Changeset 640b39c in Klonkt for src/middleware/auth.js

Timestamp:

06/14/2026 04:25:27 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

a64f642

Parents:

8cb1dc7

Message:

auth: read-only view accounts (view everything, modify nothing)

New users.readonly column + readonly in the session. Global guard in server.js
blocks every state-modifying method (POST/PUT/PATCH/DELETE) for read-only
accounts -> no comments, saves, settings, nothing. GET remains free, so they
can view everything (including admin panels). Sticky "read-only demo" banner in
the shell when such an account is logged in.

Co-Authored-By: Claude <noreply@…>

(No files)