@geekity/cms 0.3.0 → 0.5.0

package/admin/components/fields.njk

@@ -0,0 +1,165 @@
+{# One labelled box, written once.
+
+   Every admin form used to spell out its own `<label for>`, control, hint and
+   error, roughly seventy-five times across sixteen templates, against a class
+   vocabulary each template had to remember. That is how /admin/users drifted
+   into hidden labels nobody else used (TASK-97): a field written by hand can
+   forget the error line, leave a label unbound, or invent a class the
+   stylesheet has never heard of, and nothing says it is wrong.
+
+   Each macro here emits the same four things in the same order:
+
+     1. the `<label for>`, bound to the control by its id,
+     2. the control,
+     3. the field error, where the form has something to say about this box,
+     4. the hint, where the field needs explaining.
+
+   Error before hint, because that is the order every screen already used: the
+   sentence about what went wrong belongs next to the box it is about, and the
+   standing explanation sits under both.
+
+   This file is under the packaged admin directory, which is the admin
+   environment's only search root (`src/admin/templates.ts`). A site's theme
+   can override any public template and cannot reach in here, so no theme can
+   shadow or break a field on the login form.
+
+   `label` and `hint` are written into the page as markup, because the admin's
+   labels and hints carry `<code>`, `<em>` and links. They are template
+   literals, never anything a visitor typed; a hint that interpolates a value
+   should be captured with `{% set … %}…{% endset %}`, which escapes what it
+   interpolates before this ever sees it. `error` is a message from the server
+   and is escaped. #}
+
+{# The field error, then the hint: the two paragraphs every macro below ends
+   with. `errorHtml` is the rare second thing a field has to say — the Reading
+   page's "that page is no longer published" — already written as its own
+   paragraph. #}
+{% macro _below(hint, error, errorHtml) %}
+{% if error %}
+  <p class="admin-field-error">{{ error }}</p>
+{% endif %}
+{% if errorHtml %}
+{{ errorHtml | safe }}
+{% endif %}
+{% if hint %}
+  <p class="admin-hint">{{ hint | safe }}</p>
+{% endif %}
+{% endmacro %}
+
+{# A box somebody types into: text, email, number, or whatever `type` says.
+
+   `value` is always written, even empty, so the control's state is on the page
+   rather than implied by its absence. #}
+{% macro text(
+  id,
+  name,
+  label,
+  value='',
+  type='text',
+  hint='',
+  error='',
+  errorHtml='',
+  min='',
+  step='',
+  inputmode='',
+  autocomplete='',
+  placeholder='',
+  spellcheck='',
+  required=false,
+  autofocus=false,
+  readonly=false,
+  disabled=false
+) %}
+  <label for="{{ id }}">{{ label | safe }}</label>
+  <input id="{{ id }}" name="{{ name }}" type="{{ type }}"{% if min %} min="{{ min }}"{% endif %}{% if step %} step="{{ step }}"{% endif %}{% if inputmode %} inputmode="{{ inputmode }}"{% endif %}{% if autocomplete %} autocomplete="{{ autocomplete }}"{% endif %} value="{{ value }}"{% if placeholder %} placeholder="{{ placeholder }}"{% endif %}{% if spellcheck %} spellcheck="{{ spellcheck }}"{% endif %}{% if required %} required{% endif %}{% if autofocus %} autofocus{% endif %}{% if readonly %} readonly{% endif %}{% if disabled %} disabled{% endif %} />
+{{ _below(hint, error, errorHtml) }}
+{%- endmacro %}
+
+{# A password box. It carries `value=""` and no way to set one: nothing typed
+   into a password field is ever printed back into the page, and a stored
+   secret is never printed at all — the placeholder says whether there is one.
+   #}
+{% macro password(
+  id,
+  name,
+  label,
+  hint='',
+  error='',
+  errorHtml='',
+  autocomplete='',
+  placeholder='',
+  spellcheck='',
+  required=false,
+  autofocus=false
+) %}
+  <label for="{{ id }}">{{ label | safe }}</label>
+  <input id="{{ id }}" name="{{ name }}" type="password" value=""{% if autocomplete %} autocomplete="{{ autocomplete }}"{% endif %}{% if spellcheck %} spellcheck="{{ spellcheck }}"{% endif %}{% if placeholder %} placeholder="{{ placeholder }}"{% endif %}{% if required %} required{% endif %}{% if autofocus %} autofocus{% endif %} />
+{{ _below(hint, error, errorHtml) }}
+{%- endmacro %}
+
+{# A box of several lines. #}
+{% macro textarea(
+  id,
+  name,
+  label,
+  value='',
+  hint='',
+  error='',
+  errorHtml='',
+  rows='',
+  spellcheck='',
+  required=false,
+  autofocus=false,
+  readonly=false,
+  disabled=false
+) %}
+  <label for="{{ id }}">{{ label | safe }}</label>
+  <textarea id="{{ id }}" name="{{ name }}"{% if rows %} rows="{{ rows }}"{% endif %}{% if spellcheck %} spellcheck="{{ spellcheck }}"{% endif %}{% if required %} required{% endif %}{% if autofocus %} autofocus{% endif %}{% if readonly %} readonly{% endif %}{% if disabled %} disabled{% endif %}>{{ value }}</textarea>
+{{ _below(hint, error, errorHtml) }}
+{%- endmacro %}
+
+{# A list to pick from. The options are the call's body, because which of them
+   is `selected` is the caller's business and an option's label is markup as
+   often as it is a word:
+
+     {% call field.select('settings-homepage', fields.homepage, 'Homepage') %}
+       <option value="">Your latest posts</option>
+     {% endcall %} #}
+{% macro select(
+  id,
+  name,
+  label,
+  hint='',
+  error='',
+  errorHtml='',
+  required=false,
+  autofocus=false,
+  disabled=false
+) %}
+  <label for="{{ id }}">{{ label | safe }}</label>
+  <select id="{{ id }}" name="{{ name }}"{% if required %} required{% endif %}{% if autofocus %} autofocus{% endif %}{% if disabled %} disabled{% endif %}>
+{{ caller() }}
+  </select>
+{{ _below(hint, error, errorHtml) }}
+{%- endmacro %}
+
+{# A switch. The label follows the box rather than heading it, which is what a
+   tick beside a sentence reads as, and `admin-check` is the class the
+   stylesheet lays that pair out with. #}
+{% macro checkbox(
+  id,
+  name,
+  label,
+  checked=false,
+  value='1',
+  hint='',
+  error='',
+  errorHtml='',
+  disabled=false
+) %}
+  <p class="admin-check">
+    <input id="{{ id }}" name="{{ name }}" type="checkbox" value="{{ value }}"{% if checked %} checked{% endif %}{% if disabled %} disabled{% endif %} />
+    <label for="{{ id }}">{{ label | safe }}</label>
+  </p>
+{{ _below(hint, error, errorHtml) }}
+{%- endmacro %}

package/admin/layouts/base.njk

@@ -19,7 +19,7 @@
     {% block chrome %}{% endblock %}
     {% block main %}
       <main class="admin-plain">
-        {% include "layouts/_flash.njk" %}
+        {% include "components/flash.njk" %}
         {% block content %}{% endblock %}
       </main>
     {% endblock %}

package/admin/layouts/settings-page.njk

@@ -0,0 +1,26 @@
+{# What every settings page is: a heading, one form that saves the fields that
+   page carries, and whatever panels sit under it. A page fills in the two
+   blocks; nothing about the chrome is written six times. #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}{{ settingsLabel }} settings{% endblock %}
+
+{% block content %}
+  <h1>{{ settingsLabel }}</h1>
+
+  {% if hasProblems %}
+    <p class="admin-error">Nothing was saved. Fix the fields marked below and try again.</p>
+  {% endif %}
+
+  <form class="admin-settings" method="post" action="{{ settingsUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+    {% block settingsFields %}{% endblock %}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Save settings</button>
+    </p>
+  </form>
+
+  {% block settingsPanels %}{% endblock %}
+{% endblock %}

package/admin/layouts/shell.njk

@@ -19,18 +19,32 @@
 
 {% block main %}
   <div class="admin-shell">
+    {# WordPress classic: a section is a heading over its screens. The heading
+       goes to the first of them, the open section shows the rest, and the one
+       you are on carries aria-current. Nothing here is scripted — the server
+       already knows which section is open, so expanding one is a page the
+       browser asks for rather than a class JavaScript toggles. #}
     <nav class="admin-nav" aria-label="Sections">
       <ul>
         {% for item in navigation %}
-          <li>
-            <a href="{{ item.url }}"{% if item.section == section %} aria-current="page"{% endif %}>{{ item.label }}</a>
+          <li class="admin-nav-section{% if item.open %} admin-nav-open{% endif %}">
+            <a class="admin-nav-heading" href="{{ item.url }}">{{ item.label }}</a>
+            {% if item.open %}
+              <ul class="admin-nav-children">
+                {% for entry in item.children %}
+                  <li>
+                    <a href="{{ entry.url }}"{% if entry.current %} aria-current="page"{% endif %}>{{ entry.label }}</a>
+                  </li>
+                {% endfor %}
+              </ul>
+            {% endif %}
           </li>
         {% endfor %}
       </ul>
     </nav>
 
     <main class="admin-main">
-      {% include "layouts/_flash.njk" %}
+      {% include "components/flash.njk" %}
       {% block content %}{% endblock %}
     </main>
   </div>

package/admin/pages/account/forgot.njk

@@ -0,0 +1,47 @@
+{# /admin/forgot: ask for a link to set a new password.
+
+   The page has three states and one rule. The rule is that a request never
+   says whether the name matched: the answer below is the same sentence
+   whoever asked and whatever was found, so this form cannot be used to find
+   out which accounts a site has. #}
+{% extends "layouts/base.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Forgotten password{% endblock %}
+
+{% block content %}
+  <h1>Forgotten password</h1>
+
+  {% if not configured %}
+    {# No provider and no credential, so there is nothing to send a link with.
+       Saying so beats a form that quietly does nothing. #}
+    <p>This site cannot send email, so a password cannot be reset from here.</p>
+    <p>
+      Whoever runs the server can add an account from a shell with
+      <code>geekity user add &lt;username&gt;</code>, and sign in with that to
+      change anything else. Turning on a mail provider under
+      <strong>Settings &rarr; Email</strong> makes this page work.
+    </p>
+    <p><a href="{{ loginUrl }}">Back to the login form</a></p>
+  {% elif sent %}
+    <p>{{ answer }}</p>
+    <p><a href="{{ loginUrl }}">Back to the login form</a></p>
+  {% else %}
+    <p>Type your username or your email address, and a link to set a new password is sent to the address on your account.</p>
+
+    {% if error %}
+      <p class="error">{{ error }}</p>
+    {% endif %}
+
+    <form method="post" action="{{ forgotUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+      {{ field.text('identifier', fields.identifier, 'Username or email address',
+           autocomplete='username', required=true, autofocus=true) }}
+
+      <button type="submit">Send a reset link</button>
+    </form>
+
+    <p class="admin-hint"><a href="{{ loginUrl }}">Back to the login form</a></p>
+  {% endif %}
+{% endblock %}

package/admin/pages/account/login.njk

@@ -0,0 +1,26 @@
+{% extends "layouts/base.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Log in{% endblock %}
+
+{% block content %}
+  <h1>Log in</h1>
+
+  {% if error %}
+    <p class="error">{{ error }}</p>
+  {% endif %}
+
+  <form method="post" action="{{ loginUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+    {{ field.text('username', 'username', 'Username', username,
+         autocomplete='username', required=true, autofocus=true) }}
+
+    {{ field.password('password', 'password', 'Password',
+         autocomplete='current-password', required=true) }}
+
+    <button type="submit">Log in</button>
+  </form>
+
+  <p class="admin-hint"><a href="{{ forgotUrl }}">Forgotten your password?</a></p>
+{% endblock %}

package/admin/pages/account/reset.njk

@@ -0,0 +1,38 @@
+{# /admin/reset: set a new password, for somebody holding a link.
+
+   The token travels from the link's query string into a hidden field, so the
+   form posts to a plain URL and the token stays out of the browser's history
+   for the POST. Nothing typed here is ever echoed back: both fields are
+   passwords. #}
+{% extends "layouts/base.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Set a new password{% endblock %}
+
+{% block content %}
+  <h1>Set a new password</h1>
+
+  {% if invalid %}
+    <p class="error">That link is no longer valid. A reset link lasts an hour and works once, and asking for a new password again invalidates the old one.</p>
+    <p><a href="{{ forgotUrl }}">Ask for another one</a></p>
+  {% else %}
+    {% if problem %}
+      <p class="error">{{ problem }}</p>
+    {% endif %}
+
+    <form method="post" action="{{ resetUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+      <input type="hidden" name="{{ fields.token }}" value="{{ token }}" />
+
+      {{ field.password('password', fields.password, 'New password',
+           autocomplete='new-password', required=true, autofocus=true) }}
+
+      {{ field.password('password_confirmation', fields.passwordConfirmation,
+           'Repeat the password', autocomplete='new-password', required=true) }}
+
+      <p class="admin-hint">Every browser signed in as you is signed out, and this link stops working.</p>
+
+      <button type="submit">Set the password</button>
+    </form>
+  {% endif %}
+{% endblock %}

package/admin/pages/account/setup.njk

@@ -0,0 +1,28 @@
+{% extends "layouts/base.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Set up{% endblock %}
+
+{% block content %}
+  <h1>Create the first admin</h1>
+  <p>Nobody can sign in to this site yet. Pick a username and a password.</p>
+
+  {% if error %}
+    <p class="error">{{ error }}</p>
+  {% endif %}
+
+  <form method="post" action="{{ setupUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+    {{ field.text('username', 'username', 'Username', username,
+         autocomplete='username', required=true, autofocus=true) }}
+
+    {{ field.password('password', 'password', 'Password',
+         autocomplete='new-password', required=true) }}
+
+    {{ field.password('password_confirmation', 'password_confirmation', 'Repeat the password',
+         autocomplete='new-password', required=true) }}
+
+    <button type="submit">Create admin</button>
+  </form>
+{% endblock %}

package/admin/pages/appearance/themes.njk

@@ -0,0 +1,69 @@
+{# /admin/appearance/themes: the theme the site is wearing, everything else on
+   disk, and the one button that changes it (decision-15).
+
+   The packaged theme comes first because it is the floor the others are laid
+   over rather than a peer in the list: a site theme ships what it changes and
+   inherits the rest. The themes directory is read on every request, so a theme
+   copied in over ssh or pulled down by git is here without a restart. #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}{{ heading }}{% endblock %}
+
+{% block content %}
+  <h1>{{ heading }}</h1>
+
+  <ul class="admin-themes">
+    {% for theme in themes %}
+      <li class="admin-theme{% if theme.active %} admin-theme-current{% endif %}">
+        <h2>{{ theme.name }}</h2>
+
+        {% if theme.active %}
+          <p class="admin-status admin-status-active">Active</p>
+        {% endif %}
+
+        {% if theme.description %}
+          <p class="admin-theme-description">{{ theme.description }}</p>
+        {% endif %}
+
+        <p class="admin-theme-id">
+          <code>{{ theme.id }}</code>
+          {% if theme.packaged %}
+            <span class="admin-status">the theme this package ships</span>
+          {% endif %}
+        </p>
+
+        {% if not theme.active %}
+          <form method="post" action="{{ themesUrl }}">
+            <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+            <input type="hidden" name="{{ fields.theme }}" value="{{ theme.value }}" />
+            <button type="submit">Activate</button>
+          </form>
+        {% endif %}
+      </li>
+    {% endfor %}
+  </ul>
+
+  {% if unreadable.length %}
+    <h2>Not themes</h2>
+
+    <p class="admin-hint">
+      These are directories in <code>{{ themesDir }}</code> that were meant to be themes and are
+      not. They are listed rather than skipped, so a typo in a <code>theme.json</code> is something
+      you can see rather than a theme that quietly stopped appearing. None of them can be
+      activated.
+    </p>
+
+    <ul class="admin-broken-themes">
+      {% for entry in unreadable %}
+        <li class="admin-broken-theme"><code>{{ entry.id }}</code> — {{ entry.reason }}</li>
+      {% endfor %}
+    </ul>
+  {% endif %}
+
+  <p class="admin-hint">
+    A theme is a directory in <code>{{ themesDir }}</code> with a <code>theme.json</code> in it,
+    named by that directory. It is laid over the theme this package ships, one file at a time, so
+    it need only carry what it changes. Activating one writes the directory name into
+    <code>content/_data/site.json</code>; the next request is already wearing it.
+  </p>
+{% endblock %}

package/admin/pages/comments/all.njk

@@ -0,0 +1,133 @@
+{# /admin/comments: the moderation queue. There is no email in this milestone,
+   so this screen is the notification — which is why the dashboard carries the
+   pending count and why this list opens on Pending.
+
+   Every button is a form of its own, so the whole screen works with
+   JavaScript switched off. #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}{{ heading }}{% endblock %}
+
+{% block content %}
+  <h1>{{ heading }}</h1>
+
+  <nav class="admin-filters" aria-label="Comment status">
+    <ul>
+      {% for tab in tabs %}
+        <li>
+          <a href="{{ tab.url }}"{% if tab.current %} aria-current="page"{% endif %}>
+            {{ tab.label }} ({{ tab.count }})
+          </a>
+        </li>
+      {% endfor %}
+    </ul>
+  </nav>
+
+  {% if rows.length == 0 %}
+    <p class="admin-empty">Nothing here.</p>
+  {% else %}
+    <ul class="admin-comments">
+      {% for row in rows %}
+        <li class="admin-comment">
+          <div class="admin-comment-meta">
+            <span class="admin-comment-author">{{ row.author }}</span>
+            {% if row.url %}
+              <a class="admin-comment-site" href="{{ row.url }}" rel="nofollow ugc noopener noreferrer">{{ row.url }}</a>
+            {% endif %}
+            {% if row.email %}
+              <span class="admin-comment-email">{{ row.email }}</span>
+            {% endif %}
+            <span class="admin-status admin-status-{{ row.status }}">{{ row.status }}</span>
+            {% if row.source != 'comment' %}
+              <span class="admin-status">{{ row.source }}</span>
+            {% endif %}
+          </div>
+
+          <p class="admin-comment-where">
+            <time>{{ row.submitted }}</time>
+            on
+            {% if row.editUrl %}
+              <a href="{{ row.editUrl }}">{{ row.post }}</a>
+            {% else %}
+              {{ row.post }}
+            {% endif %}
+            {% if row.postUrl %}
+              &middot; <a href="{{ row.postUrl }}#comment-{{ row.id }}">View</a>
+            {% endif %}
+            {% if row.inReplyTo %}
+              &middot; a reply to another comment
+            {% endif %}
+            {% if row.address %}
+              &middot; <code title="A salted hash of the address it came from">{{ row.address }}</code>
+            {% endif %}
+          </p>
+
+          <div class="admin-comment-body">{{ row.html | safe }}</div>
+
+          <div class="admin-actions">
+            {% if row.status != 'approved' %}
+              <form method="post" action="{{ moderateUrl }}">
+                <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+                <input type="hidden" name="{{ fields.id }}" value="{{ row.id }}" />
+                <input type="hidden" name="{{ fields.status }}" value="{{ status }}" />
+                <button type="submit" name="{{ fields.action }}" value="approve">Approve</button>
+              </form>
+            {% endif %}
+
+            {% if row.status != 'spam' %}
+              <form method="post" action="{{ moderateUrl }}">
+                <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+                <input type="hidden" name="{{ fields.id }}" value="{{ row.id }}" />
+                <input type="hidden" name="{{ fields.status }}" value="{{ status }}" />
+                <button type="submit" name="{{ fields.action }}" value="spam">Spam</button>
+              </form>
+            {% endif %}
+
+            <form method="post" action="{{ moderateUrl }}">
+              <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+              <input type="hidden" name="{{ fields.id }}" value="{{ row.id }}" />
+              <input type="hidden" name="{{ fields.status }}" value="{{ status }}" />
+              <button type="submit" name="{{ fields.action }}" value="delete">Delete</button>
+            </form>
+          </div>
+
+          <details class="admin-comment-reply">
+            <summary>Reply</summary>
+            <form method="post" action="{{ replyUrl }}">
+              <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+              <input type="hidden" name="{{ fields.id }}" value="{{ row.id }}" />
+              <input type="hidden" name="{{ fields.status }}" value="{{ status }}" />
+              <label class="admin-visually-hidden" for="reply-{{ loop.index }}">
+                Reply to {{ row.author }}
+              </label>
+              <textarea id="reply-{{ loop.index }}" name="{{ fields.body }}" rows="4" required></textarea>
+              <p class="admin-hint">Markdown, rendered the same way a visitor’s comment is. It is posted approved, under this one.</p>
+              <p class="admin-settings-buttons">
+                <button type="submit">Post reply</button>
+              </p>
+            </form>
+          </details>
+        </li>
+      {% endfor %}
+    </ul>
+
+    {% if previousUrl or nextUrl %}
+      <nav class="admin-pagination" aria-label="Pages">
+        {% if previousUrl %}
+          <a rel="prev" href="{{ previousUrl }}">Newer</a>
+        {% endif %}
+        <span>Page {{ page }} of {{ pages }}</span>
+        {% if nextUrl %}
+          <a rel="next" href="{{ nextUrl }}">Older</a>
+        {% endif %}
+      </nav>
+    {% endif %}
+  {% endif %}
+
+  <p class="admin-hint">
+    Comments live as one JSON file per post under <code>content/_data/comments/</code>, so they
+    are in git beside the posts and an Eleventy build of the same directory shows them. Everything
+    here rewrites that file; the database is only an index of it. Spam is kept rather than deleted,
+    so a mistake can be undone — and so a spam checker can be told when it was wrong.
+  </p>
+{% endblock %}

package/admin/{layouts/dashboard.njk → pages/dashboard/home.njk}

@@ -25,6 +25,14 @@
           <dt>Followers</dt>
           <dd><a href="{{ federationUrl }}">{{ followers }}</a></dd>
         </div>
+        <div>
+          <dt>Comments waiting</dt>
+          <dd><a href="{{ commentsUrl }}?status=pending">{{ pendingComments }}</a></dd>
+        </div>
+        <div>
+          <dt>Messages unread</dt>
+          <dd><a href="{{ messagesUrl }}">{{ unreadMessages }}</a></dd>
+        </div>
       </dl>
     </section>
 
@@ -59,20 +67,5 @@
         <p class="admin-empty">Nothing written yet.</p>
       {% endif %}
     </section>
-
-    <section class="admin-panel">
-      <h2>Quick draft</h2>
-      <form method="post" action="{{ quickDraftUrl }}">
-        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
-
-        <label for="quick-draft-title">Title</label>
-        <input id="quick-draft-title" name="title" type="text" required />
-
-        <label for="quick-draft-body">Body</label>
-        <textarea id="quick-draft-body" name="body" rows="6"></textarea>
-
-        <button type="submit">Save draft</button>
-      </form>
-    </section>
   </div>
 {% endblock %}

package/admin/{layouts/document-conflict.njk → pages/documents/conflict.njk}

@@ -39,6 +39,7 @@
     <input type="hidden" name="permalink" value="{{ form.permalink }}" />
     <input type="hidden" name="date" value="{{ form.date }}" />
     <input type="hidden" name="tags" value="{{ form.tags }}" />
+    <input type="hidden" name="categories" value="{{ form.categories }}" />
     <input type="hidden" name="description" value="{{ form.description }}" />
     {% if form.draft %}
       <input type="hidden" name="draft" value="1" />