Side B implements a real feature (Reddit OAuth linking with UUID-canonical identity, conflict handling, private linked-provider display, batch-consistent trust weight updates) plus corresponding test infrastructure updates, delivering concrete user-facing and security-relevant behavior. Side A adds a well-tested URL canonicalization graph, which is solid engineering but a narrower, self-contained utility with less integration risk and lower overall product impact than B's auth/identity change.
constitution · epochs · watch · epoch 3
comparison
c_9bced108c8aa (tommy-mor) vs c_afa638171cf7 (tommy-mor)
download prompt · raw event · cmp_fccc2a38cef78e
council reasoning
Side A introduces a complete, lasting URL subsystem (DFA graph traversal, GraphBuilder validation, host/path absorb patterns, generic fallback, encode-safe canonicals, and dense equivalence/breadcrumb tests across Reddit/YouTube). Side B is a solid identity/auth extension (UUID-only principal, multi-provider link semantics, Reddit OAuth paths, pending-weight batching) but largely builds on the existing OAuth/session model rather than a new core domain design.
Side A introduces a new URL parsing and semantic graph framework with generic canonicalization, breadcrumb generation, graph validation via a builder, host/query normalization, and extensive tests. Side B adds useful OAuth functionality (Reddit provider support, UUID-centered account linking, projection fixes, and UI updates), but it extends an existing authentication system, whereas Side A establishes a broader reusable architecture for URL canonicalization that is likely to underpin future URL rules and behavior.
sides
A — c_9bced108c8aa (tommy-mor)
message
[15e1037a] url stuff
diff preview
diff --git a/server/src/url_rules/graph.rs b/server/src/url_rules/graph.rs
new file mode 100644
index 0000000000000000000000000000000000000000..f7ac0f9a551a1727cb2f9294778c283b9885b147
--- /dev/null
+++ b/server/src/url_rules/graph.rs
@@ -0,0 +1,831 @@
+//! Semantic URL graph: DFA traversal on host + path, query in context, generic fallback.
+
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+use url::Url;
+
+use super::graph_builder::GraphBuilder;
+use super::parse::{normalize_match_host, strip_tracking_query, UrlParts};
+
+#[derive(Debug, Clone, Default)]
+pub struct Context {
+ pub vars: HashMap<String, String>,
+ pub query: HashMap<String, String>,
+}
+
+pub type CanonicalFn = fn(&Context) -> Option<String>;
+
+#[derive(Clone, Copy)]
+pub enum EdgePattern {
+ Literal(&'static str),
+ Variable(&'static str),
+ /// Absorb any trailing segment without leaving this node (e.g. post title slug).
+ AbsorbAny,
+ /// Absorb segment when `cond(seg)` (e.g. subreddit listing suffix).
+ AbsorbIf(fn(&str) -> bool),
+}
+
+pub struct Edge {
+ pub pattern: EdgePattern,
+ pub target: &'static str,
+}
+
+pub struct Node {
+ pub edges: Vec<Edge>,
+ pub canonical: CanonicalFn,
+ pub parent: Option<&'static str>,
+}
+
+impl Node {
+ pub(crate) fn empty() -> Self {
+ Self {
+ edges: Vec::new(),
+ canonical: |_| None,
+ parent: None,
+ }
+ }
+}
+
+pub struct Graph {
+ pub nodes: HashMap<&'static str, Node>,
+}
+
+static GRAPH: OnceLock<Graph> = OnceLock::new();
+
+pub fn graph() -> &'static Graph {
+ GRAPH.get_or_init(build_graph)
+}
+
+impl Graph {
+ pub fn resolve_canonical(&self, parts: &UrlParts) -> Option<String> {
+ let mut query = parts.query.clone();
+ strip_tracking_query(&mut query);
+ let mut ctx = Context {
+ vars: HashMap::new(),
+ query,
+ };
+
+ if let Some(node_id) = self.traverse(parts, &mut ctx) {
+ if let Some(canon) = (self.nodes.get(node_id)?.canonical)(&ctx) {
+ return Some(canon);
+ }
+ }
+ Some(generic_canonical(parts))
+ }
+
+ pub fn breadcrumbs(&self, parts: &UrlParts) -> Vec<String> {
+ let mut query = parts.query.clone();
+ strip_tracking_query(&mut query);
+ let mut ctx = Context {
+ vars: HashMap::new(),
+ query,
+ };
+
+ if let Some(mut node_id) = self.traverse(parts, &mut ctx) {
+ let mut paths = Vec::new();
+ loop {
+ let node = match self.nodes.get(node_id) {
+ Some(n) => n,
+ None => break,
+ };
+ if let Some(url) = (node.canonical)(&ctx) {
+ if paths.last() != Some(&url) {
+ paths.push(url);
+ }
+ }
+ match node.parent {
+ Some(p) => node_id = p,
+ None => break,
+ }
+ }
+ paths.reverse();
+ if !paths.is_empty() {
+ return paths;
+ }
+ }
+ generic_breadcrumbs(parts)
+ }
+
+ fn traverse(&self, parts: &UrlParts, ctx: &mut Context) -> Option<&'static str> {
+ let host = parts.match_host();
+ let mut node_id = match host.as_str() {
+ "reddit.com" => "reddit_root",
+ "youtube.com" => "youtube_root",
+ "youtu.be" => "youtu_be_entry",
+ _ => return None,
+ };
+
+ let segs: Vec<&str> = parts.path_segments.iter().map(String::as_str).collect();
+ let mut i = 0;
+ while i < segs.len() {
+ let seg = segs[i];
+ match self.follow_edge(node_id, seg, ctx) {
+ Ok(next) => {
+ node_id = next;
+ i += 1;
+ }
+ Err(()) => {
+ if self.try_absorb(node_id, seg) {
+ i += 1;
+ continue;
+ }
+ return None;
+ }
+ }
+ }
+ Some(node_id)
+ }
+
+ fn follow_edge(
+ &self,
+ node_id: &'static str,
+ seg: &str,
+ ctx: &mut Context,
+ ) -> Result<&'static str, ()> {
+ let node = self.nodes.get(node_id).ok_or(())?;
+ for edge in &node.edges {
+ match edge.pattern {
+ EdgePattern::Literal(lit) if lit == seg => return Ok(edge.target),
+ EdgePattern::Variable(name) => {
+ ctx.vars.insert(name.to_string(), seg.to_string());
+ return Ok(edge.target);
+ }
+ EdgePattern::AbsorbAny
+ | EdgePattern::AbsorbIf(_)
+ | EdgePattern::Literal(_)
+ | EdgePattern::Variable(_) => {}
+ }
+ }
+ Err(())
+ }
+
+ fn try_absorb(&self, node_id: &'static str, seg: &str) -> bool {
+ let node = match self.nodes.get(node_id) {
+ Some(n) => n,
+ None => return false,
+ };
+ for edge in &node.edges {
+ match edge.pattern {
+ EdgePattern::AbsorbAny => return true,
+ EdgePattern::AbsorbIf(cond) if cond(seg) => return true,
+ EdgePattern::AbsorbIf(_) | EdgePattern::Literal(_) | EdgePattern::Variable(_) => {}
+ }
+ }
+ false
+ }
+
+ /// Test hook: terminal graph node and captured context after traversal.
+ #[cfg(test)]
+ pub fn traverse_terminal(&self, parts: &UrlParts) -> Option<(&'static str, Context)> {
+ let mut query = parts.query.clone();
+ strip_tracking_query(&mut query);
+ let mut ctx = Context {
+ vars: HashMap::new(),
+ query,
+ };
+ let node = self.traverse(parts, &mut ctx)?;
+ Some((node, ctx))
+ }
+}
+
+fn is_reddit_listing_suffix(seg: &str) -> bool {
+ matches!(seg, "hot" | "top" | "new" | "rising" | "controversial")
+}
+
+/// Percent-encode a path or query fragment so `&`, `?`, etc. cannot break URL structure.
+fn enc(s: &str) -> String {
+ urlencoding::encode(s).into_owned()
+}
+
+// --- Canonical formatters ---
+
+fn canon_reddit_root(_: &Context) -> Option<String> {
+ Some("https://reddit.com".to_string())
+}
+
+fn canon_reddit_r_hub(_: &Context) -> Option<String> {
+ Some("https://reddit.com/r".to_string())
+}
+
+fn canon_reddit_subreddit(ctx: &Context) -> Option<String> {
+ let sub = ctx.vars.get("subreddit")?;
+ Some(format!(
+ "https://reddit.com/r/{}",
+ enc(&sub.to_ascii_lowercase())
+ ))
+}
+
+fn canon_reddit_post(ctx: &Context) -> Option<String> {
+ let sub = ctx.vars.get("subreddit")?.to_ascii_lowercase();
+ let id = ctx.vars.get("post_id")?;
+ Some(format!(
+ "https://reddit.com/r/{}/comments/{}",
+ enc(&sub),
+ enc(id)
+ ))
+}
+
+fn canon_youtube_root(_: &Context) -> Option<String> {
+ Some("https://youtube.com".to_string())
+}
+
+fn canon_youtube_watch(ctx: &Context) -> Option<String> {
+ let v = ctx
+ .query
+ .get("v")
+ .or_else(|| ctx.vars.get("video_id"))?;
+ Some(format!("https://youtube.com/watch?v={}", enc(v)))
+}
+
+fn canon_youtu_be(ctx: &Context) -> Option<String> {
+ let v = ctx.vars.get("vid_id")?;
+ Some(format!("https://youtube.com/watch?v={}", enc(v)))
+}
+
+pub fn build_graph() -> Graph {
+ GraphBuilder::new()
+ .node("reddit_root")
+ .canonical(canon_reddit_root)
+ .edge(EdgePattern::Literal("r"), "reddit_r_hub")
+ .node("reddit_r_hub")
+ .parent("reddit_root")
+ .canonical(canon_reddit_r_hub)
+ .edge(EdgePattern::Variable("subreddit"), "reddit_subreddit")
+ .node("reddit_subreddit")
+ .parent("reddit_r_hub")
+ .canonical(canon_reddit_subreddit)
+ .edge(
+ EdgePattern::AbsorbIf(is_reddit_listing_suffix),
+ "reddit_subreddit",
+ )
+ .edge(EdgePattern::Literal("comments"), "reddit_comments_gate")
+ .node("reddit_comments_gate")
+ .parent("reddit_subreddit")
+ .canonical(canon_reddit_subreddit)
+ .edge(EdgePattern::Variable("post_id"), "reddit_post")
+ .node("reddit_post")
+ .parent("reddit_subreddit")
+ .canonical(canon_reddit_post)
+ .edge(EdgePattern::AbsorbAny, "reddit_post")
+ .node("youtube_root")
+ .canonical(canon_youtube_root)
+ .edge(EdgePattern::Literal("watch"), "youtube_watch")
+ .edge(EdgePattern::Literal("shorts"), "youtube_shorts_gate")
+ .node("youtube_watch")
+ .parent("youtube_root")
+ .canonical(canon_youtube_watch)
+ .node("youtube_shorts_gate")
+ .parent("youtube_root")
+ .canonical(canon_youtube_root)
+ .edge(EdgePattern::Variable("video_id"), "youtube_watch")
+ .node("youtu_be_entry")
+ .canonical(canon_youtube_root)
+ .edge(EdgePattern::Variable("vid_id"), "youtu_be_video")
+ .node("youtu_be_video")
+ .parent("youtube_root")
+ .canonical(canon_youtu_be)
+ .build()
+}
+
+// --- Generic internet fallback ---
+
+pub fn generic_canonical(parts: &UrlParts) -> String {
+ let host = normalize_match_host(&parts.host);
+ let path_segments: Vec<String> = parts.path_segments.clone();
+ let mut query = parts.query.clone();
+ strip_tracking_query(&mut query);
+
+ let mut url = if path_segments.is_empty() {
+ Url::parse(&format!("https://{host}"))
+ .unwrap_or_else(|_| Url::parse("https://invalid").unwrap())
+ } else {
+ let path = format!("/{}", path_segments.join("/"));
+ Url::parse(&format!("https://{host}{path}"))
+ .unwrap_or_else(|_| Url::parse("https://invalid").unwrap())
+ };
+
+ if !query.is_empty() {
+ let mut pairs: Vec<_> = query.iter().collect();
+ pairs.sort_by(|a, b| a.0.cmp(b.0));
+ url.query_pairs_mut().clear();
+ for (k, v) in pairs {
+ url.query_pairs_mut().append_pair(k, v);
+ }
+ }
+
+ let mut s = url.to_string();
+ if path_segments.is_empty() {
+ s = s.trim_end_matches('/').to_string();
+ }
+ s
+}
+
+pub fn generic_breadcrumbs(parts: &UrlParts) -> Vec<String> {
+ let host = normalize_match_host(&parts.host);
+ let n = parts.path_segments.len();
+ let mut out = Vec::new();
+
+ let base = generic_canonical(&UrlParts {
+ scheme: "https".to_string(),
+ host: host.clone(),
+ path_segments: vec![],
+ query: HashMap::new(),
+ });
+ out.push(base);
+
+ for i in 0..n {
+ let segs: Vec<String> = parts.path_segments[..=i].to_vec();
+ let url = generic_canonical(&UrlParts {
+ scheme: "https".to_string(),
+ host: host.clone(),
+ path_segments: segs,
+ query: HashMap::new(),
+ });
+ if out.last() != Some(&url) {
+ out.push(url);
+ }
+ }
+ out
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use crate::url_rules::parse::test_parts;
+
+ fn g() -> &'static Graph {
+ graph()
+ }
+
+ fn canon(parts: &UrlParts) -> String {
+ g().resolve_canonical(parts).unwrap()
+ }
+
+ fn crumbs(parts: &UrlParts) -> Vec<String> {
+ g().breadcrumbs(parts)
+ }
+
+ fn terminal(parts: &UrlParts) -> Option<&'static str> {
+ g().traverse_terminal(parts).map(|(n, _)| n)
+ }
+
+ fn vars(parts: &UrlParts) -> HashMap<String, String> {
+ g().traverse_terminal(parts)
+ .map(|(_, c)| c.vars)
+ .unwrap_or_default()
+ }
+
+ #[test]
+ fn youtu_be_malicious_segment_encoded_not_injected() {
+ let p = test_parts("youtu.be", &["abc&t=1"], &[]);
+ assert_eq!(canon(&p
… preview truncated; 29,502 characters omittedB — c_afa638171cf7 (tommy-mor)
message
[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity. OAuth providers only attach to a session UUID (first link creates the principal); linked providers stay private on the account page. Co-authored-by: Cursor <cursoragent@cursor.com>
diff preview
diff --git a/AGENTS.md b/AGENTS.md
index 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):
- `SORTER2_DATA_DIR` — default `./data` (created on startup)
- `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)
+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)
+
+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.
Health check: `GET /healthz` → `ok`.
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -1,4 +1,8 @@
-//! GitHub OAuth login, session cookies, and vote actor resolution.
+//! OAuth linking, session cookies, and vote actor resolution.
+//!
+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID
+//! (first link creates the principal; later links attach while logged in).
+//! Which providers are linked is private to the account owner.
pub mod config;
pub mod identity;
@@ -22,7 +26,9 @@ use crate::{
form_template::template_json_compact,
html::layout,
state::AppState,
- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},
+ storage_schema::{
+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,
+ },
ui_action::UI_RPC_FIELD,
};
@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {
pub struct LoginQuery {
#[serde(default)]
pub return_to: Option<String>,
+ #[serde(default)]
+ pub error: Option<String>,
}
#[derive(Debug, Deserialize)]
-pub struct GitHubStartQuery {
+pub struct OAuthStartQuery {
#[serde(default)]
pub return_to: Option<String>,
#[serde(default)]
@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {
.unwrap_or_else(|| "/".to_string())
}
-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {
+/// Available OAuth link targets: `(provider_key, label, start_href)`.
+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {
let mut out = Vec::new();
+ let enc = urlencoding::encode(return_to);
if oauth::GitHubConfig::from_env(base_url).is_some() {
out.push((
- "GitHub",
- format!(
- "/auth/github?return_to={}",
- urlencoding::encode(return_to)
- ),
+ "github",
+ oauth::provider_label("github"),
+ format!("/auth/github?return_to={enc}"),
+ ));
+ }
+ if oauth::RedditConfig::from_env(base_url).is_some() {
+ out.push((
+ "reddit",
+ oauth::provider_label("reddit"),
+ format!("/auth/reddit?return_to={enc}"),
));
}
out
@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat
})
}
-fn signed_out_body(providers: &[(&str, String)]) -> Markup {
+fn login_error_message(code: Option<&str>) -> Option<&'static str> {
+ match code {
+ Some("oauth_taken") => {
+ Some("that OAuth account is already linked to a different sorter2 account")
+ }
+ Some("oauth_failed") => Some("OAuth failed — try again"),
+ _ => None,
+ }
+}
+
+fn signed_out_body(
+ providers: &[(&str, &str, String)],
+ error: Option<&str>,
+) -> Markup {
html! {
main class="panel login-page" {
section class="login-section" {
h1 { "sign in" }
- p class="muted" { "link an account to vote under a lasting alias" }
+ p class="muted" {
+ "link an OAuth account to create your identity, then claim an alias to vote"
+ }
+ @if let Some(msg) = login_error_message(error) {
+ p class="alias-bad" data-testid="login-error" { (msg) }
+ }
@if providers.is_empty() {
p class="muted" {
- "OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET."
+ "OAuth is not configured. Set GitHub and/or Reddit client credentials."
}
} @else {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in providers {
li {
a href=(href) class="btn-primary oauth-provider"
- data-testid=(format!("oauth-{}", name.to_lowercase())) {
- (format!("Continue with {name}"))
+ data-testid=(format!("oauth-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {
fn account_body(
actor: &session::SessionActor,
aliases: &[String],
- providers: &[(&str, String)],
+ // Provider keys already linked to this UUID (private).
+ linked: &[String],
+ // Providers available to link: not yet attached.
+ unlinkable: &[(&str, &str, String)],
claim_forms: Markup,
) -> Markup {
let current = actor.pseudonym.trim();
@@ -212,16 +248,29 @@ fn account_body(
(claim_forms)
}
- @if !providers.is_empty() {
- section class="login-section" {
- h2 { "linked sign-in" }
- p class="muted small" { "sign in again with the same provider to return to this account" }
+ section class="login-section" {
+ h2 { "linked sign-in" }
+ p class="muted small" {
+ "private to you — linking more providers raises trust weight without publishing which accounts you use"
+ }
+ @if linked.is_empty() {
+ p class="muted" data-testid="linked-providers-empty" { "none yet" }
+ } @else {
+ ul class="linked-provider-list" data-testid="linked-providers" {
+ @for key in linked {
+ li data-testid=(format!("linked-{key}")) {
+ (oauth::provider_label(key))
+ }
+ }
+ }
+ }
+ @if !unlinkable.is_empty() {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in unlinkable {
li {
a href=(href) class="btn-secondary oauth-provider"
- data-testid=(format!("oauth-relink-{}", name.to_lowercase())) {
- (format!("Re-link {name}"))
+ data-testid=(format!("oauth-link-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -243,12 +292,21 @@ fn account_body(
fn login_body(
session: Option<&session::SessionActor>,
aliases: &[String],
- providers: &[(&str, String)],
+ linked: &[String],
+ providers: &[(&str, &str, String)],
claim_forms: Option<Markup>,
+ error: Option<&str>,
) -> Markup {
match (session, claim_forms) {
- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),
- _ => signed_out_body(providers),
+ (Some(actor), Some(forms)) => {
+ let unlinkable: Vec<_> = providers
+ .iter()
+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))
+ .cloned()
+ .collect();
+ account_body(actor, aliases, linked, &unlinkable, forms)
+ }
+ _ => signed_out_body(providers, error),
}
}
@@ -268,6 +326,10 @@ pub async fn login_page(
.as_ref()
.map(|s| alias_list(db, &s.uuid))
.unwrap_or_default();
+ let linked = session
+ .as_ref()
+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())
+ .unwrap_or_default();
let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);
let claim_forms = if session.is_some() {
@@ -282,7 +344,14 @@ pub async fn login_page(
} else {
"login · sorter2"
},
- login_body(session.as_ref(), &aliases, &providers, claim_forms),
+ login_body(
+ session.as_ref(),
+ &aliases,
+ &linked,
+ &providers,
+ claim_forms,
+ query.error.as_deref(),
+ ),
state.views.get_views("/login"),
session
.as_ref()
@@ -302,7 +371,6 @@ pub async fn alias_page(
let db = state.projection_store.db();
let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;
if session::session_has_pseudonym(&session) {
- // Already onboarded — manage aliases on the account page.
return Ok(Redirect::to("/login").into_response());
}
@@ -331,7 +399,7 @@ pub async fn alias_page(
pub async fn github_start(
State(state): State<AppState>,
jar: CookieJar,
- Query(query): Query<GitHubStartQuery>,
+ Query(query): Query<OAuthStartQuery>,
) -> Result<Response, StatusCode> {
let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))
.ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
@@ -342,7 +410,28 @@ pub async fn github_start(
} else {
None
};
- let url = oauth::authorize_url(&cfg, &state_token, mock_user);
+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);
+ let jar = jar
+ .add(session::oauth_state_cookie_value(&state_token))
+ .add(session::auth_return_cookie_value(&return_to));
+ Ok((jar, Redirect::temporary(&url)).into_response())
+}
+
+pub async fn reddit_start(
+ State(state): State<AppState>,
+ jar: CookieJar,
+ Query(query): Query<OAuthStartQuery>,
+) -> Result<Response, StatusCode> {
+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))
+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
+ let state_token = session::new_oauth_state();
+ let mock_user = if config::mock_oauth_allowed() {
+ query.mock_user.as_deref()
+ } else {
+ None
+ };
+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);
let jar = jar
.add(session::oauth_state_cookie_value(&state_token))
.add(session::auth_return_cookie_value(&return_to));
@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {
pub state: String,
}
+/// Link `provider:provider_id` to a UUID.
+///
+/// - Logged in + new provider → attach to session UUID
+/// - Logged in + already ours → no-op
+/// - Logged in
… preview truncated; 29,823 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.