Changeset 640b39c in Klonkt for src/views


Ignore:
Timestamp:
06/14/2026 04:25:27 PM (3 months ago)
Author:
roboburr <roboburr@…>
Branches:
main
Children:
a64f642
Parents:
8cb1dc7
Message:

auth: read-only view accounts (view everything, modify nothing)

New users.readonly column + readonly in the session. Global guard in server.js
blocks every state-modifying method (POST/PUT/PATCH/DELETE) for read-only
accounts -> no comments, saves, settings, nothing. GET remains free, so they
can view everything (including admin panels). Sticky "read-only demo" banner in
the shell when such an account is logged in.

Co-Authored-By: Claude <noreply@…>

File:
1 edited

Legend:

Unmodified
Added
Removed

  • src/views/shell.ejs

    r8cb1dc7 r640b39c  
    238238
    239239<body class="<%= bodyClass || 'on-home' %> has-bottom-tab" data-feed-view="<%= _e(safeSite.feed_view_default || 'timeline') %>" data-grid-cols="3">
     240
     241<% if (user && user.readonly) { %>
     242  <div style="position:sticky;top:0;z-index:50;background:#e8b04b;color:#1a1a1a;text-align:center;font-size:0.85rem;font-weight:600;padding:0.4rem 1rem;">
     243    👁️ Demo — alleen-lezen: je kunt alles bekijken, maar niets wijzigen.
     244  </div>
     245<% } %>
    240246
    241247<%# Geen shell-chrome (masthead/profile-header/view-switcher/bottom-tab) op:
Note: See TracChangeset for help on using the changeset viewer.