Add in-app edit UI for dashboard config

A web editor at /edit for managing pages and widgets without hand-editing YAML: - Page list and per-page widget views with breadcrumb navigation - Add/delete pages, add/delete/reorder widgets within a column - Per-widget textarea editor with curated starter templates, widget-specific help (example, full field reference, link to upstream docs), and inline error rendering that preserves the user's edits on validation failure - Pre-save validation via newConfigFromYAML; atomic temp+rename writes with .bak backup; YAML edits go through yaml.Node so comments and unresolved ${env:X}/${secret:X} tokens survive round-trips - Auth gate: editing requires auth.users to be configured, or admin.allow-without-auth: true as an explicit opt-in for trusted networks - Pencil button on the dashboard near the theme picker for quick access - Admin views read fresh from disk so the list updates immediately after saves rather than lagging the fsnotify watcher Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-30 14:12:18 +00:00
parent 6c5b7a3f4c
commit 2e198a19b4
12 changed files with 1468 additions and 107 deletions
@@ -0,0 +1,555 @@
+package glance
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// configEditor manipulates glance.yml as a yaml.Node tree, preserving
+// comments, ordering, and unresolved ${env:X}/${secret:X} tokens that
+// would be destroyed by round-tripping through the parsed config struct.
+type configEditor struct {
+	path string
+	root yaml.Node
+}
+
+func loadConfigEditor(path string) (*configEditor, error) {
+	_, includes, err := parseYAMLIncludes(path)
+	if err != nil {
+		return nil, fmt.Errorf("parsing config: %w", err)
+	}
+	if len(includes) > 0 {
+		return nil, fmt.Errorf("admin editing is not supported when the config uses include directives — edit included files manually for now")
+	}
+
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("reading config: %w", err)
+	}
+
+	e := &configEditor{path: path}
+	if err := yaml.Unmarshal(raw, &e.root); err != nil {
+		return nil, fmt.Errorf("parsing config yaml: %w", err)
+	}
+	if e.root.Kind != yaml.DocumentNode || len(e.root.Content) == 0 {
+		return nil, fmt.Errorf("config has no document content")
+	}
+	if e.root.Content[0].Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("config top-level is not a mapping")
+	}
+	return e, nil
+}
+
+// save validates the edited tree against newConfigFromYAML, writes a
+// .bak of the previous file, then writes via temp+rename for atomicity.
+func (e *configEditor) save() error {
+	out, err := yaml.Marshal(&e.root)
+	if err != nil {
+		return fmt.Errorf("marshaling config: %w", err)
+	}
+
+	if _, err := newConfigFromYAML(out); err != nil {
+		return fmt.Errorf("edited config is invalid: %w", err)
+	}
+
+	if existing, err := os.ReadFile(e.path); err == nil {
+		if werr := os.WriteFile(e.path+".bak", existing, 0644); werr != nil {
+			log.Printf("admin: failed to write backup: %v", werr)
+		}
+	}
+
+	tmpPath := e.path + ".tmp"
+	if err := os.WriteFile(tmpPath, out, 0644); err != nil {
+		return fmt.Errorf("writing temp file: %w", err)
+	}
+	if err := os.Rename(tmpPath, e.path); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("renaming temp file into place: %w", err)
+	}
+	return nil
+}
+
+func (e *configEditor) topMapping() *yaml.Node {
+	return e.root.Content[0]
+}
+
+// findOrCreateKey returns the value node for the given key under a mapping.
+// If create is true and the key does not exist, it is appended with a fresh
+// value node of the given kind.
+func findOrCreateKey(m *yaml.Node, key string, create bool, valueKind yaml.Kind) (*yaml.Node, error) {
+	if m.Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("node is not a mapping")
+	}
+	for i := 0; i+1 < len(m.Content); i += 2 {
+		if m.Content[i].Value == key {
+			return m.Content[i+1], nil
+		}
+	}
+	if !create {
+		return nil, fmt.Errorf("key %q not found", key)
+	}
+	keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
+	valNode := &yaml.Node{Kind: valueKind}
+	m.Content = append(m.Content, keyNode, valNode)
+	return valNode, nil
+}
+
+func (e *configEditor) pagesNode(create bool) (*yaml.Node, error) {
+	return findOrCreateKey(e.topMapping(), "pages", create, yaml.SequenceNode)
+}
+
+// widgetSlot returns the sequence node holding the widget and the widget's
+// position within it. Caller can read via seq.Content[pos] or replace by
+// assigning to seq.Content[pos]. Use colIdx = -1 for head widgets.
+func (e *configEditor) widgetSlot(pageIdx, colIdx, widgetIdx int) (*yaml.Node, int, error) {
+	pageNode, err := e.pageNodeAt(pageIdx)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	var seq *yaml.Node
+	if colIdx == -1 {
+		seq, err = findOrCreateKey(pageNode, "head-widgets", false, yaml.SequenceNode)
+		if err != nil {
+			return nil, 0, err
+		}
+	} else {
+		columns, err := columnsOf(pageNode)
+		if err != nil {
+			return nil, 0, err
+		}
+		if colIdx < 0 || colIdx >= len(columns.Content) {
+			return nil, 0, fmt.Errorf("column index out of range")
+		}
+		seq, err = widgetsOf(columns.Content[colIdx])
+		if err != nil {
+			return nil, 0, err
+		}
+	}
+
+	if widgetIdx < 0 || widgetIdx >= len(seq.Content) {
+		return nil, 0, fmt.Errorf("widget index out of range")
+	}
+	return seq, widgetIdx, nil
+}
+
+func (e *configEditor) pageNodeAt(idx int) (*yaml.Node, error) {
+	pages, err := e.pagesNode(false)
+	if err != nil {
+		return nil, err
+	}
+	if pages.Kind != yaml.SequenceNode {
+		return nil, fmt.Errorf("pages is not a sequence")
+	}
+	if idx < 0 || idx >= len(pages.Content) {
+		return nil, fmt.Errorf("page index %d out of range", idx)
+	}
+	return pages.Content[idx], nil
+}
+
+func columnsOf(pageNode *yaml.Node) (*yaml.Node, error) {
+	return findOrCreateKey(pageNode, "columns", false, yaml.SequenceNode)
+}
+
+func widgetsOf(columnNode *yaml.Node) (*yaml.Node, error) {
+	return findOrCreateKey(columnNode, "widgets", true, yaml.SequenceNode)
+}
+
+func newPageNode(title string) *yaml.Node {
+	return &yaml.Node{
+		Kind: yaml.MappingNode,
+		Content: []*yaml.Node{
+			{Kind: yaml.ScalarNode, Value: "name"},
+			{Kind: yaml.ScalarNode, Value: title},
+			{Kind: yaml.ScalarNode, Value: "columns"},
+			{Kind: yaml.SequenceNode, Content: []*yaml.Node{
+				{Kind: yaml.MappingNode, Content: []*yaml.Node{
+					{Kind: yaml.ScalarNode, Value: "size"},
+					{Kind: yaml.ScalarNode, Value: "full"},
+					{Kind: yaml.ScalarNode, Value: "widgets"},
+					{Kind: yaml.SequenceNode},
+				}},
+			}},
+		},
+	}
+}
+
+// adminError renders a minimal HTML error page so failed mutations don't
+// leave the user staring at a blank screen. The hot-reload watcher will
+// still pick up any successful intermediate save state.
+func adminError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+	w.Write([]byte("<!doctype html><meta charset=utf-8><title>Edit error</title><body style=\"font-family:sans-serif;padding:2rem;max-width:50rem\"><h1>Couldn't save</h1><p>The change wasn't applied. Your config file is unchanged.</p><pre style=\"white-space:pre-wrap;background:#f4f4f4;padding:1rem;border-radius:4px\">"))
+	w.Write([]byte(htmlEscape(msg)))
+	w.Write([]byte("</pre><p><a href=\"javascript:history.back()\">Back</a></p>"))
+}
+
+func htmlEscape(s string) string {
+	r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;", "\"", "&quot;", "'", "&#39;")
+	return r.Replace(s)
+}
+
+// ---- handlers ----
+
+func (a *application) handleAdminAddPage(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		adminError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	title := strings.TrimSpace(r.FormValue("title"))
+	if title == "" {
+		adminError(w, http.StatusBadRequest, "page title is required")
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	pages, err := editor.pagesNode(true)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	pages.Content = append(pages.Content, newPageNode(title))
+
+	if err := editor.save(); err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, a.Config.Server.BaseURL+"/edit", http.StatusSeeOther)
+}
+
+func (a *application) handleAdminDeletePage(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	slug := r.PathValue("page")
+	idx, ok := a.freshPageIndexBySlug(slug)
+	if !ok {
+		a.handleNotFound(w, r)
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	pages, err := editor.pagesNode(false)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if idx >= len(pages.Content) {
+		adminError(w, http.StatusInternalServerError, "page index out of range — config may have been edited externally")
+		return
+	}
+	if len(pages.Content) <= 1 {
+		adminError(w, http.StatusBadRequest, "cannot delete the last remaining page")
+		return
+	}
+	pages.Content = append(pages.Content[:idx], pages.Content[idx+1:]...)
+
+	if err := editor.save(); err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, a.Config.Server.BaseURL+"/edit", http.StatusSeeOther)
+}
+
+func (a *application) handleAdminDeleteWidget(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	slug := r.PathValue("page")
+	pageIdx, ok := a.freshPageIndexBySlug(slug)
+	if !ok {
+		a.handleNotFound(w, r)
+		return
+	}
+	col, err := strconv.Atoi(r.PathValue("col"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+	idx, err := strconv.Atoi(r.PathValue("idx"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	pageNode, err := editor.pageNodeAt(pageIdx)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	columns, err := columnsOf(pageNode)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if col < 0 || col >= len(columns.Content) {
+		adminError(w, http.StatusBadRequest, "column index out of range")
+		return
+	}
+	widgets, err := widgetsOf(columns.Content[col])
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if idx < 0 || idx >= len(widgets.Content) {
+		adminError(w, http.StatusBadRequest, "widget index out of range")
+		return
+	}
+	widgets.Content = append(widgets.Content[:idx], widgets.Content[idx+1:]...)
+
+	if err := editor.save(); err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
+}
+
+func (a *application) handleAdminMoveWidget(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	slug := r.PathValue("page")
+	pageIdx, ok := a.freshPageIndexBySlug(slug)
+	if !ok {
+		a.handleNotFound(w, r)
+		return
+	}
+	col, err := strconv.Atoi(r.PathValue("col"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+	idx, err := strconv.Atoi(r.PathValue("idx"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+
+	dir := r.URL.Query().Get("dir")
+	delta := 0
+	switch dir {
+	case "up":
+		delta = -1
+	case "down":
+		delta = 1
+	default:
+		adminError(w, http.StatusBadRequest, "dir must be 'up' or 'down'")
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	pageNode, err := editor.pageNodeAt(pageIdx)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	columns, err := columnsOf(pageNode)
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if col < 0 || col >= len(columns.Content) {
+		adminError(w, http.StatusBadRequest, "column index out of range")
+		return
+	}
+	widgets, err := widgetsOf(columns.Content[col])
+	if err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	target := idx + delta
+	if idx < 0 || idx >= len(widgets.Content) || target < 0 || target >= len(widgets.Content) {
+		adminError(w, http.StatusBadRequest, "cannot move further in that direction")
+		return
+	}
+	widgets.Content[idx], widgets.Content[target] = widgets.Content[target], widgets.Content[idx]
+
+	if err := editor.save(); err != nil {
+		adminError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
+}
+
+func (a *application) handleAdminEditWidget(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		adminError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	slug := r.PathValue("page")
+	page, pageIdx, exists := findPageBySlug(a.freshPagesFromDisk(), slug)
+	if !exists {
+		a.handleNotFound(w, r)
+		return
+	}
+	col, err := strconv.Atoi(r.PathValue("col"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+	idx, err := strconv.Atoi(r.PathValue("idx"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+
+	yamlText := r.FormValue("yaml")
+
+	rerenderError := func(msg string) {
+		a.renderWidgetEditor(w, r, editorRenderInput{
+			pageTitle:    page.Title,
+			pageSlug:     page.Slug,
+			col:          col,
+			idx:          idx,
+			widgetType:   widgetTypeFromYAML(yamlText),
+			yamlText:     yamlText,
+			errorMessage: msg,
+		})
+	}
+
+	newNode, err := parseWidgetYAML(yamlText)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	seq, pos, err := editor.widgetSlot(pageIdx, col, idx)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	seq.Content[pos] = newNode
+
+	if err := editor.save(); err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	http.Redirect(w, r,
+		fmt.Sprintf("%s/edit/pages/%s/widgets/%d/%d", a.Config.Server.BaseURL, slug, col, idx),
+		http.StatusSeeOther)
+}
+
+// parseWidgetYAML parses the editor's submitted text into a single mapping
+// node suitable for splicing into the config tree.
+func parseWidgetYAML(yamlText string) (*yaml.Node, error) {
+	var doc yaml.Node
+	if err := yaml.Unmarshal([]byte(yamlText), &doc); err != nil {
+		return nil, fmt.Errorf("YAML parse error: %w", err)
+	}
+	if doc.Kind != yaml.DocumentNode || len(doc.Content) == 0 {
+		return nil, fmt.Errorf("submitted YAML is empty")
+	}
+	node := doc.Content[0]
+	if node.Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("widget YAML must be a mapping (key: value pairs)")
+	}
+	return node, nil
+}
+
+func (a *application) handleAdminCreateWidget(w http.ResponseWriter, r *http.Request) {
+	if !a.adminAccessAllowed(w, r) {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		adminError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	slug := r.PathValue("page")
+	page, pageIdx, exists := findPageBySlug(a.freshPagesFromDisk(), slug)
+	if !exists {
+		a.handleNotFound(w, r)
+		return
+	}
+	col, err := strconv.Atoi(r.PathValue("col"))
+	if err != nil {
+		a.handleNotFound(w, r)
+		return
+	}
+
+	yamlText := r.FormValue("yaml")
+
+	rerenderError := func(msg string) {
+		a.renderWidgetEditor(w, r, editorRenderInput{
+			pageTitle:    page.Title,
+			pageSlug:     page.Slug,
+			isNew:        true,
+			col:          col,
+			widgetType:   widgetTypeFromYAML(yamlText),
+			yamlText:     yamlText,
+			errorMessage: msg,
+		})
+	}
+
+	newNode, err := parseWidgetYAML(yamlText)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+
+	editor, err := loadConfigEditor(a.ConfigPath)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	pageNode, err := editor.pageNodeAt(pageIdx)
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	columns, err := columnsOf(pageNode)
+	if err != nil {
+		rerenderError("page has no columns; add a column first")
+		return
+	}
+	if col < 0 || col >= len(columns.Content) {
+		rerenderError("column index out of range")
+		return
+	}
+	widgets, err := widgetsOf(columns.Content[col])
+	if err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	widgets.Content = append(widgets.Content, newNode)
+
+	if err := editor.save(); err != nil {
+		rerenderError(err.Error())
+		return
+	}
+	http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
+}