Guild classes

\n${failed ? '

Incorrect password.

' : \"\"}\n\n`,\n {\n status: failed ? 401 : 200,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n },\n );\n}\n\nfunction pretty(key: string, all: GuildEvent[]): string {\n const ev = all.find((e) => e.courseKey === key);\n // Same strips as courseKeyFor, in the same order, so the label matches the key.\n return ev ? ev.name.replace(COHORT_RE, \"\").replace(SLOT_RE, \"\").trim() : key;\n}\n\n/**\n * Sort key for a display name: \"EDG-Fundamentals\" and \"EDG - Fundamentals\"\n * are the same course, but a hyphen and a space sort apart under plain ASCII\n * comparison. Collapsing every separator to a space and folding case groups\n * siblings regardless of which punctuation the scrape happened to keep — the\n * displayed text itself is never touched.\n */\nexport function sortKey(name: string): string {\n return name.replace(/[-–—]/g, \" \").replace(/\\s+/g, \" \").trim().toLowerCase();\n}\n\n/** Alphabetical by display name, using the normalized key above. */\nexport function compareNames(a: string, b: string): number {\n return sortKey(a).localeCompare(sortKey(b));\n}\n\n/**\n * \"Coming up\" is a schedule, not a list: it has to read chronologically or\n * the soonest class ends up buried under whatever course starts with an\n * early letter. A course with no next occurrence sorts last; two courses\n * landing on the same day tie-break on the normalized name so the order is\n * deterministic instead of tracking scrape order.\n */\nexport function compareUpcoming(\n a: { name: string; nextDay: string | null },\n b: { name: string; nextDay: string | null },\n): number {\n if (a.nextDay !== b.nextDay) {\n if (a.nextDay == null) return 1;\n if (b.nextDay == null) return -1;\n return a.nextDay < b.nextDay ? -1 : 1;\n }\n return compareNames(a.name, b.name);\n}\n\n/**\n * The row's name, linked or not.\n *\n * Exported so the properties that matter can be asserted without rendering a\n * page: a new-tab link carrying rel=\"noopener noreferrer\" — the destination is\n * not ours, so no window.opener handle and no Referer with this page's URL —\n * and a fragment containing no form, because the hide/show button is a sibling\n * of this and must never become a child of the link.\n *\n * `label` arrives already escaped: the caller escapes once and uses it in both\n * branches, so the unlinked case cannot quietly become the unescaped one.\n */\nexport function courseLink(label: string, href: string | null): string {\n if (!href) return label;\n return `${label}`;\n}\n\n/**\n * Exactly what each tooltip says, in one place so the row cannot drift from it.\n * Two states, two sentences: they make different claims and must not be\n * interchangeable. The orange one deliberately says \"may still\", because it\n * also covers the case where the later sessions are simply beyond the\n * widget's horizon and nobody knows.\n */\nconst FULL_ALL_TIP =\n \"Every scheduled session of this class is full — registration is closed and only a waitlist is open.\";\nconst FULL_NEXT_TIP =\n \"The next session is full, but a later one may still have room — check the other dates before joining the waitlist.\";\n\n/**\n * The whole two-state rule, as one pure function so it can be tested without a\n * renderer, a request or a snapshot.\n *\n * red the next session is full, and there is no other way in: either it\n * is the only session scheduled, or every other future session is\n * KNOWN full. This is the strong claim, so it takes positive\n * evidence — a single unknown anywhere later withdraws it.\n * orange the next session is full and something later might not be. That\n * covers a later session known open AND a later session nobody has\n * data for, because the fullness widget only reaches ~3.5 months out\n * and beyond that everything is \"unknown\". Under-claiming here is the\n * cheap mistake; over-claiming \"no way in\" is the expensive one.\n * null the next session is open, or nobody knows what it is. Unchanged\n * from before the second state existed: no icon, no colour, nothing.\n *\n * \"unknown\" is never read as full and never read as open. It only ever has the\n * effect of pulling red down to orange.\n *\n * Takes the id/start pairs it actually needs rather than whole GuildEvents, so\n * a test can state a case in one line. Sorts its own input by `start`, the\n * same rule nextOccurrence() uses, so the row's date and the row's colour\n * cannot end up describing two different sessions.\n */\nexport function courseFullState(\n occurrences: { id: string; start: string }[],\n fullness: Record | undefined,\n): \"red\" | \"orange\" | null {\n const sorted = [...occurrences].sort((a, b) => a.start.localeCompare(b.start));\n const next = sorted[0];\n if (!next) return null;\n if (fullnessOf(fullness, next.id) !== \"full\") return null;\n\n const later = sorted.slice(1).map((e) => fullnessOf(fullness, e.id));\n // Nothing else is scheduled. There is genuinely no other date to take, so\n // this is the \"no way in\" state even though there is no second session to\n // corroborate it — the claim is about the schedule, and the schedule is one\n // full session long.\n if (later.length === 0) return \"red\";\n // every() over a non-empty list, so red always rests on at least one other\n // session positively known to be full.\n return later.every((s) => s === \"full\") ? \"red\" : \"orange\";\n}\n\n/** An ISO instant as a Guild-time \"Sep 5\". Same timezone rule as todayStamp(). */\nfunction guildDate(iso: string): string {\n return new Intl.DateTimeFormat(\"en-US\", {\n timeZone: TZ,\n month: \"short\",\n day: \"numeric\",\n }).format(new Date(iso));\n}\n\nfunction page(\n all: GuildEvent[],\n done: string[],\n origin: string,\n fullness: Record = {},\n firstSeen: Record = {},\n): Response {\n const today = todayStamp();\n const now = Date.now();\n const upcoming = all.filter((e) => e.courseKey && e.start >= today && !e.cancelled);\n\n const keys = [...new Set(upcoming.map((e) => e.courseKey!))];\n\n /** Every upcoming occurrence of a course. One filter, three readers below. */\n const occurrences = (k: string): GuildEvent[] => upcoming.filter((x) => x.courseKey === k);\n\n // The earliest upcoming occurrence of a course, or undefined. Everything\n // per-row is read off this one event so the date shown, the state shown and\n // the row's sort position can never describe three different occurrences.\n const nextOccurrence = (k: string): GuildEvent | undefined =>\n occurrences(k).sort((a, b) => a.start.localeCompare(b.start))[0];\n\n // Link target for the row's name: the Guild's page for the same occurrence\n // the \"next on\" line names. Built from the id rather than read off ev.url,\n // so a snapshot written by an older version, or one whose url field is\n // anything unexpected, can never put a junk string in an href.\n const nextUrl = (k: string): string | null => {\n const ev = nextOccurrence(k);\n if (!ev || !/^\\d+$/.test(String(ev.id))) return null;\n return eventUrl(String(ev.id));\n };\n\n // When this course first turned up in a scrape, across all of its upcoming\n // occurrences. Earliest, so a long-running class that posts a fresh cohort\n // does not read as new — the cohort is new, the course is not.\n const firstSeenAt = (k: string): string | null =>\n earliestFirstSeen(firstSeen, occurrences(k).map((e) => e.id));\n\n // Earliest occurrence's floating-local start, e.g. \"20260909T170000\" or\n // the all-day \"20260801\"; null when nothing for this key is upcoming.\n const nextStart = (k: string): string | null => nextOccurrence(k)?.start ?? null;\n\n // A row is one course, and the colour is now a claim about the course, not\n // only about the occurrence the \"next on\" line names: a full next session\n // with a later cohort that has room is a different situation from a course\n // that is full all the way down, and the two get told apart. All of the\n // branching lives in courseFullState(); this is only the lookup.\n const fullState = (k: string) => courseFullState(occurrences(k), fullness);\n\n // Calendar day only (first 8 chars), so two courses starting at different\n // times on the same day still count as a tie for sorting purposes.\n const nextDay = (k: string): string | null => nextStart(k)?.slice(0, 8) ?? null;\n\n const nextDate = (k: string) => {\n const s = nextStart(k);\n if (!s) return \"\";\n const d = new Date(\n Number(s.slice(0, 4)),\n Number(s.slice(4, 6)) - 1,\n Number(s.slice(6, 8)),\n );\n return d.toLocaleDateString(\"en-US\", { month: \"short\", day: \"numeric\" });\n };\n\n // A POST, not a link: link prefetchers and mail scanners fire GETs, and were\n // silently marking classes taken.\n const button = (k: string, isDone: boolean) =>\n ``;\n\n // `showFullness` is passed explicitly at both call sites and never through\n // `.map(row)`: Array#map hands the callback an index as its second argument,\n // which would arrive here as a truthy flag on every row but the first.\n const row = (k: string, showFullness: boolean) => {\n const isDone = done.includes(k);\n // Three states, three renderings, and the third one is \"render it the way\n // this page rendered every row before the feature existed\" — no icon, no\n // colour, no tooltip. There is nothing to say about an occurrence the\n // widget did not describe, and a guess would be worse than silence.\n //\n // The two that do render differ by glyph as well as by colour: 🛑 is a\n // wide octagon, ⏳ a tall hourglass, so they are separable by shape alone\n // when the red and the orange are not separable at all. The accessible\n // names and the tooltips differ too, so nothing about the distinction is\n // carried by sight only.\n const state = showFullness ? fullState(k) : null;\n const mark = state === \"red\"\n ? `🛑`\n : state === \"orange\"\n ? `⏳`\n : \"\";\n const tip = state === \"red\"\n ? ` title=\"${esc(FULL_ALL_TIP)}\"`\n : state === \"orange\"\n ? ` title=\"${esc(FULL_NEXT_TIP)}\"`\n : \"\";\n const stateClass = state === \"red\" ? \" full-all\" : state === \"orange\" ? \" full-next\" : \"\";\n\n // The link wraps the name text and nothing else. It is inside .name, which\n // is a sibling of the form, so the hide/show button stays outside it.\n // New tab, and rel=\"noopener noreferrer\" because the destination is not\n // ours: no window.opener handle and no Referer carrying this page's URL.\n const named = courseLink(esc(pretty(k, all)), nextUrl(k));\n\n // Two showings of one fact: a pill so the row is scannable, and the date\n // in the line that already carries dates. Both appear only inside the\n // window, so an event baselined at the epoch reaches neither.\n const since = firstSeenAt(k);\n const isNew = isNewSince(since, now);\n const badge = isNew ? `new` : \"\";\n const appeared = isNew ? ` · first seen ${esc(guildDate(since!))}` : \"\";\n\n return `

${mark}${named}${badge}\n next on ${esc(nextDate(k))}${appeared}\n ${button(k, isDone)}

`;\n };\n\n // The schedule: soonest class first. Both sort inputs are computed once per\n // key rather than inside the comparator — pretty() and nextDay() each scan\n // the whole event list, and a comparator runs O(n log n) times. Same\n // comparator, same values, same input order, so the resulting order is\n // unchanged; only the number of scans is.\n const open = keys.filter((k) => !done.includes(k))\n .map((k) => ({ k, name: pretty(k, all), nextDay: nextDay(k) }))\n .sort(compareUpcoming)\n .map((e) => e.k);\n // Lookup lists, not schedules: name order, not date order.\n const hidden = keys.filter((k) => done.includes(k)).sort((a, b) =>\n compareNames(pretty(a, all), pretty(b, all))\n );\n const orphans = done.filter((k) => !keys.includes(k)).sort((a, b) =>\n compareNames(pretty(a, all), pretty(b, all))\n );\n\n return new Response(\n `\n\nGuild classes\n

Guild classes

Hide a class and it drops out of your filtered feed. Everything still shows in the full one.

Subscribe: ${esc(origin)}/new.ics · full: ${\n esc(origin)\n }/all.ics

Coming up

Nothing scheduled.

\n${\n // Fullness is shown only here. A hidden class is one the owner has\n // already taken, so whether it is full tells him nothing, and colour\n // running through a list whose whole visual job is to look muted makes\n // both signals harder to read.\n hidden.length\n ? `

Hidden

${hidden.map((k) => row(k, false)).join(\"\")}`\n : \"\"\n }\n${\n orphans.length\n // Deliberately unlinked. These keys have no upcoming occurrence at\n // all, so the only event id we could point at is one that has already\n // happened — a link to a stale page is worse than no link.\n ? `

Hidden, not currently offered

${esc(pretty(k, all))}\n ${button(k, true)}

`\n : \"\"\n }\n\n`,\n { headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/all.ics\") {\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const seq = await sequences();\n if (!seq.ok) return problem(seq);\n return ics(\n renderIcs(stored.events, {\n calName: \"Guild of Oregon Woodworkers\",\n base: origin,\n sequences: seq.map,\n fullness: await readFullness(),\n }),\n \"guild-all.ics\",\n );\n }\n\n if (url.pathname === \"/new.ics\") {\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const done = await taken();\n if (!done.ok) return problem(done);\n const seq = await sequences();\n if (!seq.ok) return problem(seq);\n return ics(\n renderIcs(filterTaken(stored.events, done.keys, todayStamp()), {\n calName: \"Guild classes (filtered)\",\n base: origin,\n sequences: seq.map,\n fullness: await readFullness(),\n }),\n \"guild-new.ics\",\n );\n }\n\n // POST-only for the same reason the mutations are: a GET-triggered login or\n // logout is something a prefetcher or a mail scanner can fire on its own.\n if (url.pathname === \"/login\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n const supplied = String((await req.formData()).get(\"token\") ?? \"\");\n // THE ONLY COMPARISON AGAINST THE SECRET IN THE PROGRAM. Below this line\n // the token is out of scope: what leaves here is a random session id, and\n // TOKEN is never written to a cookie, a header, the HTML, a URL, a log\n // line, an .ics body or a bound SQL argument.\n if (!TOKEN || supplied !== TOKEN) return loginPage(true);\n let sid: string;\n try {\n sid = await createSession();\n } catch (e) {\n // No cookie on this path. A 303 carrying a session id we failed to store\n // would hand the browser a credential that authenticates nothing, and\n // the owner would see the login page again with no idea why.\n return problem({ status: 503, message: `Could not start a session: ${e}` });\n }\n return new Response(null, {\n status: 303,\n headers: {\n location: \"/\",\n \"set-cookie\": cookie(sid, SESSION_MAX_AGE_S),\n },\n });\n }\n\n if (url.pathname === \"/logout\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n // The row goes first, and if it will not go, neither does the cookie.\n // Clearing the cookie alone — all the old logout did — left the value\n // replayable by anyone who had kept a copy, which is precisely the\n // revocation the old design could not perform. Reporting a logout that did\n // not revoke anything is the one answer worse than an error here.\n try {\n await destroySession(sessionCookie(req));\n } catch (e) {\n return problem({ status: 503, message: `Could not log out: ${e}` });\n }\n return new Response(null, {\n status: 303,\n headers: { location: \"/\", \"set-cookie\": cookie(\"\", 0) },\n });\n }\n\n if (url.pathname === \"/taken\" || url.pathname === \"/untaken\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n const who = await auth(req);\n if (!who.ok) return problem(who);\n if (!who.sid) return new Response(\"Wrong or missing token.\", { status: 403 });\n\n const key = String((await req.formData()).get(\"key\") ?? \"\");\n if (!key) return new Response(\"Missing key.\", { status: 400 });\n\n // One row, no read first. The old code read the whole list, edited it in\n // memory and wrote it all back, so a second request that overlapped the\n // first threw one of the two changes away.\n try {\n if (url.pathname === \"/taken\") await hide(key);\n else await unhide(key);\n } catch (e) {\n // Never redirect as though the click landed: a 303 to \"/\" after a failed\n // write shows the old list back and reads as success.\n return problem({ status: 503, message: `Could not save that change: ${e}` });\n }\n\n // Redirect after POST so a refresh doesn't re-submit.\n return new Response(null, { status: 303, headers: { location: \"/\" } });\n }\n\n if (url.pathname === \"/\") {\n const who = await auth(req);\n // A session store that cannot be read is a 503, not a login page: telling\n // the owner his password is wrong when the database is down would send him\n // to rotate a secret that was never the problem.\n if (!who.ok) return problem(who);\n if (!who.sid) return loginPage(false);\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const done = await taken();\n if (!done.ok) return problem(done);\n // Deliberately not a fourth member of the 503 set above. Events, the\n // taken-list and the sequence map all 503 because serving them wrong is\n // worse than serving nothing — an empty feed reads as \"every event was\n // deleted\", an unreadable taken-list reads as \"you have hidden nothing\".\n // This one has a correct answer for every failure it can have, and that\n // answer is \"unknown\", which the page already knows how to render. Taking\n // the class list down because a decoration is missing would be a\n // regression, so readFullness() swallows and returns an empty map.\n //\n // readFirstSeen() is in the same category and swallows for the same\n // reason. It differs from readFullness() in one respect worth naming: it\n // does reach sqlite, so it can fail the way the taken-list read can — but\n // taken() has already run and already 503'd if the store were unreachable,\n // so what is left here is a failure of that one table, whose right answer\n // is \"nothing is known to be new\". That renders as the page rendered\n // before the badge existed.\n return page(\n stored.events,\n done.keys,\n origin,\n await readFullness(),\n await readFirstSeen(),\n );\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n",[],[219],["D",1788830856989],[],[18],["D",1788654659900],{"_11":12,"_146":71},{"_11":12,"_141":142,"_70":71,"_30":69,"_143":144,"_145":24},{"_41":132,"_13":16,"_35":38,"_133":97,"_134":-5,"_135":-5,"_136":-5,"_137":-5,"_138":-5,"_139":14,"_140":12},"ctx",{"_54":-5,"_165":266,"_267":268,"_269":270,"_271":24,"_272":24,"_273":24,"_274":109,"_275":-5,"_276":-7,"_277":-7,"_278":26,"_279":24,"_280":24,"_281":-5,"_282":24,"_283":24,"_284":24,"_285":-5},"ENV",{"_237":238,"_239":240,"_241":16,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · cron.ts