-
-
- {% if is_private or read_only %}
-
- {% endif %}
-
- {{ render_title(project['title'], author_is_admin=is_admin(author)) }}
-
- ● {{ project.get('status', 'In Development') }}
-
-
- {{ project.get('project_type', 'software').replace('_', ' ') }}
- {% if project.get('release_date') %}
- 📅 Released: {{ format_date(project['release_date']) }}
+
+
+
+
+
+ {% if cover_src %}
+ ![{{ project['title'] }} cover image]({{ cover_src }})
{% endif %}
- {% if project.get('demo_date') %}
- 🎭 Demo: {{ format_date(project['demo_date']) }}
- {% endif %}
-
-
- {% if forked_from %}
-
- {% endif %}
-
-
-
- {% if maturity_hidden(maturity, user) %}
- {% set _level = maturity %}{% include "_maturity_gate.html" %}
- {% else %}
- {{ render_content(project.get('description', ''), author_is_admin=is_admin(author)) }}
- {% endif %}
-
- {% if attachments %}
- {% include "_attachment_display.html" %}
- {% endif %}
-
- {% if platforms %}
-
-
- {% endif %}
-
- Platforms
-
- {% for plat in platforms %}
- {{ plat.strip() }}
- {% endfor %}
-
-
- 📁 Files ({{ file_count }} files)
- {% if workspace_editor_url %}
- {% set _url = workspace_editor_url %}
- {% set _uid = project['uid'] %}
- {% set _class = "project-star-btn" %}
- {% set _icon = "💻"|safe %}
- {% set _mode = workspace_editor_mode %}
- {% set _width = workspace_editor_width %}
- {% set _height = workspace_editor_height %}
- {% set _label = "Editor" %}
- {% include "_editor_open.html" %}
- {% endif %}
-
- {% if user %}
- {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _my_vote = my_vote %}{% set _count = star_count %}{% set _btn_class = "project-star-btn" %}{% include "_star_vote.html" %}
- {% endif %}
- {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
- {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _reactions = reactions %}{% include "_reaction_bar.html" %}
- {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _owner = project['user_uid'] %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "project-star-btn" %}{% include "_report_button.html" %}
-
-
-
-
+ Comments {{ comment_count }}
+ Files {{ file_count }}
+
+
+
{% if is_owner %}
+ {% call modal('create-post-modal', 'Post an update') %}
+ {% set _composer_topic = 'devlog' %}{% set _composer_project = project['uid'] %}{% include "_post_composer_form.html" %}
+ {% endcall %}
+
+ {% call modal('add-screenshots-modal', 'Add screenshots') %}
+
+ {% endcall %}
+
{% call modal('edit-project-modal', 'Edit Project') %}
- {% if viewer_can_workspace %}
- Workspace
+
+
+
+ {% if logo %}
+ ![{{ project['title'] }} logo]({{ logo['thumbnail_url'] or logo['url'] }})
{% endif %}
- {% if viewer_can_containers %}
- Containers
+
+
+
+ {% if project.get('website_url') %}
+
+
+
+
+ {{ render_title(project['title'], author_is_admin=is_admin(author)) }}
+
+ ● {{ project.get('status', 'In Development') }}
+
+
+ 🌐 Visit Website
+
{% endif %}
-
+
+ {% if project.get('release_date') or project.get('demo_date') or forked_from %}
+
+ {% endif %}
+
+
-
+ 📁 Files ({{ file_count }} files)
+ {% if workspace_editor_url %}
+ {% set _url = workspace_editor_url %}
+ {% set _uid = project['uid'] %}
+ {% set _class = "project-star-btn" %}
+ {% set _icon = "💻"|safe %}
+ {% set _mode = workspace_editor_mode %}
+ {% set _width = workspace_editor_width %}
+ {% set _height = workspace_editor_height %}
+ {% set _label = "Editor" %}
+ {% include "_editor_open.html" %}
+ {% endif %}
+
{% if user %}
-
- {% endif %}
- {% if is_owner %}
-
-
-
- {% endif %}
- {% if is_owner or is_admin(user) %}
-
+ {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _my_vote = my_vote %}{% set _count = star_count %}{% set _btn_class = "project-star-btn" %}{% include "_star_vote.html" %}
{% endif %}
+ {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _bookmarked = bookmarked %}{% include "_bookmark_button.html" %}
+ {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _reactions = reactions %}{% include "_reaction_bar.html" %}
+ {% set _type = "project" %}{% set _uid = project['uid'] %}{% set _owner = project['user_uid'] %}{% set _owner_name = (author or {}).get('username', '') %}{% set _class = "project-star-btn" %}{% include "_report_button.html" %}
+
+
+
+ {% if viewer_can_workspace %}
+ Workspace
+ {% endif %}
+ {% if viewer_can_containers %}
+ Containers
+ {% endif %}
+
+ {% if user %}
+
+ {% endif %}
+ {% if is_owner %}
+
+
+
+
+ {% endif %}
+ {% if is_owner or is_admin(user) %}
+
+ {% endif %}
+
Devlog
- {% if devlog_posts %} - {% for item in devlog_posts %} - {% set _author = item.author %}{% set _time = item.time_ago %}{% set _show_share = false %}{% set _show_comment_form = false %}{% include "_post_card.html" %} - {% endfor %} - {% set next_cursor = devlog_next_cursor %}{% include "_load_more.html" %} - {% else %} -No devlog posts yet.
+
+
+
+
+
+
+
+
+
+ {% if gallery %}
+
+
+ {% endif %}
+
+
+ {% with target_uid=project['uid'], target_type="project" %}
+ {% include "_comment_section.html" %}
+ {% endwith %}
+
+
+
+
+ About
+ {% if maturity_hidden(maturity, user) %} + {% set _level = maturity %}{% include "_maturity_gate.html" %} + {% else %} +{{ render_content(project.get('description', ''), author_is_admin=is_admin(author)) }}
+ {% endif %}
+ {% if other_attachments %}
+ {% set attachments = other_attachments %}
+ {% include "_attachment_display.html" %}
+ {% endif %}
+
+
+ {% if devlog_posts %}
+ {% for item in devlog_posts %}
+ {% set _author = item.author %}{% set _time = item.time_ago %}{% set _show_share = false %}{% set _show_comment_form = false %}{% include "_post_card.html" %}
+ {% endfor %}
+ {% set next_cursor = devlog_next_cursor %}{% include "_load_more.html" %}
+ {% else %}
+ Devlog
+ {{ devlog_count }} update{{ '' if devlog_count == 1 else 's' }} + {% if is_owner %} + + {% endif %} +No devlog posts yet.{% if is_owner %} Share your first update to give this project a public build log.{% endif %}
+ {% endif %} +Screenshots
+
+ {% for shot in gallery[:12] %}
+ ![{{ project['title'] }} screenshot {{ loop.index }}]({{ shot['thumbnail_url'] or shot['url'] }})
+ {% endfor %}
+
+ {% if gallery | length > 12 %}
+ Showing 12 of {{ gallery | length }} screenshots.
+ {% endif %} +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -200,10 +346,6 @@
{% endcall %}
{% endif %}
-
- {% with target_uid=project['uid'], target_type="project" %}
- {% include "_comment_section.html" %}
- {% endwith %}
{% endblock %}
{% block extra_js %}
@@ -215,6 +357,3 @@ if (actions) {
}
{% endblock %}
-
-
-
diff --git a/devplacepy/templates/projects.html b/devplacepy/templates/projects.html
index 966c8e06..a67662c1 100644
--- a/devplacepy/templates/projects.html
+++ b/devplacepy/templates/projects.html
@@ -126,6 +126,28 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/devplacepy/templating.py b/devplacepy/templating.py
index b150222a..08134506 100644
--- a/devplacepy/templating.py
+++ b/devplacepy/templating.py
@@ -13,7 +13,12 @@ from devplacepy.avatar import avatar_url, avatar_seed
from devplacepy.utils import format_date as _format_date
from devplacepy.utils import time_ago as _time_ago
from devplacepy.utils import get_badge, is_admin, is_primary_admin, pretty_json
-from devplacepy.attachments import format_file_size, file_icon_emoji
+from devplacepy.attachments import (
+ IMAGE_EXTENSIONS,
+ allowed_extensions,
+ format_file_size,
+ file_icon_emoji,
+)
from devplacepy.content import is_owner as _owns
from devplacepy.content import maturity_hidden as _maturity_hidden
from devplacepy.customization import custom_css_tag, custom_js_tag, page_type_for
@@ -224,9 +229,14 @@ def jinja_allowed_file_types() -> str:
return get_setting("allowed_file_types", "")
+def jinja_allowed_image_types() -> str:
+ return ",".join(sorted(allowed_extensions() & IMAGE_EXTENSIONS))
+
+
templates.env.globals["max_upload_size_mb"] = jinja_max_upload_size_mb
templates.env.globals["max_attachments_per_resource"] = jinja_max_attachments
templates.env.globals["allowed_file_types"] = jinja_allowed_file_types
+templates.env.globals["allowed_image_types"] = jinja_allowed_image_types
_LANGUAGE_NAMES = {
"python": "Python",
diff --git a/events.md b/events.md
index a9b30d3e..c57f2616 100644
--- a/events.md
+++ b/events.md
@@ -422,6 +422,7 @@ Every state-changing action in DevPlace records one append-only row through `dev
| `project.fork.request` | `routers/projects/index.py` |
| `project.readonly.disable` | `routers/projects/index.py` |
| `project.readonly.enable` | `routers/projects/index.py` |
+| `project.screenshots.add` | `routers/projects/index.py` |
| `project.visibility.private` | `routers/projects/index.py` |
| `project.visibility.public` | `routers/projects/index.py` |
| `project.zip.request` | `routers/projects/index.py` |
diff --git a/tests/api/projects/devlog.py b/tests/api/projects/devlog.py
index 297f2397..a6ea0abb 100644
--- a/tests/api/projects/devlog.py
+++ b/tests/api/projects/devlog.py
@@ -271,3 +271,124 @@ def test_devlog_works_for_guest_visitor(app_server):
assert "devlog_posts" in body
assert body["devlog_posts"] == []
+
+def test_devlog_count_and_comment_count_in_json(app_server):
+ """devlog_count and comment_count ride the detail JSON."""
+ session, name = _member()
+ project = _create_project(session)
+ slug = project["slug"] or project["uid"]
+ user = _db_user(name)
+
+ for i in range(3):
+ _create_post_direct(project["uid"], user["uid"], i)
+
+ r = session.get(f"{BASE_URL}/projects/{slug}", headers=JSON)
+ assert r.status_code == 200, r.text[:300]
+ body = r.json()
+ assert body["devlog_count"] == 3
+ assert body["comment_count"] == 0
+
+
+def _upload_image(session, name="shot.png", color=(30, 60, 120)):
+ import io
+ from PIL import Image
+
+ buf = io.BytesIO()
+ Image.new("RGB", (10, 10), color).save(buf, "PNG")
+ r = session.post(
+ f"{BASE_URL}/uploads/upload",
+ files={"file": (name, buf.getvalue(), "image/png")},
+ )
+ assert r.status_code == 201, r.text[:300]
+ return r.json()["uid"]
+
+
+def test_cover_and_logo_attachments_render_in_hero(app_server):
+ """cover/logo attachment uids resolve to the hero banner and logo tile."""
+ session, _ = _member()
+ cover_uid = _upload_image(session, "cover.png", (10, 20, 90))
+ logo_uid = _upload_image(session, "logo.png", (90, 20, 10))
+
+ r = session.post(
+ f"{BASE_URL}/projects/create",
+ headers=JSON,
+ data={
+ "title": _unique("dlhero"),
+ "description": "Hero art test project",
+ "project_type": "game",
+ "status": "In Development",
+ "platforms": "PC",
+ "cover_attachment_uid": cover_uid,
+ "logo_attachment_uid": logo_uid,
+ },
+ )
+ assert r.status_code == 200, r.text[:300]
+ slug = r.json()["data"]["slug"]
+
+ refresh_snapshot()
+ row = get_table("projects").find_one(slug=slug)
+ assert row["cover_attachment_uid"] == cover_uid
+ assert row["logo_attachment_uid"] == logo_uid
+
+ html = session.get(f"{BASE_URL}/projects/{slug}").text
+ assert 'class="project-cover-img"' in html
+ assert 'class="project-logo"' in html
+ assert "project-screenshot-grid" not in html, (
+ "Cover and logo must not repeat in the Screenshots gallery"
+ )
+
+
+def test_hero_attachment_uid_rejects_foreign_and_missing(app_server):
+ """A foreign or unknown attachment uid is ignored rather than linked."""
+ owner, _ = _member()
+ other, _ = _member()
+ foreign_uid = _upload_image(other, "foreign.png")
+
+ r = owner.post(
+ f"{BASE_URL}/projects/create",
+ headers=JSON,
+ data={
+ "title": _unique("dlreject"),
+ "description": "Hero guard test project",
+ "project_type": "software",
+ "status": "In Development",
+ "platforms": "",
+ "cover_attachment_uid": foreign_uid,
+ "logo_attachment_uid": "does-not-exist",
+ },
+ )
+ assert r.status_code == 200, r.text[:300]
+ slug = r.json()["data"]["slug"]
+ refresh_snapshot()
+ row = get_table("projects").find_one(slug=slug)
+ assert row["cover_attachment_uid"] is None
+ assert row["logo_attachment_uid"] is None
+
+
+def test_owner_adds_screenshots_from_the_page(app_server):
+ """POST /projects/{slug}/screenshots links uploads into the gallery; non-owners are refused."""
+ session, _ = _member()
+ project = _create_project(session)
+ slug = project["slug"] or project["uid"]
+
+ assert "project-screenshot-grid" not in session.get(f"{BASE_URL}/projects/{slug}").text
+
+ uid = _upload_image(session, "gallery.png", (5, 120, 60))
+ r = session.post(
+ f"{BASE_URL}/projects/{slug}/screenshots",
+ headers=JSON,
+ data={"attachment_uids": uid},
+ )
+ assert r.status_code == 200, r.text[:300]
+ assert r.json()["data"]["linked"] == 1
+
+ html = session.get(f"{BASE_URL}/projects/{slug}").text
+ assert "project-screenshot-grid" in html, "Expected the gallery after linking"
+
+ intruder, _ = _member()
+ r = intruder.post(
+ f"{BASE_URL}/projects/{slug}/screenshots",
+ headers=JSON,
+ data={"attachment_uids": uid},
+ )
+ assert r.status_code == 403, r.text[:300]
diff --git a/tests/api/projects/edit.py b/tests/api/projects/edit.py
index 43144e49..57a22959 100644
--- a/tests/api/projects/edit.py
+++ b/tests/api/projects/edit.py
@@ -105,6 +105,47 @@ def test_owner_can_edit_project(app_server):
assert row["platforms"] == "Linux,Web"
+def test_owner_can_set_and_clear_link_urls(app_server):
+ _, _, key = _signup_project_visibility()
+ slug = _create_project_project_visibility(key, "Website Via Api")["slug"]
+ r = requests.post(
+ f"{BASE_URL}/projects/edit/{slug}",
+ headers=_h_project_visibility(key),
+ data={
+ "title": "Website Via Api",
+ "description": "has links now",
+ "website_url": "myproject.dev/docs",
+ "repo_url": "github.com/me/website-via-api",
+ },
+ allow_redirects=False,
+ )
+ assert r.status_code == 200 and r.json()["ok"] is True
+ row = get_table("projects").find_one(slug=slug)
+ assert row["website_url"] == "https://myproject.dev/docs"
+ assert row["repo_url"] == "https://github.com/me/website-via-api"
+
+ html = requests.get(f"{BASE_URL}/projects/{slug}").text
+ assert "Visit Website" in html
+ assert "Repository" in html
+
+ r = requests.post(
+ f"{BASE_URL}/projects/edit/{slug}",
+ headers=_h_project_visibility(key),
+ data={
+ "title": "Website Via Api",
+ "description": "links removed",
+ "website_url": "",
+ "repo_url": "",
+ },
+ allow_redirects=False,
+ )
+ assert r.status_code == 200
+ row = get_table("projects").find_one(slug=slug)
+ assert row["website_url"] is None
+ assert row["repo_url"] is None
+ assert "Visit Website" not in requests.get(f"{BASE_URL}/projects/{slug}").text
+
+
def test_non_owner_cannot_edit_project(app_server):
_, _, owner_key = _signup_project_visibility()
slug = _create_project_project_visibility(owner_key, "Owner Edit Guard")["slug"]
diff --git a/tests/e2e/project/files.py b/tests/e2e/project/files.py
index b84fe66d..a63f0a86 100644
--- a/tests/e2e/project/files.py
+++ b/tests/e2e/project/files.py
@@ -119,7 +119,7 @@ def _alice_key():
def test_files_link_on_detail(alice):
page, _ = alice
_make_project_ui(page, "UI Files Link")
- link = page.locator("a:has-text('Files')")
+ link = page.locator(".project-detail-actions a:has-text('Files')")
expect(link).to_be_visible()
link.click()
page.wait_for_url("**/files", wait_until="domcontentloaded")
diff --git a/tests/e2e/projects/devlog.py b/tests/e2e/projects/devlog.py
index 08850f5b..ec85b58e 100644
--- a/tests/e2e/projects/devlog.py
+++ b/tests/e2e/projects/devlog.py
@@ -85,7 +85,7 @@ def test_devlog_empty_state_on_project_page(alice):
devlog_section = page.locator(".project-devlog")
expect(devlog_section).to_be_visible()
- expect(devlog_section.locator("h3:has-text('Devlog')")).to_be_visible()
+ expect(devlog_section.locator("h2:has-text('Devlog')")).to_be_visible()
expect(page.locator(".empty-state:has-text('No devlog posts yet.')")).to_be_visible()
@@ -187,3 +187,42 @@ def test_devlog_multiple_posts_order(alice):
f"Expected newest post first: {markers[-1]}, got: {first_text}"
)
+
+def test_project_stats_card_visible(alice):
+ """The sidebar Stats card shows stars, updates, comments, files, forks."""
+ page, _ = alice
+ slug, project_uid, owner_uid = _seed_project()
+ _seed_project_post(project_uid, owner_uid, 0)
+
+ page.goto(f"{BASE_URL}/projects/{slug}", wait_until="domcontentloaded")
+
+ stats = page.locator(".project-stats")
+ expect(stats).to_be_visible()
+ expect(stats.locator(".project-stat")).to_have_count(5)
+ expect(stats.locator(".project-stat:has-text('update')")).to_contain_text("1")
+
+
+def test_owner_post_update_button_opens_preset_composer(alice):
+ """The owner's Post update button opens the composer preselected to this project."""
+ page, _ = alice
+ _create_project_ui(page, f"Composer Project {uuid4().hex[:6]}")
+
+ button = page.locator(".project-devlog-post-btn")
+ expect(button).to_be_visible()
+ button.click()
+
+ modal = page.locator("#create-post-modal")
+ expect(modal).to_be_visible()
+ expect(modal.locator("input[name='topic'][value='devlog']")).to_be_checked()
+ selected = modal.locator("#project_uid").input_value()
+ assert selected != "", "Expected the project preselected in the composer"
+
+
+def test_guest_sees_no_post_update_button(app_server):
+ """Guests and non-owners get no Post update control."""
+ import requests
+
+ slug, _, _ = _seed_project()
+ r = requests.get(f"{BASE_URL}/projects/{slug}")
+ assert r.status_code == 200
+ assert "project-devlog-post-btn" not in r.text
diff --git a/tests/e2e/projects/index.py b/tests/e2e/projects/index.py
index 0b0a2763..40292d61 100644
--- a/tests/e2e/projects/index.py
+++ b/tests/e2e/projects/index.py
@@ -767,7 +767,7 @@ def test_project_comments_form_visible(alice):
page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
assert page.is_visible("text=Comments")
assert page.is_visible("text=No comments yet")
- assert page.is_visible("textarea[name='content']")
+ assert page.is_visible(".comment-form textarea[name='content']")
def test_project_comment_create(alice):
@@ -778,8 +778,8 @@ def test_project_comment_create(alice):
page.fill("#description", "Project for creating a comment")
page.click("button:has-text('Create Project')")
page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
- page.fill("textarea[name='content']", "Great project!")
- page.click("button:has-text('Post')")
+ page.fill(".comment-form textarea[name='content']", "Great project!")
+ page.click(".comment-form button:has-text('Post')")
page.wait_for_timeout(500)
assert page.is_visible("text=Great project!")
@@ -792,8 +792,8 @@ def test_project_comment_reply(alice):
page.fill("#description", "Project for testing reply")
page.click("button:has-text('Create Project')")
page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
- page.fill("textarea[name='content']", "First comment")
- page.click("button:has-text('Post')")
+ page.fill(".comment-form textarea[name='content']", "First comment")
+ page.click(".comment-form button:has-text('Post')")
page.wait_for_timeout(500)
assert page.is_visible("text=First comment")
page.click("button:has-text('Reply')")
@@ -812,8 +812,8 @@ def test_project_comment_delete(alice):
page.fill("#description", "Project for testing delete")
page.click("button:has-text('Create Project')")
page.wait_for_url(f"{BASE_URL}/projects/*", wait_until="domcontentloaded")
- page.fill("textarea[name='content']", "Comment to delete")
- page.click("button:has-text('Post')")
+ page.fill(".comment-form textarea[name='content']", "Comment to delete")
+ page.click(".comment-form button:has-text('Post')")
page.wait_for_timeout(500)
assert page.is_visible("text=Comment to delete")
page.locator(".comment-action-btn:has-text('Delete')").click()
diff --git a/tests/unit/models.py b/tests/unit/models.py
index dc21345e..24b74e3c 100644
--- a/tests/unit/models.py
+++ b/tests/unit/models.py
@@ -47,6 +47,24 @@ def test_isslop_run_form_normalizes_typos_and_bare_domains():
assert IsslopRunForm(url="http:/x.dev/a").url == "http://x.dev/a"
+def test_project_form_link_urls_normalize_and_validate():
+ from devplacepy.models import ProjectForm, normalize_website_url
+
+ base = {"title": "T", "description": "D"}
+ assert ProjectForm(**base).website_url == ""
+ assert ProjectForm(**base, website_url="myproject.dev").website_url == "https://myproject.dev"
+ assert ProjectForm(**base, repo_url="github.com/me/x").repo_url == "https://github.com/me/x"
+ assert (
+ ProjectForm(**base, website_url="http://x.dev/a?b=1").website_url
+ == "http://x.dev/a?b=1"
+ )
+ assert normalize_website_url(" ") == ""
+ with pytest.raises(ValidationError):
+ ProjectForm(**base, website_url="javascript:alert(1)")
+ with pytest.raises(ValidationError):
+ ProjectForm(**base, repo_url="not a url")
+
+
def test_reaction_form_accepts_any_single_emoji():
from devplacepy.models import ReactionForm