Open registration to guild members (#27) (#36)

Closes #27.

Guild membership is now the whole gate. `discordCallback` checks membership
(and `DISCORD_REQUIRED_ROLE` when set), then `Store.EnsureReader` creates the
Reader on first sight and returns the same row on every later login. The
refusal returns before `EnsureReader`, so a turned-away sign-in leaves no row
behind. `OWNER_DISCORD_ID` still seeds the owner, but only as the
administrator — it no longer gates login.

The cutover grace path goes with it: `API_TOKEN`, `API_TOKEN_GRACE_UNTIL` and
the legacy branch in `httpmw.ResolveReader` are deleted, so a credential
authenticates exactly one Reader or nothing. `userscript.Handler` drops its
re-derivation too — the resolved path segment is already the credential.

New surfaces: an empty library offers both install links (behind the
tab-specific empty states, so "No favourites yet" still wins), and the owner
alone gets a Readers panel with `POST /readers/{id}/revoke`. The owner's own
row is not revocable — 404, not a self-logout.

Isolation is asserted from both directions for read, modify and delete, and
the shared-series invariant is pinned: two Readers on one series produce one
series row, two independent progresses, one poll per due cycle, and one
Reader's delete leaves the other's bookmark and the poll intact.

Verified: `go test ./...` green; live smoke against a throwaway Postgres —
empty-library state in both colour branches, roster rendering, a real revoke
through the panel (target 401s next request, owner untouched), owner
self-revoke refused 404, per-Reader `/u/<cred>` and bearer auth both 200 with
404 for an unknown credential.

Reviewed-on: #36
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

This commit was merged in pull request #36.

This commit is contained in:

Sulthan Zaki

2026-08-08 20:23:17 +07:00

committed by

sulthan

parent c2b47eb05b

commit 2ef769d421

25 changed files with 850 additions and 367 deletions

									
										CUTOVER.md
									
		+4
		-1
	
												View File
												
				@@ -271,7 +271,10 @@ would catch a correct import behind a broken join:

				```bash

				API=https://bookmark-api.violetcrown.my.id

				TOKEN=$(grep -E '^API_TOKEN=' .env | cut -d= -f2)   # grace-window credential

				# Your own Reader credential: sign in to the web UI and take it from the

				# Userscripts panel's install link, or read the API_TOKEN constant out of an

				# already-installed script. There is no credential in .env to grep.

				TOKEN=<your Reader credential>

				curl -s -H "Authorization: Bearer $TOKEN" $API/bookmarks |

				  python3 -c 'import json,sys; print(len(json.load(sys.stdin)))'   # -> 29

				```