Resolve community links and outside-account notes

Merged
JS
6d ago
+556-98

A book is usually shared as https://hackmd.io/community/@owner/slug, which note_ref refused, and another user's note such as @0xff07/BTS came back as a bare not_found because the API reads only the account's own and its teams' notes. Community links now resolve like @owner/slug, and an owner outside the account returns the new status outside_account with published_markdown, the note's /download URL, which a guest-readable note (a book's table of contents included) answers signed out. Existing status names are unchanged.

Owner paths are matched ignoring ASCII case, as HackMD does, and a team takes the path the API spells; slugs stay exact. Measured 2026-10-18: @SYSPROG/c-prog/download and GET /v1/teams/SYSPROG/notes answer as sysprog does (same 2259 notes, teamPath: sysprog), while @sysprog/C-PROG/download answers 404. Push and the tracked list compare team paths the same way. Create and folder writes still require the exact spelling, since no write through another case was measured, and the refusal names the spelling to pass.

The first commit is comment reflow from make indent only, with no code changes, kept apart so the feature diff reads cleanly.

Verified with make check (415 unit tests plus the integration targets), cargo clippy --all-targets --all-features -- -D warnings, and cargo fmt --check. The release binary was also run over stdio against the live API, read-only: community/@SysProg/c-prog resolves to the sysprog team note, @0xff07/BTS returns outside_account whose link answers 200 text/markdown, community/@0xff07/BTS/download is refused, and hackmd_create_note with team_path: "SYSPROG" is refused before any write.

Left out: a bare ID or s/<shortId> given with a mis-cased team_path is still sent as typed, and sync state keys keep exact spelling. Canonicalizing every explicit team_path at resolution would close both, at the cost of a cached /teams lookup on bare-ID calls; that is a separate change.

Summary by cubic

Resolves community/@owner/slug links to the same note as @owner/slug, and returns a new outside_account status with published_markdown for notes whose owner is neither the account nor one of its teams. The status names only who the owner is not; it calls the link unconfirmed and falls back to not_found when no /download URL can be built, as with a custom HACKMD_API_URL or a slug the site cannot address.

  • Read paths ignore ASCII case for owners and team paths, as HackMD does; slugs stay exact. Team writes still require the exact spelling, and the refusal now names the spelling to use.
  • community links with a trailing /download are refused, since that redirects to the community listing instead of the note.
  • A team the cached list lacks gets one fresh look before an owner is judged outside the account.
  • A decoded control character in a note_ref URL is refused up front, so it cannot slip into a link built later and name another note.
  • The first commit is a comment reflow with no code changes.