- Add AdminRequired middleware to all /admin routes for proper authorization
- Restrict admin panel, comments, users, settings to admin role only
- Create separate /my/articles routes for regular users to manage their own articles
- Add MyArticlesPage handler for users to view/edit/delete their own content
- Update navigation menus with role-based visibility
- Admin dropdown shows only 'Admin Panel' link, other features in dashboard
- Regular users see 'My Articles' link in profile dropdown
- Add i18n translations for 'my_articles' and 'comment_manage' keys
- Fix permission boundary issues where author role could access admin settings
Security improvements:
- Platform settings now require admin role
- Comment moderation requires admin role
- User management requires admin role
- Regular users can only manage their own articles
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings
- Comment model with nested replies (ParentID), dual authorship
(logged-in UserID / anonymous GuestToken cookie), email hash for
Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
/ use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
help; rendered client-side via marked + DOMPurify, with server-side
HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
"comment posted" banner no longer persists across refreshes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add an attachments table and AJAX upload/management on the article
create and edit pages.
- Attachment model with article_id (0 while pending on create),
session_token ownership, and SHA-256 content-addressed stored_name
- Upload validates via the platform policy (switch/type/size) and
deduplicates on disk by content hash
- Plan-A binding: attachments uploaded before an article exists are
owned by a session token and bound to the new article on save
- Delete soft-removes the record and drops the disk file only when no
remaining rows reference it (reference counting for deduped files)
- Edit page loads existing attachments via JSON list endpoint
- Row actions: insert into body (markdown image/link), set as cover
(image only), and delete
- Download URLs use the configured default download base URL when set,
else the local /uploads path
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add four DB-backed configuration tables for site-wide settings:
site_settings (logo, top-left title, header/footer text with zh/en
variants), upload_configs (master switch, default size, storage dir),
upload_file_types (per-extension whitelist with per-type size limits),
and download_baseurls (multiple download sources with priority/default).
- Models, AutoMigrate, and first-run seed (18 common file types)
- Process-level config cache warmed at startup, refreshed on admin save
- SetUserContext injects cached site settings into templates
- base.html renders logo (local upload or external URL), title, header
banner, and footer with i18n fallback
- Upload validator drives avatar uploads (form + AJAX) through the
configured switch/type/size policy
- Admin pages for site/upload/download settings with i18n keys
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add admin article list page at /admin/articles with status badges,
pin marker, publish time, and edit/delete actions
- Share the create/edit form: dynamic action URL, prefilled fields,
is_top checkbox state, and create-vs-edit heading
- Add ArticleUpdate/ArticleDelete handlers (soft-delete via DeletedAt);
stamp PublishedAt on first publish
- Add "Manage Articles" entry on the dashboard
- Hide home page sign-in/dashboard buttons
- Add EN/ZH i18n keys for the management UI
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Gin + GORM + Tailwind CSS blog engine
- OS-aware config (Linux /etc/blog_go/, Windows ./win/etc/blog_go/)
- SQLite by default, MySQL support via config
- Auto-migrate database + seed admin user on first run
- Session-based auth (login/logout)
- i18n: Chinese/English with auto-detect + manual switch
- Avatar dropdown nav with click-to-toggle menu
- Profile page: avatar upload, edit info, change password
- Role system: admin (full access) and author (profile only)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinandClaude Fable 5