Changeset 640b39c in Klonkt for src/routes/auth.js

Timestamp:

06/14/2026 04:25:27 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

a64f642

Parents:

8cb1dc7

Message:

auth: read-only view accounts (view everything, modify nothing)

New users.readonly column + readonly in the session. Global guard in server.js
blocks every state-modifying method (POST/PUT/PATCH/DELETE) for read-only
accounts -> no comments, saves, settings, nothing. GET remains free, so they
can view everything (including admin panels). Sticky "read-only demo" banner in
the shell when such an account is logged in.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/auth.js (modified) (2 diffs)

src/routes/auth.js

@@ -76 +76 @@
     id: user.id, username: user.username, email: user.email, role: user.role,
     avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
+    readonly: !!user.readonly,
   };
   res.redirect(next || '/');
@@ -290 +291 @@
       id: user.id, username: user.username, email: user.email, role: user.role,
       avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
+      readonly: !!user.readonly,
     };
     res.redirect(next || '/');