trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/public-content-visibility/tasks.md
Ullrich Schäfer 5905cdadea
Apply public-content-visibility: visibility flag + public profile 
Implements the public-content-visibility OpenSpec change. Adds the
smallest social surface that lets us demo the product to logged-out
visitors without user signup.

Schema:
- `visibility text NOT NULL DEFAULT 'private'` on routes + activities.
- Shared Visibility type exported from the schema module.

Access:
- New canView(content, viewer, { asDirectLink }) helper in auth.server.ts
  centralises the rule: public → anyone; unlisted → anyone on direct
  link; private → owner only.
- routes.$id and activities.$id loaders return 404 (not 403) when
  canView rejects, so existence of private content isn't leaked.
- Detail pages emit Open Graph + Twitter Card meta on public/unlisted
  content only.

Editing:
- Visibility <select> on routes/:id/edit with owner-only access.
- Activity detail page gets a small visibility form + set-visibility
  action intent (no separate activity-edit page needed).
- EN + DE i18n under routes.visibility.* and activities.visibility.*.

Listings:
- Listing helpers listPublicRoutesForOwner / listPublicActivitiesForOwner
  for cross-user queries. Existing owner-scoped listRoutes/listActivities
  stay — owners see their own content regardless of visibility.

Public profile:
- /users/:username is now truly public. Renders the user's public
  routes + activities, 404s when no public content exists AND viewer
  isn't the owner (prevents account enumeration).
- Owner sees a short "this is your profile" note linking to settings.
- Open Graph meta (og:type=profile) for shareable preview.

Privacy manifest:
- Added a bullet noting public content is world-visible on profile
  and indexable by search engines.
- Bumped PRIVACY_LAST_UPDATED to 2026-04-20 + rendered legal-archive
  snapshot.

Tests:
- 13 unit tests for canView covering the full matrix.
- 6 E2E tests in e2e/public-content.test.ts covering:
  - Private route → 404 for logged-out visitor
  - Public route → reachable + OG tags present (og:title, og:type,
    og:site_name)
  - Owner still sees own private content
  - Profile 404 when no public content
  - Profile renders when at least one public route exists
  - Unlisted route reachable via direct URL but hidden from profile
- Test file runs serially (describe.configure mode=serial) to avoid
  WebAuthn virtual-authenticator races under Playwright's default
  parallel workers.
- New public-content Playwright project added to config.

Rollout safety: every existing row in prod keeps visibility='private'
by default — nothing becomes visible to outsiders until an owner
explicitly opts in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-19 09:11:39 +02:00

4.2 KiB
Raw Blame History

1. Schema

  • 1.1 Add visibility text NOT NULL DEFAULT 'private' to journal.routes in packages/db/src/schema/journal.ts
  • 1.2 Add the same column to journal.activities in the same file
  • 1.3 Export a shared type type Visibility = 'private' | 'unlisted' | 'public' from packages/db/src/schema/journal.ts (or a small adjacent module) and reuse at the app layer

2. Server-side access helper

  • 2.1 Add canView(content, user) in apps/journal/app/lib/auth.server.ts that returns true for public, true for unlisted (the direct-URL case — callers pass true when routed to a detail page, false when generating listings), and ownership-checked otherwise
  • 2.2 Unit test the three matrix cells

3. Route detail access

  • 3.1 Update apps/journal/app/routes/routes.$id.tsx loader: fetch route, then apply canView; return 404 when not allowed
  • 3.2 Expose visibility on the loader's returned shape so the component can render the current-visibility badge to the owner
  • 3.3 Emit Open Graph / Twitter Card meta for public and unlisted routes (title, description, og:type="article", og:site_name="trails.cool", twitter:card="summary")

4. Activity detail access

  • 4.1 Mirror 3.1 in apps/journal/app/routes/activities.$id.tsx
  • 4.2 Mirror 3.3 for activities

5. Visibility selector in the edit flow

  • 5.1 Add a visibility <select> to apps/journal/app/routes/routes.$id.edit.tsx
  • 5.2 Wire the form action in routes.$id.tsx / the edit route to persist the new value via updateRoute
  • 5.3 Add i18n keys (EN + DE) for routes.visibility.{label,private,unlisted,public,privateHelp,unlistedHelp,publicHelp}
  • 5.4 Surface the selector on the activity detail page for the owner (simpler than a new edit page); new updateActivityVisibility helper + set-visibility action intent

6. Listing filters

  • 6.1 Added listPublicRoutesForOwner(ownerId) — returns only public rows for profile listings. listRoutes(ownerId) stays as-is (owners see their own content regardless of visibility, per spec)
  • 6.2 Added listPublicActivitiesForOwner(ownerId) with the same shape
  • 6.3 Audited all callsites of listRoutes / listActivities / raw selects on from(routes|activities) — every path already passes the session user's own id, so no cross-user leaks. Cross-user surface is new (profile page) and uses the public-only helpers.

7. Public profile page

  • 7.1 The loader never required auth (it was already public-accessible); kept that way
  • 7.2 Fetch user row by username; 404 if missing
  • 7.3 Fetch public routes + public activities via the new listPublicRoutesForOwner / listPublicActivitiesForOwner
  • 7.4 404 when user has no public content AND the viewer isn't the owner (owners still see their own empty profile)
  • 7.5 Rendered profile header, reverse-chron lists, owner-only note linking to settings
  • 7.6 Open Graph + Twitter Card meta (og:title, og:description, og:type="profile", og:site_name)

8. Copy + docs

  • 8.1 Privacy Manifest: added a bullet in the Journal section explaining the visibility flag and that public content is world-visible
  • 8.2 Bumped PRIVACY_LAST_UPDATED to 2026-04-20 and rendered docs/legal-archive/privacy-2026-04-20.md

9. Testing

  • 9.1 Unit: canView matrix (13 cases across private/unlisted/public × owner/other/anon × asDirectLink)
  • 9.2 E2E: private route returns 404 to logged-out visitor; public route renders
  • 9.3 E2E: owner can view their own private route; unlisted reachable on direct URL but omitted from profile
  • 9.4 E2E: /users/:username 404s when no public content; renders when there's at least one public route
  • 9.5 E2E: OG tags (og:title, og:type=article, og:site_name) present on public route pages

10. Rollout

  • 10.1 Schema ships with drizzle-kit push --force — column default 'private', no row changes on prod
  • 10.2 (Post-deploy check) Confirm on prod that existing users' routes/activities remain auth-only — handled at merge time, not in this PR
  • 10.3 (Next change) demo-activity-bot will insert with visibility='public' directly — not in this PR