Skip to content

rendall-dev-Oy/simple-comment

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

320 Commits

.github/workflows

.github/workflows

 
 

.vscode

.vscode

 
 

cypress

cypress

 
 

dist

dist

 
 

docs

docs

 
 

scripts

scripts

 
 

src

src

 
 

tests

tests

 
 

.eslintignore

.eslintignore

 
 

.gitignore

.gitignore

 
 

.markdownlint.json

.markdownlint.json

 
 

.nvmrc

.nvmrc

 
 

.prettierignore

.prettierignore

 
 

.prettierrc.json

.prettierrc.json

 
 

LICENSE

LICENSE

 
 

README.md

README.md

 
 

SECURITY.md

SECURITY.md

 
 

cypress.json

cypress.json

 
 

example.env

example.env

 
 

jest-mongodb-config.ts

jest-mongodb-config.ts

 
 

jest.config.ts

jest.config.ts

 
 

jest.preset.ts

jest.preset.ts

 
 

netlify.toml

netlify.toml

 
 

package.json

package.json

 
 

tsconfig.json

tsconfig.json

 
 

webpack.config.js

webpack.config.js

 
 

webpack.netlify.functions.js

webpack.netlify.functions.js

 
 

yarn.lock

yarn.lock

 
 

Repository files navigation

Simple Comment

Simple Comment enables any website visitor to leave comments. It is serverless, open-source, self-hosted, free, scaleable, and designed to feel unremarkably similar to the dozen or so other excellent solutions.

See the demo: https://simple-comment.netlify.app

Status

Netlify Status Open API 3.0 Validator Website Total alerts Language grade: JavaScript Documentation Status

MVP is complete!

The minimum functionality is up and running!

Completed tasks: (click to open)
  • Cross-origin capability
  • Script with frontend
  • All API endpoint respond as expected
    • Access-Control-Allow-Origin responds to .env variables
  • Authentication and Identification works as expected
  • Authenticated users and admins can interact with Simple Comment as expected
  • Anonymous user can create topics
    • This is useful for sites with lots of pages
    • For security reasons, restrictions apply:
      • The Referer header and the topicId must map properly
      • The Origin must be on the Access-Control-Allow-Origin list
  • Server-side validation of user-posted data
  • Setup instructions
    • Are complicated but work when followed
  • Visitor can post anonymously
    • Comment includes guest user
  • Designed a beautiful badge!
    • Powered by Simple Comment
  • Visitors can read and reply to comments

Top priority after MVP

  • Optional user authentication and identification
  • Moderator holds posts for approval
  • Spam prevention measures
  • Integration with 3rd party authentication
  • Email notification & integration
  • Framework-friendly frontends
  • Extensive helpful comments!
  • E2E tests

Nice to haves

  • Moderator change policy on holding posts for approval
  • Visitor can claim ownership over anonymous posts
  • Edit button
  • Delete / edit time windows in policy
  • User profiles
    • See comments
    • Avatar

Features

  • Easy to use anywhere
  • Industry-standard security
  • Designed to be fully customizable
  • Scalable, from free-tier to enterprise!
  • Free (as in "free beer": no cost)
    • Takes advantage of free-tier offerings from DBaaS and website hosts
  • Free (as in "libre": open source)
    • The source code is available to be modified and used without restriction
    • Commercial use allowed! Start a business with it! Knock yourself out!
    • MIT licensing available
  • Fully documented API
    • Open API 3
  • Ethical, no-track, visitor control over data
  • Friendly and welcoming developer community

Upcoming features

  • CLI (command-line interface) for
    • installation and setup
    • content moderation
    • user admininstration
  • GraphQL endpoint
  • GDPR compliance
    • Users can view and delete their own data without moderator
  • Moderators can restrict visitor read and write access
    • IP whitelists, graylists and blacklists
    • User whitelists, graylists and blacklists
  • User self-verification
  • Optional connection to the Fediverse
  • Support for other databases (PostgreSQL, Firestore, CockroachDB, etc) and hosting services (Heroku, AWS Lambda, GCS)
  • Support Web Authentication API https://w3c.github.io/webauthn/
  • User profiles
  • Upvoting / Reactions

Setup

Simple Comment can be run on the same server as your website or on a separate, cross-domain server

It is necessary that Simple Comment is served via https:

These instructions assume some devOps skill, but if anything is unclear, please create a new issue

  1. Fork this repository to your own account
  2. git clone https://github.com/<your-github-profile>/simple-comment replacing <your-github-profile>
  3. cd simple-comment
  4. yarn install (or npm install)
  5. Copy and rename example.env as .env
  6. In .env, enter your own, secret values, replacing everything to the right of the = in every case:
    1. SIMPLE_COMMENT_MODERATOR_ID
    2. SIMPLE_COMMENT_MODERATOR_PASSWORD
    3. JWT_SECRET
    4. SIMPLE_COMMENT_API_URL
  7. sign up for a free MongoDB Atlas account
    1. Follow these instructions
    2. In .env add the proper DB_CONNECION_STRING
  8. Sign up for a Netlify account, begin a new website, and link your repository to the new website
    1. Review Netlify's Build environment variables page
    2. Navigate to 'Build & Deploy => Environment`
    3. Under Environmental Variables click the button Edit Variables
    4. For each entry in .env add the key and corresponding value for all variables
    5. For IS_CROSS_SITE add the value true if the comment system is hosted in its own domain and false if it is the same domain.
  9. Modify your website. These are simple instructions, but feel free to hack away
    1. In the HTML for each page on your website where you want Simple Comment to run, add these two tags:
      1. <script src="[path-to]/simple-comment.js" defer></script> (src must point to the simple-comment.js file)
      2. <div id="simple-comment-display"></div>
    2. Upload the simple-comment.js file to your website's script folder
    3. Upload the login.html page on the root of your website (or somewhere accessible)
  10. It should now be possible to leave and read comments on your website

Troubleshooting

  • Error: Refused to connect to 'api/auth' because it violates the following Content Security Policy directive: connect-src 'self'
  • Error: Access to fetch at 'https://<your-comment-app>.netlify.app/.netlify/functions/' from origin '<your-website>' has been blocked by CORS policy...
    • Add <your-website> to the ALLOW_ORIGIN key in .env and as a Netlify environmental variable

Moderating

  1. Visit the login.html page you uploaded in Setup and
  2. Log in using the SIMPLE_COMMENT_MODERATOR_ID and SIMPLE_COMMENT_MODERATOR_PASSWORD values in your .env file

Default build

The default stack uses Netlify + MongoDB for the backend, and a minimal fetch based client for the frontend, but it can be readily adapted to use any technology stack, as long as the tests pass and the API conforms to the Open API 3 schema file

You can get your own free-tier MongoDB-in-the-cloud by following these instructions

API

The API specification is described by the file simple-comment-api.json in Open API 3 format and is designed to be interchangeable with any backend, frontend and identification system

This is an overview of the Simple Comment API endpoints

/comment

A comment is text that a user posts in reply to either another comment or a topic, and presenting these replies is the sole reason this project exists!

The comment endpoint is for the creation, reading, updating and deleting (CRUD) of individual comments. All comments must have a parent, that is, something it replies to, whether a topic or comment

/topic

A topic is a special kind of comment that by default can only be created by admin users, and forms an organizational bucket for comments that reply. It is a kind of root comment, and therefore has no parent

The /topic endpoint handles CRUD for these root comments. A GET operation of /topic will get a list of topics and GET on /topic/{topicId} will get all comments in reply to that topic and their descendents

/user

By default, comments can be posted by anonymous users, but Simple Comment does have a minimal identification scheme so that commenters who choose to do so can have control over their comments after the are posted, according to policy

/auth

Auth is the endpoint for the authentication and identification scheme. A user submits their username and password to the auth endpoint, and receives a JSON Web Token (JWT) that authenticates them as that user for other CRUD operations

/verify

Returns the logged-in user id or 401

policy

policy is an object holding key-value pairs that governs how Simple Comment behaves, determining for instance maximum comment length or whether ordinary users can delete themselves

Alternatives

There are 34 solutions that are not Simple Comment listed here. Nearly all of these are more mature than Simple Comment, and I would recommend considering one if you are not looking specifically for a serverless, open-source, self-hosted solution. Listed below each are pros and cons that distinguish it from Simple Comment. If Trust is required is listed, it means that using the service requires trust in the company, because they will be serving closed-source code to your users that you do not control and cannot easily inspect; as well, user data will be held on servers they control. This list is based on public documentation, not experience. If anything is incorrect or missing, please let me know.

About

No description, website, or topics provided.

Resources

Readme

License

AGPL-3.0 license

Security policy

Security policy
Activity
Custom properties

Stars

1 star

Watchers

1 watching

Forks

1 fork
Report repository

Releases

No releases published

Packages

No packages published

Languages