Changeset a64f642 in Klonkt for src/routes/admin-users.js

Timestamp:

06/14/2026 04:28:57 PM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

ab544fd

Parents:

640b39c

Message:

admin: read-only ("View mode") configurable per user in Admin -> Users

Toggle in the user list (POST /admin/users/:id/readonly, god-only, not on
yourself). Sets users.readonly on/off so an account can view everything but
cannot modify anything.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/admin-users.js (modified) (2 diffs)

src/routes/admin-users.js

@@ -29 +29 @@
 router.get('/', requireGod, (req, res) => {
   const users = db.prepare(`
-    SELECT u.id, u.username, u.email, u.role, u.created_at, u.avatar_url,
+    SELECT u.id, u.username, u.email, u.role, u.created_at, u.avatar_url, u.readonly,
            (SELECT COUNT(*) FROM posts p WHERE p.author_id = u.id) AS post_count,
            (SELECT COUNT(*) FROM sites s  WHERE s.owner_id  = u.id) AS site_count
@@ -71 +71 @@
 });
 
+// ==================== READ-ONLY (kijk-account) ====================
+router.post('/:id/readonly', requireGod, (req, res) => {
+  const target = db.prepare('SELECT id FROM users WHERE id = ?').get(req.params.id);
+  if (!target) return res.redirect('/admin/users?error=User+not+found');
+  // Niet op jezelf — voorkomt dat een god zichzelf alleen-lezen maakt en vastloopt.
+  if (target.id === req.session.user.id) {
+    return res.redirect('/admin/users?error=' + encodeURIComponent('Kan jezelf niet op alleen-lezen zetten'));
+  }
+  const ro = req.body.readonly === '1' ? 1 : 0;
+  db.prepare('UPDATE users SET readonly = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
+    .run(ro, req.params.id);
+  res.redirect('/admin/users?success=' + encodeURIComponent(ro ? 'Kijk-modus aan' : 'Kijk-modus uit'));
+});
+
 // ==================== DELETE ====================
 router.post('/:id/delete', requireGod, (req, res) => {