Changeset 640b39c in Klonkt for src/server.js

Timestamp:

06/14/2026 04:25:27 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

a64f642

Parents:

8cb1dc7

Message:

auth: read-only view accounts (view everything, modify nothing)

New users.readonly column + readonly in the session. Global guard in server.js
blocks every state-modifying method (POST/PUT/PATCH/DELETE) for read-only
accounts -> no comments, saves, settings, nothing. GET remains free, so they
can view everything (including admin panels). Sticky "read-only demo" banner in
the shell when such an account is logged in.

Co-Authored-By: Claude <noreply@…>

File:

• src/server.js (modified) (1 diff)

src/server.js

@@ -164 +164 @@
 });
 
+// Read-only/kijk-accounts: alles bekijken mag, niets wijzigen. Blokkeert elke
+// state-wijzigende methode (de login-POST zelf zet de sessie pas, dus die valt
+// hier nog niet onder).
+app.use((req, res, next) => {
+  if (req.session?.user?.readonly && req.method !== 'GET' && req.method !== 'HEAD' && req.method !== 'OPTIONS') {
+    return res.status(403).send('Demo-account: alleen-lezen — wijzigen is uitgeschakeld.');
+  }
+  next();
+});
+
 app.use('/auth', authRoutes);
 app.use('/account', accountRoutes);