Both commits are substantial feature additions with test coverage, but Side A's invite system introduces a coherent new capability (invite links, room audit, room timeline, thread system-lines) with a dedicated integration test and careful state/event handling, while Side B's OAuth-linking change (adding Reddit provider linking, UUID-canonical identity) is also solid but is more narrowly scoped to auth wiring and mock-server plumbing, with less new user-facing surface area. Side A's diff touches more of the system's core data model (reducer, timeline, RPC, CLI) providing broader lasting value than Side B's addition of a second OAuth provider to an existing linking mechanism.
constitution · epochs · watch · epoch 3
comparison
c_55f1cdf12e22 (tommy-mor) vs c_afa638171cf7 (tommy-mor)
download prompt · raw event · cmp_ee989217c9bd1a
council reasoning
A ships a full invite path (mint RPC, /join redemption wired through OAuth, multi-cap RoomGrant, RoomAudit, CLI, and invites.bb) plus thread timeline/system rows—real product surface with end-to-end tests. B improves identity design (UUID-canonical multi-provider link/conflict handling, Reddit OAuth, linked-provider privacy, batch trust-weight fix) but largely extends an existing OAuth/session model rather than adding comparable new capability.
Side A implements a substantial new room invitation and access-management workflow end to end: RPCs for minting invites and auditing grants, `/join/:token` redemption integrated into OAuth, capability grants, CLI support, new tests, and related API/type changes. Side B makes an important architectural improvement by making UUIDs the canonical identity and adding Reddit OAuth linking, but A delivers a broader user-facing capability with server, client, routing, state, and integration-test coverage despite some invite state remaining ephemeral.
sides
A — c_55f1cdf12e22 (tommy-mor)
message
[00be3a29] invite system
diff preview
diff --git a/bb.edn b/bb.edn
index 50be8232847e672b3f273a2fb25ddd1d12adb7e2..818f850765370d12d58f239e287764fc3649d78b 100644
--- a/bb.edn
+++ b/bb.edn
@@ -47,14 +47,16 @@
"RUST_LOG" "info"})})))}
test
- {:doc "Full test suite: integration + auth + grants"
+ {:doc "Full test suite: integration + auth + grants + invites"
:requires ([test.integration :as integration]
[test.auth :as auth]
- [test.grants :as grants])
+ [test.grants :as grants]
+ [test.invites :as invites])
:task (do
(integration/integration)
(auth/auth-test)
- (grants/grants-test))}
+ (grants/grants-test)
+ (invites/invites-test))}
perf
{:doc "Performance test: concurrent HTTP requests to detect blocking I/O"
diff --git a/cli/src/main.rs b/cli/src/main.rs
index e5833b0b93d8e667b94c574ba2b0f8cb758ff3df..8eda9f485bd1f7392f1e34be27176c21e20354eb 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -105,6 +105,23 @@ enum ScopedCmd {
#[arg(long)]
json: bool,
},
+
+ /// Mint a shareable invite link (24h TTL, in-memory until redeemed). Requires Manage on the room.
+ InviteLink {
+ /// Comma-separated: view, post, vote, add_item, manage
+ #[arg(long = "caps", value_delimiter = ',')]
+ caps: Vec<String>,
+ #[arg(long, default_value_t = 1)]
+ uses: usize,
+ #[arg(long)]
+ json: bool,
+ },
+
+ /// List principals granted access in this room (requires View or Manage)
+ Audit {
+ #[arg(long)]
+ json: bool,
+ },
}
#[derive(Subcommand, Debug)]
@@ -514,17 +531,35 @@ fn print_thread(resp: &ThreadDetailResponse) {
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_millis() as i64;
- if resp.total > resp.posts.len() {
- let end = resp.offset + resp.posts.len();
- eprintln!("# showing {}-{} of {} posts (--offset N --limit N to paginate)", resp.offset, end.saturating_sub(1), resp.total);
+ if resp.total > resp.items.len() {
+ let end = resp.offset + resp.items.len();
+ eprintln!(
+ "# showing {}-{} of {} rows (--offset N --limit N to paginate)",
+ resp.offset,
+ end.saturating_sub(1),
+ resp.total
+ );
}
- for (i, post) in resp.posts.iter().enumerate() {
- let timeago = slug_types::timeago::timeago_compact(now_ms, post.ts);
- let body = &post.body.trim();
- println!("<post index=\"{}\" timeago=\"{}\">", post.index, timeago);
- println!("{}", body);
- println!("</post>");
- if i + 1 < resp.posts.len() {
+ for (i, item) in resp.items.iter().enumerate() {
+ match item {
+ ThreadItem::Post {
+ index,
+ ts,
+ body,
+ ..
+ } => {
+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+ let body = body.trim();
+ println!("<post index=\"{}\" timeago=\"{}\">", index, timeago);
+ println!("{}", body);
+ println!("</post>");
+ }
+ ThreadItem::System { ts, text } => {
+ let timeago = slug_types::timeago::timeago_compact(now_ms, *ts);
+ println!("<system timeago=\"{}\">{}</system>", timeago, text.trim());
+ }
+ }
+ if i + 1 < resp.items.len() {
println!();
println!();
}
@@ -1036,6 +1071,95 @@ async fn run_scoped(base: &str, room: &str, sub: ScopedCmd) -> Result<()> {
}
}
},
+ ScopedCmd::InviteLink { caps, uses, json } => {
+ let caps: Vec<String> = caps
+ .into_iter()
+ .flat_map(|s| {
+ s.split(',')
+ .map(|p| p.trim().to_lowercase())
+ .filter(|p| !p.is_empty())
+ .collect::<Vec<_>>()
+ })
+ .collect();
+ if caps.is_empty() {
+ return Err(anyhow!("--caps is required (e.g. --caps view,post,vote)"));
+ }
+ let bearer = effective_bearer().ok_or_else(|| {
+ anyhow!(
+ "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+ then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+ )
+ })?;
+ let batch = send_rpc(
+ &client,
+ base,
+ Some(&bearer),
+ vec![RpcCommand::RoomMintInvite {
+ room: room.to_string(),
+ capabilities: caps,
+ max_uses: uses,
+ }],
+ )
+ .await?;
+ match rpc_line_ok(&batch.results[0])? {
+ RpcResult::RoomInviteMinted {
+ invite_url,
+ expires_at_ms,
+ max_uses,
+ } => {
+ if json {
+ println!(
+ "{}",
+ serde_json::to_string_pretty(&serde_json::json!({
+ "invite_url": invite_url,
+ "expires_at_ms": expires_at_ms,
+ "max_uses": max_uses,
+ }))?
+ );
+ } else {
+ println!("{invite_url}");
+ println!("(Expires in 24 hours. Max uses: {max_uses})");
+ }
+ }
+ _ => return Err(anyhow!("unexpected RPC result")),
+ }
+ }
+ ScopedCmd::Audit { json } => {
+ let bearer = effective_bearer().ok_or_else(|| {
+ anyhow!(
+ "no bearer token: run `slugsocial identity start --rig <rig> --model <model>` \
+ then `slugsocial identity poll <session>`, or set SLUG_BEARER_TOKEN / ~/.config/slugsocial/token"
+ )
+ })?;
+ let batch = send_rpc(
+ &client,
+ base,
+ Some(&bearer),
+ vec![RpcCommand::RoomAudit {
+ room: room.to_string(),
+ }],
+ )
+ .await?;
+ match rpc_line_ok(&batch.results[0])? {
+ RpcResult::RoomAudit(resp) => {
+ if json {
+ println!("{}", serde_json::to_string_pretty(&resp)?);
+ } else {
+ println!("room {}", resp.room);
+ if resp.grants.is_empty() {
+ println!("(no grants recorded)");
+ } else {
+ let w_user = resp.grants.iter().map(|g| g.username.len()).max().unwrap_or(0);
+ for g in &resp.grants {
+ let caps = g.capabilities.join(", ");
+ println!("{:<width$} {}", g.username, caps, width = w_user.max(8));
+ }
+ }
+ }
+ }
+ _ => return Err(anyhow!("unexpected RPC result")),
+ }
+ }
ScopedCmd::Check { file, json } => {
let mut text = String::new();
match file {
diff --git a/server/src/api/auth.rs b/server/src/api/auth.rs
index 995ce4a61d29b024c399c656134f541ecfd880cf..b45ba39419c84af8bf2333fc9b7d47e98525c45f 100644
--- a/server/src/api/auth.rs
+++ b/server/src/api/auth.rs
@@ -12,12 +12,61 @@ use tokio::sync::RwLock;
use crate::{
api::helpers::{api_error, now_ms, sha256_hex},
- events::{Event, TokenIssued, UserRegistered},
+ events::{Event, GrantAdded, TokenIssued, UserRegistered},
identity::{parse_agent, parse_username},
html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},
state::{AppState, PendingSession},
};
+/// Delegate id for browser users who land via `/join/inv_…` (no CLI agent).
+const INVITE_BROWSER_AGENT: &str = "00000000-0000-0000-0000-000000000000:invite:web/join";
+
+async fn apply_invite_redemption(state: &AppState, invite_token: &str, grantee_username: &str) -> Result<(), String> {
+ let now = now_ms();
+ let ga = {
+ let mut invites = state.invites.write().await;
+ let Some(inv) = invites.get_mut(invite_token) else {
+ return Err("invite not found".into());
+ };
+ if now > inv.expires_at_ms {
+ invites.remove(invite_token);
+ return Err("invite expired".into());
+ }
+ if inv.current_uses >= inv.max_uses {
+ return Err("invite exhausted".into());
+ }
+ inv.current_uses += 1;
+ Event::GrantAdded(GrantAdded {
+ ts: now,
+ room_id: inv.room_id.clone(),
+ username: grantee_username.to_string(),
+ capabilities: inv.capabilities.clone(),
+ granted_by: inv.inviter.clone(),
+ })
+ };
+
+ match state.event_log.append(&ga).await {
+ Ok(()) => {
+ let mut reduced = state.reduced.write().await;
+ reduced.apply_event(ga);
+ let mut invites = state.invites.write().await;
+ if let Some(inv) = invites.get(invite_token) {
+ if inv.current_uses >= inv.max_uses {
+ invites.remove(invite_token);
+ }
+ }
+ Ok(())
+ }
+ Err(e) => {
+ let mut invites = state.invites.write().await;
+ if let Some(inv) = invites.get_mut(invite_token) {
+ inv.current_uses = inv.current_uses.saturating_sub(1);
+ }
+ Err(format!("{e}"))
+ }
+ }
+}
+
fn pending_sessions(state: &AppState) -> Arc<RwLock<HashMap<String, PendingSession>>> {
state.pending_sessions.clone()
}
@@ -115,6 +164,42 @@ pub struct AuthLoginQuery {
pub session: String,
}
+pub async fn get_join_invite(Path(token): Path<String>, State(state): State<AppState>) -> impl IntoResponse {
+ let token = token.trim().to_string();
+ if token.is_empty() {
+ return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+ }
+ let now = now_ms();
+ let valid = {
+ let invites = state.invites.read().await;
+ match invites.get(&token) {
+ None => false,
+ Some(inv) => now <= inv.expires_at_ms && inv.current_uses < inv.max_uses,
+ }
+ };
+ if !valid {
+ return api_error(StatusCode::NOT_FOUND, "invite invalid or expired", None).into_response();
+ }
+
+ let session = format!("p_{}", uuid::Uuid::new_v4().simple());
+ let s = PendingSession {
+ agent: INVITE_BROWSER_AGENT.to_string(),
+ created_ts: now_ms(),
+ provider: None,
+ provider_id: None,
+ redeem_invite: Some(token),
+ complete: None,
+ };
+ state.pending_sessions.write().await.insert(session.clone(), s);
+
+ let public_url = std::env::var("SLUG_PUBLIC_URL").unwrap_or_else(|_| "http://127.0.0.1:8080".to_string());
+ Redirect::temporary(&format!(
+ "{public_url}/auth/login?session={}",
+ urlencoding::encode(&session)
+ ))
+ .into_response()
+}
+
pub async fn get_auth_login(Query(q): Query<AuthLoginQuery>, State(state): State<AppState>) -> impl IntoResponse {
// Redirect to Google auth endpoint.
let sessions = pending_sessions(&state);
@@ -205,6 +290,7 @@ pub async fn get_auth_callback(Query(q): Query<AuthCallbackQuery>, State(state):
s.provider = Som
… preview truncated; 45,403 characters omittedB — c_afa638171cf7 (tommy-mor)
message
[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity. OAuth providers only attach to a session UUID (first link creates the principal); linked providers stay private on the account page. Co-authored-by: Cursor <cursoragent@cursor.com>
diff preview
diff --git a/AGENTS.md b/AGENTS.md
index 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):
- `SORTER2_DATA_DIR` — default `./data` (created on startup)
- `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)
+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)
+
+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.
Health check: `GET /healthz` → `ok`.
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -1,4 +1,8 @@
-//! GitHub OAuth login, session cookies, and vote actor resolution.
+//! OAuth linking, session cookies, and vote actor resolution.
+//!
+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID
+//! (first link creates the principal; later links attach while logged in).
+//! Which providers are linked is private to the account owner.
pub mod config;
pub mod identity;
@@ -22,7 +26,9 @@ use crate::{
form_template::template_json_compact,
html::layout,
state::AppState,
- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},
+ storage_schema::{
+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,
+ },
ui_action::UI_RPC_FIELD,
};
@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {
pub struct LoginQuery {
#[serde(default)]
pub return_to: Option<String>,
+ #[serde(default)]
+ pub error: Option<String>,
}
#[derive(Debug, Deserialize)]
-pub struct GitHubStartQuery {
+pub struct OAuthStartQuery {
#[serde(default)]
pub return_to: Option<String>,
#[serde(default)]
@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {
.unwrap_or_else(|| "/".to_string())
}
-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {
+/// Available OAuth link targets: `(provider_key, label, start_href)`.
+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {
let mut out = Vec::new();
+ let enc = urlencoding::encode(return_to);
if oauth::GitHubConfig::from_env(base_url).is_some() {
out.push((
- "GitHub",
- format!(
- "/auth/github?return_to={}",
- urlencoding::encode(return_to)
- ),
+ "github",
+ oauth::provider_label("github"),
+ format!("/auth/github?return_to={enc}"),
+ ));
+ }
+ if oauth::RedditConfig::from_env(base_url).is_some() {
+ out.push((
+ "reddit",
+ oauth::provider_label("reddit"),
+ format!("/auth/reddit?return_to={enc}"),
));
}
out
@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat
})
}
-fn signed_out_body(providers: &[(&str, String)]) -> Markup {
+fn login_error_message(code: Option<&str>) -> Option<&'static str> {
+ match code {
+ Some("oauth_taken") => {
+ Some("that OAuth account is already linked to a different sorter2 account")
+ }
+ Some("oauth_failed") => Some("OAuth failed — try again"),
+ _ => None,
+ }
+}
+
+fn signed_out_body(
+ providers: &[(&str, &str, String)],
+ error: Option<&str>,
+) -> Markup {
html! {
main class="panel login-page" {
section class="login-section" {
h1 { "sign in" }
- p class="muted" { "link an account to vote under a lasting alias" }
+ p class="muted" {
+ "link an OAuth account to create your identity, then claim an alias to vote"
+ }
+ @if let Some(msg) = login_error_message(error) {
+ p class="alias-bad" data-testid="login-error" { (msg) }
+ }
@if providers.is_empty() {
p class="muted" {
- "OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET."
+ "OAuth is not configured. Set GitHub and/or Reddit client credentials."
}
} @else {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in providers {
li {
a href=(href) class="btn-primary oauth-provider"
- data-testid=(format!("oauth-{}", name.to_lowercase())) {
- (format!("Continue with {name}"))
+ data-testid=(format!("oauth-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {
fn account_body(
actor: &session::SessionActor,
aliases: &[String],
- providers: &[(&str, String)],
+ // Provider keys already linked to this UUID (private).
+ linked: &[String],
+ // Providers available to link: not yet attached.
+ unlinkable: &[(&str, &str, String)],
claim_forms: Markup,
) -> Markup {
let current = actor.pseudonym.trim();
@@ -212,16 +248,29 @@ fn account_body(
(claim_forms)
}
- @if !providers.is_empty() {
- section class="login-section" {
- h2 { "linked sign-in" }
- p class="muted small" { "sign in again with the same provider to return to this account" }
+ section class="login-section" {
+ h2 { "linked sign-in" }
+ p class="muted small" {
+ "private to you — linking more providers raises trust weight without publishing which accounts you use"
+ }
+ @if linked.is_empty() {
+ p class="muted" data-testid="linked-providers-empty" { "none yet" }
+ } @else {
+ ul class="linked-provider-list" data-testid="linked-providers" {
+ @for key in linked {
+ li data-testid=(format!("linked-{key}")) {
+ (oauth::provider_label(key))
+ }
+ }
+ }
+ }
+ @if !unlinkable.is_empty() {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in unlinkable {
li {
a href=(href) class="btn-secondary oauth-provider"
- data-testid=(format!("oauth-relink-{}", name.to_lowercase())) {
- (format!("Re-link {name}"))
+ data-testid=(format!("oauth-link-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -243,12 +292,21 @@ fn account_body(
fn login_body(
session: Option<&session::SessionActor>,
aliases: &[String],
- providers: &[(&str, String)],
+ linked: &[String],
+ providers: &[(&str, &str, String)],
claim_forms: Option<Markup>,
+ error: Option<&str>,
) -> Markup {
match (session, claim_forms) {
- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),
- _ => signed_out_body(providers),
+ (Some(actor), Some(forms)) => {
+ let unlinkable: Vec<_> = providers
+ .iter()
+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))
+ .cloned()
+ .collect();
+ account_body(actor, aliases, linked, &unlinkable, forms)
+ }
+ _ => signed_out_body(providers, error),
}
}
@@ -268,6 +326,10 @@ pub async fn login_page(
.as_ref()
.map(|s| alias_list(db, &s.uuid))
.unwrap_or_default();
+ let linked = session
+ .as_ref()
+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())
+ .unwrap_or_default();
let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);
let claim_forms = if session.is_some() {
@@ -282,7 +344,14 @@ pub async fn login_page(
} else {
"login · sorter2"
},
- login_body(session.as_ref(), &aliases, &providers, claim_forms),
+ login_body(
+ session.as_ref(),
+ &aliases,
+ &linked,
+ &providers,
+ claim_forms,
+ query.error.as_deref(),
+ ),
state.views.get_views("/login"),
session
.as_ref()
@@ -302,7 +371,6 @@ pub async fn alias_page(
let db = state.projection_store.db();
let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;
if session::session_has_pseudonym(&session) {
- // Already onboarded — manage aliases on the account page.
return Ok(Redirect::to("/login").into_response());
}
@@ -331,7 +399,7 @@ pub async fn alias_page(
pub async fn github_start(
State(state): State<AppState>,
jar: CookieJar,
- Query(query): Query<GitHubStartQuery>,
+ Query(query): Query<OAuthStartQuery>,
) -> Result<Response, StatusCode> {
let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))
.ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
@@ -342,7 +410,28 @@ pub async fn github_start(
} else {
None
};
- let url = oauth::authorize_url(&cfg, &state_token, mock_user);
+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);
+ let jar = jar
+ .add(session::oauth_state_cookie_value(&state_token))
+ .add(session::auth_return_cookie_value(&return_to));
+ Ok((jar, Redirect::temporary(&url)).into_response())
+}
+
+pub async fn reddit_start(
+ State(state): State<AppState>,
+ jar: CookieJar,
+ Query(query): Query<OAuthStartQuery>,
+) -> Result<Response, StatusCode> {
+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))
+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
+ let state_token = session::new_oauth_state();
+ let mock_user = if config::mock_oauth_allowed() {
+ query.mock_user.as_deref()
+ } else {
+ None
+ };
+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);
let jar = jar
.add(session::oauth_state_cookie_value(&state_token))
.add(session::auth_return_cookie_value(&return_to));
@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {
pub state: String,
}
+/// Link `provider:provider_id` to a UUID.
+///
+/// - Logged in + new provider → attach to session UUID
+/// - Logged in + already ours → no-op
+/// - Logged in
… preview truncated; 29,823 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.