@geekity/cms 0.3.0 → 0.5.0

package/admin/pages/settings/email.njk

@@ -0,0 +1,203 @@
+{# /admin/settings/email: how the site sends mail, and where a message written
+   to it goes. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {% set providerHint %}
+    The key or password each one needs is a credential and is saved below,
+    in <code>data/mail.json</code> rather than in <code>site.json</code>.
+  {% endset %}
+  {% call field.select('settings-mail-provider', fields.mailProvider, 'Provider',
+       error=problems.mailProvider, hint=providerHint) %}
+    {% for provider in mailProviders %}
+      <option value="{{ provider }}"{% if form.mailProvider == provider %} selected{% endif %}>
+        {% if provider == 'none' %}None &mdash; this site sends no email{% elif provider == 'brevo' %}Brevo (transactional API){% else %}SMTP{% endif %}
+      </option>
+    {% endfor %}
+  {% endcall %}
+
+  {{ field.text('settings-mail-from-name', fields.mailFromName, 'From name', form.mailFromName,
+       hint='The name on the From line. Empty uses the site title.') }}
+
+  {% set fromAddressHint %}
+    Providers only send from an address they have verified, so this should be
+    one you own. Empty falls back to <code>no-reply@</code> at the site's host.
+  {% endset %}
+  {{ field.text('settings-mail-from-address', fields.mailFromAddress, 'From address',
+       form.mailFromAddress, error=problems.mailFromAddress, hint=fromAddressHint,
+       inputmode='email') }}
+
+  {{ field.text('settings-mail-reply-to', fields.mailReplyTo, 'Reply-to', form.mailReplyTo,
+       error=problems.mailReplyTo, inputmode='email',
+       hint='Where a reply goes. Empty replies to the From address.') }}
+
+  {% set contactHint %}
+    Where a message from a page&rsquo;s contact form is sent, with reply-to set to whoever
+    wrote it. Empty writes to the first admin with an email address. It is read when a
+    message arrives and never appears on the public site.
+  {% endset %}
+  {{ field.text('settings-contact-email', fields.contactEmail, 'Contact address',
+       form.contactEmail, error=problems.contactEmail, hint=contactHint, inputmode='email') }}
+{% endblock %}
+
+{% block settingsPanels %}
+  {# The mail credential is its own pair of forms for the reason the Akismet
+     key is: an API key and an SMTP password belong in data/mail.json, not in
+     the public site.json, and a mistyped one must not lose an edit to the
+     From line. #}
+  <section class="admin-settings admin-mail-panel">
+    <h2>Mail credentials</h2>
+
+    <p class="admin-mail-state admin-mail-{{ mailProvider }}">
+      {% if mailConfigured %}
+        <strong>Configured</strong> &mdash; sending through {{ mailProvider }}.
+      {% elif mailProvider == 'none' %}
+        <strong>Not sending</strong> &mdash; no provider is chosen.
+      {% else %}
+        <strong>Not configured</strong> &mdash; {{ mailProvider }} is chosen but has no credential.
+      {% endif %}
+    </p>
+    <p class="admin-hint">{{ mailHint }}</p>
+
+    {# One provider's boxes, never both. A site sending through Brevo has no
+       use for an SMTP port and a site sending through SMTP has none for an API
+       key, and seven boxes where one is wanted is how a screen teaches people
+       to stop reading it.
+
+       The provider branched on is the saved one, from `site.json`, not
+       whatever the select above happens to be showing: that select belongs to
+       the settings form and nothing it shows is true until Save settings is
+       pressed. Saying so is the paragraph below — without it, somebody who
+       picks SMTP, looks straight down for a Host box and finds an API key
+       would reasonably call this broken. Doing it the other way round would
+       take JavaScript, and no other admin screen needs any. #}
+    {% if mailProvider == 'none' %}
+      <p class="admin-hint">
+        No provider is <em>saved</em>, so there is no credential to give and no
+        box here to give it in. Choose one under <strong>Provider</strong> above
+        and press <strong>Save settings</strong> &mdash; picking it in the select
+        alone changes nothing &mdash; and the boxes it needs appear here.
+      </p>
+    {% else %}
+      <p class="admin-hint">
+        These are the boxes
+        <strong>{% if mailProvider == 'brevo' %}Brevo{% else %}SMTP{% endif %}</strong>
+        needs, and they follow the provider this site has <em>saved</em> &mdash; not
+        the one the select above is showing. Change <strong>Provider</strong> and
+        press <strong>Save settings</strong> first, and the boxes here change with it.
+      </p>
+
+      <form method="post" action="{{ mailUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+        {% if mailProvider == 'brevo' %}
+          <h3>Brevo</h3>
+          {% if mailBrevoPresent %}
+            <p class="admin-hint">A key is stored, ending {{ mailBrevoKeyHint }}.</p>
+            {% set brevoPlaceholder = 'Leave blank to keep the stored key' %}
+          {% else %}
+            {% set brevoPlaceholder = 'Paste your key' %}
+          {% endif %}
+          {{ field.password('settings-mail-brevo-key', mailFields.brevoApiKey, 'API key',
+               autocomplete='off', spellcheck='false', placeholder=brevoPlaceholder) }}
+        {% else %}
+          <h3>SMTP</h3>
+          {{ field.text('settings-mail-smtp-host', mailFields.smtpHost, 'Host', mailSmtp.host,
+               autocomplete='off') }}
+
+          {{ field.text('settings-mail-smtp-port', mailFields.smtpPort, 'Port',
+               mailSmtp.port if mailSmtp else 587, inputmode='numeric') }}
+
+          {# Its own box with the sentence beside it, like every other switch in
+             the admin. It used to be a label wrapped round the tick in a class the
+             stylesheet has never heard of, so it was the one switch here that
+             rendered unstyled. #}
+          {{ field.checkbox('settings-mail-smtp-secure', mailFields.smtpSecure,
+               'TLS from the first byte (port 465)', checked=mailSmtp.secure,
+               hint='Leave this off for port 587, which upgrades with STARTTLS.') }}
+
+          {{ field.text('settings-mail-smtp-user', mailFields.smtpUser, 'Username', mailSmtp.user,
+               autocomplete='off') }}
+
+          {% if mailSmtp.hasPassword %}
+            {% set smtpPlaceholder = 'Leave blank to keep the stored password' %}
+          {% else %}
+            {% set smtpPlaceholder = 'The SMTP password' %}
+          {% endif %}
+          {{ field.password('settings-mail-smtp-password', mailFields.smtpPassword, 'Password',
+               autocomplete='off', spellcheck='false', placeholder=smtpPlaceholder) }}
+        {% endif %}
+
+        <p class="admin-settings-buttons">
+          <button type="submit">Save credentials</button>
+        </p>
+      </form>
+    {% endif %}
+
+    {# A credential kept for a provider that is not the chosen one. Its boxes
+       are gone but the secret is still on disk, and this panel is the only
+       place in the admin that says so, so it is reported in words instead.
+       Hiding a stored API key would be the screen lying about what the site
+       holds. #}
+    {% set brevoStoredElsewhere = mailBrevoPresent and mailProvider != 'brevo' %}
+    {% set smtpStoredElsewhere = mailSmtpPresent and mailProvider != 'smtp' %}
+    {% if brevoStoredElsewhere or smtpStoredElsewhere %}
+      <h3>Also stored</h3>
+
+      {% if brevoStoredElsewhere %}
+        <p class="admin-field-static">
+          A <strong>Brevo</strong> API key, ending {{ mailBrevoKeyHint }}.
+        </p>
+      {% endif %}
+      {% if smtpStoredElsewhere %}
+        <p class="admin-field-static">
+          An <strong>SMTP</strong> server:
+          {% if mailSmtp.user %}{{ mailSmtp.user }} at {% endif %}{{ mailSmtp.host }}
+          port {{ mailSmtp.port }}{% if mailSmtp.hasPassword %}, with a password{% endif %}.
+        </p>
+      {% endif %}
+
+      <p class="admin-hint">
+        Kept in <code>data/mail.json</code> and used by nothing while
+        {% if mailProvider == 'none' %}no provider is chosen{% else %}{% if mailProvider == 'brevo' %}Brevo{% else %}SMTP{% endif %} is the chosen provider{% endif %}.
+        Choose that provider above to edit it, or press
+        <strong>Remove credentials</strong> to forget every credential this site
+        holds, this one included.
+      </p>
+    {% endif %}
+
+    {% if mailBrevoPresent or mailSmtpPresent %}
+      <form method="post" action="{{ mailUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        <input type="hidden" name="{{ mailFields.action }}" value="{{ mailRemove }}" />
+        <p class="admin-settings-buttons">
+          <button type="submit">Remove credentials</button>
+        </p>
+      </form>
+    {% endif %}
+
+    {# Only where there is something to send with, the way the notice switches
+       on a user's page are drawn only where there is both a provider and an
+       address (TASK-97). A Send test email button on a site with no credential
+       can do one thing, which is say it did nothing. #}
+    {% if mailConfigured %}
+      <form method="post" action="{{ mailTestUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        {{ field.text('settings-mail-test-to', mailTestFields.to, 'Send a test message to', '',
+             inputmode='email', placeholder='you@example.com') }}
+        <p class="admin-settings-buttons">
+          <button type="submit">Send test email</button>
+        </p>
+      </form>
+    {% endif %}
+
+    <p class="admin-hint">
+      Neither the API key nor the SMTP password is ever printed back into this
+      page. Both are kept in <code>data/mail.json</code> at mode
+      <code>0600</code>, beside the password hashes and the actor's private
+      keys, and never in <code>site.json</code>, which is public and in git.
+      Leaving a secret blank keeps the one already stored.
+    </p>
+  </section>
+{% endblock %}

package/admin/pages/settings/general.njk

@@ -0,0 +1,29 @@
+{# /admin/settings: what the site is called, where it lives, and its picture. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {{ field.text('settings-title', fields.title, 'Title', form.title,
+       error=problems.title, required=true, autofocus=true) }}
+
+  {{ field.text('settings-tagline', fields.tagline, 'Tagline', form.tagline,
+       hint='One line, shown under the title and used as the feed subtitle.') }}
+
+  {{ field.text('settings-author', fields.author, 'Author', form.author,
+       hint='The name on the feeds.') }}
+
+  {% set baseUrlHint %}In effect: <code>{{ baseUrlInEffect }}</code>. {{ baseUrlNote }}{% endset %}
+  {{ field.text('settings-base-url', fields.baseUrl, 'Base URL', form.baseUrl,
+       error=problems.baseUrl, hint=baseUrlHint, inputmode='url',
+       readonly=baseUrlOverridden, disabled=baseUrlOverridden) }}
+
+  {% set timezoneHint %}An IANA name, such as <code>Europe/London</code> or <code>UTC</code>.{% endset %}
+  {{ field.text('settings-timezone', fields.timezone, 'Time zone', form.timezone,
+       error=problems.timezone, hint=timezoneHint, required=true) }}
+
+  {% set languageHint %}A BCP 47 tag, such as <code>en</code> or <code>en-GB</code>. It is the page's <code>lang</code> and the feeds' language.{% endset %}
+  {{ field.text('settings-language', fields.language, 'Language', form.language,
+       error=problems.language, hint=languageHint, required=true) }}
+{% endblock %}
+
+{% block settingsPanels %}{% endblock %}

package/admin/pages/settings/permalinks.njk

@@ -0,0 +1,50 @@
+{# /admin/settings/permalinks: the URLs the archives live at, and the ones they
+   used to. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {% set tagBaseHint %}The tag archives live at <code>/{{ form.tagBase }}/{tag}/</code>. One path segment, no slashes.{% endset %}
+  {{ field.text('settings-tag-base', fields.tagBase, 'Tag base', form.tagBase,
+       error=problems.tagBase, hint=tagBaseHint, required=true, autofocus=true) }}
+
+  {% set categoryBaseHint %}The category archives live at <code>/{{ form.categoryBase }}/{name}/</code>.{% endset %}
+  {{ field.text('settings-category-base', fields.categoryBase, 'Category base', form.categoryBase,
+       error=problems.categoryBase, hint=categoryBaseHint, required=true) }}
+{% endblock %}
+
+{% block settingsPanels %}
+  {# The recorded renames are a record of what happened rather than a
+     preference: the taxonomy screens write them as a term is renamed or merged,
+     and this page is where the URLs they are about are decided. #}
+  <section class="admin-settings admin-redirects-panel">
+    <h2>Archive redirects</h2>
+
+    {% if taxonomyRedirects.length %}
+      <table class="admin-list">
+        <thead>
+          <tr><th scope="col">Taxonomy</th><th scope="col">Was</th><th scope="col">Is now</th></tr>
+        </thead>
+        <tbody>
+          {% for redirect in taxonomyRedirects %}
+            <tr>
+              <td>{{ redirect.label }}</td>
+              <td><code>{{ redirect.from }}</code></td>
+              <td><code>{{ redirect.to }}</code></td>
+            </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+      <p class="admin-hint">
+        Every one of these answers with a permanent redirect to the archive the
+        term lives at now, so a link somebody published still arrives.
+      </p>
+    {% else %}
+      <p class="admin-hint">
+        Nothing has moved yet. Renaming or merging a term on the Tags or
+        Categories screen records the archive URL it used to have here, and the
+        site answers that URL with a permanent redirect from then on.
+      </p>
+    {% endif %}
+  </section>
+{% endblock %}

package/admin/pages/settings/reading.njk

@@ -0,0 +1,64 @@
+{# /admin/settings/reading: what a visitor is shown, and who is told when it
+   changes. The site menu was here until TASK-108; it is on /admin/navigation,
+   with every other menu the site holds. #}
+{% extends "layouts/settings-page.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block settingsFields %}
+  {# WordPress's "Your homepage displays": the empty option is Your latest
+     posts, so the choice and the page it needs are one control rather than a
+     radio and a select that can disagree with each other. #}
+  {% set homepageGone %}
+    {% if homepageMissing %}
+      <p class="admin-field-error">
+        The homepage was <code>{{ form.homepage }}</code>, which is no longer published,
+        so the site is showing its latest posts. Publish that page again to have it back,
+        or pick another.
+      </p>
+    {% endif %}
+  {% endset %}
+  {% set homepageHint %}
+    Your latest posts is the archive at <code>/</code>. A page instead is served
+    there, and its own URL redirects to <code>/</code> so there is one front page.
+  {% endset %}
+  {% call field.select('settings-homepage', fields.homepage, 'Your homepage displays',
+       error=problems.homepage, errorHtml=homepageGone, hint=homepageHint, autofocus=true) %}
+    <option value="">Your latest posts</option>
+    {% for page in pageChoices %}
+      <option value="{{ page.slug }}"{% if page.slug == form.homepage %} selected{% endif %}>{{ page.title }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {% set postsPageGone %}
+    {% if postsPageMissing %}
+      <p class="admin-field-error">
+        The posts page was <code>{{ form.postsPage }}</code>, which is no longer published,
+        so the listing has no page of its own.
+      </p>
+    {% endif %}
+  {% endset %}
+  {% set postsPageHint %}
+    Where the posts go once the homepage is a page: this page's URL carries the
+    listing, with its own title and words above it. It needs a homepage first.
+    The feeds stay at <code>/feed/</code> either way.
+  {% endset %}
+  {% call field.select('settings-posts-page', fields.postsPage, 'Posts page',
+       error=problems.postsPage, errorHtml=postsPageGone, hint=postsPageHint) %}
+    <option value="">&mdash; None &mdash;</option>
+    {% for page in pageChoices %}
+      <option value="{{ page.slug }}"{% if page.slug == form.postsPage %} selected{% endif %}>{{ page.title }}</option>
+    {% endfor %}
+  {% endcall %}
+
+  {{ field.text('settings-posts-per-page', fields.postsPerPage, 'Posts per page', form.postsPerPage,
+       error=problems.postsPerPage, inputmode='numeric', required=true,
+       hint='How many posts a listing page holds, on the home page and on every archive.') }}
+
+  {% set notifyHint %}
+    An rssCloud and WebSub server, told whenever a feed changes so subscribers
+    hear at once instead of waiting for their next poll. Every feed advertises
+    it. Leave it empty for none.
+  {% endset %}
+  {{ field.text('settings-notify-server', fields.notifyServer, 'Notify server', form.notifyServer,
+       error=problems.notifyServer, hint=notifyHint, inputmode='url') }}
+{% endblock %}

package/admin/pages/tools/content-index.njk

@@ -0,0 +1,89 @@
+{# /admin/tools: what the derived index holds, and the button that reads every
+   file back into it without stopping the site (TASK-95).
+
+   The counts are the point of the screen as much as the button is: an index
+   that disagrees with the files is not something the site complains about, so
+   the only way to notice is to be shown what it holds. #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}{{ heading }}{% endblock %}
+
+{% block content %}
+  <h1>{{ heading }}</h1>
+
+  <p>
+    Everything in <code>data/geekity.db</code> is a reading of the files under
+    <code>{{ contentDir }}</code>, so it can always be read again. Rebuild it after
+    editing content outside the admin &mdash; over ssh, or with a
+    <code>git pull</code> while the site was down &mdash; or when what is listed here
+    disagrees with what is on disk.
+  </p>
+
+  <table class="admin-list">
+    <thead>
+      <tr>
+        <th scope="col">What the index holds</th>
+        <th scope="col">Count</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <th scope="row">Documents</th>
+        <td>{{ indexed.documents }}</td>
+      </tr>
+      <tr>
+        <th scope="row">Followers</th>
+        <td>{{ indexed.followers }}</td>
+      </tr>
+      <tr>
+        <th scope="row">Inbox activities</th>
+        <td>{{ indexed.activities }}</td>
+      </tr>
+      <tr>
+        <th scope="row">Comments</th>
+        <td>{{ indexed.comments }}</td>
+      </tr>
+    </tbody>
+  </table>
+
+  {% if confirm %}
+    {# Offered rather than done, the way a merge is on the taxonomy screens.
+       The window in the middle is the whole reason: for as long as the scan
+       runs the site answers 404 for documents whose files are perfectly fine,
+       and that is not a thing to discover afterwards. #}
+    <form class="admin-settings" method="post" action="{{ rebuildUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+      <input type="hidden" name="{{ fields.confirm }}" value="1" />
+
+      <h2>Rebuild the index now?</h2>
+
+      <p>
+        The index is emptied and every file read again. Until the scan finishes, this
+        site answers <strong>404</strong> for its posts and pages &mdash; under a second
+        on a small site, longer on a large one &mdash; and it is serving the whole time.
+        Nothing is deleted and nothing is sent: you stay signed in, the delivery log and
+        the relays are kept, and no follower, feed or linked page is told about a post
+        the scan re-indexes.
+      </p>
+
+      <p class="admin-settings-buttons">
+        <button type="submit">Rebuild it</button>
+        <a href="{{ toolsUrl }}">Cancel</a>
+      </p>
+    </form>
+  {% else %}
+    <form class="admin-settings" method="post" action="{{ rebuildUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+      <p class="admin-settings-buttons">
+        <button type="submit">Rebuild the index</button>
+      </p>
+    </form>
+  {% endif %}
+
+  <p class="admin-hint">
+    This runs on the site as it is: nothing is deleted, no connection is swapped and
+    nobody is signed out. <code>geekity rebuild</code> at the command line is the other
+    door, and it is for the one case this screen cannot be: a database this version
+    refuses to open, where there is no site running to press a button in.
+  </p>
+{% endblock %}