@geekity/cms 0.3.0 → 0.5.0

package/themes/default/mail/comment-digest.html.njk

@@ -0,0 +1,37 @@
+{# The HTML twin of the digest. Deliberately plain: a single column and almost
+   no styling is what survives the widest range of mail readers. #}
+<p>{{ total }} comment{% if total != 1 %}s are{% else %} is{% endif %} waiting for you.</p>
+
+{% for item in items %}
+  <hr />
+  <p>
+    {% if item.comment.source == 'webmention' %}A page linked to{% else %}A comment on{% endif %}
+    <a href="{{ item.post.url }}">{{ item.post.title }}</a>
+  </p>
+
+  <p>
+    <strong>{{ item.comment.author }}</strong>{% if item.comment.website %} &mdash; <a href="{{ item.comment.website }}" rel="nofollow ugc">{{ item.comment.website }}</a>{% endif %}<br />
+    {% if item.comment.url %}<a href="{{ item.comment.url }}" rel="nofollow ugc">{{ item.comment.url }}</a><br />{% endif %}
+    <span>{{ item.comment.submitted }}</span>
+  </p>
+
+  <blockquote>
+    {% if item.comment.html %}{{ item.comment.html | safe }}{% else %}<p>(nothing was said &mdash; it is a {{ item.comment.kind }})</p>{% endif %}
+  </blockquote>
+
+  <p>
+    {% for choice in item.actions %}<a href="{{ choice.url }}">{{ choice.label }}</a>{% if not loop.last %} &middot; {% endif %}{% endfor %}
+  </p>
+{% endfor %}
+
+<hr />
+
+{% if more %}<p>And {{ more }} more waiting, which <a href="{{ queueUrl }}">the queue</a> has.</p>{% endif %}
+
+<p>
+  Each link works once and lasts a week. After that, the queue is at
+  <a href="{{ queueUrl }}">{{ queueUrl }}</a>. This is your
+  {% if mode == 'daily' %}daily{% else %}hourly{% endif %} digest; change it on the users screen.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/comment-digest.subject.njk

@@ -0,0 +1,3 @@
+{# The subject of the digest a batched user gets. One line, and it says how
+   many, because the count is the thing that decides whether to open it now. #}
+{{ total }} comment{% if total != 1 %}s{% endif %} waiting on {{ site.title }}

package/themes/default/mail/comment-digest.txt.njk

@@ -0,0 +1,40 @@
+{# The plain text body of the digest: everything still waiting, each item with
+   its own three links. The links are the point of the message, exactly as they
+   are in comment-pending — each carries a signed token, works once, and lands
+   on a page with a button rather than acting on being opened. #}
+{{ total }} comment{% if total != 1 %}s are{% else %} is{% endif %} waiting for you.
+{% for item in items %}
+
+--
+{{ loop.index }}. {% if item.comment.source == 'webmention' %}A page linked to{% else %}A comment on{% endif %} “{{ item.post.title }}”
+{{ item.post.url }}
+
+From: {{ item.comment.author }}
+{% if item.comment.website %}
+Site: {{ item.comment.website }}
+{% endif %}
+{% if item.comment.url %}
+Page: {{ item.comment.url }}
+{% endif %}
+When: {{ item.comment.submitted }}
+
+{{ item.comment.text | trim if item.comment.text | trim else '(nothing was said — it is a ' + item.comment.kind + ')' }}
+
+{% for choice in item.actions %}
+{{ choice.label }}: {{ choice.url }}
+{% endfor %}
+{% endfor %}
+
+--
+{% if more %}
+And {{ more }} more waiting, which the queue has:
+{{ queueUrl }}
+
+{% endif %}
+Each link works once and lasts a week. After that, the queue is at
+{{ queueUrl }}. This is your {% if mode == 'daily' %}daily{% else %}hourly{% endif %} digest;
+you can change that on the users screen.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/comment-pending.html.njk

@@ -0,0 +1,27 @@
+{# The HTML twin of the moderation notice. Deliberately plain: a single column
+   and almost no styling is what survives the widest range of mail readers. #}
+<p>
+  {% if comment.source == 'webmention' %}A page has linked to{% else %}Somebody has commented on{% endif %}
+  <a href="{{ post.url }}">{{ post.title }}</a> and it is waiting for you.
+</p>
+
+<p>
+  <strong>{{ comment.author }}</strong>{% if comment.website %} &mdash; <a href="{{ comment.website }}" rel="nofollow ugc">{{ comment.website }}</a>{% endif %}<br />
+  {% if comment.url %}<a href="{{ comment.url }}" rel="nofollow ugc">{{ comment.url }}</a><br />{% endif %}
+  <span>{{ comment.submitted }}</span>
+</p>
+
+<blockquote>
+  {% if comment.html %}{{ comment.html | safe }}{% else %}<p>(nothing was said &mdash; it is a {{ comment.kind }})</p>{% endif %}
+</blockquote>
+
+<p>
+  {% for choice in actions %}<a href="{{ choice.url }}">{{ choice.label }}</a>{% if not loop.last %} &middot; {% endif %}{% endfor %}
+</p>
+
+<p>
+  Each link works once and lasts a week. After that, the queue is at
+  <a href="{{ queueUrl }}">{{ queueUrl }}</a>.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/comment-pending.subject.njk

@@ -0,0 +1,2 @@
+{# The subject of the message a comment waiting for a moderator sends. One line. #}
+{% if comment.source == 'webmention' %}New webmention{% else %}New comment{% endif %} on “{{ post.title }}”

package/themes/default/mail/comment-pending.txt.njk

@@ -0,0 +1,24 @@
+{# The plain text body of the moderation notice. The three links are the point
+   of the whole message: each carries a signed token, works once, and lands on
+   a page with a button rather than acting on being opened, so that a mail
+   scanner following links cannot moderate this site. #}
+{% if comment.source == 'webmention' %}A page has linked to{% else %}Somebody has commented on{% endif %} “{{ post.title }}” and it is waiting for you.
+
+{{ post.url }}
+
+From: {{ comment.author }}{% if comment.website %}
+Site: {{ comment.website }}{% endif %}{% if comment.url %}
+Page: {{ comment.url }}{% endif %}
+When: {{ comment.submitted }}
+
+{{ comment.text | trim if comment.text | trim else '(nothing was said — it is a ' + comment.kind + ')' }}
+
+--
+{% for choice in actions %}{{ choice.label }}: {{ choice.url }}
+{% endfor %}
+Each link works once and lasts a week. After that, the queue is at
+{{ queueUrl }}.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/comment-reply.html.njk

@@ -0,0 +1,21 @@
+{# The HTML twin of the reply notice. Deliberately plain, like the rest. #}
+<p>
+  <strong>{{ reply.author }}</strong> has replied to your comment on
+  <a href="{{ post.url }}">{{ post.title }}</a>.
+</p>
+
+<blockquote>{{ reply.html | safe }}</blockquote>
+
+<p><a href="{{ reply.url }}">Read it on the page</a></p>
+
+<p>You wrote:</p>
+
+<blockquote>{{ comment.html | safe }}</blockquote>
+
+<p>
+  You asked to hear about replies when you commented.
+  <a href="{{ unsubscribeUrl }}">Stop these messages</a> &mdash; your comment stays
+  where it is.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/comment-reply.subject.njk

@@ -0,0 +1,2 @@
+{# The subject of the message a reply to somebody's comment sends. One line. #}
+{{ reply.author }} replied to you on “{{ post.title }}”

package/themes/default/mail/comment-reply.txt.njk

@@ -0,0 +1,22 @@
+{# The plain text body of the reply notice. It goes only when the reply has
+   been approved, and only to somebody who ticked the box when they commented.
+   The unsubscribe link is signed, needs no login, and stops every message of
+   this kind to this address. #}
+{{ reply.author }} has replied to your comment on “{{ post.title }}”.
+
+{{ reply.url }}
+
+{{ reply.text | trim }}
+
+You wrote:
+
+{{ comment.text | trim }}
+
+--
+You asked to hear about replies when you commented. To stop, open
+{{ unsubscribeUrl }}
+and press the button. Your comment stays where it is.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/contact-message.html.njk

@@ -0,0 +1,24 @@
+{# The HTML twin of a contact message. Deliberately plain: a single column and
+   almost no styling is what survives the widest range of mail readers. The
+   message itself is printed rather than rendered — it is plain text, and
+   nothing a stranger typed is turned into markup here. #}
+<p>
+  <strong>{{ from.name }}</strong> &lt;<a href="mailto:{{ from.email }}">{{ from.email }}</a>&gt;
+  wrote to you from <a href="{{ page.url }}">{{ page.title }}</a>.
+</p>
+
+<p>
+  <span>{{ message.received }}</span>
+  {% if message.subject %}<br /><strong>{{ message.subject }}</strong>{% endif %}
+</p>
+
+<blockquote>
+  <p style="white-space: pre-wrap;">{{ message.text }}</p>
+</blockquote>
+
+<p>
+  Reply to this message and it goes straight back to {{ from.email }}.
+  Every message is kept at <a href="{{ messagesUrl }}">{{ messagesUrl }}</a>.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/contact-message.subject.njk

@@ -0,0 +1,5 @@
+{# The subject of a message from the contact form. One line.
+
+   The sender's own subject when they gave one, because that is what the person
+   reading their mail wants to see in a list; their name when they did not. #}
+{% if message.subject %}{{ message.subject }}{% else %}A message from {{ from.name }}{% endif %}

package/themes/default/mail/contact-message.txt.njk

@@ -0,0 +1,20 @@
+{# The plain text body of a message from the contact form.
+
+   Reply-to is the sender, so answering this is a Reply in whatever reads it.
+   The message is quoted as it was typed: it is plain text and is never
+   rendered as anything else. #}
+{{ from.name }} <{{ from.email }}> wrote to you from {{ page.title }}.
+
+{{ page.url }}
+When: {{ message.received }}
+{% if message.subject %}Subject: {{ message.subject }}
+{% endif %}
+{{ message.text }}
+
+--
+Reply to this message and it goes straight back to {{ from.email }}.
+Every message is kept at {{ messagesUrl }}.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/password-changed.html.njk

@@ -0,0 +1,18 @@
+{# The HTML twin of the confirmation. No link back in, on purpose. #}
+<p>Hello {{ username }},</p>
+
+<p>
+  The password for <strong>{{ username }}</strong> on {{ site.title }} has just
+  been set through a reset link.{% if signedOut %} Every browser that was signed in as {{ username }} was signed out.{% endif %}
+</p>
+
+<p>If that was you, there is nothing to do.</p>
+
+<p>
+  If it was not, somebody has your email and your account. Sign in at
+  <a href="{{ baseUrl }}/admin/login">{{ baseUrl }}/admin/login</a> with the new
+  password if you have it, and ask whoever runs this site to look at the account
+  if you do not.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/password-changed.subject.njk

@@ -0,0 +1,2 @@
+{# The subject of the message that goes out once a password has been set. #}
+Your password on {{ site.title }} was changed

package/themes/default/mail/password-changed.txt.njk

@@ -0,0 +1,17 @@
+{# The plain text body of the confirmation. It carries no link and no token:
+   it is a notice, and a notice that could let somebody in would be a second
+   reset link nobody asked for. #}
+Hello {{ username }},
+
+The password for {{ username }} on {{ site.title }} has just been set through a
+reset link.{% if signedOut %} Every browser that was signed in as {{ username }} was signed out.{% endif %}
+
+If that was you, there is nothing to do.
+
+If it was not, somebody has your email and your account. Sign in at
+{{ baseUrl }}/admin/login with the new password if you have it, and ask whoever
+runs this site to look at the account if you do not.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/password-reset.html.njk

@@ -0,0 +1,22 @@
+{# The HTML twin of the password reset message. Deliberately plain: a single
+   column and no styling is what survives the widest range of mail readers. #}
+<p>Hello {{ username }},</p>
+
+<p>
+  Somebody asked to set a new password for <strong>{{ username }}</strong> on
+  {{ site.title }}. If it was you, open this link:
+</p>
+
+<p><a href="{{ resetUrl }}">{{ resetUrl }}</a></p>
+
+<p>
+  It lasts {{ expiresInHours }} hour{% if expiresInHours != 1 %}s{% endif %} and works once. Once you have used it,
+  every browser signed in as {{ username }} is signed out.
+</p>
+
+<p>
+  If it was not you, nothing has happened and you can ignore this message. Your
+  password has not changed, and nobody can change it without this link.
+</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/password-reset.subject.njk

@@ -0,0 +1,2 @@
+{# The subject of the message a Forgot password request sends. One line. #}
+Set a new password for {{ site.title }}

package/themes/default/mail/password-reset.txt.njk

@@ -0,0 +1,18 @@
+{# The plain text body of the password reset message. The link is the secret:
+   it is the whole of what proves the reader owns this address. #}
+Hello {{ username }},
+
+Somebody asked to set a new password for {{ username }} on {{ site.title }}.
+If it was you, open this link:
+
+{{ resetUrl }}
+
+It lasts {{ expiresInHours }} hour{% if expiresInHours != 1 %}s{% endif %} and works once. Once you have used it, every
+browser signed in as {{ username }} is signed out.
+
+If it was not you, nothing has happened and you can ignore this message. Your
+password has not changed, and nobody can change it without this link.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/mail/test.html.njk

@@ -0,0 +1,14 @@
+{# The HTML twin of the test message. Deliberately plain: inline styles and a
+   single column are what survives the widest range of mail readers, and a
+   message this simple has nothing to gain from more. #}
+<p>This is a test message from <strong>{{ site.title }}</strong>.</p>
+
+<p>
+  If you are reading it, <a href="{{ baseUrl }}">{{ baseUrl }}</a> can send
+  email, and the password resets, moderation notices and contact messages that
+  go through the same service will arrive as well.
+</p>
+
+<p>Nothing was sent to anybody else, and nothing about this message was stored.</p>
+
+<p>&mdash; {{ site.title }}</p>

package/themes/default/mail/test.subject.njk

@@ -0,0 +1,2 @@
+{# The subject of the Send test email button on /admin/settings. One line. #}
+Test message from {{ site.title }}

package/themes/default/mail/test.txt.njk

@@ -0,0 +1,12 @@
+{# The plain text body of the test message. Every message has one of these. #}
+This is a test message from {{ site.title }}.
+
+If you are reading it, {{ baseUrl }} can send email, and the password resets,
+moderation notices and contact messages that go through the same service will
+arrive as well.
+
+Nothing was sent to anybody else, and nothing about this message was stored.
+
+--
+{{ site.title }}
+{{ baseUrl }}

package/themes/default/partials/archive.njk

@@ -0,0 +1,27 @@
+{#
+  Everything the site has published, month by month: the source design's
+  essays page (decision-16, TASK-85).
+
+  `archiveMonths` is on the context only when a page's front matter says
+  `archive: true`, so including this is the whole of it. Each month is a
+  heading over an `ol.list-none` of links, newest month first and newest post
+  first inside it; which month a post belongs to is the CMS's answer rather
+  than this file's, because a date is an instant and the month it falls in
+  depends on the site's timezone (decision-11).
+
+  No dates and no excerpts: the page is a way of finding one piece of writing
+  among hundreds, and a summary under each of them would make it a listing
+  rather than an index.
+#}
+{% if archiveMonths.length %}
+<section class="archive">
+  {% for group in archiveMonths %}
+  <h2>{{ group.month }}</h2>
+  <ol class="list-none">
+    {% for entry in group.posts %}
+    <li><a href="{{ entry.url | url }}"><span>{{ entry.title }}</span></a></li>
+    {% endfor %}
+  </ol>
+  {% endfor %}
+</section>
+{% endif %}

package/themes/default/partials/bio.njk

@@ -0,0 +1,71 @@
+{#
+  Who the page in front of the reader is by: the `p-author h-card` the source
+  design puts in an entry's footer (decision-16, TASK-83).
+
+  It replaces `partials/byline.njk`, which printed a name in a meta line. This
+  is the whole credit — a round photo, "Written by" linked to their archive
+  with `rel="author me"`, what they do, where they are, what they wrote about
+  themselves and the links they call their own.
+
+  The person and only the person (TASK-105). The site menu used to be printed
+  here as well, because the design had no header navigation; it is in
+  `header.global-header` on every page now, so this card says nothing about
+  the site and a reader looking for the way around never has to find the bio
+  first.
+
+  Set `bioAuthor` before including it and nothing renders when that is absent:
+
+    {% set bioAuthor = author %}
+    {% include "partials/bio.njk" %}
+
+  `bioAuthor` is one of the profile objects the context carries — `author` on a
+  post, `siteAuthor` on a page, the archive's person on an author archive — so
+  what a reader sees and what `partials/jsonld.njk` says come from one record
+  and cannot drift. Every field but `name` is optional: a profile with nothing
+  in it prints a name and nothing else, and a name this site has no account for
+  is printed unlinked, because the file still said somebody wrote this.
+
+  `bioLead` is what the line opens with, "Written by" unless a layout says
+  otherwise. An author archive sets "Posts by", because the card there heads a
+  list of somebody's writing rather than crediting one piece of it.
+
+  The `p-note` and the `rel="me"` links are printed wherever the card is, which
+  is what `bioProfile` used to ask for on an author archive alone. An entry
+  left that switch unset because the page footer carried the site's identity
+  links; it carries nobody's now, so somebody's links belong under what they
+  wrote rather than one page further on.
+#}
+{% if bioAuthor %}
+<div class="bio p-author h-card">
+  {%- if bioAuthor.avatar %}
+  <div class="bio-avatar">
+    <img class="u-photo" src="{{ bioAuthor.avatar | url }}" alt="{{ bioAuthor.name }}" width="50" height="50">
+  </div>
+  {%- endif %}
+
+  <div>
+    <p>
+      {{ bioLead | default("Written by") }}
+      {%- if bioAuthor.url %}
+      <a class="u-url p-name" rel="author me" href="{{ bioAuthor.url | url }}">{{ bioAuthor.name }}</a>
+      {%- else %}
+      <strong class="p-name">{{ bioAuthor.name }}</strong>
+      {%- endif %}
+      {%- if bioAuthor.jobTitle %}, a <span class="p-job-title">{{ bioAuthor.jobTitle }}</span>{% endif %}
+      {%- if bioAuthor.location %} from <span class="p-locality">{{ bioAuthor.location }}</span>{% endif %}.
+    </p>
+
+    {%- if bioAuthor.bio %}
+    <p class="bio-note p-note">{{ bioAuthor.bio }}</p>
+    {%- endif %}
+
+    {%- if bioAuthor.links.length %}
+    <ul class="hlist bio-links">
+      {%- for link in bioAuthor.links %}
+      <li><a class="u-url" rel="me" href="{{ link.href }}">{{ link.label }}</a></li>
+      {%- endfor %}
+    </ul>
+    {%- endif %}
+  </div>
+</div>
+{% endif %}

package/themes/default/partials/comment-form.njk

@@ -0,0 +1,137 @@
+{#
+  The form under a post that is still taking comments.
+
+  `commentForm` is on the context only when the post is open — the site switch,
+  the closing window and the post's own `comments:` front matter all agree
+  before it gets here — so a layout asks `{% if commentForm %}` and nothing
+  else. A site replaces this whole section with a
+  `partials/comment-form.njk` of its own in the theme it wears; the shape it is
+  handed is documented in the theme README under "The comment form".
+
+  `comment-respond` and `comment-reply-title` are the source design's names for
+  a form under a post and its heading (decision-16), and the stylesheet styles
+  every label, field and button through them — so the contact form wears the
+  same class rather than repeating the rules.
+
+  It draws two forms. For a stranger: the name, email and website boxes, the
+  honeypot and the loaded-at stamp. For somebody signed in to this site's
+  admin — `commentForm.signedInAs` — none of those, because the site already
+  knows all three and a session is better evidence than a honeypot, and a
+  hidden CSRF token instead, because this form posts under somebody's name.
+  A theme that replaces this partial has to draw both.
+
+  It works with JavaScript switched off, and there is no script on it.
+#}
+<section class="comment-respond" id="respond">
+  <h2 class="comment-reply-title">Leave a comment</h2>
+
+  {% if commentNotice %}
+  <p class="comment-notice" role="status">{{ commentNotice }}</p>
+  {% endif %}
+
+  {% if commentForm.error %}
+  <p class="comment-error" role="alert">{{ commentForm.error }}</p>
+  {% endif %}
+
+  <form method="post" action="{{ commentForm.action }}">
+    <input type="hidden" name="{{ commentForm.fields.post }}" value="{{ commentForm.post }}" />
+    {#
+      What this comment answers. `commentReplyTo` is the `?reply_to=` on the
+      URL, which a Reply link put there and the CMS has already checked names
+      an approved comment on this very post; otherwise it is whatever a refused
+      submission carried.
+    #}
+    {% set replyTo = commentReplyTo if commentReplyTo else commentForm.values.inReplyTo %}
+    <input type="hidden" name="{{ commentForm.fields.inReplyTo }}" value="{{ replyTo }}" />
+
+    {% if commentReplyingTo %}
+    <p class="comment-replying-to">
+      Replying to {{ commentReplyingTo }}.
+      <a href="{{ page.url }}#respond">Comment on the post instead</a>
+    </p>
+    {% endif %}
+
+    {% if commentForm.signedInAs %}
+    {#
+      Signed in to this site. The comment is attributed from the account, so
+      there is nothing to type and nothing to get wrong; the token is what
+      stops a page on another site posting under this name without them
+      knowing.
+    #}
+    <input type="hidden" name="{{ commentForm.fields.csrf }}" value="{{ commentForm.csrfToken }}" />
+
+    <p class="comment-signed-in">
+      Commenting as <a href="{{ commentForm.signedInAs.url }}">{{ commentForm.signedInAs.name }}</a>.
+    </p>
+    {% else %}
+    {#
+      When this form was drawn, which is what the minimum submit time is
+      measured against. A signed-in form carries none: a session says more
+      about whether this is a person than a stopwatch does.
+    #}
+    <input type="hidden" name="{{ commentForm.fields.loaded }}" value="{{ commentForm.loaded }}" />
+
+    {#
+      The honeypot. Hidden from sight and from assistive technology, out of the
+      tab order, and told not to autofill: a person never sees it and never
+      fills it in, so anything that does is not a person.
+    #}
+    <div class="comment-trap" aria-hidden="true">
+      <label for="comment-website">Website</label>
+      <input id="comment-website" name="{{ commentForm.fields.trap }}" type="text" tabindex="-1" autocomplete="off" value="" />
+    </div>
+
+    <p class="comment-field">
+      <label for="comment-name">Name</label>
+      <input id="comment-name" name="{{ commentForm.fields.name }}" type="text" value="{{ commentForm.values.name }}" maxlength="{{ commentForm.nameLength }}" autocomplete="name" required />
+      {% if commentForm.problems.name %}
+      <span class="comment-field-error">{{ commentForm.problems.name }}</span>
+      {% endif %}
+    </p>
+
+    <p class="comment-field">
+      <label for="comment-email">Email <span class="comment-optional">(optional, never shown)</span></label>
+      <input id="comment-email" name="{{ commentForm.fields.email }}" type="email" value="{{ commentForm.values.email }}" autocomplete="email" />
+      {% if commentForm.problems.email %}
+      <span class="comment-field-error">{{ commentForm.problems.email }}</span>
+      {% endif %}
+    </p>
+
+    <p class="comment-field">
+      <label for="comment-url">Your site <span class="comment-optional">(optional)</span></label>
+      <input id="comment-url" name="{{ commentForm.fields.url }}" type="text" inputmode="url" value="{{ commentForm.values.url }}" autocomplete="url" />
+      {% if commentForm.problems.url %}
+      <span class="comment-field-error">{{ commentForm.problems.url }}</span>
+      {% endif %}
+    </p>
+    {% endif %}
+
+    <p class="comment-field">
+      <label for="comment-body">Comment</label>
+      <textarea id="comment-body" name="{{ commentForm.fields.body }}" rows="6" maxlength="{{ commentForm.bodyLength }}" required>{{ commentForm.values.body }}</textarea>
+      {% if commentForm.problems.body %}
+      <span class="comment-field-error">{{ commentForm.problems.body }}</span>
+      {% endif %}
+      <span class="comment-hint">Markdown works. Links are marked <code>nofollow ugc</code>; HTML is not.</span>
+    </p>
+
+    {#
+      "Tell me about replies". Only on a site that can actually send mail —
+      `notifiable` is false otherwise — because a box that promised a message
+      nothing would ever send would be a lie on a form. The address is the one
+      typed above — or the account's, for somebody signed in — is never shown
+      anywhere, and every message it sends carries a one-click unsubscribe
+      link.
+    #}
+    {% if commentForm.notifiable %}
+    <p class="comment-check">
+      <input id="comment-notify" name="{{ commentForm.fields.notify }}" type="checkbox" value="1"{% if commentForm.values.notify %} checked{% endif %} />
+      <label for="comment-notify">Email me when somebody replies to this</label>
+    </p>
+    {% endif %}
+
+    <p class="form-submit">
+      <button type="submit">Post comment</button>
+    </p>
+  </form>
+</section>