collavre 0.1.0

data/app/controllers/collavre/attachments_controller.rb

@@ -0,0 +1,44 @@
+module Collavre
+  class AttachmentsController < ApplicationController
+    # DELETE /attachments/:signed_id
+    def destroy
+      blob = ActiveStorage::Blob.find_signed(params[:signed_id])
+
+      unless authorized_to_purge?(blob)
+        return head :forbidden
+      end
+
+      blob.purge
+      head :no_content
+    rescue ActiveRecord::RecordNotFound
+      head :not_found
+    rescue => e
+      Rails.logger.error("Failed to delete attachment: #{e.message}")
+      head :internal_server_error
+    end
+
+    private
+
+    def authorized_to_purge?(blob)
+      return false unless Current.user
+
+      attachment_owned_by_current_user?(blob) || editable_creative_reference?(blob)
+    end
+
+    def attachment_owned_by_current_user?(blob)
+      blob.attachments.any? do |attachment|
+        record = attachment.record
+        record == Current.user || record.respond_to?(:user_id) && record.user_id == Current.user.id
+      end
+    end
+
+    def editable_creative_reference?(blob)
+      signed_id = blob.signed_id
+      pattern = "%#{ActiveRecord::Base.sanitize_sql_like(signed_id)}%"
+
+      Creative.where("description LIKE ?", pattern).any? do |creative|
+        creative.has_permission?(Current.user, :write)
+      end
+    end
+  end
+end

data/app/controllers/collavre/calendar_events_controller.rb

@@ -0,0 +1,15 @@
+module Collavre
+  class CalendarEventsController < ApplicationController
+    def destroy
+      event = CalendarEvent.where(user: Current.user).find(params[:id])
+      event.destroy
+      respond_to do |format|
+        format.html do
+          redirect_back fallback_location: main_app.root_path,
+                        notice: t("collavre.calendar_events.deleted", default: "Event deleted.")
+        end
+        format.json { head :no_content }
+      end
+    end
+  end
+end

data/app/controllers/collavre/comment_read_pointers_controller.rb

@@ -0,0 +1,80 @@
+module Collavre
+  class CommentReadPointersController < ApplicationController
+    def update
+      creative = Creative.find(params[:creative_id]).effective_origin
+      last_id = creative.comments.where("comments.private = ? OR comments.user_id = ? OR comments.approver_id = ?", false, Current.user.id, Current.user.id).maximum(:id)
+      pointer = CommentReadPointer.find_or_initialize_by(user: Current.user, creative: creative)
+
+      previous_last_read_id = pointer.last_read_comment_id
+      pointer.last_read_comment_id = last_id
+      pointer.save!
+
+      mark_inbox_items_read(creative, last_id)
+      Comment.broadcast_badge(creative, Current.user)
+
+      if previous_last_read_id && previous_last_read_id != last_id
+        broadcast_read_receipts(creative, previous_last_read_id)
+      end
+      broadcast_read_receipts(creative, last_id)
+
+      render json: { success: true }
+    end
+
+    private
+
+    def broadcast_read_receipts(creative, comment_id)
+      return unless comment_id
+
+      # We map to the nearest PUBLIC comment to avoid leaking the existence/ID of private comments
+      # via the public action cable channel.
+      # Trade-off: Private-only threads (with no preceding public comment) will not get real-time read updates.
+      effective_id = find_nearest_public_comment_id(creative, comment_id)
+      return unless effective_id
+
+      users = fetch_users_on_effective_id(creative, effective_id)
+
+      present_user_ids = CommentPresenceStore.list(creative.id)
+
+      Turbo::StreamsChannel.broadcast_update_to(
+        [ creative, :comments ],
+        target: "read_receipts_comment_#{effective_id}",
+        partial: "collavre/comments/read_receipts",
+        locals: { read_by_users: users, present_user_ids: present_user_ids }
+      )
+    end
+
+    def find_nearest_public_comment_id(creative, comment_id)
+      creative.comments.where(private: false).where("id <= ?", comment_id).maximum(:id)
+    end
+
+    def fetch_users_on_effective_id(creative, effective_id)
+      next_public_id = creative.comments.where(private: false).where("id > ?", effective_id).minimum(:id)
+
+      query = CommentReadPointer.where(creative: creative)
+                                .where("last_read_comment_id >= ?", effective_id)
+
+      query = query.where("last_read_comment_id < ?", next_public_id) if next_public_id
+
+      query.includes(user: { avatar_attachment: :blob }).map(&:user)
+    end
+
+    def mark_inbox_items_read(creative, last_comment_id)
+      return unless last_comment_id
+
+      base_scope = InboxItem.where(owner: Current.user, state: "new")
+                            .where(message_key: [ "inbox.comment_added", "inbox.user_mentioned" ])
+
+      with_creative = base_scope.where(creative: creative)
+                                .where("comment_id IS NULL OR comment_id <= ?", last_comment_id)
+
+      ids = with_creative.pluck(:id)
+      return if ids.empty?
+
+      InboxItem.transaction do
+        InboxItem.where(id: ids).where.not(state: "read").find_each do |item|
+          item.update!(state: "read")
+        end
+      end
+    end
+  end
+end

data/app/controllers/collavre/comments/activity_logs_controller.rb

@@ -0,0 +1,26 @@
+module Collavre
+  module Comments
+    class ActivityLogsController < ApplicationController
+      before_action :set_comment
+      before_action :ensure_permission
+
+      def show
+        @activity_logs = @comment.activity_logs.order(created_at: :desc)
+        render partial: "collavre/comments/activity_log_details", locals: { activity_logs: @activity_logs, comment: @comment }
+      end
+
+      private
+
+      def set_comment
+        @comment = Comment.find(params[:comment_id])
+      end
+
+      def ensure_permission
+        # Ensure user can read the creative the comment belongs to
+        unless @comment.creative.has_permission?(Current.user, :read)
+          head :forbidden
+        end
+      end
+    end
+  end
+end

data/app/controllers/collavre/comments/reactions_controller.rb

@@ -0,0 +1,82 @@
+module Collavre
+  module Comments
+    class ReactionsController < ApplicationController
+      before_action :set_creative
+      before_action :set_comment
+      before_action :authorize_feedback!
+
+      def create
+        emoji = params[:emoji].to_s.strip
+        if emoji.blank?
+          render json: { error: I18n.t("collavre.comments.reaction_invalid") }, status: :unprocessable_entity and return
+        end
+
+        @comment.comment_reactions.find_or_create_by!(user: Current.user, emoji: emoji)
+        broadcast_reaction_update
+        render json: build_reaction_payload
+      end
+
+      def destroy
+        emoji = params[:emoji].to_s.strip
+        if emoji.blank?
+          render json: { error: I18n.t("collavre.comments.reaction_invalid") }, status: :unprocessable_entity and return
+        end
+
+        reaction = @comment.comment_reactions.find_by(user: Current.user, emoji: emoji)
+        reaction&.destroy
+        broadcast_reaction_update
+        render json: build_reaction_payload
+      end
+
+      private
+
+      def build_reaction_payload
+        # Fetch fresh reactions
+        reactions = @comment.comment_reactions.reload.to_a
+        reaction_groups = reactions.group_by(&:emoji)
+
+        reaction_groups.map do |emoji, grouped_reactions|
+          {
+            emoji: emoji,
+            count: grouped_reactions.size,
+            user_ids: grouped_reactions.map(&:user_id)
+          }
+        end
+      end
+
+      def broadcast_reaction_update
+        payload = build_reaction_payload
+        Turbo::StreamsChannel.broadcast_action_to(
+          [ @creative, :comments ],
+          action: "update_reactions",
+          target: view_context.dom_id(@comment),
+          attributes: {
+            data: payload.to_json
+          }
+        )
+      end
+
+      def set_creative
+        @creative = Creative.find(params[:creative_id]).effective_origin
+      end
+
+      def set_comment
+        comment_id = params[:comment_id] || params[:id]
+        @comment = @creative.comments
+                           .where(
+                             "comments.private = ? OR comments.user_id = ? OR comments.approver_id = ?",
+                             false,
+                             Current.user.id,
+                             Current.user.id
+                           )
+                           .find(comment_id)
+      end
+
+      def authorize_feedback!
+        return if @creative.has_permission?(Current.user, :feedback)
+
+        render json: { error: I18n.t("collavre.comments.no_permission") }, status: :forbidden
+      end
+    end
+  end
+end