ChatComment 0.2.0__tar.gz → 0.2.2__tar.gz

{chatcomment-0.2.0 → chatcomment-0.2.2}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.2
+
+- `Store.set_visibility`、`site visibility --public/--private` 和站点 visibility API 可切换既有站点公开/私有，只改 private，不重建站点或覆盖留言/设置。
+- 签名模式的 visibility API 要求真实已认证的站点 owner 与写 CSRF；字段设置、审核和导出仍须密码再认证。公开访客只获 read/comment，不获邮箱齿轮或管理权限。
+- 签名匿名访客也受每站点/可信会话 10 次每分钟的提交预算限制；旧公开模式保留每来源 IP 预算，内存桶数量有界。
+- 公开访客无需账号即可提交，但仍受来源、页面、匿名开关、字段必填及审核规则约束；注册默认私有保持兼容。
+
+## 0.2.1
+
+- `--require-existing-db` 在 Store 初始化之前验证既有 SQLite 完整性、必要表/字段和可读性，拒绝空文件、损坏或错误 schema。
+- 只读源文件并在私有稳定快照上校验，保留活跃 WAL 支持，不在挂载目录创建 SQLite 辅助文件；允许完整 schema 的零留言数据库。
+
 ## 0.2.0
 
 - 平台中立的 `AccessContext` / `SiteAccess` API，复用 ChatLogin 主体并显式检查每站 read/comment/manage/owner；管理 grant 按 session 和站点区分。

{chatcomment-0.2.0 → chatcomment-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.2.0
+Version: 0.2.2
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -42,10 +42,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.0 → chatcomment-0.2.2}/README.md

@@ -22,10 +22,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.0 → chatcomment-0.2.2}/docs/api.md

@@ -1,6 +1,6 @@
 # Commands and APIs
 
-`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `site allow-origin`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `allow_origin`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service. Platform APIs `AccessContext`, `SiteAccess`, `sign_context`, `verify_context` are described in [platform.md](platform.md).
+`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `site allow-origin`, `site visibility`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `set_visibility`, `allow_origin`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service. Platform APIs `AccessContext`, `SiteAccess`, `sign_context`, `verify_context` are described in [platform.md](platform.md).
 
 All request bodies are JSON (maximum 32 KiB). Site IDs are explicit, origins are exact and page paths must be pre-registered; query strings and hashes do not create new comment streams.
 
@@ -19,6 +19,7 @@ Platform deployments use `serve --gateway-key-env NAME`, optionally `--session-e
 | GET | `/board?site={id}&page=/path/` | Standalone widget host; apply the private-site gateway to this HTML too |
 | GET/POST | `/api/admin/sites` | List/register sites |
 | POST | `/api/sites/{id}/settings` | Complete settings object |
+| POST | `/api/sites/{id}/visibility` | `{"private":false}` (or true); authenticated site owner plus write CSRF in platform mode |
 | GET | `/api/sites/{id}/admin?page=/path/` | All states with private fields |
 | POST | `/api/sites/{id}/moderate` | `{id,status:approved|pending|deleted}` |
 | GET | `/api/sites/{id}/export?page=/path/` | Admin data, paginated |
@@ -38,3 +39,7 @@ Settings example:
 ```
 
 Hidden fields are discarded. Email/URL formats, required fields and 1–5000 character plain text content are checked server-side. Browser output uses `textContent`; no comment HTML or third-party avatars are executed.
+
+Visibility changes update only the existing `sites.private` value. They preserve every comment column/state, origin, page and field setting; unknown sites and non-boolean values are rejected. Registration remains private by default. The local operator must explicitly choose `site visibility SITE --public` or `--private`. The platform API requires a live authenticated site owner and verified write CSRF; a delegated manager, viewer or anonymous visitor cannot change this owner policy. Unlike field settings/moderation/export, this publishing-policy action does not require a temporary password management grant. Public site visibility and `allow_anonymous` are separate: both public visibility and anonymous submission permission are needed for a guest post.
+
+Signed public guest submissions are limited to ten attempts/minute/site/verified guest-session identifier per process. The gateway supplies that opaque identifier in its signed context and must enforce its own visitor/abuse limits; client identity headers cannot choose it. Raw legacy public traffic retains the per-IP limit. Limiter state stays in bounded process memory and is not written to the comments database.

{chatcomment-0.2.0 → chatcomment-0.2.2}/docs/deployment.md

@@ -4,7 +4,7 @@ Install the built wheel into a versioned virtual environment. Run the service as
 
 For a private site, apply the existing site login to **every** API and asset request under the integration prefix. For writes, validate the existing session's CSRF token before proxying. The widget supports `data-csrf-endpoint="/api/session"`, which fetches a native `csrf_token` just before a write; it does not store credentials. The management UI also uses this native endpoint. Other session systems can provide this minimal same-origin contract or host a custom admin client.
 
-The gateway maps its prefix to backend `/`, injects the Bearer token and a verified identity marker, and relays only required response headers. Block unexpected methods and cap body size. A separate public site may explicitly use `site register --public`, but the private site setting must remain private. Site IDs are not secrets and never replace access control.
+The gateway maps its prefix to backend `/`, injects the Bearer token and a verified identity marker, and relays only required response headers. Block unexpected methods and cap body size. A public site may explicitly use `site register --public`. Change an existing site's policy with `site visibility SITE --public` or `--private`; take a consistent backup and verify that only the private flag changed. Do not re-register an existing ID or restore an old database to change visibility. Site IDs are not secrets and never replace access control.
 
 For the single-gear workflow, inject the configured owner email only as the server-side `X-ChatComment-Admin-Email` header. Implement `/api/admin/reauth` at the gateway: check current session and CSRF, verify the supplied email/password through the existing account backend, verify its owner role, rotate the native session cookie and create a short-lived grant bound to that session. Protect `/admin`, `/api/admin/sites` and site settings/admin/export/moderate routes with this grant. Reject readers even if they type the owner email or forge role headers. Keep email hints, private read access and management grants distinct. The included login HTML stores no credentials and delegates password verification entirely to this gateway contract.
 

{chatcomment-0.2.0 → chatcomment-0.2.2}/docs/platform.md

@@ -21,6 +21,13 @@ on the direct native application domain, require a signed context. `/health`
 is the only unsigned route. This mode explicitly rejects legacy token mode;
 browser `Role`, nickname, email and Bearer headers do not grant access.
 
+`--require-existing-db` validates the existing SQLite before `Store` can initialize
+anything: header, integrity, required tables/columns and readable schema. Empty,
+corrupt, unrelated or incompatible files fail closed without source changes.
+It reads a stable private snapshot including WAL rather than creating sidecars
+beside the mounted source; valid schemas with zero comments are accepted.
+The same preflight is available as `validate_existing_database(path)`.
+
 The legacy `--token-file` mode remains for existing deployments during staged
 migration. It must not be used as a multi-user platform authorization shortcut.
 
@@ -63,6 +70,45 @@ or logged. Keep the backend path canonical and preserve raw body bytes.
 Guest contexts must explicitly use `authenticated=False`; they cannot have
 management eligibility and never read private sites, even if mis-scoped.
 
+For a public site, the platform can authorize a visitor without creating an
+account. Verify the current app's public visibility, exact request Origin and a
+server-issued guest CSRF token before signing a write:
+
+```python
+guest = AccessContext(
+    subject='public-visitor', session=verified_guest_session_digest,
+    authenticated=False, csrf_verified=actual_guest_csrf_was_verified,
+    sites={site_id: SiteAccess(read=True, comment=True)},
+)
+```
+
+Never set guest `manage` or `owner`, infer identity from the email form, or mark a
+guest authenticated to bypass private-site checks. The site itself must be
+public and its settings must allow anonymous submissions. Required fields,
+moderation, origin and page registration still apply. Its raw backend routes
+remain signature-only even when the site is public.
+
+The widget's configured session endpoint must return HTTP 200 and `csrf_token`
+for authorized public guests as well as signed-in readers. A host-page loader
+must allow `read=true` instead of requiring `authenticated=true`. Guests receive
+`can_manage=false` and no settings gear. Signed guest posts have a ten/minute
+budget per verified session and site in bounded process memory; gateways should
+also enforce visitor limits before signing to prevent session cycling.
+
+An existing site's policy can be changed with
+`Store.set_visibility(site_id, private=False)` or the local operator command
+`chatcomment --db /data/comments.sqlite3 site visibility SITE --public` (use
+`--private` to reverse it). For delegated management use
+`POST /api/sites/{id}/visibility` with `{"private":false}`: this requires a live
+authenticated owner of the selected site and verified write CSRF. The
+`visibility` permission deliberately uses the owner scope without a temporary
+management grant, so the platform can synchronize an owner's explicit project
+publishing policy without fabricating password reauthentication. Field settings,
+moderation, export and the management UI continue requiring the password grant.
+It changes only the private flag, not origins, pages, settings or comment rows.
+Initial registration remains private unless the integration explicitly opts
+into public access; existing sites never change silently on package upgrade.
+
 For a native in-process adapter, `make_handler(..., context_resolver=callable)`
 accepts the same validated context. The callable receives headers, method,
 downstream path and body bytes. Do not combine it with a gateway key or legacy

{chatcomment-0.2.0 → chatcomment-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ChatComment"
-version = "0.2.0"
+version = "0.2.2"
 description = "Embeddable comments with a Python server, SQLite storage and a small JavaScript widget."
 readme = "README.md"
 requires-python = ">=3.10"

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/ChatComment.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.2.0
+Version: 0.2.2
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -42,10 +42,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/ChatComment.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/chatcomment/access.py
 src/chatcomment/cli.py
 src/chatcomment/server.py
 src/chatcomment/store.py
+src/chatcomment/validation.py
 src/chatcomment/static/admin.html
 src/chatcomment/static/board.html
 src/chatcomment/static/login.html
@@ -27,4 +28,5 @@ tests/cli-tests/test_cli.py
 tests/code-tests/test_access.py
 tests/code-tests/test_chatlogin_adapter.py
 tests/code-tests/test_comments.py
-tests/code-tests/test_platform_http.py
+tests/code-tests/test_platform_http.py
+tests/code-tests/test_validation.py

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/chatcomment/__init__.py

@@ -1,7 +1,8 @@
 """Reusable comments storage and HTTP service."""
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 from .store import Store
 from .access import AccessContext,SiteAccess,sign_context,verify_context
+from .validation import validate_existing_database
 
-__all__ = ["Store", "AccessContext", "SiteAccess", "sign_context", "verify_context", "__version__"]
+__all__ = ["Store", "AccessContext", "SiteAccess", "sign_context", "verify_context", "validate_existing_database", "__version__"]

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/chatcomment/access.py

@@ -69,6 +69,7 @@ class AccessContext:
         scope=self.scope(site_id)
         if action=='read':return scope.read
         if action=='comment':return scope.read and scope.comment
+        if action=='visibility':return self.authenticated and scope.read and scope.owner
         if action=='hint':return self.authenticated and scope.read and scope.owner
         if action=='manage':
             return self.authenticated and scope.read and scope.manage and scope.management_until>(time.time() if now is None else now)

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/chatcomment/cli.py

@@ -7,6 +7,7 @@ import click
 from chatstyle import add_tree_option
 
 from . import Store, __version__
+from .validation import validate_existing_database
 
 
 @click.group(name='chatcomment')
@@ -29,7 +30,7 @@ def main(ctx, db):
 @click.option('--session-endpoint', default='/api/session',show_default=True)
 @click.option('--reauth-endpoint', default=None,help='Platform same-origin management reauthentication endpoint.')
 @click.option('--return-path', default='/',show_default=True)
-@click.option('--require-existing-db',is_flag=True,help='Fail closed if the persistent database mount is missing.')
+@click.option('--require-existing-db',is_flag=True,help='Validate a readable existing ChatComment SQLite database before initialization.')
 @click.pass_context
 def serve(ctx, host, port, token_file,gateway_key_file,gateway_key_env,session_endpoint,reauth_endpoint,return_path,require_existing_db):
     """Serve API, widget assets and the gateway-protected admin page."""
@@ -40,8 +41,11 @@ def serve(ctx, host, port, token_file,gateway_key_file,gateway_key_env,session_e
     key=gateway_key_file.read_text().strip() if gateway_key_file else os.environ.get(gateway_key_env,'') if gateway_key_env else None
     if len(token if token is not None else key or '')<32:
         raise click.ClickException('Server credential must contain at least 32 characters.')
-    if require_existing_db and not ctx.obj['db'].expanduser().is_file():
-        raise click.ClickException('Persistent database mount is missing; refusing to create an empty database.')
+    if require_existing_db:
+        try:
+            validate_existing_database(ctx.obj['db'])
+        except ValueError as exc:
+            raise click.ClickException(str(exc)) from exc
     run(Store(ctx.obj['db']), token=token,gateway_key=key, host=host, port=port,
         session_endpoint=session_endpoint,reauth_endpoint=reauth_endpoint,return_path=return_path)
 
@@ -87,6 +91,20 @@ def allow_origin(ctx,site_id,origin):
     click.echo(json.dumps(result,ensure_ascii=False,indent=2))
 
 
+@site.command(name='visibility')
+@click.argument('site_id')
+@click.option('--public/--private','public',default=None,help='Choose explicitly: public visitors or authenticated private access.')
+@click.pass_context
+def visibility(ctx,site_id,public):
+    """Change an existing site's visibility, preserving comments and settings."""
+    if public is None:raise click.UsageError('Choose --public or --private explicitly.')
+    try:
+        result=Store(ctx.obj['db']).set_visibility(site_id,private=not public)
+    except (ValueError,KeyError) as exc:
+        raise click.ClickException(str(exc)) from exc
+    click.echo(json.dumps(result,ensure_ascii=False,indent=2))
+
+
 @main.command()
 @click.argument('destination', type=click.Path(path_type=Path))
 @click.pass_context

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/chatcomment/server.py

@@ -213,6 +213,11 @@ def make_handler(store: Store, admin_token: str | None = None, *, gateway_key=No
                                           'auth':auth_config})
                 if action == 'settings' and self.command == 'POST':
                     return self.send(200, store.configure(site_id, self.payload()))
+                if action == 'visibility' and self.command == 'POST':
+                    if scoped:
+                        context.require(site_id,'visibility',write=True)
+                    elif not manager:raise PermissionError('需要站点所有者权限')
+                    return self.send(200,store.set_visibility(site_id,private=self.payload().get('private')))
                 if action == 'moderate' and self.command == 'POST':
                     v = self.payload()
                     return self.send(200, store.moderate(site_id, v.get('id'), v.get('status')))
@@ -223,15 +228,22 @@ def make_handler(store: Store, admin_token: str | None = None, *, gateway_key=No
                         context.require(site_id,'comment',write=True)
                     if not trusted and (not request_origin or self.headers.get('X-ChatComment-Request') != '1'):
                         raise PermissionError('留言需通过允许来源的组件提交')
-                    # A process-local bound keeps public submissions within 10/minute/IP.
-                    if not trusted:
+                    signed_guest=bool(scoped and context and not context.authenticated)
+                    if signed_guest and not request_origin:
+                        raise PermissionError('匿名留言需通过允许来源的组件提交')
+                    # Gateways share a source IP. Their verified guest session
+                    # scopes the budget; raw public mode keeps its per-IP budget.
+                    if not trusted or signed_guest:
                         now = time.monotonic()
                         with lock:
-                            if len(attempts) > 10000:
+                            if len(attempts) >= 10000:
                                 for k in list(attempts):
                                     if not attempts[k] or now - attempts[k][-1] > 60:
                                         del attempts[k]
-                            key = (self.client_address[0],site_id)
+                            identity=('gateway-session',context.session) if signed_guest else ('ip',self.client_address[0])
+                            key = (identity,site_id)
+                            if key not in attempts and len(attempts)>=10000:
+                                return self.send(429,{'error':'留言太频繁，请稍后再试'})
                             bucket = attempts[key]
                             while bucket and now - bucket[0] > 60:
                                 bucket.popleft()

{chatcomment-0.2.0 → chatcomment-0.2.2}/src/chatcomment/store.py

@@ -142,6 +142,15 @@ class Store:
             db.execute('UPDATE sites SET settings=? WHERE id=?', (json.dumps(config), site_id))
         return self.site(site_id)
 
+    def set_visibility(self,site_id,*,private):
+        """Change one existing site's visibility without recreating its data."""
+        if type(private) is not bool:
+            raise Invalid('private 必须是布尔值')
+        with self.connect() as db:
+            result=db.execute('UPDATE sites SET private=? WHERE id=?',(int(private),site_id))
+            if result.rowcount!=1:raise KeyError('站点不存在')
+        return self.site(site_id)
+
     def allow_origin(self,site_id,value):
         """Add an approved platform origin without touching fields or comments."""
         approved=origin(value)

chatcomment-0.2.2/src/chatcomment/validation.py

@@ -0,0 +1,98 @@
+"""Read-only preflight for an existing persistent ChatComment database.
+
+SQLite mode=ro may still create WAL sidecars, and immutable=1 ignores a live
+WAL. Validate a stable private copy of the main file and journals instead; never
+open the source with SQLite, change its permissions or initialize its schema.
+"""
+from __future__ import annotations
+
+from contextlib import closing
+import os
+from pathlib import Path
+import shutil
+import sqlite3
+import stat
+import tempfile
+
+from .store import Invalid
+
+_COLUMNS = {
+    'sites': {'id':'TEXT','title':'TEXT','origins':'TEXT','pages':'TEXT','private':'INTEGER','settings':'TEXT'},
+    'comments': {'id':'TEXT','site_id':'TEXT','page_key':'TEXT','nickname':'TEXT','email':'TEXT',
+                 'website':'TEXT','content':'TEXT','status':'TEXT','created_at':'TEXT','authenticated':'INTEGER'},
+}
+
+
+def _files_state(path):
+    state={}
+    for suffix in ['', '-wal', '-journal']:
+        candidate=Path(str(path)+suffix)
+        try:
+            info=candidate.stat()
+        except FileNotFoundError:
+            state[suffix]=None
+            continue
+        if not stat.S_ISREG(info.st_mode):
+            raise Invalid('Persistent database validation failed: database and journals must be regular files.')
+        state[suffix]=(info.st_dev,info.st_ino,info.st_size,info.st_mtime_ns,info.st_ctime_ns)
+    return state
+
+
+def _validate_snapshot(path):
+    with closing(sqlite3.connect(path.as_uri()+'?mode=ro',uri=True,timeout=5)) as db:
+        db.execute('PRAGMA query_only=ON')
+        if db.execute('PRAGMA quick_check').fetchall()!=[('ok',)]:
+            raise Invalid('Persistent database validation failed: SQLite integrity check failed.')
+        tables={row[0] for row in db.execute("SELECT name FROM sqlite_master WHERE type='table'")}
+        for table,required in _COLUMNS.items():
+            if table not in tables:
+                raise Invalid(f'Persistent database validation failed: missing ChatComment table {table}.')
+            columns={row[1]:row for row in db.execute(f'PRAGMA table_info({table})')}
+            if ([name for name,row in columns.items() if row[5]]!=['id'] or
+                    any(name not in columns or columns[name][2].strip().upper()!=kind or
+                        (name!='id' and columns[name][3]!=1) for name,kind in required.items())):
+                raise Invalid(f'Persistent database validation failed: incompatible ChatComment schema for {table}.')
+            db.execute('SELECT '+','.join(required)+' FROM '+table+' LIMIT 1').fetchall()
+        foreign_keys={(row[2],row[3],row[4]) for row in db.execute('PRAGMA foreign_key_list(comments)')}
+        if ('sites','site_id','id') not in foreign_keys:
+            raise Invalid('Persistent database validation failed: missing comment site relationship.')
+
+
+def validate_existing_database(value):
+    """Validate a readable, structurally intact existing database without writes.
+
+    Empty files, unrelated SQLite databases, corrupt/incomplete schema and
+    unreadable files are refused before Store initialization. A valid database
+    may contain zero comments or even zero sites. Normal WAL writes may require
+    a retry to obtain a stable snapshot; persistent changes fail closed.
+    """
+    try:
+        path=Path(value).expanduser().resolve()
+        if not path.is_file():
+            raise Invalid('Persistent database mount is missing; refusing to create an empty database.')
+        with path.open('rb') as source:
+            if source.read(16)!=b'SQLite format 3\x00':
+                raise Invalid('Persistent database validation failed: empty or invalid SQLite file.')
+        for _ in range(3):
+            before=_files_state(path)
+            if before[''] is None:
+                continue
+            with tempfile.TemporaryDirectory(prefix='chatcomment-validate-') as directory:
+                snapshot=Path(directory)/'database.sqlite3'
+                try:
+                    for suffix,info in before.items():
+                        if info is None:
+                            continue
+                        target=Path(str(snapshot)+suffix)
+                        descriptor=os.open(target,os.O_CREAT|os.O_EXCL|os.O_WRONLY,0o600)
+                        with os.fdopen(descriptor,'wb') as destination,Path(str(path)+suffix).open('rb') as source:
+                            shutil.copyfileobj(source,destination)
+                    if _files_state(path)!=before:
+                        continue
+                    _validate_snapshot(snapshot)
+                    return path
+                except FileNotFoundError:
+                    continue
+        raise Invalid('Persistent database validation failed: database changed during the read-only check; retry startup.')
+    except (OSError,sqlite3.Error) as exc:
+        raise Invalid('Persistent database validation failed: database or schema is unreadable or corrupt.') from exc

{chatcomment-0.2.0 → chatcomment-0.2.2}/tests/cli-tests/test_cli.py

@@ -21,3 +21,20 @@ def test_scoped_missing_database_fails_before_creating_file(tmp_path):
     result=CliRunner().invoke(main,['--db',str(path),'serve','--gateway-key-env','TEST_GATEWAY_KEY','--require-existing-db'],env={'TEST_GATEWAY_KEY':'x'*48})
     assert result.exit_code!=0 and 'mount is missing' in result.output
     assert not path.exists()
+
+
+def test_operator_visibility_requires_explicit_choice_and_preserves_site(tmp_path):
+    import json
+    from chatcomment import Store
+    path=tmp_path/'db.sqlite3';store=Store(path)
+    before=store.register('demo',title='Demo',origins=['https://example.com'],pages=['/post/'])
+    row=store.create('demo',{'page':'/post/','content':'keep row'},authenticated=True)
+    r=CliRunner();args=['--db',str(path),'site','visibility','demo']
+    missing=r.invoke(main,args)
+    assert missing.exit_code!=0 and 'Choose --public or --private' in missing.output
+    for option,private in [('--public',False),('--private',True)]:
+        result=r.invoke(main,args+[option]);assert result.exit_code==0,result.output
+        actual=json.loads(result.output)
+        assert actual['private'] is private
+        assert {k:v for k,v in actual.items() if k!='private'}=={k:v for k,v in before.items() if k!='private'}
+        assert store.comments('demo','/post/',admin=True)['comments'][0]['id']==row['id']

{chatcomment-0.2.0 → chatcomment-0.2.2}/tests/code-tests/test_access.py

@@ -35,6 +35,19 @@ def test_chatlogin_global_admin_does_not_grant_sites():
     assert not c.permits('any-site','manage',now=100)
 
 
+def test_visibility_is_live_site_owner_policy_with_csrf_not_management_reauth():
+    c=context()
+    assert c.permits('owned','visibility',now=500)
+    assert not c.permits('owned','manage',now=500)
+    assert not c.permits('viewed','visibility')
+    assert not c.permits('other-managed','visibility')
+    assert not c.permits('ungranted','visibility')
+    guest=AccessContext('guest','guest-digest',sites={'owned':SiteAccess(read=True,comment=True)},authenticated=False)
+    assert not guest.permits('owned','visibility')
+    no_csrf=AccessContext('owner','owner-digest',sites={'owned':SiteAccess(True,True,True,True)})
+    with pytest.raises(PermissionError):no_csrf.require('owned','visibility',write=True)
+
+
 def test_signed_body_method_path_and_ttl():
     headers=sign_context(context(),key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=100)
     c=verify_context(headers,key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=110)

{chatcomment-0.2.0 → chatcomment-0.2.2}/tests/code-tests/test_comments.py

@@ -42,6 +42,24 @@ def test_allow_origin_preserves_all_other_site_fields_and_rows(store):
     assert store.allow_origin('first','https://new-platform.example')==after
 
 
+def test_visibility_changes_only_existing_site_private_flag(store):
+    item=store.create('second',{'page':'/one/','content':'Keep every column','email':'private@example.invalid'},authenticated=True)
+    store.moderate('second',item['id'],'deleted')
+    before=store.site('second');comments=store.comments('second','/one/',admin=True)
+    other=store.site('first');physical=store.path.stat()
+    for private in [False,False,True]:
+        after=store.set_visibility('second',private=private)
+        assert after['private'] is private
+        assert {k:v for k,v in after.items() if k!='private'}=={k:v for k,v in before.items() if k!='private'}
+        assert store.comments('second','/one/',admin=True)==comments
+        assert store.site('first')==other
+        assert store.path.stat().st_ino==physical.st_ino
+    for invalid in [None,0,1,'public',{},[]]:
+        with pytest.raises(Invalid):store.set_visibility('second',private=invalid)
+    with pytest.raises(KeyError):store.set_visibility('missing-site',private=False)
+    assert store.site('second')==before
+
+
 def test_fields_and_anonymous_enforced(store):
     config=store.site('first')['settings']
     config['fields']['email']='required'

{chatcomment-0.2.0 → chatcomment-0.2.2}/tests/code-tests/test_platform_http.py

@@ -23,10 +23,10 @@ def platform(tmp_path):
     server=ThreadingHTTPServer(('127.0.0.1',0),make_handler(store,gateway_key=KEY,
         session_endpoint='/auth/api/session',reauth_endpoint='/extensions/comments/reauth',return_path='/sites/alice-site/'))
     thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
-    def request(path,*,context=None,body=None,signature_path=None,legacy=False):
+    def request(path,*,context=None,body=None,signature_path=None,legacy=False,origin='https://platform.example'):
         raw=json.dumps(body).encode() if body is not None else b''
         method='POST' if body is not None else 'GET'
-        headers={'Origin':'https://platform.example'}
+        headers={'Origin':origin} if origin else {}
         if body is not None:headers['Content-Type']='application/json'
         if context is not None:headers.update(sign_context(context,key=KEY,method=method,path=signature_path or path,body=raw))
         if legacy:headers.update({'Authorization':'Bearer '+KEY,'X-ChatComment-Role':'admin','X-ChatComment-Identity':'alice'})
@@ -101,3 +101,78 @@ def test_scoped_login_configuration_and_registration_denial(platform):
     assert http('/login?site=bob-site',context=owner())[0]==403
     assert http('/api/admin/sites',context=owner(verified=True),body={'id':'bob-site','title':'overwrite','origins':['https://platform.example'],'pages':['/kept/page/']})[0]==403
     with pytest.raises(ValueError):make_handler(store,KEY,gateway_key=KEY)
+
+
+def guest(*,session='guest-session-digest',csrf=True):
+    return AccessContext('public-visitor',session,sites={
+        'alice-site':SiteAccess(read=True,comment=True),'bob-site':SiteAccess(read=True,comment=True)},
+        authenticated=False,csrf_verified=csrf)
+
+
+def test_owner_visibility_transition_public_guest_and_management_boundaries(platform):
+    store,http=platform
+    original=store.site('alice-site')
+    kept=store.create('alice-site',{'page':'/kept/page/','content':'Existing owner comment','email':'kept@example.invalid'},authenticated=True)
+    before=store.comments('alice-site','/kept/page/',admin=True)
+    path='/api/sites/alice-site/visibility'
+    viewer=AccessContext('viewer','viewer-session',sites={'alice-site':SiteAccess(read=True)},csrf_verified=True)
+    deployer=AccessContext('deployer','deployer-session',sites={'alice-site':SiteAccess(read=True,comment=True)},csrf_verified=True)
+    manager=AccessContext('manager','manager-session',sites={
+        'alice-site':SiteAccess(True,True,True,False,time.time()+900)},csrf_verified=True)
+    for context in [owner(verified=True,csrf=False),viewer,deployer,manager]:
+        assert http(path,context=context,body={'private':False})[0]==403
+    assert http(path,context=owner(verified=True),origin='https://malicious.example',body={'private':False})[0]==403
+    assert http(path,context=owner(verified=True),body={'private':'false'})[0]==400
+    code,site=http(path,context=owner(),body={'private':False})
+    assert code==200 and site['private'] is False
+    assert http('/api/sites/alice-site/settings',context=owner(),body=original['settings'])[0]==403
+    assert http('/api/admin/sites',context=owner())[0]==403
+    assert {k:v for k,v in site.items() if k!='private'}=={k:v for k,v in original.items() if k!='private'}
+    assert store.comments('alice-site','/kept/page/',admin=True)==before
+    code,config=http('/api/sites/alice-site/config',context=guest())
+    assert code==200 and config['can_manage'] is False
+    assert http('/api/sites/alice-site/config')[0]==403
+    assert http('/widget.js')[0]==403
+    body={'page':'/kept/page/','content':'Anonymous guest comment'}
+    code,row=http('/api/sites/alice-site/comments',context=guest(),body=body)
+    assert code==201
+    with store.connect() as db:
+        assert db.execute('SELECT authenticated FROM comments WHERE id=?',(row['id'],)).fetchone()[0]==0
+    rows=http('/api/sites/alice-site/comments?page=/kept/page/',context=guest())[1]['comments']
+    assert {r['id'] for r in rows}=={kept['id'],row['id']} and all('email' not in r for r in rows)
+    assert http('/api/sites/alice-site/comments',context=guest(csrf=False),body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),origin='https://malicious.example',body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),origin=None,body=body)[0]==403
+    assert http('/api/admin/entry',context=guest(),body={'site':'alice-site','email':'alice@example.invalid'})[0]==403
+    assert http('/api/admin/sites',context=guest())[0]==403
+    assert http('/login?site=alice-site',context=guest())[0]==403
+    assert http(path,context=guest(),body={'private':True})[0]==403
+    assert http('/api/sites/alice-site/settings',context=guest(),body=original['settings'])[0]==403
+    assert http('/api/sites/bob-site/visibility',context=owner(verified=True),body={'private':False})[0]==403
+    assert http(path,context=owner(),body={'private':True})[0]==200
+    assert store.site('alice-site')==original
+    assert http('/api/sites/alice-site/config',context=guest())[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==403
+
+
+def test_signed_guest_rate_budget_is_by_verified_session_and_site(platform):
+    store,http=platform
+    for site in ['alice-site','bob-site']:store.set_visibility(site,private=False)
+    body={'page':'/kept/page/','content':'Isolated guest rate-limit test'}
+    for _ in range(10):assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==201
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==429
+    assert http('/api/sites/alice-site/comments',context=guest(session='different-verified-session'),body=body)[0]==201
+    assert http('/api/sites/bob-site/comments',context=guest(),body=body)[0]==201
+    assert http('/api/sites/alice-site/comments',context=owner(),body=body)[0]==201
+
+
+def test_public_guest_still_obeys_anonymous_and_field_settings(platform):
+    store,http=platform;store.set_visibility('alice-site',private=False)
+    body={'page':'/kept/page/','content':'Anonymous rules'}
+    config=store.site('alice-site')['settings'];config['allow_anonymous']=False
+    store.configure('alice-site',config)
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==403
+    config['allow_anonymous']=True;config['fields']['nickname']='required'
+    store.configure('alice-site',config)
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==400
+    assert http('/api/sites/alice-site/comments',context=guest(),body={**body,'nickname':'Guest'})[0]==201

chatcomment-0.2.2/tests/code-tests/test_validation.py

@@ -0,0 +1,89 @@
+import os
+from pathlib import Path
+import sqlite3
+from unittest.mock import patch
+
+from click.testing import CliRunner
+import pytest
+
+from chatcomment import Store,validate_existing_database
+from chatcomment.cli import main
+from chatcomment.store import Invalid
+
+
+def source_state(directory):
+    return {p.name:(p.read_bytes(),p.stat().st_mtime_ns,p.stat().st_mode) for p in directory.iterdir() if p.is_file()}
+
+
+@pytest.mark.parametrize('kind',['empty','garbage','corrupt','unrelated','missing-table','bad-columns','views'])
+def test_invalid_existing_database_never_initializes_or_writes(tmp_path,kind):
+    path=tmp_path/'comments.sqlite3'
+    if kind=='empty':path.touch()
+    elif kind=='garbage':path.write_bytes(b'not a sqlite database')
+    elif kind=='corrupt':
+        Store(path)
+        path.write_bytes(path.read_bytes()[:100])
+    else:
+        with sqlite3.connect(path) as db:
+            if kind=='unrelated':db.execute('CREATE TABLE unrelated(id INTEGER)')
+            elif kind=='missing-table':db.execute('CREATE TABLE sites(id TEXT PRIMARY KEY)')
+            elif kind=='bad-columns':
+                db.execute('CREATE TABLE sites(id INTEGER,title TEXT)')
+                db.execute('CREATE TABLE comments(id TEXT)')
+            else:
+                db.execute('CREATE TABLE data(id TEXT)')
+                db.execute('CREATE VIEW sites AS SELECT * FROM data')
+                db.execute('CREATE VIEW comments AS SELECT * FROM data')
+    before=source_state(tmp_path)
+    with patch('chatcomment.cli.Store') as constructor,patch('chatcomment.server.serve') as run:
+        result=CliRunner().invoke(main,['--db',str(path),'serve','--gateway-key-env','TEST_GATEWAY_KEY','--require-existing-db'],env={'TEST_GATEWAY_KEY':'x'*48})
+        assert result.exit_code!=0 and 'Persistent database validation failed' in result.output
+        constructor.assert_not_called();run.assert_not_called()
+    assert source_state(tmp_path)==before
+
+
+def test_complete_zero_comment_schema_is_accepted_without_source_sidecars(tmp_path):
+    path=tmp_path/'comments.sqlite3';Store(path)
+    before=source_state(tmp_path)
+    assert validate_existing_database(path)==path.resolve()
+    assert source_state(tmp_path)==before
+    with patch('chatcomment.server.serve') as run:
+        result=CliRunner().invoke(main,['--db',str(path),'serve','--gateway-key-env','TEST_GATEWAY_KEY','--require-existing-db'],env={'TEST_GATEWAY_KEY':'x'*48})
+        assert result.exit_code==0,result.output
+        run.assert_called_once()
+
+
+def test_live_wal_schema_is_read_and_source_files_are_untouched(tmp_path):
+    path=tmp_path/'comments.sqlite3'
+    # Keep a writer open so the current schema lives in WAL, not the base file.
+    template=Store(tmp_path/'template.sqlite3')
+    with template.connect() as db:
+        schema=[r[0] for r in db.execute("SELECT sql FROM sqlite_master WHERE sql IS NOT NULL ORDER BY rowid")]
+    writer=sqlite3.connect(path)
+    writer.execute('PRAGMA journal_mode=WAL');writer.execute('PRAGMA wal_autocheckpoint=0')
+    writer.executescript(';\n'.join(schema)+';')
+    with sqlite3.connect(path.as_uri()+'?mode=ro&immutable=1',uri=True) as base_only:
+        assert 'comments' not in {r[0] for r in base_only.execute('SELECT name FROM sqlite_master')}
+    before=source_state(tmp_path)
+    assert validate_existing_database(path)==path.resolve()
+    assert source_state(tmp_path)==before
+    writer.close()
+
+
+def test_wrong_wal_schema_does_not_create_source_sidecars(tmp_path):
+    path=tmp_path/'comments.sqlite3'
+    writer=sqlite3.connect(path);writer.execute('PRAGMA journal_mode=WAL')
+    writer.execute('CREATE TABLE unrelated(id TEXT)');writer.commit()
+    before=source_state(tmp_path)
+    with pytest.raises(Invalid):validate_existing_database(path)
+    assert source_state(tmp_path)==before
+    writer.close()
+
+
+@pytest.mark.skipif(hasattr(os,'geteuid') and os.geteuid()==0,reason='Root can read mode000 files')
+def test_unreadable_file_is_refused_without_changing_permissions(tmp_path):
+    path=tmp_path/'comments.sqlite3';Store(path);path.chmod(0)
+    try:
+        with pytest.raises(Invalid,match='unreadable'):validate_existing_database(path)
+        assert path.stat().st_mode & 0o777==0
+    finally:path.chmod(0o600)