brewlog/templates/pages/edit_roast.html
Jon Seager 920931ba17
refactor: fix template review findings (security, macros, tokens)
Address findings from the templates code review:

- Fix XSS in admin.html onclick handlers via data attributes
- Fix XSS in 5 edit page signal initializations via JSON serialization
- Fix register.html token exposure by moving to data attribute
- Add entity_icon, quick_notes_toggles, add_form_submit macros
- Replace hardcoded colors with design tokens (warning, error, success)
- Add warning design tokens to CSS theme
- Scope MutationObserver to main element
- Add defer to webauthn.js script tags
- Refactor login/register JS to arrow functions
- Guard lightbox script behind image_url check
- Fix else-if to elif in 5 templates
2026-02-13 16:20:30 +00:00

140 lines
4.7 KiB
HTML

{% extends "base.html" %}
{% import "partials/icons.html" as icons %}
{% import "partials/image_section.html" as img %}
{% import "partials/detail_cards.html" as detail_cards %}
{% block title %}Brewlog · Edit Roast{% endblock %}
{% block content %}
<header class="flex flex-col gap-2">
<h1 class="text-3xl font-semibold">Edit Roast</h1>
<p class="max-w-2xl text-sm text-text-secondary">Update roast details.</p>
</header>
<section class="rounded-lg border bg-surface p-5">
<form
class="flex flex-col gap-4 pb-16 md:pb-0"
data-signals="{{ signals_json }}"
data-on:submit="$_submitting = true; $_submitError = ''; @put('/api/v1/roasts/{{ id }}', {contentType: 'form'})"
data-on:datastar-fetch="if (!$_submitting) return;
if (evt.detail.type === 'finished') { $_submitting = false; sessionStorage.setItem('toast', 'Roast updated') }
else if (evt.detail.type === 'error') { $_submitting = false; $_submitError = 'Failed to save changes.' }"
>
<div class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Roaster*</span
>
<searchable-select
name="roaster_id"
placeholder="Type to search roasters&hellip;"
initial-value="{{ roaster_id }}"
>
{% for roaster in roaster_options %}
<button
type="button"
value="{{ roaster.id }}"
data-display="{{ roaster.name }}"
class="w-full px-3 py-2 text-left text-sm hover:bg-surface-alt transition"
>
<span class="font-medium text-text">{{ roaster.name }}</span>
</button>
{% endfor %}
</searchable-select>
</div>
<div class="grid gap-4 sm:grid-cols-2">
<label class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Roast Name*</span
>
<input
type="text"
name="name"
required
aria-required="true"
class="input-field"
placeholder="Ethiopia Yirgacheffe"
data-bind:_name
/>
</label>
<label class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Origin*</span
>
<input
type="text"
name="origin"
required
aria-required="true"
class="input-field"
placeholder="Ethiopia"
data-bind:_origin
/>
</label>
<label class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Region*</span
>
<input
type="text"
name="region"
required
aria-required="true"
class="input-field"
placeholder="Guji"
data-bind:_region
/>
</label>
<label class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Producer*</span
>
<input
type="text"
name="producer"
required
aria-required="true"
class="input-field"
placeholder="Chelbesa Cooperative"
data-bind:_producer
/>
</label>
<label class="flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Process*</span
>
<input
type="text"
name="process"
required
aria-required="true"
class="input-field"
placeholder="Washed"
data-bind:_process
/>
</label>
<label class="sm:col-span-2 flex flex-col gap-1 text-sm">
<span
class="text-xs font-semibold text-text-muted uppercase tracking-wide"
>Tasting Notes* (comma or newline separated)</span
>
<textarea
name="tasting_notes"
rows="2"
required
aria-required="true"
class="input-field"
placeholder="Blueberry, Jasmine"
data-bind:_tasting-notes
></textarea>
</label>
</div>
{{ img::deferred_upload_with_preview("edit-roast-image", "Roast Image", "roast", id, image_url) }}
{{ detail_cards::edit_form_actions() }}
</form>
</section>
{% endblock %}