card 1.97.0.1 → 1.98.0

data/mod/account/set/type/role.rb

@@ -0,0 +1,17 @@
+def disabled?
+  Auth.current&.fetch(trait: :disabled_roles)&.item_ids&.include? id
+end
+
+format :html do
+  view :link_with_checkbox, cache: :never do
+    role_checkbox
+  end
+
+  def role_checkbox
+    name = card.disabled? ? "add_item" : "drop_item"
+    subformat(Auth.current.field(:disabled_roles, new: {})).card_form :update do
+      [check_box_tag(name, card.id, !card.disabled?, class: "_edit-item"),
+       render_link]
+    end
+  end
+end

data/mod/account/set/type/user.rb

@@ -4,9 +4,9 @@ include Basic
 attr_accessor :email
 
 format :html do
-  view :setup, tags: :unknown_ok, perms: ->(_r) { Auth.needs_setup? } do
+  view :setup, unknown: true, perms: ->(_fmt) { Auth.needs_setup? } do
     with_nest_mode :edit do
-      voo.title = "Welcome, Decker!"
+      voo.title = "Welcome, Shark!" # LOCALIZE
       voo.show! :help
       voo.hide! :menu
       Auth.as_bot { setup_form }
@@ -69,7 +69,8 @@ end
 event :setup_first_user, :prepare_to_store,
       on: :create, when: proc { Card::Env.params[:setup] } do
   add_subcard "signup alert email+*to", content: name
-  add_subfield :roles, content: Card[:administrator].name
+  add_subfield :roles,
+               content: %i[help_desk shark administrator].map(&:cardname)
 end
 
 event :signin_after_setup, :integrate,

data/mod/account/spec/set/all/account_spec.rb

@@ -29,7 +29,8 @@ RSpec.describe Card::Set::All::Account do
         end
 
         it "initially has only auth and self " do
-          expect(@parties).to eq([Card::AnyoneSignedInID, @joe_user_card.id])
+          expect(@parties)
+            .to eq([Card::AnyoneSignedInID, Card::SharkID, @joe_user_card.id])
         end
 
         it "updates when new roles are set" do
@@ -37,10 +38,6 @@ RSpec.describe Card::Set::All::Account do
           r1 = Card["r1"]
 
           Card::Auth.as_bot { roles_card.items = [r1.id] }
-          expect(Card["Joe User"].parties).to eq(@parties)
-          # local cache still has old parties
-          # (permission does not change mid-request)
-
           Card::Cache.restore
           # simulate new request
           # clears local cache, where, eg, @parties would still be cached on card
@@ -119,11 +116,11 @@ RSpec.describe Card::Set::All::Account do
         expect(@read_rules.member?(Card.fetch("*all+*read").id)).to be_truthy
       end
 
-      it "18 more should apply to Joe Admin" do
+      it "11 more should apply to Joe Admin" do
         # includes lots of account rules...
         Card::Auth.as("joe_admin") do
           ids = Card::Auth.as_card.read_rules
-          expect(ids.length).to eq(@read_rules.size + 18)
+          expect(ids.length).to eq(@read_rules.size + 17)
         end
       end
     end

data/mod/account/spec/set/right/roles_spec.rb

@@ -0,0 +1,24 @@
+# -*- encoding : utf-8 -*-
+
+RSpec.describe Card::Set::Right::Roles do
+  it "shark can't assign Administrator role", with_user: "Joe User" do
+    card = Card.fetch "u1+*roles"
+    card.update content: "Administrator"
+    expect(card.errors[:permission_denied])
+      .to include(/You don't have permission to assign the role Administrator/)
+  end
+
+  it "shark can't assign Administrator to himself", with_user: "Joe User" do
+    card = Card.fetch "Joe User+*roles"
+    card.update content: "Administrator"
+    expect(card.errors[:permission_denied])
+      .to include(/You don't have permission to assign the role Administrator/)
+  end
+
+  it "user can't change role", with_user: "Joe Camel" do
+    card = Card.fetch "u1+*roles"
+    card.update content: "Shark"
+    expect(card.errors[:permission_denied])
+      .to include("You don't have permission to update u1+*roles")
+  end
+end

data/mod/ace_editor/db/migrate_core_cards/20160805112548_delete_ace_help_card.rb

@@ -0,0 +1,8 @@
+# -*- encoding : utf-8 -*-
+
+class DeleteAceHelpCard < Card::Migration
+  def up
+    delete_card "*Ace+*self+*help"
+    update_card "*Ace", type_id: Card::JsonID
+  end
+end

data/mod/ace_editor/lib/javascript/script_ace_config.js.coffee

@@ -32,10 +32,6 @@ $.extend decko,
     editor.setOptions conf
 
   initAce: (textarea) ->
-    return if textarea.data('aceInited')
-    textarea.data('aceInited', true)
-    # prevents double initialization
-
     mode = textarea.attr "data-ace-mode"
 
     unless mode

data/mod/ace_editor/set/self/ace.rb

@@ -0,0 +1,7 @@
+format :html do
+  def raw_help_text
+    "Configure [[https://ace.c9.io/|ace]], "\
+    "Decko's default code editor, using these available "\
+    "[[https://github.com/ajaxorg/ace/wiki/Configuring-Ace|options]]."
+  end
+end

data/mod/admin/set/self/admin_info.rb

@@ -5,15 +5,14 @@ end
 format :html do
   view :core do
     warnings = []
-    if Card.config.action_mailer.perform_deliveries == false
-      warnings << email_warning
-    end
+    warnings << email_warning if Card.config.action_mailer.perform_deliveries == false
     if Card.config.recaptcha_public_key ==
        Card::Auth::Permissions::RECAPTCHA_DEFAULTS[:recaptcha_public_key] &&
        card.rule(:captcha) == "1"
       warnings << recaptcha_warning
     end
     return "" if warnings.empty?
+
     alert :warning, true do
       warning_list warnings
     end
@@ -22,7 +21,7 @@ format :html do
   def warning_list warnings
     # 'ADMINISTRATOR WARNING'
     admin_warn = I18n.t(:admin_warn, scope: "mod.admin.set.self.admin_info")
-    "<h5>#{admin_warn}</h5>" + warnings.join("\n")
+    "<h5>#{admin_warn}</h5>" + list_tag(warnings)
   end
 
   def warning_list_with_auto_scope warnings
@@ -45,55 +44,23 @@ format :html do
         # %(Your captcha is currently working with temporary settings.
         #   This is fine for a local installation, but you will need new
         #   recaptcha keys if you want to make this site public.)
-        I18n.t(:captcha_temp, scope: "mod.admin.set.self.admin_info")
+        I18n.t(:captcha_temp, scope: "mod.admin.set.self.admin_info",
+                              recaptcha_link: add_recaptcha_keys_link)
       else
         # %(You are configured to use [[*captcha]], but for that to work
         #   you need new recaptcha keys.)
-        process_content(I18n.t(:captcha_keys,
-                               scope: "mod.admin.set.self.admin_info"))
+        I18n.t(:captcha_keys, scope: "mod.admin.set.self.admin_info",
+                              recaptcha_link: add_recaptcha_keys_link,
+                              captcha_link: link_to_card(:captcha))
       end
-    # 'Instructions'
-    instructions = I18n.t(:instructions,
-                          scope: "mod.admin.set.self.admin_info")
     <<-HTML
-      <p>
-        #{warning}
-      </p>
-      <h5>#{instructions}</h5>
-      #{howto_add_new_recaptcha_keys}
-      #{howto_turn_captcha_off}
+      <p>#{warning}</p>
     HTML
   end
 
-  def instructions title, steps
-    steps = list_tag steps, ordered: true
-    "#{title}#{steps}"
-  end
-
-  def howto_add_new_recaptcha_keys
-    instructions(
-      I18n.t(:howto_add_keys, scope: "mod.admin.set.self.admin_info"),
-      [
-        I18n.t(:howto_register,
-               scope: "mod.admin.set.self.admin_info",
-               recaptcha_link: link_to_resource("http://google.com/recaptcha")),
-        I18n.t(:howto_add,
-               scope: "mod.admin.set.self.admin_info",
-               recaptcha_settings: link_to_card(:recaptcha_settings))
-      ]
-    )
-  end
-
-  def howto_turn_captcha_off
-    instructions(
-      I18n.t(:howto_turn_off, scope: "mod.admin.set.self.admin_info"),
-      [
-        I18n.t(:howto_go,
-               scope: "mod.admin.set.self.admin_info",
-               captcha_card: link_to_card(:captcha)),
-        I18n.t(:howto_update,
-               scope: "mod.admin.set.self.admin_info")
-      ]
-    )
+  def add_recaptcha_keys_link
+    nest :recaptcha_settings,
+         view: :edit_link, title: I18n.t(:recaptcha_keys,
+                                         scope: "mod.admin.set.self.admin_info")
   end
 end

data/mod/admin/set/self/recaptcha_secret_key.rb

@@ -1,5 +1,5 @@
 event :validate_recaptcha_secret_key, :validate do
-  return if content.match?(/^[a-zA-Z0-9\-_]+$/)
+  return if content.match?(/^[a-zA-Z0-9\-_]*$/)
 
   errors.add :content, "invalid key" # LOCALIZE
 end

data/mod/admin/set/self/recaptcha_settings.rb

@@ -0,0 +1,44 @@
+format :html do
+  def raw_help_text
+    # LOCALIZE
+    "Register your domain at Google's [[http://google.com/recaptcha|reCAPTCHA service]] "\
+    "and enter your site key and secret key below.<br>"\
+    "If you want to turn catchas off then change all [[*captcha|captcha rules]] to 'no'."
+  end
+
+  # def instructions title, steps
+  #   steps = list_tag steps, ordered: true
+  #   "#{title}#{steps}"
+  # end
+  #
+  #       <h5>#{instructions}</h5>
+  #       #{howto_add_new_recaptcha_keys}
+  #       #{howto_turn_captcha_off}
+  #
+  # def howto_add_new_recaptcha_keys
+  #   instructions(
+  #     I18n.t(:howto_add_keys, scope: "mod.admin.set.self.admin_info"),
+  #     [
+  #       I18n.t(:howto_register,
+  #              scope: "mod.admin.set.self.admin_info",
+  #              recaptcha_link: link_to_resource("http://google.com/recaptcha")),
+  #       I18n.t(:howto_add,
+  #              scope: "mod.admin.set.self.admin_info",
+  #              recaptcha_settings: link_to_card(:recaptcha_settings))
+  #     ]
+  #   )
+  # end
+  #
+  # def howto_turn_captcha_off
+  #   instructions(
+  #     I18n.t(:howto_turn_off, scope: "mod.admin.set.self.admin_info"),
+  #     [
+  #       I18n.t(:howto_go,
+  #              scope: "mod.admin.set.self.admin_info",
+  #              captcha_card: link_to_card(:captcha)),
+  #       I18n.t(:howto_update,
+  #              scope: "mod.admin.set.self.admin_info")
+  #     ]
+  #   )
+  # end
+end

data/mod/admin/set/self/recaptcha_site_key.rb

@@ -1,5 +1,5 @@
 event :validate_recaptcha_site_key, :validate do
-  return if content.match?(/^[a-zA-Z0-9\-_]+$/)
+  return if content.match?(/^[a-zA-Z0-9\-_]*$/)
 
   errors.add :content, "invalid key" # LOCALIZE
 end

data/mod/admin/set/self/version.rb

@@ -2,6 +2,10 @@
 
 require_dependency "card/version"
 
+def ok_to_read
+  true
+end
+
 def content
   Card::Version.release
 end

data/mod/admin/spec/set/self/admin_info_spec.rb

@@ -4,7 +4,6 @@ RSpec.describe Card::Set::Self::AdminInfo do
   specify "view core" do
     expect_view(:core).to have_tag("div.alert.alert-warning.alert-dismissible") do
       with_tag "button.close"
-      with_tag "a.external-link"
     end
   end
 end

data/mod/basic_formats/format/json_format.rb

@@ -9,12 +9,12 @@ class Card
         "text/json"
       end
 
-      def expand_stubs content, &block
+      def expand_stubs content
         case content
         when Hash
-          content.each { |k, v| content[k] = expand_stubs v, &block }
+          content.each { |k, v| content[k] = expand_stubs v }
         when Array
-          content.map { |item| expand_stubs item, &block }
+          content.map { |item| expand_stubs item }
         else
           super
         end

data/mod/basic_formats/set/all/base.rb

@@ -22,9 +22,6 @@ format do
   view(:linkname, closed: true, perms: :none) { card.name.url_key }
   view(:url,      closed: true, perms: :none) { card_url _render_linkname }
 
-  view :title, closed: true, perms: :none do
-    name_variant(title_in_context(voo.title))
-  end
 
   view :url_link, closed: true, perms: :none do
     link_to_resource card_url(_render_linkname)
@@ -97,7 +94,7 @@ format do
     end
   end
 
-  view :labeled_content, tags: :unknown_ok do
+  view :labeled_content, unknown: true do
     valid_labeled_content { render_core }
   end
 
@@ -109,8 +106,8 @@ format do
     end
   end
 
-  view :titled_content do
-    _render_core
+  view :titled_content, unknown: :blank do
+    render_core
   end
 
   view :blank, closed: true, perms: :none do
@@ -144,7 +141,7 @@ format do
 
   # none of the below belongs here!!
 
-  view :template_rule, cache: :never, tags: :unknown_ok do
+  view :template_rule, cache: :never, unknown: true do
     return "" unless voo.nest_name
     if voo.nest_name.to_name.field_only?
       set_card = Card.fetch template_link_set_name

data/mod/basic_formats/set/all/head.rb

@@ -1,5 +1,5 @@
 format do
-  view :page_title, tags: :unknown_ok, perms: :none do
+  view :page_title, unknown: true, perms: :none do
     [(safe_name if card.name.present?), Card.global_setting(:title)].compact.join " - "
   end
 end
@@ -10,7 +10,7 @@ format :html do
   #  - the name of a javascript method that handles the config
   basket :mod_js_config
 
-  view :head, tags: :unknown_ok, perms: :none do
+  view :head, unknown: true, perms: :none do
     views_in_head.map { |viewname| render viewname }.flatten.compact.join "\n"
   end
 
@@ -22,23 +22,23 @@ format :html do
   end
 
   # FIXME: tags not working with `template: :haml`
-  view :meta_tags, tags: :unknown_ok, perms: :none do
+  view :meta_tags, unknown: true, perms: :none do
     haml :meta_tags
   end
 
-  view :html5shiv_tag, tags: :unknown_ok, perms: :none do
+  view :html5shiv_tag, unknown: true, perms: :none do
     nest :script_html5shiv_printshiv, view: :script_tag
   end
 
-  view :page_title_tag, tags: :unknown_ok, perms: :none do
+  view :page_title_tag, unknown: true, perms: :none do
     content_tag(:title) { render :page_title }
   end
 
-  view :favicon_tag, tags: :unknown_ok, perms: :none do
+  view :favicon_tag, unknown: true, perms: :none do
     nest :favicon, view: :link_tag
   end
 
-  view :universal_edit_button, tags: :unknown_ok, denial: :blank, perms: :update do
+  view :universal_edit_button, unknown: true, denial: :blank, perms: :update do
     return if card.new?
     tag "link", rel: "alternate", type: "application/x-wiki",
                 title: "Edit this page!", href: path(view: :edit)
@@ -47,18 +47,18 @@ format :html do
   # these should render a view of the rule card
   # it would then be safe to cache if combined with param handling
   # (but note that machine clearing would need to reset card cache...)
-  view :head_stylesheet, tags: :unknown_ok, cache: :never, perms: :none do
+  view :head_stylesheet, unknown: true, cache: :never, perms: :none do
     return unless (href = head_stylesheet_path)
     tag "link", href: href, media: "all", rel: "stylesheet", type: "text/css"
   end
 
-  view :head_javascript, tags: :unknown_ok, cache: :never, perms: :none do
+  view :head_javascript, unknown: true, cache: :never, perms: :none do
     Array.wrap(head_javascript_paths).map do |path|
       javascript_include_tag path
     end
   end
 
-  view :decko_script_variables, tags: :unknown_ok, cache: :never, perms: :none do
+  view :decko_script_variables, unknown: true, cache: :never, perms: :none do
     string = ""
     decko_script_variables.each do |k, v|
       string += "#{k}=#{script_variable_to_js v};\n"
@@ -118,7 +118,7 @@ format :html do
     end
   end
 
-  view :script_config_and_initiation, tags: :unknown_ok, perms: :none do
+  view :script_config_and_initiation, unknown: true, perms: :none do
     javascript_tag do
       (mod_js_configs << trigger_slot_ready).join "\n\n"
     end
@@ -136,7 +136,7 @@ format :html do
   end
 
   # TODO: move to rss mod
-  view :rss_links, tags: :unknown_ok, perms: :none do
+  view :rss_links, unknown: true, perms: :none do
     render :rss_link_tag if rss_link?
   end
 

data/mod/basic_formats/set/all/json.rb

@@ -27,7 +27,7 @@ format :json do
     JSON.send method, raw
   end
 
-  view :status, tags: :unknown_ok, perms: :none, cache: :never do
+  view :status, unknown: true, perms: :none do
     status = card.state
     hash = { key: card.key,
              url_key: card.name.url_key,
@@ -36,6 +36,7 @@ format :json do
     hash
   end
 
+  # NOCACHE because of timestamp
   view :page, cache: :never do
     { url: request_url,
       timestamp: Time.now.to_s,
@@ -47,7 +48,7 @@ format :json do
     req ? req.original_url : path
   end
 
-  view :core do
+  view :core, unknown: true do
     card.known? ? render_content : nil
   end
 
@@ -55,36 +56,26 @@ format :json do
     card.content
   end
 
-  view :nucleus, cache: :never do
-    h = { id: card.id,
-          name: card.name,
-          type: card.type_name,
-          url: path(format: :json) }
-    h[:codename] = card.codename if card.codename
-    h
+  view :nucleus do
+    nucleus
   end
 
   # TODO: add simple values for fields
-  view :atom, cache: :never, tags: :unknown_ok do
-    h = _render_nucleus
-    h[:content] = render_content if card.known? && !card.structure
-    h
+  view :atom, unknown: true do
+    atom
   end
 
-  view :molecule, cache: :never do
-    _render_atom.merge items: _render_items,
-                       links: _render_links,
-                       ancestors: _render_ancestors,
-                       html_url: path,
-                       type: nest(card.type_card, view: :nucleus)
-
+  view :molecule do
+    molecule
   end
 
+  # NOCACHE because sometimes item_cards is dynamic.
+  # could be safely cached for non-dynamic lists
   view :items, cache: :never do
     listing item_cards, view: :atom
   end
 
-  view :links, cache: :never do
+  view :links do
     card.link_chunks.map do |chunk|
       if chunk.referee_name
         path mark: chunk.referee_name, format: :json
@@ -94,14 +85,14 @@ format :json do
     end
   end
 
-  view :ancestors, cache: :never do
+  view :ancestors do
     card.name.ancestors.map do |name|
       nest name, view: :nucleus
     end
   end
 
   # minimum needed to re-fetch card
-  view :cast, cache: :never do
+  view :cast do
     card.cast
   end
 
@@ -127,6 +118,32 @@ format :json do
     return {} if card.structure
     { content: card.db_content }
   end
+
+  # NOTE: moving these to methods prevents potential caching problems, because other
+  # views manipulate their hashes.
+  #
+  def nucleus
+    h = { id: card.id,
+          name: card.name,
+          type: card.type_name,
+          url: path(format: :json) }
+    h[:codename] = card.codename if card.codename
+    h
+  end
+
+  def atom
+    h = nucleus
+    h[:content] = render_content if card.known? && !card.structure
+    h
+  end
+
+  def molecule
+    atom.merge items: _render_items,
+               links: _render_links,
+               ancestors: _render_ancestors,
+               html_url: path,
+               type: nest(card.type_card, view: :nucleus)
+  end
 end
 
 # TODO: perhaps this should be in a general "data" module.