# Progress ## This attempt (#3, Topcoat) 190 tests. Active milestone in [current.md](current.md). ### Milestone 0 — Skeleton · done Topcoat 0.5 app serving pages, `AppConfig` from `STEID_*` env, SQLite pool in app context. Split into a library plus a thin binary — the domain layer had no consumers yet and read as ~30 dead-code warnings in a bare binary, and it unlocks `tests/`. Topcoat's link-time page discovery works from a library; that was checked, not assumed. **Requires rustc ≥ 1.95.** On older toolchains `cargo add topcoat` silently resolves to an empty `topcoat v0.0.0` placeholder instead of failing. ### Milestone 1 — Identity, thin · done **Domain.** Typed IDs, `Email`, `PasswordHash`, `OrgName`, `Organization`, `User`, `Membership`, `Role`, `Actor`, `Session`, `SetupToken`, `DomainError`. Value objects pair `new()` (validates) with `from_trusted()` (skips, for rows already validated). **Application.** `claim_instance`, `login`, `resolve_actor`, `record_session`, `end_session`, `sweep_expired`. `PasswordHasher` port with Argon2 and a stub. **Infrastructure.** Migrations for orgs, users, memberships, sessions. In-memory and SQLite implementations of every port. Root layout, `/setup`, `/login`, `/logout`, home, and `/api/me`. `describe_identity` is the first use case with two consumers — the home page and `/api/me` both read through it. Until that existed, "the application layer is transport-neutral" was an assertion with one caller behind it. **Verified in a browser and by curl:** wrong token refused with nothing written; correct token creates org + user + owner membership and signs the owner in; session authenticates; logout clears cookie and row; wrong password bounces; right one signs in; re-claiming a claimed instance is refused. #### Decisions worth remembering - **`Actor` is an enum with an explicit `Anonymous`**, not `Option`. Attempt #2 used a placeholder `UserId("ssh-anonymous")` and it became a security hole. A variant can't be forgotten the way a sentinel can. - **`login` verifies a dummy hash when no user matched.** Returning early on the unknown-email path makes it measurably faster and leaks which addresses have accounts. A test pins that the dummy stays parseable — if it stops being, `verify` bails early and the defence dies silently. - **`SetupToken` compares in constant time.** An early-return comparison leaks how much of the token is right, which recovers it a character at a time. - **The setup token is only in app context while unclaimed**, so a claimed instance has nothing for a claim attempt to match. - **SQLite ignores foreign keys unless asked**, per connection. `foreign_keys(true)` plus a test that a user pointing at a missing org is refused. - **`sqlx migrate add` stamps versions to the second** — three calls in one second collide, leaving apply order ambiguous between tables that reference each other. - **An unparseable role surfaces as an error**, never as "no membership". The latter silently downgrades an owner to no access. - **`Secure` session cookies over plain-HTTP localhost fail silently.** See [runbook.md](runbook.md#steid_insecure_cookies--development-only). This one actually bit, and it looked exactly like broken auth logic. ### Milestone 2 — Profile page · done `/{handle}` is the real profile page: label, handle, bio, and the section frame for repositories, writing, and projects. Public, renders signed out, 404s on an unknown handle, and resolves regardless of casing. `/` forwards a signed-in owner to their own profile. `/api/users/{handle}` serves the same read model as JSON. URLs settled as root handles with grouped application routes ([0004](decisions/0004-root-handles-grouped-routes.md)), superseding [0003](decisions/0003-scoped-urls.md) the same day. A twenty-word reserved list in `OrgName::new` keeps handles from shadowing routes. #### Decisions worth remembering - **`PublicProfile` has no email field, deliberately.** `Identity` does, and `/api/me` returns it, because that endpoint describes the caller to themselves. Giving the type that reaches the page nowhere to put an email makes the leak impossible rather than merely avoided. - **`viewer_is_owner` is decided in the use case**, so the web form and `/api` cannot disagree about who may edit. Tested for a signed-in stranger and a non-owner member — "signed in" quietly becoming "allowed" is the usual failure. - **`Organization::update_profile` clears on blank input** rather than storing whitespace, so cleared and never-set are one state and the page renders one case. A rejected edit applies nothing. - **Bio length counts characters, not bytes.** A byte check would reject a bio of accented text well under the limit. - **`path_param` is an attribute macro in 0.5**, not function-like. The vendored crate is the authority for the pinned version, not the docs on `main`. - **Components are invoked bare inside `view!`**, and `if`/`match`/`for`/`let` are native to the macro. - **`#[query_params]` needs `error = …`** to work with `?`; otherwise the error borrows from `cx` and escapes the handler. - **Forms re-render on failure and redirect on success.** Redirecting after a validation error throws away what was typed and hides the reason. - **Styling is Tailwind via Topcoat's build script**, with registry components copied in rather than depended on ([0005](decisions/0005-tailwind-and-copied-components.md)). Components reference theme tokens, never raw colours. ### Milestone 3 — Repo model · done Repositories exist as records and as bare repos on disk, and they appear on the profile. Domain, both persistence adapters, `GitStorage` with `DiskGitStorage` behind it, `create_repo` / `view_repo` / `list_repos`, the `/{handle}/repos/new` form and `/{handle}/repos/{name}` page, the profile's Repositories section, and `/api/users/{handle}/repos`. How git is invoked is recorded in [0006](decisions/0006-git-binary-behind-narrow-ports.md). **Verified in a browser and by curl:** the owner creates a repo through the form, a bare repo appears at `{data_dir}/{handle}/{name}.git`, and it lists on the profile; a private repo is absent for a signed-out visitor on both the page and `/api`; an unknown handle 404s rather than answering `[]`. `git clone` does not work yet — Milestone 4. #### Decisions worth remembering - **`git init` on an existing repository exits 0 and re-initialises in silence.** Measured, not assumed. So `AlreadyExists` has to be our own `path.exists()` check — there is no exit code to key off. Refusing rather than adopting matters because a directory with no matching row is an orphan from a crashed create, and re-initialising it would resurface a private repository's objects under a fresh record. - **`git init` creates missing parent directories itself**, so there is no `create_dir_all` before it. This was in the plan and the probe removed it. - **`--template=` takes a new bare repo from 18 files to 2.** The default seeds sixteen `.sample` hooks. Timed at 15.2ms against 13.1ms across 20 runs — so the ~2ms is not the reason; Steid installs its own hooks later and the samples would be noise to work around. - **`--initial-branch=main` is explicit** so the host's `init.defaultBranch` cannot decide it. This machine's git already says `main`, which is precisely why a drift would go unnoticed — hence the test. - **`GIT_CONFIG_GLOBAL` and `GIT_CONFIG_SYSTEM` are pointed at `/dev/null`**, and the five `GIT_*` variables that redirect object storage are removed from the child environment. `GIT_DIR` was checked and does *not* override an explicit path argument, but `GIT_OBJECT_DIRECTORY` does redirect where objects land, and the failure is silent — the repository just looks empty. - **One `run_git` owns the invocation.** With a single caller this looks premature; it is a private function rather than a public abstraction for that reason. The point is that Milestone 4's `http-backend` spawn cannot quietly disagree about isolation. - **`tokio::process` and `tokio::fs`, never the `std` equivalents.** `init_bare` is not hot — ~13ms, once per repository — but `remove_dir_all` on a repo with real history walks every loose object and would stall a runtime worker. The performance that matters is Milestone 4's per-request spawn, not this. - **`tempfile` for test fixtures, not `target/`.** Parallel-safe by construction and self-cleaning on panic. Debris under `target/` would be actively harmful here, since `init_bare` refuses a path that already exists. - **Membership is resolved once per listing, not once per row.** Obvious in hindsight; the shape that invites the mistake is filtering inside a loop that can `await`. - **One empty state serves "no repositories" and "none you may see".** A distinct message for the second — or any count — leaks that private repositories exist and how many. Tested, because it is the kind of thing a later "helpful" tweak would undo. - **`redirect()` is a 307, and 307 preserves the method.** Post/redirect/get needs a 303, or the browser re-POSTs the form to its redirect target. Milestone 2's settings form shipped with this and nothing caught it — every test passed, because the tests are on the use case and the bug is in the reply. Found by following the redirect with curl. The fix is a `StatusCode::SEE_OTHER` plus a `Location` pair inside `view!`, wrapped as `web::context::location`, because `see_other()` is a response type and `#[page]` must return a view for the layout to wrap the failure re-render. `RedirectError::new` is private, so a 303 cannot be built as an error, and the error-to-response path only downcasts topcoat's own error types — a custom one becomes a 500. - **`#[page]` returns a view; `#[route]` returns a response.** That is the whole reason the redirect is spelled awkwardly: a form handler needs both a redirect and a full-page re-render, and only the view path gets the layout. - **Boolean HTML attributes take an explicit value in `view!`** — `required=(true)`, not bare `required`, which fails to parse. `false` omits the attribute entirely, so `selected=(bool)` on an `