card 1.18.6 → 1.19.0

data/tmpsets/set/mod001-core/all/permissions.rb

@@ -0,0 +1,309 @@
+# -*- encoding : utf-8 -*-
+class Card; module Set; class All; module Permissions; extend Card::Set
+# ~~ above autogenerated; below pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/permissions.rb ~~
+
+Card.error_codes.merge! permission_denied: [:denial, 403],
+                        captcha: [:errors, 449]
+
+module ClassMethods
+  def repair_all_permissions
+    Card.where(
+      "(read_rule_class is null or read_rule_id is null) and trash is false"
+    ).each do |broken_card|
+      broken_card.include_set_modules
+      broken_card.repair_permissions!
+    end
+  end
+end
+
+def repair_permissions!
+  rule_id, rule_class = permission_rule_id_and_class :read
+  update_columns read_rule_id: rule_id, read_rule_class: rule_class
+end
+
+# ok? and ok! are public facing methods to approve one action at a time
+#
+#   fetching: if the optional :trait parameter is supplied, it is passed
+#      to fetch and the test is perfomed on the fetched card, therefore:
+#
+#      trait: :account      would fetch this card plus a tag codenamed :account
+#      trait: :roles, new: {} would initialize a new card with default ({})
+# options.
+
+def ok? action
+  @action_ok = true
+  send "ok_to_#{action}"
+  @action_ok
+end
+
+def ok_with_fetch? action, opts={}
+  card = opts[:trait].nil? ? self : fetch(opts)
+  card && card.ok_without_fetch?(action)
+end
+
+# note: method is chained so that we can return the instance variable @action_ok
+alias_method_chain :ok?, :fetch
+
+def ok! action, opts={}
+  raise Card::Error::PermissionDenied, self unless ok? action, opts
+end
+
+def who_can action
+  # warn "who_can[#{name}] #{(prc=permission_rule_card(action)).inspect},
+  # #{prc.first.item_cards.map(&:id)}" if action == :update
+  permission_rule_card(action).item_cards.map(&:id)
+end
+
+def permission_rule_id_and_class action
+  direct_rule_id = rule_card_id action
+  require_permission_rule! direct_rule_id, action
+  direct_rule = Card.fetch direct_rule_id, skip_modules: true
+  [applicable_permission_rule_id(direct_rule, action),
+   direct_rule.rule_class_name]
+end
+
+def applicable_permission_rule_id direct_rule, action
+  if junction? && direct_rule.db_content =~ /^\[?\[?_left\]?\]?$/
+    lcard = left_or_new(skip_virtual: true, skip_modules: true)
+    if action == :create && lcard.real? && !lcard.action == :create
+      action = :update
+    end
+    lcard.permission_rule_id_and_class(action).first
+  else
+    direct_rule.id
+  end
+end
+
+def permission_rule_card action
+  Card.fetch permission_rule_id_and_class(action).first
+end
+
+def require_permission_rule! rule_id, action
+  return if rule_id
+  # RULE missing.  should not be possible.
+  # generalize this to handling of all required rules
+  errors.add :permission_denied, "No #{action} rule for #{name}"
+  raise Card::Error::PermissionDenied, self
+end
+
+def rule_class_name
+  trunk.type_id == Card::SetID ? cardname.trunk_name.tag : nil
+end
+
+def you_cant what
+  "You don't have permission to #{what}"
+end
+
+def deny_because why
+  @permission_errors << why if @permission_errors
+  @action_ok = false
+end
+
+def permitted? action
+  return if Card.config.read_only
+  return true if action != :comment && Auth.always_ok?
+
+  permitted_ids = who_can action
+  if action == :comment && Auth.always_ok?
+    # admin can comment if anyone can
+    !permitted_ids.empty?
+  else
+    Auth.as_card.among? permitted_ids
+  end
+end
+
+def permit action, verb=nil
+  # not called by ok_to_read
+  deny_because "Currently in read-only mode" if Card.config.read_only
+
+  return if permitted? action
+  verb ||= action.to_s
+  deny_because you_cant("#{verb} #{name.present? ? name : 'this'}")
+end
+
+def ok_to_create
+  permit :create
+  return if !@action_ok || !junction?
+
+  [:left, :right].each do |side|
+    # left is supercard; create permissions will get checked there.
+    next if side == :left && @superleft
+    part_card = send side, new: {}
+    # if no card, there must be other errors
+    next unless part_card && part_card.new_card?
+    unless part_card.ok? :create
+      deny_because you_cant("create #{part_card.name}")
+    end
+  end
+end
+
+def ok_to_read
+  return if Auth.always_ok?
+  @read_rule_id ||= permission_rule_id_and_class(:read).first
+  return if Auth.as_card.read_rules.member? @read_rule_id
+  deny_because you_cant "read this"
+end
+
+def ok_to_update
+  permit :update
+  if @action_ok && type_id_changed? && !permitted?(:create)
+    deny_because you_cant("change to this type (need create permission)")
+  end
+  ok_to_read if @action_ok
+end
+
+def ok_to_delete
+  permit :delete
+end
+
+def ok_to_comment
+  permit :comment, "comment on"
+  return unless @action_ok
+  deny_because "No comments allowed on templates" if is_template?
+  deny_because "No comments allowed on structured content" if structure
+end
+
+event :clear_read_rule, :store, on: :delete do
+  self.read_rule_id = self.read_rule_class = nil
+end
+
+event :set_read_rule, :store,
+      on: :save, changed: [:type_id, :name] do
+  read_rule_id, read_rule_class = permission_rule_id_and_class(:read)
+  self.read_rule_id = read_rule_id
+  self.read_rule_class = read_rule_class
+end
+
+event :set_field_read_rules,
+      after: :set_read_rule, on: :update, changed: :type_id do
+  # find all cards with me as trunk and update their read_rule
+  # (because of *type plus right)
+  # skip if name is updated because will already be resaved
+
+  Auth.as_bot do
+    fields.each do |field|
+      field.refresh.update_read_rule
+    end
+  end
+end
+
+def update_read_rule
+  Card.record_timestamps = false
+  reset_patterns # why is this needed?
+  rcard_id, rclass = permission_rule_id_and_class :read
+  # these two are just to make sure vals are correct on current object
+  self.read_rule_id = rcard_id
+  self.read_rule_class = rclass
+  Card.where(id: id).update_all read_rule_id: rcard_id, read_rule_class: rclass
+  expire_hard
+
+  # currently doing a brute force search for every card that may be impacted.
+  # may want to optimize(?)
+  Auth.as_bot do
+    fields.each do |field|
+      field.update_read_rule if field.rule(:read) == "_left"
+    end
+  end
+
+ensure
+  Card.record_timestamps = true
+end
+
+def add_to_read_rule_update_queue updates
+  @read_rule_update_queue = Array.wrap(@read_rule_update_queue).concat updates
+end
+
+event :check_permissions, :validate do
+  task =
+    if @action != :delete && comment # will be obviated by new comment handling
+      :comment
+    else
+      @action
+    end
+  track_permission_errors do
+    ok? task
+  end
+end
+
+def track_permission_errors
+  @permission_errors = []
+  result = yield
+
+  @permission_errors.each do |message|
+    errors.add :permission_denied, message
+  end
+  @permission_errors = nil
+
+  result
+end
+
+def recaptcha_on?
+  have_recaptcha_keys? &&
+    Env[:controller]   &&
+    !Auth.signed_in?   &&
+    !Auth.needs_setup? &&
+    !Auth.always_ok?   &&
+    Card.toggle(rule(:captcha))
+end
+
+def have_recaptcha_keys?
+  @@have_recaptcha_keys =
+    if defined?(@@have_recaptcha_keys)
+      @@have_recaptcha_keys
+    else
+      !!(Card.config.recaptcha_public_key && Card.config.recaptcha_private_key)
+    end
+end
+
+event :recaptcha, :validate do
+  if !@supercard && !Env[:recaptcha_used] && recaptcha_on?
+    Env[:recaptcha_used] = true
+    Env[:controller].verify_recaptcha model: self, attribute: :captcha
+  end
+end
+
+module Accounts
+  # This is a short-term hack that is used in account-related cards to allow a
+  # permissions pattern where permissions are restricted to the owner of the
+  # account (and, by default, Admin)
+  # That pattern should be permitted by our card representation
+  # (without creating separate rules for each account holder) but is not yet.
+
+  def permit action, verb=nil
+    if action == :comment then @action_ok = false
+    elsif action == :create  then @superleft ? true : super(action, verb)
+      # restricts account creation to subcard handling on permitted card
+      # (unless explicitly permitted)
+    elsif own_account? then true
+    else
+      super action, verb
+    end
+  end
+end
+
+module Follow
+  def ok_to_update
+    permit :update
+  end
+
+  def ok_to_create
+    permit :create
+  end
+
+  def ok_to_delete
+    permit :delete
+  end
+
+  def permit action, verb=nil
+    if [:create, :delete, :update].include?(action) && Auth.signed_in? &&
+       (user = rule_user) && Auth.current_id == user.id
+      return true
+    else
+      super action, verb
+    end
+  end
+end
+
+
+# ~~ below autogenerated; above pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/permissions.rb ~~
+end;end;end;end;

data/tmpsets/set/mod001-core/all/phases.rb

@@ -0,0 +1,23 @@
+# -*- encoding : utf-8 -*-
+class Card; module Set; class All; module Phases; extend Card::Set
+# ~~ above autogenerated; below pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/phases.rb ~~
+def prepare_for_phases
+  reset_patterns
+  include_set_modules
+end
+
+def only_storage_phase?
+  only_storage_phase || !director.main?
+end
+
+delegate :validation_phase, to: :director
+delegate :storage_phase, to: :director
+delegate :integration_phase, to: :director
+
+def clean_up
+  Card::DirectorRegister.clear
+end
+
+
+# ~~ below autogenerated; above pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/phases.rb ~~
+end;end;end;end;

data/tmpsets/set/mod001-core/all/references.rb

@@ -0,0 +1,187 @@
+# -*- encoding : utf-8 -*-
+class Card; module Set; class All; module References; extend Card::Set
+# ~~ above autogenerated; below pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/references.rb ~~
+# frozen_string_literal: true
+
+# Cards can refer to other cards in their content, eg via links and nests.
+# The card that refers is the "referer", the card that is referred to is
+# the "referee". The reference itself has its own class (Card::Reference),
+# which handles id-based reference tracking.
+
+PARTIAL_REF_CODE = "P".freeze
+
+# cards that refer to self
+def referers
+  references_in.map(&:referer_id).map(&Card.method(:fetch)).compact
+end
+
+# cards that include self
+def includers
+  refs = references_in.where(ref_type: "I")
+  refs.map(&:referer_id).map(&Card.method(:fetch)).compact
+end
+
+# cards that self refers to
+def referees
+  references_out.map { |ref| Card.fetch ref.referee_key, new: {} }
+end
+
+# cards that self includes
+def includees
+  refs = references_out.where(ref_type: "I")
+  refs.map { |ref| Card.fetch ref.referee_key, new: {} }
+end
+
+# cards that refer to self by name
+# (finds cards not yet linked by id)
+def name_referers
+  Card.joins(:references_out).where card_references: { referee_key: key }
+end
+
+# cards that refer to self or any descendant
+def family_referers
+  @family_referers ||= ([self] + descendants).map(&:referers).flatten.uniq
+  # FIXME: could be much more efficient!
+end
+
+# replace references in card content
+def replace_reference_syntax old_name, new_name
+  obj_content = Card::Content.new raw_content, self
+  obj_content.find_chunks(Card::Content::Chunk::Reference).select do |chunk|
+    next unless (old_ref_name = chunk.referee_name)
+    next unless (new_ref_name = old_ref_name.replace_part old_name, new_name)
+    chunk.referee_name = chunk.replace_reference old_name, new_name
+    refs = Card::Reference.where referee_key: old_ref_name.key
+    refs.update_all referee_key: new_ref_name.key
+  end
+
+  obj_content.to_s
+end
+
+# delete old references from this card's content, create new ones
+def update_references_out
+  delete_references_out
+  create_references_out
+end
+
+# interpret references from this card's content and
+# insert entries in reference table
+def create_references_out
+  ref_hash = {}
+  each_reference_out do |referee_name, ref_type|
+    interpret_reference ref_hash, referee_name, ref_type
+  end
+  return if ref_hash.empty?
+  Card::Reference.mass_insert reference_values_array(ref_hash)
+end
+
+# delete references from this card
+def delete_references_out
+  raise "id required to delete references" if id.nil?
+  Card::Reference.delete_all referer_id: id
+end
+
+# interpretation phase helps to prevent duplicate references
+# results in hash like:
+# { referee1_key: [referee1_id, referee1_type1, referee1_type2],
+#   referee2_key...
+# }
+def interpret_reference ref_hash, referee_name, ref_type
+  return unless referee_name # eg commented nest has no referee_name
+  referee_key = (referee_name = referee_name.to_name).key
+  return if referee_key == key # don't create self reference
+
+  referee_id = Card.fetch_id(referee_name)
+  ref_hash[referee_key] ||= [referee_id]
+  ref_hash[referee_key] << ref_type
+
+  interpret_partial_references ref_hash, referee_name unless referee_id
+end
+
+# Partial references are needed to track references to virtual cards.
+# For example a link to virual card [[A+*self]] won't have a referee_id,
+# but when A's name is changed we have to find and update that link.
+def interpret_partial_references ref_hash, referee_name
+  [referee_name.left, referee_name.right].each do |sidename|
+    interpret_reference ref_hash, sidename, PARTIAL_REF_CODE
+  end
+end
+
+# translate interpreted reference hash into values array,
+# removing duplicate and unnecessary ref_types
+def reference_values_array ref_hash
+  values = []
+  ref_hash.each do |referee_key, hash_val|
+    referee_id = hash_val.shift || "null"
+    ref_types = hash_val.uniq
+    ref_types.delete PARTIAL_REF_CODE if ref_types.size > 1
+    # partial references are not necessary if there are explicit references
+    ref_types.each do |ref_type|
+      values << [id, referee_id, "'#{referee_key}'", "'#{ref_type}'"]
+    end
+  end
+  values
+end
+
+# invokes the given block for each reference in raw_content with
+# the reference name and reference type
+def each_reference_out
+  content_obj = Card::Content.new raw_content, self
+  content_obj.find_chunks(Card::Content::Chunk::Reference).each do |chunk|
+    yield(chunk.referee_name, chunk.reference_code)
+  end
+end
+
+protected
+
+# test for updating referer content & preload referer list
+event :prepare_referer_update, :validate, on: :update, changed: :name do
+  self.update_referers = ![nil, false, "false"].member?(update_referers)
+  family_referers
+end
+
+# when name changes, update references to card
+event :refresh_references_in, :finalize, on: :save, changed: :name do
+  Card::Reference.unmap_referees id if @action == :update && !update_referers
+  Card::Reference.map_referees key, id
+end
+
+# when content changes, update references to other cards
+event :refresh_references_out, :finalize, on: :save, changed: :content do
+  update_references_out
+end
+
+# clean up reference table when card is deleted
+event :clear_references, :finalize, on: :delete do
+  delete_references_out
+  Card::Reference.unmap_referees id
+end
+
+# on rename, update names in cards that refer to self by name (as directed)
+event :update_referer_content, :finalize,
+      on: :update, changed: :name,
+      when: proc { |card| card.update_referers } do
+  # FIXME: break into correct stages
+  Auth.as_bot do
+    family_referers.each do |card|
+      next if card == self || card.structure
+      card = card.refresh
+      card.db_content = card.replace_reference_syntax name_was, name
+      card.save!
+    end
+  end
+end
+
+# on rename, when NOT updating referer content, update references to ensure
+# that partial references are correctly tracked
+# eg.  A links to X+Y.  if X+Y is renamed and we're not updating the link in A,
+# then we need to be sure that A has a partial reference
+event :update_referer_references_out, :finalize,
+      on: :update, changed: :name,
+      when: proc { |c| !c.update_referers } do
+  family_referers.map(&:update_references_out)
+end
+
+
+# ~~ below autogenerated; above pulled from /Users/ethan/dev/wagn/gem/card/mod/core/set/all/references.rb ~~
+end;end;end;end;