Gesture input type, redoal-relay client, gitea_releases, content-driven branding

Four coupled additions that let one portal build serve a second face
(redoal.com) next to uhhm.no:

- type: gesture requirement - gesture.js draws a single stroke on a
  DPR-aware canvas (pointer events, touch-action: none), mirrors
  {points, key} into the paired hidden input prosekit-style, and -
  when content declares relay: wss://... - speaks the redoal-relay
  protocol: announce on stroke end, ghost the ack's decoded key path,
  show echoes of similar strokes as thumbnails. Offline/broken relay
  degrades to a plain drawing input; the widget handle's stop()
  closes the socket on SPA navigation (yes.js lifecycle, not
  prosekit's fire-and-forget). Submit re-parses gesture values so the
  bucket stores a real object, not double-encoded JSON.
- gitea_releases resource source - token-authenticated
  /repos/{owner}/{repo}/releases, for advertising a private repo's
  releases (content pins url: null - private html_urls 404 publicly).
- site.yaml branding - optional, at the content repo root: title,
  wordmark, hero {kind: yes|gesture|plain, relay}. Absent file means
  the historical uhhm look, so uhhm changes nothing without a content
  edit. Hot-swapped with questions/aggregates on content reload;
  question_lint validates it in both --path and --repo modes.
- deploy.yml ships the same build twice: uhhm-portal (3010) as
  before, redoal-portal (3020, CONTENT_REPO=redoal/questions,
  redoal.com vhost). Needs host prep + REDOAL_OAUTH2_* repo
  secrets/vars before the new steps succeed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/content.rs

@@ -163,6 +163,11 @@ pub enum ResourceSource {
     Kv { bucket: String },
     GiteaStarred { username: String },
     GiteaOrgRepos { org: String },
+    /// A repo's releases - fetched with `GITEA_API_TOKEN`, so it works
+    /// for private repos too (shape the link with jq: a private
+    /// release's html_url 404s for anonymous visitors, so map it to
+    /// null unless the repo is public).
+    GiteaReleases { owner: String, repo: String },
     /// Any other HTTPS JSON endpoint. Scheme-restricted and checked
     /// against loopback/private/link-local addresses at fetch time
     /// (`resource::fetch_url_resource`) - a server-side fetch of a
@@ -178,6 +183,7 @@ impl ResourceSpec {
             ResourceSource::Kv { bucket } => Some(bucket),
             ResourceSource::GiteaStarred { .. }
             | ResourceSource::GiteaOrgRepos { .. }
+            | ResourceSource::GiteaReleases { .. }
             | ResourceSource::Url { .. } => None,
         }
     }
@@ -231,6 +237,13 @@ pub struct Requirement {
     /// the selected file's current content.
     #[serde(default)]
     pub bind: Option<Bind>,
+    /// `type: gesture` only - ws(s):// URL of a redoal-relay instance
+    /// the drawing widget connects to for live echoes of similar
+    /// strokes. Absent means the widget works offline: the drawn path
+    /// still submits, it just never gets a network-computed key or
+    /// echoes.
+    #[serde(default)]
+    pub relay: Option<String>,
 }
 
 /// A field's live data source, parameterized by a sibling field's
@@ -265,6 +278,104 @@ impl Requirement {
     }
 }
 
+/// Site-wide branding declared by the content repo - `site.yaml` at
+/// the repo root, sibling of `aggregates.yaml`. An absent file means
+/// all defaults, which is exactly the historical uhhm look: existing
+/// deployments change nothing without a content edit. Everything the
+/// browser needs, so it travels through a server fn (`get_site`).
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq)]
+pub struct SiteConfig {
+    /// Browser-tab title and wordmark alt text. `None` falls back to
+    /// the compile-time `SITE_NAME`.
+    #[serde(default)]
+    pub title: Option<String>,
+    /// Wordmark image URL (absolute or a path this instance serves).
+    /// `None` falls back to `/wordmark.svg`.
+    #[serde(default)]
+    pub wordmark: Option<String>,
+    #[serde(default)]
+    pub hero: HeroConfig,
+}
+
+/// What the landing page's hero is: the YES canvas piece (`yes`, the
+/// default), a redoal gesture-drawing canvas (`gesture`), or copy
+/// only (`plain`).
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HeroConfig {
+    #[serde(default = "default_hero_kind")]
+    pub kind: String,
+    /// `kind: gesture` only - ws(s):// URL of a redoal-relay for
+    /// ambient echoes. Absent means the hero draws offline.
+    #[serde(default)]
+    pub relay: Option<String>,
+}
+
+impl Default for HeroConfig {
+    fn default() -> Self {
+        Self { kind: default_hero_kind(), relay: None }
+    }
+}
+
+fn default_hero_kind() -> String {
+    "yes".to_string()
+}
+
+#[cfg(feature = "ssr")]
+impl SiteConfig {
+    /// Shared by `load_site_from_gitea` and the `question-lint` binary
+    /// so a typo'd hero kind is a caught rejection, not a silently
+    /// plain hero.
+    pub fn validate(&self) -> anyhow::Result<()> {
+        if !matches!(self.hero.kind.as_str(), "yes" | "gesture" | "plain") {
+            anyhow::bail!(
+                "site.yaml: hero.kind {:?} is not one of yes | gesture | plain",
+                self.hero.kind
+            );
+        }
+        if let Some(relay) = &self.hero.relay {
+            if self.hero.kind != "gesture" {
+                anyhow::bail!("site.yaml: hero.relay only makes sense with hero.kind: gesture");
+            }
+            validate_relay_url(relay).map_err(|e| anyhow::anyhow!("site.yaml: {e}"))?;
+        }
+        Ok(())
+    }
+}
+
+/// A relay must be a ws:// or wss:// URL - shared between site.yaml's
+/// hero and `Requirement.relay` validation.
+#[cfg(feature = "ssr")]
+pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
+    let parsed = url::Url::parse(relay)
+        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
+    if !matches!(parsed.scheme(), "ws" | "wss") {
+        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
+    }
+    Ok(())
+}
+
+/// Fetches and parses `site.yaml` from the content repo root. A fetch
+/// failure (typically 404 - the file is optional) yields the default
+/// config; a file that exists but doesn't parse or validate is a real
+/// error, surfaced at boot rather than papered over.
+#[cfg(feature = "ssr")]
+pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let client = openidconnect::reqwest::Client::new();
+    let raw = match fetch_gitea_file(&client, &api_base, &owner, &repo, branch, "site.yaml").await {
+        Ok(raw) => raw,
+        Err(e) => {
+            tracing::info!("no site.yaml in content repo ({e}), using default branding");
+            return Ok(SiteConfig::default());
+        }
+    };
+    let site: SiteConfig =
+        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
+    site.validate()?;
+    Ok(site)
+}
+
 /// Extracts `scheme://host` from a repo's normal browser URL - the
 /// Gitea API base every helper in this module builds requests against.
 #[cfg(feature = "ssr")]
@@ -472,6 +583,26 @@ pub fn validate_questions(
                             question.id, alternative.name, feature.name, requirement.name
                         );
                     }
+                    if let Some(relay) = &requirement.relay {
+                        if requirement.kind != "gesture" {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture",
+                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
+                            );
+                        }
+                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
+                            question.id, alternative.name, feature.name, requirement.name
+                        ))?;
+                    }
+                    if requirement.kind == "gesture"
+                        && (requirement.resource.is_some() || requirement.bind.is_some())
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
                     if let Some(bind) = &requirement.bind {
                         if bind.field == requirement.name
                             || !sibling_names.contains(bind.field.as_str())
@@ -543,6 +674,7 @@ pub async fn watch_for_reload(
     aggregates: std::sync::Arc<
         arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
     >,
+    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
 ) {
     let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
         Ok(sub) => sub,
@@ -560,6 +692,17 @@ pub async fn watch_for_reload(
                 continue;
             }
         };
+        // Branding swaps with the same all-or-nothing rule: a
+        // present-but-broken site.yaml keeps last-good everything
+        // (load_site distinguishes "absent" - a normal default - from
+        // "present but invalid").
+        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => loaded,
+            Err(e) => {
+                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
         match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
             Ok(loaded) => {
                 if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
@@ -569,6 +712,7 @@ pub async fn watch_for_reload(
                 let count = loaded.len();
                 questions.store(std::sync::Arc::new(loaded));
                 aggregates.store(std::sync::Arc::new(loaded_aggregates));
+                site.store(std::sync::Arc::new(loaded_site));
                 tracing::info!(count, "reloaded content");
             }
             Err(e) => {
@@ -849,4 +993,80 @@ alternatives:
         let err = validate_questions(&question_with_bind("body"), &Default::default()).unwrap_err();
         assert!(err.to_string().contains("not another requirement"));
     }
+
+    fn question_with_requirement(req_yaml: &str) -> std::collections::HashMap<String, Question> {
+        let question: Question = serde_yaml::from_str(&format!(
+            "id: /g\nname: G\nalternatives:\n  - name: A\n    features:\n      - name: \"\"\n        requirements:\n{req_yaml}\n"
+        ))
+        .unwrap();
+        std::collections::HashMap::from([(question.id.clone(), question)])
+    }
+
+    #[test]
+    fn gesture_with_wss_relay_passes() {
+        let questions = question_with_requirement(
+            "          - { name: curve, type: gesture, relay: \"wss://relay.redoal.com\", optional: true }",
+        );
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+    }
+
+    #[test]
+    fn gesture_without_relay_passes_offline() {
+        let questions =
+            question_with_requirement("          - { name: curve, type: gesture, optional: true }");
+        assert!(validate_questions(&questions, &Default::default()).is_ok());
+    }
+
+    #[test]
+    fn relay_on_non_gesture_kind_is_rejected() {
+        let questions = question_with_requirement(
+            "          - { name: email, type: email, relay: \"wss://relay.redoal.com\" }",
+        );
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("relay only makes sense on type: gesture"));
+    }
+
+    #[test]
+    fn https_relay_is_rejected() {
+        let questions = question_with_requirement(
+            "          - { name: curve, type: gesture, relay: \"https://relay.redoal.com\" }",
+        );
+        let err = validate_questions(&questions, &Default::default()).unwrap_err();
+        assert!(err.to_string().contains("ws:// or wss://"));
+    }
+
+    #[test]
+    fn site_config_defaults_to_the_yes_hero() {
+        let site = SiteConfig::default();
+        assert_eq!(site.hero.kind, "yes");
+        assert!(site.validate().is_ok());
+        // And an empty file parses to the same thing.
+        let parsed: SiteConfig = serde_yaml::from_str("{}").unwrap();
+        assert_eq!(parsed, site);
+    }
+
+    #[test]
+    fn site_config_rejects_unknown_hero_kind() {
+        let site: SiteConfig = serde_yaml::from_str("hero: { kind: fireworks }").unwrap();
+        let err = site.validate().unwrap_err();
+        assert!(err.to_string().contains("fireworks"));
+    }
+
+    #[test]
+    fn site_config_rejects_relay_without_gesture_hero() {
+        let site: SiteConfig =
+            serde_yaml::from_str("hero: { kind: yes, relay: \"wss://relay.redoal.com\" }").unwrap();
+        assert!(site.validate().is_err());
+    }
+
+    #[test]
+    fn redoal_site_yaml_shape_parses() {
+        let site: SiteConfig = serde_yaml::from_str(
+            "title: redoal\nwordmark: https://project.uhhm.no/redoal/questions/raw/branch/main/wordmark.svg\nhero:\n  kind: gesture\n  relay: wss://relay.redoal.com\n",
+        )
+        .unwrap();
+        assert!(site.validate().is_ok());
+        assert_eq!(site.title.as_deref(), Some("redoal"));
+        assert_eq!(site.hero.kind, "gesture");
+    }
 }