# Showing posts in your own pages The built-in reader at `/blog/` is deliberately plain. Most projects want posts somewhere else too: a "Latest from the blog" strip on the home page, a `/news/` page in the project's own theme, a React or Astro front end, a static site. This page is the recipe for each of those, and for publishing *into* a blog from your own code. Everything below rests on one rule: **never filter posts yourself**. Which posts a visitor may see depends on the blog's visibility (private / members / public), the post's status, *and* whether its publish time has passed — a scheduled post is `published` with a future `published_at`. The scopers in `apps.blog.permissions` and the public JSON API encode all three. Use them and your page shows exactly what `/blog/` shows. ## Pick the route | Where the page is rendered | Use | |---|---| | A Django view in this project (your own template, your own theme) | the Python scopers, [below](#in-a-django-template-same-project) | | A separate front end — React, Vue, Astro, Next, a static-site generator | the anonymous JSON API, [below](#from-another-front-end-the-json-api) | | A feed reader, a newsletter tool, another CMS | the [feeds](feeds-and-apis.md) | ## In a Django template (same project) Query through the permission scopers, then render the stored HTML. ```python # apps/website/views.py from django.shortcuts import render from apps.blog import permissions from apps.blog.models import Post def home_view(request): latest = ( permissions.viewable_posts(request.user) # what THIS visitor may read .filter(blog__slug="field-notes") # optional: one blog .select_related("blog", "author") .prefetch_related("tags") .order_by("-published_at", "-id")[:3] ) return render(request, "website/home.html", {"latest_posts": latest}) ``` ```django {# templates/website/home.html #}

Latest from the blog

{% for post in latest_posts %}

{{ post.title }}

{{ post.excerpt }}

{{ post.published_at|date:"j M Y" }} · {{ post.blog.name }} {% for tag in post.tags.all %} · {{ tag.name }}{% endfor %}
{% empty %}

Nothing published yet.

{% endfor %} All posts →
``` Two scopers cover every case: - `permissions.viewable_posts(user)` — everything `user` may read: live posts in blogs they can see, plus their own drafts if they are an author. Pass `request.user` and an anonymous visitor, a colleague on a members blog and the owner previewing a draft all get the right answer from one line. - `permissions.public_posts()` — the anonymous subset only (live posts in public blogs). Use it for anything cached or shared between visitors, such as a sitemap, a home-page strip rendered into a page cache, or a feed. Both accept an optional queryset to narrow first: `permissions.public_posts(Post.objects.filter(is_featured=True))`. ### A full post page in your theme If you want the article itself inside your own base template rather than the built-in reader: ```python from django.shortcuts import get_object_or_404, render from apps.blog import permissions def article_view(request, blog_slug, post_slug): post = get_object_or_404( permissions.viewable_posts(request.user).select_related("blog"), blog__slug=blog_slug, slug=post_slug, ) return render(request, "website/article.html", {"post": post}) ``` ```django {% extends "smallstack/base.html" %} {% load static %} {% block extra_css %}{% endblock %} {% block content %}

{{ post.title }}

{% if post.cover_image %}{{ post.cover_alt }}{% endif %} {% if post.body_toc %}{% endif %} {{ post.body_html|safe }}
{% endblock %} ``` The fields you will reach for: | Field | Notes | |---|---| | `title`, `slug`, `excerpt` | `excerpt` is plain text, derived from the body when the author leaves it blank | | `body_html` | Rendered and sanitised when the post was saved. `\|safe` is correct here — raw HTML in the markdown is escaped at render time, not trusted | | `body_toc` | A `