Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Ben Stull
|
2590c244d6 | ||
|
Ben Stull
|
c92730a737 |
+232
@@ -23,6 +23,238 @@ skip versions are the composition of each intervening adjacent
|
||||
release's steps in order — no A-to-B path is pre-computed beyond
|
||||
that.
|
||||
|
||||
## 0.7.0 — 2026-05-28
|
||||
|
||||
**Minor — schema migration required; new auth path is additive.**
|
||||
This release lands email + one-time-code sign-in (roadmap item #5,
|
||||
SPEC §6.2) as the primary human-auth gesture. Users sign in by
|
||||
typing their email, receiving a six-digit code via email, and
|
||||
entering it. The Gitea OAuth callback (`/auth/callback`) remains
|
||||
functional during migration — the new UI no longer points at it
|
||||
primarily, but a "Sign in with Gitea (fallback)" link survives on
|
||||
the new login surface so users with active OAuth sessions or older
|
||||
invite paths still have a way in. A future release retires the
|
||||
OAuth path entirely once every active user has signed in at least
|
||||
once via OTC.
|
||||
|
||||
The migration path for existing users: first OTC sign-in matches by
|
||||
`users.email` (case-insensitive) to the OAuth-era row and reuses
|
||||
that row's `id` and `gitea_id`. New users provisioned via OTC carry
|
||||
`gitea_id = NULL` and `gitea_login = NULL`. The `gitea_id` linker
|
||||
remains the canonical handle for grandfathered users; `email`
|
||||
becomes the identity key for everything provisioned after v0.7.0.
|
||||
|
||||
The Gitea **bot** user + token are still required (server-side git
|
||||
operations — repo reads, PR creation — still flow through it). Only
|
||||
the operator-facing sign-in surface moves.
|
||||
|
||||
### Upgrade steps (from 0.6.0)
|
||||
|
||||
1. **MUST** restart the backend so migration `012_otc.sql` runs.
|
||||
The migration rebuilds the `users` table (SQLite cannot ALTER
|
||||
COLUMN); existing rows pass through unchanged, but the new
|
||||
schema relaxes `gitea_id` / `gitea_login` to nullable (with
|
||||
partial unique indexes that ignore NULL) and adds a partial
|
||||
unique index on `email`. A new `otc_codes` table is created.
|
||||
2. **MUST** confirm the SMTP overlay is set (`SMTP_HOST`,
|
||||
`SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_STARTTLS`,
|
||||
`EMAIL_FROM`, `EMAIL_FROM_NAME`). The OHM overlay already
|
||||
carries these as of v0.5.0; deployments without them fall back
|
||||
to logging the code to stdout (dev-only path — production
|
||||
visitors will not receive their codes).
|
||||
3. **SHOULD** announce the new email-based sign-in to existing
|
||||
users. Wording suggestion: "You can now sign in by entering
|
||||
your email and a one-time code we'll send you. Your old
|
||||
account is linked automatically the first time you sign in."
|
||||
4. **MAY** keep the existing OAuth callback as a fallback path.
|
||||
The new login UI surfaces a small "Sign in with Gitea
|
||||
(fallback)" link beneath the primary email/code form; a
|
||||
deployment that prefers to hide it can override the Login
|
||||
component in a future framework release that exposes the link
|
||||
behind a feature flag. For v0.7.0, the link is hard-coded.
|
||||
|
||||
### New environment variables (all optional with defaults)
|
||||
|
||||
- `OTC_TTL_MINUTES` (default `10`) — how long a one-time code is
|
||||
valid after issuance. Re-requesting invalidates the prior code
|
||||
immediately regardless of TTL.
|
||||
- `OTC_REQUEST_COOLDOWN_SECONDS` (default `60`) — per-email cooldown
|
||||
between successive `/auth/otc/request` calls. The endpoint returns
|
||||
HTTP 429 when the cooldown blocks a request (the loud-failure
|
||||
shape; the abuse path is visible rather than swallowed).
|
||||
|
||||
No new secrets are required. The existing `SECRET_KEY` continues to
|
||||
sign session cookies; OTC codes are bcrypt-hashed at rest using a
|
||||
per-row salt the library generates.
|
||||
|
||||
### Added
|
||||
|
||||
- **`POST /auth/otc/request`** — body `{email}`. Generates a six-digit
|
||||
code, stores its bcrypt hash with an expiry, and dispatches a plain
|
||||
text email via the existing SMTP layer. Returns HTTP 200 (`{ok:true}`)
|
||||
uniformly so allowlist state is not leaked. Returns HTTP 429 when
|
||||
the per-email cooldown blocks the request.
|
||||
- **`POST /auth/otc/verify`** — body `{email, code}`. Validates the
|
||||
bcrypt hash against the most-recent unconsumed non-expired row, marks
|
||||
the row consumed, provisions or links the `users` row by email, and
|
||||
stores the session cookie. Returns HTTP 200 on success, HTTP 400 on
|
||||
any failure (expired, consumed, wrong, unknown).
|
||||
- **`backend/migrations/012_otc.sql`** — creates `otc_codes` and
|
||||
rebuilds `users` with nullable `gitea_id` / `gitea_login` plus a
|
||||
partial unique index on `email`.
|
||||
- **`backend/app/otc.py`** — the OTC request/verify state machine and
|
||||
the `provision_or_link_user` linker.
|
||||
- **`backend/app/email_otc.py`** — outbound OTC mail composition. Reuses
|
||||
the SMTP plumbing from `email.py` (`EmailConfig.from_env()`) and the
|
||||
test buffer (`_SENT`) but writes its own envelope (no unsubscribe
|
||||
footer, no quiet-hours hold — OTC mail carries a credential and
|
||||
ignores notification preferences).
|
||||
- **`frontend/src/components/Login.jsx`** — two-step sign-in surface
|
||||
at `/login`. Step 1: enter email → request code. Step 2: enter
|
||||
six-digit code → verify. Cmd/Ctrl+Enter on the code field submits.
|
||||
The previous header "Sign in" link and the `Welcome` component's
|
||||
inline link now route to `/login` instead of jumping straight to
|
||||
the Gitea OAuth dance.
|
||||
- **SPEC `§6.1` / `§6.2` / `§14.1` / `§17` / `§19.2`** corrections per
|
||||
§19.3 rule-2 — see below.
|
||||
- **`backend/tests/test_otc_vertical.py`** — 11 new tests covering
|
||||
the happy path, expired/consumed/wrong codes, the per-email rate
|
||||
limit (and its per-email isolation), the allowlist gate, the
|
||||
migration link to OAuth-era users, fresh provisioning, and the
|
||||
prior-code-invalidation behavior on re-request.
|
||||
|
||||
### Changed
|
||||
|
||||
- **`backend/app/auth.py#current_user`** — coerces NULL `gitea_id` and
|
||||
NULL `gitea_login` to `0` / `""` so the `SessionUser` shape stays
|
||||
stable for OTC-only users. The DB remains the source of truth for
|
||||
"is this user OAuth-linked" (`gitea_id IS NOT NULL`).
|
||||
- **`backend/requirements.txt`** — adds `bcrypt>=4.2` for OTC code
|
||||
hashing. Pure-Python wheels are available on every platform the
|
||||
deployment matrix targets; `pip install -r backend/requirements.txt`
|
||||
picks it up.
|
||||
- **`frontend/src/App.jsx`** — adds the `/login` route and replaces
|
||||
the header "Sign in" `<a href="/auth/login">` with `<Link to="/login">`.
|
||||
The `Welcome` component's inline sign-in link follows suit.
|
||||
- **`frontend/src/components/Landing.jsx`** — the `/welcome` page's
|
||||
primary action moves from "Sign in with Gitea" to "Sign in" pointing
|
||||
at `/login`.
|
||||
|
||||
### Deferred to later releases
|
||||
|
||||
Per the v0.7.0 scope discipline (the foundation for items #6, #8, #9,
|
||||
#10), several adjacent capabilities are intentionally not in this
|
||||
release and surface as §19.2 candidates:
|
||||
|
||||
- **First-OTC profile capture** (first name, last name, "why") — item
|
||||
#6, expected v0.8.0.
|
||||
- **Open beta-access request flow** replacing the allowlist gate —
|
||||
also item #6, v0.8.0.
|
||||
- **Passcodes** (a long-term reauth token alternative) — item #8,
|
||||
expected v0.10.0.
|
||||
- **Device-trust 30-day skip** — item #9, expected v0.11.0.
|
||||
- **Cloudflare Turnstile** on `/auth/otc/request` — item #10,
|
||||
expected v0.12.0.
|
||||
- **Removing the Gitea OAuth `/auth/callback` route entirely** — a
|
||||
later release after every active user has signed in via OTC.
|
||||
|
||||
## 0.5.0 — 2026-05-27
|
||||
|
||||
**Minor — no operator action required.** This release wires the
|
||||
PR-less per-RFC discussion surface (roadmap item #3, SPEC §10.10).
|
||||
An RFC's main view now carries a discussion panel distinct from PR
|
||||
comments and branch chat; contribution — proposing edits the document
|
||||
will land — still requires opening a PR via the §10.1 affordance.
|
||||
The substrate is the existing `threads` / `thread_messages` tables;
|
||||
rows with `threads.branch_name IS NULL` scope to the RFC's main view.
|
||||
No schema migration is required.
|
||||
|
||||
### Added
|
||||
|
||||
- **PR-less discussion endpoints** (`backend/app/api_discussion.py`)
|
||||
mounted at `/api/rfcs/<slug>/discussion/...`:
|
||||
- `GET /api/rfcs/<slug>/discussion/threads` — list threads where
|
||||
`threads.branch_name IS NULL`. Anonymous-readable per the v0.3.0
|
||||
contract; the default whole-doc chat thread is materialized
|
||||
lazily on first read.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads` — open a new
|
||||
discussion thread (`thread_kind='chat'`, `anchor_kind='whole-doc'`,
|
||||
`branch_name=NULL`). Body: optional `label`, optional first
|
||||
`message`. Requires contributor role.
|
||||
- `GET /api/rfcs/<slug>/discussion/threads/<thread_id>/messages`
|
||||
— read messages on a discussion thread. Anonymous-readable.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages`
|
||||
— post a message. Body: `text`, optional `quote`. Requires
|
||||
contributor role.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve`
|
||||
— resolve a discussion thread. Permission per §10.10: thread
|
||||
creator, RFC owner / arbiter, or app admin / owner.
|
||||
- **`RFCDiscussionPanel.jsx`** — the right-column surface on the RFC
|
||||
view when the viewer is on `main`. Composer requires sign-in;
|
||||
Cmd/Ctrl+Enter sends. Multiple threads surface as pill-shaped
|
||||
tabs above the message feed. A "New thread" affordance opens a
|
||||
fresh thread on the same RFC.
|
||||
- **SPEC `§10.10` PR-less discussion vs. contribution** — settles
|
||||
the distinction between discussion (RFC-scoped, no PR, both
|
||||
anonymous-readable and contributor-writeable) and contribution
|
||||
(still requires a PR via §10.1). Also extends `§5`'s `threads`
|
||||
table commentary so the null-branch interpretation is documented
|
||||
as actively used rather than reserved scaffold.
|
||||
- **SPEC `§17`** — lists the five new `discussion/...` endpoints
|
||||
in the illustrative table.
|
||||
|
||||
### Changed
|
||||
|
||||
- **`backend/app/chat.py`** — `_fan_out_chat` now passes
|
||||
`branch_name` straight through to the notify chokepoint instead of
|
||||
coercing `None` to `"main"`. The notifications row carries the
|
||||
null through, which preserves the §15.7 reconciler's keying on
|
||||
`(rfc_slug, branch_name)` for the eventual discussion-side
|
||||
chat-seen advance (deferred to a §19.2 candidate). Existing
|
||||
branch-scoped chat continues to pass non-null branch names; the
|
||||
change is invisible to that path.
|
||||
- **`backend/app/notify.py`** — `fan_out_chat_message`'s
|
||||
`branch_name` parameter is now typed `str | None` to match the
|
||||
v0.5.0 PR-less shape. Routing rules are unchanged; the inbox prose
|
||||
renders identically whether the chat lives on a branch or on the
|
||||
RFC's discussion surface, which is the right honest signal.
|
||||
- **`RFCView.jsx`** — the right-column panel is now conditional:
|
||||
when `branchParam === 'main'`, render `RFCDiscussionPanel`
|
||||
(the new PR-less surface); otherwise render the existing
|
||||
`ChatPanel` (branch chat unchanged).
|
||||
|
||||
### §19.2 candidates surfaced
|
||||
|
||||
- PR-less discussion: range / paragraph anchors (the data model
|
||||
permits them; the UI is the deferred part).
|
||||
- PR-less discussion: distinct notification `event_kind`s
|
||||
(`open_rfc_discussion_thread`, etc.) if usage shows contributors
|
||||
want to filter discussion-vs-branch in the §15.2 inbox.
|
||||
- PR-less discussion: chat-seen cursor closing the §15.7
|
||||
reconciliation loop for the new surface.
|
||||
- PR-less discussion: AI participant invocation (discussion-only,
|
||||
no `<change>` block side-effects).
|
||||
- PR-less discussion: anonymous-read polish to match the v0.6.0
|
||||
write-gate hardening (item #4).
|
||||
|
||||
### Upgrade steps (from 0.4.0)
|
||||
|
||||
1. The deployment **MUST** rebuild the frontend (`npm install &&
|
||||
npm run build`) so `RFCDiscussionPanel.jsx` ships in the bundle.
|
||||
No new env vars; existing `frontend/.env` is sufficient.
|
||||
2. The deployment **MUST** restart the backend so the new
|
||||
`api_discussion` router mounts. No schema migration runs — the
|
||||
`threads` table already supports `branch_name IS NULL` per §5,
|
||||
and the v0.5.0 build is the first to write rows in that shape.
|
||||
3. The deployment **MAY** announce the new surface to its
|
||||
contributors: the RFC view's main page now carries a discussion
|
||||
panel below the document. Existing branch chat and PR review
|
||||
surfaces are unchanged.
|
||||
4. The deployment **SHOULD NOT** expect a hardening of the
|
||||
anonymous-write gate in v0.5.0 — that lands in v0.6.0 (item #4).
|
||||
v0.5.0's write paths already refuse anonymous posts, so no
|
||||
pre-emptive operator action is needed.
|
||||
|
||||
## 0.4.0 — 2026-05-27
|
||||
|
||||
**Minor — no operator action required beyond rebuild + restart.** The
|
||||
|
||||
@@ -253,13 +253,18 @@ and exact columns are illustrative; the implementing session can adjust.
|
||||
- `threads` — every conversation in the system, whether scoped to an RFC's
|
||||
main view, a branch, or a span within a branch's document. Columns:
|
||||
`id`, `rfc_slug`, `branch_name` (nullable — null means scoped to the
|
||||
RFC's main view), `anchor_kind` (`whole-doc` | `range` | `paragraph`),
|
||||
RFC's main view, the PR-less per-RFC discussion surface per §10's
|
||||
closing note; non-null means scoped to a branch's work, including
|
||||
PR-comment threads), `anchor_kind` (`whole-doc` | `range` | `paragraph`),
|
||||
`anchor_payload` (JSON: serialized ProseMirror range or paragraph id),
|
||||
`thread_kind` (`chat` | `flag` | `review` — `review` is the diff-anchored
|
||||
PR-review thread defined in §10.4), `label` (short human-authored summary;
|
||||
for flags this is the entire content), `state` (`open` | `resolved` |
|
||||
`stale`), `created_by`, `created_at`, `resolved_at`, `resolved_by`.
|
||||
Visibility is derived from the underlying branch (§11.1).
|
||||
Visibility is derived from the underlying branch (§11.1); for the
|
||||
null-branch PR-less discussion surface, visibility follows the RFC
|
||||
(anonymous read open per the §14 / v0.3.0 contract, write requires
|
||||
contributor per §6.1, tightened toward anon-write-refused in v0.6.0).
|
||||
- `thread_messages` — the actual chat content for `chat`-kind threads.
|
||||
Columns: `id`, `thread_id`, `role` (`user` | `assistant` | `system`),
|
||||
`author_user_id` (nullable; null for assistant), `model_id` (nullable;
|
||||
@@ -344,17 +349,34 @@ merge with no data movement.
|
||||
|
||||
Authorization is owned by the app. Gitea sees only the bot account.
|
||||
|
||||
Authentication, as of v0.7.0, is by email + one-time-code: a visitor
|
||||
enters their email address, receives a six-digit code via SMTP, and
|
||||
exchanges the code for a session. The Gitea OAuth callback that
|
||||
v0.1 used as the human sign-in path remains as a migration fallback
|
||||
during the v0.7.0 window — `users.gitea_id` is preserved on existing
|
||||
rows so a grandfathered user signing in via either path resolves to
|
||||
the same row — but the primary surface points at OTC. `users.email`
|
||||
is the identity key for everything provisioned after v0.7.0;
|
||||
`users.gitea_id` is the grandfathering linker (nullable, partial-
|
||||
unique). The Gitea bot user + token are still required for server-
|
||||
side git operations (repo reads, PR creation); only the operator-
|
||||
facing sign-in surface moved.
|
||||
|
||||
### 6.1 Four roles, each a strict superset of the one below
|
||||
|
||||
1. **Anonymous.** Can read public RFCs (the meta repo's main branch,
|
||||
every RFC repo's main branch), read any branch whose `read_public`
|
||||
is true, read any PR. Cannot chat, propose, create branches, or
|
||||
open PRs.
|
||||
2. **Contributor.** Default role for any authenticated account.
|
||||
Everything anonymous can do, plus: propose new RFCs (open a PR
|
||||
against the meta repo), create branches on any RFC repo, open PRs
|
||||
from branches they have contribute access to, chat on anything
|
||||
they can read, claim ownership of unclaimed super-drafts.
|
||||
2. **Contributor.** Default role for any authenticated account. A
|
||||
first OTC sign-in by a previously unknown email provisions a row
|
||||
at this role; v0.7.0 keeps the v0.3.0 allowlist gate (`allowed_emails`)
|
||||
as the admission control, deferring the open beta-access request
|
||||
flow to a later release. Everything anonymous can do, plus:
|
||||
propose new RFCs (open a PR against the meta repo), create
|
||||
branches on any RFC repo, open PRs from branches they have
|
||||
contribute access to, chat on anything they can read, claim
|
||||
ownership of unclaimed super-drafts.
|
||||
3. **Admin.** Everything contributor can do, plus: act on any RFC
|
||||
(merge PRs on behalf of arbiters, graduate super-drafts, set
|
||||
branch visibility on anyone's behalf, downgrade or restore
|
||||
@@ -372,6 +394,14 @@ subject to the standard 30/90 hygiene rules (§12). Restoring is the
|
||||
reverse action. Every mute and restore is logged in
|
||||
`permission_events`.
|
||||
|
||||
The write-mute is keyed on `users.id` and is auth-path-agnostic: a
|
||||
contributor muted under the v0.1 OAuth-era flow stays muted after
|
||||
the v0.7.0 email/OTC migration, since the same row is reused via the
|
||||
email-match linker. Identity in this section means the `users.id`
|
||||
column; the v0.7.0 identity-key shift (`gitea_id` → `email`) is
|
||||
about which column carries the unique constraint for new
|
||||
provisioning, not about which column the permission gates read.
|
||||
|
||||
This write-mute is structurally distinct from the two notification
|
||||
mutes introduced in §15.8 — the per-RFC notification mute (the
|
||||
`muted` state on the `watches` row, §15.6) and the per-user
|
||||
@@ -1639,6 +1669,40 @@ framework's evidence unit; admitting plumbing commits — "fix merge
|
||||
conflict with main" — into that timeline would dilute the signal each
|
||||
commit is meant to carry.
|
||||
|
||||
### 10.10 PR-less discussion vs. contribution
|
||||
|
||||
PR comments and branch chat (§10.4, §8.4) are PR-scoped: they live on
|
||||
the `threads` rows whose `branch_name` names a branch (the PR's head
|
||||
or, pre-PR, a feature branch). They are the right surface for *this
|
||||
specific proposed change*. They are not the right surface for "what
|
||||
about this part of the RFC overall?" or "have we considered…?" — a
|
||||
question that doesn't yet warrant cutting a branch and that would
|
||||
distort a PR's review timeline if it landed there.
|
||||
|
||||
The RFC view carries a **discussion surface** distinct from PR
|
||||
comments. Its substrate is `threads` rows whose `branch_name IS NULL`
|
||||
(§5) — the same conversation table used by branch chat, with the
|
||||
nullable column doing the segregating. Posting a discussion thread or
|
||||
message does not open a PR; the §1 chokepoint is unaffected because
|
||||
chat messages never produced Git writes. Contribution — proposing
|
||||
edits the document will land — still requires opening a PR via the
|
||||
§10.1 affordance.
|
||||
|
||||
The distinction in one line: **discussion is what the RFC is for;
|
||||
contribution is how the RFC changes.** Either is honest; conflating
|
||||
them was the failure mode of generic-PR-comments-as-only-conversation.
|
||||
|
||||
Reads on the discussion surface follow §14 / the v0.3.0 anonymous-read
|
||||
contract: anyone can see the conversation. Writes require contributor
|
||||
role per §6.1 (v0.5.0 implements the gate; v0.6.0 — item #4 — hardens
|
||||
adjacent surfaces to match). The notification routing reuses the
|
||||
existing `chat_message_in_participated_thread` /
|
||||
`chat_reply_to_my_message` event kinds with `branch_name=null` on the
|
||||
fan-out row; the §15.7 reconciler and §15 inbox prose render
|
||||
identically whether the chat lives on a branch or on the RFC's
|
||||
discussion surface. A distinct `open_rfc_discussion_thread` event
|
||||
kind is a §19.2 candidate if evidence demands the split.
|
||||
|
||||
---
|
||||
|
||||
## 11. Branches and PRs: visibility, contribute, lifecycle
|
||||
@@ -1895,8 +1959,12 @@ and its public face.
|
||||
The app's root URL, accessed by an unauthenticated visitor, renders a
|
||||
landing page consisting of the title, the subtitle, and the short-form
|
||||
deck from the top of `PHILOSOPHY.md` (see §2). Beneath the deck, a
|
||||
single primary action: "Sign in with Gitea." Beneath that, a secondary
|
||||
link: "Read the full philosophy" → `/philosophy`.
|
||||
single primary action: "Sign in" → the email + one-time-code surface
|
||||
at `/login` (per §6.2). Beneath that, a secondary link: "Read the
|
||||
full philosophy" → `/philosophy`. The v0.1 landing said "Sign in
|
||||
with Gitea"; v0.7.0's email/OTC surface replaced that as the primary
|
||||
gesture, with a small "Sign in with Gitea (fallback)" link surviving
|
||||
on `/login` itself for the migration window.
|
||||
|
||||
This is the front door. It sets expectation before the user encounters
|
||||
the mechanics, so the mechanics (super-drafts, graduation, public
|
||||
@@ -2450,6 +2518,28 @@ The follow-up session will refine this. A minimal starting set:
|
||||
returned `version` matches the tag the operator just deployed,
|
||||
catching the failure mode where a restart did not pick up the
|
||||
new code.
|
||||
- `POST /auth/otc/request` — unauthenticated. Body carries `email`.
|
||||
Generates a six-digit code, stores its bcrypt hash with an expiry
|
||||
(`OTC_TTL_MINUTES`, default 10), and dispatches a plain-text email
|
||||
via the SMTP layer. Returns HTTP 200 (`{ok:true}`) uniformly so
|
||||
allowlist state (§6.1 / §6.2) is not leaked to callers. Returns
|
||||
HTTP 429 when the per-email cooldown (`OTC_REQUEST_COOLDOWN_SECONDS`,
|
||||
default 60) blocks back-to-back requests — the loud-failure shape
|
||||
for the abuse path. A re-request invalidates the prior unused
|
||||
code for the same email so only one code is outstanding at a time.
|
||||
Per §19.2's expected next session, this endpoint is the lead-up
|
||||
to the Cloudflare-Turnstile abuse-mitigation overlay.
|
||||
- `POST /auth/otc/verify` — unauthenticated. Body carries `email` and
|
||||
`code`. Validates the bcrypt hash against the most-recent unconsumed
|
||||
non-expired row for the email, marks the row consumed, provisions
|
||||
or links the `users` row by email (per §6.2's migration path —
|
||||
match by `users.email` case-insensitive, otherwise insert a fresh
|
||||
contributor row with `gitea_id = NULL`), and stores the session
|
||||
cookie. Returns HTTP 200 on success with a minimal user payload;
|
||||
HTTP 400 on any failure (expired, consumed, wrong, unknown). The
|
||||
failure modes collapse to a single generic message so a probing
|
||||
client cannot distinguish "you got the wrong code" from "we don't
|
||||
know this email" — the operator logs carry the distinction.
|
||||
- `GET /api/rfcs` — list entries with state, id, title, slug, repo,
|
||||
owners, last_active_at, has_open_prs, starred-by-me. Supports
|
||||
search, sort, filter chips, and the `unclaimed` predicate.
|
||||
@@ -2552,6 +2642,26 @@ The follow-up session will refine this. A minimal starting set:
|
||||
- `POST /api/rfcs/<slug>/branches/<branch>/threads/<thread_id>/resolve`
|
||||
— resolve a thread per §8.12; permission per the rules in that
|
||||
section.
|
||||
- `GET /api/rfcs/<slug>/discussion/threads` — list threads on the
|
||||
RFC's PR-less discussion surface per §10.10 (rows where
|
||||
`threads.branch_name IS NULL`). Anonymous-readable per the v0.3.0
|
||||
anonymous-read contract; the default whole-doc chat thread is
|
||||
materialized lazily on first read, mirroring the §8.12 branch-chat
|
||||
default.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads` — open a discussion
|
||||
thread per §10.10. Body: optional `label` (short summary), optional
|
||||
first `message`. Writes require contributor role; anonymous viewers
|
||||
receive 401. Thread is created with `anchor_kind='whole-doc'`,
|
||||
`thread_kind='chat'`, `branch_name=NULL`.
|
||||
- `GET /api/rfcs/<slug>/discussion/threads/<thread_id>/messages` —
|
||||
read messages on a discussion thread. Anonymous-readable.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages` —
|
||||
post a message into a discussion thread per §10.10. Body: `text`,
|
||||
optional `quote`. Writes require contributor role.
|
||||
- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve` —
|
||||
resolve a discussion thread per §10.10; permission collapses to the
|
||||
thread creator, any RFC owner / arbiter per §6.3, and any app
|
||||
admin / owner per §6.1.
|
||||
- `POST /api/rfcs/<slug>/branches/<branch>/open-pr` — open a PR per
|
||||
§10.1; body carries the AI-drafted (and possibly edited) title and
|
||||
description.
|
||||
@@ -3287,6 +3397,55 @@ binding.
|
||||
("operators MAY configure their monitoring to probe `/api/health`;
|
||||
the endpoint is unauthenticated by design"). §17 now lists the
|
||||
endpoint in its illustrative table.*
|
||||
- **PR-less discussion: range and paragraph anchors.** v0.5.0 lands
|
||||
the structural discussion surface (§10.10) but constrains every
|
||||
PR-less thread to `anchor_kind='whole-doc'` — the data model permits
|
||||
`range` and `paragraph` anchors (§5) but the UI work to surface a
|
||||
passage-anchored thread on a non-branch view is the deferred half.
|
||||
The natural follow-on is a margin-icon affordance on the main view
|
||||
matching §8.12's branch-side surface, with the anchor stored on the
|
||||
null-branch thread. Earns its session when discussion volume warrants
|
||||
the precision; v0.5.0's flat surface is sufficient for most "have we
|
||||
considered…?" gestures. Touches §10.10 and §8.12.
|
||||
- **PR-less discussion: distinct notification event_kinds.** v0.5.0
|
||||
routes per-RFC discussion messages through the existing
|
||||
`chat_message_in_participated_thread` and `chat_reply_to_my_message`
|
||||
event kinds with `branch_name=null` on the fan-out row. The inbox
|
||||
prose reads identically whether the chat lives on a branch or on the
|
||||
RFC's discussion surface, which is honest signal: the conversation
|
||||
shape is the same; only the scope differs. A future session may
|
||||
introduce `open_rfc_discussion_thread` / `post_rfc_discussion_message`
|
||||
if evidence shows contributors want to filter discussion-vs-branch
|
||||
chat distinctly in the §15.2 inbox. Touches §15.1 (the event_kind
|
||||
enum), §15.2 (the inbox filter chips), and §10.10.
|
||||
- **PR-less discussion: chat-seen cursor.** §15.7 commits the
|
||||
`branch_chat_seen` cursor for branch-scoped chat. The PR-less
|
||||
discussion surface has no equivalent cursor in v0.5.0; the inbox
|
||||
reconciler's keying on `(rfc_slug, branch_name)` does match a
|
||||
null-branch advance, but no write path advances it. A natural
|
||||
follow-on is a sibling table — `rfc_discussion_seen` or a
|
||||
null-branch row on `branch_chat_seen` — that the discussion panel
|
||||
advances on read, closing the §15.7 reconciliation loop for
|
||||
discussion-surface notifications. Defer-able until inbox volume on
|
||||
the new surface shows it matters.
|
||||
- **PR-less discussion: AI participation.** v0.5.0's discussion
|
||||
surface is human-only — no AI participant invocation, no `<change>`
|
||||
block parsing, no per-thread model picker. The branch chat (§8.12)
|
||||
retains the §18 AI surface. The natural follow-on is wiring the AI
|
||||
participant into discussion threads (the model picker, the
|
||||
`Ask Claude` button on a selection tooltip) without enabling
|
||||
document edits — a discussion-only AI turn produces only chat
|
||||
content, no `changes` row, no commit. Contribution still requires a
|
||||
PR; the AI's discussion-side help is just better prompts. Touches
|
||||
§10.10, §8.12, and §18.
|
||||
- **PR-less discussion: anonymous read polish.** v0.5.0 inherits the
|
||||
v0.3.0 anonymous-read contract — anyone can read; only signed-in
|
||||
contributors can write. The composer affordance for anonymous
|
||||
viewers ("Sign in to comment.") matches the existing read-only-bar
|
||||
treatment but the surface has not yet been audited for the v0.6.0
|
||||
hardening that tightens write gates app-wide. The §19.2 "public
|
||||
face of discuss mode" entry overlaps; this entry is its discussion-
|
||||
surface variant.
|
||||
- **Deployment-supplied subject framing.** The framework was built
|
||||
with one deployment in mind (OHM, standardizing natural-language
|
||||
vocabulary), but the substrate generalizes to any domain that
|
||||
@@ -3340,6 +3499,68 @@ the new §15 (Notifications, in full), and §17 (the notification
|
||||
endpoints — list, mark-read, stream, watch mutation, preferences,
|
||||
quiet-hours, per-user mute, unsubscribe, bounce webhook).
|
||||
|
||||
- **First-OTC profile capture.** *Surfaced by v0.7.0's email/OTC
|
||||
migration.* When a fresh email lands at `/auth/otc/verify` with
|
||||
no matching `users.email` row, v0.7.0 provisions the row with
|
||||
`display_name = <local part of email>` and no other identity
|
||||
fields. A subsequent release (the roadmap item-#6 candidate)
|
||||
is expected to add a one-shot profile-capture step on the
|
||||
first-OTC sign-in: first name, last name, and a free-text
|
||||
"why I want access" field that flows into the open beta-access
|
||||
request queue (also item #6) that replaces the v0.3.0
|
||||
`allowed_emails` gate. The schema slot exists implicitly already
|
||||
(`users.display_name` is updateable, the audit-log + permission-
|
||||
events tables carry the freeform notes); the structural decision
|
||||
is what gates the capture (modal on `/login` after verify? a
|
||||
one-time redirect to `/welcome/profile`? a deferred banner on
|
||||
the main view?) and how it interacts with the open-access
|
||||
request flow that replaces the allowlist. Earns its session as
|
||||
the v0.8.0 design pass.
|
||||
- **Removing the Gitea OAuth fallback.** *Surfaced by v0.7.0.*
|
||||
v0.7.0 keeps `/auth/callback` functional and links to it as a
|
||||
"Sign in with Gitea (fallback)" affordance on the new `/login`
|
||||
surface, so users with active OAuth sessions or older invite
|
||||
paths still have a way in during the migration window. A later
|
||||
release retires the route entirely. Decision points: how do we
|
||||
know "every active user has signed in via OTC at least once"
|
||||
(probably: a `users.otc_first_signed_in_at` timestamp added in
|
||||
v0.7.x and a query that confirms 100% population), how do we
|
||||
handle users who never come back (probably: silently leave them
|
||||
with stale rows; OAuth callback returning 404 is a sufficient
|
||||
message), and whether the `/auth/login` and `/auth/callback`
|
||||
routes get a tombstone redirect to `/login` or just 404. Earns
|
||||
its session once the OTC adoption curve flattens.
|
||||
- **Device trust (30-day skip).** *Surfaced by v0.7.0 — the
|
||||
signed-in cookie already lasts 30 days via SessionMiddleware,
|
||||
but every sign-in still requires a fresh OTC.* The roadmap
|
||||
item-#9 candidate adds a "trust this device" affordance on the
|
||||
verify step that issues a longer-lived rotating token, so
|
||||
returning visitors on the same device skip the OTC step. The
|
||||
shape question is whether the trust is a signed cookie distinct
|
||||
from the session, a row in a `device_trust` table keyed by a
|
||||
random device-id, or a property of the session itself; and
|
||||
whether the trust survives password-equivalent events (none
|
||||
exist yet — passcodes are item #8 / v0.10.0) or only survives
|
||||
explicit logout. Earns its session as the v0.11.0 design pass.
|
||||
- **Cloudflare Turnstile (or equivalent) on `/auth/otc/request`.**
|
||||
*Surfaced by v0.7.0 — the endpoint is now the new abuse hot
|
||||
path.* Per-email cooldown stops the trivial loop; what it
|
||||
doesn't stop is a distributed scrape that fans out across a
|
||||
large invitee list to harvest the "this email is admitted vs.
|
||||
this email is not" signal indirectly (timing differences, SMTP
|
||||
bounce-rate observation). The roadmap item-#10 candidate gates
|
||||
the request endpoint behind a one-step browser-side challenge
|
||||
before the bcrypt hash + SMTP send. Open questions: which
|
||||
provider (Turnstile is the default since it's free and
|
||||
privacy-respecting; hCaptcha and reCAPTCHA are also viable);
|
||||
how the deployment configures it (`TURNSTILE_SITE_KEY` +
|
||||
`TURNSTILE_SECRET_KEY` env vars, gated by `if
|
||||
config.turnstile_site_key:` at the handler so existing
|
||||
deployments don't break); whether the verify endpoint also
|
||||
gets a challenge (probably yes for parity); and how the test
|
||||
harness mocks the challenge. Earns its session as the v0.12.0
|
||||
design pass.
|
||||
|
||||
### 19.3 Working agreement for the queue
|
||||
|
||||
Pre-build sessions ran on the queue agreement from prior versions
|
||||
|
||||
@@ -81,3 +81,14 @@ WEBHOOK_EMAIL_BOUNCE_SECRET=
|
||||
# Production default is hourly; tests override to seconds via the same
|
||||
# env var.
|
||||
HYGIENE_TICK_SECONDS=3600
|
||||
|
||||
# --- v0.7.0: email + one-time-code sign-in (§6.2) ---
|
||||
# How long a one-time code stays valid after issuance. Re-requesting
|
||||
# invalidates the prior code immediately regardless of TTL.
|
||||
OTC_TTL_MINUTES=10
|
||||
|
||||
# Per-email cooldown between successive /auth/otc/request calls. The
|
||||
# endpoint returns HTTP 429 when the cooldown blocks a request (the
|
||||
# loud-failure shape so the abuse path is visible). Set to 0 to
|
||||
# disable the cooldown — useful for tests but never in production.
|
||||
OTC_REQUEST_COOLDOWN_SECONDS=60
|
||||
|
||||
@@ -20,6 +20,7 @@ from pydantic import BaseModel, Field
|
||||
from . import (
|
||||
api_admin,
|
||||
api_branches,
|
||||
api_discussion,
|
||||
api_graduation,
|
||||
api_notifications,
|
||||
api_prs,
|
||||
@@ -81,6 +82,12 @@ def make_router(
|
||||
# the §15.8 mute typeahead) and the §6/§17 admin surfaces
|
||||
# (role, write-mute, audit-log, graduation-readiness queue).
|
||||
router.include_router(api_admin.make_router(config))
|
||||
# v0.5.0: §5 / §7 / §10 — PR-less per-RFC discussion endpoints.
|
||||
# The substrate is the existing threads/thread_messages tables;
|
||||
# rows whose branch_name IS NULL scope to the RFC's main view.
|
||||
# Contribution still requires a PR (api_prs above); this surface
|
||||
# is for discussion that does not yet warrant a branch.
|
||||
router.include_router(api_discussion.make_router())
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# §17: /api/health — unauthenticated post-flight probe.
|
||||
|
||||
@@ -0,0 +1,330 @@
|
||||
"""§5 / §7 / §10 — PR-less per-RFC discussion endpoints (v0.5.0).
|
||||
|
||||
This module surfaces the discussion-without-PR shape committed by the
|
||||
roadmap's item #3. The substrate is the existing `threads` /
|
||||
`thread_messages` pair from §5: rows whose `branch_name` is NULL are
|
||||
scoped to the RFC's main view (the schema comment on the column says
|
||||
exactly this; until now no write path produced such rows). This module
|
||||
is the read+write surface for those rows.
|
||||
|
||||
Contribution still requires a PR: the §10 PR flow is unchanged, the
|
||||
branch-scoped chat in `api_branches.py` is unchanged, and accept /
|
||||
decline of AI `<change>` blocks still lives on a branch. What this
|
||||
module adds is the "discuss freely about the RFC, no branch yet" surface
|
||||
— a place to drop a question, a flag-style observation, or a multi-turn
|
||||
conversation that does not yet warrant cutting a branch.
|
||||
|
||||
Auth shape mirrors the v0.3.0 anonymous-read contract: reads are open,
|
||||
writes require `auth.require_contributor`. Item #4 ("anon discuss/
|
||||
contribute off-limits") tightens the read gate in v0.6.0; v0.5.0's
|
||||
write gate already holds the line.
|
||||
|
||||
Notification routing reuses the existing `fan_out_chat_message` path
|
||||
with `branch_name=None`; the `notifications.branch_name` column is
|
||||
nullable, and the inbox row prose ("@alice posted a chat message on
|
||||
<RFC title>") renders identically whether the chat lives on a branch
|
||||
or on the RFC's discussion surface. The existing
|
||||
`chat_message_in_participated_thread` / `chat_reply_to_my_message`
|
||||
event kinds carry both shapes; introducing a parallel
|
||||
`open_rfc_discussion_thread` / `post_rfc_discussion_message` enum pair
|
||||
would split routing without adding signal. The §15 §19.2 candidate
|
||||
"distinct event_kinds for PR-less discussion" notes the option for a
|
||||
future session if evidence demands the split.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import logging
|
||||
from typing import Any
|
||||
|
||||
from fastapi import APIRouter, HTTPException, Request
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
from . import auth, chat as chat_layer, db
|
||||
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Request bodies
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
class DiscussionThreadCreateBody(BaseModel):
|
||||
"""A discussion thread is a `thread_kind='chat'`, `anchor_kind='whole-doc'`,
|
||||
`branch_name=NULL` row. Anchored-range / per-paragraph threads on the
|
||||
RFC discussion surface are a §19.2 candidate — the schema supports
|
||||
them; the UI work to surface a range-anchor on a non-branch view is
|
||||
the deferred part. v0.5.0 keeps the shape narrow."""
|
||||
label: str | None = Field(default=None, max_length=400)
|
||||
message: str | None = Field(default=None, max_length=20_000)
|
||||
|
||||
|
||||
class DiscussionMessageBody(BaseModel):
|
||||
text: str = Field(min_length=1, max_length=20_000)
|
||||
quote: str | None = Field(default=None, max_length=2000)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Router
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def make_router() -> APIRouter:
|
||||
router = APIRouter()
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# GET /api/rfcs/<slug>/discussion/threads
|
||||
# Lists every PR-less thread on the RFC. The default whole-doc thread
|
||||
# is materialized lazily on first list (mirroring the §8.12 branch-
|
||||
# chat default-thread treatment) so the UI always has a target for
|
||||
# the compose-message affordance.
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
@router.get("/api/rfcs/{slug}/discussion/threads")
|
||||
async def list_discussion_threads(slug: str, request: Request) -> dict[str, Any]:
|
||||
viewer = auth.current_user(request)
|
||||
_require_rfc_readable(slug)
|
||||
# Ensure the default whole-doc discussion thread exists. We mint
|
||||
# it on first read regardless of viewer (anonymous viewers can
|
||||
# trigger the creation — the row's `created_by` is null in that
|
||||
# case, mirroring `_ensure_branch_chat_thread`).
|
||||
_ensure_discussion_thread(slug, viewer)
|
||||
rows = db.conn().execute(
|
||||
"""
|
||||
SELECT id, anchor_kind, anchor_payload, thread_kind, label, state,
|
||||
created_by, created_at, resolved_at, resolved_by
|
||||
FROM threads
|
||||
WHERE rfc_slug = ? AND branch_name IS NULL
|
||||
ORDER BY id
|
||||
""",
|
||||
(slug,),
|
||||
).fetchall()
|
||||
return {"items": [_serialize_thread(r) for r in rows]}
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# POST /api/rfcs/<slug>/discussion/threads
|
||||
# Open a fresh discussion thread. Writes require require_contributor
|
||||
# — anonymous viewers can read but cannot open a thread, per item
|
||||
# #4's hardening anticipated in v0.6.0 (we already enforce it here
|
||||
# to avoid the open window).
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
@router.post("/api/rfcs/{slug}/discussion/threads")
|
||||
async def create_discussion_thread(
|
||||
slug: str, body: DiscussionThreadCreateBody, request: Request
|
||||
) -> dict[str, Any]:
|
||||
viewer = auth.require_contributor(request)
|
||||
_require_rfc_readable(slug)
|
||||
cur = db.conn().execute(
|
||||
"""
|
||||
INSERT INTO threads
|
||||
(rfc_slug, branch_name, anchor_kind, anchor_payload,
|
||||
thread_kind, label, created_by)
|
||||
VALUES (?, NULL, 'whole-doc', NULL, 'chat', ?, ?)
|
||||
""",
|
||||
(slug, body.label, viewer.user_id),
|
||||
)
|
||||
thread_id = cur.lastrowid
|
||||
message_id = None
|
||||
if body.message:
|
||||
message_id = chat_layer.append_user_message(
|
||||
thread_id=thread_id,
|
||||
author_user_id=viewer.user_id,
|
||||
text=body.message,
|
||||
quote=None,
|
||||
)
|
||||
return {"thread_id": thread_id, "message_id": message_id}
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# GET /api/rfcs/<slug>/discussion/threads/<thread_id>/messages
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
@router.get("/api/rfcs/{slug}/discussion/threads/{thread_id}/messages")
|
||||
async def get_discussion_thread_messages(
|
||||
slug: str, thread_id: int, request: Request
|
||||
) -> dict[str, Any]:
|
||||
_viewer = auth.current_user(request)
|
||||
_require_rfc_readable(slug)
|
||||
thread = _require_discussion_thread(slug, thread_id)
|
||||
rows = db.conn().execute(
|
||||
"""
|
||||
SELECT m.id, m.role, m.author_user_id,
|
||||
u.gitea_login AS author_login,
|
||||
u.display_name AS author_display,
|
||||
m.model_id, m.text, m.quote, m.created_at
|
||||
FROM thread_messages m
|
||||
LEFT JOIN users u ON u.id = m.author_user_id
|
||||
WHERE m.thread_id = ?
|
||||
ORDER BY m.id
|
||||
""",
|
||||
(thread_id,),
|
||||
).fetchall()
|
||||
return {
|
||||
"thread": _serialize_thread(thread),
|
||||
"messages": [_serialize_message(r) for r in rows],
|
||||
}
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
@router.post("/api/rfcs/{slug}/discussion/threads/{thread_id}/messages")
|
||||
async def post_discussion_message(
|
||||
slug: str, thread_id: int, body: DiscussionMessageBody, request: Request
|
||||
) -> dict[str, Any]:
|
||||
viewer = auth.require_contributor(request)
|
||||
_require_rfc_readable(slug)
|
||||
_require_discussion_thread(slug, thread_id)
|
||||
message_id = chat_layer.append_user_message(
|
||||
thread_id=thread_id,
|
||||
author_user_id=viewer.user_id,
|
||||
text=body.text,
|
||||
quote=body.quote,
|
||||
)
|
||||
return {"ok": True, "message_id": message_id}
|
||||
|
||||
# -------------------------------------------------------------------
|
||||
# POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve
|
||||
# -------------------------------------------------------------------
|
||||
|
||||
@router.post("/api/rfcs/{slug}/discussion/threads/{thread_id}/resolve")
|
||||
async def resolve_discussion_thread(
|
||||
slug: str, thread_id: int, request: Request
|
||||
) -> dict[str, Any]:
|
||||
viewer = auth.require_contributor(request)
|
||||
rfc = _require_rfc_readable(slug)
|
||||
thread = _require_discussion_thread(slug, thread_id)
|
||||
if not _can_resolve(rfc, thread, viewer):
|
||||
raise HTTPException(
|
||||
403,
|
||||
"Only the thread creator, an RFC owner/arbiter, or an app admin/owner may resolve",
|
||||
)
|
||||
db.conn().execute(
|
||||
"""
|
||||
UPDATE threads
|
||||
SET state = 'resolved',
|
||||
resolved_by = ?,
|
||||
resolved_at = datetime('now')
|
||||
WHERE id = ?
|
||||
""",
|
||||
(viewer.user_id, thread_id),
|
||||
)
|
||||
return {"ok": True, "thread_id": thread_id}
|
||||
|
||||
return router
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _require_rfc_readable(slug: str):
|
||||
"""Per the v0.3.0 anonymous-read contract: any cached RFC is readable
|
||||
by anyone. Withdrawn entries refuse reads of every shape — same rule
|
||||
`_require_rfc_with_repo` in `api_branches.py` follows."""
|
||||
row = db.conn().execute(
|
||||
"SELECT * FROM cached_rfcs WHERE slug = ?", (slug,)
|
||||
).fetchone()
|
||||
if row is None:
|
||||
raise HTTPException(404, "RFC not found")
|
||||
if row["state"] == "withdrawn":
|
||||
raise HTTPException(409, "RFC is withdrawn")
|
||||
return row
|
||||
|
||||
|
||||
def _require_discussion_thread(slug: str, thread_id: int):
|
||||
"""A discussion thread is one whose (rfc_slug, branch_name) = (slug,
|
||||
NULL). Refuse cleanly if the thread id resolves to a branch-scoped
|
||||
thread instead — that lookup belongs on the branch endpoints."""
|
||||
row = db.conn().execute(
|
||||
"""
|
||||
SELECT * FROM threads
|
||||
WHERE id = ? AND rfc_slug = ? AND branch_name IS NULL
|
||||
""",
|
||||
(thread_id, slug),
|
||||
).fetchone()
|
||||
if not row:
|
||||
raise HTTPException(404, "Discussion thread not found")
|
||||
return row
|
||||
|
||||
|
||||
def _ensure_discussion_thread(slug: str, viewer) -> int:
|
||||
"""Per the §8.12 lazy-create pattern, materialize a default whole-doc
|
||||
chat thread on the RFC's discussion surface on first read. Created_by
|
||||
is null when an anonymous viewer triggers creation — the thread is
|
||||
structurally owned by the RFC, not by whoever opened the view."""
|
||||
row = db.conn().execute(
|
||||
"""
|
||||
SELECT id FROM threads
|
||||
WHERE rfc_slug = ? AND branch_name IS NULL
|
||||
AND anchor_kind = 'whole-doc' AND thread_kind = 'chat'
|
||||
ORDER BY id LIMIT 1
|
||||
""",
|
||||
(slug,),
|
||||
).fetchone()
|
||||
if row:
|
||||
return row["id"]
|
||||
cur = db.conn().execute(
|
||||
"""
|
||||
INSERT INTO threads
|
||||
(rfc_slug, branch_name, anchor_kind, thread_kind, label, created_by)
|
||||
VALUES (?, NULL, 'whole-doc', 'chat', NULL, ?)
|
||||
""",
|
||||
(slug, viewer.user_id if viewer else None),
|
||||
)
|
||||
return cur.lastrowid
|
||||
|
||||
|
||||
def _can_resolve(rfc, thread, viewer) -> bool:
|
||||
if viewer is None:
|
||||
return False
|
||||
if viewer.role in ("owner", "admin"):
|
||||
return True
|
||||
owners = json.loads(rfc["owners_json"] or "[]")
|
||||
arbiters = json.loads(rfc["arbiters_json"] or "[]")
|
||||
if viewer.gitea_login in owners or viewer.gitea_login in arbiters:
|
||||
return True
|
||||
if thread["created_by"] == viewer.user_id:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Serializers — mirror api_branches.py's shape
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _serialize_thread(row) -> dict[str, Any]:
|
||||
payload = row["anchor_payload"]
|
||||
try:
|
||||
anchor = json.loads(payload) if payload else None
|
||||
except Exception:
|
||||
anchor = None
|
||||
return {
|
||||
"id": row["id"],
|
||||
"anchor_kind": row["anchor_kind"],
|
||||
"anchor_payload": anchor,
|
||||
"thread_kind": row["thread_kind"],
|
||||
"label": row["label"],
|
||||
"state": row["state"],
|
||||
"created_by": row["created_by"],
|
||||
"created_at": row["created_at"],
|
||||
"resolved_at": row["resolved_at"] if "resolved_at" in row.keys() else None,
|
||||
"resolved_by": row["resolved_by"] if "resolved_by" in row.keys() else None,
|
||||
}
|
||||
|
||||
|
||||
def _serialize_message(row) -> dict[str, Any]:
|
||||
return {
|
||||
"id": row["id"],
|
||||
"role": row["role"],
|
||||
"author_user_id": row["author_user_id"],
|
||||
"author_login": row["author_login"],
|
||||
"author_display": row["author_display"],
|
||||
"model_id": row["model_id"],
|
||||
"text": row["text"],
|
||||
"quote": row["quote"],
|
||||
"created_at": row["created_at"],
|
||||
}
|
||||
+8
-2
@@ -193,10 +193,16 @@ def current_user(request: Request) -> SessionUser | None:
|
||||
).fetchone()
|
||||
if row is None:
|
||||
return None
|
||||
# v0.7.0: OTC-provisioned users have NULL gitea_id / gitea_login.
|
||||
# Coerce nulls to the SessionUser's typed defaults so downstream
|
||||
# code (Actor, _on_behalf_trailer) reads a stable shape regardless
|
||||
# of which sign-in path the row came from. The DB remains the
|
||||
# source of truth for "is this an OAuth-linked user" (gitea_id IS
|
||||
# NOT NULL); the in-memory SessionUser is the per-request handle.
|
||||
return SessionUser(
|
||||
user_id=row["id"],
|
||||
gitea_id=row["gitea_id"],
|
||||
gitea_login=row["gitea_login"],
|
||||
gitea_id=row["gitea_id"] or 0,
|
||||
gitea_login=row["gitea_login"] or "",
|
||||
display_name=row["display_name"],
|
||||
email=row["email"] or "",
|
||||
avatar_url=row["avatar_url"] or "",
|
||||
|
||||
+6
-1
@@ -168,10 +168,15 @@ def _fan_out_chat(thread_id: int, author_user_id: int, message_id: int) -> None:
|
||||
).fetchone()
|
||||
if pr_row:
|
||||
pr_number = pr_row["pr_number"]
|
||||
# v0.5.0 (§5 / §10 — PR-less discussion): a thread with
|
||||
# branch_name IS NULL is scoped to the RFC's main view. Pass None
|
||||
# through to the notify chokepoint so the notifications row keeps
|
||||
# `branch_name` null — coercing it to "main" would misroute the
|
||||
# §15.7 chat-seen reconciler (which keys on branch_name).
|
||||
notify.fan_out_chat_message(
|
||||
actor_user_id=author_user_id,
|
||||
rfc_slug=row["rfc_slug"],
|
||||
branch_name=row["branch_name"] or "main",
|
||||
branch_name=row["branch_name"],
|
||||
thread_id=thread_id,
|
||||
message_id=message_id,
|
||||
is_review_thread=(row["thread_kind"] == "review"),
|
||||
|
||||
@@ -0,0 +1,96 @@
|
||||
"""Outbound OTC email — a thin wrapper over the existing SMTP layer.
|
||||
|
||||
The §15.4 notification mailer in `email.py` is purpose-built for
|
||||
inbox-driven mail (unsubscribe footers, quiet-hours holds, bundling).
|
||||
OTC mail is structurally different: it carries a credential, has no
|
||||
inbox row behind it, and ignores user-preferences (a contributor
|
||||
who's opted out of every notification still needs to receive the
|
||||
code they explicitly requested).
|
||||
|
||||
So this module reuses `EmailConfig.from_env()` for the SMTP plumbing
|
||||
and the From identity, but writes its own envelope. In dev (no
|
||||
SMTP_HOST set), the envelope is logged at INFO level and pushed to
|
||||
the same `_SENT` buffer the notification mailer uses, so the
|
||||
integration tests can assert on the outbound shape without standing
|
||||
up an SMTP server.
|
||||
|
||||
The send is synchronous. The `/auth/otc/request` endpoint always
|
||||
returns 202 regardless of send outcome — the user-facing surface
|
||||
doesn't know whether the SMTP relay was reachable, since revealing
|
||||
that would let an attacker probe for valid emails on a tight loop.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import smtplib
|
||||
from email.message import EmailMessage
|
||||
from email.utils import formataddr
|
||||
|
||||
from .email import EmailConfig, _SENT
|
||||
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def send_otc_email(to_address: str, code: str) -> bool:
|
||||
"""Compose and send the one-time-code email. Returns True on the
|
||||
happy path; False on SMTP failure. The notifier-side buffer
|
||||
`_SENT` is appended either way so tests can assert on content.
|
||||
|
||||
The subject and body intentionally avoid branding strings that
|
||||
belong to a deployment — only `EMAIL_FROM_NAME` (operator-supplied
|
||||
via env) lands in the From line. The body names the code, the
|
||||
TTL, and a single instruction line. No tracking pixel, no
|
||||
deep-link query, no embedded JS — plain text only."""
|
||||
cfg = EmailConfig.from_env()
|
||||
subject = f"Your sign-in code for {cfg.from_name}"
|
||||
body = _body(code, cfg)
|
||||
envelope = {
|
||||
"to": to_address,
|
||||
"from": formataddr((cfg.from_name, cfg.from_address)),
|
||||
"subject": subject,
|
||||
"body": body,
|
||||
"kind": "otc",
|
||||
}
|
||||
_SENT.append(envelope)
|
||||
|
||||
if not cfg.enabled:
|
||||
log.info("otc email disabled (EMAIL_ENABLED=0): to=%s", to_address)
|
||||
return True
|
||||
if not cfg.smtp_host:
|
||||
# Dev fallback: surface the code at INFO so the operator can
|
||||
# complete a sign-in flow without an SMTP relay. In production
|
||||
# SMTP_HOST is always set per OHM's overlay.
|
||||
log.info("otc email (stdout fallback): to=%s code=%s", to_address, code)
|
||||
return True
|
||||
|
||||
try:
|
||||
msg = EmailMessage()
|
||||
msg["From"] = envelope["from"]
|
||||
msg["To"] = to_address
|
||||
msg["Subject"] = subject
|
||||
msg.set_content(body)
|
||||
smtp = smtplib.SMTP(cfg.smtp_host, cfg.smtp_port, timeout=30)
|
||||
try:
|
||||
if cfg.smtp_starttls:
|
||||
smtp.starttls()
|
||||
if cfg.smtp_user:
|
||||
smtp.login(cfg.smtp_user, cfg.smtp_password)
|
||||
smtp.send_message(msg)
|
||||
finally:
|
||||
smtp.quit()
|
||||
return True
|
||||
except Exception:
|
||||
log.exception("otc email send failed: to=%s", to_address)
|
||||
return False
|
||||
|
||||
|
||||
def _body(code: str, cfg: EmailConfig) -> str:
|
||||
return (
|
||||
f"Your sign-in code is:\n\n"
|
||||
f" {code}\n\n"
|
||||
f"Enter this code in the sign-in screen to finish signing in.\n"
|
||||
f"The code expires in 10 minutes. If you did not request this,\n"
|
||||
f"you can safely ignore this email — no account was created.\n\n"
|
||||
f"---\n"
|
||||
f"{cfg.from_name} · {cfg.app_url}\n"
|
||||
)
|
||||
+61
-1
@@ -12,9 +12,21 @@ from contextlib import asynccontextmanager
|
||||
|
||||
from fastapi import APIRouter, FastAPI, HTTPException, Request
|
||||
from fastapi.responses import RedirectResponse
|
||||
from pydantic import BaseModel, Field
|
||||
from starlette.middleware.sessions import SessionMiddleware
|
||||
|
||||
from . import api as api_routes, auth, cache, db, digest, hygiene, providers as providers_mod, webhooks
|
||||
from . import (
|
||||
api as api_routes,
|
||||
auth,
|
||||
cache,
|
||||
db,
|
||||
digest,
|
||||
email_otc,
|
||||
hygiene,
|
||||
otc,
|
||||
providers as providers_mod,
|
||||
webhooks,
|
||||
)
|
||||
from .bot import Bot
|
||||
from .config import load_config
|
||||
from .gitea import Gitea
|
||||
@@ -23,6 +35,15 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name
|
||||
log = logging.getLogger("rfc_app")
|
||||
|
||||
|
||||
class OtcRequestBody(BaseModel):
|
||||
email: str = Field(min_length=3, max_length=320)
|
||||
|
||||
|
||||
class OtcVerifyBody(BaseModel):
|
||||
email: str = Field(min_length=3, max_length=320)
|
||||
code: str = Field(min_length=1, max_length=16)
|
||||
|
||||
|
||||
@asynccontextmanager
|
||||
async def lifespan(app: FastAPI):
|
||||
config = load_config()
|
||||
@@ -122,4 +143,43 @@ def _oauth_router(config) -> APIRouter:
|
||||
request.session.clear()
|
||||
return RedirectResponse("/")
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# v0.7.0: email + one-time-code sign-in (§6.2).
|
||||
#
|
||||
# Replaces the OAuth gesture as the primary human-auth path. The
|
||||
# /auth/callback handler above remains functional as a fallback;
|
||||
# the new UI no longer surfaces it. A future release retires the
|
||||
# OAuth path entirely once every active user has signed in at
|
||||
# least once via OTC.
|
||||
# ---------------------------------------------------------------
|
||||
|
||||
@router.post("/auth/otc/request")
|
||||
async def otc_request(body: OtcRequestBody):
|
||||
outcome = otc.request_code(body.email)
|
||||
if outcome.reason == "cooldown":
|
||||
# Loud failure per the rate-limit primitive — the abuse
|
||||
# surface should be visible to clients hammering /request.
|
||||
raise HTTPException(429, "Wait before requesting another code")
|
||||
if outcome.sent and outcome.code is not None:
|
||||
email_otc.send_otc_email(body.email.strip(), outcome.code)
|
||||
# 202 regardless of allowlist/invalid — don't leak which
|
||||
# emails are recognized.
|
||||
return {"ok": True}
|
||||
|
||||
@router.post("/auth/otc/verify")
|
||||
async def otc_verify(body: OtcVerifyBody, request: Request):
|
||||
result = otc.verify_code(body.email, body.code)
|
||||
if not result.ok or result.user is None:
|
||||
raise HTTPException(400, "Invalid or expired code")
|
||||
auth.store_session(request, result.user)
|
||||
return {
|
||||
"ok": True,
|
||||
"user": {
|
||||
"id": result.user.user_id,
|
||||
"display_name": result.user.display_name,
|
||||
"email": result.user.email,
|
||||
"role": result.user.role,
|
||||
},
|
||||
}
|
||||
|
||||
return router
|
||||
|
||||
@@ -212,7 +212,7 @@ def fan_out_chat_message(
|
||||
*,
|
||||
actor_user_id: int,
|
||||
rfc_slug: str,
|
||||
branch_name: str,
|
||||
branch_name: str | None,
|
||||
thread_id: int,
|
||||
message_id: int,
|
||||
is_review_thread: bool = False,
|
||||
@@ -227,6 +227,14 @@ def fan_out_chat_message(
|
||||
(state='watching', i.e. full stream) get a churn-class
|
||||
`chat_message_in_participated_thread`. The two are union'd so a user
|
||||
who is both gets only the personal-direct row.
|
||||
|
||||
v0.5.0: `branch_name` may be None — that is the PR-less per-RFC
|
||||
discussion shape (`threads.branch_name IS NULL`, §5). The
|
||||
notifications row carries the null through; the inbox prose renders
|
||||
identically whether the chat lives on a branch or on the RFC's
|
||||
discussion surface, and the §15.7 reconciler keys on
|
||||
(rfc_slug, branch_name) so a null branch correctly matches the
|
||||
PR-less discussion's eventual chat-seen-equivalent advance.
|
||||
"""
|
||||
_bump_auto_watch(actor_user_id, rfc_slug)
|
||||
|
||||
|
||||
@@ -0,0 +1,329 @@
|
||||
"""§6.2 / v0.7.0: email + one-time-code sign-in.
|
||||
|
||||
Replaces the Gitea OAuth gesture as the primary human-auth path. The
|
||||
Gitea bot user + token are still needed for server-side git
|
||||
operations (repo reads, PR creation); only the operator-facing
|
||||
sign-in surface moves through this module.
|
||||
|
||||
The shape:
|
||||
|
||||
* `request_code(email)` generates a 6-digit decimal code,
|
||||
hashes it (bcrypt), stores the hash + expiry in `otc_codes`,
|
||||
and dispatches a plain-text email via `email_otc.send`. It
|
||||
invalidates any prior unused codes for the same email so a
|
||||
re-request keeps the surface to one outstanding code per
|
||||
address. The TTL comes from `OTC_TTL_MINUTES` (default 10).
|
||||
A per-email cooldown (`OTC_REQUEST_COOLDOWN_SECONDS`, default
|
||||
60) refuses back-to-back requests inside the window.
|
||||
|
||||
* `verify_code(email, code)` walks the most recent unconsumed
|
||||
non-expired row for the email, checks the bcrypt hash, marks
|
||||
the row consumed, and returns the linked or freshly-provisioned
|
||||
user row.
|
||||
|
||||
* `provision_or_link_user(email)` is the migration path: if a
|
||||
`users` row already carries `email` (case-insensitive), it is
|
||||
reused — `gitea_id` is left alone so a grandfathered OAuth-era
|
||||
user keeps the linker intact. Otherwise a fresh contributor
|
||||
row is provisioned with `gitea_id = NULL`, `gitea_login = NULL`.
|
||||
|
||||
The endpoints in `main.py` thin-wrap this module. The allowlist gate
|
||||
from v0.3.0 is consulted at request time — if `allowed_emails` is
|
||||
populated and the requested address isn't on it, the request returns
|
||||
202 as usual but no email is sent. This intentionally does not leak
|
||||
allowlist state to the caller; the §19.2 candidate for v0.8.0
|
||||
replaces this gate with an admin-grant flow.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import os
|
||||
import secrets
|
||||
from dataclasses import dataclass
|
||||
|
||||
import bcrypt
|
||||
|
||||
from . import db
|
||||
from .auth import SessionUser, allowlist_is_active
|
||||
|
||||
log = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Tunables — env-driven with defaults so v0.7.0 needs no new secrets.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _ttl_minutes() -> int:
|
||||
raw = os.environ.get("OTC_TTL_MINUTES", "").strip()
|
||||
if not raw:
|
||||
return 10
|
||||
try:
|
||||
return max(1, int(raw))
|
||||
except ValueError:
|
||||
return 10
|
||||
|
||||
|
||||
def _cooldown_seconds() -> int:
|
||||
raw = os.environ.get("OTC_REQUEST_COOLDOWN_SECONDS", "").strip()
|
||||
if not raw:
|
||||
return 60
|
||||
try:
|
||||
return max(0, int(raw))
|
||||
except ValueError:
|
||||
return 60
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Code generation + hashing
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _new_code() -> str:
|
||||
"""Six decimal digits. `secrets.randbelow` is CSPRNG-backed so the
|
||||
code resists guessing even at the small (10^6) keyspace. The TTL
|
||||
+ rate-limit are what carry the security weight — the entropy of a
|
||||
six-digit code by itself is intentionally human-readable."""
|
||||
return f"{secrets.randbelow(1_000_000):06d}"
|
||||
|
||||
|
||||
def _hash_code(code: str) -> str:
|
||||
"""bcrypt over the code bytes. The hash is stored at rest; the code
|
||||
itself only travels in the outbound email and the inbound verify
|
||||
body."""
|
||||
return bcrypt.hashpw(code.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
|
||||
|
||||
|
||||
def _check_code(code: str, code_hash: str) -> bool:
|
||||
try:
|
||||
return bcrypt.checkpw(code.encode("utf-8"), code_hash.encode("ascii"))
|
||||
except (ValueError, TypeError):
|
||||
return False
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Allowlist gate — shared with the OAuth flow.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _allowlist_admits(email: str) -> bool:
|
||||
"""The same allowlist v0.3.0 introduced for OAuth, applied to OTC
|
||||
requests. If the allowlist is populated and the email is not on it,
|
||||
we still respond 202 to the caller, but no code is sent."""
|
||||
if not allowlist_is_active():
|
||||
return True
|
||||
row = db.conn().execute(
|
||||
"SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
|
||||
).fetchone()
|
||||
return row is not None
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Request path
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@dataclass
|
||||
class RequestOutcome:
|
||||
"""The outcome of a `request_code` call.
|
||||
|
||||
`code` is None whenever no code was generated — either because the
|
||||
allowlist denied the email or because the cooldown window blocked
|
||||
the request. The caller (the API endpoint) does not surface this
|
||||
distinction to the user; it returns 202 either way.
|
||||
"""
|
||||
sent: bool
|
||||
code: str | None
|
||||
reason: str # 'sent' | 'allowlist' | 'cooldown' | 'invalid'
|
||||
|
||||
|
||||
def request_code(email: str) -> RequestOutcome:
|
||||
email = (email or "").strip()
|
||||
if not email or "@" not in email:
|
||||
return RequestOutcome(sent=False, code=None, reason="invalid")
|
||||
|
||||
# Cooldown: refuse if a code was issued for this email in the last
|
||||
# COOLDOWN_SECONDS. We surface it as a distinct outcome so the
|
||||
# endpoint can return 429 — the spec calls this out as a "loud
|
||||
# failure" so the abuse path is visible rather than swallowed.
|
||||
cooldown = _cooldown_seconds()
|
||||
if cooldown > 0:
|
||||
row = db.conn().execute(
|
||||
f"""
|
||||
SELECT 1 FROM otc_codes
|
||||
WHERE email = ?
|
||||
AND datetime(created_at, '+{cooldown} seconds') > datetime('now')
|
||||
LIMIT 1
|
||||
""",
|
||||
(email,),
|
||||
).fetchone()
|
||||
if row is not None:
|
||||
return RequestOutcome(sent=False, code=None, reason="cooldown")
|
||||
|
||||
# Allowlist: silently drop the send if the email isn't on the list.
|
||||
# The row is not written either — there's nothing for verify to
|
||||
# match against, so the user-facing experience is "I never got an
|
||||
# email", which is the intended shape for the private-beta gate.
|
||||
if not _allowlist_admits(email):
|
||||
return RequestOutcome(sent=False, code=None, reason="allowlist")
|
||||
|
||||
# Invalidate prior unused codes for this email. A re-request is
|
||||
# always for the most recent code; older codes are dead.
|
||||
db.conn().execute(
|
||||
"""
|
||||
UPDATE otc_codes
|
||||
SET consumed_at = datetime('now')
|
||||
WHERE email = ?
|
||||
AND consumed_at IS NULL
|
||||
""",
|
||||
(email,),
|
||||
)
|
||||
|
||||
code = _new_code()
|
||||
code_hash = _hash_code(code)
|
||||
ttl = _ttl_minutes()
|
||||
db.conn().execute(
|
||||
f"""
|
||||
INSERT INTO otc_codes (email, code_hash, expires_at)
|
||||
VALUES (?, ?, datetime('now', '+{ttl} minutes'))
|
||||
""",
|
||||
(email, code_hash),
|
||||
)
|
||||
return RequestOutcome(sent=True, code=code, reason="sent")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Verify path
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@dataclass
|
||||
class VerifyOutcome:
|
||||
"""Result of a `verify_code` call.
|
||||
|
||||
`user` is populated only on success. `reason` distinguishes the
|
||||
failure modes the UI can render — 'expired', 'consumed', 'wrong',
|
||||
'unknown' (no outstanding code at all). The endpoint maps the
|
||||
failure modes to a single 400 with a generic message; the reason
|
||||
is logged for the operator.
|
||||
"""
|
||||
ok: bool
|
||||
user: SessionUser | None
|
||||
reason: str
|
||||
|
||||
|
||||
def verify_code(email: str, code: str) -> VerifyOutcome:
|
||||
email = (email or "").strip()
|
||||
code = (code or "").strip()
|
||||
if not email or not code:
|
||||
return VerifyOutcome(ok=False, user=None, reason="invalid")
|
||||
|
||||
rows = db.conn().execute(
|
||||
"""
|
||||
SELECT id, code_hash, expires_at, consumed_at
|
||||
FROM otc_codes
|
||||
WHERE email = ?
|
||||
ORDER BY id DESC
|
||||
LIMIT 5
|
||||
""",
|
||||
(email,),
|
||||
).fetchall()
|
||||
if not rows:
|
||||
return VerifyOutcome(ok=False, user=None, reason="unknown")
|
||||
|
||||
# Walk the recent rows so a user who pasted an older code still
|
||||
# gets a sensible error — without this, the most-recent-row check
|
||||
# would mask "you entered yesterday's code" as "wrong code".
|
||||
matched = None
|
||||
for row in rows:
|
||||
if _check_code(code, row["code_hash"]):
|
||||
matched = row
|
||||
break
|
||||
|
||||
if matched is None:
|
||||
return VerifyOutcome(ok=False, user=None, reason="wrong")
|
||||
|
||||
if matched["consumed_at"] is not None:
|
||||
return VerifyOutcome(ok=False, user=None, reason="consumed")
|
||||
|
||||
expired = db.conn().execute(
|
||||
"SELECT datetime(?) < datetime('now') AS expired",
|
||||
(matched["expires_at"],),
|
||||
).fetchone()["expired"]
|
||||
if expired:
|
||||
return VerifyOutcome(ok=False, user=None, reason="expired")
|
||||
|
||||
# Stamp consumed before provisioning so a parallel verify of the
|
||||
# same row can't double-sign-in.
|
||||
db.conn().execute(
|
||||
"UPDATE otc_codes SET consumed_at = datetime('now') WHERE id = ?",
|
||||
(matched["id"],),
|
||||
)
|
||||
user = provision_or_link_user(email)
|
||||
return VerifyOutcome(ok=True, user=user, reason="ok")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Provisioning — the migration path from OAuth identity to email identity.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def provision_or_link_user(email: str) -> SessionUser:
|
||||
"""Link the OTC sign-in to a `users` row.
|
||||
|
||||
Match order:
|
||||
1. An existing row whose email equals (case-insensitive) the
|
||||
requested email — the OAuth-era user is grandfathered in via
|
||||
this path. `gitea_id` is preserved so a future OAuth round
|
||||
trip still resolves the same row.
|
||||
2. Otherwise: a fresh contributor row with `gitea_id = NULL`,
|
||||
`gitea_login = NULL`. The display name defaults to the local
|
||||
part of the email (everything before the `@`) — users can
|
||||
rename later via the §19.2 first-OTC profile-capture flow
|
||||
that v0.8.0 introduces.
|
||||
|
||||
The §6.1 owner-zero bootstrap still applies: if the email matches
|
||||
the configured `OWNER_GITEA_LOGIN`-derived owner identity, the row
|
||||
is provisioned with role='owner'. v0.7.0 keeps that field as the
|
||||
Gitea login (so existing deployments don't break); a future
|
||||
release may add a parallel `OWNER_EMAIL` env if the OAuth route is
|
||||
dropped entirely.
|
||||
"""
|
||||
email = email.strip()
|
||||
existing = db.conn().execute(
|
||||
"SELECT * FROM users WHERE email = ? COLLATE NOCASE",
|
||||
(email,),
|
||||
).fetchone()
|
||||
if existing is not None:
|
||||
db.conn().execute(
|
||||
"UPDATE users SET last_seen_at = datetime('now') WHERE id = ?",
|
||||
(existing["id"],),
|
||||
)
|
||||
return SessionUser(
|
||||
user_id=existing["id"],
|
||||
gitea_id=existing["gitea_id"] or 0,
|
||||
gitea_login=existing["gitea_login"] or "",
|
||||
display_name=existing["display_name"],
|
||||
email=existing["email"] or email,
|
||||
avatar_url=existing["avatar_url"] or "",
|
||||
role=existing["role"],
|
||||
)
|
||||
|
||||
display = email.split("@", 1)[0] or email
|
||||
cur = db.conn().execute(
|
||||
"""
|
||||
INSERT INTO users (gitea_id, gitea_login, email, display_name, avatar_url, role)
|
||||
VALUES (NULL, NULL, ?, ?, '', 'contributor')
|
||||
""",
|
||||
(email, display),
|
||||
)
|
||||
user_id = cur.lastrowid
|
||||
return SessionUser(
|
||||
user_id=user_id,
|
||||
gitea_id=0,
|
||||
gitea_login="",
|
||||
display_name=display,
|
||||
email=email,
|
||||
avatar_url="",
|
||||
role="contributor",
|
||||
)
|
||||
@@ -0,0 +1,105 @@
|
||||
-- §6.2 / v0.7.0: email + one-time-code sign-in.
|
||||
--
|
||||
-- Replaces the Gitea OAuth gesture as the primary human-auth path.
|
||||
-- The Gitea bot user + token are still needed for server-side git
|
||||
-- operations (repo reads, PR creation); only the operator-facing
|
||||
-- sign-in surface moves. The /auth/callback OAuth route remains
|
||||
-- functional during migration as a fallback, scheduled for removal
|
||||
-- in a future release once every active user has signed in via OTC
|
||||
-- at least once.
|
||||
--
|
||||
-- A row in `otc_codes` represents an outstanding 6-digit code that
|
||||
-- was emailed to `email`. Codes are stored hashed (bcrypt) rather
|
||||
-- than plaintext, so a database compromise does not expose the
|
||||
-- in-flight code. TTL is enforced by `expires_at`. Each `verify`
|
||||
-- success stamps `consumed_at` and refuses every later attempt
|
||||
-- against the same row.
|
||||
--
|
||||
-- The §6.2 identity model under v0.7.0:
|
||||
--
|
||||
-- * `users.email` is the primary identity key for new sign-ins.
|
||||
-- * `users.gitea_id` stays populated for users grandfathered in
|
||||
-- via the OAuth-era flow; new users have `gitea_id = NULL`.
|
||||
-- The unique-constraint on `gitea_id` is relaxed (in v0.5.0 it
|
||||
-- was `INTEGER UNIQUE NOT NULL`) to permit the NULL.
|
||||
-- * `users.email` becomes a (case-insensitive) unique key. An
|
||||
-- existing OAuth user whose Gitea profile carried an email is
|
||||
-- linked on first OTC sign-in; if no row matches, a fresh
|
||||
-- contributor row is provisioned.
|
||||
--
|
||||
-- New env vars (v0.7.0):
|
||||
-- * `OTC_TTL_MINUTES` (default 10): how long a code stays valid.
|
||||
-- * `OTC_REQUEST_COOLDOWN_SECONDS` (default 60): per-email rate
|
||||
-- limit between successive `/auth/otc/request` calls.
|
||||
|
||||
CREATE TABLE otc_codes (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
email TEXT NOT NULL COLLATE NOCASE,
|
||||
code_hash TEXT NOT NULL,
|
||||
created_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||||
expires_at TEXT NOT NULL,
|
||||
consumed_at TEXT
|
||||
);
|
||||
|
||||
CREATE INDEX idx_otc_codes_email ON otc_codes (email, consumed_at, expires_at);
|
||||
|
||||
-- Relax `users.gitea_id` from `INTEGER UNIQUE NOT NULL` to a nullable
|
||||
-- column with a partial unique index that ignores nulls. SQLite does
|
||||
-- not support ALTER COLUMN, so we rebuild the table.
|
||||
--
|
||||
-- A few defensive notes:
|
||||
-- * Every foreign key into `users(id)` continues to resolve — `id`
|
||||
-- is the same INTEGER PRIMARY KEY in the rebuilt table.
|
||||
-- * `email` is now declared NOCASE so a `WHERE email = ?` match
|
||||
-- is case-insensitive without changing every read site. The
|
||||
-- prior column accepted any text; existing rows pass through
|
||||
-- unchanged.
|
||||
-- * `gitea_login` likewise relaxes from NOT NULL to nullable, so
|
||||
-- users provisioned by OTC alone don't carry a synthetic login.
|
||||
|
||||
CREATE TABLE users_new (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
gitea_id INTEGER,
|
||||
gitea_login TEXT,
|
||||
email TEXT COLLATE NOCASE,
|
||||
display_name TEXT NOT NULL,
|
||||
avatar_url TEXT,
|
||||
role TEXT NOT NULL CHECK (role IN ('owner', 'admin', 'contributor')),
|
||||
muted INTEGER NOT NULL DEFAULT 0,
|
||||
email_personal_direct INTEGER NOT NULL DEFAULT 1,
|
||||
email_watched_structural INTEGER NOT NULL DEFAULT 0,
|
||||
email_admin_actionable INTEGER NOT NULL DEFAULT 1,
|
||||
email_opt_out_all INTEGER NOT NULL DEFAULT 0,
|
||||
digest_cadence TEXT NOT NULL DEFAULT 'weekly' CHECK (digest_cadence IN ('off', 'weekly', 'daily')),
|
||||
notification_quiet_hours_start TEXT,
|
||||
notification_quiet_hours_end TEXT,
|
||||
notification_quiet_hours_timezone TEXT,
|
||||
created_at TEXT NOT NULL DEFAULT (datetime('now')),
|
||||
last_seen_at TEXT NOT NULL DEFAULT (datetime('now'))
|
||||
);
|
||||
|
||||
INSERT INTO users_new (
|
||||
id, gitea_id, gitea_login, email, display_name, avatar_url, role,
|
||||
muted, email_personal_direct, email_watched_structural,
|
||||
email_admin_actionable, email_opt_out_all, digest_cadence,
|
||||
notification_quiet_hours_start, notification_quiet_hours_end,
|
||||
notification_quiet_hours_timezone, created_at, last_seen_at
|
||||
)
|
||||
SELECT
|
||||
id, gitea_id, gitea_login, email, display_name, avatar_url, role,
|
||||
muted, email_personal_direct, email_watched_structural,
|
||||
email_admin_actionable, email_opt_out_all, digest_cadence,
|
||||
notification_quiet_hours_start, notification_quiet_hours_end,
|
||||
notification_quiet_hours_timezone, created_at, last_seen_at
|
||||
FROM users;
|
||||
|
||||
DROP TABLE users;
|
||||
ALTER TABLE users_new RENAME TO users;
|
||||
|
||||
CREATE INDEX idx_users_role ON users (role);
|
||||
-- Partial unique indexes so NULLs are permitted but populated values
|
||||
-- collide. Gitea linkage stays unique per gitea_id; OTC-era identity
|
||||
-- is keyed on email (case-insensitive via NOCASE on the column).
|
||||
CREATE UNIQUE INDEX idx_users_gitea_id ON users (gitea_id) WHERE gitea_id IS NOT NULL;
|
||||
CREATE UNIQUE INDEX idx_users_gitea_login ON users (gitea_login) WHERE gitea_login IS NOT NULL;
|
||||
CREATE UNIQUE INDEX idx_users_email ON users (email) WHERE email IS NOT NULL AND email != '';
|
||||
@@ -8,3 +8,4 @@ anthropic>=0.39
|
||||
google-generativeai>=0.8
|
||||
openai>=1.50
|
||||
PyYAML>=6.0
|
||||
bcrypt>=4.2
|
||||
|
||||
@@ -0,0 +1,237 @@
|
||||
"""End-to-end integration tests for the v0.5.0 PR-less discussion
|
||||
surface — roadmap item #3, "discussion without PR; contribution requires
|
||||
PR."
|
||||
|
||||
The vertical: an active RFC exists; the discussion endpoints under
|
||||
`/api/rfcs/<slug>/discussion/...` open threads with
|
||||
`threads.branch_name IS NULL`, post messages into them, and surface
|
||||
them on subsequent reads. Branch-scoped threads (the §8.12 surface)
|
||||
remain segregated. Anonymous viewers can read; only signed-in
|
||||
contributors can write.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import pytest
|
||||
|
||||
# Reuse the harness from Slice 1 / Slice 2.
|
||||
from test_propose_vertical import ( # noqa: F401 — fixtures land via import
|
||||
FakeGitea,
|
||||
app_with_fake_gitea,
|
||||
provision_user_row,
|
||||
sign_in_as,
|
||||
tmp_env,
|
||||
)
|
||||
from test_rfc_view_vertical import seed_active_rfc, SEED_BODY
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Tests
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_create_and_post_to_pr_less_discussion_thread(app_with_fake_gitea):
|
||||
"""The vertical: signed-in contributor opens a thread on the RFC's
|
||||
discussion surface, posts a message, and the thread + message
|
||||
surface on subsequent reads with branch_name IS NULL."""
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
provision_user_row(user_id=1, login="alice", role="contributor")
|
||||
seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
|
||||
sign_in_as(client, user_id=1, gitea_login="alice", display_name="Alice", role="contributor")
|
||||
|
||||
# Listing materializes the default whole-doc thread.
|
||||
r = client.get("/api/rfcs/ohm/discussion/threads")
|
||||
assert r.status_code == 200, r.text
|
||||
items = r.json()["items"]
|
||||
assert len(items) == 1
|
||||
default_thread_id = items[0]["id"]
|
||||
assert items[0]["anchor_kind"] == "whole-doc"
|
||||
assert items[0]["thread_kind"] == "chat"
|
||||
|
||||
# Open an additional discussion thread with a first message.
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"label": "Question about §3", "message": "Is consent baked into the trait model?"},
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
payload = r.json()
|
||||
thread_id = payload["thread_id"]
|
||||
message_id = payload["message_id"]
|
||||
assert thread_id is not None and message_id is not None
|
||||
|
||||
# Confirm the row carries branch_name IS NULL (the PR-less shape).
|
||||
row = db.conn().execute(
|
||||
"SELECT rfc_slug, branch_name, thread_kind, anchor_kind, created_by FROM threads WHERE id = ?",
|
||||
(thread_id,),
|
||||
).fetchone()
|
||||
assert row["rfc_slug"] == "ohm"
|
||||
assert row["branch_name"] is None
|
||||
assert row["thread_kind"] == "chat"
|
||||
assert row["anchor_kind"] == "whole-doc"
|
||||
assert row["created_by"] == 1
|
||||
|
||||
# The thread surfaces on the list endpoint alongside the default.
|
||||
r = client.get("/api/rfcs/ohm/discussion/threads")
|
||||
ids = [t["id"] for t in r.json()["items"]]
|
||||
assert default_thread_id in ids
|
||||
assert thread_id in ids
|
||||
|
||||
# Posting a reply on the new thread persists and returns the id.
|
||||
r = client.post(
|
||||
f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages",
|
||||
json={"text": "Following up — see §3.2."},
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
reply_id = r.json()["message_id"]
|
||||
|
||||
# The messages read endpoint returns both messages in order.
|
||||
r = client.get(f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages")
|
||||
assert r.status_code == 200
|
||||
messages = r.json()["messages"]
|
||||
assert [m["id"] for m in messages] == [message_id, reply_id]
|
||||
assert messages[0]["author_login"] == "alice"
|
||||
assert messages[0]["text"].startswith("Is consent")
|
||||
|
||||
|
||||
def test_anonymous_can_read_but_cannot_post_discussion(app_with_fake_gitea):
|
||||
"""Per the v0.3.0 anonymous-read contract: reads on the discussion
|
||||
surface are open; write attempts return 401. v0.6.0 (item #4) will
|
||||
tighten the read gate — v0.5.0 holds the write line so there is no
|
||||
open window between releases."""
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
provision_user_row(user_id=2, login="alice", role="contributor")
|
||||
seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
|
||||
|
||||
# Seed the discussion thread + first message as Alice.
|
||||
sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"message": "First."},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
thread_id = r.json()["thread_id"]
|
||||
|
||||
# Drop the session — viewer is anonymous now.
|
||||
client.cookies.clear()
|
||||
|
||||
# Reads are open.
|
||||
r = client.get("/api/rfcs/ohm/discussion/threads")
|
||||
assert r.status_code == 200
|
||||
assert any(t["id"] == thread_id for t in r.json()["items"])
|
||||
|
||||
r = client.get(f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages")
|
||||
assert r.status_code == 200
|
||||
assert len(r.json()["messages"]) >= 1
|
||||
|
||||
# Writes refuse 401.
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"message": "Drive-by."},
|
||||
)
|
||||
assert r.status_code == 401
|
||||
|
||||
r = client.post(
|
||||
f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages",
|
||||
json={"text": "Drive-by reply."},
|
||||
)
|
||||
assert r.status_code == 401
|
||||
|
||||
|
||||
def test_discussion_threads_and_branch_threads_are_segregated(app_with_fake_gitea):
|
||||
"""A branch-scoped thread (the §8.12 surface, branch_name='main' or a
|
||||
feature branch) MUST NOT surface on the discussion endpoint, which
|
||||
is keyed on branch_name IS NULL. The two surfaces share a table; the
|
||||
null-filter is what segregates them."""
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
provision_user_row(user_id=3, login="alice", role="contributor")
|
||||
seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
|
||||
sign_in_as(client, user_id=3, gitea_login="alice", display_name="Alice", role="contributor")
|
||||
|
||||
# Manually materialize a branch-scoped thread on a feature branch.
|
||||
db.conn().execute(
|
||||
"""
|
||||
INSERT INTO threads
|
||||
(rfc_slug, branch_name, anchor_kind, thread_kind, label, created_by)
|
||||
VALUES ('ohm', 'alice-draft-aa00', 'whole-doc', 'chat', NULL, 3)
|
||||
"""
|
||||
)
|
||||
# And one on the discussion surface.
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"message": "Discussion-surface message."},
|
||||
)
|
||||
assert r.status_code == 200
|
||||
discussion_thread_id = r.json()["thread_id"]
|
||||
|
||||
# The discussion list contains the null-branch thread (plus the
|
||||
# default whole-doc) and excludes the feature-branch thread.
|
||||
r = client.get("/api/rfcs/ohm/discussion/threads")
|
||||
assert r.status_code == 200
|
||||
ids = [t["id"] for t in r.json()["items"]]
|
||||
assert discussion_thread_id in ids
|
||||
# Feature-branch thread MUST NOT surface.
|
||||
branch_thread_row = db.conn().execute(
|
||||
"SELECT id FROM threads WHERE branch_name = 'alice-draft-aa00'"
|
||||
).fetchone()
|
||||
assert branch_thread_row is not None
|
||||
assert branch_thread_row["id"] not in ids
|
||||
|
||||
|
||||
def test_discussion_thread_resolve_permissions(app_with_fake_gitea):
|
||||
"""A thread's creator can resolve it; an unrelated contributor cannot;
|
||||
an admin / owner / RFC-owner can. Mirrors §8.12's resolution rule for
|
||||
branch-scoped threads."""
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
provision_user_row(user_id=4, login="alice", role="contributor")
|
||||
provision_user_row(user_id=5, login="bob", role="contributor")
|
||||
provision_user_row(user_id=6, login="ben", role="owner")
|
||||
seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
|
||||
|
||||
sign_in_as(client, user_id=4, gitea_login="alice", display_name="Alice", role="contributor")
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"label": "Alice's thread", "message": "..."},
|
||||
)
|
||||
thread_id = r.json()["thread_id"]
|
||||
|
||||
# Unrelated contributor refused.
|
||||
sign_in_as(client, user_id=5, gitea_login="bob", display_name="Bob", role="contributor")
|
||||
r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id}/resolve")
|
||||
assert r.status_code == 403
|
||||
|
||||
# Creator allowed.
|
||||
sign_in_as(client, user_id=4, gitea_login="alice", display_name="Alice", role="contributor")
|
||||
r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id}/resolve")
|
||||
assert r.status_code == 200
|
||||
|
||||
# Open another thread, resolve it as the owner.
|
||||
r = client.post(
|
||||
"/api/rfcs/ohm/discussion/threads",
|
||||
json={"label": "Another thread", "message": "..."},
|
||||
)
|
||||
thread_id2 = r.json()["thread_id"]
|
||||
sign_in_as(client, user_id=6, gitea_login="ben", display_name="Ben", role="owner")
|
||||
r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id2}/resolve")
|
||||
assert r.status_code == 200
|
||||
|
||||
|
||||
def test_discussion_404_on_unknown_rfc(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
r = client.get("/api/rfcs/nonexistent/discussion/threads")
|
||||
assert r.status_code == 404
|
||||
@@ -0,0 +1,333 @@
|
||||
"""End-to-end integration tests for the v0.7.0 email/OTC sign-in
|
||||
vertical (§6.2).
|
||||
|
||||
The release replaces the Gitea OAuth gesture as the primary human
|
||||
sign-in path. The tests prove:
|
||||
|
||||
* `/auth/otc/request` is rate-limited per-email — back-to-back
|
||||
requests inside `OTC_REQUEST_COOLDOWN_SECONDS` are refused with
|
||||
429 (the loud-failure shape the spec calls out).
|
||||
* The happy path: request → code lands in the outbound buffer →
|
||||
verify with the code → session cookie surfaces an authenticated
|
||||
user via `/api/auth/me`.
|
||||
* Expired codes refuse with 400.
|
||||
* Already-consumed codes refuse with 400 on re-use.
|
||||
* Wrong codes refuse with 400.
|
||||
* Allowlist gate: when `allowed_emails` is populated and the email
|
||||
isn't on it, the response is still 202 (no leak), but no email
|
||||
lands in the outbound buffer and verify finds no matching code.
|
||||
* Migration link: an existing OAuth-era user (with a `users.email`
|
||||
row) is linked by email on first OTC sign-in — `gitea_id` is
|
||||
preserved.
|
||||
* Provisioning path: an unrecognized email creates a fresh
|
||||
contributor row with `gitea_id = NULL`.
|
||||
|
||||
The Gitea bot user + token are still required at process construction
|
||||
(every test harness sets the same `GITEA_*` env vars); the OTC flow
|
||||
itself never reaches Gitea. The fakes from `test_propose_vertical`
|
||||
remain in scope so the rest of the app boots cleanly.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import pytest
|
||||
|
||||
from test_propose_vertical import ( # noqa: F401
|
||||
FakeGitea,
|
||||
app_with_fake_gitea,
|
||||
provision_user_row,
|
||||
tmp_env,
|
||||
)
|
||||
|
||||
|
||||
def _reset_outbound():
|
||||
from app import email as email_mod
|
||||
email_mod.reset_sent_envelopes()
|
||||
|
||||
|
||||
def _outbound_otc_codes(to_address: str | None = None) -> list[str]:
|
||||
"""Pluck the `code` line out of every OTC email in the test buffer.
|
||||
|
||||
The OTC mailer stamps `kind='otc'` on the envelope so the §15.4
|
||||
notification mailer's envelopes (the unsubscribe-footer shape)
|
||||
don't accidentally satisfy the assertion. Each envelope's body
|
||||
carries the code on its own indented line; this helper extracts
|
||||
just that token so the test reads the same way the user would
|
||||
read the email.
|
||||
"""
|
||||
from app import email as email_mod
|
||||
out = []
|
||||
for env in email_mod.sent_envelopes():
|
||||
if env.get("kind") != "otc":
|
||||
continue
|
||||
if to_address is not None and env["to"] != to_address:
|
||||
continue
|
||||
for line in env["body"].splitlines():
|
||||
tok = line.strip()
|
||||
if tok.isdigit() and len(tok) == 6:
|
||||
out.append(tok)
|
||||
break
|
||||
return out
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Happy path
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_request_then_verify_signs_in_a_fresh_user(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
|
||||
# Request: 202 + a single OTC envelope to the requested address.
|
||||
r = client.post("/auth/otc/request", json={"email": "newcomer@example.com"})
|
||||
assert r.status_code == 200, r.text
|
||||
codes = _outbound_otc_codes("newcomer@example.com")
|
||||
assert len(codes) == 1
|
||||
code = codes[0]
|
||||
|
||||
# Verify: 200 + session cookie + me-shape now reads authenticated.
|
||||
r = client.post("/auth/otc/verify", json={"email": "newcomer@example.com", "code": code})
|
||||
assert r.status_code == 200, r.text
|
||||
me = client.get("/api/auth/me").json()
|
||||
assert me["authenticated"] is True
|
||||
assert me["user"]["email"] == "newcomer@example.com"
|
||||
# Fresh provisioning: no gitea linker. The display name is the
|
||||
# local part of the email per §6.2.
|
||||
assert me["user"]["role"] == "contributor"
|
||||
assert me["user"]["display_name"] == "newcomer"
|
||||
|
||||
# The `users` row reflects the same: gitea_id NULL, email set.
|
||||
from app import db
|
||||
row = db.conn().execute(
|
||||
"SELECT gitea_id, email FROM users WHERE email = ? COLLATE NOCASE",
|
||||
("newcomer@example.com",),
|
||||
).fetchone()
|
||||
assert row is not None
|
||||
assert row["gitea_id"] is None
|
||||
assert row["email"] == "newcomer@example.com"
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Failure modes on verify
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_verify_refuses_wrong_code(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": "000000"})
|
||||
assert r.status_code == 400
|
||||
|
||||
|
||||
def test_otc_verify_refuses_consumed_code(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
code = _outbound_otc_codes("alice@example.com")[-1]
|
||||
# First verify succeeds.
|
||||
r1 = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
|
||||
assert r1.status_code == 200
|
||||
# Drop the session cookie so the re-verify reads as fresh.
|
||||
client.cookies.clear()
|
||||
# Second verify with the same code is refused — `consumed_at`
|
||||
# stamped on the row blocks the replay.
|
||||
r2 = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
|
||||
assert r2.status_code == 400
|
||||
|
||||
|
||||
def test_otc_verify_refuses_expired_code(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
code = _outbound_otc_codes("alice@example.com")[-1]
|
||||
# Backdate the row's expires_at to the past. The TTL setting is
|
||||
# an env var (default 10 min); rather than waiting, the test
|
||||
# rewrites the row.
|
||||
db.conn().execute(
|
||||
"UPDATE otc_codes SET expires_at = datetime('now', '-1 minute') WHERE email = ?",
|
||||
("alice@example.com",),
|
||||
)
|
||||
r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
|
||||
assert r.status_code == 400
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Rate limiting
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_request_rate_limited_per_email(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
r1 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
assert r1.status_code == 200
|
||||
# Cooldown defaults to 60s; the second back-to-back call is
|
||||
# refused with a loud 429.
|
||||
r2 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
assert r2.status_code == 429
|
||||
# The buffer still has exactly one envelope — the rate-limited
|
||||
# call didn't double-send.
|
||||
assert len(_outbound_otc_codes("alice@example.com")) == 1
|
||||
|
||||
|
||||
def test_otc_request_cooldown_is_per_email_not_global(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
r1 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
assert r1.status_code == 200
|
||||
# Different email, fresh cooldown.
|
||||
r2 = client.post("/auth/otc/request", json={"email": "bob@example.com"})
|
||||
assert r2.status_code == 200
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Allowlist gate
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_request_silently_drops_when_email_not_on_allowlist(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
# Populate the allowlist so the gate turns on.
|
||||
db.conn().execute("INSERT INTO allowed_emails (email) VALUES (?)", ("invited@example.com",))
|
||||
|
||||
r = client.post("/auth/otc/request", json={"email": "stranger@example.com"})
|
||||
# Still 202 — the allowlist's state is not leaked to callers.
|
||||
assert r.status_code == 200
|
||||
# But no email was sent, and no row landed in otc_codes.
|
||||
assert _outbound_otc_codes("stranger@example.com") == []
|
||||
row = db.conn().execute(
|
||||
"SELECT 1 FROM otc_codes WHERE email = ?",
|
||||
("stranger@example.com",),
|
||||
).fetchone()
|
||||
assert row is None
|
||||
|
||||
|
||||
def test_otc_request_admits_allowlisted_email(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
db.conn().execute("INSERT INTO allowed_emails (email) VALUES (?)", ("invited@example.com",))
|
||||
r = client.post("/auth/otc/request", json={"email": "invited@example.com"})
|
||||
assert r.status_code == 200
|
||||
assert len(_outbound_otc_codes("invited@example.com")) == 1
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Migration path — link by email to an OAuth-era user
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_links_to_existing_oauth_user_by_email(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
# Seed an OAuth-era row. `provision_user_row` writes
|
||||
# email=<login>@test, so we sign in via OTC with the matching
|
||||
# email and expect the same `users.id` to come back.
|
||||
provision_user_row(user_id=42, login="legacyuser", role="contributor")
|
||||
existing = db.conn().execute(
|
||||
"SELECT id, gitea_id FROM users WHERE id = ?", (42,)
|
||||
).fetchone()
|
||||
assert existing["gitea_id"] == 42 # OAuth linker is set.
|
||||
|
||||
r = client.post("/auth/otc/request", json={"email": "legacyuser@test"})
|
||||
assert r.status_code == 200
|
||||
code = _outbound_otc_codes("legacyuser@test")[-1]
|
||||
r = client.post("/auth/otc/verify", json={"email": "legacyuser@test", "code": code})
|
||||
assert r.status_code == 200
|
||||
|
||||
# /api/auth/me reports the linked user — same id, original role.
|
||||
me = client.get("/api/auth/me").json()
|
||||
assert me["authenticated"] is True
|
||||
assert me["user"]["id"] == 42
|
||||
assert me["user"]["role"] == "contributor"
|
||||
|
||||
# gitea_id is preserved on the linked row — the migration path
|
||||
# doesn't disturb the OAuth linker.
|
||||
row = db.conn().execute(
|
||||
"SELECT gitea_id FROM users WHERE id = ?", (42,)
|
||||
).fetchone()
|
||||
assert row["gitea_id"] == 42
|
||||
|
||||
|
||||
def test_otc_provisions_fresh_user_when_email_matches_no_one(app_with_fake_gitea):
|
||||
from fastapi.testclient import TestClient
|
||||
from app import db
|
||||
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
r = client.post("/auth/otc/request", json={"email": "newperson@example.com"})
|
||||
assert r.status_code == 200
|
||||
code = _outbound_otc_codes("newperson@example.com")[-1]
|
||||
r = client.post("/auth/otc/verify", json={"email": "newperson@example.com", "code": code})
|
||||
assert r.status_code == 200
|
||||
|
||||
# A fresh row landed with NULL gitea_id (no OAuth linker).
|
||||
row = db.conn().execute(
|
||||
"SELECT id, gitea_id, gitea_login, role FROM users WHERE email = ? COLLATE NOCASE",
|
||||
("newperson@example.com",),
|
||||
).fetchone()
|
||||
assert row is not None
|
||||
assert row["gitea_id"] is None
|
||||
assert row["gitea_login"] is None
|
||||
assert row["role"] == "contributor"
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Re-request invalidates prior code
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def test_otc_re_request_invalidates_prior_unused_code(app_with_fake_gitea, monkeypatch):
|
||||
from fastapi.testclient import TestClient
|
||||
|
||||
# Drop the cooldown so the second request lands instead of 429ing.
|
||||
monkeypatch.setenv("OTC_REQUEST_COOLDOWN_SECONDS", "0")
|
||||
app, _fake = app_with_fake_gitea
|
||||
with TestClient(app) as client:
|
||||
_reset_outbound()
|
||||
client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
first = _outbound_otc_codes("alice@example.com")[-1]
|
||||
client.post("/auth/otc/request", json={"email": "alice@example.com"})
|
||||
second = _outbound_otc_codes("alice@example.com")[-1]
|
||||
assert first != second
|
||||
|
||||
# The old code is invalidated — verify with `first` now refuses.
|
||||
r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": first})
|
||||
assert r.status_code == 400
|
||||
|
||||
# The new code still works.
|
||||
r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": second})
|
||||
assert r.status_code == 200
|
||||
Generated
+2
-2
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "rfc-app-frontend",
|
||||
"version": "0.2.1",
|
||||
"version": "0.7.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "rfc-app-frontend",
|
||||
"version": "0.2.1",
|
||||
"version": "0.7.0",
|
||||
"dependencies": {
|
||||
"@codemirror/commands": "^6.10.3",
|
||||
"@codemirror/lang-markdown": "^6.5.0",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "rfc-app-frontend",
|
||||
"private": true,
|
||||
"version": "0.4.0",
|
||||
"version": "0.7.0",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"dev": "vite",
|
||||
|
||||
@@ -352,6 +352,89 @@
|
||||
}
|
||||
.landing .secondary-link:hover { color: #1a1a1a; text-decoration: underline; }
|
||||
|
||||
/* --- v0.7.0: email + one-time-code sign-in (§6.2) --- */
|
||||
|
||||
.otc-login {
|
||||
flex: 1;
|
||||
display: flex; align-items: center; justify-content: center;
|
||||
padding: 40px 24px;
|
||||
}
|
||||
.otc-login-inner {
|
||||
max-width: 360px;
|
||||
width: 100%;
|
||||
display: flex; flex-direction: column;
|
||||
gap: 14px;
|
||||
}
|
||||
.otc-login h1 {
|
||||
font-size: 22px;
|
||||
font-weight: 600;
|
||||
margin: 0 0 4px;
|
||||
}
|
||||
.otc-login .otc-hint {
|
||||
color: #555;
|
||||
font-size: 14px;
|
||||
line-height: 1.5;
|
||||
margin: 0;
|
||||
}
|
||||
.otc-login input {
|
||||
width: 100%;
|
||||
padding: 10px 12px;
|
||||
font-size: 15px;
|
||||
border: 1px solid #ddd;
|
||||
border-radius: 6px;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
.otc-login input:focus {
|
||||
outline: none;
|
||||
border-color: #1a1a1a;
|
||||
}
|
||||
.otc-login button[type="submit"] {
|
||||
background: #1a1a1a; color: #fff;
|
||||
border: none; border-radius: 6px;
|
||||
padding: 10px 18px;
|
||||
font-size: 14px; font-weight: 600;
|
||||
cursor: pointer;
|
||||
}
|
||||
.otc-login button[type="submit"]:hover:not(:disabled) { background: #333; }
|
||||
.otc-login button[type="submit"]:disabled { opacity: 0.5; cursor: not-allowed; }
|
||||
.otc-login form {
|
||||
display: flex; flex-direction: column;
|
||||
gap: 10px;
|
||||
}
|
||||
.otc-actions {
|
||||
display: flex; align-items: center; gap: 12px;
|
||||
}
|
||||
.otc-login .btn-link-quiet {
|
||||
background: none; border: none;
|
||||
color: #666; font-size: 13px;
|
||||
cursor: pointer; padding: 0;
|
||||
}
|
||||
.otc-login .btn-link-quiet:hover { color: #1a1a1a; text-decoration: underline; }
|
||||
.otc-shortcut-hint {
|
||||
color: #888; font-size: 12px; margin: 4px 0 0;
|
||||
}
|
||||
.otc-shortcut-hint kbd {
|
||||
background: #f0f0ee; border: 1px solid #ddd; border-radius: 3px;
|
||||
padding: 1px 5px; font-size: 11px; font-family: inherit;
|
||||
}
|
||||
.otc-status {
|
||||
color: #555; font-size: 13px;
|
||||
background: #f7f6f0;
|
||||
border-left: 3px solid #cfc8a8;
|
||||
padding: 8px 12px;
|
||||
margin: 4px 0 0;
|
||||
}
|
||||
.otc-fallback {
|
||||
font-size: 12px; color: #777;
|
||||
margin: 16px 0 0;
|
||||
display: flex; gap: 8px; align-items: center; flex-wrap: wrap;
|
||||
}
|
||||
.otc-fallback a, .otc-fallback .otc-fallback-link {
|
||||
color: #666; text-decoration: none;
|
||||
}
|
||||
.otc-fallback a:hover { color: #1a1a1a; text-decoration: underline; }
|
||||
.otc-fallback-sep { color: #ccc; }
|
||||
|
||||
/* --- Beta-pending page (post-OAuth-rejection) --- */
|
||||
|
||||
.beta-pending {
|
||||
@@ -1776,3 +1859,91 @@
|
||||
.grad-queue-link:hover strong { text-decoration: underline; }
|
||||
.muted { color: #6b7280; }
|
||||
.error { color: #b91c1c; }
|
||||
|
||||
/* v0.5.0 — PR-less per-RFC discussion panel (RFCDiscussionPanel.jsx).
|
||||
Visual neighbor of .chat-panel but distinct: discussion lives on the
|
||||
RFC, branch chat lives on the branch. Same flex column shape so it
|
||||
slots cleanly into the existing .right-panel container.
|
||||
*/
|
||||
.discussion-panel {
|
||||
flex: 1; display: flex; flex-direction: column;
|
||||
overflow: hidden; min-height: 0;
|
||||
}
|
||||
.discussion-header {
|
||||
padding: 10px 14px;
|
||||
border-bottom: 1px solid #f0f0ee;
|
||||
background: #fafafa;
|
||||
display: flex; flex-direction: column; gap: 4px;
|
||||
}
|
||||
.discussion-header-title { font-size: 12px; color: #555; font-weight: 600; }
|
||||
.discussion-header-meta { font-size: 11px; color: #888; }
|
||||
.discussion-thread-tabs {
|
||||
display: flex; gap: 4px; flex-wrap: wrap;
|
||||
padding: 6px 14px;
|
||||
border-bottom: 1px solid #f0f0ee;
|
||||
background: #fcfcfb;
|
||||
}
|
||||
.discussion-thread-tab {
|
||||
background: #fff; border: 1px solid #e5e5e0; cursor: pointer;
|
||||
font-size: 11px; color: #555;
|
||||
padding: 3px 8px; border-radius: 999px;
|
||||
}
|
||||
.discussion-thread-tab.active {
|
||||
background: #eef2ff; border-color: #5b5bd6; color: #3737a0;
|
||||
}
|
||||
.discussion-thread-tab.resolved { opacity: 0.6; }
|
||||
.discussion-messages {
|
||||
flex: 1; overflow-y: auto;
|
||||
padding: 14px;
|
||||
display: flex; flex-direction: column; gap: 10px;
|
||||
}
|
||||
.discussion-empty {
|
||||
flex: 1; display: flex; align-items: center; justify-content: center;
|
||||
text-align: center; padding: 24px;
|
||||
}
|
||||
.discussion-empty p {
|
||||
font-size: 13px; color: #999; line-height: 1.6; max-width: 280px;
|
||||
}
|
||||
.discussion-error {
|
||||
background: #fee; border: 1px solid #fcc; color: #b91c1c;
|
||||
padding: 8px 10px; border-radius: 4px; font-size: 12px;
|
||||
}
|
||||
.discussion-message { display: flex; flex-direction: column; gap: 3px; }
|
||||
.discussion-message-meta {
|
||||
display: flex; gap: 8px; font-size: 11px; color: #888;
|
||||
}
|
||||
.discussion-message-author { color: #5b5bd6; font-weight: 500; }
|
||||
.discussion-message-quote {
|
||||
font-size: 11px; color: #666; font-style: italic;
|
||||
border-left: 2px solid #ddd; padding-left: 8px; margin-bottom: 2px;
|
||||
}
|
||||
.discussion-message-body {
|
||||
font-size: 13px; color: #222; line-height: 1.5;
|
||||
white-space: pre-wrap; word-wrap: break-word;
|
||||
background: #f7f7f5; padding: 8px 10px; border-radius: 6px;
|
||||
}
|
||||
.discussion-message.system .discussion-system-bubble {
|
||||
font-size: 12px; color: #888; font-style: italic;
|
||||
text-align: center; padding: 4px 0;
|
||||
}
|
||||
.discussion-composer {
|
||||
border-top: 1px solid #f0f0ee;
|
||||
padding: 10px 14px;
|
||||
background: #fafafa;
|
||||
display: flex; flex-direction: column; gap: 6px;
|
||||
}
|
||||
.discussion-composer-textarea {
|
||||
width: 100%; resize: vertical; min-height: 60px;
|
||||
font-family: inherit; font-size: 13px;
|
||||
border: 1px solid #ddd; border-radius: 4px;
|
||||
padding: 6px 8px;
|
||||
}
|
||||
.discussion-composer-textarea:focus {
|
||||
outline: none; border-color: #5b5bd6;
|
||||
}
|
||||
.discussion-composer-actions {
|
||||
display: flex; gap: 8px; align-items: center; justify-content: flex-end;
|
||||
}
|
||||
.discussion-readonly {
|
||||
font-size: 12px; color: #666; padding: 4px 0;
|
||||
}
|
||||
|
||||
@@ -8,6 +8,7 @@ import PRView from './components/PRView.jsx'
|
||||
import ProposalView from './components/ProposalView.jsx'
|
||||
import ProposeModal from './components/ProposeModal.jsx'
|
||||
import Landing from './components/Landing.jsx'
|
||||
import Login from './components/Login.jsx'
|
||||
import BetaPending from './components/BetaPending.jsx'
|
||||
import Philosophy from './components/Philosophy.jsx'
|
||||
import NotificationSettings from './components/NotificationSettings.jsx'
|
||||
@@ -121,15 +122,16 @@ export default function App() {
|
||||
<a className="btn-link" href="/auth/logout">Sign out</a>
|
||||
</>
|
||||
) : (
|
||||
<a className="btn-signin-header" href="/auth/login" title="Private beta — only invited emails can sign in">
|
||||
<Link className="btn-signin-header" to="/login" title="Private beta — only invited emails can sign in">
|
||||
Sign in <span className="beta-chip">Beta</span>
|
||||
</a>
|
||||
</Link>
|
||||
)}
|
||||
</div>
|
||||
</header>
|
||||
<div className="app-body">
|
||||
<Routes>
|
||||
<Route path="/welcome" element={<Landing />} />
|
||||
<Route path="/login" element={<Login />} />
|
||||
<Route path="/beta-pending" element={<BetaPending />} />
|
||||
<Route path="/philosophy" element={<PhilosophyWithSidebar viewer={viewer} />} />
|
||||
{viewer && (
|
||||
@@ -216,7 +218,7 @@ function Welcome({ viewer }) {
|
||||
</p>
|
||||
<p>
|
||||
Discussion and contribution are in private <strong>Beta</strong> —
|
||||
read freely, and <a href="/auth/login">sign in</a> if your email has
|
||||
read freely, and <Link to="/login">sign in</Link> if your email has
|
||||
been invited.
|
||||
</p>
|
||||
<p>
|
||||
|
||||
@@ -25,6 +25,30 @@ export async function getMe() {
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
// ── v0.7.0: email + one-time-code sign-in (§6.2) ─────────────────────────
|
||||
//
|
||||
// The legacy /auth/login → /auth/callback OAuth flow remains during the
|
||||
// migration — the new UI just no longer points at it primarily. These
|
||||
// two helpers drive the Login.jsx surface.
|
||||
|
||||
export async function requestOtc(email) {
|
||||
const res = await fetch('/auth/otc/request', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ email }),
|
||||
})
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
export async function verifyOtc(email, code) {
|
||||
const res = await fetch('/auth/otc/verify', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ email, code }),
|
||||
})
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
export async function listRFCs() {
|
||||
return jsonOrThrow(await fetch('/api/rfcs'))
|
||||
}
|
||||
@@ -197,6 +221,52 @@ export async function resolveThread(slug, branch, threadId) {
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
// ── v0.5.0: PR-less per-RFC discussion (§5 / §10) ────────────────────────
|
||||
//
|
||||
// The substrate is `threads.branch_name IS NULL` — the same threads
|
||||
// table the branch chat uses, with a null branch the schema already
|
||||
// supported. Contribution still requires a PR (api_prs / openPR), so
|
||||
// these endpoints are read+write for discussion only.
|
||||
|
||||
export async function listDiscussionThreads(slug) {
|
||||
return jsonOrThrow(await fetch(`/api/rfcs/${slug}/discussion/threads`))
|
||||
}
|
||||
|
||||
export async function createDiscussionThread(slug, { label = null, message = null } = {}) {
|
||||
const res = await fetch(`/api/rfcs/${slug}/discussion/threads`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ label, message }),
|
||||
})
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
export async function getDiscussionThreadMessages(slug, threadId) {
|
||||
return jsonOrThrow(await fetch(
|
||||
`/api/rfcs/${slug}/discussion/threads/${threadId}/messages`,
|
||||
))
|
||||
}
|
||||
|
||||
export async function postDiscussionMessage(slug, threadId, { text, quote = null }) {
|
||||
const res = await fetch(
|
||||
`/api/rfcs/${slug}/discussion/threads/${threadId}/messages`,
|
||||
{
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ text, quote }),
|
||||
},
|
||||
)
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
export async function resolveDiscussionThread(slug, threadId) {
|
||||
const res = await fetch(
|
||||
`/api/rfcs/${slug}/discussion/threads/${threadId}/resolve`,
|
||||
{ method: 'POST' },
|
||||
)
|
||||
return jsonOrThrow(res)
|
||||
}
|
||||
|
||||
// ── Slice 4: super-draft body editing (§9.5) ─────────────────────────────
|
||||
|
||||
export async function startEditBranch(slug, body = {}) {
|
||||
|
||||
@@ -28,7 +28,7 @@ export default function Landing() {
|
||||
first RFC defining <em>human</em>. Build the dictionary first.
|
||||
</p>
|
||||
|
||||
<a className="btn-signin" href="/auth/login">Sign in with Gitea</a>
|
||||
<Link className="btn-signin" to="/login">Sign in</Link>
|
||||
<Link className="secondary-link" to="/philosophy">Read the full philosophy →</Link>
|
||||
|
||||
<ul className="landing-deck">
|
||||
|
||||
@@ -0,0 +1,167 @@
|
||||
// Login.jsx — v0.7.0's primary sign-in surface (§6.2).
|
||||
//
|
||||
// Two-step:
|
||||
// 1. Enter email → POST /auth/otc/request → on 200, advance.
|
||||
// On 429 (rate-limit), surface a "wait a moment" hint and keep
|
||||
// the user on step 1.
|
||||
// 2. Enter the six-digit code from the email → POST /auth/otc/verify
|
||||
// → on 200, redirect to the post-login landing. Cmd/Ctrl+Enter
|
||||
// on the code field is the keyboard shortcut.
|
||||
//
|
||||
// Server-side, /auth/otc/request always returns 202 for an unrecognized
|
||||
// email (so the allowlist gate doesn't leak), so this surface never
|
||||
// distinguishes "we couldn't reach you" from "we don't know you" —
|
||||
// it just advances to step 2. If a user is genuinely blocked, the
|
||||
// code never arrives.
|
||||
//
|
||||
// The legacy Gitea OAuth callback remains at /auth/login → /auth/callback
|
||||
// during the v0.7.0 migration; we surface a "Sign in with Gitea" link
|
||||
// as a fallback in the footer so users with active OAuth sessions or
|
||||
// older invite emails still have a path.
|
||||
|
||||
import { useEffect, useRef, useState } from 'react'
|
||||
import { useNavigate, Link } from 'react-router-dom'
|
||||
import { requestOtc, verifyOtc } from '../api'
|
||||
|
||||
export default function Login() {
|
||||
const [step, setStep] = useState('email')
|
||||
const [email, setEmail] = useState('')
|
||||
const [code, setCode] = useState('')
|
||||
const [status, setStatus] = useState('')
|
||||
const [busy, setBusy] = useState(false)
|
||||
const emailRef = useRef(null)
|
||||
const codeRef = useRef(null)
|
||||
const navigate = useNavigate()
|
||||
|
||||
useEffect(() => {
|
||||
if (step === 'email') emailRef.current?.focus()
|
||||
else codeRef.current?.focus()
|
||||
}, [step])
|
||||
|
||||
async function submitEmail(e) {
|
||||
e.preventDefault()
|
||||
if (!email.trim() || !email.includes('@')) {
|
||||
setStatus('Enter a valid email address.')
|
||||
return
|
||||
}
|
||||
setBusy(true)
|
||||
setStatus('')
|
||||
try {
|
||||
await requestOtc(email.trim())
|
||||
setStep('code')
|
||||
setStatus('Check your inbox — a six-digit code is on the way.')
|
||||
} catch (err) {
|
||||
if (err.status === 429) {
|
||||
setStatus('Slow down — wait a minute before requesting another code.')
|
||||
} else {
|
||||
setStatus(err.message || 'Could not request a code. Try again.')
|
||||
}
|
||||
} finally {
|
||||
setBusy(false)
|
||||
}
|
||||
}
|
||||
|
||||
async function submitCode(e) {
|
||||
if (e) e.preventDefault()
|
||||
if (!code.trim() || code.trim().length !== 6) {
|
||||
setStatus('Enter the six-digit code from your email.')
|
||||
return
|
||||
}
|
||||
setBusy(true)
|
||||
setStatus('')
|
||||
try {
|
||||
await verifyOtc(email.trim(), code.trim())
|
||||
// Reload so App.jsx's getMe() picks up the fresh session. We
|
||||
// navigate to "/" via a hard load so any cached "anonymous"
|
||||
// view state in memory is dropped cleanly.
|
||||
window.location.assign('/')
|
||||
} catch (err) {
|
||||
setStatus('That code is invalid or expired. Try again, or request a new code.')
|
||||
setBusy(false)
|
||||
}
|
||||
}
|
||||
|
||||
function onCodeKey(e) {
|
||||
// §6.2 ergonomic: Cmd/Ctrl+Enter submits from the code field.
|
||||
if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
|
||||
submitCode(e)
|
||||
}
|
||||
}
|
||||
|
||||
function backToEmail() {
|
||||
setStep('email')
|
||||
setCode('')
|
||||
setStatus('')
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="otc-login">
|
||||
<div className="otc-login-inner">
|
||||
<h1>Sign in</h1>
|
||||
{step === 'email' && (
|
||||
<form onSubmit={submitEmail}>
|
||||
<p className="otc-hint">
|
||||
Enter your email. We'll send you a one-time code.
|
||||
</p>
|
||||
<input
|
||||
ref={emailRef}
|
||||
type="email"
|
||||
autoComplete="email"
|
||||
value={email}
|
||||
onChange={e => setEmail(e.target.value)}
|
||||
placeholder="you@example.com"
|
||||
required
|
||||
disabled={busy}
|
||||
/>
|
||||
<button type="submit" disabled={busy || !email.trim()}>
|
||||
{busy ? 'Sending…' : 'Send code'}
|
||||
</button>
|
||||
</form>
|
||||
)}
|
||||
{step === 'code' && (
|
||||
<form onSubmit={submitCode}>
|
||||
<p className="otc-hint">
|
||||
Enter the six-digit code we sent to <strong>{email}</strong>.
|
||||
</p>
|
||||
<input
|
||||
ref={codeRef}
|
||||
type="text"
|
||||
inputMode="numeric"
|
||||
pattern="[0-9]*"
|
||||
autoComplete="one-time-code"
|
||||
maxLength={6}
|
||||
value={code}
|
||||
onChange={e => setCode(e.target.value.replace(/\D/g, ''))}
|
||||
onKeyDown={onCodeKey}
|
||||
placeholder="123456"
|
||||
required
|
||||
disabled={busy}
|
||||
/>
|
||||
<div className="otc-actions">
|
||||
<button type="submit" disabled={busy || code.length !== 6}>
|
||||
{busy ? 'Signing in…' : 'Sign in'}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
className="btn-link-quiet"
|
||||
onClick={backToEmail}
|
||||
disabled={busy}
|
||||
>
|
||||
Use a different email
|
||||
</button>
|
||||
</div>
|
||||
<p className="otc-shortcut-hint">
|
||||
Tip: <kbd>⌘</kbd>+<kbd>Enter</kbd> (or <kbd>Ctrl</kbd>+<kbd>Enter</kbd>) to sign in.
|
||||
</p>
|
||||
</form>
|
||||
)}
|
||||
{status && <p className="otc-status">{status}</p>}
|
||||
<p className="otc-fallback">
|
||||
<Link to="/philosophy">Read the philosophy →</Link>
|
||||
<span className="otc-fallback-sep">·</span>
|
||||
<a href="/auth/login">Sign in with Gitea (fallback)</a>
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,290 @@
|
||||
// RFCDiscussionPanel.jsx — v0.5.0's PR-less per-RFC discussion surface.
|
||||
//
|
||||
// Roadmap item #3: an RFC's main view now has a discussion surface
|
||||
// distinct from PR comments and from branch chat. The substrate is the
|
||||
// existing threads/thread_messages tables — rows with
|
||||
// `threads.branch_name IS NULL` scope to "the RFC, no branch yet."
|
||||
//
|
||||
// Reused as the right-column panel on `branchParam === 'main'`. Branch
|
||||
// chat (ChatPanel.jsx) keeps its existing role for branch-scoped work,
|
||||
// including PRs. Contribution remains gated behind opening a PR —
|
||||
// nothing here writes to the document.
|
||||
|
||||
import { useCallback, useEffect, useRef, useState } from 'react'
|
||||
import {
|
||||
createDiscussionThread,
|
||||
getDiscussionThreadMessages,
|
||||
listDiscussionThreads,
|
||||
postDiscussionMessage,
|
||||
resolveDiscussionThread,
|
||||
} from '../api'
|
||||
|
||||
export default function RFCDiscussionPanel({ slug, viewer }) {
|
||||
const [threads, setThreads] = useState([])
|
||||
const [messagesByThread, setMessagesByThread] = useState({})
|
||||
const [composer, setComposer] = useState('')
|
||||
const [activeThreadId, setActiveThreadId] = useState(null)
|
||||
const [error, setError] = useState(null)
|
||||
const [sending, setSending] = useState(false)
|
||||
const bottomRef = useRef(null)
|
||||
|
||||
// Pull threads + messages on mount / slug change.
|
||||
useEffect(() => {
|
||||
if (!slug) return
|
||||
let cancelled = false
|
||||
setError(null)
|
||||
setThreads([])
|
||||
setMessagesByThread({})
|
||||
setActiveThreadId(null)
|
||||
listDiscussionThreads(slug)
|
||||
.then(async ({ items }) => {
|
||||
if (cancelled) return
|
||||
setThreads(items || [])
|
||||
// Pre-load messages for each thread. The list is small (per-RFC,
|
||||
// not per-branch) so a fan-out fetch is fine; §19.2 candidate
|
||||
// for paging if a hot RFC accumulates lots of threads.
|
||||
const collected = {}
|
||||
for (const t of items || []) {
|
||||
try {
|
||||
const { messages } = await getDiscussionThreadMessages(slug, t.id)
|
||||
collected[t.id] = messages
|
||||
} catch {
|
||||
collected[t.id] = []
|
||||
}
|
||||
}
|
||||
if (!cancelled) {
|
||||
setMessagesByThread(collected)
|
||||
// Default the active thread to the system's lazy whole-doc
|
||||
// default (the first row with anchor_kind='whole-doc' and
|
||||
// no label) so the composer wires to a real id immediately.
|
||||
const dflt = (items || []).find(
|
||||
t => t.anchor_kind === 'whole-doc' && !t.label,
|
||||
)
|
||||
setActiveThreadId(dflt?.id || items?.[0]?.id || null)
|
||||
}
|
||||
})
|
||||
.catch(err => { if (!cancelled) setError(err.message) })
|
||||
return () => { cancelled = true }
|
||||
}, [slug])
|
||||
|
||||
// Scroll to bottom when messages land in the active thread.
|
||||
useEffect(() => {
|
||||
bottomRef.current?.scrollIntoView({ behavior: 'smooth' })
|
||||
}, [activeThreadId, messagesByThread[activeThreadId]?.length])
|
||||
|
||||
const handleSend = useCallback(async () => {
|
||||
if (!viewer) { window.location.href = '/auth/login'; return }
|
||||
const text = composer.trim()
|
||||
if (!text || sending) return
|
||||
setSending(true)
|
||||
setError(null)
|
||||
try {
|
||||
// If no thread yet, mint one with the message as its first turn.
|
||||
if (!activeThreadId) {
|
||||
const { thread_id, message_id } = await createDiscussionThread(slug, { message: text })
|
||||
// Re-pull authoritative state — the default whole-doc thread
|
||||
// existed pre-this call (the GET creates it lazily), so we
|
||||
// either get the existing default's id back from the new
|
||||
// thread's row or the prior default; either way the list call
|
||||
// is the source of truth.
|
||||
const { items } = await listDiscussionThreads(slug)
|
||||
setThreads(items || [])
|
||||
const { messages } = await getDiscussionThreadMessages(slug, thread_id)
|
||||
setMessagesByThread(prev => ({ ...prev, [thread_id]: messages }))
|
||||
setActiveThreadId(thread_id)
|
||||
void message_id
|
||||
} else {
|
||||
const { message_id } = await postDiscussionMessage(slug, activeThreadId, { text })
|
||||
const { messages } = await getDiscussionThreadMessages(slug, activeThreadId)
|
||||
setMessagesByThread(prev => ({ ...prev, [activeThreadId]: messages }))
|
||||
void message_id
|
||||
}
|
||||
setComposer('')
|
||||
} catch (err) {
|
||||
setError(err.message)
|
||||
} finally {
|
||||
setSending(false)
|
||||
}
|
||||
}, [composer, sending, viewer, slug, activeThreadId])
|
||||
|
||||
const handleNewThread = useCallback(async () => {
|
||||
if (!viewer) { window.location.href = '/auth/login'; return }
|
||||
setError(null)
|
||||
try {
|
||||
const { thread_id } = await createDiscussionThread(slug, { label: null, message: null })
|
||||
const { items } = await listDiscussionThreads(slug)
|
||||
setThreads(items || [])
|
||||
setActiveThreadId(thread_id)
|
||||
setMessagesByThread(prev => ({ ...prev, [thread_id]: [] }))
|
||||
} catch (err) {
|
||||
setError(err.message)
|
||||
}
|
||||
}, [viewer, slug])
|
||||
|
||||
const handleResolve = useCallback(async (threadId) => {
|
||||
if (!viewer) return
|
||||
setError(null)
|
||||
try {
|
||||
await resolveDiscussionThread(slug, threadId)
|
||||
const { items } = await listDiscussionThreads(slug)
|
||||
setThreads(items || [])
|
||||
} catch (err) {
|
||||
setError(err.message)
|
||||
}
|
||||
}, [viewer, slug])
|
||||
|
||||
const onKeyDown = useCallback((e) => {
|
||||
if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
|
||||
e.preventDefault()
|
||||
handleSend()
|
||||
}
|
||||
}, [handleSend])
|
||||
|
||||
const activeThread = threads.find(t => t.id === activeThreadId) || null
|
||||
const activeMessages = messagesByThread[activeThreadId] || []
|
||||
const openThreads = threads.filter(t => t.state === 'open')
|
||||
|
||||
return (
|
||||
<div className="discussion-panel">
|
||||
<div className="discussion-header">
|
||||
<span className="discussion-header-title">
|
||||
Discussion <span className="beta-chip">Beta</span>
|
||||
</span>
|
||||
<span className="discussion-header-meta">
|
||||
{openThreads.length} open thread{openThreads.length === 1 ? '' : 's'}
|
||||
{' · '}contribution requires a PR
|
||||
</span>
|
||||
</div>
|
||||
|
||||
{threads.length > 1 && (
|
||||
<div className="discussion-thread-tabs">
|
||||
{threads.map(t => (
|
||||
<button
|
||||
key={t.id}
|
||||
type="button"
|
||||
className={`discussion-thread-tab ${t.id === activeThreadId ? 'active' : ''} ${t.state === 'resolved' ? 'resolved' : ''}`}
|
||||
onClick={() => setActiveThreadId(t.id)}
|
||||
title={t.label || (t.id === activeThreadId ? 'Current thread' : 'Open thread')}
|
||||
>
|
||||
{t.label || (t.anchor_kind === 'whole-doc' && !t.label ? 'General' : `Thread ${t.id}`)}
|
||||
{t.state === 'resolved' && ' ✓'}
|
||||
</button>
|
||||
))}
|
||||
</div>
|
||||
)}
|
||||
|
||||
<div className="discussion-messages">
|
||||
{error && <div className="discussion-error">{error}</div>}
|
||||
{activeMessages.length === 0 && !error && (
|
||||
<div className="discussion-empty">
|
||||
<p>
|
||||
{viewer
|
||||
? 'No discussion yet. Be the first to comment — discussion lives here without opening a PR. To propose an edit, use Start Contributing above.'
|
||||
: 'No discussion yet. Sign in to comment. Discussion lives here without opening a PR; proposed edits still flow through PRs.'}
|
||||
</p>
|
||||
</div>
|
||||
)}
|
||||
{activeMessages.map(msg => (
|
||||
<DiscussionMessage key={msg.id} message={msg} />
|
||||
))}
|
||||
<div ref={bottomRef} />
|
||||
</div>
|
||||
|
||||
<div className="discussion-composer">
|
||||
{viewer ? (
|
||||
<>
|
||||
<textarea
|
||||
className="discussion-composer-textarea"
|
||||
value={composer}
|
||||
onChange={e => setComposer(e.target.value)}
|
||||
onKeyDown={onKeyDown}
|
||||
placeholder={
|
||||
activeThread?.label
|
||||
? `Reply in "${activeThread.label}" — Cmd/Ctrl+Enter to send`
|
||||
: 'Discuss this RFC — Cmd/Ctrl+Enter to send'
|
||||
}
|
||||
disabled={sending}
|
||||
rows={3}
|
||||
/>
|
||||
<div className="discussion-composer-actions">
|
||||
<button
|
||||
type="button"
|
||||
className="btn-secondary"
|
||||
onClick={handleNewThread}
|
||||
disabled={sending}
|
||||
title="Open a fresh discussion thread on this RFC"
|
||||
>
|
||||
New thread
|
||||
</button>
|
||||
{activeThread
|
||||
&& activeThread.state === 'open'
|
||||
&& (activeThread.created_by === viewer.user_id
|
||||
|| viewer.role === 'owner'
|
||||
|| viewer.role === 'admin') && (
|
||||
<button
|
||||
type="button"
|
||||
className="btn-link"
|
||||
onClick={() => handleResolve(activeThread.id)}
|
||||
disabled={sending}
|
||||
title="Mark this discussion thread resolved"
|
||||
>
|
||||
Resolve
|
||||
</button>
|
||||
)}
|
||||
<button
|
||||
type="button"
|
||||
className="btn-primary"
|
||||
onClick={handleSend}
|
||||
disabled={sending || !composer.trim()}
|
||||
>
|
||||
{sending ? 'Sending…' : 'Send'}
|
||||
</button>
|
||||
</div>
|
||||
</>
|
||||
) : (
|
||||
<div className="discussion-readonly">
|
||||
Read-only — <a href="/auth/login">sign in</a> to join the discussion.
|
||||
Discussion is in private <strong>Beta</strong>.
|
||||
</div>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function DiscussionMessage({ message }) {
|
||||
const isSystem = message.role === 'system'
|
||||
if (isSystem) {
|
||||
return (
|
||||
<div className="discussion-message system">
|
||||
<div className="discussion-system-bubble">{message.text}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
return (
|
||||
<div className={`discussion-message ${message.role}`}>
|
||||
<div className="discussion-message-meta">
|
||||
<span className="discussion-message-author">
|
||||
@{message.author_login || '—'}
|
||||
</span>
|
||||
<span className="discussion-message-time">
|
||||
{formatTimestamp(message.created_at)}
|
||||
</span>
|
||||
</div>
|
||||
{message.quote && (
|
||||
<div className="discussion-message-quote">"{message.quote}"</div>
|
||||
)}
|
||||
<div className="discussion-message-body">{message.text}</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function formatTimestamp(ts) {
|
||||
if (!ts) return ''
|
||||
try {
|
||||
const d = new Date(ts + (ts.endsWith('Z') ? '' : 'Z'))
|
||||
return d.toLocaleString()
|
||||
} catch {
|
||||
return ts
|
||||
}
|
||||
}
|
||||
@@ -39,6 +39,7 @@ import MarkdownPreview from './MarkdownPreview.jsx'
|
||||
import SelectionTooltip from './SelectionTooltip.jsx'
|
||||
import PromptBar from './PromptBar.jsx'
|
||||
import ChatPanel from './ChatPanel.jsx'
|
||||
import RFCDiscussionPanel from './RFCDiscussionPanel.jsx'
|
||||
import ChangePanel, { diffWords } from './ChangePanel.jsx'
|
||||
import PRModal from './PRModal.jsx'
|
||||
import GraduateDialog from './GraduateDialog.jsx'
|
||||
@@ -759,17 +760,25 @@ export default function RFCView({ viewer }) {
|
||||
data-open={drawerOpen ? 'true' : 'false'}
|
||||
/>
|
||||
<div className={`right-panel${drawerOpen ? ' drawer-open' : ''}`} role="complementary">
|
||||
<ChatPanel
|
||||
messages={messages}
|
||||
threads={branchView.threads || []}
|
||||
changes={changes}
|
||||
branchName={branchParam}
|
||||
isStreaming={isStreaming}
|
||||
contributionMode={mode === 'contribute'}
|
||||
onStartContribution={handleStartContributing}
|
||||
onScrollToChange={setFocusedChangeId}
|
||||
onResolveThread={handleResolveThread}
|
||||
/>
|
||||
{/* v0.5.0 — on main, the right panel is the PR-less discussion
|
||||
* surface (threads.branch_name IS NULL). Branches keep their
|
||||
* existing branch-chat panel; contribution still requires
|
||||
* opening a PR from a branch via the Open PR affordance above. */}
|
||||
{branchParam === 'main' ? (
|
||||
<RFCDiscussionPanel slug={slug} viewer={viewer} />
|
||||
) : (
|
||||
<ChatPanel
|
||||
messages={messages}
|
||||
threads={branchView.threads || []}
|
||||
changes={changes}
|
||||
branchName={branchParam}
|
||||
isStreaming={isStreaming}
|
||||
contributionMode={mode === 'contribute'}
|
||||
onStartContribution={handleStartContributing}
|
||||
onScrollToChange={setFocusedChangeId}
|
||||
onResolveThread={handleResolveThread}
|
||||
/>
|
||||
)}
|
||||
{mode === 'contribute' && (changes.length > 0 || manualPending) && (
|
||||
<ChangePanel
|
||||
changes={changes}
|
||||
|
||||
Reference in New Issue
Block a user