alchemy_cms 8.3.10 → 8.4.0

data/app/components/alchemy/ingredients/boolean_editor.rb

@@ -14,6 +14,7 @@ module Alchemy
               render_hint_for(ingredient, size: "1x", fixed_width: false)
             ])
           }
+          concat validation_error
         end
       end
     end

data/app/components/alchemy/ingredients/color_editor.rb

@@ -4,18 +4,21 @@ module Alchemy
   module Ingredients
     class ColorEditor < BaseEditor
       def input_field
-        content_tag("alchemy-color-select") do
-          if colors.none?
+        if colors.none?
+          content_tag("alchemy-color-input", class: "color-select") do
             concat text_field_tag(
               form_field_name,
               value,
               disabled: !editable?
             )
             concat color_field_tag(nil, value, disabled: disabled?)
-          else
+          end
+        else
+          content_tag("div", class: "color-select") do
             concat select_tag(
               form_field_name,
               color_options.join.html_safe,
+              is: "alchemy-color-select",
               disabled: !editable?
             )
             concat color_field_tag(form_field_name, value, disabled: disabled?)

data/app/components/alchemy/ingredients/datetime_view.rb

@@ -17,7 +17,7 @@ module Alchemy
         if date_format == "rfc822"
           datetime.to_fs(:rfc822)
         else
-          ::I18n.l(datetime, format: date_format)
+          Alchemy.l(datetime, format: date_format)
         end.html_safe
       end
     end

data/app/components/alchemy/ingredients/picture_view.rb

@@ -96,10 +96,8 @@ module Alchemy
       end
 
       def srcset_options
-        srcset.map do |size|
-          url = ingredient.picture_url(size: size)
-          width, height = size.split("x")
-          width.present? ? "#{url} #{width}w" : "#{url} #{height}h"
+        ingredient.picture_srcset_options(srcset).map do |source|
+          "#{source[:url]} #{source[:desc]}"
         end
       end
 

data/app/components/alchemy/menubar.html.erb

@@ -0,0 +1,157 @@
+<alchemy-menubar>
+  <template>
+    <style>
+      .menubar {
+        --icon-size: 24px;
+        --panel-width: 525px;
+        --border-radius: 3px;
+        --left-offset: 0px;
+        display: flex;
+        position: fixed;
+        top: 0;
+        left: calc(-1 * (var(--panel-width) - var(--left-offset)));
+        z-index: 10000;
+        background-color: #214166cc;
+        backdrop-filter: blur(3px);
+        transition: left 0.25s cubic-bezier(0.23, 1, 0.32, 1), background-color .2s linear , backdrop-filter .2s linear;
+        box-shadow: 0 0 0 1px #ffffff80;
+        box-sizing: border-box;
+        border-bottom-right-radius: var(--border-radius);
+        padding: 12px 16px 12px 12px;
+        gap: 12px;
+        justify-content: space-between;
+        align-items: center;
+        flex-wrap: nowrap;
+        overflow: hidden;
+        font-family: "Open Sans", "Lucida Grande", "Lucida Sans Unicode",
+          "Lucida Sans", Verdana, Tahoma, sans-serif;
+        font-size: 13px;
+        line-height: normal;
+
+        &:hover {
+          background-color: #214166;
+        }
+      }
+
+      .menubar * {
+        box-sizing: border-box;
+        margin: 0;
+        padding: 0;
+      }
+
+      .menubar:hover,
+      .menubar:focus-within,
+      .menubar.is-open {
+        left: 0;
+      }
+
+      .menubar > svg {
+        width: var(--icon-size);
+        height: var(--icon-size);
+        flex-shrink: 0;
+        margin-left: 4px;
+      }
+
+      .menubar .button {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        gap: 8px;
+        font-size: inherit;
+        font-weight: 700;
+        cursor: pointer;
+        border-radius: var(--border-radius);
+        background-color: transparent;
+        border: 1px solid rgba(255, 255, 255, 0.5);
+        color: #fff;
+        margin: 0;
+        padding: 0.75em 1.5em;
+        appearance: none;
+        transition: all 250ms;
+        -webkit-font-smoothing: antialiased;
+        -moz-osx-font-smoothing: grayscale;
+        text-decoration: none;
+        white-space: nowrap;
+      }
+
+      .menubar .button:hover {
+        text-decoration: none;
+        background-color: rgba(0, 0, 0, 0.25);
+        border-color: rgba(255, 255, 255, 0.75)
+      }
+
+      .menubar .button:active {
+        box-shadow: inset 0px 1px 1px -1px #333;
+      }
+
+      .menubar .button:focus {
+        outline: solid 2px #eca96e;
+        outline-offset: 2px;
+      }
+    </style>
+
+    <div class="menubar" data-turbo="false">
+      <%= link_to alchemy.admin_dashboard_url, class: "button" do %>
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="16" height="16" fill="currentColor">
+          <path d="M7.82843 10.9999H20V12.9999H7.82843L13.1924 18.3638L11.7782 19.778L4 11.9999L11.7782 4.22168L13.1924 5.63589L7.82843 10.9999Z"></path>
+        </svg>
+        <%= Alchemy.t(:to_alchemy) %>
+      <% end %>
+      <%= link_to alchemy.edit_admin_page_url(page), class: "button" do %>
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="16" height="16" fill="currentColor">
+          <path d="M6.41421 15.89L16.5563 5.74785L15.1421 4.33363L5 14.4758V15.89H6.41421ZM7.24264 17.89H3V13.6473L14.435 2.21231C14.8256 1.82179 15.4587 1.82179 15.8492 2.21231L18.6777 5.04074C19.0682 5.43126 19.0682 6.06443 18.6777 6.45495L7.24264 17.89ZM3 19.89H21V21.89H3V19.89Z"></path>
+        </svg>
+        <%= Alchemy.t(:edit_page) %>
+      <% end %>
+      <%= form_tag Alchemy.config.logout_path, method: Alchemy.config.logout_method do %>
+        <%= button_tag class: "button" do %>
+          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="16" height="16" fill="currentColor">
+            <path d="M5 22C4.44772 22 4 21.5523 4 21V3C4 2.44772 4.44772 2 5 2H19C19.5523 2 20 2.44772 20 3V6H18V4H6V20H18V18H20V21C20 21.5523 19.5523 22 19 22H5ZM18 16V13H11V11H18V8L23 12L18 16Z"></path>
+          </svg>
+          <%= Alchemy.t(:logout) %>
+        <% end %>
+      <% end %>
+      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30">
+        <path fill="#fff" d="M15.7 7.9L9.9 2.2 2.1 4.3 0 12.1l5.7 5.8 7.8-2.1 2.2-7.9zm-5.3 10.3l-1.2 4.4 3.2 3.2 4.4-1.2 1.2-4.4-3.2-3.2-4.4 1.2zM23.5 7.3L17.2 9l-1.7 6.2 4.5 4.6 6.2-1.7 1.7-6.2-4.4-4.6z" />
+      </svg>
+    </div>
+  </template>
+
+  <%= tag.script(type: "module", data: {turbo_eval: false}, nonce: helpers.content_security_policy_nonce) do %>
+    class Menubar extends HTMLElement {
+      connectedCallback() {
+        const template = this.querySelector("template")
+        const attachedShadowRoot = this.attachShadow({ mode: "open" })
+        attachedShadowRoot.appendChild(template.content.cloneNode(true))
+        const width = this.bar.offsetWidth
+        this.bar.style = `--panel-width: ${width}px; --left-offset: calc(var(--icon-size) + 32px);`
+        this.bar.addEventListener("touchstart", this, { passive: false })
+        document.addEventListener("touchstart", this, { passive: true })
+      }
+
+      handleEvent(event) {
+        // click on menubar
+        if (event.currentTarget === this.bar) {
+          if (!this.bar.classList.contains("is-open")) {
+            event.preventDefault()
+            this.bar.classList.add("is-open")
+          }
+        // click outside of menubar
+        } else if (!event.composedPath().includes(this.bar)) {
+          this.bar.classList.remove("is-open")
+        }
+      }
+
+      disconnectedCallback() {
+        this.bar.removeEventListener("touchstart", this)
+        document.removeEventListener("touchstart", this)
+      }
+
+      get bar() {
+        return this.shadowRoot.querySelector(".menubar")
+      }
+    }
+
+    customElements.define("alchemy-menubar", Menubar)
+  <% end %>
+</alchemy-menubar>

data/app/components/alchemy/menubar.rb

@@ -0,0 +1,15 @@
+module Alchemy
+  class Menubar < ViewComponent::Base
+    attr_reader :page
+
+    delegate :alchemy, :can?, to: :helpers
+
+    def initialize(page: Alchemy::Current.page)
+      @page = page
+    end
+
+    def render?
+      page && !Alchemy::Current.preview_page? && can?(:edit_content, page)
+    end
+  end
+end

data/app/controllers/alchemy/admin/attachments_controller.rb

@@ -6,16 +6,19 @@ module Alchemy
       include UploaderResponses
       include ArchiveOverlay
 
-      add_alchemy_filter :by_file_type, type: :select, options: ->(_query, params) do
-        case params&.to_h
-        in {except:}
-          Attachment.file_types - Attachment.file_types(from_extensions: except)
-        in {only:}
-          Attachment.file_types(from_extensions: only)
-        else
-          Attachment.file_types
+      add_alchemy_filter :by_file_type, type: :select,
+        multiple: ->(params) { params[:only].presence&.many? || params[:except].present? },
+        include_blank: ->(params) { params[:only].blank? && params[:except].blank? },
+        options: ->(_query, params) do
+          case params&.to_h
+          in {except:}
+            Attachment.file_types - Attachment.file_types(from_extensions: except)
+          in {only:}
+            Attachment.file_types(from_extensions: only)
+          else
+            Attachment.file_types
+          end
         end
-      end
 
       add_alchemy_filter :recent, type: :checkbox
       add_alchemy_filter :last_upload, type: :checkbox

data/app/controllers/alchemy/admin/base_controller.rb

@@ -2,15 +2,19 @@
 
 module Alchemy
   module Admin
+    # Turbo Frame id wrapping admin dialog content. A form inside submits into
+    # this frame, so its request carries the id and the server can tell a dialog
+    # submission apart from the same form rendered on its own page.
+    DIALOG_FRAME_ID = "alchemy_dialog_frame"
+
     class BaseController < Alchemy::BaseController
       include Userstamp
       include Locale
       include Timezone
+      include CspProtection
 
       before_action :load_locked_pages
 
-      helper_method :is_admin?
-
       check_authorization
 
       rescue_from Exception do |exception|
@@ -27,11 +31,15 @@ module Alchemy
 
       def leave
         authorize! :leave, :alchemy_admin
-        render template: "/alchemy/admin/leave", layout: !request.xhr?
+        render template: "/alchemy/admin/leave", layout: !turbo_frame_request?
       end
 
       private
 
+      # Controllers of the host application can inherit from this class, and
+      # their views would not be ours to make assumptions about.
+      def apply_content_security_policy? = controller_path.start_with?("alchemy/")
+
       def safe_redirect_path(path = params[:redirect_to], fallback: admin_path)
         if is_safe_redirect_path?(path)
           path
@@ -53,9 +61,19 @@ module Alchemy
         URI(referer).path
       end
 
-      # Disable layout rendering for xhr requests.
+      # Disable layout rendering for Turbo Frame requests.
+      #
+      # Content requested by the dialog's Turbo Frame is wrapped in that frame,
+      # so Turbo can render it. Only the dialog's own request carries this
+      # frame id, so the same action rendered as a full page stays unwrapped.
       def set_layout
-        (request.xhr? || turbo_frame_request?) ? false : "alchemy/admin"
+        if turbo_frame_request_id == DIALOG_FRAME_ID
+          "alchemy/admin/dialog"
+        elsif turbo_frame_request?
+          false
+        else
+          "alchemy/admin"
+        end
       end
 
       # Handles exceptions
@@ -72,8 +90,6 @@ module Alchemy
         @notice = error.message[0..255]
         if request.format.json?
           render json: {message: @notice}, status: 500
-        elsif request.xhr?
-          render action: "error_notice"
         else
           @trace = error.backtrace[0..50]
           render "500", status: 500
@@ -92,13 +108,6 @@ module Alchemy
         end
       end
 
-      # Returns true if the current_alchemy_user (The logged-in Alchemy User) has the admin role.
-      def is_admin?
-        return false if !current_alchemy_user
-
-        current_alchemy_user.admin?
-      end
-
       # Displays errors in a #errors div if any errors are present on the object.
       # Or redirects to the given redirect url.
       #
@@ -122,16 +131,20 @@ module Alchemy
       #
       def do_redirect_to(url_or_path)
         redirect_path = safe_redirect_path(url_or_path)
+        # A dialog form submits into the dialog frame, so a redirect would be
+        # followed inside it and render the target page within the dialog. Let
+        # the dialog close itself and visit the destination instead.
+        if turbo_frame_request_id == DIALOG_FRAME_ID
+          return render(turbo_stream: helpers.turbo_stream_action_tag(
+            :dialog_visit, url: redirect_path
+          ))
+        end
         respond_to do |format|
-          format.js do
-            @redirect_url = redirect_path
-            render :redirect
-          end
           format.turbo_stream do
-            redirect_to(redirect_path, allow_other_host: false)
+            redirect_to(redirect_path, allow_other_host: false, status: :see_other)
           end
           format.html do
-            redirect_to(redirect_path, allow_other_host: false)
+            redirect_to(redirect_path, allow_other_host: false, status: :see_other)
           end
         end
       end
@@ -150,7 +163,7 @@ module Alchemy
       end
 
       def load_locked_pages
-        @locked_pages = Page.locked_by(current_alchemy_user).order(:locked_at)
+        @locked_pages ||= current_alchemy_user&.locked_pages
       end
 
       # Returns the current site for admin controllers.

data/app/controllers/alchemy/admin/dashboard_controller.rb

@@ -15,6 +15,10 @@ module Alchemy
           Requesting `admin/dashboard/info` is deprecated. Please render Alchemy::Admin::Dashboard::Widgets::SystemInfo instead.
         WARN
       end
+
+      def license
+        @license = Alchemy::Engine.root.join("LICENSE").read
+      end
     end
   end
 end

data/app/controllers/alchemy/admin/elements_controller.rb

@@ -59,31 +59,12 @@ module Alchemy
       # Updates the element and all ingredients in the element.
       #
       def update
-        if @element.update(element_params)
-          render json: {
-            notice: Alchemy.t(:element_saved),
-            previewText: Rails::Html::SafeListSanitizer.new.sanitize(@element.preview_text),
-            ingredientAnchors: @element.ingredients.filter_map do |ingredient|
-              if ingredient.settings[:anchor]
-                {
-                  ingredientId: ingredient.id,
-                  active: ingredient.dom_id.present?
-                }
-              end
-            end
-          }.merge(pagePublicationData(@element.page))
+        @element_validated = @element.update(element_params)
+        if @element_validated
+          render :update
         else
           @warning = Alchemy.t("Validation failed")
-          render json: {
-            warning: @warning,
-            errorMessage: Alchemy.t(:ingredient_validations_headline),
-            ingredientsWithErrors: @element.ingredients_with_errors.map do |ingredient|
-              {
-                id: ingredient.id,
-                errorMessage: ingredient.errors.messages[:value].to_sentence
-              }
-            end
-          }, status: 422
+          render :update, status: 422
         end
       end
 

data/app/controllers/alchemy/admin/languages_controller.rb

@@ -51,7 +51,7 @@ module Alchemy
       def load_current_site
         @current_site = Alchemy::Current.site
         if @current_site.nil?
-          flash[:warning] = Alchemy.t("Please create a site first.")
+          flash[:info] = Alchemy.t("Please create a site first.")
           do_redirect_to admin_sites_path
         end
       end

data/app/controllers/alchemy/admin/nodes_controller.rb

@@ -18,7 +18,7 @@ module Alchemy
       end
 
       def create
-        if turbo_frame_request?
+        if turbo_frame_request_id == "page_nodes"
           @page = Alchemy::Page.find(resource_params[:page_id])
           @node = @page.nodes.build(resource_params)
           if @node.valid?

data/app/controllers/alchemy/admin/pages_controller.rb

@@ -85,7 +85,7 @@ module Alchemy
       end
 
       def info
-        render layout: !request.xhr?
+        render layout: !turbo_frame_request?
       end
 
       def new

data/app/controllers/alchemy/admin/pictures_controller.rb

@@ -27,9 +27,12 @@ module Alchemy
       # that would otherwise fire for every picture the view renders.
       before_action :load_deletable_picture_ids, only: [:index, :update]
 
-      add_alchemy_filter :by_file_format, type: :select, options: ->(query) do
-        Alchemy::Picture.file_formats(query.result)
-      end
+      add_alchemy_filter :by_file_format, type: :select,
+        multiple: ->(params) { params[:only].presence&.many? || params[:except].present? },
+        include_blank: ->(params) { params[:only].blank? && params[:except].blank? },
+        options: ->(query) do
+          Alchemy::Picture.file_formats(query.result)
+        end
       add_alchemy_filter :recent, type: :checkbox
       add_alchemy_filter :last_upload, type: :checkbox
       add_alchemy_filter :without_tag, type: :checkbox

data/app/controllers/alchemy/admin/resources_controller.rb

@@ -100,12 +100,12 @@ module Alchemy
           default: Alchemy.t("Successfully #{verb}"))
       end
 
-      def is_alchemy_module?
-        !alchemy_module.nil? && !alchemy_module["engine_name"].nil?
-      end
-
       def alchemy_module
-        @alchemy_module ||= module_definition_for(controller: controller_path, action: "index")
+        @alchemy_module ||= {
+          "engine_name" => Rails::Engine.subclasses.detect { |engine|
+            engine.routes.equal?(self.class._routes)
+          }&.engine_name
+        }
       end
 
       def load_resource

data/app/controllers/alchemy/admin/sites_controller.rb

@@ -6,7 +6,7 @@ module Alchemy
       def create
         @site = Alchemy::Site.new(resource_params)
         if @site.save
-          flash[:notice] = Alchemy.t("Please create a default language for this site.")
+          flash[:info] = Alchemy.t("Please create a default language for this site.")
           do_redirect_to alchemy.admin_languages_path(site_id: @site)
         else
           render :new

data/app/controllers/alchemy/base_controller.rb

@@ -53,9 +53,7 @@ module Alchemy
           #{current_alchemy_user.inspect}
         WARN
       end
-      if request.format.json?
-        render json: {message: Alchemy.t("You are not authorized")}, status: 401
-      elsif current_alchemy_user
+      if current_alchemy_user
         handle_redirect_for_user
       else
         handle_redirect_for_guest
@@ -63,6 +61,10 @@ module Alchemy
     end
 
     def handle_redirect_for_user
+      if api_request?
+        return render json: {message: Alchemy.t("You are not authorized")}, status: :forbidden
+      end
+
       flash[:warning] = Alchemy.t("You are not authorized")
       if can?(:index, :alchemy_admin_dashboard)
         redirect_or_render_notice
@@ -72,17 +74,7 @@ module Alchemy
     end
 
     def redirect_or_render_notice
-      if request.xhr?
-        respond_to do |format|
-          format.js do
-            render plain: flash.discard(:warning), status: 403
-          end
-          format.html do
-            render partial: "alchemy/admin/partials/flash",
-              locals: {message: flash[:warning], flash_type: "warning"}
-          end
-        end
-      elsif turbo_frame_request?
+      if turbo_frame_request?
         render "403", status: 403
       else
         redirect_to(alchemy.admin_dashboard_path)
@@ -91,14 +83,30 @@ module Alchemy
 
     def handle_redirect_for_guest
       flash[:info] = Alchemy.t("Please log in")
-      if request.xhr?
-        render :permission_denied
+      if api_request?
+        render json: {
+          message: Alchemy.t("Please log in"),
+          redirect_url: Alchemy.config.login_path
+        }, status: :unauthorized
+      elsif turbo_frame_request?
+        # Redirecting would be followed inside the frame and render the login
+        # page in the dialog. Turbo runs a stream action from any response,
+        # whatever status or Accept header, so it can break out of the frame.
+        render turbo_stream: helpers.turbo_stream_action_tag(
+          :dialog_visit, url: Alchemy.config.login_path
+        ), status: :unauthorized
       else
         store_location
         redirect_to Alchemy.config.login_path
       end
     end
 
+    # Requests from our own admin JavaScript, that expect a machine readable
+    # response instead of a page to render.
+    def api_request?
+      request.format.json? || request.xhr?
+    end
+
     # Logs the current exception to the error log.
     def exception_logger(error)
       Logger.error("\n#{error.class} #{error.message} in #{error.backtrace.first}")

data/app/controllers/alchemy/pages_controller.rb

@@ -73,11 +73,16 @@ module Alchemy
     end
 
     # Renders a search engine compatible xml sitemap.
+    #
+    # @deprecated Point the +/sitemap.xml+ route at {Alchemy::SitemapController} instead.
+    #
     def sitemap
+      Alchemy::Deprecation.warn(
+        "Alchemy::PagesController#sitemap is deprecated and will be removed in Alchemy 9.0. " \
+        "Route /sitemap.xml to Alchemy::SitemapController#show instead."
+      )
       @pages = Page.sitemap
-      respond_to do |format|
-        format.xml { render layout: "alchemy/sitemap" }
-      end
+      render layout: "alchemy/sitemap"
     end
 
     private
@@ -190,9 +195,14 @@ module Alchemy
 
     def set_expiration_headers
       if must_not_cache?
+        # no-store, not no-cache: no-cache still lets caches store the response and
+        # reuse it after a 304, which serves stale content (e.g. flash messages) and
+        # skips re-rendering elements that opted out of page caching.
+        no_store
+      elsif page_cache_control.no_cache?
         expires_now
       else
-        expires_in @page.expiration_time, {public: !@page.restricted}.merge(caching_options)
+        expires_in @page.expiration_time, {public: page_cache_control.public?}.merge(caching_options)
       end
     end
 
@@ -209,7 +219,13 @@ module Alchemy
     end
 
     def signup_required?
-      if Alchemy.config.user_class.respond_to?(:admins)
+      if Alchemy.config.user_class.respond_to?(:alchemy_admins)
+        Alchemy.config.user_class.alchemy_admins.empty?
+      elsif Alchemy.config.user_class.respond_to?(:admins)
+        Alchemy::Deprecation.warn(
+          "Using `#{Alchemy.config.user_class}.admins` is deprecated. " \
+          "Include `Alchemy::UserMethods` into your user class to provide `alchemy_admins` instead."
+        )
         Alchemy.config.user_class.admins.empty?
       end
     end
@@ -240,14 +256,19 @@ module Alchemy
     def render_fresh_page?
       must_not_cache? || stale?(
         etag: page_etag,
-        public: !@page.restricted,
+        public: page_cache_control.public?,
         template: "pages/show"
       )
     end
 
-    # don't cache pages if we have flash message to display or the page has caching disabled
+    # don't cache pages if app caching is off, a flash message is present, or the
+    # page's effective Cache-Control forbids storing the response.
     def must_not_cache?
-      !caching_enabled? || !@page.cache_page? || flash.present?
+      !caching_enabled? || flash.present? || page_cache_control.no_store?
+    end
+
+    def page_cache_control
+      @page.cache_control
     end
 
     def caching_enabled?