alchemy_cms 8.3.11 → 8.4.0

data/lib/alchemy/tasks/generate_thumbnails.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module Alchemy
+  # Pre-generates picture thumbnails so they do not have to be rendered
+  # on the first request.
+  #
+  # Used by the +alchemy:generate:thumbnails+ rake tasks. Works with both
+  # the +active_storage+ and the +dragonfly+ storage adapter.
+  #
+  # Both methods yield each processed record, so callers (like the rake task)
+  # can report progress without this service having to know about the shell.
+  #
+  # With +async: true+ the +active_storage+ variants are enqueued as
+  # +ActiveStorage::TransformJob+s instead of being processed inline. The
+  # +dragonfly+ adapter has no background processor and always runs inline.
+  class GenerateThumbnails
+    class << self
+      # Pre-generates the archive thumbnails (+Alchemy::Picture::THUMBNAIL_SIZES+)
+      # for every picture. These are the thumbnails used by the picture archive.
+      #
+      # @param async [Boolean] Enqueue active_storage variants as background jobs
+      # @yield [Alchemy::Picture] each picture after it was processed / enqueued
+      def pictures(async: false)
+        Alchemy::Picture.find_each do |picture|
+          generate_for_picture(picture, async: async)
+          yield picture if block_given?
+        end
+      end
+
+      # Pre-generates the thumbnails rendered for published picture ingredients.
+      #
+      # Takes the ingredients crop and srcset settings into account, so all
+      # variants that the frontend requests are generated upfront.
+      #
+      # @param element_names [Array<String>, nil] Restrict to these element names
+      # @param async [Boolean] Enqueue active_storage variants as background jobs
+      # @yield [Alchemy::Ingredients::Picture] each ingredient after it was processed / enqueued
+      def ingredients(element_names: nil, async: false)
+        ingredient_scope(element_names).find_each do |ingredient|
+          generate_for_ingredient(ingredient, async: async)
+          yield ingredient if block_given?
+        end
+      end
+
+      private
+
+      def generate_for_picture(picture, async:)
+        Alchemy::Picture::THUMBNAIL_SIZES.each_value do |size|
+          preprocess(picture, {size: size, flatten: true}, async: async)
+        end
+      end
+
+      def generate_for_ingredient(ingredient, async:)
+        picture = ingredient.picture
+        return if picture.nil?
+
+        preprocess(picture, ingredient.picture_url_options, async: async)
+        preprocess(picture, ingredient.thumbnail_url_options, async: async)
+        ingredient.picture_srcset_variant_options.each do |options|
+          preprocess(picture, options, async: async)
+        end
+      end
+
+      # Materializes a single picture variant for the given render options
+      # using the configured storage adapter.
+      #
+      # Under +active_storage+ this processes and stores the variant inline, or
+      # enqueues a native +ActiveStorage::TransformJob+ when +async+ is true.
+      # Under +dragonfly+ requesting the url persists the +Alchemy::PictureThumb+.
+      def preprocess(picture, options, async: false)
+        return unless picture&.has_convertible_format?
+
+        if Alchemy.storage_adapter.active_storage?
+          transformations = Alchemy::DragonflyToImageProcessing.call(options)
+          if async
+            ActiveStorage::TransformJob.perform_later(picture.image_file.blob, transformations)
+          else
+            picture.image_file.variant(transformations).processed
+          end
+        else
+          picture.url(options)
+        end
+      rescue => error
+        Alchemy::ErrorTracking.notification_handler.call(error)
+        nil
+      end
+
+      def ingredient_scope(element_names)
+        scope = Alchemy::Ingredients::Picture
+          .joins(:element)
+          .preload(:related_object)
+          .merge(Alchemy::Element.published)
+        return scope if element_names.blank?
+
+        scope.merge(Alchemy::Element.named(element_names))
+      end
+    end
+  end
+end

data/lib/alchemy/tasks/tidy.rb

@@ -64,8 +64,8 @@ module Alchemy
       def remove_duplicate_legacy_urls
         puts "\n## Removing duplicate legacy URLs"
         keep_ids = Alchemy::LegacyPageUrl
-          .select("MAX(id)")
           .group(:page_id, :urlname)
+          .pluck(Arel.sql("MAX(id)"))
         count = Alchemy::LegacyPageUrl
           .where.not(id: keep_ids)
           .delete_all

data/lib/alchemy/test_support/capybara_helpers.rb

@@ -3,26 +3,12 @@
 module Alchemy
   module TestSupport
     module CapybaraHelpers
-      # Select2 capybara helper
+      # @deprecated Use {#tom_select} instead.
       def select2(value, options)
-        label = find_label_by_text(options[:from])
-
-        select2_anchor_selector = ".select2-container a"
-
-        if label.has_css?(select2_anchor_selector)
-          label.find(select2_anchor_selector).click
-        else
-          within label.find(:xpath, "..") do
-            find(select2_anchor_selector).click
-          end
-        end
-
-        within_entire_page do
-          page.find(
-            "div.select2-result-label",
-            text: /#{Regexp.escape(value)}/i, match: :prefer_exact
-          ).click
-        end
+        Alchemy::Deprecation.warn(
+          "Alchemy::TestSupport::CapybaraHelpers#select2 is deprecated. Use #tom_select instead."
+        )
+        tom_select(value, options)
       end
 
       # Tom Select capybara helper
@@ -42,30 +28,55 @@ module Alchemy
         end
       end
 
-      def select2_search(value, options)
-        if options[:from]
-          label = find_label_by_text(options[:from])
-          within label.first(:xpath, ".//..") do
-            options[:from] = "##{find(".select2-container")["id"]}"
-          end
-        elsif options[:element_id] && options[:ingredient_role]
-          container_id = find("#element_#{options[:element_id]} [data-ingredient-role='#{options[:ingredient_role]}'] .select2-container")["id"]
-          options[:from] = "##{container_id}"
+      # Tom Select capybara helper for adding a tag to an
+      # alchemy-tags-autocomplete field.
+      def add_tom_select_tag(value, options)
+        label = find_label_by_text(options[:from])
+
+        within label.find(:xpath, "..") do
+          find(".ts-control").click
+          find(".ts-control input").send_keys(value, :return)
         end
+      end
 
-        find("#{options[:from]}:not(.select2-container-disabled):not(.select2-offscreen)").click
+      # Tom Select capybara helper for remote (ajax) selects. Types the given
+      # value into the search field to trigger the server request and selects the
+      # matching option. Pass `select: false` to only search without selecting.
+      def tom_select_search(value, options)
+        scope =
+          if options[:from]
+            find_label_by_text(options[:from]).find(:xpath, "..")
+          elsif options[:element_id] && options[:ingredient_role]
+            find("#element_#{options[:element_id]} [data-ingredient-role='#{options[:ingredient_role]}']")
+          else
+            page
+          end
 
-        within_entire_page do
-          find("input.select2-input.select2-focused").set(value)
-          expect(page).to_not have_selector(".select2-searching")
-          unless options[:select] == false
-            expect(page).to have_selector(".select2-result-label", visible: true)
-            find("div.select2-result-label", text: /#{Regexp.escape(value)}/i, match: :prefer_exact).click
-            expect(page).not_to have_selector(".select2-result-label")
+        within scope do
+          find(".ts-control").click
+          find(".ts-control input").send_keys(value)
+        end
+
+        # The dropdown is appended to the body, so search the whole page for it.
+        # `find` waits for the debounced remote request to deliver the option.
+        unless options[:select] == false
+          within_entire_page do
+            find(
+              ".ts-dropdown .option",
+              text: /#{Regexp.escape(value)}/i, match: :prefer_exact
+            ).click
           end
         end
       end
 
+      # @deprecated Use {#tom_select_search} instead.
+      def select2_search(value, options)
+        Alchemy::Deprecation.warn(
+          "Alchemy::TestSupport::CapybaraHelpers#select2_search is deprecated. Use #tom_select_search instead."
+        )
+        tom_select_search(value, options)
+      end
+
       def click_button_with_tooltip(content)
         find(%([content="#{content}"] button)).click
       end
@@ -85,7 +96,7 @@ module Alchemy
       end
 
       def find_label_by_text(text)
-        find "label:not(.select2-offscreen)",
+        find "label",
           text: /#{Regexp.escape(text)}/i,
           match: :one
       rescue Capybara::ElementNotFound

data/lib/alchemy/test_support/current_language_shared_examples.rb

@@ -24,7 +24,7 @@ RSpec.shared_examples_for "a controller that loads current language" do |args|
         it "shows flash warning with redirect" do
           Alchemy::Language.destroy_all
           get :index, params: {site_id: site_1.id}
-          expect(flash[:warning]).to eq Alchemy.t("Please create a language first.")
+          expect(flash[:info]).to eq Alchemy.t("Please create a language first.")
           expect(response).to redirect_to admin_languages_path
         end
       end

data/lib/alchemy/test_support/factories/dummy_user_factory.rb

@@ -4,7 +4,10 @@ FactoryBot.define do
   factory :alchemy_dummy_user, class: "DummyUser" do
     sequence(:email) { |n| "john.#{n}@doe.com" }
     password { "s3cr3t" }
-    alchemy_roles { ["member"] }
+
+    trait :as_member do
+      alchemy_roles { ["member"] }
+    end
 
     trait :as_admin do
       alchemy_roles { ["admin"] }

data/lib/alchemy/test_support/having_picture_thumbnails_examples.rb

@@ -183,6 +183,61 @@ RSpec.shared_examples_for "having picture thumbnails" do
       end
     end
 
+    context "having format setting" do
+      before do
+        allow(record).to receive(:settings) { {format: "webp"} }
+      end
+
+      context "with picture having a convertible format" do
+        before do
+          allow(picture).to receive(:has_convertible_format?) { true }
+        end
+
+        it "includes this format" do
+          expect(picture_url_options[:format]).to eq "webp"
+        end
+
+        context "with format option given" do
+          subject(:picture_url_options) { record.picture_url_options(format: "png") }
+
+          it "prefers the option" do
+            expect(picture_url_options[:format]).to eq "png"
+          end
+        end
+      end
+
+      context "with picture not having a convertible format" do
+        before do
+          allow(picture).to receive(:has_convertible_format?) { false }
+          allow(picture).to receive(:default_render_format) { "svg" }
+        end
+
+        it "includes the pictures default render format" do
+          expect(picture_url_options[:format]).to eq "svg"
+        end
+
+        context "with format option given" do
+          subject(:picture_url_options) { record.picture_url_options(format: "png") }
+
+          it "still includes the pictures default render format" do
+            expect(picture_url_options[:format]).to eq "svg"
+          end
+        end
+      end
+    end
+
+    context "with size option given" do
+      subject(:picture_url_options) { record.picture_url_options(size: "100x100") }
+
+      before do
+        allow(record).to receive(:settings) { {size: "30x70"} }
+      end
+
+      it "prefers the option" do
+        expect(picture_url_options[:size]).to eq "100x100"
+      end
+    end
+
     context "without picture assigned" do
       let(:picture) { nil }
 
@@ -190,6 +245,83 @@ RSpec.shared_examples_for "having picture thumbnails" do
     end
   end
 
+  describe "#picture_srcset_variant_options" do
+    subject(:picture_srcset_variant_options) { record.picture_srcset_variant_options }
+
+    let(:picture) do
+      build(:alchemy_picture).tap do |picture|
+        allow(picture).to receive(:has_convertible_format?) { true }
+        allow(picture).to receive(:default_render_format) { "jpg" }
+      end
+    end
+
+    before do
+      allow(record).to receive(:settings) do
+        {
+          size: "1200x800",
+          srcset: ["360x360", {size: "360x360", format: "webp"}]
+        }.with_indifferent_access
+      end
+    end
+
+    it "returns url options for each srcset entry" do
+      expect(picture_srcset_variant_options.map { |options| options.slice(:size, :format) }).to eq([
+        {"size" => "360x360", "format" => "jpg"},
+        {"size" => "360x360", "format" => "webp"}
+      ])
+    end
+
+    context "with format setting" do
+      before do
+        allow(record).to receive(:settings) do
+          {format: "png", srcset: ["360x360", {size: "360x360", format: "webp"}]}.with_indifferent_access
+        end
+      end
+
+      it "uses the format setting for entries without format" do
+        expect(picture_srcset_variant_options.map { |options| options[:format] }).to eq(["png", "webp"])
+      end
+    end
+
+    context "without picture assigned" do
+      let(:picture) { nil }
+
+      it { is_expected.to eq([]) }
+    end
+  end
+
+  describe "#picture_srcset_options" do
+    subject(:picture_srcset_options) { record.picture_srcset_options }
+
+    let(:picture) do
+      create(:alchemy_picture).tap do |picture|
+        allow(picture).to receive(:has_convertible_format?) { true }
+        allow(picture).to receive(:default_render_format) { "jpg" }
+      end
+    end
+
+    before do
+      allow(record).to receive(:settings) do
+        {srcset: ["360x240", {size: "360x240", format: "webp"}]}.with_indifferent_access
+      end
+    end
+
+    it "returns url, dimensions and mime type for each srcset entry", :aggregate_failures do
+      expect(picture_srcset_options.map { |src| src.except(:url) }).to eq([
+        {desc: "360w", width: "360", height: "240", type: "image/jpeg"},
+        {desc: "360w", width: "360", height: "240", type: "image/webp"}
+      ])
+      expect(picture_srcset_options[0][:url]).to match(/\.jpg/)
+      expect(picture_srcset_options[1][:url]).to match(/\.webp/)
+    end
+
+    context "without picture assigned" do
+      let(:picture) { nil }
+
+      it { is_expected.to eq([]) }
+    end
+  end
+
   describe "#thumbnail_url" do
     subject(:thumbnail_url) { record.thumbnail_url }
 

data/lib/alchemy/test_support/shared_ingredient_examples.rb

@@ -80,3 +80,55 @@ RSpec.shared_examples_for "an alchemy ingredient" do
     it { is_expected.to be_a("#{described_class}View".constantize) }
   end
 end
+
+# Shared by the ingredients that store an editor supplied url.
+#
+#   it_behaves_like "a linkable alchemy ingredient", :link
+#
+RSpec.shared_examples_for "a linkable alchemy ingredient" do |url_attribute|
+  describe "url scheme validation" do
+    let(:element) { build(:alchemy_element, name: "article") }
+
+    subject(:ingredient) do
+      described_class.new(element: element, role: "headline")
+    end
+
+    # captured in a let, a block parameter is not in scope inside a def
+    let(:attribute) { url_attribute }
+
+    def errors_for(url)
+      ingredient.public_send(:"#{attribute}=", url)
+      ingredient.valid?
+      ingredient.errors[attribute]
+    end
+
+    it "allows a blank url" do
+      expect(errors_for(nil)).to be_empty
+    end
+
+    it "allows an allowed scheme" do
+      expect(errors_for("https://example.com")).to be_empty
+      expect(errors_for("mailto:jane@example.com")).to be_empty
+    end
+
+    it "allows a relative url" do
+      expect(errors_for("/a/path")).to be_empty
+      expect(errors_for("#an-anchor")).to be_empty
+    end
+
+    it "rejects an executable scheme" do
+      expect(errors_for("javascript:alert(document.domain)")).to be_present
+      expect(errors_for("data:text/html;base64,PHN2Zz4=")).to be_present
+      expect(errors_for("vbscript:msgbox(1)")).to be_present
+    end
+
+    it "rejects an executable scheme obfuscated by whitespace" do
+      expect(errors_for(" javascript:alert(1)")).to be_present
+      expect(errors_for("java\tscript:alert(1)")).to be_present
+    end
+
+    it "rejects a javascript url disguised as an authority" do
+      expect(errors_for("javascript://%0aalert(1)")).to be_present
+    end
+  end
+end

data/lib/alchemy/test_support/shared_publishable_examples.rb

@@ -33,6 +33,11 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
     it "only includes records without public_on date" do
       expect(subject).to eq [nil]
     end
+
+    it "delegates to the resolver" do
+      expect(Alchemy.config.publishable_resolver).to receive(:draft)
+      described_class.draft
+    end
   end
 
   describe ".scheduled" do
@@ -50,6 +55,11 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
         public_two
       ])
     end
+
+    it "delegates to the resolver" do
+      expect(Alchemy.config.publishable_resolver).to receive(:scheduled)
+      subject
+    end
   end
 
   describe ".published" do
@@ -57,6 +67,11 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
     let!(:public_two) { create(factory_name, public_on: Date.tomorrow) }
     let!(:non_public) { create(factory_name, public_on: nil) }
 
+    it "delegates to the resolver" do
+      expect(Alchemy.config.publishable_resolver).to receive(:published)
+      described_class.published
+    end
+
     context "without time given" do
       subject { described_class.published }
 
@@ -97,13 +112,16 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
     subject { publishable.scheduled? }
 
     let(:publishable) { build(factory_name, public_on:, public_until:) }
+    let(:public_on) { nil }
+    let(:public_until) { nil }
 
-    context "when public_on is nil" do
-      let(:public_on) { nil }
+    it "delegates to the resolver" do
+      expect_any_instance_of(Alchemy.config.publishable_resolver).to receive(:scheduled?)
+      subject
+    end
 
+    context "when public_on is nil" do
       context "and public_until is nil" do
-        let(:public_until) { nil }
-
         it { expect(subject).to be(false) }
       end
 
@@ -155,6 +173,13 @@ RSpec.shared_examples_for "being publishable" do |factory_name|
   describe "#public?" do
     subject { publishable.public? }
 
+    let(:publishable) { build(factory_name) }
+
+    it "delegates to the resolver" do
+      expect_any_instance_of(Alchemy.config.publishable_resolver).to receive(:public?)
+      subject
+    end
+
     context "when public_on is not set" do
       let(:publishable) { build(factory_name, public_on: nil) }