Changeset 8cb1dc7 in Klonkt for src/routes/admin-comments.js

Timestamp:

06/14/2026 04:17:14 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

640b39c

Parents:

ccbd6a6

Message:

hub: artist self-management — owner manages their own subsite (posts/appearance/comments)

A site owner (member) now gets a "My PrutFolio" dashboard and can manage their
OWN site; cross-site access is restricted.

• auth.js: requireSiteManager (owner of res.locals.site or god) + requireSiteManagerBySlug (owner of :slug or god).
• admin.js: /admin role-aware -> god=hub management, owner=my-site dashboard, member without site=403.
• admin-sites.js: /:slug/edit + /save owner-or-god (was god-only); upload-photo requireAuth. list/new/create/delete remain god-only.
• admin-comments.js: requireSiteManager + redirects/form actions via siteUrlBase so the artist context (/user/<slug>/admin/comments) is correct.
• render.js: userOwnsSite flag; topnav + overview show "Admin" for owners; topnav "New post" uses siteUrlBase.
• pages/my-site.ejs: artist dashboard.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/admin-comments.js (modified) (3 diffs)

src/routes/admin-comments.js

@@ -15 +15 @@
 import db from '../config/database.js';
 import { renderPage } from '../middleware/render.js';
-import { requireGod } from '../middleware/auth.js';
+import { requireSiteManager } from '../middleware/auth.js';
 
 const router = express.Router();
 
-router.get('/', requireGod, (req, res) => {
+router.get('/', requireSiteManager, (req, res) => {
   const site = res.locals.site;
   if (!site) return res.status(404).send('No site');
@@ -61 +61 @@
   const site = res.locals.site;
   if (!site) return res.status(404).send('No site');
+  const base = res.locals.siteUrlBase || ''; // /user/<slug> in hub-artiestcontext, anders ''
 
   const row = db.prepare(`
@@ -67 +68 @@
   `).get(req.params.id, site.id);
 
-  if (!row) return res.redirect('/admin/comments?error=Not+found');
+  if (!row) return res.redirect(base + '/admin/comments?error=Not+found');
 
   db.prepare(
     'UPDATE comments SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?'
   ).run(status, req.params.id);
-  res.redirect('/admin/comments?success=' + encodeURIComponent('Comment ' + status));
+  res.redirect(base + '/admin/comments?success=' + encodeURIComponent('Comment ' + status));
 }
 
-router.post('/:id/approve', requireGod, (req, res) => setStatus(req, res, 'approved'));
-router.post('/:id/reject',  requireGod, (req, res) => setStatus(req, res, 'rejected'));
+router.post('/:id/approve', requireSiteManager, (req, res) => setStatus(req, res, 'approved'));
+router.post('/:id/reject',  requireSiteManager, (req, res) => setStatus(req, res, 'rejected'));
 
 export default router;