Changeset c06816e in Klonkt for src/routes/posts.js

Timestamp:

07/01/2026 09:49:52 PM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

5a27ba4

Parents:

8cf8b5f

Message:

feat(audio): sharing openly on the fediverse is one-way + lock the editor choice

Once a track has federated openly the file is out there — re-gating would be false
security. Opening is now permanent: the flag can be set but never cleared, the editor
locks the checkbox once open, and warns before you tick it. Default stays closed
(safe default; self-hosters choose per track).

• src/routes/posts.js — setAudioFediOpen never writes fedi_open back to 0 (one-way).
• src/views/pages/post-edit.ejs — locked (checked+disabled) checkbox with an explainer once open; a red permanence warning appears when ticking it on a gated post. Also fixes the poll fields showing while "Add a poll" was unchecked: the conditional style attribute was emitted through an escaping tag, turning it into entity soup — the condition now lives inside the quoted attribute.
• src/services/i18n.js — pedit.fedi_audio_oneway + pedit.fedi_audio_locked (nl/en/de).
• CHANGELOG(.nl/.de).md — "Sharing audio openly is now one-way" under Changed.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/posts.js (modified) (1 diff)

src/routes/posts.js

@@ -212 +212 @@
 // attachment). NB: the file gate is per file, so opening a track in one post makes its file
 // fetchable for every post that reuses it.
+// ONE-WAY: opening is permanent. Once the file has federated it's out there — re-gating
+// would be false security (remote copies keep the URL), so we never write fedi_open back to 0.
 function setAudioFediOpen(siteId, content, open) {
-  const val = open ? 1 : 0;
+  if (!open) return; // never close — see one-way note above
   const c = content || '';
   try {
-    for (const m of c.matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = ? WHERE id = ? AND site_id = ?').run(val, m[1], siteId);
-    for (const m of c.matchAll(/\[\[album:([^\]]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = ? WHERE site_id = ? AND album = ?').run(val, siteId, m[1].trim());
-    for (const m of c.matchAll(/\[\[playlist:([A-Za-z0-9_-]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = ? WHERE id IN (SELECT track_id FROM playlist_tracks WHERE playlist_id = ?)').run(val, m[1]);
+    for (const m of c.matchAll(/\[\[track:([A-Za-z0-9_-]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = 1 WHERE id = ? AND site_id = ?').run(m[1], siteId);
+    for (const m of c.matchAll(/\[\[album:([^\]]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = 1 WHERE site_id = ? AND album = ?').run(siteId, m[1].trim());
+    for (const m of c.matchAll(/\[\[playlist:([A-Za-z0-9_-]+)\]\]/g)) db.prepare('UPDATE audio_tracks SET fedi_open = 1 WHERE id IN (SELECT track_id FROM playlist_tracks WHERE playlist_id = ?)').run(m[1]);
   } catch { /* non-fatal */ }
 }