Node page Discord picker: org's servers + voice channels, not raw IDs (#213 item 3) #220

2026-10-04T20:07:42-04:00

logan commented

2026-10-04 20:07:42 -04:00

Addresses #213 item 3 and #109 item 13. Neither issue should close on merge, because other items in both are still open. Pairs with #218 (feat/213-guild-link, #213 item 1): this PR reads the guild_name field #218 writes and honours its rule that an explicitly unlinked server (unlinked_at) gets no default-org fallback. Merges cleanly with #218 in either order (checked with git merge-tree).

What changed

The node page Join Discord modal no longer takes raw Guild/Voice Channel IDs. It's now a Discord radio panel (layout from design-canvas/discord-system-mockup.html › Radio channels): the voice channels this node streams into, desired → actual state per row, Stop per row, Stop all, and + Add radio channel, which opens a picker: server → voice channel (grouped by category) → mode (ad-hoc / persistent).

c2-core — new routers/discord_web.py

PUT /discord/guilds/{id}/directory (bot service key only): the server bot pushes each server's name + voice channels from its gateway cache. Merged onto discord_guilds; it never touches org_id. C2 never calls Discord for the browser, and no token string reaches the browser.
GET /discord/nodes/{id}/join-options: the node org's servers (same resolve rule the bot uses), their voice channels with any live stream on them, whether a radio bot can serve each one (with invite links if not, from pick_token), and this node's streams. Readable by anyone in the node's org; can_control comes back with it.
POST /discord/nodes/{id}/streams: a stream pinned to this node through the #216 desired-state API (start_stream(node_id=…)). It also adds the checks the raw-ID path skipped: the server must belong to the node's org (404 otherwise), the channel must be one the bot reported (400), and the per-server (discord_guild_max_streams) and per-node (discord_node_max_streams) caps apply. Lease refusals return {detail, code, invite}.
POST /discord/nodes/{id}/streams/stop: stops one stream on this node, or all of them.
Who can start/stop: a platform admin, the org owner, or an operator whose owned_node_ids lists the node. This is wider than before: the old /nodes/{id}/command route was platform-admin only, so an org owner's Join/Leave buttons always failed.
routers/nodes.py: the legacy raw-ID discord_join now refuses a server outside the node's org. Before, a platform admin could stream any org's node into any server.

discord bot: a new DirectorySync cog (app/commands/directory.py). It pushes every server on startup and every 15 minutes, on join/leave/rename, and on voice/category channel create/update/delete (debounced 3s). It sends names only: no members, messages or roles.

frontend: components/NodeDiscordRadio.tsx, lib/discordPicker.ts, and 3 c2api methods. DiscordJoinModal and the Join/Leave buttons are removed. There are no dead CTAs: every button calls one of the routes above, and users who can't control streams see the table without buttons.

Verification

~/venvs/drb-5c/bin/python -m pytest -q (drb-c2-core): 624 passed, 4 warnings (baseline on main: 608 passed). That includes 16 new tests in tests/test_discord_web_picker.py covering: org scoping, the unlinked fallback and no fallback after an unlink, member read-only, operator limited to the owned node, a directory push that leaves org_id alone, the directory-only channel rule, the node cap with idempotent re-pick, a lease refusal that returns invite links and no secret, stop scoped to the node, and the legacy raw-ID org guard.
tsc --noEmit (Node v20.18.0, TypeScript 5.9.3): tsc exit 0.
Bot: the cog loads in a commands.Bot and directory_payload was smoke-tested on mocked guilds (stage and text channels are excluded). It has not been run against live Discord.

Not done / follow-ups

Prod needs the discord-bot image redeployed before the picker shows any channels. Until the first push, a linked server shows "the DRB bot has not reported this server's channels yet".
A persistent pinned stream that loses its node gets moved by the reconciler to any org node on the same system, so the pin doesn't survive that move. The picker copy says so.
#213 items 2 and 4 belong to other slices.

🤖 Generated with Claude Code

Addresses #213 item 3 and #109 item 13. Neither issue should close on merge, because other items in both are still open. **Pairs with #218** (`feat/213-guild-link`, #213 item 1): this PR reads the `guild_name` field #218 writes and honours its rule that an explicitly unlinked server (`unlinked_at`) gets no default-org fallback. Merges cleanly with #218 in either order (checked with `git merge-tree`). ## What changed The node page **Join Discord** modal no longer takes raw Guild/Voice Channel IDs. It's now a **Discord radio** panel (layout from `design-canvas/discord-system-mockup.html` › Radio channels): the voice channels this node streams into, desired → actual state per row, **Stop** per row, **Stop all**, and **+ Add radio channel**, which opens a picker: server → voice channel (grouped by category) → mode (ad-hoc / persistent). **c2-core** — new `routers/discord_web.py` - `PUT /discord/guilds/{id}/directory` (bot service key only): the server bot pushes each server's name + voice channels from its gateway cache. Merged onto `discord_guilds`; it never touches `org_id`. C2 never calls Discord for the browser, and no token string reaches the browser. - `GET /discord/nodes/{id}/join-options`: the node org's servers (same resolve rule the bot uses), their voice channels with any live stream on them, whether a radio bot can serve each one (with invite links if not, from `pick_token`), and this node's streams. Readable by anyone in the node's org; `can_control` comes back with it. - `POST /discord/nodes/{id}/streams`: a stream **pinned to this node** through the #216 desired-state API (`start_stream(node_id=…)`). It also adds the checks the raw-ID path skipped: the server must belong to the node's org (404 otherwise), the channel must be one the bot reported (400), and the per-server (`discord_guild_max_streams`) and per-node (`discord_node_max_streams`) caps apply. Lease refusals return `{detail, code, invite}`. - `POST /discord/nodes/{id}/streams/stop`: stops one stream on this node, or all of them. - Who can start/stop: a platform admin, the org owner, or an operator whose `owned_node_ids` lists the node. **This is wider than before:** the old `/nodes/{id}/command` route was platform-admin only, so an org owner's Join/Leave buttons always failed. - `routers/nodes.py`: the legacy raw-ID `discord_join` now refuses a server outside the node's org. Before, a platform admin could stream any org's node into any server. **discord bot**: a new `DirectorySync` cog (`app/commands/directory.py`). It pushes every server on startup and every 15 minutes, on join/leave/rename, and on voice/category channel create/update/delete (debounced 3s). It sends names only: no members, messages or roles. **frontend**: `components/NodeDiscordRadio.tsx`, `lib/discordPicker.ts`, and 3 `c2api` methods. `DiscordJoinModal` and the Join/Leave buttons are removed. There are no dead CTAs: every button calls one of the routes above, and users who can't control streams see the table without buttons. ## Verification - `~/venvs/drb-5c/bin/python -m pytest -q` (drb-c2-core): `624 passed, 4 warnings` (baseline on main: 608 passed). That includes 16 new tests in `tests/test_discord_web_picker.py` covering: org scoping, the unlinked fallback and no fallback after an unlink, member read-only, operator limited to the owned node, a directory push that leaves `org_id` alone, the directory-only channel rule, the node cap with idempotent re-pick, a lease refusal that returns invite links and no secret, stop scoped to the node, and the legacy raw-ID org guard. - `tsc --noEmit` (Node v20.18.0, TypeScript 5.9.3): `tsc exit 0`. - Bot: the cog loads in a `commands.Bot` and `directory_payload` was smoke-tested on mocked guilds (stage and text channels are excluded). It has not been run against live Discord. ## Not done / follow-ups - Prod needs the discord-bot image redeployed before the picker shows any channels. Until the first push, a linked server shows "the DRB bot has not reported this server's channels yet". - A persistent pinned stream that loses its node gets moved by the reconciler to *any* org node on the same system, so the pin doesn't survive that move. The picker copy says so. - #213 items 2 and 4 belong to other slices. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

logan added 3 commits 2026-10-04 20:07:42 -04:00

Node page Discord picker: org's linked servers + voice channels, not raw IDs (#213 item 3, #109 item 13) 62e6d69bfa

- c2-core routers/discord_web.py:
  PUT  /discord/guilds/{id}/directory (service key): the server bot pushes each
       server's name + voice channels; merged onto discord_guilds, never touches org_id.
  GET  /discord/nodes/{id}/join-options: the node org's servers (same
       resolve rule as the bot), their voice channels with any live stream,
       radio-bot readiness + invite links, and this node's streams. No tokens.
  POST /discord/nodes/{id}/streams: stream pinned to the node; server must be
       the node org's, channel must be in the bot's directory, guild + node caps.
  POST /discord/nodes/{id}/streams/stop: one stream on this node, or all.
  Control = platform admin, org owner, or operator owning the node.
- nodes.py: legacy raw-ID discord_join now refuses a server outside the node's org.
- discord bot: DirectorySync cog pushes on ready (15-min loop), join/leave,
  rename, voice/category channel changes (debounced).
- frontend: NodeDiscordRadio panel + picker replaces DiscordJoinModal and the
  admin-only Join/Leave buttons.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Picker: share PR #218 's guild_name field and its no-fallback-after-unlink rule a2c840f186

A server an org explicitly unlinked (unlinked_at) must not fall back to the
default org in the picker either, or the founding org could stream into it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Move picker router/client additions off PR #218 's lines (no merge conflict) 2457d2d734

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

logan referenced this pull request

2026-10-04 20:08:46 -04:00

Node page shows admin-only buttons to non-admins (Restart OP25, override Ack/Force Revert): dead CTAs #222

logan referenced this pull request

2026-10-04 20:08:47 -04:00

Discord: no self-serve guild->org link and no admin UI for radio channels/bots (follow-up to #203/#204) #213

logan referenced this pull request

2026-10-04 20:09:02 -04:00

Frontend punch-list (drb.cusano.net live review, 2026-09-07) #109

logan added 1 commit 2026-10-04 21:36:42 -04:00

Picker review fixes: validate stream_id on stop; accurate offline + no-system copy d2437e3a0b

- POST /discord/nodes/{id}/streams/stop: stream_id must be guild:channel
  snowflakes, so a malformed id is a 422 instead of a Firestore path error.
- Offline footer said channels resume on reconnect; ad-hoc ones stop once
  the node is gone past the lease grace (reconcile_once). Say so.
- Picker: say why Start is disabled when the node has no system.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

logan referenced this pull request

2026-10-04 21:36:58 -04:00

Discord stream caps are check-then-write: concurrent starts can exceed the per-server and per-node limits #223

logan commented

2026-10-04 21:37:04 -04:00

Review pass, pushed as d2437e3:

streams/stop now validates stream_id as guild:channel snowflakes (a / in it was a Firestore path error, so a 500). Test added.
The offline footer said channels resume when the node reconnects. Ad-hoc ones stop once the node is gone past the lease grace (reconcile_once), so it says that now.
The picker now says why Start is disabled when the node has no system.

Re-verified: c2-core pytest 625 passed, 4 warnings; tsc --noEmit exit 0 (Node 20.18.0, TS 5.9.3).

Merge order: the empty-state copy ("link it to your organization") only works for an org owner once #218 (self-serve /drb link) is in, so merge #218 first or together. Non-atomic caps filed as #223.

Review pass, pushed as d2437e3: - `streams/stop` now validates `stream_id` as `guild:channel` snowflakes (a `/` in it was a Firestore path error, so a 500). Test added. - The offline footer said channels resume when the node reconnects. Ad-hoc ones stop once the node is gone past the lease grace (`reconcile_once`), so it says that now. - The picker now says why Start is disabled when the node has no system. Re-verified: c2-core pytest `625 passed, 4 warnings`; `tsc --noEmit` exit 0 (Node 20.18.0, TS 5.9.3). Merge order: the empty-state copy ("link it to your organization") only works for an org owner once #218 (self-serve `/drb link`) is in, so merge #218 first or together. Non-atomic caps filed as #223.

logan merged commit fabdf5839e into main

2026-10-04 22:05:50 -04:00

logan referenced this pull request

2026-10-05 00:14:39 -04:00

Discord: customers shouldn't need the main DRB bot in their server — radio bots (via C2) should cover linking, channel directory and permission checks #225

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: logan/server-26#220