Brings the branch up to user/main, which was ahead on both content and
theme fixes. Notably e17a5dc ("block submit on unfinished photo uploads;
un-squeeze EXIF portraits in lightbox") — the branch point predated it, and
its absence is why UG1, UG2 and LD1 failed here: the upload gate and the
oriented-derivative slide dims those specs assert simply were not on this
branch. Also picks up denmark-2026 `published: true`, so the local testing
flip is no longer needed.
js/src/post-form.js auto-merged cleanly, keeping both main's upload gate and
this branch's location-override panel + lazy maplibre CSS link. The only
conflict was js/post/post-form.js, a generated bundle — resolved by
rebuilding via make build-assets rather than hand-merging minified output.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs/demo/trips/italy-2025/ shares its slug with a real trip (deliberately —
the fixture supplies that trip's GPX and dailies), so demo-load copies this
trip.md straight over the live page. The fixture was a snapshot from before the
trip gained a tagline, so every `make test` silently deleted that tagline from
real content, showing up as an unexplained dirty submodule afterwards.
Re-sync it byte-identically to the live page. The note about keeping colliding
fixtures in sync goes in the Makefile recipe, not here — anything added to this
file lands in real content on the next demo-load.
The engine was already a lazy import(), but its CSS was a static one — the
usual workaround for esbuild never emitting a <link> for a code-split chunk's
stylesheet (R10). That folded the whole vendor sheet into post-form.css, so
every /post load paid for a panel most submits never open, and ~78% of those
bytes were rules for controls this map never creates (popups, geolocate, zoom,
compass, fullscreen, terrain, scale).
Build the vendor sheet as its own css-compiled/maplibre-gl.css and have
location-map.js <link> it at panel-open, concurrently with the engine's
import(). Keeping the file intact rather than hand-picking the ~16 selectors
in use means a maplibre upgrade can't silently un-style the map.
post-form.css 92,244 → 26,784 raw (14,528 → 5,631 gzip)
The href resolves from import.meta.url, so it is correct under any Grav base
path without threading a URL through the template — the panel is built entirely
in JS, so there is no element to hang a data-attr on. A failed stylesheet load
resolves rather than rejects: the map degrades to unstyled, never to absent.
The existing lazy-load guard spec already matched every maplibre-gl URL, so it
covers the stylesheet too; its message now says so, and a new test asserts the
other half — that opening the panel does link and apply the sheet.
Two code-review follow-ups.
cleanCoordinate() — the server-side coordinate sanitizer the design doc and
plan both describe as already shipped — had never actually been committed; it
existed only as uncommitted work in another checkout, so this branch had no
server-side validation of lat/lng at all (the blueprint fields are plain
`type: text` with no `validate:` key). Landing it here makes the spec's stated
safety net real. Also corrected its onAdminSave comment, which justified that
hook by saying the public form's lat/lng inputs are CSS-hidden and GPS-filled
— true before this feature, inverted by it. Both hooks are needed: this branch
makes /post the primary hand-entry path, not Admin2.
The geocode lookup swallowed every failure and reset the button, leaving the
DOM byte-identical to the pre-click state — a traveller on flaky mobile data
could not distinguish a failed lookup from a broken button. It now shows a
distinct hint, and checks r.ok first so a 4xx/5xx body no longer parses as
"no results" and tells the traveller their city does not exist. R8's actual
guarantee (fields untouched on failure) is preserved.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Code-review fixes to the location-override panel.
parseFloat is a prefix parser, so '48abc', '48,85' (comma-decimal paste) and
'35.0116S' (hemisphere suffix, silently flipped to the wrong side of the
equator) all passed the isFinite + range check, cleared the mismatch flag and
were POSTed verbatim — the same silent-corruption class this feature exists to
end. Replaced with a whole-value decimal check, and the valid branch now
normalises to the 6dp the GPS handler and onDragEnd already write, so the pin
and the submitted value cannot disagree.
The submit gate keyed on the .location-field--mismatch class, which was only
ever set by syncFields() on blur / debounced input / toggle-open-success / GPS
— never at init. Three paths therefore reached the server unflagged: a draft
restored by initDraft() (which runs before initLocationDetails() and assigns
.value directly, firing no events), an edit-mode async prefill, and an open
panel whose maplibre chunk failed to load. syncFields() now runs once at the
end of initLocationDetails(), in the toggle handler's catch arm, and after the
edit prefill writes lat/lng.
Blanking both fields left the marker behind, presenting a stale coordinate as
if it were still the entry's — added clearPin() to the map handle and call it.
Removed hasPin(), which had no caller. Corrected two comments that named the
wrong stylesheet and claimed .field-invalid reuse the code does not do.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Code review (4 independent reviewers) converged on the same bug: the
maplibre-gl singleton cached its handle only after import() resolved,
so a fast close/reopen of the "More location details" panel could
race two Map instances onto one container. Cache the in-flight promise
synchronously instead, and propagate/handle import rejection so a
failed map load surfaces a hint instead of hanging silently.
Also closes a submit-time hole the adversarial pass found: the
mismatch flag on lat/lng was purely cosmetic and never blocked
form submission, so out-of-range coordinates could be saved. The
flag now gates submit like the other required fields, and clears
itself when both fields are blanked back out instead of sticking.
The geocode fetch gets a 10s timeout via AbortController so a hung
response can't leave the lookup button disabled forever.
Also moves the location-details CSS out of the site-wide style.css
into post-form's own code-split stylesheet, since none of it is used
outside the post form.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Closed-by-default disclosure below City/Country holding a city/country
geocode lookup (Open-Meteo, city-only query with client-side country
ranking), a single-marker draggable MapLibre preview (lazy-loaded via
location-map.js), and the relocated lat/lng fields. GPS button, search
pick, pin drag, and typed values all stay in sync via syncPinFromFields(),
with a visual mismatch flag for unparseable typed input.
Built entirely in JS (mirrors the existing 'More options' disclosure
pattern) so post-form.html.twig needs no template change.
Single source of truth for the MapLibre style URL, shared between
maplibre-utils.js (multi-marker/GPX maps) and the new location-map.js
preview module — no behavior change.
Removes the CSS rule hiding data[lat]/data[lng] and adds styling for the
new 'More location details' disclosure, search results list, map preview
container, and mismatch-flag state.
The entry-map partial always rendered .feed-map-fullscreen-btn, but the
MapLibre init AND the button's click wiring only run when entries exist —
so on the home pre-departure state (active trip, no published posts) mobile
showed a dead button floating over an empty 40vh map area. Gate the button
on the same entries|length condition as the init script; it reappears with
the first published post, exactly when it becomes functional. Covers any
zero-entry trip page too (shared partial).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195b3cDdMeize2Mm1FgC2aU
Two prod bugs from the 2026-07-09 owner test:
- post-form.js: complete upload gate on create submit. The form plugin's
guard only blocks PROCESSING/QUEUED, so a failed upload (processing-error)
or a just-picked file (loading) submitted silently and the entry saved
without its photo. Submit is now blocked unless every FilePond item is
processing-complete, with a visible status message for the failed vs
still-uploading cases. (Bundle rebuilt via make build-assets.)
- entry-journal partial: PhotoSwipe slides now link to a 2000px fit-within
derivative and measure THAT file for data-pswp-width/height. The old
img.width/height came from raw getimagesize() of the original, which
ignores EXIF orientation, so stored-rotated portrait JPEGs got landscape
slide boxes and rendered squeezed. Derivatives are re-encoded (EXIF
stripped, orientation baked in server-side), so declared dims always match
rendering. Also fixes the wrapper aspect-ratio pick for portrait-first
entries. Note: Medium 'path' must be called as path() in Twig — the
ArrayAccess 'path' item (page folder) shadows the method.
Covered by tests/ui/post/upload-gate.spec.js and lightbox-dims.spec.js in
the dev repo.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195b3cDdMeize2Mm1FgC2aU
- Override the Login plugin's white #grav-login box to use dark theme tokens
- Style flash/form notices (.notices, #messages .toast) globally on-theme;
override markdown-notices' bright per-colour variant backgrounds so error/
success/warning messages stay dark with a coloured left border
- Add a Logout link to the main nav (authenticated-only, plain nav style);
no login link in the menu
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rw9Tceo6DSzVqWKkjVJpHZ
- featured: true on Central Asia 2023, Italy 2025, and US/Canada/Mexico 2024 entries
(surface in the between-trips homepage highlights grid)
- Denmark 2026 trip: published: true + Vestkystruten GPX track
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn
Owner publish/unpublish toggle on the /trips listing (owner-gated API endpoint
mutating trip.md published state with APCu-aware cache invalidation, owner-
visible drafts, home fallback), plus the code-review follow-ups: shared scope-
guard helper, guarded cache-flush, shared api-utils (apiSend/apiErrorMsg with
opt-in timeout), template-asserted publish target, active-trip one-liner, and
the --color-draft-accent token.
Merges cleanly with the denmark-2026 cover content on main (disjoint files).
- resolveTripChild now asserts the resolved page uses the trip template, so a
non-trip direct child of /trips could never be toggled through this endpoint
(P3 adversarial).
- apiSend gains an optional timeoutMs (AbortController); trip-publish passes 10s
so a hung toggle can't leave the switch stuck aria-busy. post-form omits it,
keeping media uploads unbounded (P2 reliability).
- trips.html.twig reuses trip.html.twig's one-line active-trip slug match
instead of a bespoke 3-branch OR (P2 maintainability).
- Draft-badge amber is now a --color-draft-accent token shared by the trip and
journal badges instead of a twice-hardcoded #E0A458 literal (P3).
Rebuilt js/trip-publish.js and js/post/post-form.js (shared api-utils change).
PHP lint clean; trip-publish suite 10/10; post suite unchanged.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn
Address the P1 maintainability finding that trip-publish.js reimplemented
post-form.js's apiSend + login-expired error copy verbatim. Extract both into
js/src/api-utils.js and import from both entry points; esbuild inlines the
module into each bundle so there is no runtime coupling. Also drops the stale
data-trip-route reference from trip-publish.js's markup-contract comment.
Rebuilt js/trip-publish.js and js/post/post-form.js.
Verified: trip-publish suite 8/8; post suite unchanged (34 pass, same 6
owner-gate environmental fails as baseline — photo-editor specs that exercise
post-form's apiSend/apiErrorMsg all green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn
Address code-review findings on the trip publish/unpublish toggle:
- Extract EntryScopeGuard::resolveChildOf() so resolveActiveDailyChild and
resolveTripChild share one find() + parent-route-assert body instead of two
copies that could drift (P1 maintainability).
- Wrap setTripPublished's post-save cache invalidation in try/catch. save() has
already persisted the published flag to disk, so a flush failure now logs a
loud reconciliation warning (and still returns success + the audit line)
rather than bubbling to a bare 500 that reads as "nothing happened"
(P2 reliability / adversarial).
Behavior-preserving; PHP lint clean; trip-publish Playwright suite 8/8.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn
Add an owner-only publish switch to each /trips card. It POSTs to a new
entry-actions route that mutates trip.md `published` and invalidates the
page-tree cache so the listing, nav and home reflect the change on the
next load. Owner sees drafts (Draft badge); anon/non-owner unchanged.
- U1 EntryScopeGuard::resolveTripChild — resolve a slug to a direct child
of /trips (drafts included, for republish)
- U2 POST /api/v1/trip/{slug}/publish (setTripPublished) — owner-gated
write, strict is_bool body, header-mutation save, audit log
- U3 trip-publish-toggle partial + CSS (role=switch, Draft badge, visible
failure toast, ≥44px target)
- U4 owner-aware /trips listing + card restructure (toggle overlays cover
as a non-anchor sibling; works for coverless drafts)
- U5 home active-trip branch falls back when the active trip is unpublished
- U6 trip-publish.js (confirm/pending/optimistic/revert) + esbuild wiring
Cache note: an in-place frontmatter edit keeps the folder-check cache id,
and driver:auto uses APCu in web memory, so deleteAll()+invalidateCache()
is insufficient — the endpoint also calls apcu_clear_cache().
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn
m038andClaude Opus 5