ordloom-cms 0.1.0__tar.gz

ordloom_cms-0.1.0/PKG-INFO

@@ -0,0 +1,26 @@
+Metadata-Version: 2.4
+Name: ordloom-cms
+Version: 0.1.0
+Summary: Ordloom 内容管理子应用
+Project-URL: Homepage, https://neekin.github.io/ordloom-docs/
+Project-URL: Documentation, https://neekin.github.io/ordloom-docs/guides/cms-and-members.html
+Project-URL: Repository, https://github.com/neekin/simpleui-antd
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: ordloom<2,>=1.1.0
+Requires-Dist: Markdown<4,>=3.7
+Requires-Dist: bleach<7,>=6.2
+
+# ordloom-cms
+
+Ordloom 子应用 SDK 的内容管理 MVP：站点、栏目、标签、Markdown 文章、封面、送审/发布/下线、不可变发布快照、公开 HTML/JSON、搜索/分页、Sitemap，以及可选会员内容。
+
+版本 0.1.0，依赖 Ordloom 1.1.0+ 的 SDK v1。独立安装：
+
+```bash
+python -m pip install ordloom-cms==0.1.0
+```
+
+注册 `ordloom_cms.apps.ExtensionConfig`，挂载 `include("ordloom_cms.urls")`，执行 `migrate` 与 `collectstatic`。站点默认不公开。管理沿用 Django 模型权限，并限制负责人/编辑成员的站点范围；公开发布另需 `publish_article` / `publish_site`。不安装会员模块时，会员内容保持关闭。
+
+完整接入与边界见 [CMS 与会员指南](https://neekin.github.io/ordloom-docs/guides/cms-and-members.html)。

ordloom_cms-0.1.0/README.md

@@ -0,0 +1,13 @@
+# ordloom-cms
+
+Ordloom 子应用 SDK 的内容管理 MVP：站点、栏目、标签、Markdown 文章、封面、送审/发布/下线、不可变发布快照、公开 HTML/JSON、搜索/分页、Sitemap，以及可选会员内容。
+
+版本 0.1.0，依赖 Ordloom 1.1.0+ 的 SDK v1。独立安装：
+
+```bash
+python -m pip install ordloom-cms==0.1.0
+```
+
+注册 `ordloom_cms.apps.ExtensionConfig`，挂载 `include("ordloom_cms.urls")`，执行 `migrate` 与 `collectstatic`。站点默认不公开。管理沿用 Django 模型权限，并限制负责人/编辑成员的站点范围；公开发布另需 `publish_article` / `publish_site`。不安装会员模块时，会员内容保持关闭。
+
+完整接入与边界见 [CMS 与会员指南](https://neekin.github.io/ordloom-docs/guides/cms-and-members.html)。

ordloom_cms-0.1.0/ordloom_cms/admin.py

@@ -0,0 +1,91 @@
+from django.contrib import admin,messages
+from django.core.exceptions import PermissionDenied,ValidationError
+from .models import Site,Section,Tag,Article
+from .services import site_scope,article_scope,transition
+
+
+class ScopedAdmin(admin.ModelAdmin):
+    def has_module_permission(self,request):
+        from .views import enabled
+        return enabled() and super().has_module_permission(request)
+    def has_add_permission(self,request):return self.has_module_permission(request) and super().has_add_permission(request)
+    def get_queryset(self,request):
+        rows=super().get_queryset(request)
+        if not self.has_module_permission(request):return rows.none()
+        return rows.filter(pk__in=site_scope(request)) if self.model is Site else rows.filter(site__in=site_scope(request))
+    def has_view_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_view_permission(request,obj) and (obj is None or self.get_queryset(request).filter(pk=obj.pk).exists())
+    def has_change_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_change_permission(request,obj) and (obj is None or self.get_queryset(request).filter(pk=obj.pk).exists())
+    def has_delete_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_delete_permission(request,obj) and (obj is None or self.get_queryset(request).filter(pk=obj.pk).exists())
+    def formfield_for_foreignkey(self,db_field,request,**kwargs):
+        if db_field.name=='site':kwargs['queryset']=site_scope(request)
+        if db_field.name=='section':kwargs['queryset']=Section.objects.filter(site__in=site_scope(request))
+        return super().formfield_for_foreignkey(db_field,request,**kwargs)
+    def formfield_for_manytomany(self,db_field,request,**kwargs):
+        if db_field.name=='tags':kwargs['queryset']=Tag.objects.filter(site__in=site_scope(request))
+        return super().formfield_for_manytomany(db_field,request,**kwargs)
+
+
+@admin.register(Site)
+class SiteAdmin(ScopedAdmin):
+    list_display=('name','slug','public_enabled','domain')
+    search_fields=('name','slug')
+    fields=('name','slug','domain','public_enabled','owner','editors')
+    def get_readonly_fields(self,request,obj=None):
+        return (() if request.user.is_superuser else ('owner',))+(() if request.user.has_perm('ordloom_cms.publish_site') else ('public_enabled',))
+    def save_model(self,request,obj,form,change):
+        if not change and not request.user.is_superuser:obj.owner=request.user
+        super().save_model(request,obj,form,change)
+    def formfield_for_foreignkey(self,db_field,request,**kwargs):
+        if db_field.name=='owner':
+            from django.contrib.auth import get_user_model
+            kwargs['queryset']=get_user_model()._default_manager.filter(is_staff=True,is_active=True)
+        return super().formfield_for_foreignkey(db_field,request,**kwargs)
+    def formfield_for_manytomany(self,db_field,request,**kwargs):
+        if db_field.name=='editors':
+            from django.contrib.auth import get_user_model
+            kwargs['queryset']=get_user_model()._default_manager.filter(is_staff=True,is_active=True)
+        return super().formfield_for_manytomany(db_field,request,**kwargs)
+
+
+@admin.register(Section)
+class SectionAdmin(ScopedAdmin):
+    list_display=('name','slug','site');search_fields=('name','slug')
+
+
+@admin.register(Tag)
+class TagAdmin(ScopedAdmin):
+    list_display=('name','slug','site');search_fields=('name','slug')
+
+
+@admin.register(Article)
+class ArticleAdmin(ScopedAdmin):
+    list_display=('title','site','state','publication','access_level','updated_at')
+    list_filter=('state','access_level','site')
+    search_fields=('title','excerpt')
+    fields=('site','section','title','slug','excerpt','body','cover','tags','access_level')
+    actions=('submit_articles','publish_articles','unpublish_articles')
+    @admin.display(description='公开版本')
+    def publication(self,obj):return '公开 v'+str(obj.published_version.number) if obj.published_version_id else '未公开'
+    def get_readonly_fields(self,request,obj=None):
+        return (('site','slug') if obj and obj.versions.exists() else ())+(() if request.user.has_perm('ordloom_cms.publish_article') else ('access_level',))
+    def has_publish_permission(self,request,obj=None):
+        return request.user.has_perm('ordloom_cms.publish_article') and self.has_change_permission(request,obj)
+    def save_model(self,request,obj,form,change):
+        if not change:obj.created_by=request.user
+        super().save_model(request,obj,form,change)
+    def save_related(self,request,form,formsets,change):
+        super().save_related(request,form,formsets,change)
+        if form.instance.tags.exclude(site=form.instance.site).exists():raise ValidationError('标签须属于当前站点')
+    def _transition(self,request,queryset,action):
+        # The core action endpoint already keeps this in its transaction.
+        for article in queryset:transition(request,article.pk,action)
+        self.message_user(request,'内容操作已完成',level=messages.SUCCESS)
+    @admin.action(description='送审当前草稿',permissions=['change'])
+    def submit_articles(self,request,queryset):self._transition(request,queryset,'submit')
+    @admin.action(description='审核并发布',permissions=['publish'])
+    def publish_articles(self,request,queryset):self._transition(request,queryset,'publish')
+    @admin.action(description='下线公开版本',permissions=['publish'])
+    def unpublish_articles(self,request,queryset):self._transition(request,queryset,'unpublish')

ordloom_cms-0.1.0/ordloom_cms/apps.py

@@ -0,0 +1,11 @@
+from django.apps import AppConfig
+
+
+class ExtensionConfig(AppConfig):
+    name = 'ordloom_cms'
+    verbose_name = '内容管理'
+    default_auto_field = 'django.db.models.BigAutoField'
+    ordloom_application = 'ordloom_cms.extension.application'
+
+    def ready(self):
+        from . import signals  # noqa: F401

ordloom_cms-0.1.0/ordloom_cms/extension.py

@@ -0,0 +1,29 @@
+from ordloom.sdk import Application,AppPage,AppTask,CanvasWidget,visible_objects
+
+
+def overview(request):
+    rows=visible_objects(request,'ordloom_cms.article')
+    from django.contrib import admin
+    from django.contrib.admin.utils import flatten_fieldsets
+    from django.urls import reverse,NoReverseMatch
+    from .models import Article
+    manager=admin.site._registry[Article];recent=[]
+    for row in sorted(rows,key=lambda r:r.pk,reverse=True)[:20]:
+        fields=set(flatten_fieldsets(manager.get_fieldsets(request,row)))
+        try:url=reverse('ordloom_cms:article',kwargs={'site_slug':row.site.slug,'slug':row.slug}) if row.published_version_id else None
+        except NoReverseMatch:url=None
+        recent.append({'id':str(row.pk),'title':row.title if 'title' in fields else '文章 '+str(row.pk),
+            'state':row.get_state_display(),'published_version':row.published_version.number if row.published_version_id else None,
+            'url':url,'history':[{'number':v.number,'title':v.title if 'title' in fields else '内容版本','created_at':v.created_at.isoformat()} for v in row.versions.all()[:10]]})
+    return {'articles':recent,'title':'内容概览','drafts':sum(r.state=='draft' for r in rows),'review':sum(r.state=='review' for r in rows),
+        'published':sum(r.published_version_id is not None for r in rows),'description':'草稿送审后由具有发布权限的人员审核发布；公开内容读取不可变快照。'}
+
+
+def audit(context):return {'processed':len(visible_objects(context.request,'ordloom_cms.article'))}
+
+application=Application(id='cms',label='内容管理',version='0.1.0',asset='ordloom_cms/extension.js', description='站点、文章审核和不可变发布内容。', category='content', distribution='ordloom-cms', documentation_url='https://neekin.github.io/ordloom-docs/guides/cms-and-members.html',
+    pages=(AppPage('overview','内容概览',overview,('ordloom_cms.view_article',),model='ordloom_cms.article'),),
+    widgets=(CanvasWidget('contentlink','内容入口',('ordloom_cms.view_article',),model='ordloom_cms.article',public=True,
+        fields={'title':{'type':'text','label':'入口标题','required':True,'max_length':100},'description':{'type':'textarea','label':'入口说明','max_length':500},'path':{'type':'text','label':'内容路径','required':True,'max_length':1000}},
+        defaults={'title':'阅读我们的最新内容','description':'浏览文章、资讯与会员专享内容。','path':'/cms/main/'}),),
+    tasks=(AppTask('audit','内容范围检查',audit,('ordloom_cms.view_article',),model='ordloom_cms.article'),))

ordloom_cms-0.1.0/ordloom_cms/migrations/0001_initial.py

@@ -0,0 +1,144 @@
+# Generated by Django 5.2.19 on 2026-11-11 14:10
+
+import django.db.models.deletion
+import ordloom.editor.fields
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Section',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=100, verbose_name='栏目名称')),
+                ('slug', models.SlugField(verbose_name='栏目标识')),
+            ],
+            options={
+                'verbose_name': '栏目',
+                'verbose_name_plural': '栏目',
+            },
+        ),
+        migrations.CreateModel(
+            name='Article',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('title', models.CharField(max_length=200, verbose_name='标题')),
+                ('slug', models.SlugField(max_length=120, verbose_name='文章标识')),
+                ('excerpt', models.CharField(blank=True, max_length=500, verbose_name='摘要')),
+                ('body', ordloom.editor.fields.MDTextField(blank=True, max_length=100000, verbose_name='正文')),
+                ('cover', models.ImageField(blank=True, upload_to='ordloom-cms/covers/', verbose_name='封面图片')),
+                ('access_level', models.CharField(choices=[('public', '公开'), ('members', '登录会员')], default='public', max_length=12, verbose_name='访问范围')),
+                ('state', models.CharField(choices=[('draft', '草稿'), ('review', '待审核'), ('published', '已发布')], default='draft', editable=False, max_length=12, verbose_name='草稿状态')),
+                ('draft_revision', models.PositiveIntegerField(default=1, editable=False)),
+                ('updated_at', models.DateTimeField(auto_now=True, verbose_name='更新时间')),
+                ('created_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='ordloom_cms_articles', to=settings.AUTH_USER_MODEL, verbose_name='创建人')),
+            ],
+            options={
+                'verbose_name': '文章',
+                'verbose_name_plural': '文章',
+                'ordering': ['-updated_at', '-pk'],
+                'permissions': [('publish_article', '可审核发布及下线文章')],
+            },
+        ),
+        migrations.CreateModel(
+            name='ArticleVersion',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('number', models.PositiveIntegerField()),
+                ('title', models.CharField(max_length=200)),
+                ('excerpt', models.CharField(blank=True, max_length=500)),
+                ('body', models.TextField(blank=True)),
+                ('cover_url', models.CharField(blank=True, max_length=2000)),
+                ('section_slug', models.SlugField(blank=True)),
+                ('section_name', models.CharField(blank=True, max_length=100)),
+                ('tags', models.JSONField(default=list)),
+                ('fingerprint', models.CharField(max_length=64)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('article', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='versions', to='ordloom_cms.article')),
+                ('created_by', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='ordloom_cms_versions', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'ordering': ['-number'],
+            },
+        ),
+        migrations.AddField(
+            model_name='article',
+            name='published_version',
+            field=models.ForeignKey(blank=True, editable=False, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to='ordloom_cms.articleversion'),
+        ),
+        migrations.AddField(
+            model_name='article',
+            name='section',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='ordloom_cms.section', verbose_name='栏目'),
+        ),
+        migrations.CreateModel(
+            name='Site',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=100, verbose_name='站点名称')),
+                ('slug', models.SlugField(unique=True, verbose_name='站点标识')),
+                ('domain', models.CharField(blank=True, max_length=253, verbose_name='公开域名（可留空）')),
+                ('public_enabled', models.BooleanField(default=False, verbose_name='公开访问')),
+                ('editors', models.ManyToManyField(blank=True, related_name='ordloom_cms_editing_sites', to=settings.AUTH_USER_MODEL, verbose_name='编辑成员')),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='ordloom_cms_sites', to=settings.AUTH_USER_MODEL, verbose_name='负责人')),
+            ],
+            options={
+                'verbose_name': '内容站点',
+                'verbose_name_plural': '内容站点',
+                'permissions': [('publish_site', '可开启内容站点公开访问')],
+            },
+        ),
+        migrations.AddField(
+            model_name='section',
+            name='site',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='sections', to='ordloom_cms.site', verbose_name='站点'),
+        ),
+        migrations.AddField(
+            model_name='article',
+            name='site',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='articles', to='ordloom_cms.site', verbose_name='站点'),
+        ),
+        migrations.CreateModel(
+            name='Tag',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=80, verbose_name='标签名称')),
+                ('slug', models.SlugField(verbose_name='标签标识')),
+                ('site', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='tags', to='ordloom_cms.site', verbose_name='站点')),
+            ],
+            options={
+                'verbose_name': '内容标签',
+                'verbose_name_plural': '内容标签',
+            },
+        ),
+        migrations.AddField(
+            model_name='article',
+            name='tags',
+            field=models.ManyToManyField(blank=True, to='ordloom_cms.tag', verbose_name='标签'),
+        ),
+        migrations.AddConstraint(
+            model_name='articleversion',
+            constraint=models.UniqueConstraint(fields=('article', 'number'), name='ordloom_cms_version_number'),
+        ),
+        migrations.AddConstraint(
+            model_name='section',
+            constraint=models.UniqueConstraint(fields=('site', 'slug'), name='ordloom_cms_section_slug'),
+        ),
+        migrations.AddConstraint(
+            model_name='tag',
+            constraint=models.UniqueConstraint(fields=('site', 'slug'), name='ordloom_cms_tag_slug'),
+        ),
+        migrations.AddConstraint(
+            model_name='article',
+            constraint=models.UniqueConstraint(fields=('site', 'slug'), name='ordloom_cms_article_slug'),
+        ),
+    ]

ordloom_cms-0.1.0/ordloom_cms/models.py

@@ -0,0 +1,127 @@
+from django.conf import settings
+from django.core.exceptions import ValidationError
+from django.db import models,transaction
+from ordloom.editor.fields import MDTextField
+
+
+class Site(models.Model):
+    name = models.CharField('站点名称',max_length=100)
+    slug = models.SlugField('站点标识',unique=True)
+    domain = models.CharField('公开域名（可留空）',max_length=253,blank=True)
+    public_enabled = models.BooleanField('公开访问',default=False)
+    owner = models.ForeignKey(settings.AUTH_USER_MODEL,on_delete=models.PROTECT,related_name='ordloom_cms_sites',verbose_name='负责人')
+    editors = models.ManyToManyField(settings.AUTH_USER_MODEL,blank=True,related_name='ordloom_cms_editing_sites',verbose_name='编辑成员')
+    class Meta:
+        verbose_name='内容站点'
+        verbose_name_plural=verbose_name
+        permissions=[('publish_site','可开启内容站点公开访问')]
+    def __str__(self):return self.name
+    def clean(self):
+        super().clean()
+        import re
+        if self.domain and not re.fullmatch(r'[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?',self.domain):raise ValidationError({'domain':'请填写不含协议、端口和路径的域名'})
+        if self.pk:
+            old=type(self).objects.get(pk=self.pk)
+            if old.slug!=self.slug and ArticleVersion.objects.filter(article__site=self).exists():raise ValidationError({'slug':'已有发布历史的站点标识固定'})
+
+
+class Section(models.Model):
+    site=models.ForeignKey(Site,on_delete=models.CASCADE,related_name='sections',verbose_name='站点')
+    name=models.CharField('栏目名称',max_length=100)
+    slug=models.SlugField('栏目标识')
+    class Meta:
+        verbose_name='栏目'
+        verbose_name_plural=verbose_name
+        constraints=[models.UniqueConstraint(fields=['site','slug'],name='ordloom_cms_section_slug')]
+    def __str__(self):return self.name
+
+
+class Tag(models.Model):
+    site=models.ForeignKey(Site,on_delete=models.CASCADE,related_name='tags',verbose_name='站点')
+    name=models.CharField('标签名称',max_length=80)
+    slug=models.SlugField('标签标识')
+    class Meta:
+        verbose_name='内容标签'
+        verbose_name_plural=verbose_name
+        constraints=[models.UniqueConstraint(fields=['site','slug'],name='ordloom_cms_tag_slug')]
+    def __str__(self):return self.name
+
+
+class Article(models.Model):
+    site=models.ForeignKey(Site,on_delete=models.PROTECT,related_name='articles',verbose_name='站点')
+    section=models.ForeignKey(Section,on_delete=models.SET_NULL,null=True,blank=True,verbose_name='栏目')
+    title=models.CharField('标题',max_length=200)
+    slug=models.SlugField('文章标识',max_length=120)
+    excerpt=models.CharField('摘要',max_length=500,blank=True)
+    body=MDTextField('正文',blank=True,max_length=100000)
+    cover=models.ImageField('封面图片',upload_to='ordloom-cms/covers/',blank=True)
+    tags=models.ManyToManyField(Tag,blank=True,verbose_name='标签')
+    access_level=models.CharField('访问范围',max_length=12,choices=[('public','公开'),('members','登录会员')],default='public')
+    state=models.CharField('草稿状态',max_length=12,choices=[('draft','草稿'),('review','待审核'),('published','已发布')],default='draft',editable=False)
+    draft_revision=models.PositiveIntegerField(default=1,editable=False)
+    published_version=models.ForeignKey('ArticleVersion',on_delete=models.SET_NULL,null=True,blank=True,editable=False,related_name='+')
+    created_by=models.ForeignKey(settings.AUTH_USER_MODEL,on_delete=models.SET_NULL,null=True,blank=True,related_name='ordloom_cms_articles',verbose_name='创建人')
+    updated_at=models.DateTimeField('更新时间',auto_now=True)
+    class Meta:
+        verbose_name='文章'
+        verbose_name_plural=verbose_name
+        ordering=['-updated_at','-pk']
+        constraints=[models.UniqueConstraint(fields=['site','slug'],name='ordloom_cms_article_slug')]
+        permissions=[('publish_article','可审核发布及下线文章')]
+    def __str__(self):return self.title
+    def clean(self):
+        super().clean()
+        if self.section_id and self.section.site_id!=self.site_id:raise ValidationError({'section':'栏目须属于当前站点'})
+        if self.pk and self.versions.exists():
+            old=type(self).objects.get(pk=self.pk)
+            if old.site_id!=self.site_id or old.slug!=self.slug:raise ValidationError('已有发布历史的文章标识和站点固定')
+    def save(self,*args,**kwargs):
+        if kwargs.get('update_fields') is not None and not kwargs['update_fields']:return
+        with transaction.atomic(using=kwargs.get('using') or 'default'):
+            if self.pk:
+                previous=type(self).objects.select_for_update().filter(pk=self.pk).first()
+                if previous:
+                    if previous.versions.exists() and (previous.site_id!=self.site_id or previous.slug!=self.slug):
+                        raise ValidationError('已有发布历史的文章标识和站点固定')
+                    self.published_version_id=previous.published_version_id
+                    fields={'site_id','section_id','title','slug','excerpt','body','cover'}
+                    if kwargs.get('update_fields') is not None:
+                        changed_fields=set(kwargs['update_fields'])
+                        fields={key for key in fields if key in changed_fields or (key[:-3] if key.endswith('_id') else key) in changed_fields}
+                    changed=any(str(getattr(self,key))!=str(getattr(previous,key)) for key in fields)
+                    self.draft_revision=previous.draft_revision+int(changed)
+                    self.state='draft' if changed else previous.state
+                    if kwargs.get('update_fields') is not None:kwargs['update_fields']=[*kwargs['update_fields'],'draft_revision','state']
+            return super().save(*args,**kwargs)
+
+
+class ImmutableVersions(models.QuerySet):
+    def update(self,**kwargs):raise ValidationError('内容发布版本不可修改')
+    def bulk_update(self,*args,**kwargs):raise ValidationError('内容发布版本不可修改')
+    def delete(self):raise ValidationError('内容发布版本不可单独删除')
+    def bulk_create(self,objs,**kwargs):
+        if kwargs.get('update_conflicts'):raise ValidationError('内容发布版本不可覆盖')
+        return super().bulk_create(objs,**kwargs)
+
+
+class ArticleVersion(models.Model):
+    article=models.ForeignKey(Article,on_delete=models.CASCADE,related_name='versions')
+    number=models.PositiveIntegerField()
+    title=models.CharField(max_length=200)
+    excerpt=models.CharField(max_length=500,blank=True)
+    body=models.TextField(blank=True)
+    cover_url=models.CharField(max_length=2000,blank=True)
+    section_slug=models.SlugField(blank=True)
+    section_name=models.CharField(max_length=100,blank=True)
+    tags=models.JSONField(default=list)
+    fingerprint=models.CharField(max_length=64)
+    created_by=models.ForeignKey(settings.AUTH_USER_MODEL,on_delete=models.SET_NULL,null=True,related_name='ordloom_cms_versions')
+    created_at=models.DateTimeField(auto_now_add=True)
+    objects=ImmutableVersions.as_manager()
+    class Meta:
+        ordering=['-number']
+        constraints=[models.UniqueConstraint(fields=['article','number'],name='ordloom_cms_version_number')]
+    def save(self,*args,**kwargs):
+        if not self._state.adding or kwargs.get('update_fields') is not None:raise ValidationError('内容发布版本不可修改')
+        kwargs['force_insert']=True;return super().save(*args,**kwargs)
+    def delete(self,*args,**kwargs):raise ValidationError('内容发布版本不可单独删除')

ordloom_cms-0.1.0/ordloom_cms/services.py

@@ -0,0 +1,64 @@
+"""Content publishing is explicit; public content never executes staff queries."""
+import hashlib,json
+from django.apps import apps
+from django.conf import settings
+from django.contrib import admin
+from django.core.exceptions import PermissionDenied,ValidationError
+from django.db import transaction
+from django.db.models import Q
+from .models import Site,Article,ArticleVersion
+
+
+def site_scope(request):
+    rows=Site.objects.all()
+    if request.user.is_superuser:return rows
+    return rows.filter(Q(owner=request.user)|Q(editors=request.user)).distinct()
+
+
+def article_scope(request):return Article.objects.filter(site__in=site_scope(request))
+
+
+def require(request,article,action):
+    manager=admin.site._registry.get(Article)
+    if manager is None or not request.user.is_active or not (request.user.is_staff or request.user.is_superuser) or not manager.has_module_permission(request):raise PermissionDenied('无内容管理权限')
+    allowed=manager.has_change_permission(request,article) if action=='submit' else manager.has_publish_permission(request,article)
+    if not allowed or not article_scope(request).filter(pk=article.pk).exists():raise PermissionDenied('无当前文章操作权限')
+
+
+def transition(request,article_id,action):
+    if action not in ('submit','publish','unpublish'):raise ValidationError('不支持的发布操作')
+    with transaction.atomic():
+        article=Article.objects.select_for_update().get(pk=article_id)
+        require(request,article,action)
+        if 'cms' in getattr(settings,'ORDLOOM_DISABLED_APPS',[]):raise PermissionDenied('内容应用未启用')
+        if action=='submit':
+            article.full_clean(exclude=['published_version'])
+            Article.objects.filter(pk=article.pk).update(state='review')
+            return None
+        if action=='unpublish':
+            Article.objects.filter(pk=article.pk).update(published_version=None,state='draft');return None
+        if article.state not in ('review','published'):raise ValidationError('请先送审当前草稿')
+        article.full_clean(exclude=['published_version'])
+        if article.tags.exclude(site=article.site).exists():raise ValidationError('标签须属于当前站点')
+        snapshot={'title':article.title,'excerpt':article.excerpt,'body':article.body,'cover_url':article.cover.url if article.cover else '',
+            'section_slug':article.section.slug if article.section else '', 'section_name':article.section.name if article.section else '',
+            'tags':list(article.tags.order_by('slug').values('slug','name'))}
+        digest=hashlib.sha256(json.dumps(snapshot,ensure_ascii=False,sort_keys=True).encode()).hexdigest()
+        latest=article.versions.first()
+        if latest is None or latest.fingerprint!=digest:
+            latest=ArticleVersion.objects.create(article=article,number=latest.number+1 if latest else 1,fingerprint=digest,created_by=request.user,**snapshot)
+        Article.objects.filter(pk=article.pk).update(published_version=latest,state='published')
+        return latest
+
+
+def member_access(request):
+    if not apps.is_installed('ordloom_members'):return False
+    from ordloom_members.services import current_member
+    return current_member(request) is not None
+
+
+def rendered_body(value):
+    import markdown,bleach
+    html=markdown.markdown(value,extensions=['fenced_code','tables'])
+    return bleach.clean(html,tags={'p','br','hr','h1','h2','h3','h4','h5','h6','strong','em','blockquote','ul','ol','li','pre','code','a','img','table','thead','tbody','tr','th','td'},
+        attributes={'a':['href','title'],'img':['src','alt','title'],'code':['class'],'th':['align'],'td':['align']},protocols={'http','https','mailto'},strip=True)

ordloom_cms-0.1.0/ordloom_cms/signals.py

@@ -0,0 +1,14 @@
+from django.db import transaction
+from django.db.models import F
+from django.db.models.signals import m2m_changed
+from django.dispatch import receiver
+from .models import Article
+
+
+@receiver(m2m_changed,sender=Article.tags.through,dispatch_uid='ordloom-cms-draft-tags')
+def tags_changed(sender,instance,action,reverse,pk_set,using,**kwargs):
+    if action not in ('pre_add','pre_remove','pre_clear'):return
+    ids=(list(pk_set) if pk_set is not None else list(sender.objects.using(using).filter(tag_id=instance.pk).values_list('article_id',flat=True))) if reverse else [instance.pk]
+    with transaction.atomic(using=using):
+        list(Article.objects.using(using).select_for_update().filter(pk__in=ids).order_by('pk').values_list('pk',flat=True))
+        Article.objects.using(using).filter(pk__in=ids).update(state='draft',draft_revision=F('draft_revision')+1)

ordloom_cms-0.1.0/ordloom_cms/static/ordloom_cms/extension.js

@@ -0,0 +1,6 @@
+export function activate({React,ui}){
+ const h=React.createElement
+ function Overview({data}){return h(ui.Card,{title:data.title},h('p',null,data.description),h(ui.Space,{wrap:true},h(ui.Statistic,{title:'草稿',value:data.drafts}),h(ui.Statistic,{title:'待审核',value:data.review}),h(ui.Statistic,{title:'公开版本',value:data.published})),h('p',null,h('a',{href:'#page=m%3Aordloom_cms.article'},'管理文章与发布操作')),h('div',null,...data.articles.map(a=>h('section',{key:a.id,style:{borderTop:'1px solid #e2e7f0',padding:'16px 0'}},h('strong',null,a.title),h('p',null,a.state+' · '+(a.published_version?'公开 v'+a.published_version:'尚未公开')),a.url?h('a',{href:a.url,target:'_blank',rel:'noopener noreferrer'},'查看公开页面'):null,h('details',null,h('summary',null,'最近发布历史（'+a.history.length+'）'),h('ul',null,...a.history.map(v=>h('li',{key:v.number},'v'+v.number+' · '+v.title+' · '+v.created_at))))))))}
+ function ContentLink({props:p}){const safe=typeof p.path==='string'&&/^\/(?!\/)/.test(p.path)&&!/[\\\u0000-\u0020]/.test(p.path);return h('article',{style:{padding:24,height:'100%',boxSizing:'border-box',background:p.dark?'#14243a':'#f4f5fc',color:p.dark?'#edf2fa':'#233147'}},h('h3',null,p.title),h('p',null,p.description),safe?h('a',{href:p.path,style:{color:'#6366f1'}},'前往阅读 →'):h('span',null,'请配置站内内容路径'))}
+ return {pages:{overview:Overview},widgets:{contentlink:ContentLink}}
+}

ordloom_cms-0.1.0/ordloom_cms/templates/ordloom_cms/article.html

@@ -0,0 +1 @@
+{% extends 'ordloom_cms/base.html' %}{% block title %}{{ article.title }} · {{ site.name }}{% endblock %}{% block meta %}<meta name="description" content="{{ article.excerpt }}"><link rel="canonical" href="{{ canonical }}">{% endblock %}{% block content %}<article class="paper"><p class="muted">{{ article.section.name }} · <time datetime="{{ article.published_at }}">{{ article.published_at|slice:':10' }}</time></p><h1>{{ article.title }}</h1><p>{{ article.excerpt }}</p>{% if article.cover_url %}<img class="cover" src="{{ article.cover_url }}" alt="">{% endif %}<div class="body">{{ article.body_html|safe }}</div><p>{% for tag in article.tags %}<span class="tag">{{ tag.name }}</span> {% endfor %}</p></article>{% endblock %}

ordloom_cms-0.1.0/ordloom_cms/templates/ordloom_cms/base.html

@@ -0,0 +1,3 @@
+<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>{% block title %}{{ site.name }}{% endblock %}</title>{% block meta %}{% endblock %}<style>
+*{box-sizing:border-box}body{margin:0;background:#f5f7fb;color:#243247;font:16px/1.8 system-ui,sans-serif}main{max-width:1040px;margin:0 auto;padding:32px 24px}header{border-bottom:1px solid #e0e6f0;margin-bottom:32px;padding-bottom:16px}h1{font-size:34px;line-height:1.35}a{color:#5554d6;text-decoration:none}.muted{color:#708098}article.card,.paper{background:white;border:1px solid #e2e7f0;border-radius:16px;padding:28px;margin:20px 0}.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:20px}.card h2{font-size:24px;line-height:1.4}.cover{width:100%;max-height:400px;object-fit:cover;border-radius:12px}.body{overflow-wrap:anywhere}.body img{max-width:100%;height:auto}.body pre{overflow:auto;background:#f4f6fa;padding:18px;border-radius:8px}.body table{border-collapse:collapse;max-width:100%;display:block;overflow:auto}.body td,.body th{border:1px solid #d8dfeb;padding:8px}.tag{display:inline-block;border-radius:20px;padding:2px 10px;background:#eef0fc;color:#5757bd;font-size:13px}input{max-width:100%;border:1px solid #d4dce8;border-radius:8px;padding:10px;font:inherit}button{background:#5757db;color:white;border:0;border-radius:8px;padding:11px 20px;font:inherit}footer{padding:24px 0;color:#708098}@media(max-width:500px){main{padding:20px 16px}h1{font-size:28px}.paper{padding:20px}}
+</style></head><body><main><header><p class="muted">ORDLOOM CMS</p><a href="{{ home_url }}">{{ site.name }}</a></header>{% block content %}{% endblock %}<footer>Ordloom · 内容服务</footer></main></body></html>

ordloom_cms-0.1.0/ordloom_cms/templates/ordloom_cms/index.html

@@ -0,0 +1 @@
+{% extends 'ordloom_cms/base.html' %}{% block content %}<h1>{{ site.name }}</h1><p class="muted">文章、动态与精选内容</p><form><input name="q" aria-label="搜索文章" placeholder="搜索文章" value="{{ request.GET.q }}"><button>搜索</button></form><div class="cards">{% for article in data.items %}<article class="card">{% if article.cover_url %}<img class="cover" src="{{ article.cover_url }}" alt="">{% endif %}<span class="tag">{{ article.section.name|default:'文章' }}</span><h2><a href="{{ article.url }}">{{ article.title }}</a></h2><p>{{ article.excerpt }}</p><a href="{{ article.url }}">阅读全文 →</a></article>{% empty %}<p>暂无已发布内容。</p>{% endfor %}</div><p>第 {{ data.page }} 页 · {{ data.total }} 篇</p>{% if data.has_next %}<a href="?page={{ data.page|add:1 }}&q={{ request.GET.q|urlencode }}&section={{ request.GET.section|urlencode }}">下一页 →</a>{% endif %}{% endblock %}

ordloom_cms-0.1.0/ordloom_cms/templates/ordloom_cms/locked.html

@@ -0,0 +1 @@
+<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>会员专享内容</title></head><body style="font:16px/1.8 system-ui;background:#f5f7fb;color:#243247"><main style="max-width:600px;margin:10vh auto;padding:32px;background:white;border-radius:16px"><h1>会员专享内容</h1><p>请先登录有效会员账号，再返回此页面阅读。</p>{% if login_url %}<a href="{{ login_url }}">前往会员中心</a>{% endif %}</main></body></html>

ordloom_cms-0.1.0/ordloom_cms/tests.py

@@ -0,0 +1,139 @@
+import copy
+from django.apps import apps
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Permission
+from django.core.cache import cache
+from django.core.exceptions import PermissionDenied,ValidationError
+from django.test import TestCase,RequestFactory,override_settings,Client
+from .models import Site,Section,Tag,Article,ArticleVersion
+from .services import transition
+
+
+class CMSTests(TestCase):
+    def setUp(self):
+        cache.clear();User=get_user_model();self.User=User
+        self.root=User._default_manager.create_user(**{User.USERNAME_FIELD:'cms-root@example.test'},is_staff=True,is_superuser=True)
+        self.editor=User._default_manager.create_user(**{User.USERNAME_FIELD:'cms-editor@example.test'},is_staff=True)
+        self.other=User._default_manager.create_user(**{User.USERNAME_FIELD:'cms-other@example.test'},is_staff=True)
+        self.editor.user_permissions.add(*Permission.objects.filter(content_type__app_label='ordloom_cms'))
+        self.site=Site.objects.create(name='示例站点',slug='main',owner=self.editor,public_enabled=True)
+        self.foreign=Site.objects.create(name='其他站点',slug='other',owner=self.other,public_enabled=True)
+        self.section=Section.objects.create(site=self.site,name='新闻',slug='news')
+        self.article=Article.objects.create(site=self.site,section=self.section,title='第一篇文章',slug='first',body='## 正文\n\n**内容**',excerpt='公开摘要',created_by=self.editor)
+        self.client.force_login(self.editor)
+    def request(self,user=None):
+        request=RequestFactory().post('/');request.user=user or self.editor;return request
+    def publish(self,article=None,user=None):
+        article=article or self.article;transition(self.request(user),article.pk,'submit');return transition(self.request(user),article.pk,'publish')
+    def public(self,slug='first',expected=200,client=None):
+        response=(client or self.client).get('/content/api/v1/main/articles/'+slug+'/');self.assertEqual(response.status_code,expected,response.content);return response
+    def test_draft_is_not_public_and_published_content_uses_immutable_snapshot(self):
+        self.public(expected=404);version=self.publish()
+        self.assertEqual(self.public().json()['data']['title'],'第一篇文章')
+        self.article.title='未发布的修改';self.article.body='private-draft';self.article.save()
+        result=self.public().json()['data'];self.assertEqual(result['title'],'第一篇文章');self.assertNotIn('private-draft',result['body'])
+        self.assertEqual(ArticleVersion.objects.get(pk=version.pk).title,'第一篇文章')
+    def test_native_admin_actions_reuse_existing_permissions_and_csrf(self):
+        url='/admin/api/action/ordloom_cms.article/'
+        response=self.client.post(url,{'name':'submit_articles','ids':[self.article.pk]},content_type='application/json')
+        self.assertEqual(response.status_code,200,response.content)
+        response=self.client.post(url,{'name':'publish_articles','ids':[self.article.pk]},content_type='application/json')
+        self.assertEqual(response.status_code,200,response.content);self.public()
+        self.client.force_login(self.other)
+        self.assertEqual(self.client.post(url,{'name':'unpublish_articles','ids':[self.article.pk]},content_type='application/json').status_code,403)
+        csrf=Client(enforce_csrf_checks=True);csrf.force_login(self.root)
+        self.assertEqual(csrf.post(url,{'name':'unpublish_articles','ids':[self.article.pk]},content_type='application/json').status_code,403)
+
+    def test_unchanged_save_preserves_review_and_published_pointer(self):
+        self.publish();self.article.refresh_from_db();revision=self.article.draft_revision
+        self.article.save();self.article.refresh_from_db()
+        self.assertEqual(self.article.state,'published');self.assertEqual(self.article.draft_revision,revision)
+
+    def test_review_is_required_and_new_edits_require_new_review(self):
+        with self.assertRaises(ValidationError):transition(self.request(),self.article.pk,'publish')
+        transition(self.request(),self.article.pk,'submit');self.article.body='changed';self.article.save()
+        with self.assertRaises(ValidationError):transition(self.request(),self.article.pk,'publish')
+        self.publish();self.assertEqual(ArticleVersion.objects.count(),1)
+    def test_republish_identical_content_reuses_latest_version(self):
+        version=self.publish();again=transition(self.request(),self.article.pk,'publish');self.assertEqual(version.pk,again.pk)
+        self.assertEqual(ArticleVersion.objects.count(),1)
+    def test_snapshot_cannot_be_mutated_and_unpublish_keeps_history(self):
+        version=self.publish()
+        with self.assertRaises(ValidationError):ArticleVersion.objects.filter(pk=version.pk).update(title='tamper')
+        with self.assertRaises(ValidationError):version.save()
+        transition(self.request(),self.article.pk,'unpublish');self.public(expected=404)
+        self.assertEqual(ArticleVersion.objects.count(),1)
+    def test_current_access_policy_and_site_switch_are_not_restored_by_content_history(self):
+        self.publish();self.article.refresh_from_db();self.article.access_level='members';self.article.save()
+        self.public(expected=403)
+        self.site.public_enabled=False;self.site.save();self.public(expected=404)
+    def test_members_only_content_requires_current_valid_customer_and_not_staff_session(self):
+        self.article.access_level='members';self.article.save();self.publish();self.public(expected=403)
+        if not apps.is_installed('ordloom_members'):return
+        from ordloom_members.models import Member
+        identity='reader@example.test';user=self.User._default_manager.create_user(**{self.User.USERNAME_FIELD:identity},password='reader-password-456')
+        member=Member.objects.create(user=user,display_name='读者');client=Client()
+        response=client.post('/members/api/v1/login/',{'identity':identity,'password':'reader-password-456'},content_type='application/json');self.assertEqual(response.status_code,200)
+        self.public(client=client);member.enabled=False;member.save(update_fields=['enabled']);self.public(expected=403,client=client)
+    def test_unpublished_and_members_content_never_leak_through_list_search_or_sitemap(self):
+        self.publish();private=Article.objects.create(site=self.site,title='private-secret',slug='secret',body='hidden-body',access_level='members');self.publish(private)
+        body=self.client.get('/content/api/v1/main/articles/').content.decode();self.assertNotIn('private-secret',body)
+        sitemap=self.client.get('/content/main/sitemap.xml').content.decode();self.assertNotIn('/secret/',sitemap);self.assertIn('/first/',sitemap)
+        self.assertEqual(self.client.get('/content/api/v1/main/articles/?q=private-secret').json()['data']['total'],0)
+    def test_domain_bound_sites_reject_wrong_host(self):
+        self.publish();self.site.domain='public.example.test';self.site.save();self.public(expected=404)
+    def test_site_scope_prevents_foreign_read_edit_and_publish(self):
+        foreign=Article.objects.create(site=self.foreign,title='别人的草稿',slug='foreign')
+        self.client.force_login(self.editor)
+        with self.assertRaises(PermissionDenied):transition(self.request(),foreign.pk,'submit')
+        from .admin import ArticleAdmin
+        from django.contrib import admin
+        manager=admin.site._registry[Article]
+        self.assertNotIn(foreign.pk,list(manager.get_queryset(self.request()).values_list('pk',flat=True)))
+        self.assertFalse(manager.has_change_permission(self.request(),foreign))
+    def test_revoked_site_editor_and_revoked_publish_permission_take_effect(self):
+        self.site.editors.add(self.other);self.other.user_permissions.add(*Permission.objects.filter(content_type__app_label='ordloom_cms'))
+        self.publish(user=self.other);self.site.editors.remove(self.other)
+        with self.assertRaises(PermissionDenied):transition(self.request(self.other),self.article.pk,'unpublish')
+        self.editor.user_permissions.remove(Permission.objects.get(content_type__app_label='ordloom_cms',codename='publish_article'))
+        fresh=self.User._default_manager.get(pk=self.editor.pk)
+        with self.assertRaises(PermissionDenied):transition(self.request(fresh),self.article.pk,'unpublish')
+    def test_cross_site_section_and_tags_are_rejected(self):
+        self.article.section=Section.objects.create(site=self.foreign,name='其他',slug='x')
+        with self.assertRaises(ValidationError):self.article.full_clean()
+        self.article.refresh_from_db();self.article.tags.add(Tag.objects.create(site=self.foreign,name='其他标签',slug='bad'))
+        with self.assertRaises(ValidationError):self.publish()
+    def test_changing_tags_invalidates_review_without_changing_public_snapshot(self):
+        self.publish();self.article.tags.add(Tag.objects.create(site=self.site,name='新标签',slug='new'))
+        self.article.refresh_from_db();self.assertEqual(self.article.state,'draft')
+        self.assertEqual(self.public().json()['data']['tags'],[])
+        with self.assertRaises(ValidationError):transition(self.request(),self.article.pk,'publish')
+    def test_published_article_route_is_stable_and_stale_save_does_not_remove_publication(self):
+        stale=Article.objects.get(pk=self.article.pk);version=self.publish();stale.body='new-draft';stale.save()
+        self.assertEqual(Article.objects.get(pk=stale.pk).published_version_id,version.pk)
+        stale.slug='renamed'
+        with self.assertRaises(ValidationError):stale.save()
+    def test_sanitized_markdown_blocks_scripts_event_attributes_and_unsafe_protocols(self):
+        self.article.body='<script>evil()</script>\n\n<img src="x" onerror="evil()">\n\n[link](javascript:evil)\n\n**safe**';self.article.save();self.publish()
+        value=self.public().json()['data']['body_html']
+        self.assertNotIn('<script',value);self.assertNotIn('onerror',value);self.assertNotIn('javascript:',value);self.assertIn('<strong>safe</strong>',value)
+        response=self.client.get('/content/main/first/');self.assertEqual(response.status_code,200);self.assertNotIn(b'<script',response.content)
+    def test_published_section_filter_uses_snapshot_not_new_draft_section(self):
+        self.publish();self.article.section=Section.objects.create(site=self.site,name='新栏目',slug='new');self.article.save()
+        self.assertEqual(self.client.get('/content/api/v1/main/articles/?section=new').json()['data']['total'],0)
+        self.assertEqual(self.client.get('/content/api/v1/main/articles/?section=news').json()['data']['total'],1)
+    @override_settings(ORDLOOM_DISABLED_APPS=['cms'])
+    def test_disabled_app_blocks_public_pages_and_model_module(self):
+        self.assertEqual(self.client.get('/content/main/').status_code,404)
+        from django.contrib import admin
+        self.assertFalse(admin.site._registry[Article].has_module_permission(self.request()))
+    def test_sdk_dashboard_and_component_are_installed_without_core_patching(self):
+        response=self.client.get('/admin/api/extensions/cms/pages/overview/');self.assertEqual(response.status_code,200,response.content)
+        self.assertEqual(response.json()['data']['drafts'],1)
+        apps=self.client.get('/admin/api/extensions/').json()['data']['applications']
+        self.assertTrue(any(a['id']=='cms' and a['widgets'][0]['type']=='app:cms.contentlink' for a in apps))
+    def test_public_listing_is_paginated_and_methods_are_readonly(self):
+        self.publish();self.assertEqual(self.client.get('/content/main/').status_code,200)
+        self.assertEqual(self.client.post('/content/main/',{}).status_code,405)
+        self.assertEqual(self.client.post('/content/api/v1/main/articles/',{}).status_code,405)
+        self.assertEqual(self.client.get('/content/api/v1/main/articles/?page=0').status_code,404)

ordloom_cms-0.1.0/ordloom_cms/urls.py

@@ -0,0 +1,7 @@
+from django.urls import path
+from . import views
+app_name='ordloom_cms'
+urlpatterns=[path('api/v1/<slug:site_slug>/articles/',views.api,name='api-list'),
+    path('api/v1/<slug:site_slug>/articles/<slug:slug>/',views.api,name='api-article'),
+    path('<slug:site_slug>/sitemap.xml',views.sitemap,name='sitemap'),
+    path('<slug:site_slug>/',views.index,name='site'),path('<slug:site_slug>/<slug:slug>/',views.article,name='article')]

ordloom_cms-0.1.0/ordloom_cms/views.py

@@ -0,0 +1,98 @@
+from urllib.parse import urlsplit
+from django.conf import settings
+from django.db.models import Q
+from django.http import JsonResponse,Http404,HttpResponse
+from django.shortcuts import render
+from django.urls import reverse,NoReverseMatch
+from django.views.decorators.cache import never_cache
+from django.utils.html import escape
+from .models import Site,Article
+from .services import member_access,rendered_body
+
+
+def enabled():return 'cms' not in getattr(settings,'ORDLOOM_DISABLED_APPS',[])
+
+
+def site_for(request,slug):
+    if not enabled():raise Http404()
+    site=Site.objects.filter(slug=slug,public_enabled=True).first()
+    if site is None or site.domain and site.domain.lower()!=urlsplit('//'+request.get_host()).hostname.lower():raise Http404()
+    return site
+
+
+def public_rows(request,site):
+    rows=Article.objects.filter(site=site,published_version__isnull=False).select_related('published_version','site')
+    if not member_access(request):rows=rows.filter(access_level='public')
+    return rows.order_by('-published_version__created_at','-pk')
+
+
+def path_for(request,name,**kwargs):
+    namespace=request.resolver_match.namespace or 'ordloom_cms'
+    return reverse(namespace+':'+name,kwargs=kwargs)
+
+
+def item(request,row,body=False):
+    version=row.published_version
+    value={'slug':row.slug,'title':version.title,'excerpt':version.excerpt,'cover_url':version.cover_url,
+        'section':{'slug':version.section_slug,'name':version.section_name},'tags':version.tags,
+        'version':version.number,'published_at':version.created_at.isoformat(),
+        'url':path_for(request,'article',site_slug=row.site.slug,slug=row.slug)}
+    if body:value.update(body=version.body,body_html=rendered_body(version.body))
+    return value
+
+
+def listing(request,site):
+    try:page=int(request.GET.get('page','1'));assert 1<=page<=10000
+    except (ValueError,AssertionError):raise Http404()
+    query=request.GET.get('q','')
+    if len(query)>100:raise Http404()
+    rows=public_rows(request,site)
+    if query:rows=rows.filter(Q(published_version__title__icontains=query)|Q(published_version__excerpt__icontains=query))
+    section=request.GET.get('section','')
+    if len(section)>50:raise Http404()
+    if section:rows=rows.filter(published_version__section_slug=section)
+    total=rows.count();items=[item(request,row) for row in rows[(page-1)*20:page*20]]
+    return {'site':{'name':site.name,'slug':site.slug},'items':items,'page':page,'total':total,'has_next':page*20<total}
+
+
+@never_cache
+def api(request,site_slug,slug=None):
+    if request.method!='GET':return JsonResponse({'ok':False,'message':'仅支持 GET'},status=405)
+    site=site_for(request,site_slug)
+    if slug is None:return JsonResponse({'ok':True,'data':listing(request,site)})
+    row=Article.objects.select_related('published_version','site').filter(site=site,slug=slug,published_version__isnull=False).first()
+    if row is None:raise Http404()
+    if row.access_level=='members' and not member_access(request):return JsonResponse({'ok':False,'message':'请先登录有效会员账号'},status=403)
+    return JsonResponse({'ok':True,'data':item(request,row,body=True)})
+
+
+@never_cache
+def index(request,site_slug):
+    if request.method!='GET':return HttpResponse(status=405)
+    site=site_for(request,site_slug);data=listing(request,site)
+    return render(request,'ordloom_cms/index.html',{'site':site,'data':data,'home_url':path_for(request,'site',site_slug=site.slug)})
+
+
+@never_cache
+def article(request,site_slug,slug):
+    if request.method!='GET':return HttpResponse(status=405)
+    site=site_for(request,site_slug)
+    row=Article.objects.select_related('published_version','site').filter(site=site,slug=slug,published_version__isnull=False).first()
+    if row is None:raise Http404()
+    if row.access_level=='members' and not member_access(request):
+        try:login_url=reverse('ordloom_members:portal')
+        except NoReverseMatch:login_url=None
+        return render(request,'ordloom_cms/locked.html',{'login_url':login_url},status=403)
+    data=item(request,row,body=True)
+    return render(request,'ordloom_cms/article.html',{'site':site,'article':data,'canonical':request.build_absolute_uri(data['url']),'home_url':path_for(request,'site',site_slug=site.slug)})
+
+
+@never_cache
+def sitemap(request,site_slug):
+    if request.method!='GET':return HttpResponse(status=405)
+    site=site_for(request,site_slug)
+    # Never list member-only URLs, including while an editor is logged in.
+    rows=Article.objects.filter(site=site,published_version__isnull=False,access_level='public').order_by('pk')[:10001]
+    if len(rows)>10000:return HttpResponse('站点地图超过本版上限',status=413)
+    urls=''.join('<url><loc>'+str(escape(request.build_absolute_uri(path_for(request,'article',site_slug=site.slug,slug=row.slug))))+'</loc></url>' for row in rows)
+    return HttpResponse('<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">'+urls+'</urlset>',content_type='application/xml')

ordloom_cms-0.1.0/ordloom_cms.egg-info/PKG-INFO

@@ -0,0 +1,26 @@
+Metadata-Version: 2.4
+Name: ordloom-cms
+Version: 0.1.0
+Summary: Ordloom 内容管理子应用
+Project-URL: Homepage, https://neekin.github.io/ordloom-docs/
+Project-URL: Documentation, https://neekin.github.io/ordloom-docs/guides/cms-and-members.html
+Project-URL: Repository, https://github.com/neekin/simpleui-antd
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: ordloom<2,>=1.1.0
+Requires-Dist: Markdown<4,>=3.7
+Requires-Dist: bleach<7,>=6.2
+
+# ordloom-cms
+
+Ordloom 子应用 SDK 的内容管理 MVP：站点、栏目、标签、Markdown 文章、封面、送审/发布/下线、不可变发布快照、公开 HTML/JSON、搜索/分页、Sitemap，以及可选会员内容。
+
+版本 0.1.0，依赖 Ordloom 1.1.0+ 的 SDK v1。独立安装：
+
+```bash
+python -m pip install ordloom-cms==0.1.0
+```
+
+注册 `ordloom_cms.apps.ExtensionConfig`，挂载 `include("ordloom_cms.urls")`，执行 `migrate` 与 `collectstatic`。站点默认不公开。管理沿用 Django 模型权限，并限制负责人/编辑成员的站点范围；公开发布另需 `publish_article` / `publish_site`。不安装会员模块时，会员内容保持关闭。
+
+完整接入与边界见 [CMS 与会员指南](https://neekin.github.io/ordloom-docs/guides/cms-and-members.html)。

ordloom_cms-0.1.0/ordloom_cms.egg-info/SOURCES.txt

@@ -0,0 +1,24 @@
+README.md
+pyproject.toml
+ordloom_cms/__init__.py
+ordloom_cms/admin.py
+ordloom_cms/apps.py
+ordloom_cms/extension.py
+ordloom_cms/models.py
+ordloom_cms/services.py
+ordloom_cms/signals.py
+ordloom_cms/tests.py
+ordloom_cms/urls.py
+ordloom_cms/views.py
+ordloom_cms.egg-info/PKG-INFO
+ordloom_cms.egg-info/SOURCES.txt
+ordloom_cms.egg-info/dependency_links.txt
+ordloom_cms.egg-info/requires.txt
+ordloom_cms.egg-info/top_level.txt
+ordloom_cms/migrations/0001_initial.py
+ordloom_cms/migrations/__init__.py
+ordloom_cms/static/ordloom_cms/extension.js
+ordloom_cms/templates/ordloom_cms/article.html
+ordloom_cms/templates/ordloom_cms/base.html
+ordloom_cms/templates/ordloom_cms/index.html
+ordloom_cms/templates/ordloom_cms/locked.html

ordloom_cms-0.1.0/ordloom_cms.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

ordloom_cms-0.1.0/ordloom_cms.egg-info/requires.txt

@@ -0,0 +1,3 @@
+ordloom<2,>=1.1.0
+Markdown<4,>=3.7
+bleach<7,>=6.2

ordloom_cms-0.1.0/ordloom_cms.egg-info/top_level.txt

@@ -0,0 +1 @@
+ordloom_cms

ordloom_cms-0.1.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ordloom-cms"
+version = "0.1.0"
+description = "Ordloom 内容管理子应用"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = ["ordloom>=1.1.0,<2", "Markdown>=3.7,<4", "bleach>=6.2,<7"]
+
+[project.urls]
+Homepage = "https://neekin.github.io/ordloom-docs/"
+Documentation = "https://neekin.github.io/ordloom-docs/guides/cms-and-members.html"
+Repository = "https://github.com/neekin/simpleui-antd"
+
+[tool.setuptools.packages.find]
+include = ["ordloom_cms*"]
+
+[tool.setuptools.package-data]
+ordloom_cms = ["static/ordloom_cms/*.js", "templates/ordloom_cms/*.html"]

ordloom_cms-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+