Initial commit -- did OMO do a good job?

2026-09-01 18:29:46 -04:00
commit 20a6c26f7c
179 changed files with 21704 additions and 0 deletions
@@ -0,0 +1,78 @@
+Evidence — Todo 15: NtfyPublisher + ntfy access snippet
+=======================================================
+
+Files created:
+- crates/news-server/src/notify/mod.rs
+- crates/news-server/src/notify/ntfy.rs
+- deploy/ntfy-access-snippet.md
+
+Files modified:
+- crates/news-server/src/lib.rs (added `pub mod notify;`)
+- crates/news-server/Cargo.toml (reqwest, url, tokio time feature, wiremock dev-dep)
+- Cargo.toml (workspace `url = "2"`)
+
+Verification commands
+---------------------
+
+1) cargo fmt --all --check
+   Output: (no output) → exit 0
+
+2) cargo clippy --workspace --all-targets -- -D warnings
+   Output tail:
+   Checking news-server v0.1.0 (...)
+   Finished `dev` profile [unoptimized + debuginfo] target(s) in 5.34s
+   → exit 0
+
+3) cargo test -p news-server
+   Output tail:
+   running 20 tests
+   test notify::ntfy::tests::normal_lane_sends_priority_three ... ok
+   test notify::ntfy::tests::bypass_lane_sends_priority_five ... ok
+   test notify::ntfy::tests::request_has_required_headers ... ok
+   test notify::ntfy::tests::retries_once_on_server_error_then_err ... ok
+   ...
+   test result: ok. 20 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
+
+Ntfy tests added:
+- notify::ntfy::tests::request_has_required_headers
+- notify::ntfy::tests::bypass_lane_sends_priority_five
+- notify::ntfy::tests::normal_lane_sends_priority_three
+- notify::ntfy::tests::retries_once_on_server_error_then_err
+
+Key implementation notes
+------------------------
+- Header shape mirrors movie_recs_notify: `Title`, `Tags`, `Priority`, `Markdown: yes`, `Content-Type: text/plain; charset=utf-8`, plus ntfy-specific `Click` and `Actions`.
+- Actions format follows ntfy docs short form with `; ` separators:
+  `view, Open article, <link>; http, Interested, <api>/api/feedback, method=POST, body='{"story_cluster_id":"...","kind":"interested"}'; http, Not interested, ...`
+- JSON bodies are wrapped in single quotes so the comma/colon-rich payload does not break ntfy's simple action parser.
+- Auth: `NTFY_TOKEN` → `Authorization: Bearer ...`; `NTFY_USER`+`NTFY_PASS` → reqwest `.basic_auth(...)` (Basic base64); otherwise none.
+- Retry: transport errors and 5xx sleep 500 ms and retry exactly once; 4xx returns `Err` immediately. No unwrap/expect/panic.
+- `feedback_base_url` is read from `NEWS_API_BASE_URL` with default `http://localhost:3000`.
+
+--- deploy/ntfy-access-snippet.md full content ---
+
+# ntfy access provisioning for `news-triage`
+
+The ntfy server is configured with a deny-by-default posture:
+
+```yaml
+# /home/connor/data/ntfy/etc/server.yml
+auth-default-access: "deny-all"
+```
+
+Because of that posture, the `news-bot` user must be created and granted
+read/write access to the `news-triage` topic before `news-server` can publish
+notifications. These are one-time operator actions.
+
+Run from the host that owns the `ntfy` container:
+
+```bash
+# Create the publishing user (interactive password prompt).
+sudo podman exec -it ntfy ntfy user add news-bot
+
+# Grant read/write access to the news-triage topic.
+sudo podman exec ntfy ntfy access news-bot news-triage rw
+```
+
+Store the resulting password in the deployment secret path (`~/.env` for the
+`news-backend` compose block) as `NTFY_USER` and `NTFY_PASS`.