Add a /manage page to edit, delete and restore posts

A new auth-gated web UI at /manage lists every post for inline editing of
caption, date and tags, with per-row and bulk delete and bulk tag add/remove.
It is backed by a small JSON API (all behind the same htpasswd Basic auth as
/upload, and unlinked from the public site):

  GET  /api/photos        list posts (newest first)
  POST /api/edit          rewrite one sidecar (caption, date, tags)
  POST /api/tags          bulk add/remove tags across posts
  POST /api/delete        move posts to content/.trash/ (reversible)
  GET  /api/trash         list trashed items
  POST /api/restore       move a trashed item back (409 on live-slug clash)
  POST /api/trash/empty   hard delete trashed items (id… or all=1)

Design notes:
- Editing only rewrites the .toml; the slug (and URL) never changes.
- Delete is reversible: image + sidecar move to content/.trash/ with a
  timestamp suffix, excluded from the site (loadPhotos skips dirs). The only
  hard delete is emptying the trash.
- Build now prunes: it drops the derived HTML trees (photo/ day/ album/ page/
  grid/page/) and regenerates them, and pruneRenditions removes orphaned
  images/thumbs/medium/og. Without this a deleted post would linger at its old
  URL and on stale day/album pages; this also cleans up after a hand-removed
  sidecar.
- Sidecars are written atomically (temp + rename) so a concurrent build never
  observes a half-written file.
- Slugs and trash ids are validated as bare filenames, closing path traversal
  and dotfile access.
- Every state-changing POST passes a sameOrigin (CSRF) check, since Basic-auth
  credentials are replayed by the browser on every request to the host. It
  honours Sec-Fetch-Site, falls back to Origin vs base-url/Host, and allows
  header-less non-browser clients. Ported from the independent /manage on
  plex/trunk-ng.

module.nix proxies /manage and /api/ to the app (nginx otherwise serves them
as missing static files). The apps are unchanged; the API is there for them to
adopt edit/delete later.

manage.go

@@ -0,0 +1,318 @@
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/BurntSushi/toml"
+)
+
+// contentExts are the image extensions a post may use; the sidecar is always
+// <slug>.toml alongside.
+var contentExts = []string{".jpg", ".jpeg", ".png"}
+
+// photoJSON is one row of GET /api/photos, consumed by the manage page.
+type photoJSON struct {
+	Slug    string   `json:"slug"`
+	Caption string   `json:"caption"`
+	Date    string   `json:"date"` // YYYY-MM-DD
+	Tags    []string `json:"tags"`
+	Thumb   string   `json:"thumb"`
+	URL     string   `json:"url"`
+}
+
+// handleManagePage serves the (auth-gated) edit/delete UI.
+func (s *Server) handleManagePage(w http.ResponseWriter, r *http.Request) {
+	data, err := assets.ReadFile("templates/manage.html")
+	if err != nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Write(data)
+}
+
+// handleListPhotos returns every post as JSON, newest first, for the manage UI.
+func (s *Server) handleListPhotos(w http.ResponseWriter, r *http.Request) {
+	photos, err := s.generator.loadPhotos()
+	if err != nil {
+		http.Error(w, "could not list photos", http.StatusInternalServerError)
+		return
+	}
+	out := make([]photoJSON, 0, len(photos))
+	for _, p := range photos {
+		tags := make([]string, 0, len(p.Tags))
+		for _, t := range p.Tags {
+			tags = append(tags, t.Name)
+		}
+		out = append(out, photoJSON{
+			Slug:    p.Slug,
+			Caption: p.Caption,
+			Date:    p.Date.Format("2006-01-02"),
+			Tags:    tags,
+			Thumb:   "/" + p.Thumb,
+			URL:     "/photo/" + p.Slug + "/",
+		})
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(out)
+}
+
+// handleEdit rewrites one post's sidecar (caption, date, tags). The slug — and
+// therefore the URL — never changes.
+func (s *Server) handleEdit(w http.ResponseWriter, r *http.Request) {
+	if s.rejectCrossSite(w, r) {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	slug := r.FormValue("slug")
+	if _, ok := s.resolveSlug(slug); !ok {
+		http.Error(w, "unknown post", http.StatusNotFound)
+		return
+	}
+
+	date := r.FormValue("date")
+	if date == "" {
+		date = time.Now().Format("2006-01-02")
+	}
+	if _, err := time.Parse("2006-01-02", date); err != nil {
+		http.Error(w, "date must be YYYY-MM-DD", http.StatusBadRequest)
+		return
+	}
+
+	caption := r.FormValue("caption")
+	if caption == "" {
+		caption = slug
+	}
+
+	var tags []string
+	for _, t := range parseTags(r.FormValue("tags")) {
+		tags = append(tags, t.Name)
+	}
+
+	if err := s.writeSidecar(slug, PhotoMeta{Caption: caption, Date: date, Tags: tags}); err != nil {
+		log.Printf("edit %s: %v", slug, err)
+		http.Error(w, "could not save", http.StatusInternalServerError)
+		return
+	}
+	s.rebuild()
+	w.WriteHeader(http.StatusOK)
+}
+
+// handleDelete moves one or more posts (image + sidecar) to content/.trash/.
+// Slugs come as repeated `slug` fields or a comma-separated `slugs` field.
+func (s *Server) handleDelete(w http.ResponseWriter, r *http.Request) {
+	if s.rejectCrossSite(w, r) {
+		return
+	}
+	slugs, err := s.formSlugs(r)
+	if err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	deleted := 0
+	for _, slug := range slugs {
+		if _, ok := s.resolveSlug(slug); !ok {
+			continue
+		}
+		if err := s.moveToTrash(slug); err != nil {
+			log.Printf("delete %s: %v", slug, err)
+			continue
+		}
+		deleted++
+	}
+	if deleted > 0 {
+		s.rebuild()
+	}
+	writeJSON(w, map[string]int{"deleted": deleted})
+}
+
+// handleBulkTags adds and/or removes tags across the given posts, leaving each
+// post's caption and date untouched. `add` and `remove` are comma-separated.
+func (s *Server) handleBulkTags(w http.ResponseWriter, r *http.Request) {
+	if s.rejectCrossSite(w, r) {
+		return
+	}
+	slugs, err := s.formSlugs(r)
+	if err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	add := parseTags(r.FormValue("add"))
+	remove := make(map[string]bool)
+	for _, t := range parseTags(r.FormValue("remove")) {
+		remove[t.Name] = true
+	}
+	if len(add) == 0 && len(remove) == 0 {
+		http.Error(w, "nothing to add or remove", http.StatusBadRequest)
+		return
+	}
+
+	updated := 0
+	for _, slug := range slugs {
+		if _, ok := s.resolveSlug(slug); !ok {
+			continue
+		}
+		meta := s.readSidecar(slug)
+
+		// Start from the current tags, append the additions, drop the removals,
+		// then let parseTags normalise and dedupe the result.
+		names := append([]string{}, meta.Tags...)
+		for _, t := range add {
+			names = append(names, t.Name)
+		}
+		var kept []string
+		for _, t := range parseTags(strings.Join(names, ",")) {
+			if !remove[t.Name] {
+				kept = append(kept, t.Name)
+			}
+		}
+		meta.Tags = kept
+
+		if err := s.writeSidecar(slug, meta); err != nil {
+			log.Printf("bulk tags %s: %v", slug, err)
+			continue
+		}
+		updated++
+	}
+	if updated > 0 {
+		s.rebuild()
+	}
+	writeJSON(w, map[string]int{"updated": updated})
+}
+
+// ── helpers ────────────────────────────────────────────────────────────────
+
+// resolveSlug reports whether slug names an existing post and returns the image
+// path. It rejects anything that is not a bare, safe filename, closing path
+// traversal and access to dotfiles such as the .trash directory.
+func (s *Server) resolveSlug(slug string) (string, bool) {
+	if slug == "" || slug != filepath.Base(slug) || strings.HasPrefix(slug, ".") {
+		return "", false
+	}
+	for _, ext := range contentExts {
+		p := filepath.Join(s.contentDir, slug+ext)
+		if fi, err := os.Stat(p); err == nil && !fi.IsDir() {
+			return p, true
+		}
+	}
+	return "", false
+}
+
+// formSlugs collects slugs from repeated `slug` fields and/or a comma-separated
+// `slugs` field, de-duplicated.
+func (s *Server) formSlugs(r *http.Request) ([]string, error) {
+	if err := r.ParseForm(); err != nil {
+		return nil, err
+	}
+	seen := make(map[string]bool)
+	var out []string
+	add := func(v string) {
+		v = strings.TrimSpace(v)
+		if v != "" && !seen[v] {
+			seen[v] = true
+			out = append(out, v)
+		}
+	}
+	for _, v := range r.Form["slug"] {
+		add(v)
+	}
+	for _, v := range strings.Split(r.FormValue("slugs"), ",") {
+		add(v)
+	}
+	return out, nil
+}
+
+// readSidecar loads a post's existing metadata, falling back to the same
+// defaults loadPhotos uses when the sidecar is missing or unreadable.
+func (s *Server) readSidecar(slug string) PhotoMeta {
+	meta := PhotoMeta{Caption: slug, Date: time.Now().Format("2006-01-02")}
+	path := filepath.Join(s.contentDir, slug+".toml")
+	if _, err := os.Stat(path); err == nil {
+		if _, err := toml.DecodeFile(path, &meta); err != nil {
+			log.Printf("read sidecar %s: %v", path, err)
+		}
+	}
+	return meta
+}
+
+// writeSidecar writes <slug>.toml atomically (temp file + rename) so a
+// concurrent build can never observe a half-written sidecar.
+func (s *Server) writeSidecar(slug string, meta PhotoMeta) error {
+	path := filepath.Join(s.contentDir, slug+".toml")
+	tmp, err := os.CreateTemp(s.contentDir, ".tmp-sidecar-*")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer os.Remove(tmpName) // no-op once the rename below succeeds
+
+	if err := toml.NewEncoder(tmp).Encode(meta); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpName, path)
+}
+
+// moveToTrash relocates a post's image and sidecar into content/.trash/, so a
+// delete is reversible. A timestamp keeps re-deleted slugs from colliding.
+func (s *Server) moveToTrash(slug string) error {
+	trash := filepath.Join(s.contentDir, ".trash")
+	if err := os.MkdirAll(trash, 0755); err != nil {
+		return err
+	}
+	stamp := time.Now().Format("20060102-150405")
+
+	// Move every file the post owns: its image (whichever extension) and its
+	// sidecar. Missing pieces are not an error.
+	var names []string
+	for _, ext := range contentExts {
+		names = append(names, slug+ext)
+	}
+	names = append(names, slug+".toml")
+
+	for _, name := range names {
+		src := filepath.Join(s.contentDir, name)
+		if _, err := os.Stat(src); err != nil {
+			continue
+		}
+		ext := filepath.Ext(name)
+		base := strings.TrimSuffix(name, ext)
+		dst := filepath.Join(trash, base+"."+stamp+ext)
+		if err := os.Rename(src, dst); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// rebuild kicks off an asynchronous site rebuild, matching the upload handler.
+// Build is mutex-guarded, so overlapping calls are safe. Tests may install a
+// rebuildHook to make this deterministic.
+func (s *Server) rebuild() {
+	if s.rebuildHook != nil {
+		s.rebuildHook()
+		return
+	}
+	go func() {
+		if err := s.generator.Build(); err != nil {
+			log.Printf("rebuild after manage op: %v", err)
+		}
+	}()
+}
+
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(v)
+}