fix(web): handler correctness, dedup helpers, drop dead web types #119

Closed

David wants to merge 1 commit from david/fix/web-handler-correctness-dedup-dead-types into main AGit

David commented

2026-06-12 04:23:47 +02:00

Owner

Fix bunyip-web handler bugs, collapse duplicated helpers to one source, advance the OCI copy-button off the BFF-trust onclick pattern, and delete dead web DTOs/helpers.

Handler correctness: membership_badge now renders a Grace Period warning badge and the membership card has guard includes GracePeriod so grace members see their plan; login_get and register_get relay the refreshed session cookie via redirect_cookies on the already-signed-in bounce instead of dropping it; the settings ?ok=/?error= messages are clamped to ~256 bytes before render; the confirm_email comment promising a cookie-clear that never happened is removed.

OCI copy button: command_block no longer splices API-sourced registry/reference into the inline onclick. The command lives in a Maud-escaped data-copy attribute and a single static COPY_CMD_JS handler reads it from this.dataset.copy at click time, so no API data ships as executable content. Trust model documented on the helper.

Dedup: one urlenc lives in util and replaces the three drifted local copies (dashboard, admin handler, admin API); base_domain wrapper dropped for domain_or_localhost; auth_pages INPUT_CLASS const and its inline copies fold into dashboard_input(); PaginatedResponse keeps a single page_size field; feedback_status_str is replaced by FeedbackStatus::as_str (with an AsRef impl).

Dead code removed: spinner(), simple_page(), downloads_for_app() + AppDownloadsResponse, FeedbackSubmissionResponse, AuthResponse.access_token, hx_redirect(), and the banner-only api_url clone (cfg is now an Arc read directly in the banner). AdminFeedbackDetail is retained: it became live after the issue snapshot (feedback detail view) and removing it would break the build.

#BUNYIP-78

Fix bunyip-web handler bugs, collapse duplicated helpers to one source, advance the OCI copy-button off the BFF-trust onclick pattern, and delete dead web DTOs/helpers. Handler correctness: membership_badge now renders a Grace Period warning badge and the membership card `has` guard includes GracePeriod so grace members see their plan; login_get and register_get relay the refreshed session cookie via redirect_cookies on the already-signed-in bounce instead of dropping it; the settings `?ok=`/`?error=` messages are clamped to ~256 bytes before render; the confirm_email comment promising a cookie-clear that never happened is removed. OCI copy button: command_block no longer splices API-sourced registry/reference into the inline onclick. The command lives in a Maud-escaped data-copy attribute and a single static COPY_CMD_JS handler reads it from this.dataset.copy at click time, so no API data ships as executable content. Trust model documented on the helper. Dedup: one urlenc lives in util and replaces the three drifted local copies (dashboard, admin handler, admin API); base_domain wrapper dropped for domain_or_localhost; auth_pages INPUT_CLASS const and its inline copies fold into dashboard_input(); PaginatedResponse keeps a single page_size field; feedback_status_str is replaced by FeedbackStatus::as_str (with an AsRef<str> impl). Dead code removed: spinner(), simple_page(), downloads_for_app() + AppDownloadsResponse, FeedbackSubmissionResponse, AuthResponse.access_token, hx_redirect(), and the banner-only api_url clone (cfg is now an Arc read directly in the banner). AdminFeedbackDetail is retained: it became live after the issue snapshot (feedback detail view) and removing it would break the build. #BUNYIP-78

David added 1 commit

2026-06-12 04:23:47 +02:00

fix(web): handler correctness, dedup helpers, drop dead web types

Check / fmt / clippy / build / test (pull_request) Successful in 1m6s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

b71ba74a0e

Fix bunyip-web handler bugs, collapse duplicated helpers to one source, advance the OCI copy-button off the BFF-trust onclick pattern, and delete dead web DTOs/helpers.

Handler correctness: membership_badge now renders a Grace Period warning badge and the membership card `has` guard includes GracePeriod so grace members see their plan; login_get and register_get relay the refreshed session cookie via redirect_cookies on the already-signed-in bounce instead of dropping it; the settings `?ok=`/`?error=` messages are clamped to ~256 bytes before render; the confirm_email comment promising a cookie-clear that never happened is removed.

OCI copy button: command_block no longer splices API-sourced registry/reference into the inline onclick. The command lives in a Maud-escaped data-copy attribute and a single static COPY_CMD_JS handler reads it from this.dataset.copy at click time, so no API data ships as executable content. Trust model documented on the helper.

Dedup: one urlenc lives in util and replaces the three drifted local copies (dashboard, admin handler, admin API); base_domain wrapper dropped for domain_or_localhost; auth_pages INPUT_CLASS const and its inline copies fold into dashboard_input(); PaginatedResponse keeps a single page_size field; feedback_status_str is replaced by FeedbackStatus::as_str (with an AsRef<str> impl).

Dead code removed: spinner(), simple_page(), downloads_for_app() + AppDownloadsResponse, FeedbackSubmissionResponse, AuthResponse.access_token, hx_redirect(), and the banner-only api_url clone (cfg is now an Arc read directly in the banner). AdminFeedbackDetail is retained: it became live after the issue snapshot (feedback detail view) and removing it would break the build.

#BUNYIP-78