source: Klonkt/src/middleware/render.js@ 5e95aac

main
Last change on this file since 5e95aac was 8afbdd6, checked in by roboburr <roboburr@…>, 3 months ago

feat: viewer role + artists directory + Klonkt Hub Beta rebrand

Viewer role (replaces the separate view-mode/readonly toggle):

  • 'kijker' is now a real role (VALID_ROLES) selectable in Admin. May view EVERYTHING including Admin, but cannot modify anything.
  • isViewer(user) (= role kijker or legacy readonly flag) is the source; requireGod/requireSiteManager(BySlug) let a viewer through (viewing), the global guard 403s every write. Existing readonly accounts are migrated on each role change (readonly=0).
  • Write leaks via GET patched: /prutter/new (INSERT) blocks for viewers, /prutter/:id skips markAsRead (UPDATE); WS upgrade rejects viewers (the HTTP guard doesn't cover WebSockets).
  • Clean "Viewer mode" page (viewer-blocked) instead of raw 403 text; styled sticky banner; account page shows read-only UI instead of an upload button that silently 403s. canMutate hides write buttons.

Scalability (>50 artists):

  • Hub home shows max 24 (most active first) + "All N artists ->".
  • New searchable, paginated /artiesten directory (hub only).
  • 'user' + 'artiesten' reserved as slugs.

Rebrand PrutFolio v1 -> Klonkt Hub Beta (footer, PWA manifest, account/
admin texts, default page title, startup, README; internal package +
PWA id 'prutfolio' remain for stability).

Co-Authored-By: Claude <noreply@…>

  • Property mode set to 100644
File size: 5.1 KB
Line 
1/**
2 * Render helper — THE pattern for the entire app.
3 *
4 * Two modes:
5 * 1. HTMX request → render just the page content (no shell)
6 * 2. Full page request → render content, then embed in shell
7 *
8 * Usage:
9 * renderPage(req, res, 'pages/home', { posts, ...data })
10 */
11
12import path from 'path';
13import { fileURLToPath } from 'url';
14import ejs from 'ejs';
15import db from '../config/database.js';
16import PermissionsService from '../services/PermissionsService.js';
17import { isViewer } from './auth.js';
18import { getSetting } from '../services/SettingsService.js';
19import { PLATFORMS as PLATFORMS_CATALOG } from '../services/PlatformIcons.js';
20
21const __dirname = path.dirname(fileURLToPath(import.meta.url));
22const VIEWS_DIR = path.join(__dirname, '..', 'views');
23
24const formatDate = (iso) => {
25 if (!iso) return '';
26 const d = new Date(iso);
27 const months = ['januari','februari','maart','april','mei','juni','juli','augustus','september','oktober','november','december'];
28 return `${d.getDate()} ${months[d.getMonth()]} ${d.getFullYear()}`;
29};
30
31const formatDateTime = (iso) => {
32 if (!iso) return '';
33 const d = new Date(iso);
34 return d.toLocaleString('nl-NL', { dateStyle: 'medium', timeStyle: 'short' });
35};
36
37export async function renderPage(req, res, viewName, data = {}) {
38 // Decide: partial (HTMX) or full?
39 const isPartial = req.headers['hx-request'] === 'true' || req.query.partial === '1';
40
41 // Bezit deze (niet-god) user een eigen site? Bepaalt of 'ie een "Beheer"-
42 // ingang ziet (artiest-zelfbeheer). god ziet beheer sowieso (op rol).
43 const _u = req.session?.user || null;
44 const userOwnsSite = !!(_u && _u.role !== 'god' &&
45 db.prepare('SELECT 1 FROM sites WHERE owner_id = ? LIMIT 1').get(_u.id));
46
47 // De avatar van de SITE-EIGENAAR (niet de kijker!) — voor de PrutFolio-kop,
48 // zodat de artiest z'n eigen account-foto als sitefoto kan gebruiken.
49 const _site = data.site || res.locals.site || null;
50 const siteOwnerAvatar = (_site && _site.owner_id)
51 ? (db.prepare('SELECT avatar_url FROM users WHERE id = ?').get(_site.owner_id)?.avatar_url || null)
52 : null;
53
54 // Kijker-modus: alles bekijken mag, niets wijzigen. Views gebruiken canMutate
55 // om schrijf-knoppen (posten, opslaan, verwijderen) te verbergen/uit te zetten.
56 const _isViewer = isViewer(_u);
57
58 // Common locals
59 const locals = {
60 user: _u,
61 userOwnsSite,
62 isViewer: _isViewer,
63 canMutate: !_isViewer,
64 siteOwnerAvatar,
65 site: _site,
66 audioTracks: data.audioTracks || res.locals.audioTracks || [],
67 siteUrlBase: res.locals.siteUrlBase || '',
68 tenancy: res.locals.tenancy || 'solo',
69 hubTitle: getSetting('hub_title') || '',
70 platforms_catalog: PLATFORMS_CATALOG,
71 permissions: PermissionsService,
72 formatDate,
73 formatDateTime,
74 pageTitle: data.pageTitle || (data.site && data.site.title) || 'Klonkt Hub Beta',
75 bodyClass: data.bodyClass || 'on-home',
76 socialDescr: data.socialDescr || '',
77 socialImage: data.socialImage || '',
78 cspNonce: () => '',
79 currentPath: req.path,
80 ...data,
81 };
82
83 try {
84 // Step 1: Render the page view to HTML
85 const viewPath = path.join(VIEWS_DIR, viewName + '.ejs');
86 const pageContent = await ejs.renderFile(viewPath, locals, { async: false });
87
88 if (isPartial) {
89 // HTMX: just send the content. Set HX-Trigger for body class swap
90 res.setHeader('HX-Trigger-After-Settle', JSON.stringify({
91 pcmsNav: { bodyClass: locals.bodyClass },
92 pcmsPostSwap: data.post ? {
93 title: data.post.title,
94 slug: data.post.slug,
95 pageTitle: locals.pageTitle,
96 } : null,
97 }));
98 return res.send(pageContent);
99 }
100
101 // Full: wrap content in shell
102 locals.pageContent = pageContent;
103 res.render('shell', locals);
104 } catch (err) {
105 console.error('[renderPage] Error rendering', viewName, err);
106 if (process.env.NODE_ENV === 'production') {
107 return res.status(500).send('Internal Server Error');
108 }
109 // Dev: surface the underlying cause prominently. EJS rewrites err.message
110 // to include the file/line/code-context, so we also surface name+stack
111 // separately in case the message was truncated or empty.
112 const escape = (s) => String(s == null ? '' : s)
113 .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
114 res.status(500).send(`<!doctype html>
115<meta charset="utf-8">
116<title>Render error: ${escape(viewName)}</title>
117<style>
118 body { font: 14px/1.5 ui-monospace, monospace; max-width: 1100px; margin: 2rem auto; padding: 0 1rem; background:#1a1a1a; color:#eee; }
119 h1 { color:#dc2626; font-family: ui-sans-serif, system-ui; }
120 h2 { color:#fb923c; font-size:1rem; margin-top:1.5rem; }
121 pre { background:#0a0a0a; border:1px solid #333; border-radius:6px; padding:1rem; overflow:auto; white-space:pre-wrap; word-break:break-word; }
122 .cause { background:#3d0a0a; border-color:#7a1a1a; color:#fca5a5; font-weight:600; }
123</style>
124<h1>Render error in ${escape(viewName)}</h1>
125<h2>Cause</h2>
126<pre class="cause">${escape(err.name || 'Error')}: ${escape(err.message || '(no message)')}</pre>
127<h2>Stack</h2>
128<pre>${escape(err.stack || '(no stack)')}</pre>
129${err.path ? `<h2>File</h2><pre>${escape(err.path)}</pre>` : ''}
130`);
131 }
132}
Note: See TracBrowser for help on using the repository browser.