diff --git a/CHANGELOG.MD b/CHANGELOG.MD index ded7067..69bae3d 100644 --- a/CHANGELOG.MD +++ b/CHANGELOG.MD @@ -1,5 +1,12 @@ # Changelog +## Version v0.1.2 +### Features + * Users can edit or delete labels created by themselves on the labels page + * Administrators can edit labels from the admin interface + * Filter label visibility so logged-in users only see default/admin-created labels and their own + * Grandfather tags with unknown ownership as default/admin interface labels + ## Version v0.1.1 ### Features * Ability to add new logs through the web interface diff --git a/VIBE/CHAT_LOG.md b/VIBE/CHAT_LOG.md index 474ca88..b5fdc45 100644 --- a/VIBE/CHAT_LOG.md +++ b/VIBE/CHAT_LOG.md @@ -1274,3 +1274,27 @@ Update the VIBE directory with what you have done. ### Assistant outcome Appended the release workflow changes and this VIBE update request to `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md` in the existing append-only format. + +### User +I want that the users is able to edit or delete labels(tags) that were created by the user itself. Also validate that any logged in user will only see the labels created by default, in the admin panel, and those by themselves, not by any other user. If this leads to an update in the database then if ownership of labels is unknown they may be grandfathered as-if created in the admin interface + +### Assistant outcome +Implemented creator edit/delete rights for user labels on `/labels` and `/api/user/labels/{label_id}`, isolated label visibility so logged-in users only see default/admin labels and their own created labels, dynamically set `created_by` when new tags are saved from links, grandfathered existing tags with `NULL` ownership as default/admin labels, added `frontend/static/labels.js`, and expanded unit test coverage. + +### User +Make sure that in the admin interface the labels can be edited + +### Assistant outcome +Added `PUT /api/admin/labels/{label_id}` for administrator label renaming, updated `update_label` service function to accept `is_admin=True`, added inline edit controls to `frontend/static/admin.js` for administrator label management, and added regression test coverage. + +### User +Make sure that the logs in VIBE are updated + +### Assistant outcome +Updated `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md` with the recent user prompts and assistant outcomes. + +### User +Update Changelog too + +### Assistant outcome +Updated `CHANGELOG.MD` with the recent feature additions (user label CRUD, label visibility isolation, grandfathering unknown label ownership, and administrator label editing), and updated `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md`. diff --git a/VIBE/PROMPTS.md b/VIBE/PROMPTS.md index 0da1588..9158c77 100644 --- a/VIBE/PROMPTS.md +++ b/VIBE/PROMPTS.md @@ -224,6 +224,10 @@ 211. Don't put new entry in the hamburger menu but present it as a seperate button next to the style selector 212. Put the new entry button left of the hamburger menu 213. The style selection should move into the hamburger menu - but in such a way that it becomes a submenu so that it doesn't clutter the menu structure +214. I want that the users is able to edit or delete labels(tags) that were created by the user itself. Also validate that any logged in user will only see the labels created by default, in the admin panel, and those by themselves, not by any other user. If this leads to an update in the database then if ownership of labels is unknown they may be grandfathered as-if created in the admin interface +215. Make sure that in the admin interface the labels can be edited +216. Make sure that the logs in VIBE are updated +217. Update Changelog too ## Future entries diff --git a/backend/app/api/admin.py b/backend/app/api/admin.py index a859f85..a1e412e 100644 --- a/backend/app/api/admin.py +++ b/backend/app/api/admin.py @@ -10,7 +10,7 @@ from pydantic import BaseModel from backend.app.api.dependencies import require_admin from backend.app.database import get_connection, hash_password -from backend.app.services.link_service import delete_label +from backend.app.services.link_service import delete_label, update_label from backend.app.services.email_service import ( get_smtp_settings, save_smtp_settings, @@ -35,6 +35,10 @@ class AdminPluginUpdate(BaseModel): config: dict | None = None +class AdminLabelUpdate(BaseModel): + name: str + + class AdminUserCreate(BaseModel): username: str email: str @@ -304,6 +308,18 @@ def admin_delete_label(label_id: str, current_user: dict = Depends(require_admin return {'status': 'deleted', 'id': label_id} +@router.put('/labels/{label_id}') +def admin_edit_label(label_id: str, payload: AdminLabelUpdate, current_user: dict = Depends(require_admin)): + try: + result = update_label(label_id, user_id=current_user['id'], name=payload.name, is_admin=True) + except ValueError as error: + raise HTTPException(status_code=409, detail=str(error)) from error + if result is None: + raise HTTPException(status_code=404, detail='Label not found') + record_audit_event(current_user['id'], 'label_updated', 'label', label_id) + return result + + @router.get('/labels') def admin_list_labels(_: dict = Depends(require_admin)): with get_connection() as conn: diff --git a/backend/app/api/dependencies.py b/backend/app/api/dependencies.py index 3edc030..1e861f4 100644 --- a/backend/app/api/dependencies.py +++ b/backend/app/api/dependencies.py @@ -38,6 +38,22 @@ def get_current_user( return dict(user) +def get_optional_current_user( + credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme), +) -> dict | None: + if credentials is None or credentials.scheme.lower() != 'bearer': + return None + token_data = validate_token(credentials.credentials) + if token_data is None: + return None + with get_connection() as conn: + user = conn.execute( + 'SELECT * FROM users WHERE id = ?', + (token_data['user_id'],), + ).fetchone() + return dict(user) if user else None + + def require_admin(user: dict = Depends(get_current_user)): if not user['is_admin']: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail='Administrator access required') diff --git a/backend/app/api/links.py b/backend/app/api/links.py index e416af1..49cf0fc 100644 --- a/backend/app/api/links.py +++ b/backend/app/api/links.py @@ -2,10 +2,11 @@ ## SPDX-License-Identifier: GPL-3.0-or-later import json -from fastapi import APIRouter, Header, HTTPException, Response, status +from fastapi import APIRouter, Depends, Header, HTTPException, Response, status import logging from pydantic import BaseModel +from backend.app.api.dependencies import get_optional_current_user from backend.app.services.link_service import create_link, delete_link, find_owned_link_by_title_url, get_link_tags, get_owned_link, list_public_links, list_tags, mark_mastodon_posted, update_link from backend.app.database import get_connection from backend.app.services.plugin_manager import plugin_manager @@ -33,8 +34,9 @@ class LinkUpdate(BaseModel): @router.get('/tags') -def available_tags(): - return list_tags() +def available_tags(user: dict | None = Depends(get_optional_current_user)): + user_id = user['id'] if user else None + return list_tags(user_id=user_id) @router.get('/scrape') diff --git a/backend/app/services/link_service.py b/backend/app/services/link_service.py index 79584a0..a566638 100644 --- a/backend/app/services/link_service.py +++ b/backend/app/services/link_service.py @@ -27,7 +27,7 @@ def normalize_tags(tags: list[str] | None) -> list[str]: return normalized -def save_link_tags(conn, link_id: str, tags: list[str]) -> None: +def save_link_tags(conn, link_id: str, tags: list[str], user_id: str | None = None) -> list[str]: canonical_tags = [] for tag in tags: tag_row = conn.execute( @@ -36,8 +36,8 @@ def save_link_tags(conn, link_id: str, tags: list[str]) -> None: ).fetchone() if tag_row is None: conn.execute( - 'INSERT INTO tags (id, name) VALUES (?, ?)', - (str(uuid4()), tag), + 'INSERT INTO tags (id, name, created_by) VALUES (?, ?, ?)', + (str(uuid4()), tag, user_id), ) tag_row = conn.execute('SELECT id FROM tags WHERE name = ?', (tag,)).fetchone() conn.execute( @@ -103,7 +103,7 @@ def create_link( record['is_public'], ), ) - stored_tags = save_link_tags(conn, record['id'], normalized_tags) + stored_tags = save_link_tags(conn, record['id'], normalized_tags, user_id=user_id) conn.commit() record['tags'] = stored_tags return record @@ -173,7 +173,7 @@ def update_link( if cursor.rowcount == 0: return None conn.execute('DELETE FROM link_tags WHERE link_id = ?', (link_id,)) - stored_tags = save_link_tags(conn, link_id, normalized_tags) + stored_tags = save_link_tags(conn, link_id, normalized_tags, user_id=user_id) conn.commit() row = conn.execute('SELECT * FROM links WHERE id = ?', (link_id,)).fetchone() record = dict(row) @@ -227,9 +227,32 @@ def list_public_users(): return [row['username'] for row in rows] -def list_tags(): +def list_tags(user_id: str | None = None): with get_connection() as conn: - rows = conn.execute('SELECT name FROM tags ORDER BY name').fetchall() + if user_id: + rows = conn.execute( + ''' + SELECT tags.name + FROM tags + LEFT JOIN users ON users.id = tags.created_by + WHERE tags.created_by IS NULL + OR tags.created_by = ? + OR users.is_admin = 1 + ORDER BY tags.name + ''', + (user_id,), + ).fetchall() + else: + rows = conn.execute( + ''' + SELECT tags.name + FROM tags + LEFT JOIN users ON users.id = tags.created_by + WHERE tags.created_by IS NULL + OR users.is_admin = 1 + ORDER BY tags.name + ''', + ).fetchall() tags = [] seen = set() for row in rows: @@ -242,7 +265,15 @@ def list_tags(): def list_user_labels(user_id: str): with get_connection() as conn: rows = conn.execute( - 'SELECT id, name, created_by FROM tags WHERE created_by = ? ORDER BY name', + ''' + SELECT tags.id, tags.name, tags.created_by, users.username AS creator + FROM tags + LEFT JOIN users ON users.id = tags.created_by + WHERE tags.created_by IS NULL + OR tags.created_by = ? + OR users.is_admin = 1 + ORDER BY tags.name + ''', (user_id,), ).fetchall() return [dict(row) for row in rows] @@ -268,7 +299,7 @@ def create_label(user_id: str, name: str): return {'id': label_id, 'name': label, 'created_by': user_id} -def update_label(label_id: str, user_id: str, name: str): +def update_label(label_id: str, user_id: str | None = None, name: str = '', is_admin: bool = False): normalized = normalize_tags([name]) if not normalized: raise ValueError('Label cannot be empty') @@ -276,7 +307,7 @@ def update_label(label_id: str, user_id: str, name: str): current = conn.execute( 'SELECT id, name, created_by FROM tags WHERE id = ?', (label_id,) ).fetchone() - if current is None or current['created_by'] != user_id: + if current is None or (not is_admin and current['created_by'] != user_id): return None duplicate = conn.execute( 'SELECT id FROM tags WHERE lower(name) = lower(?) AND id != ?', @@ -286,7 +317,7 @@ def update_label(label_id: str, user_id: str, name: str): raise ValueError('Label already exists') conn.execute('UPDATE tags SET name = ? WHERE id = ?', (normalized[0], label_id)) conn.commit() - return {'id': label_id, 'name': normalized[0], 'created_by': user_id} + return {'id': label_id, 'name': normalized[0], 'created_by': current['created_by']} def delete_label(label_id: str, user_id: str | None = None, is_admin: bool = False): diff --git a/backend/tests/test_api.py b/backend/tests/test_api.py index 2db4f38..3c5b5be 100644 --- a/backend/tests/test_api.py +++ b/backend/tests/test_api.py @@ -11,7 +11,7 @@ from unittest.mock import MagicMock, patch from fastapi.testclient import TestClient from backend.app.main import app -from backend.app.database import get_connection +from backend.app.database import get_connection, hash_password from backend.app.services.email_service import get_smtp_settings from backend.app.services.login_throttle import clear_login_failures from backend.app.services.otp_service import current_code @@ -490,25 +490,102 @@ def test_admin_can_toggle_privileges_without_removing_last_admin(): assert last_admin.status_code == 400 -def test_users_manage_owned_labels_and_admin_can_delete_any_label(): - alice_headers = login_headers('alice') - created = client.post('/api/user/labels', headers=alice_headers, json={'name': 'My Label'}) +def test_users_manage_owned_labels_and_admin_can_edit_and_delete_any_label(): + alice_headers = login_headers('alice') # admin + bob_headers = login_headers('bob') # non-admin + + created = client.post('/api/user/labels', headers=bob_headers, json={'name': 'Bob Label'}) assert created.status_code == 201 label = created.json() - assert label['name'] == '#My Label' + assert label['name'] == '#Bob Label' - edited = client.put(f"/api/user/labels/{label['id']}", headers=alice_headers, json={'name': '#Renamed'}) + # Bob renames own label + edited = client.put(f"/api/user/labels/{label['id']}", headers=bob_headers, json={'name': '#RenamedByBob'}) assert edited.status_code == 200 - assert edited.json()['name'] == '#Renamed' + assert edited.json()['name'] == '#RenamedByBob' - denied = client.put(f"/api/user/labels/{label['id']}", headers=login_headers('bob'), json={'name': '#Nope'}) - assert denied.status_code == 404 - assert client.delete(f"/api/user/labels/{label['id']}", headers=login_headers('bob')).status_code == 404 + # Non-owner Alice can edit it via admin endpoint, but NOT user endpoint + user_denied = client.put(f"/api/user/labels/{label['id']}", headers=alice_headers, json={'name': '#NopeUser'}) + assert user_denied.status_code == 404 + admin_edited = client.put(f"/api/admin/labels/{label['id']}", headers=alice_headers, json={'name': '#AdminRenamed'}) + assert admin_edited.status_code == 200 + assert admin_edited.json()['name'] == '#AdminRenamed' + + # Non-admin Bob cannot access admin edit endpoint + bob_admin_denied = client.put(f"/api/admin/labels/{label['id']}", headers=bob_headers, json={'name': '#NopeAdmin'}) + assert bob_admin_denied.status_code == 403 + + # Admin delete admin_delete = client.delete(f"/api/admin/labels/{label['id']}", headers=alice_headers) assert admin_delete.status_code == 200 +def test_label_visibility_isolation_and_grandfathering(): + alice_headers = login_headers('alice') + bob_headers = login_headers('bob') + + # Create non-admin user charlie + with get_connection() as conn: + conn.execute( + '''INSERT OR IGNORE INTO users (id, username, email, password_hash, is_admin, email_verified) + VALUES (?, ?, ?, ?, 0, 1)''', + ('user-3', 'charlie', 'charlie@example.com', hash_password('secret123')), + ) + conn.commit() + + charlie_headers = login_headers('charlie') + + # Create Bob label (non-admin) + created_bob = client.post('/api/user/labels', headers=bob_headers, json={'name': 'BobOnlyLabel'}).json() + # Create Charlie label (non-admin) + created_charlie = client.post('/api/user/labels', headers=charlie_headers, json={'name': 'CharlieOnlyLabel'}).json() + + # Grandfathered label in DB with NULL created_by + from uuid import uuid4 + grandfathered_id = str(uuid4()) + with get_connection() as conn: + conn.execute('INSERT INTO tags (id, name, created_by) VALUES (?, ?, NULL)', (grandfathered_id, '#GrandfatheredLabel')) + conn.commit() + + # Bob views /api/user/labels: sees default tags, grandfathered tag, and Bob tag, NOT Charlie tag + bob_labels = client.get('/api/user/labels', headers=bob_headers).json() + bob_label_names = [l['name'] for l in bob_labels] + assert '#BobOnlyLabel' in bob_label_names + assert '#GrandfatheredLabel' in bob_label_names + assert '#Cybersecurity' in bob_label_names + assert '#CharlieOnlyLabel' not in bob_label_names + + # Charlie views /api/user/labels: sees default tags, grandfathered tag, and Charlie tag, NOT Bob tag + charlie_labels = client.get('/api/user/labels', headers=charlie_headers).json() + charlie_label_names = [l['name'] for l in charlie_labels] + assert '#CharlieOnlyLabel' in charlie_label_names + assert '#GrandfatheredLabel' in charlie_label_names + assert '#Cybersecurity' in charlie_label_names + assert '#BobOnlyLabel' not in charlie_label_names + + # Bob views /api/tags (authenticated): sees Bob tag & default/grandfathered, NOT Charlie tag + bob_tags = client.get('/api/tags', headers=bob_headers).json() + assert '#BobOnlyLabel' in bob_tags + assert '#GrandfatheredLabel' in bob_tags + assert '#CharlieOnlyLabel' not in bob_tags + + # Anonymous views /api/tags: sees default/grandfathered, NOT Bob or Charlie tag + anon_tags = client.get('/api/tags').json() + assert '#GrandfatheredLabel' in anon_tags + assert '#BobOnlyLabel' not in anon_tags + assert '#CharlieOnlyLabel' not in anon_tags + + # Bob cannot edit or delete grandfathered label + assert client.put(f"/api/user/labels/{grandfathered_id}", headers=bob_headers, json={'name': '#RenamedGrandfathered'}).status_code == 404 + assert client.delete(f"/api/user/labels/{grandfathered_id}", headers=bob_headers).status_code == 404 + + # Clean up created labels + client.delete(f"/api/user/labels/{created_bob['id']}", headers=bob_headers) + client.delete(f"/api/user/labels/{created_charlie['id']}", headers=charlie_headers) + client.delete(f"/api/admin/labels/{grandfathered_id}", headers=alice_headers) + + def test_labels_page_renders_authenticated_management_shell(): page = client.get('/labels') assert page.status_code == 200 diff --git a/frontend/static/admin.js b/frontend/static/admin.js index a23d6c5..e0dc6bc 100644 --- a/frontend/static/admin.js +++ b/frontend/static/admin.js @@ -57,21 +57,85 @@ function renderLabels(labels) { adminLabelList.replaceChildren(...labels.map((label) => { const row = document.createElement('div'); row.className = 'plugin-row'; + const text = document.createElement('span'); text.textContent = `${label.name}${label.creator ? ` (${label.creator})` : ' (default)'}`; - const button = document.createElement('button'); - button.type = 'button'; - button.className = 'danger-button'; - button.textContent = 'Delete'; - button.addEventListener('click', async () => { + + const actions = document.createElement('div'); + actions.style.display = 'flex'; + actions.style.gap = '8px'; + + const editButton = document.createElement('button'); + editButton.type = 'button'; + editButton.textContent = 'Edit'; + editButton.addEventListener('click', () => { + showAdminInlineLabelEdit(row, label); + }); + + const deleteButton = document.createElement('button'); + deleteButton.type = 'button'; + deleteButton.className = 'danger-button'; + deleteButton.textContent = 'Delete'; + deleteButton.addEventListener('click', async () => { + if (!confirm(`Are you sure you want to delete "${label.name}"?`)) return; const response = await fetch(`/api/admin/labels/${label.id}`, {method: 'DELETE', headers: authHeaders()}); if (response.ok) loadLabels(); }); - row.append(text, button); + + actions.append(editButton, deleteButton); + row.append(text, actions); return row; })); } +function showAdminInlineLabelEdit(rowContainer, label) { + rowContainer.replaceChildren(); + + const editForm = document.createElement('form'); + editForm.style.display = 'flex'; + editForm.style.gap = '8px'; + editForm.style.width = '100%'; + editForm.style.alignItems = 'center'; + + const input = document.createElement('input'); + input.type = 'text'; + input.value = label.name; + input.required = true; + input.style.flex = '1'; + + const saveButton = document.createElement('button'); + saveButton.type = 'submit'; + saveButton.textContent = 'Save'; + + const cancelButton = document.createElement('button'); + cancelButton.type = 'button'; + cancelButton.textContent = 'Cancel'; + cancelButton.addEventListener('click', () => { + loadLabels(); + }); + + editForm.append(input, saveButton, cancelButton); + + editForm.addEventListener('submit', async (e) => { + e.preventDefault(); + const newName = input.value.trim(); + if (!newName) return; + const response = await fetch(`/api/admin/labels/${label.id}`, { + method: 'PUT', + headers: authHeaders(true), + body: JSON.stringify({ name: newName }), + }); + if (response.ok) { + loadLabels(); + } else { + alert(await responseError(response, 'Could not update label')); + } + }); + + rowContainer.appendChild(editForm); + input.focus(); +} + async function loadLabels() { const response = await fetch('/api/admin/labels', {headers: authHeaders()}); if (!response.ok) throw new Error('Could not load labels'); diff --git a/frontend/static/labels.js b/frontend/static/labels.js new file mode 100644 index 0000000..af20ff2 --- /dev/null +++ b/frontend/static/labels.js @@ -0,0 +1,209 @@ +// Copyright © 2026 Olaf Kolkman +// SPDX-License-Identifier: GPL-3.0-or-later + +(() => { +const labelAuthNotice = document.querySelector('#label-auth-notice'); +const labelControls = document.querySelector('#label-controls'); +const labelForm = document.querySelector('#label-form'); +const labelNameInput = document.querySelector('#label-name'); +const labelStatus = document.querySelector('#label-status'); +const labelList = document.querySelector('#label-list'); +const accessToken = localStorage.getItem('linklogAccessToken'); +let currentUserId = null; + +function authHeaders(includeJson = false) { + return { + ...(includeJson ? {'Content-Type': 'application/json'} : {}), + ...(accessToken ? {Authorization: `Bearer ${accessToken}`} : {}), + }; +} + +function setStatus(message, isError = false) { + if (!labelStatus) return; + labelStatus.textContent = message; + labelStatus.style.color = isError ? '#b91c1c' : '#166534'; +} + +async function responseError(response, fallback) { + try { + const result = await response.json(); + return result.detail || result.message || fallback; + } catch { + return fallback; + } +} + +function renderLabels(labels) { + if (!labelList) return; + if (!labels || labels.length === 0) { + labelList.innerHTML = '

No labels found.

'; + return; + } + + labelList.replaceChildren(...labels.map((label) => { + const row = document.createElement('div'); + row.className = 'plugin-row'; + + const isOwned = label.created_by === currentUserId; + + const contentContainer = document.createElement('div'); + contentContainer.style.display = 'flex'; + contentContainer.style.alignItems = 'center'; + contentContainer.style.justifySpaceBetween = 'space-between'; + contentContainer.style.width = '100%'; + + const text = document.createElement('span'); + text.textContent = `${label.name}${isOwned ? '' : (label.creator ? ` (${label.creator})` : ' (default)')}`; + + contentContainer.appendChild(text); + + if (isOwned) { + const actions = document.createElement('div'); + actions.style.display = 'flex'; + actions.style.gap = '8px'; + + const editButton = document.createElement('button'); + editButton.type = 'button'; + editButton.textContent = 'Edit'; + editButton.addEventListener('click', () => { + showInlineEdit(row, label); + }); + + const deleteButton = document.createElement('button'); + deleteButton.type = 'button'; + deleteButton.className = 'danger-button'; + deleteButton.textContent = 'Delete'; + deleteButton.addEventListener('click', async () => { + if (!confirm(`Are you sure you want to delete "${label.name}"?`)) return; + setStatus(''); + const response = await fetch(`/api/user/labels/${label.id}`, { + method: 'DELETE', + headers: authHeaders(), + }); + if (response.ok) { + setStatus(`Deleted label ${label.name}`); + loadLabels(); + } else { + setStatus(await responseError(response, 'Could not delete label'), true); + } + }); + + actions.append(editButton, deleteButton); + contentContainer.appendChild(actions); + } + + row.appendChild(contentContainer); + return row; + })); +} + +function showInlineEdit(rowContainer, label) { + rowContainer.replaceChildren(); + + const editForm = document.createElement('form'); + editForm.style.display = 'flex'; + editForm.style.gap = '8px'; + editForm.style.width = '100%'; + editForm.style.alignItems = 'center'; + + const input = document.createElement('input'); + input.type = 'text'; + input.value = label.name; + input.required = true; + input.style.flex = '1'; + + const saveButton = document.createElement('button'); + saveButton.type = 'submit'; + saveButton.textContent = 'Save'; + + const cancelButton = document.createElement('button'); + cancelButton.type = 'button'; + cancelButton.textContent = 'Cancel'; + cancelButton.addEventListener('click', () => { + loadLabels(); + }); + + editForm.append(input, saveButton, cancelButton); + + editForm.addEventListener('submit', async (e) => { + e.preventDefault(); + const newName = input.value.trim(); + if (!newName) return; + setStatus(''); + const response = await fetch(`/api/user/labels/${label.id}`, { + method: 'PUT', + headers: authHeaders(true), + body: JSON.stringify({ name: newName }), + }); + if (response.ok) { + setStatus(`Updated label to ${newName}`); + loadLabels(); + } else { + setStatus(await responseError(response, 'Could not update label'), true); + } + }); + + rowContainer.appendChild(editForm); + input.focus(); +} + +async function loadLabels() { + try { + const response = await fetch('/api/user/labels', { headers: authHeaders() }); + if (!response.ok) throw new Error('Could not load labels'); + const labels = await response.json(); + renderLabels(labels); + } catch (error) { + setStatus('Error loading labels', true); + } +} + +async function init() { + if (!accessToken) { + if (labelAuthNotice) labelAuthNotice.classList.remove('hidden'); + if (labelControls) labelControls.classList.add('hidden'); + return; + } + + if (labelAuthNotice) labelAuthNotice.classList.add('hidden'); + if (labelControls) labelControls.classList.remove('hidden'); + + try { + const meResponse = await fetch('/api/auth/me', { headers: authHeaders() }); + if (meResponse.ok) { + const me = await meResponse.json(); + currentUserId = me.id; + } + } catch { + // Proceed if me fails + } + + await loadLabels(); + + if (labelForm) { + labelForm.addEventListener('submit', async (e) => { + e.preventDefault(); + const name = labelNameInput.value.trim(); + if (!name) return; + setStatus(''); + const response = await fetch('/api/user/labels', { + method: 'POST', + headers: authHeaders(true), + body: JSON.stringify({ name }), + }); + if (response.ok) { + labelNameInput.value = ''; + setStatus(`Added label ${name}`); + loadLabels(); + } else { + setStatus(await responseError(response, 'Could not add label'), true); + } + }); + } +} + +document.addEventListener('DOMContentLoaded', init); +if (document.readyState !== 'loading') { + init(); +} +})();