Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback

- type: prosekit requirement kind, backed by public/prosekit-editor.js
  (ProseMirror via prosekit, loaded from esm.sh, no bundler) - mirrors
  its HTML into a paired hidden input so it reuses the existing
  RwSignal/on:input wiring.
- Pasting a project.uhhm.no/<owner>/<repo> URL in the editor embeds a
  repo card, resolved server-side via a new /gitea-repo handler
  (content::gitea_repo_handler) so the browser never needs Gitea API
  CORS.
- New /automation/kv/{bucket} handler, bearer-token gated
  (AUTOMATION_READ_TOKEN), for backing automations (n8n) to read a
  NATS KV bucket without a browser session.
- Fix: a login started on one of apex/www set its session cookie
  there, but Kanidm's redirect_uri is fixed to PUBLIC_URL - landing
  the callback on a different, empty session ("no login in
  progress"). Caddy now redirects www -> apex so every visit stays on
  one canonical host.

src/app.rs

@@ -198,6 +198,31 @@ mod yes {
     }
 }
 
+// Same idiomatic-typed-module approach as `yes` above, for the
+// prosekit-backed rich-text requirement kind (`prosekit-editor.js`,
+// project root - `#[wasm_bindgen(module = "/x.js")]` resolves relative
+// to the crate root, not the `public/` static-asset dir, same as
+// `yes.js` below). `mount_editor` hands the editor a container node
+// plus the paired
+// hidden `<input>` it mirrors its HTML into and fires real `input`
+// events on - see `mount_editor`'s call site in `AlternativeCard`, and
+// the JS module itself for why a hidden-input bridge rather than a
+// bespoke Rust<->JS value channel.
+#[cfg(feature = "hydrate")]
+mod prosekit {
+    use wasm_bindgen::prelude::*;
+
+    #[wasm_bindgen(module = "/prosekit-editor.js")]
+    extern "C" {
+        #[wasm_bindgen(js_name = mountEditor)]
+        pub fn mount_editor(
+            container: &web_sys::HtmlDivElement,
+            hidden: &web_sys::HtmlInputElement,
+            initial: &str,
+        );
+    }
+}
+
 #[component]
 fn Hero(title: String, description: String, show_yes: bool) -> impl IntoView {
     // Only the landing page gets the full interactive piece - it's the
@@ -427,6 +452,8 @@ fn AlternativeCard(
                                                     </span>
                                                 };
 
+                                                let sig = field_map.get(&req.name).copied().unwrap_or_else(|| RwSignal::new(String::new()));
+
                                                 if req.kind == "file" {
                                                     let file_ref = file_refs.get(&req.name).copied().unwrap_or_else(NodeRef::new);
                                                     return view! {
@@ -445,7 +472,38 @@ fn AlternativeCard(
                                                     .into_any();
                                                 }
 
-                                                let sig = field_map.get(&req.name).copied().unwrap_or_else(|| RwSignal::new(String::new()));
+                                                if req.kind == "prosekit" {
+                                                    let container_ref: NodeRef<leptos::html::Div> = NodeRef::new();
+                                                    let hidden_ref: NodeRef<leptos::html::Input> = NodeRef::new();
+
+                                                    #[cfg(feature = "hydrate")]
+                                                    {
+                                                        Effect::new(move |_| {
+                                                            let (Some(container), Some(hidden)) =
+                                                                (container_ref.get(), hidden_ref.get())
+                                                            else {
+                                                                return;
+                                                            };
+                                                            prosekit::mount_editor(&container, &hidden, &sig.get_untracked());
+                                                        });
+                                                    }
+
+                                                    return view! {
+                                                        <label class="field" for=label_for>
+                                                            {label_text}
+                                                            <input
+                                                                id=field_id
+                                                                type="hidden"
+                                                                node_ref=hidden_ref
+                                                                prop:value=move || sig.get()
+                                                                on:input=move |ev| sig.set(event_target_value(&ev))
+                                                            />
+                                                            <div class="prosekit-editor" node_ref=container_ref></div>
+                                                        </label>
+                                                    }
+                                                    .into_any();
+                                                }
+
                                                 view! {
                                                     <label class="field" for=label_for>
                                                         {label_text}

src/content.rs

@@ -143,6 +143,24 @@ impl Requirement {
     }
 }
 
+/// Extracts `scheme://host` from a repo's normal browser URL (e.g.
+/// `https://project.uhhm.no/uhhm/questions` -> `https://project.uhhm.no`)
+/// - the Gitea API base every helper in this module builds requests
+/// against, including ones (like `resolve_gitea_repo`) that have
+/// nothing to do with content loading, just the same Gitea instance.
+#[cfg(feature = "ssr")]
+pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing repo url {repo_url}: {e}"))?;
+    Ok(format!(
+        "{}://{}",
+        parsed.scheme(),
+        parsed
+            .host_str()
+            .ok_or_else(|| anyhow::anyhow!("no host in repo url {repo_url}"))?
+    ))
+}
+
 /// Fetches every `*.yaml` file under `subdir` in a Gitea repo as a
 /// `Question`, keyed by its own `id`. `repo_url` is the repo's normal
 /// browser URL (e.g. `https://project.uhhm.no/uhhm/questions`) - the
@@ -158,13 +176,7 @@ pub async fn load_questions_from_gitea(
 ) -> anyhow::Result<std::collections::HashMap<String, Question>> {
     let parsed = url::Url::parse(repo_url)
         .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
-    let api_base = format!(
-        "{}://{}",
-        parsed.scheme(),
-        parsed
-            .host_str()
-            .ok_or_else(|| anyhow::anyhow!("no host in content repo url {repo_url}"))?
-    );
+    let api_base = gitea_api_base(repo_url)?;
     let mut segments = parsed
         .path_segments()
         .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
@@ -261,3 +273,138 @@ pub async fn watch_for_reload(
         }
     }
 }
+
+/// A public Gitea repo's basic info - what `resolve_gitea_repo` returns
+/// for the prosekit editor's repo-embed node to render as a static
+/// card, baked in once at embed time rather than re-fetched by every
+/// reader (an emailed newsletter can't run JS to do that anyway).
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct GiteaRepoInfo {
+    pub owner: String,
+    pub repo: String,
+    pub description: String,
+    pub url: String,
+}
+
+#[derive(Deserialize)]
+#[cfg(feature = "ssr")]
+pub struct GiteaRepoQuery {
+    pub owner: String,
+    pub repo: String,
+}
+
+/// Looks up `owner/repo` on the same Gitea instance content is loaded
+/// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
+/// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
+/// caller here is the prosekit editor's own paste-to-embed rule (see
+/// `prosekit-editor.js`) doing a plain `fetch`, the same reason
+/// `/upload` (`src/upload.rs`) is a raw handler rather than a `#[server]`
+/// fn. Keeping this server-resolved (rather than having the browser
+/// call Gitea's API directly) is consistent with every other backing
+/// store in this app, and sidesteps needing a CORS allowance on Gitea's
+/// side just for this. No auth, same as content loading - resolves
+/// only what's already public.
+#[cfg(feature = "ssr")]
+pub async fn gitea_repo_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Query(query): axum::extract::Query<GiteaRepoQuery>,
+) -> Result<axum::Json<GiteaRepoInfo>, (axum::http::StatusCode, String)> {
+    let is_safe_segment = |s: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+    };
+    if !is_safe_segment(&query.owner) || !is_safe_segment(&query.repo) {
+        return Err((axum::http::StatusCode::BAD_REQUEST, "invalid owner/repo".to_string()));
+    }
+    let GiteaRepoQuery { owner, repo } = query;
+
+    let client = openidconnect::reqwest::Client::new();
+    let api_url = format!("{}/api/v1/repos/{owner}/{repo}", state.gitea_base);
+    let body = client
+        .get(&api_url)
+        .send()
+        .await
+        .and_then(|r| r.error_for_status())
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("fetching {api_url}: {e}")))?
+        .text()
+        .await
+        .map_err(|e| {
+            (
+                axum::http::StatusCode::BAD_GATEWAY,
+                format!("reading repo info from {api_url}: {e}"),
+            )
+        })?;
+    let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+        (
+            axum::http::StatusCode::BAD_GATEWAY,
+            format!("parsing repo info from {api_url}: {e}"),
+        )
+    })?;
+
+    Ok(axum::Json(GiteaRepoInfo {
+        owner: owner.clone(),
+        repo: repo.clone(),
+        description: json
+            .get("description")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string(),
+        url: json
+            .get("html_url")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| format!("{}/{owner}/{repo}", state.gitea_base)),
+    }))
+}
+
+/// Lists every entry in a NATS KV bucket as JSON - a raw Axum handler
+/// (mounted at `/automation/kv/{bucket}` in `main.rs`), for backing
+/// automations (e.g. an n8n workflow reading `portal_subscribers` to
+/// send a newsletter) that aren't a signed-in browser session and so
+/// can't go through `resource::get_resource`'s Kanidm-group check.
+/// Gated by a single shared bearer token (`AUTOMATION_READ_TOKEN`) -
+/// deliberately not per-caller/per-bucket scoped, since every current
+/// caller is a trusted internal automation, not a third party. Read
+/// only, matching `get_resource`'s own "reads can be public/shared,
+/// mutations always need real identity" split - nothing here writes.
+#[cfg(feature = "ssr")]
+pub async fn automation_kv_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(bucket): axum::extract::Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Result<axum::Json<serde_json::Value>, (axum::http::StatusCode, String)> {
+    let expected = std::env::var("AUTOMATION_READ_TOKEN").unwrap_or_default();
+    let presented = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .unwrap_or("");
+    if expected.is_empty() || presented != expected {
+        return Err((axum::http::StatusCode::UNAUTHORIZED, "unauthorized".to_string()));
+    }
+
+    let store = state
+        .jetstream
+        .get_key_value(&bucket)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("bucket unavailable: {e}")))?;
+
+    use futures::TryStreamExt;
+    let keys: Vec<String> = store
+        .keys()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?
+        .try_collect()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?;
+    let mut items = Vec::new();
+    for key in keys {
+        if let Ok(Some(bytes)) = store.get(&key).await {
+            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                items.push(value);
+            }
+        }
+    }
+    Ok(axum::Json(serde_json::Value::Array(items)))
+}

src/main.rs

@@ -28,6 +28,7 @@ async fn main() -> anyhow::Result<()> {
     let content_repo = std::env::var("CONTENT_REPO")
         .unwrap_or_else(|_| "https://project.uhhm.no/uhhm/questions".to_string());
     let content_branch = std::env::var("CONTENT_BRANCH").unwrap_or_else(|_| "main".to_string());
+    let gitea_base = content::gitea_api_base(&content_repo)?;
     let questions = content::load_questions_from_gitea(&content_repo, &content_branch, "questions").await?;
     tracing::info!(count = questions.len(), repo = %content_repo, branch = %content_branch, "loaded content");
     let questions = Arc::new(arc_swap::ArcSwap::from_pointee(questions));
@@ -70,6 +71,7 @@ async fn main() -> anyhow::Result<()> {
         nats,
         jetstream,
         questions,
+        gitea_base,
         oidc: oidc_state,
         garage,
     };
@@ -122,6 +124,8 @@ async fn main() -> anyhow::Result<()> {
         .route("/auth/logout", get(oidc::logout))
         .route("/api/{*fn_name}", any(server_fn_handler))
         .route("/upload", post(upload::upload))
+        .route("/gitea-repo", get(content::gitea_repo_handler))
+        .route("/automation/kv/{bucket}", get(content::automation_kv_handler))
         .nest_service("/pkg", ServeDir::new(pkg_dir))
         .nest_service("/fonts", ServeDir::new(fonts_dir))
         .route_service("/favicon.svg", ServeFile::new(favicon_path))

src/server/mod.rs

@@ -22,6 +22,11 @@ pub struct AppState {
     /// a lock, just an atomic pointer load, so a reload never blocks or
     /// is blocked by an in-flight request.
     pub questions: Arc<ArcSwap<HashMap<String, Question>>>,
+    /// `scheme://host` of the Gitea instance content is loaded from
+    /// (see `content::gitea_api_base`) - kept alongside `questions`
+    /// rather than re-derived per call, since `resolve_gitea_repo` needs
+    /// it too and has no other reason to see `CONTENT_REPO` itself.
+    pub gitea_base: String,
     pub oidc: Arc<oidc::Oidc>,
     /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
     /// optional feature, everything else works without Garage.