alchemy_cms 8.3.11 → 8.4.0

data/app/models/alchemy/safe_url_validator.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Alchemy
+  # Validates that a url does not carry an executable scheme.
+  #
+  # Only schemes listed in +Alchemy.config.allowed_url_schemes+ pass. Urls
+  # without a scheme (absolute and relative paths, anchors, queries and
+  # protocol relative urls) pass as well, they cannot carry executable code.
+  #
+  #   validates_with Alchemy::SafeUrlValidator, attributes: [:url]
+  #
+  class SafeUrlValidator < ActiveModel::EachValidator
+    SCHEME_REGEX = /\A(?<scheme>[a-z][a-z0-9+.-]*):/i
+
+    # Browsers drop these before they parse a url, which makes "java\tscript:"
+    # a working "javascript:" url. They have to go before the scheme is read.
+    STRIPPED_CHARS = /[\u0000-\u0020]/
+
+    def validate_each(record, attribute, value)
+      return if value.blank?
+
+      scheme = SCHEME_REGEX.match(value.to_s.gsub(STRIPPED_CHARS, ""))&.[](:scheme)&.downcase
+      return if scheme.nil? || allowed_schemes.include?(scheme)
+
+      record.errors.add(attribute, :invalid_url_scheme, scheme: scheme)
+    end
+
+    private
+
+    def allowed_schemes
+      Alchemy.config.allowed_url_schemes.map(&:downcase)
+    end
+  end
+end

data/app/models/alchemy/site.rb

@@ -5,13 +5,18 @@
 # Table name: alchemy_sites
 #
 #  id                       :integer          not null, primary key
+#  aliases                  :text
 #  host                     :string
 #  name                     :string
+#  public                   :boolean          default(FALSE), not null
+#  redirect_to_primary_host :boolean          default(FALSE), not null
 #  created_at               :datetime         not null
 #  updated_at               :datetime         not null
-#  public                   :boolean          default(FALSE)
-#  aliases                  :text
-#  redirect_to_primary_host :boolean
+#
+# Indexes
+#
+#  alchemy_sites_public_hosts_idx  (host,public)
+#  index_alchemy_sites_on_host     (host)
 #
 
 module Alchemy

data/app/models/alchemy/storage_adapter/active_storage/preprocessor.rb

@@ -23,9 +23,13 @@ module Alchemy
       attr_reader :attachable
 
       class << self
-        def generate_thumbs!(attachable)
-          Alchemy::Picture::THUMBNAIL_SIZES.values.each do |size|
-            process_thumb(attachable, size: size, flatten: true)
+        def generate_thumbs!(picture)
+          format = picture.image_file_extension || "jpg"
+          Alchemy::Picture::THUMBNAIL_SIZES.each_value do |size|
+            transformations = Alchemy::DragonflyToImageProcessing.call(
+              flatten: true, format: format, size: size
+            )
+            ::ActiveStorage::TransformJob.perform_later(picture.image_file.blob, transformations)
           end
         end
 

data/app/models/alchemy/storage_adapter/active_storage.rb

@@ -5,13 +5,16 @@ module Alchemy
         def self.included(base)
           base.has_one_attached :image_file do |attachable|
             Alchemy.storage_adapter.preprocessor_class.new(attachable).call
-            Alchemy.storage_adapter.preprocessor_class.generate_thumbs!(attachable)
           end
 
           base.after_create_commit if: :svg? do
             SanitizeSvgJob.perform_later(self, file_accessor: :image_file)
           end
 
+          base.after_create_commit if: :has_convertible_format? do
+            Alchemy.storage_adapter.preprocessor_class.generate_thumbs!(self)
+          end
+
           # The image file's dirty state is cleared by the time
           # +after_update_commit+ runs, so capture it here to know whether the
           # blob was actually replaced (rather than only its metadata updated).

data/app/models/alchemy/tag.rb

@@ -5,8 +5,15 @@
 # Table name: gutentag_tags
 #
 #  id             :integer          not null, primary key
-#  name           :string
-#  taggings_count :integer          default(0)
+#  name           :string           not null
+#  taggings_count :integer          default(0), not null
+#  created_at     :datetime         not null
+#  updated_at     :datetime         not null
+#
+# Indexes
+#
+#  index_gutentag_tags_on_name            (name) UNIQUE
+#  index_gutentag_tags_on_taggings_count  (taggings_count)
 #
 
 # Just holds some useful tag methods.
@@ -24,8 +31,7 @@ module Alchemy
     # Replaces tag with new tag on all models tagged with tag.
     def self.replace(tag, new_tag)
       tag.taggings.collect(&:taggable).each do |taggable|
-        taggable.tag_list.delete(tag.name)
-        taggable.tag_list << new_tag.name
+        taggable.tag_names = taggable.tag_names - [tag.name] + [new_tag.name]
         taggable.save
       end
     end

data/{lib → app/models/concerns}/alchemy/filetypes.rb

@@ -5,9 +5,13 @@ module Alchemy
     ARCHIVE_FILE_TYPES = ["application/zip", "application/x-rar"]
 
     AUDIO_FILE_TYPES = [
+      "audio/aac",
+      "audio/flac",
       "audio/mpeg",
       "audio/mp4",
+      "audio/ogg",
       "audio/wav",
+      "audio/webm",
       "audio/x-wav"
     ]
 
@@ -29,6 +33,7 @@ module Alchemy
       "video/x-flv",
       "video/mp4",
       "video/mpeg",
+      "video/ogg",
       "video/quicktime",
       "video/webm",
       "video/x-msvideo",

data/app/models/concerns/alchemy/picture_thumbnails.rb

@@ -37,27 +37,74 @@ module Alchemy
     def picture_url(options = {})
       return if picture.nil?
 
-      picture.url(picture_url_options.merge(options)) || "missing-image.png"
+      picture.url(picture_url_options(options)) || "missing-image.png"
     end
 
     # Picture rendering options
     #
-    # Returns the +default_render_format+ of the associated +Alchemy::Picture+
-    # together with the +crop_from+ and +crop_size+ values
+    # Returns the render format of the associated +Alchemy::Picture+
+    # together with the +crop_from+ and +crop_size+ values.
+    #
+    # The render format is taken from the +format+ option, the +format+ setting
+    # of the ingredient definition or the +default_render_format+ of the picture.
+    # A format is only applied if the picture can be converted.
+    #
+    # @param options [Hash] Options that override the defaults (i.e. +size+ or +format+ of a srcset entry)
     #
     # @return [HashWithIndifferentAccess]
-    def picture_url_options
+    def picture_url_options(options = {})
       return {} if picture.nil?
 
+      options = options.symbolize_keys
       crop = !!settings[:crop]
 
       {
-        format: picture.default_render_format,
+        format: picture_render_format(options.delete(:format) || settings[:format]),
         crop: crop,
         crop_from: crop && crop_from.presence || nil,
         crop_size: crop && crop_size.presence || nil,
         size: settings[:size]
-      }.with_indifferent_access
+      }.merge(options).with_indifferent_access
+    end
+
+    # Picture rendering options for each entry of the +srcset+ setting
+    #
+    # Entries can either be a size string (i.e. +"800x600"+) or a hash
+    # with +size+ and optional +format+ keys.
+    #
+    # @param srcset [Array<String, Hash>] Defaults to the +srcset+ setting
+    #
+    # @return [Array<HashWithIndifferentAccess>]
+    def picture_srcset_variant_options(srcset = settings.fetch(:srcset, []))
+      return [] if picture.nil?
+
+      srcset.map do |src|
+        picture_url_options(src.is_a?(Hash) ? src : {size: src})
+      end
+    end
+
+    # Url, dimensions and mime type for each entry of the +srcset+ setting
+    #
+    # === Example:
+    #
+    #   picture_srcset_options
+    #   # => [{url: "/pictures/1/360x360/cats.webp", desc: "360w", width: "360", height: "360", type: "image/webp"}]
+    #
+    # @param srcset [Array<String, Hash>] Defaults to the +srcset+ setting
+    #
+    # @return [Array<Hash>]
+    def picture_srcset_options(srcset = settings.fetch(:srcset, []))
+      picture_srcset_variant_options(srcset).map do |options|
+        width, height = options[:size].to_s.split("x", 2)
+
+        {
+          url: picture_url(options),
+          desc: width.present? ? "#{width}w" : "#{height}h",
+          width: width,
+          height: height,
+          type: Mime::Type.lookup_by_extension(options[:format]).to_s
+        }
+      end
     end
 
     # Returns an url for the thumbnail representation of the assigned picture
@@ -109,6 +156,14 @@ module Alchemy
 
     private
 
+    def picture_render_format(format)
+      if format.present? && picture.has_convertible_format?
+        format.to_s
+      else
+        picture.default_render_format
+      end
+    end
+
     # An Image smaller than dimensions
     # can not be cropped to given size - unless upsample is true.
     #

data/app/models/concerns/alchemy/publishable.rb

@@ -3,13 +3,10 @@ module Alchemy
     extend ActiveSupport::Concern
 
     included do
-      scope :draft, -> { where(public_on: nil) }
-      scope :scheduled, -> { where.not(public_on: nil) }
-
+      scope :draft, -> { Alchemy.config.publishable_resolver.draft(all) }
+      scope :scheduled, -> { Alchemy.config.publishable_resolver.scheduled(all) }
       scope :published, ->(at: Current.preview_time) {
-        scheduled
-          .where("#{table_name}.public_on <= :at", at:)
-          .where("#{table_name}.public_until IS NULL OR #{table_name}.public_until > :at", at:)
+        Alchemy.config.publishable_resolver.published(all, at:)
       }
 
       validate do
@@ -23,42 +20,32 @@ module Alchemy
 
     # Determines if this record is public
     #
-    # Takes the two timestamps +public_on+ and +public_until+
-    # and returns true if the time given (+Time.current+ per default)
-    # is in this timespan.
-    #
-    # @param at [DateTime] (Time.current)
+    # @param at [DateTime] (Current.preview_time)
     # @returns Boolean
     def public?(at: Current.preview_time)
-      already_public_for?(at:) && still_public_for?(at:)
+      publishable_resolver.public?(at:)
     end
     alias_method :public, :public?
 
+    # Determines if this record has a future publication or expiration event
+    #
+    # @param at [DateTime] (Current.preview_time)
+    # @returns Boolean
     def scheduled?(at: Current.preview_time)
-      (public_on.present? && public_on > at) || (public_until.present? && public_until > at)
+      publishable_resolver.scheduled?(at:)
     end
 
     # Determines if this record is publishable
     #
-    # A record is publishable if a +public_on+ timestamp is set and not expired yet.
-    #
     # @returns Boolean
     def publishable?
-      !public_on.nil? && still_public_for?(at: Time.current)
+      publishable_resolver.publishable?
     end
 
-    # Determines if this record is already public for given time
-    # @param at [DateTime] (Time.current)
-    # @returns Boolean
-    def already_public_for?(at: Current.preview_time)
-      !public_on.nil? && public_on <= at
-    end
+    private
 
-    # Determines if this record is still public for given time
-    # @param at [DateTime] (Time.current)
-    # @returns Boolean
-    def still_public_for?(at: Current.preview_time)
-      public_until.nil? || public_until > at
+    def publishable_resolver
+      @_publishable_resolver ||= Alchemy.config.publishable_resolver.new(self)
     end
   end
 end

data/app/models/concerns/alchemy/taggable.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Alchemy
+  # ActsAsTaggableOn to Gutentag interface compatibility module
+  # Include this module to add tagging support to your model.
+  module Taggable
+    def self.included(base)
+      Gutentag::ActiveRecord.call base
+      base.extend ClassMethods
+
+      # Opt-in denormalized cache, maintained only for taggables whose table
+      # has a cached_tag_list column. serialize defers until the schema loads,
+      # so declaring it unconditionally never touches the DB at boot and is
+      # harmless for taggables without the column.
+      base.attribute :cached_tag_list, default: -> { [] }
+      base.serialize :cached_tag_list, coder: JSON
+      base.before_save :remember_tag_name_change
+      base.after_save :cache_tag_list
+    end
+
+    # The public list of tag names. Reads the denormalized cache column so the
+    # common read paths (rendering, serializing) issue no query. Models without
+    # the cache column fall back to gutentag's lazy-loading tag_names.
+    #
+    # The column is nullable, so rows written before the cache was introduced
+    # read back nil, which we coerce to an empty array.
+    def tag_list
+      caches_tag_list? ? (cached_tag_list || []) : tag_names
+    end
+
+    # Set a list of tags
+    # Pass a String with comma separated tag names or
+    # an Array of tag names
+    def tag_list=(tags)
+      case tags
+      when String
+        self.tag_names = tags.split(/,\s*/)
+      when Array
+        self.tag_names = tags
+      end
+    end
+
+    private
+
+    # gutentag reconciles the tags in an after_save callback, and reading its
+    # tag_names accessor before that runs would lazy-load from the still-empty
+    # tags association of an unsaved record. So we remember whether the tags
+    # changed here (query-free) and read the reconciled value after the save.
+    def remember_tag_name_change
+      @tag_names_changed = will_save_change_to_tag_names?
+      true
+    end
+
+    # Keeps the denormalized cached_tag_list column in sync with the tags.
+    # Only runs when the tags actually changed, so untagged saves stay
+    # query-free.
+    def cache_tag_list
+      return unless @tag_names_changed
+      return unless caches_tag_list?
+
+      update_column(:cached_tag_list, Array(tag_names))
+    end
+
+    def caches_tag_list?
+      self.class.column_names.include?("cached_tag_list")
+    end
+
+    module ClassMethods
+      def tagged_with(names = [], **args)
+        if names.is_a? String
+          names = names.split(/,\s*/)
+        end
+
+        unless args[:match]
+          args[:match] = :all
+        end
+
+        if names.any?
+          args[:names] = names
+        end
+
+        super(args)
+      end
+
+      # Returns all unique tags
+      def tag_counts
+        Gutentag::Tag.distinct.joins(:taggings)
+          .where(gutentag_taggings: {taggable_type: name})
+      end
+    end
+  end
+end

data/app/models/concerns/alchemy/user_methods.rb

@@ -0,0 +1,95 @@
+module Alchemy
+  module UserMethods
+    extend ActiveSupport::Concern
+
+    included do
+      # Unlock all locked pages before destroy.
+      before_destroy :unlock_pages!
+
+      scope :alchemy_admins, -> { with_alchemy_role(:admin) }
+
+      scope :with_alchemy_role, ->(role) {
+        role = role.to_s.downcase
+        unless Alchemy.config.user_roles.include?(role)
+          Alchemy::Logger.warn("Unknown Alchemy role: #{role.inspect}")
+        end
+
+        col = arel_table[:alchemy_roles]
+        where(
+          col.eq(role)
+            .or(col.matches("#{role} %"))
+            .or(col.matches("% #{role} %"))
+            .or(col.matches("% #{role}"))
+        )
+      }
+
+      validates :alchemy_roles,
+        inclusion: {
+          in: Alchemy.config.user_roles,
+          message: "is not included in #{Alchemy.config.user_roles.join(", ")}"
+        }
+
+      # Returns all pages locked by user.
+      #
+      # A page gets locked when the user starts to edit the page.
+      #
+      has_many :locked_pages,
+        -> { order(:locked_at) },
+        foreign_key: :locked_by,
+        class_name: "Alchemy::Page",
+        inverse_of: :locker
+    end
+
+    class_methods do
+      def human_alchemy_rolename(role)
+        Alchemy.t("user_roles.#{role}")
+      end
+    end
+
+    def alchemy_admin?
+      has_alchemy_role?("admin")
+    end
+
+    def alchemy_roles
+      if self.class.columns_hash["alchemy_roles"]
+        read_attribute(:alchemy_roles).to_s.split(" ")
+      else
+        Alchemy::Logger.warn <<-WARN.strip_heredoc
+          The `alchemy_roles` column is missing in the #{self.class.table_name} table!
+
+          Please run
+
+            rails generate alchemy:user_columns_migration
+
+          to add it.
+
+          Falling back to default role: `member`.
+        WARN
+        ["member"]
+      end
+    end
+
+    def alchemy_roles=(roles)
+      roles = Array(roles).map { _1.to_s.strip }
+      roles.reject!(&:blank?)
+      roles.uniq!
+      super(roles.join(" "))
+    end
+
+    # Returns true if the user has the given role.
+    def has_alchemy_role?(role)
+      alchemy_roles.include?(role.to_s)
+    end
+
+    def human_alchemy_roles
+      alchemy_roles.map do |role|
+        self.class.human_alchemy_rolename(role)
+      end.to_sentence
+    end
+
+    # Calls unlock on all locked pages
+    def unlock_pages!
+      locked_pages.each(&:unlock!)
+    end
+  end
+end

data/app/services/alchemy/duplicate_element.rb

@@ -4,6 +4,7 @@ module Alchemy
   class DuplicateElement
     SKIPPED_ATTRIBUTES_ON_COPY = [
       "cached_tag_list",
+      "tag_names",
       "created_at",
       "creator_id",
       "position",
@@ -27,11 +28,13 @@ module Alchemy
         .merge(differences)
         .merge(
           autogenerate_ingredients: false,
-          autogenerate_nested_elements: false,
-          tags: source_element.tags
+          autogenerate_nested_elements: false
         )
 
       new_element = Element.new(attributes)
+      # Only assign tags when the source has any, so copying untagged elements
+      # (the common case) does not trigger gutentag's tag reconciliation.
+      new_element.tag_list = source_element.tag_list if source_element.tag_list.present?
       new_element.ingredients = source_element.ingredients.map(&:dup)
       new_element.save!
 

data/app/services/alchemy/element_preloader.rb

@@ -72,8 +72,7 @@ module Alchemy
     # Associations to preload for element rendering
     def element_includes
       [
-        {ingredients: :related_object},
-        :tags
+        {ingredients: :related_object}
       ]
     end
 

data/app/stylesheets/alchemy/_custom-properties.scss

@@ -68,6 +68,7 @@
   --font-size_xlarge: 24px; /* 2 rem */
 
   --font-weight_normal: 500;
+  --font-weight_semibold: 600;
   --font-weight_bold: 700;
 
   --font-default: var(--font-size_medium) var(--font-sans);

data/app/stylesheets/alchemy/_extends.scss

@@ -53,11 +53,3 @@
     cursor: not-allowed;
   }
 }
-
-%gradiated-toolbar {
-  display: flex;
-  background: var(--toolbar-bg-color);
-  padding: var(--toolbar-padding);
-  height: var(--toolbar-height);
-  border-bottom: var(--toolbar-border-bottom);
-}

data/app/stylesheets/alchemy/_themes.scss

@@ -152,8 +152,10 @@
   --pagination-disabled-text-color: var(--a-light-grey);
 
   /* Panels */
-  --panel-background-color: var(--a-darker-grey);
+  --panel-background-color: var(--body-background-color);
   --panel-border-color: var(--a-grey);
+  --panel-box-shadow: 0 var(--spacing-0) var(--spacing-2)
+    hsla(0deg, 0%, 0%, 0.5);
 
   --picture-thumbnail-background-color: var(--a-dark-grey);
   --picture-thumbnail-toolbar-bg-color: var(--a-darker-grey);
@@ -172,6 +174,8 @@
   --select-hover-bg-color: var(--color-blue_dark);
   --select-hover-border-color: var(--form-field-border-color);
   --select-hover-text-color: var(--text-color);
+  --select-selected-bg-color: var(--a-grey);
+  --select-selected-marker-color: var(--color-blue_medium);
   --select-background-image: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" fill="hsl(200deg, 5%, 70%)" viewBox="0 0 24 24"><path d="M11.9997 13.1714L16.9495 8.22168L18.3637 9.63589L11.9997 15.9999L5.63574 9.63589L7.04996 8.22168L11.9997 13.1714Z"></path></svg>');
   --select-close-icon: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="hsl(200deg, 5%, 70%)"><path d="M11.9997 10.5865L16.9495 5.63672L18.3637 7.05093L13.4139 12.0007L18.3637 16.9504L16.9495 18.3646L11.9997 13.4149L7.04996 18.3646L5.63574 16.9504L10.5855 12.0007L5.63574 7.05093L7.04996 5.63672L11.9997 10.5865Z"></path></svg>');
   --select-disabled-background-color: transparent;
@@ -284,12 +288,6 @@
   --sl-color-neutral-800: var(--a-lightest-grey);
   --sl-color-neutral-900: var(--a-lightest-grey);
   --sl-color-neutral-950: var(--a-lightest-grey);
-
-  .select2-container.select2-container-multi
-    .select2-search-choice-close:before,
-  .select2-container.select2-allowclear .select2-search-choice-close:before {
-    background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="hsl(200deg, 5%, 70%)"><path d="M11.9997 10.5865L16.9495 5.63672L18.3637 7.05093L13.4139 12.0007L18.3637 16.9504L16.9495 18.3646L11.9997 13.4149L7.04996 18.3646L5.63574 16.9504L10.5855 12.0007L5.63574 7.05093L7.04996 5.63672L11.9997 10.5865Z"></path></svg>');
-  }
 }
 
 @mixin light-theme {
@@ -434,8 +432,9 @@
   --pagination-disabled-text-color: #c0c0c0;
 
   /* Panels */
-  --panel-background-color: var(--color-grey_light);
-  --panel-border-color: var(--border-color);
+  --panel-background-color: var(--body-background-color);
+  --panel-border-color: var(--color-grey_light);
+  --panel-box-shadow: var(--dashboard-widget-box-shadow);
 
   --picture-tool-background-color: var(--color-white);
   --picture-tool-hover-background-color: var(--color-grey_very_light);
@@ -452,6 +451,8 @@
   --select-hover-bg-color: var(--color-blue_dark);
   --select-hover-border-color: var(--border-color);
   --select-hover-text-color: var(--color-white);
+  --select-selected-bg-color: var(--color-grey_light);
+  --select-selected-marker-color: var(--color-blue_medium);
   --select-background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="hsla(224deg, 23%, 26%, 0.75)"><path d="M11.9999 13.1714L16.9497 8.22168L18.3639 9.63589L11.9999 15.9999L5.63599 9.63589L7.0502 8.22168L11.9999 13.1714Z"></path></svg>');
   --select-close-icon: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="hsla(224deg, 23%, 26%, 0.75)"><path d="M11.9997 10.5865L16.9495 5.63672L18.3637 7.05093L13.4139 12.0007L18.3637 16.9504L16.9495 18.3646L11.9997 13.4149L7.04996 18.3646L5.63574 16.9504L10.5855 12.0007L5.63574 7.05093L7.04996 5.63672L11.9997 10.5865Z"></path></svg>');
   --select-disabled-background-color: transparent;

data/app/stylesheets/alchemy/admin/_empty-state.scss

@@ -0,0 +1,29 @@
+.empty-state {
+  width: 100%;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: var(--spacing-2);
+}
+
+.empty-state-header {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: var(--spacing-2);
+  margin-top: var(--spacing-2);
+  width: 100%;
+
+  > svg {
+    width: var(--icon-size-xl);
+    height: auto;
+  }
+
+  .empty-state-notice {
+    text-align: center;
+    padding-bottom: var(--spacing-4);
+    border-bottom: 1px solid var(--panel-border-color);
+    margin-bottom: var(--spacing-4);
+    text-shadow: var(--text-shadow-light);
+  }
+}

data/app/stylesheets/alchemy/admin/_help.scss

@@ -0,0 +1,10 @@
+.help-container {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+}
+
+.help-resource-links {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: var(--spacing-4);
+}