Implements the public-content-visibility OpenSpec change. Adds the
smallest social surface that lets us demo the product to logged-out
visitors without user signup.
Schema:
- `visibility text NOT NULL DEFAULT 'private'` on routes + activities.
- Shared Visibility type exported from the schema module.
Access:
- New canView(content, viewer, { asDirectLink }) helper in auth.server.ts
centralises the rule: public → anyone; unlisted → anyone on direct
link; private → owner only.
- routes.$id and activities.$id loaders return 404 (not 403) when
canView rejects, so existence of private content isn't leaked.
- Detail pages emit Open Graph + Twitter Card meta on public/unlisted
content only.
Editing:
- Visibility <select> on routes/:id/edit with owner-only access.
- Activity detail page gets a small visibility form + set-visibility
action intent (no separate activity-edit page needed).
- EN + DE i18n under routes.visibility.* and activities.visibility.*.
Listings:
- Listing helpers listPublicRoutesForOwner / listPublicActivitiesForOwner
for cross-user queries. Existing owner-scoped listRoutes/listActivities
stay — owners see their own content regardless of visibility.
Public profile:
- /users/:username is now truly public. Renders the user's public
routes + activities, 404s when no public content exists AND viewer
isn't the owner (prevents account enumeration).
- Owner sees a short "this is your profile" note linking to settings.
- Open Graph meta (og:type=profile) for shareable preview.
Privacy manifest:
- Added a bullet noting public content is world-visible on profile
and indexable by search engines.
- Bumped PRIVACY_LAST_UPDATED to 2026-04-20 + rendered legal-archive
snapshot.
Tests:
- 13 unit tests for canView covering the full matrix.
- 6 E2E tests in e2e/public-content.test.ts covering:
- Private route → 404 for logged-out visitor
- Public route → reachable + OG tags present (og:title, og:type,
og:site_name)
- Owner still sees own private content
- Profile 404 when no public content
- Profile renders when at least one public route exists
- Unlisted route reachable via direct URL but hidden from profile
- Test file runs serially (describe.configure mode=serial) to avoid
WebAuthn virtual-authenticator races under Playwright's default
parallel workers.
- New public-content Playwright project added to config.
Rollout safety: every existing row in prod keeps visibility='private'
by default — nothing becomes visible to outsiders until an owner
explicitly opts in.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
143 lines
5.3 KiB
TypeScript
143 lines
5.3 KiB
TypeScript
import { data, redirect } from "react-router";
|
|
import { useTranslation } from "react-i18next";
|
|
import type { Route } from "./+types/routes.$id.edit";
|
|
import { getSessionUser } from "~/lib/auth.server";
|
|
import { getRoute, updateRoute } from "~/lib/routes.server";
|
|
import type { Visibility } from "@trails-cool/db/schema/journal";
|
|
|
|
const VISIBILITY_VALUES = new Set<Visibility>(["private", "unlisted", "public"]);
|
|
|
|
export async function loader({ params, request }: Route.LoaderArgs) {
|
|
const user = await getSessionUser(request);
|
|
if (!user) return redirect("/auth/login");
|
|
|
|
const route = await getRoute(params.id);
|
|
if (!route) throw data({ error: "Route not found" }, { status: 404 });
|
|
if (route.ownerId !== user.id) throw data({ error: "Not authorized" }, { status: 403 });
|
|
|
|
return data({
|
|
route: {
|
|
id: route.id,
|
|
name: route.name,
|
|
description: route.description,
|
|
visibility: route.visibility,
|
|
},
|
|
});
|
|
}
|
|
|
|
export async function action({ params, request }: Route.ActionArgs) {
|
|
const user = await getSessionUser(request);
|
|
if (!user) return redirect("/auth/login");
|
|
|
|
const formData = await request.formData();
|
|
const name = formData.get("name") as string;
|
|
const description = formData.get("description") as string;
|
|
const gpxFile = formData.get("gpx") as File | null;
|
|
const visibilityRaw = formData.get("visibility") as string | null;
|
|
|
|
const input: { name?: string; description?: string; gpx?: string; visibility?: Visibility } = {};
|
|
if (name) input.name = name;
|
|
if (description !== null) input.description = description;
|
|
if (gpxFile && gpxFile.size > 0) {
|
|
input.gpx = await gpxFile.text();
|
|
}
|
|
if (visibilityRaw && VISIBILITY_VALUES.has(visibilityRaw as Visibility)) {
|
|
input.visibility = visibilityRaw as Visibility;
|
|
}
|
|
|
|
await updateRoute(params.id, user.id, input);
|
|
return redirect(`/routes/${params.id}`);
|
|
}
|
|
|
|
export function meta(_args: Route.MetaArgs) {
|
|
return [{ title: "Edit Route — trails.cool" }];
|
|
}
|
|
|
|
export default function EditRoutePage({ loaderData }: Route.ComponentProps) {
|
|
const { route } = loaderData;
|
|
const { t } = useTranslation("journal");
|
|
|
|
return (
|
|
<div className="mx-auto max-w-2xl px-4 py-8">
|
|
<h1 className="text-2xl font-bold text-gray-900">Edit Route</h1>
|
|
|
|
<form method="post" encType="multipart/form-data" className="mt-6 space-y-4">
|
|
<div>
|
|
<label htmlFor="name" className="block text-sm font-medium text-gray-700">
|
|
Name
|
|
</label>
|
|
<input
|
|
id="name"
|
|
name="name"
|
|
type="text"
|
|
required
|
|
defaultValue={route.name}
|
|
className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 shadow-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
|
/>
|
|
</div>
|
|
|
|
<div>
|
|
<label htmlFor="description" className="block text-sm font-medium text-gray-700">
|
|
Description
|
|
</label>
|
|
<textarea
|
|
id="description"
|
|
name="description"
|
|
rows={3}
|
|
defaultValue={route.description ?? ""}
|
|
className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 shadow-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
|
/>
|
|
</div>
|
|
|
|
<div>
|
|
<label htmlFor="visibility" className="block text-sm font-medium text-gray-700">
|
|
{t("routes.visibility.label")}
|
|
</label>
|
|
<select
|
|
id="visibility"
|
|
name="visibility"
|
|
defaultValue={route.visibility}
|
|
className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 shadow-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500"
|
|
>
|
|
<option value="private">{t("routes.visibility.private")}</option>
|
|
<option value="unlisted">{t("routes.visibility.unlisted")}</option>
|
|
<option value="public">{t("routes.visibility.public")}</option>
|
|
</select>
|
|
<p className="mt-1 text-xs text-gray-500">
|
|
{route.visibility === "private" && t("routes.visibility.privateHelp")}
|
|
{route.visibility === "unlisted" && t("routes.visibility.unlistedHelp")}
|
|
{route.visibility === "public" && t("routes.visibility.publicHelp")}
|
|
</p>
|
|
</div>
|
|
|
|
<div>
|
|
<label htmlFor="gpx" className="block text-sm font-medium text-gray-700">
|
|
Update GPX (optional — creates new version)
|
|
</label>
|
|
<input
|
|
id="gpx"
|
|
name="gpx"
|
|
type="file"
|
|
accept=".gpx,application/gpx+xml"
|
|
className="mt-1 block w-full text-sm text-gray-500 file:mr-4 file:rounded-md file:border-0 file:bg-blue-50 file:px-4 file:py-2 file:text-sm file:font-medium file:text-blue-700 hover:file:bg-blue-100"
|
|
/>
|
|
</div>
|
|
|
|
<div className="flex gap-3">
|
|
<button
|
|
type="submit"
|
|
className="rounded-md bg-blue-600 px-4 py-2 text-white hover:bg-blue-700"
|
|
>
|
|
Save Changes
|
|
</button>
|
|
<a
|
|
href={`/routes/${route.id}`}
|
|
className="rounded-md border border-gray-300 px-4 py-2 text-gray-700 hover:bg-gray-50"
|
|
>
|
|
Cancel
|
|
</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
);
|
|
}
|