getEnvProd returns the env var if set; otherwise it panics in prod mode (fail-fast — no silent dev-default fallback for things that must be configured

mapArtifactErr translates artifact client sentinels into user-facing messages.

nameOf strips the "<category>/" prefix to recover the within-category name.

notifyContentInteraction creates a "someone liked / favorited your content" notification. msgType distinguishes the interaction so the message center

wikiPathFromRequest turns the incoming original URL into the Wiki path, preserving exact path/query encoding. c.OriginalURL() keeps the raw, undecoded

─── shared write helpers ──────────────────────────────

CardFromBrief builds a GalgameCard from a Wiki brief alone (no local patch row). All moyu-side stats stay zero — used when enriching Wiki responses (t

CreateMentionMessages notifies every @mentioned user. commentID is the comment carrying the mention, so the notification deep-links straight to it (/p

Download returns a download URL (presigned GET, or a Worker URL for public artifacts on a site with a CDN base configured).

===== Mention detection ===== ExtractMentionUserIDs delegates to the markdown package so the regex used for notification routing matches exactly what

===== Favorites =====

===== Follow =====

===== Resource Favorites (per-resource subscription) =====

─── Room ─────────────────────────────────────────── FindRoomByLink looks up a room by its link.

FindUserByID looks up the local user row by id. The id should equal OAuth.users.id (aligned by migrate-users) and is taken from oauth/userinfo's `id`

GetCommentPatchID returns the comment's owning patch.id so the handler can NSFW-gate it before serving the markdown body.

GetRoles returns the OAuth roles for the current request, or an empty slice if no session is attached. Roles come from the access_token JWT roles clai

===== Settings ===== Source of truth is the site_setting table via settingService (durable + audited), NOT Redis. SetSetting records the acting admin

IsMember reports whether a user is a member of a given room.

MainURL builds the canonical CDN URL for the full image (`.webp`). Returns "" for empty / malformed hashes — caller can fall back to a placeholder.

NewCompleteUploadRequestWithBody generates requests for CompleteUpload with any type of body

NewInitUploadRequestWithBody generates requests for InitUpload with any type of body

ParseCompleteUploadResp parses an HTTP response from a CompleteUploadWithResponse call

ParseInitUploadResp parses an HTTP response from a InitUploadWithResponse call

Sanitize runs the shared allow-list over already-rendered HTML. Exposed so the render entry points (Render / RenderWithTOC) share one boundary.

===== Wiki submission proxies (docs/galgame_wiki/07-submission.md) ===== Each endpoint is a thin pass-through to Wiki: extract the user's access_toke

UpdateGalgame PUT /api/v1/galgame/:gid Thin proxy over the Wiki Service's PUT /galgame/:gid. Two modes: - application/json -> forwards the JSON bod

applyCommentSideEffects runs the once-per-visible-comment bookkeeping: bump the patch's comment_count, award the owner +1 moemoepoint (unless they aut

applyFollowCountsTx applies the +/-delta to following_count (follower) and follower_count (followee) within the given tx. GREATEST clamps at 0.

attachGalgameNames batch-resolves the multilingual game name (from each game-scoped message's /patch/<id> link) and stamps msg.GalgameName, so the fro

attachPatchSummaries stamps the `Patch` field on each resource and each comment in one Wiki batch call (name + banner come from the Wiki Service). Eit

attachPatchSummaries fills the owning-galgame summary (name / banner / vndb_id) on comment / resource rows so the admin UI can show the game's NAME in

attachSenders batch-resolves sender briefs from OAuth /users/batch and stamps msg.Sender. Without this every message serialized with sender=nil, and t

briefsToFollowItems is briefsToUserBasic + per-row is_followed stamp. One follow-set lookup covers the whole page.

clearSessionCookie wipes the kun_session cookie on the response. Used when we reject a request because the upstream OAuth refresh permanently failed -

composeMe merges the local user row with the OAuth brief (name/avatar/bio) into a MeResponse. If the OAuth /users/batch call fails we still return the

composeSlug builds the stored "<category>/<name>" slug from its parts.

createPatchRow is the shared register-a-carrier body for both entrypoints: idempotent dedup by id (= galgame_id), mirror the Wiki release_date, then o

decodeJWTRoles extracts the `roles` claim from a JWT without verifying the signature. Safe here because the token came out of our Redis session (place

doEnvelope executes req, decodes the standard {code,message,data} envelope and returns the raw `data` (so the handler can re-wrap without an extra unm

enrichMessages fills ContentHTML (rendered markdown), Reaction[] (with the reacting users' briefs) and QuoteMessage (the replied-to message preview) f

hikariFail writes the legacy error envelope ({success:false, data:null}).

newRenderContext builds the parser context shared by Render / RenderWithTOC: CJK-friendly heading IDs plus (when a meta resolver is wired) the content

oauthPostJSON POSTs JSON to the OAuth server and decodes the wrapped {code, message, data} envelope into out (when not nil). A non-zero envelope code

parseDeleteReason reads an OPTIONAL moderation reason from the request body ({"reason":"..."}) sent when a mod/admin deletes someone else's content fr

parseDocDate tolerantly parses a doc's display date (e.g. "2025-6-18"). Unparseable values return the zero time so they sort last.

parseGalgameMultipart is shared between SubmitGalgame and PatchGalgameDraft. Returns the JSON body, the file name / bytes / mime if present, or an App

parseRef splits a "type:id" moemoepoint ref (e.g. "comment:42") into its kind and numeric id; id is 0 when absent / unparseable.

payloadString pulls a scalar string field out of the Wiki message payload JSON. Returns "" when missing or wrong-typed (no error — payload fields are

proxyUserOAuth is the shared helper for the display-layer proxies. Pulls access_token from session, forwards body + content-type to the OAuth endpoint

renewSlidingSession implements the rolling half of the session-timeout model: while the user is active it slides the cookie + Redis TTL forward, so a

unionInts merges several int slices into one deduped slice (order unimportant — used only for `WHERE id IN (...)` recompute targets).

uploadTier resolves the caller's per-role upload allowance from the OAuth roles claim: admin/ren > moderator > creator > user. Each tier is distinct;

waitForRefreshedSession is the lock-loser path. Another request holds the per-session refresh lock and is doing the OAuth round-trip; we poll Redis fo