alchemy_cms 8.3.10 → 8.4.0

data/app/controllers/alchemy/sitemap_controller.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Alchemy
+  # Renders a search engine compatible XML sitemap.
+  #
+  # The sitemap contains absolute urls, so it has to follow the site's primary
+  # host redirect just like a page request does.
+  #
+  class SitemapController < Alchemy::BaseController
+    include SiteRedirects
+
+    # Still the pages template, because apps override it at that path.
+    #
+    # TODO: Move to alchemy/sitemap/show in Alchemy 9.0, together with the
+    # deprecated PagesController#sitemap.
+    TEMPLATE = "alchemy/pages/sitemap"
+
+    def show
+      if sitemap_caching_enabled?
+        expires_in sitemap_max_age, public: true
+
+        # The etag is checked before the pages are loaded, so a revalidating
+        # client only costs us the cache key queries, not a full render.
+        return unless stale?(etag: sitemap_cache_key, public: true)
+
+        @sitemap_cache_key = sitemap_cache_key
+        @sitemap_max_age = sitemap_max_age
+      end
+
+      # Left unloaded on purpose. The template wraps the urls in a fragment
+      # cache, so a cache hit never runs this query.
+      @pages = Page.sitemap
+
+      render template: TEMPLATE, layout: "alchemy/sitemap"
+    end
+
+    private
+
+    def sitemap_cache_key
+      @_sitemap_cache_key ||= Page::SitemapCacheKey.new(
+        site: Current.site,
+        base_url: request.base_url,
+        max_age: sitemap_max_age
+      ).call
+    end
+
+    def sitemap_max_age
+      Alchemy.config.sitemap.max_age
+    end
+
+    # The sitemap has its own cache setting and does not follow the page cache.
+    # A max_age of zero (or less) disables it, because it would leave the time
+    # bucket undefined.
+    def sitemap_caching_enabled?
+      perform_caching && sitemap_max_age.to_i.positive?
+    end
+  end
+end

data/app/controllers/concerns/alchemy/admin/csp_protection.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Alchemy
+  module Admin
+    # Applies Alchemy's own Content Security Policy to the including controller.
+    #
+    # Include it into any controller that renders the Alchemy admin but does not
+    # inherit from +Alchemy::Admin::BaseController+, so that its responses carry
+    # the same policy as the rest of the admin:
+    #
+    #     class Alchemy::Admin::PasswordsController < Devise::PasswordsController
+    #       include Alchemy::Admin::CspProtection
+    #     end
+    #
+    # Including it is opting in, so the policy applies to every action. Override
+    # +apply_content_security_policy?+ to narrow that down.
+    #
+    # The policy itself comes from +Alchemy.config.admin_content_security_policy+
+    # and is left alone when the host application configured one of its own.
+    module CspProtection
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :set_content_security_policy, if: :apply_content_security_policy?
+      end
+
+      private
+
+      def apply_content_security_policy? = true
+
+      def set_content_security_policy
+        policy_class = Alchemy.config.admin_content_security_policy
+        return unless policy_class
+        return if request.content_security_policy
+
+        policy = policy_class.new(request)
+        request.content_security_policy_nonce_generator ||= policy.nonce_generator
+        request.content_security_policy = policy.call
+        request.content_security_policy_report_only = policy.report_only?
+      end
+    end
+  end
+end

data/app/controllers/concerns/alchemy/admin/current_language.rb

@@ -28,7 +28,7 @@ module Alchemy
           Current.language
         end
         if @current_language.nil?
-          flash[:warning] = Alchemy.t("Please create a language first.")
+          flash[:info] = Alchemy.t("Please create a language first.")
           redirect_to admin_languages_path
         end
       end

data/app/controllers/concerns/alchemy/admin/resource_filter.rb

@@ -21,6 +21,8 @@ module Alchemy
         #   add_alchemy_filter :by_location, type: :select, options: ->(query) { Location.pluck(:name, :id) }
         #   add_alchemy_filter :future, type: :checkbox
         #   add_alchemy_filter :by_timeframe, type: :select, options: ["today", "tomorrow"]
+        #   add_alchemy_filter :by_tag, type: :select, options: ->(query) { Tag.pluck(:name) }, multiple: true, include_blank: false
+        #   add_alchemy_filter :by_tag, type: :select, options: ->(query) { Tag.pluck(:name) }, multiple: ->(params) { params[:only].present? }
         def add_alchemy_filter(name, type:, **args)
           alchemy_filters << "Alchemy::Admin::Filters::#{type.to_s.camelize}".constantize.new(
             name:,
@@ -74,7 +76,7 @@ module Alchemy
       def permitted_ransack_search_fields
         [
           resource_handler.search_field_name
-        ] + alchemy_filters.map(&:name)
+        ] + alchemy_filters.flat_map(&:permitted_search_params)
       end
 
       def resource_has_filters

data/{lib → app/controllers/concerns}/alchemy/controller_actions.rb

@@ -7,6 +7,7 @@ module Alchemy
     included do
       before_action :set_current_alchemy_site
       before_action :set_alchemy_language
+      before_action :set_current_alchemy_user
 
       helper "alchemy/pages"
 
@@ -59,6 +60,18 @@ module Alchemy
       Current.site = current_alchemy_site
     end
 
+    # Stores the current user in +Current.user+ so models and services can
+    # access the acting user without threading it through every call.
+    #
+    # Apps without a configured +current_user_method+ leave it +nil+ instead
+    # of raising, so the public frontend keeps working without authentication.
+    #
+    def set_current_alchemy_user
+      Current.user = current_alchemy_user
+    rescue NoCurrentUserFoundError
+      Current.user = nil
+    end
+
     # Sets the current language for Alchemy.
     #
     def set_alchemy_language(lang = nil)

data/app/controllers/concerns/alchemy/legacy_page_redirects.rb

@@ -3,8 +3,8 @@
 module Alchemy
   # Handles Legacy page redirects
   #
-  # If the page could not be found via its urlname we try to find
-  # a legacy page url for requested url to redirect to.
+  # If the page could not be found via its urlname or is not public we try to find
+  # a legacy page url of a published page for requested url to redirect to.
   #
   module LegacyPageRedirects
     extend ActiveSupport::Concern
@@ -22,7 +22,7 @@ module Alchemy
     end
 
     def redirect_to_legacy_url?
-      (@page.nil? || request.format.nil?) && last_legacy_url
+      (@page.nil? || !@page.public? || request.format.nil?) && last_legacy_url
     end
 
     # Use the bare minimum to redirect to legacy page
@@ -48,7 +48,7 @@ module Alchemy
         Page.table_name => {
           language_id: Current.language.id
         }
-      )
+      ).where(page_id: Page.published.select(:id))
     end
 
     def last_legacy_url

data/app/helpers/alchemy/admin/base_helper.rb

@@ -272,8 +272,11 @@ module Alchemy
       end
 
       # Returns the regular expression used for external url validation in link dialog.
+      #
+      # Anchored with ^ instead of \A because the link dialog receives this as a
+      # JavaScript literal, where Ruby's anchors are a syntax error.
       def link_url_regexp
-        Alchemy.config.format_matchers.link_url || /^(mailto:|\/|[a-z]+:\/\/)/
+        Alchemy.config.format_matchers.link_url || Alchemy::Configurations::FormatMatchers::LINK_URL
       end
 
       # Renders a hint with tooltip

data/app/helpers/alchemy/admin/form_helper.rb

@@ -10,13 +10,11 @@ module Alchemy
       # == Defaults
       #
       # * It uses Alchemy::Forms::Builder as builder
-      # * It makes a remote request, if the request was XHR request.
       # * It adds the alchemy class to form
       #
       def alchemy_form_for(object, *args, &block)
         options = args.extract_options!
         options[:builder] = Alchemy::Forms::Builder
-        options.key?(:remote) || options[:remote] = request.xhr?
         options[:html] = {
           id: options.delete(:id),
           class: ["alchemy", options.delete(:class)].compact.join(" "),

data/app/helpers/alchemy/admin/navigation_helper.rb

@@ -11,212 +11,41 @@ module Alchemy
       #   The Hash representing a Alchemy module
       #
       def alchemy_main_navigation_entry(alchemy_module)
-        validate_controller_existence!(alchemy_module)
-        render(
-          "alchemy/admin/partials/main_navigation_entry",
-          alchemy_module: alchemy_module,
-          navigation: alchemy_module["navigation"]
+        render Alchemy::Admin::MainNavigation::Entry.new(
+          item: Alchemy::Configurations::MenuItem.from_legacy_hash(alchemy_module)
         )
       end
-
-      # Used for checking the main navi permissions
-      #
-      # To let your module be navigatable by the user you have to provide an Ability for it.
-      #
-      # === Example:
-      #
-      #   # module.yml
-      #   name: 'my_module'
-      #   navigation: {
-      #     controller: 'my/admin/posts'
-      #     action: 'index'
-      #   }
-      #
-      #   # ability.rb
-      #   can :index, :my_admin_posts
-      #
-      def navigate_module(navigation)
-        [
-          navigation["action"].to_sym,
-          navigation["controller"].to_s.gsub(/\A\//, "").tr("/", "_").to_sym
-        ]
-      end
-
-      # CSS classes for main navigation entry.
-      #
-      def main_navigation_css_classes(navigation)
-        [
-          "main_navi_entry",
-          admin_mainnavi_active?(navigation) ? "active" : nil,
-          navigation.key?("sub_navigation") ? "has_sub_navigation" : nil
-        ].compact
-      end
-
-      # Returns true if given navi entry is in params controller and action
-      #
-      # == Example
-      #   <%= entry_active?({controller: 'admin/users', action: 'index'}) %>
-      #
-      # @param [Hash]
-      #   A Alchemy module definition navigation entry
-      #
-      def entry_active?(entry)
-        is_entry_controller_active?(entry) && is_entry_action_active?(entry)
-      end
+      deprecate alchemy_main_navigation_entry: "Render `Alchemy::Admin::MainNavigation::Entry` instead",
+        deprecator: Alchemy::Deprecation
 
       # Returns url for given Alchemy module.
       #
-      # If the module is inside an engine it calls the +url_for+ helper on the engines routing proxy.
-      #
-      # If the module is inside the host rails app it calls the +url_for+ helper on the main_app routing proxy.
-      #
       # @param [Hash]
       #   A Alchemy module definition
       #
       def url_for_module(alchemy_module)
-        route_from_engine_or_main_app(
-          alchemy_module["engine_name"],
-          url_options_for_module(alchemy_module)
-        )
-      end
-
-      # Returns url for given Alchemy module sub navigation entry.
-      #
-      # If the module is inside an engine it calls the +url_for+ helper on the engines routing proxy.
-      #
-      # If the module is inside the host rails app it calls the +url_for+ helper on the main_app routing proxy.
-      #
-      # @param [Hash]
-      #   A Alchemy module sub navigation definition
-      #
-      def url_for_module_sub_navigation(navigation)
-        alchemy_module = module_definition_for(navigation)
-        return if alchemy_module.nil?
-
-        route_from_engine_or_main_app(
-          alchemy_module["engine_name"],
-          url_options_for_navigation_entry(navigation)
-        )
+        Alchemy::Configurations::MenuItem.from_legacy_hash(alchemy_module).path(self)
       end
+      deprecate url_for_module: "Use `Alchemy::Configurations::MenuItem#path` instead",
+        deprecator: Alchemy::Deprecation
 
       # Alchemy modules for main navigation.
       #
       # Sorted by position attribute, if given.
       #
       def sorted_alchemy_modules
-        sorted = []
-        not_sorted = []
-        alchemy_modules.map do |m|
-          if m["position"].blank?
-            not_sorted << m
-          else
-            sorted << m
-          end
-        end
-        sorted.sort_by { |m| m["position"] } + not_sorted
+        Alchemy::Admin::MainNavigation::Menu.new.items.map { |menu_item| Alchemy::Modules.to_legacy_hash(menu_item) }
       end
+      deprecate sorted_alchemy_modules: "Use `Alchemy.config.menu` instead",
+        deprecator: Alchemy::Deprecation
 
       private
 
-      # Calls +url_for+ helper on engine if present or on host app.
-      #
-      # @param [String]
-      #   A name of an engine
-      # @param [Hash]
-      #   url options hash passed to +url_for+ helper
-      #
-      def route_from_engine_or_main_app(engine_name, url_options)
-        if engine_name.present?
-          send(engine_name).url_for(url_options)
-        else
-          main_app.url_for(url_options)
-        end
-      end
-
-      # Returns a url options hash for given Alchemy module.
-      #
-      # @param [Hash]
-      #   A Alchemy module definition
-      #
-      def url_options_for_module(alchemy_module)
-        url_options_for_navigation_entry(alchemy_module["navigation"] || {})
-      end
-
-      # Validates the existence of a given controller configuration.
-      #
-      # @param String
-      #   The controller name
-      def validate_controller_existence!(definition_hash)
-        controllers = [definition_hash["navigation"]["controller"]]
-
-        if definition_hash["navigation"]["sub_navigation"].is_a?(Array)
-          controllers.concat(definition_hash["navigation"]["sub_navigation"].map { |x| x["controller"] })
-        end
-
-        controllers.each do |controller|
-          controller_const_name = "#{controller.camelize}Controller"
-          controller_const_name.constantize
-        rescue NameError
-          raise "Error in AlchemyCMS module definition: '#{definition_hash["name"]}'. Could not find the " \
-            "matching controller class #{controller_const_name} for the specified controller: '#{controller}'"
-        end
-      end
-
-      # Returns a url options hash for given navigation entry.
-      #
-      # @param [Hash]
-      #   A Alchemy module navigation entry
-      #
-      def url_options_for_navigation_entry(entry)
-        {
-          controller: entry["controller"],
-          action: entry["action"],
-          only_path: true,
-          params: entry["params"]
-        }.delete_if { |_k, v| v.nil? }
-      end
-
       # Retrieves the current Alchemy module from controller and index action.
       #
       def current_alchemy_module
         module_definition_for(controller: params[:controller], action: "index")
       end
-
-      # Returns true if the current controller and action is in a modules navigation definition.
-      #
-      def admin_mainnavi_active?(navigation)
-        # Has the given navigation entry a active sub navigation?
-        has_active_entry?(navigation["sub_navigation"] || []) ||
-          # Has the given navigation entry a active nested navigation?
-          has_active_entry?(navigation["nested"] || []) ||
-          # Is the navigation entry active?
-          entry_active?(navigation || {})
-      end
-
-      # Returns true if the given entry's controller is current controller
-      #
-      def is_entry_controller_active?(entry)
-        entry["controller"].gsub(/\A\//, "") == params[:controller] ||
-          entry.fetch("nested_controllers", []).include?(params[:controller])
-      end
-
-      # Returns true if the given entry's action is current controllers action
-      #
-      # Also checks if given entry has a +nested_actions+ key, if so it checks if one of them is current controller's action
-      #
-      def is_entry_action_active?(entry)
-        entry["action"] == params[:action] ||
-          entry.fetch("nested_actions", []).include?(params[:action])
-      end
-
-      # Returns true if an entry of given entries is active.
-      #
-      # @param [Array]
-      #   Alchemy module navigation entries.
-      #
-      def has_active_entry?(entries)
-        entries.any? { |entry| entry_active?(entry) }
-      end
     end
   end
 end

data/app/helpers/alchemy/elements_block_helper.rb

@@ -58,6 +58,20 @@ module Alchemy
         element.ingredient_by_role(role)
       end
       alias_method :ingredient, :ingredient_by_role
+
+      # The element's visible nested children.
+      #
+      # Reads them from the page version's shared in-memory element repository
+      # instead of the +nested_elements+ association, so rendering a deeply
+      # nested element tree does not issue one query per parent.
+      #
+      # Returns an +Alchemy::ElementsRepository+ so callers can keep chaining
+      # scopes (e.g. +nested_elements.named(:slide)+) while still rendering it
+      # directly as a collection (+render el.nested_elements+).
+      #
+      def nested_elements
+        element.page_version.element_repository.children_of(element).visible
+      end
     end
 
     # Block-level helper for element views. Constructs a DOM element wrapping

data/app/helpers/alchemy/resources_helper.rb

@@ -15,6 +15,20 @@ module Alchemy
       @resource_window_size ||= "480x#{100 + resource_handler.attributes.length * 40}"
     end
 
+    # Returns the translated label for the resource dialog title and button text
+    # Add a scoped label by adding a "Create <resource-name>" translation key
+    # or rely on the generic "Create" translation key with interpolated `%{resource_name}`
+    # generated from `resouce_model.model_name.human`.
+    def create_resource_label
+      Alchemy.t(
+        "Create #{resource_name}",
+        default: Alchemy.t(
+          "Create",
+          resource_name: resource_model.model_name.human
+        )
+      )
+    end
+
     def resource_instance_variable
       instance_variable_get(:"@#{resource_name}")
     end
@@ -84,7 +98,7 @@ module Alchemy
         else
           options[:time_format] || :"alchemy.time"
         end
-        value = l(attribute_value, format: localization_format)
+        value = Alchemy.l(attribute_value, format: localization_format)
       elsif attribute[:type] == :boolean
         value = attribute_value ? '<alchemy-icon name="check"></alchemy-icon>'.html_safe : nil
       else

data/app/javascript/alchemy_admin/components/attachment_select.js

@@ -1,27 +1,18 @@
-import {
-  RemoteSelect,
-  escapeHtml
-} from "alchemy_admin/components/remote_select"
+import { RemoteSelect } from "alchemy_admin/components/remote_select"
 
 export class AttachmentSelect extends RemoteSelect {
-  _renderResult(item) {
-    return this._renderListEntry(item)
+  _entry(attachment, term) {
+    return {
+      icon: attachment.icon_css_class,
+      primary: this._hightlightTerm(attachment.name, term)
+    }
   }
 
-  /**
-   * html template for each list entry
-   * @param {object} page
-   * @param {string} term
-   * @returns {string}
-   * @private
-   */
-  _renderListEntry(attachment, term) {
-    return `
-      <div class="attachment-select--attachment">
-        <alchemy-icon name="${escapeHtml(attachment.icon_css_class)}"></alchemy-icon>
-        <span class="attachment-select--attachment-name">${this._hightlightTerm(attachment.name, term)}</span>
-      </div>
-    `
+  _selectedEntry(attachment) {
+    return {
+      icon: attachment.icon_css_class,
+      primary: attachment.name
+    }
   }
 }
 

data/app/javascript/alchemy_admin/components/auto_submit.js

@@ -2,13 +2,11 @@
 // contained in a form, so that Turbo can submit the form.
 class AutoSubmit extends HTMLElement {
   connectedCallback() {
-    // Still using jQuery here, because select2 does not emit
-    // the event from the original select element.
-    $(this).on("change", this.#onChange)
+    this.addEventListener("change", this.#onChange)
   }
 
   disconnectedCallback() {
-    $(this).off("change", this.#onChange)
+    this.removeEventListener("change", this.#onChange)
   }
 
   #onChange = (event) => {

data/app/javascript/alchemy_admin/components/button.js

@@ -4,11 +4,6 @@ class Button extends HTMLButtonElement {
   connectedCallback() {
     if (this.form) {
       this.form.addEventListener("submit", this)
-
-      if (this.form.dataset.remote == "true") {
-        this.form.addEventListener("ajax:complete", this)
-      }
-
       this.form.addEventListener("turbo:submit-end", this)
     } else {
       console.warn("No form for button found!", this)
@@ -27,7 +22,6 @@ class Button extends HTMLButtonElement {
           this.disable()
         }
         break
-      case "ajax:complete":
       case "turbo:submit-end":
         this.enable()
         break

data/app/javascript/alchemy_admin/components/clear_schedule_button.js

@@ -0,0 +1,21 @@
+class ClearScheduleButton extends HTMLButtonElement {
+  connectedCallback() {
+    this.addEventListener("click", this)
+  }
+
+  disconnectedCallback() {
+    this.removeEventListener("click", this)
+  }
+
+  handleEvent() {
+    this.form
+      ?.querySelectorAll('input[type="datetime-local"]')
+      .forEach((input) => {
+        input.value = ""
+      })
+  }
+}
+
+customElements.define("alchemy-clear-schedule-button", ClearScheduleButton, {
+  extends: "button"
+})