alchemy_cms 8.3.11 → 8.4.0

data/app/models/alchemy/admin/content_security_policy.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module Alchemy
+  module Admin
+    # The Content Security Policy Alchemy applies to its own admin responses.
+    #
+    # Not configured by default. Opt in with:
+    #
+    #     Alchemy.config.admin_content_security_policy = "Alchemy::Admin::ContentSecurityPolicy"
+    #
+    # 'self' follows the origin the admin is served from, so mounting it under
+    # its own subdomain through +Alchemy.admin_constraints+ needs no extra
+    # configuration. The page preview is same origin as well, because it falls
+    # back to an admin path, unless a preview host is configured, in which case
+    # that host is added to +frame-src+.
+    #
+    # +img-src+ is the exception: it allows any https host, because the host
+    # serving the pictures is not knowable here. Narrow it in a subclass, or
+    # keep pictures same origin with
+    # +config.active_storage.resolve_model_to_route = :rails_storage_proxy+.
+    #
+    # Assets your application adds through +admin_stylesheets+ or through
+    # +Alchemy.importmap+ are picked up automatically, so a module pinned to a
+    # CDN does not need any extra configuration. Subclass to allow anything
+    # else, and configure the subclass instead:
+    #
+    #     class AdminContentSecurityPolicy < Alchemy::Admin::ContentSecurityPolicy
+    #       def call
+    #         super.tap do |policy|
+    #           policy.connect_src(*policy.directives["connect-src"], "https://api.example.com")
+    #         end
+    #       end
+    #     end
+    #
+    class ContentSecurityPolicy
+      class InvalidSourceError < StandardError; end
+
+      # Rails calls an asset host proc with the asset source, so we need one to
+      # evaluate it with. Any source resolves to the same origin unless the
+      # host shards, which the %d form covers separately.
+      ASSET_SOURCE = "/"
+
+      def initialize(request = nil)
+        @request = request
+      end
+
+      attr_reader :request
+      # Send the policy as Content-Security-Policy-Report-Only, which reports
+      # violations to the browser console and to +report_uri+ without blocking
+      # anything. Worth running first, to find what a policy would break.
+      def report_only? = false
+
+      # Authorizes the inline scripts Alchemy renders. It has to be
+      # unguessable, otherwise injected markup could carry a valid nonce.
+      def nonce_generator = ->(_request) { SecureRandom.base64(16) }
+
+      def call
+        ActionDispatch::ContentSecurityPolicy.new do |policy|
+          policy.default_src :self
+          # script-src and style-src have to be named explicitly, because Rails
+          # only appends the nonce to directives the policy actually declares.
+          policy.script_src :self, *asset_hosts, *importmap_origins
+          policy.style_src :self, *asset_hosts, *admin_stylesheet_origins
+          # Inline style attributes cannot carry a nonce. Turbo sets them for
+          # its progress bar, and so do several of our bundled dependencies.
+          policy.style_src_attr :unsafe_inline
+          # Pictures come from wherever the storage backend puts them, which
+          # cannot be read from here. ActiveStorage redirects to a signed
+          # service URL, and a redirect still has to match the host.
+          policy.img_src :self, :data, :blob, :https
+          policy.font_src :self, :data, *asset_hosts
+          policy.media_src :self, :blob, *asset_hosts
+          policy.connect_src :self, *asset_hosts
+          policy.frame_src :self, *preview_hosts
+          policy.object_src :none
+          policy.base_uri :self
+          policy.form_action :self
+          # An endpoint of your own that the browser POSTs a JSON report to
+          # whenever it blocks something:
+          #
+          #   policy.report_uri "/csp-violation-reports"
+        end
+      end
+
+      private
+
+      def asset_hosts
+        host = ActionController::Base.asset_host
+        return [] if host.blank?
+
+        hosts = if host.respond_to?(:call)
+          [call_asset_host(host)]
+        elsif host.include?("%d")
+          # Rails shards these over four hosts.
+          4.times.map { host % _1 }
+        else
+          [host]
+        end
+        hosts.filter_map { origin(_1) }.uniq
+      end
+
+      def call_asset_host(host)
+        arity = host.respond_to?(:arity) ? host.arity : host.method(:call).arity
+        args = [ASSET_SOURCE]
+        args << request if request && (arity > 1 || arity < 0)
+        host.call(*args)
+      end
+
+      # Modules can be pinned to a CDN, in which case the pin holds an absolute
+      # URL instead of an asset name.
+      def importmap_origins
+        Alchemy.importmap.packages.values.filter_map { origin(_1.path) }.uniq
+      end
+
+      # Admin stylesheets are usually asset names, but an absolute URL is
+      # allowed here too.
+      def admin_stylesheet_origins
+        Alchemy.config.admin_stylesheets.filter_map { origin(_1) }.uniq
+      end
+
+      # A CSP source is an origin, so anything with a host contributes one and
+      # everything else (asset names, module specifiers) is same origin already.
+      def origin(url)
+        uri = URI.parse(url.to_s)
+        return nil unless uri.host
+
+        port = ":#{uri.port}" if uri.port && uri.port != uri.default_port
+        "#{uri.scheme ? "#{uri.scheme}://" : "//"}#{uri.host}#{port}"
+      rescue URI::InvalidURIError => error
+        raise InvalidSourceError, "Cannot build a Content Security Policy source from " \
+          "#{url.inspect} (#{error.message}). It came from your asset host, your " \
+          "admin stylesheets, an importmap pin or a preview host."
+      end
+
+      # The page editor renders the frontend of the application in an iframe,
+      # which is a different host whenever a preview host is configured.
+      def preview_hosts
+        preview = Alchemy.config.preview
+        ([preview.host] + preview.per_site_configs.map(&:host)).filter_map { origin(_1) }.uniq
+      end
+    end
+  end
+end

data/app/models/alchemy/admin/filters/base.rb

@@ -11,6 +11,13 @@ module Alchemy
           @resource_name = resource_name
         end
 
+        # The strong parameters entries needed to permit this filter's value(s)
+        # under `q`. Override in subclasses whose input can submit a shape
+        # other than a single scalar value (e.g. an array from `<select multiple>`).
+        def permitted_search_params
+          [name]
+        end
+
         def applied_filter_component(search_filter_params:, resource_url_proxy:, query:)
           Alchemy::Admin::Resource::AppliedFilter.new(
             link: dismiss_filter_url(search_filter_params, resource_url_proxy),

data/app/models/alchemy/admin/filters/datepicker.rb

@@ -45,7 +45,7 @@ module Alchemy
           when :time
             ::I18n.t(:time, scope: [:time, :formats, :alchemy])
           end
-          ::I18n.l(date, format: format)
+          Alchemy.l(date, format: format)
         end
       end
     end

data/app/models/alchemy/admin/filters/select.rb

@@ -10,9 +10,13 @@ module Alchemy
         # @param name [String] The name of the filter.
         # @param resource_name [String] The name of the resource.
         # @param options [Proc, Array] A proc that returns the options for the select, or an array of options.
-        def initialize(name:, resource_name:, options:)
+        # @param multiple [Boolean, Proc] Whether multiple values can be selected, or a proc called with the search filter params that returns a Boolean.
+        # @param include_blank [Boolean, String, Proc] Whether (or with what label) to include a blank option, or a proc called with the search filter params that returns a Boolean/String.
+        def initialize(name:, resource_name:, options:, multiple: false, include_blank: true)
           super(name:, resource_name:)
           @options = options_to_proc(options)
+          @multiple = bool_or_proc(multiple)
+          @include_blank = bool_or_proc(include_blank)
         end
 
         # Returns a select filter component.
@@ -31,18 +35,27 @@ module Alchemy
           )
         end
 
+        # `multiple` can be enabled dynamically via a Proc, so both the
+        # scalar and array shape of the submitted value need to be permitted.
+        def permitted_search_params
+          [name, {name => []}]
+        end
+
         private
 
         def multiple?(params)
-          params[:only].presence&.many? || params[:except].present?
+          @multiple.call(params)
         end
 
         def include_blank(params)
-          if params[:only].present? || params[:except].present?
-            false
-          else
-            Alchemy.t(:all, scope: [:filters, resource_name, name])
-          end
+          value = @include_blank.call(params)
+          return value unless value == true
+
+          Alchemy.t(:all, scope: [:filters, resource_name, name])
+        end
+
+        def bool_or_proc(value)
+          value.is_a?(Proc) ? value : ->(_params) { value }
         end
 
         def options_to_proc(options)

data/app/models/alchemy/attachment.rb

@@ -5,16 +5,23 @@
 # Table name: alchemy_attachments
 #
 #  id              :integer          not null, primary key
-#  name            :string
-#  file_name       :string
+#  cached_tag_list :text
 #  file_mime_type  :string
+#  file_name       :string
 #  file_size       :integer
-#  creator_id      :integer
-#  updater_id      :integer
+#  file_uid        :string
+#  name            :string
 #  created_at      :datetime         not null
 #  updated_at      :datetime         not null
-#  cached_tag_list :text
-#  file_uid        :string
+#  creator_id      :integer
+#  updater_id      :integer
+#
+# Indexes
+#
+#  index_alchemy_attachments_on_created_at  (created_at)
+#  index_alchemy_attachments_on_creator_id  (creator_id)
+#  index_alchemy_attachments_on_file_uid    (file_uid)
+#  index_alchemy_attachments_on_updater_id  (updater_id)
 #
 
 module Alchemy
@@ -199,7 +206,7 @@ module Alchemy
     private
 
     def file_type_allowed
-      unless extension&.in?(self.class.allowed_filetypes)
+      unless extension&.downcase&.in?(self.class.allowed_filetypes.map(&:downcase))
         errors.add(:file, Alchemy.t("not a valid file"))
       end
     end

data/app/models/alchemy/cache_control.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module Alchemy
+  # Normalized HTTP Cache-Control directives derived from a page layout `cache`
+  # or element `page_cache` config value. Combine two values with `#&` to get the
+  # most restrictive of the two — this is how the page layout and its elements
+  # are merged (elements can only tighten, never loosen).
+  class CacheControl
+    VISIBILITIES = [:public, :private].freeze
+
+    # @param value [nil, true, false, Integer, Hash, CacheControl]
+    # @return [CacheControl]
+    def self.parse(value)
+      case value
+      when CacheControl then value
+      when nil, true then new(default: true)
+      when false then new(no_store: true)
+      when Integer then new(max_age: value)
+      when Hash then from_hash(value)
+      else new(default: true)
+      end
+    end
+
+    def self.from_hash(hash)
+      options = hash.transform_keys(&:to_sym)
+      new(
+        no_store: !!options[:no_store],
+        no_cache: !!options[:no_cache],
+        max_age: options[:max_age],
+        visibility: (options[:visibility] || :public).to_sym
+      )
+    end
+    private_class_method :from_hash
+
+    attr_reader :max_age, :visibility
+
+    def initialize(no_store: false, no_cache: false, max_age: nil, visibility: :public, default: false)
+      @no_store = no_store
+      @no_cache = no_cache
+      @max_age = max_age
+      @visibility = visibility
+      @default = default
+    end
+
+    def no_store?
+      @no_store
+    end
+
+    def no_cache?
+      @no_cache
+    end
+
+    def default?
+      @default
+    end
+
+    # Whether the response is flagged `public` to HTTP caches. A no-cache
+    # response is never public: Rails only pairs no-cache with public, and
+    # "public" adds nothing to an always-revalidated response.
+    def public?
+      visibility == :public && !no_cache?
+    end
+
+    def private?
+      visibility == :private
+    end
+
+    # Most restrictive of self and other.
+    def &(other)
+      return self if other.nil?
+      return self.class.new(no_store: true) if no_store? || other.no_store?
+
+      vis = (private? || other.private?) ? :private : :public
+      return self.class.new(no_cache: true, visibility: vis) if no_cache? || other.no_cache?
+
+      self.class.new(visibility: vis, max_age: min_max_age(other))
+    end
+
+    def restrict_visibility
+      return self if no_store? || private?
+
+      self.class.new(no_cache: no_cache?, max_age: max_age, visibility: :private)
+    end
+
+    def ==(other)
+      other.is_a?(CacheControl) &&
+        no_store? == other.no_store? &&
+        no_cache? == other.no_cache? &&
+        max_age == other.max_age &&
+        visibility == other.visibility
+    end
+    alias_method :eql?, :==
+
+    def hash
+      [no_store?, no_cache?, max_age, visibility].hash
+    end
+
+    private
+
+    def min_max_age(other)
+      [max_age, other.max_age].compact.min
+    end
+  end
+end

data/app/models/alchemy/current.rb

@@ -1,6 +1,6 @@
 module Alchemy
   class Current < ActiveSupport::CurrentAttributes
-    attribute :preview_page, :preview_time, :page, :language, :site
+    attribute :preview_page, :preview_time, :page, :language, :site, :user
 
     def language
       super || Language.default

data/app/models/alchemy/eager_loading.rb

@@ -18,14 +18,12 @@ module Alchemy
         raise UnsupportedPageVersion unless version.in? PAGE_VERSIONS
 
         [
-          :tags,
           {
             :language => :site,
             version => {
               elements: [
                 :page,
                 :touchable_pages,
-                :tags,
                 {
                   ingredients: :related_object
                 }

data/app/models/alchemy/element.rb

@@ -5,20 +5,34 @@
 # Table name: alchemy_elements
 #
 #  id                :integer          not null, primary key
+#  cached_tag_list   :text
+#  fixed             :boolean          default(FALSE), not null
+#  folded            :boolean          default(FALSE), not null
 #  name              :string
 #  position          :integer
-#  page_version_id   :integer          not null
-#  public_on         :timestamp
-#  public_until      :timestamp
-#  fixed             :boolean          default(FALSE)
-#  folded            :boolean          default(FALSE)
-#  unique            :boolean          default(FALSE)
+#  public_on         :datetime
+#  public_until      :datetime
+#  unique            :boolean          default(FALSE), not null
 #  created_at        :datetime         not null
 #  updated_at        :datetime         not null
 #  creator_id        :integer
-#  updater_id        :integer
-#  cached_tag_list   :text
+#  page_version_id   :integer          not null
 #  parent_element_id :integer
+#  updater_id        :integer
+#
+# Indexes
+#
+#  idx_alchemy_elements_on_page_version_id_and_parent_element_id  (page_version_id,parent_element_id)
+#  idx_alchemy_elements_on_page_version_id_and_position           (page_version_id,position)
+#  index_alchemy_elements_on_creator_id                           (creator_id)
+#  index_alchemy_elements_on_fixed                                (fixed)
+#  index_alchemy_elements_on_page_version_id                      (page_version_id)
+#  index_alchemy_elements_on_public_on_and_public_until           (public_on,public_until)
+#  index_alchemy_elements_on_updater_id                           (updater_id)
+#
+# Foreign Keys
+#
+#  page_version_id  (page_version_id => alchemy_page_versions.id) ON DELETE => cascade
 #
 
 require_dependency "alchemy/element/definitions"
@@ -49,6 +63,7 @@ module Alchemy
       "ingredients",
       "message",
       "nestable_elements",
+      "page_cache",
       "searchable",
       "taggable",
       "warning"

data/app/models/alchemy/element_definition.rb

@@ -13,6 +13,7 @@ module Alchemy
     attribute :taggable, :boolean, default: false
     attribute :compact, :boolean, default: false
     attribute :fixed, :boolean, default: false
+    attribute :page_cache, Alchemy::CacheControlType.new, default: true
     attribute :ingredients, default: []
     attribute :nestable_elements, default: []
     attribute :autogenerate, default: []

data/app/models/alchemy/elements_repository.rb

@@ -125,6 +125,17 @@ module Alchemy
       elements.each(&)
     end
 
+    # Allows the repository to be passed to the ActionView collection renderer
+    # (+render repository+), which detects a collection by +to_ary+.
+    def to_ary
+      elements
+    end
+
+    def size
+      elements.size
+    end
+    alias_method :length, :size
+
     private
 
     attr_reader :elements

data/app/models/alchemy/folded_page.rb

@@ -5,9 +5,13 @@
 # Table name: alchemy_folded_pages
 #
 #  id      :integer          not null, primary key
+#  folded  :boolean          default(FALSE), not null
 #  page_id :integer          not null
 #  user_id :integer          not null
-#  folded  :boolean          default(FALSE)
+#
+# Indexes
+#
+#  index_alchemy_folded_pages_on_page_id_and_user_id  (page_id,user_id) UNIQUE
 #
 
 module Alchemy

data/app/models/alchemy/ingredient.rb

@@ -1,5 +1,31 @@
 # frozen_string_literal: true
 
+# == Schema Information
+#
+# Table name: alchemy_ingredients
+#
+#  id                  :integer          not null, primary key
+#  data                :json
+#  related_object_type :string
+#  role                :string           not null
+#  type                :string           not null
+#  value               :text
+#  created_at          :datetime         not null
+#  updated_at          :datetime         not null
+#  element_id          :integer          not null
+#  related_object_id   :integer
+#
+# Indexes
+#
+#  idx_alchemy_ingredient_relation                   (related_object_id,related_object_type)
+#  index_alchemy_ingredients_on_element_id           (element_id)
+#  index_alchemy_ingredients_on_element_id_and_role  (element_id,role) UNIQUE
+#  index_alchemy_ingredients_on_type                 (type)
+#
+# Foreign Keys
+#
+#  element_id  (element_id => alchemy_elements.id) ON DELETE => cascade
+#
 module Alchemy
   class Ingredient < BaseRecord
     class DefinitionError < StandardError; end

data/app/models/alchemy/ingredients/datetime.rb

@@ -15,7 +15,7 @@ module Alchemy
       def preview_text(_maxlength = nil)
         return "" unless value
 
-        ::I18n.l(value, format: :"alchemy.ingredient_date")
+        Alchemy.l(value, format: :"alchemy.ingredient_date")
       end
     end
   end

data/app/models/alchemy/ingredients/link.rb

@@ -12,6 +12,8 @@ module Alchemy
 
       allow_settings %i[text]
 
+      validates_with Alchemy::SafeUrlValidator, attributes: [:value]
+
       alias_method :link, :value
     end
   end

data/app/models/alchemy/ingredients/picture.rb

@@ -31,6 +31,7 @@ module Alchemy
         crop
         css_classes
         fixed_ratio
+        format
         linkable
         size
         sizes
@@ -38,6 +39,8 @@ module Alchemy
         upsample
       ]
 
+      validates_with Alchemy::SafeUrlValidator, attributes: [:link]
+
       delegate :description_for, :name, to: :picture, allow_nil: true
 
       def alt_text(language: Alchemy::Current.language)

data/app/models/alchemy/ingredients/text.rb

@@ -23,6 +23,8 @@ module Alchemy
         input_type
         linkable
       ]
+
+      validates_with Alchemy::SafeUrlValidator, attributes: [:link]
     end
   end
 end

data/app/models/alchemy/language.rb

@@ -5,19 +5,31 @@
 # Table name: alchemy_languages
 #
 #  id             :integer          not null, primary key
-#  name           :string
-#  language_code  :string
+#  country_code   :string           default(""), not null
+#  default        :boolean          default(FALSE), not null
 #  frontpage_name :string
+#  language_code  :string
+#  locale         :string
+#  name           :string
 #  page_layout    :string           default("intro")
-#  public         :boolean          default(FALSE)
+#  public         :boolean          default(FALSE), not null
 #  created_at     :datetime         not null
 #  updated_at     :datetime         not null
 #  creator_id     :integer
-#  updater_id     :integer
-#  default        :boolean          default(FALSE)
-#  country_code   :string           default(""), not null
 #  site_id        :integer          not null
-#  locale         :string
+#  updater_id     :integer
+#
+# Indexes
+#
+#  index_alchemy_languages_on_creator_id                      (creator_id)
+#  index_alchemy_languages_on_language_code                   (language_code)
+#  index_alchemy_languages_on_language_code_and_country_code  (language_code,country_code)
+#  index_alchemy_languages_on_site_id                         (site_id)
+#  index_alchemy_languages_on_updater_id                      (updater_id)
+#
+# Foreign Keys
+#
+#  site_id  (site_id => alchemy_sites.id)
 #
 
 require_dependency "alchemy/site"

data/app/models/alchemy/legacy_page_url.rb

@@ -6,9 +6,14 @@
 #
 #  id         :integer          not null, primary key
 #  urlname    :string           not null
-#  page_id    :integer          not null
 #  created_at :datetime         not null
 #  updated_at :datetime         not null
+#  page_id    :integer          not null
+#
+# Indexes
+#
+#  index_alchemy_legacy_page_urls_on_page_id  (page_id)
+#  index_alchemy_legacy_page_urls_on_urlname  (urlname)
 #
 
 class Alchemy::LegacyPageUrl < ActiveRecord::Base