From a2d4f81bfe4e14f5d620f479b2f1389941e0dce8 Mon Sep 17 00:00:00 2001 From: Mischa Date: Sat, 4 Jul 2026 23:44:00 +0200 Subject: [PATCH] =?UTF-8?q?feat(post-form):=20U3=20=E2=80=94=20auth-aware?= =?UTF-8?q?=20feed=20collection;=20drafts=20owner-only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner-aware draft visibility (R5, KTD7/KTD8) on trip.html.twig and home.html.twig (active-trip branch): - Compute owner_can_edit = authenticated AND username == site.owner_username AND (this is the active trip). The super-admin tester authenticates too, so the gate is owner identity, not mere login. - The feed list (all_items) uses an owner-aware journal collection: owner sees drafts, everyone else (and every non-active-trip view) sees published only. - journal_entries stays published-only — it feeds stats/counts. map_entries now filters on item.page.published, so drafts get a feed card but no marker and no stat contribution. - Thread owner_can_edit into trip-feed-col (defaults false) for the U4 controls. Between-trips home grid stays published-only. Stories untouched (journal drafts only). Verified on the container: draft entry with coords shows in the owner's feed but not the map or count; absent entirely for anonymous (V4). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01H1FrCYNq6RXdGYbn5PFrhM --- themes/intotheeast/templates/home.html.twig | 16 +++++++++++--- .../partials/trip-feed-col.html.twig | 4 ++++ themes/intotheeast/templates/trip.html.twig | 21 ++++++++++++++++--- 3 files changed, 35 insertions(+), 6 deletions(-) diff --git a/themes/intotheeast/templates/home.html.twig b/themes/intotheeast/templates/home.html.twig index 1544a0a..1f73e59 100644 --- a/themes/intotheeast/templates/home.html.twig +++ b/themes/intotheeast/templates/home.html.twig @@ -14,11 +14,19 @@ {% set dailies_page = grav.pages.find(trip_route ~ '/dailies') %} {% set stories_page = grav.pages.find(trip_route ~ '/stories') %} +{# published-only — feeds the map, stats and counts (drafts excluded, R5) #} {% set journal_entries = dailies_page ? dailies_page.children.published() : [] %} {% set story_entries = stories_page ? stories_page.children.published() : [] %} +{# This branch IS the active trip, so the owner gate is just owner identity + (KTD8). The super-admin tester authenticates too, so gate on owner_username. #} +{% set owner_can_edit = grav.user.authenticated + and grav.user.username == grav.config.site.owner_username %} +{# Owner-aware feed list: owner sees drafts; everyone else published only #} +{% set journal_feed = (owner_can_edit and dailies_page) ? dailies_page.children : journal_entries %} + {% set all_items = [] %} -{% for e in journal_entries %} +{% for e in journal_feed %} {% set all_items = all_items|merge([{'type': 'journal', 'page': e, 'date': e.header.date}]) %} {% endfor %} {% for s in story_entries %} @@ -38,7 +46,8 @@ {% set map_entries = [] %} {% for item in all_items %} - {% if item.type == 'journal' and item.page.header.lat is not empty and item.page.header.lng is not empty %} + {# drafts render as a feed card only — never a map marker (R5) #} + {% if item.type == 'journal' and item.page.published and item.page.header.lat is not empty and item.page.header.lng is not empty %} {% set map_entries = map_entries|merge([{ 'lat': item.page.header.lat|number_format(6, '.', ''), 'lng': item.page.header.lng|number_format(6, '.', ''), @@ -87,7 +96,8 @@ has_gpx: home_gpx_urls|length > 0, gpx_urls: home_gpx_urls, gps_points: gps_points, - show_sort: false + show_sort: false, + owner_can_edit: owner_can_edit } only %} {% endif %} diff --git a/themes/intotheeast/templates/partials/trip-feed-col.html.twig b/themes/intotheeast/templates/partials/trip-feed-col.html.twig index 8c024ef..5163316 100644 --- a/themes/intotheeast/templates/partials/trip-feed-col.html.twig +++ b/themes/intotheeast/templates/partials/trip-feed-col.html.twig @@ -1,5 +1,9 @@ {% import 'macros/stats.html.twig' as stats_m %} {% import 'macros/cycling.html.twig' as cycling_m %} +{# owner_can_edit gates the Draft badge + Edit/Delete controls on each card + (threaded into entry-journal below). Default false so any caller that doesn't + pass it renders a read-only feed. #} +{% set owner_can_edit = owner_can_edit ?? false %}

{{ trip_page.title }}

diff --git a/themes/intotheeast/templates/trip.html.twig b/themes/intotheeast/templates/trip.html.twig index 5d68118..d6e83b3 100644 --- a/themes/intotheeast/templates/trip.html.twig +++ b/themes/intotheeast/templates/trip.html.twig @@ -9,11 +9,24 @@ {% endblock %} {% set dailies_page = grav.pages.find(page.route ~ '/dailies') %} {% set stories_page = grav.pages.find(page.route ~ '/stories') %} +{# journal_entries stays published-only — it feeds the map, stats and counts, + which must never include drafts (R5). #} {% set journal_entries = dailies_page ? dailies_page.children.published() : [] %} {% set story_entries = stories_page ? stories_page.children.published() : [] %} +{# Owner gate (KTD8): the site owner (not merely any login — the super-admin + tester also authenticates) viewing the ACTIVE trip. Drives draft visibility + in the feed and the Edit/Delete controls (threaded to the card partial). #} +{% set active_trip_slug = (grav.config.site.active_trip|default(''))|split('/')|last %} +{% set owner_can_edit = grav.user.authenticated + and grav.user.username == grav.config.site.owner_username + and page.slug == active_trip_slug %} +{# Feed list is owner-aware: the owner sees drafts (unpublished) too; everyone + else (and every non-active-trip view) sees published only (R5, KTD7). #} +{% set journal_feed = (owner_can_edit and dailies_page) ? dailies_page.children : journal_entries %} + {% set all_items = [] %} -{% for e in journal_entries %} +{% for e in journal_feed %} {% set all_items = all_items|merge([{'type': 'journal', 'page': e, 'date': e.header.date}]) %} {% endfor %} {% for s in story_entries %} @@ -41,7 +54,8 @@ {% set map_entries = [] %} {% for item in all_items %} - {% if item.page.header.lat is not empty and item.page.header.lng is not empty %} + {# drafts render as a feed card only — never a map marker (R5) #} + {% if item.page.published and item.page.header.lat is not empty and item.page.header.lng is not empty %} {% set map_entries = map_entries|merge([{ 'type': item.type, 'lat': item.page.header.lat|number_format(6, '.', ''), @@ -78,7 +92,8 @@ has_gpx: has_gpx, gpx_urls: gpx_urls, gps_points: gps_points, - show_sort: true + show_sort: true, + owner_can_edit: owner_can_edit } only %}