@geekity/cms 0.3.0 → 0.4.0

package/admin/pages/settings/general.njk

@@ -0,0 +1,29 @@
+{# /admin/settings: what the site is called, where it lives, and its picture. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {{ field.text('settings-title', fields.title, 'Title', form.title,
+       error=problems.title, required=true, autofocus=true) }}
+
+  {{ field.text('settings-tagline', fields.tagline, 'Tagline', form.tagline,
+       hint='One line, shown under the title and used as the feed subtitle.') }}
+
+  {{ field.text('settings-author', fields.author, 'Author', form.author,
+       hint='The name on the feeds.') }}
+
+  {% set baseUrlHint %}In effect: <code>{{ baseUrlInEffect }}</code>. {{ baseUrlNote }}{% endset %}
+  {{ field.text('settings-base-url', fields.baseUrl, 'Base URL', form.baseUrl,
+       error=problems.baseUrl, hint=baseUrlHint, inputmode='url',
+       readonly=baseUrlOverridden, disabled=baseUrlOverridden) }}
+
+  {% set timezoneHint %}An IANA name, such as <code>Europe/London</code> or <code>UTC</code>.{% endset %}
+  {{ field.text('settings-timezone', fields.timezone, 'Time zone', form.timezone,
+       error=problems.timezone, hint=timezoneHint, required=true) }}
+
+  {% set languageHint %}A BCP 47 tag, such as <code>en</code> or <code>en-GB</code>. It is the page's <code>lang</code> and the feeds' language.{% endset %}
+  {{ field.text('settings-language', fields.language, 'Language', form.language,
+       error=problems.language, hint=languageHint, required=true) }}
+{% endblock %}
+
+{% block settingsPanels %}{% endblock %}

package/admin/pages/settings/permalinks.njk

@@ -0,0 +1,50 @@
+{# /admin/settings/permalinks: the URLs the archives live at, and the ones they
+   used to. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {% set tagBaseHint %}The tag archives live at <code>/{{ form.tagBase }}/{tag}/</code>. One path segment, no slashes.{% endset %}
+  {{ field.text('settings-tag-base', fields.tagBase, 'Tag base', form.tagBase,
+       error=problems.tagBase, hint=tagBaseHint, required=true, autofocus=true) }}
+
+  {% set categoryBaseHint %}The category archives live at <code>/{{ form.categoryBase }}/{name}/</code>.{% endset %}
+  {{ field.text('settings-category-base', fields.categoryBase, 'Category base', form.categoryBase,
+       error=problems.categoryBase, hint=categoryBaseHint, required=true) }}
+{% endblock %}
+
+{% block settingsPanels %}
+  {# The recorded renames are a record of what happened rather than a
+     preference: the taxonomy screens write them as a term is renamed or merged,
+     and this page is where the URLs they are about are decided. #}
+  <section class="admin-settings admin-redirects-panel">
+    <h2>Archive redirects</h2>
+
+    {% if taxonomyRedirects.length %}
+      <table class="admin-list">
+        <thead>
+          <tr><th scope="col">Taxonomy</th><th scope="col">Was</th><th scope="col">Is now</th></tr>
+        </thead>
+        <tbody>
+          {% for redirect in taxonomyRedirects %}
+            <tr>
+              <td>{{ redirect.label }}</td>
+              <td><code>{{ redirect.from }}</code></td>
+              <td><code>{{ redirect.to }}</code></td>
+            </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+      <p class="admin-hint">
+        Every one of these answers with a permanent redirect to the archive the
+        term lives at now, so a link somebody published still arrives.
+      </p>
+    {% else %}
+      <p class="admin-hint">
+        Nothing has moved yet. Renaming or merging a term on the Tags or
+        Categories screen records the archive URL it used to have here, and the
+        site answers that URL with a permanent redirect from then on.
+      </p>
+    {% endif %}
+  </section>
+{% endblock %}

package/admin/pages/settings/reading.njk

@@ -0,0 +1,72 @@
+{# /admin/settings/reading: what a visitor is shown, and who is told when it
+   changes. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {# WordPress's "Your homepage displays": the empty option is Your latest
+     posts, so the choice and the page it needs are one control rather than a
+     radio and a select that can disagree with each other. #}
+  {% set homepageGone %}
+    {% if homepageMissing %}
+      <p class="admin-field-error">
+        The homepage was <code>{{ form.homepage }}</code>, which is no longer published,
+        so the site is showing its latest posts. Publish that page again to have it back,
+        or pick another.
+      </p>
+    {% endif %}
+  {% endset %}
+  {% set homepageHint %}
+    Your latest posts is the archive at <code>/</code>. A page instead is served
+    there, and its own URL redirects to <code>/</code> so there is one front page.
+  {% endset %}
+  {% call field.select('settings-homepage', fields.homepage, 'Your homepage displays',
+       error=problems.homepage, errorHtml=homepageGone, hint=homepageHint, autofocus=true) %}
+    <option value="">Your latest posts</option>
+    {% for page in pageChoices %}
+      <option value="{{ page.slug }}"{% if page.slug == form.homepage %} selected{% endif %}>{{ page.title }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {% set postsPageGone %}
+    {% if postsPageMissing %}
+      <p class="admin-field-error">
+        The posts page was <code>{{ form.postsPage }}</code>, which is no longer published,
+        so the listing has no page of its own.
+      </p>
+    {% endif %}
+  {% endset %}
+  {% set postsPageHint %}
+    Where the posts go once the homepage is a page: this page's URL carries the
+    listing, with its own title and words above it. It needs a homepage first.
+    The feeds stay at <code>/feed/</code> either way.
+  {% endset %}
+  {% call field.select('settings-posts-page', fields.postsPage, 'Posts page',
+       error=problems.postsPage, errorHtml=postsPageGone, hint=postsPageHint) %}
+    <option value="">&mdash; None &mdash;</option>
+    {% for page in pageChoices %}
+      <option value="{{ page.slug }}"{% if page.slug == form.postsPage %} selected{% endif %}>{{ page.title }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {{ field.text('settings-posts-per-page', fields.postsPerPage, 'Posts per page', form.postsPerPage,
+       error=problems.postsPerPage, inputmode='numeric', required=true,
+       hint='How many posts a listing page holds, on the home page and on every archive.') }}
+
+  {% set navigationHint %}
+    One item per line, written <code>Label | URL</code> &mdash; for example
+    <code>About | /about/</code> or <code>Mastodon | https://example.social/@me</code>.
+    They are the menu in the site header, in this order. A page can put itself
+    on the end of it by ticking <em>Show in navigation</em> in the editor.
+  {% endset %}
+  {{ field.textarea('settings-navigation', fields.navigation, 'Menu', form.navigation,
+       error=problems.navigation, hint=navigationHint, rows='4', spellcheck='false') }}
+
+  {% set notifyHint %}
+    An rssCloud and WebSub server, told whenever a feed changes so subscribers
+    hear at once instead of waiting for their next poll. Every feed advertises
+    it. Leave it empty for none.
+  {% endset %}
+  {{ field.text('settings-notify-server', fields.notifyServer, 'Notify server', form.notifyServer,
+       error=problems.notifyServer, hint=notifyHint, inputmode='url') }}
+{% endblock %}

package/admin/pages/users/edit.njk

@@ -0,0 +1,239 @@
+{# /admin/users/<id>: everything about one person, a panel at a time.
+
+   The table behind it says who there is; this says what they are. Every box
+   here carries a label the eye can read, because these fields used to sit in
+   a row of that table where a placeholder was the only thing telling them
+   apart — and a placeholder disappears the moment somebody types.
+
+   Four forms rather than one, for the reason there were four before: an email
+   address is private to the site and a profile is the public face, a notice
+   switch is a button and how often it arrives is a select, and a password is
+   about whoever is signed in. Each saves what its own heading is about and
+   lands back here, so a Save always shows its own result. #}
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Edit {{ account.username }}{% endblock %}
+
+{% block content %}
+  <h1>Edit {{ account.username }}{% if account.you %} <span class="admin-status">(you)</span>{% endif %}</h1>
+
+  <p class="admin-hint"><a href="{{ usersUrl }}">Back to all users</a></p>
+
+  <form class="admin-settings" method="post" action="{{ userEmailUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+
+    <h2>Account</h2>
+
+    <p class="admin-field-static">
+      Signs in as <strong>{{ account.username }}</strong>, and writes at
+      <a href="{{ account.archiveUrl }}">{{ account.archiveUrl }}</a>.
+    </p>
+    <p class="admin-hint">
+      A username is not editable: it is the login, the author URL above, and
+      the actor a follower holds. Somebody who needs a different one is a new
+      account.
+    </p>
+    {# The id they were published under somewhere else (TASK-69). Read-only on
+       purpose: it is what the fediverse already holds, and changing it would
+       orphan every follow. #}
+    {% if account.storedActorId %}
+      <p class="admin-hint">
+        Also <code>{{ account.storedActorId }}</code> — what the fediverse knows
+        this user by. Set by the import or by hand in
+        <code>data/users.json</code>, never here.
+      </p>
+    {% endif %}
+
+    {% set emailHint %}
+      {% if mailConfigured %}
+        Optional, and never shown on the public site. It is what a forgotten password is recovered through and where the notices below go. Empty it to stop the site writing to this person at all.
+      {% else %}
+        Optional, and this site sends no mail yet, so nothing will be sent to one. Choose a provider on <a href="{{ adminUrl }}/settings/email">Settings &rsaquo; Email</a> to turn password recovery on.
+      {% endif %}
+    {% endset %}
+    {{ field.text('user-email', fields.email, 'Email address', account.email,
+         type='email', autocomplete='email', hint=emailHint) }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Save email address</button>
+    </p>
+  </form>
+
+  {# The public face of this person (TASK-67). Anybody's, not only your own:
+     there is one role, so an admin who has just added a colleague can put a
+     name and a line about them on their archive without waiting for them to
+     sign in. After decision-14 these same fields are what their ActivityPub
+     actor carries, which is why they live beside the account rather than in
+     the site settings — and why saving them tells their followers. #}
+  <form class="admin-settings" method="post" action="{{ userProfileUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+
+    <h2>Profile</h2>
+
+    <p class="admin-hint">
+      A profile is public. Nothing in it is required — a user with no profile
+      still has an archive under their username — and a box left empty is a
+      field they do not have.
+    </p>
+
+    {{ field.text('profile-display-name', fields.displayName, 'Display name',
+         account.profile.displayName,
+         hint='Printed instead of the login: it heads the archive and is the byline under their posts.') }}
+
+    {{ field.textarea('profile-bio', fields.bio, 'Bio', account.profile.bio, rows='4',
+         hint='A line or two about them, shown on the archive under the name.') }}
+
+    {% set avatarHint %}A path such as <code>/uploads/2026/09/me.jpg</code>, or a full URL.{% endset %}
+    {{ field.text('profile-avatar', fields.avatar, 'Avatar', account.profile.avatar,
+         hint=avatarHint) }}
+
+    {{ field.text('profile-job-title', fields.jobTitle, 'Job title', account.profile.jobTitle,
+         hint='What they do, printed beside the name on the archive.') }}
+
+    {{ field.text('profile-location', fields.location, 'Location', account.profile.location,
+         hint='Where they are, as they write it.') }}
+
+    {% set linksHint %}
+      One per line, either <code>Label | https://example.com</code> or a bare
+      URL that labels itself.
+    {% endset %}
+    {{ field.textarea('profile-links', fields.links, 'Links', account.profile.links, rows='4',
+         hint=linksHint) }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Save profile</button>
+    </p>
+  </form>
+
+  {# Only once there is both somewhere to write to and something to write
+     with. These switches decide what is sent to the address above, so without
+     an address, or without a mail provider on Settings > Email, every one of
+     them could be on and the site would still send this person nothing. The
+     lines below say which is missing where the panel would have been, rather
+     than letting it vanish without explanation. #}
+  {% if account.email and mailConfigured %}
+  <section class="admin-settings">
+    <h2>Email {{ account.username }} about</h2>
+
+    <p class="admin-hint">
+      What this site writes to {{ account.username }} at <code>{{ account.email }}</code>.
+    </p>
+
+    {# One form per switch, not one form with a checkbox each: a browser sends
+       no field for an unticked box, so a single form could not tell "turned
+       this off" from "left it alone". Adding a notice is one entry in the
+       registry and no change here. #}
+    {% for notice in account.notifications %}
+      <div class="admin-notice">
+        <h3>{{ notice.label }}</h3>
+        <p class="admin-hint">{{ notice.description }}</p>
+
+        <form class="admin-inline" method="post" action="{{ userNotificationsUrl }}">
+          <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+          <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+          <input type="hidden" name="{{ fields.event }}" value="{{ notice.name }}" />
+          <input type="hidden" name="{{ fields.on }}" value="{% if notice.on %}{% else %}1{% endif %}" />
+          <span class="admin-status">{% if notice.on %}On{% else %}Off{% endif %}</span>
+          <button type="submit">{% if notice.on %}Turn off{% else %}Turn on{% endif %}</button>
+        </form>
+
+        {# And, for a notice the registry says can be batched, how often it
+           should arrive. A second form because a select needs a Save beside
+           it and the switch above is a button; the registry decides which
+           notices get one. #}
+        {% if notice.batched %}
+          <form class="admin-inline" method="post" action="{{ userNotificationModeUrl }}">
+            <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+            <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+            <input type="hidden" name="{{ fields.event }}" value="{{ notice.name }}" />
+            {% call field.select('notice-mode-' + notice.name, fields.mode, 'How often') %}
+              {% for choice in notice.modes %}
+                <option value="{{ choice.value }}"{% if choice.chosen %} selected{% endif %}>{{ choice.label }}</option>
+              {% endfor %}
+            {% endcall %}
+            <button type="submit">Save</button>
+          </form>
+          <p class="admin-hint">
+            On an hourly or a daily digest nothing is sent as they arrive;
+            instead one message a window lists everything still waiting, and
+            no message goes at all when nothing is.
+          </p>
+        {% endif %}
+      </div>
+    {% endfor %}
+  </section>
+  {% else %}
+  <section class="admin-settings">
+    <h2>Email {{ account.username }} about</h2>
+
+    {% if not mailConfigured %}
+      <p class="admin-hint">
+        Nothing, while this site has no mail provider: there is nothing to send
+        with. Choose one on <a href="{{ adminUrl }}/settings/email">Settings
+        &rsaquo; Email</a> and what to send comes back here.
+      </p>
+    {% else %}
+      <p class="admin-hint">
+        Nothing, while the box above is empty: there is nowhere to write to.
+        Give {% if account.you %}yourself{% else %}this account{% endif %} an
+        address and what to send comes back here.
+      </p>
+    {% endif %}
+  </section>
+  {% endif %}
+
+  {# Only on your own page: it asks for the current password, so it is about
+     whoever is signed in and means nothing on somebody else's screen.
+     Resetting a colleague's password from under them is deliberately not
+     offered — a fresh account is what that is for. #}
+  {% if account.you %}
+    <form class="admin-settings" method="post" action="{{ changePasswordUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+      <h2>Change your password</h2>
+
+      {% if passwordProblems.currentPassword or passwordProblems.newPassword %}
+        <p class="admin-error">Your password was not changed. Fix the fields marked below and try again.</p>
+      {% endif %}
+
+      {{ field.password('current-password', fields.currentPassword, 'Current password',
+           error=passwordProblems.currentPassword, autocomplete='current-password',
+           required=true) }}
+
+      {{ field.password('new-password', fields.newPassword, 'New password',
+           error=passwordProblems.newPassword, autocomplete='new-password', required=true) }}
+
+      {{ field.password('new-password-confirmation', fields.newPasswordConfirmation,
+           'New password again', autocomplete='new-password', required=true) }}
+
+      <p class="admin-hint">Every other browser signed in as you is signed out. This one stays.</p>
+
+      <p class="admin-settings-buttons">
+        <button type="submit">Change password</button>
+      </p>
+    </form>
+  {% endif %}
+
+  <section class="admin-settings">
+    <h2>Delete</h2>
+
+    {# Either the button or the reason there is none, never both: the screen
+       does not offer an action it is about to refuse. #}
+    {% if deleteRefusal %}
+      <p class="admin-hint">{{ deleteRefusal }}</p>
+    {% else %}
+      <p class="admin-hint">
+        Deleting {{ account.username }} signs out every browser they are in and
+        cannot be undone. What they have written stays where it is.
+      </p>
+      <form method="post" action="{{ deleteUserUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+        <button type="submit">Delete {{ account.username }}</button>
+      </form>
+    {% endif %}
+  </section>
+{% endblock %}

package/admin/pages/users/list.njk

@@ -0,0 +1,48 @@
+{# /admin/users: who can sign in.
+
+   A listing and nothing else (TASK-97). Every field a user has is edited on
+   that user's own screen, which the Edit link in each row goes to, so no box
+   in this table can be mistaken for another one. Adding somebody is its own
+   screen next door, `new.njk`, because Users > Add new is its own menu entry.
+ #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}Users{% endblock %}
+
+{% block content %}
+  <h1>Users <a class="admin-button admin-button-small" href="{{ addUserUrl }}">Add new</a></h1>
+
+  <table class="admin-list">
+    <thead>
+      <tr>
+        <th scope="col">Username</th>
+        <th scope="col">Email</th>
+        <th scope="col">Created</th>
+        <th scope="col">Actions</th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for entry in users %}
+        <tr>
+          <td>
+            <a href="{{ entry.editUrl }}">{{ entry.username }}</a>{% if entry.you %} <span class="admin-status">(you)</span>{% endif %}
+            <br /><a href="{{ entry.archiveUrl }}">{{ entry.archiveUrl }}</a>
+          </td>
+          <td>{% if entry.email %}{{ entry.email }}{% else %}<span class="admin-status">None</span>{% endif %}</td>
+          <td>{{ entry.createdAt | date('html') }}</td>
+          <td class="admin-actions">
+            <a class="admin-button admin-button-small" href="{{ entry.editUrl }}">Edit</a>
+            {% if entry.deletable %}
+              <form method="post" action="{{ deleteUserUrl }}">
+                <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+                <input type="hidden" name="{{ fields.userId }}" value="{{ entry.id }}" />
+                <button type="submit">Delete</button>
+              </form>
+            {% endif %}
+          </td>
+        </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+
+{% endblock %}

package/admin/pages/users/new.njk

@@ -0,0 +1,41 @@
+{# /admin/users/new: add somebody who can sign in.
+
+   The other half of what the listing used to hold: one form, the same chrome,
+   and its own menu entry under Users. A refused add comes back here with what
+   was typed still in the boxes, so nothing is retyped to fix one field.
+ #}
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Add new user{% endblock %}
+
+{% block content %}
+  <h1>Add new user</h1>
+
+  <form class="admin-settings" method="post" action="{{ addUserUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+    {% if addProblems.username or addProblems.password or addProblems.email %}
+      <p class="admin-error">Nobody was added. Fix the fields marked below and try again.</p>
+    {% endif %}
+
+    {{ field.text('add-username', fields.username, 'Username', addForm.username,
+         error=addProblems.username, required=true) }}
+
+    {{ field.text('add-email', fields.email, 'Email <span class="admin-status">(optional)</span>',
+         addForm.email, type='email', autocomplete='email', error=addProblems.email) }}
+
+    {{ field.password('add-password', fields.password, 'Password',
+         error=addProblems.password, autocomplete='new-password') }}
+
+    {{ field.checkbox('add-generate', fields.generate,
+         'Generate one instead, and show it to me once', checked=addForm.generate,
+         hint='A generated password is shown on the next page and nowhere else. Copy it before you leave.') }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Add user</button>
+    </p>
+  </form>
+
+  <p class="admin-hint"><a href="{{ usersUrl }}">Back to all users</a></p>
+{% endblock %}