Files
intotheeast-com-content/themes/intotheeast/templates/trip.html.twig
T
m038andClaude Opus 4.8 b8daea217d feat(post-form): U6 — owner-scoped delete API route + card wiring
New custom-in-repo plugin entry-actions (un-ignored in .gitignore, NOT in
plugins.txt) registers DELETE /api/v1/entry/{slug} via onApiRegisterRoutes
(KTD5). The handler requires the authenticated site OWNER (not any login/admin),
rejects unsafe slugs (400), resolves the target through the page tree, asserts it
is a direct child of the active trip's dailies container, deletes the folder and
clears the cache — sharing EntryScopeGuard with the save path so R6 can't diverge.
A lazy per-namespace autoloader loads the controller on cached-route requests
(the router dispatches from route.cache without re-firing onApiRegisterRoutes).
EntryScopeGuard gains isOwnerUser() (API user comes from the request, not
$grav['user']) and enablePages() before find() (pages are lazily disabled in the
API context).

feed-actions.js (new, built via make build-assets; loaded on the trip/home feed
only when owner_can_edit) wires the inline Delete → Cancel/Confirm swap: on
Confirm it locks both buttons (D2, no double-DELETE), fetches the route
(credentials:include), removes the card, moves focus to the next card, and
announces via a page-level aria-live region (D4); on failure it restores the
control with an inline message (D7). Adds .sr-only + .entry-action[hidden] CSS.

Verified on the 2.0.4 container — API matrix 8/8 (anon 401, non-owner 403, bad
slug 400, out-of-scope 404, owner 204 + folder removed; V3/V5) and the delete UI
in a headless browser (confirm swap, card removal, disk deletion, live announce).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H1FrCYNq6RXdGYbn5PFrhM
2026-07-05 00:19:15 +02:00

105 lines
4.2 KiB
Twig

{% extends 'partials/base.html.twig' %}
{% block content %}
{% import 'macros/stats.html.twig' as stats_m %}
{% import 'macros/cycling.html.twig' as cycling_m %}
{% block map_assets %}
{% do assets.addCss('theme://css-compiled/map.css') %}
{% do assets.addJs('theme://js/map.js', {group: 'bottom'}) %}
{% endblock %}
{% set dailies_page = grav.pages.find(page.route ~ '/dailies') %}
{% set stories_page = grav.pages.find(page.route ~ '/stories') %}
{# journal_entries stays published-only — it feeds the map, stats and counts,
which must never include drafts (R5). #}
{% set journal_entries = dailies_page ? dailies_page.children.published() : [] %}
{% set story_entries = stories_page ? stories_page.children.published() : [] %}
{# Owner gate (KTD8): the site owner (not merely any login — the super-admin
tester also authenticates) viewing the ACTIVE trip. Drives draft visibility
in the feed and the Edit/Delete controls (threaded to the card partial). #}
{% set active_trip_slug = (grav.config.site.active_trip|default(''))|split('/')|last %}
{% set owner_can_edit = grav.user.authenticated
and grav.user.username == grav.config.site.owner_username
and page.slug == active_trip_slug %}
{# Feed list is owner-aware: the owner sees drafts (unpublished) too; everyone
else (and every non-active-trip view) sees published only (R5, KTD7). #}
{% set journal_feed = (owner_can_edit and dailies_page) ? dailies_page.children : journal_entries %}
{% if owner_can_edit %}{% do assets.addJs('theme://js/feed-actions.js', {group: 'bottom'}) %}{% endif %}
{% set all_items = [] %}
{% for e in journal_feed %}
{% set all_items = all_items|merge([{'type': 'journal', 'page': e, 'date': e.header.date}]) %}
{% endfor %}
{% for s in story_entries %}
{% set all_items = all_items|merge([{'type': 'story', 'page': s, 'date': s.header.date}]) %}
{% endfor %}
{% set all_items = all_items|sort_by_key('date', 4) %}
{% set journal_count = journal_entries|length %}
{% set story_count = story_entries|length %}
{% set gps_points = [] %}
{% for entry in journal_entries %}
{% if entry.header.lat is not empty and entry.header.lng is not empty %}
{% set gps_points = gps_points|merge([[entry.header.lat, entry.header.lng]]) %}
{% endif %}
{% endfor %}
{% set gpx_urls = [] %}
{% for name, media in page.media.all %}
{% if name|split('.')|last == 'gpx' %}
{% set gpx_urls = gpx_urls|merge([page.url ~ '/' ~ name]) %}
{% endif %}
{% endfor %}
{% set has_gpx = gpx_urls|length > 0 %}
{% set map_entries = [] %}
{% for item in all_items %}
{# drafts render as a feed card only — never a map marker (R5) #}
{% if item.page.published and item.page.header.lat is not empty and item.page.header.lng is not empty %}
{% set map_entries = map_entries|merge([{
'type': item.type,
'lat': item.page.header.lat|number_format(6, '.', ''),
'lng': item.page.header.lng|number_format(6, '.', ''),
'slug': item.page.slug,
'title': item.page.title,
'url': item.page.url,
'force_connect': item.page.header.force_connect ? true : false,
'transport_mode': item.page.header.transport_mode ? item.page.header.transport_mode : null
}]) %}
{% endif %}
{% endfor %}
<div class="home-layout">
{% include 'partials/entry-map.html.twig' with {
map_id: 'trip-map',
map_global: 'tripMap',
entries: map_entries,
card_prefix: 'entry-',
story_markers: true,
gpx_urls: gpx_urls,
use_gpx: page.header.use_gpx ?? true,
autoconnect: page.header.autoconnect ?? 'on',
gpx_source_prefix: 'gpx',
journey_id: 'trip-journey'
} only %}
{% include 'partials/trip-feed-col.html.twig' with {
trip_page: page,
all_items: all_items,
journal_entries: journal_entries,
journal_count: journal_count,
story_count: story_count,
has_gpx: has_gpx,
gpx_urls: gpx_urls,
gps_points: gps_points,
show_sort: true,
owner_can_edit: owner_can_edit,
feed_return_url: page.url
} only %}
</div>
<button class="story-totop" id="trip-totop" aria-label="Back to top">↑ Top</button>
{% endblock %}