Feature Request: Make it possible to set a password for guests

[miterion]

We currently use etherpad with a custom pad manager so we can set a password to view/edit a pad. This way the links can be shared and not be edited by anyone. Would it be possible to add this to hackmd?

[SISheogorath]

You can use the usual auth integrations + permission.

Set it to limited and only users that are able to authenticate to a pad, can edit or see it.

And sorry for the late response, we currently revisit all issues.

[SISheogorath]

Interesting idea:

You can set one password for a pad in the permission section and everyone who would find a 403 right now, like Guest when a note is marked as "Limited", "Protected" or "Private" or users in case of a "Private" one, will be prompted for the password. And additional checkbox, besides the password field should toggle write access to for these users.

It's a very basic feature, but should be enough.

[miterion]

This would be very cool, would love to see this implemented or implement it myself

[SISheogorath]

We would very welcome a PR ❤️. Can't say when I'll get into this.

Feel free to ask if you have questions 😄

Meet us in our Gitter-Space:

[SISheogorath]

From a UI perspective I did some experiments:

Note implementation

With label at the bottom:

---

Without at the bottom:

---

With label but over the deletion in between:

---

Without label but over the deletion in between:

---

403-page implementation

---

Right now, I didn't do any server-side implementation. So there is no branch for testing right now. I wonder what is preferred.

Any additional/alternative ideas?

[miterion]

I would add a submit button to the 403 page, since many people would expect this.

[ccoenen]

regarding the different variants: I believe "note password" alone is not enough, it needs the extra label. Especially when something is already entered and the hint inside the input is no longer visible.

Also, input and label needs some margins left and right.

[SISheogorath]

Is this better?

---

---

403 with button

---

For people who want to develop the backend part:
https://github.com/SISheogorath/hackmd/tree/feature/guestPassword

Also an interesting question: Should the password be visible or not? Includes the question: do we store the password for the note as a real secret (hashed password) or as plaintext password

[SISheogorath]

Hints for the backend implementation:

https://github.com/hackmdio/hackmd/blob/ca959012047bef3c0b2dd6f2974a8373a6615125/lib/response.js#L154-L158

https://github.com/hackmdio/hackmd/blob/ea9b1557f9834b2b140bd9b07488b5fca3953791/lib/realtime.js#L804-L811

https://github.com/hackmdio/hackmd/blob/ca959012047bef3c0b2dd6f2974a8373a6615125/lib/response.js#L20-L22

[miterion]

I have a few questions regarding the backend implementation:

• When the password gets send to the server (from the 403 page), it has to be checked somewhere. I would implement it as a noteAction (see below)
  https://github.com/hackmdio/hackmd/blob/ca959012047bef3c0b2dd6f2974a8373a6615125/lib/response.js#L366
  Would that be okay or is there a better place
• My first idea for saving the password during a session is to save it with a cookie. The key would be the node id, the value the password.

Would love some feedback on these questions