Repository navigation
feat: add the web interface for works, libraries, and copies - #5
Merged
Merged
Conversation
Add server-rendered pages for Phase 3, starting with sign-in and a searchable, paged works list, built as a thin layer over the existing service functions so it can't do anything the API can't. - Add cookie-based web sessions, stored by hash, with a 14-day lifetime and a synchronizer CSRF token per session. - Use a double-submit cookie for the sign-in form itself, since it runs before a session exists. - Split accounts.login into sign_in and issue_login_token so the UI can authenticate without issuing a bearer token. - Add Jinja2 templates, static assets, and security headers (CSP, no-sniff, no-store) for all non-API routes. - Add a @ui_route decorator and parity tests that confirm each page declares and calls the same service function as its matching API operation. Assisted-by: Claude Code Signed-off-by: Natalie Boedecker <git@boedecker.dev>
Move the works list route into a new works module and add detail, create, edit, and delete pages, reusing the existing catalog service functions so the UI still can't do anything the API can't. - Show editing links to non-guests and the delete form only to admins, while leaving the actual authorization to the policy layer. - Add form helpers that trim text to None for blank optional fields and turn validation errors into field-level messages without echoing submitted values back verbatim. - Require a ticked confirmation checkbox before deleting a work. Assisted-by: Claude Code Signed-off-by: Natalie Boedecker <git@boedecker.dev>
Let people manage libraries and their copies from the browser, as thin layers over the existing service functions, so a page offers only what the policy layer allows and the server still checks every request. - Add pages to list, view, create, edit, and delete a library. - Add pages to view, add, edit, and delete a copy, and to add an edition to a work, because a copy is added from an edition. - Show each library's members by name, and add display_name to the members response in the API. - Add a service function that returns the user's role in each library. - Add shared test helpers for signed-in users and a sample library. Assisted-by: Claude Code Signed-off-by: Natalie Boedecker <git@boedecker.dev>
nkboedecker
changed the title
nkboedecker
marked this pull request as ready for review
November 2, 2026 13:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add server-rendered pages for Phase 3, as thin layers over the existing service functions, so a page can't do anything the API can't. Each page offers only what the policy layer allows, and the service layer checks again on every request.
display_namefield in the API's members response.Phase 3 is not finished. Tags, shelves, reading status, ratings, reviews, notes, loa still to come.
Checklist
CHANGELOG.mdhas a line underUnreleased.Signed-off-byline.Breaking changes
None. The added
display_namefield in the members response is additive.Security-sensitive areas
AI assistance
Claude Code wrote the code. The maintainer reviewed and made the commits.