Web dashboard step 2: full issue pages, article chapters, POST /rate

Signed-in issue page with the Brief, downloads, index and colophon; article,
World Briefing and Behind the paper pages under the login guard; the rating
widget with its fetch enhancement; the admin-only POST /rate writing
dashboard-attributed rating events; the HMAC confirmation page links to the
site.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NHyYupFdBiR4VfoUM7NjSM

src/web/mod.rs

@@ -1,5 +1,6 @@
 pub mod issue;
 pub mod public;
+pub mod rate;
 pub mod session;
 pub mod users;
 
@@ -18,6 +19,7 @@ use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
 use self::session::Viewer;
+use axum_login::tower_sessions::Session;
 
 #[async_trait]
 pub trait JobRunner: Send + Sync {
@@ -135,6 +137,13 @@ impl Page {
     }
 }
 
+pub async fn take_flash(session: &Session) -> Result<Option<Flash>, WebError> {
+    session
+        .remove("flash")
+        .await
+        .map_err(|error| WebError::Internal(error.into()))
+}
+
 pub struct Html<T: Template>(pub T);
 
 impl<T: Template> IntoResponse for Html<T> {
@@ -347,9 +356,19 @@ pub fn router(config: &crate::config::Config) -> axum::Router<crate::server::App
             login_url = "/login",
             redirect_field = "next"
         ));
+    let full_issues = axum::Router::new()
+        .route("/issues/{date}/articles/{article_id}", get(issue::article))
+        .route("/issues/{date}/world", get(issue::world))
+        .route("/issues/{date}/behind", get(issue::behind))
+        .route_layer(login_required!(
+            session::Backend,
+            login_url = "/login",
+            redirect_field = "next"
+        ))
+        .route_layer(from_fn(map_forbidden));
     let dashboard = axum::Router::new()
         .route("/dashboard", get(dashboard_stub))
-        .route("/rate", post(rate_stub))
+        .route("/rate", post(rate::post))
         .route_layer(permission_required!(
             session::Backend,
             login_url = "/login",
@@ -367,6 +386,7 @@ pub fn router(config: &crate::config::Config) -> axum::Router<crate::server::App
         .route("/static/{file}", get(static_asset))
         .merge(login)
         .merge(account)
+        .merge(full_issues)
         .merge(dashboard)
 }
 
@@ -384,10 +404,6 @@ async fn dashboard_stub(auth: session::AuthSession) -> Result<Response, WebError
     .into_response())
 }
 
-async fn rate_stub() -> StatusCode {
-    StatusCode::NOT_IMPLEMENTED
-}
-
 async fn map_forbidden(request: Request, next: Next) -> Response {
     let mut response = next.run(request).await;
     if response.status() == StatusCode::FORBIDDEN {
@@ -674,7 +690,7 @@ mod tests {
             )
             .await
             .unwrap();
-        assert_eq!(allowed_rate.status(), StatusCode::NOT_IMPLEMENTED);
+        assert_eq!(allowed_rate.status(), StatusCode::BAD_REQUEST);
     }
 
     #[tokio::test]