324,7 +354,7 @@ pub async fn check_web_ingest(
return js_clear_errors(&form_error_target(&form)).into_response();
}
- match rpc_check_with_bearer(&state, &bearer, room, form.text.clone()).await {
+ match rpc_check_with_bearer(state, &bearer, room, form.text.clone()).await {
Ok(RpcResult::CheckOk { .. }) => js_clear_errors(&form_error_target(&form)).into_response(),
Ok(_) => form_js_error(&form, "unexpected response", "Check did not return CheckOk.").into_response(),
Err((msg, hint)) => form_js_error(&form, &msg, hint.as_deref().unwrap_or("")).into_response(),
diff --git a/server/src/form_template.rs b/server/src/form_template.rs
new file mode 100644
index 0000000000000000000000000000000000000000..3709c2c09a859da006e4af173413d5d235bc19be
--- /dev/null
+++ b/server/src/form_template.rs
@@ -0,0 +1,142 @@
+//! Plan2-style JSON templates with `{"$form": "field_name"}` holes, filled from
+//! `application/x-www-form-urlencoded` (or any `String` → `String` map) **before**
+//! deserializing into a typed struct.
+//!
+//! # Wire format
+//!
+//! Templates are **compact JSON** (`serde_json::to_string`): one line, no pretty
+//! printing, strings escaped per JSON rules (`\"`, `\n`, etc.). Embed that string
+//! in HTML attributes or text nodes with normal HTML escaping (e.g. maud), not
+//! bespoke encodings.
+//!
+//! # Power vs flat hidden fields
+//!
+//! A form is always a string→string map. You can fake depth with dotted keys (`a.b.c`),
+//! but one structured blob (`__rpc__` = compact JSON) gives you nested objects,
+//! arrays, and optional fields without inventing a new naming scheme each time.
+//!
+//! # Security
+//!
+//! Substitution runs **before** `serde` into your command type. It does not fix
+//! authorization: if the client can replace the hidden `__rpc__` value, they can
+//! change the command shape unless you validate (signed blob, server-side session
+//! context, or treat the blob as hints only). Same threat model as any hidden field.
+
+use serde::Serialize;
+use serde_json::Value;
+use std::collections::HashMap;
+
+/// Serialize a value to compact JSON for a hidden `__rpc__` (or similar) field.
+pub fn template_json_compact<T: Serialize>(v: &T) -> serde_json::Result<String> {
+ serde_json::to_string(v)
+}
+
+/// Recursively walk the JSON AST and replace `{"$form": "key"}` with the submitted
+/// string for `key` (empty if missing). Other keys are unchanged.
+pub fn substitute_form_vars(val: &mut Value, form_data: &HashMap<String, String>) {
+ match val {
+ Value::Object(map) => {
+ if map.len() == 1 {
+ if let Some(Value::String(field_name)) = map.get("$form") {
+ let submitted = form_data
+ .get(field_name.as_str())
+ .map(|s| s.as_str())
+ .unwrap_or("");
+
… preview truncated; 13,273 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.