feat(showtags): endpoint cookie + toggle nel menu utente

src/components/Header.astro

@@ -6,7 +6,7 @@ interface Props {
   showTags: boolean;
   canTags: boolean;
 }
-const { user, canTags } = Astro.props;
+const { user, canTags, showTags } = Astro.props;
 const path = Astro.url.pathname;
 const loginHref = `/login?next=${encodeURIComponent(path)}`;
 const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin';
@@ -26,7 +26,7 @@ const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin';
           <div class="umenu__panel">
             <a href={areaHref}>Area riservata</a>
             {canTags && (
-              <button type="button" class="umenu__tags" id="toggle-tags" data-slot="tags">Mostra tag</button>
+              <button type="button" class="umenu__tags" id="toggle-tags" data-on={showTags ? '1' : '0'}>{showTags ? 'Nascondi tag' : 'Mostra tag'}</button>
             )}
             <a href="/admin/logout">Esci</a>
           </div>
@@ -76,4 +76,18 @@ const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin';
     const open = nav.classList.toggle('is-open');
     toggle.setAttribute('aria-expanded', String(open));
   });
+
+  const tagsBtn = document.getElementById('toggle-tags');
+  if (tagsBtn) {
+    const on = tagsBtn.dataset.on === '1';
+    tagsBtn.addEventListener('click', async () => {
+      const res = await fetch('/api/admin/showtags', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ on: !on }),
+      });
+      if (res.ok) location.reload();
+      else alert('Operazione non riuscita.');
+    });
+  }
 </script>

src/pages/api/admin/showtags.ts

@@ -0,0 +1,18 @@
+import type { APIRoute } from 'astro';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const POST: APIRoute = async ({ request, cookies, locals }) => {
+  const role = locals.user!.role;
+  if (role !== 'superuser' && role !== 'admin') return json(403, { error: 'Permessi insufficienti' });
+  let data: { on?: unknown };
+  try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); }
+  if (data.on) {
+    cookies.set('showtags', '1', { httpOnly: true, sameSite: 'lax', path: '/', secure: import.meta.env.PROD });
+  } else {
+    cookies.delete('showtags', { path: '/' });
+  }
+  return json(200, { on: Boolean(data.on) });
+};