Add access restrictions to UI (#19)

- Vary default user access for new web logs (#19)
- Add htmx detection to not auth/404 handlers
- Bump version

src/admin-theme/_layout.liquid

@@ -7,20 +7,26 @@
         <span class="navbar-toggler-icon"></span>
       </button>
       <div class="collapse navbar-collapse" id="navbarText">
-        {% if logged_on -%}
+        {% if is_logged_on -%}
           <ul class="navbar-nav">
             {{ "admin/dashboard" | nav_link: "Dashboard" }}
-            {{ "admin/pages" | nav_link: "Pages" }}
-            {{ "admin/posts" | nav_link: "Posts" }}
-            {{ "admin/uploads" | nav_link: "Uploads" }}
-            {{ "admin/categories" | nav_link: "Categories" }}
-            {{ "admin/settings" | nav_link: "Settings" }}
+            {% if is_author %}
+              {{ "admin/pages" | nav_link: "Pages" }}
+              {{ "admin/posts" | nav_link: "Posts" }}
+              {{ "admin/uploads" | nav_link: "Uploads" }}
+            {% endif %}
+            {% if is_web_log_admin %}
+              {{ "admin/categories" | nav_link: "Categories" }}
+              {{ "admin/settings" | nav_link: "Settings" }}
+            {% endif %}
           </ul>
         {%- endif %}
         <ul class="navbar-nav flex-grow-1 justify-content-end">
-          {% if logged_on -%}
+          {% if is_logged_on -%}
             {{ "admin/user/edit" | nav_link: "Edit User" }}
-            {{ "user/log-off" | nav_link: "Log Off" }}
+            <li class="nav-item">
+              <a class="nav-link" href="{{ "user/log-off" | relative_link }}" hx-boost="false">Log Off</a>
+            </li>
           {%- else -%}
             {{ "user/log-on" | nav_link: "Log On" }}
           {%- endif %}

src/admin-theme/category-list-body.liquid

@@ -13,20 +13,19 @@
           {%- endif %}
           {{ cat.name }}<br>
           <small>
+            {%- assign cat_url_base = "admin/category/" | append: cat.id -%}
             {%- if cat.post_count > 0 %}
               <a href="{{ cat | category_link }}" target="_blank">
                 View {{ cat.post_count }} Post{% unless cat.post_count == 1 %}s{% endunless -%}
               </a>
               <span class="text-muted"> &bull; </span>
             {%- endif %}
-            {%- capture cat_edit %}admin/category/{{ cat.id }}/edit{% endcapture -%}
-            <a href="{{ cat_edit | relative_link }}" hx-target="#cat_{{ cat.id }}"
+            <a href="{{ cat_url_base | append: "/edit" | relative_link }}" hx-target="#cat_{{ cat.id }}"
                hx-swap="innerHTML show:#cat_{{ cat.id }}:top">
               Edit
             </a>
             <span class="text-muted"> &bull; </span>
-            {%- capture cat_del %}admin/category/{{ cat.id }}/delete{% endcapture -%}
-            {%- capture cat_del_link %}{{ cat_del | relative_link }}{% endcapture -%}
+            {%- assign cat_del_link = cat_url_base | append: "/delete" | relative_link -%}
             <a href="{{ cat_del_link }}" hx-post="{{ cat_del_link }}" class="text-danger"
                hx-confirm="Are you sure you want to delete the category &ldquo;{{ cat.name }}&rdquo;? This action cannot be undone.">
               Delete

src/admin-theme/dashboard.liquid

@@ -9,8 +9,10 @@
             Published <span class="badge rounded-pill bg-secondary">{{ model.posts }}</span>
             &nbsp; Drafts <span class="badge rounded-pill bg-secondary">{{ model.drafts }}</span>
           </h6>
-          <a href="{{ "admin/posts" | relative_link }}" class="btn btn-secondary me-2">View All</a>
-          <a href="{{ "admin/post/new/edit" | relative_link }}" class="btn btn-primary">Write a New Post</a>
+          {% if is_author %}
+            <a href="{{ "admin/posts" | relative_link }}" class="btn btn-secondary me-2">View All</a>
+            <a href="{{ "admin/post/new/edit" | relative_link }}" class="btn btn-primary">Write a New Post</a>
+          {% endif %}
         </div>
       </div>
     </section>
@@ -22,8 +24,10 @@
             All <span class="badge rounded-pill bg-secondary">{{ model.pages }}</span>
             &nbsp; Shown in Page List <span class="badge rounded-pill bg-secondary">{{ model.listed_pages }}</span>
           </h6>
-          <a href="{{ "admin/pages" | relative_link }}" class="btn btn-secondary me-2">View All</a>
-          <a href="{{ "admin/page/new/edit" | relative_link }}" class="btn btn-primary">Create a New Page</a>
+          {% if is_author %}
+            <a href="{{ "admin/pages" | relative_link }}" class="btn btn-secondary me-2">View All</a>
+            <a href="{{ "admin/page/new/edit" | relative_link }}" class="btn btn-primary">Create a New Page</a>
+          {% endif %}
         </div>
       </div>
     </section>
@@ -37,15 +41,19 @@
             All <span class="badge rounded-pill bg-secondary">{{ model.categories }}</span>
             &nbsp; Top Level <span class="badge rounded-pill bg-secondary">{{ model.top_level_categories }}</span>
           </h6>
-          <a href="{{ "admin/categories" | relative_link }}" class="btn btn-secondary me-2">View All</a>
-          <a href="{{ "admin/category/new/edit" | relative_link }}" class="btn btn-secondary">Add a New Category</a>
+          {% if is_web_log_admin %}
+            <a href="{{ "admin/categories" | relative_link }}" class="btn btn-secondary me-2">View All</a>
+            <a href="{{ "admin/category/new/edit" | relative_link }}" class="btn btn-secondary">Add a New Category</a>
+          {% endif %}
         </div>
       </div>
     </section>
   </div>
-  <div class="row pb-3">
-    <div class="col text-end">
-      <a href="{{ "admin/settings" | relative_link }}" class="btn btn-secondary">Modify Settings</a>
+  {% if is_web_log_admin %}
+    <div class="row pb-3">
+      <div class="col text-end">
+        <a href="{{ "admin/settings" | relative_link }}" class="btn btn-secondary">Modify Settings</a>
+      </div>
     </div>
-  </div>
+  {% endif %}
 </article>

src/admin-theme/page-list.liquid

@@ -24,15 +24,18 @@
             <small>
               {%- capture pg_link %}{% unless pg.is_default %}{{ pg.permalink }}{% endunless %}{% endcapture -%}
               <a href="{{ pg_link | relative_link }}" target="_blank">View Page</a>
-              <span class="text-muted"> &bull; </span>
-              <a href="{{ pg | edit_page_link }}">Edit</a>
-              <span class="text-muted"> &bull; </span>
-              {%- capture pg_del %}admin/page/{{ pg.id }}/delete{% endcapture -%}
-              {%- capture pg_del_link %}{{ pg_del | relative_link }}{% endcapture -%}
-              <a href="{{ pg_del_link }}" hx-post="{{ pg_del_link }}" class="text-danger"
-                 hx-confirm="Are you sure you want to delete the page &ldquo;{{ pg.title | strip_html | escape }}&rdquo;? This action cannot be undone.">
-                Delete
-              </a>
+              {% if is_editor or is_author and user_id == pg.author_id %}
+                <span class="text-muted"> &bull; </span>
+                <a href="{{ pg | edit_page_link }}">Edit</a>
+              {% endif %}
+              {% if is_web_log_admin %}
+                <span class="text-muted"> &bull; </span>
+                {%- assign pg_del_link = "admin/page/" | append: pg.id | append: "/delete" | relative_link -%}
+                <a href="{{ pg_del_link }}" hx-post="{{ pg_del_link }}" class="text-danger"
+                   hx-confirm="Are you sure you want to delete the page &ldquo;{{ pg.title | strip_html | escape }}&rdquo;? This action cannot be undone.">
+                  Delete
+                </a>
+              {% endif %}
             </small>
           </div>
           <div class="{{ link_col }}">
@@ -55,14 +58,18 @@
     <div class="d-flex justify-content-evenly pb-3">
       <div>
         {% if page_nbr > 1 %}
-          {%- capture prev_link %}admin/pages{{ prev_page }}{% endcapture -%}
-          <p><a class="btn btn-default" href="{{ prev_link | relative_link }}">&laquo; Previous</a></p>
+          <p>
+            <a class="btn btn-default" href="{{ "admin/pages" | append: prev_page | relative_link }}">
+              &laquo; Previous
+            </a>
+          </p>
         {% endif %}
       </div>
       <div class="text-right">
         {% if page_count == 25 %}
-          {%- capture next_link %}admin/pages{{ next_page }}{% endcapture -%}
-          <p><a class="btn btn-default" href="{{ next_link | relative_link }}">Next &raquo;</a></p>
+          <p>
+            <a class="btn btn-default" href="{{ "admin/pages" | append: next_page | relative_link }}">Next &raquo;</a>
+          </p>
         {% endif %}
       </div>
     </div>

src/admin-theme/permalinks.liquid

@@ -1,7 +1,7 @@
 <h2 class="my-3">{{ page_title }}</h2>
 <article>
-  {%- capture form_action %}admin/{{ model.entity }}/permalinks{% endcapture -%}
-  <form action="{{ form_action | relative_link }}" method="post">
+  {%- assign base_url = "admin/" | append: model.entity | append: "/" -%}
+  <form action="{{ base_url | append: "permalinks" | relative_link }}" method="post">
     <input type="hidden" name="{{ csrf.form_field_name }}" value="{{ csrf.request_token }}">
     <input type="hidden" name="id" value="{{ model.id }}">
     <div class="container">
@@ -11,8 +11,9 @@
             <strong>{{ model.current_title }}</strong><br>
             <small class="text-muted">
               <span class="fst-italic">{{ model.current_permalink }}</span><br>
-              {%- capture back_link %}admin/{{ model.entity }}/{{ model.id }}/edit{% endcapture -%}
-              <a href="{{ back_link | relative_link }}">&laquo; Back to Edit {{ model.entity | capitalize }}</a>
+              <a href="{{ base_url | append: model.id | append: "/edit" | relative_link }}">
+                &laquo; Back to Edit {{ model.entity | capitalize }}
+              </a>
             </small>
           </p>
         </div>

src/admin-theme/post-list.liquid

@@ -46,15 +46,18 @@
             {{ post.title }}<br>
             <small>
               <a href="{{ post | relative_link }}" target="_blank">View Post</a>
-              <span class="text-muted"> &bull; </span>
-              <a href="{{ post | edit_post_link }}">Edit</a>
-              <span class="text-muted"> &bull; </span>
-              {%- capture post_del %}admin/post/{{ post.id }}/delete{% endcapture -%}
-              {%- capture post_del_link %}{{ post_del | relative_link }}{% endcapture -%}
-              <a href="{{ post_del_link }}" hx-post="{{ post_del_link }}" class="text-danger"
-                 hx-confirm="Are you sure you want to delete the page &ldquo;{{ post.title | strip_html | escape }}&rdquo;? This action cannot be undone.">
-                Delete
-              </a>
+              {% if is_editor or is_author and user_id == post.author_id %}
+                <span class="text-muted"> &bull; </span>
+                <a href="{{ post | edit_post_link }}">Edit</a>
+              {% endif %}
+              {% if is_web_log_admin %}
+                <span class="text-muted"> &bull; </span>
+                {%- assign post_del_link = "admin/post/" | append: post.id | append: "/delete" | relative_link -%}
+                <a href="{{ post_del_link }}" hx-post="{{ post_del_link }}" class="text-danger"
+                   hx-confirm="Are you sure you want to delete the page &ldquo;{{ post.title | strip_html | escape }}&rdquo;? This action cannot be undone.">
+                  Delete
+                </a>
+              {% endif %}
             </small>
           </div>
           <div class="{{ author_col }}">

src/admin-theme/rss-settings.liquid

@@ -85,13 +85,12 @@
             {{ feed.source }}
             {%- if feed.is_podcast %} &nbsp; <span class="badge bg-primary">PODCAST</span>{% endif %}<br>
             <small>
+              {%- assign feed_url = "admin/settings/rss/" | append: feed.id -%}
               <a href="{{ feed.path | relative_link }}" target="_blank">View Feed</a>
               <span class="text-muted"> &bull; </span>
-              {%- capture feed_edit %}admin/settings/rss/{{ feed.id }}/edit{% endcapture -%}
-              <a href="{{ feed_edit | relative_link }}">Edit</a>
+              <a href="{{ feed_url | append: "/edit" | relative_link }}">Edit</a>
               <span class="text-muted"> &bull; </span>
-              {%- capture feed_del %}admin/settings/rss/{{ feed.id }}/delete{% endcapture -%}
-              {%- capture feed_del_link %}{{ feed_del | relative_link }}{% endcapture -%}
+              {%- assign feed_del_link = feed_url | append: "/delete" | relative_link -%}
               <a href="{{ feed_del_link }}" hx-post="{{ feed_del_link }}" class="text-danger"
                  hx-confirm="Are you sure you want to delete the custom RSS feed based on {{ feed.source | strip_html | escape }}? This action cannot be undone.">
                 Delete

src/admin-theme/tag-mapping-list-body.liquid

@@ -9,14 +9,13 @@
         <div class="col no-wrap">
           {{ map.tag }}<br>
           <small>
-            {%- capture map_edit %}admin/settings/tag-mapping/{{ map_id }}/edit{% endcapture -%}
-            <a href="{{ map_edit | relative_link }}" hx-target="#tag_{{ map_id }}"
+            {%- assign map_url = "admin/settings/tag-mapping/" | append: map_id -%}
+            <a href="{{ map_url | append: "/edit" | relative_link }}" hx-target="#tag_{{ map_id }}"
                hx-swap="innerHTML show:#tag_{{ map_id }}:top">
               Edit
             </a>
             <span class="text-muted"> &bull; </span>
-            {%- capture map_del %}admin/settings/tag-mapping/{{ map_id }}/delete{% endcapture -%}
-            {%- capture map_del_link %}{{ map_del | relative_link }}{% endcapture -%}
+            {%- assign map_del_link = map_url | append: "/delete" | relative_link -%}
             <a href="{{ map_del_link }}" hx-post="{{ map_del_link }}" class="text-danger"
                hx-confirm="Are you sure you want to delete the mapping for &ldquo;{{ map.tag }}&rdquo;? This action cannot be undone.">
               Delete

src/admin-theme/upload-list.liquid

@@ -22,12 +22,12 @@
             {%- capture badge_class -%}
               {%- if file.source == "disk" %}secondary{% else %}primary{% endif -%}
             {%- endcapture -%}
-            {%- capture rel_url %}{{ upload_base }}{{ file.path }}{{ file.name }}{% endcapture -%}
-            {%- capture blog_rel %}{{ upload_path }}{{ file.path }}{{ file.name }}{% endcapture -%}
+            {%- assign path_and_name = file.path | append: file.name -%}
+            {%- assign blog_rel = upload_path | append: path_and_name -%}
             <span class="badge bg-{{ badge_class }} text-uppercase float-end mt-1">{{ file.source }}</span>
             {{ file.name }}<br>
             <small>
-              <a href="{{ rel_url }}" target="_blank">View File</a>
+              <a href="{{ upload_base | append: path_and_name }}" target="_blank">View File</a>
               <span class="text-muted"> &bull; Copy </span>
               <a href="{{ blog_rel | absolute_link }}" hx-boost="false"
                  onclick="return Admin.copyText('{{ blog_rel | absolute_link }}', this)">
@@ -45,17 +45,20 @@
                   For Post
                 </a>
               {%- endunless %}
-              <span class="text-muted"> Link &bull; </span>
-              {%- capture delete_url -%}
-                {%- if file.source == "disk" -%}
-                  admin/upload/delete/{{ file.path }}{{ file.name }}
-                {%- else -%}
-                  admin/upload/{{ file.id }}/delete
-                {%- endif -%}
-              {%- endcapture -%}
-              <a href="{{ delete_url | relative_link }}" hx-post="{{ delete_url | relative_link }}"
-                 hx-confirm="Are you sure you want to delete {{ file.name }}? This action cannot be undone."
-                 class="text-danger">Delete</a>
+              <span class="text-muted"> Link</span>
+              {% if is_web_log_admin %}
+                <span class="text-muted"> &bull; </span>
+                {%- capture delete_url -%}
+                  {%- if file.source == "disk" -%}
+                    admin/upload/delete/{{ path_and_name }}
+                  {%- else -%}
+                    admin/upload/{{ file.id }}/delete
+                  {%- endif -%}
+                {%- endcapture -%}
+                <a href="{{ delete_url | relative_link }}" hx-post="{{ delete_url | relative_link }}"
+                   hx-confirm="Are you sure you want to delete {{ file.name }}? This action cannot be undone."
+                   class="text-danger">Delete</a>
+              {% endif %}
             </small>
           </div>
           <div class="col-3">{{ file.path }}</div>

src/admin-theme/version.txt

@@ -1,2 +1,2 @@
 myWebLog Admin
-2.0.0-beta03
+2.0.0-beta05