card 1.97.0.1 → 1.98.0

data/lib/card/view/options.rb

@@ -1,6 +1,17 @@
 class Card
   class View
-    # Manages options for card views, including those used in nest syntax
+    # Manages options for rendering card views
+    #
+    # Many options are available to sharks via nests. (See https://decko.org/Nest_Syntax)
+    #
+    #      {{cardname|hide:menu}}
+    #
+    # These options and others are available to monkeys when rendering views via
+    # #render or #nest.
+    #
+    #      nest "cardname", hide: :menu
+    #      render :viewname, hide: :menu
+    #
     module Options
       # the keymap represents a 2x2 matrix, where the factors are
       # (a) whether an option's value can be set by a shark via nests, and
@@ -24,7 +35,7 @@ class Card
         #                      or comma separated views (String)
         # NOTE: although show and hide are in this non-inheriting group, they are
         # actually inherited, just not through the standard mechanism. Because, well,
-        # they're weird. (See process_visibility options)
+        # they're weird. (See process_visibility)
         heir: [
           :main,           # format object is page's "main" object (Boolean)
           :home_view,      # view for slot to return to when no view specified
@@ -47,8 +58,10 @@ class Card
           :items,          # options for items (Hash)
           :cache,          # change view cache behaviour
           #                    (Symbol<:always, :standard, :never>)
-          :edit            # edit mode
+          :edit,           # edit mode
           #                    (Symbol<:inline, :standard, :full>)
+          :separator,      # item separator in certain lists
+          :filter
         ],
         none: [
           :skip_perms,     # do not check permissions for this view (Boolean)
@@ -66,11 +79,14 @@ class Card
 
           @keymap[type] << name
           reset_key_lists
+          VooApi.define_getter name
+          VooApi.define_setter name
         end
       end
 
       extend KeyLists
       include VooApi
+      include Visibility
     end
   end
 end

data/lib/card/view/options/key_lists.rb

@@ -30,6 +30,10 @@ class Card
           ]
         end
 
+        def slot_keys
+          @slot_keys ||= all_keys - [:skip_perms]
+        end
+
         def reset_key_lists
           @all_keys = nil
           @shark_keys = nil

data/lib/card/view/options/visibility.rb

@@ -0,0 +1,99 @@
+class Card
+  class View
+    module Options
+      # manages showing and hiding optional view renders
+      module Visibility
+        # tracks show/hide value for each view with an explicit setting
+        # eg  { toggle: :hide }
+        def viz_hash
+          @viz_hash ||= {}
+        end
+
+        # test methods
+
+        def hide? view
+          viz_hash[view&.to_sym] == :hide
+        end
+
+        def show? view
+          !hide? view
+        end
+
+        # write methods
+
+        def show *views
+          viz views, :show
+        end
+
+        def hide *views
+          viz views, :hide
+        end
+
+        # force write methods
+
+        def show! *views
+          viz views, :show, true
+        end
+
+        def hide! *views
+          viz views, :hide, true
+        end
+
+        # advanced write method
+        VIZ_SETTING = { show: :show, true => :show,
+                        hide: :hide, false => :hide, nil => :hide }.freeze
+
+        def viz views, setting, force=false
+          Array.wrap(views).flatten.each do |view|
+            view = view.to_sym
+            next if !force && viz_hash[view]
+
+            viz_hash[view] = VIZ_SETTING[setting]
+          end
+        end
+
+        def visible? view
+          viz view, yield unless viz_hash[view]
+          show? view
+        end
+
+        # test whether view is optional
+        # (@optional is set in normalize_options
+        # @return [true/false]
+        def optional?
+          @optional
+        end
+
+        # translate raw hide, show options (which can be strings, symbols,
+        # arrays, etc)
+        def process_visibility
+          viz_hash.reverse_merge! parent.viz_hash if parent
+          process_visibility_options live_options
+          viz requested_view, @optional if @optional && !viz_hash[requested_view]
+        end
+
+        private
+
+        # if true, #process returns nil
+        def hide_requested_view?
+          optional? && hide?(requested_view)
+        end
+
+        # takes an options_hash and processes it to update viz_hash
+        def process_visibility_options options_hash
+          %i[hide show].each do |setting|
+            views = View.normalize_list(options_hash.delete(setting)).map(&:to_sym)
+            viz views, setting, true
+          end
+        end
+
+        def normalized_visibility_options
+          viz_hash.each_with_object({}) do |(key, val), hash|
+            hash[val] ||= []
+            hash[val] << key
+          end
+        end
+      end
+    end
+  end
+end

data/lib/card/view/options/voo_api.rb

@@ -1,8 +1,7 @@
 class Card
   class View
     module Options
-      # The methods of the VooApi module allow developers
-      # to read and write options dynamically.
+      # VooApi methods let developers use view options dynamically.
       module VooApi
         # There are two primary options hashes:
 
@@ -50,9 +49,7 @@ class Card
         # because they can get changed after.  current solution is a compromise.
         # @return [Hash]
         def slot_options
-          normalized_options.merge(view: requested_view).select do |k, _v|
-            Options.all_keys.include? k
-          end
+          normalized_options.merge(view: requested_view).slice(*Options.slot_keys)
         end
 
         # def inherit key
@@ -98,7 +95,9 @@ class Card
         protected
 
         # - @live_options are dynamic and can be altered by the "voo" API at any time.
-        # Such alterations are NOT used in stubs
+        # Such alterations are NOT used in the stub of the current voo, but they
+        # ARE inherited by children voos.
+        #
         # @return [Hash]
         def live_options
           @live_options ||= process_live_options
@@ -157,18 +156,20 @@ class Card
           @live_options = normalized_options.clone
           process_main_nest_options
           process_before_view
-          process_visibility_options
+          process_visibility
+          return :hide if hide_requested_view? # bail to avoid unnecessary processing
+
           process_view_wrappers
           @live_options
         end
 
-        # This method triggers the "before" blocks which can alter the
-        # @live_options hash both directly and indirectly (via the voo API)
+        # This method triggers the "before" blocks which can alter the @live_options
+        # hash both directly and indirectly (via the voo API)
         def process_before_view
           format.before_view requested_view
         end
 
-        # adds the wrappers that
+        # adds the wrappers assigned to ok_view in view definition
         def process_view_wrappers
           view_wrappers = format.view_setting(:wrap, ok_view)
           return unless view_wrappers.present?
@@ -193,6 +194,8 @@ class Card
         def validate_options! opts
           return unless (foreign_opts = foreign_options_in opts)
 
+          # TODO: this should raise a UserError if the options come directly from params
+          # (eg, mycard?slot[badoption]=true should not be treated as a server error)
           raise Card::Error, "illegal view options: #{foreign_opts}"
         end
 

data/lib/card/view/permission.rb

@@ -0,0 +1,54 @@
+class Card
+  class View
+    # View permissions support view-specific permission handling
+    #
+    # Views can be configured in {Set::Format::AbstractFormat#view view definitions}
+    # with the `perms` directive, eg
+    #
+    #         # only render if user has permission to update card
+    #         view :myview, perms: :update do...
+    module Permission
+      def view_perms
+        @view_perms = setting(:perms) || :read
+      end
+
+      private
+
+      def altered_view
+        return if skip_check?
+        alter_unknown || denial
+      end
+
+      def skip_check?
+        normalized_options[:skip_perms] || view_perms == :none
+      end
+
+      def setting setting_name, view=nil
+        view ||= requested_view
+        format.view_setting setting_name, view
+      end
+
+      # by default views can't handle unknown cards, but this can be overridden in
+      # view definitions with the `unknown` directive
+      def alter_unknown
+        setting = setting(:unknown)
+        return if setting == true || card.known?
+        setting.is_a?(Symbol) ? setting : format.view_for_unknown(requested_view)
+      end
+
+      def denial
+        return unless (task = denied_task)
+
+        format.view_for_denial requested_view, task
+      end
+
+      def denied_task
+        if view_perms.is_a? Proc
+          :read unless view_perms.call(format)  # read isn't quite right
+        else
+          Array.wrap(view_perms).find { |task| !format.ok? task }
+        end
+      end
+    end
+  end
+end

data/lib/cardio.rb

@@ -52,8 +52,7 @@ module Cardio
         closed_search_limit:    10,
         paging_limit:           20,
 
-        non_createable_types:   [%w[signup setting set
-                                   bootswatch_skin customized_bootswatch_skin]],
+        non_createable_types:   [%w[signup setting set session bootswatch_skin customized_bootswatch_skin]], # FIXME
         view_cache:             false,
         rss_enabled:            false,
         double_click:           :signed_in,
@@ -78,7 +77,8 @@ module Cardio
         allow_irreversible_admin_tasks: false,
         raise_all_rendering_errors:     false,
         rescue_all_in_controller:       true,
-        navbox_match_start_only:        true
+        navbox_match_start_only:        :true,
+        load_strategy:                  :eval
       }
     end
 

data/mod/Modfile

@@ -23,7 +23,9 @@ mod 'rules'
 mod 'edit'
 mod 'date'
 mod 'account'
+mod 'navbar'
 mod 'bootstrap'
 mod 'google_analytics'
 mod 'recaptcha'
+gem_mod 'markdown'
 # mod 'twitter'

data/mod/account/README.md

@@ -0,0 +1,5 @@
+# @title README: account mod
+
+# account
+
+Create and manage accounts with cards. 

data/mod/account/set/all/account.rb

@@ -13,13 +13,13 @@ def accountable?
 end
 
 def parties
-  @parties ||= (all_roles << id).flatten.reject(&:blank?)
+  @parties ||= (all_enabled_roles << id).flatten.reject(&:blank?)
 end
 
 def among? ok_ids
   ok_ids.any? do |ok_id|
     ok_id == Card::AnyoneID ||
-      (ok_id == Card::AnyoneWithRoleID && all_roles.size > 1) ||
+      (ok_id == Card::AnyoneWithRoleID && all_enabled_roles.size > 1) ||
       parties.member?(ok_id)
   end
 end
@@ -31,23 +31,44 @@ def own_account?
 end
 
 def read_rules
-  @read_rules ||= begin
-    rule_ids = []
-    unless id == Card::WagnBotID # always_ok, so not needed
-      ([Card::AnyoneID] + parties).each do |party_id|
-        if (rule_ids_for_party = self.class.read_rule_cache[party_id])
-          rule_ids += rule_ids_for_party
-        end
-      end
-    end
-    rule_ids
+  @read_rules ||= fetch_read_rules
+end
+
+def fetch_read_rules
+  return [] if id == Card::WagnBotID # always_ok, so not needed
+
+  ([Card::AnyoneID] + parties).each_with_object([]) do |party_id, rule_ids|
+    next unless self.class.read_rule_cache[party_id]
+    rule_ids.concat self.class.read_rule_cache[party_id]
   end
 end
 
+def clear_roles
+  @parties = @all_roles = @all_active_roles = @read_rules = nil
+end
+
+def with_clear_roles
+  a, b, c, d = @parties, @all_roles, @all_active_roles, @read_rules
+  yield
+ensure
+  @parties, @all_roles, @all_active_roles, @read_rules = a, b, c, d
+end
+
+def all_enabled_roles
+  @all_active_roles ||= (id == Card::AnonymousID ? [] : enabled_role_ids)
+end
+
 def all_roles
   @all_roles ||= (id == Card::AnonymousID ? [] : fetch_roles)
 end
 
+def enabled_role_ids
+  Auth.as_bot do
+    role_trait = fetch(trait: :enabled_roles, new: { type_id: SessionID })
+    role_trait.virtual? ? role_trait.item_ids : fetch_roles
+  end
+end
+
 def fetch_roles
   [Card::AnyoneSignedInID] + role_ids_from_roles_trait
 end

data/mod/account/set/right/roles.rb

@@ -0,0 +1,27 @@
+event :validate_permission_to_assign_roles, :validate, on: :save do
+  return unless (fr = forbidden_roles).present?
+
+  errors.add :permission_denied,
+             "You don't have permission to assign the role#{'s' if fr.size > 1} "\
+             "#{fr.map(&:name).to_sentence}"   # LOCALIZE
+end
+
+def forbidden_roles
+  # restore old roles for permission check
+  with_old_role_permissions do |new_roles|
+    new_roles.select do |card|
+      !Card.fetch(card, "*members").ok? :update
+    end
+  end
+end
+
+def with_old_role_permissions
+  new_roles = item_cards
+  new_content = content
+  left.clear_roles
+  Auth.update_always_cache Card::Auth.as_id, nil
+  self.content = db_content_before_act
+  yield new_roles
+ensure
+  self.content = new_content
+end

data/mod/account/set/self/signin.rb

@@ -1,4 +1,3 @@
-
 # The Sign In card manages logging in and out of the site.
 #
 # /:signin (core view) gives the login ui
@@ -23,6 +22,7 @@ event :signin_success, after: :signin do
 end
 
 event :signout, :validate, on: :delete do
+  Env.reset_session
   Auth.signin AnonymousID
   abort :success
 end
@@ -34,6 +34,10 @@ event :send_reset_password_token, before: :signin, on: :update, trigger: :requir
   send_reset_password_email_or_fail email
 end
 
+def ok_to_read
+  true
+end
+
 def consider_recaptcha?
   false
 end
@@ -133,7 +137,6 @@ format :html do
     voo.hide :help
   end
 
-
   view :edit_buttons do
     text = I18n.t :reset_my_password, scope: "mod.account.set.self.signin"
     button_tag text, situation: "primary", class: "_close-modal-on-success"