collavre 0.23.0 → 0.24.0

data/app/services/collavre/creatives/permission_checker.rb

@@ -7,7 +7,7 @@ module Collavre
       end
 
       def allowed?(required_permission = :read)
-        base = creative.origin_id.nil? ? creative : creative.origin
+        base = EffectiveCreativeResolution.effective_creative(creative)
 
         # Owner always has admin permission (fallback for fixtures and missing cache entries)
         return true if base.user_id == user&.id

data/app/services/collavre/creatives/permission_filter.rb

@@ -5,46 +5,173 @@ module Creatives
   # has_children presence check can apply the exact same permission posture as
   # the browse endpoint (children_with_permission) without re-deriving it.
   #
-  # no_access wins over a public share, so user-level denials are subtracted
-  # from the public set. Owned creatives are always readable.
+  # A user-specific cache entry is authoritative over a public share: it grants
+  # only when its own rank meets the requested threshold and otherwise suppresses
+  # the public share (so a no_access — or any below-threshold user entry — wins
+  # over a more permissive public share). Owned creatives are always readable.
   class PermissionFilter
+    # An owner always resolves to admin, the top rank, so it satisfies any
+    # min_permission threshold. This is the canonical owner rank the read-path
+    # callers (TreeBuilder, SlideViewable) inherit via #ranks_for / #readable_ids.
+    OWNER_RANK = CreativeShare.permissions[:admin]
+
     def initialize(user:)
       @user = user
     end
 
-    # Returns the subset of `ids` the user may read, as an Array.
-    def readable_ids(ids)
-      ids = ids.to_a
+    # Returns the subset of `ids` the user may access at `min_permission` or
+    # higher, as an Array. `min_permission:` defaults to `:read`, so the no-arg
+    # form is unchanged; pass `:write` (etc.) to share the one batch filter with
+    # write-posture sites instead of re-deriving the rank comparison.
+    #
+    # Each id is resolved to its effective (origin) creative via the SAME
+    # logic PermissionChecker uses, so a linked creative yields identical
+    # permission whether checked one-by-one or filtered in a batch.
+    def readable_ids(ids, min_permission: :read)
+      # Normalize to Integer so the final select (and owned-shell lookup) compare
+      # against pluck-derived integer ids rather than string inputs; keeps the
+      # canonical batch filter robust to param-sourced ids. Non-numeric ids drop.
+      ids = ids.to_a.filter_map { |id| Integer(id, exception: false) }.uniq
       return [] if ids.empty?
 
+      min_rank = rank_for(min_permission)
+      effective_by_id = EffectiveCreativeResolution.effective_creative_ids(ids)
+      readable_effective = readable_effective_ids(effective_by_id.values.uniq, min_rank)
+
+      # A linked creative borrows its ORIGIN's permission, but the shell row
+      # itself represents a specific PLACEMENT of that link inside a tree.
+      # Returning a shell solely because its origin is readable would leak other
+      # users' private shell placements into search/filter results — a batch can
+      # be fed foreign shells (e.g. FilterPipeline#resolve_ancestors pulls every
+      # Creative.where(origin_id: ...) regardless of owner). So a shell is gated
+      # on the viewer being able to SEE its placement at the requested rank, in
+      # ADDITION to origin readability: either the viewer owns the shell, or the
+      # shell sits in a subtree shared with the viewer AT >= min_permission (a
+      # propagated CreativeSharesCache entry on the shell row itself — e.g. a
+      # public help doc's linked child). The placement is checked at min_rank
+      # (not always :read) because higher-privilege callers share this batch —
+      # children_with_permission(user, :admin), used by DestroyService's
+      # recursive delete, must not reach a shell the viewer only has read on. A
+      # shell in a foreign PRIVATE tree (no viewer entry) stays hidden. Non-shell
+      # ids keep origin-readability-only behaviour.
+      visible_shells = visible_shell_ids(effective_by_id, min_rank)
+
+      ids.select do |id|
+        next false unless readable_effective.include?(effective_by_id[id])
+
+        effective_by_id[id] == id || visible_shells.include?(id)
+      end
+    end
+
+    # Returns { input_id => effective_permission_rank } for the ids the user has
+    # ANY relationship to, mirroring single-item PermissionChecker: owner wins
+    # (admin rank), else the user's own cache entry (INCLUDING a no_access deny,
+    # which is rank 0 and beats a public share), else the public entry. Ids with
+    # no owner/entry/public share are ABSENT from the hash (distinct from rank 0).
+    #
+    # The rank is the raw CreativeShare.permissions integer, so callers compare
+    # `rank >= rank_for(:write)` themselves. Unlike readable_ids this does NOT
+    # apply the shell-ownership anti-leak gate — it is for tree_builder /
+    # slide_viewable which rank creatives already inside the viewer's own tree,
+    # exactly as PermissionChecker#allowed? would resolve them one by one.
+    def ranks_for(ids)
+      ids = ids.to_a.filter_map { |id| Integer(id, exception: false) }.uniq
+      return {} if ids.empty?
+
+      effective_by_id = EffectiveCreativeResolution.effective_creative_ids(ids)
+      effective_ids = effective_by_id.values.uniq
+
+      owner_by_effective = Creative.where(id: effective_ids).pluck(:id, :user_id).to_h
+
+      user_entries = if user
+        CreativeSharesCache.where(creative_id: effective_ids, user_id: user.id)
+          .pluck(:creative_id, :permission).to_h
+      else
+        {}
+      end
+
+      needs_public = effective_ids - user_entries.keys
+      public_entries = if needs_public.any?
+        CreativeSharesCache.where(creative_id: needs_public, user_id: nil)
+          .pluck(:creative_id, :permission).to_h
+      else
+        {}
+      end
+
+      ranks = {}
+      ids.each do |id|
+        effective = effective_by_id[id]
+        if user && owner_by_effective[effective] == user.id
+          ranks[id] = OWNER_RANK
+        else
+          permission = user_entries[effective] || public_entries[effective]
+          ranks[id] = CreativeShare.permissions[permission] if permission
+        end
+      end
+      ranks
+    end
+
+    private
+
+    attr_reader :user
+
+    def rank_for(permission)
+      CreativeShare.permissions.fetch(permission.to_s)
+    end
+
+    # The subset of shell ids (effective != self) whose PLACEMENT the viewer can
+    # see AT `min_rank`: shells the viewer owns, plus shells sitting in a subtree
+    # shared with the viewer at >= min_rank. A shell inside a shared/public tree
+    # inherits a propagated CreativeSharesCache entry keyed on its own id
+    # (PermissionCacheBuilder#propagate_share walks [creative] + descendants,
+    # which includes placed shells), so readability of the shell id itself
+    # captures exactly "the viewer may act on this link here at this rank". The
+    # placement is checked at the caller's min_rank rather than always :read
+    # because higher-privilege callers share this batch — e.g.
+    # children_with_permission(user, :admin) drives DestroyService's recursive
+    # delete, which must not reach a placement the viewer only has read on. A
+    # shell in a foreign private tree has no entry and is excluded, preserving
+    # the anti-leak guarantee against FilterPipeline#resolve_ancestors' owner-
+    # agnostic pull.
+    def visible_shell_ids(effective_by_id, min_rank = rank_for(:read))
+      shell_ids = effective_by_id.filter_map { |id, effective| id if effective != id }
+      return Set.new if shell_ids.empty?
+
+      readable_effective_ids(shell_ids, min_rank)
+    end
+
+    # Returns the subset of already-origin-resolved ids the user may access at
+    # `min_rank` or higher, as a Set. A user-specific entry is authoritative:
+    # it grants only when its own rank meets the threshold and otherwise
+    # suppresses the public share entirely (so a user no_access — or any
+    # below-threshold user entry — wins over a more permissive public share).
+    # Owned creatives are always accessible (owner has admin).
+    def readable_effective_ids(ids, min_rank = rank_for(:read))
+      return Set.new if ids.empty?
+
       accessible_ids = Set.new
 
       if user
-        user_accessible = []
-        user_denied = Set.new
+        user_has_entry = Set.new
         CreativeSharesCache.where(creative_id: ids, user_id: user.id)
           .pluck(:creative_id, :permission).each do |cid, perm|
-            perm == "no_access" ? user_denied << cid : user_accessible << cid
+            user_has_entry << cid
+            accessible_ids << cid if CreativeShare.permissions[perm] >= min_rank
           end
-        accessible_ids.merge(user_accessible)
 
         public_ids = CreativeSharesCache.where(creative_id: ids, user_id: nil)
-          .where.not(permission: :no_access).pluck(:creative_id)
-        accessible_ids.merge(public_ids - user_denied.to_a)
+          .where("permission >= ?", min_rank).pluck(:creative_id)
+        accessible_ids.merge(public_ids.reject { |cid| user_has_entry.include?(cid) })
 
         owned_ids = Creative.where(id: ids, user_id: user.id).pluck(:id)
         accessible_ids.merge(owned_ids)
       else
         accessible_ids = CreativeSharesCache.where(creative_id: ids, user_id: nil)
-          .where.not(permission: :no_access).pluck(:creative_id).to_set
+          .where("permission >= ?", min_rank).pluck(:creative_id).to_set
       end
 
-      accessible_ids.to_a
+      accessible_ids
     end
-
-    private
-
-    attr_reader :user
   end
 end
 end

data/app/services/collavre/creatives/tree_builder.rb

@@ -12,85 +12,99 @@ module Creatives
       @max_level = max_level
       @allowed_creative_ids = allowed_creative_ids
       @progress_map = progress_map
-      @permission_cache = {}
+      @permission_rank = {}
     end
 
     def build(collection, level: 1)
       return [] if collection.blank?
 
-      creatives = Array(collection)
-      # Preload permissions for all creatives in this batch to avoid N+1
-      preload_permissions(creatives)
-
-      build_nodes(creatives, level: level)
+      build_nodes(Array(collection), level: level)
     end
 
     private
 
-    attr_reader :user, :view_context, :raw_params, :expanded_state_map, :select_mode, :max_level, :allowed_creative_ids, :progress_map, :permission_cache
+    attr_reader :user, :view_context, :raw_params, :expanded_state_map, :select_mode, :max_level, :allowed_creative_ids, :progress_map
 
-    def preload_permissions(creatives)
-      return unless user
+    def children_index
+      @children_index ||= ChildrenIndex.new(
+        user: user,
+        show_archived: raw_params["show_archived"].present?,
+        allowed_creative_ids: allowed_creative_ids
+      )
+    end
+
+    def comment_badge_index
+      @comment_badge_index ||= CommentBadgeIndex.new(user: user)
+    end
 
-      creative_ids = creatives.map(&:id)
-      return if creative_ids.empty?
+    # Everything a level of nodes needs, resolved in a fixed number of queries
+    # rather than a handful per node. The recursion re-enters here for each level,
+    # so total cost tracks tree *depth*, not node count.
+    def prepare_level(creatives)
+      ActiveRecord::Associations::Preloader.new(
+        records: creatives,
+        associations: [ :origin, { tags: :label } ]
+      ).call
 
-      # Skip if already cached
-      uncached_ids = creative_ids - @permission_cache.keys
-      return if uncached_ids.empty?
+      preload_permissions(creatives)
+      preload_comment_badges(creatives)
 
-      write_rank = CreativeShare.permissions[:write]
+      return if children_suppressed?
 
-      # Batch query for user-specific permissions
-      user_permissions = CreativeSharesCache
-        .where(creative_id: uncached_ids, user_id: user.id)
-        .pluck(:creative_id, :permission)
+      children_index.index(creatives)
+      expanding = creatives.select { |creative| load_children_now?(creative) }
+      children_index.load(expanding) if expanding.any?
+    end
 
-      user_permissions.each do |cid, perm|
-        perm_rank = CreativeSharesCache.permissions[perm]
-        @permission_cache[cid] = perm_rank && perm_rank >= write_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-      end
+    # Batch effective-origin permission ranks via the single PermissionFilter
+    # read path (owner wins, then the user's own cache entry incl. a no_access
+    # deny, then the public entry). Every pending creative gets an explicit
+    # entry — nil when no share resolves — so #allowed? can trust
+    # @permission_rank.key? and never falls back per-item for absent ids.
+    def preload_permissions(creatives)
+      pending = creatives.reject { |creative| @permission_rank.key?(creative.id) }
+      return if pending.empty?
 
-      # For remaining uncached, check public shares
-      still_uncached = uncached_ids - @permission_cache.keys
-      if still_uncached.any?
-        public_permissions = CreativeSharesCache
-          .where(creative_id: still_uncached, user_id: nil)
-          .pluck(:creative_id, :permission)
-
-        public_permissions.each do |cid, perm|
-          next if @permission_cache.key?(cid)
-          perm_rank = CreativeSharesCache.permissions[perm]
-          @permission_cache[cid] = perm_rank && perm_rank >= write_rank && perm_rank != CreativeSharesCache.permissions[:no_access]
-        end
-      end
+      ranks = PermissionFilter.new(user: user).ranks_for(pending.map(&:id))
+      pending.each { |creative| @permission_rank[creative.id] = ranks[creative.id] }
+    end
 
-      # Mark owned creatives as having write permission
-      owned_ids = creatives.select { |c| c.user_id == user.id }.map(&:id)
-      owned_ids.each { |cid| @permission_cache[cid] = true }
+    # Equivalent to `creative.has_permission?(user, permission)`, served from the
+    # level's batched ranks. Falls back for a creative the batch never saw.
+    def allowed?(creative, permission)
+      return creative.has_permission?(user, permission) unless @permission_rank.key?(creative.id)
 
-      # Default to false for any remaining uncached
-      uncached_ids.each { |cid| @permission_cache[cid] ||= false }
+      rank = @permission_rank[creative.id]
+      return false if rank.nil?
+
+      rank >= CreativeShare.permissions[permission.to_s]
     end
 
-    def cached_can_write?(creative)
+    def can_write?(creative)
       return false unless user
-      # GitHub-synced creatives are always read-only
-      return false if creative.github_markdown?
-
-      if @permission_cache.key?(creative.id)
-        @permission_cache[creative.id]
-      else
-        # Fallback to individual check if not cached
-        creative.has_permission?(user, :write)
-      end
+      # Read-only-source creatives are never writable
+      return false if creative.read_only_source?
+
+      allowed?(creative, :write)
+    end
+
+    def can_feedback?(creative)
+      allowed?(creative, :feedback)
+    end
+
+    # Only rows that will actually render a badge are worth batching.
+    def preload_comment_badges(creatives)
+      visible = creatives.reject(&:archived?).select { |creative| can_feedback?(creative) }
+      return if visible.empty?
+
+      comment_badge_index.index(visible.map(&:effective_origin))
     end
 
     def build_nodes(creatives, level:)
       return [] if level > max_level
+      return [] if creatives.empty?
 
-      # Preload permissions for this batch of creatives
-      preload_permissions(creatives) if creatives.any?
+      prepare_level(creatives)
 
       creatives.flat_map do |creative|
         build_nodes_for_creative(creative, level: level)
@@ -102,16 +116,18 @@ module Creatives
         creative.filtered_progress = progress_map[creative.id.to_s]
       end
 
-      filtered_children = filtered_children_for(creative)
       expanded = expanded?(creative.id)
       skip = skip_creative?(creative)
       child_level = level + 1
       child_render_level = skip ? level : child_level
-      load_children_now = filters_applied? || expanded || skip
-      children_nodes = load_children_now ? build_nodes(filtered_children, level: child_render_level) : []
+      load_children_now = load_children_now?(creative)
+      has_children = !children_suppressed? && children_index.has_children?(creative)
+      children_nodes = load_children_now ? build_nodes(children_index.children_for(creative), level: child_render_level) : []
 
       return children_nodes if skip
 
+      can_write = can_write?(creative)
+
       [
         {
           id: creative.id,
@@ -119,19 +135,22 @@ module Creatives
           parent_id: creative.parent_id,
           level: level,
           select_mode: !!select_mode,
-          can_write: cached_can_write?(creative),
-          has_children: filtered_children.any?,
+          can_write: can_write,
+          has_children: has_children,
           expanded: expanded,
-          is_root: creative.parent.nil?,
+          is_root: creative.parent_id.nil?,
           archived: creative.archived?,
-          github_source: creative.github_markdown?,
+          # `github_source` is the wire key the tree renderer JS reads; its value
+          # is now the neutral read-only-source flag (GitHub-synced content is one
+          # such source) so core names no vendor here.
+          github_source: creative.read_only_source?,
           sequence: creative.sequence,
           link_url: view_context.collavre.creative_path(creative),
-          templates: template_payload_for(creative, has_children: filtered_children.any?),
-          inline_editor_payload: inline_editor_payload_for(creative, can_write: cached_can_write?(creative)),
+          templates: template_payload_for(creative, has_children: has_children, can_write: can_write),
+          inline_editor_payload: inline_editor_payload_for(creative, can_write: can_write),
           children_container: children_container_payload(
             creative,
-            filtered_children,
+            has_children: has_children,
             child_level: child_level,
             children_nodes: children_nodes,
             expanded: expanded,
@@ -149,16 +168,17 @@ module Creatives
       false
     end
 
-    def filtered_children_for(creative)
-      return [] if raw_params["comment"] == "true" || (raw_params["search"].present? && raw_params["search_mode"] != "tree")
+    # The chats feed and flat search render rows, not a tree: no node has children
+    # there, so the whole child resolution is skipped.
+    def children_suppressed?
+      return @children_suppressed if defined?(@children_suppressed)
 
-      children = creative.children_with_permission(user)
-      children = children.select { |c| !c.archived? } unless raw_params["show_archived"]
-      if allowed_creative_ids
-        children.select { |c| allowed_creative_ids.include?(c.id.to_s) }
-      else
-        children
-      end
+      @children_suppressed = raw_params["comment"] == "true" ||
+        (raw_params["search"].present? && raw_params["search_mode"] != "tree")
+    end
+
+    def load_children_now?(creative)
+      filters_applied? || expanded?(creative.id) || skip_creative?(creative)
     end
 
     def expanded?(creative_id)
@@ -174,9 +194,17 @@ module Creatives
       end
     end
 
-    def template_payload_for(creative, has_children: nil)
+    def template_payload_for(creative, has_children: nil, can_write: nil)
       description_html = view_context.embed_youtube_iframe(creative.effective_description(raw_params["tags"]&.first))
-      progress_html = view_context.render_creative_progress(creative, select_mode: !!select_mode, has_children: has_children)
+      can_feedback = can_feedback?(creative)
+      progress_html = view_context.render_creative_progress(
+        creative,
+        select_mode: !!select_mode,
+        has_children: has_children,
+        can_write: can_write,
+        can_feedback: can_feedback,
+        unread_count: can_feedback ? comment_badge_index.unread_count_for(creative.effective_origin) : nil
+      )
 
       {
         description_html: description_html,
@@ -189,7 +217,7 @@ module Creatives
 
     def inline_editor_payload_for(creative, can_write:)
       effective = creative.effective_origin(Set.new)
-      origin_writable = effective.id == creative.id ? can_write : creative.has_permission?(user, :write)
+      origin_writable = effective.id == creative.id ? can_write : allowed?(creative, :write)
       {
         description_raw_html: creative.effective_description(nil, true),
         progress: creative.progress,
@@ -200,8 +228,8 @@ module Creatives
       }
     end
 
-    def children_container_payload(creative, filtered_children, child_level:, children_nodes:, expanded:, load_children_now:)
-      return nil unless filtered_children.any?
+    def children_container_payload(creative, has_children:, child_level:, children_nodes:, expanded:, load_children_now:)
+      return nil unless has_children
 
       {
         id: "creative-children-#{creative.id}",

data/app/services/collavre/http_client.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+
+module Collavre
+  # Thin, dependency-free HTTP wrapper over Net::HTTP shared across engines.
+  #
+  # It centralizes timeout configuration, TLS negotiation and transport-error
+  # handling so vendor engines no longer each hand-roll their own Net::HTTP /
+  # HTTParty / Faraday setup. Callers keep full ownership of their own response
+  # parsing and domain error mapping — this wrapper only performs the request and
+  # returns a small Response value object.
+  #
+  # Transport-layer failures (DNS, connection refused/reset, TLS handshake,
+  # open/read timeouts) are wrapped in Collavre::HttpClient::ConnectionError so a
+  # caller can rescue a single, stable error type regardless of the underlying
+  # exception class.
+  class HttpClient
+    class Error < StandardError; end
+    class ConnectionError < Error; end
+
+    DEFAULT_OPEN_TIMEOUT = 10
+    DEFAULT_READ_TIMEOUT = 30
+
+    # Transport-level exceptions that occur before any HTTP response exists.
+    TRANSPORT_ERRORS = [
+      SocketError, SystemCallError, Timeout::Error, IOError,
+      OpenSSL::SSL::SSLError, Net::OpenTimeout, Net::ReadTimeout
+    ].freeze
+
+    REQUEST_CLASSES = {
+      get: Net::HTTP::Get,
+      post: Net::HTTP::Post,
+      patch: Net::HTTP::Patch,
+      put: Net::HTTP::Put,
+      delete: Net::HTTP::Delete
+    }.freeze
+
+    # A minimal, read-only view over a Net::HTTP response.
+    class Response
+      attr_reader :code, :message, :body, :headers
+
+      def initialize(net_response)
+        @net_response = net_response
+        @code = net_response.code.to_i
+        @message = net_response.message
+        @body = net_response.body
+        @headers = net_response.to_hash
+      end
+
+      def success?
+        @net_response.is_a?(Net::HTTPSuccess)
+      end
+
+      # Parse the response body as JSON, or nil when the body is empty.
+      def json
+        return nil if body.nil? || body.empty?
+
+        JSON.parse(body)
+      end
+    end
+
+    def initialize(open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, default_headers: {})
+      @open_timeout = open_timeout
+      @read_timeout = read_timeout
+      @default_headers = default_headers
+    end
+
+    def get(url, headers: {})
+      request(:get, url, headers: headers)
+    end
+
+    def post(url, body: nil, headers: {})
+      request(:post, url, body: body, headers: headers)
+    end
+
+    def patch(url, body: nil, headers: {})
+      request(:patch, url, body: body, headers: headers)
+    end
+
+    def put(url, body: nil, headers: {})
+      request(:put, url, body: body, headers: headers)
+    end
+
+    def delete(url, headers: {})
+      request(:delete, url, headers: headers)
+    end
+
+    private
+
+    def request(method, url, body: nil, headers: {})
+      uri = URI.parse(url)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = @open_timeout
+      http.read_timeout = @read_timeout
+
+      req = build_request(method, uri, body, headers)
+      Response.new(http.request(req))
+    rescue *TRANSPORT_ERRORS => e
+      raise ConnectionError, "#{e.class}: #{e.message}"
+    end
+
+    def build_request(method, uri, body, headers)
+      path = uri.path.presence || "/"
+      path = "#{path}?#{uri.query}" if uri.query.present?
+
+      request_class = REQUEST_CLASSES.fetch(method) do
+        raise ArgumentError, "Unsupported HTTP method: #{method}"
+      end
+      req = request_class.new(path)
+      @default_headers.merge(headers).each { |key, value| req[key] = value }
+      req.body = body unless body.nil?
+      req
+    end
+  end
+end