Changeset 8afbdd6 in Klonkt for src/views/pages/post.ejs

Timestamp:

06/14/2026 06:07:51 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

c869272

Parents:

b94c08e

Message:

feat: viewer role + artists directory + Klonkt Hub Beta rebrand

Viewer role (replaces the separate view-mode/readonly toggle):

• 'kijker' is now a real role (VALID_ROLES) selectable in Admin. May view EVERYTHING including Admin, but cannot modify anything.
• isViewer(user) (= role kijker or legacy readonly flag) is the source; requireGod/requireSiteManager(BySlug) let a viewer through (viewing), the global guard 403s every write. Existing readonly accounts are migrated on each role change (readonly=0).
• Write leaks via GET patched: /prutter/new (INSERT) blocks for viewers, /prutter/:id skips markAsRead (UPDATE); WS upgrade rejects viewers (the HTTP guard doesn't cover WebSockets).
• Clean "Viewer mode" page (viewer-blocked) instead of raw 403 text; styled sticky banner; account page shows read-only UI instead of an upload button that silently 403s. canMutate hides write buttons.

Scalability (>50 artists):

• Hub home shows max 24 (most active first) + "All N artists ->".
• New searchable, paginated /artiesten directory (hub only).
• 'user' + 'artiesten' reserved as slugs.

Rebrand PrutFolio v1 -> Klonkt Hub Beta (footer, PWA manifest, account/
admin texts, default page title, startup, README; internal package +
PWA id 'prutfolio' remain for stability).

Co-Authored-By: Claude <noreply@…>

File:

• src/views/pages/post.ejs (modified) (4 diffs)

src/views/pages/post.ejs

@@ -103 +103 @@
               <div class="comment-content"><%= c.content %></div>
               <div class="comment-actions">
-                <% if (user) { %>
+                <% if (user && canMutate) { %>
                   <button type="button" class="comment-reply-btn" data-reply-to="<%= c.id %>">Reply</button>
                 <% } %>
@@ -114 +114 @@
 
               <!-- Inline reply form (hidden by default) -->
-              <% if (user) { %>
+              <% if (user && canMutate) { %>
                 <form method="post" action="<%= _base %>/comments" class="comment-reply-form" hidden data-reply-form-for="<%= c.id %>">
                   <input type="hidden" name="post_slug" value="<%= post.slug %>">
@@ -163 +163 @@
 
     <!-- Top-level comment form (only for logged-in users for now) -->
-    <% if (user) { %>
+    <% if (user && canMutate) { %>
       <form method="post" action="<%= _base %>/comments" class="comment-form">
         <input type="hidden" name="post_slug" value="<%= post.slug %>">
@@ -172 +172 @@
         <button type="submit" class="btn btn-primary">Post comment</button>
       </form>
-    <% } else { %>
+    <% } else if (!user) { %>
       <p class="comments-login-cta">
         <a href="/auth/login?next=<%= encodeURIComponent(_base + '/' + post.slug + '#comments') %>" class="btn">Log in to comment</a>
       </p>
+    <% } else { %>
+      <p class="comments-login-cta" style="color:var(--ink-muted)">👁️ Kijker-modus — reageren is uitgeschakeld.</p>
     <% } %>
   </section>