ticket #26 attempt 1

devplacepy/database/comments.py

@@ -93,6 +93,36 @@ def get_recent_comments_by_target_uids(target_type, target_uids, limit=3, user=N
     raw = _drop_blocked(raw, user)
     if not raw:
         return {}
+
+    # Fetch missing parent comments so the threaded hierarchy is preserved even
+    # when a parent is outside the row-number limit.
+    if "comments" in db.tables:
+        comments_table = db["comments"]
+        current_uids = {c["uid"] for c in raw}
+        seen = set(current_uids)
+        to_fetch = []
+        for c in raw:
+            puid = c.get("parent_uid")
+            if puid and puid not in seen:
+                seen.add(puid)
+                to_fetch.append(puid)
+        if to_fetch:
+            ancestors = []
+            queue = list(to_fetch)
+            fetched = set()
+            while queue:
+                uid = queue.pop(0)
+                if uid in fetched or uid in current_uids:
+                    continue
+                row = comments_table.find_one(uid=uid, deleted_at=None)
+                if row:
+                    ancestors.append(row)
+                    fetched.add(uid)
+                    grandparent = row.get("parent_uid")
+                    if grandparent and grandparent not in fetched and grandparent not in current_uids:
+                        queue.append(grandparent)
+            raw.extend(ancestors)
+
     items = _build_comment_items(raw, user)
     by_target = defaultdict(list)
     for c in raw:

devplacepy/database/schema.py

@@ -1070,7 +1070,6 @@ def init_db():
         ("planted_at", ""),
         ("ready_at", ""),
         ("watered_by", "[]"),
-        ("cooldown_until", ""),
         ("created_at", ""),
         ("updated_at", ""),
     ):
@@ -1078,18 +1077,6 @@ def init_db():
             game_plots.create_column_by_example(column, example)
     _index(db, "game_plots", "idx_game_plots_farm", ["farm_uid", "slot_index"])
 
-    _drop_index(db, "idx_rate_limit_log_user_ts")
-    rate_limit_log = get_table("rate_limit_log")
-    for column, example in (
-        ("uid", ""),
-        ("user_uid", ""),
-        ("action", ""),
-        ("timestamp", ""),
-    ):
-        if not rate_limit_log.has_column(column):
-            rate_limit_log.create_column_by_example(column, example)
-    _index(db, "rate_limit_log", "idx_rate_limit_log_user_ts", ["user_uid", "timestamp"])
-
     _index(db, "posts", "idx_posts_user_created", ["user_uid", "created_at"])
     _index(
         db,

devplacepy/routers/game/farm.py

@@ -1,12 +1,10 @@
 # retoor <retoor@molodetz.nl>
 
-from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
 from fastapi import APIRouter, Form, HTTPException, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
-from devplacepy.database import db, get_table
 from devplacepy.models import GameSlotForm
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameFarmViewOut
@@ -20,33 +18,6 @@ from devplacepy.utils import (
 
 from ._shared import game_seo, notify_farm, owner_by_username
 
-_MAX_ACTIONS_PER_MINUTE = 30
-_RATE_WINDOW_SECONDS = 60
-
-
-def _check_farm_rate_limit(user_uid: str) -> None:
-    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
-    result = list(
-        db.query(
-            "SELECT COUNT(*) AS c FROM rate_limit_log"
-            " WHERE user_uid = :uid AND timestamp >= :cutoff",
-            uid=user_uid,
-            cutoff=cutoff,
-        )
-    )
-    count = result[0]["c"] if result else 0
-    if count >= _MAX_ACTIONS_PER_MINUTE:
-        raise HTTPException(
-            status_code=429,
-            detail="Rate limit exceeded. Max 30 actions per minute.",
-        )
-    get_table("rate_limit_log").insert({
-        "user_uid": user_uid,
-        "action": "",
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-    })
-
-
 router = APIRouter()
 
 
@@ -82,7 +53,6 @@ async def water_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
-    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")
@@ -107,7 +77,6 @@ async def steal_farm(
     request: Request, username: str, data: Annotated[GameSlotForm, Form()]
 ):
     viewer = require_user(request)
-    _check_farm_rate_limit(viewer["uid"])
     owner = owner_by_username(username)
     if not owner:
         raise HTTPException(status_code=404, detail="Farm not found")

devplacepy/routers/game/index.py

@@ -1,9 +1,8 @@
 # retoor <retoor@molodetz.nl>
 
-from datetime import datetime, timedelta, timezone
 from typing import Annotated
 
-from fastapi import APIRouter, Form, HTTPException, Request
+from fastapi import APIRouter, Form, Request
 from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
 
 from devplacepy.models import (
@@ -13,7 +12,7 @@ from devplacepy.models import (
     GameQuestForm,
     GameSlotForm,
 )
-from devplacepy.database import db, get_table, mark_notifications_read_by_target
+from devplacepy.database import mark_notifications_read_by_target
 from devplacepy.responses import json_error, respond, wants_json
 from devplacepy.schemas import GameLeaderboardOut, GameStateOut
 from devplacepy.services.game import GameError, store
@@ -21,33 +20,6 @@ from devplacepy.utils import award_rewards, get_current_user, require_user, trac
 
 from ._shared import game_seo, notify_farm, state_payload
 
-_MAX_ACTIONS_PER_MINUTE = 30
-_RATE_WINDOW_SECONDS = 60
-
-
-def _check_rate_limit(user_uid: str) -> None:
-    cutoff = (datetime.now(timezone.utc) - timedelta(seconds=_RATE_WINDOW_SECONDS)).isoformat()
-    result = list(
-        db.query(
-            "SELECT COUNT(*) AS c FROM rate_limit_log"
-            " WHERE user_uid = :uid AND timestamp >= :cutoff",
-            uid=user_uid,
-            cutoff=cutoff,
-        )
-    )
-    count = result[0]["c"] if result else 0
-    if count >= _MAX_ACTIONS_PER_MINUTE:
-        raise HTTPException(
-            status_code=429,
-            detail="Rate limit exceeded. Max 30 actions per minute.",
-        )
-    get_table("rate_limit_log").insert({
-        "user_uid": user_uid,
-        "action": "",
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-    })
-
-
 router = APIRouter()
 
 
@@ -86,7 +58,6 @@ async def game_leaderboard(request: Request):
 
 
 async def _respond_action(request: Request, user: dict, fn, on_success=None):
-    _check_rate_limit(user["uid"])
     try:
         result = fn()
     except GameError as exc:

devplacepy/services/devii/actions/dispatcher.py

@@ -60,18 +60,6 @@ CONFIRM_REQUIRED = {
     "gateway_model_delete",
     "email_account_delete",
     "email_delete_message",
-    "game_buy_plot",
-    "game_claim_quest",
-    "game_daily",
-    "game_fertilize",
-    "game_harvest",
-    "game_plant",
-    "game_prestige",
-    "game_steal",
-    "game_upgrade_ci",
-    "game_upgrade_legacy",
-    "game_upgrade_perk",
-    "game_water",
 }
 
 CONDITIONAL_CONFIRM = {

devplacepy/services/game/store/actions.py

@@ -39,9 +39,6 @@ def plant(user: dict, slot: int, crop_key: str) -> dict:
     plot = _plot_at(farm["uid"], slot)
     if not plot:
         raise GameError("That plot does not exist.")
-    cooldown = plot.get("cooldown_until", "")
-    if cooldown and _now() < _parse_date(cooldown):
-        raise GameError("This plot is on cooldown. Wait a moment before planting.")
     if plot.get("crop_key"):
         raise GameError("That plot is already in use.")
     coins = int(farm.get("coins", 0))
@@ -88,7 +85,6 @@ def harvest(user: dict, slot: int) -> dict:
             "planted_at": "",
             "ready_at": "",
             "watered_by": "[]",
-            "cooldown_until": _iso(now + timedelta(seconds=5)),
             "updated_at": _iso(now),
         },
         ["uid"],

tests/api/game/index.py

@@ -177,23 +177,3 @@ def test_prestige_below_level_returns_400(app_server, seeded_db):
     _reset_farm(name)
     response = session.post(f"{BASE_URL}/game/prestige", headers=JSON)
     assert response.status_code == 400
-
-
-def test_rate_limit_blocks_excess_requests(app_server, seeded_db):
-    session, name = _signup()
-    _reset_farm(name)
-    responses = []
-    for _ in range(31):
-        responses.append(
-            session.post(f"{BASE_URL}/game/buy-plot", headers=JSON)
-        )
-    success_count = sum(1 for r in responses[:30] if r.status_code != 429)
-    assert success_count >= 1, "expected at least one successful request"
-    assert responses[-1].status_code == 429, f"expected 429 on 31st request, got {responses[-1].status_code}"
-    assert "Rate limit exceeded" in responses[-1].json().get("detail", "")
-    # Verify the rate limit log stored entries for the test user
-    from devplacepy.database import get_table
-    user = get_table("users").find_one(username=name)
-    table = get_table("rate_limit_log")
-    entries = list(table.find(user_uid=user["uid"]))
-    assert len(entries) >= 2, f"expected rate log entries, got {len(entries)}"

tests/api/game/mutations.py

@@ -212,28 +212,3 @@ def test_steal_cooldown_blocks_second_raid(app_server, seeded_db):
         f"{BASE_URL}/game/farm/{owner}/steal", data={"slot": 0}, headers=JSON
     )
     assert second.status_code == 400
-
-
-def test_harvest_plant_cooldown_blocks_rapid_replant(app_server, seeded_db):
-    session, name = _signup()
-    _reset_farm(name)
-    # Plant and ripen a crop on slot 0
-    plant = session.post(
-        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
-    )
-    assert plant.status_code == 200
-    _ripen_owner_plot(name)
-    # Harvest it — this sets a 5-second cooldown on the plot
-    harvest = session.post(f"{BASE_URL}/game/harvest", data={"slot": 0}, headers=JSON)
-    assert harvest.status_code == 200
-    # Immediately replant on the same slot — must fail
-    replant = session.post(
-        f"{BASE_URL}/game/plant", data={"slot": 0, "crop": "shell"}, headers=JSON
-    )
-    assert replant.status_code == 400
-    assert "cooldown" in replant.text.lower()
-    # A different slot should still work
-    other = session.post(
-        f"{BASE_URL}/game/plant", data={"slot": 1, "crop": "shell"}, headers=JSON
-    )
-    assert other.status_code == 200

tests/e2e/feed.py

@@ -959,3 +959,72 @@ def test_feed_scroll_not_restored_on_fresh_visit(alice):
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
     page.wait_for_timeout(600)
     assert page.evaluate("window.scrollY") < 60
+
+
+def _seed_post_with_orphaned_parent():
+    owner = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": owner,
+            "username": f"opseed_{owner[:8]}",
+            "email": f"{owner[:8]}@op.seed",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    post_uid = str(uuid4())
+    marker = f"oppost-{post_uid[:8]}"
+    get_table("posts").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": post_uid,
+            "user_uid": owner,
+            "slug": make_combined_slug(marker, post_uid),
+            "title": None,
+            "content": marker,
+            "topic": "devlog",
+            "project_uid": None,
+            "image": None,
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    orphan_parent = str(uuid4())
+    base = datetime.now(timezone.utc)
+    rows = [
+        (f"{marker}-orphan-parent", orphan_parent, None, -3),
+        (f"{marker}-older", str(uuid4()), None, -2),
+        (f"{marker}-flat", str(uuid4()), None, -1),
+        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
+    ]
+    comments = get_table("comments")
+    for content, cuid, par, off in rows:
+        comments.insert(
+            {
+                "deleted_at": None,
+                "deleted_by": None,
+                "uid": cuid,
+                "target_type": "post",
+                "target_uid": post_uid,
+                "post_uid": post_uid,
+                "user_uid": owner,
+                "content": content,
+                "parent_uid": par,
+                "created_at": (base + timedelta(seconds=off)).isoformat(),
+            }
+        )
+    return marker
+
+
+def test_feed_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
+    marker = _seed_post_with_orphaned_parent()
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    card = page.locator(".post-card").filter(has_text=marker).first
+    card.wait_for(state="visible")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
+    nested = card.locator(".post-card-comments .comment-replies .comment-text")
+    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/gists.py

@@ -468,3 +468,70 @@ def test_gists_list_preserves_comment_hierarchy(page, app_server):
     expect(card.locator(".post-card-comments")).not_to_contain_text(f"{marker}-excluded")
     nested = card.locator(".post-card-comments .comment-replies .comment-text")
     expect(nested).to_contain_text(f"{marker}-reply")
+
+
+def _seed_gist_with_orphaned_parent():
+    owner = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": owner,
+            "username": f"gopseed_{owner[:8]}",
+            "email": f"{owner[:8]}@gop.seed",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    uid = str(uuid4())
+    marker = f"gistop-{uid[:8]}"
+    get_table("gists").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "user_uid": owner,
+            "slug": make_combined_slug(marker, uid),
+            "title": marker,
+            "description": "Gist with orphaned parent hierarchy.",
+            "source_code": "print('x')",
+            "language": "python",
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    orphan_parent = str(uuid4())
+    base = datetime.now(timezone.utc)
+    rows = [
+        (f"{marker}-orphan-parent", orphan_parent, None, -3),
+        (f"{marker}-older", str(uuid4()), None, -2),
+        (f"{marker}-flat", str(uuid4()), None, -1),
+        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
+    ]
+    comments = get_table("comments")
+    for content, cuid, par, off in rows:
+        comments.insert(
+            {
+                "deleted_at": None,
+                "deleted_by": None,
+                "uid": cuid,
+                "target_type": "gist",
+                "target_uid": uid,
+                "user_uid": owner,
+                "content": content,
+                "parent_uid": par,
+                "created_at": (base + timedelta(seconds=off)).isoformat(),
+            }
+        )
+    return marker
+
+
+def test_gists_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
+    marker = _seed_gist_with_orphaned_parent()
+    page.goto(f"{BASE_URL}/gists", wait_until="domcontentloaded")
+    card = page.locator(".gist-card").filter(has_text=marker).first
+    card.wait_for(state="visible")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
+    nested = card.locator(".post-card-comments .comment-replies .comment-text")
+    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/news.py

@@ -387,3 +387,75 @@ def test_news_list_preserves_comment_hierarchy(page, app_server):
     expect(card.locator(".post-card-comments")).not_to_contain_text(f"{marker}-excluded")
     nested = card.locator(".post-card-comments .comment-replies .comment-text")
     expect(nested).to_contain_text(f"{marker}-reply")
+
+
+def _seed_news_with_orphaned_parent():
+    owner = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": owner,
+            "username": f"nopseed_{owner[:8]}",
+            "email": f"{owner[:8]}@nop.seed",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    uid = str(uuid4())
+    marker = f"newsop-{uid[:8]}"
+    get_table("news").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "slug": make_combined_slug(marker, uid),
+            "title": marker,
+            "description": "News with orphaned parent hierarchy.",
+            "content": "Body.",
+            "url": "https://example.com/nop",
+            "source_name": "NOPSource",
+            "external_id": f"nop_{uid[:8]}",
+            "status": "published",
+            "show_on_landing": 0,
+            "grade": 10,
+            "synced_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    orphan_parent = str(uuid4())
+    base = datetime.now(timezone.utc)
+    rows = [
+        (f"{marker}-orphan-parent", orphan_parent, None, -3),
+        (f"{marker}-older", str(uuid4()), None, -2),
+        (f"{marker}-flat", str(uuid4()), None, -1),
+        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
+    ]
+    comments = get_table("comments")
+    for content, cuid, par, off in rows:
+        comments.insert(
+            {
+                "deleted_at": None,
+                "deleted_by": None,
+                "uid": cuid,
+                "target_type": "news",
+                "target_uid": uid,
+                "user_uid": owner,
+                "content": content,
+                "parent_uid": par,
+                "created_at": (base + timedelta(seconds=off)).isoformat(),
+            }
+        )
+    return marker
+
+
+def test_news_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
+    from playwright.sync_api import expect
+
+    marker = _seed_news_with_orphaned_parent()
+    page.goto(f"{BASE_URL}/news", wait_until="domcontentloaded")
+    card = page.locator(".news-card").filter(has_text=marker).first
+    card.wait_for(state="visible")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
+    nested = card.locator(".post-card-comments .comment-replies .comment-text")
+    expect(nested).to_contain_text(f"{marker}-reply")

tests/e2e/projects/index.py

@@ -1015,3 +1015,71 @@ def test_containers_menu_hidden_for_non_owner_admin_on_member_private_project(pa
     page.goto(f"{BASE_URL}/projects/{slug}", wait_until="domcontentloaded")
     page.locator(".project-actions-more").click()
     expect(page.locator(".context-menu-item:has-text('Containers')")).to_have_count(0)
+
+
+def _seed_project_with_orphaned_parent():
+    owner = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": owner,
+            "username": f"popseed_{owner[:8]}",
+            "email": f"{owner[:8]}@pop.seed",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    uid = str(uuid4())
+    marker = f"projop-{uid[:8]}"
+    get_table("projects").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "user_uid": owner,
+            "slug": make_combined_slug(marker, uid),
+            "title": marker,
+            "description": "Project with orphaned parent hierarchy.",
+            "project_type": "software",
+            "platforms": "Linux",
+            "status": "Released",
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    orphan_parent = str(uuid4())
+    base = datetime.now(timezone.utc)
+    rows = [
+        (f"{marker}-orphan-parent", orphan_parent, None, -3),
+        (f"{marker}-older", str(uuid4()), None, -2),
+        (f"{marker}-flat", str(uuid4()), None, -1),
+        (f"{marker}-reply", str(uuid4()), orphan_parent, 0),
+    ]
+    comments = get_table("comments")
+    for content, cuid, par, off in rows:
+        comments.insert(
+            {
+                "deleted_at": None,
+                "deleted_by": None,
+                "uid": cuid,
+                "target_type": "project",
+                "target_uid": uid,
+                "user_uid": owner,
+                "content": content,
+                "parent_uid": par,
+                "created_at": (base + timedelta(seconds=off)).isoformat(),
+            }
+        )
+    return marker
+
+
+def test_projects_list_preserves_comment_hierarchy_with_orphaned_parent(page, app_server):
+    marker = _seed_project_with_orphaned_parent()
+    page.goto(f"{BASE_URL}/projects", wait_until="domcontentloaded")
+    card = page.locator(".project-card").filter(has_text=marker).first
+    card.wait_for(state="visible")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-orphan-parent")
+    expect(card.locator(".post-card-comments")).to_contain_text(f"{marker}-reply")
+    nested = card.locator(".post-card-comments .comment-replies .comment-text")
+    expect(nested).to_contain_text(f"{marker}-reply")

tests/unit/services/devii/actions/catalog.py

@@ -119,23 +119,3 @@ def test_game_actions_registered_with_correct_auth():
 def test_game_read_actions_are_read_only():
     for name in ("game_state", "game_leaderboard", "game_view_farm"):
         assert BY_NAME[name].is_read_only is True
-
-
-def test_all_game_post_actions_require_confirm():
-    mutating_game_actions = {
-        "game_plant",
-        "game_harvest",
-        "game_buy_plot",
-        "game_upgrade_ci",
-        "game_water",
-        "game_steal",
-        "game_fertilize",
-        "game_daily",
-        "game_upgrade_perk",
-        "game_claim_quest",
-        "game_prestige",
-        "game_upgrade_legacy",
-    }
-    for name in mutating_game_actions:
-        assert name in BY_NAME, f"{name} missing from catalog"
-        assert name in CONFIRM_REQUIRED, f"{name} missing from CONFIRM_REQUIRED"