Skip to main content

max / makenotwork

11.7 KB · 319 lines History Blame Raw
1 //! Public project page handler.
2
3 use axum::{
4 extract::{Path, State},
5 response::{IntoResponse, Response},
6 };
7 use sqlx::PgPool;
8 use tower_sessions::Session;
9
10 use crate::{
11 auth::{MaybeUserVerified, SessionUser},
12 config::Config,
13 db::{self, FollowTargetType, ItemId, ItemType, Slug},
14 error::{AppError, Result},
15 helpers::get_csrf_token,
16 pricing,
17 templates::{ProjectPaywallTemplate, ProjectTemplate},
18 types::{Item, Project, ProjectSection, SubscriptionTier},
19 };
20
21 /// Render a public project page with its published items.
22 #[tracing::instrument(skip_all, name = "content::project_page", fields(%slug))]
23 pub(in crate::routes::pages::public) async fn project_page(
24 State(db): State<PgPool>,
25 State(config): State<Config>,
26 State(page_view_tx): State<crate::db::page_views::PageViewTx>,
27 session: Session,
28 headers: axum::http::HeaderMap,
29 MaybeUserVerified(maybe_user): MaybeUserVerified,
30 Path(slug): Path<String>,
31 ) -> Result<Response> {
32 let csrf_token = get_csrf_token(&session).await;
33 let slug = Slug::new(&slug).map_err(|_| AppError::NotFound)?;
34 let db_project = db::projects::get_public_project_by_slug(&db, &slug)
35 .await?
36 .ok_or(AppError::NotFound)?;
37 let response = render_project_page(&db, &config, &db_project, csrf_token, maybe_user).await?;
38 let ua = headers
39 .get(axum::http::header::USER_AGENT)
40 .and_then(|v| v.to_str().ok())
41 .unwrap_or("");
42 if !super::is_bot(ua) {
43 super::track_view(&page_view_tx, "project", *db_project.id);
44 }
45 Ok(response)
46 }
47
48 /// Shared project page renderer, used by both named routes and custom domain fallback.
49 #[tracing::instrument(
50 skip_all,
51 name = "content::render_project_page",
52 fields(project_id = %db_project.id, project_slug = %db_project.slug, viewer_id = ?maybe_user.as_ref().map(|u| u.id))
53 )]
54 pub(crate) async fn render_project_page(
55 db: &PgPool,
56 config: &Config,
57 db_project: &db::DbProject,
58 csrf_token: Option<String>,
59 maybe_user: Option<SessionUser>,
60 ) -> Result<Response> {
61 let db_user = db::users::get_user_by_id(db, db_project.user_id)
62 .await?
63 .ok_or(AppError::NotFound)?;
64
65 // Project-level paywall gate
66 let project_pricing = pricing::for_project(db_project);
67 if !project_pricing.is_free() {
68 let project_ctx = pricing::build_project_access_context(
69 db,
70 maybe_user.as_ref().map(|u| u.id),
71 db_project.id,
72 db_project.user_id,
73 )
74 .await?;
75 if !project_pricing.can_access(&project_ctx) {
76 tracing::warn!(
77 project_id = %db_project.id,
78 project_slug = %db_project.slug,
79 creator_user_id = %db_project.user_id,
80 viewer_user_id = ?maybe_user.as_ref().map(|u| u.id),
81 is_creator = project_ctx.is_creator,
82 has_purchased = project_ctx.has_purchased,
83 has_active_subscription = project_ctx.has_active_subscription(),
84 pricing_kind = ?project_pricing.kind(),
85 "project paywall gate: showing paywall"
86 );
87 let db_tiers =
88 db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
89 let subscription_tiers: Vec<SubscriptionTier> = db_tiers
90 .iter()
91 .map(|t| SubscriptionTier::from_db(t, db_user.settlement_currency))
92 .collect();
93 // Show how much is behind the paywall. A project with a lot in it
94 // sells better than a bare price, and the count is not the thing
95 // being sold: the items themselves stay gated. Reads the
96 // denormalized column, so it matches the discover card exactly and
97 // costs one indexed lookup.
98 let item_count = db::projects::get_active_item_count(db, db_project.id)
99 .await
100 .unwrap_or_else(|e| {
101 tracing::warn!(
102 project_id = %db_project.id,
103 error = %e,
104 "paywall item count lookup failed; rendering without a count"
105 );
106 0
107 });
108 let project = Project::from_db(db_project, item_count.max(0) as u32);
109 return Ok(ProjectPaywallTemplate {
110 csrf_token,
111 session_user: maybe_user,
112 project,
113 creator_username: db_user.username.to_string(),
114 price_display: project_pricing.price_display(db_user.settlement_currency),
115 checkout_type: project_pricing.checkout_type(),
116 pwyw_min_dollars: crate::formatting::format_dollars_plain(
117 project_pricing.minimum_cents().unwrap_or(0),
118 ),
119 subscription_tiers,
120 host_url: config.host_url.clone(),
121 }
122 .into_response());
123 }
124 }
125
126 let db_items = db::items::get_public_items_by_project(db, db_project.id).await?;
127
128 let is_creator = maybe_user
129 .as_ref()
130 .is_some_and(|u| u.id == db_project.user_id);
131
132 // Scope the purchase lookup to the items actually rendered on this page
133 // rather than fetching the viewer's entire purchase history (fuzz 2026-07-06
134 // F6). `purchased_subset` is a single `item_id = ANY($2)` roundtrip.
135 let purchased_item_ids: std::collections::HashSet<ItemId> = if let Some(ref user) = maybe_user {
136 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
137 db::transactions::purchased_subset(db, user.id, &item_ids).await?
138 } else {
139 std::collections::HashSet::new()
140 };
141
142 // Per-item subscription proofs for this user, so each item's AccessContext
143 // gets its own gate witness rather than a bare membership bool.
144 #[allow(
145 clippy::zero_sized_map_values,
146 reason = "SubscriptionGate is a deliberate zero-sized capability witness, not data"
147 )]
148 let subscribed_gates = if let Some(ref user) = maybe_user {
149 db::subscriptions::SubscriptionGate::subscribed_item_gates(db, user.id).await?
150 } else {
151 std::collections::HashMap::new()
152 };
153
154 let has_subscription = if let Some(ref user) = maybe_user {
155 db::subscriptions::has_access(
156 db,
157 user.id,
158 db::subscriptions::SubscriptionScope::Project(db_project.id),
159 )
160 .await?
161 } else {
162 false
163 };
164
165 let project = Project::from_db(db_project, db_items.len() as u32);
166
167 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
168 let tags_map = db::tags::get_tags_for_items(db, &item_ids).await?;
169
170 // Batch child-counts for all bundles on the page in one query (was one
171 // COUNT per bundle inside the loop below).
172 let bundle_ids: Vec<ItemId> = db_items
173 .iter()
174 .filter(|i| i.item_type == ItemType::Bundle)
175 .map(|i| i.id)
176 .collect();
177 let bundle_counts = if bundle_ids.is_empty() {
178 std::collections::HashMap::new()
179 } else {
180 db::bundles::get_bundle_item_counts(db, &bundle_ids).await?
181 };
182
183 let mut items: Vec<Item> = Vec::with_capacity(db_items.len());
184 for i in &db_items {
185 let item_pricing = pricing::for_item(i);
186 let ctx = pricing::AccessContext {
187 is_creator,
188 has_purchased: purchased_item_ids.contains(&i.id),
189 subscription: subscribed_gates.get(&i.id).copied(),
190 };
191 let can_access = item_pricing.can_access(&ctx);
192 let is_free = item_pricing.is_free();
193 let item_tags = tags_map.get(&i.id).map_or(&[][..], std::vec::Vec::as_slice);
194 let mut item = Item::from_db_list(
195 i,
196 item_tags,
197 is_free,
198 can_access,
199 db_user.settlement_currency,
200 );
201 if i.item_type == ItemType::Bundle {
202 item.bundle_item_count = bundle_counts.get(&i.id).copied().unwrap_or(0);
203 }
204 items.push(item);
205 }
206
207 let follower_count =
208 db::follows::get_follower_count(db, FollowTargetType::Project, db_project.id.into())
209 .await?;
210 let is_following = if let Some(ref viewer) = maybe_user {
211 db::follows::is_following(
212 db,
213 viewer.id,
214 FollowTargetType::Project,
215 db_project.id.into(),
216 )
217 .await?
218 } else {
219 false
220 };
221
222 let db_tiers = db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
223 let subscription_tiers: Vec<SubscriptionTier> = db_tiers
224 .iter()
225 .map(|t| SubscriptionTier::from_db(t, db_user.settlement_currency))
226 .collect();
227
228 let git_repos = if config.build.git_repos_path.is_some() {
229 let linked = db::git_repos::get_repos_by_project(db, db_project.id)
230 .await
231 .unwrap_or_else(|e| {
232 tracing::warn!(project_id = %db_project.id, error = %e, "linked git repos lookup failed; omitting repo links");
233 Vec::default()
234 });
235 linked
236 .into_iter()
237 .map(|r| {
238 let url = format!("/git/{}/{}", db_user.username, r.name);
239 (r.name, url)
240 })
241 .collect()
242 } else {
243 Vec::new()
244 };
245
246 let has_blog_posts = db::blog_posts::has_published_posts(db, db_project.id).await?;
247
248 let community_url = if db_project.mt_community_id.is_some() {
249 config
250 .integrations
251 .mt_base_url
252 .as_ref()
253 .map(|base| format!("{}/p/{}", base, db_project.slug))
254 } else {
255 None
256 };
257
258 let is_owner = maybe_user
259 .as_ref()
260 .is_some_and(|u| u.id == db_project.user_id);
261
262 let db_sections = db::project_sections::list_by_project(db, db_project.id).await?;
263 let cdn_base = config.cdn_base_url.as_str();
264 let sections: Vec<ProjectSection> = db_sections
265 .iter()
266 .map(|s| ProjectSection::from_db(s, db_project.user_id, cdn_base))
267 .collect();
268
269 // Ordered gallery → carousel frames (additive to the cover image). Alt is
270 // creator-optional; fall back to a title-based description (CarouselFrame::new
271 // debug-asserts non-empty alt, so build the struct directly).
272 let gallery = db::gallery_images::list_for_project(db, db_project.id)
273 .await
274 .unwrap_or_else(|e| {
275 tracing::warn!(project_id = %db_project.id, error = %e, "gallery image lookup failed; rendering without carousel");
276 Vec::default()
277 })
278 .into_iter()
279 .map(|g| crate::templates::CarouselFrame {
280 // A creator upload: `gallery_images` records a byte count and never
281 // recorded a size, so there is nothing to reserve with. Filed as
282 // the reason galleries still shift while the landing page does not.
283 intrinsic: None,
284 image: g.image_url,
285 alt: if g.alt.trim().is_empty() {
286 format!("{} gallery image", db_project.title)
287 } else {
288 g.alt
289 },
290 caption: None,
291 })
292 .collect();
293
294 Ok(ProjectTemplate {
295 csrf_token,
296 session_user: maybe_user,
297 project,
298 creator_username: db_user.username.to_string(),
299 items,
300 project_id: db_project.id.to_string(),
301 is_following,
302 follower_count,
303 subscription_tiers,
304 has_subscription,
305 host_url: config.host_url.clone(),
306 git_repos,
307 has_blog_posts,
308 community_url,
309 tips_enabled: db_user.tips_enabled && db_user.stripe_charges_enabled,
310 creator_id: db_user.id.to_string(),
311 tip_project_id: Some(db_project.id.to_string()),
312 is_owner,
313 sections,
314 gallery,
315 theme_css: crate::theming::theme_css(db_project.theme_id.as_deref()),
316 }
317 .into_response())
318 }
319