browsercms 3.5.7 → 4.0.0.alpha

data/app/models/cms/page_component.rb

@@ -0,0 +1,43 @@
+module Cms
+
+  # Handles the conversion from Mercury editor (i.e. the JSON hash it submits) to a Cms Page and blocks
+  class PageComponent
+    extend ::ActiveModel::Naming
+
+    attr_accessor :page_id, :page_title, :blocks
+
+    def initialize(page_id, params)
+      params = HashWithIndifferentAccess.new(params)
+      self.page_title = params[:page_title]
+      self.blocks = params[:blocks] ? params[:blocks] : []
+      self.page_id = page_id
+    end
+
+
+    # Save the change to the underlying page (and its content)
+    def save
+      @page = Page.find(@page_id)
+      @page.title = page_title[:value]
+      blocks.each do |block_type|
+        content_block_class = block_type[0]
+        content_ids = block_type[1].keys
+
+        content_ids.each do |block_id|
+          block = content_block_class.constantize.find(block_id)
+          assignment_hash = convert_mercury_params_to_assignment_hash(block_id, block_type)
+          block.update_attributes(assignment_hash)
+        end
+      end
+      @page.save
+    end
+
+    def convert_mercury_params_to_assignment_hash(block_id, block_type)
+      block_attribute_names = block_type[1][block_id].keys
+      assignment_hash = {}
+      block_attribute_names.each do |attr_name|
+        assignment_hash[attr_name] = block_type[1][block_id][attr_name][:value]
+      end
+      assignment_hash
+    end
+  end
+end

data/app/models/cms/page_partial.rb

@@ -5,6 +5,10 @@ module Cms
 
     validates_format_of :name, :with => /\A_[a-z]+[a-z0-9_]*\Z/, :message => "can only contain lowercase letters, numbers and underscores and must begin with an underscore"
 
+    def self.relative_path
+      "partials"
+    end
+
     def file_path
       File.join(self.class.base_path, "partials", file_name)
     end
@@ -14,19 +18,23 @@ module Cms
       "#{name.sub(/^_/, '').titleize} (#{format}/#{handler})"
     end
 
-    def self.resource_collection_name
-      "page_partial"
-    end
-
-    def self.path_elements
-      [Cms::PagePartial]
-    end
-
     def prepend_underscore
       if !name.blank? && name[0, 1] != '_'
         self.name = "_#{name}"
       end
     end
 
+    def partial?
+      true
+    end
+
+    def placeholder
+      "_header"
+    end
+
+    # Generates hint for editing
+    def hint
+      "No spaces allowed. Must start with _."
+    end
   end
 end

data/app/models/cms/page_route.rb

@@ -21,7 +21,7 @@ class Cms::PageRoute < ActiveRecord::Base
   has_many :conditions, :class_name => 'Cms::PageRouteCondition'
   has_many :requirements, :class_name => 'Cms::PageRouteRequirement'
 
-  attr_accessible :name, :pattern, :code, :page_id, :page
+  extend Cms::DefaultAccessible
   
   validates_presence_of :pattern, :page_id
   validates_uniqueness_of :pattern

data/app/models/cms/page_route_condition.rb

@@ -1,5 +1,5 @@
 module Cms
   class PageRouteCondition < Cms::PageRouteOption
-    include DefaultAccessible
+    extend DefaultAccessible
   end
 end

data/app/models/cms/page_route_option.rb

@@ -2,6 +2,6 @@ module Cms
   class PageRouteOption < ActiveRecord::Base
     belongs_to :page_route, :class_name => 'Cms::PageRoute'
 
-    include DefaultAccessible
+    extend DefaultAccessible
   end
 end

data/app/models/cms/page_route_requirement.rb

@@ -1,5 +1,5 @@
 module Cms
   class PageRouteRequirement < Cms::PageRouteOption
-    include DefaultAccessible
+    extend DefaultAccessible
   end
 end

data/app/models/cms/page_template.rb

@@ -17,15 +17,8 @@ module Cms
 
     def self.display_name(file_name)
       name, format, handler = file_name.split('.')
-      "#{name.titleize} (#{format}/#{handler})"
-    end
-
-    def self.resource_collection_name
-      "page_template"
-    end
-
-    def self.path_elements
-      [Cms::PageTemplate]
+      content_type = handler ? "#{format}/#{handler}" : "#{format}"
+      "#{name.titleize} (#{content_type})"
     end
 
     # This is a combination of file system page templates
@@ -36,5 +29,17 @@ module Cms
       page_templates.map { |f| [display_name(f), f] }.sort.uniq
     end
 
+    def partial?
+      false
+    end
+
+    def placeholder
+      "subpage"
+    end
+
+    # Generates hint for editing
+    def hint
+      "No spaces allowed. Must start with lowercase letter."
+    end
   end
 end

data/app/models/cms/permission.rb

@@ -1,7 +1,7 @@
 module Cms
   class Permission < ActiveRecord::Base
 
-    attr_accessible :name, :full_name, :description
+   #attr_accessible :name, :full_name, :description
 
     has_many :group_permissions, :class_name => 'Cms::GroupPermission'
     has_many :groups, :through => :group_permissions, :class_name => 'Cms::Group'
@@ -9,7 +9,9 @@ module Cms
     validates_presence_of :name
     validates_uniqueness_of :name
 
-    scope :named, lambda { |name| {:conditions => {:name => name}} }
+    def self.named(name)
+      where(name: name)
+    end
 
   end
 end

data/app/models/cms/persistent_user.rb

@@ -0,0 +1,208 @@
+module Cms
+
+  # A parent class for users that need to be persisted in the CMS database.
+  class PersistentUser < ActiveRecord::Base
+
+    self.table_name = 'cms_users'
+
+    # Note that Chrome doesn't expire session cookies immediately so test this in other browsers.
+    # http://stackoverflow.com/questions/16817229/issues-with-devise-rememberable
+    devise :database_authenticatable,
+           # Note that Chrome doesn't expire session cookies immediately so test this in other browsers.
+           # http://stackoverflow.com/questions/16817229/issues-with-devise-rememberable
+           :rememberable,
+           :authentication_keys => [:login]
+
+
+    has_many :user_group_memberships, :class_name => 'Cms::UserGroupMembership', foreign_key: :user_id
+    has_many :groups, :through => :user_group_memberships, :class_name => 'Cms::Group', foreign_key: :user_id
+    has_many :tasks, :foreign_key => "assigned_to_id", :class_name => 'Cms::Task'
+
+    scope :active, -> { where(["expires_at IS NULL OR expires_at > ?", Time.now.utc]) }
+    extend DefaultAccessible
+
+
+    validates_presence_of :login
+    validates_uniqueness_of :login, :case_sensitive => false
+    validates_format_of :login, :with => /\A\w[\w\.\-_@]+\z/, :message => "use only letters, numbers, and .-_@ please."
+
+    # Class Methods
+    class << self
+
+      def permitted_params
+        super + [{:group_ids => []}]
+      end
+
+      # Returns all users that can :edit_content or :publish_content permissions.
+      #
+      # @return [ActiveRelation<Cms::User>] A scope which will find users with the correct permissions.
+      def able_to_edit_or_publish_content
+        where(["#{Permission.table_name}.name = ? OR #{Permission.table_name}.name = ?", "edit_content", "publish_content"]).includes({:groups => :permissions}).references(:permissions)
+      end
+
+      def current
+        Thread.current[:cms_user]
+      end
+
+      def current=(user)
+        Thread.current[:cms_user] = user
+      end
+
+      # Return a GuestUser with the given values.
+      def guest(options = {})
+        Cms::GuestUser.new(options)
+      end
+    end
+
+    # Determines if this user a Guest or not.
+    def guest?
+      !!@guest
+    end
+
+    # Determines if this user should have access to the CMS administration tools. Can be overridden by specific users (like GuestUser)
+    # which may not need to check the database for that information.
+    def cms_access?
+      groups.cms_access.count > 0
+    end
+
+    def disable
+      if self.class.where(["expires_at is null and id != ?", id]).count > 0
+        self.expires_at = Time.now - 2.minutes
+      else
+        false
+      end
+    end
+
+    def disable!
+      unless disable
+        raise "You must have at least 1 enabled user"
+      end
+      save!
+    end
+
+    # Determines if this user should be authenticated. Hook for Devise.
+    #
+    # @override Devise::Models::Authenticatable#active_for_authentication?
+    # @return [Boolean] true if this user has not expired.
+    def active_for_authentication?
+      is_active = !expired?
+      logger.error "Expired User '#{login}' failed to login. Account expired on #{expires_at_formatted}." unless is_active
+      is_active
+    end
+
+    # Determines if this User can have their password changed.
+    def password_changeable?
+      true
+    end
+
+    # Determines if this user has expired or has been disabled.
+    # @return [Boolean]
+    def expired?
+      expires_at && expires_at <= Time.now
+    end
+
+    def enable
+      self.expires_at = nil
+    end
+
+    def enable!
+      enable
+      save!
+    end
+
+    def full_name
+      [first_name, last_name].reject { |e| e.nil? }.join(" ")
+    end
+
+    def full_name_with_login
+      "#{full_name} (#{login})"
+    end
+
+    def full_name_or_login
+      if full_name.strip.blank?
+        login
+      else
+        full_name
+      end
+    end
+
+    # This is to show a formated date on the input form. I'm unsure that
+    # this is the best way to solve this, but it works.
+    def expires_at_formatted
+      expires_at ? (expires_at.strftime '%m/%d/%Y') : nil
+    end
+
+    def permissions
+      @permissions ||= Cms::Permission.where(["#{self.class.table_name}.id = ?", id]).includes({:groups => :users}).references(:users)
+    end
+
+    def viewable_sections
+      @viewable_sections ||= Cms::Section.where(["#{self.class.table_name}.id = ?", id]).includes(:groups => :users).references(:users)
+    end
+
+    def modifiable_sections
+      @modifiable_sections ||= Cms::Section.where(["#{self.class.table_name}.id = ? and #{GroupType.table_name}.cms_access = ?", id, true]).includes(:groups => [:group_type, :users]).references(:users, :groups)
+    end
+
+    # Expects a list of names of Permissions
+    # true if the user has any of the permissions
+    def able_to?(*required_permissions)
+      perms = required_permissions.map(&:to_sym)
+      permissions.any? do |p|
+        perms.include?(p.name.to_sym)
+      end
+    end
+
+    # Determine if this user has permission to view the specific object. Permissions
+    #   are always tied to a specific section. This method can take different input parameters
+    #   and will attempt to determine the relevant section to check.
+    # Expects object to be of type:
+    #   1. Section - Will check the user's groups to see if any of those groups can view this section.
+    #   2. Path - Will look up the section based on the path, then check it.  (Note that section paths are not currently unique, so this will check the first one it finds).
+    #   3. Other - Assumes it has a section attribute and will call that and check the return value.
+    #
+    # Returns: true if the user can view this object, false otherwise.
+    # Raises: ActiveRecord::RecordNotFound if a path to a not existent section is passed in.
+    def able_to_view?(object)
+      section = object
+      if object.is_a?(String)
+        section = Cms::Section.find_by_path(object)
+        raise ActiveRecord::RecordNotFound.new("Could not find section with path = '#{object}'") unless section
+      elsif !object.is_a?(Cms::Section)
+        section = object.parent
+      end
+      viewable_sections.include?(section) || cms_access?
+    end
+
+    def able_to_modify?(object)
+      case object
+        when Cms::Section
+          modifiable_sections.include?(object)
+        when Cms::Page, Cms::Link
+          modifiable_sections.include?(object.section)
+        else
+          if object.class.respond_to?(:connectable?) && object.class.connectable?
+            object.connected_pages.all? { |page| able_to_modify?(page) }
+          else
+            true
+          end
+      end
+    end
+
+    # Expects node to be a Section, Page or Link
+    # Returns true if the specified node, or any of its ancestor sections, is editable by any of
+    # the user's 'CMS User' groups.
+    def able_to_edit?(object)
+      able_to?(:edit_content) && able_to_modify?(object)
+    end
+
+    def able_to_publish?(object)
+      able_to?(:publish_content) && able_to_modify?(object)
+    end
+
+    def able_to_edit_or_publish_content?
+      able_to?(:edit_content, :publish_content)
+    end
+
+  end
+end

data/app/models/cms/portlet.rb

@@ -2,11 +2,26 @@ module Cms
   class Portlet < ActiveRecord::Base
     validates_presence_of :name
     is_searchable
+    uses_soft_delete
+    has_content_type :module => :core
 
     # These are here simply to temporarily hold these values
     # Makes it easy to pass them through the process of selecting a portlet type
     attr_accessor :connect_to_page_id, :connect_to_container, :controller
-    attr_accessible :connect_to_page_id, :connect_to_container, :controller, :name
+
+    # Descriptions for portlets will be displayed when a user is adding one to page, or when editing the portlet.
+    # The goal is provide a more detailed overview of how a portlet should be used or what it does.
+    # @param [String] description (If supplied, it will set the new value)
+    # @return [String]
+    def self.description(description="")
+      unless description.blank?
+        @description = description
+      end
+      if @description.blank?
+        return "(No description available)"
+      end
+      @description
+    end
 
     delegate :request, :response, :session,
              :flash, :params, :cookies,
@@ -17,11 +32,11 @@ module Cms
       super if defined? super
     ensure
       subclass.class_eval do
+        extend Cms::PolymorphicSingleTableInheritance
 
-        # Using the table prefix here is NOT tested, since unloading classes is hard during tests.
         has_dynamic_attributes :class_name => "CmsPortletAttribute",
                                :foreign_key => "portlet_id",
-                               :table_name => Namespacing.prefix("portlet_attributes"),
+                               :table_name => "cms_portlet_attributes",
                                :relationship_name => :portlet_attributes
 
         acts_as_content_block(
@@ -33,7 +48,6 @@ module Cms
         # Portlets aren't verisonable but are connectable, so this will prevent the saving of portlets.
         attr_accessor :skip_callbacks
 
-
         def self.template_path
           default_template_path
         end
@@ -45,6 +59,13 @@ module Cms
         def self.helper_class
           "#{name}Helper".constantize
         end
+
+        # Portlets don't generally support inline editing. Subclasses can override this if they do though.
+        def supports_inline_editing?
+          false
+        end
+
+
       end
     end
 
@@ -52,14 +73,34 @@ module Cms
       false
     end
 
+    # Returns an alphabetical list of classes that descend from Cms::Portlet.
+    #
+    # @return [Array<Class>]
     def self.types
       @types ||= ActiveSupport::Dependencies.autoload_paths.map do |d|
         if d =~ /app\/portlets/
           Dir["#{d}/*_portlet.rb"].map do |p|
-            File.basename(p, ".rb").classify
+            File.basename(p, ".rb").classify.constantize
           end
         end
-      end.flatten.compact.uniq.sort
+      end.flatten.compact.uniq
+      @types.sort! { |a,b| a.name.downcase <=> b.name.downcase }
+      @types.select! { |type| !blacklist.include?(type.name)}
+      @types
+    end
+
+    # Determines if a content_type is blacklisted or not.
+    #
+    # @param [Symbol] type (:dynamic_portlet)
+    def self.blacklisted?(type_name)
+      blacklist.include?(type_name.to_s.camelize)
+    end
+
+    # Returns a blacklist of all content types that shouldn't be accessible. Includes both portlets and other CMS types.
+    #
+    # @return [Array<String>] List of class names ['DynamicPortlet', 'LoginPortlet']
+    def self.blacklist
+      @blacklist ||= Rails.configuration.cms.content_types.blacklist.map {|underscore_name| underscore_name.to_s.camelize }
     end
 
     def self.get_subclass(type)
@@ -137,15 +178,21 @@ module Cms
       true
     end
 
+    # For polymorphic permissions
+    # A generic portlet shouldn't be connected to pages.
+    def connected_pages
+      []
+    end
+
     #----- Portlet Action Related Methods ----------------------------------------
-    
+
     # Used by portlets to set a custom title, typically in the render body.
-    # For example, this allows a page with a single portlet that might display a content block to set the page name to 
+    # For example, this allows a page with a single portlet that might display a content block to set the page name to
     # that block name.
     def page_title(new_title)
       controller.current_page.title = new_title
     end
-    
+
     def instance_name
       "#{self.class.name.demodulize.underscore}_#{id}"
     end