Skip to main content

max / makenotwork

10.3 KB · 287 lines History Blame Raw
1 //! Public project page handler.
2
3 use axum::{
4 extract::{Path, State},
5 response::{IntoResponse, Response},
6 };
7 use sqlx::PgPool;
8 use tower_sessions::Session;
9
10 use crate::{
11 auth::{MaybeUserVerified, SessionUser},
12 config::Config,
13 db::{self, FollowTargetType, ItemId, ItemType, Slug},
14 error::{AppError, Result},
15 helpers::get_csrf_token,
16 pricing,
17 templates::{ProjectPaywallTemplate, ProjectTemplate},
18 types::{Item, Project, ProjectSection, SubscriptionTier},
19 };
20
21 /// Render a public project page with its published items.
22 #[tracing::instrument(skip_all, name = "content::project_page", fields(%slug))]
23 pub(in crate::routes::pages::public) async fn project_page(
24 State(db): State<PgPool>,
25 State(config): State<Config>,
26 State(page_view_tx): State<crate::db::page_views::PageViewTx>,
27 session: Session,
28 headers: axum::http::HeaderMap,
29 MaybeUserVerified(maybe_user): MaybeUserVerified,
30 Path(slug): Path<String>,
31 ) -> Result<Response> {
32 let csrf_token = get_csrf_token(&session).await;
33 let slug = Slug::new(&slug).map_err(|_| AppError::NotFound)?;
34 let db_project = db::projects::get_public_project_by_slug(&db, &slug)
35 .await?
36 .ok_or(AppError::NotFound)?;
37 let response = render_project_page(&db, &config, &db_project, csrf_token, maybe_user).await?;
38 let ua = headers
39 .get(axum::http::header::USER_AGENT)
40 .and_then(|v| v.to_str().ok())
41 .unwrap_or("");
42 if !super::is_bot(ua) {
43 super::track_view(&page_view_tx, "project", *db_project.id);
44 }
45 Ok(response)
46 }
47
48 /// Shared project page renderer, used by both named routes and custom domain fallback.
49 #[tracing::instrument(
50 skip_all,
51 name = "content::render_project_page",
52 fields(project_id = %db_project.id, project_slug = %db_project.slug, viewer_id = ?maybe_user.as_ref().map(|u| u.id))
53 )]
54 pub(crate) async fn render_project_page(
55 db: &PgPool,
56 config: &Config,
57 db_project: &db::DbProject,
58 csrf_token: Option<String>,
59 maybe_user: Option<SessionUser>,
60 ) -> Result<Response> {
61 let db_user = db::users::get_user_by_id(db, db_project.user_id)
62 .await?
63 .ok_or(AppError::NotFound)?;
64
65 // Project-level paywall gate
66 let project_pricing = pricing::for_project(db_project);
67 if !project_pricing.is_free() {
68 let project_ctx = pricing::build_project_access_context(
69 db,
70 maybe_user.as_ref().map(|u| u.id),
71 db_project.id,
72 db_project.user_id,
73 )
74 .await?;
75 if !project_pricing.can_access(&project_ctx) {
76 tracing::warn!(
77 project_id = %db_project.id,
78 project_slug = %db_project.slug,
79 creator_user_id = %db_project.user_id,
80 viewer_user_id = ?maybe_user.as_ref().map(|u| u.id),
81 is_creator = project_ctx.is_creator,
82 has_purchased = project_ctx.has_purchased,
83 has_active_subscription = project_ctx.has_active_subscription(),
84 pricing_kind = ?project_pricing.kind(),
85 "project paywall gate: showing paywall"
86 );
87 let db_tiers =
88 db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
89 let subscription_tiers: Vec<SubscriptionTier> =
90 db_tiers.iter().map(SubscriptionTier::from).collect();
91 let project = Project::from_db(db_project, 0);
92 return Ok(ProjectPaywallTemplate {
93 csrf_token,
94 session_user: maybe_user,
95 project,
96 creator_username: db_user.username.to_string(),
97 price_display: project_pricing.price_display(),
98 checkout_type: project_pricing.checkout_type(),
99 subscription_tiers,
100 host_url: config.host_url.clone(),
101 }
102 .into_response());
103 }
104 }
105
106 let db_items = db::items::get_public_items_by_project(db, db_project.id).await?;
107
108 let is_creator = maybe_user
109 .as_ref()
110 .is_some_and(|u| u.id == db_project.user_id);
111
112 // Scope the purchase lookup to the items actually rendered on this page
113 // rather than fetching the viewer's entire purchase history (fuzz 2026-07-06
114 // F6). `purchased_subset` is a single `item_id = ANY($2)` roundtrip.
115 let purchased_item_ids: std::collections::HashSet<ItemId> = if let Some(ref user) = maybe_user {
116 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
117 db::transactions::purchased_subset(db, user.id, &item_ids).await?
118 } else {
119 std::collections::HashSet::new()
120 };
121
122 // Per-item subscription proofs for this user, so each item's AccessContext
123 // gets its own gate witness rather than a bare membership bool.
124 #[allow(
125 clippy::zero_sized_map_values,
126 reason = "SubscriptionGate is a deliberate zero-sized capability witness, not data"
127 )]
128 let subscribed_gates = if let Some(ref user) = maybe_user {
129 db::subscriptions::SubscriptionGate::subscribed_item_gates(db, user.id).await?
130 } else {
131 std::collections::HashMap::new()
132 };
133
134 let has_subscription = if let Some(ref user) = maybe_user {
135 db::subscriptions::has_access(
136 db,
137 user.id,
138 db::subscriptions::SubscriptionScope::Project(db_project.id),
139 )
140 .await?
141 } else {
142 false
143 };
144
145 let project = Project::from_db(db_project, db_items.len() as u32);
146
147 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
148 let tags_map = db::tags::get_tags_for_items(db, &item_ids).await?;
149
150 // Batch child-counts for all bundles on the page in one query (was one
151 // COUNT per bundle inside the loop below).
152 let bundle_ids: Vec<ItemId> = db_items
153 .iter()
154 .filter(|i| i.item_type == ItemType::Bundle)
155 .map(|i| i.id)
156 .collect();
157 let bundle_counts = if bundle_ids.is_empty() {
158 std::collections::HashMap::new()
159 } else {
160 db::bundles::get_bundle_item_counts(db, &bundle_ids).await?
161 };
162
163 let mut items: Vec<Item> = Vec::with_capacity(db_items.len());
164 for i in &db_items {
165 let item_pricing = pricing::for_item(i);
166 let ctx = pricing::AccessContext {
167 is_creator,
168 has_purchased: purchased_item_ids.contains(&i.id),
169 subscription: subscribed_gates.get(&i.id).copied(),
170 };
171 let can_access = item_pricing.can_access(&ctx);
172 let is_free = item_pricing.is_free();
173 let item_tags = tags_map.get(&i.id).map_or(&[][..], std::vec::Vec::as_slice);
174 let mut item = Item::from_db_list(i, item_tags, is_free, can_access);
175 if i.item_type == ItemType::Bundle {
176 item.bundle_item_count = bundle_counts.get(&i.id).copied().unwrap_or(0);
177 }
178 items.push(item);
179 }
180
181 let follower_count =
182 db::follows::get_follower_count(db, FollowTargetType::Project, db_project.id.into())
183 .await?;
184 let is_following = if let Some(ref viewer) = maybe_user {
185 db::follows::is_following(
186 db,
187 viewer.id,
188 FollowTargetType::Project,
189 db_project.id.into(),
190 )
191 .await?
192 } else {
193 false
194 };
195
196 let db_tiers = db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
197 let subscription_tiers: Vec<SubscriptionTier> =
198 db_tiers.iter().map(SubscriptionTier::from).collect();
199
200 let git_repos = if config.build.git_repos_path.is_some() {
201 let linked = db::git_repos::get_repos_by_project(db, db_project.id)
202 .await
203 .unwrap_or_else(|e| {
204 tracing::warn!(project_id = %db_project.id, error = %e, "linked git repos lookup failed; omitting repo links");
205 Vec::default()
206 });
207 linked
208 .into_iter()
209 .map(|r| {
210 let url = format!("/git/{}/{}", db_user.username, r.name);
211 (r.name, url)
212 })
213 .collect()
214 } else {
215 Vec::new()
216 };
217
218 let has_blog_posts = db::blog_posts::has_published_posts(db, db_project.id).await?;
219
220 let community_url = if db_project.mt_community_id.is_some() {
221 config
222 .integrations
223 .mt_base_url
224 .as_ref()
225 .map(|base| format!("{}/p/{}", base, db_project.slug))
226 } else {
227 None
228 };
229
230 let is_owner = maybe_user
231 .as_ref()
232 .is_some_and(|u| u.id == db_project.user_id);
233
234 let db_sections = db::project_sections::list_by_project(db, db_project.id).await?;
235 let cdn_base = config.cdn_base_url.as_str();
236 let sections: Vec<ProjectSection> = db_sections
237 .iter()
238 .map(|s| ProjectSection::from_db(s, db_project.user_id, cdn_base))
239 .collect();
240
241 // Ordered gallery → carousel frames (additive to the cover image). Alt is
242 // creator-optional; fall back to a title-based description (CarouselFrame::new
243 // debug-asserts non-empty alt, so build the struct directly).
244 let gallery = db::gallery_images::list_for_project(db, db_project.id)
245 .await
246 .unwrap_or_else(|e| {
247 tracing::warn!(project_id = %db_project.id, error = %e, "gallery image lookup failed; rendering without carousel");
248 Vec::default()
249 })
250 .into_iter()
251 .map(|g| crate::templates::CarouselFrame {
252 image: g.image_url,
253 alt: if g.alt.trim().is_empty() {
254 format!("{} gallery image", db_project.title)
255 } else {
256 g.alt
257 },
258 caption: None,
259 })
260 .collect();
261
262 Ok(ProjectTemplate {
263 csrf_token,
264 session_user: maybe_user,
265 project,
266 creator_username: db_user.username.to_string(),
267 items,
268 project_id: db_project.id.to_string(),
269 is_following,
270 follower_count,
271 subscription_tiers,
272 has_subscription,
273 host_url: config.host_url.clone(),
274 git_repos,
275 has_blog_posts,
276 community_url,
277 tips_enabled: db_user.tips_enabled && db_user.stripe_charges_enabled,
278 creator_id: db_user.id.to_string(),
279 tip_project_id: Some(db_project.id.to_string()),
280 is_owner,
281 sections,
282 gallery,
283 theme_css: crate::theming::theme_css(db_project.theme_id.as_deref()),
284 }
285 .into_response())
286 }
287