openwrite 0.14.0__tar.gz → 0.16.0__tar.gz

{openwrite-0.14.0/openwrite.egg-info → openwrite-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwrite
-Version: 0.14.0
+Version: 0.16.0
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
                                Version 3, 19 November 2007
         
@@ -689,13 +689,13 @@ Requires-Dist: redis
 Dynamic: license-file
 
 ![logo](https://openwrite.io/static/logo.png)
+
 openwrite is a minimalist blogging platform built for writing freely, hosting independently, and publishing without noise.
 
 ![PyPI - Downloads](https://img.shields.io/pypi/dw/openwrite)
 ![PyPI - Version](https://img.shields.io/pypi/v/openwrite)
 [![License: AGPL-3.0-or-later](https://img.shields.io/badge/License-AGPL--3.0--or--later-blue.svg)](LICENSE)
 ![pythonver](https://img.shields.io/badge/python%20version-3.11-blue)
-![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/openwriteio/openwrite/python-tests.yml)
 
 ---
 
@@ -715,7 +715,7 @@ openwrite is a minimalist blogging platform built for writing freely, hosting in
 - Lightweight
 - No tracking, only data collected is anonymized(hashed) IP for post view counting and likes
 - Custom CSS per blog
-- Federation using ActivityPub protocol: Follow and Like
+- Federation using ActivityPub protocol
 - Likes system
 - Posts importing from xml/csv
 - Blog themes
@@ -724,6 +724,10 @@ openwrite is a minimalist blogging platform built for writing freely, hosting in
 - Multilanguage (currently English and Polish)
 - Custom favicon per blog
 - Subpages per blog
+- Valkey support
+- Post tags, filtering
+- Optional comments per post
+- Auto save during typing
 
 
 ## Installation

{openwrite-0.14.0 → openwrite-0.16.0}/README.md

@@ -1,11 +1,11 @@
 ![logo](https://openwrite.io/static/logo.png)
+
 openwrite is a minimalist blogging platform built for writing freely, hosting independently, and publishing without noise.
 
 ![PyPI - Downloads](https://img.shields.io/pypi/dw/openwrite)
 ![PyPI - Version](https://img.shields.io/pypi/v/openwrite)
 [![License: AGPL-3.0-or-later](https://img.shields.io/badge/License-AGPL--3.0--or--later-blue.svg)](LICENSE)
 ![pythonver](https://img.shields.io/badge/python%20version-3.11-blue)
-![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/openwriteio/openwrite/python-tests.yml)
 
 ---
 
@@ -25,7 +25,7 @@ openwrite is a minimalist blogging platform built for writing freely, hosting in
 - Lightweight
 - No tracking, only data collected is anonymized(hashed) IP for post view counting and likes
 - Custom CSS per blog
-- Federation using ActivityPub protocol: Follow and Like
+- Federation using ActivityPub protocol
 - Likes system
 - Posts importing from xml/csv
 - Blog themes
@@ -34,6 +34,10 @@ openwrite is a minimalist blogging platform built for writing freely, hosting in
 - Multilanguage (currently English and Polish)
 - Custom favicon per blog
 - Subpages per blog
+- Valkey support
+- Post tags, filtering
+- Optional comments per post
+- Auto save during typing
 
 
 ## Installation

{openwrite-0.14.0 → openwrite-0.16.0}/openwrite/__init__.py

@@ -25,17 +25,21 @@ def create_app(test_config=None):
         db_path = test_config.get("DB_PATH", "data.db")
         load_dotenv(test_config.get("env"), override=True)
 
+    # Always run database migrations to ensure schema is up to date
+    from .utils.create_db import init_db
+    init_db(db_type, db_path)
+    
+    # Initialize database engine and session
+    from .utils.models import User, Blog, Post, Settings, Home, Page
+    from .utils.db import init_engine, SessionLocal
+    init_engine(db_type, db_path)
+    from .utils.db import SessionLocal
+
     if not os.path.exists(".initialized") or test_config is not None:
         mode = os.getenv("MODE")
         domain = os.getenv("DOMAIN")
         f_abs_path = os.path.abspath(__file__)
         file_cwd = "/".join(f_abs_path.split("/")[:-1])
-        from .utils.create_db import init_db
-        init_db(db_type, db_path)
-        from .utils.models import User, Blog, Post, Settings, Home, Page
-        from .utils.db import init_engine, SessionLocal
-        init_engine(db_type, db_path)
-        from .utils.db import SessionLocal
         admin_password = os.urandom(16).hex()
         hashed = bcrypt.hashpw("openwrite".encode("utf-8"), bcrypt.gensalt())
         admin_user = User(username="admin", email="", password_hash=hashed.decode("utf-8"), verified=1, admin=1)
@@ -163,6 +167,7 @@ def create_app(test_config=None):
     app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1, x_port=1)
     app.secret_key = os.getenv("SECRET_KEY")
     app.config['SERVER_NAME'] = os.getenv("DOMAIN")
+    app.config['SESSION_COOKIE_DOMAIN'] = '.' + os.getenv("DOMAIN", "").split(':')[0]
 
     from .routes.auth import auth_bp
     from .routes.dashboard import dashboard_bp
@@ -171,14 +176,10 @@ def create_app(test_config=None):
     from .routes.main import main_bp
     from .routes.upload import upload_bp
     from .routes.federation import federation_bp
-    from .utils.db import init_engine, SessionLocal
     from flask_cors import CORS
     
     CORS(app)
 
-    init_engine(db_type, db_path)    
-    from .utils.db import SessionLocal
-
     app.register_blueprint(auth_bp)
     app.register_blueprint(dashboard_bp)
     app.register_blueprint(blog_bp)
@@ -212,7 +213,7 @@ def create_app(test_config=None):
 
         trans = g.db.query(Home).filter(Home.type == "translation", Home.language == lang).all()
         
-        g.version = "0.14.0"
+        g.version = "0.15.0"
         g.mode = os.getenv("MODE")
         f_abs_path = os.path.abspath(__file__)
         g.mainpath = "/".join(f_abs_path.split("/")[:-1])

{openwrite-0.14.0 → openwrite-0.16.0}/openwrite/cli.py

@@ -152,8 +152,8 @@ def init():
         if captcha_enabled:
             f.write(f"FRIENDLY_CAPTCHA_SITEKEY={captcha_sitekey}\n")
             f.write(f"FRIENDLY_CAPTCHA_APIKEY={captcha_apikey}\n")
+        f.write(f"VALKEY_ENABLED={'yes' if valkey_enabled else 'no'}\n")
         if valkey_enabled:
-            f.write(f"VALKEY_ENABLED={'yes' if valkey_enabled else 'no'}\n")
             f.write(f"VALKEY_HOST={valkey_host}\n")
             f.write(f"VALKEY_PORT={valkey_port}\n")
             f.write(f"VALKEY_PASSWORD={valkey_password}\n")

{openwrite-0.14.0 → openwrite-0.16.0}/openwrite/gemini_multi.py

@@ -22,8 +22,10 @@ def root(req):
     global session
     resp = f"```\n{openwrite_logo}\n```"
     resp += "\nopenwrite.io is a minimalist blogging platform built for writing freely, hosting independently, and publishing without noise. To create your own blog, visit:\n"
-    resp += "=> https://openwrite.io openwrite.io\n"
+    resp += "=> https://openwrite.io https://openwrite.io\n"
     resp += "In here you can read posts published.\n"
+    resp += "If you want to list all blogs (that did not disable indexing) find them in the link below:\n"
+    resp += "=> /blogs All Blogs list"
     resp += "\n## 🗞️ Latest posts:\n"
     try:
         posts = (session.query(Post).filter(Post.feed == "1", Post.isdraft == "0").order_by(Post.id.desc()).limit(10).all())
@@ -36,6 +38,20 @@ def root(req):
     finally:
         session.close()
 
+def all_blogs(req):
+    global session
+    blogs = session.query(Blog).filter_by(index='on').order_by(Blog.title).all()
+    resp = "Here you will find a list of all blogs in openwrite that did not disable their indexing:\n"
+    resp += "\n"
+    for b in blogs:
+        posts = session.query(Post).filter_by(blog=b.id).count()
+        last = session.query(Post).filter_by(blog=b.id).order_by(Post.date.desc()).first()
+        resp += f"=> /b/{b.name} {b.title} \n"
+        resp += f"Posts: {posts}\n"
+        resp += f"Last posted: {last.date if last is not None else 'never'}\n\n"
+
+    return resp
+
 def blog_index(req):                                                                           
         global session
         path = req.path
@@ -134,3 +150,7 @@ def init(capsule):
     capsule.add("/b/*",
         blog_index,
         protocol='gemini')
+
+    capsule.add("/blogs",
+                all_blogs,
+                protocol='gemini')

{openwrite-0.14.0 → openwrite-0.16.0}/openwrite/routes/auth.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, redirect, request, session, g
+from flask import Blueprint, render_template, redirect, request, session, g, current_app
 from openwrite.utils.models import User
 import bcrypt
 import re
@@ -19,7 +19,7 @@ def register():
         return render_template('register.html')
 
     form_username = request.form.get('username')
-    if not re.match(r"^[a-zA-Z0-9](?:[a-zA-Z0-9_-]{1,28}[a-zA-Z0-9])?$", form_username):
+    if not re.match(r"^[a-zA-Z0-9](?:[a-zA-Z0-9_-]{1,28}[a-zA-Z0-9])+$", form_username):
         return render_template('register.html', error=g.trans['wrong_username'])
     form_password = request.form.get('password')
     form_password2 = request.form.get('password2')
@@ -74,5 +74,10 @@ def login():
 @auth_bp.route("/logout")
 def logout():
     session.clear()
-    return redirect("/")
+    response = redirect("/")
+    cookie_name = current_app.config.get('SESSION_COOKIE_NAME', 'session')
+    cookie_domain = current_app.config.get('SESSION_COOKIE_DOMAIN')
+    response.delete_cookie(cookie_name, path='/', domain=cookie_domain)
+    response.delete_cookie(cookie_name, path='/')
+    return response
 

{openwrite-0.14.0 → openwrite-0.16.0}/openwrite/routes/blog.py

@@ -1,5 +1,6 @@
-from flask import Blueprint, render_template, redirect, request, g, Response, abort
-from openwrite.utils.models import Blog, Post, User, View, Like, Page
+from flask import Blueprint, render_template, redirect, request, g, Response, abort, send_file, jsonify
+from openwrite.utils.models import Blog, Post, User, View, Like, Page, PostDraft, Comment
+from openwrite.utils.tags import get_post_tags, parse_tags_from_posts_syntax, get_posts_by_tags
 from openwrite.utils.helpers import gen_link, sanitize_html, anonymize, get_ip
 from openwrite.utils.valkey_client import valkey_client
 from feedgen.feed import FeedGenerator
@@ -12,6 +13,26 @@ from datetime import timezone, datetime
 
 blog_bp = Blueprint("blog", __name__)
 
+def process_posts_content(page, blog_id, blog_url, domain):
+    posts_matches = re.findall(r'{posts[^}]*}', page.content_raw)
+    if not posts_matches:
+        return [], page.content_html
+        
+    posts_syntax = posts_matches[0]
+    tag_names = parse_tags_from_posts_syntax(posts_syntax)
+    posts = get_posts_by_tags(g.db, blog_id, tag_names)
+    
+    posts_html = ""
+    for post in posts:
+        post_url = f"{blog_url}/{post.link}"
+        posts_html += f'<div class="postlist_item"><i class="datetime">{post.date}</i> - <a href="{post_url}">{post.title}</a></div>'
+    
+    processed_content = page.content_html
+    for match in posts_matches:
+        processed_content = processed_content.replace(match, posts_html)
+        
+    return posts, processed_content
+
 def create_activity_object(post, blog, url, full_content=True):
     """Create ActivityPub object (Article or Note) based on post content length"""
     dt = datetime.strptime(str(post.date), "%Y-%m-%d %H:%M:%S")
@@ -139,11 +160,9 @@ def show_blog(blog):
     pages = g.db.query(Page).filter_by(blog=blog_obj.id).all()
     blog_obj.url = f"/b/{blog_obj.name}"
     homepage = g.db.query(Page).filter(Page.blog == blog_obj.id, Page.url == "").first()
-    if "{posts}" in homepage.content_raw:
-        posts = g.db.query(Post).filter(Post.blog == blog_obj.id, Post.isdraft == "0").order_by(desc(Post.id)).all()
-        return render_template("blog.html", blog=blog_obj, page=homepage, posts=posts, pages=pages)
-
-    return render_template("blog.html", blog=blog_obj, page=homepage, pages=pages)
+    
+    posts, processed_content = process_posts_content(homepage, blog_obj.id, blog_obj.url, g.main_domain)
+    return render_template("blog.html", blog=blog_obj, page=homepage, posts=posts, pages=pages, processed_content=processed_content)
 
 @blog_bp.route("/", subdomain="<blog>")
 def show_subblog(blog):
@@ -167,11 +186,9 @@ def show_subblog(blog):
     blog_obj.url = f"https://{blog_obj.name}.{os.getenv('DOMAIN')}"
     pages = g.db.query(Page).filter_by(blog=blog_obj.id).all()
     homepage = g.db.query(Page).filter(Page.blog == blog_obj.id, Page.url == "").first()
-    if "{posts}" in homepage.content_raw:
-        posts = g.db.query(Post).filter(Post.blog == blog_obj.id, Post.isdraft == "0").order_by(desc(Post.id)).all()
-        return render_template("blog.html", blog=blog_obj, page=homepage, posts=posts, pages=pages)
-
-    return render_template("blog.html", blog=blog_obj, page=homepage, pages=pages)
+    
+    posts, processed_content = process_posts_content(homepage, blog_obj.id, blog_obj.url, g.main_domain)
+    return render_template("blog.html", blog=blog_obj, page=homepage, posts=posts, pages=pages, processed_content=processed_content)
 
 @blog_bp.route("/b/<blog>/<post>")
 def show_post(blog, post):
@@ -182,7 +199,7 @@ def show_post(blog, post):
         return redirect("/")
 
     if post == "rss":
-        return _generate_rss(blog_obj)
+        return serve_rss(blog_obj)
 
     if blog_obj.access == "domain":
         return redirect(f"https://{blog_obj.name}.{os.getenv('DOMAIN')}/{post}")
@@ -196,11 +213,8 @@ def show_post(blog, post):
         if not page:
             return redirect("/")
 
-        if "{posts}" in page.content_raw:
-            posts = g.db.query(Post).filter(Post.blog == blog_obj.id, Post.isdraft == "0").order_by(desc(Post.id)).all()
-            return render_template("blog.html", blog=blog_obj, page=page, posts=posts, pages=pages)
-        
-        return render_template("blog.html", blog=blog_obj, page=page, pages=pages)
+        posts, processed_content = process_posts_content(page, blog_obj.id, blog_obj.url, g.main_domain)
+        return render_template("blog.html", blog=blog_obj, page=page, posts=posts, pages=pages, processed_content=processed_content)
 
     if is_activitypub_request():
         url = f"https://{g.main_domain}/b/{blog}"
@@ -240,8 +254,11 @@ def show_post(blog, post):
     one_post.likes = likes
     one_post.liked = liked
 
+    post_tags = get_post_tags(g.db, one_post)
+    comments = g.db.query(Comment).filter_by(blog_id=blog_obj.id, post_id=one_post.id).order_by(Comment.created_at.asc()).all() if one_post.comments_allowed == "1" else []
+
     user = g.db.query(User).filter_by(id=g.user) if g.user else None
-    return render_template("post.html", blog=blog_obj, post=one_post, user=user, views=v, likes=likes, pages=pages)
+    return render_template("post.html", blog=blog_obj, post=one_post, user=user, views=v, likes=likes, pages=pages, post_tags=post_tags, comments=comments)
 
 @blog_bp.route("/<post>", subdomain="<blog>")
 def show_subpost(blog, post):
@@ -252,7 +269,7 @@ def show_subpost(blog, post):
         return redirect(f"https://{os.getenv('DOMAIN')}/")
 
     if post == "rss":
-        return _generate_rss(blog_obj)
+        return serve_rss(blog_obj)
 
     if blog_obj.access == "path":
         return redirect(f"https://{os.getenv('DOMAIN')}/b/{blog_obj.name}/{post}")
@@ -267,11 +284,8 @@ def show_subpost(blog, post):
         if not page:
             return redirect("/")
 
-        if "{posts}" in page.content_raw:
-            posts = g.db.query(Post).filter(Post.blog == blog_obj.id, Post.isdraft == "0").order_by(desc(Post.id)).all()
-            return render_template("blog.html", blog=blog_obj, page=page, posts=posts, pages=pages)
-        
-        return render_template("blog.html", blog=blog_obj, page=page, pages=pages)
+        posts, processed_content = process_posts_content(page, blog_obj.id, blog_obj.url, g.main_domain)
+        return render_template("blog.html", blog=blog_obj, page=page, posts=posts, pages=pages, processed_content=processed_content)
 
     if is_activitypub_request():
         url = f"https://{blog}.{g.main_domain}"
@@ -310,9 +324,12 @@ def show_subpost(blog, post):
 
     one_post.likes = likes
     one_post.liked = liked
+ 
+    post_tags = get_post_tags(g.db, one_post)
+    comments = g.db.query(Comment).filter_by(blog_id=blog_obj.id, post_id=one_post.id).order_by(Comment.created_at.asc()).all() if one_post.comments_allowed == "1" else []
 
     user = g.db.query(User).filter_by(id=g.user) if g.user else None
-    return render_template("post.html", blog=blog_obj, post=one_post, user=user, views=v, likes=likes, pages=pages)
+    return render_template("post.html", blog=blog_obj, post=one_post, user=user, views=v, likes=likes, pages=pages, post_tags=post_tags, comments=comments)
 
 @blog_bp.route("/.well-known/webfinger")
 def webfinger():
@@ -382,12 +399,8 @@ def single_showpost(post):
         if not page:
             return redirect("/")
 
-        if "{posts}" in page.content_raw:
-            posts = g.db.query(Post).filter(Post.blog == blog.id, Post.isdraft == "0").order_by(desc(Post.id)).all()
-
-            return render_template("blog.html", blog=blog, page=page, posts=posts, pages=pages)
-        
-        return render_template("blog.html", blog=blog, page=page, pages=pages)
+        posts, processed_content = process_posts_content(page, blog.id, blog.url, g.main_domain)
+        return render_template("blog.html", blog=blog, page=page, posts=posts, pages=pages, processed_content=processed_content)
 
     if is_activitypub_request():
         url = f"https://{g.main_domain}"
@@ -426,8 +439,11 @@ def single_showpost(post):
     one_post.likes = likes
     one_post.liked = liked
 
+    post_tags = get_post_tags(g.db, one_post)
+    comments = g.db.query(Comment).filter_by(blog_id=blog.id, post_id=one_post.id).order_by(Comment.created_at.asc()).all() if one_post.comments_allowed == "1" else []
+
     user = g.db.query(User).filter_by(id=g.user) if g.user else None
-    return render_template("post.html", blog=blog, post=one_post, user=user, views=v, likes=likes, pages=pages)
+    return render_template("post.html", blog=blog, post=one_post, user=user, views=v, likes=likes, pages=pages, post_tags=post_tags, comments=comments)
 
 @blog_bp.route("/rss")
 def single_rss():
@@ -435,7 +451,7 @@ def single_rss():
         return redirect("/")
 
     blog = g.db.query(Blog).first()
-    return _generate_rss(blog)
+    return serve_rss(blog)
 
 @blog_bp.route("/like", methods=["POST"])
 def like():
@@ -483,29 +499,117 @@ def like():
         status = 201
     
     return resp, status
-    
 
-def _generate_rss(blog):
-    posts = g.db.query(Post).filter(Post.blog == blog.id, Post.isdraft == "0").all()
-    fg = FeedGenerator()
-    fg.title(blog.title)
-    
-    if blog.access == "domain":
-        blog_url = f"https://{blog.name}.{g.main_domain}"
-        post_base_url = blog_url
+
+
+def serve_rss(blog):
+    """
+    Here we just serve static RSS files :)
+    """
+    return send_file(f"{g.mainpath}/static/feed/{blog.name}.xml")
+
+
+@blog_bp.route("/comment", methods=['POST'])
+def add_comment():
+    blog_id = request.form.get('blog_id', type=int)
+    post_id = request.form.get('post_id', type=int)
+    author_name = request.form.get('author_name', '').strip()[:50]
+    content = request.form.get('content', '').strip()[:1000]
+    redirect_to = request.referrer or '/'
+
+    if not blog_id or not post_id:
+        abort(400)
+
+    post = g.db.query(Post).filter_by(id=post_id, blog=blog_id).first()
+    if not post or post.comments_allowed != '1':
+        abort(403)
+
+    if not author_name or not content:
+        return redirect(redirect_to)
+
+    now = datetime.now(timezone.utc).replace(microsecond=0)
+    comment = Comment(blog_id=blog_id, post_id=post_id, author_name=author_name, content=content, created_at=now)
+    g.db.add(comment)
+    g.db.commit()
+    return redirect(redirect_to)
+
+
+@blog_bp.route("/comment/<int:comment_id>/delete", methods=['POST'])
+def delete_comment(comment_id):
+    if g.user is None:
+        abort(403)
+
+    comment = g.db.query(Comment).filter_by(id=comment_id).first()
+    if not comment:
+        abort(404)
+
+    blog = g.db.query(Blog).filter_by(id=comment.blog_id).first()
+    if not blog or blog.owner != g.user:
+        abort(403)
+
+    redirect_to = request.referrer or '/'
+    g.db.delete(comment)
+    g.db.commit()
+    return redirect(redirect_to)
+
+
+@blog_bp.route("/dashboard/autosave/<blog_name>", methods=['POST'])
+def autosave_post(blog_name):
+    if g.user is None:
+        abort(403)
+
+    blog = g.db.query(Blog).filter_by(name=blog_name).first()
+    if blog is None or blog.owner != g.user:
+        abort(403)
+
+    data = request.get_json()
+    if not data:
+        abort(400)
+
+    title = data.get('title', '')[:128]
+    content_raw = data.get('content_raw', '')
+    post_id = data.get('post_id')
+    session_key = data.get('session_key') if post_id is None else None
+
+    now = datetime.now(timezone.utc).replace(microsecond=0)
+    draft = PostDraft(post_id=post_id, blog_id=blog.id, session_key=session_key, title=title, content_raw=content_raw, saved_at=now)
+    g.db.add(draft)
+    g.db.flush()
+
+    if post_id is not None:
+        existing = g.db.query(PostDraft).filter_by(post_id=post_id, blog_id=blog.id).order_by(PostDraft.saved_at.desc()).all()
     else:
-        blog_url = f"https://{g.main_domain}/b/{blog.name}"
-        post_base_url = blog_url
-    
-    fg.link(href=blog_url, rel="alternate")
-    fg.description(blog.description_html)
-
-    for p in posts:
-        soup = BeautifulSoup(p.content_html, "html.parser")
-        fe = fg.add_entry()
-        fe.title(p.title)
-        fe.link(href=f"{post_base_url}/{p.link}")
-        fe.description(soup.get_text())
-        fe.published(p.date.replace(tzinfo=timezone.utc))
-
-    return Response(fg.rss_str(pretty=True).decode("utf-8"), mimetype="application/rss+xml")
+        existing = g.db.query(PostDraft).filter_by(session_key=session_key, blog_id=blog.id).order_by(PostDraft.saved_at.desc()).all()
+
+    for old in existing[20:]:
+        g.db.delete(old)
+
+    g.db.commit()
+    return {'status': 'ok'}, 200
+
+
+@blog_bp.route("/dashboard/autosaves/<blog_name>", methods=['GET'])
+def get_autosaves(blog_name):
+    if g.user is None:
+        abort(403)
+
+    blog = g.db.query(Blog).filter_by(name=blog_name).first()
+    if blog is None or blog.owner != g.user:
+        abort(403)
+
+    post_id = request.args.get('post_id', type=int)
+    session_key = request.args.get('session_key')
+
+    if post_id is not None:
+        drafts = g.db.query(PostDraft).filter_by(post_id=post_id, blog_id=blog.id).order_by(PostDraft.saved_at.desc()).limit(20).all()
+    elif session_key:
+        drafts = g.db.query(PostDraft).filter_by(session_key=session_key, blog_id=blog.id).order_by(PostDraft.saved_at.desc()).limit(20).all()
+    else:
+        drafts = []
+
+    return jsonify([{
+        'id': d.id,
+        'title': d.title,
+        'content_raw': d.content_raw,
+        'saved_at': d.saved_at.strftime('%Y-%m-%dT%H:%M:%SZ')
+    } for d in drafts])