make private assets private

Installer.mk

@@ -4,7 +4,7 @@ SHELL := /bin/bash
 install:
 	test -d www/themes || mkdir -p www/themes
 	test -d data/files || mkdir -p data/files
-	test -d www/assets || mkdir -p www/assets
+	test -d www/assets/private || mkdir -p www/assets/private
 	test -d www/statics || mkdir -p www/statics
 	test -d totp/ || mkdir -p totp
 	test -d ~/.tcms || mkdir ~/.tcms

Readme.md

@@ -4,53 +4,43 @@ tCMS
 A flexible perl CMS which supports multiple data models and content types.
 Should be readily portable/hostable between any other system that runs tCMS due to being largely self-contained.
 
-tCMS is built fully around ubuntu hosts at the moment.
+tCMS is built to be run by tPSGI.
 
-Deployment is currently:
+Simple deployment is currently:
 * make -f Installer.mk depend
 * make -f Installer.mk install
+* Setup tPSGI (supposing this clone is in a subdir tCMS of the tPSGI clone):
+
+.tpsgi.conf :
+```
+http_user=www-data
+user=INSERT_MY_USERNAME_HERE
+domain=INSERT_MY_DOMAIN_NAME_HERE
+routers=tCMS/lib/TCMS.pm
+indices=
+custom_log="/var/log/www/tpsgi.log"
+basedir="tCMS"
+```
 
 Then:
 * open tmux or screen
-* `sudo ./tcms`
-OR (if you want tCMS as a systemd service for production/preproduction contexts):
-* `make -f Installer.mk all`
-
-This sets up nginx, reverse proxy and SSL certs for you.
-It also sets up the mailserver and DNS for you via pdns.
-
-It is strongly suggested that you chmod everything but the run/ directory to be 0700, particularly in a shared environment.
-
-## Administration/Development
+* `HOME=. bin/tpsgi -p 5001`
 
-Administrating the server should in general be done via the system user we setup which will be the domain setup with `tcms-hostname` with dots replaced with dashes.
-Slap in the authorized public key to .ssh/authorized\_keys, as this is the system user's homedir.
-From there you'll need to `sudo chsh -s /bin/bash $system_user_name` to allow logging in remotely.
-In production you should probably leave things nologin, and instead sudo into the user for shells from an administrator account.
+You won't want to run like this in production, but this is probably how you want to develop your themes
+or hack on tCMS itself.
 
-The user guide is self-hosted; After you first login, hit the 'Manual' section in the backend.
-
-Rate-Limiting is expected to be handled at the level of the webserver proxying requests to this application.
-See ufw/setup-rules as an example of the easy way to setup rules/limiting for all the services you need to run tCMS.
-
-Containerization
+Production Deployment
 ====================
 
-A Dockerfile and deployment scripts are provided for your convenience in building/running containers based on this:
-```
-# Build and run the server
-./fulldeploy.sh
-# Just run the server with latest changes
-./dockerdeploy.sh
-# Extract configuration & local data, then spin down the server
-./docker-exfil.sh
-```
-There is also podman container code; see images/README.md
+See trog-provisioner & related provisioners repository.
+
+In the latter you will be interested particularly in:
 
-Migration of tCMS1 sites
-=========================
+- Provisioner::Recipe::tcms
+- Provisioner::Recipe::tpsgi
+- Provisioner::Recipe::nginxproxy
 
-See migrate.pl, and modify the $docroot variable appropriately
+Many of the advanced features of tCMS won't work quite right without the configurations encoded therein.
 
 Content Types
 =============

lib/Trog/DataModule.pm

@@ -402,10 +402,13 @@ sub add ( $self, @posts ) {
 # Not actually a subprocess, kek
 sub _process ($post) {
 
-    $post->{href}      = _handle_upload( $post->{file},           $post->{id} ) if $post->{file};
-    $post->{preview}   = _handle_upload( $post->{preview_file},   $post->{id} ) if $post->{preview_file};
-    $post->{wallpaper} = _handle_upload( $post->{wallpaper_file}, $post->{id} ) if $post->{wallpaper_file};
-    @{ $post->{attachments} } = map { _handle_upload( $_, $post->{id} ) } @{ $post->{attachments} } if $post->{attachments};
+    # If the post is private, make sure it's associated assets are too.
+    my $is_private_post = $post->{visibility} eq 'private';
+
+    $post->{href}      = _handle_upload( $post->{file},           $post->{id}, $is_private_post ) if $post->{file};
+    $post->{preview}   = _handle_upload( $post->{preview_file},   $post->{id}, $is_private_post ) if $post->{preview_file};
+    $post->{wallpaper} = _handle_upload( $post->{wallpaper_file}, $post->{id}, $is_private_post ) if $post->{wallpaper_file};
+    @{ $post->{attachments} } = map { _handle_upload( $_, $post->{id}, $is_private_post ) } @{ $post->{attachments} } if $post->{attachments};
     $post->{preview} = $post->{href} if $post->{app} && $post->{app} eq 'image';
     delete $post->{app};
     delete $post->{file};
@@ -423,7 +426,7 @@ sub _process ($post) {
         my $subj = $_;
         !grep { $_ eq $subj } qw{public private unlisted}
     } @{ $post->{tags} };
-    push( @{ $post->{tags} }, @{ $post->{acls} } ) if $post->{visibility} eq 'private';
+    push( @{ $post->{tags} }, @{ $post->{acls} } ) if $is_private_post;
     delete $post->{acls};
     push( @{ $post->{tags} }, $post->{visibility} );
 
@@ -454,7 +457,7 @@ sub _process ($post) {
 # Browsers try and save time in the event that the same file is sent twice, so handle that.
 my %seen_files;
 
-sub _handle_upload ( $file, $uuid ) {
+sub _handle_upload ( $file, $uuid, $private=0 ) {
     my $fname;
     if ( ref $file ne 'HASH' ) {
         use Data::Dumper;
@@ -466,6 +469,7 @@ sub _handle_upload ( $file, $uuid ) {
     my $f = $file->{tempname};
     $fname = basename( $file->{filename} );
     my $newname = "$uuid.$file->{filename}";
+    $newname = "private/$newname" if $private;
     File::Copy::move( $f, "www/assets/$newname" );
     $seen_files{$fname} = "/assets/$newname";
     return $seen_files{$fname};