# Review package: d4cf3598059fb57d39289d363218202f4921ed28..HEAD ## Commits e2bbc90 fix(create-user): ruoli aggiornati a superuser/user (gap dal piano) be77285 test(smoke): login pubblico, badge, protezione /admin/users c36ad4c feat(users): gestione utenti /admin/users con guardie self/ultimo-admin 0f2b2ba feat(blog): firma autore sotto il titolo, fallback Staff InsanityLab 2bf6b3d feat(admin): nav per 3 ruoli, blog filtrato per autore + colonna autore 22d72be feat(inline): badge con guid + modal di modifica contenuti in pagina 8423716 feat(showtags): endpoint cookie + toggle nel menu utente 71cd162 feat(header): identità utente SSR, link Accedi / menu utente 6b85872 feat(login): pagina pubblica /login con next sicuro 5ce10da feat(content): guid in resolve/componenti + GET /api/admin/content/[tag] c3267c9 feat(posts-api): assegna autore in POST, ownership su PUT/DELETE 6d1e260 feat(posts): author_id nel repository + listByAuthor + helper utenti db92fc9 feat(middleware): autorizzazione a matrice + redirect per ruolo e87a464 feat(auth): matrice permessi 3 ruoli + landingFor 5cea895 feat(db): migrazioni ruoli editor->superuser, guid contenuti, posts.author_id ## Files changed scripts/create-user.mjs | 4 +- scripts/smoke.sh | 20 +++ src/components/Header.astro | 47 +++++++ src/components/content/T.astro | 4 +- src/components/content/TImg.astro | 10 +- src/layouts/Admin.astro | 13 +- src/layouts/Base.astro | 169 +++++++++++++++++++---- src/lib/auth.ts | 64 ++++++++- src/lib/content.ts | 21 +-- src/lib/db.ts | 27 +++- src/lib/posts.ts | 19 ++- src/lib/safe-next.ts | 7 + src/middleware.ts | 4 +- src/pages/admin/index.astro | 11 +- src/pages/admin/users.astro | 95 +++++++++++++ src/pages/api/admin/content/[tag].ts | 15 ++ src/pages/api/admin/posts/[id].ts | 16 ++- src/pages/api/admin/posts/index.ts | 4 +- src/pages/api/admin/showtags.ts | 18 +++ src/pages/api/admin/users/[id]/index.ts | 19 +++ src/pages/api/admin/users/[id]/reset-password.ts | 16 +++ src/pages/api/admin/users/[id]/role.ts | 21 +++ src/pages/api/admin/users/index.ts | 26 ++++ src/pages/blog/[slug].astro | 5 +- src/pages/login.astro | 53 +++++++ tests/content-api.test.ts | 13 ++ tests/content-db.test.ts | 29 ++++ tests/content.test.ts | 8 +- tests/posts-ownership.test.ts | 21 +++ tests/posts.test.ts | 27 +++- tests/roles.test.ts | 68 ++++++--- tests/safe-next.test.ts | 18 +++ tests/users.test.ts | 49 +++++++ 33 files changed, 847 insertions(+), 94 deletions(-) ## Diff diff --git a/scripts/create-user.mjs b/scripts/create-user.mjs index 8568b66..4690813 100644 --- a/scripts/create-user.mjs +++ b/scripts/create-user.mjs @@ -1,22 +1,22 @@ import Database from 'better-sqlite3'; import bcrypt from 'bcryptjs'; import { mkdirSync } from 'node:fs'; import { dirname } from 'node:path'; const [, , username, password, role = 'admin'] = process.argv; if (!username || !password) { console.error('Uso: npm run create-user -- [role]'); process.exit(1); } -if (!['admin', 'editor'].includes(role)) { - console.error('Ruolo non valido. Ammessi: admin, editor'); +if (!['admin', 'superuser', 'user'].includes(role)) { + console.error('Ruolo non valido. Ammessi: admin, superuser, user'); process.exit(1); } const path = process.env.DB_PATH ?? 'data/insanitylab.db'; mkdirSync(dirname(path), { recursive: true }); const db = new Database(path); db.exec(`CREATE TABLE IF NOT EXISTS users ( id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT NOT NULL UNIQUE, password_hash TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'admin' diff --git a/scripts/smoke.sh b/scripts/smoke.sh index 226f29b..7db9da2 100755 --- a/scripts/smoke.sh +++ b/scripts/smoke.sh @@ -21,11 +21,31 @@ echo "$code /sitemap.xml" [ "$code" = "200" ] || fail=1 locs=$(curl -s http://localhost:4399/sitemap.xml | grep -c '') echo "$locs in sitemap (atteso >= 12)" [ "$locs" -ge 12 ] || fail=1 tags=$(curl -s http://localhost:4399/ | grep -c 'data-tag=') echo "$tags righe con data-tag= in home (atteso >= 1)" [ "$tags" -ge 1 ] || fail=1 badges=$(curl -s 'http://localhost:4399/?annotate=1' | grep -c 'tag-badge' || true) echo "$badges tag-badge da anonimo con ?annotate=1 (atteso 0)" [ "$badges" = "0" ] || fail=1 + +# /login pubblico raggiungibile +code=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:4399/login) +echo "$code /login" +[ "$code" = "200" ] || fail=1 + +# Header mostra "Accedi" da anonimo +curl -s http://localhost:4399/ | grep -q 'Accedi' || { echo "FAIL: link Accedi assente"; fail=1; } + +# Nessun badge tag-badge da anonimo sulla home semplice +badges2=$(curl -s http://localhost:4399/ | grep -c 'tag-badge' || true) +echo "$badges2 tag-badge da anonimo in home semplice (atteso 0)" +[ "$badges2" = "0" ] || fail=1 + +# Rotta gestione utenti protetta (redirect al login da anonimo) +code=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:4399/admin/users) +echo "$code /admin/users (atteso 302)" +[ "$code" = "302" ] || fail=1 + +echo "smoke ruoli/login/inline OK" exit $fail diff --git a/src/components/Header.astro b/src/components/Header.astro index 33a0b4c..bfcbcdc 100644 --- a/src/components/Header.astro +++ b/src/components/Header.astro @@ -1,23 +1,47 @@ --- import { site } from '../data/site'; import { t, contentImageUrl } from '../lib/content'; +interface Props { + user: { username: string; role: string } | null; + showTags: boolean; + canTags: boolean; +} +const { user, canTags, showTags } = Astro.props; const path = Astro.url.pathname; +const loginHref = `/login?next=${encodeURIComponent(path)}`; +const areaHref = user?.role === 'superuser' ? '/admin/content' : '/admin'; --- diff --git a/src/components/content/T.astro b/src/components/content/T.astro index 41cefd3..b11d23e 100644 --- a/src/components/content/T.astro +++ b/src/components/content/T.astro @@ -1,11 +1,11 @@ --- import { resolveContent } from '../../lib/content'; interface Props { tag: string; as?: string; class?: string } const { tag, as = 'span', class: cls } = Astro.props; const Tag = as; const c = resolveContent(tag); const classes = [cls, c.classes].filter(Boolean).join(' ') || undefined; --- {c.type === 'html' - ? - : {c.value}} + ? + : {c.value}} diff --git a/src/components/content/TImg.astro b/src/components/content/TImg.astro index 3fcb915..b1f6ac3 100644 --- a/src/components/content/TImg.astro +++ b/src/components/content/TImg.astro @@ -1,14 +1,16 @@ --- import { Image } from 'astro:assets'; import type { ImageMetadata } from 'astro'; -import { getImageOverride } from '../../lib/content'; +import { resolveContent } from '../../lib/content'; interface Props { tag: string; src: ImageMetadata; alt: string; class?: string; loading?: 'lazy' | 'eager'; widths?: number[]; sizes?: string; height?: number; } const { tag, src, alt, class: cls, ...rest } = Astro.props; -const override = getImageOverride(tag); +const c = resolveContent(tag); +const override = c.type === 'image' && c.value ? `/uploads/${c.value}` : null; +const guid = c.guid || undefined; --- {override - ? {alt}

- :

} + ?

+ :

} diff --git a/src/layouts/Admin.astro b/src/layouts/Admin.astro index e61622f..ab98680 100644 --- a/src/layouts/Admin.astro +++ b/src/layouts/Admin.astro @@ -24,17 +24,26 @@ const user = Astro.locals.user; .pill--draft { background: #f3d9a4; } .form-msg { font-size: .9rem; margin-top: 8px; } .form-msg--ok { color: #3c7a3c; } .form-msg--err { color: #b03030; }

InsanityLab · Admin - {user && user.role === 'editor' && <>{`Ciao, ${user.username}`} Contenuti Esci} - {user && user.role !== 'editor' && <>{`Ciao, ${user.username}`} Articoli Contenuti Nuovo Esci Vedi sito ↗} + {user && ( + <> + {`Ciao, ${user.username}`} + Articoli + {(user.role === 'superuser' || user.role === 'admin') && Contenuti} + {user.role === 'admin' && Utenti} + Nuovo + Esci + Vedi sito ↗ + + )}

diff --git a/src/layouts/Base.astro b/src/layouts/Base.astro index 365aabf..4e4263d 100644 --- a/src/layouts/Base.astro +++ b/src/layouts/Base.astro @@ -7,44 +7,43 @@ import '@fontsource/open-sans/400.css'; import '@fontsource/open-sans/600.css'; import '../styles/global.css'; import Header from '../components/Header.astro'; import Footer from '../components/Footer.astro'; import { getDb } from '../lib/db'; import { getSessionUser, SESSION_COOKIE } from '../lib/auth'; interface Props { title: string; description?: string } const { title, description = 'InsanityLab — Performance. Balance. Longevity. Allenamento personalizzato, piccoli gruppi e benessere a Bologna.' } = Astro.props; -// Overlay annotate: badge coi tag contenuto, solo per utenti loggati con ?annotate=1. -let annotate = false; -if (Astro.url.searchParams.get('annotate') === '1') { - const tok = Astro.cookies.get(SESSION_COOKIE)?.value; - annotate = Boolean(tok && getSessionUser(getDb(), tok)); -} +const tok = Astro.cookies.get(SESSION_COOKIE)?.value; +const user = tok ? getSessionUser(getDb(), tok) : null; +const canTags = !!user && (user.role === 'superuser' || user.role === 'admin'); +const wantTags = Astro.cookies.get('showtags')?.value === '1' || Astro.url.searchParams.get('annotate') === '1'; +const showTags = canTags && wantTags; --- {title} — InsanityLab -

- {annotate && ( + {showTags && ( + )} diff --git a/src/lib/auth.ts b/src/lib/auth.ts index 2dea325..ed02c90 100644 --- a/src/lib/auth.ts +++ b/src/lib/auth.ts @@ -1,18 +1,18 @@ import type Database from 'better-sqlite3'; import bcrypt from 'bcryptjs'; import { randomBytes } from 'node:crypto'; export const SESSION_COOKIE = 'session'; const SESSION_DAYS = 7; -export type Role = 'admin' | 'editor'; +export type Role = 'admin' | 'superuser' | 'user'; export function hashPassword(plain: string): string { return bcrypt.hashSync(plain, 12); } export function verifyPassword(plain: string, hash: string): boolean { return bcrypt.compareSync(plain, hash); } export function createUser(db: Database.Database, username: string, password: string, role: Role = 'admin'): number { @@ -42,17 +42,73 @@ export function getSessionUser(db: Database.Database, token: string): { id: numb db.prepare('DELETE FROM sessions WHERE token = ?').run(token); return null; } return { id: row.id, username: row.username, role: row.role }; } export function logout(db: Database.Database, token: string): void { db.prepare('DELETE FROM sessions WHERE token = ?').run(token); } -// Percorsi admin consentiti anche al ruolo editor. -const EDITOR_ALLOWED = [/^\/admin\/content(\/|$)/, /^\/api\/admin\/content(\/|$)/, /^\/admin\/logout$/]; +// Autorizzazione per prefisso di rotta. L'admin passa sempre; per gli altri, la prima regola +// che matcha decide; se nessuna regola matcha la rotta è "blog/upload/logout" → consentita a +// qualsiasi loggato (il middleware protegge solo /admin e /api/admin, quindi qui arrivano solo +// utenti già autenticati). +const RULES: [RegExp, Role[]][] = [ + [/^\/admin\/users(\/|$)/, ['admin']], + [/^\/api\/admin\/users(\/|$)/, ['admin']], + [/^\/admin\/content(\/|$)/, ['admin', 'superuser']], + [/^\/api\/admin\/content(\/|$)/, ['admin', 'superuser']], +]; export function canAccessAdminPath(role: string, pathname: string): boolean { if (role === 'admin') return true; - return EDITOR_ALLOWED.some((re) => re.test(pathname)); + for (const [re, roles] of RULES) { + if (re.test(pathname)) return roles.includes(role as Role); + } + return true; // blog, upload, logout, showtags: tutti i loggati +} + +export function getUsernameById(db: Database.Database, id: number): string | null { + const row = db.prepare('SELECT username FROM users WHERE id = ?').get(id) as { username: string } | undefined; + return row?.username ?? null; +} + +export function listUsers(db: Database.Database): { id: number; username: string; role: string }[] { + return db.prepare('SELECT id, username, role FROM users ORDER BY username').all() as + { id: number; username: string; role: string }[]; +} + +export function countAdmins(db: Database.Database): number { + return (db.prepare("SELECT COUNT(*) AS n FROM users WHERE role = 'admin'").get() as { n: number }).n; +} + +export function getUserById(db: Database.Database, id: number): { id: number; username: string; role: string } | null { + const row = db.prepare('SELECT id, username, role FROM users WHERE id = ?').get(id) as + { id: number; username: string; role: string } | undefined; + return row ?? null; +} + +export function updateUserRole(db: Database.Database, id: number, role: Role): void { + db.prepare('UPDATE users SET role = ? WHERE id = ?').run(role, id); +} + +export function updateUserPassword(db: Database.Database, id: number, hash: string): void { + db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(hash, id); +} + +export function deleteUser(db: Database.Database, id: number): void { + db.prepare('DELETE FROM users WHERE id = ?').run(id); +} + +export function randomPassword(): string { + return randomBytes(9).toString('base64url'); // ~12 caratteri +} + +export function isRole(v: unknown): v is Role { + return v === 'admin' || v === 'superuser' || v === 'user'; +} + +export function landingFor(role: string): string { + if (role === 'superuser') return '/admin/content'; + return '/admin'; } diff --git a/src/lib/content.ts b/src/lib/content.ts index b873685..db2a539 100644 --- a/src/lib/content.ts +++ b/src/lib/content.ts @@ -1,47 +1,48 @@ import type Database from 'better-sqlite3'; +import { randomUUID } from 'node:crypto'; import { getDb } from './db'; import { contentSeed, seedByTag, type ContentType } from '../data/content-seed'; import { stylesToClasses } from './style-presets'; -interface Entry { value: string; type: ContentType; styles: Record } +interface Entry { value: string; type: ContentType; styles: Record; guid: string } export function syncSeed(db: Database.Database): void { - const ins = db.prepare('INSERT OR IGNORE INTO content_blocks (tag, type, value) VALUES (?, ?, ?)'); - const tx = db.transaction(() => { for (const e of contentSeed) ins.run(e.tag, e.type, e.value); }); + const ins = db.prepare('INSERT OR IGNORE INTO content_blocks (tag, type, value, guid) VALUES (?, ?, ?, ?)'); + const tx = db.transaction(() => { for (const e of contentSeed) ins.run(e.tag, e.type, e.value, randomUUID()); }); tx(); } export function makeContentStore(dbGetter: () => Database.Database) { let cache: Map | null = null; const load = (): Map => { if (cache) return cache; - const rows = dbGetter().prepare('SELECT tag, type, value, styles FROM content_blocks').all() as - { tag: string; type: ContentType; value: string; styles: string }[]; + const rows = dbGetter().prepare('SELECT tag, type, value, styles, guid FROM content_blocks').all() as + { tag: string; type: ContentType; value: string; styles: string; guid: string | null }[]; cache = new Map(rows.map((r) => { let styles: Record = {}; try { styles = JSON.parse(r.styles); } catch { /* styles corrotto: si ignora */ } if (typeof styles !== 'object' || styles === null) styles = {}; - return [r.tag, { value: r.value, type: r.type, styles }]; + return [r.tag, { value: r.value, type: r.type, styles, guid: r.guid ?? '' }]; })); return cache; }; return { - resolve(tag: string): { value: string; type: ContentType; classes: string } { + resolve(tag: string): { value: string; type: ContentType; classes: string; guid: string } { const hit = load().get(tag); - if (hit) return { value: hit.value, type: hit.type, classes: stylesToClasses(hit.styles) }; + if (hit) return { value: hit.value, type: hit.type, classes: stylesToClasses(hit.styles), guid: hit.guid }; const seed = seedByTag.get(tag); - if (seed) return { value: seed.value, type: seed.type, classes: '' }; + if (seed) return { value: seed.value, type: seed.type, classes: '', guid: '' }; console.warn(`[content] tag sconosciuto: ${tag}`); - return { value: '', type: 'text', classes: '' }; + return { value: '', type: 'text', classes: '', guid: '' }; }, invalidate(): void { cache = null; }, }; } const store = makeContentStore(getDb); export const resolveContent = (tag: string) => store.resolve(tag); export const t = (tag: string): string => store.resolve(tag).value; export const invalidateContentCache = (): void => store.invalidate(); diff --git a/src/lib/db.ts b/src/lib/db.ts index cf8c82c..7260f13 100644 --- a/src/lib/db.ts +++ b/src/lib/db.ts @@ -1,13 +1,14 @@ import Database from 'better-sqlite3'; import { mkdirSync } from 'node:fs'; import { dirname } from 'node:path'; +import { randomUUID } from 'node:crypto'; import { contentSeed } from '../data/content-seed'; const SCHEMA = ` CREATE TABLE IF NOT EXISTS posts ( id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, category TEXT NOT NULL, excerpt TEXT NOT NULL DEFAULT '', body_html TEXT NOT NULL DEFAULT '', @@ -43,20 +44,34 @@ export function createDb(path?: string): Database.Database { if (p !== ':memory:') mkdirSync(dirname(p), { recursive: true }); const db = new Database(p); db.pragma('journal_mode = WAL'); db.pragma('foreign_keys = ON'); db.exec(SCHEMA); // Migrazione additiva: DB creati prima dell'introduzione dei ruoli non hanno users.role. const userCols = db.prepare(`PRAGMA table_info(users)`).all() as { name: string }[]; if (!userCols.some((c) => c.name === 'role')) { db.exec(`ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`); } + // Ruolo editor unificato in superuser (3 ruoli: admin, superuser, user). Idempotente. + db.prepare("UPDATE users SET role = 'superuser' WHERE role = 'editor'").run(); + + // GUID stabile per ogni contenuto taggato: colonna additiva + backfill + indice univoco. + const contentCols = db.prepare(`PRAGMA table_info(content_blocks)`).all() as { name: string }[]; + if (!contentCols.some((c) => c.name === 'guid')) { + db.exec(`ALTER TABLE content_blocks ADD COLUMN guid TEXT`); + } + + // Autore articoli: colonna nullable (post storici restano senza autore). + const postCols = db.prepare(`PRAGMA table_info(posts)`).all() as { name: string }[]; + if (!postCols.some((c) => c.name === 'author_id')) { + db.exec(`ALTER TABLE posts ADD COLUMN author_id INTEGER`); + } // Migrazione: la sezione "Programmi" è diventata "Servizi" → rinomina dei tag esistenti // preservando le modifiche fatte dal pannello. Ordine: prima i prefissi più specifici. // UPDATE OR IGNORE salta le righe in conflitto (tag nuovo già presente); la DELETE // successiva ripulisce le righe vecchie rimaste. Idempotente: al secondo giro nessun match. const TAG_RENAMES: [string, string][] = [ ['home.programs.', 'home.services.'], ['footer.programs.', 'footer.services.'], ['programs.', 'services.'], ['program.', 'service.'], ]; @@ -89,22 +104,30 @@ export function createDb(path?: string): Database.Database { ['service.pricing.empty-note', 'Contattaci per i dettagli di questo programma. Scrivici →'], ]; const seedValue = new Map(contentSeed.map((e) => [e.tag, e.value])); const updValue = db.prepare('UPDATE content_blocks SET value = ? WHERE tag = ? AND value = ?'); for (const [tag, oldValue] of OLD_SECTION_DEFAULTS) { const next = seedValue.get(tag); if (next !== undefined) updValue.run(next, tag, oldValue); } }); renameTx(); - const ins = db.prepare('INSERT OR IGNORE INTO content_blocks (tag, type, value) VALUES (?, ?, ?)'); - const syncTx = db.transaction(() => { for (const e of contentSeed) ins.run(e.tag, e.type, e.value); }); + const ins = db.prepare('INSERT OR IGNORE INTO content_blocks (tag, type, value, guid) VALUES (?, ?, ?, ?)'); + const syncTx = db.transaction(() => { for (const e of contentSeed) ins.run(e.tag, e.type, e.value, randomUUID()); }); syncTx(); + // Backfill: righe pre-esistenti (già presenti prima dell'introduzione del guid) restano + // ignorate dall'INSERT OR IGNORE e hanno guid nullo → assegna un UUID a ciascuna. + const missing = db.prepare(`SELECT tag FROM content_blocks WHERE guid IS NULL OR guid = ''`).all() as { tag: string }[]; + const backfill = db.prepare('UPDATE content_blocks SET guid = ? WHERE tag = ?'); + const bfTx = db.transaction(() => { for (const m of missing) backfill.run(randomUUID(), m.tag); }); + bfTx(); + // Indice univoco creato dopo il backfill, così non fallisce su righe a guid nullo. + db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_content_guid ON content_blocks(guid)`); return db; } let singleton: Database.Database | null = null; export function getDb(): Database.Database { if (!singleton) singleton = createDb(); return singleton; } diff --git a/src/lib/posts.ts b/src/lib/posts.ts index dad9159..2b346dd 100644 --- a/src/lib/posts.ts +++ b/src/lib/posts.ts @@ -1,29 +1,29 @@ import type Database from 'better-sqlite3'; export interface Post { id: number; title: string; slug: string; category: string; excerpt: string; - body_html: string; cover: string | null; draft: number; + body_html: string; cover: string | null; draft: number; author_id: number | null; published_at: string | null; created_at: string; updated_at: string; } export interface PostInput { title: string; slug: string; category: string; excerpt: string; - body_html: string; cover?: string | null; draft: boolean; + body_html: string; cover?: string | null; draft: boolean; author_id?: number | null; } export function createPost(db: Database.Database, input: PostInput): number { const res = db.prepare( - `INSERT INTO posts (title, slug, category, excerpt, body_html, cover, draft, published_at) - VALUES (@title, @slug, @category, @excerpt, @body_html, @cover, @draft, + `INSERT INTO posts (title, slug, category, excerpt, body_html, cover, draft, author_id, published_at) + VALUES (@title, @slug, @category, @excerpt, @body_html, @cover, @draft, @author_id, CASE WHEN @draft = 0 THEN datetime('now') ELSE NULL END)` - ).run({ ...input, cover: input.cover ?? null, draft: input.draft ? 1 : 0 }); + ).run({ ...input, cover: input.cover ?? null, author_id: input.author_id ?? null, draft: input.draft ? 1 : 0 }); return Number(res.lastInsertRowid); } export function updatePost(db: Database.Database, id: number, input: PostInput): void { db.prepare( `UPDATE posts SET title = @title, slug = @slug, category = @category, excerpt = @excerpt, body_html = @body_html, cover = @cover, draft = @draft, published_at = CASE WHEN @draft = 0 AND published_at IS NULL THEN datetime('now') ELSE published_at END, updated_at = datetime('now') WHERE id = @id` @@ -65,10 +65,19 @@ export function listRecent(db: Database.Database, limit = 4): Post[] { 'SELECT * FROM posts WHERE draft = 0 ORDER BY published_at DESC LIMIT ?' ).all(limit) as Post[]; } export function listArchiveMonths(db: Database.Database): { month: string; count: number }[] { return db.prepare( `SELECT strftime('%Y-%m', published_at) AS month, COUNT(*) AS count FROM posts WHERE draft = 0 GROUP BY month ORDER BY month DESC` ).all() as { month: string; count: number }[]; } + +export function listByAuthor(db: Database.Database, authorId: number): Post[] { + return db.prepare('SELECT * FROM posts WHERE author_id = ? ORDER BY updated_at DESC').all(authorId) as Post[]; +} + +export function canModifyPost(role: string, userId: number, post: { author_id: number | null }): boolean { + if (role === 'admin' || role === 'superuser') return true; + return post.author_id === userId; +} diff --git a/src/lib/safe-next.ts b/src/lib/safe-next.ts new file mode 100644 index 0000000..b9b9a6c --- /dev/null +++ b/src/lib/safe-next.ts @@ -0,0 +1,7 @@ +// Path interno sicuro per il redirect post-login: deve iniziare con "/", non essere +// protocol-relative ("//"), non puntare alle API. Tutto il resto → home. +export function safeNext(next: string | null): string { + if (!next || !next.startsWith('/') || next.startsWith('//')) return '/'; + if (next.startsWith('/api/')) return '/'; + return next; +} diff --git a/src/middleware.ts b/src/middleware.ts index bed89db..c8c53b5 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -1,13 +1,13 @@ import { defineMiddleware } from 'astro:middleware'; import { getDb } from './lib/db'; -import { getSessionUser, SESSION_COOKIE, canAccessAdminPath } from './lib/auth'; +import { getSessionUser, SESSION_COOKIE, canAccessAdminPath, landingFor } from './lib/auth'; export const onRequest = defineMiddleware((context, next) => { const { pathname } = context.url; const isProtected = (pathname.startsWith('/admin') && pathname !== '/admin/login') || pathname.startsWith('/api/admin'); if (!isProtected) return next(); const token = context.cookies.get(SESSION_COOKIE)?.value; const user = token ? getSessionUser(getDb(), token) : null; @@ -19,16 +19,16 @@ export const onRequest = defineMiddleware((context, next) => { } return context.redirect('/admin/login'); } if (!canAccessAdminPath(user.role, pathname)) { if (pathname.startsWith('/api/')) { return new Response(JSON.stringify({ error: 'Permessi insufficienti' }), { status: 403, headers: { 'Content-Type': 'application/json' }, }); } - return context.redirect('/admin/content'); + return context.redirect(landingFor(user.role)); } context.locals.user = user; return next(); }); diff --git a/src/pages/admin/index.astro b/src/pages/admin/index.astro index a8e0cd3..24cb0ca 100644 --- a/src/pages/admin/index.astro +++ b/src/pages/admin/index.astro @@ -1,28 +1,33 @@ --- import Admin from '../../layouts/Admin.astro'; import { getDb } from '../../lib/db'; -import { listAllPosts } from '../../lib/posts'; +import { listAllPosts, listByAuthor } from '../../lib/posts'; +import { listUsers } from '../../lib/auth'; export const prerender = false; -const posts = listAllPosts(getDb()); +const user = Astro.locals.user!; +const isManager = user.role === 'superuser' || user.role === 'admin'; +const posts = isManager ? listAllPosts(getDb()) : listByAuthor(getDb(), user.id); +const nameById = new Map(listUsers(getDb()).map((u) => [u.id, u.username])); const fmt = new Intl.DateTimeFormat('it-IT', { dateStyle: 'short', timeStyle: 'short' }); ---

Articoli

+ Nuovo articolo

- + {isManager && } {posts.map((p) => ( + {isManager && } ))}

Titolo	Categoria	Stato	Aggiornato
Titolo	Categoria	Autore	Stato	Aggiornato
{p.title}	{p.category}	{p.author_id ? (nameById.get(p.author_id) ?? 'Staff InsanityLab') : 'Staff InsanityLab'}	{p.draft ? 'Bozza' : 'Pubblicato'}	{fmt.format(new Date(p.updated_at.replace(' ', 'T') + 'Z'))}

{posts.length === 0 &&

Nessun articolo: creane uno nuovo.

} diff --git a/src/pages/admin/users.astro b/src/pages/admin/users.astro new file mode 100644 index 0000000..e88c746 --- /dev/null +++ b/src/pages/admin/users.astro @@ -0,0 +1,95 @@ +--- +import Admin from '../../layouts/Admin.astro'; +import { getDb } from '../../lib/db'; +import { listUsers } from '../../lib/auth'; +export const prerender = false; +const users = listUsers(getDb()); +const me = Astro.locals.user!; +--- + +

Utenti

+ +

Nuovo utente

+ + +

Elenco

+ + + + {users.map((u) => ( + + + + + + ))} + +

Utente	Ruolo
{u.username}{u.id === me.id && ' (tu)'}	+ +	+ + {u.id !== me.id && } +

+ + + diff --git a/src/pages/api/admin/content/[tag].ts b/src/pages/api/admin/content/[tag].ts index 1fd7c0b..8ad2488 100644 --- a/src/pages/api/admin/content/[tag].ts +++ b/src/pages/api/admin/content/[tag].ts @@ -1,19 +1,34 @@ import type { APIRoute } from 'astro'; import { getDb } from '../../../../lib/db'; import { applyContentUpdate } from '../../../../lib/content-update'; import { invalidateContentCache } from '../../../../lib/content'; +import { seedByTag } from '../../../../data/content-seed'; export const prerender = false; const json = (status: number, body: object) => new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); +export const GET: APIRoute = ({ params }) => { + const tag = params.tag ?? ''; + const row = getDb().prepare('SELECT tag, type, value, guid FROM content_blocks WHERE tag = ?').get(tag) as + { tag: string; type: string; value: string; guid: string | null } | undefined; + if (!row) return json(404, { error: 'Tag inesistente.' }); + return json(200, { + tag: row.tag, + guid: row.guid ?? '', + type: row.type, + value: row.value, + styleOptions: seedByTag.get(row.tag)?.styleOptions ?? [], + }); +}; + export const PUT: APIRoute = async ({ params, request, locals }) => { let data: Record; try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } if (typeof data !== 'object' || data === null) return json(400, { error: 'Dati non validi.' }); const r = applyContentUpdate(getDb(), params.tag ?? '', data, locals.user!.username); if (!r.ok) return json(r.status, { error: r.error }); invalidateContentCache(); // Il value salvato può differire da quello inviato (sanitizeInline sui tag html): // lo restituiamo così il pannello mostra il dato reale. const row = getDb().prepare('SELECT value FROM content_blocks WHERE tag = ?').get(params.tag) as { value: string }; diff --git a/src/pages/api/admin/posts/[id].ts b/src/pages/api/admin/posts/[id].ts index c7e8a33..8c7ef21 100644 --- a/src/pages/api/admin/posts/[id].ts +++ b/src/pages/api/admin/posts/[id].ts @@ -1,29 +1,35 @@ import type { APIRoute } from 'astro'; import { getDb } from '../../../../lib/db'; -import { getPostById, updatePost, deletePost } from '../../../../lib/posts'; +import { getPostById, updatePost, deletePost, canModifyPost } from '../../../../lib/posts'; import { parsePostBody } from '../../../../lib/post-body'; export const prerender = false; const json = (status: number, body: object) => new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); -export const PUT: APIRoute = async ({ params, request }) => { +export const PUT: APIRoute = async ({ params, request, locals }) => { const id = Number(params.id); - if (!getPostById(getDb(), id)) return json(404, { error: 'Articolo non trovato.' }); + const existing = getPostById(getDb(), id); + if (!existing) return json(404, { error: 'Articolo non trovato.' }); + if (!canModifyPost(locals.user!.role, locals.user!.id, existing)) return json(403, { error: 'Non puoi modificare questo articolo.' }); let data: Record; try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } const parsed = parsePostBody(data); if ('error' in parsed) return json(400, { error: parsed.error }); try { updatePost(getDb(), id, parsed.value); return json(200, { ok: true }); } catch (err: any) { if (String(err?.message).includes('UNIQUE')) return json(400, { error: 'Slug già esistente.' }); throw err; } }; -export const DELETE: APIRoute = ({ params }) => { - deletePost(getDb(), Number(params.id)); +export const DELETE: APIRoute = ({ params, locals }) => { + const id = Number(params.id); + const existing = getPostById(getDb(), id); + if (!existing) return json(404, { error: 'Articolo non trovato.' }); + if (!canModifyPost(locals.user!.role, locals.user!.id, existing)) return json(403, { error: 'Non puoi eliminare questo articolo.' }); + deletePost(getDb(), id); return json(200, { ok: true }); }; diff --git a/src/pages/api/admin/posts/index.ts b/src/pages/api/admin/posts/index.ts index 16305d7..6d95c5d 100644 --- a/src/pages/api/admin/posts/index.ts +++ b/src/pages/api/admin/posts/index.ts @@ -1,22 +1,22 @@ import type { APIRoute } from 'astro'; import { getDb } from '../../../../lib/db'; import { createPost } from '../../../../lib/posts'; import { parsePostBody } from '../../../../lib/post-body'; export const prerender = false; const json = (status: number, body: object) => new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); -export const POST: APIRoute = async ({ request }) => { +export const POST: APIRoute = async ({ request, locals }) => { let data: Record; try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } const parsed = parsePostBody(data); if ('error' in parsed) return json(400, { error: parsed.error }); try { - const id = createPost(getDb(), parsed.value); + const id = createPost(getDb(), { ...parsed.value, author_id: locals.user!.id }); return json(201, { id, slug: parsed.value.slug }); } catch (err: any) { if (String(err?.message).includes('UNIQUE')) return json(400, { error: 'Slug già esistente.' }); throw err; } }; diff --git a/src/pages/api/admin/showtags.ts b/src/pages/api/admin/showtags.ts new file mode 100644 index 0000000..9459624 --- /dev/null +++ b/src/pages/api/admin/showtags.ts @@ -0,0 +1,18 @@ +import type { APIRoute } from 'astro'; +export const prerender = false; + +const json = (status: number, body: object) => + new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); + +export const POST: APIRoute = async ({ request, cookies, locals }) => { + const role = locals.user!.role; + if (role !== 'superuser' && role !== 'admin') return json(403, { error: 'Permessi insufficienti' }); + let data: { on?: unknown }; + try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } + if (data.on) { + cookies.set('showtags', '1', { httpOnly: true, sameSite: 'lax', path: '/', secure: import.meta.env.PROD }); + } else { + cookies.delete('showtags', { path: '/' }); + } + return json(200, { on: Boolean(data.on) }); +}; diff --git a/src/pages/api/admin/users/[id]/index.ts b/src/pages/api/admin/users/[id]/index.ts new file mode 100644 index 0000000..f382e80 --- /dev/null +++ b/src/pages/api/admin/users/[id]/index.ts @@ -0,0 +1,19 @@ +import type { APIRoute } from 'astro'; +import { getDb } from '../../../../../lib/db'; +import { getUserById, deleteUser, countAdmins } from '../../../../../lib/auth'; +export const prerender = false; + +const json = (status: number, body: object) => + new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); + +export const DELETE: APIRoute = ({ params, locals }) => { + const id = Number(params.id); + const target = getUserById(getDb(), id); + if (!target) return json(404, { error: 'Utente inesistente.' }); + if (id === locals.user!.id) return json(400, { error: 'Non puoi eliminare te stesso.' }); + if (target.role === 'admin' && countAdmins(getDb()) <= 1) { + return json(400, { error: 'Deve restare almeno un admin.' }); + } + deleteUser(getDb(), id); + return json(200, { ok: true }); +}; diff --git a/src/pages/api/admin/users/[id]/reset-password.ts b/src/pages/api/admin/users/[id]/reset-password.ts new file mode 100644 index 0000000..7101e88 --- /dev/null +++ b/src/pages/api/admin/users/[id]/reset-password.ts @@ -0,0 +1,16 @@ +import type { APIRoute } from 'astro'; +import { getDb } from '../../../../../lib/db'; +import { getUserById, updateUserPassword, hashPassword, randomPassword } from '../../../../../lib/auth'; +export const prerender = false; + +const json = (status: number, body: object) => + new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); + +export const POST: APIRoute = ({ params }) => { + const id = Number(params.id); + if (!getUserById(getDb(), id)) return json(404, { error: 'Utente inesistente.' }); + const password = randomPassword(); + updateUserPassword(getDb(), id, hashPassword(password)); + // La password in chiaro è restituita UNA sola volta: l'admin la copia e la consegna. + return json(200, { password }); +}; diff --git a/src/pages/api/admin/users/[id]/role.ts b/src/pages/api/admin/users/[id]/role.ts new file mode 100644 index 0000000..673447f --- /dev/null +++ b/src/pages/api/admin/users/[id]/role.ts @@ -0,0 +1,21 @@ +import type { APIRoute } from 'astro'; +import { getDb } from '../../../../../lib/db'; +import { getUserById, updateUserRole, countAdmins, isRole } from '../../../../../lib/auth'; +export const prerender = false; + +const json = (status: number, body: object) => + new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); + +export const PUT: APIRoute = async ({ params, request }) => { + const id = Number(params.id); + const target = getUserById(getDb(), id); + if (!target) return json(404, { error: 'Utente inesistente.' }); + let data: { role?: unknown }; + try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } + if (!isRole(data.role)) return json(400, { error: 'Ruolo non valido.' }); + if (target.role === 'admin' && data.role !== 'admin' && countAdmins(getDb()) <= 1) { + return json(400, { error: 'Deve restare almeno un admin.' }); + } + updateUserRole(getDb(), id, data.role); + return json(200, { ok: true }); +}; diff --git a/src/pages/api/admin/users/index.ts b/src/pages/api/admin/users/index.ts new file mode 100644 index 0000000..307bbe4 --- /dev/null +++ b/src/pages/api/admin/users/index.ts @@ -0,0 +1,26 @@ +import type { APIRoute } from 'astro'; +import { getDb } from '../../../../lib/db'; +import { createUser, listUsers, isRole } from '../../../../lib/auth'; +export const prerender = false; + +const json = (status: number, body: object) => + new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } }); + +export const GET: APIRoute = () => json(200, { users: listUsers(getDb()) }); + +export const POST: APIRoute = async ({ request }) => { + let data: { username?: unknown; password?: unknown; role?: unknown }; + try { data = await request.json(); } catch { return json(400, { error: 'Dati non validi.' }); } + const username = String(data.username ?? '').trim(); + const password = String(data.password ?? ''); + if (username.length < 2) return json(400, { error: 'Nome utente troppo corto.' }); + if (password.length < 8) return json(400, { error: 'Password troppo corta (min 8).' }); + if (!isRole(data.role)) return json(400, { error: 'Ruolo non valido.' }); + try { + const id = createUser(getDb(), username, password, data.role); + return json(201, { id }); + } catch (err: any) { + if (String(err?.message).includes('UNIQUE')) return json(400, { error: 'Nome utente già esistente.' }); + throw err; + } +}; diff --git a/src/pages/blog/[slug].astro b/src/pages/blog/[slug].astro index 34eda3e..634231e 100644 --- a/src/pages/blog/[slug].astro +++ b/src/pages/blog/[slug].astro @@ -1,27 +1,30 @@ --- import Base from '../../layouts/Base.astro'; import Sidebar from '../../components/blog/Sidebar.astro'; import { getDb } from '../../lib/db'; import { getPublishedBySlug } from '../../lib/posts'; +import { getUsernameById } from '../../lib/auth'; export const prerender = false; const post = getPublishedBySlug(getDb(), Astro.params.slug!); if (!post) return new Response(null, { status: 404 }); const fmt = new Intl.DateTimeFormat('it-IT', { dateStyle: 'long' }); +const author = post.author_id ? getUsernameById(getDb(), post.author_id) : null; +const byline = author ?? 'Staff InsanityLab'; ---

{post.cover &&

} -

{post.published_at && fmt.format(new Date(post.published_at))} · {post.category}

{post.published_at && fmt.format(new Date(post.published_at))} · {post.category} · di {byline}

{post.title}

diff --git a/tests/content-api.test.ts b/tests/content-api.test.ts index 6d61853..66075dc 100644 --- a/tests/content-api.test.ts +++ b/tests/content-api.test.ts @@ -28,10 +28,23 @@ describe('applyContentUpdate', () => { if (htmlTag) { applyContentUpdate(db, htmlTag, { value: 'ciao ok' }, 'a'); const row = db.prepare('SELECT value FROM content_blocks WHERE tag = ?').get(htmlTag) as any; expect(row.value).not.toContain('