stub some more thread endpoints

app/routes/threads.py

@@ -1,10 +1,24 @@
 from flask import Blueprint, redirect, url_for, render_template, request, abort
+from functools import wraps
 from ..auth import login_required, get_active_user
 from ..models import Threads, Posts, Topics, Users, Reactions
 import math
 
 bp = Blueprint('threads', __name__, url_prefix='/threads/')
 
+def ownership_or_mod_required(view_func):
+    @wraps(view_func)
+    def wrapper(*args, **kwargs):
+        thread = Threads.find({'id': kwargs.get('thread_id', None)})
+        if not thread:
+            abort(404)
+
+        if thread.user_id != get_active_user().id and not get_active_user().is_mod():
+            abort(403)
+
+        return view_func(*args, **kwargs)
+    return wrapper
+
 @bp.get('/<int:thread_id>/')
 def thread_by_id(thread_id):
     thread = Threads.find({'id': thread_id})
@@ -57,6 +71,18 @@ def reply(thread_id):
     post = Posts.new(user.id, thread.id, request.form.get('babycode_content'))
     return redirect(url_for('.thread_by_id', thread_id=thread_id, after=post.id, _anchor=f'post-{post.id}'))
 
+@bp.get('/<int:thread_id>/edit/')
+@login_required
+@ownership_or_mod_required
+def edit(thread_id):
+    return 'stub'
+
+@bp.post('/<int:thread_id>/edit/')
+@login_required
+@ownership_or_mod_required
+def edit_post(thread_id):
+    return 'stub'
+
 @bp.get('/<int:thread_id>/feed.atom/')
 def feed(thread_id):
     return 'stub'

app/templates/threads/thread.html

@@ -20,6 +20,9 @@
 <fieldset class="plank even no-shadow minimal thread-actions">
   <legend>Actions</legend>
   {%- if is_logged_in() -%}
+  {%- if thread.user_id == get_active_user().id -%}
+  <a class="linkbutton" href="{{url_for('threads.edit', thread_id=thread.id)}}">Edit&hellip;</a>
+  {%- endif -%}
   <button>Subscribe</button>
   <button disabled title="This feature requires JavaScript to be enabled.">Bookmark&hellip;</button>
   {%- endif -%}
@@ -28,6 +31,9 @@
 {%- if is_mod() -%}
 <fieldset class="plank even no-shadow minimal thread-actions">
   <legend>Moderation actions</legend>
+  {%- if thread.user_id != get_active_user().id -%}
+  <a class="linkbutton warn" href="{{url_for('threads.edit', thread_id=thread.id)}}">Edit&hellip;</a>
+  {%- endif -%}
   <form method="POST">
     <input type="hidden" name="lock" value="{{(not thread.locked()) | int}}">
     <input type="hidden" name="sticky" value="{{(not thread.stickied()) | int}}">