adva 0.0.1 → 0.1.0

data/config/routes.rb

@@ -0,0 +1,56 @@
+Rails.application.routes.draw do
+  scope constraints: ->(req) { Site.count.zero? } do
+    get "/" => redirect("/admin/install")
+  end
+
+  scope :constraints => lambda { |req| Page.where(:permalink => req.params[:section_permalink]).exists? } do
+    get "/:section_permalink" => "articles#index", :as => :page
+    scope :constraints => lambda { |req| Article.where(:permalink => req.params[:permalink]).exists? } do
+      get "/:section_permalink/:permalink" => "articles#show", :as => :page_article
+    end
+  end
+
+  scope :constraints => lambda { |req|
+    Section.any? && begin
+      permalinks = Article.where(:section_id => Section.first.id).pluck(:permalink)
+      permalinks.include? req.fullpath[1..-1]
+    end
+  } do
+    get "/:permalink" => "articles#show"
+  end
+
+  get "/" => "articles#index", :as => :root
+
+  namespace :admin do
+    post "install" => "install#index"
+    get "install" => "install#index"
+
+    resources :sites
+    resource :site
+
+    resources :sections do
+      put "/", :action => "update_all", :on => :collection
+      resources :contents, :articles, :links, :categories do
+        put "/", :action => "update_all", :on => :collection
+      end
+    end
+
+    resources :pages do
+      scope :module => :page do
+        resources :contents, :articles, :links, :categories do
+          put "/", :action => "update_all", :on => :collection
+        end
+      end
+    end
+
+    resources :cells, :only => :index
+
+    resources :users
+  end
+
+  get "login" => "session#new"
+  delete "logout" => "session#destroy"
+
+  resource :session,     :controller => "session"
+  resource :password,    :controller => "password"
+end

data/db/migrate/20161227203152_add_timestamps_to_categories.rb

@@ -0,0 +1,6 @@
+class AddTimestampsToCategories < ActiveRecord::Migration
+  def change
+    add_column :categories, :created_at, :timestamp
+    add_column :categories, :updated_at, :timestamp
+  end
+end

data/doc/NOTES

@@ -125,9 +125,9 @@ apache multisite config http://www.appelsiini.net/2007/6/mephisto-multiple-site-
 
         page caching is turned off globally
         test_1 requires class MyModel caches_page :foo end
-        no after_filter is added
+        no after_action is added
         test_2 turns page caching on and requires class MyModel (which was already loaded, so requiring is skipped)
-        still no after_filter added so page caching does not kick in
+        still no after_action added so page caching does not kick in
 
     Asset Helpers: apparently they need a server restart to rebuild a cached file when it got deleted
 
@@ -139,8 +139,8 @@ apache multisite config http://www.appelsiini.net/2007/6/mephisto-multiple-site-
         class Role belongs_to :object, :polymorphic => true
         class Role::Admin < Role
 
-    force certain after_filters to be run even if the filter chain has been halted:
-        :after_filter => :bla, :force => true
+    force certain after_actions to be run even if the filter chain has been halted:
+        :after_action => :bla, :force => true
 
     section.articles.maximum(:position) returns nil when table is empty. shouldn't that be 0?
 
@@ -166,7 +166,7 @@ apache multisite config http://www.appelsiini.net/2007/6/mephisto-multiple-site-
     rational: controller specs should work and controllers behave correctly
     not matter if the plugin is installed or not
 
-    after_filter won't be called when the filter chain is halted. maybe an around_filter is a better choice?
+    after_action won't be called when the filter chain is halted. maybe an around_action is a better choice?
 
 # rspec
 

data/lib/action_controller/authenticate_anonymous.rb

@@ -0,0 +1,69 @@
+# Auto-registers and re-authenticates anonymous users based on a single token
+# that's stored in the session. This is for anonymous posting of blog comments,
+# editing wikipages etc. and allows to do such things as:
+#
+# * store user information in the user table (which keeps the model and db
+#   structure clean) and
+# * allow users to (e.g.) edit their comment based on this anonymous login.
+
+module ActionController
+  module AuthenticateAnonymous
+    def self.included(base)
+      base.extend ClassMethods
+    end
+
+    module ClassMethods
+      def authenticates_anonymous_user
+        return if authenticates_anonymous_user?
+        include InstanceMethods
+        prepend Module.new {
+          def current_user
+            @current_user ||= (super || login_or_register_anonymous)
+          end
+
+          def authenticated?
+            !!current_user and !current_user.anonymous?
+          end
+        }
+      end
+
+      def authenticates_anonymous_user?
+        included_modules.include? InstanceMethods
+      end
+    end
+
+    module InstanceMethods
+      def login_or_register_anonymous
+        anonymous = try_login_anonymous || User.anonymous
+        anonymous = register_or_update_anonymous anonymous if params[:user]
+        login_anonymous! anonymous if anonymous
+        anonymous
+      end
+
+      def try_login_anonymous
+        # try to authenticate if token is present
+        validate_token User, session[:anonymous_token] if session[:anonymous_token]
+      end
+
+      def register_or_update_anonymous(anonymous)
+        # if :name and :email params are passed either register a new Anonymous or update the existing one
+        anonymous.update params[:user].merge(request_info)
+        anonymous
+      end
+
+      def login_anonymous!(anonymous)
+        # set a new session token and expiration
+        token = anonymous.assign_token('anonymous', 3.hour.from_now)
+        anonymous.save
+        session[:anonymous_token] = "#{anonymous.id};#{token}"
+        cookies[:aid] = anonymous.id.to_s unless anonymous.new_record?
+      end
+
+      def request_info
+        { :ip      => request.env["REMOTE_ADDR"],
+          :agent   => request.env["HTTP_USER_AGENT"],
+          :referer => request.env["HTTP_REFERER"] }
+      end
+    end
+  end
+end

data/lib/action_controller/authenticate_user.rb

@@ -0,0 +1,203 @@
+module ActionController
+
+  # Module automatically mixed into the all controllers making the
+  # application of authentication easy. See
+  # Login::ControllerIntegration::ClassMethods for how to apply
+  # authentication.
+  module AuthenticateUser
+    def self.included(target)
+      target.extend(ClassMethods)
+      target.send(:include, InstanceMethods)
+      target.helper_method(:logged_in?, :authenticated?)
+    end
+
+    # Methods available as macro-style methods on any controller
+    module ClassMethods
+
+      # Sets up the controller so that authentication is required. If
+      # the user is not authenticated then they will be redirected to
+      # the login screen.
+      #
+      # The page requested will be saved so that once the login has
+      # occured they will be sent back to the page they first
+      # requested. If no page was requested (they went to the login
+      # page directly) then they will be directed to profiles/home
+      # after login which is a placeholder for the app to override.
+      #
+      # Options given are passed directly to the before_action method
+      # so feel free to provide :only and :except options.
+      def authentication_required
+        before_action :require_authentication
+      end
+
+      # Will remove authentication from certain actions. Options given
+      # are passed directly to skip_before_action so feel free to use
+      # :only and :except options.
+      #
+      # This method is useful in cases where you have locked down the
+      # entire application by putting authentication_required in your
+      # ApplicationController but then want to open an action back up
+      # in a specific controller.
+      def no_authentication_required
+        skip_before_action :require_authentication
+      end
+    end
+
+    # Methods callable from within actions
+    module InstanceMethods
+      def authenticate_user(credentials)
+        User.authenticate(credentials).tap do |user|
+          if user
+            # prevent session hijacking - unnecessary according to http://dev.rubyonrails.org/ticket/10108
+            # reset_session_except :return_location
+            session[:uid] = user.id
+            set_user_cookie!(user)
+          end
+        end
+      end
+
+      # Will retrieve the current_user. Will not force a login but
+      # simply load the current user if a person is logged in. If
+      # you need the user object loaded with extra options (such as
+      # eager loading) then create a private method called
+      # "user_find_options" on your controller that returns a hash
+      # of the find options you want.
+      #
+      # This method will also inform the models of the current user
+      # if the current user is logged in and the "User" class responds
+      # to the class method current_user=. This is a nice way to
+      # communciate the current user down to the model level for
+      # model-level security. This means you will want to call this
+      # method at least once before using the model-level security.
+      # Usually you will call it in a before filter. This method is
+      # called automatically when authentication_required is applied to
+      # an action.
+      def current_user
+        @current_user ||= begin
+          # Check for session[:uid] here? That would mean that for token auth the
+          # user always needs to be logged out (e.g. in UserController#create).
+          # Looks a bit more robust this way:
+          try_login
+          if session && session[:uid]
+            user = find_current_user
+            set_user_cookie!(user)
+            user
+          else
+            User.anonymous
+          end
+        end
+      end
+
+      def authenticated?
+        !current_user.anonymous?
+      end
+      alias :logged_in? :authenticated?
+
+      # killed this because it's just the wrong way to do it
+      #
+      # # Will store the current params so that we can return here on
+      # # successful login. If you want to redirect to the login yourself
+      # # (perhaps you are applying your own security instead of just
+      # # determining if the user is logged in) then you will want to
+      # # call this before issuing your redirect to the login screen.
+      # def store_return_location
+      #   session[:return_location] = params
+      # end
+
+      private
+
+        # Will actually test to see if the user is authorized
+        def require_authentication
+          # No matter what the app does a user can always login, forgot
+          # password and register. The controllers provided by this
+          # plugin alreaddy have these controllers/actions on an
+          # exception list but this prevents a mistake an overridden
+          # controller from preventing the normal login behavior.
+          %w(session password user).each do |c|
+  	        %w(new create).each do |a|
+              return if (controller_name == c) && (action_name == a)
+            end
+  	      end
+
+          # If we cannot get the current user store the requested page
+          # and send them to the login page.
+          if current_user.anonymous?
+            redirect_to login_url(:return_to => request.url) and false
+          end
+        end
+
+        def logout
+          reset_session
+          forget_me!
+        end
+
+        def forget_me!
+          cookies[:remember_me] = nil
+          cookies[:uid] = nil
+          cookies[:uname] = nil
+        end
+
+        def remember_me!
+          token = current_user.assign_token!('remember me')
+          cookies[:remember_me] = { :value => "#{current_user.id};#{token}", :expires => 10.years.from_now }
+        end
+
+        def set_user_cookie!(user = current_user)
+          unless user.anonymous?
+            cookies[:uid] = user.id.to_s
+            cookies[:uname] = user.name
+          end
+        end
+
+        # There are a few ways that a user can login without going through
+        # a login screen. These methods all rely on authenticating with
+        # the information given in the request. If any of these methods
+        # are successful then session[:uid] will be set with the current
+        # user id and current_user will return the current user
+        def try_login
+          if user = http_auth_login || validation_login || remember_me_login
+            session[:uid] = user.id
+          end
+        end
+
+        # Will attempt to authenticate with HTTP Auth. HTTP Auth will not
+        # be required. We are just checking if it is provided mainly for
+        # RESTful requests.
+        def http_auth_login
+          # FIXME: Implement
+        end
+
+        # Will use the URL param :token to see if we can do a token
+        # authentication.
+        def validation_login
+          validate_token User, params[:token]
+        end
+
+        # Will check for a :remember_me cookie for a token that will
+        # authenticate the user.
+        def remember_me_login
+          validate_token User, cookies[:remember_me]
+        end
+
+        # The tokens are stored in various places as id;token. This method
+        # will split that out and validate it. If everything is successful
+        # then the user object is returned. Otherwise nil is returned.
+        # The full token should be passed in.
+        def validate_token(klass, token, options = {})
+          return nil if token.blank?
+          return nil unless token =~ /\;/
+
+          uid, token = token.split ';'
+          if object = klass.find_by_id(uid)
+            return object if object.authenticate(token)
+          end
+          nil
+        end
+
+        def find_current_user
+          User.find_by_id(session[:uid])
+        end
+
+    end
+  end
+end

data/lib/active_record/belongs_to_author.rb

@@ -0,0 +1,48 @@
+require "active_record/belongs_to_cacheable"
+
+module ActiveRecord
+  module BelongsToAuthor
+    def self.included(base)
+      base.include BelongsToCacheable
+      base.extend ActMacro
+    end
+
+    module ActMacro
+      def belongs_to_user(*args)
+        options = args.extract_options!
+        args = (args.empty? ? [:user] : args)
+        belongs_to_cacheable *args.dup << options # FIXME should not be polymorphic!
+        
+        args.each do |name|
+          class_eval <<-code, __FILE__, __LINE__
+            def #{name}_ip
+              #{name}.ip if #{name} && #{name}.respond_to?(:ip)
+            end
+
+            def #{name}_agent
+              #{name}.agent if #{name} && #{name}.respond_to?(:agent)
+            end
+
+            def #{name}_referer
+              #{name}.referer if #{name} && #{name}.respond_to?(:referer)
+            end
+
+            def #{name}_link include_email: true
+              if include_email
+                %(<a href="mailto:\#{#{name}_email}">\#{#{name}_name}</a>).html_safe
+              else
+                #{name}_name
+              end
+            end
+          code
+        end
+      end
+
+      def belongs_to_author(*args)
+        options = args.extract_options!
+        args = (args.empty? ? [:author] : args) << options
+        belongs_to_user *args
+      end
+    end
+  end
+end

data/lib/adva/version.rb

@@ -1,3 +1,3 @@
 module Adva
-  VERSION = "0.0.1"
+  VERSION = "0.1.0"
 end

data/lib/adva.rb

@@ -1,5 +1,66 @@
-# require "adva/version"
+# require "adva_cms/version"
+require "rails"
+require "will_paginate"
+require "awesome_nested_set"
+require "actionpack/page_caching"
+
+require 'extensible_forms'
+require 'time_hacks'
+require 'core_ext'
+require 'rails_ext'
+require "rails-observers"
+
+# require 'menu'
+# require 'event'    # need to force these to be loaded now, so Rails won't
+# require 'registry' # reload them between requests (FIXME ... this doesn't seem to happen?)
+
+# config.to_prepare do
+#   Registry.set :redirect, {
+#     :login        => lambda { |c| c.send(:admin_sites_url) },
+#     :verify       => '/',
+#     :site_deleted => lambda { |c| c.send(:admin_sites_url) }
+#   }
+# end 
+# load vendored gems
+Dir["#{File.expand_path("#{File.dirname(__FILE__)}/../vendor/gems")}/**/lib"].each do |vendored_gem_path|
+  $: << vendored_gem_path
+end
+
+require "has_counter"
+require "belongs_to_cacheable"
+require "filtered_column"
+require "has_filter"
+require "simple_taggable"
+require "tags"
+require "table_builder"
+require "xss_terminate"
+require "authentication"
 
 module Adva
-  # Your code goes here...
+  class Engine < Rails::Engine
+    initializer "add assets to precompilation list" do |app|
+      app.config.assets.precompile += %w(adva_cms/application.js)
+      app.config.assets.precompile += %w(adva_cms/admin.css adva_cms/admin/activities.css)
+      app.config.assets.precompile += %w(admin.css admin.js)
+    end
+
+    initializer "setup xss_terminate" do
+      XssTerminate.untaint_after_find = true
+    end
+
+    initializer "adva_user.init" do
+      ActionController::Base.send :include, ActionController::AuthenticateUser
+      ActionController::Base.send :include, ActionController::AuthenticateAnonymous
+      ActiveRecord::Base.send :include, ActiveRecord::BelongsToAuthor
+      ActionView::Base.send :include, Login::HelperIntegration
+
+      Event.observers << 'PasswordMailer'
+    end
+  end
 end
+
+require "action_controller/authenticate_user"
+require "action_controller/authenticate_anonymous"
+require "active_record/belongs_to_author"
+require "login/helper_integration"
+