From b3e12b975064f0873bdb4d2834cae75925387d6b Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Mon, 10 Aug 2026 23:28:03 +0200
Subject: feat(core): add received webmention admin actions

Add authenticated delete and reverify actions to the received
webmentions admin view and protect them with CSRF validation.

Enable CSRF protection globally while exempting the public Webmention
endpoint.
---
 webmentions_ssg/views.py | 72 ++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 70 insertions(+), 2 deletions(-)

(limited to 'webmentions_ssg/views.py')

diff --git a/webmentions_ssg/views.py b/webmentions_ssg/views.py
index 5408fa4..b52ae07 100644
--- a/webmentions_ssg/views.py
+++ b/webmentions_ssg/views.py
@@ -17,8 +17,8 @@ from flask import (
 from flask.typing import ResponseReturnValue
 from flask_login import current_user, login_required, login_user, logout_user
 
+from . import CSRF, forms
 from . import DATABASE as db
-from . import forms
 from .models import ReceivedWebmention, User
 from .tasks.receiver import verify_webmention
 
@@ -74,10 +74,78 @@ def received() -> ResponseReturnValue:
         "received.html",
         title="Received Webmentions",
         webmentions=webmentions,
+        action_form=forms.AdminActionForm(),
     )
 
 
-@root_page.route("/endpoint", methods=["POST"])
+@root_page.post("/received/<uuid:identifier>/delete")
+@login_required
+def delete_received_webmention(
+    identifier: uuid.UUID,
+) -> ResponseReturnValue:
+    form = forms.AdminActionForm()
+
+    if not form.validate_on_submit():
+        return abort(400)
+
+    webmention = db.session.get(
+        ReceivedWebmention,
+        identifier,
+    )
+
+    if webmention is None:
+        return abort(404)
+
+    db.session.delete(webmention)
+    db.session.commit()
+
+    flash(f"Webmention {webmention.uuid} deleted.", "success")
+
+    return redirect(
+        url_for(
+            "root.received",
+            page=request.args.get("page", 1, type=int),
+        )
+    )
+
+
+@root_page.post("/received/<uuid:identifier>/reverify")
+@login_required
+def reverify_received_webmention(
+    identifier: uuid.UUID,
+) -> ResponseReturnValue:
+    form = forms.AdminActionForm()
+
+    if not form.validate_on_submit():
+        return abort(400)
+
+    webmention = db.session.get(
+        ReceivedWebmention,
+        identifier,
+    )
+
+    if webmention is None:
+        return abort(404)
+
+    webmention.status = "received"
+    webmention.failure_reason = None
+
+    db.session.commit()
+
+    verify_webmention(identifier)
+
+    flash(f"Webmention {webmention.uuid} queued for reverification.", "success")
+
+    return redirect(
+        url_for(
+            "root.received",
+            page=request.args.get("page", 1, type=int),
+        )
+    )
+
+
+@root_page.post("/endpoint")
+@CSRF.exempt
 def endpoint() -> ResponseReturnValue:
     form = forms.EndpointForm(meta={"csrf": False})
 
-- 
cgit v1.3.1