Files
flowdeck/app/templates/accounts.html
T
bruno 770fdc2b68
FlowDeck CI / lint (push) Successful in 1m57s
FlowDeck CI / test (push) Successful in 15m20s
FlowDeck CI / docker (push) Canceled after 0s
fix: A43 TERMINÉ + A38 phase 1 — CSRF rendu côté serveur, helper unique (v7.33.0)
A43 (les 4 items sont clos) :
- `__CSRF_PLACEHOLDER__` supprimé : ContextVar CSRF_TOKEN posée par
  CSRFMiddleware avant call_next (même mécanique que le nonce CSP),
  global `{{ csrf_token() }}` dans templating, base.html rend
  `{"X-CSRF-Token":{{ csrf_token()|tojson }}}` — vide si cookie absent,
  `htmx:configRequest` re-lit le cookie à chaque appel → plus jamais de
  jeton factice servi.
- Palette : `fetch('/api/search…')` SANS header (GET ∈ SAFE_METHODS →
  CSRF inapplicable) — le JSON.parse du body-attr par frappe disparaît.
- utcnow déprécié = 0 dans app/**.py ; health loggé (A25) + booléens db/
  gitea = raison ; probe réseau = voulu (test de connectivité).

A38 phase 1 (CSRF unifié) :
- `window.getCsrf()` unique dans le <head> de base.html.
- 76 lectures brutes du cookie → getCsrf() dans 13 fichiers (47 formes
  `(…||[])[1]||''`, 25 déclarations `const X = match(…)` avec conversion
  de leurs usages `X?X[1]:''` → `X` (noms collectés PAR FICHIER, jamais
  de règle globale), 4 formes espacées).
- Définitions dupliquées supprimées : card_detail.html (multi-lignes),
  database_table.js (1 ligne dans IIFE → chute sur le global).
- Les 3 variantes de base.html (IIFE getCsrf + 2 getCsrfToken) →
  `return getCsrf()`.
- welcome.html garde sa lecture locale (page autonome sans base) ;
  reste exactement 1 raw dans base.html (la déf head) + 2 dans welcome.

Test : test_csrf_server_rendered_no_placeholder (pas de placeholder +
token du hx-headers == cookie csrf_token).

suite **1092/1092** · ruff OK · node --check vert · docs à jour
2026-10-02 08:45:27 -04:00

133 lines
5.3 KiB
HTML

{% extends "base.html" %}
{% block page_icon %}{{ fd_icon("user",18) }}{% endblock %}
{% block page_title %}Accounts{% endblock %}
{% block title_prefix %}Accounts{% endblock %}
{% block content %}
<div class="page-title-area">
<div class="page-title">
<span class="page-icon-lg">{{ fd_icon("user",24) }}</span>
<h1>Account Management</h1>
</div>
</div>
<div style="padding: 0 24px; max-width: 900px;" x-data="accountsData()">
<!-- Current user profile -->
<div style="background:var(--bg-secondary); border-radius:8px; padding:20px; margin-bottom:24px;">
<h3 style="margin-bottom:16px;">Your Profile</h3>
<div style="display:flex; gap:16px; align-items:flex-start;">
<div class="workspace-avatar" style="width:48px; height:48px; font-size:20px;">
{{ user.login[0] if user else 'B' }}
</div>
<div style="flex:1;">
<div style="display:flex; gap:12px; margin-bottom:12px;">
<div style="flex:1;">
<label style="font-size:12px; color:var(--text-dim);">Username</label>
<input type="text" value="{{ user.login }}" disabled
style="width:100%; background:var(--bg-tertiary); border:1px solid var(--border); border-radius:6px;
padding:8px; color:var(--text-dim); font-size:14px;">
</div>
<div style="flex:1;">
<label style="font-size:12px; color:var(--text-dim);">Display name</label>
<input type="text" x-model="profile.full_name"
style="width:100%; background:var(--bg-secondary); border:1px solid var(--border); border-radius:6px;
padding:8px; color:var(--text-primary); font-size:14px; outline:none;">
</div>
</div>
<div style="margin-bottom:12px;">
<label style="font-size:12px; color:var(--text-dim);">Email</label>
<input type="text" x-model="profile.email"
style="width:100%; background:var(--bg-secondary); border:1px solid var(--border); border-radius:6px;
padding:8px; color:var(--text-primary); font-size:14px; outline:none;">
</div>
<button class="btn-new" @click="saveProfile()">Save Profile</button>
<span x-show="saved" style="color:var(--green); font-size:13px; margin-left:8px;">✓ Saved</span>
</div>
</div>
</div>
<!-- Connected accounts -->
<div style="background:var(--bg-secondary); border-radius:8px; padding:20px; margin-bottom:24px;">
<h3 style="margin-bottom:12px;">Connected Accounts</h3>
<div style="display:flex; align-items:center; gap:12px; padding:12px; border:1px solid var(--border); border-radius:6px;">
<span style="font-size:20px;">{{ fd_icon("link",20) }}</span>
<div style="flex:1;">
<div style="font-weight:600;">Gitea</div>
<div style="font-size:12px; color:var(--text-dim);">
{% if user %}Connected as {{ user.login }}{% else %}Not connected{% endif %}
</div>
</div>
{% if user %}
<a href="/auth/logout" class="toolbar-btn" style="color:var(--red);">Disconnect</a>
{% else %}
<a href="/auth/login" class="btn-new">Connect Gitea</a>
{% endif %}
</div>
</div>
<!-- Users in workspace -->
<div style="background:var(--bg-secondary); border-radius:8px; padding:20px;">
<h3 style="margin-bottom:12px;">Workspace Members</h3>
<div style="font-size:13px; color:var(--text-dim); margin-bottom:12px;">
Members are managed through Gitea. New users connect via OAuth and appear here automatically.
</div>
<table class="data-table" style="width:100%;">
<thead>
<tr>
<th>User</th>
<th>Email</th>
<th>Joined</th>
<th>Role</th>
</tr>
</thead>
<tbody>
{% for u in users %}
<tr>
<td>
<div style="display:flex; align-items:center; gap:8px;">
<div class="card-avatar" style="width:24px; height:24px; font-size:11px;">{{ u.login[0] }}</div>
<span>{{ u.login }}</span>
</div>
</td>
<td>{{ u.email or '—' }}</td>
<td>{{ u.created_at[:10] if u.created_at else '—' }}</td>
<td>{% if u.is_admin %}Admin{% else %}Member{% endif %}</td>
</tr>
{% endfor %}
{% if not users %}
<tr><td colspan="4" style="text-align:center; color:var(--text-dim); padding:24px;">No members yet</td></tr>
{% endif %}
</tbody>
</table>
</div>
</div>
{% endblock %}
{% block scripts %}
<script data-cfasync="false" nonce="{{ csp_nonce() }}">
function accountsData() {
return {
profile: { full_name: '', email: '' },
saved: false,
async init() {
try {
const r = await fetch('/api/users/me');
const data = await r.json();
this.profile = { full_name: data.full_name || '', email: data.email || '' };
} catch(e) {}
},
saveProfile() {
const csrf = getCsrf();;
const token = csrf;
fetch(`/api/users/me?full_name=${encodeURIComponent(this.profile.full_name)}&email=${encodeURIComponent(this.profile.email)}`, {
method: 'PUT', headers: { 'X-CSRF-Token': token }
}).then(() => {
this.saved = true;
setTimeout(() => this.saved = false, 3000);
});
}
};
}
</script>
{% endblock %}