ChatComment 0.1.0__tar.gz → 0.1.1__tar.gz

{chatcomment-0.1.0 → chatcomment-0.1.1}/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.1
+
+- 留言区仅显示一个齿轮入口；本人填写管理员邮箱后由服务器确认显示，不按昵称判断、不下发管理员邮箱。
+- 提供邮箱/密码验证页，网关可在现有账号校验后授予短时管理权限；管理 API 仍由服务器角色授权。
+
 ## 0.1.0
 
 - Python/SQLite 留言服务、无依赖 JS 组件及同源管理界面。

{chatcomment-0.1.0 → chatcomment-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.1.0
+Version: 0.1.1
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -43,4 +43,6 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。设置按钮只在服务器返回 `can_manage=true` 时显示。网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称或伪造角色 header 获得权限，因为缺少服务器 Bearer token。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+
+网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.0 → chatcomment-0.1.1}/README.md

@@ -24,4 +24,6 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。设置按钮只在服务器返回 `can_manage=true` 时显示。网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称或伪造角色 header 获得权限，因为缺少服务器 Bearer token。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+
+网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.0 → chatcomment-0.1.1}/docs/api.md

@@ -12,6 +12,8 @@ All request bodies are JSON (maximum 32 KiB). Site IDs are explicit, origins are
 | GET | `/api/sites/{id}/comments?page=/path/` | Approved comments, never emails |
 | POST | `/api/sites/{id}/comments` | `{page,content,nickname?,email?,website?}` |
 | GET | `/admin` | Gateway-protected management UI |
+| GET | `/login` | Owner reauthentication form; gateway owns password verification |
+| POST | `/api/admin/entry` | `{email}` → `{show_settings}`; trusted owner only, hint never authorizes management |
 | GET | `/board?site={id}&page=/path/` | Standalone widget host; apply the private-site gateway to this HTML too |
 | GET/POST | `/api/admin/sites` | List/register sites |
 | POST | `/api/sites/{id}/settings` | Complete settings object |
@@ -25,6 +27,8 @@ Private sites and all admin calls require `Authorization: Bearer <server token>`
 
 Gateway members use `X-ChatComment-Role: reader`; they can read a private site and submit with a verified identity but cannot administer. Only owner requests receive `admin`. A direct bearer API client defaults to admin for compatibility. `/config` returns `can_manage` from this trusted role, and the widget shows the settings link accordingly. Private HTML, site read permissions and site-specific authorization remain the gateway's responsibility.
 
+In 0.1.1 the widget additionally requires a successful `/api/admin/entry` hint for the entered email before displaying its single gear. The expected email comes only from `X-ChatComment-Admin-Email` on a trusted server request. Nicknames have no role. The `/login` form posts `{email,password}` to gateway-owned `/api/admin/reauth` with native session CSRF. The gateway must validate the existing account password and owner role, issue its native cookie, and enforce a short-lived management grant on `/admin` and all management API routes. A hint response alone must never grant that access.
+
 Settings example:
 
 ```json

{chatcomment-0.1.0 → chatcomment-0.1.1}/docs/deployment.md

@@ -6,6 +6,8 @@ For a private site, apply the existing site login to **every** API and asset req
 
 The gateway maps its prefix to backend `/`, injects the Bearer token and a verified identity marker, and relays only required response headers. Block unexpected methods and cap body size. A separate public site may explicitly use `site register --public`, but the private site setting must remain private. Site IDs are not secrets and never replace access control.
 
+For the single-gear workflow, inject the configured owner email only as the server-side `X-ChatComment-Admin-Email` header. Implement `/api/admin/reauth` at the gateway: check current session and CSRF, verify the supplied email/password through the existing account backend, verify its owner role, rotate the native session cookie and create a short-lived grant bound to that session. Protect `/admin`, `/api/admin/sites` and site settings/admin/export/moderate routes with this grant. Reject readers even if they type the owner email or forge role headers. Keep email hints, private read access and management grants distinct. The included login HTML stores no credentials and delegates password verification entirely to this gateway contract.
+
 Consistent live backup:
 
 ```sh

{chatcomment-0.1.0 → chatcomment-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ChatComment"
-version = "0.1.0"
+version = "0.1.1"
 description = "Embeddable comments with a Python server, SQLite storage and a small JavaScript widget."
 readme = "README.md"
 requires-python = ">=3.10"

{chatcomment-0.1.0 → chatcomment-0.1.1}/src/ChatComment.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.1.0
+Version: 0.1.1
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -43,4 +43,6 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。设置按钮只在服务器返回 `can_manage=true` 时显示。网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称或伪造角色 header 获得权限，因为缺少服务器 Bearer token。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+
+网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.1.0 → chatcomment-0.1.1}/src/ChatComment.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/chatcomment/server.py
 src/chatcomment/store.py
 src/chatcomment/static/admin.html
 src/chatcomment/static/board.html
+src/chatcomment/static/login.html
 src/chatcomment/static/widget.css
 src/chatcomment/static/widget.js
 tests/cli-tests/test_cli.py

{chatcomment-0.1.0 → chatcomment-0.1.1}/src/chatcomment/__init__.py

@@ -1,5 +1,5 @@
 """Reusable comments storage and HTTP service."""
-__version__ = "0.1.0"
+__version__ = "0.1.1"
 
 from .store import Store
 

{chatcomment-0.1.0 → chatcomment-0.1.1}/src/chatcomment/server.py

@@ -11,7 +11,7 @@ import time
 from urllib.parse import parse_qs, urlsplit
 
 from . import __version__
-from .store import Invalid, Store, origin
+from .store import Invalid, Store, origin, text
 
 
 def make_handler(store: Store, admin_token: str):
@@ -83,6 +83,16 @@ def make_handler(store: Store, admin_token: str):
                 if not manager:
                     raise PermissionError('请通过已登录管理网关访问')
                 return self.send(200, files('chatcomment').joinpath('static/admin.html').read_bytes(), 'text/html; charset=utf-8')
+            if p.path == '/login' and self.command in {'GET','HEAD'}:
+                if not manager:
+                    raise PermissionError('请通过已登录管理网关访问')
+                return self.send(200, files('chatcomment').joinpath('static/login.html').read_bytes(), 'text/html; charset=utf-8')
+            if p.path == '/api/admin/entry' and self.command == 'POST':
+                if not manager:
+                    raise PermissionError('需要本人账号')
+                entered = text(self.payload().get('email',''),'邮箱',500)
+                expected = self.headers.get('X-ChatComment-Admin-Email','')
+                return self.send(200, {'show_settings':bool(expected) and secrets.compare_digest(entered.casefold().encode(),expected.strip().casefold().encode())})
             if p.path == '/api/admin/sites':
                 if not manager:
                     raise PermissionError('需要管理权限')

chatcomment-0.1.1/src/chatcomment/static/login.html

@@ -0,0 +1,17 @@
+<!doctype html><html lang="zh-CN"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>ChatComment · 验证管理身份</title>
+<style>body{margin:0;background:#f0f4f0;font:16px/1.6 system-ui,sans-serif;color:#243d30}main{max-width:420px;margin:10vh auto;padding:28px;background:white;border:1px solid #d7e0d9;border-radius:14px}label{display:block;margin:18px 0}input{display:block;box-sizing:border-box;width:100%;font:inherit;padding:10px;border:1px solid #c7d4ca;border-radius:7px}button{font:inherit;background:#2c6550;color:white;border:0;border-radius:7px;padding:10px 18px;cursor:pointer}a{color:#2d6953}p{font-size:14px;color:#617366}</style>
+<main><a id="back">← 返回页面</a><h1>验证管理身份</h1><p>使用既有站点账号的邮箱和密码。只有本人账号可管理此留言区。</p><form><label>邮箱<input name="email" type="email" autocomplete="username" required></label><label>密码<input name="password" type="password" autocomplete="current-password" required></label><button>验证并进入设置</button><p role="status" aria-live="polite"></p></form></main>
+<script>
+(() => {
+ const base=location.pathname.replace(/\/login\/?$/,'');
+ document.getElementById('back').href=base.replace(/\/comments$/,'/')||'/';
+ const form=document.querySelector('form'),status=document.querySelector('[role=status]');
+ form.addEventListener('submit',async e=>{e.preventDefault();const button=form.querySelector('button');button.disabled=true;status.textContent='正在验证…';
+  try{const session=await fetch('/api/session',{credentials:'same-origin'});if(!session.ok)throw new Error('请先登录站点');const csrf=(await session.json()).csrf_token;
+   const response=await fetch(base+'/api/admin/reauth',{method:'POST',credentials:'same-origin',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf},body:JSON.stringify(Object.fromEntries(new FormData(form)))});
+   const result=await response.json();if(!response.ok)throw new Error(result.error||'邮箱或密码不正确');
+   form.elements.password.value='';location.assign(base+'/admin');
+  }catch(error){status.textContent=error.message;form.elements.password.value='';button.disabled=false;}
+ });
+})();
+</script></html>

{chatcomment-0.1.0 → chatcomment-0.1.1}/src/chatcomment/static/widget.js

@@ -12,13 +12,13 @@
     const link = document.createElement('link');
     link.rel = 'stylesheet'; link.href = `${api}/widget.css`; root.append(link);
     const box = document.createElement('section'); box.className = 'chatcomment'; root.append(box);
-    box.innerHTML = `<header><div><p class="cc-eyebrow">ChatComment</p><h2>留下想法</h2></div><a class="cc-admin" hidden>设置与管理</a></header>
+    box.innerHTML = `<header><div><p class="cc-eyebrow">ChatComment</p><h2>留下想法</h2></div><a class="cc-admin" aria-label="留言设置" title="留言设置" hidden>⚙</a></header>
       <p class="cc-note">留言保存在服务器，刷新后仍可查看。邮箱仅管理员可见。</p>
       <form><div class="cc-fields"></div><label>留言 <span>必填</span><textarea name="content" required maxlength="5000" rows="4" placeholder="有什么想法，或者值得接着做的事？"></textarea></label>
       <div class="cc-actions"><button type="submit">提交留言</button><button type="button" class="cc-refresh">刷新留言</button><span class="cc-status" role="status" aria-live="polite"></span></div></form>
       <div class="cc-list" aria-live="polite"></div><button type="button" class="cc-more" hidden>更早的留言</button>`;
     // The API base comes from the deployer's script attribute; never from comments.
-    box.querySelector('.cc-admin').href = `${api}/admin`;
+    box.querySelector('.cc-admin').href = `${api}/login`;
     const status = box.querySelector('.cc-status');
     const list = box.querySelector('.cc-list');
     const form = box.querySelector('form');
@@ -43,7 +43,7 @@
     }
     async function config() {
       const data = await request(`/api/sites/${site}/config`);
-      box.querySelector('.cc-admin').hidden = data.can_manage !== true;
+      const gear = box.querySelector('.cc-admin'); gear.hidden = true;
       const fields = box.querySelector('.cc-fields'); fields.replaceChildren();
       const labels = {nickname:'昵称',email:'邮箱',website:'网址'};
       for (const [name, mode] of Object.entries(data.settings.fields)) {
@@ -55,6 +55,20 @@
         input.type = name === 'email' ? 'email' : name === 'website' ? 'url' : 'text';
         input.maxLength = name === 'nickname' ? 120 : 500;
         label.append(input); fields.append(label);
+        if (name === 'email' && data.can_manage === true) {
+          let timer;
+          input.addEventListener('input', () => {
+            clearTimeout(timer); gear.hidden = true;
+            const value = input.value.trim();
+            if (!value || !input.validity.valid) return;
+            timer = setTimeout(async () => {
+              try {
+                const hint = await request('/api/admin/entry', {email:value});
+                gear.hidden = input.value.trim() !== value || hint.show_settings !== true;
+              } catch (_) { gear.hidden = true; }
+            }, 250);
+          });
+        }
       }
       box.querySelector('.cc-note').textContent = `${data.settings.allow_anonymous?'无需留言账号，可匿名提交。':'需要已验证的站点身份。'}${data.settings.moderation?'留言经审核后显示。':''}邮箱仅管理员可见。`;
     }

{chatcomment-0.1.0 → chatcomment-0.1.1}/tests/code-tests/test_comments.py

@@ -97,6 +97,10 @@ def test_http_private_admin_origins_and_no_header_spoof(http):
     assert http('/api/sites/second/config',trusted=True,extra={'X-ChatComment-Role':'reader'})[2]['can_manage'] is False
     assert http('/api/sites/first/config')[2]['can_manage'] is False
     assert http('/api/sites/first/config',trusted=True)[2]['can_manage'] is True
+    assert http('/api/admin/entry',{'email':'rexwzh@example.invalid'})[0]==403
+    assert http('/api/admin/entry',{'email':'rexwzh@example.invalid'},trusted=True,extra={'X-ChatComment-Role':'reader'})[0]==403
+    assert http('/api/admin/entry',{'email':'other@example.invalid'},trusted=True,extra={'X-ChatComment-Admin-Email':'rexwzh@example.invalid'})[2]['show_settings'] is False
+    assert http('/api/admin/entry',{'email':'RexWzh@example.invalid'},trusted=True,extra={'X-ChatComment-Admin-Email':'rexwzh@example.invalid'})[2]['show_settings'] is True
     assert http('/api/sites/second/settings',{},trusted=True,extra={'X-ChatComment-Role':'reader'})[0]==403
     assert http('/api/admin/sites')[0]==403
     assert http('/api/sites/second/config',identity=True)[0]==403