@@ -221,3 +221,5 @@ __marimo__/
 
 # Streamlit
 .streamlit/secrets.toml
+
+config/data/*
@@ -1,5 +1,6 @@
 import { validateResourceId } from "../feedback/resources.js";
 import type { Resource } from "../feedback/resources.js";
+import type { Vote, VoteResult } from "../protocol/github.js";
 
 export interface ReactionState {
   id: string | null;
@@ -111,11 +112,47 @@ export class FeedbackClient {
     return { id: payload.id, number: payload.number };
   }
 
-  async #post(path: string, body: Record<string, unknown>, signal?: AbortSignal): Promise<Record<string, unknown>> {
+  async vote(
+    key: string,
+    requested: Vote,
+    token: AccessToken,
+    signal?: AbortSignal,
+  ): Promise<VoteResult> {
+    validateResourceId(key);
+    const payload = await this.#post(
+      "votes",
+      { key, vote: requested },
+      signal,
+      token.value,
+    );
+    const up = payload.up;
+    const down = payload.down;
+    const viewer = payload.viewer;
+    if (
+      !Number.isSafeInteger(up) || (up as number) < 0 ||
+      !Number.isSafeInteger(down) || (down as number) < 0 ||
+      (viewer !== "up" && viewer !== "down" && viewer !== "none")
+    ) {
+      throw new TypeError("Invalid vote response");
+    }
+    return { up: up as number, down: down as number, viewer };
+  }
+
+  async #post(
+    path: string,
+    body: Record<string, unknown>,
+    signal?: AbortSignal,
+    accessToken?: string,
+  ): Promise<Record<string, unknown>> {
     const url = new URL(`/v1/sites/${encodeURIComponent(this.#site)}/${path}`, this.#apiOrigin);
+    const headers: Record<string, string> = {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+    };
+    if (accessToken !== undefined) headers.Authorization = `Bearer ${accessToken}`;
     const init: RequestInit = {
       method: "POST",
-      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      headers,
       body: JSON.stringify(body),
     };
     if (signal) init.signal = signal;
 
@@ -1,9 +1,9 @@
-import { FeedbackClient } from "../api/client.js";
+import { FeedbackClient, FeedbackError } from "../api/client.js";
 import { Authentication } from "../auth/controller.js";
 import { PendingVoteStore } from "../auth/pending-vote.js";
 import { trustedOrigin } from "../auth/origin.js";
 import { Stars } from "../feedback/stars.js";
-import { GitHubRequestError, viewerVote, vote, type Vote } from "../protocol/github.js";
+import type { Vote } from "../protocol/github.js";
 
 const parameters = new URLSearchParams(location.search);
 const site = parameters.get("site") ?? "feedback-cpp-social";
@@ -65,13 +65,12 @@ async function castVote(requested: Vote): Promise<void> {
       const discussion = await client.ensure(resource, token.creationGrant);
       discussionId = discussion.id;
     }
-    const current = await viewerVote(token, discussionId);
-    const result = await vote(token, discussionId, current, pending.vote);
+    const result = await client.vote(resource.key, pending.vote, token);
     render(result.up, result.down);
     status.textContent = result.viewer === "none" ? "Vote removed." : `${result.viewer} vote saved.`;
   } catch (error) {
     pendingVotes.clear();
-    if (error instanceof GitHubRequestError && error.status === 401) authentication.clear();
+    if (error instanceof FeedbackError && error.status === 401) authentication.clear();
     showError(error);
   } finally {
     disable(false);
 
@@ -77,3 +77,30 @@ void test("default browser fetch keeps its global receiver", async () => {
 
   assert.equal(called, true);
 });
+
+void test("votes are submitted through the service with the user token", async () => {
+  let request: Request | undefined;
+  const fetch = (input: URL | RequestInfo, init?: RequestInit): Promise<Response> => {
+    request = new Request(input, init);
+    return Promise.resolve(Response.json({
+      v: 1,
+      up: 12,
+      down: 3,
+      viewer: "up",
+    }));
+  };
+  const client = new FeedbackClient({
+    apiOrigin: "https://feedback-api.cpp.social",
+    site: "cpp-social",
+    fetch,
+  });
+  const token = { value: "ghu_user", expiresAt: 2_000_000_000, creationGrant: "grant" };
+
+  const result = await client.vote("feedback/example", "up", token);
+
+  assert.ok(request);
+  assert.equal(request.url, "https://feedback-api.cpp.social/v1/sites/cpp-social/votes");
+  assert.equal(request.headers.get("authorization"), "Bearer ghu_user");
+  assert.deepEqual(await request.json(), { key: "feedback/example", vote: "up" });
+  assert.deepEqual(result, { up: 12, down: 3, viewer: "up" });
+});
@@ -3,6 +3,7 @@
 import hashlib
 import json
 import logging
+from contextlib import suppress
 from typing import cast
 
 from starlette.requests import Request
@@ -22,7 +23,9 @@
 from feedback.protocol.github.oauth import OAuthError
 from feedback.service.discussions import DiscussionError
 from feedback.service.oauth_state import GrantError, StateError
+from feedback.service.resources import ResourceError, validate_resource_id
 from feedback.service.runtime import FeedbackRuntime
+from feedback.service.votes import VoteError
 
 oauth_logger = logging.getLogger("feedback.oauth")
 github_logger = logging.getLogger("feedback.github")
@@ -39,9 +42,11 @@ async def reactions(request: Request) -> Response:
         assert origin is not None
         return preflight(origin, method="GET", headers="If-None-Match")
     keys = resource_keys(request.query_params, site.max_batch_size)
-    now = int(container.clock())
     cached = container.databases[site.id].reactions(keys)
-    container.schedule_refresh(site, cached)
+    with suppress(GitHubError):
+        await container.refresh_stale(site, cached)
+    cached = container.databases[site.id].reactions(keys)
+    now = int(container.clock())
     items: dict[str, dict[str, str | int | bool | None]] = {}
     for key in keys:
         item = cached.get(key)
@@ -60,7 +65,10 @@ async def reactions(request: Request) -> Response:
     body = json.dumps(payload, separators=(",", ":"), sort_keys=True).encode()
     etag = f'"{hashlib.sha256(body).hexdigest()}"'
     headers = {
-        "Cache-Control": "public, max-age=30, stale-while-revalidate=300",
+        # Revalidate with the service so a successful vote is visible after a
+        # reload. GitHub traffic is still bounded by the server-side freshness
+        # window and coalesced refresh task.
+        "Cache-Control": "no-cache",
         "ETag": etag,
         "Vary": "Origin",
     }
@@ -183,6 +191,52 @@ async def ensure_discussion(request: Request) -> Response:
     )
 
 
+async def submit_vote(request: Request) -> Response:
+    container, site, origin = site_context(request, require_origin=True)
+    assert origin is not None
+    if container.votes is None:
+        raise ApiError("service_unavailable", "Voting is unavailable.", 503)
+    if request.method == "OPTIONS":
+        return preflight(origin, method="POST", headers="Authorization, Content-Type")
+    body = await json_strings(request, frozenset({"key", "vote"}))
+    try:
+        resource_id = validate_resource_id(body["key"])
+    except ResourceError:
+        raise ApiError("invalid_vote", "Vote parameters are invalid.", 400) from None
+    if body["vote"] not in {"up", "down"}:
+        raise ApiError("invalid_vote", "Vote parameters are invalid.", 400)
+    cached = container.databases[site.id].reactions([resource_id])
+    with suppress(GitHubError):
+        await container.refresh_stale(site, cached)
+    try:
+        result = await container.votes.vote(
+            container.databases[site.id],
+            resource_id=resource_id,
+            requested=body["vote"],
+            token=bearer_token(request),
+        )
+    except VoteError as exc:
+        raise ApiError("discussion_not_found", str(exc), 404) from exc
+    except GitHubError as exc:
+        github_logger.warning(
+            "GitHub vote failed: code=%s status=%s github_request_id=%s site=%s origin=%s",
+            exc.code,
+            exc.status,
+            exc.request_id,
+            site.id,
+            origin,
+        )
+        status = 401 if exc.status == 401 else 502
+        raise ApiError("github_vote_failed", "GitHub rejected the vote.", status) from exc
+    return cors(
+        JSONResponse(
+            {"v": 1, "up": result.up, "down": result.down, "viewer": result.viewer},
+            headers={"Cache-Control": "no-store"},
+        ),
+        origin,
+    )
+
+
 async def api_error(request: Request, error: Exception) -> Response:
     assert isinstance(error, ApiError)
     response = error_response(error)
@@ -195,6 +249,20 @@ def services(request: Request) -> FeedbackRuntime:
     return cast(FeedbackRuntime, request.app.state.services)
 
 
+def bearer_token(request: Request) -> str:
+    authorization = request.headers.get("authorization", "")
+    scheme, separator, token = authorization.partition(" ")
+    if (
+        separator != " "
+        or scheme.lower() != "bearer"
+        or not token.startswith("ghu_")
+        or not 8 <= len(token) <= 512
+        or any(character.isspace() for character in token)
+    ):
+        raise ApiError("invalid_token", "A GitHub user token is required.", 401)
+    return token
+
+
 def site_context(
     request: Request, *, require_origin: bool = False
 ) -> tuple[FeedbackRuntime, SiteConfig, str | None]:
 
@@ -22,16 +22,19 @@
     oauth_authorize,
     oauth_exchange,
     reactions,
+    submit_vote,
 )
 from feedback.config import Config, load_config_from_environment
 from feedback.database.sqlite import SiteDatabase
 from feedback.protocol.github.client import GitHubClient
 from feedback.protocol.github.discussions import GitHubDiscussions
 from feedback.protocol.github.oauth import OAuthClient
+from feedback.protocol.github.votes import GitHubVotes
 from feedback.service.discussions import DiscussionService
 from feedback.service.oauth_state import CreationGrantSigner, StateSigner
 from feedback.service.reaction_cache import ReactionRefresher
 from feedback.service.runtime import FeedbackRuntime
+from feedback.service.votes import VoteService
 
 logger = logging.getLogger("feedback.runtime")
 
@@ -44,6 +47,7 @@ def create_app(
     refresher: ReactionRefresher | None = None,
     grants: CreationGrantSigner | None = None,
     discussions: DiscussionService | None = None,
+    votes: VoteService | None = None,
 ) -> Starlette:
     if oauth is not None and grants is None:
         raise ValueError("OAuth and creation grants must be configured together")
@@ -56,6 +60,7 @@ async def lifespan(application: Starlette) -> AsyncIterator[None]:
         resolved_refresher: ReactionRefresher | None
         resolved_grants: CreationGrantSigner | None
         resolved_discussions: DiscussionService | None
+        resolved_votes: VoteService | None
         if config is None and oauth is None:
             owned_http = httpx.AsyncClient(
                 timeout=httpx.Timeout(
@@ -70,11 +75,13 @@ async def lifespan(application: Starlette) -> AsyncIterator[None]:
             github = _github_client(loaded, owned_http, clock)
             resolved_refresher = ReactionRefresher(github, clock=clock)
             resolved_discussions = DiscussionService(GitHubDiscussions(github))
+            resolved_votes = VoteService(GitHubVotes(owned_http))
         else:
             resolved_oauth = oauth
             resolved_refresher = refresher
             resolved_grants = grants
             resolved_discussions = discussions
+            resolved_votes = votes
         databases = {
             site_id: SiteDatabase(loaded.service.data_directory / f"{site_id}.sqlite3")
             for site_id in loaded.sites
@@ -89,6 +96,7 @@ async def lifespan(application: Starlette) -> AsyncIterator[None]:
             refresher=resolved_refresher,
             grants=resolved_grants,
             discussions=resolved_discussions,
+            votes=resolved_votes,
         )
         application.state.services = services
         logger.info(
@@ -122,6 +130,11 @@ async def lifespan(application: Starlette) -> AsyncIterator[None]:
                 ensure_discussion,
                 methods=["POST", "OPTIONS"],
             ),
+            Route(
+                "/v1/sites/{site}/votes",
+                submit_vote,
+                methods=["POST", "OPTIONS"],
+            ),
         ],
         lifespan=lifespan,
         exception_handlers={ApiError: api_error},
 
@@ -0,0 +1,6 @@
+UPDATE discussions
+SET
+    up_count = MAX(0, up_count + ?),
+    down_count = MAX(0, down_count + ?)
+WHERE resource_id = ? AND github_node_id = ?
+RETURNING up_count, down_count
@@ -15,6 +15,7 @@
 DISCUSSION = load("discussion")
 PUT_DISCUSSION = load("put_discussion")
 UPDATE_REACTIONS = load("update_reactions")
+ADJUST_REACTIONS = load("adjust_reactions")
 
 
 class DatabaseError(RuntimeError):
@@ -124,3 +125,18 @@ def update_reactions(
                 (up, down, locked, github_updated_at, fetched_at, node_id),
             )
         return cursor.rowcount == 1
+
+    def adjust_reactions(
+        self,
+        *,
+        resource_id: str,
+        node_id: str,
+        up_delta: int,
+        down_delta: int,
+    ) -> tuple[int, int] | None:
+        with self.connect() as connection:
+            row = connection.execute(
+                ADJUST_REACTIONS,
+                (up_delta, down_delta, resource_id, node_id),
+            ).fetchone()
+        return (row[0], row[1]) if row is not None else None
@@ -0,0 +1,10 @@
+query FeedbackViewerVote($id: ID!) {
+  node(id: $id) {
+    ... on Discussion {
+      reactionGroups {
+        content
+        viewerHasReacted
+      }
+    }
+  }
+}
@@ -0,0 +1,24 @@
+mutation FeedbackVote(
+  $id: ID!
+  $removeUp: Boolean!
+  $removeDown: Boolean!
+  $addUp: Boolean!
+  $addDown: Boolean!
+) {
+  removeUp: removeReaction(input: {subjectId: $id, content: THUMBS_UP})
+    @include(if: $removeUp) { subject { ...FeedbackReactions } }
+  removeDown: removeReaction(input: {subjectId: $id, content: THUMBS_DOWN})
+    @include(if: $removeDown) { subject { ...FeedbackReactions } }
+  addUp: addReaction(input: {subjectId: $id, content: THUMBS_UP})
+    @include(if: $addUp) { subject { ...FeedbackReactions } }
+  addDown: addReaction(input: {subjectId: $id, content: THUMBS_DOWN})
+    @include(if: $addDown) { subject { ...FeedbackReactions } }
+}
+
+fragment FeedbackReactions on Reactable {
+  reactionGroups {
+    content
+    users { totalCount }
+    viewerHasReacted
+  }
+}