Anonymous subscriptions to reports and requests #11

Merged

Breadway merged 3 commits from feature/bug-20-subscriptions into main

2026-10-12 09:52:49 +08:00

Breadway commented

2026-10-11 16:55:39 +08:00

Owner

Part of BUG-EP1, implements breadboard issue BUG-20 (anonymous subscriptions). Stacked on the BUG-19 branch.

POST /v1/reports/{receipt}/follow subscribes an install to the cluster behind a report (no account, receipt is the capability, follow token returned). DELETE /v1/follows/{token} unsubscribes. One follow per install per cluster, tokens stored hashed only, merges fold followers into the target, ungrouped reports get 409, banned installs get 403. Admin cluster page shows follower count.

Verified: cargo test (all suites green, 6 new tests in tests/follow.rs), cargo clippy with -D warnings clean, cargo fmt clean.

Closes BUG-20

Part of BUG-EP1, implements breadboard issue BUG-20 (anonymous subscriptions). Stacked on the BUG-19 branch. POST /v1/reports/{receipt}/follow subscribes an install to the cluster behind a report (no account, receipt is the capability, follow token returned). DELETE /v1/follows/{token} unsubscribes. One follow per install per cluster, tokens stored hashed only, merges fold followers into the target, ungrouped reports get 409, banned installs get 403. Admin cluster page shows follower count. Verified: cargo test (all suites green, 6 new tests in tests/follow.rs), cargo clippy with -D warnings clean, cargo fmt clean. Closes BUG-20

Breadway added 1 commit

2026-10-11 16:55:39 +08:00

feat: anonymous subscriptions to reports and requests

check / check (push) Successful in 1m3s

Details

4157963532

Follow the cluster behind any grouped report with POST
/v1/reports/{receipt}/follow (install header required, ban checked,
network rate limited) and stop with DELETE /v1/follows/{token}.
Follows are one per install per cluster, tokens stored hashed, and
merge folds followers into the target. Ungrouped reports get 409 so
clients can retry after triage. The admin cluster page shows the
follower count.

Breadway added 1 commit

2026-10-11 21:50:36 +08:00

fix: reporter follow auth, recoverable follow token, merge aliases

check / check (push) Successful in 1m1s

Details

6b35801a28

Address review on the anonymous subscriptions slice:
- follow has two authorized flows: the reporter proves themselves with the
  report's deletion token in the Authorization header (no install id
  needed), and any other subscriber proves themselves with their install id
  (the separate non-reporter flow). A wrong token with no install is 403
- a retry now rotates the caller's follow token and returns a usable one,
  so a lost first response is recoverable under install-scoped idempotency;
  no other install's token is ever revealed
- merging clusters keeps every capability token as an alias on the target
  (the unique-per-install index is dropped, idempotency is enforced by
  rotating), and the follower count counts distinct installs
- tests: reporter auth, wrong-token fallback, lost-response recovery,
  merge aliases with each token unsubscribing, distinct-install counting

Breadway added 1 commit

2026-10-11 22:07:30 +08:00

Merge remote-tracking branch 'origin/feature/bug-19-request-intake' into feature/bug-20-subscriptions

check / check (push) Successful in 1m24s

Details

9b6553d6a2

Breadway added 1 commit

2026-10-11 23:28:37 +08:00

Merge remote-tracking branch 'origin/feature/bug-19-request-intake' into feature/bug-20-subscriptions

check / check (push) Successful in 1m33s

Details

b2859bbc1f