Index: CHANGELOG.de.md =================================================================== --- CHANGELOG.de.md (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ CHANGELOG.de.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -5,4 +5,76 @@ ## [Unreleased] + +## [1.7.0] · 2026-08-07 + +### Hinzugefügt +- **Nachrichten ist eine einzige Gesprächsansicht.** Nachrichten, Gespräche und + Gesendet waren drei getrennte Filter, wodurch ein Austausch auseinanderfiel: + was du gesendet hast, stand unter Gesendet, was zurückkam unter einem der + beiden anderen, und um einem Verlauf zu folgen, musstest du hin und her + wechseln. Es ist jetzt eine Gesprächsansicht, in der Gesendetes und + Empfangenes im selben Verlauf stehen, das Älteste oben, mit deinen eigenen + Beiträgen markiert. Vier Filter bleiben: Alle, Gespräche, Aktivität und + Moderation. +- **Ein Gespräch sagt, worum es geht.** Hängt ein Verlauf an einem deiner + Beiträge, verlinkt die Kopfzeile darauf. Ohne diesen Zusammenhang lässt sich + eine Antwort in einer Liste nicht einordnen. Verläufe ohne Beitrag laufen + stattdessen pro Person. +- **Beiträge in Nachrichten sehen aus wie Beiträge.** Formatierung, Bilder, + Audio, Video, Zitatkarten und Link-Vorschauen werden jetzt genauso dargestellt + wie in den Nachrichten der Zeitung — auch bei dem, was du selbst gesendet hast: + ein von dir angehängtes Foto kam auf dem eigenen Bildschirm als nackter Text + an, während alle anderen das Bild sahen. +- **Die Guardian-App zeigt Beiträge deines Wards vollständig.** Dieselbe Lücke + steckte in der Guardian-Ansicht: ein Beitrag deines Wards kam ohne Medien, + Zitatkarte oder Emoji an — genau der Beitrag, den ein Guardian beurteilen + können muss. Eine Inhaltswarnung bleibt dort wie bisher eingeklappt. +- **Aus einem Gespräch heraus antworten.** Unter einem Verlauf steht ein eigenes + Antwortfeld, der reichhaltige Editor mit Formatierung, Medien und Sprachwahl. + Winken bleibt eine eigene Schaltfläche daneben: ein Winken ist ein Zeichen, + keine Antwort. + +### Behoben +- **Menschen auf datenschutzstrengen Servern können dir wieder folgen.** Manche + Server geben den öffentlichen Schlüssel eines Kontos nur an eine signierte + Anfrage heraus. Klonkt fragte ohne Signatur, wurde abgewiesen und konnte die + gerade eingegangene Folge-Anfrage deshalb nicht prüfen — sie wurde abgelehnt, + und der andere Server versuchte es tagelang erneut. Klonkt signiert diese + Abfrage jetzt, und solche Follows kommen durch. Das betraf auch alles andere, + was von so einem Server geholt wurde: Profile, Beiträge und Antworten. +- **Antworten anderer kommen jetzt im Verlauf an.** Antwortete jemand auf einen + Beitrag in einem Gespräch, an dem du beteiligt warst, leitete dessen Server die + Antwort an dich weiter — und sie wurde abgewiesen, weil ein weiterleitender + Server mit seinem eigenen Schlüssel signiert und nicht mit dem des Autors. + Verläufe waren auf deiner Seite dadurch stillschweigend unvollständig. Eine + solche Antwort wird jetzt an der Quelle geprüft statt abgewiesen: der Beitrag + wird bei dem Server geholt, der ihn beherbergt, und nur das von dort wird + gespeichert. Eine weitergeleitete Löschung wird weiterhin abgewiesen, denn ein + gelöschter Beitrag lässt sich nicht prüfen. +- **Ein Like oder Boost sieht überall gleich aus.** Derselbe Beitrag konnte in + der Zeitung als geliked und auf der Interact-Seite als nicht geliked + erscheinen, weil beide eine eigene Buchführung hatten. Es gibt jetzt nur noch + eine, also stimmen die Schaltflächen überein — auch für alles, worauf du vor + dieser Version schon reagiert hast; das wird beim Aktualisieren der Seite + automatisch übernommen. +- **Ein Like aus einer App bleibt jetzt bestehen.** Ein Like aus Shaer wurde + zwar gespeichert, aber die App bekam das nie zurück, sodass das Herz beim + nächsten Laden wieder aussprang — und weil die App das Like nie sah, konnte sie + es nur erneut senden und nie zurücknehmen. Das Zurücknehmen aus einer App + funktioniert jetzt. + +### Sicherheit + +- **Aktualisierte Komponenten schließen sieben Sicherheitshinweise.** Der + schwerwiegendste steckte in der Bibliothek, die von außen eintreffende + Beiträge säubert: ein sorgfältig gebauter Beitrag konnte ein Skript daran + vorbeischmuggeln, und ein Skript, das auf deiner Seite läuft, kann in deinem + Namen handeln. Gleichzeitig ging der Mailversand drei Hauptversionen weiter + und schloss damit eine Reihe von Lücken — darunter eine, bei der ein + präparierter Name Befehle in das Gespräch mit dem Mailserver einschleusen + konnte, und eine, bei der eine Nachricht bei einer anderen Domain landen + konnte als der adressierten. An Aussehen und Verhalten von Klonkt ändert das + nichts. Ein Hinweis bleibt bewusst offen: er betrifft eine Art, Bezeichner zu + erzeugen, die Klonkt nicht verwendet. ## [1.6.0] · 2026-07-31 Index: CHANGELOG.md =================================================================== --- CHANGELOG.md (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ CHANGELOG.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -5,4 +5,68 @@ ## [Unreleased] + +## [1.7.0] · 2026-08-07 + +### Added +- **Messages is one conversation view.** Messages, Conversations and Sent were + three separate filters, so a single exchange fell apart: what you sent sat + under Sent, what came back under one of the other two, and you had to switch + filters to follow a thread. They are now one Conversations view in which sent + and received sit in the same thread, oldest at the top, with your own + contributions marked. Four filters remain: All, Conversations, Activity and + Moderation. +- **A conversation says what it is about.** When a thread hangs off one of your + posts, its header links to that post. Without it a reply in a list is + impossible to place. Threads that are not about a post run per person instead. +- **Posts in Messages look like posts.** Formatting, images, audio, video, quote + cards and link previews now render the same way they do in News, including on + the messages you sent yourself — a photo you attached used to arrive as bare + text on your own screen while everyone else saw the picture. +- **The Guardian app shows a ward's posts in full.** The same gap sat in the + guardian view: a post from your ward arrived without its media, quote card or + emoji, which is exactly the post a guardian needs to be able to judge. A + content warning still stays collapsed there, as before. +- **Reply from inside a conversation.** A thread has its own reply editor, the + rich one with formatting, media and a language picker. Waving stays a separate + button next to it: a wave is a nudge, not an answer. + +### Fixed +- **People on privacy-strict servers can follow you again.** Some servers only + hand out an account's public key to a signed request. Klonkt asked without + signing, got turned away, and could therefore not check the follow request that + had just arrived — so it was refused, and the other server kept retrying for + days. Klonkt now signs that lookup, and those follows go through. This also + affected everything else fetched from such a server: profiles, posts and + replies. +- **Replies from other people now arrive in threads.** When someone replied to a + post in a conversation you were part of, their server forwarded that reply to + you — and it was turned away, because the forwarding server signs with its own + key rather than the author's. Threads were quietly incomplete on your side. + Such a reply is now checked at the source instead of being refused: the post is + fetched from the server that hosts it, and only what comes back from there is + stored. A forwarded delete is still refused, because a deleted post cannot be + checked. +- **A like or boost looks the same everywhere.** The same post could show as + liked in News and as not liked on the interact page, because both kept their + own record. There is one record now, so the buttons agree — including for + everything you reacted to before this release, which is carried over + automatically when the site updates. +- **A like from an app now sticks.** Liking a post from Shaer was stored, but + the app never got that back, so the heart popped off again on the next reload + — and because the app never saw the like, it could only offer "like" again and + never undo it. Un-liking from an app now works. + +### Security + +- **Updated components close seven security advisories.** The heaviest one sat + in the library that cleans up posts arriving from elsewhere: a carefully built + post could slip a script past it, and a script running on your page can act as + if it were you. At the same time mail handling moved three major versions on, + closing a cluster of holes around sending — among them one where a prepared + name could smuggle commands into the conversation with the mail server, and + one where a message could end up at a different domain than the one addressed. + None of this changes how Klonkt looks or behaves. One advisory is knowingly + left open: it concerns a way of generating identifiers that Klonkt does not + use. ## [1.6.0] · 2026-07-31 Index: CHANGELOG.nl.md =================================================================== --- CHANGELOG.nl.md (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ CHANGELOG.nl.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -5,4 +5,71 @@ ## [Unreleased] + +## [1.7.0] · 2026-08-07 + +### Toegevoegd +- **Berichten is één gesprekkenweergave.** Berichten, Gesprekken en Verzonden + waren drie losse filters, waardoor één uitwisseling uit elkaar viel: wat jij + stuurde stond onder Verzonden, wat terugkwam onder een van de andere twee, en + om een draad te volgen moest je heen en weer klikken. Het is nu één + Gesprekken-weergave waarin verzonden en ontvangen in dezelfde draad staan, + oudste bovenaan, met jouw eigen bijdragen gemarkeerd. Er blijven vier filters + over: Alles, Gesprekken, Activiteit en Moderatie. +- **Een gesprek vertelt waar het over gaat.** Hangt een draad aan een van je + posts, dan staat er een link naar die post in de kop. Zonder die context is + een antwoord in een lijst niet te plaatsen. Draden die niet over een post gaan + lopen per persoon. +- **Posts in Berichten zien eruit als posts.** Opmaak, afbeeldingen, geluid, + video, quote-kaarten en linkvoorbeelden worden nu net zo getoond als in de + Krant, ook bij de berichten die je zelf stuurde — een foto die jij meestuurde + kwam op je eigen scherm als kale tekst binnen terwijl de ander wel een plaatje + zag. +- **De Guardian-app toont posts van je ward compleet.** Hetzelfde gat zat in de + guardian-weergave: een post van je ward kwam binnen zonder media, quote-kaart + of emoji, terwijl dat juist de post is die je als guardian wilt kunnen + beoordelen. Een content warning blijft daar zoals eerder dichtgeklapt. +- **Antwoorden vanuit een gesprek.** Onder een draad staat een eigen + antwoordvenster, de rijke editor met opmaak, media en een taalkeuze. Zwaaien + blijft een aparte knop ernaast: een zwaai is een seintje, geen antwoord. + +### Opgelost +- **Mensen op privacy-strenge servers kunnen je weer volgen.** Sommige servers + geven de publieke sleutel van een account alleen aan een ondertekend verzoek. + Klonkt vroeg zonder handtekening, werd geweigerd, en kon daardoor het + volgverzoek dat net binnenkwam niet controleren — dus werd dat afgewezen, en + bleef de andere server het dagenlang opnieuw proberen. Klonkt ondertekent die + navraag nu, en die volgers komen erdoor. Dit raakte ook al het andere dat bij + zo'n server werd opgehaald: profielen, posts en reacties. +- **Reacties van anderen komen nu in de draad aan.** Reageerde iemand op een + post in een gesprek waar jij bij zat, dan stuurde hun server die reactie naar + je door — en werd hij geweigerd, omdat een doorsturende server met zijn eigen + sleutel ondertekent en niet met die van de schrijver. Threads waren daardoor + aan jouw kant stilletjes onvolledig. Zo'n reactie wordt nu bij de bron + gecontroleerd in plaats van afgewezen: de post wordt opgehaald bij de server + die hem herbergt, en alleen wat daarvandaan komt wordt bewaard. Een + doorgestuurde verwijdering wordt nog steeds geweigerd, want een verwijderde + post valt niet te controleren. +- **Een like of boost ziet er overal hetzelfde uit.** Dezelfde post kon in de + Krant als geliket verschijnen en op de interact-pagina als niet-geliket, omdat + allebei een eigen administratie bijhielden. Er is er nu één, dus de knoppen + zijn het eens — ook voor alles wat je vóór deze versie al had gereageerd; dat + wordt bij het bijwerken van de site automatisch meegenomen. +- **Een like vanuit een app blijft nu staan.** Een like die je in Shaer gaf werd + wel opgeslagen, maar de app kreeg dat nooit terug, dus het hartje sprong bij de + eerste herlaadbeurt weer uit — en omdat de app de like nooit zag, kon hij hem + alleen opnieuw geven en nooit intrekken. Un-liken vanuit een app werkt nu. + +### Beveiliging + +- **Bijgewerkte onderdelen sluiten zeven beveiligingsadviezen.** Het zwaarste + zat in de bibliotheek die berichten van elders opschoont: een zorgvuldig + opgebouwd bericht kon daar een script langs krijgen, en een script dat op jouw + pagina draait kan doen alsof het jou is. Tegelijk ging de mailafhandeling drie + hoofdversies vooruit, wat een reeks gaten rond verzenden dichtte — waaronder + een waarbij een geprepareerde naam commando's het gesprek met de mailserver in + kon smokkelen, en een waarbij een bericht bij een ander domein kon belanden + dan het geadresseerde. Aan hoe Klonkt eruitziet of werkt verandert dit niets. + Eén advies blijft bewust staan: het gaat over een manier om identifiers te + maken die Klonkt niet gebruikt. ## [1.6.0] · 2026-07-31 Index: deploy/HOSTING.md =================================================================== --- deploy/HOSTING.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ deploy/HOSTING.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,266 @@ +# Running Klonkt for other people + +A runbook for someone who has a VPS and is about to host Klonkt instances for +people who are not themselves. + +This is **not** an install guide. For that: + +| | | +|---|---| +| [DEPLOY.md](DEPLOY.md) | one Klonkt, from bare VPS to running | +| [MULTI-INSTANCE.md](MULTI-INSTANCE.md) | the split layout, `klonkt@` units | + +Those tell you how. This one tells you what changes the moment the data on your +disk stops being yours. + +--- + +## 0. The question to answer first + +**Are you hosting for yourself, or for other people?** + +If it is only you, stop reading and use the two guides above. Everything below is +about the second case, and the difference is not technical. One Klonkt is one +person, so the moment there is a second instance there is a second person, and +you are now holding their conversations, their contacts, and their identity. + +Read §5 before you accept your first user, not after. + +--- + +## 1. Day one + +Follow [MULTI-INSTANCE.md](MULTI-INSTANCE.md) for the layout, then: + +```bash +sudo bash /opt/klonkt/scripts/klonkt-add-instance.sh +``` + +Leave the port out and a free one is chosen. Then check it came up: + +```bash +systemctl status klonkt@ +``` + +Before you tell anyone it is ready, do these three: + +1. **Test the backup, do not just install it.** Run `deploy/backup.sh` once by + hand and then actually unpack the tarball somewhere and look inside. A backup + you have never restored is a hope, not a backup. +2. **Check the disk.** Media grows quietly; databases do not. `df -h` now, and + know what number worries you. +3. **Update once on purpose**, while nobody is depending on it, so the first time + you run `klonkt-update` is not also the first time you find out what it does. + +--- + +## 2. The weekly rhythm + +Nothing here takes long. Skipping it is how small problems become 3am problems. + +```bash +systemctl list-units 'klonkt@*' # still running? +df -h # disk +journalctl -u 'klonkt@*' --since '7 days ago' -p warning --no-pager +``` + +If that last one answers `Failed to add filter for units: No data available`, +nothing matched — which is usually the good news (no warnings in the window), not +a broken command. Widen the window before you go looking for a fault. + +`-u` matches against the units that actually appear in the journal, so an +instance that logged nothing at all is simply absent. Run it as root: an +unprivileged account sees only its own messages and will get the same empty +answer for the wrong reason. + +The log line worth reading properly is anything about federation: a rejected +signature, a delivery that keeps retrying. Those are usually the other side's +problem, but they are also how you find out that one of your users has been +invisible to half the fediverse for a week. + +--- + +## 3. Updating, and getting back + +```bash +klonkt-update +``` + +One command updates the shared code and restarts **every** instance on the +machine. That is the point of the shared layout, and it is also the risk: a bad +release takes all of your users down at once, not one. + +So before you update: + +- **know what you are on.** `git -C /opt/klonkt rev-parse --abbrev-ref HEAD`. + `stable` is what you want unless you have decided otherwise on purpose. +- **do it when you are awake.** Not before you leave the house. + +`klonkt-update` prints the previous commit and the command to go back. It looks +like this: + +```bash +runuser -u klonkt -- git -C /opt/klonkt checkout -qf -B stable +systemctl restart 'klonkt@*' +``` + +The glob only matches units systemd already has loaded. An instance that was +stopped will be skipped, so check with `systemctl list-units 'klonkt@*' +--all` afterwards rather than assuming. + +That only works if the checkout has history. Older installs were cloned shallow +and could not roll back at all; the updater now deepens once, on its first run +after this change. If you are not sure: + +```bash +git -C /opt/klonkt rev-parse --is-shallow-repository # want: false +``` + +`true` means you cannot roll back yet. Run +`sudo bash /opt/klonkt/scripts/klonkt-refresh-updater.sh` and then +`klonkt-update` once. + +**Roll back is not atomic.** All instances share one checkout, so during the +switch the code is briefly half-old. For a handful of instances this is seconds +and nobody notices. It is still the reason to keep a maintenance page in mind if +you ever grow. + +--- + +## 4. When it breaks + +**An instance will not start.** + +```bash +journalctl -u klonkt@ -n 50 --no-pager +``` + +Nine times out of ten it is the `.env`: a missing `SESSION_SECRET`, or a path +that points at a directory that no longer exists. The app refuses to boot rather +than come up half-configured, which is deliberate. + +**One instance is broken, the rest are fine.** Do not run `klonkt-update` hoping +it helps — it restarts everyone to fix one. Restart the single unit. + +**Everything is broken after an update.** Roll back (§3) first, ask why second. + +**Disk full.** Media, then logs. `journalctl --vacuum-size=200M` buys you room +immediately; the media is a conversation with the user, not a delete decision you +make alone. + +--- + +## 5. What you are actually holding + +This is the section people skip. Do not. + +Each instance's data directory contains that person's database: their posts, +their private messages, who they follow, and — if they are a ward or a guardian — +their guardianship relationships. It also contains **the private key of their +fediverse actor**. + +That last one is not a privacy nuance. Whoever has that key can post as that +person, follow as that person, and send messages as that person, and the rest of +the fediverse has no way to tell. You have it because you have the machine. There +is no configuration that takes it away. + +So: + +- **Say so.** Tell the people you host, in plain words, that you can technically + read and impersonate. It is better coming from you than discovered later. +- **Do not build tooling that makes it easy.** Never export or display actor keys + from an admin panel. It prevents nothing, but a tool that offers it invites it. +- **Guardianship data deserves more care than the rest.** A ward is often a + minor, and a 🛟 help request is a distress signal. That a guardianship exists + may be visible to you for support. What is in it is not yours to read. + +### If someone changes hoster + +An ActivityPub `Move` does **not** apply here. Move takes an actor from one id to +another and tells the followers to re-follow. If the domain stays the same, the +actor id stays the same, and there is nothing to move: the fediverse only ever +sees the URI and cannot tell which machine answers it. Changing hoster with the +same domain is a server migration. Copy the data across and the world notices +nothing. + +Which leaves the key, and Move would not have helped with that either — a Move +carries no keys; the new actor simply has its own. + +So the choice is: take the key along, or make a new one. + +Take it along and everything keeps working — **and the old hoster keeps a working +copy, permanently.** ActivityPub has no revocation. Nothing marks a key as no +longer valid; it is only superseded once other servers refetch the actor. + +Klonkt cannot rotate keys today. `getOrCreateKeys()` creates a pair when there is +none and never replaces one. So for now, treat a change of hoster as what it is: +the previous hoster can go on signing as that person, and the only real mitigation +is choosing hosters you would trust after the fact. + +Say this out loud to anyone leaving you, and to anyone arriving. + +The fediverse is working on the root of this. FEP-521a (final) already lets an +actor publish several keys at once, which is what a graceful rotation would need — +though it deliberately stops at the representation and says nothing about when an +old key stops counting. FEP-ef61, *Portable Objects* (draft), goes further: it +gives objects server-independent ids and allows the signing key to live with the +**user** instead of the server. On that model a change of hoster leaks nothing, +because the hoster never held the key. That is where this should end up; it is not +where it is today. + +### The legal shape + +Under the GDPR you are a **processor**: you handle personal data on behalf of +someone else, who is the controller. That relationship needs a written agreement +(Art. 28). This is true even if you host for free, and even for one friend. + +If you also use the data for your own purposes — statistics across instances, +moderating what people post, backups you keep for your own reasons — you are no +longer only a processor, and the bar is higher. + +The single-user design helps you here more than you would expect. A request to +see or delete everything about one person is *one instance*, not a query across +shared tables. You can answer it honestly, and prove it. + +--- + +## 6. Letting someone leave + +A hoster who cannot be left is not a hoster. Klonkt has a portable content +archive; see [../docs/EXPORT-FORMAT.md](../docs/EXPORT-FORMAT.md). + +```bash +cd /opt/klonkt +node scripts/export-archive.mjs --out /tmp/-archive.zip +``` + +It contains their posts, their media, and the replies underneath as a read-only +record. No credentials, no keys. Hand it over and it can be imported into another +Klonkt. + +Two things to know before you hand it over: + +- If the site has **paid posts**, the archive contains their full text. Treat the + file like the content itself. +- The **ActivityPub ids survive** only if the new home has the same domain. + Moving to a different domain means new ids, and the boosts and replies that + point at the old ones do not follow. That is a property of the fediverse, not + of the export. + +Then remove the instance ([MULTI-INSTANCE.md](MULTI-INSTANCE.md) §Removing an +instance) — and only after they confirm the archive opens. + +--- + +## 7. Things not to do + +- **Do not host for people you would not tell about §5.** If you would rather + they did not know what you can see, you should not be holding it. +- **Do not update to fix one instance.** It restarts all of them. +- **Do not put security updates behind anything.** If you ever charge for + hosting, charge for the convenience — scheduled, all at once, with a way back + — never for the update itself. An unpatched fediverse server is a problem for + everyone it talks to, not only for you. +- **Do not keep backups you have never restored.** See §1. +- **Do not delete someone's instance the same day they ask.** Export first, + confirm they can open it, then remove. Index: deploy/MULTI-INSTANCE.md =================================================================== --- deploy/MULTI-INSTANCE.md (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ deploy/MULTI-INSTANCE.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -195,4 +195,10 @@ Then remove its block from the web server config and reload it. +## Hosting for other people + +Everything here is about the machine. The moment an instance belongs to someone +who is not you, there is a second set of questions — what you are holding, what +you owe them, and how they leave. See [HOSTING.md](HOSTING.md). + ## Everyday commands Index: docs/EXPORT-FORMAT.md =================================================================== --- docs/EXPORT-FORMAT.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ docs/EXPORT-FORMAT.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,302 @@ +# Klonkt Content Archive, format version 1 + +A portable archive of **your own content**: posts, their media, and — as a +read-only historical record — the replies other people wrote underneath them. +It can be exported from one Klonkt and imported into another, and it stays +readable when Klonkt is gone. + +This is the format specification. It is written before the exporter and the +importer exist, on purpose: without a written format each of them writes down +its own assumptions, and then there are two sources of truth instead of one. + +## What this is not + +| | | +|---|---| +| **Storage backup** (`shaer-190t`) | A byte-level zip of the storage directory, including password hashes, sessions and the per-actor private RSA keys. A backup for Klonkt-to-Klonkt restore. Never hand it to anyone. | +| **GDPR data export** (`shaer-0j2`) | Personal data for inspection. Different scope, different audience. | +| **This format** | Your content, portable, importable, reproducible, and free of every credential. | + +They may share serialisation code. They do not share a purpose, and they must +not quietly become the same file. + +## Container layout + +``` +manifest.json format version, origin, counts, checksums +posts/.json ONE post — canonical, the only thing import reads +replies/.json replies received under that post — read-only archive +media/. the bytes, content-addressed +readable/.md rendered for humans — derived, NEVER read on import +``` + +Delivered as a zip. `` is Klonkt's own post id, which is also the tail +of the ActivityPub object id (`/ap/notes/`). Using it as the +filename means the identity is visible in the tree and no character escaping is +needed. The slug lives inside the file, where it can change without renaming +anything. + +## manifest.json + +```json +{ + "formatVersion": 1, + "generator": "klonkt/1.6.0", + "exportedAt": "2026-08-06T13:00:00Z", + "origin": "https://boiert.eu", + "actor": "https://boiert.eu/ap/users/boiert", + "site": { "slug": "boiert", "title": "Boiert" }, + "counts": { "posts": 412, "replies": 1180, "media": 233, "mediaMissing": 7 }, + "files": { "posts/abc123.json": "", "media/.jpg": "" } +} +``` + +`origin` is the field the importer cannot work without. It decides whether the +ActivityPub ids may be kept (see [Import rules](#import-rules)). Everything else +in the manifest is verification and reporting. + +`exportedAt` lives **only** here. It must not appear in any post file, or two +exports of unchanged content would differ. + +## posts/<post-id>.json + +An ActivityStreams 2.0 object carrying the post **as authored**, with Klonkt's +own fields in the `shaer:` namespace. + +### It is not what we federate, and that is deliberate + +`buildNote()` produces a *projection* for the fediverse, and that projection is +lossy by design: + +- the title is baked into the content as a bold first line, because Mastodon + ignores a Note's `name`; +- a paid post federates a **teaser only**, never the body; +- `` is stripped from the content and moved into `attachment`, because + Mastodon drops inline images; +- when a post carries an external embed the image attachments are suppressed, so + the link card wins. + +Exporting that projection would mean archiving a paid post as its teaser. So the +archive carries the authoring truth instead, and the differences are: + +| | federated (`buildNote`) | archive | +|---|---|---| +| type | always `Note` | `Article` when the post has a title, else `Note` | +| title | inside `content` | `name` | +| paid post body | teaser | full content | +| inline images | stripped from `content` | left in `content`, and also listed in `attachment` | + +### Fields + +| AS2 / `shaer:` | source | notes | +|---|---|---| +| `id` | `/ap/notes/` | the federation identity; see import rules | +| `type` | `posts.title` present? | `Article` / `Note` | +| `attributedTo` | site actor | | +| `name` | `posts.title` | plain text, not HTML | +| `content` | `posts.content` | authored HTML, shorthand intact | +| `contentMap` | `posts.language` | omitted when the post has no language | +| `summary` | `posts.content_warning` | AS2 summary is the content warning | +| `sensitive` | `posts.nsfw` | | +| `published` | `posts.published_at` ?? `created_at` | ISO 8601, UTC. Klonkt stores timestamps in two spellings (`YYYY-MM-DD HH:MM:SS` and full ISO); the archive normalises to ISO. The **instant** survives a round trip, the spelling does not. | +| `updated` | `posts.updated_at` | omitted when equal to `published` | +| `url` | `/` | the human permalink | +| `attachment` | cover, inline ``, `c2s_attachments` **and their `poster`**, hosted audio tracks | see [Media](#media); each carries a `shaer:role` | +| `tag` | `posts.tags`, mentions, custom emoji | `Hashtag`, `Mention`, `toot:Emoji` | +| `oneOf` / `anyOf` / `endTime` | `posts.poll_json` | a poll exports as a `Question` | +| `quoteUrl`, `shaer:quoteActor` | `posts.quote_uri`, `quote_actor` | FEP-044f | +| `shaer:slug` | `posts.slug` | | +| `shaer:status` | `posts.status` | `draft` posts are yours too and are exported | +| `shaer:excerpt` | `posts.excerpt` | | +| `shaer:type` | `posts.type` | | +| `shaer:pinned`, `shaer:noindex`, `shaer:fanOnly` | idem | | +| `shaer:paid`, `shaer:paidMinCents` | idem | **see the warning below** | +| `shaer:apVisibility` | `posts.ap_visibility` | | +| `shaer:publishAt` | `posts.publish_at` | a scheduled post keeps its schedule | +| `shaer:coverAlt` | `posts.cover_alt` | | +| `shaer:viewCount` | `posts.view_count` | optional; a restore without it loses history | +| `shaer:audio` | `audio_tracks` rows referenced from the content | title, artist, duration, credit, license, external links, `shaer:ref` (the `[[track:id]]` it belongs to) and `shaer:media` (which attachment holds its file) | + +**Deliberately not exported:** `yjs_binary` (collaborative editor state — large, +regenerable, and meaningless elsewhere), `content_rendered` (derived from +`content`; exporting it would create a second truth that can drift), +`origin_server`, and every id that belongs to a foreign server. + +> **Warning — a paid post exports in the clear.** The archive contains the full +> body of paywalled posts, because an archive that silently drops your own +> content is worse than useless. An export of a site with paid posts must be +> handled like the content itself. + +### Klonkt shorthand inside `content` + +`content` may contain Klonkt shorthand that other software will not understand: + +``` +[[track:]] a hosted audio track → see shaer:audio +[[album:]] an album of tracks +[[playlist:]] a playlist +[[embed:]] an external player (Spotify, YouTube, SoundCloud, …) +``` + +They are left in place, because resolving them at export would destroy the +authored source. A foreign consumer should either strip them or resolve them +using `shaer:audio`. `readable/.md` has them rendered. + +## Media + +Media are content-addressed by the SHA-256 of the bytes, so two exports of the +same content produce the same filenames and duplicates collapse on their own. + +An attachment has three possible states, and the format must be able to say +which one applies. Two are not enough: at Boiert we will know that a picture +existed and where it lived, without having the bytes. An empty attachment list +would be a lie, and a reference to a missing file would be a broken archive. + +```json +{ + "type": "Image", + "mediaType": "image/jpeg", + "name": "alt text", + "url": "media/9f86d0….jpg", + "shaer:availability": "included", + "shaer:originalUrl": "https://boiert.eu/media/2026/cover.jpg", + "shaer:sha256": "9f86d0…" +} +``` + +| `shaer:availability` | meaning | `url` | +|---|---|---| +| `included` | the bytes are in `media/` | container-relative path | +| `missing` | it existed, we know where, we do not have it | the original absolute URL | + +Every attachment also carries **`shaer:role`**, saying what it was for: + +| role | restored to | +|---|---| +| `cover` / `coverVideo` | `posts.cover_image_url` / `cover_video_url` | +| `inline` | already referenced from `content` | +| `c2s` | an entry in `posts.c2s_attachments` | +| `poster` | the `poster` of the `c2s` entry named in `shaer:posterFor` | +| `track` | the file behind a `[[track:id]]`, linked from `shaer:audio` | + +The role is not decoration. Without it the archive holds the bytes but not the +fact that they *were the cover*, and the post comes back without one — which is +invisible until you compare every column, not a handful. + +`url` for an included attachment is a **container-relative path**, not a URL. An +importer must rewrite it. This is the one place where the archive deviates from +strict AS2, and it is the price of carrying bytes at all. + +An importer must **count and report** every `missing` attachment. It must never +silently drop one: a post whose picture has vanished should say so. + +## replies/<post-id>.json + +An AS2 `OrderedCollection` of the replies received under that post, as received. + +```json +{ + "type": "OrderedCollection", + "shaer:archive": true, + "shaer:inReplyTo": "https://boiert.eu/ap/notes/abc123", + "orderedItems": [ { "id": "https://mstdn.social/users/x/statuses/1", "…": "…" } ] +} +``` + +This is **other people's content**. Three rules follow, and none is optional: + +1. It is never re-delivered, produces no notifications and no push. It is + history, not traffic. +2. Their ids belong to their servers. We carry them as they are and never claim + them. +3. Because of this section an export is not purely "your data". That is exactly + why this format and the GDPR export (`shaer-0j2`) have different scopes and + must not silently become the same file. + +`shaer:archive: true` is what an importer keys on. An importer that does not +understand this section must skip it, never read it as own content. + +## readable/<slug>.md + +Markdown with YAML front matter, rendered from the canonical file: title, date, +content with the shorthand resolved, images as links into `media/`. + +It exists so the archive survives Klonkt itself. It is **derived** and travels +in one direction only — the importer never reads it. This is not tidiness: an +archive whose Markdown and JSON are both read is an archive with two sources of +truth, and they will drift. + +## Versioning + +`formatVersion` is an integer in `manifest.json`. + +- Adding a property does **not** bump it. Readers must ignore properties they do + not know. +- Changing or removing the meaning of a property bumps it. +- An importer that meets a `formatVersion` **higher than it knows must refuse the + whole archive** and say so. It must never read it partially: a half-understood + restore is worse than no restore, because it looks like it worked. + +## Import rules + +**Identity.** Compare `manifest.origin` with the importing site's own origin. + +- Equal → **keep the ActivityPub ids**. This is what makes a restore a restore: + the boosts, likes and replies that already point at those ids find their post + again. +- Different → **mint new ids**, and keep the original `url` as a historical + reference. Keeping foreign ids would mean publishing objects under an id you + do not control; remote servers resolve such an id at its original host, and it + is a forgery surface besides. + +The importer determines this itself. It is not a question for the user, because +a wrong answer cannot be taken back. + +**Consequences of keeping ids.** The post id is part of the identity, so the +importer must be able to *set* the primary key rather than let it be generated. +That is a different write path from creating a post, and it must not be reachable +outside the import. + +**No `Update` broadcast.** If the restored content differs from what other +servers cached long ago, their copy stays stale. Sending `Update` activities +would fix that, but it is a broadcast to the whole fediverse and must never be a +side effect of an import. Separate, deliberate action. + +**Dry run.** The importer offers a mode that reports what would happen — +including the missing-media count — before anything is written. + +**Idempotent.** Importing the same archive twice produces no duplicates. On a +collision with an existing id the importer follows one documented rule (skip, +overwrite, or refuse and report); it never guesses per post. + +## Reproducibility + +Two exports of unchanged content must be **byte-identical except for +`manifest.exportedAt`**, which is by definition the moment of export. Everything +else — every post file, every media file, and the `files` checksum map — must +match. That is what makes an archive verifiable and a diff meaningful: if the +checksum map is equal, nothing changed. + +- JSON: keys sorted, two-space indent, LF, trailing newline. +- Posts ordered by `published`, then by `id` for ties. +- No timestamps inside post files; `exportedAt` lives only in the manifest. +- Zip entries in sorted path order, with a fixed modification time. +- Media names derive from the bytes, so they never depend on export order. + +## Worked example: the hardest post + +The format is tested against the most demanding post Klonkt can produce, not the +easiest: a **poll** with **attachments**, a **quote card**, **custom emoji**, a +**content warning**, and **paid** access. + +- poll → `type: "Question"` with `oneOf`/`anyOf` and `endTime`; the votes are + federation state, not content, and are not exported; +- attachments → `attachment[]`, each with its own availability; +- quote → `quoteUrl` + `shaer:quoteActor` (FEP-044f); +- custom emoji → `tag[]` entries of `toot:Emoji`, whose icons are media like any + other and are content-addressed the same way; +- content warning → `summary` + `sensitive: true`; +- paid → full `content` plus `shaer:paid`, with the warning above. + +A post that survives this round trip unchanged is the acceptance test for +slices 2 and 3. Index: docs/shaer-c2s-api.md =================================================================== --- docs/shaer-c2s-api.md (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ docs/shaer-c2s-api.md (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -80,4 +80,63 @@ | `GET /ap/users/:slug/outbox` | OrderedCollection of the account's own `Create(Note)` | | `GET /ap/users/:slug/inbox` | OrderedCollection of recent inbound posts (accounts you follow) as `Create(Note)`. Owner only; `403` for anyone else. The unified home feed is outbox + inbox merged. | + +### Waiting for news on the inbox read + +The inbox read can hold the answer until there is something new, so a client does +not have to poll. It is the **same call and the same response** — no separate +endpoint and no separate "there is news" shape, because a second shape is a +second description of a post that can drift from the first. + +``` +GET /ap/users/:slug/inbox?since=&wait=25 +``` + +- `since` is the `shaer:cursor` from your previous answer. Treat it as opaque. +- `wait` is seconds, capped at 50 — well under what a proxy will hold. +- Send neither and the route behaves exactly as it always did. + +Two possible answers: + +| | | +|---|---| +| **`200`** | something changed. The full, current collection with a fresh `shaer:cursor`. | +| **`304`** | nothing changed within `wait`. **No body.** Keep the cursor you have and ask again. | + +`304` is not an error — it is the normal answer to a quiet minute, and it is why +this costs nothing while nothing happens. Sending the whole timeline back every +`wait` seconds just to say "still nothing" would be a poor trade for saving one +round trip. + +A server that has not run the feed-state migration yet cannot tell change from +stillness, and answers `200` with the collection every time rather than `304` +forever. Slower, never wrong. + +The cursor moves for **all four** sources this read merges: the timeline, +messages, replies on your own posts, and your own sent notes. + +Limits worth knowing as a client author: + +- four waiting connections per account. A fifth gets the current state + immediately rather than an error, so a broken reconnect loop degrades to + ordinary polling instead of locking the account out. +- hanging up ends the wait; there is no cost to abandoning a request. +- the bearer is checked *before* any waiting, so an unauthenticated caller can + never hold a connection open. + +This works while your app is in the foreground, and only there. iOS freezes +network activity the moment an app is backgrounded, and a held-open connection +does not survive it. + +**There is no background channel to fall back on for a native app.** Klonkt's +web push uses VAPID, which a self-hosted instance can generate and send entirely +on its own — but only to a browser or an installed PWA. A native app receives +push through APNs (or FCM), signed with the *application's* key, which a +self-hosted Klonkt does not have and should not have: whoever holds it can push +to every user of that app. Closing that gap needs a relay run by the app's +publisher, and that is a decision about money and control, not a protocol +detail. + +So for a self-hosted setup this is not a stopgap until push arrives. For now it +is the freshness channel. | `GET /ap/users/:slug/followers` | see below | | `GET /ap/users/:slug/following` | see below | Index: package-lock.json =================================================================== --- package-lock.json (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ package-lock.json (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -1,5 +1,5 @@ { "name": "klonkt", - "version": "1.6.0-dev", + "version": "1.7.0", "lockfileVersion": 3, "requires": true, @@ -7,5 +7,5 @@ "": { "name": "klonkt", - "version": "1.6.0-dev", + "version": "1.7.0", "license": "AGPL-3.0-or-later", "dependencies": { @@ -28,5 +28,5 @@ "multer": "^1.4.5-lts.1", "node-webpmux": "^3.2.1", - "nodemailer": "^6.9.15", + "nodemailer": "^9.0.5", "qrcode": "^1.5.4", "sanitize-html": "^2.17.3", @@ -680,7 +680,7 @@ }, "node_modules/body-parser": { - "version": "1.20.5", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz", - "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==", + "version": "1.20.6", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz", + "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==", "license": "MIT", "dependencies": { @@ -704,7 +704,7 @@ }, "node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { @@ -934,4 +934,10 @@ "license": "MIT" }, + "node_modules/dayjs": { + "version": "1.11.21", + "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz", + "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==", + "license": "MIT" + }, "node_modules/debug": { "version": "2.6.9", @@ -1206,7 +1212,7 @@ }, "node_modules/es-object-atoms": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", - "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", + "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", "license": "MIT", "dependencies": { @@ -1254,12 +1260,12 @@ }, "node_modules/express": { - "version": "4.22.1", - "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz", - "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==", + "version": "4.22.2", + "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz", + "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==", "license": "MIT", "dependencies": { "accepts": "~1.3.8", "array-flatten": "1.1.1", - "body-parser": "~1.20.3", + "body-parser": "~1.20.5", "content-disposition": "~0.5.4", "content-type": "~1.0.4", @@ -1280,5 +1286,5 @@ "path-to-regexp": "~0.1.12", "proxy-addr": "~2.0.7", - "qs": "~6.14.0", + "qs": "~6.15.1", "range-parser": "~1.2.1", "safe-buffer": "5.2.1", @@ -1335,19 +1341,4 @@ "type": "opencollective", "url": "https://opencollective.com/express" - } - }, - "node_modules/express/node_modules/qs": { - "version": "6.14.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz", - "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==", - "license": "BSD-3-Clause", - "dependencies": { - "side-channel": "^1.1.0" - }, - "engines": { - "node": ">=0.6" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" } }, @@ -1543,7 +1534,7 @@ }, "node_modules/hasown": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz", - "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", "license": "MIT", "dependencies": { @@ -1783,4 +1774,13 @@ } }, + "node_modules/launder": { + "version": "1.7.1", + "resolved": "https://registry.npmjs.org/launder/-/launder-1.7.1.tgz", + "integrity": "sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==", + "license": "MIT", + "dependencies": { + "dayjs": "^1.11.7" + } + }, "node_modules/locate-path": { "version": "5.0.0", @@ -1959,7 +1959,7 @@ }, "node_modules/nanoid": { - "version": "3.3.11", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz", - "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==", + "version": "3.3.17", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", + "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", "funding": [ { @@ -2010,7 +2010,7 @@ }, "node_modules/nodemailer": { - "version": "6.10.1", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz", - "integrity": "sha512-Z+iLaBGVaSjbIzQ4pX6XV41HrooLsQ10ZWPUehGmuantvzWoDVBnmsdUcOIDM1t+yPor5pDhVlDESgOMEGxhHA==", + "version": "9.0.5", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.5.tgz", + "integrity": "sha512-wvjiKvjczmsN7U/8006JOdXubgBk2XFAbioDMbT+sM7cPs0QrhJTa6KBRX7P5REGGkDcLUz/EarWidb8G8C1jQ==", "license": "MIT-0", "engines": { @@ -2156,7 +2156,7 @@ }, "node_modules/postcss": { - "version": "8.5.12", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.12.tgz", - "integrity": "sha512-W62t/Se6rA0Az3DfCL0AqJwXuKwBeYg6nOaIgzP+xZ7N5BFCI7DYi1qs6ygUYT6rvfi6t9k65UMLJC+PHZpDAA==", + "version": "8.5.26", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz", + "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==", "funding": [ { @@ -2175,5 +2175,5 @@ "license": "MIT", "dependencies": { - "nanoid": "^3.3.11", + "nanoid": "^3.3.17", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" @@ -2284,10 +2284,11 @@ }, "node_modules/qs": { - "version": "6.15.1", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz", - "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==", + "version": "6.15.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", + "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { @@ -2408,7 +2409,7 @@ }, "node_modules/sanitize-html": { - "version": "2.17.3", - "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.3.tgz", - "integrity": "sha512-Kn4srCAo2+wZyvCNKCSyB2g8RQ8IkX/gQs2uqoSRNu5t9I2qvUyAVvRDiFUVAiX3N3PNuwStY0eNr+ooBHVWEg==", + "version": "2.17.5", + "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.17.5.tgz", + "integrity": "sha512-ZmU1joGRrvoyctKIiuwUxqR6moLoU2Wk+2bMccN6f7UwhAmwYDvWziqPxRDDN2Qip62NqnIrVrT9akbL6Wretg==", "license": "MIT", "dependencies": { @@ -2417,4 +2418,5 @@ "htmlparser2": "^10.1.0", "is-plain-object": "^5.0.0", + "launder": "^1.7.1", "parse-srcset": "^1.0.2", "postcss": "^8.3.11" @@ -2491,12 +2493,12 @@ }, "node_modules/side-channel": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz", - "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", "license": "MIT", "dependencies": { "es-errors": "^1.3.0", - "object-inspect": "^1.13.3", - "side-channel-list": "^1.0.0", + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" Index: package.json =================================================================== --- package.json (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ package.json (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -1,5 +1,5 @@ { "name": "klonkt", - "version": "1.6.0", + "version": "1.7.0", "description": "Klonkt — self-hosted multi-site music & blog platform (solo, hub or circles). Node + SQLite + htmx.", "license": "AGPL-3.0-or-later", @@ -33,5 +33,5 @@ "multer": "^1.4.5-lts.1", "node-webpmux": "^3.2.1", - "nodemailer": "^6.9.15", + "nodemailer": "^9.0.5", "qrcode": "^1.5.4", "sanitize-html": "^2.17.3", Index: scripts/backfill-reactions.mjs =================================================================== --- scripts/backfill-reactions.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ scripts/backfill-reactions.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,107 @@ +#!/usr/bin/env node +// +// Reactie-migratie handmatig draaien (shaer-9e9). +// +// Normaal hoef je dit NIET: migrateReactions() draait bij boot, één keer per +// REACTIONS_MIGRATION_VERSION-bump, net als de self-heal. Dit script is er om +// vooraf te kijken wat er zou gebeuren, of om het gericht op één instance te +// forceren. +// +// node scripts/backfill-reactions.mjs --dry-run +// node scripts/backfill-reactions.mjs # respecteert de versievlag +// node scripts/backfill-reactions.mjs --force # ook als de vlag al staat +// +// Bewust een schil om dezelfde functie die bij boot draait: twee implementaties +// van een migratie lopen uiteen, en dan repareert de ene wat de andere niet ziet. +// +// Wat het doet, en waarom allebei nodig is: +// +// HERSLEUTELEN De oude interact-route bewaarde de URI waarmee je binnenkwam, +// en de bookmarklet geeft de permalink door. Sinds de reacties +// op de canonieke object-URI gezocht worden, zouden die rijen +// wees zijn. De created_at reist mee. +// AANVULLEN Alles wat op oude code via de Krant is gegeven staat alleen in +// ap_timeline.liked/boosted. Zonder deze stap toont het als +// niet-gereageerd -- en klikt iemand opnieuw, met een tweede +// Like de fediverse in als gevolg. +// UIT REACTIES De derde bron (shaer-ipb): ap_interactions.acted_like/_boost, +// wat jij deed met een reactie ONDER je eigen post. Zelfde +// gevolg als hierboven, alleen op een ander oppervlak. +// +// Wat het NIET kan: bij AANVULLEN de oorspronkelijke reactiedatum herstellen. +// Wanneer je reageerde is nergens vastgelegd, dus die rijen krijgen de datum van +// nu. Bij hersleutelen blijft de datum wel behouden. + +import db from '../src/config/database.js'; +import { migrateReactions } from '../src/services/ActivityPubService.js'; + +const dryRun = process.argv.includes('--dry-run'); +const force = process.argv.includes('--force'); + +const meet = () => ({ + tussentabel: db.prepare('SELECT COUNT(*) AS n FROM ap_my_reactions').get().n, + liked: db.prepare('SELECT COUNT(*) AS n FROM ap_timeline WHERE liked = 1').get().n, + boosted: db.prepare('SELECT COUNT(*) AS n FROM ap_timeline WHERE boosted = 1').get().n, + scheef: db.prepare(` + SELECT COUNT(*) AS n FROM ap_timeline t + WHERE (t.liked = 1 OR t.boosted = 1) + AND NOT EXISTS (SELECT 1 FROM ap_my_reactions r + WHERE r.site_slug = t.slug AND r.target_uri = t.id)`).get().n, + // Een reactie op een COMMENT hoort geen tijdlijnrij te hebben, dus die telt + // hier niet als wees -- anders slaat de controle hieronder alarm op precies + // wat stap 3 net goed heeft gezet. + wees: db.prepare(` + SELECT COUNT(*) AS n FROM ap_my_reactions r + WHERE NOT EXISTS (SELECT 1 FROM ap_timeline t + WHERE t.slug = r.site_slug AND t.id = r.target_uri) + AND NOT EXISTS (SELECT 1 FROM ap_interactions i WHERE i.object_uri = r.target_uri)`).get().n, + scheefActed: db.prepare(` + SELECT COUNT(*) AS n FROM ap_interactions i + JOIN posts p ON p.id = i.post_id + JOIN sites s ON s.id = p.site_id + WHERE (i.acted_like = 1 OR i.acted_boost = 1) AND IFNULL(i.object_uri, '') <> '' + AND NOT EXISTS (SELECT 1 FROM ap_my_reactions r + WHERE r.site_slug = s.slug AND r.target_uri = i.object_uri)`).get().n, +}); + +const voor = meet(); +console.log('vooraf :', JSON.stringify(voor)); + +const uit = migrateReactions({ dryRun, force: force || dryRun }); +if (uit.overgeslagen) { + console.log('\novergeslagen: de versievlag staat al. Gebruik --force om toch te draaien.'); + process.exit(0); +} +if (dryRun) { + console.log(`\n--dry-run: zou ${uit.hersleuteld} rij(en) hersleutelen, ${uit.aangevuld} aanvullen` + + ` en ${uit.reacties} uit reacties overnemen. Niets geschreven.`); + process.exit(0); +} + +const na = meet(); +console.log('hersleuteld:', uit.hersleuteld, ' aangevuld:', uit.aangevuld, ' uit reacties:', uit.reacties); +console.log('achteraf :', JSON.stringify(na)); + +// De twee controles die tellen. Blijft er een vlag zonder tegenhanger, dan is de +// tussentabel niet compleet en tonen reacties als niet-gegeven. Blijft er een +// tussentabel-rij zonder tijdlijnrij, dan is die op iets buiten je tijdlijn +// gericht (legitiem) OF nog op een permalink (niet legitiem) -- vandaar de +// waarschuwing in plaats van een fout. +if (na.scheef !== 0) { + console.error(`\nFOUT: nog ${na.scheef} rij(en) met een vlag zonder tegenhanger.`); + process.exit(1); +} +if (na.scheefActed !== 0) { + console.error(`\nFOUT: nog ${na.scheefActed} reactie(s) onder je eigen posts met acted_* zonder tegenhanger.`); + process.exit(1); +} +if (na.wees > voor.wees) { + console.error('\nFOUT: er zijn tussentabel-rijen bijgekomen die nergens op slaan.'); + process.exit(1); +} +if (na.wees) { + console.warn(`\nLET OP: ${na.wees} tussentabel-rij(en) zonder tijdlijnrij. Dat mag (een reactie op iets\n` + + 'buiten je tijdlijn), maar controleer of er geen permalinks tussen zitten van een post die je\n' + + 'wel kent -- die zouden hersleuteld moeten zijn.'); +} +console.log('\nOK: elke vlag heeft een tegenhanger in de tussentabel.'); Index: scripts/export-archive.mjs =================================================================== --- scripts/export-archive.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ scripts/export-archive.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,57 @@ +#!/usr/bin/env node +// +// Exporteer het inhoudsarchief van een site (shaer-1a6). +// +// node scripts/export-archive.mjs --dry-run +// node scripts/export-archive.mjs --out boiert.zip +// node scripts/export-archive.mjs --dir ./archief +// +// Het formaat staat in docs/EXPORT-FORMAT.md. +// +// Dit is NIET de storage-zip: er zit geen sleutel, sessie, wachtwoordhash of +// DM van een ander in. Wel je eigen concepten, en -- als je die hebt -- de +// volledige inhoud van betaalde posts. Behandel het bestand als de inhoud zelf. + +import fs from 'fs'; +import path from 'path'; +import { buildArchive, zipArchive, writeArchiveDir } from '../src/services/ArchiveExportService.js'; + +const args = process.argv.slice(2); +const slug = args.find((a) => !a.startsWith('-')); +const vlag = (naam) => { const i = args.indexOf(naam); return i >= 0 ? (args[i + 1] || true) : null; }; + +if (!slug) { + console.error('gebruik: node scripts/export-archive.mjs [--dry-run | --out | --dir ]'); + process.exit(1); +} + +const uit = buildArchive(slug); +const t = uit.counts; +console.log(`site : ${uit.manifest.site.slug} (${uit.manifest.origin || 'geen PUBLIC_BASE_URL'})`); +console.log(`posts : ${t.posts}`); +console.log(`antwoorden: ${t.replies} (alleen-lezen archief)`); +console.log(`media : ${t.media} meegenomen, ${t.mediaMissing} ontbrekend`); + +// Ontbrekende media worden GETELD en GEMELD, nooit stil overgeslagen: een post +// waarvan het plaatje verdwenen is hoort dat te zeggen. +if (uit.missing.length) { + console.log('\nontbrekende media:'); + for (const m of uit.missing.slice(0, 20)) console.log(` ${m.post} ${m.url}`); + if (uit.missing.length > 20) console.log(` ... en nog ${uit.missing.length - 20}`); +} + +if (args.includes('--dry-run')) { + console.log(`\n--dry-run: ${uit.files.size} bestand(en) zouden geschreven worden. Niets geschreven.`); + process.exit(0); +} + +const dir = vlag('--dir'); +if (dir && typeof dir === 'string') { + writeArchiveDir(uit.files, dir); + console.log(`\ngeschreven naar ${path.resolve(dir)}`); + process.exit(0); +} + +const out = (typeof vlag('--out') === 'string' ? vlag('--out') : null) || `${slug}-archief.zip`; +fs.writeFileSync(out, zipArchive(uit.files)); +console.log(`\ngeschreven: ${out} (${fs.statSync(out).size} bytes)`); Index: scripts/import-archive.mjs =================================================================== --- scripts/import-archive.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ scripts/import-archive.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,53 @@ +#!/usr/bin/env node +// +// Importeer een inhoudsarchief in een site (shaer-pmr). +// +// node scripts/import-archive.mjs --dry-run +// node scripts/import-archive.mjs +// node scripts/import-archive.mjs --overwrite +// +// Het formaat staat in docs/EXPORT-FORMAT.md. +// +// Standaard wordt een bestaande post met hetzelfde id of dezelfde slug +// OVERGESLAGEN. Dat maakt de import idempotent en zorgt dat je nooit per ongeluk +// inhoud vernietigt die er al staat. --overwrite doet het wel, expliciet. +// +// Er gaat GEEN Update de fediverse in. Als andere servers een oudere kopie +// hebben, blijft die daar staan; dat rechttrekken is een uitzending naar iedereen +// en hoort een aparte, bewuste actie te zijn. + +import { readArchive, importArchive } from '../src/services/ArchiveImportService.js'; + +const args = process.argv.slice(2); +const vrij = args.filter((a) => !a.startsWith('-')); +const [slug, bron] = vrij; + +if (!slug || !bron) { + console.error('gebruik: node scripts/import-archive.mjs [--dry-run] [--overwrite]'); + process.exit(1); +} + +let files; +try { files = readArchive(bron); } +catch (e) { console.error(`kan het archief niet lezen: ${e.message}`); process.exit(1); } + +let r; +try { r = importArchive(files, { slug, dryRun: args.includes('--dry-run'), overwrite: args.includes('--overwrite') }); } +catch (e) { console.error(`geweigerd: ${e.message}`); process.exit(1); } + +console.log(`formaatversie : ${r.formatVersion}`); +console.log(`herkomst : ${r.origin || '(geen)'}`); +console.log(`AP-ids : ${r.idsBehouden ? 'BEHOUDEN (zelfde origin)' : 'nieuw (andere origin)'}`); +console.log(`posts : ${r.posts}${r.overschreven ? `, waarvan ${r.overschreven} overschreven` : ''}`); +console.log(`overgeslagen : ${r.overgeslagen} (bestonden al)`); +console.log(`antwoorden : ${r.replies} (alleen-lezen archief)`); +console.log(`media : ${r.media} teruggezet, ${r.mediaMissing} ontbrekend`); + +if (r.gemist.length) { + console.log('\nontbrekende media:'); + for (const m of r.gemist.slice(0, 20)) console.log(` ${m.post} ${m.url}`); + if (r.gemist.length > 20) console.log(` ... en nog ${r.gemist.length - 20}`); +} +for (const w of r.waarschuwingen) console.log(`\nLET OP: ${w}`); + +if (args.includes('--dry-run')) console.log('\n--dry-run: niets geschreven.'); Index: scripts/klonkt-refresh-updater.sh =================================================================== --- scripts/klonkt-refresh-updater.sh (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ scripts/klonkt-refresh-updater.sh (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -30,5 +30,14 @@ D="${KLONKT_DIR}" B=\$(runuser -u ${KLONKT_USER} -- git -C "\$D" rev-parse HEAD 2>/dev/null || true) -runuser -u ${KLONKT_USER} -- git -C "\$D" fetch --depth 1 origin ${BRANCH} +# Deepen a shallow checkout ONCE. \`fetch --depth 1\` keeps only the newest commit +# and \`checkout -f\` throws away the tree that was there, so after an update the +# previous version existed nowhere on the machine: a bad release could not be +# undone without the network, and only if you knew which commit to ask for. +# One deepening buys back the history; every later fetch keeps it. +if [ "\$(runuser -u ${KLONKT_USER} -- git -C "\$D" rev-parse --is-shallow-repository 2>/dev/null)" = "true" ]; then + echo "deepening the checkout once so updates can be rolled back..." + runuser -u ${KLONKT_USER} -- git -C "\$D" fetch --unshallow origin ${BRANCH} || true +fi +runuser -u ${KLONKT_USER} -- git -C "\$D" fetch origin ${BRANCH} runuser -u ${KLONKT_USER} -- git -C "\$D" checkout -qf -B ${BRANCH} FETCH_HEAD A=\$(runuser -u ${KLONKT_USER} -- git -C "\$D" rev-parse HEAD) @@ -54,4 +63,13 @@ else echo "Klonkt updated (\$A) + restarted \$N instance(s)." +fi +# History alone is not a rollback; at three in the morning you also need the +# command. Print it while the previous commit is still known. +if [ -n "\$B" ]; then + echo + echo "Previous version: \$B" + echo "To go back:" + echo " runuser -u ${KLONKT_USER} -- git -C \$D checkout -qf -B ${BRANCH} \$B" + echo " then restart the instances (systemctl restart 'klonkt@*')" fi EOF Index: scripts/recover-from-cache.mjs =================================================================== --- scripts/recover-from-cache.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ scripts/recover-from-cache.mjs (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,95 @@ +#!/usr/bin/env node +// +// Herstel de posts van een verloren Klonkt uit de tijdlijn-cache van instances +// die haar volgden (shaer-l1v). +// +// node scripts/recover-from-cache.mjs \ +// --actor https://boiert.eu/ap/users/boiert \ +// --from /pad/naar/sound-fabrics/database.sqlite \ +// --from /pad/naar/nog-een/database.sqlite \ +// --media /geredde/storage/media \ +// --audio /geredde/storage/audio \ +// --out boiert-herstel.zip +// +// Het resultaat is een gewoon archief in het formaat uit docs/EXPORT-FORMAT.md. +// Terugzetten gaat dus met scripts/import-archive.mjs, met dezelfde droogloop en +// dezelfde regel rond het behouden van AP-ids. Er is bewust geen apart +// herstelpad: dat zou een tweede implementatie zijn van iets dat al bestaat. +// +// WAT HIER PRINCIPIEEL NIET IN ZIT: +// - antwoorden van de verloren site zelf (die staan niet in een tijdlijn-cache) +// - alles van voor het moment dat de bron ging volgen +// - concepten (nooit gefedereerd, dus nergens gecachet) +// - de plek van afbeeldingen IN de tekst (bij het federeren eruit gehaald) + +import fs from 'fs'; +import path from 'path'; +import { recoverFromCache } from '../src/services/ArchiveRecoveryService.js'; +import { zipArchive } from '../src/services/ArchiveExportService.js'; + +const args = process.argv.slice(2); +const alle = (naam) => args.reduce((uit, a, i) => (a === naam && args[i + 1] ? [...uit, args[i + 1]] : uit), []); +const een = (naam) => alle(naam)[0] || null; + +const actor = een('--actor'); +const sources = alle('--from'); +if (!actor || !sources.length) { + console.error('gebruik: node scripts/recover-from-cache.mjs --actor --from [--from ] [--media ] [--audio ] [--out | --dir ] [--houd-titel]'); + process.exit(1); +} + +let uit; +try { + uit = recoverFromCache({ + sources, actorUri: actor, mediaRoot: een('--media'), audioRoot: een('--audio'), + houdTitelInTekst: args.includes('--houd-titel'), + slug: een('--slug') || '', title: een('--titel') || '', + }); +} catch (e) { console.error(`kan niet herstellen: ${e.message}`); process.exit(1); } + +const r = uit.rapport; +console.log('bronnen:'); +for (const b of r.bronnen) console.log(` ${b.rijen.toString().padStart(5)} rij(en) ${b.pad}`); +console.log(`\nposts gevonden : ${r.posts}`); +console.log(`periode : ${r.oudste || '?'} tot ${r.nieuwste || '?'}`); +console.log(`media : ${r.media} gered, ${r.mediaMissing} niet gevonden`); +console.log(`titels : ${r.titels.length} losgetrokken uit de tekst`); + +// De titels horen door een MENS nagelopen te worden. Er is geen sluitend signaal +// dat een vetgedrukte eerste regel een titel was; de slug is er niet van afgeleid. +if (r.titels.length) { + console.log('\nteruggevonden titels -- loop deze na, een post die echt met een vetgedrukte'); + console.log('regel begint raakt die regel kwijt aan zijn titel:'); + for (const t of r.titels.slice(0, 30)) console.log(` ${t.slug.padEnd(28)} ${t.titel}`); + if (r.titels.length > 30) console.log(` ... en nog ${r.titels.length - 30}`); +} +if (r.gemist.length) { + console.log('\nmedia niet gevonden op schijf:'); + for (const m of r.gemist.slice(0, 20)) console.log(` ${m.slug.padEnd(28)} ${m.url}`); + if (r.gemist.length > 20) console.log(` ... en nog ${r.gemist.length - 20}`); +} +for (const w of r.waarschuwingen) console.log(`\nLET OP: ${w}`); + +console.log('\nNIET herstelbaar uit een tijdlijn-cache: eigen antwoorden, alles van voor het'); +console.log('volgmoment, concepten, en de plek van afbeeldingen in de tekst.'); + +if (args.includes('--dry-run')) { + console.log(`\n--dry-run: ${uit.files.size} bestand(en) zouden geschreven worden. Niets geschreven.`); + process.exit(0); +} + +const dir = een('--dir'); +if (dir) { + for (const pad of [...uit.files.keys()].sort()) { + const doel = path.join(dir, pad); + fs.mkdirSync(path.dirname(doel), { recursive: true }); + fs.writeFileSync(doel, uit.files.get(pad)); + } + console.log(`\ngeschreven naar ${path.resolve(dir)}`); + process.exit(0); +} + +const out = een('--out') || 'herstel.zip'; +fs.writeFileSync(out, zipArchive(uit.files)); +console.log(`\ngeschreven: ${out} (${fs.statSync(out).size} bytes)`); +console.log(`\nterugzetten: node scripts/import-archive.mjs ${out} --dry-run`); Index: src/assets/css/guardian.css =================================================================== --- src/assets/css/guardian.css (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ src/assets/css/guardian.css (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -168,2 +168,30 @@ .g-card.gated { border-left: 3px solid var(--accent); } .g-card.gated .row { margin-top: 8px; gap: 8px; } + +/* Het gate-paneel per ward (shaer-ahy.1). Een rij per gate, met het soort en de + drempel erbij. Bewust rustig: dit is een overzicht om te LEZEN, en pas daarna + een plek om iets voor te stellen. */ +.g-gate { padding: .5rem 0; border-top: 1px solid var(--g-line, rgba(0,0,0,.08)); } +.g-gate:first-of-type { border-top: 0; } +.g-gate-head { display: flex; align-items: baseline; gap: .5rem; flex-wrap: wrap; } +.g-gate-name { font-weight: 600; } +/* Het soort is een fluistering, geen kop: het hoort erbij te staan zonder de + naam van de gate te overstemmen. */ +.g-gate-kind { font-size: .78em; opacity: .65; } +.g-gate-meta { display: flex; gap: .75rem; flex-wrap: wrap; margin-top: .15rem; } +.g-gate-meta .g-dim { opacity: .55; } +/* Onomkeerbaar krijgt gewicht, want dat is het enige in dit paneel dat je niet + kunt terugdraaien. */ +.g-gate-warn { font-weight: 600; } +.g-gate-wait { font-weight: 600; } + +/* De gedeelde staat van een hulpvraag (shaer-lgo). Rustig: dit is geen alarm, + het moet alleen onmogelijk te missen zijn wie er al op af is. */ +.g-help-state { margin-top: .5rem; } +.g-help-pick { font-size: .9em; } +.g-help-age { opacity: .6; } /* oud, maar niet weg */ +.g-help-done { font-weight: 600; } +.g-confirm { margin-top: .5rem; } + +/* Het archief van afgehandelde hulpvragen: aanwezig, niet in de weg. */ +.g-help-archive { margin-top: .5rem; opacity: .75; } Index: src/assets/js/guardian.js =================================================================== --- src/assets/js/guardian.js (revision f85b2c37408ce5c5fc3bca3b94691552a2696f4b) +++ src/assets/js/guardian.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -49,4 +49,18 @@ // child's panel. var HELP_TOP = 5; + + /** + * Wacht deze hulpvraag nog op iemand? + * + * EEN plek, met opzet. Dit werd eerst op twee plekken los beslist -- de lijst + * en de teller op de wardregel -- en toen de lijst gefilterd werd bleef die + * teller een afgehandelde vraag meetellen. Een derde plek komt er vast, en dan + * hoort hij hier langs te komen. + * + * Bij TWIJFEL open: alles wat geen expliciete afsluiting draagt telt als + * wachtend. De omgekeerde fout -- iets als afgehandeld tonen dat het niet is -- + * is hier de gevaarlijke. + */ + function helpOpen(h) { return !h || !h.state || h.state.open; } function helpCard(h) { @@ -72,5 +86,80 @@ card.appendChild(a); } + card.appendChild(helpState(h)); return card; + } + + /** Hoe lang geleden, grof. Een oppik vervalt niet maar hoort wel te verouderen. */ + function ago(ms) { + var u = Math.floor(ms / 3600000); + if (u < 1) return T.help_just_now || 'just now'; + if (u < 24) return (T.help_hours || '{n}h ago').replace('{n}', u); + return (T.help_days || '{n}d ago').replace('{n}', Math.floor(u / 24)); + } + + /** + * De gedeelde staat van een hulpvraag (shaer-lgo): wie er al op af is, of het + * is afgesloten, en de twee knoppen. + * + * De faalstand hier is NIET veilig: 'iedereen denkt dat het geregeld is' is + * gevaarlijker dan geen markering. Dus bij twijfel toont dit OPEN, en een oude + * oppik verkleurt in plaats van te verdwijnen -- anders ziet een hulpvraag er + * onaangeroerd uit terwijl er iemand mee bezig is. + */ + function helpState(h) { + var st = h.state || { open: true, pickedUpBy: [], handled: null, ageMs: null }; + var box = el('div', 'g-help-state'); + + if (st.handled) { + var wie = st.handled.handle || handleOf(st.handled.uri); + box.appendChild(el('div', 'g-help-done', (T.help_handled_by || 'Handled by {who}').replace('{who}', wie))); + // Geen terugdraaiknop: leeft de vraag nog, dan wordt hij opnieuw gesteld. + box.appendChild(el('p', 'small g-empty', T.help_handled_note || '')); + return box; + } + + (st.pickedUpBy || []).forEach(function (p) { + var line = (T.help_picked_by || '{who} is looking into this').replace('{who}', p.handle || handleOf(p.uri)); + box.appendChild(el('div', 'g-help-pick', line)); + }); + // Oud, maar niet weg. Dit is het verschil tussen 'er is iemand mee bezig' en + // 'er was ooit iemand mee bezig'. + if (st.ageMs != null && st.ageMs > 3600000) { + box.appendChild(el('div', 'g-help-age small', ago(st.ageMs))); + } + + var row = el('div', 'row'); + var mij = (st.pickedUpBy || []).some(function (p) { return p.uri === S.me; }); + if (!mij) { + var pick = el('button', 'small', T.help_pick || 'I am on it'); + pick.addEventListener('click', function () { markHelp(h, 'pickup', pick); }); + row.appendChild(pick); + } + var done = el('button', 'quiet small', T.help_close || 'Mark handled'); + // Een stevige bevestiging, en nooit een window.confirm: dat verstopt een + // uitleg achter een OK die mensen wegklikken. Zelfde lijn als het loslaten + // van een ward. + done.addEventListener('click', function () { + done.hidden = true; + var ask = el('div', 'g-confirm'); + ask.appendChild(el('p', 'small', T.help_close_ask || '')); + var ja = el('button', 'small', T.help_close_yes || 'Yes, handled'); + ja.addEventListener('click', function () { markHelp(h, 'handled', ja); }); + var nee = el('button', 'quiet small', T.release_no || 'No'); + nee.addEventListener('click', function () { ask.remove(); done.hidden = false; }); + ask.appendChild(ja); ask.appendChild(nee); + box.appendChild(ask); + }); + row.appendChild(done); + box.appendChild(row); + return box; + } + + function markHelp(h, kind, btn) { + if (btn) btn.disabled = true; + fetch('/guardian/api/help/' + kind, { + method: 'POST', headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ note: h.object_uri, ward: h.actor_uri, site: S.site }), + }).then(refresh).catch(function () { if (btn) btn.disabled = false; }); } @@ -78,12 +167,40 @@ var list = document.getElementById('help-list'); list.textContent = ''; - var help = S.help || []; - help.slice(0, HELP_TOP).forEach(function (h) { list.appendChild(helpCard(h)); }); - if (help.length > HELP_TOP) { - list.appendChild(el('p', 'g-sec-sub', '+ ' + (help.length - HELP_TOP) + ' — ' + (T.panel_help || ''))); - } + var alle = S.help || []; + // Afgehandeld hoort niet meer in de lijst die om aandacht vraagt, en niet + // meer in de teller: anders blijft het cijfer alarm slaan voor iets dat af + // is, en neemt een gesloten vraag de ruimte in van een open vraag. + var open = alle.filter(helpOpen); + var klaar = alle.filter(function (h) { return !helpOpen(h); }); + + open.slice(0, HELP_TOP).forEach(function (h) { list.appendChild(helpCard(h)); }); + if (open.length > HELP_TOP) { + list.appendChild(el('p', 'g-sec-sub', '+ ' + (open.length - HELP_TOP) + ' — ' + (T.panel_help || ''))); + } + + // WEG is niet hetzelfde als AF. Een afgehandelde hulpvraag blijft bestaan -- + // er wordt in dit systeem niets herschreven -- maar hij hoort achter een + // klik, niet voor je neus. De volledige geschiedenis per kind staat sowieso + // in het paneel van dat kind. + if (klaar.length) { + var doos = el('div', 'g-help-archive'); + doos.hidden = true; + klaar.forEach(function (h) { doos.appendChild(helpCard(h)); }); + var knop = el('button', 'quiet small', (T.help_archive || '{n} handled').replace('{n}', klaar.length)); + knop.addEventListener('click', function () { + doos.hidden = !doos.hidden; + knop.textContent = doos.hidden + ? (T.help_archive || '{n} handled').replace('{n}', klaar.length) + : (T.help_archive_hide || 'hide'); + }); + list.appendChild(knop); + list.appendChild(doos); + } + var badge = document.getElementById('help-count'); - badge.textContent = help.length; badge.hidden = help.length === 0; - show('help-empty', help.length === 0); + badge.textContent = open.length; badge.hidden = open.length === 0; + // "Geen hulpverzoeken. Mooi zo." mag ook staan als er wel een archief is: + // er wacht dan immers niets. + show('help-empty', open.length === 0); } @@ -351,4 +468,64 @@ } + /** Het woord dat we voor een gate gebruiken; onbekend valt terug op de naam. */ + function gateLabel(feature) { + return T['gate_' + feature.replace('shaer:', '')] || feature.replace('shaer:', ''); + } + + /** + * Een rij in het gate-paneel. Toont WAT er geldt, van welk SOORT het is, welke + * drempel er hoort en wat er loopt -- en pas daarna een knop, als er iets te + * verzetten valt. + * + * Het soort staat erbij omdat de gates niet hetzelfde werken: een stand is aan + * of uit, volgverzoeken zijn een stroom beslissingen, en een overdracht is + * onomkeerbaar zodra het kind hem gebruikt. Vier rijen met dezelfde schakelaar + * zouden dat verschil wegpoetsen. + */ + function gateRow(w, g) { + var row = el('div', 'g-gate'); + var head = el('div', 'g-gate-head'); + head.appendChild(el('span', 'g-gate-name', gateLabel(g.feature))); + head.appendChild(el('span', 'g-gate-kind', T['gate_kind_' + g.kind] || g.kind)); + row.appendChild(head); + + // De stand. NULL is onbekend en dat is iets anders dan uit: bij een ward op + // een andere server wordt die kolom daar bijgehouden. + var stand = g.value === null || g.value === undefined + ? (T.gate_unknown || 'unknown') + : (g.value ? (T.prop_on || 'on') : (T.prop_off || 'off')); + var meta = el('div', 'g-gate-meta small'); + meta.appendChild(el('span', null, stand)); + if (g.threshold) { + meta.appendChild(el('span', null, (T.gate_threshold || '{need} of {of} guardians') + .replace('{need}', g.threshold.need).replace('{of}', g.threshold.of))); + } else { + // Geen drempel verzinnen die we niet kennen. + meta.appendChild(el('span', 'g-dim', T.gate_threshold_unknown || '')); + } + if (!g.reversible) meta.appendChild(el('span', 'g-gate-warn', T.gate_irreversible || '')); + if (g.waiting) { + meta.appendChild(el('span', 'g-gate-wait', (T.gate_waiting || '{n} waiting').replace('{n}', g.waiting))); + } + row.appendChild(meta); + + if (g.proposal) { + row.appendChild(el('p', 'small g-prop g-prop-' + g.proposal.status, + (T.prop_line || 'Proposal {what} {value}: {status}') + .replace('{what}', gateLabel(g.feature)) + .replace('{value}', g.proposal.value ? (T.prop_on || 'on') : (T.prop_off || 'off')) + .replace('{status}', T['prop_st_' + g.proposal.status] || g.proposal.status))); + } + if (g.blockedBy) { + row.appendChild(el('p', 'small g-empty', (T.gate_blocked || 'needs {what} first') + .replace('{what}', gateLabel(g.blockedBy)))); + } + if (g.adjustable) { + row.appendChild(gateButton(w, g.feature, g.value, T.gate_propose || T.embeds_propose, + T.prop_on || 'on', T.prop_off || 'off')); + } + return row; + } + function wardPanel(w) { var uri = w.other_uri; @@ -358,28 +535,25 @@ var set = el('div', 'g-panel-sec'); set.appendChild(el('h3', null, T.settings_title || 'Settings')); - var setRow = el('div', 'row'); - setRow.appendChild(gateButton(w, 'shaer:externalEmbeds', w.embeds, T.embeds_propose, T.embeds_on, T.embeds_off)); - // The heavier sibling (5.6): seeing that a video exists is one decision, - // letting a third party's player run inside the app is another. Hidden - // only when previews are known-OFF: for a ward on another server the - // value is unknown, and unknown is not off. Hiding it there meant a - // guardian elsewhere could never even propose playback, which is how a - // whole proposal round went into the wrong gate. The ward's server - // enforces play-needs-previews at serve time regardless. - if (w.embeds !== false) { - setRow.appendChild(gateButton(w, 'shaer:externalPlayback', w.playback, T.play_propose, T.play_on, T.play_off)); - } - set.appendChild(setRow); - // What this guardian proposed and how it stands (5.6). This used to be a - // button caption that vanished on refresh, so a running decision was - // invisible: you could not tell "waiting", "done" and "expired" apart. - (w.proposals || []).forEach(function (p) { - var what = p.feature === 'shaer:externalPlayback' ? (T.prop_play || 'playback') : (T.prop_embeds || 'link previews'); - var line = (T.prop_line || 'Proposal {what} {value}: {status}') - .replace('{what}', what) - .replace('{value}', p.value ? (T.prop_on || 'on') : (T.prop_off || 'off')) - .replace('{status}', T['prop_st_' + p.status] || p.status); - set.appendChild(el('p', 'small g-prop g-prop-' + p.status, line)); - }); + // Een rij per gate, uit de catalogus van de server (shaer-ahy.1). Losse + // knoppen lieten een guardian zelf uitzoeken wat er allemaal geldt, en wat + // niet verstelbaar is stond nergens -- terwijl dat de helft van het antwoord + // is op "wat mag dit kind". + (w.gates || []).forEach(function (g) { set.appendChild(gateRow(w, g)); }); + // Terugval voor een server die de catalogus nog niet stuurt: dan de twee + // knoppen zoals ze waren, zodat een oudere Klonkt niet met een leeg vak zit. + if (!(w.gates || []).length) { + var setRow = el('div', 'row'); + setRow.appendChild(gateButton(w, 'shaer:externalEmbeds', w.embeds, T.embeds_propose, T.embeds_on, T.embeds_off)); + if (w.embeds !== false) { + setRow.appendChild(gateButton(w, 'shaer:externalPlayback', w.playback, T.play_propose, T.play_on, T.play_off)); + } + set.appendChild(setRow); + (w.proposals || []).forEach(function (p) { + var what = p.feature === 'shaer:externalPlayback' ? (T.prop_play || 'playback') : (T.prop_embeds || 'link previews'); + set.appendChild(el('p', 'small g-prop g-prop-' + p.status, (T.prop_line || 'Proposal {what} {value}: {status}') + .replace('{what}', what).replace('{value}', p.value ? (T.prop_on || 'on') : (T.prop_off || 'off')) + .replace('{status}', T['prop_st_' + p.status] || p.status))); + }); + } panel.appendChild(set); @@ -420,6 +594,10 @@ T.panel_follow_empty || '', followCard); + // Hier juist de VOLLEDIGE geschiedenis van dit kind -- dat is waar dit + // paneel voor is. Wel wat nog wacht bovenaan, want dat is waar je naar zoekt + // als je het opent. sectionInto(panel, T.panel_help || 'Calls for help', - (S.help || []).filter(function (h) { return h.actor_uri === uri; }), + (S.help || []).filter(function (h) { return h.actor_uri === uri; }) + .sort(function (a, b) { return (helpOpen(b) ? 1 : 0) - (helpOpen(a) ? 1 : 0); }), T.panel_help_empty || '', helpCard); @@ -453,5 +631,9 @@ actRow.appendChild(rel); act.appendChild(actRow); - panel.appendChild(act); + // Bovenaan, niet onderaan: zwaaien en loslaten zijn de dingen die je DOET. + // De rest van het paneel is lezen -- instellingen, wie er nog meer op let, + // wat er binnenkwam. Wie het paneel opent om iets te doen hoorde eerst langs + // vijf secties te scrollen. + panel.insertBefore(act, panel.firstChild); return panel; } @@ -467,5 +649,7 @@ row.appendChild(el('span', 'who grow', handleOf(uri, w.other_handle))); // Counts on the row: whatever is waiting must be visible with the panel shut. - var nHelp = (S.help || []).filter(function (h) { return h.actor_uri === uri; }).length; + // Alleen wat nog WACHT, zoals het commentaar hierboven al zei: een + // afgehandelde vraag hoorde de boei niet te laten staan. + var nHelp = (S.help || []).filter(function (h) { return h.actor_uri === uri && helpOpen(h); }).length; var nFollow = FOLLOWS.filter(function (f) { return f.wardUri === uri; }).length; if (nHelp) row.appendChild(el('span', 'tag help', '🛟 ' + nHelp)); @@ -553,11 +737,17 @@ card.appendChild(head); var body = el('div', 'feed-body'); + // body_html is de gedeelde note-body-partial, serverside gerenderd: opmaak, + // media, quote-kaart en embed, precies als in de Krant en in Berichten. + // Valt terug op de kale content voor een client uit de cache. + var html = p.body_html || p.content || ''; if (p.cw) { + // De content warning blijft van de PWA zelf: note-body versluiert alleen + // bij nsfw, en een ward-post met alleen een cw hoort hier dicht te staan. var d = document.createElement('details'); var sum = document.createElement('summary'); sum.textContent = p.cw; d.appendChild(sum); - var inner = el('div'); inner.innerHTML = p.content || ''; d.appendChild(inner); + var inner = el('div'); inner.innerHTML = html; d.appendChild(inner); body.appendChild(d); } else { - body.innerHTML = p.content || ''; // server-sanitized HTML (same as Berichten) + body.innerHTML = html; // server-sanitized HTML (same as Berichten) } card.appendChild(body); @@ -700,5 +890,19 @@ renderAll(); pushState(); loadFeed(); loadFollowReqs(); - setInterval(refresh, 45000); // live-ish while open + + // De push die de melding brengt is meteen het teken dat de staat veranderd is. + // Daarmee hoeft er geen tweede, open verbinding bij: hetzelfde kanaal doet het + // werk, en het werkt ook als de app dicht is. + if ('serviceWorker' in navigator) { + navigator.serviceWorker.addEventListener('message', function (e) { + if (e.data && e.data.klonkt === 'push') refresh(); + }); + } + // Het tikje blijft als vangnet -- niet elke verandering geeft een melding, en + // niet iedereen heeft meldingen aanstaan. Maar niet tikken terwijl niemand + // kijkt: dat waren verzoeken voor een tabblad op de achtergrond. Bij terugkomen + // meteen een keer, want dan is de kans op nieuws het grootst. + setInterval(function () { if (!document.hidden) refresh(); }, 45000); + document.addEventListener('visibilitychange', function () { if (!document.hidden) refresh(); }); } catch (e) { fatal((e && e.message) || String(e)); Index: src/assets/js/mod/admin-audio.js =================================================================== --- src/assets/js/mod/admin-audio.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-audio.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,442 @@ +// Audio in beheer -- verplaatst uit inline script, shaer-bqr. +// +// Servergegevens komen uit pageData(); interpolatie kan niet in een statisch +// bestand. Inline script wordt bovendien geweigerd zodra deze pagina via een +// link BINNEN de site binnenkomt (shaer-0i6). + +import { pageData } from './lib.js'; + + const T = pageData(); + +(function() { + + // ── Live filename display for custom file inputs ────────────── + document.querySelectorAll('.ax-file-control input[type="file"]').forEach(input => { + const nameEl = input.parentElement.querySelector('.ax-file-name'); + if (!nameEl) return; + input.addEventListener('change', () => { + if (input.files && input.files[0]) { + nameEl.textContent = input.files[0].name; + nameEl.removeAttribute('data-empty'); + } else { + nameEl.textContent = (T.no_file || ''); + nameEl.setAttribute('data-empty', ''); + } + }); + }); + + // ── Inline track preview (routed through the global mini-player) ── + // Each .ax-track-play button is a thin wrapper around the global + // window.pcmsAudioPlayer.setQueue([...]) call. Visual state (▶ / ⏸ / + // .is-playing) is synced from the player's own audio element so it + // stays accurate even when the user uses the mini-player's controls. + (function setupTrackPreview() { + const buttons = document.querySelectorAll('.ax-track-play'); + if (!buttons.length) return; + + function setIcon(btn, playing) { + const icon = btn.querySelector('.ax-track-play-icon'); + if (icon) icon.textContent = playing ? '⏸' : '▶'; + btn.classList.toggle('is-playing', playing); + btn.setAttribute('aria-label', playing ? (T.pause || '') : (T.play || '')); + } + + // Resync ALL preview buttons against the current audio element state. + // Called on every play/pause/ended event so admins always see the right + // icon — including the case where they hit pause on the mini-player + // bar instead of the row's button. + function resyncAll() { + const audio = document.getElementById('audio-element'); + const player = window.pcmsAudioPlayer; + const playing = audio && !audio.paused && !audio.ended; + // audio.src is now a blob: URL (Spotify-style playback), so compare + // against the player's logical track URL, not the element src. + const cur = player && player.currentTrack(); + const curUrl = cur ? cur.url : ''; + buttons.forEach(b => { + const isThisOne = playing && curUrl === b.dataset.streamUrl; + setIcon(b, isThisOne); + }); + } + + buttons.forEach(btn => { + btn.addEventListener('click', e => { + e.preventDefault(); + const player = window.pcmsAudioPlayer; + if (!player) { + console.warn('[admin-audio] miniplayer not available'); + return; + } + const url = btn.dataset.streamUrl; + if (!url) return; + + // Build track metadata from the row's DOM so the mini-player shows + // useful info (title/artist/album/cover) without an extra API call. + const row = btn.closest('.ax-track'); + const titleEl = row && row.querySelector('[data-cell="title"]'); + const artistEl = row && row.querySelector('[data-cell="artist"]'); + const albumEl = row && row.querySelector('[data-cell="album"]'); + const coverImg = row && row.querySelector('img[data-cover-thumb]'); + const track = { + url, + title: titleEl ? titleEl.textContent.trim() : 'Track', + artist: artistEl ? artistEl.textContent.trim() : '', + album: albumEl ? albumEl.textContent.trim() : '', + cover: coverImg ? coverImg.src : '', + }; + + // If this exact track is already current, toggle pause/play instead + // of restarting from zero. Compare logical URLs (audio.src is a blob:). + const cur = player.currentTrack(); + if (cur && cur.url === url) { + if (player.isPlaying()) player.pause(); + else player.play(); + return; + } + + player.setQueue([track], 0); + }); + }); + + // Hook the global audio element's events to keep the row buttons synced. + // We attach lazily after the player has built its DOM. The script in + // shell.ejs runs at page-load so #audio-element exists by the time + // this IIFE fires (script tag is below the body content). + const audio = document.getElementById('audio-element'); + if (audio) { + ['play', 'pause', 'ended', 'loadstart', 'emptied'].forEach(ev => { + audio.addEventListener(ev, resyncAll); + }); + // Initial state on page load (e.g. user navigated back while a track + // was already playing — buttons should reflect that). + resyncAll(); + } + })(); + + + // ── Bulk upload (drag-drop + sequential transcoding) ───────── + // Files dropped or picked are queued (not uploaded immediately) so the + // user can review the list, set shared metadata, then hit "Start upload". + // The loop POSTs one file at a time to /admin/audio/upload with + // Accept: application/json so the server returns structured per-file + // results instead of redirecting. + const dropzone = document.getElementById('audio-dropzone'); + const fileInput = document.getElementById('audio-files'); + const queueEl = document.getElementById('upload-queue'); + const actionsEl = document.getElementById('upload-actions'); + const startBtn = document.getElementById('start-upload-btn'); + const clearBtn = document.getElementById('clear-queue-btn'); + const artistInput= document.getElementById('batch-artist'); + const albumInput = document.getElementById('batch-album'); + const coverInput = document.getElementById('batch-cover'); + + /** @type {Array<{file: File, el: HTMLElement, status: string}>} */ + const queue = []; + + function fmtBytes(n) { + if (n < 1024) return n + ' B'; + if (n < 1024 * 1024) return (n / 1024).toFixed(0) + ' KB'; + return (n / 1024 / 1024).toFixed(1) + ' MB'; + } + + function setItemStatus(item, status, label) { + const labels = { + queued: (T.st_queued || ''), + uploading: (T.st_uploading || ''), + transcoding: (T.st_transcoding || ''), + done: '✓ ' + (T.st_done || ''), + error: '✗ ' + (T.st_error || ''), + }; + item.status = status; + const badge = item.el.querySelector('.ax-queue-status'); + badge.className = 'ax-queue-status ax-queue-status--' + status; + badge.textContent = label || labels[status] || status; + // Restyle the row + item.el.classList.remove( + 'ax-queue-item--active', 'ax-queue-item--done', 'ax-queue-item--error' + ); + if (status === 'uploading' || status === 'transcoding') item.el.classList.add('ax-queue-item--active'); + else if (status === 'done') item.el.classList.add('ax-queue-item--done'); + else if (status === 'error') item.el.classList.add('ax-queue-item--error'); + } + + function addFiles(files) { + let added = 0; + for (const file of files) { + if (!file.type.startsWith('audio/') && + !/\.(mp3|m4a|ogg|opus|flac|wav|webm|aac|oga|mp4)$/i.test(file.name)) { + // Silently skip non-audio drops; keeps the UX uncluttered. + continue; + } + const li = document.createElement('li'); + li.className = 'ax-queue-item'; + li.innerHTML = + '
' + + '' + (T.st_queued || '') + ''; + // Use textContent to avoid HTML-injection if a filename contains markup. + li.querySelector('.ax-queue-name').textContent = file.name; + // Append size hint inline + const size = document.createElement('span'); + size.className = 'ax-queue-size'; + size.textContent = fmtBytes(file.size); + li.querySelector('.ax-queue-name').appendChild(size); + queueEl.appendChild(li); + queue.push({ file, el: li, status: 'queued' }); + added++; + } + if (added) { + queueEl.hidden = false; + actionsEl.hidden = false; + } + } + + // ── Drop-zone events ───────────────────────────────────────── + // Page-level guard: a dropped file outside the zone would otherwise + // make the browser navigate to it (e.g. opening the audio inline), which + // discards typed metadata. We swallow drops anywhere unless the dropzone + // explicitly handles them. + ['dragover', 'drop'].forEach(ev => { + window.addEventListener(ev, e => { + // Allow drops INSIDE the dropzone — its own listener handles those. + if (dropzone.contains(e.target)) return; + e.preventDefault(); + }); + }); + + ['dragenter', 'dragover'].forEach(ev => { + dropzone.addEventListener(ev, e => { + e.preventDefault(); + dropzone.classList.add('is-dragover'); + }); + }); + ['dragleave', 'drop'].forEach(ev => { + dropzone.addEventListener(ev, e => { + e.preventDefault(); + dropzone.classList.remove('is-dragover'); + }); + }); + dropzone.addEventListener('drop', e => { + if (e.dataTransfer && e.dataTransfer.files) addFiles(e.dataTransfer.files); + }); + fileInput.addEventListener('change', () => { + addFiles(fileInput.files); + // Reset so the same file can be picked again later if user wants + fileInput.value = ''; + }); + + // ── Clear queue button ─────────────────────────────────────── + clearBtn.addEventListener('click', () => { + // Only remove items that aren't currently uploading (anything queued + // or already finished). An in-progress upload finishes, then its row + // would also disappear once we re-render — but we keep it simple and + // just refuse to clear during an active run. + if (startBtn.disabled) return; + queue.length = 0; + queueEl.innerHTML = ''; + queueEl.hidden = true; + actionsEl.hidden = true; + }); + + // ── Sequential upload loop ─────────────────────────────────── + startBtn.addEventListener('click', async () => { + if (startBtn.disabled) return; + startBtn.disabled = true; + clearBtn.disabled = true; + dropzone.style.pointerEvents = 'none'; + dropzone.style.opacity = '0.5'; + + const sharedArtist = artistInput.value.trim(); + const sharedAlbum = albumInput.value.trim(); + const sharedCover = coverInput.files && coverInput.files[0]; + + // Process queued items one at a time. We iterate via index so that + // if more files get dropped during the run they ALSO get processed + // (queue.push above mutates the same array we're iterating). + for (let i = 0; i < queue.length; i++) { + const item = queue[i]; + if (item.status !== 'queued') continue; + try { + await uploadOne(item, sharedArtist, sharedAlbum, sharedCover); + } catch (err) { + console.error('upload failed for', item.file.name, err); + setItemStatus(item, 'error', '✗ ' + (err.message || (T.failed || ''))); + } + } + + startBtn.disabled = false; + clearBtn.disabled = false; + dropzone.style.pointerEvents = ''; + dropzone.style.opacity = ''; + + // Reload the page so the new tracks appear in the list below. + // Could also fetch them and inject, but a full reload is simpler and + // ensures position indexes / album-grouping are correct. + const anyDone = queue.some(q => q.status === 'done'); + if (anyDone) { + setTimeout(() => location.reload(), 700); + } + }); + + async function uploadOne(item, sharedArtist, sharedAlbum, sharedCover) { + setItemStatus(item, 'uploading'); + + const fd = new FormData(); + fd.append('audio', item.file); + if (sharedArtist) fd.append('artist', sharedArtist); + if (sharedAlbum) fd.append('album', sharedAlbum); + if (sharedCover) fd.append('cover', sharedCover); + // Title is intentionally omitted — server uses filename fallback. + + // We can't reliably distinguish "still uploading bytes" from + // "uploading done, ffmpeg running" without progress events, but the + // status flips to "Converteren…" once the request is past upload phase. + // We approximate this by waiting until the response arrives — by then + // both phases are complete on the server side. For a smoother feel we + // briefly show "transcoding" near the end of the request lifecycle. + const transcodeHint = setTimeout(() => { + if (item.status === 'uploading') setItemStatus(item, 'transcoding'); + }, 1500); + + try { + const res = await fetch('/admin/audio/upload', { + method: 'POST', + headers: { 'Accept': 'application/json' }, + body: fd, + credentials: 'same-origin', + }); + clearTimeout(transcodeHint); + + // Server responds with JSON for our Accept header. If it didn't + // (e.g. session expired and got an HTML login page), surface that. + let data; + try { data = await res.json(); } + catch (_) { throw new Error((T.err_unexpected || '') + ' (' + res.status + ')'); } + + if (!res.ok || !data.ok) { + throw new Error(data.error || ('HTTP ' + res.status)); + } + + setItemStatus(item, 'done', '✓ ' + (data.title || (T.st_done || ''))); + } catch (err) { + clearTimeout(transcodeHint); + throw err; + } + } + + // ── Click-to-copy embed codes ───────────────────────────────── + document.querySelectorAll('[data-copy]').forEach(el => { + el.addEventListener('click', async () => { + const text = el.dataset.copy; + try { + await navigator.clipboard.writeText(text); + el.classList.add('is-copied'); + const original = el.textContent; + el.textContent = '✓ ' + (T.copied || ''); + setTimeout(() => { + el.classList.remove('is-copied'); + el.textContent = original; + }, 1200); + } catch (_) { /* fall through — selection still works */ } + }); + }); + + // ── "+ Track zonder audio": maak een link-only stub + open de editor ── + const addLinkBtn = document.getElementById('add-link-track-btn'); + if (addLinkBtn) { + addLinkBtn.addEventListener('click', async () => { + addLinkBtn.disabled = true; + try { + const r = await fetch('/admin/audio/create-link', { + method: 'POST', credentials: 'same-origin', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ title: (T.new_track || '') }), + }); + const j = await r.json(); + if (!r.ok || !j.ok) throw new Error(j.error || (T.create_failed || '')); + if (typeof window.openTrackEditor !== 'function') { location.reload(); return; } + window.openTrackEditor({ id: j.id, onSaved: () => location.reload() }); + } catch (err) { + alert((T.create_failed || '') + ': ' + err.message); + } finally { + addLinkBtn.disabled = false; + } + }); + } + + // ── Wire all "Edit" buttons to the track-editor modal ───────── + // After save we patch the row in-place rather than reloading, + // so the user keeps their scroll position on long lists. + document.querySelectorAll('[data-track-edit]').forEach(btn => { + btn.addEventListener('click', () => { + if (typeof window.openTrackEditor !== 'function') { + alert((T.editor_not_loaded || '')); + return; + } + const id = btn.dataset.id; + window.openTrackEditor({ + id, + onSaved: (track) => { + const row = document.querySelector('li[data-track-id="' + id + '"]'); + if (!row) return; + // Update visible cells + const titleEl = row.querySelector('[data-cell="title"]'); + const artistEl = row.querySelector('[data-cell="artist"]'); + const albumEl = row.querySelector('[data-cell="album"]'); + if (titleEl) titleEl.textContent = track.title || (T.untitled || ''); + if (artistEl) artistEl.textContent = track.artist || '—'; + if (albumEl) { + albumEl.textContent = track.album || ''; + if (track.album) albumEl.removeAttribute('hidden'); + else albumEl.setAttribute('hidden', ''); + } + // Update cover thumb (replace element if type changed) + const oldThumb = row.querySelector('[data-cover-thumb]'); + if (oldThumb) { + const parent = oldThumb.parentElement; + if (track.cover_url) { + const img = document.createElement('img'); + img.className = 'ax-track-cover'; + img.src = track.cover_url; + img.alt = ''; + img.dataset.coverThumb = ''; + parent.replaceChild(img, oldThumb); + } else { + const sp = document.createElement('span'); + sp.className = 'ax-track-cover ax-track-cover-empty'; + sp.textContent = '♫'; + sp.dataset.coverThumb = ''; + parent.replaceChild(sp, oldThumb); + } + } + }, + }); + }); + }); + + // Download-voor-email toggle — AJAX (geen pagina-reload meer). + document.querySelectorAll('[data-track-dl]').forEach(btn => { + btn.addEventListener('click', async () => { + if (btn.disabled) return; + const want = btn.dataset.on === '1' ? 0 : 1; + btn.disabled = true; + try { + const res = await fetch('/admin/audio/api/' + btn.dataset.id, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ downloadable: !!want }), + }); + if (!res.ok) throw new Error('HTTP ' + res.status); + btn.dataset.on = String(want); + btn.style.color = want ? 'var(--accent,#6b8f71)' : ''; + btn.style.opacity = want ? '1' : '.5'; + btn.title = want + ? (T.dl_on || '') + : (T.dl_off || ''); + } catch (e) { + alert((T.change_failed || '') + ': ' + (e.message || e)); + } finally { + btn.disabled = false; + } + }); + }); +})(); Index: src/assets/js/mod/admin-epk.js =================================================================== --- src/assets/js/mod/admin-epk.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-epk.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,21 @@ +// Het EPK-scherm in beheer (pages/admin-epk.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + +(function () { + var box = document.querySelector('.epk-track-pick'); + if (!box) return; + var max = parseInt(box.dataset.max, 10) || 5; + function sync() { + var checks = box.querySelectorAll('input[type=checkbox]'); + var n = box.querySelectorAll('input[type=checkbox]:checked').length; + checks.forEach(function (c) { c.disabled = (!c.checked && n >= max); }); + } + box.addEventListener('change', sync); + sync(); +})(); Index: src/assets/js/mod/admin-help.js =================================================================== --- src/assets/js/mod/admin-help.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-help.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,30 @@ +// Het hulpscherm in beheer (pages/admin-help.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + +(function () { + var q = document.getElementById('hb-q'); + var items = [].slice.call(document.querySelectorAll('.hb-item')); + var empty = document.getElementById('hb-empty'); + var count = document.getElementById('hb-count'); + if (!q) return; + // Bewaar de originele tekst per item (voor highlight-reset). + items.forEach(function (it) { it._txt = it.textContent.toLowerCase(); }); + function run() { + var term = q.value.trim().toLowerCase(); + var shown = 0; + items.forEach(function (it) { + var hit = !term || it._txt.indexOf(term) >= 0; + it.classList.toggle('hb-hidden', !hit); + if (hit) shown++; + }); + empty.hidden = shown !== 0; + count.textContent = term ? (shown + ' onderwerp' + (shown === 1 ? '' : 'en') + ' gevonden') : ''; + } + q.addEventListener('input', run); +})(); Index: src/assets/js/mod/admin-media.js =================================================================== --- src/assets/js/mod/admin-media.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-media.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,38 @@ +// Media in beheer -- verplaatst uit inline script, shaer-bqr. +// +// Inline script wordt door de CSP geweigerd zodra deze pagina via een link +// BINNEN de site binnenkomt (shaer-0i6). Servergegevens komen uit pageData(); +// interpolatie kan niet in een statisch bestand. + +import { pageData } from './lib.js'; + +(function () { + if (window.__mediaWired) return; window.__mediaWired = true; + var T = pageData(); + document.addEventListener('click', function (e) { + var c = e.target.closest('[data-copy]'); + if (c) { + var u = location.origin + c.getAttribute('data-copy'); + var done = function () { var o = c.textContent; c.textContent = '✓'; setTimeout(function () { c.textContent = o === '✓' ? T.copy : o; }, 1200); }; + if (navigator.clipboard) navigator.clipboard.writeText(u).then(done).catch(function () { window.prompt('URL', u); }); + else window.prompt('URL', u); + return; + } + var d = e.target.closest('[data-del]'); + if (d) { + if (!window.confirm(T.delC)) return; + fetch('/admin/media/delete', { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ file: d.getAttribute('data-del') }) }) + .then(function (r) { return r.json(); }) + .then(function (j) { if (j && j.ok) { var card = d.closest('.media-card'); if (card) card.remove(); } else window.alert((j && j.error) || 'Error'); }) + .catch(function () { window.alert('Error'); }); + return; + } + if (e.target.closest('#media-cleanup')) { + if (!window.confirm(T.cleanC)) return; + fetch('/admin/media/cleanup', { method: 'POST', credentials: 'same-origin' }) + .then(function (r) { return r.json(); }) + .then(function (j) { location.href = '/admin/media?success=' + encodeURIComponent(((j && j.removed) || 0) + ' file(s) removed'); }) + .catch(function () { window.alert('Error'); }); + } + }); +})(); Index: src/assets/js/mod/admin-paid.js =================================================================== --- src/assets/js/mod/admin-paid.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-paid.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,21 @@ +// Betaalde posts in beheer (pages/admin-paid.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + +(function () { + var field = document.getElementById('pd-redirect'); + var btn = document.getElementById('pd-copy'); + if (!field || !btn) return; + field.addEventListener('focus', function () { field.select(); }); + btn.addEventListener('click', function () { + field.select(); + var done = function () { var t = btn.textContent; btn.textContent = document.getElementById('pd-copy').getAttribute('data-copied'); setTimeout(function () { btn.textContent = t; }, 1400); }; + if (navigator.clipboard && navigator.clipboard.writeText) { navigator.clipboard.writeText(field.value).then(done, function () { try { document.execCommand('copy'); done(); } catch (e) {} }); } + else { try { document.execCommand('copy'); done(); } catch (e) {} } + }); +})(); Index: src/assets/js/mod/admin-playlists.js =================================================================== --- src/assets/js/mod/admin-playlists.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-playlists.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,75 @@ +// Afspeellijsten in beheer -- verplaatst uit inline script, shaer-bqr. +// +// Servergegevens (het csrf-token en drie teksten) komen uit pageData(); +// interpolatie kan niet in een statisch bestand. + +import { pageData } from './lib.js'; + +(function() { + const _d = pageData(); + const csrf = _d.csrf || ''; + + document.getElementById('pl-new-btn')?.addEventListener('click', () => { + if (typeof window.openPlaylistEditor === 'function') { + window.openPlaylistEditor({ mode: 'create', onSaved: () => location.reload() }); + } + }); + + // Click-to-copy on shortcodes + document.querySelectorAll('[data-copy]').forEach(el => { + el.addEventListener('click', async () => { + try { + await navigator.clipboard.writeText(el.dataset.copy); + el.classList.add('is-copied'); + const original = el.textContent; + el.textContent = '✓ ' + (_d.copied || ''); + setTimeout(() => { el.classList.remove('is-copied'); el.textContent = original; }, 1200); + } catch (_) { /* fall back to selection */ } + }); + }); + + document.querySelectorAll('[data-pl-edit]').forEach(btn => { + btn.addEventListener('click', () => { + if (typeof window.openPlaylistEditor === 'function') { + window.openPlaylistEditor({ mode: 'edit', id: btn.dataset.id, onSaved: () => location.reload() }); + } + }); + }); + + document.querySelectorAll('[data-pl-delete]').forEach(btn => { + btn.addEventListener('click', async () => { + const id = btn.dataset.id; + const title = btn.dataset.title || id; + if (!confirm((_d.delConfirm || '').replace('{title}', title))) return; + try { + const r = await fetch(`/admin/playlists/api/${encodeURIComponent(id)}/delete`, { + method: 'POST', + headers: { 'X-CSRF-Token': csrf }, + credentials: 'same-origin', + }); + const j = await r.json(); + if (j.ok) location.reload(); + else alert((_d.delFailed || '') + ': ' + (j.error || '')); + } catch (err) { + alert((_d.delFailed || '') + ': ' + err.message); + } + }); + }); + + // P52 — deep-link from playlist embed (?edit=) auto-opens the editor. + // openPlaylistEditor is defined synchronously by the included partial, so + // it's available by the time this IIFE runs. + (function deepLinkEdit() { + const params = new URLSearchParams(location.search); + const editId = params.get('edit'); + if (!editId) return; + if (typeof window.openPlaylistEditor !== 'function') return; + // Strip the query param immediately so reload after save doesn't re-open. + history.replaceState({}, '', location.pathname); + window.openPlaylistEditor({ + mode: 'edit', + id: editId, + onSaved: () => location.reload(), + }); + })(); +})(); Index: src/assets/js/mod/admin-push.js =================================================================== --- src/assets/js/mod/admin-push.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-push.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,110 @@ +// Pushmeldingen in beheer (pages/admin-push.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + +(function () { + var cfg = JSON.parse(document.getElementById('np-data').textContent); + var elState = document.getElementById('np-state'); + var btnOn = document.getElementById('np-on'), btnOff = document.getElementById('np-off'), btnTest = document.getElementById('np-test'); + var alertsBox = document.getElementById('np-alerts'), savedMsg = document.getElementById('np-saved'); + var currentEndpoint = null; + + var isIos = /iPad|iPhone|iPod/.test(navigator.userAgent); + var standalone = window.matchMedia('(display-mode: standalone)').matches || window.navigator.standalone === true; + if (isIos && !standalone) document.getElementById('np-ios-hint').hidden = false; + + if (!('serviceWorker' in navigator) || !('PushManager' in window) || !('Notification' in window)) { + document.getElementById('np-unsupported').hidden = false; + elState.textContent = cfg.i18n.unsupported; + return; + } + + function b64ToU8(s) { + var pad = '='.repeat((4 - (s.length % 4)) % 4); + var raw = atob((s + pad).replace(/-/g, '+').replace(/_/g, '/')); + var out = new Uint8Array(raw.length); + for (var i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i); + return out; + } + function post(url, body) { + return fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body || {}) }); + } + function deviceLabel() { + var ua = navigator.userAgent; + var browser = /Firefox\//.test(ua) ? 'Firefox' : /Edg\//.test(ua) ? 'Edge' : /Chrome\//.test(ua) ? 'Chrome' : /Safari\//.test(ua) ? 'Safari' : 'Browser'; + var os = /Android/.test(ua) ? 'Android' : /iPad|iPhone|iPod/.test(ua) ? 'iOS' : /Mac/.test(ua) ? 'macOS' : /Win/.test(ua) ? 'Windows' : /Linux/.test(ua) ? 'Linux' : ''; + return (browser + (os ? ' op ' + os : '')); + } + function readAlertBoxes() { + var out = {}; + alertsBox.querySelectorAll('input[data-alert]').forEach(function (cb) { out[cb.getAttribute('data-alert')] = cb.checked ? 1 : 0; }); + return out; + } + function setAlertBoxes(alerts) { + alertsBox.querySelectorAll('input[data-alert]').forEach(function (cb) { + cb.checked = !!alerts[cb.getAttribute('data-alert')]; + }); + } + + function render(sub) { + currentEndpoint = sub ? sub.endpoint : null; + elState.textContent = sub ? cfg.i18n.on : (Notification.permission === 'denied' ? cfg.i18n.denied : cfg.i18n.off); + btnOn.hidden = !!sub || Notification.permission === 'denied'; + btnOff.hidden = !sub; + btnTest.hidden = !sub; + alertsBox.hidden = !sub; + } + + navigator.serviceWorker.ready.then(function (reg) { + return reg.pushManager.getSubscription(); + }).then(function (sub) { + // Show this device's SAVED prefs when we know them, defaults otherwise. + setAlertBoxes((sub && cfg.saved[sub.endpoint]) ? Object.assign({}, cfg.alerts, cfg.saved[sub.endpoint]) : cfg.alerts); + render(sub); + }).catch(function () { elState.textContent = cfg.i18n.unknown; }); + + btnOn.addEventListener('click', function () { + btnOn.disabled = true; + Notification.requestPermission().then(function (perm) { + if (perm !== 'granted') { btnOn.disabled = false; render(null); return; } + navigator.serviceWorker.ready.then(function (reg) { + return reg.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: b64ToU8(cfg.vapid) }); + }).then(function (sub) { + return post('/push/subscribe', { subscription: sub.toJSON(), alerts: readAlertBoxes(), uaLabel: deviceLabel() }) + .then(function (r) { if (!r.ok) throw new Error('subscribe failed'); render(sub); location.reload(); }); + }).catch(function () { btnOn.disabled = false; elState.textContent = cfg.i18n.failed; }); + }); + }); + + btnOff.addEventListener('click', function () { + navigator.serviceWorker.ready.then(function (reg) { return reg.pushManager.getSubscription(); }).then(function (sub) { + if (!sub) { render(null); return; } + var ep = sub.endpoint; + sub.unsubscribe().then(function () { return post('/push/unsubscribe', { endpoint: ep }); }) + .then(function () { location.reload(); }); + }); + }); + + btnTest.addEventListener('click', function () { + btnTest.disabled = true; + post('/push/test').then(function () { setTimeout(function () { btnTest.disabled = false; }, 2000); }); + }); + + alertsBox.addEventListener('change', function () { + if (!currentEndpoint) return; + post('/push/alerts', { endpoint: currentEndpoint, alerts: readAlertBoxes() }).then(function (r) { + if (r.ok) { savedMsg.hidden = false; setTimeout(function () { savedMsg.hidden = true; }, 1500); } + }); + }); + + document.querySelectorAll('.np-remove').forEach(function (btn) { + btn.addEventListener('click', function () { + post('/push/unsubscribe', { endpoint: btn.getAttribute('data-endpoint') }).then(function () { location.reload(); }); + }); + }); +})(); Index: src/assets/js/mod/admin-settings.js =================================================================== --- src/assets/js/mod/admin-settings.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-settings.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,20 @@ +// Instellingen in beheer (pages/admin-settings.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + + (function () { + var f = document.getElementById('mode-form'); + if (!f || f.__age18wired) return; f.__age18wired = true; + f.addEventListener('submit', function (e) { + var sel = f.querySelector('input[name=mode]:checked'); + if (sel && sel.value === 'cirkels' && f.getAttribute('data-was-cirkels') === '0') { + if (!window.confirm(f.getAttribute('data-confirm'))) e.preventDefault(); + } + }); + })(); + Index: src/assets/js/mod/admin-site-edit.js =================================================================== --- src/assets/js/mod/admin-site-edit.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) +++ src/assets/js/mod/admin-site-edit.js (revision 952baf39d4219c186a0428025fb689aec377f7f5) @@ -0,0 +1,130 @@ +// Site bewerken in beheer (pages/admin-site-edit.ejs) -- verplaatst uit inline script, shaer-bqr. +// +// Inline script in een pagina wordt door de CSP geweigerd zodra je die pagina via +// een link BINNEN de site opent: de nonce rouleert per verzoek (shaer-0i6). Dit +// bestand wordt door de bootstrap in shell.ejs geladen en heeft dat probleem niet. +// +// Alles hier hoort GEDELEGEERD te luisteren (op document, niet op een element dat +// er nu staat) en tegen een tweede aanroep te kunnen. + + (function(){ + if (window.__themePreviewWired) return; window.__themePreviewWired = true; + var html = document.documentElement; + function applyAccent(hex){ + if(!/^#[0-9a-fA-F]{6}$/.test(hex)) return; + var sa = document.getElementById('pcms-site-accent'); + if(!sa){ sa = document.createElement('style'); sa.id = 'pcms-site-accent'; document.head.appendChild(sa); } + sa.textContent = ':root,[data-palette]{--accent:'+hex+';--accent-soft:color-mix(in srgb,'+hex+' 80%,white);--accent-tint:color-mix(in srgb,'+hex+' 12%,transparent);}'; + } + document.addEventListener('change', function(e){ + var t = e.target; if(!t || !t.name) return; + if(t.name === 'palette'){ html.setAttribute('data-palette', t.value); } + else if(t.name === 'accent'){ applyAccent(t.value); } + else if(t.name === 'theme_override'){ + if(t.value === 'light' || t.value === 'dark'){ html.setAttribute('data-theme', t.value); } + else { var dk = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches; html.setAttribute('data-theme', dk ? 'dark' : 'light'); } + } + }); + })(); + + +// ── volgend blok ── + +(function() { + // Slug URL field: show the real host as a dimmed prefix (the slug itself is + // coloured via CSS). Hub → host/user/, otherwise host/. + var sh = document.getElementById('slug-host'); + if (sh) sh.textContent = location.host + (sh.dataset.prefix || '/'); +})(); +(function() { + // Profile-links repeater: add row from