Soapbox: statisk blogg med mobilvennlig markdown-editor

Flask-app som genererer statiske sider til public/ og serverer dem
sammen med et admin-grensesnitt (/admin). Innhold ligger som markdown
og bilder i et git-repo (data/content), brukere i sqlite.

- Editor med toolbar, live server-side forhåndsvisning, bildeopplasting
  via knapp, dra-og-slipp og lim inn. Bilder nedskaleres og EXIF fjernes.
- Hovedbruker publiserer under /<slug>/, gjester under /<bruker>/<slug>/.
  Slug lages fra tittelen og fryses ved publisering.
- Alle interne lenker er relative, så siden kan flyttes mellom domener og
  sub-paths (SOAPBOX_BASE_PATH) uten rebuild.
- Tema 'green' med CSS-variabler, mørk modus og WCAG-kontrast.
- Containerfile (python:alpine + git), compose.yaml og Caddyfile-eksempel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JcEy43fNYpwg6K6oTKakWR

tests/test_app.py

@@ -0,0 +1,136 @@
+import re
+
+from soapbox.app import create_app
+from soapbox.config import load_config
+from tests.conftest import csrf, login, png_bytes
+
+
+def _create_post(client, prefix=""):
+    login(client, prefix=prefix)
+    r = client.post(f"{prefix}/admin/new", data={"csrf": csrf(client)})
+    assert r.status_code == 302
+    post_id = r.headers["Location"].split("/admin/edit/")[1]
+    return post_id
+
+
+def test_login_required(client):
+    assert client.get("/admin/").status_code == 302
+    assert client.get("/admin/login").status_code == 200
+    assert client.get("/admin/static/admin.css").content_type.startswith("text/css")
+    assert client.get("/admin/static/editor.js").status_code == 200
+
+
+def test_full_flow_owner(client, cfg):
+    post_id = _create_post(client)
+    assert post_id == "_owner/nytt-innlegg"
+    token = csrf(client)
+
+    # Last opp et bilde
+    r = client.post(
+        f"/admin/upload/{post_id}",
+        data={"file": (__import__("io").BytesIO(png_bytes()), "Mitt Bilde.PNG")},
+        headers={"X-CSRF": token},
+        content_type="multipart/form-data",
+    )
+    assert r.status_code == 200, r.data
+    assert r.json["filename"] == "mitt-bilde.png"
+
+    # Forhåndsvisning peker bildet til admin-media
+    r = client.post(
+        f"/admin/preview/{post_id}",
+        json={"body": "![](mitt-bilde.png) [x](/annet/)"},
+        headers={"X-CSRF": token},
+    )
+    assert f'src="/admin/media/{post_id}/mitt-bilde.png"' in r.text
+    assert 'href="../annet/"' in r.text
+
+    # Publiser: slug følger tittelen
+    body = "Hei **verden**\n\n![](mitt-bilde.png)\n\n[hjem](/)"
+    r = client.post(
+        f"/admin/edit/{post_id}",
+        data={"csrf": token, "title": "Grønt er skjønt", "body": body, "action": "publish"},
+    )
+    assert r.headers["Location"].endswith("/admin/edit/_owner/groent-er-skjoent")
+    assert (cfg.content_dir / "posts/groent-er-skjoent/index.md").exists()
+    assert (cfg.content_dir / "posts/groent-er-skjoent/mitt-bilde.png").exists()
+
+    # Statisk output
+    r = client.get("/groent-er-skjoent")
+    assert r.status_code == 301 and r.headers["Location"].endswith("/groent-er-skjoent/")
+    html = client.get("/groent-er-skjoent/").text
+    assert "<strong>verden</strong>" in html
+    assert 'href="../theme/style.css"' in html
+    assert 'href="../"' in html  # intern lenke omskrevet til relativ
+    assert client.get("/groent-er-skjoent/mitt-bilde.png").status_code == 200
+    assert "Grønt er skjønt" in client.get("/").text
+    feed = client.get("/feed.xml").text
+    assert "https://blog.example.no/groent-er-skjoent/" in feed
+
+    # Etter publisering fryses slug selv om tittelen endres
+    r = client.post(
+        "/admin/edit/_owner/groent-er-skjoent",
+        data={"csrf": token, "title": "Ny tittel", "body": body, "action": "save"},
+    )
+    assert r.headers["Location"].endswith("/admin/edit/_owner/groent-er-skjoent")
+
+    # Git-historikk
+    from soapbox.gitstore import log
+
+    lines = log(cfg.content_dir)
+    assert any("Publiserte: Grønt er skjønt" in line for line in lines)
+    assert all("eier:" in line for line in lines)
+
+
+def test_guest_flow_and_isolation(client, cfg):
+    post_id = _create_post(client)  # eierens utkast
+    client.post("/admin/logout", data={"csrf": csrf(client)})
+
+    login(client, "gjest1")
+    token = csrf(client)
+    # Gjest kan ikke røre eierens innlegg
+    assert client.get(f"/admin/edit/{post_id}").status_code == 403
+    assert client.get("/admin/users").status_code == 403
+
+    r = client.post("/admin/new", data={"csrf": token})
+    gid = r.headers["Location"].split("/admin/edit/")[1]
+    assert gid == "gjest1/nytt-innlegg"
+    client.post(
+        f"/admin/edit/{gid}",
+        data={"csrf": token, "title": "Post 1", "body": "hei", "action": "publish"},
+    )
+    assert (cfg.content_dir / "guests/gjest1/post-1/index.md").exists()
+
+    html = client.get("/gjest1/post-1/").text
+    assert 'href="../../theme/style.css"' in html
+    assert "Gjest En" in html
+    assert "Post 1" in client.get("/gjest1/").text
+    assert "Post 1" in client.get("/").text  # gjesteinnlegg vises også på forsiden
+    # eierens utkast er ikke publisert
+    assert client.get("/nytt-innlegg/").status_code == 404
+
+
+def test_csrf_enforced(client):
+    login(client)
+    assert client.post("/admin/new", data={}).status_code == 403
+
+
+def test_subpath_mount(tmp_path):
+    cfg = load_config({"SOAPBOX_DATA_DIR": str(tmp_path / "d"), "SOAPBOX_BASE_PATH": "/blog/"})
+    assert cfg.base_path == "/blog"
+    app = create_app(cfg)
+    app.config["TESTING"] = True
+    from soapbox import db
+
+    conn = db.connect(cfg.db_path)
+    db.create_user(conn, "eier", "hemmelig123", db.ROLE_OWNER)
+    conn.close()
+    client = app.test_client()
+    assert client.get("/admin/login").status_code == 404
+    assert client.get("/blog/admin/login").status_code == 200
+    login(client, prefix="/blog")
+    r = client.post("/blog/admin/new", data={"csrf": csrf(client, "/blog")})
+    assert r.headers["Location"].startswith("/blog/admin/edit/")
+    html = client.get("/blog/").text
+    assert 'href="theme/style.css"' in html
+    assert re.search(r'href="admin/"', html)
+    assert client.get("/blog/theme/style.css").status_code == 200