add subscribing and unsubscribing, add post editing

app/routes/posts.py

@@ -1,7 +1,9 @@
-from flask import Blueprint, abort
+from flask import Blueprint, abort, render_template, redirect, url_for, request
 from functools import wraps
 from ..auth import login_required, get_active_user
-from ..models import Posts
+from ..models import Posts, Threads
+from ..util import get_post_url
+from ..db import db
 
 bp = Blueprint('posts', __name__, url_prefix='/posts/')
 
@@ -9,10 +11,11 @@ def ownership_required(view_func):
     @wraps(view_func)
     def wrapper(*args, **kwargs):
         post = Posts.find({'id': kwargs.get('post_id', None)})
+        user = get_active_user()
         if not post:
             abort(404)
 
-        if post.user_id != get_active_user().id:
+        if post.user_id != user.id:
             abort(403)
 
         return view_func(*args, **kwargs)
@@ -35,7 +38,46 @@ def ownership_or_mod_required(view_func):
 @login_required
 @ownership_required
 def edit(post_id):
-    return 'stub'
+    post = Posts.find({'id': post_id})
+    thread = Threads.find({'id': post.thread_id})
+    user = get_active_user()
+    if not thread:
+        # what?
+        abort(404)
+
+    if thread.locked() and not user.is_mod():
+        abort(403)
+
+    thread_predicate = f'{Posts.FULL_POSTS_QUERY} WHERE posts.thread_id = ?'
+
+    context_prev_q = f'{thread_predicate} AND posts.created_at < ? ORDER BY posts.created_at DESC LIMIT 2'
+    context_next_q = f'{thread_predicate} AND posts.created_at > ? ORDER BY posts.created_at ASC LIMIT 2'
+
+    context_next = db.query(context_next_q, thread.id, post.created_at)
+    context_prev = db.query(context_prev_q, thread.id, post.created_at)
+
+    return render_template(
+        'posts/edit.html', post=post.get_full_post_view(),
+        context_next=context_next, context_prev=context_prev
+        )
+
+@bp.post('/<int:post_id>/edit/')
+@login_required
+@ownership_required
+def edit_post(post_id):
+    post = Posts.find({'id': post_id})
+    thread = Threads.find({'id': post.thread_id})
+    user = get_active_user()
+    if not thread:
+        # what?
+        abort(404)
+
+    if thread.locked() and not user.is_mod():
+        abort(403)
+
+    post.edit(request.form.get('babycode_content', ''))
+
+    return redirect(get_post_url(post.id, _anchor=True))
 
 @bp.get('/<int:post_id>/delete/')
 @login_required