agentcode 0.9.0

data/lib/agentcode/blueprint/generators/policy_generator.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module AgentCode
+  module Blueprint
+    module Generators
+      # Generates fully working Ruby policy classes with role-based attribute permissions.
+      # Port of agentcode-adonis-server policy_generator.ts.
+      class PolicyGenerator
+        # Generate a complete policy class.
+        #
+        # @param blueprint [Hash] ParsedBlueprint
+        # @return [String] Ruby source code
+        def generate(blueprint)
+          model_name = blueprint[:model]
+          slug = blueprint[:slug]
+          permissions = blueprint[:permissions]
+
+          show_method = build_permitted_attributes_method("permitted_attributes_for_show", permissions, :show_fields)
+          hidden_method = build_hidden_attributes_method(permissions)
+          create_method = build_permitted_attributes_method("permitted_attributes_for_create", permissions, :create_fields)
+          update_method = build_permitted_attributes_method("permitted_attributes_for_update", permissions, :update_fields)
+
+          <<~RUBY
+            # frozen_string_literal: true
+
+            class #{model_name}Policy < AgentCode::ResourcePolicy
+              self.resource_slug = '#{slug}'
+
+            #{show_method}
+            #{hidden_method}
+            #{create_method}
+            #{update_method}
+            end
+          RUBY
+        end
+
+        # Group roles with identical field sets into combined conditions.
+        #
+        # @param permissions [Hash<String, Hash>]
+        # @param field_key [Symbol] :show_fields, :create_fields, etc.
+        # @return [Array<Hash>] [{ fields: [...], roles: [...] }, ...]
+        def group_roles_by_fields(permissions, field_key)
+          groups = {}
+
+          permissions.each do |role, perm|
+            fields = perm[field_key] || []
+            next if fields.empty?
+
+            key = fields.sort.join(",")
+            groups[key] ||= { fields: fields, roles: [] }
+            groups[key][:roles] << role
+          end
+
+          groups.values
+        end
+
+        # Build a role condition string.
+        #
+        # @param roles [Array<String>]
+        # @return [String] e.g. "has_role?(user, 'admin') || has_role?(user, 'editor')"
+        def build_role_condition(roles)
+          roles.map { |r| "has_role?(user, '#{r}')" }.join(" || ")
+        end
+
+        # Convert field array to Ruby array literal.
+        #
+        # @param fields [Array<String>]
+        # @return [String]
+        def fields_to_ruby_array(fields)
+          return "[]" if fields.empty?
+          return "['*']" if fields == ["*"]
+
+          items = fields.map { |f| "'#{f}'" }
+          inline = "[#{items.join(', ')}]"
+
+          if inline.length <= 80
+            inline
+          else
+            lines = items.join(",\n        ")
+            "[\n        #{lines},\n      ]"
+          end
+        end
+
+        # Build a permitted_attributes method body.
+        #
+        # @param method_name [String]
+        # @param permissions [Hash<String, Hash>]
+        # @param field_key [Symbol]
+        # @return [String]
+        def build_permitted_attributes_method(method_name, permissions, field_key)
+          groups = group_roles_by_fields(permissions, field_key)
+
+          if groups.empty?
+            return <<~RUBY.chomp
+                def #{method_name}(user)
+                  ['*']
+                end
+            RUBY
+          end
+
+          lines = []
+          lines << "  def #{method_name}(user)"
+
+          groups.each do |group|
+            condition = build_role_condition(group[:roles])
+            array_str = fields_to_ruby_array(group[:fields])
+            lines << "    return #{array_str} if #{condition}"
+          end
+
+          lines << "    []"
+          lines << "  end"
+
+          lines.join("\n")
+        end
+
+        # Build the hidden_attributes_for_show method.
+        #
+        # @param permissions [Hash<String, Hash>]
+        # @return [String]
+        def build_hidden_attributes_method(permissions)
+          # Filter to only roles with hidden_fields
+          hidden_perms = permissions.select { |_, perm| perm[:hidden_fields]&.any? }
+
+          if hidden_perms.empty?
+            return <<~RUBY.chomp
+                def hidden_attributes_for_show(user)
+                  []
+                end
+            RUBY
+          end
+
+          groups = group_roles_by_fields(
+            hidden_perms.transform_values { |p| { show_fields: p[:hidden_fields] } },
+            :show_fields
+          )
+
+          lines = []
+          lines << "  def hidden_attributes_for_show(user)"
+
+          groups.each do |group|
+            condition = build_role_condition(group[:roles])
+            array_str = fields_to_ruby_array(group[:fields])
+            lines << "    return #{array_str} if #{condition}"
+          end
+
+          lines << "    []"
+          lines << "  end"
+
+          lines.join("\n")
+        end
+      end
+    end
+  end
+end

data/lib/agentcode/blueprint/generators/seeder_generator.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+module AgentCode
+  module Blueprint
+    module Generators
+      # Generates seeder files for roles and users with aggregated permissions.
+      # Port of agentcode-adonis-server seeder_generator.ts.
+      class SeederGenerator
+        ALL_ACTIONS = %w[index show store update destroy trashed restore forceDelete].freeze
+
+        # Generate a RoleSeeder file for multi-tenant apps.
+        #
+        # @param roles [Hash<String, Hash>]
+        # @return [String] Ruby source code
+        def generate_role_seeder(roles)
+          role_entries = roles.map do |slug, role|
+            desc = role[:description].gsub("'", "\\\\'")
+            <<~RUBY.chomp
+                Role.find_or_create_by!(slug: '#{slug}') do |r|
+                  r.name = '#{role[:name]}'
+                  r.description = '#{desc}'
+                end
+            RUBY
+          end.join("\n\n")
+
+          <<~RUBY
+            # frozen_string_literal: true
+
+
+            #{role_entries}
+          RUBY
+        end
+
+        # Generate a UserRoleSeeder file for multi-tenant apps.
+        #
+        # @param roles [Hash<String, Hash>]
+        # @param aggregated_permissions [Hash<String, Array<String>>]
+        # @return [String] Ruby source code
+        def generate_user_role_seeder(roles, aggregated_permissions)
+          user_entries = roles.map do |slug, role|
+            permissions = aggregated_permissions[slug] || []
+            perm_str = permissions_to_ruby_array(permissions)
+
+            <<~RUBY.chomp
+                # #{role[:name]}
+                #{slug}_user = User.find_or_create_by!(email: '#{slug}@demo.com') do |u|
+                  u.password = 'password'
+                end
+                #{slug}_role = Role.find_by!(slug: '#{slug}')
+                UserRole.find_or_create_by!(
+                  user: #{slug}_user,
+                  organization: org,
+                  role: #{slug}_role
+                ) do |ur|
+                  ur.permissions = #{perm_str}
+                end
+            RUBY
+          end.join("\n\n")
+
+          <<~RUBY
+            # frozen_string_literal: true
+
+
+            org = Organization.find_or_create_by!(slug: 'demo-org') do |o|
+              o.name = 'Demo Organization'
+            end
+
+            #{user_entries}
+          RUBY
+        end
+
+        # Generate a UserPermissionSeeder file for non-tenant apps.
+        #
+        # @param roles [Hash<String, Hash>]
+        # @param aggregated_permissions [Hash<String, Array<String>>]
+        # @return [String] Ruby source code
+        def generate_user_permission_seeder(roles, aggregated_permissions)
+          user_entries = roles.map do |slug, role|
+            permissions = aggregated_permissions[slug] || []
+            perm_str = permissions_to_ruby_array(permissions)
+
+            <<~RUBY.chomp
+                # #{role[:name]}
+                User.find_or_create_by!(email: '#{slug}@demo.com') do |u|
+                  u.password = 'password'
+                  u.permissions = #{perm_str}
+                end
+            RUBY
+          end.join("\n\n")
+
+          <<~RUBY
+            # frozen_string_literal: true
+
+
+            #{user_entries}
+          RUBY
+        end
+
+        # Aggregate permissions from multiple blueprints.
+        # Returns { role_slug => ['model.action', ...] } with wildcard simplification.
+        #
+        # @param blueprints [Array<Hash>]
+        # @return [Hash<String, Array<String>>]
+        def aggregate_permissions(blueprints)
+          result = {}
+
+          blueprints.each do |blueprint|
+            slug = blueprint[:slug]
+
+            blueprint[:permissions].each do |role, perm|
+              result[role] ||= Set.new
+
+              has_all = ALL_ACTIONS.all? { |a| perm[:actions].include?(a) }
+
+              if has_all
+                result[role].add("#{slug}.*")
+              else
+                perm[:actions].each { |action| result[role].add("#{slug}.#{action}") }
+              end
+            end
+          end
+
+          # Simplify: if a role has wildcard on ALL models → ['*']
+          model_slugs = blueprints.map { |b| b[:slug] }
+          final_result = {}
+
+          result.each do |role, perms|
+            perm_array = perms.to_a.sort
+
+            has_all_wildcards = model_slugs.all? { |s| perms.include?("#{s}.*") }
+
+            if has_all_wildcards && model_slugs.any?
+              final_result[role] = ["*"]
+            else
+              final_result[role] = perm_array
+            end
+          end
+
+          final_result
+        end
+
+        # Convert permission array to Ruby array literal.
+        def permissions_to_ruby_array(permissions)
+          return "[]" if permissions.empty?
+          return "['*']" if permissions.length == 1 && permissions[0] == "*"
+
+          items = permissions.map { |p| "'#{p}'" }
+          inline = "[#{items.join(', ')}]"
+
+          if inline.length <= 80
+            inline
+          else
+            lines = items.join(",\n        ")
+            "[\n        #{lines},\n      ]"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/agentcode/blueprint/generators/test_generator.rb

@@ -0,0 +1,291 @@
+# frozen_string_literal: true
+
+module AgentCode
+  module Blueprint
+    module Generators
+      # Generates RSpec request spec files with per-role contexts and individual action tests.
+      class TestGenerator
+        ALL_ACTIONS = %w[index show store update destroy trashed restore forceDelete].freeze
+
+        ACTION_LABELS = {
+          "index" => "list",
+          "show" => "show",
+          "store" => "create",
+          "update" => "update",
+          "destroy" => "delete",
+          "trashed" => "view trashed",
+          "restore" => "restore",
+          "forceDelete" => "force delete"
+        }.freeze
+
+        def generate(blueprint, is_multi_tenant, org_identifier = "slug")
+          model = blueprint[:model]
+          slug = blueprint[:slug]
+          permissions = blueprint[:permissions]
+          columns = blueprint[:columns]
+          factory_name = model_to_factory(model)
+
+          role_contexts = build_role_contexts(slug, factory_name, permissions, columns, is_multi_tenant, org_identifier)
+
+          if is_multi_tenant
+            wrap_multi_tenant(model, slug, role_contexts, org_identifier)
+          else
+            wrap_non_tenant(model, slug, role_contexts)
+          end
+        end
+
+        def actions_to_permissions(actions, slug)
+          if (ALL_ACTIONS - actions).empty?
+            "['#{slug}.*']"
+          else
+            items = actions.map { |a| "'#{slug}.#{a}'" }
+            "[#{items.join(', ')}]"
+          end
+        end
+
+        private
+
+        def model_to_factory(model)
+          model.gsub(/([a-z])([A-Z])/, '\1_\2').downcase
+        end
+
+        def build_role_contexts(slug, factory_name, permissions, columns, is_multi_tenant, org_identifier)
+          return "" if permissions.empty?
+
+          all_defined_actions = permissions.values.flat_map { |p| p[:actions] }.uniq & ALL_ACTIONS
+          lines = []
+
+          permissions.each do |role, perm|
+            allowed = perm[:actions] & all_defined_actions
+            blocked = all_defined_actions - perm[:actions]
+
+            lines << "    context 'as #{role}' do"
+            lines << build_let_user(role, perm[:actions], slug, is_multi_tenant, org_identifier)
+            lines << build_let_record(factory_name, is_multi_tenant)
+            lines << ""
+
+            # Individual allowed action tests
+            allowed.each do |action|
+              lines << build_single_action_test(slug, action, is_multi_tenant, org_identifier, true)
+              lines << ""
+            end
+
+            # Individual blocked action tests
+            blocked.each do |action|
+              lines << build_single_action_test(slug, action, is_multi_tenant, org_identifier, false)
+              lines << ""
+            end
+
+            # Field visibility tests
+            field_test = build_field_visibility_test(slug, role, perm, columns, is_multi_tenant, org_identifier)
+            if field_test
+              lines << field_test
+              lines << ""
+            end
+
+            # Forbidden field tests
+            forbidden_test = build_forbidden_field_test(slug, role, perm, columns, is_multi_tenant, org_identifier)
+            if forbidden_test
+              lines << forbidden_test
+              lines << ""
+            end
+
+            lines << "    end"
+            lines << ""
+          end
+
+          lines.join("\n")
+        end
+
+        def build_let_user(role, actions, slug, is_multi_tenant, org_identifier)
+          perms = actions_to_permissions(actions, slug)
+          if is_multi_tenant
+            "      let(:user) { create_user_with_role('#{role}', org, #{perms}) }"
+          else
+            "      let(:user) { create_user_with_permissions(#{perms}) }"
+          end
+        end
+
+        def build_let_record(factory_name, is_multi_tenant)
+          if is_multi_tenant
+            "      let(:record) { create(:#{factory_name}, organization: org) }"
+          else
+            "      let(:record) { create(:#{factory_name}) }"
+          end
+        end
+
+        def build_single_action_test(slug, action, is_multi_tenant, org_identifier, expect_success)
+          id_actions = %w[show update destroy restore forceDelete]
+          needs_id = id_actions.include?(action)
+          needs_discard = %w[restore forceDelete].include?(action)
+
+          action_methods = {
+            "index" => "get", "show" => "get", "store" => "post",
+            "update" => "put", "destroy" => "delete", "trashed" => "get",
+            "restore" => "post", "forceDelete" => "delete"
+          }
+
+          action_path_suffix = {
+            "index" => "", "show" => "/\#{record.id}", "store" => "",
+            "update" => "/\#{record.id}", "destroy" => "/\#{record.id}",
+            "trashed" => "/trashed", "restore" => "/\#{record.id}/restore",
+            "forceDelete" => "/\#{record.id}/force-delete"
+          }
+
+          success_codes = { "store" => ":created", "destroy" => ":no_content", "forceDelete" => ":no_content" }
+          default_success = ":ok"
+
+          http_method = action_methods[action]
+          suffix = action_path_suffix[action]
+          return "" unless http_method
+
+          label = ACTION_LABELS[action] || action
+
+          if is_multi_tenant
+            url = "\"/api/\#{org.#{org_identifier}}/#{slug}#{suffix}\""
+          else
+            url = "\"/api/#{slug}#{suffix}\""
+          end
+
+          if expect_success
+            code = success_codes[action] || default_success
+            verb = "can"
+          else
+            code = ":forbidden"
+            verb = "cannot"
+          end
+
+          lines = []
+          lines << "      it '#{verb} #{label} #{slug}' do"
+          lines << "        record.discard" if needs_discard
+          lines << "        #{http_method} #{url}, headers: auth_headers(user)"
+          if expect_success && action == "store"
+            lines << "        expect(response.status).not_to eq(403)"
+          else
+            lines << "        expect(response).to have_http_status(#{code})"
+          end
+          lines << "      end"
+          lines.join("\n")
+        end
+
+        def build_field_visibility_test(slug, role, perm, columns, is_multi_tenant, org_identifier)
+          return nil unless perm[:actions].include?("show")
+          return nil if perm[:show_fields] == ["*"]
+          return nil if perm[:show_fields].empty?
+
+          all_fields = columns.map { |c| c[:name] }
+          visible = perm[:show_fields].include?("*") ? all_fields : perm[:show_fields]
+          hidden = all_fields - visible + (perm[:hidden_fields] || [])
+          hidden = hidden.uniq - visible
+
+          return nil if hidden.empty? && visible.empty?
+
+          lines = []
+          lines << "      it 'shows only permitted fields' do"
+
+          if is_multi_tenant
+            lines << "        get \"/api/\#{org.#{org_identifier}}/#{slug}/\#{record.id}\", headers: auth_headers(user)"
+          else
+            lines << "        get \"/api/#{slug}/\#{record.id}\", headers: auth_headers(user)"
+          end
+
+          lines << "        expect(response).to have_http_status(:ok)"
+          lines << "        data = JSON.parse(response.body)"
+          lines << ""
+
+          visible.each do |field|
+            lines << "        expect(data).to have_key('#{field}')"
+          end
+
+          if hidden.any?
+            lines << ""
+            hidden.each do |field|
+              lines << "        expect(data).not_to have_key('#{field}')"
+            end
+          end
+
+          lines << "      end"
+          lines.join("\n")
+        end
+
+        def build_forbidden_field_test(slug, role, perm, columns, is_multi_tenant, org_identifier)
+          return nil unless perm[:actions].include?("store")
+          return nil if perm[:create_fields] == ["*"]
+          return nil if perm[:create_fields].empty?
+
+          all_fields = columns.map { |c| c[:name] }
+          forbidden = all_fields - perm[:create_fields]
+
+          return nil if forbidden.empty?
+
+          lines = []
+          lines << "      it 'returns 403 when setting restricted fields' do"
+
+          if is_multi_tenant
+            lines << "        post \"/api/\#{org.#{org_identifier}}/#{slug}\","
+          else
+            lines << "        post \"/api/#{slug}\","
+          end
+
+          lines << "          params: { #{forbidden.first}: 'forbidden_value' },"
+          lines << "          headers: auth_headers(user)"
+          lines << ""
+          lines << "        expect(response).to have_http_status(:forbidden)"
+          lines << "      end"
+          lines.join("\n")
+        end
+
+        def wrap_multi_tenant(model, slug, role_contexts, org_identifier)
+          <<~RUBY
+            # frozen_string_literal: true
+
+            require 'rails_helper'
+
+            RSpec.describe '#{model} — CRUD & Permissions', type: :request do
+              let(:org) { create(:organization) }
+
+              def create_user_with_role(role_slug, organization, permissions)
+                user = create(:user)
+                role = Role.find_or_create_by!(slug: role_slug, name: role_slug.capitalize)
+                UserRole.find_or_create_by!(
+                  user: user,
+                  organization: organization,
+                  role: role
+                ) do |ur|
+                  ur.permissions = permissions
+                end
+                user
+              end
+
+              def auth_headers(user)
+                { 'Authorization' => "Bearer \#{user.api_token}" }
+              end
+
+            #{role_contexts}
+            end
+          RUBY
+        end
+
+        def wrap_non_tenant(model, slug, role_contexts)
+          <<~RUBY
+            # frozen_string_literal: true
+
+            require 'rails_helper'
+
+            RSpec.describe '#{model} — CRUD & Permissions', type: :request do
+              def create_user_with_permissions(permissions)
+                create(:user, permissions: permissions)
+              end
+
+              def auth_headers(user)
+                { 'Authorization' => "Bearer \#{user.api_token}" }
+              end
+
+            #{role_contexts}
+            end
+          RUBY
+        end
+      end
+    end
+  end
+end

data/lib/agentcode/blueprint/manifest_manager.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "json"
+
+module AgentCode
+  module Blueprint
+    # Tracks file hashes and generated files for change detection.
+    # Port of agentcode-server ManifestManager.php / agentcode-adonis-server manifest_manager.ts.
+    class ManifestManager
+      def initialize(blueprints_dir)
+        @manifest_path = File.join(blueprints_dir, ".blueprint-manifest.json")
+        @manifest = load_manifest
+      end
+
+      # Check if a blueprint file has changed since last generation.
+      def has_changed?(filename, current_hash)
+        entry = @manifest.dig("files", filename)
+        return true unless entry
+
+        entry["content_hash"] != current_hash
+      end
+
+      # Record a successful generation.
+      def record_generation(filename, content_hash, generated_files)
+        @manifest["files"][filename] = {
+          "content_hash" => content_hash,
+          "generated_files" => generated_files,
+          "generated_at" => Time.now.iso8601
+        }
+        @manifest["generated_at"] = Time.now.iso8601
+      end
+
+      # Get the list of generated files for a blueprint.
+      def get_generated_files(filename)
+        @manifest.dig("files", filename, "generated_files") || []
+      end
+
+      # Get all tracked blueprint filenames.
+      def get_tracked_files
+        @manifest["files"].keys
+      end
+
+      # Remove tracking for a blueprint file.
+      def remove_tracking(filename)
+        @manifest["files"].delete(filename)
+      end
+
+      # Save manifest to disk.
+      def save
+        File.write(@manifest_path, JSON.pretty_generate(@manifest))
+      end
+
+      # Load manifest from disk, returning empty structure if missing or corrupted.
+      def load_manifest
+        return empty_manifest unless File.exist?(@manifest_path)
+
+        begin
+          parsed = JSON.parse(File.read(@manifest_path))
+
+          if parsed.is_a?(Hash) && parsed["version"] && parsed["files"]
+            parsed
+          else
+            empty_manifest
+          end
+        rescue JSON::ParserError
+          empty_manifest
+        end
+      end
+
+      private
+
+      def empty_manifest
+        {
+          "version" => 1,
+          "generated_at" => Time.now.iso8601,
+          "files" => {}
+        }
+      end
+    end
+  end
+end