Changeset 640b39c in Klonkt


Ignore:
Timestamp:
06/14/2026 04:25:27 PM (3 months ago)
Author:
roboburr <roboburr@…>
Branches:
main
Children:
a64f642
Parents:
8cb1dc7
Message:

auth: read-only view accounts (view everything, modify nothing)

New users.readonly column + readonly in the session. Global guard in server.js
blocks every state-modifying method (POST/PUT/PATCH/DELETE) for read-only
accounts -> no comments, saves, settings, nothing. GET remains free, so they
can view everything (including admin panels). Sticky "read-only demo" banner in
the shell when such an account is logged in.

Co-Authored-By: Claude <noreply@…>

Location:
src
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • src/config/database.js

    r8cb1dc7 r640b39c  
    4141  // Google OAuth: koppel een Google-account aan een user (login via Google).
    4242  ensureColumn('users', 'google_sub', 'TEXT');
     43  // Read-only/kijk-account: kan alles bekijken maar geen wijzigingen doen.
     44  ensureColumn('users', 'readonly', 'INTEGER DEFAULT 0');
    4345  // Site-level moderation toggle. 'trust' = auto-approve, 'moderate' = pending until reviewed.
    4446  ensureColumn('sites', 'comments_moderation_mode', "TEXT DEFAULT 'trust'");

  • src/routes/auth.js

    r8cb1dc7 r640b39c  
    7676    id: user.id, username: user.username, email: user.email, role: user.role,
    7777    avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
     78    readonly: !!user.readonly,
    7879  };
    7980  res.redirect(next || '/');
    … …  
    290291      id: user.id, username: user.username, email: user.email, role: user.role,
    291292      avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
     293      readonly: !!user.readonly,
    292294    };
    293295    res.redirect(next || '/');

  • src/server.js

    r8cb1dc7 r640b39c  
    164164});
    165165
     166// Read-only/kijk-accounts: alles bekijken mag, niets wijzigen. Blokkeert elke
     167// state-wijzigende methode (de login-POST zelf zet de sessie pas, dus die valt
     168// hier nog niet onder).
     169app.use((req, res, next) => {
     170  if (req.session?.user?.readonly && req.method !== 'GET' && req.method !== 'HEAD' && req.method !== 'OPTIONS') {
     171    return res.status(403).send('Demo-account: alleen-lezen — wijzigen is uitgeschakeld.');
     172  }
     173  next();
     174});
     175
    166176app.use('/auth', authRoutes);
    167177app.use('/account', accountRoutes);

  • src/views/shell.ejs

    r8cb1dc7 r640b39c  
    238238
    239239<body class="<%= bodyClass || 'on-home' %> has-bottom-tab" data-feed-view="<%= _e(safeSite.feed_view_default || 'timeline') %>" data-grid-cols="3">
     240
     241<% if (user && user.readonly) { %>
     242  <div style="position:sticky;top:0;z-index:50;background:#e8b04b;color:#1a1a1a;text-align:center;font-size:0.85rem;font-weight:600;padding:0.4rem 1rem;">
     243    👁️ Demo — alleen-lezen: je kunt alles bekijken, maar niets wijzigen.
     244  </div>
     245<% } %>
    240246
    241247<%# Geen shell-chrome (masthead/profile-header/view-switcher/bottom-tab) op:
Note: See TracChangeset for help on using the changeset viewer.