Fix AP blueprint cross-DB queries + harden Ghost sync init

AP blueprints (activitypub.py, ap_social.py) were querying federation tables (ap_actor_profiles etc.) on g.s which points to the app's own DB after the per-app split. Now uses g._ap_s backed by get_federation_session() for non-federation apps. Also hardens Ghost sync before_app_serving to catch/rollback on failure instead of crashing the Hypercorn worker. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 14:06:42 +00:00
parent 97d2021a00
commit 094b6c55cd
10 changed files with 1855 additions and 37 deletions
--- a/.claude/plans/flickering-gathering-wilkes.md
+++ b/.claude/plans/flickering-gathering-wilkes.md
@@ -0,0 +1,236 @@
+# Ticket Purchase Through Cart
+
+## Context
+
+Tickets (Ticket model) are currently created with state="reserved" immediately when a user clicks "Buy" (`POST /tickets/buy/`). They bypass the cart and checkout entirely — no cart display, no SumUp payment, no order linkage. The user wants tickets to flow through the cart exactly like products and calendar bookings: appear in the cart, go through checkout, get confirmed on payment. Login required. No reservation — if the event sells out before payment completes, the user gets refunded (admin handles refund; we show a notice).
+
+## Current Flow vs Desired Flow
+
+**Now:** Click Buy → Ticket created (state="reserved") → done (no cart, no payment)
+
+**Desired:** Click Buy → Ticket created (state="pending", in cart) → Checkout → SumUp payment → Ticket confirmed
+
+## Approach
+
+Mirror the CalendarEntry pattern: CalendarEntry uses state="pending" to mean "in cart". We add state="pending" for Ticket. Pending tickets don't count toward availability (not allocated). At checkout, pending→reserved + linked to order. On payment, reserved→confirmed.
+
+---
+
+## Step 1: Update TicketDTO
+
+**File:** `shared/contracts/dtos.py`
+
+Add fields needed for cart display and page-grouping:
+- `entry_id: int` (for linking back)
+- `cost: Decimal` (ticket price — from ticket_type.cost or entry.ticket_price)
+- `calendar_container_id: int | None` (for page-grouping in cart)
+- `calendar_container_type: str | None`
+
+Also add `ticket_count` and `ticket_total` to `CartSummaryDTO`.
+
+## Step 2: Add ticket methods to CalendarService protocol
+
+**File:** `shared/contracts/protocols.py`
+
+```python
+async def pending_tickets(
+    self, session: AsyncSession, *, user_id: int,
+) -> list[TicketDTO]: ...
+
+async def claim_tickets_for_order(
+    self, session: AsyncSession, order_id: int, user_id: int,
+    page_post_id: int | None = None,
+) -> None: ...
+
+async def confirm_tickets_for_order(
+    self, session: AsyncSession, order_id: int,
+) -> None: ...
+```
+
+## Step 3: Implement in SqlCalendarService
+
+**File:** `shared/services/calendar_impl.py`
+
+- **`pending_tickets`**: Query `Ticket` where `user_id` matches, `state="pending"`, eager-load entry→calendar + ticket_type. Map to TicketDTO with cost from `ticket_type.cost` or `entry.ticket_price`.
+- **`claim_tickets_for_order`**: UPDATE Ticket SET state="reserved", order_id=? WHERE user_id=? AND state="pending". If `page_post_id`, filter via entry→calendar→container.
+- **`confirm_tickets_for_order`**: UPDATE Ticket SET state="confirmed" WHERE order_id=? AND state="reserved".
+
+Update `_ticket_to_dto` to populate the new fields (entry_id, cost, calendar_container_id/type).
+
+## Step 4: Add stubs
+
+**File:** `shared/services/stubs.py`
+
+Add no-op stubs returning `[]`/`None` for the 3 new methods.
+
+## Step 5: Update SqlCartService
+
+**File:** `shared/services/cart_impl.py`
+
+In `cart_summary()`, also query pending tickets via `services.calendar.pending_tickets()` and include `ticket_count` + `ticket_total` in the returned `CartSummaryDTO`.
+
+## Step 6: Update cart internal API
+
+**File:** `cart/bp/cart/api.py`
+
+Add `ticket_count` and `ticket_total` to the JSON summary response. Query via `services.calendar.pending_tickets()`.
+
+## Step 7: Add ticket cart service functions
+
+**File:** `cart/bp/cart/services/calendar_cart.py`
+
+Add:
+```python
+async def get_ticket_cart_entries(session):
+    ident = current_cart_identity()
+    if ident["user_id"] is None:
+        return []
+    return await services.calendar.pending_tickets(session, user_id=ident["user_id"])
+
+def ticket_total(tickets) -> float:
+    return sum((t.cost or 0) for t in tickets if t.cost is not None)
+```
+
+**File:** `cart/bp/cart/services/__init__.py` — export the new functions.
+
+## Step 8: Update cart page grouping
+
+**File:** `cart/bp/cart/services/page_cart.py`
+
+In `get_cart_grouped_by_page()`:
+- Fetch ticket cart entries via `get_ticket_cart_entries()`
+- Attach tickets to page groups by `calendar_container_id` (same pattern as calendar entries)
+- Add `ticket_count` and `ticket_total` to each group dict
+
+## Step 9: Modify ticket buy route
+
+**File:** `events/bp/tickets/routes.py` — `buy_tickets()`
+
+- **Require login**: If `ident["user_id"]` is None, return error prompting sign-in
+- **Create with state="pending"** instead of "reserved"
+- **Remove availability check** at buy time (pending tickets not allocated)
+- Update response template to say "added to cart" instead of "reserved"
+
+## Step 10: Update availability count
+
+**File:** `events/bp/tickets/services/tickets.py` — `get_available_ticket_count()`
+
+Change from counting `state != "cancelled"` to counting `state.in_(("reserved", "confirmed", "checked_in"))`. This excludes "pending" (in-cart) tickets from sold count.
+
+## Step 11: Update buy form template
+
+**File:** `events/templates/_types/tickets/_buy_form.html`
+
+- If user not logged in, show "Sign in to buy tickets" link instead of buy form
+- Keep existing form for logged-in users
+
+**File:** `events/templates/_types/tickets/_buy_result.html`
+
+- Change "reserved" messaging to "added to cart"
+- Add link to cart app
+- Add sold-out refund notice: "If the event sells out before payment, you will be refunded."
+
+## Step 12: Update cart display templates
+
+**File:** `shared/browser/templates/_types/cart/_cart.html`
+
+In `show_cart()` macro:
+- Add empty check: `{% if not cart and not calendar_cart_entries and not ticket_cart_entries %}`
+- Add tickets section after calendar bookings (same style)
+- Add sold-out notice under tickets section
+
+In `summary()` and `cart_grand_total()` macros:
+- Include ticket_total in the grand total calculation
+
+**File:** `shared/browser/templates/_types/cart/_mini.html`
+
+- Add ticket count to the badge total
+
+## Step 13: Update cart overview template
+
+**File:** `cart/templates/_types/cart/overview/_main_panel.html`
+
+- Add ticket count badge alongside product and calendar count badges
+
+## Step 14: Update checkout flow
+
+**File:** `cart/bp/cart/global_routes.py` — `checkout()`
+
+- Fetch pending tickets: `get_ticket_cart_entries(g.s)`
+- Include ticket total in cart_total calculation
+- Include `not ticket_entries` in empty check
+- Pass tickets to `create_order_from_cart()` (or claim separately after)
+
+**File:** `cart/bp/cart/page_routes.py` — `page_checkout()`
+
+Same changes, scoped to page.
+
+**File:** `cart/bp/cart/services/checkout.py` — `create_order_from_cart()`
+
+- Accept new param `ticket_total: float` (add to order total)
+- After claiming calendar entries, also claim tickets: `services.calendar.claim_tickets_for_order()`
+- Include tickets in `resolve_page_config` page detection
+
+## Step 15: Update payment confirmation
+
+**File:** `cart/bp/cart/services/check_sumup_status.py`
+
+When status == "PAID", also call `services.calendar.confirm_tickets_for_order(session, order.id)` alongside `confirm_entries_for_order`.
+
+## Step 16: Update checkout return page
+
+**File:** `cart/bp/cart/global_routes.py` — `checkout_return()`
+
+- Also fetch tickets for order: `services.calendar.user_tickets()` filtered by order_id (or add a `get_tickets_for_order` method)
+
+**File:** `shared/browser/templates/_types/order/_calendar_items.html`
+
+- Add a tickets section showing ordered/confirmed tickets.
+
+## Step 17: Sync shared files
+
+Copy all changed shared files to blog/, cart/, events/, market/ submodules.
+
+---
+
+## Files Modified (Summary)
+
+### Shared contracts/services:
+- `shared/contracts/dtos.py` — update TicketDTO, CartSummaryDTO
+- `shared/contracts/protocols.py` — add 3 methods to CalendarService
+- `shared/services/calendar_impl.py` — implement 3 new methods, update _ticket_to_dto
+- `shared/services/stubs.py` — add stubs
+- `shared/services/cart_impl.py` — include tickets in cart_summary
+
+### Cart app:
+- `cart/bp/cart/api.py` — add ticket info to summary API
+- `cart/bp/cart/services/calendar_cart.py` — add ticket functions
+- `cart/bp/cart/services/__init__.py` — export new functions
+- `cart/bp/cart/services/page_cart.py` — include tickets in grouped view
+- `cart/bp/cart/global_routes.py` — include tickets in checkout + return
+- `cart/bp/cart/page_routes.py` — include tickets in page checkout
+- `cart/bp/cart/services/checkout.py` — include ticket total in order
+- `cart/bp/cart/services/check_sumup_status.py` — confirm tickets on payment
+
+### Events app:
+- `events/bp/tickets/routes.py` — require login, state="pending"
+- `events/bp/tickets/services/tickets.py` — update availability count
+- `events/templates/_types/tickets/_buy_form.html` — login gate
+- `events/templates/_types/tickets/_buy_result.html` — "added to cart" messaging
+
+### Templates (shared):
+- `shared/browser/templates/_types/cart/_cart.html` — ticket section + totals
+- `shared/browser/templates/_types/cart/_mini.html` — ticket count in badge
+- `cart/templates/_types/cart/overview/_main_panel.html` — ticket badge
+- `shared/browser/templates/_types/order/_calendar_items.html` — ticket section
+
+## Verification
+
+1. Go to an event entry with tickets configured (state="confirmed", ticket_price set)
+2. Click "Buy Tickets" while not logged in → should see "sign in" prompt
+3. Log in, click "Buy Tickets" → ticket created with state="pending"
+4. Navigate to cart → ticket appears alongside any products/bookings
+5. Proceed to checkout → SumUp payment page
+6. Complete payment → ticket state becomes "confirmed"
+7. Check cart mini badge shows ticket count
+8. Verify availability count doesn't include pending tickets
--- a/.claude/plans/glittery-zooming-hummingbird.md
+++ b/.claude/plans/glittery-zooming-hummingbird.md
@@ -0,0 +1,425 @@
+# Phase 6: Full Cross-App Decoupling via Glue Services
+
+## Context
+
+Phases 1-5 are complete. All cross-domain FK constraints have been dropped (except `OrderItem.product_id` and `CartItem.product_id`/`market_place_id`/`user_id`, kept as pragmatic exceptions). Cross-domain **writes** go through glue services.
+
+However, **25+ cross-app model imports** remain — apps still `from blog.models.ghost_content import Post`, `from market.models.market import CartItem`, etc. This means every app needs every other app's code on disk to start, making separate databases or independent deployment impossible.
+
+**Goal:** Eliminate all cross-app model imports. Every app only imports from its own `models/`, from `shared/`, and from `glue/`. Cross-domain access goes through glue services. After this phase, each app could theoretically run against its own database.
+
+---
+
+## Inventory of Cross-App Imports to Eliminate
+
+### Cart app imports (9 files, 4 foreign models):
+| File | Import | Usage |
+|------|--------|-------|
+| `cart/bp/cart/api.py` | `market.models.market.CartItem` | Query cart items |
+| `cart/bp/cart/api.py` | `market.models.market_place.MarketPlace` | Filter by container |
+| `cart/bp/cart/api.py` | `events.models.calendars.CalendarEntry, Calendar` | Query pending entries |
+| `cart/bp/cart/api.py` | `blog.models.ghost_content.Post` | Resolve page slug |
+| `cart/bp/cart/services/checkout.py` | `market.models.market.Product, CartItem` | Find cart items, validate products |
+| `cart/bp/cart/services/checkout.py` | `events.models.calendars.CalendarEntry, Calendar` | Resolve page containers |
+| `cart/bp/cart/services/checkout.py` | `market.models.market_place.MarketPlace` | Get container_id |
+| `cart/bp/cart/services/page_cart.py` | `market.models.market.CartItem` | Query page cart |
+| `cart/bp/cart/services/page_cart.py` | `market.models.market_place.MarketPlace` | Join for container |
+| `cart/bp/cart/services/page_cart.py` | `events.models.calendars.CalendarEntry, Calendar` | Query page entries |
+| `cart/bp/cart/services/page_cart.py` | `blog.models.ghost_content.Post` | Batch-load posts |
+| `cart/bp/cart/services/get_cart.py` | `market.models.market.CartItem` | Query cart items |
+| `cart/bp/cart/services/calendar_cart.py` | `events.models.calendars.CalendarEntry` | Query pending entries |
+| `cart/bp/cart/services/clear_cart_for_order.py` | `market.models.market.CartItem` | Soft-delete items |
+| `cart/bp/cart/services/clear_cart_for_order.py` | `market.models.market_place.MarketPlace` | Filter by page |
+| `cart/bp/orders/routes.py` | `market.models.market.Product` | Join for search |
+| `cart/bp/order/routes.py` | `market.models.market.Product` | Load product details |
+| `cart/app.py` | `blog.models.ghost_content.Post` | Page slug hydration |
+
+### Blog app imports (8 files, 3 foreign models):
+| File | Import | Usage |
+|------|--------|-------|
+| `blog/bp/post/admin/routes.py` | `cart.models.page_config.PageConfig` (3 places) | Load/update page config |
+| `blog/bp/post/admin/routes.py` | `events.models.calendars.Calendar` (3 places) | Query calendars |
+| `blog/bp/post/admin/routes.py` | `market.models.market_place.MarketPlace` (3 places) | Query/create/delete markets |
+| `blog/bp/post/services/markets.py` | `market.models.market_place.MarketPlace` | Create/delete markets |
+| `blog/bp/post/services/markets.py` | `cart.models.page_config.PageConfig` | Check feature flag |
+| `blog/bp/post/services/entry_associations.py` | `events.models.calendars.CalendarEntry, CalendarEntryPost, Calendar` | Post-entry associations |
+| `blog/bp/post/routes.py` | `events.models.calendars.Calendar` | Page context |
+| `blog/bp/post/routes.py` | `market.models.market_place.MarketPlace` | Page context |
+| `blog/bp/blog/ghost_db.py` | `cart.models.page_config.PageConfig` | Query page configs |
+| `blog/bp/blog/ghost/ghost_sync.py` | `cart.models.page_config.PageConfig` | Sync page config |
+| `blog/bp/blog/services/posts_data.py` | `events.models.calendars.CalendarEntry, CalendarEntryPost` | Fetch associated entries |
+
+### Events app imports (5 files, 3 foreign models):
+| File | Import | Usage |
+|------|--------|-------|
+| `events/app.py` | `blog.models.ghost_content.Post` | Page slug hydration |
+| `events/app.py` | `market.models.market_place.MarketPlace` | Context processor |
+| `events/bp/markets/services/markets.py` | `market.models.market_place.MarketPlace` | Create/delete markets |
+| `events/bp/markets/services/markets.py` | `blog.models.ghost_content.Post` | Validate post exists |
+| `events/bp/markets/routes.py` | `market.models.market_place.MarketPlace` | Query/delete markets |
+| `events/bp/calendars/services/calendars.py` | `blog.models.ghost_content.Post` | Validate post exists |
+| `events/bp/calendar_entry/services/post_associations.py` | `blog.models.ghost_content.Post` | Manage post-entry assocs |
+| `events/bp/payments/routes.py` | `cart.models.page_config.PageConfig` | Load/update SumUp config |
+
+### Market app imports (1 file):
+| File | Import | Usage |
+|------|--------|-------|
+| `market/app.py` | `blog.models.ghost_content.Post` | Page slug hydration |
+
+### Glue layer imports (2 files):
+| File | Import | Usage |
+|------|--------|-------|
+| `glue/services/cart_adoption.py` | `market.models.market.CartItem` | Adopt cart items |
+| `glue/services/cart_adoption.py` | `events.models.calendars.CalendarEntry` | Adopt entries |
+| `glue/services/order_lifecycle.py` | `events.models.calendars.CalendarEntry, Calendar` | Claim/confirm entries |
+
+---
+
+## Design Decisions
+
+1. **Glue services return ORM objects** (not dicts) when the model is standalone — PageConfig, MarketPlace, Calendar, CalendarEntry. This avoids template changes and keeps SQLAlchemy lazy-load working.
+
+2. **Glue services for Post return dicts** — other apps only need `{id, slug, title, is_page, feature_image}`. Returning the full ORM object would couple them to the blog schema.
+
+3. **CartItem stays in `market/models/market.py`** — it has FKs to `products.id`, `market_places.id`, and `users.id`, plus relationships to `Product`, `MarketPlace`, and `User`. Moving it to cart/ would just reverse the cross-app import direction. Instead, cart reads CartItem through glue.
+
+4. **OrderItem.product relationship uses string forward-ref** — already works via SQLAlchemy string resolution as long as Product is registered in the mapper. Glue setup handles this.
+
+5. **Glue services are allowed to import from any app's models** — that's the glue layer's job. Apps call glue; glue touches models.
+
+6. **blog/bp/post/services/markets.py and entry_associations.py move to glue** — these are pure cross-domain CRUD (blog writes to MarketPlace, blog reads CalendarEntry). They belong in glue.
+
+---
+
+## Step 1: Glue service for pages (Post access)
+
+New file: `glue/services/pages.py`
+
+Provides dict-based Post access for non-blog apps:
+
+```python
+async def get_page_by_slug(session, slug) -> dict | None:
+    """Return {id, slug, title, is_page, feature_image, ...} or None."""
+
+async def get_page_by_id(session, post_id) -> dict | None:
+    """Return page dict by id."""
+
+async def get_pages_by_ids(session, post_ids) -> dict[int, dict]:
+    """Batch-load pages. Returns {id: page_dict}."""
+
+async def page_exists(session, post_id) -> bool:
+    """Check if post exists (for validation before creating calendars/markets)."""
+
+async def is_page(session, post_id) -> bool:
+    """Check if post exists and is_page=True."""
+
+async def search_posts(session, query, page=1, per_page=10) -> tuple[list[dict], int]:
+    """Search posts by title (for events post_associations)."""
+```
+
+All functions import `from blog.models.ghost_content import Post` internally.
+
+**Files changed:**
+- `market/app.py` — replace `from blog.models.ghost_content import Post` with `from glue.services.pages import get_page_by_slug`
+- `events/app.py` — same
+- `cart/app.py` — same
+- `cart/bp/cart/api.py` — replace Post import with `from glue.services.pages import get_page_by_slug`
+- `cart/bp/cart/services/page_cart.py` — replace Post import with `from glue.services.pages import get_pages_by_ids`
+- `events/bp/calendars/services/calendars.py` — replace `from blog.models.ghost_content import Post` with `from glue.services.pages import page_exists, is_page`
+- `events/bp/markets/services/markets.py` — replace `from blog.models.ghost_content import Post` with `from glue.services.pages import page_exists, is_page`
+
+---
+
+## Step 2: Glue service for page config
+
+New file: `glue/services/page_config.py`
+
+```python
+async def get_page_config(session, post_id) -> PageConfig | None:
+    """Load PageConfig for a page."""
+
+async def get_or_create_page_config(session, post_id) -> PageConfig:
+    """Load or create PageConfig. Emits container.child_attached if created."""
+
+async def get_page_configs_by_ids(session, post_ids) -> dict[int, PageConfig]:
+    """Batch-load PageConfigs by container_id."""
+```
+
+Imports `from cart.models.page_config import PageConfig` internally.
+
+**Files changed:**
+- `blog/bp/post/admin/routes.py` — replace `from cart.models.page_config import PageConfig` with glue service calls
+- `blog/bp/post/services/markets.py` — replace PageConfig import
+- `blog/bp/blog/ghost_db.py` — replace PageConfig import
+- `blog/bp/blog/ghost/ghost_sync.py` — replace PageConfig import
+- `events/bp/payments/routes.py` — replace PageConfig import
+- `cart/bp/cart/services/checkout.py` — replace `from models.page_config import PageConfig` stays (same app)
+
+---
+
+## Step 3: Glue service for calendars (events access from blog)
+
+New file: `glue/services/calendars.py`
+
+```python
+async def get_calendars_for_page(session, post_id) -> list[Calendar]:
+    """Return active calendars for a page."""
+
+async def get_calendar_entries_for_posts(session, post_ids) -> dict[int, list]:
+    """Fetch confirmed CalendarEntries associated with posts (via CalendarEntryPost).
+    Returns {post_id: [entry, ...]}."""
+```
+
+Move and adapt from `blog/bp/post/services/entry_associations.py`:
+
+```python
+async def toggle_entry_association(session, post_id, entry_id) -> tuple[bool, str | None]:
+async def get_post_entry_ids(session, post_id) -> set[int]:
+async def get_associated_entries(session, post_id, page=1, per_page=10) -> dict:
+```
+
+These functions import from `events.models.calendars` internally.
+
+**Files changed:**
+- `blog/bp/post/routes.py` — replace `from events.models.calendars import Calendar` + `from market.models.market_place import MarketPlace` with glue service calls
+- `blog/bp/post/admin/routes.py` — replace Calendar imports with glue service calls
+- `blog/bp/post/services/entry_associations.py` — **delete file**, moved to glue
+- `blog/bp/blog/services/posts_data.py` — replace `from events.models.calendars import CalendarEntry, CalendarEntryPost` with glue service call
+
+---
+
+## Step 4: Glue service for marketplaces
+
+New file: `glue/services/marketplaces.py`
+
+```python
+async def get_marketplaces_for_page(session, post_id) -> list[MarketPlace]:
+    """Return active marketplaces for a page."""
+
+async def create_marketplace(session, post_id, name) -> MarketPlace:
+    """Create marketplace (validates page exists via pages service)."""
+
+async def soft_delete_marketplace(session, post_slug, market_slug) -> bool:
+    """Soft-delete a marketplace."""
+```
+
+Move the logic from `blog/bp/post/services/markets.py` and `events/bp/markets/services/markets.py` (they're nearly identical).
+
+**Files changed:**
+- `blog/bp/post/services/markets.py` — **delete file**, moved to glue
+- `blog/bp/post/admin/routes.py` — replace MarketPlace imports + service calls with glue
+- `blog/bp/post/routes.py` — replace MarketPlace import with glue service
+- `events/bp/markets/services/markets.py` — **delete file**, moved to glue
+- `events/bp/markets/routes.py` — replace MarketPlace import, use glue
+- `events/app.py` — replace MarketPlace import with glue service
+
+---
+
+## Step 5: Glue service for cart items (market model access from cart)
+
+New file: `glue/services/cart_items.py`
+
+```python
+async def get_cart_items(session, user_id=None, session_id=None, *, page_post_id=None) -> list[CartItem]:
+    """Get cart items for identity, optionally scoped to page."""
+
+async def find_or_create_cart_item(session, product_id, user_id, session_id) -> CartItem | None:
+    """Find existing or create new cart item. Returns None if product missing."""
+
+async def clear_cart_for_order(session, order, *, page_post_id=None) -> None:
+    """Soft-delete cart items for order identity."""
+
+async def get_calendar_cart_entries(session, user_id=None, session_id=None, *, page_post_id=None) -> list[CalendarEntry]:
+    """Get pending calendar entries for identity, optionally scoped to page."""
+```
+
+Imports `CartItem`, `Product`, `MarketPlace` from market, `CalendarEntry`, `Calendar` from events internally.
+
+**Files changed:**
+- `cart/bp/cart/services/get_cart.py` — replace CartItem import with glue call
+- `cart/bp/cart/services/calendar_cart.py` — replace CalendarEntry import with glue call
+- `cart/bp/cart/services/clear_cart_for_order.py` — replace CartItem/MarketPlace imports with glue call
+- `cart/bp/cart/services/checkout.py` — replace CartItem/Product/MarketPlace/CalendarEntry/Calendar imports with glue calls
+- `cart/bp/cart/api.py` — replace CartItem/MarketPlace/CalendarEntry/Calendar imports with glue calls
+- `cart/bp/cart/services/page_cart.py` — replace CartItem/MarketPlace/CalendarEntry/Calendar imports with glue calls
+
+---
+
+## Step 6: Glue service for products (market access from cart orders)
+
+New file: `glue/services/products.py`
+
+```python
+async def get_product(session, product_id) -> Product | None:
+    """Get product by ID."""
+```
+
+This is minimal — only needed by `cart/bp/order/routes.py` and `cart/bp/orders/routes.py` for search/display. However, `OrderItem.product` relationship already resolves via string forward-ref. We only need Product for the join-based search in orders listing.
+
+**Files changed:**
+- `cart/bp/orders/routes.py` — replace `from market.models.market import Product` with glue import or use `OrderItem.product` relationship
+- `cart/bp/order/routes.py` — replace `from market.models.market import Product` (already uses OrderItem.product relationship for display)
+
+---
+
+## Step 7: Glue service for post associations (events-side)
+
+Move `events/bp/calendar_entry/services/post_associations.py` into glue:
+
+New additions to `glue/services/pages.py` (or separate file `glue/services/post_associations.py`):
+
+```python
+async def add_post_to_entry(session, entry_id, post_id) -> tuple[bool, str | None]:
+async def remove_post_from_entry(session, entry_id, post_id) -> tuple[bool, str | None]:
+async def get_entry_posts(session, entry_id) -> list[dict]:
+async def search_posts_for_entry(session, query, page=1, per_page=10) -> tuple[list[dict], int]:
+```
+
+**Files changed:**
+- `events/bp/calendar_entry/services/post_associations.py` — **delete file**, moved to glue
+- Update any routes in events that call this service to use glue instead
+
+---
+
+## Step 8: Update glue model registration
+
+`glue/setup.py` needs to ensure all models from all apps are registered in SQLAlchemy's mapper when starting any app. This is because string-based relationship references (like `OrderItem.product → "Product"`) need the target model class registered.
+
+```python
+def register_models():
+    """Import all model modules to register them with SQLAlchemy mapper."""
+    # These are already imported by each app, but ensure completeness:
+    try:
+        import blog.models.ghost_content  # noqa
+    except ImportError:
+        pass
+    try:
+        import market.models.market  # noqa
+        import market.models.market_place  # noqa
+    except ImportError:
+        pass
+    try:
+        import cart.models.order  # noqa
+        import cart.models.page_config  # noqa
+    except ImportError:
+        pass
+    try:
+        import events.models.calendars  # noqa
+    except ImportError:
+        pass
+```
+
+Each app's `app.py` calls `register_models()` at startup. The try/except guards handle Docker where only one app's code is present — but since all apps share `glue/` and the DB, all model files need to be importable.
+
+**Note:** In Docker, each container only has its own app + shared + glue. For glue services that import from other apps' models, those models must be available. This means either:
+- (a) Include all model files in each container (symlinks or copies), or
+- (b) Have glue services that import other apps' models use try/except at import time
+
+Since all apps already share one DB and all model files are available in development, option (a) is cleaner for production. Alternatively, the current Docker setup could be extended to include cross-app model files in each image.
+
+---
+
+## Step 9: Update existing glue services
+
+**`glue/services/cart_adoption.py`** — already imports from market and events (correct — this is glue's job). No change needed.
+
+**`glue/services/order_lifecycle.py`** — already imports from events. No change needed.
+
+---
+
+## Step 10: Clean up dead imports and update app.py files
+
+After all glue services are wired:
+
+- `cart/app.py` — remove `from blog.models.ghost_content import Post`, use `from glue.services.pages import get_page_by_slug`
+- `market/app.py` — remove `from blog.models.ghost_content import Post`, use `from glue.services.pages import get_page_by_slug`
+- `events/app.py` — remove `from blog.models.ghost_content import Post` and `from market.models.market_place import MarketPlace`
+- Remove any now-empty cross-app model directories if they exist
+
+---
+
+## Files Summary
+
+| Repo | File | Change |
+|------|------|--------|
+| **glue** | `services/pages.py` | **NEW** — Post access (slug, id, exists, search) |
+| **glue** | `services/page_config.py` | **NEW** — PageConfig CRUD |
+| **glue** | `services/calendars.py` | **NEW** — Calendar queries + entry associations (from blog) |
+| **glue** | `services/marketplaces.py` | **NEW** — MarketPlace CRUD (from blog+events) |
+| **glue** | `services/cart_items.py` | **NEW** — CartItem/CalendarEntry queries for cart |
+| **glue** | `services/products.py` | **NEW** — Product access for cart orders |
+| **glue** | `services/post_associations.py` | **NEW** — Post-CalendarEntry associations (from events) |
+| **glue** | `setup.py` | Add `register_models()` |
+| **cart** | `app.py` | Replace Post import with glue |
+| **cart** | `bp/cart/api.py` | Replace all 4 cross-app imports with glue |
+| **cart** | `bp/cart/services/checkout.py` | Replace cross-app imports with glue |
+| **cart** | `bp/cart/services/page_cart.py` | Replace all cross-app imports with glue |
+| **cart** | `bp/cart/services/get_cart.py` | Replace CartItem import with glue |
+| **cart** | `bp/cart/services/calendar_cart.py` | Replace CalendarEntry import with glue |
+| **cart** | `bp/cart/services/clear_cart_for_order.py` | Replace CartItem/MarketPlace with glue |
+| **cart** | `bp/orders/routes.py` | Replace Product import with glue |
+| **cart** | `bp/order/routes.py` | Replace Product import with glue |
+| **blog** | `bp/post/admin/routes.py` | Replace PageConfig/Calendar/MarketPlace with glue |
+| **blog** | `bp/post/routes.py` | Replace Calendar/MarketPlace with glue |
+| **blog** | `bp/post/services/entry_associations.py` | **DELETE** — moved to `glue/services/calendars.py` |
+| **blog** | `bp/post/services/markets.py` | **DELETE** — moved to `glue/services/marketplaces.py` |
+| **blog** | `bp/blog/ghost_db.py` | Replace PageConfig import with glue |
+| **blog** | `bp/blog/ghost/ghost_sync.py` | Replace PageConfig import with glue |
+| **blog** | `bp/blog/services/posts_data.py` | Replace CalendarEntry/CalendarEntryPost with glue |
+| **events** | `app.py` | Replace Post + MarketPlace imports with glue |
+| **events** | `bp/markets/services/markets.py` | **DELETE** — moved to `glue/services/marketplaces.py` |
+| **events** | `bp/markets/routes.py` | Replace MarketPlace import, use glue |
+| **events** | `bp/calendars/services/calendars.py` | Replace Post import with glue |
+| **events** | `bp/calendar_entry/services/post_associations.py` | **DELETE** — moved to `glue/services/post_associations.py` |
+| **events** | `bp/payments/routes.py` | Replace PageConfig import with glue |
+| **market** | `app.py` | Replace Post import with glue |
+
+---
+
+## Implementation Order
+
+1. **Step 1** (pages.py) — unlocks Steps 2-4 which depend on page validation
+2. **Step 2** (page_config.py) — independent after Step 1
+3. **Steps 3-4** (calendars.py, marketplaces.py) — can be done in parallel, both use pages.py
+4. **Step 5** (cart_items.py) — depends on steps 1, 3 for calendar queries
+5. **Step 6** (products.py) — independent
+6. **Step 7** (post_associations.py) — independent, uses pages.py
+7. **Steps 8-10** (registration, cleanup) — after all services exist
+
+---
+
+## What's NOT changing
+
+- **CartItem stays in `market/models/market.py`** — moving it creates equal or worse coupling
+- **OrderItem stays in `cart/models/order.py`** with `product_id` FK — pragmatic exception
+- **OrderItem.product_id FK** — kept, denormalized `product_title` makes it non-critical
+- **CartItem.product_id FK** — kept, same DB
+- **CartItem.market_place_id FK** — kept, same DB
+- **CartItem.user_id FK** — kept, shared model
+- **Internal HTTP APIs** (cart/summary, coop/*, events/*) — not changing
+- **`shared/` models** (User, MagicLink, etc.) — shared across all apps by design
+
+---
+
+## Docker Consideration
+
+For glue services to work in Docker (single app per container), model files from other apps must be importable. Options:
+1. **Copy model files** into each Docker image during build (just the `models/` dirs)
+2. **Use try/except** in glue services at import time (degrade gracefully)
+3. **Mount shared volume** with all model files
+
+Recommend option 2 for now — glue services that can't import a model simply raise ImportError at call time, which only happens if the service is called from the wrong app (shouldn't happen in practice).
+
+---
+
+## Verification
+
+1. `grep -r "from blog\.models" cart/ market/ events/ glue/` — should return zero results (only in blog/ itself)
+2. `grep -r "from market\.models" blog/ cart/ events/` — should return zero results (only in market/ and glue/)
+3. `grep -r "from cart\.models" blog/ market/ events/` — should return zero results (only in cart/ and glue/)
+4. `grep -r "from events\.models" blog/ cart/ market/` — should return zero results (only in events/ and glue/)
+5. All 4 apps start without import errors
+6. Checkout flow works end-to-end
+7. Blog admin: can toggle features, create/delete markets, manage calendar entries
+8. Events admin: can create calendars, manage markets, configure payments
+9. Market app: markets listing page loads correctly
--- a/.claude/plans/rippling-tumbling-cocke.md
+++ b/.claude/plans/rippling-tumbling-cocke.md
@@ -0,0 +1,149 @@
+# Ticket UX Improvements: +/- Buttons, Sold Count, Cart Grouping
+
+## Context
+The entry page currently uses a numeric input + "Buy Tickets" button, which replaces itself with a confirmation after purchase. The cart lists each ticket individually. The user wants the ticket UX to match the product pattern: +/- buttons, "in basket" count, tickets grouped by event on cart.
+
+## Requirements
+1. **Entry page**: Show tickets sold count + current user's "in basket" count
+2. **Entry page**: Replace qty input with "Add to basket" / +/- buttons (product pattern)
+3. **Entry page**: Keep form active after adding (don't replace with confirmation)
+4. **Cart page**: Group tickets by event (entry_id + ticket_type), show quantity with +/- buttons
+
+---
+
+## 1. Add `ticket_type_id` to TicketDTO
+
+**File**: `shared/contracts/dtos.py`
+- Add `ticket_type_id: int | None = None` field to `TicketDTO`
+
+**File**: `shared/services/calendar_impl.py`
+- In `_ticket_to_dto()`, populate `ticket_type_id=ticket.ticket_type_id`
+
+**Sync**: Copy to all 4 app submodule copies.
+
+## 2. New ticket service functions
+
+**File**: `events/bp/tickets/services/tickets.py`
+- Add `get_user_reserved_count(session, entry_id, user_id, session_id, ticket_type_id=None) -> int`
+  - Counts reserved tickets for this user+entry+type
+- Add `get_sold_ticket_count(session, entry_id) -> int`
+  - Counts all non-cancelled tickets for this entry
+- Add `cancel_latest_reserved_ticket(session, entry_id, user_id, session_id, ticket_type_id=None) -> bool`
+  - Finds the most recently created reserved ticket for this user+entry+type, sets state='cancelled'. Returns True if one was cancelled.
+
+## 3. Add `adjust_quantity` route to events tickets blueprint
+
+**File**: `events/bp/tickets/routes.py`
+- New route: `POST /tickets/adjust/`
+- Form fields: `entry_id`, `ticket_type_id` (optional), `count` (target quantity)
+- Logic:
+  - Get current user reserved count for this entry/type
+  - If count > current: create `(count - current)` tickets via `create_ticket()`
+  - If count < current: cancel `(current - count)` tickets via `cancel_latest_reserved_ticket()` in a loop
+  - If count == 0: cancel all
+  - Check availability before adding (like existing `buy_tickets`)
+- Response: re-render `_buy_form.html` (HTMX swap replaces form, keeps it active)
+- Include OOB cart-mini update: `{{ mini(oob='true') }}`
+
+## 4. Inject ticket counts into entry page context
+
+**File**: `events/bp/calendar_entry/routes.py` — `inject_root` context processor
+- Add `ticket_sold_count`: total non-cancelled tickets for entry (via `get_sold_ticket_count`)
+- Add `user_ticket_count`: current user's reserved count (via `get_user_reserved_count`)
+- For multi-type entries, add `user_ticket_counts_by_type`: dict mapping ticket_type_id → count
+
+## 5. Rewrite entry page buy form
+
+**File**: `events/templates/_types/tickets/_buy_form.html`
+- Show "X sold" (from `ticket_sold_count`) alongside "X remaining"
+- Show "X in basket" for current user
+
+**For single-price entries (no ticket types)**:
+- If `user_ticket_count == 0`: show "Add to basket" button (posts to `/tickets/adjust/` with count=1)
+- If `user_ticket_count > 0`: show `[-]` [count badge] `[+]` buttons
+  - Minus: posts count=user_ticket_count-1
+  - Plus: posts count=user_ticket_count+1
+- All forms: `hx-post`, `hx-target="#ticket-buy-{{ entry.id }}"`, `hx-swap="outerHTML"`
+
+**For multi-type entries**:
+- Same pattern per ticket type row, using `user_ticket_counts_by_type[tt.id]`
+
+Style: match product pattern exactly — emerald circular buttons, w-8 h-8, cart icon with badge.
+
+## 6. Add ticket quantity route to cart app
+
+**File**: `cart/bp/cart/global_routes.py`
+- New route: `POST /cart/ticket-quantity/`
+- Form fields: `entry_id`, `ticket_type_id` (optional), `count` (target quantity)
+- Logic: call into CalendarService or directly use ticket functions
+  - Since cart app uses service contracts, add `adjust_ticket_quantity` to CalendarService protocol
+
+**File**: `shared/contracts/protocols.py` — CalendarService
+- Add: `adjust_ticket_quantity(session, entry_id, count, *, user_id, session_id, ticket_type_id=None) -> int`
+
+**File**: `shared/services/calendar_impl.py`
+- Implement `adjust_ticket_quantity`:
+  - Same logic as events adjust route (create/cancel to match target count)
+  - Return new count
+
+**File**: `shared/services/stubs.py`
+- Add stub: returns 0
+
+Response: `HX-Refresh: true` (same as product quantity route).
+
+## 7. Cart page: group tickets by event with +/- buttons
+
+**File**: `cart/templates/_types/cart/_cart.html` — ticket section (lines 63-95)
+- Replace individual ticket list with grouped display
+- Group `ticket_cart_entries` by `(entry_id, ticket_type_id)`:
+  - Use Jinja `groupby` on `entry_id` first, then sub-group by `ticket_type_name`
+  - Or pre-group in the route handler and pass as a dict
+
+**Approach**: Pre-group in the route handler for cleaner templates.
+
+**File**: `cart/bp/cart/page_routes.py` — `page_view`
+- After getting `page_tickets`, group them into a list of dicts:
+  ```
+  [{"entry_name": ..., "entry_id": ..., "ticket_type_name": ..., "ticket_type_id": ...,
+    "entry_start_at": ..., "entry_end_at": ..., "price": ..., "quantity": N}]
+  ```
+- Pass as `ticket_groups` to template
+
+**File**: `cart/bp/cart/global_routes.py` — overview/checkout routes
+- Same grouping for global cart view if tickets appear there
+
+**Cart ticket group template**: Each group shows:
+- Event name + ticket type (if any)
+- Date/time
+- Price per ticket
+- `-` [qty] `+` buttons (posting to `/cart/ticket-quantity/`)
+- Line total (price × qty)
+
+Match product `cart_item` macro style (article card with quantity controls).
+
+## 8. Cart summary update
+
+**File**: `cart/templates/_types/cart/_cart.html` — `summary` macro
+- Update Items count: include ticket quantities in total (currently just product quantities)
+
+## Files to modify (summary)
+- `shared/contracts/dtos.py` — add ticket_type_id to TicketDTO
+- `shared/contracts/protocols.py` — add adjust_ticket_quantity to CalendarService
+- `shared/services/calendar_impl.py` — implement adjust_ticket_quantity, update _ticket_to_dto
+- `shared/services/stubs.py` — add stub
+- `events/bp/tickets/services/tickets.py` — add count/cancel functions
+- `events/bp/tickets/routes.py` — add adjust route
+- `events/bp/calendar_entry/routes.py` — inject sold/user counts
+- `events/templates/_types/tickets/_buy_form.html` — rewrite with +/- pattern
+- `cart/bp/cart/global_routes.py` — add ticket-quantity route
+- `cart/bp/cart/page_routes.py` — group tickets
+- `cart/templates/_types/cart/_cart.html` — grouped ticket display with +/-
+- All 4 app `shared/` submodule copies synced
+
+## Verification
+1. Visit entry page → see "X sold", "X in basket", "Add to basket" button
+2. Click "Add to basket" → form stays, shows `-` [1] `+`, basket count shows "1 in basket"
+3. Click `+` → count increases, sold count increases
+4. Click `-` → count decreases, ticket cancelled
+5. Visit cart page → tickets grouped by event, +/- buttons work
+6. Checkout flow still works (existing tests)
--- a/.claude/plans/unified-inventing-kay.md
+++ b/.claude/plans/unified-inventing-kay.md
@@ -0,0 +1,171 @@
+# Social Network Sharing Integration
+
+## Context
+
+Rose Ash already has ActivityPub for federated social sharing. This plan adds OAuth-based sharing to mainstream social networks — Facebook, Instagram, Threads, Twitter/X, LinkedIn, and Mastodon. Users connect their social accounts via the account dashboard, then manually share content (blog posts, events, products) via a share button on content pages.
+
+All social logic lives in the **account** microservice. Content apps get a share button that opens the account share page.
+
+---
+
+## Phase 1: Data Model + Encryption
+
+### 1a. `shared/models/social_connection.py` (NEW)
+- SQLAlchemy 2.0 model following `oauth_grant.py` pattern
+- Table `social_connections` in db_account
+- Columns: `id`, `user_id` (FK to users.id with CASCADE), `platform` (facebook/instagram/threads/twitter/linkedin/mastodon), `platform_user_id`, `platform_username`, `display_name`, `access_token_enc`, `refresh_token_enc`, `token_expires_at`, `scopes`, `extra_data` (JSONB — mastodon instance URL, facebook page ID, etc.), `created_at`, `updated_at`, `revoked_at`
+- Indexes: `(user_id, platform)`, unique `(platform, platform_user_id)`
+
+### 1b. `shared/models/__init__.py` (MODIFY)
+- Add `from .social_connection import SocialConnection`
+
+### 1c. `shared/infrastructure/social_crypto.py` (NEW)
+- Fernet encrypt/decrypt using `SOCIAL_ENCRYPTION_KEY` env var
+- `encrypt_token(plaintext) -> str`, `decrypt_token(ciphertext) -> str`
+
+### 1d. Alembic migration (NEW)
+- Creates `social_connections` table
+
+### 1e. `docker-compose.yml` (MODIFY)
+- Add to `x-app-env`: `SOCIAL_ENCRYPTION_KEY`, plus per-platform credentials (`SOCIAL_FACEBOOK_APP_ID`, `SOCIAL_FACEBOOK_APP_SECRET`, `SOCIAL_TWITTER_CLIENT_ID`, `SOCIAL_TWITTER_CLIENT_SECRET`, `SOCIAL_LINKEDIN_CLIENT_ID`, `SOCIAL_LINKEDIN_CLIENT_SECRET`)
+
+---
+
+## Phase 2: Platform OAuth Clients
+
+All in `account/services/social_platforms/`:
+
+### 2a. `base.py` (NEW)
+- `OAuthResult` dataclass (platform_user_id, tokens, expiry, extra_data)
+- `ShareResult` dataclass (success, platform_post_id, platform_post_url, error)
+- `SocialPlatform` abstract base class: `get_authorize_url()`, `exchange_code()`, `refresh_access_token()`, `share_link()`, `verify_token()`
+
+### 2b. `meta.py` (NEW) — Facebook + Instagram + Threads
+- **Facebook**: OAuth2 via Graph API, `pages_manage_posts` scope, exchange user token → long-lived → page token, post via `/{page_id}/feed`
+- **Instagram**: Same Meta OAuth, `instagram_basic` + `instagram_content_publish` scopes, business/creator accounts only, container → publish workflow
+- **Threads**: Separate OAuth at threads.net, `threads_basic` + `threads_content_publish` scopes, container → publish
+
+### 2c. `twitter.py` (NEW) — Twitter/X
+- OAuth 2.0 with PKCE, `tweet.write` + `offline.access` scopes
+- Post via `POST https://api.twitter.com/2/tweets`
+
+### 2d. `linkedin.py` (NEW) — LinkedIn
+- OAuth 2.0, `w_member_social` + `openid` scopes
+- Post via LinkedIn Posts API
+
+### 2e. `mastodon.py` (NEW) — Mastodon
+- Dynamic app registration per instance (`POST /api/v1/apps`)
+- OAuth 2.0, `write:statuses` scope
+- Post via `POST /api/v1/statuses`
+- Instance URL stored in `extra_data["instance_url"]`
+
+### 2f. `__init__.py` (NEW) — Platform registry
+- `PLATFORMS` dict, lazy-initialized from env vars
+- Mastodon always available (no pre-configured credentials)
+- `get_platform(name)`, `available_platforms()`
+
+---
+
+## Phase 3: Account Social Blueprint
+
+### 3a. `account/bp/social/__init__.py` (NEW)
+### 3b. `account/bp/social/routes.py` (NEW)
+
+Routes (all require login):
+- `GET /social/` — list connected accounts + available platforms
+- `GET /social/connect/<platform>/` — start OAuth redirect (Mastodon: accept instance URL param)
+- `GET /social/callback/<platform>/` — OAuth callback, exchange code, encrypt & store tokens
+- `POST /social/disconnect/<int:id>/` — soft-delete (set revoked_at)
+- `GET /social/share/` — share page (params: url, title, description, image)
+- `POST /social/share/` — execute share to selected accounts, return results
+
+OAuth state stored in session (nonce + platform + redirect params).
+
+### 3c. `account/bp/__init__.py` (MODIFY)
+- Add `from .social.routes import register as register_social_bp`
+
+### 3d. `account/app.py` (MODIFY)
+- Register social blueprint **before** account blueprint (account has catch-all `/<slug>/`)
+```python
+app.register_blueprint(register_auth_bp())
+app.register_blueprint(register_social_bp())   # <-- NEW, before account
+app.register_blueprint(register_account_bp())
+app.register_blueprint(register_fragments())
+```
+
+### 3e. `account/templates/_types/auth/_nav.html` (MODIFY)
+- Add "social" link between newsletters and `account_nav_html`
+
+---
+
+## Phase 4: Templates
+
+### 4a. `account/templates/_types/auth/_social_panel.html` (NEW)
+- Platform cards with icons (Font Awesome: `fa-facebook`, `fa-instagram`, `fa-threads`, `fa-x-twitter`, `fa-linkedin`, `fa-mastodon`)
+- Connected accounts per platform: display name, username, disconnect button
+- "Connect" button per platform
+- Mastodon: instance URL input before connecting
+
+### 4b. `account/templates/_types/auth/_share_panel.html` (NEW)
+- Content preview card (title, image, URL)
+- Connected accounts as checkboxes grouped by platform
+- Optional message textarea
+- Share button → HTMX POST to `/social/share/`
+
+### 4c. `account/templates/_types/auth/_share_result.html` (NEW)
+- Per-platform success/failure with links to created posts
+
+### 4d. `account/templates/_types/auth/_mastodon_connect.html` (NEW)
+- Instance URL input form
+
+---
+
+## Phase 5: Share Button in Content Apps
+
+### 5a. `account/bp/fragments/routes.py` (MODIFY)
+- Add `share-button` handler: accepts url, title, description, image params
+- Returns a share icon/link pointing to `account.rose-ash.com/social/share/?url=...&title=...`
+
+### 5b. `account/templates/fragments/share_button.html` (NEW)
+- Small button: `<a href="..." target="_blank"><i class="fa-solid fa-share-nodes"></i> Share</a>`
+
+### 5c. Content app integration
+- Blog post detail: fetch `share-button` fragment from account, render in post template
+- Events detail: same pattern
+- Market product detail: same pattern
+- Each passes its own public URL, title, description, image to the fragment
+
+---
+
+## Phase 6: Token Refresh + Share History
+
+### 6a. Token refresh in share flow
+- Before posting, check `token_expires_at`; if expired, call `refresh_access_token()`
+- Update encrypted tokens in DB
+- If refresh fails, mark connection with error and prompt reconnect
+
+### 6b. `shared/models/social_share.py` (NEW, optional)
+- Table `social_shares`: connection_id, shared_url, shared_title, platform_post_id, platform_post_url, status, error_message, created_at
+- Prevents duplicate shares, enables "shared" indicator on content pages
+
+---
+
+## Key Patterns to Follow
+
+| Pattern | Reference File |
+|---------|---------------|
+| ORM model (mapped_column, FK, indexes) | `shared/models/oauth_grant.py` |
+| Blueprint registration + OOB template | `account/bp/account/routes.py` |
+| Fragment handler dict | `account/bp/fragments/routes.py` |
+| Account nav link | `account/templates/_types/auth/_nav.html` |
+| httpx async client | `shared/infrastructure/actions.py` |
+
+## Verification
+
+1. Generate `SOCIAL_ENCRYPTION_KEY`, add to `.env`
+2. Run Alembic migration
+3. Start account app, navigate to `/social/`
+4. Connect a test Mastodon account (easiest — no app review needed)
+5. Navigate to a blog post, click Share, select Mastodon account, verify post appears
+6. Disconnect account, verify soft-delete
+7. Test token refresh by connecting Facebook with short-lived token