Changeset 8cb1dc7 in Klonkt

Timestamp:

06/14/2026 04:17:14 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

640b39c

Parents:

ccbd6a6

Message:

hub: artist self-management — owner manages their own subsite (posts/appearance/comments)

A site owner (member) now gets a "My PrutFolio" dashboard and can manage their
OWN site; cross-site access is restricted.

• auth.js: requireSiteManager (owner of res.locals.site or god) + requireSiteManagerBySlug (owner of :slug or god).
• admin.js: /admin role-aware -> god=hub management, owner=my-site dashboard, member without site=403.
• admin-sites.js: /:slug/edit + /save owner-or-god (was god-only); upload-photo requireAuth. list/new/create/delete remain god-only.
• admin-comments.js: requireSiteManager + redirects/form actions via siteUrlBase so the artist context (/user/<slug>/admin/comments) is correct.
• render.js: userOwnsSite flag; topnav + overview show "Admin" for owners; topnav "New post" uses siteUrlBase.
• pages/my-site.ejs: artist dashboard.

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• middleware/auth.js (modified) (2 diffs)
• middleware/render.js (modified) (2 diffs)
• routes/admin-comments.js (modified) (3 diffs)
• routes/admin-sites.js (modified) (4 diffs)
• routes/admin.js (modified) (1 diff)
• views/pages/admin-comments.ejs (modified) (2 diffs)
• views/pages/hub-home.ejs (modified) (1 diff)
• views/pages/my-site.ejs (added)
• views/partials/topnav.ejs (modified) (2 diffs)

src/middleware/auth.js

@@ -2 +2 @@
  * Auth middleware
  */
+
+import db from '../config/database.js';
 
 /**
@@ -42 +44 @@
   next();
 }
+
+// Mag de ingelogde user de HUIDIGE site (res.locals.site) beheren? god altijd;
+// anders alleen de owner van die site. Gebruikt voor site-gescopete beheerroutes
+// die een artiest via /user/<eigen-slug>/admin/... bereikt (res.locals.site is dan
+// z'n eigen site; een vreemde slug levert een andere site -> 403).
+export function requireSiteManager(req, res, next) {
+  if (!req.session?.user) return loginRedirect(req, res);
+  const u = req.session.user;
+  if (u.role === 'god') return next();
+  const site = res.locals.site;
+  if (site && site.owner_id === u.id) return next();
+  return res.status(403).send('Geen toegang tot deze site.');
+}
+
+// Idem, maar de site wordt bepaald door de :slug-parameter (bv. site-edit).
+export function requireSiteManagerBySlug(req, res, next) {
+  if (!req.session?.user) return loginRedirect(req, res);
+  const u = req.session.user;
+  if (u.role === 'god') return next();
+  const site = db.prepare('SELECT owner_id FROM sites WHERE slug = ?').get(req.params.slug);
+  if (site && site.owner_id === u.id) return next();
+  return res.status(403).send('Geen toegang tot deze site.');
+}

src/middleware/render.js

@@ -13 +13 @@
 import { fileURLToPath } from 'url';
 import ejs from 'ejs';
+import db from '../config/database.js';
 import PermissionsService from '../services/PermissionsService.js';
 import { PLATFORMS as PLATFORMS_CATALOG } from '../services/PlatformIcons.js';
@@ -36 +37 @@
   const isPartial = req.headers['hx-request'] === 'true' || req.query.partial === '1';
 
+  // Bezit deze (niet-god) user een eigen site? Bepaalt of 'ie een "Beheer"-
+  // ingang ziet (artiest-zelfbeheer). god ziet beheer sowieso (op rol).
+  const _u = req.session?.user || null;
+  const userOwnsSite = !!(_u && _u.role !== 'god' &&
+    db.prepare('SELECT 1 FROM sites WHERE owner_id = ? LIMIT 1').get(_u.id));
+
   // Common locals
   const locals = {
-    user: req.session?.user || null,
+    user: _u,
+    userOwnsSite,
     site: data.site || res.locals.site || null,
     audioTracks: data.audioTracks || res.locals.audioTracks || [],

src/routes/admin-comments.js

@@ -15 +15 @@
 import db from '../config/database.js';
 import { renderPage } from '../middleware/render.js';
-import { requireGod } from '../middleware/auth.js';
+import { requireSiteManager } from '../middleware/auth.js';
 
 const router = express.Router();
 
-router.get('/', requireGod, (req, res) => {
+router.get('/', requireSiteManager, (req, res) => {
   const site = res.locals.site;
   if (!site) return res.status(404).send('No site');
@@ -61 +61 @@
   const site = res.locals.site;
   if (!site) return res.status(404).send('No site');
+  const base = res.locals.siteUrlBase || ''; // /user/<slug> in hub-artiestcontext, anders ''
 
   const row = db.prepare(`
@@ -67 +68 @@
   `).get(req.params.id, site.id);
 
-  if (!row) return res.redirect('/admin/comments?error=Not+found');
+  if (!row) return res.redirect(base + '/admin/comments?error=Not+found');
 
   db.prepare(
     'UPDATE comments SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?'
   ).run(status, req.params.id);
-  res.redirect('/admin/comments?success=' + encodeURIComponent('Comment ' + status));
+  res.redirect(base + '/admin/comments?success=' + encodeURIComponent('Comment ' + status));
 }
 
-router.post('/:id/approve', requireGod, (req, res) => setStatus(req, res, 'approved'));
-router.post('/:id/reject',  requireGod, (req, res) => setStatus(req, res, 'rejected'));
+router.post('/:id/approve', requireSiteManager, (req, res) => setStatus(req, res, 'approved'));
+router.post('/:id/reject',  requireSiteManager, (req, res) => setStatus(req, res, 'rejected'));
 
 export default router;

src/routes/admin-sites.js

@@ -22 +22 @@
 import db from '../config/database.js';
 import { renderPage } from '../middleware/render.js';
-import { requireGod } from '../middleware/auth.js';
+import { requireGod, requireAuth, requireSiteManagerBySlug } from '../middleware/auth.js';
 import ThemeService from '../services/ThemeService.js';
 import { listPlatforms, PLATFORMS } from '../services/PlatformIcons.js';
@@ -82 +82 @@
 // holds the URL string in `profile_photo` — this endpoint just stores the
 // file and hands back a URL that the form can paste into the input field.
-router.post('/upload-photo', requireGod, (req, res) => {
+router.post('/upload-photo', requireAuth, (req, res) => {
   photoUpload.single('photo')(req, res, (err) => {
     if (err) return res.status(400).json({ ok: false, error: err.message });
@@ -218 +218 @@
 
 // ==================== EDIT (form) ====================
-router.get('/:slug/edit', requireGod, (req, res) => {
+router.get('/:slug/edit', requireSiteManagerBySlug, (req, res) => {
   const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(req.params.slug);
   if (!site) return res.redirect('/admin/sites?error=Not+found');
@@ -242 +242 @@
 
 // ==================== SAVE ====================
-router.post('/:slug/save', requireGod, (req, res) => {
+router.post('/:slug/save', requireSiteManagerBySlug, (req, res) => {
   const site = db.prepare('SELECT id FROM sites WHERE slug = ?').get(req.params.slug);
   if (!site) return res.redirect('/admin/sites?error=Not+found');

src/routes/admin.js

@@ -8 +8 @@
 import db from '../config/database.js';
 import { renderPage } from '../middleware/render.js';
-import { requireGod } from '../middleware/auth.js';
+import { requireAuth } from '../middleware/auth.js';
 import { getTenancy } from '../services/SettingsService.js';
 
 const router = express.Router();
 
-router.get('/', requireGod, (req, res) => {
+router.get('/', requireAuth, (req, res) => {
+  const user = req.session.user;
+
+  // Niet-god: een artiest die een eigen site bezit krijgt een "Mijn PrutFolio"-
+  // dashboard, gescopet op z'n eigen site. Bezit 'ie geen site -> geen beheer.
+  if (user.role !== 'god') {
+    const mySite = db.prepare(
+      'SELECT * FROM sites WHERE owner_id = ? ORDER BY created_at ASC LIMIT 1'
+    ).get(user.id);
+    if (!mySite) return res.status(403).send('Geen beheer beschikbaar voor dit account.');
+
+    const mine = {
+      posts: db.prepare("SELECT COUNT(*) AS c FROM posts WHERE site_id = ?").get(mySite.id).c,
+      published: db.prepare("SELECT COUNT(*) AS c FROM posts WHERE site_id = ? AND status = 'published'").get(mySite.id).c,
+    };
+    return renderPage(req, res, 'pages/my-site', {
+      pageTitle: 'Mijn PrutFolio',
+      bodyClass: 'on-admin',
+      mySite,
+      mine,
+    });
+  }
+
   const tenancy = getTenancy();
 

src/views/pages/admin-comments.ejs

@@ -26 +26 @@
             <strong><%= c.author_username %></strong>
             <% if (c.parent_comment_id) { %><span class="muted">(reply)</span><% } %>
-            on <a href="/<%= c.post_slug %>"><%= c.post_title || c.post_slug %></a>
+            on <a href="<%= siteUrlBase %>/<%= c.post_slug %>"><%= c.post_title || c.post_slug %></a>
             <span class="muted">&middot; <%= formatDateTime(c.created_at) %></span>
           </div>
           <blockquote class="moderation-content"><%= c.content %></blockquote>
           <div class="moderation-actions">
-            <form method="post" action="/admin/comments/<%= c.id %>/approve" style="display:inline">
+            <form method="post" action="<%= siteUrlBase %>/admin/comments/<%= c.id %>/approve" style="display:inline">
               <button type="submit" class="btn btn-primary">Approve</button>
             </form>
-            <form method="post" action="/admin/comments/<%= c.id %>/reject" style="display:inline">
+            <form method="post" action="<%= siteUrlBase %>/admin/comments/<%= c.id %>/reject" style="display:inline">
               <button type="submit" class="btn btn-danger">Reject</button>
             </form>
@@ -55 +55 @@
           <tr class="status-<%= c.status %>">
             <td><%= c.author_username %></td>
-            <td><a href="/<%= c.post_slug %>"><%= c.post_title || c.post_slug %></a></td>
+            <td><a href="<%= siteUrlBase %>/<%= c.post_slug %>"><%= c.post_title || c.post_slug %></a></td>
             <td>
               <span class="status-pill status-pill--<%= c.status %>"><%= c.status %></span>

src/views/pages/hub-home.ejs

@@ -5 +5 @@
     <div class="hub-nav-inner container">
       <% if (user) { %>
-        <% if (user.role === 'god' || user.role === 'admin') { %>
+        <% if (user.role === 'god' || user.role === 'admin' || (typeof userOwnsSite !== 'undefined' && userOwnsSite)) { %>
           <a class="hub-nav-link" href="/admin">Beheer</a>
         <% } %>

src/views/partials/topnav.ejs

@@ -109 +109 @@
                 <span>Account</span>
               </a>
-              <% if (user.role === 'god' || user.role === 'admin') { %>
+              <% if (user.role === 'god' || user.role === 'admin' || (typeof userOwnsSite !== 'undefined' && userOwnsSite)) { %>
                 <a href="/admin" role="menuitem" class="udi">
                   <svg class="udi-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3 3h7v7H3z"/><path d="M14 3h7v7h-7z"/><path d="M14 14h7v7h-7z"/><path d="M3 14h7v7H3z"/></svg>
@@ -116 +116 @@
               <% } %>
               <% if (_canPost) { %>
-                <a href="/posts/new" role="menuitem" class="udi"
-                   hx-get="/posts/new?partial=1" hx-target="#pcms-main" hx-swap="innerHTML"
-                   hx-push-url="/posts/new" hx-indicator="#pcms-loading">
+                <a href="<%= _siteUrlBase %>/posts/new" role="menuitem" class="udi"
+                   hx-get="<%= _siteUrlBase %>/posts/new?partial=1" hx-target="#pcms-main" hx-swap="innerHTML"
+                   hx-push-url="<%= _siteUrlBase %>/posts/new" hx-indicator="#pcms-loading">
                   <svg class="udi-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"/><path d="M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4 12.5-12.5z"/></svg>
                   <span>Nieuwe post</span>