[codex] Use live catalog for vote validation

scripts/check.mjs

@@ -193,6 +193,7 @@ assert(css.includes(".vote-controls[hidden]"));
 assert(authVotesSource.includes('scope: "read:user"'));
 assert(authVotesSource.includes("function authBridge"));
 assert(authVotesSource.includes("readSignedValue(state"));
+assert(authVotesSource.includes('LOOP_CATALOG_INSTANCE = "published-loops"'));
 assert(browserScript.includes('window.sessionStorage.setItem(OAUTH_NONCE_KEY'));
 assert(browserScript.includes('window.sessionStorage.getItem(VOTE_SESSION_KEY)'));
 assert(browserScript.includes('url.searchParams.set("client_nonce", nonce)'));

worker/src/auth-votes.js

@@ -2,6 +2,7 @@ const SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
 const OAUTH_TTL_SECONDS = 10 * 60;
 const MAX_VOTE_BODY_BYTES = 1024;
 const OAUTH_NONCE_PATTERN = /^[A-Za-z0-9_-]{32,128}$/;
+const LOOP_CATALOG_INSTANCE = "published-loops";
 
 export async function handleAuthVoteRoute(
   request,
@@ -413,7 +414,7 @@ async function readAuthBody(request) {
 }
 
 async function isPublishedLoop(env, slug) {
-  const id = env.LOOP_CATALOG.idFromName("production");
+  const id = env.LOOP_CATALOG.idFromName(LOOP_CATALOG_INSTANCE);
   const response = await env.LOOP_CATALOG.get(id).fetch("https://loop-catalog/published");
   if (!response.ok) return false;
   const catalog = await response.json();

worker/test/auth-votes.test.js

@@ -61,6 +61,7 @@ class MemoryVoteNamespace {
 
 class MemoryCatalogNamespace {
   idFromName(name) {
+    assert.equal(name, "published-loops");
     return name;
   }