John O'Keefe
fb95b6d400
script-src now allow-lists the guard by sha256 of its rendered bytes (middleware.ScriptHashThemeFlashGuard) instead of 'unsafe-inline' — the guard is the app's only inline <script>. security_headers_test.go renders templates.ThemeFlashGuard() and fails with the replacement hash if the script text ever drifts. Executing anti-XSS strict CSP surfaced three latent violations the eval-removal sweep couldn't see (hash mode is stricter than eval mode, because inline event handler ATTRIBUTES now count against script-src): 1. admin_archived / admin_library: 15 native onclick=/onsubmit= handlers (modal open/close, folder-browser picker, purge button) converted to Alpine @click/@submit component methods — openCreateLibraryModal, hideModal, pickBrowsePath added to the admin component; purgeArchivedItems promoted from its window global into the component and the (window as any) exposure removed. 2. dashboard/docs: onclick handlers converted — dashboard's event.stopPropagation() → @click.stop; docs' sidebar/search closers → closeDocsSidebar/closeSearchResults component methods. 3. 8 onerror= image-fallback attributes (cover placeholders app-wide + audiobook cover hide) replaced by data-fallback attributes handled by one delegated capture-phase listener in web/src/image_fallback.ts — works for htmx-swapped content without re-binding. Verified: theme guard applies a saved theme on public pages under the hash CSP; 14-page authenticated sweep clean; admin pages clean under the promoted admin; admin-library modal open/close bindings exercised; readers render error-free; go build/vet/middleware-test, tsc, vp check/test (146), build:ts all green.
117 lines
4.4 KiB
Templ
117 lines
4.4 KiB
Templ
package templates
|
|
|
|
templ AdminArchived(user User, items []ArchivedItem, retentionDays int) {
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
|
|
<title>Archived Items - Bookhoard</title>
|
|
<script src="/static/htmx.min.js"></script>
|
|
<link href="/static/style.css" rel="stylesheet"/>
|
|
<link rel="icon" type="image/svg+xml" href="/static/favicon.svg"/>
|
|
</head>
|
|
<body class={ "theme-" + user.Theme }>
|
|
@Header(user, "/admin/archived")
|
|
<main class="p-8">
|
|
<div class="max-w-5xl">
|
|
<div class="mb-8">
|
|
<div class="flex items-center justify-between gap-4 flex-wrap">
|
|
<div>
|
|
<div class="flex items-center gap-3 mb-1">
|
|
<span class="grid place-items-center h-10 w-10 rounded-xl" style="background-color: var(--accent-muted); color: var(--accent);">
|
|
@Icon("library", "h-5 w-5")
|
|
</span>
|
|
<h1 class="text-2xl font-bold tracking-tight" style="color: var(--text-primary)">Archived Items</h1>
|
|
</div>
|
|
<p class="text-sm" style="color: var(--text-secondary)">
|
|
Books hidden because their files are missing from disk. Reading history is
|
|
kept in case a file returns; moves are detected automatically.
|
|
if retentionDays > 0 {
|
|
Archived items are permanently deleted after { retentionDays } days
|
|
(ARCHIVE_RETENTION_DAYS).
|
|
} else {
|
|
Archived items are kept until manually purged (retention disabled).
|
|
}
|
|
</p>
|
|
</div>
|
|
if len(items) > 0 {
|
|
<button type="button" @click="purgeArchivedItems()" class="btn btn-secondary">
|
|
@Icon("trash", "h-4 w-4")
|
|
Purge All Archived
|
|
</button>
|
|
}
|
|
</div>
|
|
</div>
|
|
|
|
if len(items) == 0 {
|
|
<div class="card p-8 text-center">
|
|
<p style="color: var(--text-secondary)">Nothing is archived or missing. All clear.</p>
|
|
</div>
|
|
} else {
|
|
<div class="card overflow-hidden">
|
|
<table class="w-full text-sm">
|
|
<thead>
|
|
<tr class="border-b text-left" style="border-color: var(--border); color: var(--text-secondary);">
|
|
<th class="px-4 py-3 font-semibold">Book</th>
|
|
<th class="px-4 py-3 font-semibold">Library</th>
|
|
<th class="px-4 py-3 font-semibold">Status</th>
|
|
<th class="px-4 py-3 font-semibold text-right">Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
for _, item := range items {
|
|
<tr class="border-b" style="border-color: color-mix(in srgb, var(--text-primary) 5%, transparent);">
|
|
<td class="px-4 py-3">
|
|
<p class="font-medium" style="color: var(--text-primary)">{ item.Title }</p>
|
|
if item.Author != "" {
|
|
<p style="color: var(--text-secondary)">{ item.Author }</p>
|
|
}
|
|
<p class="font-mono text-xs break-all" style="color: var(--text-secondary)">{ item.FilePath }</p>
|
|
</td>
|
|
<td class="px-4 py-3" style="color: var(--text-primary)">{ item.LibraryName }</td>
|
|
<td class="px-4 py-3" style="color: var(--text-secondary)">{ item.Status }</td>
|
|
<td class="px-4 py-3 text-right whitespace-nowrap">
|
|
if item.MatchID != "" {
|
|
<button
|
|
type="button"
|
|
data-merge-source={ item.ID }
|
|
data-merge-target={ item.MatchID }
|
|
class="btn btn-ghost text-xs"
|
|
title={ "Merge this archived copy's reading data into the active copy \"" + item.MatchTitle + "\" (" + item.MatchLibraryName + ") and remove the archived entry" }
|
|
>
|
|
@Icon("copy", "h-3.5 w-3.5")
|
|
Merge
|
|
</button>
|
|
}
|
|
<button
|
|
type="button"
|
|
data-unarchive={ item.ID }
|
|
class="btn btn-ghost text-xs"
|
|
title="Restore to libraries now; if the file is still gone the next scan hides it again"
|
|
>
|
|
@Icon("refresh", "h-3.5 w-3.5")
|
|
Restore
|
|
</button>
|
|
<button
|
|
type="button"
|
|
data-delete-archived={ item.ID }
|
|
class="btn btn-ghost text-xs"
|
|
title="Delete this item and its reading history permanently"
|
|
>
|
|
@Icon("trash", "h-3.5 w-3.5")
|
|
Delete
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
}
|
|
</div>
|
|
</main>
|
|
</body>
|
|
</html>
|
|
}
|