grpc: Move /posts/<id> to backend by ashquarky · Pull Request #127 · PretendoNetwork/juxtaposition

ashquarky · 2025-06-08T08:44:57Z

Part of #112
Need to submit this before it gets unreviewable

Changes:

This PR adds the extra infrastructure needed for miiverse-api to act as datasource (authentication, error handling, type conversions, validation etc.) and then moves the "post by id" endpoint (and only this endpoint) to the new backend. A few calls to the old database exist in the frontend since they rely on the Post being a Mongoose object for further DB calls - these will be ported once those further calls are in the API.

The Endpoint: Just sends the document right out of MongoDB for now.
Validation: On the frontend side, that document gets passed through a Zod schema. The one I've written (Post) is descriptive, not prescriptive, made in consultation with the prod database so all the jank of the current DB schema is preserved. This will be useful to make sure changes we make to miiverse-api don't break the frontend.
Authentication: Either the OAuth token (web), service token (console) or nothing (guest web) are included with requests to the backend as headers. It has middlewares to process these tokens, and also has per-endpoint middlewares to select between guest, user, moderator access. On the frontend side, a "UserTokens" object keeps the current state of things cached and can be blindly passed back into the API, so this doesn't make much mess in the business logic.
Error handling (API): Errors can be thrown deliberately to get specific HTTP codes (Unauthorized, Forbidden etc.), or can just be general JavaScript errors. I know throwing is a different design to what I had refactored into the Nintendo API, but I think this is nicer again. Maybe I'll re-refactor the Nintendo API.
Error handling (frontend): HTTP codes from the backend are thrown and allowed to bubble. The error handlers and rendering are tweaked to work better (instead of sometimes spewing a stacktrace), include the request ID, etc. A special case is included for when the user needs to re-log-in; the frontend is extremely permissive about caching and not re-checking tokens, see also juxtaposition-ui: Check for expired tokens in frontend #114 - I'm expecting this might be a problem in prod

I know this is an absolute boatload of infrastructure for a very minimalist endpoint (and even it's missing some things, like the moderator/removed posts override) but hopefully it will serve as a foundation for us to work on top of.

I have read and agreed to the Code of Conduct.
I have read and complied with the contributing guidelines.
What I'm implementing was an approved issue.
I have tested all of my changes.

If we're putting the method and such in the JSON object, it makes sense to keep the headers at that layer rather than pushing them up to gRPC. This lets the Express router access those headers in the usual way.

Easy mistake

This worked well for miiverse-api. It still just spits the stacktrace into the browser, but hey, at least it doesn't crash the server process

i'm not stupid i'm smart

some callsites to the old database method still exist, since the helpers on Post are used for things the backend doesn't have yet it's annoying to pass the whole Express request so just have a blob object for the things that the user is authenticated with

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js

apps/miiverse-api/src/services/internal/server.ts

apps/juxtaposition-ui/src/backend.ts

apps/juxtaposition-ui/src/models/api/post.ts

apps/juxtaposition-ui/src/services/juxt-web/routes/console/posts.js

apps/miiverse-api/src/services/internal/index.ts

apps/miiverse-api/src/services/internal/middleware/authentication.ts

apps/miiverse-api/src/services/internal/middleware/check-user-account.ts

apps/miiverse-api/src/services/internal/middleware/authentication.ts

apps/miiverse-api/src/services/internal/middleware/check-user-account.ts

apps/miiverse-api/src/services/internal/routes/posts.ts

ashquarky · 2025-06-08T12:17:09Z

Note to self: Need to check Juxt bans on the API too (not just PNID bans)

I went through a copy of the prod db and found lots of optional fields that aren't marked as such, old documents missing fields, etc. Introduces an IPostInput type that accounts for the mongoose schema doing defaults and fixes, while also allowing IPost to reflect the real db type. Groundwork for a proper DTO structure.

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js

ashquarky · 2025-06-11T10:00:29Z

I hate CodeQL actually. I do exactly what it suggests and it goes "nuh"

This provides a layer of abstraction between the actual database implementation and the on-the-wire types which will be useful when the database is changed soon

Mostly naming tweaks for clarity

apps/miiverse-api/src/services/internal/server.ts

apps/miiverse-api/src/services/api/index.ts

apps/miiverse-api/src/services/internal/routes/posts.ts

Some paths use the login template to render errors (?) and this now requires a redirect URL. Provide one.

mrjvs · 2025-06-15T10:45:47Z

lgtm, is this ready for merge?

ashquarky · 2025-06-15T14:45:50Z

I think so. I am a bit worried about token expiry (web frontend requests that go thru this api check the token on every request now) but we can always branch this back off if it becomes a problem

ashquarky · 2025-06-16T09:01:04Z

Token expiry issue PretendoNetwork/account#184

mrjvs · 2025-06-21T14:04:49Z

This is waiting on PretendoNetwork/account#184 to be resolved, can be merged when that's done

ashquarky · 2025-06-27T07:59:58Z

Account server side is good to go, ~~now just need our side (~~which is present in #138~~) and this can land

ashquarky · 2025-06-27T13:18:00Z

This should be ok to go barring any conflict with #138

ashquarky added 16 commits June 7, 2025 19:04

feat(vscode): Add option to rebuild gRPC bindings

9a43270

feat(grpc): Move headers into the JSON object

d6a5d2d

If we're putting the method and such in the JSON object, it makes sense to keep the headers at that layer rather than pushing them up to gRPC. This lets the Express router access those headers in the usual way.

fix(grpc): Log the error object

f2b6938

Easy mistake

feat(grpc): helpers for responding with error codes

a4da331

feat(grpc): Work-in-progress authentication middleware

93e3ad1

chore(internal): Refactor error handling

a4f5153

feat(internal): Implement authentication and tweak error handling more

c695ef2

feat(internal): Check for banned accounts

d9f70e9

feat(internal): WIP posts endpoint (auth not working)

06ab562

fix(ui): Don't crash on promise rejection (please)

2be4de2

This worked well for miiverse-api. It still just spits the stacktrace into the browser, but hey, at least it doesn't crash the server process

fix(internal): enable posts route

fc8204c

i'm not stupid i'm smart

fix(server): Fix incorrect Express error handler

5c91b11

feat(internal): Set up guest access controls per-endpoint

771b649

fix(server): Force re-login if backend rejects user token

126378b

feat(ui): Support redirecting out of the login page

9668d68

ashquarky requested a review from mrjvs June 8, 2025 08:45

github-advanced-security bot found potential problems Jun 8, 2025

View reviewed changes

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js Fixed Show fixed Hide fixed

apps/miiverse-api/src/services/internal/server.ts Fixed Show fixed Hide fixed

mrjvs requested changes Jun 8, 2025

View reviewed changes

apps/miiverse-api/src/services/internal/routes/posts.ts Outdated Show resolved Hide resolved

ashquarky added 2 commits June 10, 2025 14:09

fix(login): Validate redirect path

6d8eced

github-advanced-security bot found potential problems Jun 11, 2025

View reviewed changes

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js Fixed Show fixed Hide fixed

ashquarky added 2 commits June 11, 2025 19:45

fix(login): Validation for the validation gods

83221c9

feat(api): Rate-limiting for the ratelimiting gods

4b8ca00

github-advanced-security bot found potential problems Jun 11, 2025

View reviewed changes

apps/juxtaposition-ui/src/services/juxt-web/routes/web/login.js Dismissed Show dismissed Hide dismissed

ashquarky added 2 commits June 12, 2025 23:14

feat(internal): Introduce dto contract type

299db63

This provides a layer of abstraction between the actual database implementation and the on-the-wire types which will be useful when the database is changed soon

feat(internal): Add explicit nulls for 404s

586e77d

fix(internal): Restructure auth and guard middlewares

77d331c

Mostly naming tweaks for clarity

github-advanced-security bot found potential problems Jun 12, 2025

View reviewed changes

apps/miiverse-api/src/services/internal/server.ts Dismissed Show dismissed Hide dismissed

ashquarky force-pushed the work/grpc branch from 7d06060 to dd1aede Compare June 12, 2025 14:14

Merge branch 'dev' into work/grpc

5716ddd

ashquarky force-pushed the work/grpc branch from dd1aede to 5716ddd Compare June 12, 2025 14:15

ashquarky requested a review from mrjvs June 12, 2025 14:16

mrjvs requested changes Jun 12, 2025

View reviewed changes

apps/miiverse-api/src/services/api/index.ts Outdated Show resolved Hide resolved

fix(api): Tweak ratelimits

eda12fb

ashquarky requested a review from mrjvs June 13, 2025 07:17

mrjvs requested changes Jun 13, 2025

View reviewed changes

apps/miiverse-api/src/services/internal/routes/posts.ts Show resolved Hide resolved

ashquarky added 3 commits June 13, 2025 22:37

feat(internal): Stronger checks on account status + mod mode

e81f230

feat(internal): Show moderators removed posts

1e1f0bf

fix(web): Provide redirect on all paths

dad0b14

Some paths use the login template to render errors (?) and this now requires a redirect URL. Provide one.

ashquarky requested a review from mrjvs June 13, 2025 13:00

mrjvs approved these changes Jun 15, 2025

View reviewed changes

mrjvs merged commit 3e20596 into dev Jun 29, 2025
13 checks passed

mrjvs deleted the work/grpc branch June 29, 2025 15:33

mrjvs mentioned this pull request Jul 2, 2025

Release #143

Merged

ashquarky mentioned this pull request Feb 5, 2026

fix(ui): increase reply post limit #323

Merged

4 tasks

Conversation

ashquarky commented Jun 8, 2025

Changes:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ashquarky commented Jun 8, 2025

Uh oh!

Uh oh!

Uh oh!

ashquarky commented Jun 11, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mrjvs commented Jun 15, 2025

Uh oh!

ashquarky commented Jun 15, 2025

Uh oh!

ashquarky commented Jun 16, 2025

Uh oh!

mrjvs commented Jun 21, 2025

Uh oh!

ashquarky commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ashquarky commented Jun 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ashquarky commented Jun 27, 2025 •

edited

Loading