Changeset a64f642 in Klonkt

Timestamp:

06/14/2026 04:28:57 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

ab544fd

Parents:

640b39c

Message:

admin: read-only ("View mode") configurable per user in Admin -> Users

Toggle in the user list (POST /admin/users/:id/readonly, god-only, not on
yourself). Sets users.readonly on/off so an account can view everything but
cannot modify anything.

Co-Authored-By: Claude <noreply@…>

Location:

src

Files:

• routes/admin-users.js (modified) (2 diffs)
• views/pages/admin-users.ejs (modified) (2 diffs)

src/routes/admin-users.js

@@ -29 +29 @@
 router.get('/', requireGod, (req, res) => {
   const users = db.prepare(`
-    SELECT u.id, u.username, u.email, u.role, u.created_at, u.avatar_url,
+    SELECT u.id, u.username, u.email, u.role, u.created_at, u.avatar_url, u.readonly,
            (SELECT COUNT(*) FROM posts p WHERE p.author_id = u.id) AS post_count,
            (SELECT COUNT(*) FROM sites s  WHERE s.owner_id  = u.id) AS site_count
@@ -71 +71 @@
 });
 
+// ==================== READ-ONLY (kijk-account) ====================
+router.post('/:id/readonly', requireGod, (req, res) => {
+  const target = db.prepare('SELECT id FROM users WHERE id = ?').get(req.params.id);
+  if (!target) return res.redirect('/admin/users?error=User+not+found');
+  // Niet op jezelf — voorkomt dat een god zichzelf alleen-lezen maakt en vastloopt.
+  if (target.id === req.session.user.id) {
+    return res.redirect('/admin/users?error=' + encodeURIComponent('Kan jezelf niet op alleen-lezen zetten'));
+  }
+  const ro = req.body.readonly === '1' ? 1 : 0;
+  db.prepare('UPDATE users SET readonly = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
+    .run(ro, req.params.id);
+  res.redirect('/admin/users?success=' + encodeURIComponent(ro ? 'Kijk-modus aan' : 'Kijk-modus uit'));
+});
+
 // ==================== DELETE ====================
 router.post('/:id/delete', requireGod, (req, res) => {

src/views/pages/admin-users.ejs

@@ -66 +66 @@
             </form>
 
+            <form method="post" action="/admin/users/<%= u.id %>/readonly" class="ax-role-form">
+              <label class="ax-role ax-ro" title="Alleen-lezen: kan alles bekijken, niets wijzigen">
+                <span>Kijk-modus</span>
+                <input type="checkbox" name="readonly" value="1" <%= u.readonly ? 'checked' : '' %>
+                       onchange="this.form.submit()" <% if (u.id === user.id) { %>disabled<% } %>>
+              </label>
+            </form>
+
             <% if (u.id !== user.id && (u.post_count + u.site_count === 0)) { %>
               <form method="post" action="/admin/users/<%= u.id %>/delete" class="ax-delete-form"
@@ -222 +230 @@
 }
 .ax-role select:disabled { cursor: not-allowed; opacity: 0.5; }
+.ax-ro { align-items: center; }
+.ax-ro input { width: 18px; height: 18px; cursor: pointer; margin-top: 0.15rem; accent-color: var(--accent); }
+.ax-ro input:disabled { cursor: not-allowed; opacity: 0.5; }
 .ax-delete-form { margin: 0; }
 .ax-icon-btn {