Add ability to hide posts from unregistered users.

app.py

@@ -78,6 +78,7 @@ def init_db():
             category TEXT NOT NULL,
             image_filename TEXT,
             author_id INTEGER NOT NULL,
+            is_hidden INTEGER NOT NULL DEFAULT 0,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
             FOREIGN KEY (author_id) REFERENCES users(id)
@@ -131,6 +132,8 @@ def init_db():
                 db.execute("UPDATE users SET email_verified = 1 WHERE email IS NOT NULL")
     if "image_filename" not in post_columns:
         db.execute("ALTER TABLE posts ADD COLUMN image_filename TEXT")
+    if "is_hidden" not in post_columns:
+        db.execute("ALTER TABLE posts ADD COLUMN is_hidden INTEGER NOT NULL DEFAULT 0")
     db.execute("CREATE UNIQUE INDEX IF NOT EXISTS users_email_unique ON users(email)")
 
     # Preserve access for accounts created before approvals were introduced.
@@ -186,10 +189,11 @@ def post_from_request(post_id=None):
     excerpt = request.form.get("excerpt", "").strip()
     body = request.form.get("body", "").strip()
     category = request.form.get("category", "Engineering").strip() or "Engineering"
+    is_hidden = int(request.form.get("is_hidden") == "1")
     if not title or not excerpt or not body:
         raise ValueError("Title, summary, and article body are required.")
     now = datetime.now(timezone.utc).isoformat()
-    return title, unique_slug(title, post_id), excerpt, body, category, now
+    return title, unique_slug(title, post_id), excerpt, body, category, is_hidden, now
 
 
 def save_post_image(image_file):
@@ -342,20 +346,20 @@ def inject_current_user():
 
 @app.route("/")
 def index():
-    posts = get_db().execute(
-        """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id
-           ORDER BY posts.created_at DESC"""
-    ).fetchall()
+    query = """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id"""
+    if not session.get("mfa_verified"):
+        query += " WHERE posts.is_hidden = 0"
+    posts = get_db().execute(f"{query} ORDER BY posts.created_at DESC").fetchall()
     return render_template("index.html", posts=posts)
 
 
 @app.route("/post/<slug>")
 def post(slug):
-    article = get_db().execute(
-        """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id
-           WHERE posts.slug = ?""",
-        (slug,),
-    ).fetchone()
+    query = """SELECT posts.*, users.username, users.real_name FROM posts JOIN users ON users.id = posts.author_id
+               WHERE posts.slug = ?"""
+    if not session.get("mfa_verified"):
+        query += " AND posts.is_hidden = 0"
+    article = get_db().execute(query, (slug,)).fetchone()
     if article is None:
         abort(404)
     images = get_db().execute("SELECT * FROM post_images WHERE post_id = ? ORDER BY position", (article["id"],)).fetchall()
@@ -668,13 +672,13 @@ def admin_password_reset(user_id):
 def write():
     if request.method == "POST":
         try:
-            title, slug, excerpt, body, category, now = post_from_request()
+            title, slug, excerpt, body, category, is_hidden, now = post_from_request()
             image_file = request.files.get("image")
             image_filename = save_post_image(image_file) if image_file and image_file.filename else None
             cursor = get_db().execute(
-                """INSERT INTO posts (title, slug, excerpt, body, category, image_filename, author_id, created_at, updated_at)
-                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)""",
-                (title, slug, excerpt, body, category, image_filename, session["user_id"], now, now),
+                     """INSERT INTO posts (title, slug, excerpt, body, category, image_filename, author_id, is_hidden, created_at, updated_at)
+                         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+                     (title, slug, excerpt, body, category, image_filename, session["user_id"], is_hidden, now, now),
             )
             save_inline_images(cursor.lastrowid)
             get_db().commit()
@@ -694,12 +698,12 @@ def edit_post(slug):
         abort(403)
     if request.method == "POST":
         try:
-            title, new_slug, excerpt, body, category, now = post_from_request(article["id"])
+            title, new_slug, excerpt, body, category, is_hidden, now = post_from_request(article["id"])
             image_file = request.files.get("image")
             image_filename = save_post_image(image_file) if image_file and image_file.filename else article["image_filename"]
             get_db().execute(
-                """UPDATE posts SET title=?, slug=?, excerpt=?, body=?, category=?, image_filename=?, updated_at=? WHERE id=?""",
-                (title, new_slug, excerpt, body, category, image_filename, now, article["id"]),
+                """UPDATE posts SET title=?, slug=?, excerpt=?, body=?, category=?, image_filename=?, is_hidden=?, updated_at=? WHERE id=?""",
+                (title, new_slug, excerpt, body, category, image_filename, is_hidden, now, article["id"]),
             )
             save_inline_images(article["id"])
             get_db().commit()