grain.social/grain

Switch repository

Loading…

What changes

The private gallery surface goes from grain-serve and the web. That is social.grain.privateGallery.{createPrivateGallery,addMember,getPrivateGallery,listMembers,listPrivateGalleries,listSharedPrivateGalleries}, their lexicons and social.grain.privateGallery.defs, their handlers (spaces/gallery.rs), the /private/** pages, the private queries in web/src/lib/queries.ts, and the private gallery list and "New private gallery" row in account settings. The settings page still says when an account's PDS serves permissioned spaces.

The pool's photo, item and gallery shapes are the group's own. photoInput, galleryItem (was privateItem) and galleryRecord (was privateGallery) are in social.grain.group.defs now. createGallery, getGallery, poolFeedItem and poolGallery ref them there. The shapes are unchanged, and the harness's pending entry follows photoInput.alt. hatk's types are regenerated from lexicons/, and nothing under server/, app/, test/ or web/ imports the type names that changed.

The space scope no longer asks to make social.grain.privateGallery spaces. That scope is gone from grain::oauth::SPACE_SCOPE and from the scope the client metadata registers (login::REGISTERED). PRIVATE_GALLERY and Admin::members (memberspace/simplespace listMembers, which only private galleries called) are gone from grain::space.

space_invite goes. Migration V12 drops it, an account's purge no longer touches it, and the import no longer copies hatk's _space_invites.

What groups shared with private galleries stays, moved to where groups read it. The session and record helpers (as_account, which was as_author, admin, parse, checked, caller) are in spaces/mod.rs. The gallery writes, space reads and people are in pool.rs. /space-blob names social.grain.group.getGallery as its method. GalleryCard takes pool alone, and a card counts as pooled when it has one.

Why

The owner decided this: private galleries were a test of spaces, and groups are what stays.

How it was checked

• Here, cargo check -p grain -p grain-serve -p grain-import --tests and cargo fmt, run before the defs moved. The runner does everything else.
• The space tests that read a private gallery now read a pool, so the shared machinery stays covered. They check the picture's content type, cache-control and vary, a missing picture and a bad space, a query's cache headers, and logging out. They also cover the whole delegation token path at /space-blob: a token is spent once, one that can't be read, one for another space, one for another caller, a reused credential, and a reader the host does not admit. crates/grain/tests/spaces.rs covers blobs, list_spaces, read_with and delegation in the pool test.
• In write.rs, a pool's createGallery and getGallery answer SpacesUnsupported on a PDS without spaces, as createPrivateGallery did.

Shortcomings

• lexicons/social/grain/privateGallery.json, the space type, stays. Production's hatk server makes spaces of that type (GALLERY_SPACE_TYPE in server/spaces/client.ts), asks for its scope (hatk.config.ts), and test/gallerySpace.test.ts uses it. It goes at cutover with the rest of the hatk side.
• spaces::support::REQUIRED still counts createSpace, putMember/addMember and listMembers as needed for a PDS to serve spaces. A group member's PDS may not need all of them. Narrowing that would change who sees groups, so this pull leaves it alone.
• Web sessions whose granted scope carries the private gallery space scope now read as behind, and their users have to log in again. That includes hatk sessions carried over at cutover from a PDS that serves spaces.

Review

Start with crates/grain-serve/src/spaces/mod.rs and pool.rs for what moved, then tests/spaces.rs for the ported coverage.

🤖 Generated with Claude Code

This removes the private gallery surface (methods, lexicons, handlers, /private/** pages, settings rows, the space scope and space_invite). The helpers groups still use move into spaces/mod.rs and pool.rs.

I could not read the whole 3.6k-line diff, because the tool output was too large for me to page through. What I did check at the head commit:

• Migration: V12 (DROP TABLE space_invite) is registered in MIGRATIONS.
• Rust references: no Rust code still refers to space_invite, apart from the original table definition and the drop. The import doc comment now says _space_invites is not read.
• Web: no /private references remain under web/src.
• Group lexicons: they still ref social.grain.privateGallery.defs#photoInput, #privateItem and #privateGallery, and those defs are kept, as the description says.
• Checks: none are reported yet, so cargo check and the tests have not been confirmed by a runner. Please make sure they pass before merging.

Two things are intended but worth knowing before you merge:

• Web sessions that still carry the private gallery space scope will be forced to log in again, as noted in the description.
• hatk.generated* still lists the deleted methods. That is harmless while nothing under server/ serves them, but it will show up in any later regeneration.

My earlier review asked for nothing beyond confirming the checks pass. At 7940011 the runner still shows all five checks (check, harness, lexicons, rust, test) as queued, so none have run. I found nothing new to block. Please don't merge until they pass, because the description leaves most verification to the runner. The intended side effects are still the same: sessions with the old private gallery scope log in again, and hatk.generated* still names the deleted methods.

Carried forward: the change this pull makes at c9bc2189920984b64b42ae58c66b4e45c83916a2 is the one reviewed at 7940011668c541675c79783c329616ca1f122199, so that review stands. What is new comes from its base.

My earlier reviews asked for nothing beyond confirming the checks pass. At c9b7fb4 all five checks (check, harness, lexicons, rust, test) are still queued, so none have run. This round also moves photoInput, galleryItem and galleryRecord into social.grain.group.defs. I did not re-read that diff in full and found nothing new to block. Please don't merge until the checks pass. The cargo check named in the description ran before the defs moved, and the runner covers the rest. The known side effects are unchanged: sessions with the old private gallery scope have to log in again, and hatk.generated* may still name the deleted methods.