collavre 0.1.0

data/app/models/collavre/inbox_item.rb

@@ -0,0 +1,95 @@
+module Collavre
+  class InboxItem < ApplicationRecord
+    self.table_name = "inbox_items"
+
+    # Use non-namespaced partial path for backward compatibility
+    def to_partial_path
+      "inbox_items/inbox_item"
+    end
+
+    INTERPOLATION_PATTERN = /%%|%\{([\w|]+)\}|%<(\w+)>[^\d]*?\d*\.?\d*[bBdiouxXeEfgGcps]/.freeze
+
+    belongs_to :owner, class_name: Collavre.configuration.user_class_name
+    belongs_to :comment, class_name: "Collavre::Comment", optional: true
+    belongs_to :creative, class_name: "Collavre::Creative", optional: true
+
+    after_commit :broadcast_badge_update, on: %i[create update destroy]
+    after_create_commit :enqueue_push_notification
+
+    attribute :state, :string, default: "new"
+    validates :state, inclusion: { in: %w[new read archived] }
+    validates :message_key, presence: true
+
+    scope :new_items, -> { where(state: "new") }
+    scope :read_items, -> { where(state: "read") }
+
+
+    def read?
+      state == "read"
+    end
+
+    def localized_message(locale: I18n.locale)
+      msg =
+        if message_key.present?
+          params = message_params || {}
+          translate_message(message_key, params.symbolize_keys, locale: locale)
+        else
+          message
+        end
+
+      msg&.gsub("&nbsp;", " ")&.gsub("\u00A0", " ")
+    end
+
+    private
+
+    def translate_message(message_key, params, locale:)
+      I18n.t(message_key, **params, locale: locale)
+    rescue I18n::MissingInterpolationArgument => e
+      missing_keys = extract_missing_keys(e.string, params)
+      fallback_params =
+        missing_keys.index_with do |missing_key|
+          default_interpolation_value(missing_key, locale: locale)
+        end
+
+      I18n.t(message_key, **params.merge(fallback_params), locale: locale)
+    end
+
+    def extract_missing_keys(translation_string, params)
+      interpolations =
+        translation_string.to_s.scan(INTERPOLATION_PATTERN).map do |match|
+          match.compact.first&.to_sym
+        end
+
+      interpolations.compact.uniq - params.keys
+    end
+
+    def default_interpolation_value(key, locale:)
+      case key.to_sym
+      when :comment_content
+        I18n.t("collavre.inbox.comment_content_unavailable", locale: locale, default: "")
+      else
+        ""
+      end
+    end
+
+    def broadcast_badge_update
+      # Recompute the new count for this owner:
+      new_count = InboxItem.where(owner: owner, state: "new").count
+
+        # Use Turbo::StreamsChannel to broadcast replace to that user's inbox stream:
+        %w[desktop-inbox-badge mobile-inbox-badge].each do |target_id|
+          Turbo::StreamsChannel.broadcast_replace_to(
+            [ "inbox", owner ],
+            target: target_id,
+            partial: "inbox/badge_component/count",
+            locals: { count: new_count, badge_id: target_id, show_zero: false }
+          )
+        end
+    end
+
+    def enqueue_push_notification
+      msg = localized_message(locale: owner.locale || "en")
+      PushNotificationJob.perform_later(owner_id, message: msg, link: link)
+    end
+  end
+end

data/app/models/collavre/invitation.rb

@@ -0,0 +1,22 @@
+module Collavre
+  class Invitation < ApplicationRecord
+    self.table_name = "invitations"
+
+    belongs_to :inviter, class_name: Collavre.configuration.user_class_name
+    belongs_to :creative, class_name: "Collavre::Creative"
+
+    enum :permission, CreativeShare.permissions
+
+    generates_token_for :invite, expires_in: 15.days
+
+    validates :expires_at, presence: true
+
+    before_validation :set_default_expires_at, on: :create
+
+    private
+
+    def set_default_expires_at
+      self.expires_at ||= 15.days.from_now
+    end
+  end
+end

data/app/models/collavre/label.rb

@@ -0,0 +1,47 @@
+module Collavre
+  class Label < ApplicationRecord
+    self.table_name = "labels"
+    # Use short class names for STI to avoid namespace issues during hot reload
+    self.store_full_sti_class = false
+
+    has_many :tags, class_name: "Collavre::Tag", dependent: :destroy
+    belongs_to :owner, class_name: Collavre.configuration.user_class_name, optional: true
+    belongs_to :creative, class_name: "Collavre::Creative", optional: false
+
+    delegate :description, to: :creative, allow_nil: true
+    alias_method :name, :description
+
+    # STI: Plan, Version, etc subclasses use type column
+    # creative_id, value, target_date etc attributes included
+
+    # Resolve short STI class names to namespaced versions
+    # Use constantize to always get fresh class reference after hot reload
+    def self.find_sti_class(type_name)
+      type_name = "Collavre::#{type_name}" unless type_name.start_with?("Collavre::")
+      type_name.constantize
+    end
+
+    after_create :create_auto_tag
+
+    # Check if user has permission to read this label
+    # If linked to a Creative, delegates to Creative's permission system
+    # Otherwise falls back to owner-based or public (nil owner) visibility
+    def readable_by?(user)
+      return true if owner_id.present? && owner_id == user&.id
+
+      if creative_id.present? && creative
+        creative.has_permission?(user, :read)
+      else
+        owner_id.nil?
+      end
+    end
+
+    private
+
+    def create_auto_tag
+      return unless creative_id.present?
+
+      tags.create!(creative_id: creative_id)
+    end
+  end
+end

data/app/models/collavre/mcp_tool.rb

@@ -0,0 +1,30 @@
+module Collavre
+  class McpTool < ApplicationRecord
+    self.table_name = "mcp_tools"
+
+    belongs_to :creative, class_name: "Collavre::Creative"
+
+    validates :name, presence: true, uniqueness: true
+    validates :source_code, presence: true
+
+    after_destroy :unregister_tool
+
+    scope :active, -> { where.not(approved_at: nil) }
+
+    def active?
+      approved_at.present?
+    end
+
+    def approve!
+      # Register the tool immediately upon approval
+      ::McpService.register_tool_from_source(source_code)
+      update!(approved_at: Time.current)
+    end
+
+    private
+
+    def unregister_tool
+      ::McpService.delete_tool(name)
+    end
+  end
+end

data/app/models/collavre/notion_account.rb

@@ -0,0 +1,17 @@
+module Collavre
+  class NotionAccount < ApplicationRecord
+    self.table_name = "notion_accounts"
+
+    belongs_to :user, class_name: Collavre.configuration.user_class_name
+    has_many :notion_page_links, class_name: "Collavre::NotionPageLink", dependent: :destroy
+
+    encrypts :token, deterministic: false
+
+    validates :notion_uid, :token, presence: true
+    validates :notion_uid, uniqueness: true
+
+    def expired?
+      token_expires_at.present? && token_expires_at < Time.current
+    end
+  end
+end

data/app/models/collavre/notion_block_link.rb

@@ -0,0 +1,10 @@
+module Collavre
+  class NotionBlockLink < ApplicationRecord
+    self.table_name = "notion_block_links"
+
+    belongs_to :notion_page_link, class_name: "Collavre::NotionPageLink"
+    belongs_to :creative, class_name: "Collavre::Creative"
+
+    validates :block_id, presence: true, uniqueness: { scope: :notion_page_link_id }
+  end
+end

data/app/models/collavre/notion_page_link.rb

@@ -0,0 +1,19 @@
+module Collavre
+  class NotionPageLink < ApplicationRecord
+    self.table_name = "notion_page_links"
+
+    belongs_to :creative, class_name: "Collavre::Creative"
+    belongs_to :notion_account, class_name: "Collavre::NotionAccount"
+    has_many :notion_block_links, class_name: "Collavre::NotionBlockLink", dependent: :destroy
+
+    validates :page_id, :page_title, presence: true
+    validates :page_id, uniqueness: true
+
+    scope :recent, -> { order(last_synced_at: :desc) }
+    scope :synced, -> { where.not(last_synced_at: nil) }
+
+    def mark_synced!
+      touch(:last_synced_at)
+    end
+  end
+end

data/app/models/collavre/plan.rb

@@ -0,0 +1,20 @@
+require "set"
+
+module Collavre
+  class Plan < Label
+    validates :target_date, presence: true
+
+    def progress(_user = nil)
+      tagged_ids = Tag.where(label_id: id).pluck(:creative_id)
+      return 0 if tagged_ids.empty?
+
+      root_ids = Creative.where(id: tagged_ids).map { |c| c.root.id }.uniq
+      roots = Creative.where(id: root_ids)
+      tagged_set = tagged_ids.to_set
+      values = roots.map { |c| c.progress_for_plan(tagged_set) }.compact
+      return 0 if values.empty?
+
+      values.sum.to_f / values.size
+    end
+  end
+end

data/app/models/collavre/session.rb

@@ -0,0 +1,24 @@
+module Collavre
+  class Session < ApplicationRecord
+    self.table_name = "sessions"
+
+    belongs_to :user, class_name: "Collavre::User"
+
+    def expired?
+      return false unless Collavre::SystemSetting.session_timeout_enabled?
+      return true if last_active_at.nil?
+
+      last_active_at < Collavre::SystemSetting.session_timeout.ago
+    end
+
+    def touch_activity!
+      update_column(:last_active_at, Time.current) if should_touch_activity?
+    end
+
+    private
+
+    def should_touch_activity?
+      last_active_at.nil? || last_active_at < 1.minute.ago
+    end
+  end
+end

data/app/models/collavre/system_setting.rb

@@ -0,0 +1,144 @@
+module Collavre
+  class SystemSetting < ApplicationRecord
+    self.table_name = "system_settings"
+
+    # Cache expiry time for settings
+    CACHE_EXPIRY = 5.minutes
+
+    # Default values for account lockout
+    DEFAULT_MAX_LOGIN_ATTEMPTS = 5
+    DEFAULT_LOCKOUT_DURATION_MINUTES = 30
+
+    # Default values for session timeout (in minutes, 0 = no timeout)
+    DEFAULT_SESSION_TIMEOUT_MINUTES = 0
+
+    # Default values for password policy
+    DEFAULT_PASSWORD_MIN_LENGTH = 8
+
+    # Default values for rate limiting
+    DEFAULT_PASSWORD_RESET_RATE_LIMIT = 5
+    DEFAULT_PASSWORD_RESET_RATE_PERIOD_MINUTES = 60
+    DEFAULT_API_RATE_LIMIT = 100
+    DEFAULT_API_RATE_PERIOD_MINUTES = 1
+
+    # Default values for creatives access
+    # By default, public access is allowed (false)
+    DEFAULT_CREATIVES_LOGIN_REQUIRED = false
+
+    # Default home page path (nil means use root_path "/")
+    DEFAULT_HOME_PAGE_PATH = nil
+
+    validates :key, presence: true, uniqueness: true
+
+    # Clear cache after save
+    after_commit :clear_cache
+
+    # Cached setting retrieval
+    def self.cached_value(key, default = nil)
+      Rails.cache.fetch("system_setting:#{key}", expires_in: CACHE_EXPIRY) do
+        find_by(key: key)&.value
+      end || default
+    end
+
+    def self.clear_all_cache
+      # Clear known setting keys
+      %w[
+        help_menu_link mcp_tool_approval_required max_login_attempts
+        lockout_duration_minutes session_timeout_minutes password_min_length
+        password_reset_rate_limit password_reset_rate_period_minutes
+        api_rate_limit api_rate_period_minutes auth_providers_disabled
+        creatives_login_required home_page_path
+      ].each { |k| Rails.cache.delete("system_setting:#{k}") }
+    end
+
+    private
+
+    def clear_cache
+      Rails.cache.delete("system_setting:#{key}")
+      # If key was changed, well also clear the old key's cache entry
+      if saved_change_to_key?
+        old_key = saved_change_to_key.first
+        Rails.cache.delete("system_setting:#{old_key}") if old_key.present?
+      end
+    end
+
+    def self.help_menu_link
+      cached_value("help_menu_link")
+    end
+
+    def self.creatives_login_required?
+      cached_value("creatives_login_required", DEFAULT_CREATIVES_LOGIN_REQUIRED.to_s) == "true"
+    end
+
+    def self.home_page_path
+      value = cached_value("home_page_path")
+      value.presence
+    end
+
+    def self.mcp_tool_approval_required?
+      if Current.mcp_tool_approval_required.nil?
+        Current.mcp_tool_approval_required = cached_value("mcp_tool_approval_required") == "true"
+      end
+      Current.mcp_tool_approval_required
+    end
+
+    # Account lockout settings
+    def self.max_login_attempts
+      cached_value("max_login_attempts")&.to_i || DEFAULT_MAX_LOGIN_ATTEMPTS
+    end
+
+    def self.lockout_duration_minutes
+      cached_value("lockout_duration_minutes")&.to_i || DEFAULT_LOCKOUT_DURATION_MINUTES
+    end
+
+    def self.lockout_duration
+      lockout_duration_minutes.minutes
+    end
+
+    # Password policy settings (capped at 72 due to bcrypt limit)
+    def self.password_min_length
+      value = cached_value("password_min_length")&.to_i
+      value = DEFAULT_PASSWORD_MIN_LENGTH if value.nil? || value < 1
+      [ value, 72 ].min
+    end
+
+    # Session timeout settings
+    def self.session_timeout_minutes
+      cached_value("session_timeout_minutes")&.to_i || DEFAULT_SESSION_TIMEOUT_MINUTES
+    end
+
+    def self.session_timeout_enabled?
+      session_timeout_minutes > 0
+    end
+
+    def self.session_timeout
+      session_timeout_minutes.minutes
+    end
+
+    # Rate limiting settings - Password Reset
+    def self.password_reset_rate_limit
+      cached_value("password_reset_rate_limit")&.to_i || DEFAULT_PASSWORD_RESET_RATE_LIMIT
+    end
+
+    def self.password_reset_rate_period_minutes
+      cached_value("password_reset_rate_period_minutes")&.to_i || DEFAULT_PASSWORD_RESET_RATE_PERIOD_MINUTES
+    end
+
+    def self.password_reset_rate_period
+      password_reset_rate_period_minutes.minutes
+    end
+
+    # Rate limiting settings - API
+    def self.api_rate_limit
+      cached_value("api_rate_limit")&.to_i || DEFAULT_API_RATE_LIMIT
+    end
+
+    def self.api_rate_period_minutes
+      cached_value("api_rate_period_minutes")&.to_i || DEFAULT_API_RATE_PERIOD_MINUTES
+    end
+
+    def self.api_rate_period
+      api_rate_period_minutes.minutes
+    end
+  end
+end

data/app/models/collavre/tag.rb

@@ -0,0 +1,10 @@
+module Collavre
+  class Tag < ApplicationRecord
+    self.table_name = "tags"
+
+    belongs_to :label, class_name: "Collavre::Label"
+
+    validates :creative_id, presence: true
+    # value 컬럼이 추가되었습니다.
+  end
+end

data/app/models/collavre/task.rb

@@ -0,0 +1,10 @@
+module Collavre
+  class Task < ApplicationRecord
+    self.table_name = "tasks"
+
+    belongs_to :agent, class_name: "Collavre::User"
+    has_many :task_actions, class_name: "Collavre::TaskAction", dependent: :destroy
+
+    validates :name, presence: true
+  end
+end

data/app/models/collavre/task_action.rb

@@ -0,0 +1,10 @@
+module Collavre
+  class TaskAction < ApplicationRecord
+    self.table_name = "task_actions"
+
+    belongs_to :task, class_name: "Collavre::Task"
+
+    validates :action_type, presence: true
+    validates :status, presence: true
+  end
+end

data/app/models/collavre/topic.rb

@@ -0,0 +1,12 @@
+module Collavre
+  class Topic < ApplicationRecord
+    self.table_name = "topics"
+
+    belongs_to :creative, class_name: "Collavre::Creative"
+    belongs_to :user, class_name: Collavre.configuration.user_class_name
+
+    has_many :comments, class_name: "Collavre::Comment", dependent: :destroy
+
+    validates :name, presence: true, uniqueness: { scope: :creative_id }
+  end
+end

data/app/models/collavre/user.rb

@@ -0,0 +1,174 @@
+module Collavre
+  class User < ApplicationRecord
+    self.table_name = "users"
+
+    has_many :user_themes, class_name: "Collavre::UserTheme", dependent: :destroy
+    DEFAULT_DISPLAY_LEVEL = 6
+
+    has_secure_password
+    has_many :sessions, class_name: "Collavre::Session", dependent: :destroy
+    has_many :oauth_applications, class_name: "Doorkeeper::Application", as: :owner, dependent: :destroy
+    has_many :access_grants, class_name: "Doorkeeper::AccessGrant", foreign_key: :resource_owner_id, dependent: :delete_all
+    has_many :access_tokens, class_name: "Doorkeeper::AccessToken", foreign_key: :resource_owner_id, dependent: :delete_all
+    has_many :webauthn_credentials, class_name: "Collavre::WebauthnCredential", dependent: :destroy
+    has_many :devices, class_name: "Collavre::Device", dependent: :destroy
+    has_many :emails, class_name: "Collavre::Email", dependent: :destroy
+    has_many :contacts, class_name: "Collavre::Contact", dependent: :destroy
+    has_many :contact_users, through: :contacts
+    has_many :contact_memberships, class_name: "Collavre::Contact", foreign_key: :contact_user_id, dependent: :destroy, inverse_of: :contact_user
+    has_one :github_account, class_name: "Collavre::GithubAccount", dependent: :destroy
+    has_one :notion_account, class_name: "Collavre::NotionAccount", dependent: :destroy
+    has_many :tasks, class_name: "Collavre::Task", foreign_key: :agent_id, dependent: :destroy
+
+    # Associations that reference creatives - must be destroyed BEFORE creatives
+    has_many :topics, class_name: "Collavre::Topic", dependent: :destroy
+    has_many :calendar_events, class_name: "Collavre::CalendarEvent", dependent: :destroy
+    has_many :comment_read_pointers, class_name: "Collavre::CommentReadPointer", dependent: :destroy
+    has_many :creative_expanded_states, class_name: "Collavre::CreativeExpandedState", dependent: :destroy
+    has_many :creative_shares, class_name: "Collavre::CreativeShare", dependent: :destroy
+    has_many :creative_shares_caches, class_name: "Collavre::CreativeSharesCache", dependent: :delete_all
+    has_many :shared_creative_shares, class_name: "Collavre::CreativeShare", foreign_key: :shared_by_id,
+                                      dependent: :nullify, inverse_of: :shared_by
+    has_many :inbox_items, class_name: "Collavre::InboxItem", foreign_key: :owner_id, dependent: :destroy, inverse_of: :owner
+    has_many :invitations, class_name: "Collavre::Invitation", foreign_key: :inviter_id, dependent: :destroy, inverse_of: :inviter
+    has_many :activity_logs, class_name: "Collavre::ActivityLog", dependent: :destroy
+    has_many :labels, class_name: "Collavre::Label", foreign_key: :owner_id, dependent: :destroy
+    has_many :comments, class_name: "Collavre::Comment", dependent: :destroy
+    has_many :action_executed_comments, class_name: "Collavre::Comment", foreign_key: :action_executed_by_id,
+                                        dependent: :nullify, inverse_of: :action_executed_by
+    has_many :approved_comments, class_name: "Collavre::Comment", foreign_key: :approver_id,
+                                 dependent: :nullify, inverse_of: :approver
+    has_many :comment_reactions, class_name: "Collavre::CommentReaction", dependent: :destroy
+
+    # Creatives must be destroyed AFTER all associations that reference them
+    has_many :creatives, class_name: "Collavre::Creative", dependent: :destroy
+
+    belongs_to :creator, class_name: "Collavre::User", foreign_key: "created_by_id", optional: true
+    has_many :created_ai_users, class_name: "Collavre::User", foreign_key: "created_by_id", dependent: :destroy
+
+    has_one_attached :avatar
+
+    attribute :display_level, :integer, default: DEFAULT_DISPLAY_LEVEL
+    attribute :completion_mark, :string, default: ""
+    attribute :theme, :string
+    attribute :calendar_id, :string
+    attribute :name, :string
+    attribute :notifications_enabled, :boolean
+    attribute :timezone, :string
+    attribute :locale, :string
+    attribute :system_admin, :boolean, default: false
+    attribute :searchable, :boolean, default: false
+
+    attribute :google_uid, :string
+    attribute :google_access_token, :string
+    attribute :google_refresh_token, :string
+    attribute :google_token_expires_at, :datetime
+
+    attribute :system_prompt, :string
+    attribute :llm_vendor, :string
+    attribute :llm_model, :string
+    attribute :llm_api_key, :string
+    attribute :tools, :json, default: -> { [] }
+
+    encrypts :llm_api_key, deterministic: false
+    encrypts :google_access_token, deterministic: false
+    encrypts :google_refresh_token, deterministic: false
+
+    SUPPORTED_LLM_MODELS = [
+      "gemini-2.5-flash",
+      "gemini-1.5-flash",
+      "gemini-1.5-pro"
+    ].freeze
+
+    def ai_user?
+      llm_vendor.present?
+    end
+
+    def self.mentionable_for(creative)
+      scope = where(searchable: true)
+      return scope unless creative
+
+      origin = creative.effective_origin
+      permitted_users = [ origin.user ].compact + origin.all_shared_users(:feedback).map(&:user)
+      permitted_ids = permitted_users.compact.map(&:id)
+      permitted_ids.any? ? scope.or(where(id: permitted_ids)) : scope
+    end
+
+    normalizes :email, with: ->(e) { e.strip.downcase }
+    normalizes :timezone, with: ->(tz) do
+      tz = tz.to_s.strip
+      next if tz.blank?
+      ActiveSupport::TimeZone[tz]&.tzinfo&.identifier || tz
+    end
+
+    validates :email, presence: true, uniqueness: true,
+                      format: { with: URI::MailTo::EMAIL_REGEXP }
+    validates :name, presence: true
+    validates :display_level, numericality: { only_integer: true, greater_than: 0 }
+    validate :theme_accessibility
+    validate :password_meets_minimum_length
+    validates :timezone,
+              inclusion: { in: ActiveSupport::TimeZone.all.map { |z| z.tzinfo.identifier } },
+              allow_nil: true
+
+    generates_token_for :email_verification, expires_in: 1.day do
+      email
+    end
+
+    def email_verified?
+      email_verified_at.present?
+    end
+
+    def display_name
+      name.presence || email
+    end
+
+    # Account lockout methods
+    def locked?
+      locked_at.present? && locked_at > Collavre::SystemSetting.lockout_duration.ago
+    end
+
+    def lock_account!
+      update_columns(locked_at: Time.current)
+    end
+
+    def unlock_account!
+      update_columns(locked_at: nil, failed_login_attempts: 0)
+    end
+
+    def record_failed_login!
+      new_count = (failed_login_attempts || 0) + 1
+      if new_count >= Collavre::SystemSetting.max_login_attempts
+        update_columns(failed_login_attempts: new_count, locked_at: Time.current)
+      else
+        update_column(:failed_login_attempts, new_count)
+      end
+    end
+
+    def reset_failed_login_attempts!
+      update_column(:failed_login_attempts, 0) if failed_login_attempts.to_i > 0
+    end
+
+    def remaining_lockout_time
+      return 0 unless locked?
+      ((locked_at + Collavre::SystemSetting.lockout_duration) - Time.current).to_i
+    end
+
+    def password_meets_minimum_length
+      return if password.blank?
+
+      min_length = Collavre::SystemSetting.password_min_length
+      if password.length < min_length
+        errors.add(:password, :too_short, count: min_length)
+      end
+    end
+
+    def theme_accessibility
+      return if theme.blank? || %w[light dark].include?(theme)
+
+      unless user_themes.exists?(id: theme)
+        errors.add(:theme, "is invalid")
+      end
+    end
+  end
+end

data/app/models/collavre/user_theme.rb

@@ -0,0 +1,10 @@
+module Collavre
+  class UserTheme < ApplicationRecord
+    self.table_name = "user_themes"
+
+    belongs_to :user, class_name: Collavre.configuration.user_class_name
+
+    validates :name, presence: true
+    validates :variables, presence: true
+  end
+end

data/app/models/collavre/variation.rb

@@ -0,0 +1,5 @@
+module Collavre
+  class Variation < Label
+    # Variation-specific logic here
+  end
+end