sulthan
b0bf6fe770
Guild membership is now the whole gate: discordCallback checks membership
(and DISCORD_REQUIRED_ROLE when set), then Store.EnsureReader creates the
Reader on first sight and returns the same row on every later login. The
refusal returns before EnsureReader, so nothing is created as a side
effect of being turned away. OWNER_DISCORD_ID keeps seeding the owner, but
only as the administrator — it no longer gates sign-in.
The cutover grace path is gone with it: API_TOKEN, API_TOKEN_GRACE_UNTIL
and the legacy branch in httpmw.ResolveReader are deleted, so a credential
authenticates exactly one Reader or nothing. That also lets
userscript.Handler drop the re-derivation — the resolved path segment is
already the credential to substitute.
New surfaces: an empty library offers both install links instead of
describing a filter (listView.Fresh, which also hides the action key it has
nothing to name), and the owner alone gets a Readers panel with
POST /readers/{id}/revoke (404 for anyone else) to sign a Reader out
everywhere.
Isolation is asserted from both directions rather than by counting one
Reader's rows, and the shared-series invariant is pinned: two Readers on
one series produce one series row, two independent progresses, one poll
per due cycle, and one Reader's delete leaves the other's bookmark and the
poll intact.
27 lines
1.1 KiB
HTML
27 lines
1.1 KiB
HTML
{{/* The owner's Reader roster. Rendered only for the owner (listView.Owner),
|
|
and re-rendered whole as the response to a revocation so the session
|
|
counts cannot describe the state before the tap. Revocation is
|
|
confirm-gated: it signs someone out of every device at once. */}}
|
|
{{define "readers"}}
|
|
<details class="setup" id="readers">
|
|
<summary>Readers</summary>
|
|
<p class="setup-copy">Everyone who has signed in through Discord. Revoking
|
|
signs a Reader out of every device; their library and bookmarks are
|
|
untouched, and they can sign in again.</p>
|
|
<ul class="readerlist">
|
|
{{range .Readers}}
|
|
<li>
|
|
<span class="reader-id">{{.DiscordID}}</span>
|
|
<span class="reader-sessions">{{.Sessions}} session{{if ne .Sessions 1}}s{{end}}</span>
|
|
{{if .Sessions}}
|
|
<form hx-post="/readers/{{.ID}}/revoke" hx-target="#readers" hx-swap="outerHTML"
|
|
hx-confirm="Revoking signs this Reader out on every device immediately. Revoke?">
|
|
<button type="submit" class="ghost danger">Revoke sessions</button>
|
|
</form>
|
|
{{end}}
|
|
</li>
|
|
{{end}}
|
|
</ul>
|
|
</details>
|
|
{{end}}
|