# Review package: 71cd162..8423716

## Commits
8423716 feat(showtags): endpoint cookie + toggle nel menu utente

## Files changed
 src/components/Header.astro     | 18 ++++++++++++++++--
 src/pages/api/admin/showtags.ts | 18 ++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

## Diff
diff --git a/src/components/Header.astro b/src/components/Header.astro
index eeb2cf3..bfcbcdc 100644
--- a/src/components/Header.astro
+++ b/src/components/Header.astro
@@ -1,39 +1,39 @@
 ---
 import { site } from '../data/site';
 import { t, contentImageUrl } from '../lib/content';
 interface Props {
   user: { username: string; role: string } | null;
   showTags: boolean;
   canTags: boolean;
 }
-const { user, canTags } = Astro.props;
+const { user, canTags, showTags } = Astro.props;
 const path = Astro.url.pathname;
 const loginHref = `/login?next=${encodeURIComponent(path)}`;
 const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin';
 ---
 <header class="hdr" id="site-header">
   <div class="container hdr__in">
     <a href="/" class="hdr__logo"><img src={contentImageUrl('header.logo.image', '/img/logo-dark.png')} alt={t('header.logo.alt')} width="150" /></a>
     <nav class="hdr__nav" id="site-nav" aria-label="principale">
       {site.navigation.map((item, i) => (
         <a href={item.href} class:list={['hdr__link', { 'is-active': path === item.href || (item.href !== '/' && path.startsWith(item.href)) }]}>{t(`global.nav.${i + 1}.label`)}</a>
       ))}
     </nav>
     <div class="hdr__user">
       {user ? (
         <details class="umenu">
           <summary class="umenu__btn">{user.username} ▾</summary>
           <div class="umenu__panel">
             <a href={areaHref}>Area riservata</a>
             {canTags && (
-              <button type="button" class="umenu__tags" id="toggle-tags" data-slot="tags">Mostra tag</button>
+              <button type="button" class="umenu__tags" id="toggle-tags" data-on={showTags ? '1' : '0'}>{showTags ? 'Nascondi tag' : 'Mostra tag'}</button>
             )}
             <a href="/admin/logout">Esci</a>
           </div>
         </details>
       ) : (
         <a class="hdr__login" href={loginHref}>Accedi</a>
       )}
     </div>
     <button class="hdr__burger" id="nav-toggle" aria-label="Apri menu" aria-expanded="false">
       <span></span><span></span><span></span>
@@ -69,11 +69,25 @@ const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin';
 
 <script>
   const header = document.getElementById('site-header')!;
   const toggle = document.getElementById('nav-toggle')!;
   const nav = document.getElementById('site-nav')!;
   addEventListener('scroll', () => header.classList.toggle('is-scrolled', scrollY > 10), { passive: true });
   toggle.addEventListener('click', () => {
     const open = nav.classList.toggle('is-open');
     toggle.setAttribute('aria-expanded', String(open));
   });
+
+  const tagsBtn = document.getElementById('toggle-tags');
+  if (tagsBtn) {
+    const on = tagsBtn.dataset.on === '1';
+    tagsBtn.addEventListener('click', async () => {
+      const res = await fetch('/api/admin/showtags', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ on: !on }),
+      });
+      if (res.ok) location.reload();
+      else alert('Operazione non riuscita.');
+    });
+  }
 </script>
diff --git a/src/pages/api/admin/showtags.ts b/src/pages/api/admin/showtags.ts
new file mode 100644
index 0000000..9459624
--- /dev/null
+++ b/src/pages/api/admin/showtags.ts
@@ -0,0 +1,18 @@
+import type { APIRoute } from 'astro';
+export const prerender = false;
+
+const json = (status: number, body: object) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+export const POST: APIRoute = async ({ request, cookies, locals }) => {
+  const role = locals.user!.role;
+  if (role !== 'superuser' && role !== 'admin') return json(403, { error: 'Permessi insufficienti' });
+  let data: { on?: unknown };
+  try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); }
+  if (data.on) {
+    cookies.set('showtags', '1', { httpOnly: true, sameSite: 'lax', path: '/', secure: import.meta.env.PROD });
+  } else {
+    cookies.delete('showtags', { path: '/' });
+  }
+  return json(200, { on: Boolean(data.on) });
+};