From 0d5afb32a1f007ff2cf5a0ef65a00f46d7880ada Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 08:31:23 +0100
Subject: [PATCH 01/10] fix: moderation preview scope, comment vote races, and
 email link origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes, consolidated into one PR by request.

1. Move the moderation preview off the public reader routes (#1340
   follow-up)

#1340 let admins resolve in_review/rejected posts at their public URLs.
That put the public reader — vote, bookmark and comment controls — on a
post that may be about to be rejected, and `post.vote` has no status
guard, so a misclick writes a vote and author points onto content the
moderator is declining. It also stopped admins seeing the site the way
readers do, and made the rejected-post banner's "not visible to anyone
else" untrue.

Preview now lives at /admin/moderation/preview/{id}: read-only, inside
the admin gate. The public routes and their visibility filter revert.

It also fixes the link path. #1340 sent Preview straight off-site, so the
member's own title/excerpt/body — where a spammer would put the payload —
was never shown; the preview renders both halves. And that off-site href
skipped `safeExternalHref` and rel, so an externalUrl that never passed
`httpUrl()` validation would run as a `javascript:` URL inside the
authenticated admin session, and the page under review received the admin
surface as its referrer.

2. Drop the frozen sort snapshot, serialise votes per comment (#1341
   follow-up)

Freezing sort scores was more than the fix needed and wrong on its own
terms: counts still updated on refetch while the order did not, so a
thread could show a 42-point comment below a 3-point one; the documented
"re-pick the sort" escape hatch never fired, because selecting the
already-selected option is a no-op; and the added tiebreak made Top
identical to New on the common all-zero thread.

Not refetching after a successful vote is the whole fix. Ordering is
derived from the data on screen again, so it cannot contradict the counts
beside it. Votes are serialised per comment (newest click wins), since
#1341 dropped the in-flight guard without replacing it and overlapping
writes could land in either order. The resync remount is per comment too.

3. Email links pointed at the deployment, not the site

`getAppOrigin()` fell back to VERCEL_URL, which is the unique
per-deployment hostname — and Vercel sets it in production too. With
DOMAIN_NAME unset, every link it built (the admin's "post awaiting
review" deep link, report emails, the verification link) went out as
*.vercel.app. Production now resolves to the project's production domain,
falling back to the canonical origin; preview deploys still get their own
URL. The duplicate copy of this logic in utils/emailToken.ts is gone.
---
 app/(admin)/admin/moderation/_client.tsx      |  50 ++----
 .../moderation/preview/[postId]/page.tsx      | 150 ++++++++++++++++++
 app/(app)/[username]/[slug]/page.tsx          |  35 ++--
 app/(app)/d/[slug]/page.tsx                   |  33 ++--
 components/ContentDetail/PostBody.tsx         |  90 +++++++++++
 components/ContentDetail/PostReader.tsx       |  81 +---------
 components/Discussion/DiscussionArea.tsx      | 130 +++++++--------
 server/api/router/admin.ts                    |   8 +-
 server/lib/postVisibility.test.ts             |  62 --------
 server/lib/postVisibility.ts                  |  38 -----
 server/lib/url.test.ts                        |  62 +++++++-
 server/lib/url.ts                             |  36 ++++-
 utils/emailToken.ts                           |  10 +-
 13 files changed, 447 insertions(+), 338 deletions(-)
 create mode 100644 app/(admin)/admin/moderation/preview/[postId]/page.tsx
 create mode 100644 components/ContentDetail/PostBody.tsx
 delete mode 100644 server/lib/postVisibility.test.ts
 delete mode 100644 server/lib/postVisibility.ts

diff --git a/app/(admin)/admin/moderation/_client.tsx b/app/(admin)/admin/moderation/_client.tsx
index b6a2592ab..285bcc28e 100644
--- a/app/(admin)/admin/moderation/_client.tsx
+++ b/app/(admin)/admin/moderation/_client.tsx
@@ -40,39 +40,21 @@ const reasonLabels: Record<ReportReason, string> = {
 const chipBase =
   "rounded-full px-2 py-0.5 font-mono text-xs uppercase tracking-label";
 
-type PreviewablePost = {
-  type: string | null;
-  slug: string | null;
-  externalUrl: string | null;
-  authorUsername: string | null;
-};
-
-// Where to send a moderator to actually read the thing they're judging.
-// Discussions and questions live under /d/; a shared link IS its destination,
-// so it points off-site; everything else renders at /{username}/{slug}, where
-// the reader grants admins the same bypass the author has — so an in_review
-// post previews exactly as readers would eventually see it.
-function postPreviewHref(post: PreviewablePost): string | null {
-  if (post.type === "link") return post.externalUrl;
-  if (!post.slug) return null;
-  if (post.type === "discussion" || post.type === "question") {
-    return `/d/${post.slug}`;
-  }
-  if (!post.authorUsername) return null;
-  return `/${post.authorUsername}/${post.slug}`;
-}
-
-const PreviewLink = ({ post }: { post: PreviewablePost }) => {
-  const href = postPreviewHref(post);
-  if (!href) return null;
-
-  return (
-    <Link href={href} target="_blank" className="secondary-button">
-      <ArrowTopRightOnSquareIcon className="h-4 w-4" />
-      Preview
-    </Link>
-  );
-};
+// Read the submission before deciding on it. The preview is an admin-side,
+// read-only render (see app/(admin)/admin/moderation/preview/[postId]) rather
+// than the public URL: an unapproved post has no public URL yet, and the public
+// reader would put vote/bookmark/comment controls on a post that may be about
+// to be rejected. Keyed by id, so it is available for every queued post.
+const PreviewLink = ({ postId }: { postId: string }) => (
+  <Link
+    href={`/admin/moderation/preview/${postId}`}
+    target="_blank"
+    className="secondary-button"
+  >
+    <ArrowTopRightOnSquareIcon className="h-4 w-4" />
+    Preview
+  </Link>
+);
 
 // datetime-local is in the moderator's LOCAL time, so shift the `min` boundary
 // by the tz offset before slicing to "YYYY-MM-DDTHH:mm".
@@ -310,7 +292,7 @@ const ModerationQueue = () => {
                   )}
                 </div>
                 <div className="flex shrink-0 flex-wrap gap-2">
-                  <PreviewLink post={post} />
+                  <PreviewLink postId={post.id} />
                   <button
                     className="primary-button"
                     disabled={isModerating}
diff --git a/app/(admin)/admin/moderation/preview/[postId]/page.tsx b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
new file mode 100644
index 000000000..3c2caf367
--- /dev/null
+++ b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
@@ -0,0 +1,150 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { ArrowLeftIcon } from "@heroicons/react/24/outline";
+import { eq } from "drizzle-orm";
+import { db } from "@/server/db";
+import { posts, user, post_tags, tag } from "@/server/db/schema";
+import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
+import { getCamelCaseFromLower } from "@/utils/utils";
+import { safeExternalHref } from "@/utils/url";
+
+export const metadata = {
+  title: "Preview - Codú Admin",
+  description: "Read a submission before approving or declining it",
+  robots: { index: false, follow: false },
+};
+
+type Props = { params: Promise<{ postId: string }> };
+
+// Read-only preview of a submission, for deciding whether it belongs on the
+// site. It deliberately lives inside `(admin)` rather than exposing unpublished
+// posts on the public reader routes: moderators need to READ a post, not vote,
+// bookmark or comment on one that may be about to be rejected — and admins
+// should still see the public site exactly as readers do.
+//
+// The body renders through the same `PostBody` the reader uses, so what a
+// moderator approves is what readers will get.
+//
+// Admin-role gate is enforced in app/(admin)/layout.tsx.
+export default async function Page({ params }: Props) {
+  const { postId } = await params;
+
+  const [record] = await db
+    .select({
+      id: posts.id,
+      title: posts.title,
+      body: posts.body,
+      excerpt: posts.excerpt,
+      type: posts.type,
+      status: posts.status,
+      slug: posts.slug,
+      externalUrl: posts.externalUrl,
+      coverImage: posts.coverImage,
+      readingTime: posts.readingTime,
+      createdAt: posts.createdAt,
+      moderationNote: posts.moderationNote,
+      authorName: user.name,
+      authorUsername: user.username,
+    })
+    .from(posts)
+    .leftJoin(user, eq(posts.authorId, user.id))
+    .where(eq(posts.id, postId))
+    .limit(1);
+
+  if (!record) notFound();
+
+  const renderedBody = renderPostBody(record.body);
+  const externalHref = safeExternalHref(record.externalUrl);
+
+  const tags = await db
+    .select({ title: tag.title, slug: tag.slug })
+    .from(post_tags)
+    .innerJoin(tag, eq(post_tags.tagId, tag.id))
+    .where(eq(post_tags.postId, record.id));
+
+  return (
+    <div className="mx-auto max-w-3xl px-0 py-4 sm:px-4 sm:py-8">
+      <div className="mb-6 flex items-center gap-4">
+        <Link
+          href="/admin/moderation"
+          className="rounded-lg p-2 text-muted transition-colors hover:bg-elevated hover:text-fg"
+        >
+          <ArrowLeftIcon className="h-5 w-5" />
+        </Link>
+        <div className="min-w-0">
+          <p className="eyebrow">
+            <span className="slash">{"// "}</span>preview
+          </p>
+          <h1 className="mt-1 font-display text-2xl font-extrabold tracking-tight text-fg">
+            {record.title || "Untitled"}
+          </h1>
+          <p className="mt-1 font-mono text-xs text-faint">
+            {record.type} · {record.status} · @
+            {record.authorUsername ?? "unknown"}
+            {record.readingTime ? ` · ${record.readingTime} min read` : ""}
+          </p>
+        </div>
+      </div>
+
+      {record.moderationNote && (
+        <p className="mb-6 rounded-lg border border-hairline bg-inset p-3 text-sm text-muted">
+          <span className="font-medium text-fg">Flagged:</span>{" "}
+          {record.moderationNote}
+        </p>
+      )}
+
+      {record.excerpt && (
+        <p className="mb-6 text-base text-muted">{record.excerpt}</p>
+      )}
+
+      {/* A link submission is judged on both halves: the member's own framing
+          above, and the destination. rel/noreferrer keep the admin surface out
+          of the referrer of a page that is under review precisely because it
+          may be hostile. */}
+      {record.type === "link" &&
+        (externalHref ? (
+          <p className="mb-6 break-all font-mono text-sm">
+            <span className="text-faint">{"// destination "}</span>
+            <a
+              href={externalHref}
+              target="_blank"
+              rel="noopener noreferrer nofollow"
+              className="text-accent underline"
+            >
+              {externalHref}
+            </a>
+          </p>
+        ) : (
+          <p className="mb-6 font-mono text-sm text-danger">
+            {"// destination missing or not a http(s) URL: "}
+            {record.externalUrl ?? "none"}
+          </p>
+        ))}
+
+      {tags.length > 0 && (
+        <div className="mb-6 flex flex-wrap gap-2">
+          {tags.map((t) => (
+            <span
+              key={t.title}
+              className="rounded-sm border border-hairline px-2.5 py-0.5 font-mono text-xs text-muted"
+            >
+              {getCamelCaseFromLower(t.title)}
+            </span>
+          ))}
+        </div>
+      )}
+
+      {record.body ? (
+        <article className="prose max-w-none dark:prose-invert">
+          <PostBody {...renderedBody} />
+        </article>
+      ) : (
+        <p className="font-mono text-sm text-faint">{"// no body submitted"}</p>
+      )}
+
+      <p className="mt-8 font-mono text-xs text-faint">
+        {"// read-only — approve or decline from the queue"}
+      </p>
+    </div>
+  );
+}
diff --git a/app/(app)/[username]/[slug]/page.tsx b/app/(app)/[username]/[slug]/page.tsx
index 3b1a622a0..b6e6f8e82 100644
--- a/app/(app)/[username]/[slug]/page.tsx
+++ b/app/(app)/[username]/[slug]/page.tsx
@@ -6,11 +6,10 @@ import { type Metadata } from "next";
 import { SITE_ORIGIN } from "@/config/site";
 import { db } from "@/server/db";
 import { posts, user, feed_sources, post_tags, tag } from "@/server/db/schema";
-import { eq, and, lte, inArray, sql } from "drizzle-orm";
+import { eq, and, lte, inArray, or, sql } from "drizzle-orm";
 import UserLinkDetail from "./_userLinkDetail";
 import PostReader from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
-import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { serverApi } from "@/server/trpc/caller";
 import { JsonLd } from "@/components/JsonLd";
 import { getArticleSchema, getBreadcrumbSchema } from "@/lib/structured-data";
@@ -32,7 +31,6 @@ async function getUserPostUncached(
   username: string,
   postSlug: string,
   viewerId?: string | null,
-  viewerIsAdmin = false,
 ) {
   // Case-insensitive handle resolution (GitHub-style), matching the profile page.
   const userRecord = await db.query.user.findFirst({
@@ -42,7 +40,22 @@ async function getUserPostUncached(
 
   if (!userRecord) return null;
 
-  const visibilityFilter = postVisibilityFilter({ viewerId, viewerIsAdmin });
+  // Owner bypass: the author may view their own in_review/rejected post;
+  // everyone else only sees published posts whose publish time has passed.
+  const isAuthor = !!viewerId && viewerId === userRecord.id;
+
+  const visibilityFilter = isAuthor
+    ? or(
+        and(
+          eq(posts.status, "published"),
+          lte(posts.publishedAt, new Date().toISOString()),
+        ),
+        inArray(posts.status, ["in_review", "rejected"]),
+      )
+    : and(
+        eq(posts.status, "published"),
+        lte(posts.publishedAt, new Date().toISOString()),
+      );
 
   const postResults = await db
     .select({
@@ -363,12 +376,7 @@ export async function generateMetadata(props: Props): Promise<Metadata> {
 
   // Same viewerId as the page body so the cache()d resolver runs once per request.
   const session = await getServerAuthSession();
-  const userPost = await getUserPost(
-    username,
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const userPost = await getUserPost(username, slug, session?.user?.id);
   if (userPost) {
     // Discussions/questions canonicalize to /d/{slug}; redirect before metadata.
     if (isDiscussionKind(userPost.type)) {
@@ -525,12 +533,7 @@ const UnifiedPostPage = async (props: Props) => {
 
   const host = (await headers()).get("host") || "";
 
-  const userPost = await getUserPost(
-    username,
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const userPost = await getUserPost(username, slug, session?.user?.id);
 
   if (userPost) {
     // Discussions/questions live under /d/{slug} — redirect before rendering.
diff --git a/app/(app)/d/[slug]/page.tsx b/app/(app)/d/[slug]/page.tsx
index cbb5f55e9..a7bddbc3b 100644
--- a/app/(app)/d/[slug]/page.tsx
+++ b/app/(app)/d/[slug]/page.tsx
@@ -7,12 +7,11 @@ import { ogPostImage } from "@/lib/og/url";
 import { getServerAuthSession } from "@/server/auth";
 import { db } from "@/server/db";
 import { posts, user, post_tags, tag, comments } from "@/server/db/schema";
-import { eq, and, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
+import { eq, and, lte, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
 import PostReader, {
   type ReaderPost,
 } from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
-import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { JsonLd } from "@/components/JsonLd";
 import {
   getDiscussionForumPostingSchema,
@@ -27,7 +26,6 @@ type Props = { params: Promise<{ slug: string }> };
 async function getDiscussionPostUncached(
   slug: string,
   viewerId?: string | null,
-  viewerIsAdmin = false,
 ): Promise<ReaderPost | null> {
   const urlId = parseUrlId(slug);
   if (!urlId) return null;
@@ -39,6 +37,13 @@ async function getDiscussionPostUncached(
       ? eq(posts.urlId, urlId)
       : or(eq(posts.urlId, urlId), eq(posts.slug, slug))!;
 
+  const publicFilter = and(
+    eq(posts.status, "published"),
+    lte(posts.publishedAt, new Date().toISOString()),
+  );
+
+  // Owner bypass: the author may view their own in_review/rejected discussion;
+  // everyone else only sees published.
   const [row] = await db
     .select({
       id: posts.id,
@@ -68,7 +73,15 @@ async function getDiscussionPostUncached(
       and(
         idMatch,
         inArray(posts.type, ["discussion", "question"]),
-        postVisibilityFilter({ viewerId, viewerIsAdmin }),
+        viewerId
+          ? or(
+              publicFilter,
+              and(
+                eq(posts.authorId, viewerId),
+                inArray(posts.status, ["in_review", "rejected"]),
+              ),
+            )
+          : publicFilter,
       ),
     )
     .limit(1);
@@ -147,11 +160,7 @@ export async function generateMetadata(props: Props): Promise<Metadata> {
   const { slug } = await props.params;
   // Same viewerId as the page body so the cache()d resolver runs once per request.
   const session = await getServerAuthSession();
-  const post = await getDiscussionPost(
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const post = await getDiscussionPost(slug, session?.user?.id);
 
   if (!post) {
     return { title: "Discussion Not Found" };
@@ -201,11 +210,7 @@ const DiscussionPage = async (props: Props) => {
   const { slug } = await props.params;
   const session = await getServerAuthSession();
 
-  const post = await getDiscussionPost(
-    slug,
-    session?.user?.id,
-    session?.user?.role === "ADMIN",
-  );
+  const post = await getDiscussionPost(slug, session?.user?.id);
 
   if (!post) return notFound();
 
diff --git a/components/ContentDetail/PostBody.tsx b/components/ContentDetail/PostBody.tsx
new file mode 100644
index 000000000..d7b5798a3
--- /dev/null
+++ b/components/ContentDetail/PostBody.tsx
@@ -0,0 +1,90 @@
+import React from "react";
+import Markdoc, { type RenderableTreeNode } from "@markdoc/markdoc";
+import type { JSONContent } from "@tiptap/core";
+import { generateHTML } from "@tiptap/core";
+import sanitizeHtml from "sanitize-html";
+import { markdocComponents } from "@/markdoc/components";
+import { config } from "@/markdoc/config";
+import NotFound from "@/components/NotFound/NotFound";
+import { RenderExtensions } from "@/components/editor/editor/extensions/render-extensions";
+
+// A post body is either tiptap JSON (newer editor) or markdoc source. Both the
+// public reader and the admin moderation preview render it through here, so a
+// moderator approving a post is looking at the same output readers will get.
+
+const parseJSON = (str: string): JSONContent | null => {
+  try {
+    return JSON.parse(str);
+  } catch {
+    return null;
+  }
+};
+
+const renderSanitizedTiptapContent = (jsonContent: JSONContent) => {
+  const rawHtml = generateHTML(jsonContent, [...RenderExtensions]);
+  return sanitizeHtml(rawHtml, {
+    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
+      "img",
+      "iframe",
+      "h1",
+      "h2",
+    ]),
+    allowedAttributes: {
+      ...sanitizeHtml.defaults.allowedAttributes,
+      img: ["src", "alt", "title", "width", "height", "class"],
+      iframe: ["src", "width", "height", "frameborder", "allowfullscreen"],
+      "*": ["class", "id", "style"],
+    },
+    allowedIframeHostnames: [
+      "www.youtube.com",
+      "youtube.com",
+      "www.youtube-nocookie.com",
+    ],
+  });
+};
+
+export function renderPostBody(body: string | null): {
+  isTiptap: boolean;
+  content: string | RenderableTreeNode;
+} {
+  const source = body ?? "";
+  const parsed = parseJSON(source);
+
+  if (parsed?.type === "doc") {
+    return { isTiptap: true, content: renderSanitizedTiptapContent(parsed) };
+  }
+
+  return {
+    isTiptap: false,
+    content: Markdoc.transform(Markdoc.parse(source), config),
+  };
+}
+
+/**
+ * The rendered body only. The heading is the caller's business: the reader
+ * prints the title above markdoc bodies (tiptap bodies carry their own H1),
+ * and the admin preview always shows its own header.
+ */
+export const PostBody = ({
+  isTiptap,
+  content,
+}: ReturnType<typeof renderPostBody>) => {
+  if (isTiptap) {
+    return content ? (
+      <div
+        dangerouslySetInnerHTML={{ __html: content as string }}
+        className="tiptap-content"
+      />
+    ) : (
+      <NotFound />
+    );
+  }
+
+  return (
+    <div>
+      {Markdoc.renderers.react(content, React, {
+        components: markdocComponents,
+      })}
+    </div>
+  );
+};
diff --git a/components/ContentDetail/PostReader.tsx b/components/ContentDetail/PostReader.tsx
index 8b1237830..378c6b840 100644
--- a/components/ContentDetail/PostReader.tsx
+++ b/components/ContentDetail/PostReader.tsx
@@ -1,20 +1,12 @@
 import React from "react";
-import type { RenderableTreeNode } from "@markdoc/markdoc";
-import Markdoc from "@markdoc/markdoc";
 import Link from "next/link";
-import type { JSONContent } from "@tiptap/core";
-import { generateHTML } from "@tiptap/core";
-import sanitizeHtml from "sanitize-html";
-import { markdocComponents } from "@/markdoc/components";
-import { config } from "@/markdoc/config";
 import DiscussionArea from "@/components/Discussion/DiscussionArea";
 import { ArticleActionBarWrapper } from "@/components/ArticleActionBar";
 import InlineAuthorBio from "@/components/ContentDetail/InlineAuthorBio";
+import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
 import ArticleAdminPanel from "@/components/ArticleAdminPanel/ArticleAdminPanel";
-import NotFound from "@/components/NotFound/NotFound";
 import { JsonLd } from "@/components/JsonLd";
 import { getCamelCaseFromLower, slugifyTag } from "@/utils/utils";
-import { RenderExtensions } from "@/components/editor/editor/extensions/render-extensions";
 import { getArticleSchema, getBreadcrumbSchema } from "@/lib/structured-data";
 import { db } from "@/server/db";
 import { comments } from "@/server/db/schema";
@@ -52,37 +44,6 @@ export interface ReaderPost {
 
 type ReaderSession = Session | null;
 
-const parseJSON = (str: string): JSONContent | null => {
-  try {
-    return JSON.parse(str);
-  } catch {
-    return null;
-  }
-};
-
-const renderSanitizedTiptapContent = (jsonContent: JSONContent) => {
-  const rawHtml = generateHTML(jsonContent, [...RenderExtensions]);
-  return sanitizeHtml(rawHtml, {
-    allowedTags: sanitizeHtml.defaults.allowedTags.concat([
-      "img",
-      "iframe",
-      "h1",
-      "h2",
-    ]),
-    allowedAttributes: {
-      ...sanitizeHtml.defaults.allowedAttributes,
-      img: ["src", "alt", "title", "width", "height", "class"],
-      iframe: ["src", "width", "height", "frameborder", "allowfullscreen"],
-      "*": ["class", "id", "style"],
-    },
-    allowedIframeHostnames: [
-      "www.youtube.com",
-      "youtube.com",
-      "www.youtube-nocookie.com",
-    ],
-  });
-};
-
 // Mirrors discussion.getContentDiscussionCount so the reader renders the same
 // "Discussion {N}" heading as the source-content reader.
 async function getDiscussionCount(contentId: string) {
@@ -120,25 +81,12 @@ const PostReader = async ({
   commentsDisabledLabel = "post",
   emitArticleSchema = true,
 }: PostReaderProps) => {
-  // Only reachable by the author or an admin (the resolvers only return
-  // non-published posts when viewerId matches the author's id, or the viewer is
-  // an admin previewing from the moderation queue).
+  // Only reachable by the author (the resolver only returns non-published posts
+  // when viewerId matches the author's id).
   const isAwaitingReview = post.status === "in_review";
   const isRejected = post.status === "rejected";
-  const bodyContent = post.body ?? "";
-  const parsedBody = parseJSON(bodyContent);
-  const isTiptapContent = parsedBody?.type === "doc";
-
-  // Tiptap branch: sanitized HTML string. Markdoc branch: the transformed tree,
-  // rendered to React exactly once at the render site below.
-  let renderedContent: string | RenderableTreeNode;
-
-  if (isTiptapContent && parsedBody) {
-    renderedContent = renderSanitizedTiptapContent(parsedBody);
-  } else {
-    const ast = Markdoc.parse(bodyContent);
-    renderedContent = Markdoc.transform(ast, config);
-  }
+  const renderedBody = renderPostBody(post.body);
+  const isTiptapContent = renderedBody.isTiptap;
 
   const articleSchema = emitArticleSchema
     ? getArticleSchema({
@@ -257,24 +205,7 @@ const PostReader = async ({
           <div className="prose mx-auto max-w-none dark:prose-invert lg:prose-lg">
             {!isTiptapContent && <h1>{post.title}</h1>}
 
-            {isTiptapContent ? (
-              renderedContent ? (
-                <div
-                  dangerouslySetInnerHTML={{
-                    __html: renderedContent as string,
-                  }}
-                  className="tiptap-content"
-                />
-              ) : (
-                <NotFound />
-              )
-            ) : (
-              <div>
-                {Markdoc.renderers.react(renderedContent, React, {
-                  components: markdocComponents,
-                })}
-              </div>
-            )}
+            <PostBody {...renderedBody} />
           </div>
 
           {post.tags.length > 0 && (
diff --git a/components/Discussion/DiscussionArea.tsx b/components/Discussion/DiscussionArea.tsx
index 1c9d89ec1..65508a2c0 100644
--- a/components/Discussion/DiscussionArea.tsx
+++ b/components/Discussion/DiscussionArea.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import React, { useMemo, useRef, useState } from "react";
+import React, { useRef, useState } from "react";
 import {
   Menu,
   MenuButton,
@@ -91,28 +91,61 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
       },
     });
 
-  // Bumped to remount every VoteControl, which owns its own optimistic state.
-  // Only needed when a vote fails and that local state has to resync with the
-  // server; a successful vote needs no refetch, so the thread never reflows.
-  const [voteResetKey, setVoteResetKey] = useState(0);
-
-  const { mutate: vote } = api.discussion.vote.useMutation({
-    async onError() {
-      toast.error("Something went wrong, try again.");
-      // Refetch BEFORE remounting: the controls seed their state on mount, so
-      // bumping the key first would reseed them from the pre-vote cache and
-      // strand every earlier successful vote showing its old count.
-      await refetch();
-      setVoteResetKey((key) => key + 1);
+  // VoteControl owns its own optimistic state, so a failed vote has to be told
+  // to resync. Bumping this comment's key remounts just that control, which
+  // reseeds from the cache — which never saw the failed vote, so it is the
+  // truth. Keyed per comment so one failure cannot discard the optimistic state
+  // of votes on other comments (or ones still in flight).
+  const [voteResetKeys, setVoteResetKeys] = useState<Record<string, number>>(
+    {},
+  );
+
+  const { mutateAsync: vote } = api.discussion.vote.useMutation({
+    onError(error, variables) {
+      toast.error(error.message || "Something went wrong, try again.");
+      setVoteResetKeys((keys) => ({
+        ...keys,
+        [variables.discussionId]: (keys[variables.discussionId] ?? 0) + 1,
+      }));
     },
   });
 
+  // One request in flight per comment, with the newest click replacing any
+  // queued one. Without this, double-clicking an arrow fires two overlapping
+  // requests whose writes can land in either order, leaving the stored vote
+  // disagreeing with what the reader sees — and burning rate-limit budget.
+  const voteQueues = useRef(
+    new Map<string, { running: boolean; next?: "up" | "down" | null }>(),
+  );
+
+  const drainVotes = async (discussionId: string) => {
+    const queue = voteQueues.current.get(discussionId);
+    if (!queue || queue.running) return;
+
+    queue.running = true;
+    while (queue.next !== undefined) {
+      const voteType = queue.next;
+      queue.next = undefined;
+      try {
+        await vote({ discussionId, voteType });
+      } catch {
+        // onError has already reported and resynced this comment; drop
+        // whatever was queued behind the failure rather than replaying it.
+        break;
+      }
+    }
+    queue.running = false;
+  };
+
   const voteDiscussion = (
     discussionId: string,
     voteType: "up" | "down" | null,
   ) => {
     if (!session) return signIn();
-    vote({ discussionId, voteType });
+    const queue = voteQueues.current.get(discussionId) ?? { running: false };
+    queue.next = voteType;
+    voteQueues.current.set(discussionId, queue);
+    void drainVotes(discussionId);
   };
 
   const discussions = discussionsResponse?.data;
@@ -135,71 +168,18 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
   type Discussions = typeof discussions;
   type Children = typeof firstChild;
 
-  // "Top" ranks by score, but re-ranking on every vote makes comments jump
-  // around while somebody is reading them. So each comment's sort score is
-  // frozen the first time we see it and reused from then on: the thread still
-  // reorders by votes, it just does it on the next load instead of mid-read.
-  // (The date-based sorts need no freezing — createdAt never changes.)
-  //
-  // The trade-off is deliberate: a tab left open for hours keeps the ranking it
-  // loaded with, even after other people's votes arrive with a later refetch.
-  // Re-picking the sort below drops the snapshot, so a reader who wants the
-  // current ranking has one click to get it.
-  const frozenSortScores = useRef(new Map<string, number>());
-  const frozenForSort = useRef<SortOrder>(sortOrder);
-
-  // Minimal shape the tree walkers below need, so they can recurse without
-  // depending on the full inferred tRPC comment type.
-  type ScoredNode = { id: string; score: number; children?: ScoredNode[] };
-
-  // Identity of the comment *set*, which changes only when comments are added
-  // or removed — not when their scores change. Drives the capture below.
-  const commentSetKey = useMemo(() => {
-    const ids: string[] = [];
-    const collect = (items: ScoredNode[] | undefined) => {
-      items?.forEach((item) => {
-        ids.push(item.id);
-        collect(item.children);
-      });
-    };
-    collect(discussions as ScoredNode[] | undefined);
-    return ids.join(",");
-  }, [discussions]);
-
-  const sortScores = useMemo(() => {
-    // Re-picking a sort is a deliberate "show me the current ranking", so let
-    // that re-rank from live scores. Passive vote traffic must not.
-    if (frozenForSort.current !== sortOrder) {
-      frozenForSort.current = sortOrder;
-      frozenSortScores.current.clear();
-    }
-    const captured = frozenSortScores.current;
-    const capture = (items: ScoredNode[] | undefined) => {
-      items?.forEach((item) => {
-        if (!captured.has(item.id)) captured.set(item.id, item.score);
-        capture(item.children);
-      });
-    };
-    capture(discussions as ScoredNode[] | undefined);
-    return new Map(captured);
-    // Intentionally keyed on the comment set rather than `discussions` itself:
-    // a score changing must NOT re-capture, or the freeze does nothing.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [commentSetKey, sortOrder]);
-
+  // Ordering is derived from `discussions`, so it only changes when that data
+  // changes. A successful vote deliberately does not refetch (see the mutation
+  // above), which is what stops a liked comment from re-ranking under the
+  // reader — the new count lives in VoteControl until the next load.
   const sortDiscussions = (
     items: Discussions | Children | undefined,
   ): typeof items => {
     if (!items) return items;
+    // Array#sort is stable, so equal scores keep the server's order.
     const sorted = [...items].sort((a, b) => {
       if (sortOrder === "top") {
-        const scoreDiff =
-          (sortScores.get(b.id) ?? b.score) - (sortScores.get(a.id) ?? a.score);
-        if (scoreDiff !== 0) return scoreDiff;
-        // Newest-first within a score tie, so ordering stays deterministic.
-        return (
-          new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()
-        );
+        return b.score - a.score;
       }
       if (sortOrder === "oldest") {
         return (
@@ -432,7 +412,7 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
 
                   <div className="mt-2 flex items-center gap-2">
                     <VoteControl
-                      key={`${id}-${voteResetKey}`}
+                      key={`${id}-${voteResetKeys[id] ?? 0}`}
                       base={
                         score -
                         (userVote === "up" ? 1 : userVote === "down" ? -1 : 0)
diff --git a/server/api/router/admin.ts b/server/api/router/admin.ts
index 5431f0f3a..13e77f94e 100644
--- a/server/api/router/admin.ts
+++ b/server/api/router/admin.ts
@@ -205,19 +205,15 @@ export const adminRouter = createTRPCRouter({
 
   // Auto-moderation queue: posts awaiting human review (status `in_review`).
   // `moderationNote` surfaces WHY a post was flagged (auto-mod reason, etc.).
-  // `excerpt` gives a moderator a first impression in the queue itself, while
-  // `type` and `externalUrl` decide where its Preview link points: /d/{slug}
-  // for discussions and questions, the linked page for shared links, and
-  // /{user}/{slug} for everything the site renders itself.
+  // `excerpt` gives a moderator a first impression in the queue itself; the
+  // full read happens on the preview page, which loads the post by id.
   listInReview: adminOnlyProcedure.query(async ({ ctx }) => {
     const rows = await ctx.db
       .select({
         id: posts.id,
         title: posts.title,
         slug: posts.slug,
-        type: posts.type,
         excerpt: posts.excerpt,
-        externalUrl: posts.externalUrl,
         authorId: posts.authorId,
         authorUsername: user.username,
         authorName: user.name,
diff --git a/server/lib/postVisibility.test.ts b/server/lib/postVisibility.test.ts
deleted file mode 100644
index fb699d229..000000000
--- a/server/lib/postVisibility.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { postVisibilityFilter } from "./postVisibility";
-
-const dialect = new PgDialect();
-
-// Statuses and ids are bound as parameters, so the interesting assertions are
-// about which values a viewer's filter binds, not the SQL text.
-const render = (viewer: Parameters<typeof postVisibilityFilter>[0]) => {
-  const { sql, params } = dialect.sqlToQuery(postVisibilityFilter(viewer));
-  return {
-    sql,
-    params,
-    scopesToAuthor: sql.includes('"author_id" = '),
-    allowsUnpublished:
-      params.includes("in_review") && params.includes("rejected"),
-  };
-};
-
-describe("postVisibilityFilter", () => {
-  it("shows an anonymous viewer only live posts", () => {
-    const filter = render({});
-
-    expect(filter.params).toContain("published");
-    expect(filter.sql).toContain('"published_at" <= ');
-    expect(filter.allowsUnpublished).toBe(false);
-  });
-
-  it("lets a signed-in viewer see unpublished posts only when they wrote them", () => {
-    const filter = render({ viewerId: "viewer-1" });
-
-    expect(filter.allowsUnpublished).toBe(true);
-    // The author predicate is what stops one member reading another's drafts.
-    expect(filter.scopesToAuthor).toBe(true);
-    expect(filter.params).toContain("viewer-1");
-  });
-
-  it("lets an admin see unpublished posts by any author", () => {
-    const filter = render({ viewerId: "admin-1", viewerIsAdmin: true });
-
-    expect(filter.allowsUnpublished).toBe(true);
-    expect(filter.scopesToAuthor).toBe(false);
-  });
-
-  it("does not grant the admin bypass on a plain signed-in session", () => {
-    const admin = render({ viewerId: "admin-1", viewerIsAdmin: true });
-    const member = render({ viewerId: "admin-1" });
-
-    expect(member.sql).not.toEqual(admin.sql);
-    expect(member.scopesToAuthor).toBe(true);
-  });
-
-  it("never exposes drafts, whoever is looking", () => {
-    for (const viewer of [
-      {},
-      { viewerId: "viewer-1" },
-      { viewerId: "admin-1", viewerIsAdmin: true },
-    ]) {
-      expect(render(viewer).params).not.toContain("draft");
-    }
-  });
-});
diff --git a/server/lib/postVisibility.ts b/server/lib/postVisibility.ts
deleted file mode 100644
index 55b4d72f7..000000000
--- a/server/lib/postVisibility.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import { and, eq, inArray, lte, or, type SQL } from "drizzle-orm";
-import { posts } from "@/server/db/schema";
-
-/**
- * Who is allowed to see a post that is not live yet.
- *
- * Every reader resolver applies the same rule, so it lives here rather than
- * being restated per route: a post is visible when it is published and its
- * publish time has passed, OR it is awaiting/failed review and the viewer is
- * either its author or an admin. Admins get the author's view so the moderation
- * queue can link straight to a full preview of a post it is asking them to
- * approve.
- *
- * Callers that already pin an author in their WHERE (the /{username}/{slug}
- * resolvers) still get the right answer: the extra authorId predicate here is
- * simply redundant with theirs.
- */
-export function postVisibilityFilter(viewer: {
-  viewerId?: string | null;
-  viewerIsAdmin?: boolean;
-}): SQL {
-  const live = and(
-    eq(posts.status, "published"),
-    lte(posts.publishedAt, new Date().toISOString()),
-  )!;
-
-  const notLiveYet = inArray(posts.status, ["in_review", "rejected"]);
-
-  if (viewer.viewerIsAdmin) {
-    return or(live, notLiveYet)!;
-  }
-
-  if (viewer.viewerId) {
-    return or(live, and(notLiveYet, eq(posts.authorId, viewer.viewerId)))!;
-  }
-
-  return live;
-}
diff --git a/server/lib/url.test.ts b/server/lib/url.test.ts
index d5246bd41..83a3f0b58 100644
--- a/server/lib/url.test.ts
+++ b/server/lib/url.test.ts
@@ -1,31 +1,81 @@
 import { describe, it, expect, afterEach } from "vitest";
 import { getAppOrigin } from "./url";
+import { SITE_ORIGIN } from "@/config/site";
 
 const save = { ...process.env };
 afterEach(() => {
   process.env = { ...save };
 });
 
+const clearEnv = () => {
+  delete process.env.DOMAIN_NAME;
+  delete process.env.VERCEL_ENV;
+  delete process.env.VERCEL_URL;
+  delete process.env.VERCEL_PROJECT_PRODUCTION_URL;
+  delete process.env.NEXTAUTH_URL;
+  delete process.env.AUTH_URL;
+};
+
 describe("getAppOrigin", () => {
   it("strips a path like /api/auth from NEXTAUTH_URL", () => {
-    delete process.env.DOMAIN_NAME;
-    delete process.env.VERCEL_URL;
+    clearEnv();
     process.env.NEXTAUTH_URL = "http://localhost:3000/api/auth";
     expect(getAppOrigin()).toBe("http://localhost:3000");
   });
+
   it("prefers DOMAIN_NAME as https origin", () => {
+    clearEnv();
     process.env.DOMAIN_NAME = "www.codu.co";
     expect(getAppOrigin()).toBe("https://www.codu.co");
   });
+
   it("handles DOMAIN_NAME that already includes scheme", () => {
+    clearEnv();
     process.env.DOMAIN_NAME = "https://www.codu.co";
     expect(getAppOrigin()).toBe("https://www.codu.co");
   });
+
   it("falls back to localhost", () => {
-    delete process.env.DOMAIN_NAME;
-    delete process.env.VERCEL_URL;
-    delete process.env.NEXTAUTH_URL;
-    delete process.env.AUTH_URL;
+    clearEnv();
     expect(getAppOrigin()).toBe("http://localhost:3000");
   });
+
+  // The bug: VERCEL_URL is the per-deployment hostname and Vercel sets it in
+  // production too, so emails went out pointing at *.vercel.app.
+  it("never uses the per-deployment URL on a production deploy", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "production";
+    process.env.VERCEL_URL = "codu-a1b2c3.vercel.app";
+    process.env.VERCEL_PROJECT_PRODUCTION_URL = "www.codu.co";
+    expect(getAppOrigin()).toBe("https://www.codu.co");
+  });
+
+  it("falls back to the canonical origin if the production domain is unset", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "production";
+    process.env.VERCEL_URL = "codu-a1b2c3.vercel.app";
+    expect(getAppOrigin()).toBe(SITE_ORIGIN);
+  });
+
+  it("still uses the deployment URL on a preview deploy", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "preview";
+    process.env.VERCEL_URL = "codu-a1b2c3.vercel.app";
+    process.env.VERCEL_PROJECT_PRODUCTION_URL = "www.codu.co";
+    expect(getAppOrigin()).toBe("https://codu-a1b2c3.vercel.app");
+  });
+
+  it("lets DOMAIN_NAME override even in production", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "production";
+    process.env.VERCEL_PROJECT_PRODUCTION_URL = "www.codu.co";
+    process.env.DOMAIN_NAME = "staging.codu.co";
+    expect(getAppOrigin()).toBe("https://staging.codu.co");
+  });
+
+  it("tolerates a trailing slash", () => {
+    clearEnv();
+    process.env.DOMAIN_NAME = "https://www.codu.co/";
+    expect(getAppOrigin()).toBe("https://www.codu.co");
+  });
 });
diff --git a/server/lib/url.ts b/server/lib/url.ts
index de1e72228..a0d3d78f9 100644
--- a/server/lib/url.ts
+++ b/server/lib/url.ts
@@ -1,11 +1,34 @@
+import { SITE_ORIGIN } from "@/config/site";
+
 /**
  * The app's public origin (scheme + host, NO path). Use for app-facing links in
- * emails. NEXTAUTH_URL carries a /api/auth path which must be stripped — using it
- * directly produced .../api/auth/admin/moderation (bug).
+ * emails.
+ *
+ * Precedence matters, because two of these are per-deployment values:
+ *
+ * - DOMAIN_NAME is the explicit override; it wins everywhere.
+ * - On a Vercel PRODUCTION deploy the origin must be the project's production
+ *   domain. VERCEL_URL is NOT that — it is the unique per-deployment hostname
+ *   (`codu-a1b2c3.vercel.app`) and Vercel sets it in production too, so
+ *   preferring it there mailed people deployment URLs instead of codu.co.
+ * - VERCEL_URL is still right for PREVIEW deploys, where a link should point
+ *   back at the deployment that sent it.
+ * - NEXTAUTH_URL carries an /api/auth path which must be stripped — using it
+ *   directly produced .../api/auth/admin/moderation (bug).
  */
 export function getAppOrigin(): string {
-  const domain = process.env.DOMAIN_NAME || process.env.VERCEL_URL;
-  if (domain) return `https://${domain.replace(/^https?:\/\//, "")}`;
+  const explicit = process.env.DOMAIN_NAME;
+  if (explicit) return toOrigin(explicit);
+
+  if (process.env.VERCEL_ENV === "production") {
+    // Set by Vercel to the project's production domain in every environment.
+    const productionDomain = process.env.VERCEL_PROJECT_PRODUCTION_URL;
+    return productionDomain ? toOrigin(productionDomain) : SITE_ORIGIN;
+  }
+
+  const deployment = process.env.VERCEL_URL;
+  if (deployment) return toOrigin(deployment);
+
   const raw = process.env.NEXTAUTH_URL || process.env.AUTH_URL;
   if (raw) {
     try {
@@ -16,3 +39,8 @@ export function getAppOrigin(): string {
   }
   return "http://localhost:3000";
 }
+
+// Env values arrive both bare (`www.codu.co`) and with a scheme.
+function toOrigin(domain: string): string {
+  return `https://${domain.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
+}
diff --git a/utils/emailToken.ts b/utils/emailToken.ts
index ec35ec344..b7555f5f9 100644
--- a/utils/emailToken.ts
+++ b/utils/emailToken.ts
@@ -3,20 +3,14 @@ import { user } from "@/server/db/schema";
 import crypto from "crypto";
 import sendEmail from "./sendEmail";
 import { eq } from "drizzle-orm";
-
-function getBaseUrl() {
-  if (typeof window !== "undefined") return "";
-  const env = process.env.DOMAIN_NAME || process.env.VERCEL_URL;
-  if (env) return "https://" + env;
-  return "http://localhost:3000";
-}
+import { getAppOrigin } from "@/server/lib/url";
 
 export const generateEmailToken = () => {
   return crypto.randomBytes(64).toString("hex");
 };
 
 export const sendVerificationEmail = async (email: string, token: string) => {
-  const verificationLink = `${getBaseUrl()}/verify-email?token=${token}`;
+  const verificationLink = `${getAppOrigin()}/verify-email?token=${token}`;
   const subject = "Confirm your email — one tap and you're in";
   const htmlMessage = `
     <!DOCTYPE html>

From 7037484059352bc8492c640c53f72c7a2dfdc318 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 08:47:21 +0100
Subject: [PATCH 02/10] fix: address review of the consolidated fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review of #1344 found nine issues, three of them mine from the previous
round.

Draft exposure (the serious one): the new preview route loaded any post
by id with no status predicate, so an admin with a post id could read a
member's private, never-submitted draft. It is now restricted to work
that actually entered the pipeline — published, in_review, rejected — and
`postVisibility.ts` is back, minus the admin bypass, carrying tests for
both rules including "never exposes a draft, whoever is looking".
Deleting that module was never required to drop the bypass, and doing so
had also left the same rule inlined twice in two different shapes.

Failed votes stranded earlier ones: I removed the pre-remount refetch on
the reasoning that the cache never saw the failed vote. That is true of
the failed vote but not of earlier successful ones, which never refetch
by design — so remounting reseeded the control from a cache that predates
them. The refetch is back, before the key bump.

Comment ordering on ties was arbitrary: the "Top" comparator leaned on
sort stability to keep "the server's order", but the server orders by
ltree path, built from a random uuid. On a thread where most scores are
0, that is no order at all. Ties now sort oldest-first, so Top degrades
to chronological rather than to a copy of New.

Reordering under the reader: with the score snapshot gone, a window-focus
refetch could re-rank the thread mid-read. That query no longer refetches
on focus; the explicit refetches after create/edit/delete stay, since
those follow something the reader did.

Also: raw tRPC error text could reach the vote toast (only the rate-limit
message, which is written for readers, is surfaced now); a malformed post
id 500'd on the uuid cast instead of 404ing; the preview's two queries ran
serially when both key off the route param; and a fork deploying to
production without VERCEL_PROJECT_PRODUCTION_URL got codu.co hardcoded
over its own configured NEXTAUTH_URL.
---
 .../moderation/preview/[postId]/page.tsx      | 66 +++++++++-------
 app/(app)/[username]/[slug]/page.tsx          | 20 +----
 app/(app)/d/[slug]/page.tsx                   | 20 +----
 components/Discussion/DiscussionArea.tsx      | 40 ++++++++--
 server/lib/postVisibility.test.ts             | 76 +++++++++++++++++++
 server/lib/postVisibility.ts                  | 52 +++++++++++++
 server/lib/url.test.ts                        | 10 +++
 server/lib/url.ts                             | 17 +++--
 8 files changed, 226 insertions(+), 75 deletions(-)
 create mode 100644 server/lib/postVisibility.test.ts
 create mode 100644 server/lib/postVisibility.ts

diff --git a/app/(admin)/admin/moderation/preview/[postId]/page.tsx b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
index 3c2caf367..534205078 100644
--- a/app/(admin)/admin/moderation/preview/[postId]/page.tsx
+++ b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
@@ -1,12 +1,14 @@
 import Link from "next/link";
 import { notFound } from "next/navigation";
 import { ArrowLeftIcon } from "@heroicons/react/24/outline";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
+import z from "zod";
 import { db } from "@/server/db";
 import { posts, user, post_tags, tag } from "@/server/db/schema";
 import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
 import { getCamelCaseFromLower } from "@/utils/utils";
 import { safeExternalHref } from "@/utils/url";
+import { moderationPreviewFilter } from "@/server/lib/postVisibility";
 
 export const metadata = {
   title: "Preview - Codú Admin",
@@ -29,39 +31,47 @@ type Props = { params: Promise<{ postId: string }> };
 export default async function Page({ params }: Props) {
   const { postId } = await params;
 
-  const [record] = await db
-    .select({
-      id: posts.id,
-      title: posts.title,
-      body: posts.body,
-      excerpt: posts.excerpt,
-      type: posts.type,
-      status: posts.status,
-      slug: posts.slug,
-      externalUrl: posts.externalUrl,
-      coverImage: posts.coverImage,
-      readingTime: posts.readingTime,
-      createdAt: posts.createdAt,
-      moderationNote: posts.moderationNote,
-      authorName: user.name,
-      authorUsername: user.username,
-    })
-    .from(posts)
-    .leftJoin(user, eq(posts.authorId, user.id))
-    .where(eq(posts.id, postId))
-    .limit(1);
+  // posts.id is a uuid column, so a mistyped or truncated id would make
+  // Postgres throw a cast error (a 500) before the not-found check below.
+  if (!z.string().uuid().safeParse(postId).success) notFound();
 
+  const [rows, tags] = await Promise.all([
+    db
+      .select({
+        id: posts.id,
+        title: posts.title,
+        body: posts.body,
+        excerpt: posts.excerpt,
+        type: posts.type,
+        status: posts.status,
+        slug: posts.slug,
+        externalUrl: posts.externalUrl,
+        coverImage: posts.coverImage,
+        readingTime: posts.readingTime,
+        createdAt: posts.createdAt,
+        moderationNote: posts.moderationNote,
+        authorName: user.name,
+        authorUsername: user.username,
+      })
+      .from(posts)
+      .leftJoin(user, eq(posts.authorId, user.id))
+      // Submitted work only. A moderator has business reading anything that
+      // entered the pipeline; a private draft is not that.
+      .where(and(eq(posts.id, postId), moderationPreviewFilter()))
+      .limit(1),
+    db
+      .select({ title: tag.title, slug: tag.slug })
+      .from(post_tags)
+      .innerJoin(tag, eq(post_tags.tagId, tag.id))
+      .where(eq(post_tags.postId, postId)),
+  ]);
+
+  const record = rows[0];
   if (!record) notFound();
 
   const renderedBody = renderPostBody(record.body);
   const externalHref = safeExternalHref(record.externalUrl);
 
-  const tags = await db
-    .select({ title: tag.title, slug: tag.slug })
-    .from(post_tags)
-    .innerJoin(tag, eq(post_tags.tagId, tag.id))
-    .where(eq(post_tags.postId, record.id));
-
   return (
     <div className="mx-auto max-w-3xl px-0 py-4 sm:px-4 sm:py-8">
       <div className="mb-6 flex items-center gap-4">
diff --git a/app/(app)/[username]/[slug]/page.tsx b/app/(app)/[username]/[slug]/page.tsx
index b6e6f8e82..b715aad9e 100644
--- a/app/(app)/[username]/[slug]/page.tsx
+++ b/app/(app)/[username]/[slug]/page.tsx
@@ -6,10 +6,11 @@ import { type Metadata } from "next";
 import { SITE_ORIGIN } from "@/config/site";
 import { db } from "@/server/db";
 import { posts, user, feed_sources, post_tags, tag } from "@/server/db/schema";
-import { eq, and, lte, inArray, or, sql } from "drizzle-orm";
+import { eq, and, lte, inArray, sql } from "drizzle-orm";
 import UserLinkDetail from "./_userLinkDetail";
 import PostReader from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
+import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { serverApi } from "@/server/trpc/caller";
 import { JsonLd } from "@/components/JsonLd";
 import { getArticleSchema, getBreadcrumbSchema } from "@/lib/structured-data";
@@ -40,22 +41,7 @@ async function getUserPostUncached(
 
   if (!userRecord) return null;
 
-  // Owner bypass: the author may view their own in_review/rejected post;
-  // everyone else only sees published posts whose publish time has passed.
-  const isAuthor = !!viewerId && viewerId === userRecord.id;
-
-  const visibilityFilter = isAuthor
-    ? or(
-        and(
-          eq(posts.status, "published"),
-          lte(posts.publishedAt, new Date().toISOString()),
-        ),
-        inArray(posts.status, ["in_review", "rejected"]),
-      )
-    : and(
-        eq(posts.status, "published"),
-        lte(posts.publishedAt, new Date().toISOString()),
-      );
+  const visibilityFilter = postVisibilityFilter({ viewerId });
 
   const postResults = await db
     .select({
diff --git a/app/(app)/d/[slug]/page.tsx b/app/(app)/d/[slug]/page.tsx
index a7bddbc3b..2789f95c7 100644
--- a/app/(app)/d/[slug]/page.tsx
+++ b/app/(app)/d/[slug]/page.tsx
@@ -7,11 +7,12 @@ import { ogPostImage } from "@/lib/og/url";
 import { getServerAuthSession } from "@/server/auth";
 import { db } from "@/server/db";
 import { posts, user, post_tags, tag, comments } from "@/server/db/schema";
-import { eq, and, lte, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
+import { eq, and, inArray, or, isNull, asc, type SQL } from "drizzle-orm";
 import PostReader, {
   type ReaderPost,
 } from "@/components/ContentDetail/PostReader";
 import { parseUrlId, canonicalMismatch } from "@/server/lib/content-url";
+import { postVisibilityFilter } from "@/server/lib/postVisibility";
 import { JsonLd } from "@/components/JsonLd";
 import {
   getDiscussionForumPostingSchema,
@@ -37,13 +38,6 @@ async function getDiscussionPostUncached(
       ? eq(posts.urlId, urlId)
       : or(eq(posts.urlId, urlId), eq(posts.slug, slug))!;
 
-  const publicFilter = and(
-    eq(posts.status, "published"),
-    lte(posts.publishedAt, new Date().toISOString()),
-  );
-
-  // Owner bypass: the author may view their own in_review/rejected discussion;
-  // everyone else only sees published.
   const [row] = await db
     .select({
       id: posts.id,
@@ -73,15 +67,7 @@ async function getDiscussionPostUncached(
       and(
         idMatch,
         inArray(posts.type, ["discussion", "question"]),
-        viewerId
-          ? or(
-              publicFilter,
-              and(
-                eq(posts.authorId, viewerId),
-                inArray(posts.status, ["in_review", "rejected"]),
-              ),
-            )
-          : publicFilter,
+        postVisibilityFilter({ viewerId }),
       ),
     )
     .limit(1);
diff --git a/components/Discussion/DiscussionArea.tsx b/components/Discussion/DiscussionArea.tsx
index 65508a2c0..592270e58 100644
--- a/components/Discussion/DiscussionArea.tsx
+++ b/components/Discussion/DiscussionArea.tsx
@@ -75,9 +75,18 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
     data: discussionsResponse,
     refetch,
     status: discussionStatus,
-  } = api.discussion.get.useQuery({
-    contentId,
-  });
+  } = api.discussion.get.useQuery(
+    { contentId },
+    {
+      // "Top" ranks by score, so any refetch can re-rank the thread. Refetching
+      // on window focus would do that to someone who just tabbed back mid-read,
+      // which is the jumping this component is trying to avoid. The explicit
+      // refetches after create/edit/delete stay — those follow an action the
+      // reader took, so a reflow there is expected.
+      refetchOnWindowFocus: false,
+      staleTime: 60_000,
+    },
+  );
 
   const { mutate, status: createDiscussionStatus } =
     api.discussion.create.useMutation({
@@ -101,8 +110,18 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
   );
 
   const { mutateAsync: vote } = api.discussion.vote.useMutation({
-    onError(error, variables) {
-      toast.error(error.message || "Something went wrong, try again.");
+    async onError(error, variables) {
+      // Rate limiting is the one failure whose message is written for readers;
+      // anything else can carry driver/schema text, so keep it generic.
+      toast.error(
+        error.data?.code === "TOO_MANY_REQUESTS"
+          ? error.message
+          : "Something went wrong, try again.",
+      );
+      // Refetch BEFORE remounting. A successful vote does not refetch, so the
+      // cache can be behind by any votes cast this session; reseeding a control
+      // from it without refreshing first would strand those showing old counts.
+      await refetch();
       setVoteResetKeys((keys) => ({
         ...keys,
         [variables.discussionId]: (keys[variables.discussionId] ?? 0) + 1,
@@ -176,10 +195,17 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
     items: Discussions | Children | undefined,
   ): typeof items => {
     if (!items) return items;
-    // Array#sort is stable, so equal scores keep the server's order.
     const sorted = [...items].sort((a, b) => {
       if (sortOrder === "top") {
-        return b.score - a.score;
+        if (b.score !== a.score) return b.score - a.score;
+        // Ties need an explicit order: the server sorts by ltree path, which is
+        // built from a random uuid, so leaning on sort stability would leave
+        // equal-score comments (most of a young thread) in arbitrary order.
+        // Oldest first, so "Top" degrades to chronological rather than to a
+        // copy of "New", and a fresh comment lands somewhere predictable.
+        return (
+          new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime()
+        );
       }
       if (sortOrder === "oldest") {
         return (
diff --git a/server/lib/postVisibility.test.ts b/server/lib/postVisibility.test.ts
new file mode 100644
index 000000000..5c2382a04
--- /dev/null
+++ b/server/lib/postVisibility.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it } from "vitest";
+import { PgDialect } from "drizzle-orm/pg-core";
+import {
+  moderationPreviewFilter,
+  postVisibilityFilter,
+  NON_DRAFT_STATUSES,
+} from "./postVisibility";
+
+const dialect = new PgDialect();
+
+// Statuses and ids bind as parameters, so the interesting assertions are about
+// which values a viewer's filter binds, not the SQL text.
+const render = (filter: ReturnType<typeof postVisibilityFilter>) => {
+  const { sql, params } = dialect.sqlToQuery(filter);
+  return {
+    sql,
+    params,
+    scopesToAuthor: sql.includes('"author_id" = '),
+    allowsUnpublished:
+      params.includes("in_review") && params.includes("rejected"),
+  };
+};
+
+describe("postVisibilityFilter", () => {
+  it("shows an anonymous viewer only live posts", () => {
+    const filter = render(postVisibilityFilter({}));
+
+    expect(filter.params).toContain("published");
+    expect(filter.sql).toContain('"published_at" <= ');
+    expect(filter.allowsUnpublished).toBe(false);
+  });
+
+  it("lets a signed-in viewer see unpublished posts only when they wrote them", () => {
+    const filter = render(postVisibilityFilter({ viewerId: "viewer-1" }));
+
+    expect(filter.allowsUnpublished).toBe(true);
+    // The author predicate is what stops one member reading another's drafts.
+    expect(filter.scopesToAuthor).toBe(true);
+    expect(filter.params).toContain("viewer-1");
+  });
+
+  // Admins read submissions through the moderation preview, not by resolving
+  // them on the public routes — so being an admin buys nothing here.
+  it("has no admin bypass: the rule depends only on who wrote the post", () => {
+    const anonymous = render(postVisibilityFilter({}));
+    const member = render(postVisibilityFilter({ viewerId: "admin-1" }));
+
+    expect(member.scopesToAuthor).toBe(true);
+    expect(member.sql).not.toEqual(anonymous.sql);
+  });
+
+  it("never exposes drafts, whoever is looking", () => {
+    for (const viewer of [{}, { viewerId: "viewer-1" }]) {
+      expect(render(postVisibilityFilter(viewer)).params).not.toContain(
+        "draft",
+      );
+    }
+  });
+});
+
+describe("moderationPreviewFilter", () => {
+  it("covers everything that has been submitted", () => {
+    const { params } = dialect.sqlToQuery(moderationPreviewFilter());
+
+    expect(params).toContain("in_review");
+    expect(params).toContain("rejected");
+    expect(params).toContain("published");
+  });
+
+  it("never exposes a private draft to a moderator", () => {
+    const { params } = dialect.sqlToQuery(moderationPreviewFilter());
+
+    expect(params).not.toContain("draft");
+    expect(NON_DRAFT_STATUSES).not.toContain("draft");
+  });
+});
diff --git a/server/lib/postVisibility.ts b/server/lib/postVisibility.ts
new file mode 100644
index 000000000..a38c19293
--- /dev/null
+++ b/server/lib/postVisibility.ts
@@ -0,0 +1,52 @@
+import { and, eq, inArray, lte, or, type SQL } from "drizzle-orm";
+import { posts } from "@/server/db/schema";
+
+/**
+ * Statuses a post can be in and still be readable by someone other than its
+ * author. `draft` is deliberately absent: a draft is private work in progress,
+ * and nothing — not the public reader, not the moderation preview — should
+ * surface one to anybody else.
+ */
+export const NON_DRAFT_STATUSES = [
+  "published",
+  "in_review",
+  "rejected",
+] as const;
+
+/**
+ * Who may see a post on the public reader routes.
+ *
+ * A post is visible when it is published and its publish time has passed, OR it
+ * is awaiting/failed review and the viewer wrote it. Admins get no bypass here:
+ * moderators read submissions through /admin/moderation/preview/{id}, so the
+ * public routes mean the same thing for everyone.
+ *
+ * Callers that already pin an author in their WHERE (the /{username}/{slug}
+ * resolvers) still get the right answer: the authorId predicate here is simply
+ * redundant with theirs.
+ */
+export function postVisibilityFilter(viewer: {
+  viewerId?: string | null;
+}): SQL {
+  const live = and(
+    eq(posts.status, "published"),
+    lte(posts.publishedAt, new Date().toISOString()),
+  )!;
+
+  const notLiveYet = inArray(posts.status, ["in_review", "rejected"]);
+
+  if (viewer.viewerId) {
+    return or(live, and(notLiveYet, eq(posts.authorId, viewer.viewerId)))!;
+  }
+
+  return live;
+}
+
+/**
+ * Which posts a moderator may open in the review preview. Everything that has
+ * been submitted — queued, already rejected, or live and since reported — but
+ * never a private draft.
+ */
+export function moderationPreviewFilter(): SQL {
+  return inArray(posts.status, [...NON_DRAFT_STATUSES]);
+}
diff --git a/server/lib/url.test.ts b/server/lib/url.test.ts
index 83a3f0b58..66d0e734c 100644
--- a/server/lib/url.test.ts
+++ b/server/lib/url.test.ts
@@ -57,6 +57,16 @@ describe("getAppOrigin", () => {
     expect(getAppOrigin()).toBe(SITE_ORIGIN);
   });
 
+  // A fork deploying to production without VERCEL_PROJECT_PRODUCTION_URL must
+  // not have its verification links point at codu.co.
+  it("prefers a configured auth origin over the canonical one in production", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "production";
+    process.env.VERCEL_URL = "fork-a1b2c3.vercel.app";
+    process.env.NEXTAUTH_URL = "https://myfork.example/api/auth";
+    expect(getAppOrigin()).toBe("https://myfork.example");
+  });
+
   it("still uses the deployment URL on a preview deploy", () => {
     clearEnv();
     process.env.VERCEL_ENV = "preview";
diff --git a/server/lib/url.ts b/server/lib/url.ts
index a0d3d78f9..2288fb1f2 100644
--- a/server/lib/url.ts
+++ b/server/lib/url.ts
@@ -20,15 +20,19 @@ export function getAppOrigin(): string {
   const explicit = process.env.DOMAIN_NAME;
   if (explicit) return toOrigin(explicit);
 
-  if (process.env.VERCEL_ENV === "production") {
+  const isProduction = process.env.VERCEL_ENV === "production";
+
+  if (isProduction) {
     // Set by Vercel to the project's production domain in every environment.
     const productionDomain = process.env.VERCEL_PROJECT_PRODUCTION_URL;
-    return productionDomain ? toOrigin(productionDomain) : SITE_ORIGIN;
+    if (productionDomain) return toOrigin(productionDomain);
+  } else {
+    const deployment = process.env.VERCEL_URL;
+    if (deployment) return toOrigin(deployment);
   }
 
-  const deployment = process.env.VERCEL_URL;
-  if (deployment) return toOrigin(deployment);
-
+  // A configured auth origin comes before the hardcoded one so a fork that
+  // sets NEXTAUTH_URL is never sent to codu.co.
   const raw = process.env.NEXTAUTH_URL || process.env.AUTH_URL;
   if (raw) {
     try {
@@ -37,7 +41,8 @@ export function getAppOrigin(): string {
       /* fall through */
     }
   }
-  return "http://localhost:3000";
+
+  return isProduction ? SITE_ORIGIN : "http://localhost:3000";
 }
 
 // Env values arrive both bare (`www.codu.co`) and with a scheme.

From 97df7e7e8b13f71f937f2a6a32bf7cc82369abdf Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 15:26:22 +0100
Subject: [PATCH 03/10] ci(e2e): serve a production build instead of the dev
 server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The suite has been failing on CI while staying green locally: 19 failures
spread across admin navigation, the editor publish flow, bookmarking, the
feed sidebar and moderation. Identical failures on develop and on every
branch off it, so nothing in the feature work caused them.

They all share a cause. Playwright's webServer ran `next dev`, so the
first request to each route blocked on an on-demand Turbopack compile.
Locally that is under a second; on a cold runner with three workers
compiling at once it outlasts the 10s expect timeout — hence assertions
like `toHaveURL(/admin/users)` polling 13 times and giving up while the
navigation was still compiling.

CI now builds once and serves it. Measured on the same machine, a cold
route costs ~0.7-1.2s under `next dev` and ~0.02-0.03s prebuilt.

Local runs keep `next dev` for the fast feedback loop.

EMAIL_AUTH_ENABLED is set for the job because a production build runs with
NODE_ENV=production, which would otherwise disable the passwordless
provider that dev turns on implicitly.
---
 .github/workflows/e2e-tests.yml |  9 +++++++++
 package.json                    |  2 ++
 playwright.config.ts            | 13 +++++++++++--
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 79da92312..2f717b29d 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -41,6 +41,9 @@ jobs:
     env:
       DATABASE_URL: "postgresql://postgres:secret@localhost:5432/postgres"
       NEXTAUTH_URL: http://localhost:3000/api/auth
+      # A production build sets NODE_ENV=production, which would otherwise turn
+      # off the passwordless provider that dev enables implicitly.
+      EMAIL_AUTH_ENABLED: "true"
       GITHUB_ID: ${{ secrets.E2E_GITHUB_ID }}
       GITHUB_SECRET: ${{ secrets.E2E_GITHUB_SECRET }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -91,6 +94,12 @@ jobs:
           npm run db:migrate
           npm run db:seed
 
+      # Playwright serves this build (see webServer in playwright.config.ts).
+      # Tests used to run against `next dev`, where the first hit on a route
+      # blocked on an on-demand compile for longer than the assertion timeouts.
+      - name: Build app
+        run: npm run build:e2e
+
       - name: Run Playwright tests
         id: playwright-tests
         run: npx playwright test
diff --git a/package.json b/package.json
index f03c2fc7e..8f7bd4ae1 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,8 @@
   "scripts": {
     "dev": "next dev",
     "dev:e2e": "ENV=E2E next dev",
+    "build:e2e": "ENV=E2E next build",
+    "start:e2e": "ENV=E2E next start",
     "build": "next build",
     "ci-build": "next build",
     "vercel-build": "if [ \"$VERCEL_ENV\" = \"production\" ]; then npm run db:migrate; fi && next build",
diff --git a/playwright.config.ts b/playwright.config.ts
index 05464d4c3..6b63271de 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -68,10 +68,19 @@ export default defineConfig({
 
   outputDir: "playwright-report",
 
-  /* Run your local dev server before starting the tests */
+  /* Run your local dev server before starting the tests.
+
+     CI serves a production build instead. Against `next dev`, the FIRST visit
+     to each route waits on an on-demand Turbopack compile, which on a cold
+     runner routinely outlasts the 10s expect timeout — that is what made the
+     admin-nav, editor-publish, bookmark, feed and moderation specs fail there
+     while the same suite stayed green locally. A prebuilt server has no
+     per-route compile step, so those assertions see the page immediately.
+     The workflow runs `build:e2e` before invoking Playwright. */
   webServer: {
-    command: "npm run dev:e2e",
+    command: process.env.CI ? "npm run start:e2e" : "npm run dev:e2e",
     url: "http://127.0.0.1:3000",
     reuseExistingServer: !process.env.CI,
+    timeout: 120_000,
   },
 });

From 38175d85232747a7533bea23ac8cec09bfe621c0 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 16:09:01 +0100
Subject: [PATCH 04/10] fix: review round three, and build the app inside the
 e2e webServer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The e2e harness fix in the previous commit did not take. The job is
triggered by `pull_request_target`, which takes the WORKFLOW from the base
branch and the CODE from the PR head — so the build step added to the
workflow never ran, while playwright.config (from the head) had already
switched to serving a prebuilt app. Result: "Could not find a production
build". The build now happens inside the webServer command, where head and
workflow cannot disagree, and the env it needs moved into the npm scripts
for the same reason.

Review fixes:

- moderationPreviewFilter missed `scheduled` and `unlisted`, so preview
  404'd on a post the admin had just approved-with-schedule. The status
  list is now derived from the enum instead of hand-listed.
- The "top" tie-break went back to newest-first. Oldest-first read better
  as conversation order but buried a comment the moment you posted it,
  which is worse than Top resembling New on an unvoted thread.
- create/edit awaited react-query's void `mutate`, so their try/catch was
  dead and the editor cleared before the request finished: a failed post
  discarded what you typed, silently. Both use mutateAsync now.
- The preview fetched the cover image and never rendered it. Clean body
  copy under an abusive image would have sailed through; it is shown now,
  behind the same scheme guard as the external URL.
- PostBody rendered the site-wide 404 component for an empty tiptap body,
  which put a "page not found" panel inside the admin shell. The empty
  state is the caller's to choose now.
- getAppOrigin fell back to the hardcoded codu.co ahead of the deployment's
  own URL, so an unconfigured fork mailed its users to this site.
- A failed vote now clears its queued follow-up explicitly.

Accepted, not fixed: the thread no longer refetches on window focus, so an
open tab does not pick up other people's comments until you post, navigate
or reload. That is the cost of not moving comments under someone mid-read.
---
 .github/workflows/e2e-tests.yml               |  9 ------
 .../moderation/preview/[postId]/page.tsx      | 26 +++++++++++++---
 components/ContentDetail/PostBody.tsx         | 11 +++++--
 components/ContentDetail/PostReader.tsx       |  3 +-
 components/Discussion/DiscussionArea.tsx      | 30 +++++++++++--------
 package.json                                  |  4 +--
 playwright.config.ts                          | 13 ++++++--
 server/lib/postVisibility.ts                  | 30 ++++++++++---------
 server/lib/url.test.ts                        | 10 ++++++-
 server/lib/url.ts                             |  9 +++++-
 10 files changed, 94 insertions(+), 51 deletions(-)

diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 2f717b29d..79da92312 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -41,9 +41,6 @@ jobs:
     env:
       DATABASE_URL: "postgresql://postgres:secret@localhost:5432/postgres"
       NEXTAUTH_URL: http://localhost:3000/api/auth
-      # A production build sets NODE_ENV=production, which would otherwise turn
-      # off the passwordless provider that dev enables implicitly.
-      EMAIL_AUTH_ENABLED: "true"
       GITHUB_ID: ${{ secrets.E2E_GITHUB_ID }}
       GITHUB_SECRET: ${{ secrets.E2E_GITHUB_SECRET }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
@@ -94,12 +91,6 @@ jobs:
           npm run db:migrate
           npm run db:seed
 
-      # Playwright serves this build (see webServer in playwright.config.ts).
-      # Tests used to run against `next dev`, where the first hit on a route
-      # blocked on an on-demand compile for longer than the assertion timeouts.
-      - name: Build app
-        run: npm run build:e2e
-
       - name: Run Playwright tests
         id: playwright-tests
         run: npx playwright test
diff --git a/app/(admin)/admin/moderation/preview/[postId]/page.tsx b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
index 534205078..a0462ee9c 100644
--- a/app/(admin)/admin/moderation/preview/[postId]/page.tsx
+++ b/app/(admin)/admin/moderation/preview/[postId]/page.tsx
@@ -44,13 +44,10 @@ export default async function Page({ params }: Props) {
         excerpt: posts.excerpt,
         type: posts.type,
         status: posts.status,
-        slug: posts.slug,
         externalUrl: posts.externalUrl,
         coverImage: posts.coverImage,
         readingTime: posts.readingTime,
-        createdAt: posts.createdAt,
         moderationNote: posts.moderationNote,
-        authorName: user.name,
         authorUsername: user.username,
       })
       .from(posts)
@@ -71,6 +68,8 @@ export default async function Page({ params }: Props) {
 
   const renderedBody = renderPostBody(record.body);
   const externalHref = safeExternalHref(record.externalUrl);
+  // Member-supplied, like externalUrl — same scheme guard applies.
+  const coverHref = safeExternalHref(record.coverImage);
 
   return (
     <div className="mx-auto max-w-3xl px-0 py-4 sm:px-4 sm:py-8">
@@ -107,6 +106,18 @@ export default async function Page({ params }: Props) {
         <p className="mb-6 text-base text-muted">{record.excerpt}</p>
       )}
 
+      {/* The cover image is the most visible part of a post on feed and profile
+          cards, so a moderator has to see it before approving — clean body copy
+          under an abusive image would otherwise sail through. */}
+      {coverHref && (
+        // eslint-disable-next-line @next/next/no-img-element
+        <img
+          src={coverHref}
+          alt=""
+          className="mb-6 max-h-80 w-full rounded-lg border border-hairline object-cover"
+        />
+      )}
+
       {/* A link submission is judged on both halves: the member's own framing
           above, and the destination. rel/noreferrer keep the admin surface out
           of the referrer of a page that is under review precisely because it
@@ -146,7 +157,14 @@ export default async function Page({ params }: Props) {
 
       {record.body ? (
         <article className="prose max-w-none dark:prose-invert">
-          <PostBody {...renderedBody} />
+          <PostBody
+            {...renderedBody}
+            emptyFallback={
+              <p className="font-mono text-sm text-faint">
+                {"// body is empty"}
+              </p>
+            }
+          />
         </article>
       ) : (
         <p className="font-mono text-sm text-faint">{"// no body submitted"}</p>
diff --git a/components/ContentDetail/PostBody.tsx b/components/ContentDetail/PostBody.tsx
index d7b5798a3..dfad85f5a 100644
--- a/components/ContentDetail/PostBody.tsx
+++ b/components/ContentDetail/PostBody.tsx
@@ -5,7 +5,6 @@ import { generateHTML } from "@tiptap/core";
 import sanitizeHtml from "sanitize-html";
 import { markdocComponents } from "@/markdoc/components";
 import { config } from "@/markdoc/config";
-import NotFound from "@/components/NotFound/NotFound";
 import { RenderExtensions } from "@/components/editor/editor/extensions/render-extensions";
 
 // A post body is either tiptap JSON (newer editor) or markdoc source. Both the
@@ -64,11 +63,17 @@ export function renderPostBody(body: string | null): {
  * The rendered body only. The heading is the caller's business: the reader
  * prints the title above markdoc bodies (tiptap bodies carry their own H1),
  * and the admin preview always shows its own header.
+ *
+ * `emptyFallback` covers a tiptap body that parses but renders to nothing. What
+ * to show there depends on the surface — the public reader treats it as a
+ * missing page, the moderation preview as an empty submission — so the caller
+ * decides rather than this component hardcoding a full-page 404.
  */
 export const PostBody = ({
   isTiptap,
   content,
-}: ReturnType<typeof renderPostBody>) => {
+  emptyFallback = null,
+}: ReturnType<typeof renderPostBody> & { emptyFallback?: React.ReactNode }) => {
   if (isTiptap) {
     return content ? (
       <div
@@ -76,7 +81,7 @@ export const PostBody = ({
         className="tiptap-content"
       />
     ) : (
-      <NotFound />
+      emptyFallback
     );
   }
 
diff --git a/components/ContentDetail/PostReader.tsx b/components/ContentDetail/PostReader.tsx
index 378c6b840..7064a987d 100644
--- a/components/ContentDetail/PostReader.tsx
+++ b/components/ContentDetail/PostReader.tsx
@@ -4,6 +4,7 @@ import DiscussionArea from "@/components/Discussion/DiscussionArea";
 import { ArticleActionBarWrapper } from "@/components/ArticleActionBar";
 import InlineAuthorBio from "@/components/ContentDetail/InlineAuthorBio";
 import { PostBody, renderPostBody } from "@/components/ContentDetail/PostBody";
+import NotFound from "@/components/NotFound/NotFound";
 import ArticleAdminPanel from "@/components/ArticleAdminPanel/ArticleAdminPanel";
 import { JsonLd } from "@/components/JsonLd";
 import { getCamelCaseFromLower, slugifyTag } from "@/utils/utils";
@@ -205,7 +206,7 @@ const PostReader = async ({
           <div className="prose mx-auto max-w-none dark:prose-invert lg:prose-lg">
             {!isTiptapContent && <h1>{post.title}</h1>}
 
-            <PostBody {...renderedBody} />
+            <PostBody {...renderedBody} emptyFallback={<NotFound />} />
           </div>
 
           {post.tags.length > 0 && (
diff --git a/components/Discussion/DiscussionArea.tsx b/components/Discussion/DiscussionArea.tsx
index 592270e58..275c46c2d 100644
--- a/components/Discussion/DiscussionArea.tsx
+++ b/components/Discussion/DiscussionArea.tsx
@@ -82,13 +82,14 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
       // on window focus would do that to someone who just tabbed back mid-read,
       // which is the jumping this component is trying to avoid. The explicit
       // refetches after create/edit/delete stay — those follow an action the
-      // reader took, so a reflow there is expected.
+      // reader took, so a reflow there is expected. The trade-off: a tab left
+      // open does not pick up other people's new comments until you post,
+      // navigate or reload.
       refetchOnWindowFocus: false,
-      staleTime: 60_000,
     },
   );
 
-  const { mutate, status: createDiscussionStatus } =
+  const { mutateAsync: createDiscussion, status: createDiscussionStatus } =
     api.discussion.create.useMutation({
       onSuccess: () => {
         refetch();
@@ -148,8 +149,11 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
       try {
         await vote({ discussionId, voteType });
       } catch {
-        // onError has already reported and resynced this comment; drop
-        // whatever was queued behind the failure rather than replaying it.
+        // Stop on failure rather than replaying whatever was queued behind it:
+        // the common cause is rate limiting, and draining into it would just
+        // fail again. onError has already toasted and resynced this comment's
+        // control to the server state, so the reader can see what stuck.
+        queue.next = undefined;
         break;
       }
     }
@@ -169,7 +173,7 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
 
   const discussions = discussionsResponse?.data;
 
-  const { mutate: editDiscussion, status: editStatus } =
+  const { mutateAsync: editDiscussion, status: editStatus } =
     api.discussion.edit.useMutation({
       onSuccess: () => {
         refetch();
@@ -198,13 +202,13 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
     const sorted = [...items].sort((a, b) => {
       if (sortOrder === "top") {
         if (b.score !== a.score) return b.score - a.score;
-        // Ties need an explicit order: the server sorts by ltree path, which is
-        // built from a random uuid, so leaning on sort stability would leave
-        // equal-score comments (most of a young thread) in arbitrary order.
-        // Oldest first, so "Top" degrades to chronological rather than to a
-        // copy of "New", and a fresh comment lands somewhere predictable.
+        // Ties need an explicit order: the server sorts by ltree path, built
+        // from a random uuid, so leaning on sort stability would leave
+        // equal-score comments — most of a young thread — in arbitrary order.
+        // Newest first, so a comment you just posted is at the top of the
+        // default view rather than buried at the bottom of the zero-score run.
         return (
-          new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime()
+          new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()
         );
       }
       if (sortOrder === "oldest") {
@@ -233,7 +237,7 @@ const DiscussionArea = ({ contentId, noWrapper = false }: Props) => {
     }
 
     try {
-      await mutate({
+      await createDiscussion({
         body,
         contentId,
         parentId,
diff --git a/package.json b/package.json
index 8f7bd4ae1..4c8d66f37 100644
--- a/package.json
+++ b/package.json
@@ -5,8 +5,8 @@
   "scripts": {
     "dev": "next dev",
     "dev:e2e": "ENV=E2E next dev",
-    "build:e2e": "ENV=E2E next build",
-    "start:e2e": "ENV=E2E next start",
+    "build:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true next build",
+    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true next start",
     "build": "next build",
     "ci-build": "next build",
     "vercel-build": "if [ \"$VERCEL_ENV\" = \"production\" ]; then npm run db:migrate; fi && next build",
diff --git a/playwright.config.ts b/playwright.config.ts
index 6b63271de..b6b20eb68 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -76,11 +76,18 @@ export default defineConfig({
      admin-nav, editor-publish, bookmark, feed and moderation specs fail there
      while the same suite stayed green locally. A prebuilt server has no
      per-route compile step, so those assertions see the page immediately.
-     The workflow runs `build:e2e` before invoking Playwright. */
+     The build runs here rather than as a workflow step on purpose: the e2e job
+     is triggered by `pull_request_target`, so the workflow file always comes
+     from the BASE branch while the code comes from the PR head. A build step
+     added to the workflow would not run until after merge — but this config
+     does, so the two can never disagree. */
   webServer: {
-    command: process.env.CI ? "npm run start:e2e" : "npm run dev:e2e",
+    command: process.env.CI
+      ? "npm run build:e2e && npm run start:e2e"
+      : "npm run dev:e2e",
     url: "http://127.0.0.1:3000",
     reuseExistingServer: !process.env.CI,
-    timeout: 120_000,
+    // Generous: on CI this covers a cold production build, not just boot.
+    timeout: process.env.CI ? 600_000 : 120_000,
   },
 });
diff --git a/server/lib/postVisibility.ts b/server/lib/postVisibility.ts
index a38c19293..6e8cdd658 100644
--- a/server/lib/postVisibility.ts
+++ b/server/lib/postVisibility.ts
@@ -1,17 +1,19 @@
 import { and, eq, inArray, lte, or, type SQL } from "drizzle-orm";
-import { posts } from "@/server/db/schema";
+import { posts, postStatus } from "@/server/db/schema";
 
 /**
- * Statuses a post can be in and still be readable by someone other than its
- * author. `draft` is deliberately absent: a draft is private work in progress,
- * and nothing — not the public reader, not the moderation preview — should
- * surface one to anybody else.
+ * Every post status except `draft`. A draft is private work in progress, so
+ * nothing — not the public reader, not the moderation preview — surfaces one to
+ * anybody but its author. Everything else has been submitted in some form.
+ *
+ * Derived from the enum rather than listed by hand: spelling out a subset meant
+ * `scheduled` (which is what approve-with-schedule produces) and `unlisted`
+ * were silently missing, so the preview 404'd on posts an admin had just
+ * approved. A new status now joins this list automatically.
  */
-export const NON_DRAFT_STATUSES = [
-  "published",
-  "in_review",
-  "rejected",
-] as const;
+export const NON_DRAFT_STATUSES = postStatus.enumValues.filter(
+  (status) => status !== "draft",
+);
 
 /**
  * Who may see a post on the public reader routes.
@@ -43,10 +45,10 @@ export function postVisibilityFilter(viewer: {
 }
 
 /**
- * Which posts a moderator may open in the review preview. Everything that has
- * been submitted — queued, already rejected, or live and since reported — but
- * never a private draft.
+ * Which posts a moderator may open in the review preview: anything submitted —
+ * queued, scheduled, already rejected, or live and since reported — but never a
+ * private draft.
  */
 export function moderationPreviewFilter(): SQL {
-  return inArray(posts.status, [...NON_DRAFT_STATUSES]);
+  return inArray(posts.status, NON_DRAFT_STATUSES);
 }
diff --git a/server/lib/url.test.ts b/server/lib/url.test.ts
index 66d0e734c..e47856dbb 100644
--- a/server/lib/url.test.ts
+++ b/server/lib/url.test.ts
@@ -50,10 +50,18 @@ describe("getAppOrigin", () => {
     expect(getAppOrigin()).toBe("https://www.codu.co");
   });
 
-  it("falls back to the canonical origin if the production domain is unset", () => {
+  // Nothing configured at all: the deployment URL is a poor origin to email,
+  // but it beats sending a fork's users to somebody else's domain.
+  it("falls back to the deployment URL before the canonical origin", () => {
     clearEnv();
     process.env.VERCEL_ENV = "production";
     process.env.VERCEL_URL = "codu-a1b2c3.vercel.app";
+    expect(getAppOrigin()).toBe("https://codu-a1b2c3.vercel.app");
+  });
+
+  it("falls back to the canonical origin when there is nothing else", () => {
+    clearEnv();
+    process.env.VERCEL_ENV = "production";
     expect(getAppOrigin()).toBe(SITE_ORIGIN);
   });
 
diff --git a/server/lib/url.ts b/server/lib/url.ts
index 2288fb1f2..fd3657f39 100644
--- a/server/lib/url.ts
+++ b/server/lib/url.ts
@@ -31,7 +31,7 @@ export function getAppOrigin(): string {
     if (deployment) return toOrigin(deployment);
   }
 
-  // A configured auth origin comes before the hardcoded one so a fork that
+  // A configured auth origin comes before anything hardcoded, so a fork that
   // sets NEXTAUTH_URL is never sent to codu.co.
   const raw = process.env.NEXTAUTH_URL || process.env.AUTH_URL;
   if (raw) {
@@ -42,6 +42,13 @@ export function getAppOrigin(): string {
     }
   }
 
+  // Last resort on a production deploy with nothing configured: the deployment
+  // URL is the wrong origin to email out, but it is at least THIS deployment.
+  // SITE_ORIGIN would send a fork's users to somebody else's site.
+  if (isProduction && process.env.VERCEL_URL) {
+    return toOrigin(process.env.VERCEL_URL);
+  }
+
   return isProduction ? SITE_ORIGIN : "http://localhost:3000";
 }
 

From ae075538ab7ed65371917587bb40a907d9694899 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Wed, 12 Aug 2026 19:11:53 +0100
Subject: [PATCH 05/10] ci(e2e): trust the request host when serving the
 production build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prebuilt server ran, but every authenticated test failed: NextAuth
rejects the request host under NODE_ENV=production unless AUTH_TRUST_HOST
is set, so /api/auth/session returned UntrustedHost, session.user was
undefined, and pages blew up on `session.user.username`. 159 failures.

Dev never hits this — it trusts the host implicitly — which is why the
suite passed locally. My earlier local check passed for the wrong reason:
I had happened to pass AUTH_URL on the command line, which also satisfies
the trust check, so the gap only showed up on CI where it is not set.

Reproduced locally against a production build: without AUTH_TRUST_HOST,
/admin redirects and the log carries UntrustedHost; with it, /admin and
/admin/moderation both return 200 and the log is clean.
---
 package.json         | 2 +-
 playwright.config.ts | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 4c8d66f37..c3cf96f48 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,7 @@
     "dev": "next dev",
     "dev:e2e": "ENV=E2E next dev",
     "build:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true next build",
-    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true next start",
+    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true AUTH_TRUST_HOST=true next start",
     "build": "next build",
     "ci-build": "next build",
     "vercel-build": "if [ \"$VERCEL_ENV\" = \"production\" ]; then npm run db:migrate; fi && next build",
diff --git a/playwright.config.ts b/playwright.config.ts
index b6b20eb68..6b2c57dd5 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -80,7 +80,12 @@ export default defineConfig({
      is triggered by `pull_request_target`, so the workflow file always comes
      from the BASE branch while the code comes from the PR head. A build step
      added to the workflow would not run until after merge — but this config
-     does, so the two can never disagree. */
+     does, so the two can never disagree.
+
+     `start:e2e` also sets AUTH_TRUST_HOST: a production build runs with
+     NODE_ENV=production, where NextAuth stops trusting the request host unless
+     told to, and every session lookup fails with UntrustedHost. Dev never hits
+     this because it trusts the host implicitly. */
   webServer: {
     command: process.env.CI
       ? "npm run build:e2e && npm run start:e2e"

From 724cda9f31fac8f737b00d227ee56d6988ab0790 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Fri, 14 Aug 2026 11:04:41 +0100
Subject: [PATCH 06/10] test(e2e): let the suite point at a throwaway database

`setup.ts` and `teardown.ts` hardcoded localhost:5432/postgres, which is
also the dev database. Running the suite locally therefore writes fixtures
into whatever you have been working on, so the remaining pre-existing
failures cannot be debugged without risking your own data.

Both now honour DATABASE_URL, falling back to the same string, so CI is
unaffected and a local run can be aimed at a scratch database instead.
---
 e2e/setup.ts    | 10 +++++++---
 e2e/teardown.ts |  8 +++++++-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/e2e/setup.ts b/e2e/setup.ts
index b1d98bc51..aa41730a0 100644
--- a/e2e/setup.ts
+++ b/e2e/setup.ts
@@ -35,10 +35,14 @@ import {
 } from "./constants";
 import { eq } from "drizzle-orm";
 
+// Honour DATABASE_URL so the suite can be pointed at a throwaway database
+// instead of always writing into whatever is on localhost:5432/postgres.
+const E2E_DATABASE_URL =
+  process.env.DATABASE_URL ??
+  "postgresql://postgres:secret@127.0.0.1:5432/postgres";
+
 export const setup = async () => {
-  const db = drizzle(
-    postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres"),
-  );
+  const db = drizzle(postgres(E2E_DATABASE_URL));
 
   // Helper to generate short ID for slugs
   const generateShortId = () => {
diff --git a/e2e/teardown.ts b/e2e/teardown.ts
index 785ac2748..068dd8212 100644
--- a/e2e/teardown.ts
+++ b/e2e/teardown.ts
@@ -5,9 +5,15 @@ import {
   E2E_ROUTING_SOURCE_SLUG,
 } from "./constants";
 
+// Honour DATABASE_URL so the suite can be pointed at a throwaway database
+// instead of always writing into whatever is on localhost:5432/postgres.
+const E2E_DATABASE_URL =
+  process.env.DATABASE_URL ??
+  "postgresql://postgres:secret@127.0.0.1:5432/postgres";
+
 export const teardown = async () => {
   try {
-    const db = postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres");
+    const db = postgres(E2E_DATABASE_URL);
 
     // Relaunch content lives in the new `posts` / `comments` tables (author_id),
     // not the legacy "Post" / "Comment" tables (userId). Clean both so reruns

From f44d55b6443aaf370f6ae2e47e5876ed8b2f4b8a Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Fri, 14 Aug 2026 11:39:37 +0100
Subject: [PATCH 07/10] test(e2e): enable moderation, fix the sidebar viewport,
 centralise the DB url
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three causes behind the long-standing failures, found by running the suite
locally against a throwaway database.

MODERATION_ENABLED was never set for the e2e app. The whole pipeline —
publish gating, the review queue, link dedupe — is behind that flag, so
e2e/moderation.spec.ts was asserting behaviour the server had switched
off. All four of its tests pass with the flag on.

The feed sidebar test asserted the right rail is visible on any non-mobile
viewport, but .app-main folds the rail away under 1300px and Playwright's
desktop viewport is 1280 — so it was asserting against a width where the
rail is correctly hidden. The test now widens past the breakpoint.

Four helpers in e2e/utils/utils.ts still hardcoded the connection string
that the file had already centralised, so a run aimed at a scratch
DATABASE_URL wrote its fixtures into the default database instead and then
failed on foreign keys.

Local suite on Desktop Chrome: 129 passed, 1 failed (a flaky multi-user
notification test), down from 6 failures before these changes.
---
 e2e/feed.spec.ts   |  7 +++++++
 e2e/utils/utils.ts | 28 ++++++++++++----------------
 package.json       |  6 +++---
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/e2e/feed.spec.ts b/e2e/feed.spec.ts
index 95f06c0fe..a05bb642e 100644
--- a/e2e/feed.spec.ts
+++ b/e2e/feed.spec.ts
@@ -129,6 +129,13 @@ test.describe("Authenticated Feed Page", () => {
     page,
     isMobile,
   }) => {
+    if (!isMobile) {
+      // The right rail folds away under 1300px (see .app-main in globals.css),
+      // and the default desktop viewport is 1280 — so widen past the breakpoint
+      // before asserting the rail is there.
+      await page.setViewportSize({ width: 1440, height: 900 });
+    }
+
     await page.goto("http://localhost:3000/");
     await page.waitForSelector("article");
 
diff --git a/e2e/utils/utils.ts b/e2e/utils/utils.ts
index 59c627314..f72771535 100644
--- a/e2e/utils/utils.ts
+++ b/e2e/utils/utils.ts
@@ -18,10 +18,14 @@ import {
   E2E_ADMIN_ID,
 } from "../constants";
 
-// All E2E DB helpers talk to the same local Postgres the global setup seeds
-// (see e2e/setup.ts). Centralised here so individual helpers don't re-declare
-// the connection string.
-const E2E_DB_URL = "postgresql://postgres:secret@127.0.0.1:5432/postgres";
+// All E2E DB helpers talk to the same Postgres the global setup seeds (see
+// e2e/setup.ts). Centralised here so individual helpers don't re-declare the
+// connection string — four of them used to, which meant a run pointed at a
+// scratch DATABASE_URL still wrote fixtures into the default database and then
+// failed on foreign keys.
+const E2E_DB_URL =
+  process.env.DATABASE_URL ??
+  "postgresql://postgres:secret@127.0.0.1:5432/postgres";
 const e2eDb = () => drizzle(postgres(E2E_DB_URL));
 
 /**
@@ -156,9 +160,7 @@ export async function createArticle({
   publishedAt = new Date().toISOString(),
   authorId = E2E_USER_ONE_ID,
 }: CreateArticleInput) {
-  const db = drizzle(
-    postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres"),
-  );
+  const db = drizzle(postgres(E2E_DB_URL));
 
   try {
     const result = await db
@@ -197,9 +199,7 @@ export async function createLinkPost({
   publishedAt = null,
   authorId = E2E_USER_ONE_ID,
 }: CreateLinkPostInput) {
-  const db = drizzle(
-    postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres"),
-  );
+  const db = drizzle(postgres(E2E_DB_URL));
 
   try {
     const result = await db
@@ -243,9 +243,7 @@ export async function createNotification({
   postId,
   commentId,
 }: CreateNotificationInput) {
-  const db = drizzle(
-    postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres"),
-  );
+  const db = drizzle(postgres(E2E_DB_URL));
 
   try {
     // If no postId provided, get a published post to use
@@ -279,9 +277,7 @@ export async function createNotification({
 }
 
 export async function clearNotifications(userId: string) {
-  const db = drizzle(
-    postgres("postgresql://postgres:secret@127.0.0.1:5432/postgres"),
-  );
+  const db = drizzle(postgres(E2E_DB_URL));
 
   try {
     await db.delete(notification).where(eq(notification.userId, userId));
diff --git a/package.json b/package.json
index c3cf96f48..8ac1ddfa8 100644
--- a/package.json
+++ b/package.json
@@ -4,9 +4,9 @@
   "private": true,
   "scripts": {
     "dev": "next dev",
-    "dev:e2e": "ENV=E2E next dev",
-    "build:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true next build",
-    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true AUTH_TRUST_HOST=true next start",
+    "dev:e2e": "ENV=E2E MODERATION_ENABLED=true next dev",
+    "build:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true MODERATION_ENABLED=true next build",
+    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true AUTH_TRUST_HOST=true MODERATION_ENABLED=true next start",
     "build": "next build",
     "ci-build": "next build",
     "vercel-build": "if [ \"$VERCEL_ENV\" = \"production\" ]; then npm run db:migrate; fi && next build",

From dbc6355233aa57c7c562d9bdb3472d5abe747fb5 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Fri, 14 Aug 2026 12:04:43 +0100
Subject: [PATCH 08/10] test(e2e): give the bookmark specs their own fixture
 per browser project
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bookmarks are per-user and all four browser projects run as the same e2e
user, so a shared article made the bookmark specs race each other: one
project saved it while another was asserting it was still unsaved. That is
why they failed on Firefox and mobile but never on Desktop Chrome, which
happened to get there first. saved.spec.ts already ran serially, but serial
mode only orders tests within a project, not across them.

Each project now creates and cleans up its own article. Reproduced the
failure locally across all four projects, and all 52 tests in those two
files pass afterwards. The /saved assertion no longer needs its "or the
empty state" escape hatch either, since nothing else can unbookmark it.

Also gives the discussion editor's submit button a data-testid. "Reply" is
the label of both the editor's submit button and every comment's
expand-reply button, so the notification spec was picking it out with
.last() — ambiguous as soon as a comment has nested children. That spec
still fails intermittently for a separate reason (its reply lands as a
top-level comment, so the server correctly raises "commented on your post"
rather than "replied to your comment"); it retries green and is left for a
follow-up rather than papered over here.
---
 .../Discussion/DiscussionEditor/Editor.tsx    |  4 +
 e2e/articles.spec.ts                          | 74 +++++++++++--------
 e2e/notifications.spec.ts                     | 11 ++-
 e2e/saved.spec.ts                             | 48 ++++++------
 4 files changed, 75 insertions(+), 62 deletions(-)

diff --git a/components/Discussion/DiscussionEditor/Editor.tsx b/components/Discussion/DiscussionEditor/Editor.tsx
index 9fe18f916..5157183a2 100644
--- a/components/Discussion/DiscussionEditor/Editor.tsx
+++ b/components/Discussion/DiscussionEditor/Editor.tsx
@@ -103,8 +103,12 @@ export function DiscussionEditor({
           >
             Cancel
           </button>
+          {/* Stable hook for tests: the submit label ("Reply") is also the
+              label of every comment's expand-reply button, so picking this one
+              out by text alone is ambiguous once a thread has nesting. */}
           <button
             type="button"
+            data-testid="discussion-submit"
             onClick={handleSubmit}
             disabled={isSubmitting || isEmpty}
             className="primary-button px-4 py-1.5 text-sm"
diff --git a/e2e/articles.spec.ts b/e2e/articles.spec.ts
index b129307a3..668440d1c 100644
--- a/e2e/articles.spec.ts
+++ b/e2e/articles.spec.ts
@@ -1,6 +1,12 @@
 import { test, expect } from "playwright/test";
 import { randomUUID } from "crypto";
-import { articleContent, articleExcerpt, loggedInAsUserOne } from "./utils";
+import {
+  articleContent,
+  articleExcerpt,
+  createArticle,
+  deletePostBySlug,
+  loggedInAsUserOne,
+} from "./utils";
 
 // Post-relaunch: the feed is the homepage at "/". The old /articles and
 // /feed?type=article routes 308-redirect to "/?type=article". Basic feed
@@ -219,46 +225,50 @@ test.describe("Authenticated Article Flows", () => {
     await expect(page.getByLabel("Upvote").first()).toBeVisible();
   });
 
-  test("Should be able to bookmark an article", async ({ page }) => {
-    await page.goto(PUBLISHED_ARTICLE_URL);
-    await page.waitForLoadState("domcontentloaded");
-
-    // Reader action bar bookmark button toggles between "Save" and "Saved".
-    // Another parallel test may have already saved it, so handle both states.
-    const saveButton = page.getByRole("button", { name: "Save", exact: true });
-    const savedButton = page.getByRole("button", {
-      name: "Saved",
-      exact: true,
+  test("Should be able to bookmark an article", async ({ page }, testInfo) => {
+    // Bookmarks are per-user and every browser project runs as the SAME e2e
+    // user, so a shared article turns this into a cross-project race: one
+    // project saves it while another is asserting it is still unsaved.
+    // (Serial mode only orders tests within a project, not across them.)
+    // Each project therefore bookmarks an article of its own.
+    const slug = `e2e-bookmark-${testInfo.project.name
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")}`;
+    await createArticle({
+      title: "E2E bookmark target",
+      slug,
+      excerpt: "Bookmark target",
+      body: "Bookmark target body",
     });
 
-    const isSaved = await savedButton.isVisible().catch(() => false);
+    try {
+      await page.goto(`http://localhost:3000/e2e-test-user-one-111/${slug}`);
+      await page.waitForLoadState("domcontentloaded");
+
+      const saveButton = page.getByRole("button", {
+        name: "Save",
+        exact: true,
+      });
+      const savedButton = page.getByRole("button", {
+        name: "Saved",
+        exact: true,
+      });
 
-    if (isSaved) {
-      // Already bookmarked - unbookmark then rebookmark to test the flow
-      await savedButton.scrollIntoViewIfNeeded();
+      await expect(saveButton).toBeVisible({ timeout: 15000 });
+      await expect(saveButton).toBeEnabled({ timeout: 5000 });
+      await saveButton.scrollIntoViewIfNeeded();
       await Promise.all([
         page.waitForResponse(
           (resp) =>
             resp.url().includes("trpc") && resp.url().includes("bookmark"),
         ),
-        savedButton.click(),
+        saveButton.click(),
       ]);
-      await expect(saveButton).toBeVisible({ timeout: 15000 });
-    }
 
-    // Now bookmark the article
-    await expect(saveButton).toBeVisible({ timeout: 15000 });
-    await expect(saveButton).toBeEnabled({ timeout: 5000 });
-    await saveButton.scrollIntoViewIfNeeded();
-    await Promise.all([
-      page.waitForResponse(
-        (resp) =>
-          resp.url().includes("trpc") && resp.url().includes("bookmark"),
-      ),
-      saveButton.click(),
-    ]);
-
-    // Button text should change to "Saved"
-    await expect(savedButton).toBeVisible({ timeout: 30000 });
+      // Button text should change to "Saved"
+      await expect(savedButton).toBeVisible({ timeout: 30000 });
+    } finally {
+      await deletePostBySlug(slug);
+    }
   });
 });
diff --git a/e2e/notifications.spec.ts b/e2e/notifications.spec.ts
index 7fb992e16..02c77ac10 100644
--- a/e2e/notifications.spec.ts
+++ b/e2e/notifications.spec.ts
@@ -249,12 +249,11 @@ test.describe("Notifications Page", () => {
         .first()
         .fill(replyText);
 
-      // Submit the reply - click the Reply button within the reply form
-      // The submit button has the same text "Reply" as the expand button, but it's the last one
-      await commentSection
-        .getByRole("button", { name: "Reply", exact: true })
-        .last()
-        .click();
+      // Submit the reply. "Reply" is also the label of every comment's
+      // expand-reply button, so match the editor's submit button by test id —
+      // only one editor is open at a time, so this is unambiguous even once
+      // the comment has nested children.
+      await commentSection.getByTestId("discussion-submit").first().click();
 
       // Verify reply was posted - this confirms the mutation completed and notification was created
       await expect(page.getByText(replyText)).toBeVisible({ timeout: 15000 });
diff --git a/e2e/saved.spec.ts b/e2e/saved.spec.ts
index 5171005f5..10392cdd1 100644
--- a/e2e/saved.spec.ts
+++ b/e2e/saved.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from "playwright/test";
-import { loggedInAsUserOne } from "./utils";
+import { createArticle, deletePostBySlug, loggedInAsUserOne } from "./utils";
 
 // Run saved tests serially to prevent parallel bookmark toggling conflicts.
 // These tests mutate the shared e2e user's bookmark state, so other specs
@@ -51,9 +51,22 @@ test.describe("Authenticated Saved Page", () => {
 
   test("Should bookmark from the article reader and appear in saved items", async ({
     page,
-  }) => {
-    // Bookmark a specific article via its reader "Save" action.
-    await page.goto(PUBLISHED_ARTICLE_URL);
+  }, testInfo) => {
+    // Serial mode above only orders tests within one project; all four browser
+    // projects run in parallel as the SAME e2e user, so a shared article still
+    // races — one project saves it while another asserts it is unsaved. Each
+    // project bookmarks its own article instead.
+    const slug = `e2e-saved-target-${testInfo.project.name
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")}`;
+    await createArticle({
+      title: "E2E saved target",
+      slug,
+      excerpt: "Saved target",
+      body: "Saved target body",
+    });
+
+    await page.goto(`http://localhost:3000/e2e-test-user-one-111/${slug}`);
     await page.waitForLoadState("domcontentloaded");
 
     // exact: true so "Save" doesn't also match "Saved".
@@ -63,20 +76,6 @@ test.describe("Authenticated Saved Page", () => {
       exact: true,
     });
 
-    // If already saved (parallel runs), unsave first so we test the save flow.
-    const isSaved = await savedButton.isVisible().catch(() => false);
-    if (isSaved) {
-      await savedButton.scrollIntoViewIfNeeded();
-      await Promise.all([
-        page.waitForResponse(
-          (resp) =>
-            resp.url().includes("trpc") && resp.url().includes("bookmark"),
-        ),
-        savedButton.click(),
-      ]);
-      await expect(saveButton).toBeVisible({ timeout: 10000 });
-    }
-
     // Now bookmark it.
     await expect(saveButton).toBeVisible({ timeout: 15000 });
     await saveButton.scrollIntoViewIfNeeded();
@@ -93,13 +92,14 @@ test.describe("Authenticated Saved Page", () => {
 
     // The /saved page should load with either the saved article or (if a
     // parallel test unbookmarked it) the empty state.
+    // With a per-project fixture nothing else can unbookmark it, so the saved
+    // page must actually list it — no "or the empty state" escape hatch.
     await page.goto("http://localhost:3000/saved");
-    await expect(
-      page
-        .locator("article")
-        .first()
-        .or(page.getByText(/nothing saved yet/i)),
-    ).toBeVisible({ timeout: 15000 });
+    await expect(page.getByText("E2E saved target").first()).toBeVisible({
+      timeout: 15000,
+    });
+
+    await deletePostBySlug(slug);
   });
 
   test("Should bookmark from the feed card Save action", async ({ page }) => {

From fd12b29299296f6a06823c489635450c0602a60e Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Fri, 14 Aug 2026 12:35:12 +0100
Subject: [PATCH 09/10] test(e2e): check the card's content link, not its first
 anchor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The routeless-/[id] guard took the FIRST anchor inside a content card, but
that is the author handle ("/{username}") — a real page that nonetheless
reads as a bare single-segment path to the shape check, so the test failed
with 'href "/e2e-test-user-one-111" looks like a routeless /[id] page'. It
only surfaced on some browsers because which card ranks first varies, and a
source card's handle link ("/s/{slug}") has two segments and slips through.

The card's content link now carries data-testid="content-card-link" and the
test targets that, so it checks the link the guard is actually about.
All 44 tests in the file pass across all four browser projects.
---
 components/UnifiedContentCard/UnifiedContentCard.tsx | 1 +
 e2e/content-urls.spec.ts                             | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/components/UnifiedContentCard/UnifiedContentCard.tsx b/components/UnifiedContentCard/UnifiedContentCard.tsx
index 4d8b7d641..14424cfb5 100644
--- a/components/UnifiedContentCard/UnifiedContentCard.tsx
+++ b/components/UnifiedContentCard/UnifiedContentCard.tsx
@@ -276,6 +276,7 @@ const UnifiedContentCard = ({
 
           <Link
             href={cardUrl}
+            data-testid="content-card-link"
             onClick={type === "LINK" ? handleExternalClick : undefined}
             className="mt-3 block"
           >
diff --git a/e2e/content-urls.spec.ts b/e2e/content-urls.spec.ts
index 999db0193..4fb1b60f1 100644
--- a/e2e/content-urls.spec.ts
+++ b/e2e/content-urls.spec.ts
@@ -169,8 +169,11 @@ test.describe("No routeless /[id] regression", () => {
   }) => {
     await page.goto(`${BASE}/`);
 
+    // The card's FIRST anchor is the author handle ("/{username}"), which is a
+    // real page but reads as a bare single-segment path to the shape check
+    // below — target the card's content link instead.
     const firstCardLink = page
-      .locator('[data-testid="content-card"] a')
+      .locator('[data-testid="content-card-link"]')
       .first();
     await expect(firstCardLink).toBeVisible({ timeout: 30000 });
     await expect(firstCardLink).toHaveAttribute("href", /.+/);

From f5d8fda59e4f1636dd5fcba40200b1b9430f76b6 Mon Sep 17 00:00:00 2001
From: NiallJoeMaher <nialljoemaher@gmail.com>
Date: Thu, 20 Aug 2026 20:36:02 +0100
Subject: [PATCH 10/10] test(e2e): bypass rate limits, and wait for comments to
 actually post
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two causes behind the long tail of failures, found once the suite could be
run locally against a throwaway database on the Node version .nvmrc pins.

`discussion-create` allows 10 comments per 10 minutes per user, and the
suite drives all four browser projects through the same two seeded users —
so later projects were silently throttled, their comments never reached the
database, and the tests that depend on them failed. Rate limiting now has an
explicit `RATE_LIMIT_DISABLED` bypass that the e2e scripts set. It is
guarded on that one env var and documented as test-only.

The notification specs asserted a comment had posted with
`getByText(commentText)`, which also matches the editor's own textarea — so
it resolved the instant `fill()` ran, before the request had been sent. The
test then switched users mid-flight, and the comment landed under whoever
was authenticated by the time it went out: the "user one comments, user two
replies" scenario ended up with both comments written by user two, replying
to itself, so no reply notification was ever generated. They now wait for
the create response and assert on a rendered `section.group/comment`.

Local suite across all four browser projects, fresh database: 518 passed,
2 failed — both Mobile Safari, a publish redirect and a dedupe toast — down
from 19 failures.
---
 e2e/notifications.spec.ts | 38 ++++++++++++++++++++++++++++++--------
 package.json              |  4 ++--
 server/api/trpc.ts        |  6 ++++++
 3 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/e2e/notifications.spec.ts b/e2e/notifications.spec.ts
index 02c77ac10..788c733c1 100644
--- a/e2e/notifications.spec.ts
+++ b/e2e/notifications.spec.ts
@@ -1,4 +1,4 @@
-import { test, expect } from "playwright/test";
+import { test, expect, type Page, type Locator } from "playwright/test";
 import { randomUUID } from "crypto";
 import {
   loggedInAsUserOne,
@@ -8,6 +8,24 @@ import {
 } from "./utils";
 import { E2E_USER_ONE_ID, E2E_USER_TWO_ID } from "./constants";
 
+// A comment that has actually been posted renders inside its own
+// `section.group/comment`. Asserting on bare text instead matches the editor's
+// textarea too, which resolves the moment `fill()` runs — so the test would
+// carry on (and swap users) while the create request was still in flight, and
+// the comment landed under whoever was authenticated by the time it went out.
+const postedComment = (page: Page, text: string) =>
+  page.locator("section.group\\/comment").filter({ hasText: text }).first();
+
+// Click a discussion editor's submit and wait for the create to come back, so
+// the assertions (and any user switch) happen after the comment really exists
+// rather than racing the in-flight request.
+const submitAndWait = async (page: Page, scope: Page | Locator = page) => {
+  await Promise.all([
+    page.waitForResponse((r) => r.url().includes("discussion.create")),
+    scope.getByTestId("discussion-submit").first().click(),
+  ]);
+};
+
 // Run notification tests serially to prevent race conditions when multiple browser
 // workers create/clear notifications for the same users simultaneously
 test.describe.configure({ mode: "serial" });
@@ -164,10 +182,12 @@ test.describe("Notifications Page", () => {
         .getByPlaceholder("What are your thoughts?")
         .first()
         .fill(commentText);
-      await page.getByRole("button", { name: "Comment", exact: true }).click();
+      await submitAndWait(page);
 
       // Verify comment was posted - this confirms the mutation completed and notification was created
-      await expect(page.getByText(commentText)).toBeVisible({ timeout: 15000 });
+      await expect(postedComment(page, commentText)).toBeVisible({
+        timeout: 15000,
+      });
 
       // Now log in as user one and check notifications
       await loggedInAsUserOne(page);
@@ -210,10 +230,10 @@ test.describe("Notifications Page", () => {
         .getByPlaceholder("What are your thoughts?")
         .first()
         .fill(originalComment);
-      await page.getByRole("button", { name: "Comment", exact: true }).click();
+      await submitAndWait(page);
 
       // Verify comment was posted
-      await expect(page.getByText(originalComment)).toBeVisible({
+      await expect(postedComment(page, originalComment)).toBeVisible({
         timeout: 15000,
       });
 
@@ -223,7 +243,7 @@ test.describe("Notifications Page", () => {
         "http://localhost:3000/e2e-test-user-one-111/e2e-test-slug-published",
       );
 
-      await expect(page.getByText(originalComment)).toBeVisible({
+      await expect(postedComment(page, originalComment)).toBeVisible({
         timeout: 15000,
       });
 
@@ -253,10 +273,12 @@ test.describe("Notifications Page", () => {
       // expand-reply button, so match the editor's submit button by test id —
       // only one editor is open at a time, so this is unambiguous even once
       // the comment has nested children.
-      await commentSection.getByTestId("discussion-submit").first().click();
+      await submitAndWait(page, commentSection);
 
       // Verify reply was posted - this confirms the mutation completed and notification was created
-      await expect(page.getByText(replyText)).toBeVisible({ timeout: 15000 });
+      await expect(postedComment(page, replyText)).toBeVisible({
+        timeout: 15000,
+      });
 
       // Log back in as user one and check for notification
       await loggedInAsUserOne(page);
diff --git a/package.json b/package.json
index 8ac1ddfa8..05e9b4905 100644
--- a/package.json
+++ b/package.json
@@ -4,9 +4,9 @@
   "private": true,
   "scripts": {
     "dev": "next dev",
-    "dev:e2e": "ENV=E2E MODERATION_ENABLED=true next dev",
+    "dev:e2e": "ENV=E2E MODERATION_ENABLED=true RATE_LIMIT_DISABLED=true next dev",
     "build:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true MODERATION_ENABLED=true next build",
-    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true AUTH_TRUST_HOST=true MODERATION_ENABLED=true next start",
+    "start:e2e": "ENV=E2E EMAIL_AUTH_ENABLED=true AUTH_TRUST_HOST=true MODERATION_ENABLED=true RATE_LIMIT_DISABLED=true next start",
     "build": "next build",
     "ci-build": "next build",
     "vercel-build": "if [ \"$VERCEL_ENV\" = \"production\" ]; then npm run db:migrate; fi && next build",
diff --git a/server/api/trpc.ts b/server/api/trpc.ts
index 61458f264..61afd9b58 100644
--- a/server/api/trpc.ts
+++ b/server/api/trpc.ts
@@ -149,6 +149,12 @@ const rateLimited = (opts: {
   message?: string;
 }) =>
   t.middleware(async ({ ctx, next }) => {
+    // The e2e suite drives every browser project through the same handful of
+    // seeded users, so it blows per-user limits (discussion-create allows 10
+    // per 10 minutes) and later projects get silently throttled. Never set this
+    // outside a test environment.
+    if (process.env.RATE_LIMIT_DISABLED === "true") return next();
+
     const key = `${opts.name}:${
       ctx.session?.user?.id ?? `ip:${clientIpFromHeaders(ctx.headers)}`
     }`;