add: markdown permission setting

improve: template

api/tree.py

@@ -1,27 +1,49 @@
 from flask import Blueprint, request, jsonify
 from sqlalchemy.orm import Session
+from sqlalchemy import and_, or_
 
 import api
-from api import etag_response
+from api import etag_response, verify_token, is_user_admin
 from db import get_db
 from db.models.Markdown import Markdown
 from db.models.Path import Path
+from db.models.MarkdownSetting import MarkdownSetting
+from db.models.MarkdownPermissionSetting import MarkdownPermissionSetting
 from api import limiter
+import env_provider
 import logging
 logger = logging.getLogger(__name__)
 
 tree_bp = Blueprint('tree', __name__, url_prefix='/api/tree')
 
 
-def build_tree(db: Session, parent_id: int = None):
+def build_tree(db: Session, parent_id: int = None, is_admin=False):
     path_nodes = db.query(Path).filter(Path.parent_id == parent_id).all()
-    md_nodes = db.query(
+
+    markdown_query = db.query(
         Markdown.id,
         Markdown.title,
         Markdown.order,
         Markdown.shortcut,
         Markdown.setting_id
-    ).filter(Markdown.path_id == parent_id).all()
+    ).filter(Markdown.path_id == parent_id)
+
+    if not is_admin:
+        markdown_query = markdown_query.outerjoin(
+            MarkdownSetting, 
+            Markdown.setting_id == MarkdownSetting.id
+        ).outerjoin(
+            MarkdownPermissionSetting,
+            MarkdownSetting.permission_setting_id == MarkdownPermissionSetting.id
+        ).filter(
+            or_(
+                MarkdownPermissionSetting.permission != 'private',
+                MarkdownPermissionSetting.permission == None
+            )
+        )
+
+    md_nodes = markdown_query.all()
+
     t0 = [
         {
             "id": node.id,
@@ -32,7 +54,7 @@ def build_tree(db: Session, parent_id: int = None):
         } for node in md_nodes
     ]
     t1 = [
-        {**node.to_dict(), "type": "path", "children": build_tree(db, node.id)} for node in path_nodes
+        {**node.to_dict(), "type": "path", "children": build_tree(db, node.id, is_admin)} for node in path_nodes
     ]
     for node in t1:
         for child in node["children"]:
@@ -45,8 +67,10 @@ def build_tree(db: Session, parent_id: int = None):
 @limiter.limit(api.get_rate_limit)
 @etag_response
 def get_tree():
+    is_admin = is_user_admin()
+
     with get_db() as session:
-        children = build_tree(session, 1)
+        children = build_tree(session, 1, is_admin)
         root = session.query(Path).get(1)
 
         return jsonify(
@@ -56,4 +80,4 @@ def get_tree():
                 "index": any("title" in child.keys() and child["title"] == "index" for child in children),
                 "children": children
             }
-        ), 200
+        ), 200