stan/website
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

books-ui: library, detail page, EPUB/PDF reader, reading status/rating/sessions migration, progress/notes APIs, owner gating and tests

Browse Source
This commit is contained in:
Stan Runge
2026-10-24 01:06:33 +00:00
parent 8b2dfed239
commit 9c46e281c2
65 changed files with 25709 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/hooks.server.ts
View File

@@ -1,7 +1,7 @@
import type { Handle } from '@sveltejs/kit/hooks';
import { building } from '$app/env';
import { auth } from '#lib/server/auth.js';
import { isOwner, isOwnerOnlyPath } from '#lib/server/owner.js';
import { isOwner, isOwnerOnlyPath, isOwnerWritePath } from '#lib/server/owner.js';
import { error } from '@sveltejs/kit';
export const handle: Handle = async ({ event, resolve }) => {
@@ -11,17 +11,15 @@ export const handle: Handle = async ({ event, resolve }) => {
const session = building ? null : await auth.api.getSession({ headers: event.request.headers });
event.locals.user = session?.user ?? null;
event.locals.session = session?.session ?? null;
// Owner-only areas (health tracker). Page loads, __data.json and the import endpoint
// 404 for non-owners in the route itself (layout load / endpoint), which renders the
// same 404 page as an unknown URL. As a backstop, any other method (form actions,
// which skip layout loads) is refused here before a route runs.
// Owner-only areas (health tracker, book files, reader and book APIs). Page loads,
// __data.json and endpoints 404 for non-owners in the route itself (layout load /
// endpoint), which renders the same 404 page as an unknown URL. As a backstop, any other
// method (form actions, which skip layout loads) is refused here before a route runs,
// including writes to the otherwise public /trackers/books pages.
const ownerOnly = isOwnerOnlyPath(event.url.pathname);
if (
ownerOnly &&
!isOwner(event) &&
event.request.method !== 'GET' &&
event.request.method !== 'HEAD'
)
const owner = isOwner(event);
const read = event.request.method === 'GET' || event.request.method === 'HEAD';
if (!owner && ((ownerOnly && !read) || (!read && isOwnerWritePath(event.url.pathname))))
error(404, 'Not Found');
const response = await resolve(event);
if (ownerOnly) {