constitution · epochs · watch · epoch 3

comparison

c_94135a1c4c58 (tommy-mor) vs c_c124c217f89c (tommy-mor)

download prompt · raw event · cmp_ede0900796b5d1

council reasoning

~anthropic/claude-sonnet-latest · winner A · 6:4 · permalink

A fixes a real security bug (votes silently falling back to anonymous instead of failing closed), adds tests for the sanitize/redirect logic, pins the durable dependency to an immutable rev instead of a mutable branch, and adds Secure-cookie support plus nav UX—concrete, verifiable hardening. B adds a substantial Reddit fetch worker with real logic (rate-limiting, OAuth, caching) which is useful, but is less critical to correctness/security and includes a stray 'todo' file and unrelated .gitignore tweak, making it slightly less polished/cohesive than A's tightly scoped security fix.

~x-ai/grok-latest · winner A · 2:1 · permalink

A delivers lasting security/correctness: fail-closed vote actors (no anon fallback), mock-OAuth gating, Secure cookies, tighter return-to sanitization with tests, plus dependency pinning—directly protecting vote integrity. B’s Reddit broker is a real feature with worker/rate-limit/OAuth design and tests, but it is product surface on top of stubs rather than core integrity fixes, and it also carries minor noise (.env gitignore, todo file).

openai/gpt-chat-latest · winner A · 4:1 · permalink

Side A delivers durable security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain conditional Secure handling, open-redirect sanitization is tightened and tested, mock OAuth is gated behind an explicit environment flag, and the durable dependency is pinned by immutable revision. Side B adds substantial Reddit import infrastructure with background fetching, OAuth support, and parsing, but it is largely new feature code with a TODO trail, whereas Side A fixes authentication and reproducibility issues that have broader long-term impact on project integrity.

sides

A — c_94135a1c4c58 (tommy-mor)

message

[880eb778] Harden auth: fail-closed votes, mock OAuth gate, Secure cookies.

Also show the current alias in the top nav and pin durable by rev.

Co-authored-by: Cursor <cursoragent@cursor.com>

diff preview

diff --git a/AGENTS.md b/AGENTS.md
index babb889d6fbfb1fa7176c9e6b7544ae17b61dd2e..6e0fd8ebb65d665c9c1438e3275971d62b98fd95 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,11 +10,11 @@ Single Rust web app **`sorter2-server`**: pairwise voting, rank-centrality ranki
 
 - **Bootstrap script**: `./scripts/cursor-env-install.sh` (also run via `.cursor/environment.json` on Cloud Agent boot) installs Playwright Chromium, Babashka, bbin, `clj-paren-repair`, and warms the RocksDB build.
 - **Rust 1.88+** is required (`rust-toolchain.toml`). The Cloud Dockerfile and `cursor-env-install.sh` install **rustup** 1.88.0 first so `cargo` works while Playwright/Clojure bootstrap continues. Do not rely on `/usr/local/cargo` (often missing or stale).
-- **RocksDB / `durable`**: Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS="-C linker=g++"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.
+- **RocksDB / `durable`**: `durable` is an external git dependency (`tommy-mor/durable`, pinned by rev in `server/Cargo.toml`). Ubuntu’s default `c++` is often **clang** without libc++ headers. Set **`CXX=g++`** and **`RUSTFLAGS="-C linker=g++"`** (or `CC=gcc`) before `cargo build` / `cargo test` — both are set in the bootstrap script and `.cursor/environment.json`.
 - **System packages** for builds: `build-essential`, `g++`, `clang`, `libclang-dev`, `pkg-config`, `libssl-dev`, `openjdk-21-jre-headless` (for `reqwest` / OpenSSL, `librocksdb-sys`, `zstd-sys` / bindgen, and **bbin** / Clojure JVM). The bootstrap sets **`JAVA_HOME`** when Java is present.
 - **Clojure CLI 1.12.0.1530** (used in CI): install from https://clojure.org/guides/install_clojure — needed for `./scripts/clj-test.sh` / Kaocha tests.
 - **Babashka / bbin / clj-paren-repair**: installed by `cursor-env-install.sh` into `~/.local/bin` (bb tasks in `bb.edn`, delimiter repair for Clojure edits).
-- **Playwright** (Spel browser tests in `test/vote_compare.clj`): Chromium via `clojure -M -e "(com.microsoft.playwright.CLI/main ...)"` — run once after clone or use the bootstrap script.
+- **Playwright** (Spel browser tests in `test/vote_compare.clj` / `test/auth_login.clj`): Chromium via `clojure -M -e "(com.microsoft.playwright.CLI/main ...)"` — run once after clone or use the bootstrap script.
 
 ### Commands (see also `TEST.sh`)
 
@@ -34,13 +34,17 @@ Environment variables (defaults in `server/src/state.rs`):
 - `PORT` — default `8080`
 - `SORTER2_DATA_DIR` — default `./data` (created on startup)
 - `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
+- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
 
 Health check: `GET /healthz` → `ok`.
 
-Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Example vote:
+Core UI flow: `POST /ui` with form field `__rpc__` (JSON). Votes require a session cookie (sign in via `/login`). Example vote:
 
 ```bash
 curl -sf -X POST http://127.0.0.1:8080/ui \
+  --cookie "sorter2_session=..." \
   --data-urlencode '__rpc__={"action":"record_vote","a":"alpha","b":"beta","ratio_left":2,"ratio_right":1}'
 ```
 
diff --git a/Cargo.lock b/Cargo.lock
index aa02997ad85777195f135bfd9456bcee0fc9a590..1f8690f3e486d099577a32c2ece48caf57ea7160 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -414,7 +414,7 @@ dependencies = [
 [[package]]
 name = "durable"
 version = "0.2.0"
-source = "git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
+source = "git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
 dependencies = [
  "ciborium",
  "durable-derive",
@@ -426,7 +426,7 @@ dependencies = [
 [[package]]
 name = "durable-derive"
 version = "0.2.0"
-source = "git+https://github.com/tommy-mor/durable.git?branch=main#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
+source = "git+https://github.com/tommy-mor/durable.git?rev=a6c14eaa809693140eea0c22b07ef24d8e74adaf#a6c14eaa809693140eea0c22b07ef24d8e74adaf"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index dfa39beddecfa37dcdeaa602cb30f4b547528fbb..bd88687fb0ba47d68f2c08eb5e11d0e08b7c4398 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -25,7 +25,7 @@ futures-util = { version = "0.3", default-features = false, features = ["std"] }
 rand = "0.8"
 urlencoding = "2"
 url = "2"
-durable = { git = "https://github.com/tommy-mor/durable.git", branch = "main" }
+durable = { git = "https://github.com/tommy-mor/durable.git", rev = "a6c14eaa809693140eea0c22b07ef24d8e74adaf" }
 
 [dev-dependencies]
 reqwest = { version = "0.12", features = ["json"] }
diff --git a/server/src/api/ui_html.rs b/server/src/api/ui_html.rs
index b86581b1f337650564274254d840e8a75b49524d..9da62ffbed07eb28729aa3160bf33b07ce0d7945 100644
--- a/server/src/api/ui_html.rs
+++ b/server/src/api/ui_html.rs
@@ -71,10 +71,16 @@ pub async fn post_ui_html(
                 return resp;
             }
             let parent = parent_from_scope(&scope);
-            let actor = resolve_vote_actor(
+            let actor = match resolve_vote_actor(
                 state.projection_store.db(),
                 session_id_from_jar(&jar).as_deref(),
-            );
+            ) {
+                Ok(actor) => actor,
+                Err(_) => {
+                    return vote_auth_redirect(&state, &jar)
+                        .unwrap_or_else(|| login_redirect_js().into_response());
+                }
+            };
             if let Err(e) = state
                 .record_vote(&parent, &a, &b, ratio_left, ratio_right, &actor)
                 .await
diff --git a/server/src/auth/config.rs b/server/src/auth/config.rs
index a1f042c655bf3e5234eeb87a7d889f64592807fb..a5976af9a52ea207b35ae87bd1fe927c47a477ca 100644
--- a/server/src/auth/config.rs
+++ b/server/src/auth/config.rs
@@ -1,9 +1,42 @@
 pub const AUTH_RETURN_COOKIE: &str = "sorter2_auth_return";
 
+/// Allow `mock_user` on `/auth/github` (test harness only).
+pub fn mock_oauth_allowed() -> bool {
+    matches!(
+        std::env::var("SORTER2_ALLOW_MOCK_OAUTH").as_deref(),
+        Ok("1") | Ok("true") | Ok("TRUE")
+    )
+}
+
+/// Set the Secure flag on auth cookies when serving over HTTPS.
+pub fn cookies_secure() -> bool {
+    std::env::var("SORTER2_BASE_URL")
+        .map(|u| u.starts_with("https://"))
+        .unwrap_or(false)
+}
+
 pub fn sanitize_return_to(raw: &str) -> String {
     let s = raw.trim();
-    if s.is_empty() || !s.starts_with('/') || s.starts_with("//") {
+    if s.is_empty() || !s.starts_with('/') || s.starts_with("//") || s.starts_with("/\\") {
+        return "/".to_string();
+    }
+    // Reject scheme-relative and protocol-smuggling forms.
+    if s.contains("://") || s.contains('\\') {
         return "/".to_string();
     }
     s.to_string()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sanitize_return_to_blocks_open_redirects() {
+        assert_eq!(sanitize_return_to(""), "/");
+        assert_eq!(sanitize_return_to("//evil.com"), "/");
+        assert_eq!(sanitize_return_to("/\\evil.com"), "/");
+        assert_eq!(sanitize_return_to("https://evil.com"), "/");
+        assert_eq!(sanitize_return_to("/vote?parent=x"), "/vote?parent=x");
+    }
+}
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5ed535ba199fa736f0048c32623b14c3b1e5de2d..d4a85ef52c15dc35148e4c743f0d646cbbdb056d 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -26,7 +26,7 @@ use crate::{
     ui_action::UI_RPC_FIELD,
 };
 
-pub use session::{resolve_vote_actor, session_id_from_jar, VoteActor};
+pub use session::{nav_pseudonym, resolve_vote_actor, session_id_from_jar, VoteActor};
 
 pub fn base_url_from_env(port: u16) -> String {
     std::env::var("SORTER2_BASE_URL")
@@ -168,6 +168,10 @@ pub async fn login_page(
         "login · sorter2",
         login_body(session.as_ref(), &aliases, &providers),
         state.views.get_views("/login"),
+        session
+            .as_ref()
+            .filter(|s| !s.pseudonym.trim().is_empty())
+            .map(|s| s.pseudonym.as_str()),
     );
     (jar, Html(markup.into_string())).into_response()
 }
@@ -222,6 +226,7 @@ pub async fn alias_page(
             "choose alias · sorter2",
             body,
             state.views.get_views("/login/alias"),
+            None,
         )
         .into_string(),
     )
@@ -237,7 +242,12 @@ pub async fn github_start(
         .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
     let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
     let state_token = session::new_oauth_state();
-    let url = oauth::authorize_url(&cfg, &state_token, query.mock_user.as_deref());
+    let mock_user = if config::mock_oauth_allowed() {
+        query.mock_user.as_deref()
+    } else {
+        None
+    };
+    let url = oauth::authorize_url(&cfg, &state_token, mock_user);
     let jar = jar
         .add(session::oauth_state_cookie_value(&state_token))
         .add(session::auth_return_cookie_value(&return_to));
diff --git a/server/src/auth/session.rs b/server/src/auth/session.rs
index 09659240b9455c6fca12db5652e1d31cf8c2acfc..41df030ded3abcafc0ab3887ab769adf103f9aa0 100644
--- a/server/src/auth/session.rs
+++ b/server/src/auth/session.rs
@@ -5,7 +5,7 @@ use durable::{Db, Durability};
 use rand::Rng;
 
 use crate::{
-    auth::config::AUTH_RETURN_COOKIE,
+    auth::config::{self, AUTH_RETURN_COOKIE},
     fetch::now_ms,
     identity::{DEFAULT_ACTOR_UUID, DEFAULT_PSEUDONYM},
     storage_dto::{SessionDataV1, SESSION_DATA_VERSION},
@@ -37,6 +37,7 @@ pub struct VoteActor {
 }
 
 impl VoteActor {
+    /// Test / bench helper: seed votes as the default pseudonym without a session.
     pub fn anon() -> Self {
         Self {
             pseudonym: DEFAULT_PSEUDONYM.to_string(),
@@ -70,20 +71,51 @@ fn hex_encode(bytes: &[u8]) -> String {
     bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
 
-pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> VoteActor {
-    let Some(session_id) = session_id else {
-        return VoteActor::anon();
-    };
-    let Ok(Some(session)) = load_session(db, session_id) else {
-        return VoteActor::anon();
-    };
-    if session.expires_at <= now_ms() {
-        return VoteActor::anon();
+fn build_cookie(name: &'static str, value: String) -> Cookie<'static> {
+    let mut builder = Cookie::build((name, value))
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .path("/");
+    if config::cookies_secure() {
+        builder = builder.secure(true);
+    }
+    builder.build()
+}
+
+fn clear_cookie(name: &'static str) -> Cookie<'static> {
+    let mut builder = Cookie::build((name, ""))
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .path("/")
+        .removal();
+    if config::cookies_secure() {
+        builder = builder.secure(true);
+    }
+    builder.build()
+}
+
+/// Resolve the vote actor from a live session. Fail-closed: never falls back to anon.
+pub fn resolve_vote_actor(db: &Db, session_id: Option<&str>) -> Result<VoteActor, &'static str> {
+    let session_id = session_id.ok_or("sign in to vote")?;
+    let session = load_valid_session(db, session_id).ok_or("session expired")?;
+    if !session_has_pseudonym(&session) {
+        return Err("choose an alias first");
     }
     let trust_weight = user_trust_weight(db, &session.uuid).unwrap_or(1.0);
-    VoteActor {
+    Ok(VoteActor {
         pseudonym: session.current_pseudonym,
         trust_weight,
+    })
+}
+
+/// Display name for the top nav, if any session is active.
+pub fn nav_pseudonym(db: &Db, jar: &CookieJar) -> Option<String> {
+    let sessio

… preview truncated; 10,040 characters omitted

download full diff A

B — c_c124c217f89c (tommy-mor)

message

[8d8230d1] reddit

diff preview

diff --git a/.gitignore b/.gitignore
index 4c7073f9fac0c30fd2050d79a60ef447af58ebeb..ada462e900d24a3a6d08165d158c80f79c35a5a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@
 data/
 repomix-output.xml
 dev-data/
+.env
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 7906a8547d56b8e6a48ef59c37aa82a8510fdee9..4677fedcb45292eebebe7e9cf6ce2f5738f18ddf 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -16,6 +16,7 @@ tower = "0.5"
 tower-http = { version = "0.5", features = ["trace"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+reqwest = { version = "0.12", features = ["json"] }
 
 [dev-dependencies]
 reqwest = { version = "0.12", features = ["json"] }
diff --git a/server/src/html/mod.rs b/server/src/html/mod.rs
index 2864407ed6e8ec284a1dc663acf1805534566b62..df6505021d9f446c2b453e20e3eb3cf696a111f9 100644
--- a/server/src/html/mod.rs
+++ b/server/src/html/mod.rs
@@ -272,5 +272,16 @@ pub async fn home(State(state): State<AppState>, uri: Uri) -> impl IntoResponse
 
 pub async fn browse(State(state): State<AppState>, uri: Uri) -> impl IntoResponse {
     let item = ItemId::from_browse_uri(uri.path()).unwrap_or(ItemId::root());
+    if item.as_str().starts_with("reddit.com") {
+        let needs_fetch = {
+            let tree = state.tree.read().await;
+            tree.get(&item)
+                .map(|n| n.data.is_none())
+                .unwrap_or(true)
+        };
+        if needs_fetch {
+            state.reddit.request_fetch(item.clone());
+        }
+    }
     item_page(state, uri, item).await
 }
diff --git a/server/src/reddit.rs b/server/src/reddit.rs
index d203dca09245daf869b3aa942898447700ae69fb..90053ad03b1d7c8e94f325dd4ee64c2b4f7da900 100644
--- a/server/src/reddit.rs
+++ b/server/src/reddit.rs
@@ -1,4 +1,12 @@
-//! Reddit API import (async, decoupled from UI request path).
+//! Reddit API import via a single background worker (rate limits, dedup, backoff).
+
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use reqwest::{header, Client, StatusCode};
+use serde::Deserialize;
+use tokio::sync::{mpsc, RwLock};
 
 use crate::{
     path_types::ItemId,
@@ -10,12 +18,401 @@ pub fn ensure_partial_tree(tree: &mut GlobalTree, id: &ItemId) {
     tree.ensure_path(id);
 }
 
-/// Placeholder for Reddit JSON import. Returns entity data when implemented.
-pub async fn fetch_reddit_entity(_id: &ItemId) -> Option<EntityData> {
-    None
+pub struct RedditCommand {
+    pub id: ItemId,
+}
+
+#[derive(Clone)]
+pub struct RedditBroker {
+    tx: mpsc::Sender<RedditCommand>,
+}
+
+#[derive(Clone)]
+struct RedditCredentials {
+    client_id: String,
+    client_secret: String,
+}
+
+struct OAuthToken {
+    access_token: String,
+    expires_at: Instant,
+}
+
+impl RedditBroker {
+    pub fn spawn(tree: Arc<RwLock<GlobalTree>>, user_agent: &str) -> Self {
+        let (tx, rx) = mpsc::channel(100);
+
+        let mut headers = header::HeaderMap::new();
+        headers.insert(
+            header::USER_AGENT,
+            header::HeaderValue::from_str(user_agent).expect("valid user agent"),
+        );
+
+        let client = Client::builder()
+            .default_headers(headers)
+            .timeout(Duration::from_secs(15))
+            .build()
+            .expect("reqwest client");
+
+        let creds = RedditCredentials::from_env();
+        tokio::spawn(reddit_worker(rx, tree, client, creds));
+
+        Self { tx }
+    }
+
+    /// Fire-and-forget: queue a fetch; worker updates the tree when done.
+    pub fn request_fetch(&self, id: ItemId) {
+        let _ = self.tx.try_send(RedditCommand { id });
+    }
+}
+
+impl RedditCredentials {
+    fn from_env() -> Option<Self> {
+        let client_id = std::env::var("REDDIT_CLIENT_ID").ok()?;
+        let client_secret = std::env::var("REDDIT_CLIENT_SECRET").ok()?;
+        if client_id.is_empty() || client_secret.is_empty() {
+            return None;
+        }
+        Some(Self {
+            client_id,
+            client_secret,
+        })
+    }
+}
+
+pub fn default_user_agent() -> String {
+    std::env::var("REDDIT_USER_AGENT").unwrap_or_else(|_| {
+        "web:sorter2.social:v0.0.1 (by /u/sorter2)".to_string()
+    })
 }
 
-/// Apply fetched entity data to a node (called from async worker).
-pub fn apply_entity(tree: &mut GlobalTree, id: &ItemId, data: EntityData) {
-    tree.set_entity_data(id, data);
+async fn reddit_worker(
+    mut rx: mpsc::Receiver<RedditCommand>,
+    tree: Arc<RwLock<GlobalTree>>,
+    client: Client,
+    creds: Option<RedditCredentials>,
+) {
+    let mut in_flight = HashSet::new();
+    let mut recently_fetched: HashMap<ItemId, Instant> = HashMap::new();
+    let mut current_delay = Duration::from_secs(1);
+    let mut oauth: Option<OAuthToken> = None;
+    let cache_ttl = Duration::from_secs(300);
+
+    while let Some(cmd) = rx.recv().await {
+        let now = Instant::now();
+        recently_fetched.retain(|_, t| now.duration_since(*t) < cache_ttl);
+
+        if in_flight.contains(&cmd.id) || recently_fetched.contains_key(&cmd.id) {
+            continue;
+        }
+
+        in_flight.insert(cmd.id.clone());
+        let fetch_id = cmd.id.clone();
+
+        tokio::time::sleep(current_delay).await;
+
+        if let Some(c) = &creds {
+            oauth = ensure_oauth_token(&client, c, oauth.take()).await;
+        }
+
+        let token = oauth.as_ref().map(|t| t.access_token.as_str());
+        let use_oauth = token.is_some();
+
+        match do_fetch(&client, &fetch_id, use_oauth, token).await {
+            Ok(FetchOutcome::Entity(data)) => {
+                let mut w = tree.write().await;
+                w.set_entity_data(&fetch_id, data);
+                recently_fetched.insert(fetch_id.clone(), Instant::now());
+                current_delay = Duration::from_millis(600);
+            }
+            Ok(FetchOutcome::NotFound) => {
+                recently_fetched.insert(fetch_id.clone(), Instant::now());
+            }
+            Ok(FetchOutcome::RateLimited { reset_secs }) => {
+                let wait = Duration::from_secs(reset_secs.max(1));
+                tracing::warn!(
+                    "Reddit rate limit for {}; sleeping {}s",
+                    fetch_id,
+                    wait.as_secs()
+                );
+                tokio::time::sleep(wait).await;
+                current_delay = (current_delay * 2).min(Duration::from_secs(60));
+            }
+            Err(e) => {
+                tracing::warn!("Reddit fetch failed for {}: {}", fetch_id, e);
+                current_delay = (current_delay * 2).min(Duration::from_secs(60));
+            }
+        }
+
+        in_flight.remove(&fetch_id);
+    }
+}
+
+enum FetchOutcome {
+    Entity(EntityData),
+    NotFound,
+    RateLimited { reset_secs: u64 },
+}
+
+async fn ensure_oauth_token(
+    client: &Client,
+    creds: &RedditCredentials,
+    existing: Option<OAuthToken>,
+) -> Option<OAuthToken> {
+    if let Some(t) = existing {
+        if Instant::now() < t.expires_at - Duration::from_secs(60) {
+            return Some(t);
+        }
+    }
+
+    let resp = client
+        .post("https://www.reddit.com/api/v1/access_token")
+        .basic_auth(&creds.client_id, Some(&creds.client_secret))
+        .form(&[("grant_type", "client_credentials")])
+        .send()
+        .await;
+
+    let resp = match resp {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("Reddit OAuth token request failed: {e}");
+            return None;
+        }
+    };
+
+    if !resp.status().is_success() {
+        tracing::warn!("Reddit OAuth token HTTP {}", resp.status());
+        return None;
+    }
+
+    #[derive(Deserialize)]
+    struct TokenResponse {
+        access_token: String,
+        expires_in: u64,
+    }
+
+    let body: TokenResponse = match resp.json().await {
+        Ok(b) => b,
+        Err(e) => {
+            tracing::warn!("Reddit OAuth token parse failed: {e}");
+            return None;
+        }
+    };
+
+    Some(OAuthToken {
+        access_token: body.access_token,
+        expires_at: Instant::now() + Duration::from_secs(body.expires_in),
+    })
+}
+
+async fn do_fetch(
+    client: &Client,
+    id: &ItemId,
+    use_oauth: bool,
+    bearer: Option<&str>,
+) -> Result<FetchOutcome, String> {
+    let url = map_item_to_reddit_api(id, use_oauth);
+    if url.is_empty() {
+        return Ok(FetchOutcome::NotFound);
+    }
+
+    let mut req = client.get(&url);
+    if let Some(token) = bearer {
+        req = req.bearer_auth(token);
+    }
+
+    let resp = req.send().await.map_err(|e| e.to_string())?;
+
+    if resp.status() == StatusCode::TOO_MANY_REQUESTS {
+        let reset = rate_limit_reset_secs(&resp);
+        return Ok(FetchOutcome::RateLimited { reset_secs: reset });
+    }
+
+    if resp.status() == StatusCode::SERVICE_UNAVAILABLE {
+        return Err("Reddit unavailable (503)".to_string());
+    }
+
+    if !resp.status().is_success() {
+        return Ok(FetchOutcome::NotFound);
+    }
+
+    if rate_limit_remaining(&resp) == Some(0) {
+        let reset = rate_limit_reset_secs(&resp);
+        return Ok(FetchOutcome::RateLimited { reset_secs: reset });
+    }
+
+    let bytes = resp.bytes().await.map_err(|e| e.to_string())?;
+    Ok(parse_reddit_json(id, &bytes)
+        .map(FetchOutcome::Entity)
+        .unwrap_or(FetchOutcome::NotFound))
+}
+
+fn rate_limit_remaining(resp: &reqwest::Response) -> Option<u64> {
+    resp.headers()
+        .get("x-ratelimit-remaining")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.parse::<f64>().ok())
+        .map(|f| f.floor() as u64)
+}
+
+fn rate_limit_reset_secs(resp: &reqwest::Response) -> u64 {
+    resp.headers()
+        .get("x-ratelimit-reset")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.parse::<f64>().ok())
+        .map(|f| f.ceil() as u64)
+        .unwrap_or(5)
+}
+
+/// Map canonical item id to Reddit JSON API URL.
+pub fn map_item_to_reddit_api(id: &ItemId, oauth: bool) -> String {
+    let path = id.as_str();
+    if !path.starts_with("reddit.com/") && path != "reddit.com" {
+        return String::new();
+    }
+
+    let base = if oauth {
+        "https://oauth.reddit.com"
+    } else {
+        "https://www.reddit.com"
+    };
+
+    let segments: Vec<&str> = path.split('/').collect();
+
+    if let Some(i) = segments.iter().position(|&p| p == "comments") {
+        if segments.len() > i + 1 {
+            let api_path = segments[1..=i + 1].join("/");
+            return format!("{base}/{api_path}.json?raw_json=1");
+        }
+    }
+
+    if segments.len() == 3 && segments[1] == "r" {
+        return format!("{base}/r/{}/about.json?raw_json=1", segments[2]);
+    }
+
+    String::new()
+}
+
+fn parse_reddit_json(id: &ItemId, bytes: &[u8]) -> Option<EntityData> {
+    let v: serde_json::Value = serde_json::from_slice(bytes).ok()?;
+    let segments: Vec<&str> = id.as_str().split('/').collect();
+
+    if segments.iter().any(|&p| p == "comments") {
+        parse_post_listing(&v)
+    } else {
+        parse_subreddit_about(&v)
+    }
+}
+
+fn parse_subreddit_about(v: &serde_json::Value) -> Option<EntityData> {
+    let data = v.get("data")?;
+    let title = data
+        .get("title")
+        .or_else(|| data.get("display_name"))
+        .and_then(|t| t.as_str())?
+        .to_string();
+    let body_html = data
+        .get("public_description_html")
+        .or_else(|| data.get("public_description"))
+        .and_then(|t| t.as_str())
+        .map(|s| s.to_string());
+    let thumb_url = data
+        .get("icon_img")
+        .or_else(|| data.get("community_icon"))
+        .and_then(|t| t.as_str())
+        .filter(|s| !s.is_empty())
+        .map(|s| s.to_string());
+
+    Some(EntityData {
+        title,
+        author: None,
+        body_html,
+        thumb_url,
+    })
+}
+
+fn parse_post_listing(v: 

… preview truncated; 4,570 characters omitted

download full diff B

Hardlinks — judgments / attempts / prompt

prompt download

judgments

attempts

Prompt text is loaded only by the download route.