m038andClaude Opus 4.8
b8daea217d
New custom-in-repo plugin entry-actions (un-ignored in .gitignore, NOT in
plugins.txt) registers DELETE /api/v1/entry/{slug} via onApiRegisterRoutes
(KTD5). The handler requires the authenticated site OWNER (not any login/admin),
rejects unsafe slugs (400), resolves the target through the page tree, asserts it
is a direct child of the active trip's dailies container, deletes the folder and
clears the cache — sharing EntryScopeGuard with the save path so R6 can't diverge.
A lazy per-namespace autoloader loads the controller on cached-route requests
(the router dispatches from route.cache without re-firing onApiRegisterRoutes).
EntryScopeGuard gains isOwnerUser() (API user comes from the request, not
$grav['user']) and enablePages() before find() (pages are lazily disabled in the
API context).
feed-actions.js (new, built via make build-assets; loaded on the trip/home feed
only when owner_can_edit) wires the inline Delete → Cancel/Confirm swap: on
Confirm it locks both buttons (D2, no double-DELETE), fetches the route
(credentials:include), removes the card, moves focus to the next card, and
announces via a page-level aria-live region (D4); on failure it restores the
control with an inline message (D7). Adds .sr-only + .entry-action[hidden] CSS.
Verified on the 2.0.4 container — API matrix 8/8 (anon 401, non-owner 403, bad
slug 400, out-of-scope 404, owner 204 + folder removed; V3/V5) and the delete UI
in a headless browser (confirm swap, card removal, disk deletion, live announce).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H1FrCYNq6RXdGYbn5PFrhM
61 lines
2.4 KiB
PHP
61 lines
2.4 KiB
PHP
<?php
|
|
namespace Grav\Plugin;
|
|
|
|
use Grav\Common\Plugin;
|
|
use RocketTheme\Toolbox\Event\Event;
|
|
|
|
/**
|
|
* Entry Actions — a thin, purpose-built API surface for owner-only, active-trip
|
|
* scoped journal-entry actions that the stock Grav API cannot express safely.
|
|
*
|
|
* M1 registers exactly one route: DELETE /api/v1/entry/{slug}. The stock
|
|
* DELETE /api/v1/pages<route> only checks write-permission (no trip scope, and
|
|
* any admin passes), which violates R6. This route requires the configured site
|
|
* OWNER and asserts the target is a direct child of the active trip's dailies
|
|
* container — sharing one guard (EntryScopeGuard) with the save path so the two
|
|
* R6 enforcement points cannot diverge (KTD5).
|
|
*
|
|
* Custom-in-repo (NOT GPM-managed): tracked via a `!` negation in user/.gitignore
|
|
* and deployed with the content push, like cache-on-save. Never in plugins.txt.
|
|
*/
|
|
class EntryActionsPlugin extends Plugin
|
|
{
|
|
public static function getSubscribedEvents(): array
|
|
{
|
|
return [
|
|
'onPluginsInitialized' => ['onPluginsInitialized', 0],
|
|
'onApiRegisterRoutes' => ['onApiRegisterRoutes', 0],
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Register a lazy PSR-4 autoloader for this plugin's classes. The api router
|
|
* dispatches from a CACHED route map and instantiates the controller directly
|
|
* (ApiRouter::handleRoute → `new $controllerClass`) WITHOUT re-firing
|
|
* onApiRegisterRoutes, so requiring the class only there would leave it
|
|
* unloaded on cached-route requests. Lazy autoloading fires exactly when the
|
|
* router constructs the controller — by which point the api plugin's own
|
|
* autoloader (for AbstractApiController) is already registered.
|
|
*/
|
|
public function onPluginsInitialized(): void
|
|
{
|
|
spl_autoload_register(static function (string $class): void {
|
|
$prefix = 'Grav\\Plugin\\EntryActions\\';
|
|
if (strncmp($class, $prefix, strlen($prefix)) !== 0) {
|
|
return;
|
|
}
|
|
$rel = substr($class, strlen($prefix));
|
|
$file = __DIR__ . '/classes/' . str_replace('\\', '/', $rel) . '.php';
|
|
if (is_file($file)) {
|
|
require_once $file;
|
|
}
|
|
});
|
|
}
|
|
|
|
public function onApiRegisterRoutes(Event $event): void
|
|
{
|
|
$routes = $event['routes'];
|
|
$routes->delete('/entry/{slug}', [EntryActions\EntryActionsApiController::class, 'deleteEntry']);
|
|
}
|
|
}
|