collavre 0.24.0 → 0.25.0

data/app/controllers/collavre/comments_controller.rb

@@ -1,5 +1,6 @@
 module Collavre
   class CommentsController < ApplicationController
+    LEGACY_TOPIC_WATERMARK_KEY = "_legacy"
     include Collavre::Comments::CommentScoping
     include Collavre::Comments::ApprovalActions
     include Collavre::Comments::Conversion
@@ -25,134 +26,7 @@ module Collavre
     end
 
     def index
-      limit = 20
-
-      visible_scope = @creative.comments.visible_to(Current.user)
-      scope = visible_scope.with_attached_images.includes(:task, :topic, :comment_reactions, :comment_versions, :snapshot_as_result)
-
-      if params[:search].present?
-        words = params[:search].to_s.strip.downcase.split(/\s+/)
-                  .first(Creatives::Filters::SearchFilter::MAX_SEARCH_WORDS)
-        words.each do |word|
-          sanitized = "%#{ActiveRecord::Base.sanitize_sql_like(word)}%"
-          scope = scope.where("LOWER(comments.content) LIKE ?", sanitized)
-        end
-      end
-
-      # Filter by topic
-      # Logic:
-      # 1. Prefer params[:topic_id] if explicit.
-      # 2. If deep linking (around_comment_id), infer from target comment if valid.
-      # 3. Default to nil (Main).
-
-      effective_topic_id = params[:topic_id].presence
-
-      if params[:around_comment_id].present?
-        target_id = params[:around_comment_id].to_i
-        # Ensure target is visible and belongs to this creative
-        target_comment = visible_scope.find_by(id: target_id)
-
-        if target_comment
-          effective_topic_id = target_comment.topic_id
-          # Inform frontend about the topic switch
-          response.headers["X-Topic-Id"] = effective_topic_id.to_s
-        end
-      end
-
-      # Apply the Topic Filter
-      if effective_topic_id.present?
-        scope = scope.where(topic_id: effective_topic_id)
-      else
-        # Main view: exclude comments from archived topics
-        archived_topic_ids = @creative.topics.archived.pluck(:id)
-        scope = scope.where.not(topic_id: archived_topic_ids) if archived_topic_ids.any?
-      end
-
-      # Default order: Newest first (created_at DESC)
-      # This matches the column-reverse layout where the first item in the list is the visual bottom (Newest).
-      scope = scope.order(created_at: :desc)
-
-
-      @comments = if params[:around_comment_id].present?
-        # Deep linking: Load context around a specific comment
-        target_id = params[:around_comment_id].to_i
-
-        # Newer messages have HIGHER IDs.
-        # Older messages have LOWER IDs.
-
-        # Newer bundle (including target): ID >= target_id
-        newer_bundle = scope.where("comments.id >= ?", target_id).reorder(created_at: :asc).limit(limit / 2 + 1)
-
-        # Older bundle: ID < target_id
-        older_bundle = scope.where("comments.id < ?", target_id).limit(limit / 2)
-
-        # Combine: [Newer (ASC) ... Target ... Older (DESC)]
-        # We need final output to be ASC due to restored view logic: [Oldest ... Target ... Newest]
-        (older_bundle.to_a.reverse + newer_bundle.to_a).uniq
-      elsif params[:after_id].present? && params[:before_id].present?
-          # Invalid state, prioritize before (loading older history)
-          scope.where("comments.id < ?", params[:before_id].to_i).limit(limit).to_a.reverse
-      elsif params[:before_id].present?
-        # Load OLDER messages (lower IDs)
-        # Visually scrolling UP
-        scope.where("comments.id < ?", params[:before_id].to_i).limit(limit).to_a.reverse
-      elsif params[:after_id].present?
-        # Load NEWER messages (higher IDs)
-        # Visually scrolling DOWN
-        # We want the ones immediately *after* the current newest.
-        # Since default sort is DESC (Newest first), "after" means id > after_id.
-        # But standard DESC query would give us the VERY Newest.
-        # We want the ones just above `after_id`.
-
-        # Use reorder(ASC) to get the ones immediately larger than after_id, then reverse back to DESC.
-        scope.where("comments.id > ?", params[:after_id].to_i).reorder(created_at: :asc).limit(limit)
-      else
-        # Initial Load (Latest messages)
-        scope.limit(limit).to_a.reverse
-      end
-
-      present_user_ids = CommentPresenceStore.list(@creative.id)
-
-      read_receipts = {}
-      if @comments.any?
-        # Fetch all read pointers for this creative that point to comments in the current list
-        # We only care about pointers that match the IDs of the comments we are displaying?
-        # Or rather, we want to show the 'line' on the comment that matches the pointer.
-
-        # Optimization: Fetch all pointers for participants of this creative.
-        # Scoped to the creative.
-        pointers = CommentReadPointer.where(creative: @creative)
-                                     .where.not(last_read_comment_id: nil)
-                                     .includes(user: { avatar_attachment: :blob })
-
-        # Fetch all visible IDs for correct read-receipt placement transparency
-        # Only map read receipts to PUBLIC comments.
-        # Users who read private comments will appear on the nearest preceding public comment.
-        public_ids = @creative.comments.public_only.order(id: :asc).pluck(:id)
-
-        pointers.each do |pointer|
-          effective_id = pointer.effective_comment_id(public_ids)
-          if effective_id
-            read_receipts[effective_id] ||= []
-            read_receipts[effective_id] << pointer.user
-          end
-        end
-      end
-
-      if params[:after_id].present? || params[:before_id].present?
-        render partial: "collavre/comments/comment",
-               collection: @comments,
-               as: :comment,
-               locals: { read_receipts: read_receipts, present_user_ids: present_user_ids, current_topic_id: effective_topic_id }
-      else
-        render partial: "collavre/comments/list", locals: {
-          comments: @comments,
-          creative: @creative,
-          read_receipts: read_receipts,
-          present_user_ids: present_user_ids,
-          current_topic_id: effective_topic_id
-        }
-      end
+      Collavre::Comments::ListResponse.new(controller: self, creative: @creative).render
     end
 
     def create
@@ -173,7 +47,9 @@ module Collavre
 
       @comment.user = Current.user
       @comment.images.attach(image_attachments) if image_attachments.present?
-      response = ::Comments::CommandProcessor.new(comment: @comment, user: Current.user).call
+      response = unless inbox_system_comment?
+        ::Comments::CommandProcessor.new(comment: @comment, user: Current.user).call
+      end
       if response.present?
         @comment.content = "#{@comment.content}\n\n#{response}"
         @comment.skip_dispatch = true
@@ -199,7 +75,7 @@ module Collavre
         safe_params = comment_params.except(:quoted_comment_id, :quoted_text)
         validate_topic_id!(safe_params[:topic_id]) or return
 
-        if @comment.update(safe_params)
+        if update_comment(safe_params)
           @comment = Comment.with_attached_images.includes(:comment_reactions, :comment_versions, :selected_version).find(@comment.id)
           render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
         else
@@ -225,7 +101,7 @@ module Collavre
         if (is_admin || is_creative_owner) && !is_owner && @comment.user.present? && !@comment.user.ai_user?
           inbox_creative = Creative.inbox_for(@comment.user)
           creative_path = Collavre::Engine.routes.url_helpers.creative_path(@creative, open_comments: true)
-          creative_link = "[#{@creative.creative_snippet}](#{creative_path})"
+          creative_link = "[#{@creative.creative_snippet_markdown}](#{creative_path})"
           msg = I18n.t(
             "inbox.comment_deleted_by_admin",
             admin_name: Current.user.name,
@@ -352,10 +228,48 @@ module Collavre
       params[:topic_id].presence || params.dig(:comment, :topic_id).presence
     end
 
+    def inbox_system_comment?
+      @creative.inbox? && @comment.topic&.name == Creative::SYSTEM_TOPIC_NAME
+    end
+
     def validate_topic_id!(topic_id)
       return true if topic_id.blank? || @creative.topics.where(id: topic_id).exists?
       render json: { error: I18n.t("collavre.comments.invalid_topic") }, status: :unprocessable_entity
       false
     end
+
+    def update_comment(attributes)
+      return update_comment_under_topic_lock(attributes) unless attributes.key?(:topic_id)
+
+      attributes = attributes.dup
+      topic_id = attributes.delete(:topic_id)
+      Comment.transaction do
+        CommentMoveService.new(creative: @creative, user: Current.user).call(
+          comment_ids: [ @comment.id ], target_topic_id: topic_id
+        )
+        updated = @comment.reload.update(attributes)
+        raise ActiveRecord::Rollback unless updated
+
+        updated
+      end
+    rescue CommentMoveService::MoveError => e
+      @comment.errors.add(:topic, e.message)
+      false
+    end
+
+    def update_comment_under_topic_lock(attributes)
+      source_topic_id = @comment.topic_id
+      matching_context = false
+      updated = false
+      Comments::TopicMutation.call(source_topic_id, @creative.id) do
+        @comment.lock!
+        matching_context = @comment.creative_id == @creative.id && @comment.topic_id == source_topic_id
+        updated = @comment.update(attributes) if matching_context
+      end
+      return updated if matching_context
+
+      @comment.errors.add(:topic, I18n.t("collavre.comments.move_not_allowed"))
+      false
+    end
   end
 end

data/app/controllers/collavre/concerns/shareable.rb

@@ -5,18 +5,24 @@ module Collavre
 
       def request_permission
         creative = @creative.effective_origin
-        if creative.user == Current.user || creative.has_permission?(Current.user, :read)
+        if creative.user == Current.user || creative.has_permission?(Current.user, :write)
           return head :unprocessable_entity
         end
 
-        short_title = helpers.strip_tags(creative.effective_origin.description).truncate(10)
+        # A requester who already has some access (read or feedback) is
+        # specifically asking for a write upgrade — distinguish that from a
+        # from-zero access request so the owner knows which one it is.
+        already_has_read_access = creative.has_permission?(Current.user, :read)
+
+        short_title = Collavre::HtmlText.markdown_label(creative.effective_origin.description, 10)
         creative_path = Collavre::Engine.routes.url_helpers.creative_path(creative, open_comments: true)
         creative_link = "[#{short_title}](#{creative_path})"
 
         inbox_creative = Creative.inbox_for(creative.user)
         system_topic = inbox_creative.system_topic(fallback_user: creative.user)
+        i18n_key = already_has_read_access ? "inbox.write_permission_requested" : "inbox.permission_requested"
         msg = I18n.t(
-          "inbox.permission_requested",
+          i18n_key,
           user: Current.user.display_name,
           short_title: creative_link,
           locale: creative.user.locale || "en"

data/app/controllers/collavre/creatives_controller.rb

@@ -1,5 +1,7 @@
 module Collavre
   class CreativesController < ApplicationController
+    WORKSPACE_TREE_EXPANSION_LIMIT = 100
+
     include Collavre::Concerns::SlideViewable
     include Collavre::Concerns::Exportable
     include Collavre::Concerns::TreeManageable
@@ -17,20 +19,40 @@ module Collavre
     # tracked separately and intentionally deferred.
     allow_unauthenticated_access only: %i[ index children export_markdown show slide_view ]
     before_action :enforce_creatives_login_policy, only: %i[ index children export_markdown show slide_view ]
-    before_action :set_creative, only: %i[ show edit update destroy parent_suggestions slide_view request_permission unconvert contexts update_contexts update_metadata archive unarchive trigger_action ]
+    before_action :set_creative, only: %i[ show edit update destroy slide_view request_permission unconvert contexts update_contexts update_metadata archive unarchive trigger_action remember_last_visited ]
     before_action :require_creative_write!, only: %i[archive unarchive]
 
     def index
       respond_to do |format|
         format.html do
+          visit_received_at = Time.current
           # HTML only needs parent_creative for nav/title - skip expensive filtered queries
           # Must check permission to avoid leaking metadata (og:title, etc.) to unauthorized users
           if params[:id].present?
             creative = Creative.find_by(id: params[:id])
             @parent_creative = creative if creative&.has_permission?(Current.user, :read)
+            if Current.user
+              @last_visited_creative_client_id = last_visited_creative_client_id
+              @last_visited_creative_visit_sequence = last_visited_creative_visit_sequence
+              unless request.head? || turbo_prefetch_request?
+                @last_visited_creative_visit_sequence = remember_last_visited_creative(
+                  @parent_creative,
+                  client_id: @last_visited_creative_client_id,
+                  sequence: @last_visited_creative_visit_sequence,
+                  received_at: visit_received_at
+                )
+              end
+              @last_visited_creative_token = last_visited_creative_token
+            end
           end
           @creatives = []  # CSR will fetch via JSON
           @shared_list = @parent_creative ? @parent_creative.all_shared_users : []
+          if Current.user&.creative_workspace_enabled?
+            @workspace_path_ids = Creatives::WorkspacePathResolver.new(
+              creative: @parent_creative,
+              user: Current.user
+            ).call
+          end
         end
         format.json do
           # Full query only for JSON requests
@@ -55,6 +77,18 @@ module Collavre
           @allowed_creative_ids = index_result.allowed_creative_ids
           @progress_map = index_result.progress_map
 
+          if params[:workspace_tree] == "1"
+            expires_now
+            render json: {
+              creatives: Collavre::Creatives::WorkspaceTreeBuilder.new(
+                user: Current.user,
+                view_context: view_context,
+                expanded_ids: workspace_tree_expanded_ids
+              ).build(index_result.creatives)
+            }
+            return
+          end
+
           # Set filtered_progress on parent creative if progress_map is available
           if @parent_creative && @progress_map && @progress_map.key?(@parent_creative.id.to_s)
             @parent_creative.filtered_progress = @progress_map[@parent_creative.id.to_s]
@@ -232,15 +266,6 @@ module Collavre
       end
     end
 
-    def parent_suggestions
-      unless @creative.has_permission?(Current.user, :read)
-        render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
-      end
-
-      suggestions = ::GeminiParentRecommender.new.recommend(@creative)
-      render json: suggestions
-    end
-
     def edit
       unless @creative.has_permission?(Current.user, :write)
         redirect_to @creative, alert: t("collavre.creatives.errors.no_permission") and return
@@ -526,6 +551,27 @@ module Collavre
       head :ok
     end
 
+    # Turbo may restore a cached workspace frame from browser history without
+    # issuing the HTML request that normally records this value. The client
+    # calls this endpoint after confirming the restored frame matches the URL.
+    def remember_last_visited
+      visit_received_at = Time.current
+      return head :forbidden unless @creative.has_permission?(Current.user, :read)
+
+      visit = restored_visit
+      return head :unprocessable_entity unless visit
+
+      remember_last_visited_creative(@creative, **visit, received_at: visit_received_at)
+      head :no_content
+    end
+
+    # Reserve an ordering value before Turbo starts a Creative navigation.
+    # Reserving does not change the remembered Creative, so a cancelled request
+    # leaves only a harmless gap in the sequence.
+    def next_last_visited_sequence
+      render json: { sequence: issue_last_visited_creative_sequence }
+    end
+
     def destroy
       parent = @creative.parent
       unless @creative.has_permission?(Current.user, :admin)
@@ -539,6 +585,84 @@ module Collavre
     end
 
     private
+      def remember_last_visited_creative(creative, client_id:, sequence:, received_at:)
+        return unless Current.user && creative
+
+        Current.user.with_lock do
+          same_client = Current.user.last_visited_creative_client_id == client_id
+          sequence ||= issue_last_visited_creative_sequence_locked
+          return sequence if same_client && Current.user.last_visited_creative_visit_sequence.to_i >= sequence
+          return sequence if !same_client && Current.user.last_visited_creative_at &&
+            Current.user.last_visited_creative_at >= received_at
+
+          Current.user.update_columns(
+            last_visited_creative_id: creative.id,
+            # A request can wait on this lock after it reaches Rails. Retain
+            # its arrival time so an older request from another browser session
+            # cannot overwrite a Creative recorded by a later-arriving visit.
+            last_visited_creative_at: received_at,
+            last_visited_creative_client_id: client_id,
+            last_visited_creative_visit_sequence: sequence
+          )
+          sequence
+        end
+      end
+
+      def issue_last_visited_creative_sequence
+        Current.user.with_lock { issue_last_visited_creative_sequence_locked }
+      end
+
+      def issue_last_visited_creative_sequence_locked
+        sequence = [
+          Current.user.last_visited_creative_issued_sequence.to_i,
+          Current.user.last_visited_creative_visit_sequence.to_i
+        ].max + 1
+        Current.user.update_column(:last_visited_creative_issued_sequence, sequence)
+        sequence
+      end
+
+      def last_visited_creative_client_id
+        session[:last_visited_creative_client_id] ||= SecureRandom.uuid
+      end
+
+      def last_visited_creative_visit_sequence
+        supplied_sequence = request.headers["X-Collavre-Last-Visited-Creative-Sequence"].to_i
+        supplied_sequence if supplied_sequence.positive? && visit_token_client_id == last_visited_creative_client_id
+      end
+
+      def last_visited_creative_token
+        return unless @parent_creative && @last_visited_creative_client_id && @last_visited_creative_visit_sequence
+
+        Rails.application.message_verifier(:last_visited_creative).generate({
+          "creative_id" => @parent_creative.id,
+          "client_id" => @last_visited_creative_client_id,
+          "sequence" => @last_visited_creative_visit_sequence
+        })
+      end
+
+      def restored_visit
+        visit = Rails.application.message_verifier(:last_visited_creative).verified(params[:visit_token])
+        sequence = request.headers["X-Collavre-Last-Visited-Creative-Sequence"].to_i
+        return unless visit.is_a?(Hash) && visit["creative_id"] == @creative.id &&
+          visit["client_id"] == last_visited_creative_client_id
+
+        { client_id: visit.fetch("client_id"), sequence: sequence.positive? ? sequence : nil }
+      rescue ActiveSupport::MessageVerifier::InvalidSignature, KeyError, ArgumentError
+        nil
+      end
+
+      def visit_token_client_id
+        token = request.headers["X-Collavre-Last-Visited-Creative-Token"]
+        visit = Rails.application.message_verifier(:last_visited_creative).verified(token)
+        visit["client_id"] if visit.is_a?(Hash)
+      rescue ActiveSupport::MessageVerifier::InvalidSignature
+        nil
+      end
+
+      def turbo_prefetch_request?
+        request.headers["X-Sec-Purpose"] == "prefetch"
+      end
+
       def build_tree(collection, params:, expanded_state_map:, level:, select_mode: false, allowed_creative_ids: nil, progress_map: nil)
         ::Creatives::TreeBuilder.new(
           user: Current.user,
@@ -577,6 +701,15 @@ module Collavre
         ).to_h
       end
 
+      def workspace_tree_expanded_ids
+        permitted = params.permit(expand: [])[:expand]
+        Array(permitted).filter_map { |id| Integer(id, exception: false) }
+          .uniq
+          .first(WORKSPACE_TREE_EXPANSION_LIMIT)
+      end
+
+      helper_method :any_filter_active?
+
       def any_filter_active?
         params[:tags].present? ||
           params[:min_progress].present? ||
@@ -677,7 +810,7 @@ module Collavre
           skip_dispatch: true
         )
 
-        scheduled = SystemEvents::Dispatcher.dispatch("comment_created", comment.dispatch_payload)
+        scheduled = SystemEvents::Dispatcher.dispatch("comment_created", comment.dispatch_payload, source: "trigger_restart")
         Rails.logger.info("[TriggerAction] restart: posted trigger comment #{comment.id}, dispatched to #{scheduled&.size || 0} agents")
       end
 

data/app/controllers/collavre/desktop_gateway_registrations_controller.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Collavre
+  # Stateless, loopback-only native handoff for the desktop shell. It has no
+  # browser session or CSRF cookie; authorization is the signed, short-lived
+  # grant issued to the authenticated desktop webview.
+  class DesktopGatewayRegistrationsController < ActionController::API
+    # Native code calls this before it creates Keychain credentials or starts
+    # the local proxy. The signed token is the administrator's short-lived
+    # setup consent and remains the sole authorization for the sessionless
+    # loopback handoff.
+    def validate_registration_grant
+      return unless require_desktop_mode!
+      return unless require_loopback!
+
+      registration_owner!
+      head :no_content
+    rescue ActionController::ParameterMissing, ActiveSupport::MessageVerifier::InvalidSignature => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    def create
+      return unless require_desktop_mode!
+      return unless require_loopback!
+
+      registration_owner = registration_owner!
+      # A desktop has one local proxy, not one proxy per administrator. The
+      # persisted desktop_managed marker identifies it independently of its
+      # user-editable display name and owner during recovery.
+      gateway = Collavre::AgentGateway.find_or_initialize_by(desktop_managed: true)
+      gateway.owner ||= registration_owner
+      gateway.name ||= available_desktop_gateway_name(gateway.owner)
+      owner = gateway.owner
+      gateway_attributes = {
+        base_url: "http://127.0.0.1:#{proxy_port}",
+        admin_key: params.require(:admin_key),
+        completion_key: params.require(:completion_key),
+        identity_secret: params.require(:identity_secret),
+        tenant_id: "collavre-desktop",
+        workspace_mode: :shared,
+        active: true
+      }
+
+      Collavre::AgentGateway.transaction do
+        gateway.update_from_desktop_registration!(gateway_attributes)
+        detected_adapters.each { |adapter| provision_preset!(owner, gateway, adapter) }
+      end
+      render json: { gateway_id: gateway.id, adapters: detected_adapters }, status: :created
+    rescue ActiveRecord::RecordInvalid => e
+      render json: { error: e.record.errors.full_messages.to_sentence }, status: :unprocessable_entity
+    rescue ActiveRecord::RecordNotUnique
+      # Concurrent first-run handoffs can both observe no marked gateway. Once
+      # one creates it, reload that durable identity and apply this handoff.
+      raise if @retried_after_gateway_insert
+
+      @retried_after_gateway_insert = true
+      retry
+    rescue ActionController::ParameterMissing, ActiveSupport::MessageVerifier::InvalidSignature => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    # Native startup checks this before trusting its persisted `registered`
+    # flag. It proves that the Rails gateway still exists at this proxy port
+    # and still holds the Keychain credentials without exposing them to the
+    # webview or requiring a browser session.
+    def registered
+      return unless require_desktop_mode!
+      return unless require_loopback!
+
+      gateway = Collavre::AgentGateway.find_by(
+        desktop_managed: true,
+        base_url: "http://127.0.0.1:#{proxy_port}"
+      )
+      return head :not_found unless gateway && gateway_credentials_match?(gateway)
+
+      head :no_content
+    rescue ActionController::ParameterMissing => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    private
+
+    def proxy_port
+      Integer(params.require(:proxy_port).to_s, 10).tap do |port|
+        raise ActionController::ParameterMissing, :proxy_port unless (1..65_535).cover?(port)
+      end
+    rescue ArgumentError
+      raise ActionController::ParameterMissing, :proxy_port
+    end
+
+    def detected_adapters
+      Array(params[:adapters]).map(&:to_s).intersection(DesktopSetupController::PRESETS.keys)
+    end
+
+    def gateway_credentials_match?(gateway)
+      %i[admin_key completion_key identity_secret].all? do |attribute|
+        ActiveSupport::SecurityUtils.secure_compare(gateway.public_send(attribute), params.require(attribute))
+      end
+    end
+
+    def provision_preset!(owner, gateway, adapter)
+      name, email, model = DesktopSetupController::PRESETS.fetch(adapter)
+      agent = owner.created_ai_users.find_or_initialize_by(desktop_preset_adapter: adapter)
+      if agent.new_record?
+        agent.assign_attributes(
+          name: name,
+          password: SecureRandom.hex(36),
+          email: available_desktop_preset_email(email, gateway),
+          email_verified_at: Time.current,
+          llm_vendor: "cli_proxy",
+          llm_model: model,
+          agent_gateway: gateway,
+          searchable: false,
+          tools: []
+        )
+        agent.save!
+      end
+      Collavre::Contact.ensure(user: owner, contact_user: agent)
+    end
+
+    def available_desktop_preset_email(email, gateway)
+      return email unless Collavre::User.exists?(email: email)
+
+      local_part, domain = email.split("@", 2)
+      base = "#{local_part}+desktop-#{gateway.id}"
+      candidate = "#{base}@#{domain}"
+      return candidate unless Collavre::User.exists?(email: candidate)
+
+      suffix = (2..).find do |number|
+        !Collavre::User.exists?(email: "#{base}-#{number}@#{domain}")
+      end
+      "#{base}-#{suffix}@#{domain}"
+    end
+
+    def available_desktop_gateway_name(owner)
+      base_name = DesktopSetupController::DESKTOP_GATEWAY_NAME
+      return base_name unless owner.owned_agent_gateways.exists?(name: base_name)
+
+      suffix = (2..).find { |number| !owner.owned_agent_gateways.exists?(name: "#{base_name} (#{number})") }
+      "#{base_name} (#{suffix})"
+    end
+
+    def registration_owner!
+      payload = Rails.application.message_verifier("desktop-gateway-registration").verify(params.require(:registration_token))
+      raise ActiveSupport::MessageVerifier::InvalidSignature if payload.fetch("expires_at").to_i < Time.current.to_i
+
+      Collavre::User.find(payload.fetch("user_id")).tap do |user|
+        raise ActiveSupport::MessageVerifier::InvalidSignature unless user.system_admin?
+      end
+    end
+
+    def require_loopback!
+      addr = IPAddr.new(request.remote_addr.to_s)
+      addr = addr.native if addr.respond_to?(:ipv4_mapped?) && addr.ipv4_mapped?
+      return true if addr.loopback?
+
+      head :forbidden
+      false
+    rescue IPAddr::InvalidAddressError
+      head :forbidden
+      false
+    end
+
+    def require_desktop_mode!
+      return true if Rails.application.config.x.desktop_proxy_setup == true
+
+      head :not_found
+      false
+    end
+  end
+end