Repository navigation
chore: fail record reads that skip HappyView - #259
Draft
botandbang wants to merge 21 commits into
Draft
botandbang wants to merge 21 commits into
botandbang wants to merge 21 commits into
Conversation
…d of PDSes HappyView now indexes community.lexicon.calendar.event, keeping only events by accounts that manage one of the root's projects, and re-reads managers' events once per record script version. The announce form, the changed-in-another-app marker, and the reads before a save or delete come from HappyView instead of the manager's PDS. The edit form carries the CIDs of the show and event it shows, and a save only lands on those: one that HappyView no longer serves is refused before anything is written, and the event and then the show are written with swapRecord on them, so a change made elsewhere asks the manager to reload. A new show stays one applyWrites, a delete removes the event and then the show, and saves and deletes wait for the event to be served too.
HappyView only learns of records from Jetstream or a per-account backfill, so locallibrary records written before HappyView indexed their collections were missing from it. The new computer.localnetwork.directory.requestIndex procedure, answered with inter-service auth, re-reads the caller's own dj.set, dj.profile and locallibrary.settings at most every ten minutes per account, through a Backfills class the set picker now shares. locallibrary's permission set grants the call. dj/set.lua also keeps a set's createdAt, sources and address as written, so a read before a write sees the record as published.
Publish plans, settings import and the bug report space's version now come from Local Network's directory instead of each account's data server, and writes swap on the CID the directory has. The first plan for an account asks the website to have the directory re-read it. --pds and the legacy plays publish record read are gone, and handles no longer fall back to Bluesky's AppView for resolution.
…bug report space from HappyView HappyView now indexes app.bsky.graph.verification (the root's only), app.bsky.actor.profile (display names of verified accounts and project managers), app.bsky.graph.follow (follows by press kit owners whose kit lets the people they follow in) and app.userinput.space (the configured space only), each behind a record gate, with their lexicons checked in. Verifications, the display-name check, the press kit "following" audience and the bug report's space version read through IndexedRepo instead of PDSes. Verification grants swap on HappyView's CID and wait for it to serve the write. New verifications are limited to project managers, the only accounts besides verified ones whose display names HappyView keeps.
…vents # Conflicts: # apps/web/README.md # apps/web/src/lib/server/forms/project.ts # apps/web/src/routes/projects/[slug]/+page.server.ts
…cords # Conflicts: # apps/web/src/lib/server/services/epk.ts
# Conflicts: # apps/web/src/lib/server/services/projects.ts
…ky-records # Conflicts: # apps/web/README.md # apps/web/src/lib/server/happyview/bundle.test.ts # apps/web/src/lib/server/happyview/refresh.ts # apps/web/src/lib/server/services/sets.test.ts # apps/web/tests/integration/flows.test.ts
…ppyview # Conflicts: # apps/web/README.md # apps/web/src/lib/server/app.ts # apps/web/tests/integration/flows.test.ts
Adds ast-grep's no-direct-pds-read rules for TypeScript, Svelte and Rust, which flag repo and sync reads, Bluesky AppView queries and its host, and RepoClient's own-repo reads, with tests. Tests and tooling are ignored in the rule; the blob fetches, the RepoClient reads and the root's project reads for booking membership carry an ast-grep-ignore with their reason. clippy.toml bans jacquard's typed repo and sync read requests. The READMEs, locallibrary's account docs and CONTRIBUTING say reads go through HappyView and list the exceptions.
…vents # Conflicts: # apps/web/README.md
…ky-records # Conflicts: # apps/web/README.md # apps/web/src/lib/server/app.ts # apps/web/src/lib/server/happyview/indexed.ts # apps/web/src/lib/server/services/epk.test.ts # apps/web/src/lib/server/services/epk.ts
…ppyview # Conflicts: # apps/locallibrary/tests/it/main.rs # apps/web/README.md # apps/web/src/lib/server/services/projects.ts # apps/web/tests/integration/flows.test.ts # crates/locallibrary/src/atmosphere/repo/tests.rs
github-actions
Bot
added
documentation
github-actions
Bot
added
web: server
bnb
approved these changes
Oct 26, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on #258.
What and why
Record reads now go through HappyView everywhere, and this makes CI fail a change that reads a PDS or Bluesky's AppView again.
Added:
tools/ast-grep/rules/no-direct-pds-read.ymlwith a TypeScript/Svelte rule and a Rust rule. They flag repo and sync read NSIDs,app.bsky.*queries, theapi.bsky.apphosts, agent repo and sync reads, andRepoClient's own-repo reads, with rule tests. Tests and tooling are ignored in the rule; the blob fetches,RepoClient's reads and the root's project reads for booking membership (ProjectService.reconcileManagerSpacesandcurrent, which must not trust a lagging index for who belongs to a thread) carry anast-grep-ignorewith their reason. Space, identity, OAuth and session calls aren't matchedclippy.tomlbans jacquard's typed repo and sync read requestsChanged:
sgconfig.ymlruns the TypeScript rule inside Svelte filesHow it was tested
pnpm exec ast-grep testandscan, each rule seen firing on a deliberate violation; clippy failing on a banned typetools/policy.sh,cargo clippy --workspace --all-targets -D warnings, and apps/web lint, check, knip and testsChecklist
apps/locallibrary/CHANGELOG.mdhas a line under Unreleased, if people using it will noticedocs/and--helpstill say what the code does