alchemy_cms 8.3.11 → 8.4.1

data/lib/alchemy/configurations/main.rb

@@ -1,12 +1,15 @@
 # frozen_string_literal: true
 
 require "alchemy/configuration"
+require "alchemy/configurations/admin_components"
 require "alchemy/configurations/dashboard"
 require "alchemy/configurations/default_language"
 require "alchemy/configurations/default_site"
 require "alchemy/configurations/importmap"
 require "alchemy/configurations/format_matchers"
 require "alchemy/configurations/mailer"
+require "alchemy/configurations/menu"
+require "alchemy/configurations/menu_item"
 require "alchemy/configurations/page_cache"
 require "alchemy/configurations/preview"
 require "alchemy/configurations/sitemap"
@@ -50,6 +53,7 @@ module Alchemy
       #
       #   show_root [Boolean] # Show language root page in sitemap?
       #   show_flag [Boolean] # Enables the Checkbox in Page#update overlay. So your customer can set the visibility of pages in the sitemap.
+      #   max_age [Integer]   # How long the sitemap is cached, in seconds. Set to 0 to disable sitemap caching.
       configuration :sitemap, Sitemap
 
       # === Default items per page in admin views
@@ -81,6 +85,14 @@ module Alchemy
       #
       configuration :preview, Preview
 
+      # === Preview load timeout
+      #
+      # The number of seconds the admin preview window waits for the preview
+      # frame to load before it stops the loading spinner and warns the user
+      # that the preview failed to load.
+      #
+      option :preview_load_timeout, :integer, default: 5
+
       # === Picture rendering settings
       #
       # Alchemy uses Dragonfly to render images. Settings for image rendering are specific to elements and are defined in elements.yml
@@ -177,17 +189,42 @@ module Alchemy
 
       # === Link Target Options
       #
-      # Values for the link target selectbox inside the page link overlay.
-      # The value gets attached as a data-link-target attribute to the link.
+      # Values for the link target selectbox inside the link dialog.
+      #
+      # Each value is stored with a leading underscore, so that it can be used
+      # as the link's `target` attribute right away: `blank` is stored as
+      # `_blank` and rendered as `target="_blank"`. Views rendering a link
+      # themselves should pass the stored value through
+      # `Alchemy::Ingredients::LinkTarget#link_target_value`, which also maps
+      # the legacy `blank` (stored before the underscore was added) to
+      # `_blank`.
       #
       # == Example:
       #
-      # Open all links set to overlay inside an jQuery UI Dialog Window.
+      # Open all links set to overlay in a dialog window in your frontend code,
+      # based on the `target="_overlay"` attribute. Such a target has no meaning
+      # to the browser, so your code needs to handle the click itself.
       #
-      #   jQuery(a[data-link-target="overlay"]).dialog();
+      #   config.link_target_options = %w[blank overlay]
       #
       option :link_target_options, :collection, item_type: :string, default: %w[blank]
 
+      # === Allowed url schemes
+      #
+      # Url schemes editors are allowed to store in menu nodes and linkable
+      # ingredients. Any other scheme is rejected, because a scheme like
+      # `javascript:` turns an editable url into script execution in your
+      # site's own origin.
+      #
+      # Urls without a scheme (absolute and relative paths, anchors, queries
+      # and protocol relative urls) are always allowed.
+      #
+      # == Example:
+      #
+      #   config.allowed_url_schemes = %w[http https mailto]
+      #
+      option :allowed_url_schemes, :collection, item_type: :string, default: %w[http https mailto tel ftp]
+
       # === Format matchers
       #
       # Named aliases for regular expressions that can be used in various places.
@@ -291,6 +328,34 @@ module Alchemy
       #
       option :admin_importmaps, :collection, collection_class: Set, item_type: :configuration, config_class: Alchemy::Configurations::Importmap, default: []
 
+      # The entries of the admin main navigation
+      #
+      # +url+ and +condition+ are evaluated in the view context.
+      #
+      # Entries without a +condition+ (and without a legacy +controller+ and
+      # +action+) are shown to every admin user.
+      #
+      # == Example
+      #
+      #    Alchemy.configure do |config|
+      #      config.menu.add(
+      #        name: "events",
+      #        title: "Events",
+      #        icon: "calendar",
+      #        url: -> { main_app.admin_events_path },
+      #        condition: -> { can?(:index, :admin_events) },
+      #        children: [
+      #          {
+      #            title: "Locations",
+      #            url: -> { main_app.admin_locations_path },
+      #            condition: -> { can?(:index, :admin_locations) }
+      #          }
+      #        ]
+      #      )
+      #    end
+      #
+      option :menu, :collection, item_type: :configuration, config_class: Alchemy::Configurations::MenuItem, default: Alchemy::Configurations::Menu::DEFAULT
+
       # Additional stylesheets to be included in the Alchemy admin UI
       #
       # == Example
@@ -468,6 +533,40 @@ module Alchemy
       # === Dashboard configuration
       #
       configuration :dashboard, Dashboard
+
+      # === Admin component registry
+      #
+      # Overridable admin ViewComponents keyed by role, so extensions can swap
+      # a component for their own.
+      #
+      configuration :admin_components, AdminComponents
+
+      # === Admin Content Security Policy
+      #
+      # The class building the Content Security Policy Alchemy sends with its
+      # own admin responses. Defaults to +nil+, which sends no policy at all.
+      # It will be enabled by default in Alchemy 9.0.
+      #
+      # It never replaces a policy the host application has configured, and it
+      # only applies to Alchemy's own controllers.
+      #
+      #    Alchemy.config.admin_content_security_policy = "Alchemy::Admin::ContentSecurityPolicy"
+      #
+      option :admin_content_security_policy, :class, default: nil
+
+      # === Publishable resolver
+      #
+      # The class used to resolve publication state for Publishable records
+      # (currently +Alchemy::Element+ and +Alchemy::PageVersion+).
+      #
+      # The default resolver uses the +public_on+ / +public_until+ timestamp
+      # columns. Apps or gems can provide a custom resolver that implements
+      # the same interface — see +Alchemy::Publishable::TimestampResolver+
+      # for the interface.
+      #
+      # == Example
+      #     Alchemy.config.publishable_resolver = "MyApp::CustomResolver"
+      option :publishable_resolver, :class, default: "Alchemy::Publishable::TimestampResolver"
     end
   end
 end

data/lib/alchemy/configurations/menu.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Alchemy
+  module Configurations
+    module Menu
+      DEFAULT = [
+        {
+          name: "dashboard",
+          title: "Home",
+          position: 1,
+          icon: "home-2",
+          url: -> { alchemy.admin_dashboard_path },
+          condition: -> { can?(:index, :alchemy_admin_dashboard) }
+        },
+        {
+          name: "pages",
+          title: "modules.pages",
+          position: 2,
+          icon: "pages",
+          url: -> { alchemy.admin_pages_path },
+          condition: -> { can?(:index, :alchemy_admin_pages) },
+          children: [
+            {
+              title: "modules.pages",
+              url: -> { alchemy.admin_pages_path },
+              condition: -> { can?(:index, :alchemy_admin_pages) }
+            },
+            {
+              title: "modules.layoutpages",
+              url: -> { alchemy.admin_layoutpages_path },
+              condition: -> { can?(:index, :alchemy_admin_layoutpages) }
+            }
+          ]
+        },
+        {
+          name: "menus",
+          title: "modules.menus",
+          position: 3,
+          icon: "menu-2",
+          url: -> { alchemy.admin_nodes_path },
+          condition: -> { can?(:index, :alchemy_admin_nodes) }
+        },
+        {
+          name: "languages",
+          title: "modules.languages",
+          position: 4,
+          icon: "translate-2",
+          icon_style: "none",
+          url: -> { alchemy.admin_languages_path },
+          condition: -> { can?(:index, :alchemy_admin_languages) }
+        },
+        {
+          name: "sites",
+          title: "modules.sites",
+          position: 5,
+          icon: "global",
+          url: -> { alchemy.admin_sites_path },
+          condition: -> { can?(:index, :alchemy_admin_sites) }
+        },
+        {
+          name: "tags",
+          title: "modules.tags",
+          position: 6,
+          icon: "price-tag-3",
+          url: -> { alchemy.admin_tags_path },
+          condition: -> { can?(:index, :alchemy_admin_tags) }
+        },
+        {
+          name: "archive",
+          title: "modules.library",
+          position: 7,
+          icon: "archive-drawer",
+          url: -> { alchemy.admin_pictures_path },
+          condition: -> { can?(:index, :alchemy_admin_pictures) },
+          children: [
+            {
+              title: "modules.pictures",
+              url: -> { alchemy.admin_pictures_path },
+              condition: -> { can?(:index, :alchemy_admin_pictures) }
+            },
+            {
+              title: "modules.attachments",
+              url: -> { alchemy.admin_attachments_path },
+              condition: -> { can?(:index, :alchemy_admin_attachments) }
+            }
+          ]
+        }
+      ].freeze
+    end
+  end
+end

data/lib/alchemy/configurations/menu_item.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+module Alchemy
+  module Configurations
+    class MenuItem < Alchemy::Configuration
+      option :name, :string
+      option :title, :string
+      option :engine_name, :string
+      option :position, :number
+      option :icon, :string
+      option :icon_style, :string
+      option :image, :string
+      option :inline_image, :string
+      option :turbo, :boolean, default: true
+      option :url, :proc
+      option :condition, :proc
+      option :match_path, :regexp
+      option :children, :collection, item_type: :configuration, config_class: MenuItem
+
+      # Legacy options of entries registered with +Alchemy::Modules.register_module+
+      option :controller, :string
+      option :action, :string
+      option :nested_controllers, :collection, item_type: :string
+      option :nested_actions, :collection, item_type: :string
+      option :nested, :collection, item_type: :configuration, config_class: MenuItem
+
+      def self.from_legacy_hash(hash)
+        hash = hash.to_h.deep_stringify_keys
+        new(
+          from_legacy_navigation(hash["navigation"] || {}, engine_name: hash["engine_name"]).merge(
+            "name" => hash["name"],
+            "position" => hash["position"]
+          ).compact
+        )
+      end
+
+      def self.from_legacy_navigation(navigation, engine_name:)
+        {
+          "title" => navigation["name"],
+          "engine_name" => engine_name,
+          "controller" => navigation["controller"],
+          "action" => navigation["action"],
+          "url" => navigation["url"],
+          "condition" => navigation["condition"],
+          "icon" => navigation["icon"],
+          "icon_style" => navigation["icon-style"],
+          "image" => navigation["image"],
+          "inline_image" => navigation["inline_image"],
+          "turbo" => navigation.dig("data", "turbo").to_s != "false",
+          "nested_controllers" => navigation["nested_controllers"],
+          "nested_actions" => navigation["nested_actions"],
+          "children" => navigation["sub_navigation"]&.map { |entry| new(from_legacy_navigation(entry, engine_name:)) },
+          "nested" => navigation["nested"]&.map { |entry| new(from_legacy_navigation(entry, engine_name:)) }
+        }.compact
+      end
+      private_class_method :from_legacy_navigation
+
+      def path(view_context)
+        if url
+          view_context.instance_exec(&url)
+        elsif controller
+          routes = engine_name.present? ? view_context.public_send(engine_name) : view_context.main_app
+          routes.url_for(controller:, action:, only_path: true)
+        end
+      end
+
+      def visible?(view_context)
+        if condition
+          view_context.instance_exec(&condition)
+        elsif controller
+          view_context.can?(action.to_sym, controller.delete_prefix("/").tr("/", "_").to_sym)
+        else
+          true
+        end
+      end
+
+      def active?(view_context)
+        current?(view_context) || children.any? { |child| child.active?(view_context) }
+      end
+
+      def current?(view_context)
+        current_path = view_context.request.path
+        path_matches = if match_path
+          match_path.match?(current_path)
+        elsif (own_path = local_path(view_context))
+          current_path == own_path || current_path.start_with?("#{own_path.chomp("/")}/")
+        end
+
+        path_matches || [self, *nested].any? do |entry|
+          entry.matches_controller?(controller: view_context.params[:controller], action: view_context.params[:action])
+        end
+      end
+
+      def matches_controller?(controller:, action:)
+        return false unless self.controller
+
+        controller = controller.to_s.delete_prefix("/")
+        action = action.to_s
+        (self.controller.delete_prefix("/") == controller || nested_controllers.include?(controller)) &&
+          (self.action == action || nested_actions.include?(action))
+      end
+
+      def validate_controller_existence!
+        [controller, *children.map(&:controller)].compact.each do |controller|
+          controller_const_name = "#{controller.camelize}Controller"
+          controller_const_name.constantize
+        rescue NameError
+          raise "Error in AlchemyCMS module definition: '#{name}'. Could not find the " \
+            "matching controller class #{controller_const_name} for the specified controller: '#{controller}'"
+        end
+      end
+
+      private
+
+      def local_path(view_context)
+        uri = URI.parse(path(view_context).to_s)
+        uri.path.presence if uri.host.nil? || uri.host == view_context.request.host
+      rescue URI::InvalidURIError
+        nil
+      end
+    end
+  end
+end

data/lib/alchemy/configurations/sitemap.rb

@@ -5,6 +5,7 @@ module Alchemy
     class Sitemap < Alchemy::Configuration
       option :show_root, :boolean, default: true
       option :show_flag, :boolean, default: false
+      option :max_age, :integer, default: 3600
     end
   end
 end

data/lib/alchemy/configurations/uploader.rb

@@ -4,7 +4,21 @@ module Alchemy
   module Configurations
     class Uploader < Alchemy::Configuration
       class AllowedFileTypes < Alchemy::Configuration
-        option :alchemy_attachments, :collection, item_type: :string, default: ["*"]
+        # Document, media and archive formats Alchemy knows how to display.
+        # Executables and other active content are deliberately absent.
+        DEFAULT_ATTACHMENT_FILE_TYPES = %w[
+          pdf
+          doc docx odt rtf txt
+          xls xlsx ods csv
+          ppt pptx odp
+          vcf
+          zip
+          avif gif jpeg jpg png psd svg tif tiff webp
+          aac flac m4a mp3 oga ogg wav weba
+          avi flv m4v mov mp4 mpeg mpg ogv webm wmv
+        ].freeze
+
+        option :alchemy_attachments, :collection, item_type: :string, default: DEFAULT_ATTACHMENT_FILE_TYPES
         option :alchemy_pictures, :collection, item_type: :string, default: %w[jpg jpeg gif png svg webp]
 
         def set(configuration_hash)

data/lib/alchemy/engine.rb

@@ -159,12 +159,6 @@ module Alchemy
           Alchemy.config.user_class.stampable(stamper_class_name: Alchemy.config.user_class_name)
         end
       end
-
-      if defined?(RailsLiveReload) && Rails.env.development?
-        require "alchemy/dev_support/live_reload_watcher"
-
-        Alchemy::LiveReloadWatcher.init
-      end
     end
 
     initializer "alchemy.webp-mime_type" do |app|

data/lib/alchemy/i18n.rb

@@ -15,6 +15,20 @@ module Alchemy
     def t(msg, **kwargs)
       Alchemy::I18n.translate(msg, **kwargs)
     end
+
+    # Alchemy shortcut localization method
+    #
+    # Instead of having to call:
+    #
+    #     Alchemy::I18n.localize(datetime)
+    #
+    # You can use this shortcut method:
+    #
+    #     Alchemy.l(datetime)
+    #
+    def l(datetime, **kwargs)
+      Alchemy::I18n.localize(datetime, **kwargs)
+    end
   end
 
   module I18n
@@ -53,6 +67,18 @@ module Alchemy
         ::I18n.t(msg, **options.merge(scope: scope))
       end
 
+      # Returns a localized time string for the given time and format.
+      #
+      # @param datetime [Time|Date|nil]
+      # @param format [Symbol] (:"alchemy.default")
+      #
+      # @return [String|nil]
+      def localize(datetime, format: :"alchemy.default")
+        return nil if datetime.nil?
+
+        ::I18n.l(datetime, format:)
+      end
+
       def available_locales
         Rails.application.config.i18n.available_locales || begin
           @@available_locales ||= nil

data/lib/alchemy/modules.rb

@@ -2,10 +2,6 @@
 
 module Alchemy
   module Modules
-    mattr_accessor :alchemy_modules
-
-    @@alchemy_modules = YAML.load_file(File.expand_path("../../config/alchemy/modules.yml", __dir__))
-
     class << self
       def included(base)
         base.send :helper_method, :alchemy_modules, :module_definition_for
@@ -25,68 +21,74 @@ module Alchemy
       #     }
       #
       def register_module(module_definition)
-        definition_hash = module_definition.deep_stringify_keys
+        menu_item = Alchemy::Configurations::MenuItem.from_legacy_hash(module_definition)
+        return if menu_item.name.present? && Alchemy.config.menu.any? { |item| item.name == menu_item.name }
+
+        Alchemy.config.menu.add(menu_item)
+      end
+      deprecate register_module: "Use `Alchemy.config.menu.add` instead", deprecator: Alchemy::Deprecation
+
+      def alchemy_modules
+        Alchemy.config.menu.map { |menu_item| to_legacy_hash(menu_item) }
+      end
+      deprecate alchemy_modules: "Use `Alchemy.config.menu` instead", deprecator: Alchemy::Deprecation
+
+      def to_legacy_hash(menu_item)
+        {
+          "name" => menu_item.name,
+          "engine_name" => menu_item.engine_name,
+          "position" => menu_item.position,
+          "navigation" => to_legacy_navigation(menu_item)
+        }.compact
+      end
+
+      private
 
-        @@alchemy_modules |= [definition_hash]
+      def to_legacy_navigation(menu_item)
+        {
+          "name" => menu_item.title,
+          "controller" => menu_item.controller,
+          "action" => menu_item.action,
+          "url" => menu_item.url,
+          "condition" => menu_item.condition,
+          "icon" => menu_item.icon,
+          "icon-style" => menu_item.icon_style,
+          "image" => menu_item.image,
+          "inline_image" => menu_item.inline_image,
+          "data" => menu_item.turbo ? nil : {turbo: false},
+          "nested_controllers" => menu_item.nested_controllers.to_a.presence,
+          "nested_actions" => menu_item.nested_actions.to_a.presence,
+          "sub_navigation" => menu_item.children.map { |child| to_legacy_navigation(child) }.presence,
+          "nested" => menu_item.nested.map { |entry| to_legacy_navigation(entry) }.presence
+        }.compact
       end
     end
 
+    def alchemy_modules
+      Alchemy::Modules.alchemy_modules
+    end
+
     # Get the module definition for given module name
     #
     # You can also pass a hash of an module definition.
     # It then tries to find the module defintion from controller name and action name
     #
     def module_definition_for(name_or_params)
-      case name_or_params
+      menu_item = case name_or_params
       when String
-        alchemy_modules.detect { |m| m["name"] == name_or_params }
+        Alchemy.config.menu.detect { |item| item.name == name_or_params }
       when Hash
-        name_or_params.stringify_keys!
-        alchemy_modules.detect do |alchemy_module|
-          module_navi = alchemy_module.fetch("navigation", {})
-          definition_from_mainnavi(module_navi, name_or_params) ||
-            definition_from_subnavi(module_navi, name_or_params) ||
-            definition_from_nested(module_navi, name_or_params)
+        params = name_or_params.stringify_keys
+        Alchemy.config.menu.detect do |item|
+          [item, *item.children, *item.nested].any? do |entry|
+            entry.matches_controller?(controller: params["controller"], action: params["action"])
+          end
         end
       else
         raise ArgumentError, "Could not find module definition for #{name_or_params}"
       end
+      Alchemy::Modules.to_legacy_hash(menu_item) if menu_item
     end
-
-    private
-
-    def definition_from_mainnavi(module_navi, params)
-      controller_matches?(module_navi, params) && action_matches?(module_navi, params)
-    end
-
-    def definition_from_subnavi(module_navi, params)
-      subnavi = module_navi["sub_navigation"]
-      return if subnavi.nil?
-
-      subnavi.any? do |navi|
-        controller_matches?(navi, params) && action_matches?(navi, params)
-      end
-    end
-
-    def definition_from_nested(module_navi, params)
-      nested = module_navi["nested"]
-      return if nested.nil?
-
-      nested.any? do |navi|
-        controller_matches?(navi, params) && action_matches?(navi, params)
-      end
-    end
-
-    def controller_matches?(navi, params)
-      remove_slash(navi["controller"]) == remove_slash(params["controller"])
-    end
-
-    def action_matches?(navi, params)
-      navi["action"] == params["action"]
-    end
-
-    def remove_slash(str)
-      str.gsub(/^\//, "")
-    end
+    deprecate module_definition_for: "Use `Alchemy.config.menu` instead", deprecator: Alchemy::Deprecation
   end
 end