Changeset 98ecf51 in Klonkt for src/routes/admin-sites.js

Timestamp:

06/18/2026 03:19:09 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

7881080

Parents:

6a2abb1

Message:

Hub #1+#2: site admin permissions work + assign owner to another user

#1 — canAdminSite was reading user.siteRoles which was NEVER populated (dead
code) → only god and the literal owner passed admin checks. Now canAdminSite
queries site_members directly (an assigned co-admin). requireSiteManager/BySlug
use canAdminSite so collaborators can access site management too.

#2 — owner_id was hard-coded to the creating god → you couldn't assign a site to
another user (the core of hub mode was missing). Now: god-only "Owner" select in
the site form; create/save set owner_id + a site_members-admin row for that owner
(upsert). Non-god doesn't see the field and cannot change the owner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

File:

• src/routes/admin-sites.js (modified) (7 diffs)

src/routes/admin-sites.js

@@ -137 +137 @@
 }
 
+/** Geldige user-id voor owner-toewijzing, of null bij leeg/onbekend. */
+function validOwnerId(raw) {
+  const id = (raw || '').toString().trim();
+  if (!id) return null;
+  return db.prepare('SELECT 1 FROM users WHERE id = ?').get(id) ? id : null;
+}
+
+/** Geef een user admin-rechten op een site (idempotent upsert). */
+function grantSiteAdmin(siteId, userId) {
+  db.prepare(`
+    INSERT INTO site_members (site_id, user_id, role) VALUES (?, ?, 'admin')
+    ON CONFLICT(site_id, user_id) DO UPDATE SET role = 'admin'
+  `).run(siteId, userId);
+}
+
+/** Kandidaat-owners voor het owner-keuzeveld (god-only). */
+function listOwnerCandidates() {
+  return db.prepare('SELECT id, username, role FROM users ORDER BY username').all();
+}
+
 // ==================== LIST ====================
 router.get('/', requireGod, (req, res) => {
@@ -163 +183 @@
     bodyClass: 'on-admin',
     isNew: true,
-    site: { slug: '', ...siteEditableFields() },
+    site: { slug: '', owner_id: req.session.user.id, ...siteEditableFields() },
+    users: listOwnerCandidates(),
     palettes: ThemeService.listPalettes(),
     accents: ThemeService.listAccents(),
@@ -187 +208 @@
 
   const f = { ...siteEditableFields(), ...req.body };
+
+  // Owner: god mag de site aan een ANDERE gebruiker toewijzen — dit is de kern
+  // van hub-modus (elke gebruiker z'n eigen, zelf te beheren Klonkt). Leeg of
+  // ongeldig → de aanmakende god zelf.
+  const ownerId = validOwnerId(req.body.owner_id) || req.session.user.id;
+
   const siteId = uuid();
   db.prepare(`
@@ -200 +227 @@
     (f.description || '').slice(0, 500),
     (f.tagline || '').slice(0, 200),
-    req.session.user.id,
+    ownerId,
     f.language || 'nl',
     f.palette || 'sage',
@@ -213 +240 @@
   );
 
-  // The site_members entry lets the god/owner show up in canAdminSite checks.
-  db.prepare(`
-    INSERT INTO site_members (site_id, user_id, role) VALUES (?, ?, 'admin')
-  `).run(siteId, req.session.user.id);
-
-  res.redirect(`/admin/sites/${slug}/edit?success=` + encodeURIComponent('Site created'));
+  // De OWNER (niet per se de aanmaker) krijgt een site_members-admin-rij → zo komt
+  // 'ie door canAdminSite + de requireSiteManager-gates en beheert 'ie z'n site.
+  grantSiteAdmin(siteId, ownerId);
+
+  res.redirect(`/admin/sites/${slug}/edit?success=` + encodeURIComponent('Site aangemaakt'));
 });
 
@@ -236 +262 @@
     isNew: false,
     site,
+    users: listOwnerCandidates(),
     palettes: ThemeService.listPalettes(),
     accents: ThemeService.listAccents(),
@@ -314 +341 @@
   );
 
-  res.redirect(`/admin/sites/${req.params.slug}/edit?success=` + encodeURIComponent('Saved'));
+  // Owner (her)toewijzen — ALLEEN god. Een site-owner die z'n eigen site bewerkt
+  // kan de eigenaar niet wijzigen (het veld wordt voor niet-god ook niet getoond).
+  if (req.session.user.role === 'god') {
+    const newOwner = validOwnerId(req.body.owner_id);
+    if (newOwner) {
+      db.prepare('UPDATE sites SET owner_id = ? WHERE id = ?').run(newOwner, site.id);
+      grantSiteAdmin(site.id, newOwner);
+    }
+  }
+
+  res.redirect(`/admin/sites/${req.params.slug}/edit?success=` + encodeURIComponent('Opgeslagen'));
 });