diff --git a/README.md b/README.md index 4f1d9cf..b526050 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,8 @@ print("hello, circuit") Code is displayed as literal text and can be copied from the article view. Image markers written inside a code fence remain literal text. +Posts are public by default. Authors can select **Members only** while writing or editing to hide a post from visitors who are not signed in; MFA-verified members can still read these posts. + ## Accounts and MFA The initial administrator account is `admin` with password `admin`, as requested for first-run access. Sign in, scan the displayed QR code with any iPhone or Android TOTP authenticator, and change this password before exposing the service to the internet. New registrations are held for approval in **Accounts**; accepted users must enroll a TOTP authenticator before they can publish. diff --git a/TODO.md b/TODO.md index a501f72..715b4ea 100644 --- a/TODO.md +++ b/TODO.md @@ -15,4 +15,4 @@ - [x] Allow users to change their email addresses. - [x] Add user email verification for registration and email-address changes. - [x] Add user real names and use them as the published-by name. -- [ ] Add ability to hide posts from unregistered users. \ No newline at end of file +- [x] Add ability to hide posts from unregistered users. \ No newline at end of file diff --git a/app.py b/app.py index 846ebf1..db183cd 100644 --- a/app.py +++ b/app.py @@ -78,6 +78,7 @@ def init_db(): category TEXT NOT NULL, image_filename TEXT, author_id INTEGER NOT NULL, + is_hidden INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, FOREIGN KEY (author_id) REFERENCES users(id) @@ -131,6 +132,8 @@ def init_db(): db.execute("UPDATE users SET email_verified = 1 WHERE email IS NOT NULL") if "image_filename" not in post_columns: db.execute("ALTER TABLE posts ADD COLUMN image_filename TEXT") + if "is_hidden" not in post_columns: + db.execute("ALTER TABLE posts ADD COLUMN is_hidden INTEGER NOT NULL DEFAULT 0") db.execute("CREATE UNIQUE INDEX IF NOT EXISTS users_email_unique ON users(email)") # Preserve access for accounts created before approvals were introduced. @@ -186,10 +189,11 @@ def post_from_request(post_id=None): excerpt = request.form.get("excerpt", "").strip() body = request.form.get("body", "").strip() category = request.form.get("category", "Engineering").strip() or "Engineering" + is_hidden = int(request.form.get("is_hidden") == "1") if not title or not excerpt or not body: raise ValueError("Title, summary, and article body are required.") now = datetime.now(timezone.utc).isoformat() - return title, unique_slug(title, post_id), excerpt, body, category, now + return title, unique_slug(title, post_id), excerpt, body, category, is_hidden, now def save_post_image(image_file): @@ -342,20 +346,20 @@ def inject_current_user(): @app.route("/") def index(): - posts = get_db().execute( - """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id - ORDER BY posts.created_at DESC""" - ).fetchall() + query = """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id""" + if not session.get("mfa_verified"): + query += " WHERE posts.is_hidden = 0" + posts = get_db().execute(f"{query} ORDER BY posts.created_at DESC").fetchall() return render_template("index.html", posts=posts) @app.route("/post/") def post(slug): - article = get_db().execute( - """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id - WHERE posts.slug = ?""", - (slug,), - ).fetchone() + query = """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id + WHERE posts.slug = ?""" + if not session.get("mfa_verified"): + query += " AND posts.is_hidden = 0" + article = get_db().execute(query, (slug,)).fetchone() if article is None: abort(404) images = get_db().execute("SELECT * FROM post_images WHERE post_id = ? ORDER BY position", (article["id"],)).fetchall() @@ -668,13 +672,13 @@ def admin_password_reset(user_id): def write(): if request.method == "POST": try: - title, slug, excerpt, body, category, now = post_from_request() + title, slug, excerpt, body, category, is_hidden, now = post_from_request() image_file = request.files.get("image") image_filename = save_post_image(image_file) if image_file and image_file.filename else None cursor = get_db().execute( - """INSERT INTO posts (title, slug, excerpt, body, category, image_filename, author_id, created_at, updated_at) - VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""", - (title, slug, excerpt, body, category, image_filename, session["user_id"], now, now), + """INSERT INTO posts (title, slug, excerpt, body, category, image_filename, author_id, is_hidden, created_at, updated_at) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""", + (title, slug, excerpt, body, category, image_filename, session["user_id"], is_hidden, now, now), ) save_inline_images(cursor.lastrowid) get_db().commit() @@ -694,12 +698,12 @@ def edit_post(slug): abort(403) if request.method == "POST": try: - title, new_slug, excerpt, body, category, now = post_from_request(article["id"]) + title, new_slug, excerpt, body, category, is_hidden, now = post_from_request(article["id"]) image_file = request.files.get("image") image_filename = save_post_image(image_file) if image_file and image_file.filename else article["image_filename"] get_db().execute( - """UPDATE posts SET title=?, slug=?, excerpt=?, body=?, category=?, image_filename=?, updated_at=? WHERE id=?""", - (title, new_slug, excerpt, body, category, image_filename, now, article["id"]), + """UPDATE posts SET title=?, slug=?, excerpt=?, body=?, category=?, image_filename=?, is_hidden=?, updated_at=? WHERE id=?""", + (title, new_slug, excerpt, body, category, image_filename, is_hidden, now, article["id"]), ) save_inline_images(article["id"]) get_db().commit() diff --git a/data/eternity.db b/data/eternity.db index 1a8a2bc..a3e1a8e 100644 Binary files a/data/eternity.db and b/data/eternity.db differ diff --git a/static/css/site.css b/static/css/site.css index 2472ac0..ba9a07b 100644 --- a/static/css/site.css +++ b/static/css/site.css @@ -13,6 +13,7 @@ nav { display:flex; align-items:center; gap:22px; font-family:"DM Mono", monospa .journal, .editor-wrap { padding:40px max(5vw, 24px) 90px; }.section-head { display:flex; justify-content:space-between; padding-bottom:14px; border-bottom:1px solid var(--ink); margin-bottom:18px; }.post-grid { display:grid; grid-template-columns:repeat(3, 1fr); border-top:1px solid var(--ink); border-left:1px solid var(--ink); }.post-card { min-height:320px; padding:21px; border-right:1px solid var(--ink); border-bottom:1px solid var(--ink); display:flex; flex-direction:column; transition:background .2s; }.post-card:hover { background:var(--acid); }.post-meta { display:flex; justify-content:space-between; color:var(--muted); }.post-card h2 { font-size:29px; line-height:1; margin:28px 0 14px; }.post-card h2 a:hover { text-decoration:underline; text-decoration-thickness:2px; }.post-card p { line-height:1.45; margin:0; color:var(--muted); }.post-foot { margin-top:auto; display:flex; justify-content:space-between; align-items:center; padding-top:20px; font:10px "DM Mono", monospace; }.post-foot a { font:30px "DM Mono", monospace; }.empty-state { min-height:300px; padding:64px 0; text-align:center; border-bottom:1px solid var(--ink); }.empty-icon { font:42px "DM Mono", monospace; color:var(--orange); }.empty-state h2 { margin:10px 0 0; font-size:31px; }.empty-state p { color:var(--muted); margin:8px 0 24px; } .auth-layout { min-height:calc(100vh - 160px); padding:70px max(10vw, 24px); display:grid; grid-template-columns:1fr minmax(280px, 390px); gap:10vw; align-items:center; }.auth-copy h1 { font-size:clamp(45px, 6vw, 82px); line-height:.9; margin:15px 0; }.auth-copy p { max-width:380px; font-size:18px; line-height:1.5; color:var(--muted); }.auth-form, .editor-form { display:grid; gap:19px; }.auth-form { padding:27px; border:1px solid var(--ink); background:rgba(241,241,233,.8); }.auth-form label, .editor-form label { display:grid; gap:7px; font:11px "DM Mono", monospace; }input, textarea { width:100%; resize:vertical; background:#fbfbf6; border:1px solid var(--ink); border-radius:0; padding:12px; color:var(--ink); font:15px "Space Grotesk", sans-serif; }input:focus, textarea:focus { outline:3px solid var(--acid); outline-offset:1px; }.form-switch { font-size:13px; color:var(--muted); }.form-switch a { color:var(--ink); text-decoration:underline; }.editor-form { max-width:900px; }.two-col { display:grid; grid-template-columns:1fr 2fr; gap:19px; } .step-images { margin:0; padding:16px; border:1px solid var(--ink); }.step-images legend { padding:0 5px; font:11px "DM Mono", monospace; }.step-images p { margin:0 0 15px; color:var(--muted); font-size:13px; line-height:1.45; }.step-images code { color:var(--orange); font:12px "DM Mono", monospace; }.step-image-row { display:grid; grid-template-columns:1fr 1fr; gap:12px; margin-bottom:12px; }.add-step-image { justify-self:start; border:1px solid var(--ink); background:transparent; padding:8px 10px; font:11px "DM Mono", monospace; cursor:pointer; }.add-step-image:hover { background:var(--acid); } +.post-visibility { grid-template-columns:auto 1fr; align-items:center; column-gap:9px; padding:12px; border:1px solid var(--ink); background:rgba(241,241,233,.8); cursor:pointer; }.post-visibility input { width:16px; height:16px; margin:0; accent-color:var(--orange); }.post-visibility small { grid-column:2; color:var(--muted); font:12px "Space Grotesk", sans-serif; letter-spacing:0; text-transform:none; } .article { max-width:850px; margin:0 auto; padding:80px 24px 100px; }.article h1 { font-size:clamp(48px, 7vw, 90px); line-height:.93; margin:23px 0; }.article-lead { border-left:4px solid var(--orange); padding-left:18px; max-width:720px; font-size:23px; line-height:1.35; }.byline { padding:20px 0; border-top:1px solid var(--ink); border-bottom:1px solid var(--ink); margin:35px 0; }.article-image-button { display:block; max-width:680px; width:100%; margin:0 0 30px; padding:0; border:0; background:none; cursor:zoom-in; }.article-image { display:block; width:100%; max-height:430px; object-fit:cover; border:1px solid var(--ink); }.inline-image { max-width:680px; margin:28px 0; }.inline-image .article-image-button { margin:0; }.inline-image figcaption { padding-top:8px; color:var(--muted); font:12px "DM Mono", monospace; }.image-dialog { width:min(94vw, 1200px); max-width:none; padding:0; border:1px solid var(--ink); background:var(--ink); }.image-dialog::backdrop { background:rgba(17,33,43,.85); }.image-dialog img { display:block; width:100%; max-height:88vh; object-fit:contain; }.dialog-close { position:absolute; top:10px; right:10px; border:1px solid var(--paper); background:var(--ink); color:var(--paper); padding:8px 10px; font:12px "DM Mono", monospace; cursor:pointer; }.article-body { max-width:680px; font-size:18px; line-height:1.7; margin-bottom:35px; }.article-text { white-space:pre-wrap; } .code-block { margin:28px 0; border:1px solid var(--ink); background:var(--ink); }.code-block-head { display:flex; align-items:center; justify-content:space-between; min-height:38px; padding:7px 10px 7px 14px; color:var(--paper); font:11px "DM Mono", monospace; letter-spacing:.7px; text-transform:uppercase; }.copy-code { border:1px solid var(--paper); background:transparent; color:var(--paper); padding:5px 8px; font:11px "DM Mono", monospace; cursor:pointer; }.copy-code:hover { border-color:var(--acid); background:var(--acid); color:var(--ink); }.code-block pre { margin:0; padding:18px; overflow:auto; background:#fbfbf6; color:var(--ink); font:14px/1.55 "DM Mono", monospace; white-space:pre; }.code-block code { font:inherit; } .flash { margin:16px max(5vw, 24px) 0; padding:11px 14px; font:12px "DM Mono", monospace; border:1px solid var(--ink); }.flash.error { border-color:var(--orange); background:#ffe3d9; }.flash.success { background:var(--acid); }footer { border-top:1px solid var(--ink); padding:23px max(5vw, 24px); display:flex; justify-content:space-between; font:10px "DM Mono", monospace; color:var(--muted); } diff --git a/templates/editor.html b/templates/editor.html index 4ad3201..3e2bdc7 100644 --- a/templates/editor.html +++ b/templates/editor.html @@ -8,6 +8,7 @@
+
Step images

Upload images for individual repair steps, then place [[image:1]], [[image:2]], and so on in the article text.

diff --git a/templates/index.html b/templates/index.html index f6b5d7a..b452049 100644 --- a/templates/index.html +++ b/templates/index.html @@ -13,7 +13,7 @@
{% for post in posts %}
-
{{ post.category }}
+
{{ post.category }}{% if post.is_hidden %} / MEMBERS{% endif %}

{{ post.title }}

{{ post.excerpt }}

BY {{ post.real_name or post.username }}→
diff --git a/templates/post.html b/templates/post.html index e30fad7..8945ec6 100644 --- a/templates/post.html +++ b/templates/post.html @@ -1,7 +1,7 @@ {% extends 'base.html' %} {% block title %}{{ post.title }} | Eternity Project{% endblock %} {% block content %} -
{{ post.category }}

{{ post.title }}

{{ post.excerpt }}

WRITTEN BY {{ post.real_name or post.username }}{% if post.updated_at != post.created_at %} / UPDATED {{ post.updated_at[:10] }}{% endif %}
{% if post.image_filename %}{% endif %}
{% for kind, content in blocks %}{% if kind == 'text' %}
{{ content }}
{% elif kind == 'code' %}
{{ content.language }}
{{ content.content }}
{% else %}
{% if content.caption %}
{{ content.caption }}
{% endif %}
{% endif %}{% endfor %}
{% if current_user and current_user.id == post.author_id %}Edit post{% endif %}
+
{{ post.category }}{% if post.is_hidden %} / MEMBERS{% endif %}

{{ post.title }}

{{ post.excerpt }}

WRITTEN BY {{ post.real_name or post.username }}{% if post.updated_at != post.created_at %} / UPDATED {{ post.updated_at[:10] }}{% endif %}
{% if post.image_filename %}{% endif %}
{% for kind, content in blocks %}{% if kind == 'text' %}
{{ content }}
{% elif kind == 'code' %}
{{ content.language }}
{{ content.content }}
{% else %}
{% if content.caption %}
{{ content.caption }}
{% endif %}
{% endif %}{% endfor %}
{% if current_user and current_user.id == post.author_id %}Edit post{% endif %}
{% endblock %} diff --git a/test_post_visibility.py b/test_post_visibility.py new file mode 100644 index 0000000..b482d70 --- /dev/null +++ b/test_post_visibility.py @@ -0,0 +1,57 @@ +import tempfile +import unittest +from pathlib import Path + +import app as application +from werkzeug.security import generate_password_hash + + +class PostVisibilityTestCase(unittest.TestCase): + def setUp(self): + self.temp_directory = tempfile.TemporaryDirectory() + self.database_path = Path(self.temp_directory.name) / "test.db" + self.original_config = application.app.config.copy() + application.app.config.update(DATABASE=self.database_path, TESTING=True, WTF_CSRF_ENABLED=False) + with application.app.app_context(): + application.init_db() + db = application.get_db() + self.user_id = db.execute( + """INSERT INTO users (username, real_name, email, email_verified, password_hash, created_at, is_approved, role, mfa_enabled) + VALUES (?, ?, ?, 1, ?, ?, 1, 'member', 1)""", + ("member", "Member Name", "member@example.com", generate_password_hash("secure-password"), "2026-09-01T00:00:00+00:00"), + ).lastrowid + db.commit() + self.client = application.app.test_client() + + def tearDown(self): + application.app.config.update(self.original_config) + self.temp_directory.cleanup() + + def test_member_only_post_is_hidden_from_anonymous_visitors(self): + with self.client.session_transaction() as session: + session["user_id"] = self.user_id + session["mfa_verified"] = True + + response = self.client.post( + "/write", + data={"title": "Member transmission", "category": "Engineering", "excerpt": "Members only.", "body": "Private body.", "is_hidden": "1"}, + ) + self.assertEqual(response.status_code, 302) + with application.app.app_context(): + self.assertEqual(application.get_db().execute("SELECT is_hidden FROM posts WHERE slug = ?", ("member-transmission",)).fetchone()[0], 1) + + self.client.get("/logout") + with self.client.session_transaction() as session: + session.clear() + self.assertNotIn(b"Member transmission", self.client.get("/").data) + self.assertEqual(self.client.get("/post/member-transmission").status_code, 404) + + with self.client.session_transaction() as session: + session["user_id"] = self.user_id + session["mfa_verified"] = True + self.assertIn(b"Member transmission", self.client.get("/").data) + self.assertEqual(self.client.get("/post/member-transmission").status_code, 200) + + +if __name__ == "__main__": + unittest.main() \ No newline at end of file