89 lines
3.5 KiB
Python
89 lines
3.5 KiB
Python
# retoor <retoor@molodetz.nl>
|
|
from fastapi import APIRouter, HTTPException, Request
|
|
|
|
from molodetz.constants import TOPICS
|
|
from molodetz.content import create_post, delete_post, edit_post
|
|
from molodetz.database import all_posts, get_post
|
|
from molodetz.dependencies import json_or_form
|
|
from molodetz.models import PostForm
|
|
from molodetz.responses import action_result, respond
|
|
from molodetz.routers.admin._shared import admin_seo
|
|
from molodetz.schemas.admin import AdminPostsOut
|
|
from molodetz.schemas.posts import PostDetailOut
|
|
from molodetz.utils.audit import record
|
|
from molodetz.utils.auth import is_admin, is_owner, not_found, require_admin
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get("/posts")
|
|
async def posts_index(request: Request):
|
|
require_admin(request)
|
|
return respond(request, "admin/posts.html", {"posts": all_posts(), "seo": admin_seo(request, "Posts")}, model=AdminPostsOut)
|
|
|
|
|
|
@router.get("/posts/new")
|
|
async def posts_new(request: Request):
|
|
require_admin(request)
|
|
ctx = {"post": None, "topics": TOPICS, "errors": [], "seo": admin_seo(request, "New post")}
|
|
return respond(request, "admin/post_form.html", ctx, model=PostDetailOut)
|
|
|
|
|
|
@router.post("/posts")
|
|
async def posts_create(request: Request):
|
|
user = require_admin(request)
|
|
data = await json_or_form(request, PostForm)
|
|
row = create_post(user, data.title, data.body, data.topic, data.status, data.is_placeholder, request=request)
|
|
return action_result(request, "/admin/posts", data={"uid": row["uid"], "slug": row["slug"]})
|
|
|
|
|
|
@router.get("/posts/{uid}/edit")
|
|
async def posts_edit(request: Request, uid: str):
|
|
require_admin(request)
|
|
post = get_post(uid)
|
|
if post is None:
|
|
not_found("Post not found")
|
|
ctx = {"post": post, "topics": TOPICS, "errors": [], "seo": admin_seo(request, "Edit post")}
|
|
return respond(request, "admin/post_form.html", ctx, model=PostDetailOut)
|
|
|
|
|
|
def _owned_post(request, user, uid):
|
|
post = get_post(uid)
|
|
if post is None:
|
|
not_found("Post not found")
|
|
if not is_owner(post, user):
|
|
record(request, "post.edit.denied", result="denied", targets=[("post", uid)], user=user)
|
|
raise HTTPException(403, "Only the author may edit this post")
|
|
return post
|
|
|
|
|
|
@router.post("/posts/{uid}")
|
|
async def posts_update(request: Request, uid: str):
|
|
user = require_admin(request)
|
|
post = _owned_post(request, user, uid)
|
|
data = await json_or_form(request, PostForm)
|
|
edit_post(post, user, data.title, data.body, data.topic, data.status, data.is_placeholder, request=request)
|
|
return action_result(request, "/admin/posts", data={"uid": uid})
|
|
|
|
|
|
@router.post("/posts/{uid}/publish")
|
|
async def posts_publish(request: Request, uid: str):
|
|
user = require_admin(request)
|
|
post = _owned_post(request, user, uid)
|
|
status = "draft" if post["status"] == "published" else "published"
|
|
edit_post(post, user, post["title"], post["body"], post["topic"], status, post.get("is_placeholder"), request=request)
|
|
return action_result(request, "/admin/posts", data={"uid": uid, "status": status})
|
|
|
|
|
|
@router.post("/posts/{uid}/delete")
|
|
async def posts_delete(request: Request, uid: str):
|
|
user = require_admin(request)
|
|
post = get_post(uid)
|
|
if post is None:
|
|
not_found("Post not found")
|
|
if not (is_owner(post, user) or is_admin(user)):
|
|
record(request, "post.delete.denied", result="denied", targets=[("post", uid)], user=user)
|
|
raise HTTPException(403, "Not allowed")
|
|
stamp = delete_post(post, user, request=request)
|
|
return action_result(request, "/admin/posts", data={"uid": uid, "stamp": stamp})
|