From 45dd39d370f3b371103fb2ef993ebb41e8904b2d Mon Sep 17 00:00:00 2001
From: Joachim <joachim.robert@protonmail.com>
Date: Wed, 22 Dec 2021 15:12:56 +0100
Subject: [PATCH] Add key creation/revocation

---
 bookwyrm/templates/annual_summary/layout.html | 45 +++++++++++++++++++
 bookwyrm/urls.py                              |  4 ++
 bookwyrm/views/__init__.py                    |  2 +
 bookwyrm/views/annual_summary.py              | 42 +++++++++++++++++
 4 files changed, 93 insertions(+)

diff --git a/bookwyrm/templates/annual_summary/layout.html b/bookwyrm/templates/annual_summary/layout.html
index 46f9c0b3..0b46e725 100644
--- a/bookwyrm/templates/annual_summary/layout.html
+++ b/bookwyrm/templates/annual_summary/layout.html
@@ -44,6 +44,51 @@
         {% blocktrans %}<em>{{ display_name }}’s</em> year of reading{% endblocktrans %}
     </p>
 
+    <details>
+        <summary>
+            <h2 class="title is-6 has-text-centered has-text-success-dark">Share this page</h2>
+        </summary>
+        <div class="columns mt-3">
+            <div class="column is-three-fifths is-offset-one-fifth">
+
+            {% if user == summary_user %}
+            {% if year_key %}
+                <div class="columns mb-2">
+                    <div class="column pb-0">
+                        <p>Sharing status: <strong>public with key</strong></p>
+                        <p>The page can be seen by anyone with the complete address.</p>
+                    </div>
+                    <form class="column pb-0 is-narrow" method="post" action="{% url "summary-revoke-key" %}" id="revoke-key">
+                        {% csrf_token %}
+                        <input type="hidden" name="year" value="{{ year }}" />
+                        <button class="button is-danger is-outlined" type="submit">Make page private</button>
+                    </form>
+                </div>
+            {% else %}
+                <div class="columns">
+                    <div class="column pb-0">
+                        <p>Sharing status: <strong>private</strong></p>
+                        <p>The page is private, only you can see it.</p>
+                    </div>
+                    <form class="column pb-0 is-narrow" method="post" action="{% url "summary-add-key" %}" id="add-key">
+                        {% csrf_token %}
+                        <input type="hidden" name="year" value="{{ year }}" />
+                        <button class="button is-primary is-outlined" type="submit">Make page public</button>
+                    </form>
+                </div>
+            {% endif %}
+                <p class="help">When you make your page private, the old key won’t give access to the page anymore. A new key will be created if the page is once again made public.</p>
+            {% endif %}
+            </div>
+        </div>
+    </details>
+
+    <div class="columns mt-1">
+        <div class="column is-one-fifth is-offset-two-fifths">
+            <hr />
+        </div>
+    </div>
+
 {% if not books %}
     <p class="has-text-centered is-size-5">{% blocktrans %}Sadly {{ display_name }} didn’t finish any book in {{ year }}{% endblocktrans %}</p>
 {% else %}
diff --git a/bookwyrm/urls.py b/bookwyrm/urls.py
index 30e54bc7..7220b545 100644
--- a/bookwyrm/urls.py
+++ b/bookwyrm/urls.py
@@ -487,4 +487,8 @@ urlpatterns = [
         views.AnnualSummary.as_view(),
         name="annual-summary",
     ),
+    re_path(r"^summary_add_key/?$", views.summary_add_key, name="summary-add-key"),
+    re_path(
+        r"^summary_revoke_key/?$", views.summary_revoke_key, name="summary-revoke-key"
+    ),
 ] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
diff --git a/bookwyrm/views/__init__.py b/bookwyrm/views/__init__.py
index 2eeda114..8b1f5648 100644
--- a/bookwyrm/views/__init__.py
+++ b/bookwyrm/views/__init__.py
@@ -99,4 +99,6 @@ from .wellknown import *
 from .annual_summary import (
     AnnualSummary,
     personal_annual_summary,
+    summary_add_key,
+    summary_revoke_key,
 )
diff --git a/bookwyrm/views/annual_summary.py b/bookwyrm/views/annual_summary.py
index 5a98c009..03d724c0 100644
--- a/bookwyrm/views/annual_summary.py
+++ b/bookwyrm/views/annual_summary.py
@@ -57,6 +57,7 @@ class AnnualSummary(View):
             data = {
                 "summary_user": user,
                 "year": year,
+                "year_key": year_key,
                 "book_total": 0,
                 "books": [],
                 "paginated_years": paginated_years,
@@ -84,6 +85,7 @@ class AnnualSummary(View):
         data = {
             "summary_user": user,
             "year": year,
+            "year_key": year_key,
             "books_total": len(read_books_in_year),
             "books": read_books_in_year,
             "pages_total": page_stats["pages__sum"],
@@ -114,6 +116,46 @@ def personal_annual_summary(request, year):
     return redirect("annual-summary", request.user.localname, year)
 
 
+@login_required
+@require_POST
+def summary_add_key(request):
+    """add summary key"""
+
+    year = request.POST["year"]
+    user = request.user
+
+    new_key = uuid4().hex
+
+    if not user.summary_keys:
+        user.summary_keys = {
+            year: new_key,
+        }
+    else:
+        user.summary_keys[year] = new_key
+
+    user.save()
+
+    response = redirect("annual-summary", user.localname, year)
+    response["Location"] += f"?key={str(new_key)}"
+    return response
+
+
+@login_required
+@require_POST
+def summary_revoke_key(request):
+    """revoke summary key"""
+
+    year = request.POST["year"]
+    user = request.user
+
+    if user.summary_keys and year in user.summary_keys:
+        user.summary_keys.pop(year)
+
+    user.save()
+
+    return redirect("annual-summary", user.localname, year)
+
+
 def get_annual_summary_year():
     """return the latest available annual summary year or None"""