collavre 0.24.0 → 0.25.0

data/app/services/collavre/creatives/workspace_tree_builder.rb

@@ -0,0 +1,92 @@
+module Collavre
+  module Creatives
+    class WorkspaceTreeBuilder
+      def initialize(user:, view_context:, expanded_ids: [])
+        @user = user
+        @view_context = view_context
+        @expanded_ids = expanded_ids.map(&:to_s).to_set
+        @children_index = ChildrenIndex.new(user: user, show_archived: false)
+        @permission_rank = {}
+      end
+
+      def build(collection)
+        entries = Array(collection).map { |creative| { creative: creative, ancestor_ids: Set.new } }
+        build_entries(entries)
+      end
+
+      private
+
+      attr_reader :children_index, :expanded_ids, :user, :view_context
+
+      def build_entries(entries)
+        return [] if entries.empty?
+
+        creatives = entries.map { |entry| entry.fetch(:creative) }.uniq(&:id)
+        prepare_level(creatives)
+        children_index.load(creatives)
+        children_by_parent = creatives.to_h { |creative| [ creative.id, children_index.children_for(creative) ] }
+        prepare_presence(children_by_parent.values.flatten)
+        child_entries_by_parent = entries.to_h do |entry|
+          creative = entry.fetch(:creative)
+          children = expanded?(creative) ? acyclic_children(entry, children_by_parent.fetch(creative.id)) : []
+          child_entries = children.map do |child|
+            { creative: child, ancestor_ids: entry.fetch(:ancestor_ids).dup.add(creative.id) }
+          end
+          [ entry.object_id, child_entries ]
+        end
+        child_nodes = build_entries(child_entries_by_parent.values.flatten)
+        next_child_node = child_nodes.each
+
+        entries.map do |entry|
+          creative = entry.fetch(:creative)
+          visible_children = acyclic_children(entry, children_by_parent.fetch(creative.id))
+          children = child_entries_by_parent.fetch(entry.object_id).map { next_child_node.next }
+          {
+            id: creative.id,
+            label: Collavre::HtmlText.label(creative.effective_description),
+            snippet: creative.creative_snippet,
+            can_comment: allowed?(creative, :feedback),
+            url: view_context.collavre.creatives_path(id: creative.id),
+            has_children: visible_children.any?,
+            children: children
+          }
+        end
+      end
+
+      def acyclic_children(entry, children)
+        visited_ids = entry.fetch(:ancestor_ids).dup.add(entry.fetch(:creative).id)
+        children.reject { |child| visited_ids.include?(child.id) }
+      end
+
+      def expanded?(creative)
+        expanded_ids.include?(creative.id.to_s)
+      end
+
+      def prepare_level(creatives)
+        ActiveRecord::Associations::Preloader.new(records: creatives, associations: :origin).call
+        preload_permissions(creatives)
+        children_index.index(creatives)
+      end
+
+      def prepare_presence(creatives)
+        return if creatives.empty?
+
+        ActiveRecord::Associations::Preloader.new(records: creatives, associations: :origin).call
+        children_index.index(creatives)
+      end
+
+      def preload_permissions(creatives)
+        pending = creatives.reject { |creative| @permission_rank.key?(creative.id) }
+        return if pending.empty?
+
+        ranks = PermissionFilter.new(user: user).ranks_for(pending.map(&:id))
+        pending.each { |creative| @permission_rank[creative.id] = ranks[creative.id] }
+      end
+
+      def allowed?(creative, permission)
+        rank = @permission_rank[creative.id]
+        rank.present? && rank >= CreativeShare.permissions.fetch(permission.to_s)
+      end
+    end
+  end
+end

data/app/services/collavre/crons/recurring_topic_tasks.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Crons
+    class RecurringTopicTasks
+      include RecurringTaskArguments
+
+      def initialize(topic_id)
+        @topic_id = topic_id.to_i
+      end
+
+      def any?
+        SolidQueue::RecurringTask.where(static: false).any? do |task|
+          parse_arguments(task)["topic_id"].to_i == topic_id
+        end
+      end
+
+      private
+
+      attr_reader :topic_id
+    end
+  end
+end

data/app/services/collavre/home_page_path.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Collavre
+  # Resolves the configured authenticated home page into the two shapes the app
+  # needs.
+  #
+  # "/" is reserved for app launch: the middleware flags it and the controller
+  # turns it into the last visited Creative. Anything that means "take me to the
+  # top level" therefore has to link at the configured home page directly rather
+  # than at "/", or it gets swallowed by the launch redirect.
+  module HomePagePath
+    # Admins can disable the authenticated redirect by setting the path to "/".
+    ROOT_SENTINEL = "/"
+
+    module_function
+
+    # Configured path with the engine mount prefix removed, for comparing
+    # against engine-relative routes:
+    #   "/collavre/creatives" mounted at "/collavre" -> "/creatives"
+    def mount_relative(script_name: nil)
+      path = configured_path.chomp("/")
+      mount = normalized_mount(script_name)
+      return path if mount.blank? || !mounted_under?(path, mount)
+
+      path.delete_prefix(mount)
+    end
+
+    # Configured path with the engine mount prefix applied, for linking:
+    #   "/creatives" mounted at "/collavre" -> "/collavre/creatives"
+    #
+    # Returns nil when the authenticated home is disabled via the "/" sentinel
+    # so callers can fall back to the application root.
+    def absolute(script_name: nil)
+      path = configured_path
+      return nil if path.blank? || path == ROOT_SENTINEL
+
+      mount = normalized_mount(script_name)
+      return path if mount.blank? || mounted_under?(path, mount)
+
+      "#{mount}#{path}"
+    end
+
+    def configured_path
+      SystemSetting.home_page_path_authenticated.to_s.strip
+    end
+
+    def normalized_mount(script_name)
+      script_name.to_s.chomp("/")
+    end
+
+    def mounted_under?(path, mount)
+      path == mount || path.start_with?("#{mount}/")
+    end
+  end
+end

data/app/services/collavre/html_text.rb

@@ -0,0 +1,64 @@
+module Collavre
+  # Single source of truth for rendering stored HTML (creative descriptions,
+  # comment bodies) as plain text for titles, labels, snippets and AI prompts.
+  #
+  # Every caller used to hand-roll `strip_tags` and, at best, pair it with
+  # `CGI.unescapeHTML`. That pair is broken: `strip_tags` runs
+  # Rails::HTML5::FullSanitizer, whose HTML5 serializer re-encodes U+00A0 as the
+  # named reference ` `, while `CGI.unescapeHTML` only decodes the five XML
+  # entities plus numeric references. The literal six-character string ` `
+  # therefore survived into labels (and got re-escaped to ` ` on
+  # render, so users saw ` ` on screen) and counted against truncation
+  # limits. Re-parsing the stripped output as an HTML fragment decodes every
+  # named reference instead.
+  module HtmlText
+    module_function
+
+    # Tags stripped, character references decoded exactly once. Whitespace is
+    # preserved as authored, so U+00A0 stays U+00A0 — use `label` for anything
+    # rendered on a single line.
+    def plain(html)
+      stripped = ActionController::Base.helpers.strip_tags(html.to_s)
+      return "" if stripped.empty?
+
+      Nokogiri::HTML5.fragment(stripped).text
+    end
+
+    # Single-line plain text for titles, labels and breadcrumbs. `squish`
+    # collapses every run of Unicode whitespace — U+00A0 included — into one
+    # ASCII space.
+    def label(html)
+      plain(html).squish
+    end
+
+    # `label` capped at `length`, matching String#truncate semantics.
+    def truncated_label(html, length, omission: "...")
+      label(html).truncate(length, omission: omission)
+    end
+
+    # Characters that would start a markdown construct where a label gets
+    # interpolated. `]` and `)` let a title close the generated link early and
+    # supply its own destination; `<` and `>` make marked emit inline HTML that
+    # the client sanitizer then deletes; the rest turn a label into emphasis, a
+    # code span or strikethrough.
+    MARKDOWN_SPECIAL = /[\\`*_\[\]()<>~]/
+    private_constant :MARKDOWN_SPECIAL
+
+    # Backslash-escapes markdown constructs so `text` renders as the literal
+    # characters the author typed. One pass over the string, so the backslashes
+    # this adds are never themselves escaped.
+    def escape_markdown(text)
+      text.to_s.gsub(MARKDOWN_SPECIAL) { |char| "\\#{char}" }
+    end
+
+    # `label` (optionally capped at `length`) escaped for interpolation into
+    # generated markdown, as in `"[#{markdown_label(html, 30)}](#{path})"`.
+    #
+    # Truncation happens before escaping so `length` counts the characters a
+    # reader sees, and a cut can never land inside a backslash escape.
+    def markdown_label(html, length = nil, omission: "...")
+      text = length ? truncated_label(html, length, omission: omission) : label(html)
+      escape_markdown(text)
+    end
+  end
+end

data/app/services/collavre/http_client.rb

@@ -62,10 +62,12 @@ module Collavre
       end
     end
 
-    def initialize(open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, default_headers: {})
+    def initialize(open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, default_headers: {},
+                   endpoint_policy: nil)
       @open_timeout = open_timeout
       @read_timeout = read_timeout
       @default_headers = default_headers
+      @endpoint_policy = endpoint_policy
     end
 
     def get(url, headers: {})
@@ -92,7 +94,7 @@ module Collavre
 
     def request(method, url, body: nil, headers: {})
       uri = URI.parse(url)
-      http = Net::HTTP.new(uri.host, uri.port)
+      http = build_connection(uri)
       http.use_ssl = uri.scheme == "https"
       http.open_timeout = @open_timeout
       http.read_timeout = @read_timeout
@@ -103,6 +105,13 @@ module Collavre
       raise ConnectionError, "#{e.class}: #{e.message}"
     end
 
+    def build_connection(uri)
+      return Net::HTTP.new(uri.host, uri.port) unless @endpoint_policy
+
+      pinned_ip = @endpoint_policy.resolve!(uri).first
+      Net::HTTP.new(uri.host, uri.port, nil).tap { |http| http.ipaddr = pinned_ip }
+    end
+
     def build_request(method, uri, body, headers)
       path = uri.path.presence || "/"
       path = "#{path}?#{uri.query}" if uri.query.present?

data/app/services/collavre/inbox_reply_service.rb

@@ -41,7 +41,7 @@ module Collavre
       latest_alarm = @creative.comments
         .where(topic: @comment.topic, user_id: nil)
         .where("comments.id < ?", @comment.id)
-        .order(created_at: :desc)
+        .order(id: :desc)
         .first
 
       return nil unless latest_alarm

data/app/services/collavre/markdown_converter.rb

@@ -59,10 +59,22 @@ module Collavre
         # styles override our theme-aware code_highlight.css palette and are blind to light/dark mode.
         # Disabling it emits a plain `<pre lang="ruby"><code>…</code></pre>`; the client re-tokenizes
         # with highlight.js so the rendered creative matches the editor (and respects the theme).
+        #
+        # header_ids: nil is pinned rather than left to the default. commonmarker 2.9.0 turned this
+        # extension on out of the box, which appends an anchor to every heading:
+        # `<h1 id="heading">Heading<a href="#heading" class="anchor"></a></h1>`. That output is stored
+        # (Creative#description is a rendered, sanitized field), and the sanitizer's allow-list drops
+        # `id` while keeping the `<a>` — so the anchor would link to a target that no longer exists,
+        # on every heading of every creative. `html_to_markdown` would also read it back as an empty
+        # link and write `[](#heading)` into the markdown. Pinning it keeps the rendered output a
+        # function of our options rather than of the gem's defaults; the key is accepted by 2.8 too.
         html = Commonmarker.to_html(input, options: {
           parse: { smart: true },
           render: { unsafe: true, hardbreaks: true },
-          extension: { table: true, strikethrough: true, autolink: true, tasklist: true, tagfilter: true }
+          extension: {
+            table: true, strikethrough: true, autolink: true, tasklist: true, tagfilter: true,
+            header_ids: nil
+          }
         }, plugins: { syntax_highlighter: nil })
 
         html.strip!