Revert "Add private categories, unlockable via a password-gated cookie login"
This reverts commit 7546c0388e.
This commit is contained in:
Claude
@@ -9,10 +9,3 @@ MEDIA_DIR=./data/media
|
||||
# header). It changes on every restart, so check the console output each time.
|
||||
|
||||
NODE_ENV=development
|
||||
|
||||
# Optional — unlocks "private" categories (marked in the admin panel's Category
|
||||
# priority list) for visitors who log in with this password on the public site's
|
||||
# lock icon. Leave unset to disable private categories entirely (they stay hidden
|
||||
# from everyone, with no way to unlock them). Unlike the admin API key above, this
|
||||
# is a fixed password you choose, and the resulting login persists across restarts.
|
||||
# PRIVATE_ACCESS_PASSWORD=
|
||||
|
||||
Generated
+6
-40
@@ -9,7 +9,6 @@
|
||||
"version": "1.0.0",
|
||||
"license": "UNLICENSED",
|
||||
"dependencies": {
|
||||
"@fastify/cookie": "^11.1.2",
|
||||
"@fastify/cors": "^11.3.0",
|
||||
"@mozilla/readability": "^0.6.0",
|
||||
"fastify": "^5.10.0",
|
||||
@@ -696,26 +695,6 @@
|
||||
"fast-uri": "^3.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@fastify/cookie": {
|
||||
"version": "11.1.2",
|
||||
"resolved": "https://registry.npmjs.org/@fastify/cookie/-/cookie-11.1.2.tgz",
|
||||
"integrity": "sha512-Dtrpk/YOGUsbRMvP/8ZqPpwnMRv0qSqodFdoQ2B589Obc7jw4s4Qla+cV72Bsm7WsZJnqlYFX/i7uSBq0xzg6g==",
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/fastify"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/fastify"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"cookie": "^2.0.0",
|
||||
"fastify-plugin": "^6.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@fastify/cors": {
|
||||
"version": "11.3.0",
|
||||
"resolved": "https://registry.npmjs.org/@fastify/cors/-/cors-11.3.0.tgz",
|
||||
@@ -1295,19 +1274,6 @@
|
||||
"require-from-string": "^2.0.2"
|
||||
}
|
||||
},
|
||||
"node_modules/cookie": {
|
||||
"version": "2.0.1",
|
||||
"resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz",
|
||||
"integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=22"
|
||||
},
|
||||
"funding": {
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/css-tree": {
|
||||
"version": "3.2.1",
|
||||
"resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
|
||||
@@ -1437,9 +1403,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/fast-json-stringify/node_modules/fast-uri": {
|
||||
"version": "4.1.1",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.1.tgz",
|
||||
"integrity": "sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==",
|
||||
"version": "4.1.0",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.0.tgz",
|
||||
"integrity": "sha512-ZodJ2cRiLVWGi9IgPb3mbgSqM4CD3LexCHkuv0FfBXHJI1ADfucTD06m6clO2Cy5RZYsw/SiCVl/dyrFI/SYWA==",
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
@@ -1462,9 +1428,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/fast-uri": {
|
||||
"version": "3.1.4",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
|
||||
"integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
|
||||
"version": "3.1.3",
|
||||
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
|
||||
"integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
|
||||
@@ -12,7 +12,6 @@
|
||||
},
|
||||
"license": "UNLICENSED",
|
||||
"dependencies": {
|
||||
"@fastify/cookie": "^11.1.2",
|
||||
"@fastify/cors": "^11.3.0",
|
||||
"@mozilla/readability": "^0.6.0",
|
||||
"fastify": "^5.10.0",
|
||||
|
||||
@@ -25,11 +25,11 @@ export async function registerAdminRoutes(app: FastifyInstance) {
|
||||
return { ...settings, categoryPriority: categoriesDb.listCategories() };
|
||||
});
|
||||
|
||||
// --- Categories (add/remove — reordering/privacy is via PATCH /settings above) ---
|
||||
// --- Categories (add/remove — reordering is via PATCH /settings above) ---
|
||||
app.post('/api/admin/categories', async (req, reply) => {
|
||||
const { name, isPrivate } = req.body as { name?: string; isPrivate?: boolean };
|
||||
const { name } = req.body as { name?: string };
|
||||
if (!name || !name.trim()) return reply.code(400).send({ error: 'name required' });
|
||||
const created = categoriesDb.createCategory(name.trim(), !!isPrivate);
|
||||
const created = categoriesDb.createCategory(name.trim());
|
||||
return reply.code(201).send(created);
|
||||
});
|
||||
|
||||
|
||||
@@ -1,75 +0,0 @@
|
||||
// Gates "private" categories (see storage/db/categories.ts's is_private column) behind a
|
||||
// single shared password configured in the backend's own .env — deliberately separate
|
||||
// from the admin API key (that's a header-based credential for the admin SPA only; this
|
||||
// is a cookie so a plain visitor's browser can carry it across ordinary page loads).
|
||||
//
|
||||
// There's no per-visitor session store: the cookie's value is a deterministic hash of the
|
||||
// configured password, so any request can be checked statelessly by recomputing that same
|
||||
// hash and comparing — same "no session table" philosophy as the admin API key.
|
||||
|
||||
import type { FastifyInstance } from 'fastify';
|
||||
import crypto from 'node:crypto';
|
||||
import { logger } from '../storage/db/logs.js';
|
||||
|
||||
const PRIVATE_ACCESS_PASSWORD = process.env.PRIVATE_ACCESS_PASSWORD || '';
|
||||
export const PRIVATE_ACCESS_COOKIE = 'hf_private';
|
||||
// Browsers cap persistent cookies at ~400 days regardless of what's requested (Chrome,
|
||||
// Firefox, Safari all enforce this) — asking for 10 years just means "the maximum they'll
|
||||
// actually allow," which is as close to "retained indefinitely" as a cookie can get.
|
||||
const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365 * 10;
|
||||
|
||||
function expectedToken(): string {
|
||||
return crypto.createHash('sha256').update(PRIVATE_ACCESS_PASSWORD).digest('hex');
|
||||
}
|
||||
|
||||
/** Feature is off entirely (no visitor can ever unlock private categories) until a password is configured. */
|
||||
export function privateAccessConfigured(): boolean {
|
||||
return PRIVATE_ACCESS_PASSWORD.length > 0;
|
||||
}
|
||||
|
||||
export function hasPrivateAccess(req: { cookies?: Record<string, string | undefined> }): boolean {
|
||||
if (!privateAccessConfigured()) return false;
|
||||
const token = req.cookies?.[PRIVATE_ACCESS_COOKIE];
|
||||
if (!token) return false;
|
||||
const expected = expectedToken();
|
||||
// Buffers must be equal length for timingSafeEqual — a mismatched length (e.g. a
|
||||
// tampered/truncated cookie) would throw rather than just failing the comparison.
|
||||
if (token.length !== expected.length) return false;
|
||||
try {
|
||||
return crypto.timingSafeEqual(Buffer.from(token), Buffer.from(expected));
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
export async function registerPrivateAccess(app: FastifyInstance) {
|
||||
app.post('/api/private-access/login', async (req, reply) => {
|
||||
if (!privateAccessConfigured()) {
|
||||
return reply.code(503).send({ error: 'Private categories are not configured on this server' });
|
||||
}
|
||||
const { password } = req.body as { password?: string };
|
||||
const attempt = Buffer.from(password ?? '');
|
||||
const expected = Buffer.from(PRIVATE_ACCESS_PASSWORD);
|
||||
const valid = attempt.length === expected.length && crypto.timingSafeEqual(attempt, expected);
|
||||
if (!valid) {
|
||||
logger.warn('private-access', 'Rejected private-category login attempt with wrong password');
|
||||
return reply.code(401).send({ error: 'Incorrect password' });
|
||||
}
|
||||
reply.setCookie(PRIVATE_ACCESS_COOKIE, expectedToken(), {
|
||||
httpOnly: true,
|
||||
sameSite: 'lax',
|
||||
path: '/',
|
||||
maxAge: COOKIE_MAX_AGE_SECONDS
|
||||
});
|
||||
return { ok: true };
|
||||
});
|
||||
|
||||
app.post('/api/private-access/logout', async (_req, reply) => {
|
||||
reply.clearCookie(PRIVATE_ACCESS_COOKIE, { path: '/' });
|
||||
return { ok: true };
|
||||
});
|
||||
|
||||
app.get('/api/private-access/status', async (req) => {
|
||||
return { authenticated: hasPrivateAccess(req as any), configured: privateAccessConfigured() };
|
||||
});
|
||||
}
|
||||
+11
-28
@@ -3,37 +3,24 @@ import * as articlesDb from '../storage/db/articles.js';
|
||||
import * as tagsDb from '../storage/db/tags.js';
|
||||
import * as eventsDb from '../storage/db/events.js';
|
||||
import * as categoriesDb from '../storage/db/categories.js';
|
||||
import { hasPrivateAccess } from './privateAccess.js';
|
||||
|
||||
export async function registerPublicRoutes(app: FastifyInstance) {
|
||||
app.get('/api/feed', async (req) => {
|
||||
const { category, geo, eventId, tag, before, limit } = req.query as Record<string, string | undefined>;
|
||||
return articlesDb.queryFeed(
|
||||
{
|
||||
category,
|
||||
geo,
|
||||
eventId,
|
||||
tag,
|
||||
before,
|
||||
limit: limit ? Number(limit) : undefined
|
||||
},
|
||||
hasPrivateAccess(req)
|
||||
);
|
||||
return articlesDb.queryFeed({
|
||||
category,
|
||||
geo,
|
||||
eventId,
|
||||
tag,
|
||||
before,
|
||||
limit: limit ? Number(limit) : undefined
|
||||
});
|
||||
});
|
||||
|
||||
app.get('/api/article/:id', async (req, reply) => {
|
||||
const { id } = req.params as { id: string };
|
||||
const article = articlesDb.getArticle(id);
|
||||
if (!article) return reply.code(404).send({ error: 'not found' });
|
||||
// 404 rather than 403 for a private article behind a paywall of sorts — an
|
||||
// unauthenticated visitor shouldn't be able to tell the difference between
|
||||
// "doesn't exist" and "exists but is private."
|
||||
if (!hasPrivateAccess(req)) {
|
||||
const privateNames = new Set(categoriesDb.listPrivateCategoryNames());
|
||||
if (article.category.some((c) => privateNames.has(c))) {
|
||||
return reply.code(404).send({ error: 'not found' });
|
||||
}
|
||||
}
|
||||
return article;
|
||||
});
|
||||
|
||||
@@ -47,12 +34,8 @@ export async function registerPublicRoutes(app: FastifyInstance) {
|
||||
});
|
||||
|
||||
// Drives the site nav — admin-editable (add/remove/reorder) via /api/admin/categories,
|
||||
// per the "user may have no interest in Business or Culture" requirement. Private
|
||||
// categories are omitted entirely for anyone without a valid private-access cookie,
|
||||
// so they don't even show up as a nav tab to unlock.
|
||||
app.get('/api/categories', async (req) => {
|
||||
const categories = categoriesDb.listCategories();
|
||||
if (hasPrivateAccess(req)) return categories;
|
||||
return categories.filter((c) => !c.isPrivate);
|
||||
// per the "user may have no interest in Business or Culture" requirement.
|
||||
app.get('/api/categories', async () => {
|
||||
return categoriesDb.listCategories();
|
||||
});
|
||||
}
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
import Fastify from 'fastify';
|
||||
import cors from '@fastify/cors';
|
||||
import cookie from '@fastify/cookie';
|
||||
import fs from 'node:fs';
|
||||
import path from 'node:path';
|
||||
import { migrate } from './storage/db/index.js';
|
||||
@@ -9,7 +8,6 @@ import { registerAuth } from './api/auth.js';
|
||||
import { registerPublicRoutes } from './api/public.js';
|
||||
import { registerAdminRoutes } from './api/admin.js';
|
||||
import { registerMediaProxy } from './api/mediaProxy.js';
|
||||
import { registerPrivateAccess, privateAccessConfigured } from './api/privateAccess.js';
|
||||
import { startScheduler } from './queue/scheduler.js';
|
||||
import { logger } from './storage/db/logs.js';
|
||||
|
||||
@@ -41,17 +39,11 @@ async function main() {
|
||||
// every PATCH (settings saves) and DELETE (removing sources/events) gets silently
|
||||
// blocked by the browser at the CORS preflight stage, before the request ever
|
||||
// reaches a route handler.
|
||||
// credentials: true is required for the browser to send/accept the private-category
|
||||
// login cookie cross-origin — safe only because origin is a specific value above,
|
||||
// never a wildcard (the two are mutually exclusive per the CORS spec anyway).
|
||||
await app.register(cors, {
|
||||
origin: FRONTEND_ORIGIN,
|
||||
credentials: true,
|
||||
methods: ['GET', 'POST', 'PATCH', 'DELETE', 'PUT', 'OPTIONS']
|
||||
});
|
||||
|
||||
await app.register(cookie);
|
||||
|
||||
// Overrides Fastify's default JSON body parser, which throws "Body cannot be empty
|
||||
// when content-type is set to 'application/json'" for any bodyless request (DELETE,
|
||||
// or POST with no payload) that still carries a Content-Type header — exactly what
|
||||
@@ -69,7 +61,6 @@ async function main() {
|
||||
await registerAuth(app);
|
||||
await registerPublicRoutes(app);
|
||||
await registerAdminRoutes(app);
|
||||
await registerPrivateAccess(app);
|
||||
|
||||
// Fastify's own logger is off (see below) — without this, an unhandled exception
|
||||
// in any route handler produces a bare 500 with zero trace anywhere, including the
|
||||
@@ -98,9 +89,6 @@ async function main() {
|
||||
|
||||
await app.listen({ port: PORT, host: '0.0.0.0' });
|
||||
logger.info('server', `Listening on :${PORT} (frontend origin: ${FRONTEND_ORIGIN})`);
|
||||
if (!privateAccessConfigured()) {
|
||||
logger.info('server', 'Private categories disabled — set PRIVATE_ACCESS_PASSWORD to enable');
|
||||
}
|
||||
|
||||
startScheduler();
|
||||
}
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
import { randomUUID } from 'node:crypto';
|
||||
import { db } from './index.js';
|
||||
import type { MergedArticle } from './types.js';
|
||||
import { listPrivateCategoryNames } from './categories.js';
|
||||
|
||||
function rowToArticle(row: any): MergedArticle {
|
||||
return {
|
||||
@@ -71,30 +70,17 @@ export function allArticlesNewestFirst(): MergedArticle[] {
|
||||
return rows.map(rowToArticle);
|
||||
}
|
||||
|
||||
export function queryFeed(
|
||||
filters: {
|
||||
category?: string;
|
||||
geo?: string;
|
||||
eventId?: string;
|
||||
tag?: string;
|
||||
before?: string;
|
||||
limit?: number;
|
||||
},
|
||||
includePrivate = false
|
||||
): MergedArticle[] {
|
||||
export function queryFeed(filters: {
|
||||
category?: string;
|
||||
geo?: string;
|
||||
eventId?: string;
|
||||
tag?: string;
|
||||
before?: string;
|
||||
limit?: number;
|
||||
}): MergedArticle[] {
|
||||
let sql = 'SELECT * FROM merged_articles WHERE 1=1';
|
||||
const params: unknown[] = [];
|
||||
|
||||
// Without a valid private-access cookie, an article belonging to ANY private
|
||||
// category is excluded entirely — including from a public category it's also
|
||||
// tagged with, so a private source can't leak in sideways through a shared tag.
|
||||
if (!includePrivate) {
|
||||
for (const name of listPrivateCategoryNames()) {
|
||||
sql += ' AND category NOT LIKE ?';
|
||||
params.push(`%"${name}"%`);
|
||||
}
|
||||
}
|
||||
|
||||
// The bare feed (no category/geo/eventId/tag — i.e. the homepage/"Top stories") only
|
||||
// shows articles whose contributing source(s) opted into "Push to Top Stories?" —
|
||||
// otherwise every ingested article from every source would flood the homepage.
|
||||
|
||||
@@ -3,13 +3,7 @@ import { db } from './index.js';
|
||||
import type { Category } from './types.js';
|
||||
|
||||
function rowToCategory(row: any): Category {
|
||||
return {
|
||||
id: row.id,
|
||||
name: row.name,
|
||||
priorityRank: row.priority_rank,
|
||||
isDefault: !!row.is_default,
|
||||
isPrivate: !!row.is_private
|
||||
};
|
||||
return { id: row.id, name: row.name, priorityRank: row.priority_rank, isDefault: !!row.is_default };
|
||||
}
|
||||
|
||||
export function listCategories(): Category[] {
|
||||
@@ -17,27 +11,16 @@ export function listCategories(): Category[] {
|
||||
return rows.map(rowToCategory);
|
||||
}
|
||||
|
||||
/** Names of every category marked private — used to filter articles/feed for unauthenticated visitors. */
|
||||
export function listPrivateCategoryNames(): string[] {
|
||||
const rows = db.prepare('SELECT name FROM categories WHERE is_private = 1').all() as { name: string }[];
|
||||
return rows.map((r) => r.name);
|
||||
export function setCategoryOrder(order: { id: string; priorityRank: number }[]) {
|
||||
const stmt = db.prepare('UPDATE categories SET priority_rank = ? WHERE id = ?');
|
||||
for (const c of order) stmt.run(c.priorityRank, c.id);
|
||||
}
|
||||
|
||||
export function setCategoryOrder(order: { id: string; priorityRank: number; isPrivate: boolean }[]) {
|
||||
const stmt = db.prepare('UPDATE categories SET priority_rank = ?, is_private = ? WHERE id = ?');
|
||||
for (const c of order) stmt.run(c.priorityRank, c.isPrivate ? 1 : 0, c.id);
|
||||
}
|
||||
|
||||
export function createCategory(name: string, isPrivate = false): Category {
|
||||
export function createCategory(name: string): Category {
|
||||
const id = `cat-${name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '')}-${randomUUID().slice(0, 6)}`;
|
||||
const maxRank = db.prepare('SELECT COALESCE(MAX(priority_rank), 0) as m FROM categories').get() as { m: number };
|
||||
db.prepare('INSERT INTO categories (id, name, priority_rank, is_default, is_private) VALUES (?, ?, ?, 0, ?)').run(
|
||||
id,
|
||||
name,
|
||||
maxRank.m + 1,
|
||||
isPrivate ? 1 : 0
|
||||
);
|
||||
return { id, name, priorityRank: maxRank.m + 1, isDefault: false, isPrivate };
|
||||
db.prepare('INSERT INTO categories (id, name, priority_rank, is_default) VALUES (?, ?, ?, 0)').run(id, name, maxRank.m + 1);
|
||||
return { id, name, priorityRank: maxRank.m + 1, isDefault: false };
|
||||
}
|
||||
|
||||
export function deleteCategory(id: string) {
|
||||
|
||||
@@ -139,8 +139,7 @@ export function migrate() {
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
priority_rank INTEGER NOT NULL,
|
||||
is_default INTEGER NOT NULL DEFAULT 0,
|
||||
is_private INTEGER NOT NULL DEFAULT 0
|
||||
is_default INTEGER NOT NULL DEFAULT 0
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS logs (
|
||||
@@ -204,9 +203,6 @@ export function migrate() {
|
||||
if (!hasColumn('global_settings', 'fxtwitter_base_url')) {
|
||||
db.exec("ALTER TABLE global_settings ADD COLUMN fxtwitter_base_url TEXT NOT NULL DEFAULT 'https://api.fxtwitter.com'");
|
||||
}
|
||||
if (!hasColumn('categories', 'is_private')) {
|
||||
db.exec('ALTER TABLE categories ADD COLUMN is_private INTEGER NOT NULL DEFAULT 0');
|
||||
}
|
||||
|
||||
// Seed default categories if none exist yet. "News" sits right under "Top stories" —
|
||||
// general news sources belong here, not on "Top stories" itself, which isn't a real
|
||||
|
||||
@@ -116,8 +116,6 @@ export interface Category {
|
||||
name: string;
|
||||
priorityRank: number;
|
||||
isDefault: boolean;
|
||||
/** Hidden from /api/categories, /api/feed, and article detail for anyone without a valid private-access cookie. */
|
||||
isPrivate: boolean;
|
||||
}
|
||||
|
||||
export interface GlobalSettings {
|
||||
|
||||
@@ -59,10 +59,10 @@ export const updateSettings = (patch: Partial<AdminSettings>, fetchFn?: typeof f
|
||||
request<AdminSettings>('/api/admin/settings', { method: 'PATCH', body: JSON.stringify(patch) }, fetchFn);
|
||||
|
||||
// Categories
|
||||
export const createCategory = (name: string, isPrivate = false, fetchFn?: typeof fetch) =>
|
||||
request<{ id: string; name: string; priorityRank: number; isDefault: boolean; isPrivate: boolean }>(
|
||||
export const createCategory = (name: string, fetchFn?: typeof fetch) =>
|
||||
request<{ id: string; name: string; priorityRank: number; isDefault: boolean }>(
|
||||
'/api/admin/categories',
|
||||
{ method: 'POST', body: JSON.stringify({ name, isPrivate }) },
|
||||
{ method: 'POST', body: JSON.stringify({ name }) },
|
||||
fetchFn
|
||||
);
|
||||
|
||||
|
||||
@@ -12,7 +12,6 @@ export interface CategoryPriority {
|
||||
name: string;
|
||||
priorityRank: number;
|
||||
isDefault: boolean;
|
||||
isPrivate: boolean;
|
||||
}
|
||||
|
||||
export interface AdminSettings {
|
||||
|
||||
@@ -2,10 +2,7 @@ import { getBackendUrl } from './config';
|
||||
import type { MergedArticle, Tag, TrackedEventPublic, Category } from './types';
|
||||
|
||||
async function get<T>(path: string, fetchFn: typeof fetch = fetch): Promise<T> {
|
||||
// credentials: 'include' so the private-access cookie (see lib/privateAccess.ts)
|
||||
// is sent cross-origin to the backend, revealing private categories/articles to
|
||||
// anyone who's logged in — without it every request would look unauthenticated.
|
||||
const res = await fetchFn(`${getBackendUrl()}${path}`, { credentials: 'include' });
|
||||
const res = await fetchFn(`${getBackendUrl()}${path}`);
|
||||
if (!res.ok) throw new Error(`Request failed: ${path} (${res.status})`);
|
||||
return res.json();
|
||||
}
|
||||
|
||||
@@ -1,103 +0,0 @@
|
||||
<script lang="ts">
|
||||
import { loginPrivateAccess } from '$lib/privateAccess';
|
||||
|
||||
let { onClose, onSuccess }: { onClose: () => void; onSuccess: () => void } = $props();
|
||||
|
||||
let password = $state('');
|
||||
let error = $state<string | null>(null);
|
||||
let loading = $state(false);
|
||||
|
||||
async function submit() {
|
||||
if (!password || loading) return;
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
await loginPrivateAccess(password);
|
||||
onSuccess();
|
||||
} catch (err) {
|
||||
error = (err as Error).message;
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<div class="overlay" onclick={onClose} onkeydown={(e) => e.key === 'Escape' && onClose()} role="presentation">
|
||||
<div
|
||||
class="modal"
|
||||
onclick={(e) => e.stopPropagation()}
|
||||
onkeydown={(e) => e.stopPropagation()}
|
||||
role="dialog"
|
||||
aria-modal="true"
|
||||
aria-label="Private access login"
|
||||
tabindex="-1"
|
||||
>
|
||||
<h2>Private access</h2>
|
||||
<p class="hint">Enter the password to unlock private categories.</p>
|
||||
<form
|
||||
onsubmit={(e) => {
|
||||
e.preventDefault();
|
||||
submit();
|
||||
}}
|
||||
>
|
||||
<!-- svelte-ignore a11y_autofocus -->
|
||||
<input type="password" placeholder="Password" bind:value={password} autofocus />
|
||||
{#if error}
|
||||
<p class="error">{error}</p>
|
||||
{/if}
|
||||
<div class="actions">
|
||||
<button type="button" class="secondary" onclick={onClose}>Cancel</button>
|
||||
<button type="submit" disabled={loading || !password}>{loading ? 'Checking…' : 'Unlock'}</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<style>
|
||||
.overlay {
|
||||
position: fixed;
|
||||
inset: 0;
|
||||
background: rgba(0, 0, 0, 0.4);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
z-index: 100;
|
||||
}
|
||||
.modal {
|
||||
background: var(--surface-1);
|
||||
border-radius: 12px;
|
||||
padding: 20px;
|
||||
width: 100%;
|
||||
max-width: 320px;
|
||||
box-shadow: 0 8px 32px rgba(0, 0, 0, 0.25);
|
||||
}
|
||||
h2 {
|
||||
font-size: 16px;
|
||||
font-weight: 600;
|
||||
margin: 0 0 6px;
|
||||
}
|
||||
.hint {
|
||||
font-size: 12px;
|
||||
color: var(--text-secondary);
|
||||
margin: 0 0 14px;
|
||||
}
|
||||
input {
|
||||
width: 100%;
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.error {
|
||||
font-size: 12px;
|
||||
color: var(--text-danger);
|
||||
margin: 0 0 10px;
|
||||
}
|
||||
.actions {
|
||||
display: flex;
|
||||
justify-content: flex-end;
|
||||
gap: 8px;
|
||||
}
|
||||
.secondary {
|
||||
background: transparent;
|
||||
border: 0.5px solid var(--border);
|
||||
color: var(--text-secondary);
|
||||
}
|
||||
</style>
|
||||
@@ -9,7 +9,6 @@
|
||||
let status = $state<'idle' | 'saving' | 'saved' | 'error'>('idle');
|
||||
let saveTimer: ReturnType<typeof setTimeout>;
|
||||
let newCategoryName = $state('');
|
||||
let newCategoryPrivate = $state(false);
|
||||
let addingCategory = $state(false);
|
||||
|
||||
function scheduleSave() {
|
||||
@@ -40,20 +39,14 @@
|
||||
if (!name) return;
|
||||
addingCategory = true;
|
||||
try {
|
||||
const created = await createCategory(name, newCategoryPrivate);
|
||||
const created = await createCategory(name);
|
||||
local.categoryPriority = [...local.categoryPriority, created];
|
||||
newCategoryName = '';
|
||||
newCategoryPrivate = false;
|
||||
} finally {
|
||||
addingCategory = false;
|
||||
}
|
||||
}
|
||||
|
||||
function togglePrivate(id: string) {
|
||||
local.categoryPriority = local.categoryPriority.map((c) => (c.id === id ? { ...c, isPrivate: !c.isPrivate } : c));
|
||||
scheduleSave();
|
||||
}
|
||||
|
||||
async function removeCategory(id: string, isDefault: boolean, name: string) {
|
||||
if (isDefault) {
|
||||
// Sensible-default categories can still be removed — e.g. a fresh install's
|
||||
@@ -151,21 +144,13 @@
|
||||
<p class="hint">
|
||||
Synthesis queue processes higher-ranked categories first. Nothing is dropped — lower
|
||||
categories just wait longer when the queue is busy. This list also drives the site's nav —
|
||||
remove anything you're not interested in (Business, Culture, etc.) or add your own. A
|
||||
private category (and everything in it) is hidden from the public site until a visitor
|
||||
logs in with the lock icon in the masthead.
|
||||
remove anything you're not interested in (Business, Culture, etc.) or add your own.
|
||||
</p>
|
||||
<div class="priority-list">
|
||||
{#each local.categoryPriority as cat, i (cat.id)}
|
||||
<div class="priority-row">
|
||||
<span class="rank">{i + 1}</span>
|
||||
<span class="name">{cat.name}</span>
|
||||
{#if cat.name.toLowerCase() !== 'top stories'}
|
||||
<label class="private-toggle">
|
||||
<input type="checkbox" checked={cat.isPrivate} onchange={() => togglePrivate(cat.id)} />
|
||||
Private
|
||||
</label>
|
||||
{/if}
|
||||
<button class="icon-btn" onclick={() => move(i, -1)} disabled={i === 0} aria-label="Move up">▲</button>
|
||||
<button
|
||||
class="icon-btn"
|
||||
@@ -188,10 +173,6 @@
|
||||
bind:value={newCategoryName}
|
||||
onkeydown={(e) => e.key === 'Enter' && addCategory()}
|
||||
/>
|
||||
<label class="private-toggle">
|
||||
<input type="checkbox" bind:checked={newCategoryPrivate} />
|
||||
Private
|
||||
</label>
|
||||
<button onclick={addCategory} disabled={addingCategory || !newCategoryName.trim()}>
|
||||
{addingCategory ? 'Adding…' : '+ Add'}
|
||||
</button>
|
||||
@@ -302,17 +283,6 @@
|
||||
color: var(--text-muted);
|
||||
width: 16px;
|
||||
}
|
||||
.private-toggle {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 5px;
|
||||
font-size: 11px;
|
||||
color: var(--text-secondary);
|
||||
white-space: nowrap;
|
||||
}
|
||||
.private-toggle input {
|
||||
width: auto;
|
||||
}
|
||||
.name {
|
||||
font-size: 13px;
|
||||
flex: 1;
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
// Client for the "private categories" cookie login (see backend/src/api/privateAccess.ts).
|
||||
// Deliberately separate from adminAuth.ts/adminApi.ts: that's a header-based API key for
|
||||
// the admin SPA only, while this is a plain cookie so an ordinary visitor's browser
|
||||
// carries it across normal page loads with no localStorage/header plumbing needed.
|
||||
|
||||
import { getBackendUrl } from './config';
|
||||
|
||||
export interface PrivateAccessStatus {
|
||||
authenticated: boolean;
|
||||
configured: boolean;
|
||||
}
|
||||
|
||||
export async function getPrivateAccessStatus(fetchFn: typeof fetch = fetch): Promise<PrivateAccessStatus> {
|
||||
const res = await fetchFn(`${getBackendUrl()}/api/private-access/status`, { credentials: 'include' });
|
||||
if (!res.ok) return { authenticated: false, configured: false };
|
||||
return res.json();
|
||||
}
|
||||
|
||||
/** Throws with a user-facing message on failure (wrong password, or the feature isn't configured). */
|
||||
export async function loginPrivateAccess(password: string): Promise<void> {
|
||||
const res = await fetch(`${getBackendUrl()}/api/private-access/login`, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
credentials: 'include',
|
||||
body: JSON.stringify({ password })
|
||||
});
|
||||
if (!res.ok) {
|
||||
const body = await res.json().catch(() => ({}));
|
||||
throw new Error(body.error ?? `Login failed (${res.status})`);
|
||||
}
|
||||
}
|
||||
|
||||
export async function logoutPrivateAccess(): Promise<void> {
|
||||
await fetch(`${getBackendUrl()}/api/private-access/logout`, { method: 'POST', credentials: 'include' });
|
||||
}
|
||||
@@ -58,5 +58,4 @@ export interface Category {
|
||||
name: string;
|
||||
priorityRank: number;
|
||||
isDefault: boolean;
|
||||
isPrivate: boolean;
|
||||
}
|
||||
|
||||
@@ -1,31 +1,12 @@
|
||||
<script lang="ts">
|
||||
import '../lib/styles/app.css';
|
||||
import { page } from '$app/stores';
|
||||
import { invalidateAll } from '$app/navigation';
|
||||
import ThemeToggle from '$lib/components/ThemeToggle.svelte';
|
||||
import PrivateAccessModal from '$lib/components/PrivateAccessModal.svelte';
|
||||
import { logoutPrivateAccess } from '$lib/privateAccess';
|
||||
import { slugify } from '$lib/format';
|
||||
import type { LayoutData } from './$types';
|
||||
|
||||
let { children, data }: { children: any; data: LayoutData } = $props();
|
||||
|
||||
let showLoginModal = $state(false);
|
||||
|
||||
async function handleLockClick() {
|
||||
if (data.privateAccess.authenticated) {
|
||||
await logoutPrivateAccess();
|
||||
await invalidateAll();
|
||||
} else {
|
||||
showLoginModal = true;
|
||||
}
|
||||
}
|
||||
|
||||
async function handleLoginSuccess() {
|
||||
showLoginModal = false;
|
||||
await invalidateAll();
|
||||
}
|
||||
|
||||
// "Top stories" is a real Category row (it drives synthesis queue priority) but
|
||||
// isn't itself a filterable category — it always means "everything, chronological",
|
||||
// i.e. the homepage. Every other admin-defined category gets its own /category/:slug
|
||||
@@ -56,26 +37,6 @@
|
||||
</nav>
|
||||
<div class="controls">
|
||||
<ThemeToggle />
|
||||
{#if data.privateAccess?.configured}
|
||||
<button
|
||||
class="lock-btn"
|
||||
onclick={handleLockClick}
|
||||
aria-label={data.privateAccess.authenticated ? 'Log out of private categories' : 'Log in to private categories'}
|
||||
title={data.privateAccess.authenticated ? 'Log out of private categories' : 'Log in to private categories'}
|
||||
>
|
||||
{#if data.privateAccess.authenticated}
|
||||
<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
|
||||
<rect x="5" y="11" width="14" height="10" rx="2" />
|
||||
<path d="M8 11V7a4 4 0 0 1 7.75-1.5" />
|
||||
</svg>
|
||||
{:else}
|
||||
<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
|
||||
<rect x="5" y="11" width="14" height="10" rx="2" />
|
||||
<path d="M8 11V7a4 4 0 0 1 8 0v4" />
|
||||
</svg>
|
||||
{/if}
|
||||
</button>
|
||||
{/if}
|
||||
{#if data.adminPanelEnabled}
|
||||
<a class="cog" href="/admin/settings" aria-label="Admin settings" title="Admin settings">
|
||||
<svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8">
|
||||
@@ -90,10 +51,6 @@
|
||||
</div>
|
||||
</header>
|
||||
|
||||
{#if showLoginModal}
|
||||
<PrivateAccessModal onClose={() => (showLoginModal = false)} onSuccess={handleLoginSuccess} />
|
||||
{/if}
|
||||
|
||||
<main class="page">
|
||||
{@render children()}
|
||||
</main>
|
||||
@@ -153,19 +110,6 @@
|
||||
align-items: center;
|
||||
gap: 12px;
|
||||
}
|
||||
.lock-btn {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
color: var(--text-secondary);
|
||||
padding: 4px;
|
||||
border-radius: var(--radius);
|
||||
background: transparent;
|
||||
border: none;
|
||||
}
|
||||
.lock-btn:hover {
|
||||
background: var(--surface-1);
|
||||
color: var(--text-primary);
|
||||
}
|
||||
.cog {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
import type { LayoutLoad } from './$types';
|
||||
import { getCategories } from '$lib/api';
|
||||
import { getPrivateAccessStatus } from '$lib/privateAccess';
|
||||
|
||||
export const load: LayoutLoad = async ({ fetch, data }) => {
|
||||
const [categories, privateAccess] = await Promise.all([getCategories(fetch), getPrivateAccessStatus(fetch)]);
|
||||
return { ...data, categories, privateAccess };
|
||||
const categories = await getCategories(fetch);
|
||||
return { ...data, categories };
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user