Skip to main content

max / makenotwork

11.6 KB · 316 lines History Blame Raw
1 //! Public project page handler.
2
3 use axum::{
4 extract::{Path, State},
5 response::{IntoResponse, Response},
6 };
7 use sqlx::PgPool;
8 use tower_sessions::Session;
9
10 use crate::{
11 auth::{MaybeUserVerified, SessionUser},
12 config::Config,
13 db::{self, FollowTargetType, ItemId, ItemType, Slug},
14 error::{AppError, Result},
15 helpers::get_csrf_token,
16 pricing,
17 templates::{ProjectPaywallTemplate, ProjectTemplate},
18 types::{Item, Project, ProjectSection, SubscriptionTier},
19 };
20
21 /// Render a public project page with its published items.
22 #[tracing::instrument(skip_all, name = "content::project_page", fields(%slug))]
23 pub(in crate::routes::pages::public) async fn project_page(
24 State(db): State<PgPool>,
25 State(config): State<Config>,
26 State(page_view_tx): State<crate::db::page_views::PageViewTx>,
27 session: Session,
28 headers: axum::http::HeaderMap,
29 MaybeUserVerified(maybe_user): MaybeUserVerified,
30 Path(slug): Path<String>,
31 ) -> Result<Response> {
32 let csrf_token = get_csrf_token(&session).await;
33 let slug = Slug::new(&slug).map_err(|_| AppError::NotFound)?;
34 let db_project = db::projects::get_public_project_by_slug(&db, &slug)
35 .await?
36 .ok_or(AppError::NotFound)?;
37 let response = render_project_page(&db, &config, &db_project, csrf_token, maybe_user).await?;
38 let ua = headers
39 .get(axum::http::header::USER_AGENT)
40 .and_then(|v| v.to_str().ok())
41 .unwrap_or("");
42 if !super::is_bot(ua) {
43 super::track_view(&page_view_tx, "project", *db_project.id);
44 }
45 Ok(response)
46 }
47
48 /// Shared project page renderer, used by both named routes and custom domain fallback.
49 #[tracing::instrument(
50 skip_all,
51 name = "content::render_project_page",
52 fields(project_id = %db_project.id, project_slug = %db_project.slug, viewer_id = ?maybe_user.as_ref().map(|u| u.id))
53 )]
54 pub(crate) async fn render_project_page(
55 db: &PgPool,
56 config: &Config,
57 db_project: &db::DbProject,
58 csrf_token: Option<String>,
59 maybe_user: Option<SessionUser>,
60 ) -> Result<Response> {
61 let db_user = db::users::get_user_by_id(db, db_project.user_id)
62 .await?
63 .ok_or(AppError::NotFound)?;
64
65 // Project-level paywall gate
66 let project_pricing = pricing::for_project(db_project);
67 if !project_pricing.is_free() {
68 let project_ctx = pricing::build_project_access_context(
69 db,
70 maybe_user.as_ref().map(|u| u.id),
71 db_project.id,
72 db_project.user_id,
73 )
74 .await?;
75 if !project_pricing.can_access(&project_ctx) {
76 tracing::warn!(
77 project_id = %db_project.id,
78 project_slug = %db_project.slug,
79 creator_user_id = %db_project.user_id,
80 viewer_user_id = ?maybe_user.as_ref().map(|u| u.id),
81 is_creator = project_ctx.is_creator,
82 has_purchased = project_ctx.has_purchased,
83 has_active_subscription = project_ctx.has_active_subscription(),
84 pricing_kind = ?project_pricing.kind(),
85 "project paywall gate: showing paywall"
86 );
87 let db_tiers =
88 db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
89 let subscription_tiers: Vec<SubscriptionTier> = db_tiers
90 .iter()
91 .map(|t| SubscriptionTier::from_db(t, db_user.settlement_currency))
92 .collect();
93 // Show how much is behind the paywall. A project with a lot in it
94 // sells better than a bare price, and the count is not the thing
95 // being sold: the items themselves stay gated. Reads the
96 // denormalized column, so it matches the discover card exactly and
97 // costs one indexed lookup.
98 let item_count = db::projects::get_active_item_count(db, db_project.id)
99 .await
100 .unwrap_or_else(|e| {
101 tracing::warn!(
102 project_id = %db_project.id,
103 error = %e,
104 "paywall item count lookup failed; rendering without a count"
105 );
106 0
107 });
108 let project = Project::from_db(db_project, item_count.max(0) as u32);
109 return Ok(ProjectPaywallTemplate {
110 csrf_token,
111 session_user: maybe_user,
112 project,
113 creator_username: db_user.username.to_string(),
114 price_display: project_pricing.price_display(db_user.settlement_currency),
115 checkout_type: project_pricing.checkout_type(),
116 subscription_tiers,
117 host_url: config.host_url.clone(),
118 }
119 .into_response());
120 }
121 }
122
123 let db_items = db::items::get_public_items_by_project(db, db_project.id).await?;
124
125 let is_creator = maybe_user
126 .as_ref()
127 .is_some_and(|u| u.id == db_project.user_id);
128
129 // Scope the purchase lookup to the items actually rendered on this page
130 // rather than fetching the viewer's entire purchase history (fuzz 2026-07-06
131 // F6). `purchased_subset` is a single `item_id = ANY($2)` roundtrip.
132 let purchased_item_ids: std::collections::HashSet<ItemId> = if let Some(ref user) = maybe_user {
133 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
134 db::transactions::purchased_subset(db, user.id, &item_ids).await?
135 } else {
136 std::collections::HashSet::new()
137 };
138
139 // Per-item subscription proofs for this user, so each item's AccessContext
140 // gets its own gate witness rather than a bare membership bool.
141 #[allow(
142 clippy::zero_sized_map_values,
143 reason = "SubscriptionGate is a deliberate zero-sized capability witness, not data"
144 )]
145 let subscribed_gates = if let Some(ref user) = maybe_user {
146 db::subscriptions::SubscriptionGate::subscribed_item_gates(db, user.id).await?
147 } else {
148 std::collections::HashMap::new()
149 };
150
151 let has_subscription = if let Some(ref user) = maybe_user {
152 db::subscriptions::has_access(
153 db,
154 user.id,
155 db::subscriptions::SubscriptionScope::Project(db_project.id),
156 )
157 .await?
158 } else {
159 false
160 };
161
162 let project = Project::from_db(db_project, db_items.len() as u32);
163
164 let item_ids: Vec<ItemId> = db_items.iter().map(|i| i.id).collect();
165 let tags_map = db::tags::get_tags_for_items(db, &item_ids).await?;
166
167 // Batch child-counts for all bundles on the page in one query (was one
168 // COUNT per bundle inside the loop below).
169 let bundle_ids: Vec<ItemId> = db_items
170 .iter()
171 .filter(|i| i.item_type == ItemType::Bundle)
172 .map(|i| i.id)
173 .collect();
174 let bundle_counts = if bundle_ids.is_empty() {
175 std::collections::HashMap::new()
176 } else {
177 db::bundles::get_bundle_item_counts(db, &bundle_ids).await?
178 };
179
180 let mut items: Vec<Item> = Vec::with_capacity(db_items.len());
181 for i in &db_items {
182 let item_pricing = pricing::for_item(i);
183 let ctx = pricing::AccessContext {
184 is_creator,
185 has_purchased: purchased_item_ids.contains(&i.id),
186 subscription: subscribed_gates.get(&i.id).copied(),
187 };
188 let can_access = item_pricing.can_access(&ctx);
189 let is_free = item_pricing.is_free();
190 let item_tags = tags_map.get(&i.id).map_or(&[][..], std::vec::Vec::as_slice);
191 let mut item = Item::from_db_list(
192 i,
193 item_tags,
194 is_free,
195 can_access,
196 db_user.settlement_currency,
197 );
198 if i.item_type == ItemType::Bundle {
199 item.bundle_item_count = bundle_counts.get(&i.id).copied().unwrap_or(0);
200 }
201 items.push(item);
202 }
203
204 let follower_count =
205 db::follows::get_follower_count(db, FollowTargetType::Project, db_project.id.into())
206 .await?;
207 let is_following = if let Some(ref viewer) = maybe_user {
208 db::follows::is_following(
209 db,
210 viewer.id,
211 FollowTargetType::Project,
212 db_project.id.into(),
213 )
214 .await?
215 } else {
216 false
217 };
218
219 let db_tiers = db::subscriptions::get_active_tiers_by_project(db, db_project.id).await?;
220 let subscription_tiers: Vec<SubscriptionTier> = db_tiers
221 .iter()
222 .map(|t| SubscriptionTier::from_db(t, db_user.settlement_currency))
223 .collect();
224
225 let git_repos = if config.build.git_repos_path.is_some() {
226 let linked = db::git_repos::get_repos_by_project(db, db_project.id)
227 .await
228 .unwrap_or_else(|e| {
229 tracing::warn!(project_id = %db_project.id, error = %e, "linked git repos lookup failed; omitting repo links");
230 Vec::default()
231 });
232 linked
233 .into_iter()
234 .map(|r| {
235 let url = format!("/git/{}/{}", db_user.username, r.name);
236 (r.name, url)
237 })
238 .collect()
239 } else {
240 Vec::new()
241 };
242
243 let has_blog_posts = db::blog_posts::has_published_posts(db, db_project.id).await?;
244
245 let community_url = if db_project.mt_community_id.is_some() {
246 config
247 .integrations
248 .mt_base_url
249 .as_ref()
250 .map(|base| format!("{}/p/{}", base, db_project.slug))
251 } else {
252 None
253 };
254
255 let is_owner = maybe_user
256 .as_ref()
257 .is_some_and(|u| u.id == db_project.user_id);
258
259 let db_sections = db::project_sections::list_by_project(db, db_project.id).await?;
260 let cdn_base = config.cdn_base_url.as_str();
261 let sections: Vec<ProjectSection> = db_sections
262 .iter()
263 .map(|s| ProjectSection::from_db(s, db_project.user_id, cdn_base))
264 .collect();
265
266 // Ordered gallery → carousel frames (additive to the cover image). Alt is
267 // creator-optional; fall back to a title-based description (CarouselFrame::new
268 // debug-asserts non-empty alt, so build the struct directly).
269 let gallery = db::gallery_images::list_for_project(db, db_project.id)
270 .await
271 .unwrap_or_else(|e| {
272 tracing::warn!(project_id = %db_project.id, error = %e, "gallery image lookup failed; rendering without carousel");
273 Vec::default()
274 })
275 .into_iter()
276 .map(|g| crate::templates::CarouselFrame {
277 // A creator upload: `gallery_images` records a byte count and never
278 // recorded a size, so there is nothing to reserve with. Filed as
279 // the reason galleries still shift while the landing page does not.
280 intrinsic: None,
281 image: g.image_url,
282 alt: if g.alt.trim().is_empty() {
283 format!("{} gallery image", db_project.title)
284 } else {
285 g.alt
286 },
287 caption: None,
288 })
289 .collect();
290
291 Ok(ProjectTemplate {
292 csrf_token,
293 session_user: maybe_user,
294 project,
295 creator_username: db_user.username.to_string(),
296 items,
297 project_id: db_project.id.to_string(),
298 is_following,
299 follower_count,
300 subscription_tiers,
301 has_subscription,
302 host_url: config.host_url.clone(),
303 git_repos,
304 has_blog_posts,
305 community_url,
306 tips_enabled: db_user.tips_enabled && db_user.stripe_charges_enabled,
307 creator_id: db_user.id.to_string(),
308 tip_project_id: Some(db_project.id.to_string()),
309 is_owner,
310 sections,
311 gallery,
312 theme_css: crate::theming::theme_css(db_project.theme_id.as_deref()),
313 }
314 .into_response())
315 }
316