active_canvas 0.0.4 → 0.1.0

data/app/controllers/active_canvas/admin/collection_items_controller.rb

@@ -0,0 +1,93 @@
+module ActiveCanvas
+  module Admin
+    class CollectionItemsController < ApplicationController
+      MAX_ROWS = 1000
+
+      before_action :set_collection
+      before_action :set_item, only: %i[edit update destroy publish unpublish history]
+      before_action :load_media, only: %i[new create edit update]
+
+      def index
+        @items = @collection.items.order(updated_at: :desc)
+        @items = @items.where(status: params[:status]) if %w[draft published].include?(params[:status])
+        @items = @items.limit(MAX_ROWS)
+        @leading_fields = @collection.fields.first(4)
+      end
+
+      def new
+        @item = @collection.items.new
+      end
+
+      def create
+        @item = @collection.items.new(item_params)
+        @item.assign_fields(data_params)
+        if @item.save
+          redirect_to edit_admin_collection_item_path(@collection, @item), notice: "Item saved as draft."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        @item.assign_attributes(item_params)
+        @item.assign_fields(data_params)
+        if @item.save
+          redirect_to edit_admin_collection_item_path(@collection, @item), notice: "Item updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @item.destroy
+        redirect_to admin_collection_items_path(@collection), notice: "Item deleted."
+      end
+
+      def publish
+        if @item.publish
+          redirect_to edit_admin_collection_item_path(@collection, @item), notice: "Item published."
+        else
+          redirect_to edit_admin_collection_item_path(@collection, @item), alert: @item.errors.full_messages.to_sentence
+        end
+      end
+
+      def unpublish
+        @item.unpublish!
+        redirect_to edit_admin_collection_item_path(@collection, @item), notice: "Item moved back to draft."
+      end
+
+      def history
+        @versions = @item.versions.order(version_number: :desc)
+      end
+
+      private
+
+      def set_collection
+        @collection = ActiveCanvas::Collection.find(params[:collection_id])
+      end
+
+      def set_item
+        @item = @collection.items.find(params[:id])
+      end
+
+      # One query for the media picker instead of one per option.
+      def load_media
+        @media = ActiveCanvas::Media.with_attached_file.recent
+      end
+
+      def item_params
+        params.fetch(:item, {}).permit(:slug)
+      end
+
+      # Field ids are dynamic; assign_fields is a schema allowlist, so reading
+      # the raw hash here is safe (unknown keys are dropped by the schema).
+      def data_params
+        data = params.dig(:item, :data)
+        data.respond_to?(:to_unsafe_h) ? data.to_unsafe_h : {}
+      end
+    end
+  end
+end

data/app/controllers/active_canvas/admin/collections_controller.rb

@@ -0,0 +1,51 @@
+module ActiveCanvas
+  module Admin
+    class CollectionsController < ApplicationController
+      before_action :set_collection, only: %i[edit update destroy]
+
+      def index
+        @collections = ActiveCanvas::Collection.order(:name)
+      end
+
+      def new
+        @collection = ActiveCanvas::Collection.new
+      end
+
+      def create
+        @collection = ActiveCanvas::Collection.new(collection_params)
+
+        if @collection.save
+          redirect_to edit_admin_collection_path(@collection), notice: "Collection was successfully created."
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        if @collection.update(collection_params)
+          redirect_to edit_admin_collection_path(@collection), notice: "Collection was successfully updated."
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @collection.destroy
+        redirect_to admin_collections_path, notice: "Collection was successfully deleted."
+      end
+
+      private
+
+      def set_collection
+        @collection = ActiveCanvas::Collection.find(params[:id])
+      end
+
+      def collection_params
+        params.require(:collection).permit(:name, :slug, :fields_json)
+      end
+    end
+  end
+end

data/app/controllers/active_canvas/admin/form_submissions_controller.rb

@@ -0,0 +1,51 @@
+require "csv"
+
+module ActiveCanvas
+  module Admin
+    class FormSubmissionsController < ApplicationController
+      MAX_ROWS = 1000
+
+      def index
+        @submissions = ActiveCanvas::FormSubmission.includes(:page).order(created_at: :desc)
+        @submissions = @submissions.where(page_id: params[:page_id]) if params[:page_id].present?
+        @submissions = @submissions.where(form_key: params[:form_key]) if params[:form_key].present?
+        @submissions = @submissions.limit(MAX_ROWS)
+
+        respond_to do |format|
+          format.html
+          format.csv { send_data csv_for(@submissions), filename: "form-submissions-#{Date.current}.csv" }
+        end
+      end
+
+      def show
+        @submission = ActiveCanvas::FormSubmission.find(params[:id])
+      end
+
+      def destroy
+        ActiveCanvas::FormSubmission.find(params[:id]).destroy
+        redirect_to admin_form_submissions_path, notice: "Submission deleted."
+      end
+
+      private
+
+      def csv_for(submissions)
+        data_keys = submissions.flat_map { |submission| submission.data.keys }.uniq
+        CSV.generate do |csv|
+          csv << [ "id", "page", "form", "created_at", "ip", *data_keys ]
+          submissions.each do |submission|
+            csv << [ submission.id, csv_cell(submission.page.title), csv_cell(submission.form_key),
+                     submission.created_at.iso8601, submission.ip,
+                     *data_keys.map { |key| csv_cell(submission.data[key]) } ]
+          end
+        end
+      end
+
+      # Neutralize CSV formula injection: submitter-controlled values that begin
+      # with a formula trigger execute when the export is opened in a spreadsheet.
+      def csv_cell(value)
+        string = value.to_s
+        string.match?(/\A[=+\-@\t\r]/) ? "'#{string}" : string
+      end
+    end
+  end
+end

data/app/controllers/active_canvas/admin/pages_controller.rb

@@ -3,7 +3,7 @@ module ActiveCanvas
     class PagesController < ApplicationController
       include ActiveCanvas::TailwindCompilation
 
-      before_action :set_page, only: %i[show edit update destroy content update_content editor save_editor versions]
+      before_action :set_page, only: %i[show edit update destroy content update_content editor save_editor versions validate_template sample_data chip_values preview_iframe]
 
       def index
         @pages = ActiveCanvas::Page.includes(:page_type).order(created_at: :desc)
@@ -70,11 +70,20 @@ module ActiveCanvas
       end
 
       def save_editor
-        content_changed = @page.content != editor_params[:content]
+        attrs = editor_params
+        if attrs[:bindings].is_a?(String)
+          begin
+            attrs[:bindings] = JSON.parse(attrs[:bindings])
+          rescue JSON::ParserError => e
+            return render json: { success: false, error: e.message }, status: :unprocessable_entity
+          end
+        end
+
+        content_changed = @page.content != attrs[:content]
         Rails.logger.info "[ActiveCanvas::PagesController] save_editor for page ##{@page.id}"
         Rails.logger.info "[ActiveCanvas::PagesController]   content_changed: #{content_changed}"
 
-        if @page.update(editor_params)
+        if @page.update(attrs)
           tailwind_info = compile_tailwind_if_needed(content_changed) do
             compiled_css = ActiveCanvas::TailwindCompiler.compile_for_page(@page)
             @page.update_columns(compiled_tailwind_css: compiled_css, tailwind_compiled_at: Time.current)
@@ -103,6 +112,102 @@ module ActiveCanvas
         @versions = @page.versions.recent.limit(50)
       end
 
+      # Runs the editor's current source through the strict preview renderer
+      # and reports the first error with its position. Never returns HTML.
+      def validate_template
+        preview = @page.preview_with(content: params[:content].to_s, bindings: parse_bindings(params[:bindings]) || {}, template_enabled: true)
+
+        if (message = invalid_bindings_message(preview))
+          return render json: { ok: false, error: { message: message } }, status: :unprocessable_entity
+        end
+
+        TemplateRenderer.new(preview, mode: :preview).render
+        render json: { ok: true, error: nil }
+      rescue ActiveCanvas::DataSources::TemplateRenderError => e
+        render json: { ok: false, error: { message: e.message, line: e.line, column: e.column } },
+               status: :unprocessable_entity
+      end
+
+      # First rows of one binding, resolved from the editor's unsaved bindings,
+      # so an author can see which field names exist before typing {{ }}.
+      # Live values for the editor's chips: what each {{ }} shows in its first
+      # occurrence and how many items each loop renders.
+      def chip_values
+        preview = @page.preview_with(bindings: parse_bindings(params[:bindings]) || {}, template_enabled: true)
+
+        if (message = invalid_bindings_message(preview))
+          return render json: { values: {}, loops: {}, error: message }, status: :unprocessable_entity
+        end
+
+        render json: TemplateRenderer.new(preview, mode: :preview).chip_values(params[:content].to_s)
+      end
+
+      def sample_data
+        preview = @page.preview_with(bindings: parse_bindings(params[:bindings]) || {})
+
+        if (message = invalid_bindings_message(preview))
+          return render json: { error: message }, status: :unprocessable_entity
+        end
+
+        name = params[:binding].to_s
+        return render json: { error: "No binding named #{name.inspect}" }, status: :not_found unless preview.bindings.key?(name)
+
+        render json: { rows: TemplateRenderer::BindingResolver.new(preview.bindings).sample(name) }
+      rescue StandardError => e
+        Rails.logger.warn("[ActiveCanvas] sample_data for page #{@page.id} failed: #{e.class}: #{e.message}")
+        message = Rails.env.development? ? e.message : "#{e.class}: the data source failed"
+        render json: { error: message }, status: :unprocessable_entity
+      end
+
+      # Renders a complete HTML page (layout, partials, CSS framework) from the
+      # editor's current unsaved state, for the preview modal's iframe. Uses the
+      # page's own template_enabled flag so a static page previews as static.
+      def preview_iframe
+        preview = @page.preview_with(
+          content: params[:content]&.to_s,
+          content_css: params[:content_css]&.to_s,
+          content_js: params[:content_js]&.to_s,
+          bindings: parse_bindings(params[:bindings])
+        )
+
+        if (message = invalid_bindings_message(preview))
+          return render json: { html: nil, error: { message: message } }, status: :unprocessable_entity
+        end
+
+        @page = preview
+        html = render_to_string(template: "active_canvas/pages/show",
+                                layout: "active_canvas/application",
+                                formats: [ :html ])
+        render json: { html: html, error: nil }
+      end
+
+      def data_sources
+        literal = {
+          name: "_literal", kind: "literal", label: "Literal", item_name: "item", list: false,
+          params: { value: { type: :string, default: nil, range: nil, allowed: nil } }
+        }
+
+        registered = ActiveCanvas::DataSources.registered_names.map do |name|
+          source = ActiveCanvas::DataSources.lookup(name)
+          {
+            name: name, kind: "source", label: name.to_s.humanize,
+            item_name: ActiveCanvas::DataSources.item_name(name), list: source.list?,
+            params: source.param_schema
+          }
+        end
+
+        collections = ActiveCanvas::Collection.order(:name).map do |collection|
+          {
+            name: collection.slug, kind: "collection", label: collection.name,
+            item_name: collection.item_name, list: true,
+            fields: collection.fields.map { |f| f.slice("id", "label", "type", "options") },
+            params: collection.param_schema
+          }
+        end
+
+        render json: [ literal ] + registered + collections
+      end
+
       private
 
       def set_page
@@ -111,7 +216,7 @@ module ActiveCanvas
 
       def page_params
         params.require(:page).permit(
-          :title, :slug, :content, :page_type_id, :published,
+          :title, :slug, :content, :page_type_id, :published, :template_enabled,
           # Header/Footer
           :show_header, :show_footer,
           # SEO fields
@@ -126,7 +231,24 @@ module ActiveCanvas
       end
 
       def editor_params
-        params.require(:page).permit(:content, :content_css, :content_js, :content_components)
+        params.require(:page).permit(:content, :content_css, :content_js, :content_components, :template_enabled, :bindings)
+      end
+
+      # Returns whatever the client sent, parsed. Page#bindings_shape does the
+      # checking, so a bad payload becomes a validation error, not a 500.
+      def parse_bindings(raw)
+        return nil if raw.blank?
+        return JSON.parse(raw) if raw.is_a?(String)
+        raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h : raw
+      rescue JSON::ParserError
+        raw
+      end
+
+      # A dup'd page fails the slug uniqueness check against its own row, so
+      # only the bindings errors are meaningful here.
+      def invalid_bindings_message(page)
+        page.validate
+        page.errors.full_messages_for(:bindings).to_sentence.presence
       end
     end
   end

data/app/controllers/active_canvas/form_submissions_controller.rb

@@ -0,0 +1,90 @@
+module ActiveCanvas
+  class FormSubmissionsController < ApplicationController
+    MAX_VALUE_BYTES = 10.kilobytes
+    MAX_PAYLOAD_BYTES = 64.kilobytes
+
+    # The signed ac_token + origin check replace Rails CSRF for this public,
+    # CMS-content-originated endpoint.
+    skip_before_action :verify_authenticity_token, raise: false
+
+    def create
+      return head :forbidden unless trusted_origin?
+
+      payload = verified_token
+      return head :unprocessable_entity unless payload
+
+      page = Page.published.find_by(id: payload["page_id"])
+      return head :not_found unless page
+
+      form_key = payload["form_key"]
+      return fake_success(page, form_key) if params[:ac_website].present?
+      return reject(page, form_key, "too_fast") if too_fast?(payload)
+      return head :too_many_requests if rate_limited?
+      return head :content_too_large if oversized?
+
+      schema = FormSchema.derive(page.content, form_key)
+      return head :unprocessable_entity unless schema
+
+      data = params.permit(*schema.fields).to_h
+      return reject(page, form_key, "missing_fields") if schema.required.any? { |field| data[field].blank? }
+
+      submission = page.form_submissions.create!(
+        form_key: form_key, data: data,
+        ip: request.remote_ip, user_agent: request.user_agent.to_s.first(500)
+      )
+      notify(submission)
+      redirect_to success_path(page, form_key)
+    end
+
+    private
+
+    def trusted_origin?
+      source = request.origin.presence || request.referer.presence
+      return false unless source
+
+      URI.parse(source).host == request.host
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def verified_token
+      FormStamper.verifier.verify(params[:ac_token].to_s)
+    rescue ActiveSupport::MessageVerifier::InvalidSignature
+      nil
+    end
+
+    def too_fast?(payload)
+      Time.current.to_f - payload["issued_at"].to_f < ActiveCanvas.config.form_min_submit_seconds
+    end
+
+    def rate_limited?
+      key = "active_canvas:form_rate:#{request.remote_ip}"
+      count = Rails.cache.increment(key, 1, expires_in: 1.minute)
+      count.to_i > ActiveCanvas.config.form_rate_limit_per_minute
+    end
+
+    def oversized?
+      request.content_length.to_i > MAX_PAYLOAD_BYTES ||
+        params.to_unsafe_h.values.any? { |value| value.is_a?(String) && value.bytesize > MAX_VALUE_BYTES }
+    end
+
+    def fake_success(page, form_key)
+      redirect_to success_path(page, form_key)
+    end
+
+    def reject(page, form_key, reason)
+      redirect_to public_page_path(page.slug, ac_form_error: reason, ac_form: form_key, anchor: form_key)
+    end
+
+    def success_path(page, form_key)
+      public_page_path(page.slug, ac_submitted: form_key, anchor: form_key)
+    end
+
+    def notify(submission)
+      ActiveSupport::Notifications.instrument("form_submission.active_canvas", submission: submission)
+      ActiveCanvas.config.on_form_submission&.call(submission)
+    rescue => e
+      Rails.logger.error("[ActiveCanvas] form submission hook failed: #{e.class}: #{e.message}")
+    end
+  end
+end

data/app/controllers/active_canvas/pages_controller.rb

@@ -1,5 +1,7 @@
 module ActiveCanvas
   class PagesController < ApplicationController
+    after_action :set_dynamic_cache_headers, only: %i[show home]
+
     def home
       @page = Setting.homepage
 
@@ -14,5 +16,11 @@ module ActiveCanvas
       @page = Page.published.find_by(slug: params[:slug])
       raise ActionController::RoutingError, "Not Found" unless @page
     end
+
+    private
+
+    def set_dynamic_cache_headers
+      response.headers["Cache-Control"] = "no-store" if @page&.template_enabled?
+    end
   end
 end

data/app/controllers/active_canvas/redirects_controller.rb

@@ -0,0 +1,10 @@
+module ActiveCanvas
+  class RedirectsController < ApplicationController
+    def show
+      page = PageRedirect.find_by(from_slug: params[:slug])&.page
+      raise ActionController::RoutingError, "Not Found" unless page&.published? && page.slug.present?
+
+      redirect_to public_page_path(page.slug), status: :moved_permanently
+    end
+  end
+end

data/app/helpers/active_canvas/admin/collection_items_helper.rb

@@ -0,0 +1,33 @@
+module ActiveCanvas
+  module Admin
+    module CollectionItemsHelper
+      # The value shown for an item in the grid, read through the schema so
+      # removed fields never appear.
+      def collection_cell(item, field)
+        raw_value = item.effective_data[field["id"]]
+
+        case field["type"]
+        when "boolean" then raw_value ? "✓" : "✗"
+        when "media"   then media_filenames[raw_value.to_i].to_s
+        else truncate(raw_value.to_s, length: 40)
+        end
+      end
+
+      def collection_status_badge(item)
+        if item.status != "published"
+          tag.span("Draft", class: "badge badge-gray")
+        elsif item.pending_changes?
+          tag.span("Published · draft changes", class: "badge badge-warning")
+        else
+          tag.span("Published", class: "badge badge-success")
+        end
+      end
+
+      private
+
+      def media_filenames
+        @media_filenames ||= ActiveCanvas::Media.pluck(:id, :filename).to_h
+      end
+    end
+  end
+end

data/app/models/active_canvas/auto_drop.rb

@@ -0,0 +1,69 @@
+module ActiveCanvas
+  # Generic Liquid Drop wrapper that exposes only declared attributes from any
+  # object. String values are HTML-escaped on the way out unless the attribute
+  # is listed in `html:` or the value is already html_safe. Associations are
+  # off by default; each must be opted in with its own whitelist. Association
+  # values are always escaped (no `html:` for nested drops). Templates should
+  # not add `| escape` on top.
+  class AutoDrop < ::Liquid::Drop
+    def self.wrap_collection(collection, attributes:, associations: {}, html: [])
+      collection.map { |item| new(item, attributes: attributes, associations: associations, html: html) }
+    end
+
+    def initialize(record, attributes:, associations: {}, html: [])
+      super()
+      @record = record
+      @attributes = attributes.map(&:to_s).freeze
+      @html = html.map(&:to_s).freeze
+      @associations = associations.each_with_object({}) do |(key, attrs), acc|
+        acc[key.to_s] = attrs
+      end.freeze
+    end
+
+    # Liquid's hook for property access. Unknown keys return nil so the
+    # surface stays tight; in strict preview mode Liquid reports them.
+    def liquid_method_missing(method_name)
+      if @attributes.include?(method_name)
+        escape(read(method_name), method_name)
+      elsif @associations.key?(method_name)
+        wrap_association(read(method_name), @associations[method_name])
+      end
+    end
+
+    # The exposed surface as a Hash (values still go through escaping and
+    # association wrapping). Used by the editor's sample-data endpoint.
+    def to_h
+      (@attributes + @associations.keys).each_with_object({}) { |name, acc| acc[name] = liquid_method_missing(name) }
+    end
+
+    private
+
+    def read(method_name)
+      @record.public_send(method_name) if @record.respond_to?(method_name)
+    end
+
+    def escape(value, attribute)
+      case value
+      when Array then value.map { |v| escape(v, attribute) }
+      when Hash  then value.each_with_object({}) { |(k, v), acc| acc[k.to_s] = escape(v, attribute) }
+      when Symbol then escape(value.to_s, attribute)
+      when String
+        value.html_safe? || @html.include?(attribute) ? value : ERB::Util.html_escape(value)
+      when Numeric, true, false, nil, Date, Time, ::Liquid::Drop
+        value
+      else
+        raise DataSources::UnsafeData.new(:auto_drop, value.class.name)
+      end
+    end
+
+    def wrap_association(value, attrs)
+      if value.nil?
+        nil
+      elsif value.is_a?(Array) || (value.respond_to?(:to_ary) && !value.is_a?(String))
+        AutoDrop.wrap_collection(value, attributes: attrs)
+      else
+        AutoDrop.new(value, attributes: attrs)
+      end
+    end
+  end
+end

data/app/models/active_canvas/collection.rb

@@ -0,0 +1,98 @@
+module ActiveCanvas
+  class Collection < ApplicationRecord
+    RESERVED_SLUGS = %w[_literal].freeze
+    # Keys CollectionSource puts on every row; a field may not shadow them.
+    RESERVED_FIELD_IDS = %w[id slug published_at].freeze
+    FIELD_ID_FORMAT = /\A[a-z][a-z0-9_]*\z/
+
+    has_many :items, class_name: "ActiveCanvas::CollectionItem", dependent: :destroy
+
+    attribute :fields, default: []
+
+    before_validation :normalize_slug
+    before_validation :assign_missing_field_ids
+
+    validates :name, presence: true
+    validates :slug, presence: true, uniqueness: true
+    validate :slug_not_reserved
+    validate :fields_well_formed
+
+    def item_name
+      ActiveCanvas::DataSources.item_name(slug)
+    end
+
+    # The params an editor can set on a binding to this collection, in the
+    # same shape as DataSources::Source#param_schema plus field labels.
+    def param_schema
+      ids = fields.map { |f| f["id"] }
+      labels = fields.each_with_object({}) { |f, acc| acc[f["id"]] = f["label"] }
+      {
+        limit:        { type: :integer, default: CollectionSource::DEFAULT_LIMIT, range: [ 1, CollectionSource::MAX_LIMIT ], allowed: nil },
+        sort_field:   { type: :string, default: nil, range: nil, allowed: ids, labels: labels },
+        sort_dir:     { type: :string, default: "desc", range: nil, allowed: %w[asc desc] },
+        filter_field: { type: :string, default: nil, range: nil, allowed: ids, labels: labels },
+        filter_value: { type: :string, default: nil, range: nil, allowed: nil }
+      }
+    end
+
+    # The field builder posts its rows as one JSON string.
+    def fields_json=(json)
+      self.fields = json.blank? ? [] : JSON.parse(json)
+    rescue JSON::ParserError, TypeError
+      @fields_unreadable = true
+    end
+
+    def fields_json
+      (fields.is_a?(Array) ? fields : []).to_json
+    end
+
+    def fields=(value)
+      @fields_unreadable = false
+      super
+    end
+
+    private
+
+    def normalize_slug
+      self.slug = (slug.presence || name).to_s.parameterize
+    end
+
+    def assign_missing_field_ids
+      return unless fields_readable?
+
+      taken = RESERVED_FIELD_IDS.dup
+      self.fields = fields.map do |field|
+        field = field.transform_keys(&:to_s)
+        id = field["id"].presence || CollectionSchema.generate_field_id(field["label"], taken)
+        taken << id
+        field.merge("id" => id)
+      end
+    end
+
+    def slug_not_reserved
+      return if slug.blank?
+
+      if RESERVED_SLUGS.include?(slug) || ActiveCanvas::DataSources.registered_names.map(&:to_s).include?(slug)
+        errors.add(:slug, "is reserved by a registered data source")
+      end
+    end
+
+    def fields_readable?
+      !@fields_unreadable && fields.is_a?(Array) && fields.all?(Hash)
+    end
+
+    def fields_well_formed
+      return errors.add(:fields, "could not be read") unless fields_readable?
+
+      seen = []
+      fields.each do |field|
+        errors.add(:fields, "must each have a label") if field["label"].blank?
+        errors.add(:fields, "have an unknown type: #{field["type"]}") unless CollectionSchema::VALID_FIELD_TYPES.include?(field["type"])
+        errors.add(:fields, "have an invalid id: #{field["id"]} (ids are lower_snake_case; remove the field and add it again)") unless field["id"].to_s.match?(FIELD_ID_FORMAT)
+        errors.add(:fields, "use a reserved id: #{field["id"]}") if RESERVED_FIELD_IDS.include?(field["id"])
+        errors.add(:fields, "have duplicate ids: #{field["id"]}") if seen.include?(field["id"])
+        seen << field["id"]
+      end
+    end
+  end
+end