From ff68864879253751af680d07706d5a1253678989 Mon Sep 17 00:00:00 2001 From: "Daniel J. Summers" Date: Sun, 29 Jan 2023 16:02:36 -0500 Subject: [PATCH] Implement hidden visibility (#39) --- src/JobsJobsJobs/Common/Domain.fs | 4 +++ src/JobsJobsJobs/Profiles/Handlers.fs | 39 ++++++++++++++++----------- src/JobsJobsJobs/Profiles/Views.fs | 9 +++++++ 3 files changed, 36 insertions(+), 16 deletions(-) diff --git a/src/JobsJobsJobs/Common/Domain.fs b/src/JobsJobsJobs/Common/Domain.fs index 409aa72..601019c 100644 --- a/src/JobsJobsJobs/Common/Domain.fs +++ b/src/JobsJobsJobs/Common/Domain.fs @@ -159,6 +159,8 @@ type OtherContact = /// Visibility options for an employment profile type ProfileVisibility = + /// Profile is only visible to the citizen to whom it belongs + | Hidden /// Profile is only visible to authenticated users | Private /// Anonymous information is visible to public users @@ -172,6 +174,7 @@ module ProfileVisibility = /// Parse a string into a profile visibility let parse viz = match viz with + | "Hidden" -> Hidden | "Private" -> Private | "Anonymous" -> Anonymous | "Public" -> Public @@ -180,6 +183,7 @@ module ProfileVisibility = /// Convert a profile visibility to its string representation let toString = function + | Hidden -> "Hidden" | Private -> "Private" | Anonymous -> "Anonymous" | Public -> "Public" diff --git a/src/JobsJobsJobs/Profiles/Handlers.fs b/src/JobsJobsJobs/Profiles/Handlers.fs index 6bce6c8..d60f14c 100644 --- a/src/JobsJobsJobs/Profiles/Handlers.fs +++ b/src/JobsJobsJobs/Profiles/Handlers.fs @@ -209,31 +209,38 @@ let deleteHistory idx : HttpHandler = requireUser >=> validateCsrf >=> fun next | None -> return! notFound ctx } -// GET: /profile/[id]/view -let view citizenId : HttpHandler = fun next ctx -> task { +/// Get a profile for view, and enforce visibility restrictions against the current user +let private getProfileForView citizenId ctx = task { let citId = CitizenId citizenId match! Data.findByIdForView citId with | Some profile -> let currentCitizen = tryUser ctx |> Option.map CitizenId.ofString - if not (profile.Profile.Visibility = Public) && Option.isNone currentCitizen then - return! Error.notAuthorized next ctx - else - let title = $"Employment Profile for {Citizen.name profile.Citizen}" - return! Views.view profile currentCitizen |> render title next ctx + let canView = + match profile.Profile.Visibility, currentCitizen with + | Private, Some _ + | Anonymous, Some _ + | Public, _ -> true + | Hidden, Some citizenId when profile.Citizen.Id = citizenId -> true + | _ -> false + return if canView then Some (profile, currentCitizen) else None + | None -> return None +} + +// GET: /profile/[id]/view +let view citizenId : HttpHandler = fun next ctx -> task { + match! getProfileForView citizenId ctx with + | Some (profile, currentCitizen) -> + let title = $"Employment Profile for {Citizen.name profile.Citizen}" + return! Views.view profile currentCitizen |> render title next ctx | None -> return! notFound ctx } // GET: /profile/[id]/print let print citizenId : HttpHandler = fun next ctx -> task { - let citId = CitizenId citizenId - match! Data.findByIdForView citId with - | Some profile -> - let currentCitizen = tryUser ctx |> Option.map CitizenId.ofString - if not (profile.Profile.Visibility = Public) && Option.isNone currentCitizen then - return! Error.notAuthorized next ctx - else - let pageTitle = $"Employment Profile for {Citizen.name profile.Citizen}" - return! Views.print profile (Option.isNone currentCitizen) |> renderPrint pageTitle next ctx + match! getProfileForView citizenId ctx with + | Some (profile, currentCitizen) -> + let pageTitle = $"Employment Profile for {Citizen.name profile.Citizen}" + return! Views.print profile (Option.isNone currentCitizen) |> renderPrint pageTitle next ctx | None -> return! notFound ctx } diff --git a/src/JobsJobsJobs/Profiles/Views.fs b/src/JobsJobsJobs/Profiles/Views.fs index 6f00013..03ea4c8 100644 --- a/src/JobsJobsJobs/Profiles/Views.fs +++ b/src/JobsJobsJobs/Profiles/Views.fs @@ -102,6 +102,15 @@ let editGeneralInfo (m : EditProfileForm) continents isHtmx csrf = div [ _class "col-12" ] [ hr [] h4 [] [ txt "Visibility" ] + div [ _class "form-check" ] [ + let hid = ProfileVisibility.toString Hidden + input [ _type "radio"; _id $"{nameof m.Visibility}Hidden"; _name (nameof m.Visibility) + _class "form-check-input"; _value hid; if m.Visibility = hid then _checked ] + label [ _class "form-check-label"; _for $"{nameof m.Visibility}Hidden" ] [ + strong [] [ txt "Hidden" ] + txt " – do not show my employment profile to anyone else" + ] + ] div [ _class "form-check" ] [ let pvt = ProfileVisibility.toString Private input [ _type "radio"; _id $"{nameof m.Visibility}Private"; _name (nameof m.Visibility)