@geekity/cms 0.3.0 → 0.5.0

package/admin/pages/users/edit.njk

@@ -0,0 +1,239 @@
+{# /admin/users/<id>: everything about one person, a panel at a time.
+
+   The table behind it says who there is; this says what they are. Every box
+   here carries a label the eye can read, because these fields used to sit in
+   a row of that table where a placeholder was the only thing telling them
+   apart — and a placeholder disappears the moment somebody types.
+
+   Four forms rather than one, for the reason there were four before: an email
+   address is private to the site and a profile is the public face, a notice
+   switch is a button and how often it arrives is a select, and a password is
+   about whoever is signed in. Each saves what its own heading is about and
+   lands back here, so a Save always shows its own result. #}
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Edit {{ account.username }}{% endblock %}
+
+{% block content %}
+  <h1>Edit {{ account.username }}{% if account.you %} <span class="admin-status">(you)</span>{% endif %}</h1>
+
+  <p class="admin-hint"><a href="{{ usersUrl }}">Back to all users</a></p>
+
+  <form class="admin-settings" method="post" action="{{ userEmailUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+
+    <h2>Account</h2>
+
+    <p class="admin-field-static">
+      Signs in as <strong>{{ account.username }}</strong>, and writes at
+      <a href="{{ account.archiveUrl }}">{{ account.archiveUrl }}</a>.
+    </p>
+    <p class="admin-hint">
+      A username is not editable: it is the login, the author URL above, and
+      the actor a follower holds. Somebody who needs a different one is a new
+      account.
+    </p>
+    {# The id they were published under somewhere else (TASK-69). Read-only on
+       purpose: it is what the fediverse already holds, and changing it would
+       orphan every follow. #}
+    {% if account.storedActorId %}
+      <p class="admin-hint">
+        Also <code>{{ account.storedActorId }}</code> — what the fediverse knows
+        this user by. Set by the import or by hand in
+        <code>data/users.json</code>, never here.
+      </p>
+    {% endif %}
+
+    {% set emailHint %}
+      {% if mailConfigured %}
+        Optional, and never shown on the public site. It is what a forgotten password is recovered through and where the notices below go. Empty it to stop the site writing to this person at all.
+      {% else %}
+        Optional, and this site sends no mail yet, so nothing will be sent to one. Choose a provider on <a href="{{ adminUrl }}/settings/email">Settings &rsaquo; Email</a> to turn password recovery on.
+      {% endif %}
+    {% endset %}
+    {{ field.text('user-email', fields.email, 'Email address', account.email,
+         type='email', autocomplete='email', hint=emailHint) }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Save email address</button>
+    </p>
+  </form>
+
+  {# The public face of this person (TASK-67). Anybody's, not only your own:
+     there is one role, so an admin who has just added a colleague can put a
+     name and a line about them on their archive without waiting for them to
+     sign in. After decision-14 these same fields are what their ActivityPub
+     actor carries, which is why they live beside the account rather than in
+     the site settings — and why saving them tells their followers. #}
+  <form class="admin-settings" method="post" action="{{ userProfileUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+    <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+
+    <h2>Profile</h2>
+
+    <p class="admin-hint">
+      A profile is public. Nothing in it is required — a user with no profile
+      still has an archive under their username — and a box left empty is a
+      field they do not have.
+    </p>
+
+    {{ field.text('profile-display-name', fields.displayName, 'Display name',
+         account.profile.displayName,
+         hint='Printed instead of the login: it heads the archive and is the byline under their posts.') }}
+
+    {{ field.textarea('profile-bio', fields.bio, 'Bio', account.profile.bio, rows='4',
+         hint='A line or two about them, shown on the archive under the name.') }}
+
+    {% set avatarHint %}A path such as <code>/uploads/2026/09/me.jpg</code>, or a full URL.{% endset %}
+    {{ field.text('profile-avatar', fields.avatar, 'Avatar', account.profile.avatar,
+         hint=avatarHint) }}
+
+    {{ field.text('profile-job-title', fields.jobTitle, 'Job title', account.profile.jobTitle,
+         hint='What they do, printed beside the name on the archive.') }}
+
+    {{ field.text('profile-location', fields.location, 'Location', account.profile.location,
+         hint='Where they are, as they write it.') }}
+
+    {% set linksHint %}
+      One per line, either <code>Label | https://example.com</code> or a bare
+      URL that labels itself.
+    {% endset %}
+    {{ field.textarea('profile-links', fields.links, 'Links', account.profile.links, rows='4',
+         hint=linksHint) }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Save profile</button>
+    </p>
+  </form>
+
+  {# Only once there is both somewhere to write to and something to write
+     with. These switches decide what is sent to the address above, so without
+     an address, or without a mail provider on Settings > Email, every one of
+     them could be on and the site would still send this person nothing. The
+     lines below say which is missing where the panel would have been, rather
+     than letting it vanish without explanation. #}
+  {% if account.email and mailConfigured %}
+  <section class="admin-settings">
+    <h2>Email {{ account.username }} about</h2>
+
+    <p class="admin-hint">
+      What this site writes to {{ account.username }} at <code>{{ account.email }}</code>.
+    </p>
+
+    {# One form per switch, not one form with a checkbox each: a browser sends
+       no field for an unticked box, so a single form could not tell "turned
+       this off" from "left it alone". Adding a notice is one entry in the
+       registry and no change here. #}
+    {% for notice in account.notifications %}
+      <div class="admin-notice">
+        <h3>{{ notice.label }}</h3>
+        <p class="admin-hint">{{ notice.description }}</p>
+
+        <form class="admin-inline" method="post" action="{{ userNotificationsUrl }}">
+          <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+          <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+          <input type="hidden" name="{{ fields.event }}" value="{{ notice.name }}" />
+          <input type="hidden" name="{{ fields.on }}" value="{% if notice.on %}{% else %}1{% endif %}" />
+          <span class="admin-status">{% if notice.on %}On{% else %}Off{% endif %}</span>
+          <button type="submit">{% if notice.on %}Turn off{% else %}Turn on{% endif %}</button>
+        </form>
+
+        {# And, for a notice the registry says can be batched, how often it
+           should arrive. A second form because a select needs a Save beside
+           it and the switch above is a button; the registry decides which
+           notices get one. #}
+        {% if notice.batched %}
+          <form class="admin-inline" method="post" action="{{ userNotificationModeUrl }}">
+            <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+            <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+            <input type="hidden" name="{{ fields.event }}" value="{{ notice.name }}" />
+            {% call field.select('notice-mode-' + notice.name, fields.mode, 'How often') %}
+              {% for choice in notice.modes %}
+                <option value="{{ choice.value }}"{% if choice.chosen %} selected{% endif %}>{{ choice.label }}</option>
+              {% endfor %}
+            {% endcall %}
+            <button type="submit">Save</button>
+          </form>
+          <p class="admin-hint">
+            On an hourly or a daily digest nothing is sent as they arrive;
+            instead one message a window lists everything still waiting, and
+            no message goes at all when nothing is.
+          </p>
+        {% endif %}
+      </div>
+    {% endfor %}
+  </section>
+  {% else %}
+  <section class="admin-settings">
+    <h2>Email {{ account.username }} about</h2>
+
+    {% if not mailConfigured %}
+      <p class="admin-hint">
+        Nothing, while this site has no mail provider: there is nothing to send
+        with. Choose one on <a href="{{ adminUrl }}/settings/email">Settings
+        &rsaquo; Email</a> and what to send comes back here.
+      </p>
+    {% else %}
+      <p class="admin-hint">
+        Nothing, while the box above is empty: there is nowhere to write to.
+        Give {% if account.you %}yourself{% else %}this account{% endif %} an
+        address and what to send comes back here.
+      </p>
+    {% endif %}
+  </section>
+  {% endif %}
+
+  {# Only on your own page: it asks for the current password, so it is about
+     whoever is signed in and means nothing on somebody else's screen.
+     Resetting a colleague's password from under them is deliberately not
+     offered — a fresh account is what that is for. #}
+  {% if account.you %}
+    <form class="admin-settings" method="post" action="{{ changePasswordUrl }}">
+      <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+      <h2>Change your password</h2>
+
+      {% if passwordProblems.currentPassword or passwordProblems.newPassword %}
+        <p class="admin-error">Your password was not changed. Fix the fields marked below and try again.</p>
+      {% endif %}
+
+      {{ field.password('current-password', fields.currentPassword, 'Current password',
+           error=passwordProblems.currentPassword, autocomplete='current-password',
+           required=true) }}
+
+      {{ field.password('new-password', fields.newPassword, 'New password',
+           error=passwordProblems.newPassword, autocomplete='new-password', required=true) }}
+
+      {{ field.password('new-password-confirmation', fields.newPasswordConfirmation,
+           'New password again', autocomplete='new-password', required=true) }}
+
+      <p class="admin-hint">Every other browser signed in as you is signed out. This one stays.</p>
+
+      <p class="admin-settings-buttons">
+        <button type="submit">Change password</button>
+      </p>
+    </form>
+  {% endif %}
+
+  <section class="admin-settings">
+    <h2>Delete</h2>
+
+    {# Either the button or the reason there is none, never both: the screen
+       does not offer an action it is about to refuse. #}
+    {% if deleteRefusal %}
+      <p class="admin-hint">{{ deleteRefusal }}</p>
+    {% else %}
+      <p class="admin-hint">
+        Deleting {{ account.username }} signs out every browser they are in and
+        cannot be undone. What they have written stays where it is.
+      </p>
+      <form method="post" action="{{ deleteUserUrl }}">
+        <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+        <input type="hidden" name="{{ fields.userId }}" value="{{ account.id }}" />
+        <button type="submit">Delete {{ account.username }}</button>
+      </form>
+    {% endif %}
+  </section>
+{% endblock %}

package/admin/pages/users/list.njk

@@ -0,0 +1,51 @@
+{# /admin/users: who can sign in.
+
+   A listing and nothing else (TASK-97). Every field a user has is edited on
+   that user's own screen, which the Edit link in each row goes to, so no box
+   in this table can be mistaken for another one. Adding somebody is its own
+   screen next door, `new.njk`, because Users > Add new is its own menu entry.
+ #}
+{% extends "layouts/shell.njk" %}
+
+{% block title %}Users{% endblock %}
+
+{% block content %}
+  <h1>Users <a class="admin-button admin-button-small" href="{{ addUserUrl }}">Add new</a></h1>
+
+  <table class="admin-list">
+    <thead>
+      <tr>
+        <th scope="col">Username</th>
+        <th scope="col">Email</th>
+        <th scope="col">Created</th>
+        <th scope="col">Actions</th>
+      </tr>
+    </thead>
+    <tbody>
+      {% for entry in users %}
+        <tr>
+          <td>
+            <a href="{{ entry.editUrl }}">{{ entry.username }}</a>{% if entry.you %} <span class="admin-status">(you)</span>{% endif %}
+          </td>
+          <td>{% if entry.email %}{{ entry.email }}{% else %}<span class="admin-status">None</span>{% endif %}</td>
+          <td>{{ entry.createdAt | date('html') }}</td>
+          {# Edit, then what can be done, then View: the order and the shape
+             `pages/documents/list.njk` uses, down to Edit being a plain link
+             rather than a button. A row here is a row there. #}
+          <td class="admin-actions">
+            <a href="{{ entry.editUrl }}">Edit</a>
+            {% if entry.deletable %}
+              <form method="post" action="{{ deleteUserUrl }}">
+                <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+                <input type="hidden" name="{{ fields.userId }}" value="{{ entry.id }}" />
+                <button type="submit">Delete</button>
+              </form>
+            {% endif %}
+            <a href="{{ entry.archiveUrl }}">View</a>
+          </td>
+        </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+
+{% endblock %}

package/admin/pages/users/new.njk

@@ -0,0 +1,41 @@
+{# /admin/users/new: add somebody who can sign in.
+
+   The other half of what the listing used to hold: one form, the same chrome,
+   and its own menu entry under Users. A refused add comes back here with what
+   was typed still in the boxes, so nothing is retyped to fix one field.
+ #}
+{% extends "layouts/shell.njk" %}
+{% import "components/fields.njk" as field %}
+
+{% block title %}Add new user{% endblock %}
+
+{% block content %}
+  <h1>Add new user</h1>
+
+  <form class="admin-settings" method="post" action="{{ addUserUrl }}">
+    <input type="hidden" name="csrf_token" value="{{ csrfToken }}" />
+
+    {% if addProblems.username or addProblems.password or addProblems.email %}
+      <p class="admin-error">Nobody was added. Fix the fields marked below and try again.</p>
+    {% endif %}
+
+    {{ field.text('add-username', fields.username, 'Username', addForm.username,
+         error=addProblems.username, required=true) }}
+
+    {{ field.text('add-email', fields.email, 'Email <span class="admin-status">(optional)</span>',
+         addForm.email, type='email', autocomplete='email', error=addProblems.email) }}
+
+    {{ field.password('add-password', fields.password, 'Password',
+         error=addProblems.password, autocomplete='new-password') }}
+
+    {{ field.checkbox('add-generate', fields.generate,
+         'Generate one instead, and show it to me once', checked=addForm.generate,
+         hint='A generated password is shown on the next page and nowhere else. Copy it before you leave.') }}
+
+    <p class="admin-settings-buttons">
+      <button type="submit">Add user</button>
+    </p>
+  </form>
+
+  <p class="admin-hint"><a href="{{ usersUrl }}">Back to all users</a></p>
+{% endblock %}