browsercms-artirix 4.0.0.rc1.art4

data/lib/cms/acts/content_page.rb

@@ -0,0 +1,90 @@
+#
+# Can be included into Controllers in your project to allow them to act as though they are CMS pages.
+# This means they can be:
+#
+#   1. Marked as having requiring permission as though they were in a particular section.
+#   2. Handle errors thrown from within the methods in the same way that CMS Pages do.
+#   3. Use CMS page templates as layouts (like TemplateSupport)
+#
+# This is intend to replace and deprecate TemplateSupport (which will be supported for a while for backwards compatibility)
+#
+# Minor Issue:
+#   Error handling for Page not found behaves slightly differently than ContentController currently. If the user is logged
+#   in as an editor, they will get a 500 page rather than 404. This would require reworking how the error processing
+#   works in Cms::ContentRenderingSupport. 
+module Cms
+  module Acts
+
+    # Override some of the behavior defined in Cms::PageHelper so templates display correctly Rails Controllers
+    module PageHelper
+
+      # Do not show the toolbar on Acts::As::ContentPages
+      def cms_toolbar
+        ""
+      end
+      
+      # If we are showing an error page, use that. Otherwise, just a blank page object that has a default title.
+      def current_page
+        super ? super : OpenStruct.new(page_title: controller.class.name.gsub("Controller", ""))
+      end
+    end
+    module ContentPage
+
+      def self.included(base)
+        base.send :include, Cms::ContentRenderingSupport
+        base.send :include, Cms::Authentication::Controller
+        base.extend ClassMethods
+
+        base.helper Cms::PageHelper
+        base.helper Cms::RenderingHelper
+        base.helper Cms::MenuHelper
+        base.helper Cms::Acts::PageHelper
+        base.helper Cms::UiElementsHelper
+        base.helper Cms::PathHelper
+        base.send :include, Cms::NavMenuHelper
+      end
+
+      # Allows a Controller method to set a page title for an action.
+      def page_title=(title)
+        @page_title = title
+      end
+
+      # Before filter that determines if the current user can access a specific section.
+      def check_access_to_section
+        user = current_user
+        logger.warn "Checking that current_user '#{user.login}' has access to view section with path '#{self.class.in_section}'."
+        unless user.able_to_view?(self.class.in_section)
+          store_location
+          raise Cms::Errors::AccessDenied
+        end
+      end
+
+      module ClassMethods
+
+        # Requires that some or all of the actions on this controller require the same permissions as a specific section of the website.
+        # Note that section paths aren't currently unique so the 'first' section found will be looked at.
+        #
+        # Params:
+        #   path - Should match the 'path' attribute for a given section.
+        #   options - Hash of options that will be passed to the before_filter call. See before_filter for valid options.
+        #
+        # Example:
+        #   MyController < ApplicationController
+        #     include Cms::Acts::ContentPage
+        #     requires_permission_for_section "/somepath", :except=>"action_name"
+        #   ...
+        #
+        def requires_permission_for_section(path, options={})
+          logger.warn "Setting path #{path}"
+          @section_path = path
+          before_filter :check_access_to_section, options
+        end
+
+        def in_section
+          @section_path
+        end
+      end
+    end
+
+  end
+end

data/lib/cms/acts.rb

@@ -0,0 +1,7 @@
+# Requires all files in the Acts As directory
+#
+# This adds the ContentBlock behavior to all Active Record objects.
+Dir["#{File.dirname(__FILE__)}/acts/*.rb"].each do |b| 
+  require File.join("cms", "acts", File.basename(b, ".rb"))
+end
+ActiveRecord::Base.send(:include, Cms::Acts::ContentBlock)

data/lib/cms/admin_tab.rb

@@ -0,0 +1,15 @@
+module Cms
+
+  # Any controller that is considered to be on the 'Admin' tab should include this.
+  module AdminTab
+    extend ActiveSupport::Concern
+
+    included do
+      before_filter :set_menu_section
+    end
+
+    def new_button_path
+      cms.new_user_path
+    end
+  end
+end

data/lib/cms/attachments/attachment_serving.rb

@@ -0,0 +1,59 @@
+module Cms
+  module Attachments
+
+    # Can be added to Controllers to handle serving files.
+    module Serving
+
+      # Send the file if:
+      #   1. It exists:
+      #   2. The user has permissions to see it.
+      #
+      # The strategy used to send the file can be configured based on the config.cms.attachments.storage parameter.
+      # Default is:
+      #   storage = :filesystem -> Cms::Attachments::FilesystemStrategy
+      def send_attachment(attachment)
+        if attachment
+          raise Cms::Errors::AccessDenied unless current_user.able_to_view?(attachment)
+          strategy_class = send_attachments_with
+          strategy_class.send_attachment(attachment, self)
+        end
+      end
+
+      def send_attachments_with
+        Cms::Attachments::Serving.send_attachments_with
+      end
+
+      # @return [#send_attachments] The strategy that will be used to serve files.
+      def self.send_attachments_with
+        storage = Rails.configuration.cms.attachments.storage
+        "Cms::Attachments::#{storage.to_s.classify}Strategy".constantize
+      end
+
+    end
+
+    class FilesystemStrategy
+
+      def self.attachments_storage_location
+        Rails.configuration.cms.attachments.storage_directory
+      end
+
+      def self.send_attachment(attachment, controller)
+        style = controller.params[:style]
+        style = "original" unless style
+        path_to_file = attachment.path(style)
+        if File.exists?(path_to_file)
+          Rails.logger.debug "Sending file #{path_to_file}"
+          controller.send_file(path_to_file,
+                               :filename => attachment.file_name,
+                               :type => attachment.file_type,
+                               :disposition => "inline"
+          )
+        else
+          msg = "Couldn't find file #{path_to_file}'"
+          Rails.logger.error msg
+          raise ActiveRecord::RecordNotFound.new(msg)
+        end
+      end
+    end
+  end
+end

data/lib/cms/attachments/configuration.rb

@@ -0,0 +1,88 @@
+require 'paperclip'
+require 'cms/attachments/attachment_serving'
+
+module Cms
+  # Cms::Attachments::Configuration exposes an interface to setup paperclip for BrowserCMS.
+  #
+  # Provides defaults that are suitable for the CMS and that probably make sense for most installations.
+  #
+  #This module also declares Paperclip interpolations that are used
+  #to construct the default url and path.
+  #
+  # For example, the default path:
+  #
+  # ":attachments_root/:id_partition/:style/:fingerprint"
+  #
+  # expands to something like:
+  #
+  #  #{Rails.root}/tmp/uploads/2011/1/30/thumb/thcu098rc87dgd
+  #
+  # but can be changed by using paperclip interpolations, either
+  # the ones already defined by Paperlip itself, the Cms::Assets
+  # module, or user defined.
+  module Attachments
+    mattr_accessor :configuration
+
+    def self.configure
+      configuration = self.configuration
+      yield configuration if block_given?
+      @@configuration = configuration
+      Attachment.configure_paperclip
+    end
+
+    def self.configuration
+      @@configuration || Configuration.new
+    end
+
+    # Allows each Attachment to have a customized configuration, even though there is a single Attachment class.
+    # Designed to allow 'typical' Paperclip configuration to be specified per attachment.
+    class Configuration
+      attr_accessor :url, :path, :styles, :processors, :default_url, :default_style, :storage, :whiny
+      attr_accessor :s3_credentials, :bucket
+      attr_accessor :file_permissions
+
+      attr_reader :use_timestamp
+
+      # Set default configurations for Attachments.
+      def initialize
+        self.url = Rails.configuration.cms.attachments[:url] || ":attachment_file_path"
+        self.path = ":attachments_root/:id_partition/:style/:fingerprint"
+        self.styles = {}
+        self.processors = [:thumbnail]
+        self.default_url = "/:attachment/:style/missing.png"
+        self.default_style = :original
+        self.storage = :filesystem
+        self.whiny = false
+
+        @use_timestamp = false
+      end
+    end
+
+
+    # This is the typical url for attachments
+    # Some attachments will have a custom path (data_file_path) specified by users
+    # while others will just be 'defaults'. This dynamically returns path at runtime based
+    # on the instance of the specific instance.
+    Paperclip.interpolates :attachment_file_path do |asset, style|
+      path = asset.instance.data_file_path
+      unless path
+        path = "/attachments/#{asset.instance.id}/#{asset.instance.data_file_name}"
+      end
+      if style && style != :original
+        "#{path}?style=#{style}"
+      else
+        path
+      end
+    end
+
+    Paperclip.interpolates :attachments_root do |_, _|
+      strategy = Cms::Attachments::Serving.send_attachments_with
+      strategy.attachments_storage_location
+    end
+
+    Paperclip.interpolates :full_filename do |asset, _|
+      "#{asset.instance.content_block_class}_#{asset.instance.data_file_name}"
+    end
+
+  end
+end

data/lib/cms/authentication/controller.rb

@@ -0,0 +1,120 @@
+#
+# Defines the authentication behavior for controllers in BrowserCMS. It can be added to any controller that needs to 
+# hook into the BrowserCMS Authentication behavior like so:
+#
+# class MySuperSecureController < ApplicationController
+#   include Cms::Authentication::Controller
+#
+# 1. Guests - These represents users that are not logged in. What guests can see and do can be modified via the CMS UI. Guests
+#             are not considered to be 'logged in'.
+# 2. 'Current' User - The currently logged in user is stored in a thread local, and can be accessed anywhere via 'Cms::User.current'.
+#             This allows model code to easily record which user is making changes to records, for versioning, etc.
+#
+# 3. 'Admin' Access Denied Page - If users try to access a protected controller, they are redirected to the CMS administration Login page
+#             which may be different than the 'front end' user login page. (Cms::Controller handles that differently)
+#
+#
+# To Dos: It appears as though we are storing the 'current' user in two places, @current_user and Cms::User.current. This is probably not DRY, but
+#   more testing would be needed.
+#
+module Cms
+  module Authentication
+    module Controller
+      # Inclusion hook to make #current_user and #logged_in?
+      # available as ActionView helper methods.
+      def self.included(base)
+        base.send :helper_method, :current_user, :logged_in? if base.respond_to? :helper_method
+        base.extend ClassMethods
+      end
+
+
+      module ClassMethods
+
+        # Determines if the current user has at least one of the following permissions. Sets up a before_action that
+        # enforces permissions.
+        #
+        # @param [Symbol, Array<Symbol>] perms One or more permissions.
+        # @raise [Cms::Errors::AccessDenied] If the current_user doesn't have ANY of the given permissions.
+        #
+        # Example:
+        # class MyCustomController < Cms::ApplicationController
+        #   check_permissions :publish_content, :except => [:index]
+        # end
+        def check_permissions(*perms)
+          opts = Hash === perms.last ? perms.pop : {}
+          before_filter(opts) do |controller|
+            raise Cms::Errors::AccessDenied unless controller.send(:current_user).able_to?(*perms)
+          end
+        end
+      end
+
+      protected
+      # Returns true or false if the user is logged in.
+      # Preloads Cms::User.current with the user model if they're logged in.
+      def logged_in?
+        !current_user.nil? && !current_user.guest?
+      end
+
+      # Returns the current user if logged in. If no user is logged in, returns the 'Guest' user which represents a
+      # what a visitor can do without being logged in.
+      def current_user
+        @current_user ||= begin
+          Cms::PersistentUser.current = current_cms_user || Cms::User.guest
+        end
+      end
+
+      # Redirect as appropriate when an access request fails.
+      #
+      # The default action is to redirect to the BrowserCMS admin login screen.
+      #
+      # Override this method in your controllers if you want to have special
+      # behavior in case the user is not authorized
+      # to access the requested action.  For example, a popup window might
+      # simply close itself.
+      def access_denied
+        respond_to do |format|
+          format.html do
+            store_location
+            redirect_to cms.login_path
+          end
+        end
+      end
+
+      # Store the URI of the current request in the session.
+      #
+      # We can return to this location by calling #redirect_back_or_default.
+      def store_location
+        session[:return_to] = request.fullpath
+      end
+
+      # Redirect to the URI stored by the most recent store_location call or
+      # to the passed default.  Set an appropriately modified
+      #   after_filter :store_location, :only => [:index, :new, :show, :edit]
+      # for any controller you want to be bounce-backable.
+      def redirect_back_or_default(default)
+        redirect_to(session[:return_to] || default)
+        session[:return_to] = nil
+      end
+
+      # This is ususally what you want; resetting the session willy-nilly wreaks
+      # havoc with forgery protection, and is only strictly necessary on login.
+      # However, **all session state variables should be unset here**.
+      def logout_keeping_session!
+        # Kill server-side auth cookie
+        Cms::PersistentUser.current.forget_me if Cms::User.current.is_a? User
+        Cms::PersistentUser.current = false # not logged in, and don't do it for me
+        session[:user_id] = nil # keeps the session but kill our variable
+        # explicitly kill any other session variables you set
+      end
+
+      # The session should only be reset at the tail end of a form POST --
+      # otherwise the request forgery protection fails. It's only really necessary
+      # when you cross quarantine (logged-out to logged-in).
+      def logout_killing_session!
+        logout_keeping_session!
+        reset_session
+      end
+
+    end
+  end
+end

data/lib/cms/authentication/test_password_strategy.rb

@@ -0,0 +1,28 @@
+module Cms
+  module Authentication
+    # For testing external authentication.
+    class TestPasswordStrategy < Devise::Strategies::Authenticatable
+      EXPECTED_LOGIN = EXPECTED_PASSWORD = 'test'
+      def authenticate!
+        if(authentication_hash[:login] == password && password == EXPECTED_PASSWORD)
+          user = Cms::ExternalUser.authenticate(authentication_hash[:login], 'Test Password', {first_name: "Test", last_name: "User"})
+          user.authorize('cms-admin', 'content-editor')
+          success!(user)
+        else
+          pass
+        end
+      end
+    end
+  end
+end
+
+Warden::Strategies.add(:test_password, Cms::Authentication::TestPasswordStrategy)
+
+# NOTE:  To enable a custom password strategy for BrowserCMS you must also add it to to the devise configuration.
+# 
+# For example enable the test_password strategy above by adding the following to config/initializers/devise.rb
+
+# # Add test_password strategy BEFORE other CMS authentication strategies
+# config.warden do |manager|
+#   manager.default_strategies(:scope => :cms_user).unshift :test_password
+# end

data/lib/cms/authentication.rb

@@ -0,0 +1,4 @@
+# Require all files in the cms/authentication directory
+Dir["#{File.dirname(__FILE__)}/authentication/*.rb"].each do |b|
+  require File.join("cms", "authentication", File.basename(b, ".rb"))
+end

data/lib/cms/authoring.rb

@@ -0,0 +1,9 @@
+module Cms::Authoring
+
+  # Represents the common permissions that are common for CMS operations.
+  PERMISSIONS = [:edit_content, :administrate, :publish_content]
+
+  # A full fledged editor can do these things.
+  EDITOR_PERMISSIONS = [:edit_content, :publish_content]
+
+end

data/lib/cms/behaviors/archiving.rb

@@ -0,0 +1,43 @@
+module Cms
+  module Behaviors
+    module Archiving
+      def self.included(model_class)
+        model_class.extend(MacroMethods)
+      end
+      module MacroMethods
+        def archivable?
+          !!@is_archivable
+        end
+        def is_archivable(options={})
+          @is_archivable = true
+          include InstanceMethods
+
+          scope :archived, ->{where(:archived => true)}
+          scope :not_archived, ->{where(:archived => false)}
+        end
+      end
+      module InstanceMethods
+        def archive
+          self.archived = true
+          self.version_comment = "Archived"
+          self.save
+        end
+        def archive!
+          self.archived = true
+          self.version_comment = "Archived"          
+          self.save!
+        end
+        def unarchive
+          self.archived = false
+          self.version_comment = "Unarchived"          
+          self.save
+        end
+        def unarchive!
+          self.archived = false
+          self.version_comment = "Unarchived"          
+          self.save!
+        end
+      end
+    end
+  end
+end