Fix Community share links and Universal Links

Author: jinwandalaohu66

.well-known/apple-app-site-association

@@ -10,6 +10,10 @@
             "/": "/s/*",
             "comment": "Open a community script or MiniApp work."
           },
+          {
+            "/": "/community/*",
+            "comment": "Open a Community V2 post or comment."
+          },
           {
             "/": "/import",
             "comment": "Open a remote import preview."

README.md

@@ -3,11 +3,14 @@
 This directory is the static GitHub Pages origin for:
 
 - `https://link.pythonide.xin/s/{scriptID}` community work shares
+- `https://link.pythonide.xin/community/{postID}` Community V2 post and comment shares
 - `https://link.pythonide.xin/l/{code}` reserved short links
 - `https://link.pythonide.xin/import?url=...` remote import links
 - `https://link.pythonide.xin/.well-known/apple-app-site-association` iOS Universal Links
 - `https://link.pythonide.xin/mcp-oauth/client.json` MCP OAuth Client ID Metadata Document
 - `https://link.pythonide.xin/mcp-oauth/callback` MCP OAuth HTTPS callback
+- `https://link.pythonide.xin/ai-oauth/client.json` custom AI OAuth Client ID Metadata Document
+- `https://link.pythonide.xin/ai-oauth/callback` custom AI OAuth HTTPS callback
 
 ## Repository and deployment
 
@@ -44,7 +47,10 @@ migration or community API change is required.
 Before either deployment, run:
 
 ```bash
-node --test link-site/tests/share-page.test.js link-edge/tests/worker.test.js
+node --test \
+  link-site/tests/share-page.test.js \
+  link-site/tests/aasa-deployment.test.js \
+  link-edge/tests/worker.test.js
 ```
 
 ## iOS Requirement
@@ -56,14 +62,32 @@ applinks:link.pythonide.xin
 webcredentials:link.pythonide.xin
 ```
 
-The AASA file currently registers `/s/*` and `/import`. Keep `/l/*` out of AASA until the short-link resolver backend is connected, so unfinished short links still open the web fallback instead of launching the app with no resolved target.
+The AASA file registers `/s/*`, `/community/*`, and `/import`. Keep `/l/*` out of AASA until the short-link resolver backend is connected, so unfinished short links still open the web fallback instead of launching the app with no resolved target.
 
 The AASA file must be reachable without redirects:
 
 ```text
 https://link.pythonide.xin/.well-known/apple-app-site-association
 ```
 
+The local check is network-free by default:
+
+```bash
+node link-site/scripts/check-aasa-deployment.mjs --plan
+```
+
+After Pages has deployed, create the production release attestation with an explicit live opt-in:
+
+```bash
+node link-site/scripts/check-aasa-deployment.mjs \
+  --verify-live \
+  --environment production \
+  --confirm-domain link.pythonide.xin \
+  --output /controlled-temporary-directory/aasa-attestation.json
+```
+
+The verifier requests both the no-redirect origin URL and Apple's AASA CDN, requires HTTP 200 with `application/json`, validates the app ID plus `/community/*`, and compares their semantic JSON digests with the reviewed local file. The output contains only URLs, status/content-type, timestamps, and digests. It never contains credentials. Community's production release gate rejects missing or older-than-24-hour attestations.
+
 ## MCP OAuth
 
 The app and hosted files share one callback contract:
@@ -82,3 +106,16 @@ the canonical HTTPS URL before the official MCP SDK validates state and PKCE.
 Both MCP OAuth files and the AASA file must be deployed together. Do not add
 the OAuth callback path to `applinks`; the compatibility page must remain
 loadable on iOS versions earlier than 17.4.
+
+## Custom AI OAuth
+
+Custom AI connections use a separate callback and credential namespace:
+
+```text
+Client ID:    https://link.pythonide.xin/ai-oauth/client.json
+Redirect URI: https://link.pythonide.xin/ai-oauth/callback
+```
+
+On iOS 16.2–17.3, the callback page forwards the query losslessly to
+`pythonide://oauth/custom-ai`. Keep the AI and MCP paths separate even though
+they intentionally share the same visual treatment.

assets/share-page.js

@@ -72,6 +72,9 @@
       previewUnavailable: '预览暂不可用',
       previewUnavailableBody: '使用下方按钮在 PythonIDE 中打开这个作品。',
       community: '社区作品',
+      communityPost: '社区帖子',
+      communityPostSummary: '在 PythonIDE 中查看完整内容、评论和互动。',
+      targetComment: '目标评论',
       remoteImport: '远程导入',
       importRemoteProject: '导入远程项目',
       missingProjectURL: '缺少项目地址',
@@ -156,6 +159,9 @@
       previewUnavailable: 'Preview unavailable',
       previewUnavailableBody: 'Use the buttons below to open this work in PythonIDE.',
       community: 'Community work',
+      communityPost: 'Community post',
+      communityPostSummary: 'View the full post, comments, and interactions in PythonIDE.',
+      targetComment: 'Target comment',
       remoteImport: 'Remote import',
       importRemoteProject: 'Import remote project',
       missingProjectURL: 'Project URL missing',
@@ -232,9 +238,48 @@
     return String(navigatorLanguage || '').toLowerCase().startsWith('zh') ? 'zh' : 'en';
   }
 
+  function normalizedCommunityIdentifier(value) {
+    const normalized = String(value || '');
+    return normalized.length <= 160 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(normalized)
+      ? normalized
+      : '';
+  }
+
+  function parseCommunityRoute(url) {
+    if (url.hash) return null;
+    const pathParts = url.pathname.split('/');
+    if (pathParts.length !== 3 || pathParts[0] !== '' || pathParts[1] !== 'community') return null;
+
+    const postID = normalizedCommunityIdentifier(decodeSegment(pathParts[2]));
+    if (!postID) return null;
+
+    const allowedQueryNames = new Set(['commentID', 'lang', 'v']);
+    for (const name of url.searchParams.keys()) {
+      if (!allowedQueryNames.has(name) || url.searchParams.getAll(name).length !== 1) return null;
+    }
+    if (url.searchParams.has('lang') && !['zh', 'en'].includes(url.searchParams.get('lang'))) return null;
+
+    const rawCommentID = url.searchParams.get('commentID');
+    const commentID = rawCommentID === null ? '' : normalizedCommunityIdentifier(rawCommentID);
+    if (rawCommentID !== null && !commentID) return null;
+
+    const canonicalPath = `/community/${encodeURIComponent(postID)}`;
+    return {
+      type: 'community',
+      postID,
+      commentID,
+      path: commentID
+        ? `${canonicalPath}?commentID=${encodeURIComponent(commentID)}`
+        : canonicalPath,
+    };
+  }
+
   function parseRoutePath(value) {
     const path = safeForwardedPath(value) || '/';
     const url = new URL(path, SITE_ORIGIN);
+    if (url.pathname === '/community' || url.pathname.startsWith('/community/')) {
+      return parseCommunityRoute(url) || { type: 'home', path: '/' };
+    }
     const parts = url.pathname.split('/').filter(Boolean);
     if (parts[0] === 's' && parts[1]) {
       return { type: 'script', id: decodeSegment(parts[1]), path: url.pathname };
@@ -261,6 +306,12 @@
   }
 
   function customURLFor(route) {
+    if (route.type === 'community') {
+      const path = `pythonide://community/post/${encodeURIComponent(route.postID)}`;
+      return route.commentID
+        ? `${path}?commentID=${encodeURIComponent(route.commentID)}`
+        : path;
+    }
     if (route.type === 'script') {
       return `pythonide://community/script?id=${encodeURIComponent(route.id)}`;
     }
@@ -424,6 +475,7 @@
     formatCount,
     isProjectScript,
     normalizedTags,
+    normalizedCommunityIdentifier,
     parseRoutePath,
     previewLines,
     preferredLanguage,
@@ -932,6 +984,29 @@
     setLoading(false);
   }
 
+  function loadCommunity() {
+    currentView = 'community';
+    currentScript = null;
+    el.authorRow.hidden = true;
+    el.openApp.disabled = false;
+    setText(el.openAppLabel, tr('openApp'));
+    hideStatus();
+    setText(el.eyebrow, `PythonIDE · ${tr('community')}`);
+    setText(el.title, tr('communityPost'));
+    setText(el.summary, tr('communityPostSummary'));
+    renderGeneric(`PythonIDE · ${tr('communityPost')}`, '#');
+    renderStats([
+      { value: tr('readOnlyValue'), label: tr('preview') },
+      { value: 'App', label: tr('openMethod') },
+      { value: route.commentID ? '1' : '—', label: tr('targetComment') },
+      { value: tr('safeValue'), label: tr('linkStructure') },
+    ]);
+    setText(el.actionTitle, tr('openApp'));
+    setText(el.actionDescription, tr('communityPostSummary'));
+    updatePageMetadata(tr('communityPost'), tr('communityPostSummary'), DEFAULT_SHARE_IMAGE);
+    setLoading(false);
+  }
+
   function loadHome() {
     currentView = 'home';
     currentScript = null;
@@ -1022,6 +1097,7 @@
     if (currentView === 'script-error') renderScriptError();
     else if (currentView === 'import') loadImport();
     else if (currentView === 'short') loadShort();
+    else if (currentView === 'community') loadCommunity();
     else if (currentView === 'home') loadHome();
   }
 
@@ -1059,5 +1135,6 @@
   if (route.type === 'script') loadScript(initialScriptData(route.id));
   else if (route.type === 'import') loadImport();
   else if (route.type === 'short') loadShort();
+  else if (route.type === 'community') loadCommunity();
   else loadHome();
 }(typeof globalThis !== 'undefined' ? globalThis : this));

edge/README.md

@@ -2,7 +2,12 @@
 
 This worker adds server-rendered Open Graph metadata and dynamic PNG preview
 cards to the existing `link.pythonide.xin` GitHub Pages site. It does not change
-the community API and only intercepts `/s/*` and `/og/*`.
+the community API and only intercepts the AASA endpoint, `/s/*`, and `/og/*`.
+
+The AASA route serves the reviewed association document directly with an
+`application/json` content type. Keep it semantically equivalent to
+`../link-site/.well-known/apple-app-site-association`; the worker test enforces
+that contract before deployment.
 
 The worker fetches the published `index.html` from the `pythonide-link`
 repository, reads public script details from the existing community API, and

edge/tests/worker.test.js

@@ -1,6 +1,9 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
 import {
+  AASA_DOCUMENT,
+  handleAssociationFile,
   handleSharePage,
   injectInitialScriptData,
   injectMetadata,
@@ -11,6 +14,31 @@ import {
   workPresentation,
 } from '../worker.js';
 
+test('serves the reviewed AASA document with the required JSON content type', async () => {
+  const reviewedDocument = JSON.parse(fs.readFileSync(
+    new URL('../../link-site/.well-known/apple-app-site-association', import.meta.url),
+    'utf8',
+  ));
+  const response = handleAssociationFile(new Request(
+    'https://link.pythonide.xin/.well-known/apple-app-site-association',
+  ));
+
+  assert.equal(response.status, 200);
+  assert.match(response.headers.get('content-type'), /^application\/json\b/);
+  assert.deepEqual(AASA_DOCUMENT, reviewedDocument);
+  assert.deepEqual(await response.json(), reviewedDocument);
+});
+
+test('serves AASA HEAD requests without a response body', async () => {
+  const response = handleAssociationFile(new Request(
+    'https://link.pythonide.xin/.well-known/apple-app-site-association',
+    { method: 'HEAD' },
+  ));
+
+  assert.equal(response.status, 200);
+  assert.equal(await response.text(), '');
+});
+
 test('embeds safe first-paint work data into generated pages', () => {
   const template = '<script id="initial-script-data" type="application/json">{}</script>';
   const html = injectInitialScriptData(template, { script_id: 'scr_1', title: '$1</script><b>unsafe</b>' });

edge/worker.js

@@ -4,6 +4,24 @@ const DEFAULT_INDEX_URL = 'https://raw.githubusercontent.com/Python-IDE/pythonid
 const DEFAULT_IMAGE = `${SITE_ORIGIN}/assets/app-icon.png`;
 const DEFAULT_TITLE = 'Python IDE 社区作品';
 const DEFAULT_DESCRIPTION = '在 Python IDE 中查看、运行和导入社区作品。';
+const AASA_DOCUMENT = {
+  applinks: {
+    details: [
+      {
+        appIDs: ['8GYAXFCC2W.app.pythonide'],
+        components: [
+          { '/': '/s/*', comment: 'Open a community script or MiniApp work.' },
+          { '/': '/community/*', comment: 'Open a Community V2 post or comment.' },
+          { '/': '/import', comment: 'Open a remote import preview.' },
+        ],
+      },
+    ],
+  },
+  webcredentials: {
+    apps: ['8GYAXFCC2W.app.pythonide'],
+  },
+};
+const AASA_JSON = JSON.stringify(AASA_DOCUMENT);
 
 const FONT = {
   ' ': ['00000','00000','00000','00000','00000','00000','00000'],
@@ -470,9 +488,22 @@ async function handleOGImage(scriptId, fetcher = fetch) {
   }
 }
 
+function handleAssociationFile(request) {
+  return new Response(request.method === 'HEAD' ? null : AASA_JSON, {
+    status: 200,
+    headers: {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'public, max-age=300, s-maxage=3600, must-revalidate',
+      'X-Content-Type-Options': 'nosniff',
+    },
+  });
+}
+
 export {
+  AASA_DOCUMENT,
   buildMetaBlock,
   encodePNG,
+  handleAssociationFile,
   handleOGImage,
   handleSharePage,
   injectInitialScriptData,
@@ -490,6 +521,9 @@ export default {
       return new Response('Method not allowed', { status: 405, headers: { Allow: 'GET, HEAD' } });
     }
     const url = new URL(request.url);
+    if (url.pathname === '/.well-known/apple-app-site-association') {
+      return handleAssociationFile(request);
+    }
     const shareMatch = /^\/s\/([^/]+)\/?$/.exec(url.pathname);
     if (shareMatch) return handleSharePage(request, decodeSegment(shareMatch[1]), env);
     const imageMatch = /^\/og\/script\/([^/]+)\.png$/.exec(url.pathname);

edge/wrangler.jsonc

@@ -4,6 +4,10 @@
   "main": "worker.js",
   "compatibility_date": "2026-07-01",
   "routes": [
+    {
+      "pattern": "link.pythonide.xin/.well-known/apple-app-site-association",
+      "zone_name": "pythonide.xin"
+    },
     {
       "pattern": "link.pythonide.xin/s/*",
       "zone_name": "pythonide.xin"