5 Commits

Include renames

Author	SHA1	Message	Date
Bendik Aagaard LynghaugandClaude Sonnet 5	ebf4bf91b3	Event-sourced applicant/subscriber/project aggregates, generalized resources ... Replaces the free-string, direct-KV-mutate state model in answers.rs with a proper event log (events/store.rs, JetStream-backed, CAS via expected_last_subject_sequence) and three pure state machines (aggregates/{applicant,subscriber,project}.rs). Closes a real lost-update race in the old transition_answer (concurrent decisions on the same item could both win, publishing contradictory events). KV buckets become best-effort read-model projections, not the source of truth. Content-declared transition targets are now validated at load/reload time against the real compiled transition tables, not accepted as arbitrary strings. Buckets renamed to describe their content, not their relation to the app (portal_applicants -> applicants, etc); "inquiry" folded into a richer "project" concept. ResourceSpec generalized beyond a single KV bucket: Kv | GiteaStarred | GiteaOrgRepos | Url sources, with an optional jq filter (via the jaq crate) to shape live data for the frontend. Url source is SSRF-guarded (https-only, rejects loopback/private/link-local, real DNS resolve). New headless question_lint binary (validates content against compiled transition tables with no NATS/OIDC/server involved) and a one-time backfill_events binary (dry-run by default) for migrating existing KV data onto the new event log. Questions get an optional `responsible` contact plus a lightweight "report this question" action. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-06 08:52:29 +02:00
Bendik Aagaard Lynghaug	213b1130bb	Add self-service transitions, authorized by item possession not group membership ... New Alternative.self_transition: like ResourceSpec.transitions, but for an anonymous visitor holding one specific item's own chain hash (from a ?chain= link, the same reference /subscribed?chain=... already carries) rather than a signed-in owner browsing a whole bucket. email is a second factor checked against the stored item, not the lookup key - defense in depth against a leaked/guessed chain hash alone. AlternativeCard renders it as a single confirm button when both ?chain= and ?email= are present; QuestionView hides the alternative entirely otherwise, rather than showing a dead card with nothing to click. Powers /subscribed's new "Unsubscribe" alternative, which the newsletter's own recipient links now carry - no email lookup needed, just the same chain_hash the subscription itself already produced.	2026-08-05 18:44:28 +02:00
Bendik Aagaard Lynghaug	6df895b1d3	Fix get_resource/transition_answer: scope feature lookup to its own alternative ... Both resolved a feature by name flattened across every alternative on the question, not scoped to the one the caller actually meant - fine when every question had exactly one alternative with a resource feature, silently wrong now that /review has three (Applicants, Inquiries, Subscribers all use the same empty feature name). Every lookup always resolved to the first alternative's feature - Subscribers was reading the (empty) Applicants bucket instead of its own, and Invite/Decline/Mark-handled buttons would have had the same problem had two of those transitions ever been clicked side by side. Threaded a new `alternative` parameter through get_resource, transition_answer, and their client-side callers (ResourceFeature/ResourceValue/AnswerRow) - the fix lives entirely in the already-generic resource-fetching machinery, no per-alternative special-casing.	2026-08-05 15:04:02 +02:00
Bendik Aagaard Lynghaug	18025bf870	Hot-reload content on a NATS trigger instead of requiring a restart ... questions is now Arc<ArcSwap<HashMap<...>>> - readers do a lock-free atomic load (state.questions.load().get(&id).cloned()), never blocking on or blocked by a reload. content::watch_for_reload subscribes to portal.content.reload (published by the questions repo's own CI after it lints a push - see that repo's lint-and-reload.yml) and swaps in a freshly re-fetched HashMap on each message. A fetch/parse failure logs and keeps serving the last-good content rather than clearing it.	2026-08-05 07:20:40 +02:00
Bendik Aagaard Lynghaug	aa1a7fa572	Initial commit: content-driven onboarding portal ... Leptos/Axum app that renders a Question/Alternative/Feature schema loaded from a sibling content repo (portal-content). Kanidm OIDC login, content-driven authorization (Question.qualifies), a generic NATS KV-backed resource + state-transition mechanism (no bespoke "applicant" concept baked into the runtime - it's all content), a SHA-256 DAG chain tying submissions and decisions together, and the "YES - Rasterized Lines" piece (ported from the live uhhm.no site) as the landing hero.	2026-07-29 19:38:40 +02:00