ChatComment 0.2.1__tar.gz → 0.2.2__tar.gz

{chatcomment-0.2.1 → chatcomment-0.2.2}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.2
+
+- `Store.set_visibility`、`site visibility --public/--private` 和站点 visibility API 可切换既有站点公开/私有，只改 private，不重建站点或覆盖留言/设置。
+- 签名模式的 visibility API 要求真实已认证的站点 owner 与写 CSRF；字段设置、审核和导出仍须密码再认证。公开访客只获 read/comment，不获邮箱齿轮或管理权限。
+- 签名匿名访客也受每站点/可信会话 10 次每分钟的提交预算限制；旧公开模式保留每来源 IP 预算，内存桶数量有界。
+- 公开访客无需账号即可提交，但仍受来源、页面、匿名开关、字段必填及审核规则约束；注册默认私有保持兼容。
+
 ## 0.2.1
 
 - `--require-existing-db` 在 Store 初始化之前验证既有 SQLite 完整性、必要表/字段和可读性，拒绝空文件、损坏或错误 schema。

{chatcomment-0.2.1 → chatcomment-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.2.1
+Version: 0.2.2
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -42,10 +42,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.1 → chatcomment-0.2.2}/README.md

@@ -22,10 +22,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.1 → chatcomment-0.2.2}/docs/api.md

@@ -1,6 +1,6 @@
 # Commands and APIs
 
-`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `site allow-origin`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `allow_origin`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service. Platform APIs `AccessContext`, `SiteAccess`, `sign_context`, `verify_context` are described in [platform.md](platform.md).
+`chatcomment --help`, `--version`, `--tree`, `--tree-brief` describe the installed CLI. Commands: `serve`, `site register`, `site list`, `site allow-origin`, `site visibility`, `backup`. Python API: `Store.register`, `site`, `sites`, `configure`, `set_visibility`, `allow_origin`, `create`, `comments`, `moderate`, `backup`; `server.make_handler` and `server.serve` expose the same HTTP service. Platform APIs `AccessContext`, `SiteAccess`, `sign_context`, `verify_context` are described in [platform.md](platform.md).
 
 All request bodies are JSON (maximum 32 KiB). Site IDs are explicit, origins are exact and page paths must be pre-registered; query strings and hashes do not create new comment streams.
 
@@ -19,6 +19,7 @@ Platform deployments use `serve --gateway-key-env NAME`, optionally `--session-e
 | GET | `/board?site={id}&page=/path/` | Standalone widget host; apply the private-site gateway to this HTML too |
 | GET/POST | `/api/admin/sites` | List/register sites |
 | POST | `/api/sites/{id}/settings` | Complete settings object |
+| POST | `/api/sites/{id}/visibility` | `{"private":false}` (or true); authenticated site owner plus write CSRF in platform mode |
 | GET | `/api/sites/{id}/admin?page=/path/` | All states with private fields |
 | POST | `/api/sites/{id}/moderate` | `{id,status:approved|pending|deleted}` |
 | GET | `/api/sites/{id}/export?page=/path/` | Admin data, paginated |
@@ -38,3 +39,7 @@ Settings example:
 ```
 
 Hidden fields are discarded. Email/URL formats, required fields and 1–5000 character plain text content are checked server-side. Browser output uses `textContent`; no comment HTML or third-party avatars are executed.
+
+Visibility changes update only the existing `sites.private` value. They preserve every comment column/state, origin, page and field setting; unknown sites and non-boolean values are rejected. Registration remains private by default. The local operator must explicitly choose `site visibility SITE --public` or `--private`. The platform API requires a live authenticated site owner and verified write CSRF; a delegated manager, viewer or anonymous visitor cannot change this owner policy. Unlike field settings/moderation/export, this publishing-policy action does not require a temporary password management grant. Public site visibility and `allow_anonymous` are separate: both public visibility and anonymous submission permission are needed for a guest post.
+
+Signed public guest submissions are limited to ten attempts/minute/site/verified guest-session identifier per process. The gateway supplies that opaque identifier in its signed context and must enforce its own visitor/abuse limits; client identity headers cannot choose it. Raw legacy public traffic retains the per-IP limit. Limiter state stays in bounded process memory and is not written to the comments database.

{chatcomment-0.2.1 → chatcomment-0.2.2}/docs/deployment.md

@@ -4,7 +4,7 @@ Install the built wheel into a versioned virtual environment. Run the service as
 
 For a private site, apply the existing site login to **every** API and asset request under the integration prefix. For writes, validate the existing session's CSRF token before proxying. The widget supports `data-csrf-endpoint="/api/session"`, which fetches a native `csrf_token` just before a write; it does not store credentials. The management UI also uses this native endpoint. Other session systems can provide this minimal same-origin contract or host a custom admin client.
 
-The gateway maps its prefix to backend `/`, injects the Bearer token and a verified identity marker, and relays only required response headers. Block unexpected methods and cap body size. A separate public site may explicitly use `site register --public`, but the private site setting must remain private. Site IDs are not secrets and never replace access control.
+The gateway maps its prefix to backend `/`, injects the Bearer token and a verified identity marker, and relays only required response headers. Block unexpected methods and cap body size. A public site may explicitly use `site register --public`. Change an existing site's policy with `site visibility SITE --public` or `--private`; take a consistent backup and verify that only the private flag changed. Do not re-register an existing ID or restore an old database to change visibility. Site IDs are not secrets and never replace access control.
 
 For the single-gear workflow, inject the configured owner email only as the server-side `X-ChatComment-Admin-Email` header. Implement `/api/admin/reauth` at the gateway: check current session and CSRF, verify the supplied email/password through the existing account backend, verify its owner role, rotate the native session cookie and create a short-lived grant bound to that session. Protect `/admin`, `/api/admin/sites` and site settings/admin/export/moderate routes with this grant. Reject readers even if they type the owner email or forge role headers. Keep email hints, private read access and management grants distinct. The included login HTML stores no credentials and delegates password verification entirely to this gateway contract.
 

{chatcomment-0.2.1 → chatcomment-0.2.2}/docs/platform.md

@@ -70,6 +70,45 @@ or logged. Keep the backend path canonical and preserve raw body bytes.
 Guest contexts must explicitly use `authenticated=False`; they cannot have
 management eligibility and never read private sites, even if mis-scoped.
 
+For a public site, the platform can authorize a visitor without creating an
+account. Verify the current app's public visibility, exact request Origin and a
+server-issued guest CSRF token before signing a write:
+
+```python
+guest = AccessContext(
+    subject='public-visitor', session=verified_guest_session_digest,
+    authenticated=False, csrf_verified=actual_guest_csrf_was_verified,
+    sites={site_id: SiteAccess(read=True, comment=True)},
+)
+```
+
+Never set guest `manage` or `owner`, infer identity from the email form, or mark a
+guest authenticated to bypass private-site checks. The site itself must be
+public and its settings must allow anonymous submissions. Required fields,
+moderation, origin and page registration still apply. Its raw backend routes
+remain signature-only even when the site is public.
+
+The widget's configured session endpoint must return HTTP 200 and `csrf_token`
+for authorized public guests as well as signed-in readers. A host-page loader
+must allow `read=true` instead of requiring `authenticated=true`. Guests receive
+`can_manage=false` and no settings gear. Signed guest posts have a ten/minute
+budget per verified session and site in bounded process memory; gateways should
+also enforce visitor limits before signing to prevent session cycling.
+
+An existing site's policy can be changed with
+`Store.set_visibility(site_id, private=False)` or the local operator command
+`chatcomment --db /data/comments.sqlite3 site visibility SITE --public` (use
+`--private` to reverse it). For delegated management use
+`POST /api/sites/{id}/visibility` with `{"private":false}`: this requires a live
+authenticated owner of the selected site and verified write CSRF. The
+`visibility` permission deliberately uses the owner scope without a temporary
+management grant, so the platform can synchronize an owner's explicit project
+publishing policy without fabricating password reauthentication. Field settings,
+moderation, export and the management UI continue requiring the password grant.
+It changes only the private flag, not origins, pages, settings or comment rows.
+Initial registration remains private unless the integration explicitly opts
+into public access; existing sites never change silently on package upgrade.
+
 For a native in-process adapter, `make_handler(..., context_resolver=callable)`
 accepts the same validated context. The callable receives headers, method,
 downstream path and body bytes. Do not combine it with a gateway key or legacy

{chatcomment-0.2.1 → chatcomment-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ChatComment"
-version = "0.2.1"
+version = "0.2.2"
 description = "Embeddable comments with a Python server, SQLite storage and a small JavaScript widget."
 readme = "README.md"
 requires-python = ">=3.10"

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/ChatComment.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ChatComment
-Version: 0.2.1
+Version: 0.2.2
 Summary: Embeddable comments with a Python server, SQLite storage and a small JavaScript widget.
 Author: ChatArch
 License-Expression: MIT
@@ -42,10 +42,19 @@ chatcomment serve --token-file ~/.chatarch/chatcomment/admin-token
 
 组件自动读取设置并只显示允许的字段；必填校验由服务器执行。默认不记住访客信息、不加载第三方头像、不渲染留言 HTML。公开模式的匿名留言不代表拥有可信实名；关闭匿名时要求可信网关提供已验证的作者身份。
 
+既有站点可以明确切换公开或私有，不需要重新注册，也不会覆盖留言、字段设置或来源：
+
+```sh
+chatcomment site visibility personal-blog --public
+chatcomment site visibility personal-blog --private
+```
+
+Python 对应 `Store.set_visibility(site_id, private=False)`。这是本地部署者命令；HTTP 对应 `POST /api/sites/{id}/visibility`、正文 `{"private":false}`，签名平台模式要求当前已认证的站点 owner 与写 CSRF。此项属于所有者发布策略；字段设置、审核和导出等留言管理仍须密码再认证。注册默认仍为私有；公开托管平台应显式使用 `--public`，或在已有站点上使用上述切换。
+
 API、网关接入、备份与恢复见 [docs/api.md](docs/api.md)、[docs/deployment.md](docs/deployment.md)。本包不自动开放防火墙或注册 DNS，也不包含云服务凭据。
 
 多用户平台接入使用 [平台服务协议](docs/platform.md)：`--gateway-key-env` 启用按主体/session/站点校验的签名上下文，所有非 health 路由均拒绝未签名访问，兼容独立 Coolify 资源。`AccessContext.from_chatlogin()` 复用已验证的 ChatLogin Session；项目 ACL 与密码二次验证由平台拥有，账户全局 admin 不能自动获得站点权限。旧 `--token-file` 模式仅保留给已有单网关部署迁移使用。
 
-独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。公开站点没有该提示。
+独立留言板为 `/board?site=personal-blog&page=%2Fpost%2Fone`，与嵌入表单读写同一留言流。组件只提供一个齿轮入口：已登录 owner 在邮箱栏填写匹配邮箱后，服务器返回显示提示；昵称不参与判断，邮箱不下发到 JS 配置。齿轮指向邮箱/密码验证页；网关须实现 `/api/admin/reauth` 并在校验现有账号后授予短时管理权限。未登录的公开访客没有该提示。
 
 网关为普通成员设置 `X-ChatComment-Role: reader`，仅经服务端验证的 owner 使用 `admin`；管理接口另行验证权限。公开浏览器不能靠昵称、邮箱或伪造角色 header 获得权限，因为缺少服务器 Bearer token。服务器可为受信 owner 请求附加 `X-ChatComment-Admin-Email`，只用于入口提示。完整验证合约见部署文档。

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/chatcomment/__init__.py

@@ -1,5 +1,5 @@
 """Reusable comments storage and HTTP service."""
-__version__ = "0.2.1"
+__version__ = "0.2.2"
 
 from .store import Store
 from .access import AccessContext,SiteAccess,sign_context,verify_context

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/chatcomment/access.py

@@ -69,6 +69,7 @@ class AccessContext:
         scope=self.scope(site_id)
         if action=='read':return scope.read
         if action=='comment':return scope.read and scope.comment
+        if action=='visibility':return self.authenticated and scope.read and scope.owner
         if action=='hint':return self.authenticated and scope.read and scope.owner
         if action=='manage':
             return self.authenticated and scope.read and scope.manage and scope.management_until>(time.time() if now is None else now)

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/chatcomment/cli.py

@@ -91,6 +91,20 @@ def allow_origin(ctx,site_id,origin):
     click.echo(json.dumps(result,ensure_ascii=False,indent=2))
 
 
+@site.command(name='visibility')
+@click.argument('site_id')
+@click.option('--public/--private','public',default=None,help='Choose explicitly: public visitors or authenticated private access.')
+@click.pass_context
+def visibility(ctx,site_id,public):
+    """Change an existing site's visibility, preserving comments and settings."""
+    if public is None:raise click.UsageError('Choose --public or --private explicitly.')
+    try:
+        result=Store(ctx.obj['db']).set_visibility(site_id,private=not public)
+    except (ValueError,KeyError) as exc:
+        raise click.ClickException(str(exc)) from exc
+    click.echo(json.dumps(result,ensure_ascii=False,indent=2))
+
+
 @main.command()
 @click.argument('destination', type=click.Path(path_type=Path))
 @click.pass_context

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/chatcomment/server.py

@@ -213,6 +213,11 @@ def make_handler(store: Store, admin_token: str | None = None, *, gateway_key=No
                                           'auth':auth_config})
                 if action == 'settings' and self.command == 'POST':
                     return self.send(200, store.configure(site_id, self.payload()))
+                if action == 'visibility' and self.command == 'POST':
+                    if scoped:
+                        context.require(site_id,'visibility',write=True)
+                    elif not manager:raise PermissionError('需要站点所有者权限')
+                    return self.send(200,store.set_visibility(site_id,private=self.payload().get('private')))
                 if action == 'moderate' and self.command == 'POST':
                     v = self.payload()
                     return self.send(200, store.moderate(site_id, v.get('id'), v.get('status')))
@@ -223,15 +228,22 @@ def make_handler(store: Store, admin_token: str | None = None, *, gateway_key=No
                         context.require(site_id,'comment',write=True)
                     if not trusted and (not request_origin or self.headers.get('X-ChatComment-Request') != '1'):
                         raise PermissionError('留言需通过允许来源的组件提交')
-                    # A process-local bound keeps public submissions within 10/minute/IP.
-                    if not trusted:
+                    signed_guest=bool(scoped and context and not context.authenticated)
+                    if signed_guest and not request_origin:
+                        raise PermissionError('匿名留言需通过允许来源的组件提交')
+                    # Gateways share a source IP. Their verified guest session
+                    # scopes the budget; raw public mode keeps its per-IP budget.
+                    if not trusted or signed_guest:
                         now = time.monotonic()
                         with lock:
-                            if len(attempts) > 10000:
+                            if len(attempts) >= 10000:
                                 for k in list(attempts):
                                     if not attempts[k] or now - attempts[k][-1] > 60:
                                         del attempts[k]
-                            key = (self.client_address[0],site_id)
+                            identity=('gateway-session',context.session) if signed_guest else ('ip',self.client_address[0])
+                            key = (identity,site_id)
+                            if key not in attempts and len(attempts)>=10000:
+                                return self.send(429,{'error':'留言太频繁，请稍后再试'})
                             bucket = attempts[key]
                             while bucket and now - bucket[0] > 60:
                                 bucket.popleft()

{chatcomment-0.2.1 → chatcomment-0.2.2}/src/chatcomment/store.py

@@ -142,6 +142,15 @@ class Store:
             db.execute('UPDATE sites SET settings=? WHERE id=?', (json.dumps(config), site_id))
         return self.site(site_id)
 
+    def set_visibility(self,site_id,*,private):
+        """Change one existing site's visibility without recreating its data."""
+        if type(private) is not bool:
+            raise Invalid('private 必须是布尔值')
+        with self.connect() as db:
+            result=db.execute('UPDATE sites SET private=? WHERE id=?',(int(private),site_id))
+            if result.rowcount!=1:raise KeyError('站点不存在')
+        return self.site(site_id)
+
     def allow_origin(self,site_id,value):
         """Add an approved platform origin without touching fields or comments."""
         approved=origin(value)

{chatcomment-0.2.1 → chatcomment-0.2.2}/tests/cli-tests/test_cli.py

@@ -21,3 +21,20 @@ def test_scoped_missing_database_fails_before_creating_file(tmp_path):
     result=CliRunner().invoke(main,['--db',str(path),'serve','--gateway-key-env','TEST_GATEWAY_KEY','--require-existing-db'],env={'TEST_GATEWAY_KEY':'x'*48})
     assert result.exit_code!=0 and 'mount is missing' in result.output
     assert not path.exists()
+
+
+def test_operator_visibility_requires_explicit_choice_and_preserves_site(tmp_path):
+    import json
+    from chatcomment import Store
+    path=tmp_path/'db.sqlite3';store=Store(path)
+    before=store.register('demo',title='Demo',origins=['https://example.com'],pages=['/post/'])
+    row=store.create('demo',{'page':'/post/','content':'keep row'},authenticated=True)
+    r=CliRunner();args=['--db',str(path),'site','visibility','demo']
+    missing=r.invoke(main,args)
+    assert missing.exit_code!=0 and 'Choose --public or --private' in missing.output
+    for option,private in [('--public',False),('--private',True)]:
+        result=r.invoke(main,args+[option]);assert result.exit_code==0,result.output
+        actual=json.loads(result.output)
+        assert actual['private'] is private
+        assert {k:v for k,v in actual.items() if k!='private'}=={k:v for k,v in before.items() if k!='private'}
+        assert store.comments('demo','/post/',admin=True)['comments'][0]['id']==row['id']

{chatcomment-0.2.1 → chatcomment-0.2.2}/tests/code-tests/test_access.py

@@ -35,6 +35,19 @@ def test_chatlogin_global_admin_does_not_grant_sites():
     assert not c.permits('any-site','manage',now=100)
 
 
+def test_visibility_is_live_site_owner_policy_with_csrf_not_management_reauth():
+    c=context()
+    assert c.permits('owned','visibility',now=500)
+    assert not c.permits('owned','manage',now=500)
+    assert not c.permits('viewed','visibility')
+    assert not c.permits('other-managed','visibility')
+    assert not c.permits('ungranted','visibility')
+    guest=AccessContext('guest','guest-digest',sites={'owned':SiteAccess(read=True,comment=True)},authenticated=False)
+    assert not guest.permits('owned','visibility')
+    no_csrf=AccessContext('owner','owner-digest',sites={'owned':SiteAccess(True,True,True,True)})
+    with pytest.raises(PermissionError):no_csrf.require('owned','visibility',write=True)
+
+
 def test_signed_body_method_path_and_ttl():
     headers=sign_context(context(),key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=100)
     c=verify_context(headers,key=KEY,method='POST',path='/api/sites/owned/settings',body=b'{"a":1}',now=110)

{chatcomment-0.2.1 → chatcomment-0.2.2}/tests/code-tests/test_comments.py

@@ -42,6 +42,24 @@ def test_allow_origin_preserves_all_other_site_fields_and_rows(store):
     assert store.allow_origin('first','https://new-platform.example')==after
 
 
+def test_visibility_changes_only_existing_site_private_flag(store):
+    item=store.create('second',{'page':'/one/','content':'Keep every column','email':'private@example.invalid'},authenticated=True)
+    store.moderate('second',item['id'],'deleted')
+    before=store.site('second');comments=store.comments('second','/one/',admin=True)
+    other=store.site('first');physical=store.path.stat()
+    for private in [False,False,True]:
+        after=store.set_visibility('second',private=private)
+        assert after['private'] is private
+        assert {k:v for k,v in after.items() if k!='private'}=={k:v for k,v in before.items() if k!='private'}
+        assert store.comments('second','/one/',admin=True)==comments
+        assert store.site('first')==other
+        assert store.path.stat().st_ino==physical.st_ino
+    for invalid in [None,0,1,'public',{},[]]:
+        with pytest.raises(Invalid):store.set_visibility('second',private=invalid)
+    with pytest.raises(KeyError):store.set_visibility('missing-site',private=False)
+    assert store.site('second')==before
+
+
 def test_fields_and_anonymous_enforced(store):
     config=store.site('first')['settings']
     config['fields']['email']='required'

{chatcomment-0.2.1 → chatcomment-0.2.2}/tests/code-tests/test_platform_http.py

@@ -23,10 +23,10 @@ def platform(tmp_path):
     server=ThreadingHTTPServer(('127.0.0.1',0),make_handler(store,gateway_key=KEY,
         session_endpoint='/auth/api/session',reauth_endpoint='/extensions/comments/reauth',return_path='/sites/alice-site/'))
     thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
-    def request(path,*,context=None,body=None,signature_path=None,legacy=False):
+    def request(path,*,context=None,body=None,signature_path=None,legacy=False,origin='https://platform.example'):
         raw=json.dumps(body).encode() if body is not None else b''
         method='POST' if body is not None else 'GET'
-        headers={'Origin':'https://platform.example'}
+        headers={'Origin':origin} if origin else {}
         if body is not None:headers['Content-Type']='application/json'
         if context is not None:headers.update(sign_context(context,key=KEY,method=method,path=signature_path or path,body=raw))
         if legacy:headers.update({'Authorization':'Bearer '+KEY,'X-ChatComment-Role':'admin','X-ChatComment-Identity':'alice'})
@@ -101,3 +101,78 @@ def test_scoped_login_configuration_and_registration_denial(platform):
     assert http('/login?site=bob-site',context=owner())[0]==403
     assert http('/api/admin/sites',context=owner(verified=True),body={'id':'bob-site','title':'overwrite','origins':['https://platform.example'],'pages':['/kept/page/']})[0]==403
     with pytest.raises(ValueError):make_handler(store,KEY,gateway_key=KEY)
+
+
+def guest(*,session='guest-session-digest',csrf=True):
+    return AccessContext('public-visitor',session,sites={
+        'alice-site':SiteAccess(read=True,comment=True),'bob-site':SiteAccess(read=True,comment=True)},
+        authenticated=False,csrf_verified=csrf)
+
+
+def test_owner_visibility_transition_public_guest_and_management_boundaries(platform):
+    store,http=platform
+    original=store.site('alice-site')
+    kept=store.create('alice-site',{'page':'/kept/page/','content':'Existing owner comment','email':'kept@example.invalid'},authenticated=True)
+    before=store.comments('alice-site','/kept/page/',admin=True)
+    path='/api/sites/alice-site/visibility'
+    viewer=AccessContext('viewer','viewer-session',sites={'alice-site':SiteAccess(read=True)},csrf_verified=True)
+    deployer=AccessContext('deployer','deployer-session',sites={'alice-site':SiteAccess(read=True,comment=True)},csrf_verified=True)
+    manager=AccessContext('manager','manager-session',sites={
+        'alice-site':SiteAccess(True,True,True,False,time.time()+900)},csrf_verified=True)
+    for context in [owner(verified=True,csrf=False),viewer,deployer,manager]:
+        assert http(path,context=context,body={'private':False})[0]==403
+    assert http(path,context=owner(verified=True),origin='https://malicious.example',body={'private':False})[0]==403
+    assert http(path,context=owner(verified=True),body={'private':'false'})[0]==400
+    code,site=http(path,context=owner(),body={'private':False})
+    assert code==200 and site['private'] is False
+    assert http('/api/sites/alice-site/settings',context=owner(),body=original['settings'])[0]==403
+    assert http('/api/admin/sites',context=owner())[0]==403
+    assert {k:v for k,v in site.items() if k!='private'}=={k:v for k,v in original.items() if k!='private'}
+    assert store.comments('alice-site','/kept/page/',admin=True)==before
+    code,config=http('/api/sites/alice-site/config',context=guest())
+    assert code==200 and config['can_manage'] is False
+    assert http('/api/sites/alice-site/config')[0]==403
+    assert http('/widget.js')[0]==403
+    body={'page':'/kept/page/','content':'Anonymous guest comment'}
+    code,row=http('/api/sites/alice-site/comments',context=guest(),body=body)
+    assert code==201
+    with store.connect() as db:
+        assert db.execute('SELECT authenticated FROM comments WHERE id=?',(row['id'],)).fetchone()[0]==0
+    rows=http('/api/sites/alice-site/comments?page=/kept/page/',context=guest())[1]['comments']
+    assert {r['id'] for r in rows}=={kept['id'],row['id']} and all('email' not in r for r in rows)
+    assert http('/api/sites/alice-site/comments',context=guest(csrf=False),body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),origin='https://malicious.example',body=body)[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),origin=None,body=body)[0]==403
+    assert http('/api/admin/entry',context=guest(),body={'site':'alice-site','email':'alice@example.invalid'})[0]==403
+    assert http('/api/admin/sites',context=guest())[0]==403
+    assert http('/login?site=alice-site',context=guest())[0]==403
+    assert http(path,context=guest(),body={'private':True})[0]==403
+    assert http('/api/sites/alice-site/settings',context=guest(),body=original['settings'])[0]==403
+    assert http('/api/sites/bob-site/visibility',context=owner(verified=True),body={'private':False})[0]==403
+    assert http(path,context=owner(),body={'private':True})[0]==200
+    assert store.site('alice-site')==original
+    assert http('/api/sites/alice-site/config',context=guest())[0]==403
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==403
+
+
+def test_signed_guest_rate_budget_is_by_verified_session_and_site(platform):
+    store,http=platform
+    for site in ['alice-site','bob-site']:store.set_visibility(site,private=False)
+    body={'page':'/kept/page/','content':'Isolated guest rate-limit test'}
+    for _ in range(10):assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==201
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==429
+    assert http('/api/sites/alice-site/comments',context=guest(session='different-verified-session'),body=body)[0]==201
+    assert http('/api/sites/bob-site/comments',context=guest(),body=body)[0]==201
+    assert http('/api/sites/alice-site/comments',context=owner(),body=body)[0]==201
+
+
+def test_public_guest_still_obeys_anonymous_and_field_settings(platform):
+    store,http=platform;store.set_visibility('alice-site',private=False)
+    body={'page':'/kept/page/','content':'Anonymous rules'}
+    config=store.site('alice-site')['settings'];config['allow_anonymous']=False
+    store.configure('alice-site',config)
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==403
+    config['allow_anonymous']=True;config['fields']['nickname']='required'
+    store.configure('alice-site',config)
+    assert http('/api/sites/alice-site/comments',context=guest(),body=body)[0]==400
+    assert http('/api/sites/alice-site/comments',context=guest(),body={**body,'nickname':'Guest'})[0]==201