Index: src/middleware/auth.js =================================================================== --- src/middleware/auth.js (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/middleware/auth.js (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -2,4 +2,6 @@ * Auth middleware */ + +import db from '../config/database.js'; /** @@ -42,2 +44,25 @@ next(); } + +// Mag de ingelogde user de HUIDIGE site (res.locals.site) beheren? god altijd; +// anders alleen de owner van die site. Gebruikt voor site-gescopete beheerroutes +// die een artiest via /user//admin/... bereikt (res.locals.site is dan +// z'n eigen site; een vreemde slug levert een andere site -> 403). +export function requireSiteManager(req, res, next) { + if (!req.session?.user) return loginRedirect(req, res); + const u = req.session.user; + if (u.role === 'god') return next(); + const site = res.locals.site; + if (site && site.owner_id === u.id) return next(); + return res.status(403).send('Geen toegang tot deze site.'); +} + +// Idem, maar de site wordt bepaald door de :slug-parameter (bv. site-edit). +export function requireSiteManagerBySlug(req, res, next) { + if (!req.session?.user) return loginRedirect(req, res); + const u = req.session.user; + if (u.role === 'god') return next(); + const site = db.prepare('SELECT owner_id FROM sites WHERE slug = ?').get(req.params.slug); + if (site && site.owner_id === u.id) return next(); + return res.status(403).send('Geen toegang tot deze site.'); +} Index: src/middleware/render.js =================================================================== --- src/middleware/render.js (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/middleware/render.js (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -13,4 +13,5 @@ import { fileURLToPath } from 'url'; import ejs from 'ejs'; +import db from '../config/database.js'; import PermissionsService from '../services/PermissionsService.js'; import { PLATFORMS as PLATFORMS_CATALOG } from '../services/PlatformIcons.js'; @@ -36,7 +37,14 @@ const isPartial = req.headers['hx-request'] === 'true' || req.query.partial === '1'; + // Bezit deze (niet-god) user een eigen site? Bepaalt of 'ie een "Beheer"- + // ingang ziet (artiest-zelfbeheer). god ziet beheer sowieso (op rol). + const _u = req.session?.user || null; + const userOwnsSite = !!(_u && _u.role !== 'god' && + db.prepare('SELECT 1 FROM sites WHERE owner_id = ? LIMIT 1').get(_u.id)); + // Common locals const locals = { - user: req.session?.user || null, + user: _u, + userOwnsSite, site: data.site || res.locals.site || null, audioTracks: data.audioTracks || res.locals.audioTracks || [], Index: src/routes/admin-comments.js =================================================================== --- src/routes/admin-comments.js (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/routes/admin-comments.js (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -15,9 +15,9 @@ import db from '../config/database.js'; import { renderPage } from '../middleware/render.js'; -import { requireGod } from '../middleware/auth.js'; +import { requireSiteManager } from '../middleware/auth.js'; const router = express.Router(); -router.get('/', requireGod, (req, res) => { +router.get('/', requireSiteManager, (req, res) => { const site = res.locals.site; if (!site) return res.status(404).send('No site'); @@ -61,4 +61,5 @@ const site = res.locals.site; if (!site) return res.status(404).send('No site'); + const base = res.locals.siteUrlBase || ''; // /user/ in hub-artiestcontext, anders '' const row = db.prepare(` @@ -67,14 +68,14 @@ `).get(req.params.id, site.id); - if (!row) return res.redirect('/admin/comments?error=Not+found'); + if (!row) return res.redirect(base + '/admin/comments?error=Not+found'); db.prepare( 'UPDATE comments SET status = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?' ).run(status, req.params.id); - res.redirect('/admin/comments?success=' + encodeURIComponent('Comment ' + status)); + res.redirect(base + '/admin/comments?success=' + encodeURIComponent('Comment ' + status)); } -router.post('/:id/approve', requireGod, (req, res) => setStatus(req, res, 'approved')); -router.post('/:id/reject', requireGod, (req, res) => setStatus(req, res, 'rejected')); +router.post('/:id/approve', requireSiteManager, (req, res) => setStatus(req, res, 'approved')); +router.post('/:id/reject', requireSiteManager, (req, res) => setStatus(req, res, 'rejected')); export default router; Index: src/routes/admin-sites.js =================================================================== --- src/routes/admin-sites.js (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/routes/admin-sites.js (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -22,5 +22,5 @@ import db from '../config/database.js'; import { renderPage } from '../middleware/render.js'; -import { requireGod } from '../middleware/auth.js'; +import { requireGod, requireAuth, requireSiteManagerBySlug } from '../middleware/auth.js'; import ThemeService from '../services/ThemeService.js'; import { listPlatforms, PLATFORMS } from '../services/PlatformIcons.js'; @@ -82,5 +82,5 @@ // holds the URL string in `profile_photo` — this endpoint just stores the // file and hands back a URL that the form can paste into the input field. -router.post('/upload-photo', requireGod, (req, res) => { +router.post('/upload-photo', requireAuth, (req, res) => { photoUpload.single('photo')(req, res, (err) => { if (err) return res.status(400).json({ ok: false, error: err.message }); @@ -218,5 +218,5 @@ // ==================== EDIT (form) ==================== -router.get('/:slug/edit', requireGod, (req, res) => { +router.get('/:slug/edit', requireSiteManagerBySlug, (req, res) => { const site = db.prepare('SELECT * FROM sites WHERE slug = ?').get(req.params.slug); if (!site) return res.redirect('/admin/sites?error=Not+found'); @@ -242,5 +242,5 @@ // ==================== SAVE ==================== -router.post('/:slug/save', requireGod, (req, res) => { +router.post('/:slug/save', requireSiteManagerBySlug, (req, res) => { const site = db.prepare('SELECT id FROM sites WHERE slug = ?').get(req.params.slug); if (!site) return res.redirect('/admin/sites?error=Not+found'); Index: src/routes/admin.js =================================================================== --- src/routes/admin.js (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/routes/admin.js (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -8,10 +8,32 @@ import db from '../config/database.js'; import { renderPage } from '../middleware/render.js'; -import { requireGod } from '../middleware/auth.js'; +import { requireAuth } from '../middleware/auth.js'; import { getTenancy } from '../services/SettingsService.js'; const router = express.Router(); -router.get('/', requireGod, (req, res) => { +router.get('/', requireAuth, (req, res) => { + const user = req.session.user; + + // Niet-god: een artiest die een eigen site bezit krijgt een "Mijn PrutFolio"- + // dashboard, gescopet op z'n eigen site. Bezit 'ie geen site -> geen beheer. + if (user.role !== 'god') { + const mySite = db.prepare( + 'SELECT * FROM sites WHERE owner_id = ? ORDER BY created_at ASC LIMIT 1' + ).get(user.id); + if (!mySite) return res.status(403).send('Geen beheer beschikbaar voor dit account.'); + + const mine = { + posts: db.prepare("SELECT COUNT(*) AS c FROM posts WHERE site_id = ?").get(mySite.id).c, + published: db.prepare("SELECT COUNT(*) AS c FROM posts WHERE site_id = ? AND status = 'published'").get(mySite.id).c, + }; + return renderPage(req, res, 'pages/my-site', { + pageTitle: 'Mijn PrutFolio', + bodyClass: 'on-admin', + mySite, + mine, + }); + } + const tenancy = getTenancy(); Index: src/views/pages/admin-comments.ejs =================================================================== --- src/views/pages/admin-comments.ejs (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/views/pages/admin-comments.ejs (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -26,13 +26,13 @@ <%= c.author_username %> <% if (c.parent_comment_id) { %>(reply)<% } %> - on <%= c.post_title || c.post_slug %> + on <%= c.post_title || c.post_slug %> · <%= formatDateTime(c.created_at) %>
<%= c.content %>
-
+
-
+
@@ -55,5 +55,5 @@ <%= c.author_username %> - <%= c.post_title || c.post_slug %> + <%= c.post_title || c.post_slug %> <%= c.status %> Index: src/views/pages/hub-home.ejs =================================================================== --- src/views/pages/hub-home.ejs (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/views/pages/hub-home.ejs (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -5,5 +5,5 @@
<% if (user) { %> - <% if (user.role === 'god' || user.role === 'admin') { %> + <% if (user.role === 'god' || user.role === 'admin' || (typeof userOwnsSite !== 'undefined' && userOwnsSite)) { %> Beheer <% } %> Index: src/views/pages/my-site.ejs =================================================================== --- src/views/pages/my-site.ejs (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) +++ src/views/pages/my-site.ejs (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -0,0 +1,34 @@ +
+

← Overzicht

+

Mijn PrutFolio

+

<%= mySite.title %>

+ + + +
+
<%= mine.posts %>
Posts
+
<%= mine.published %>
Gepubliceerd
+
+
+ + Index: src/views/partials/topnav.ejs =================================================================== --- src/views/partials/topnav.ejs (revision ccbd6a67197d7fdb179b5f427667654b00df27ae) +++ src/views/partials/topnav.ejs (revision 8cb1dc7b23142c8a8ec44f7659178b51a2da4ddf) @@ -109,5 +109,5 @@ Account - <% if (user.role === 'god' || user.role === 'admin') { %> + <% if (user.role === 'god' || user.role === 'admin' || (typeof userOwnsSite !== 'undefined' && userOwnsSite)) { %> @@ -116,7 +116,7 @@ <% } %> <% if (_canPost) { %> - + Nieuwe post