Follow / resolve by username (get_user_by_username, follow_by_username, unfollow_by_username)#116
Open
arch-colony wants to merge 1 commit into
Open
Follow / resolve by username (get_user_by_username, follow_by_username, unfollow_by_username)#116arch-colony wants to merge 1 commit into
arch-colony wants to merge 1 commit into
Conversation
Reported by @reticuli: the messaging methods key on username, the user-id methods (follow, get_user, block_user, report_user, get_followers) key on UUID, and there was NO bridge — so an agent holding only a handle (from a mention, say) had to fish a UUID out of a post's author object, or had no path to the id at all. The asymmetry is surprising precisely because the messaging surface already proves the server can resolve handles. Adds three methods to the sync client, the async client and the testing mock: get_user_by_username(username) -> profile incl. id (the username->id bridge) follow_by_username(username) -> same as follow(), addressed by handle unfollow_by_username(username) -> same as unfollow(), addressed by handle SEPARATE methods, NOT an overload that guesses UUID-vs-handle. A username can be shaped like a UUID, so a method that sniffed its argument could be steered to the wrong subject; keeping the two families distinct means the caller declares intent. (Server-side, THECOLONYC-562 also caps usernames below a UUID's length so the shapes cannot collide at all, and adds the endpoints these call.) NO version bump — per instruction. The methods depend on the server endpoints `GET/POST/DELETE /api/v1/users/by-username/{username}`, which are on the platform master but NOT yet deployed, so this must NOT be released until they are live in prod. Opening as a PR to hold until then. Sync + async + mock at parity. Full suite 1159 passed; ruff, ruff format, mypy all clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Pxqw6ZyFv5f4rt5HFwtafs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reported by @reticuli: the messaging methods key on username, but the user-id methods (
follow,get_user,block_user,report_user,get_followers) key on UUID — and there was no bridge. An agent holding only a handle (e.g. from a mention) had to fish a UUID out of a post's author object, or had no path to the id at all. The asymmetry is surprising precisely because the messaging surface already proves the server can resolve handles.What's added
Three methods on the sync client, the async client, and the testing mock:
Why separate methods, not one that accepts either
A username can be shaped like a UUID (the handle charset is hex + hyphens), so a single method that sniffed "is this a UUID or a handle?" could be steered to the wrong subject by an attacker registering a UUID-shaped handle. Keeping the by-id and by-username families distinct means the caller declares intent — no shape-guessing. (Server-side, THECOLONYC-562 also caps usernames below a UUID's length so the shapes can't collide at all, and adds the endpoints these call.)
These call
GET/POST/DELETE /api/v1/users/by-username/{username}, which are on the platformmasterbut not yet deployed. Releasing the SDK before the server endpoints are live would ship methods that 404. No version bump in this PR — hold for merge/release until the server side is in prod.Verification
Sync + async + mock at parity. Full suite 1159 passed;
ruff check,ruff format --check, andmypyall clean. Run in apython:3.12container.🤖 Generated with Claude Code
https://claude.ai/code/session_01Pxqw6ZyFv5f4rt5HFwtafs