giles
278ae3e8f6
SxExpr is now a str subclass so it works everywhere a plain string does (join, isinstance, f-strings) while serialize() still emits it unquoted. sx_call() and all internal render functions (_render_to_sx, async_eval_to_sx, etc.) return SxExpr, eliminating the "forgot to wrap" bug class that caused the sx_content leak and list serialization bugs. - Phase 0: SxExpr(str) with .source property, __add__/__radd__ - Phase 1: sx_call returns SxExpr (drop-in, all 200+ sites unchanged) - Phase 2: async_eval_to_sx, async_eval_slot_to_sx, _render_to_sx, mobile_menu_sx return SxExpr; remove isinstance(str) workaround - Phase 3: Remove ~150 redundant SxExpr() wrappings across 45 files - Phase 4: serialize() docstring, handler return docs, ;; returns: sx Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
131 lines
4.5 KiB
Python
131 lines
4.5 KiB
Python
"""Username selection flow.
|
|
|
|
Users must choose a preferred_username before they can publish.
|
|
This creates their ActorProfile with RSA keys.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
|
|
from quart import (
|
|
Blueprint, request, redirect, url_for, g, abort,
|
|
)
|
|
|
|
from shared.services.registry import services
|
|
|
|
|
|
# Username rules: 3-32 chars, lowercase alphanumeric + underscores
|
|
USERNAME_RE = re.compile(r"^[a-z][a-z0-9_]{2,31}$")
|
|
|
|
# Reserved usernames
|
|
RESERVED = frozenset({
|
|
"admin", "administrator", "root", "system", "moderator", "mod",
|
|
"support", "help", "info", "postmaster", "webmaster", "abuse",
|
|
"federation", "activitypub", "api", "static", "media", "assets",
|
|
"well-known", "nodeinfo", "inbox", "outbox", "followers", "following",
|
|
})
|
|
|
|
|
|
async def _render_choose_username(*, actor=None, error="", username=""):
|
|
"""Render choose-username page — replaces sx_components helper."""
|
|
from shared.browser.app.csrf import generate_csrf_token
|
|
from shared.config import config
|
|
from shared.sx.helpers import sx_call
|
|
from shared.sx.page import get_template_context
|
|
from sxc.pages.utils import _social_page
|
|
from markupsafe import escape
|
|
|
|
ctx = await get_template_context()
|
|
csrf = generate_csrf_token()
|
|
ap_domain = config().get("ap_domain", "rose-ash.com")
|
|
check_url = url_for("identity.check_username")
|
|
|
|
error_sx = sx_call("auth-error-banner", error=error) if error else ""
|
|
content = sx_call(
|
|
"federation-choose-username",
|
|
domain=str(escape(ap_domain)),
|
|
error=error_sx or None,
|
|
csrf=csrf, username=str(escape(username)),
|
|
check_url=check_url,
|
|
)
|
|
return await _social_page(ctx, actor, content=content,
|
|
title="Choose Username \u2014 Rose Ash")
|
|
|
|
|
|
def register(url_prefix="/identity"):
|
|
bp = Blueprint("identity", __name__, url_prefix=url_prefix)
|
|
|
|
@bp.get("/choose-username")
|
|
async def choose_username_form():
|
|
if not g.get("user"):
|
|
return redirect(url_for("auth.login_form"))
|
|
|
|
# Already has a username?
|
|
actor = await services.federation.get_actor_by_user_id(g.s, g.user.id)
|
|
if actor:
|
|
return redirect(url_for("activitypub.actor_profile", username=actor.preferred_username))
|
|
|
|
return await _render_choose_username(actor=actor)
|
|
|
|
@bp.post("/choose-username")
|
|
async def choose_username():
|
|
if not g.get("user"):
|
|
abort(401)
|
|
|
|
# Already has a username?
|
|
existing = await services.federation.get_actor_by_user_id(g.s, g.user.id)
|
|
if existing:
|
|
return redirect(url_for("activitypub.actor_profile", username=existing.preferred_username))
|
|
|
|
form = await request.form
|
|
username = (form.get("username") or "").strip().lower()
|
|
|
|
# Validate format
|
|
error = None
|
|
if not USERNAME_RE.match(username):
|
|
error = (
|
|
"Username must be 3-32 characters, start with a letter, "
|
|
"and contain only lowercase letters, numbers, and underscores."
|
|
)
|
|
elif username in RESERVED:
|
|
error = "This username is reserved."
|
|
elif not await services.federation.username_available(g.s, username):
|
|
error = "This username is already taken."
|
|
|
|
if error:
|
|
return await _render_choose_username(error=error, username=username), 400
|
|
|
|
# Create ActorProfile with RSA keys
|
|
display_name = g.user.name or username
|
|
actor = await services.federation.create_actor(
|
|
g.s, g.user.id, username,
|
|
display_name=display_name,
|
|
)
|
|
|
|
# Redirect to where they were going, or their new profile
|
|
next_url = request.args.get("next")
|
|
if next_url:
|
|
return redirect(next_url)
|
|
return redirect(url_for("activitypub.actor_profile", username=actor.preferred_username))
|
|
|
|
@bp.get("/check-username")
|
|
async def check_username():
|
|
"""HTMX endpoint to check username availability."""
|
|
username = (request.args.get("username") or "").strip().lower()
|
|
|
|
if not username:
|
|
return ""
|
|
|
|
if not USERNAME_RE.match(username):
|
|
return '<span class="text-red-600">Invalid format</span>'
|
|
|
|
if username in RESERVED:
|
|
return '<span class="text-red-600">Reserved</span>'
|
|
|
|
available = await services.federation.username_available(g.s, username)
|
|
if available:
|
|
return '<span class="text-green-600">Available</span>'
|
|
return '<span class="text-red-600">Taken</span>'
|
|
|
|
return bp
|