collavre 0.1.0

data/app/controllers/collavre/inbox_items_controller.rb

@@ -0,0 +1,64 @@
+module Collavre
+  class InboxItemsController < ApplicationController
+    before_action :set_inbox_item, only: [ :update, :destroy ]
+
+    PER_PAGE = 20
+
+    def index
+      scope = InboxItem.where(owner: Current.user).order(created_at: :desc)
+      scope = scope.new_items unless params[:show] == "all"
+
+      per_page = params[:per_page].presence&.to_i || PER_PAGE
+      per_page = PER_PAGE if per_page <= 0 || per_page > 100
+      page = params[:page].presence&.to_i || 1
+      page = 1 if page < 1
+      offset = (page - 1) * per_page
+
+      items = scope.offset(offset).limit(per_page + 1).to_a
+      @inbox_items = items.first(per_page)
+      @next_page = items.length > per_page ? page + 1 : nil
+
+      respond_to do |format|
+        format.html do
+          render partial: "collavre/inbox_items/list", locals: { items: @inbox_items, next_page: @next_page }
+        end
+        format.json do
+          render json: {
+            items_html: render_to_string(partial: "collavre/inbox_items/items", formats: [ :html ], locals: { items: @inbox_items }),
+            next_page: @next_page,
+            empty: @inbox_items.empty?
+          }
+        end
+      end
+    end
+
+    def count
+      c = InboxItem.where(owner: Current.user, state: "new").count
+      render json: { count: c }
+    end
+
+    def update
+      if @inbox_item.owner == Current.user
+        @inbox_item.update(state: params[:state])
+        head :no_content
+      else
+        head :forbidden
+      end
+    end
+
+    def destroy
+      if @inbox_item.owner == Current.user
+        @inbox_item.destroy
+        head :no_content
+      else
+        head :forbidden
+      end
+    end
+
+    private
+
+    def set_inbox_item
+      @inbox_item = InboxItem.find(params[:id])
+    end
+  end
+end

data/app/controllers/collavre/invites_controller.rb

@@ -0,0 +1,27 @@
+module Collavre
+  class InvitesController < ApplicationController
+    allow_unauthenticated_access only: :show
+    before_action :set_invitation, only: :show
+
+    def create
+      creative = Creative.find(params[:creative_id]).effective_origin
+      permission = params[:permission] || :read
+      invitation = Invitation.create!(inviter: Current.user,
+                                      creative: creative,
+                                      permission: permission)
+      render json: { url: invite_url(token: invitation.generate_token_for(:invite)) }
+    end
+
+    def show
+      @invitation.update(clicked_at: Time.current) unless @invitation.clicked_at
+    end
+
+    private
+
+    def set_invitation
+      @invitation = Invitation.find_by_token_for(:invite, params[:token])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature
+      redirect_to main_app.new_user_path, alert: t("collavre.invites.invalid")
+    end
+  end
+end

data/app/controllers/collavre/notion_auth_controller.rb

@@ -0,0 +1,25 @@
+module Collavre
+  class NotionAuthController < ApplicationController
+    allow_unauthenticated_access only: :callback
+    before_action -> { enforce_auth_provider!(:notion) }, only: :callback
+
+    def callback
+      auth = request.env["omniauth.auth"]
+      notion = Collavre::NotionAccount.find_or_initialize_by(notion_uid: auth.uid)
+
+      if notion.new_record?
+        unless Current.user
+          redirect_to collavre.new_session_path, alert: I18n.t("collavre.notion_auth.login_first")
+          return
+        end
+        notion.user = Current.user
+      end
+
+      notion.token = auth.credentials.token
+      notion.workspace_name = auth.info.name
+      notion.save!
+
+      redirect_to creatives_path, notice: I18n.t("collavre.notion_auth.connected")
+    end
+  end
+end

data/app/controllers/collavre/passwords_controller.rb

@@ -0,0 +1,37 @@
+module Collavre
+  class PasswordsController < ApplicationController
+    allow_unauthenticated_access
+    before_action :set_user_by_token, only: %i[ edit update ]
+    before_action :check_password_reset_rate_limit!, only: :create
+
+    def new
+    end
+
+    def create
+      if user = Collavre::User.find_by(email: params[:email])
+        PasswordsMailer.reset(user).deliver_later
+      end
+
+      redirect_to new_session_path, notice: "Password reset instructions sent (if user with that email address exists)."
+    end
+
+    def edit
+    end
+
+    def update
+      if @user.update(params.permit(:password, :password_confirmation))
+        redirect_to new_session_path, notice: "Password has been reset."
+      else
+        redirect_to edit_password_path(params[:token]), alert: "Passwords did not match."
+      end
+    end
+
+    private
+
+    def set_user_by_token
+      @user = Collavre::User.find_by_password_reset_token!(params[:token])
+    rescue ActiveSupport::MessageVerifier::InvalidSignature
+      redirect_to new_password_path, alert: "Password reset link is invalid or has expired."
+    end
+  end
+end

data/app/controllers/collavre/plans_controller.rb

@@ -0,0 +1,110 @@
+module Collavre
+  class PlansController < ApplicationController
+    def index
+      center = if params[:date].present?
+                  Date.parse(params[:date]) rescue Date.current
+      else
+                  Date.current
+      end
+      start_date = center - 30
+      end_date = center + 30
+      @plans = Plan.includes(:creative)
+                   .where("target_date >= ? AND created_at <= ?", start_date, end_date)
+                   .order(:created_at)
+                   .select { |plan| plan.readable_by?(Current.user) }
+      calendar_scope = CalendarEvent.includes(:creative)
+                                    .where("DATE(start_time) <= ? AND DATE(end_time) >= ?", end_date, start_date)
+                                    .order(:start_time)
+      events_in_scope = calendar_scope.to_a
+      own_events = events_in_scope.select { |event| event.user_id == Current.user.id }
+      shared_events = events_in_scope.reject { |event| event.user_id == Current.user.id }
+                                     .select { |event| event.creative&.has_permission?(Current.user, :write) }
+      @calendar_events = (own_events + shared_events).uniq.sort_by(&:start_time)
+      respond_to do |format|
+        format.html do
+          render html: render_to_string(PlansTimelineComponent.new(plans: @plans, calendar_events: @calendar_events), layout: false)
+        end
+        format.json do
+          plan_jsons = @plans.map { |p| plan_json(p) }
+          event_jsons = @calendar_events.map { |e| calendar_json(e) }
+          render json: plan_jsons + event_jsons
+        end
+      end
+    end
+    def create
+      @plan = Plan.new(plan_params)
+      @plan.owner = Current.user
+      if @plan.save
+        respond_to do |format|
+          format.html do
+            redirect_back fallback_location: main_app.root_path, notice: t("collavre.plans.created")
+          end
+          format.json do
+            render json: plan_json(@plan), status: :created
+          end
+        end
+      else
+        respond_to do |format|
+          format.html do
+            flash[:alert] = @plan.errors.full_messages.join(", ")
+            redirect_back fallback_location: main_app.root_path
+          end
+          format.json do
+            render json: { errors: @plan.errors.full_messages }, status: :unprocessable_entity
+          end
+        end
+      end
+    end
+
+    def destroy
+      @plan = Plan.find(params[:id])
+      @plan.destroy
+      respond_to do |format|
+        format.html do
+          redirect_back fallback_location: main_app.root_path,
+                        notice: t("collavre.plans.deleted", default: "Plan deleted.")
+        end
+        format.json { head :no_content }
+      end
+    end
+
+    private
+
+    def plan_params
+      params.require(:plan).permit(:target_date, :creative_id)
+    end
+
+    def plan_json(plan)
+      {
+        id: plan.id,
+        name: (plan.creative&.effective_description(nil, false) || plan.name.presence || I18n.l(plan.target_date)),
+        created_at: plan.created_at.to_date,
+        target_date: plan.target_date,
+        progress: plan.progress,
+        path: plan_creatives_path(plan),
+        deletable: plan.owner_id == Current.user&.id
+      }
+    end
+
+
+    def calendar_json(event)
+      {
+        id: "calendar_event_#{event.id}",
+        name: event.summary.presence || I18n.l(event.start_time.to_date),
+        created_at: event.start_time.to_date,
+        target_date: event.end_time.to_date,
+        progress: event.creative&.progress || 0,
+        path: event.creative ? creative_path(event.creative) : event.html_link,
+        deletable: event.user_id == Current.user&.id
+      }
+    end
+
+    def plan_creatives_path(plan)
+      if params[:id].present?
+        creative_path(params[:id], tags: [ plan.id ])
+      else
+        creatives_path(tags: [ plan.id ])
+      end
+    end
+  end
+end

data/app/controllers/collavre/sessions_controller.rb

@@ -0,0 +1,57 @@
+module Collavre
+  class SessionsController < ApplicationController
+    allow_unauthenticated_access only: %i[ new create ]
+    before_action -> { enforce_auth_provider!(:email) }, only: :create
+
+    # Read rate limiting from environment-driven configuration
+    limit_cfg = Rails.configuration.x.sessions_create_rate_limit || {}
+    rate_limit to: (limit_cfg[:to] || 10),
+               within: (limit_cfg[:within] || 3.minutes),
+               only: :create,
+               with: -> { redirect_to new_session_url, alert: I18n.t("collavre.users.sessions.new.try_again_later") }
+
+    def new
+    end
+
+    def create
+      credentials = params.permit(:email, :password)
+      user = Collavre::User.find_by(email: credentials[:email]&.downcase)
+
+      # Check if account is locked
+      if user&.locked?
+        minutes = (user.remaining_lockout_time / 60.0).ceil
+        redirect_to new_session_path, alert: I18n.t("collavre.users.sessions.new.account_locked", minutes: minutes)
+        return
+      end
+
+      if user && user.authenticate(credentials[:password])
+        if user.email_verified?
+          user.reset_failed_login_attempts!
+          handle_invitation_for(user) if params[:invite_token].present?
+          start_new_session_for user
+          tz = params[:timezone]
+          user.update(timezone: tz) if tz.present? && user.timezone != tz
+          redirect_to after_authentication_url
+        else
+          redirect_to new_session_path, alert: I18n.t("collavre.users.sessions.new.email_not_verified")
+        end
+      else
+        # Record failed login attempt if user exists
+        user&.record_failed_login!
+        if user&.locked?
+          minutes = Collavre::SystemSetting.lockout_duration_minutes
+          redirect_to new_session_path, alert: I18n.t("collavre.users.sessions.new.account_locked_now", minutes: minutes)
+        else
+          redirect_to new_session_path, alert: I18n.t("collavre.users.sessions.new.try_another_email_or_password")
+        end
+      end
+    end
+
+    def destroy
+      terminate_session
+      redirect_to new_session_path
+    end
+
+    private
+  end
+end

data/app/controllers/collavre/topics_controller.rb

@@ -0,0 +1,58 @@
+module Collavre
+  class TopicsController < ApplicationController
+    before_action :set_creative
+
+    def index
+      can_manage = @creative.has_permission?(Current.user, :admin) || @creative.user == Current.user
+      render json: {
+        topics: @creative.topics.order(:created_at),
+        can_manage: can_manage
+      }
+    end
+
+    def create
+      unless @creative.has_permission?(Current.user, :write) || @creative.user == Current.user
+        render json: { error: I18n.t("collavre.topics.no_permission") }, status: :forbidden and return
+      end
+
+      topic = @creative.topics.build(topic_params)
+      topic.user = Current.user
+
+      if topic.save
+        TopicsChannel.broadcast_to(
+          @creative,
+          { action: "created", topic: topic.slice(:id, :name) }
+        )
+        render json: topic, status: :created
+      else
+        render json: { errors: topic.errors.full_messages }, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      unless @creative.has_permission?(Current.user, :admin) || @creative.user == Current.user
+        render json: { error: I18n.t("collavre.topics.no_permission") }, status: :forbidden and return
+      end
+
+      topic = @creative.topics.find(params[:id])
+      topic_id = topic.id
+      topic.destroy
+
+      TopicsChannel.broadcast_to(
+        @creative,
+        { action: "deleted", topic_id: topic_id }
+      )
+      head :no_content
+    end
+
+    private
+
+    def set_creative
+      @creative = Creative.find(params[:creative_id]).effective_origin
+    end
+
+    def topic_params
+      params.require(:topic).permit(:name)
+    end
+  end
+end

data/app/controllers/collavre/user_themes_controller.rb

@@ -0,0 +1,58 @@
+module Collavre
+  class UserThemesController < ApplicationController
+    def index
+      @themes = Current.user.user_themes.order(created_at: :desc)
+      @new_theme = UserTheme.new
+    end
+
+    def create
+      description = params[:description]
+      if description.blank?
+        @error = t("collavre.themes.alerts.description_empty")
+        @themes = Current.user.user_themes.order(created_at: :desc)
+        @new_theme = UserTheme.new
+        render :index
+        return
+      end
+
+      variables = AutoThemeGenerator.new.generate(description)
+
+      if variables.empty?
+        @error = t("collavre.themes.alerts.generation_failed")
+        @themes = Current.user.user_themes.order(created_at: :desc)
+        @new_theme = UserTheme.new
+        render :index
+        return
+      end
+
+      # Generate a name from description or use first few words
+      name = description.truncate(30)
+
+      @theme = Current.user.user_themes.build(name: name, variables: variables)
+
+      if @theme.save
+        redirect_to user_themes_path, notice: t("collavre.themes.alerts.success")
+      else
+        redirect_to user_themes_path, alert: t("collavre.themes.alerts.save_failed")
+      end
+    end
+
+    def destroy
+      @theme = Current.user.user_themes.find(params[:id])
+      @theme.destroy
+      if Current.user.theme == @theme.id.to_s
+        Current.user.update(theme: "light")
+      end
+      redirect_to user_themes_path, notice: t("collavre.themes.alerts.deleted")
+    end
+
+    def apply
+      @theme = Current.user.user_themes.find(params[:id])
+      if Current.user.update(theme: @theme.id.to_s)
+        redirect_to user_themes_path, notice: t("collavre.themes.alerts.applied")
+      else
+        redirect_to user_themes_path, alert: t("collavre.themes.alerts.apply_failed", errors: Current.user.errors.full_messages.join(", "))
+      end
+    end
+  end
+end