Say in the forum list what a caller may do in each forum - #17
Merged
Conversation
A client could not tell a feed-only forum from an ordinary one until it tried to post into it. `news` on bbs.hqtui.com is `memberPosting: 'replies'`, so a new topic there answers 403, and `GET /api/v1/forums` described it exactly as it described `announcements`. A posting client therefore discovered the difference in public, which is what happened to myna's release announcement. The board already knew: `resolvePermissions` resolves `canPost` per viewer and `forum.isLocked` sits beside it, and the write route checks both. So the tree now carries `canPost` and `canReply` for the viewer it was built for, resolved by that same function, and both `/api/v1/forums` and `/api/v1/board` return them along with the forum's own `locked` flag. A category is never postable: it holds forums, not topics. The test asserts the claim against the write route in the same run, posting to a reply-only forum for the 403 and to an ordinary one for the 201. A permission hint that can drift from the thing it describes is worse than no hint. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011XqFUXQkK6npCGxBtgizQg
Merged
ralyodio
added a commit
that referenced
this pull request
Sep 8, 2026
The forum list says what a caller may do in each forum: canPost, canReply and locked, resolved the same way the write routes resolve them (#17). Claude-Session: https://claude.ai/code/session_011XqFUXQkK6npCGxBtgizQg Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A client cannot tell a feed-only forum from an ordinary one until it tries to post into one.
newson bbs.hqtui.com ismemberPosting: 'replies'— the hqtui blog opens the topics and members reply. A new topic there answers 403, andGET /api/v1/forumsdescribed it identically toannouncements. So a posting client discovers the difference in public, which is exactly what happened to a myna release announcement:The board already knew the answer.
resolvePermissionsresolvescanPostper viewer,forum.isLockedsits beside it, and the write route checks both:The change
ForumNodecarriescanPostandcanReplyfor the viewer it was built for, resolved by that same function with the same two conditions./api/v1/forumsand/api/v1/boardboth return them, plus the forum's ownlockedflag. A category is never postable — it holds forums, not topics. The OpenAPI description says what they mean.Nothing changes for the HTML pages and no permission decision moves: this publishes a decision the board was already making.
Verified
pnpm typecheckclean;pnpm test193 pass, 0 fail (1 new).canPost: falsefor both, then posts to the reply-only forum for the 403 and togeneralfor the 201. A permission hint that can drift from what it describes is worse than no hint.Once this is released,
myna login tsbb <board> --forum <slugs>can reject a feed-only forum up front instead of learning from a 403 on the first announcement.🤖 Generated with Claude Code
https://claude.ai/code/session_011XqFUXQkK6npCGxBtgizQg