collavre 0.5.0 → 0.7.0

data/app/controllers/collavre/creatives_controller.rb

@@ -1,10 +1,15 @@
 module Collavre
   class CreativesController < ApplicationController
+    include Collavre::Concerns::SlideViewable
+    include Collavre::Concerns::Exportable
+    include Collavre::Concerns::TreeManageable
+    include Collavre::Concerns::Shareable
+
     # TODO: for not for security reasons for this Collavre app, we don't expose to public, later it should be controlled by roles for each Creatives
     # Removed unauthenticated access to index and show actions
     allow_unauthenticated_access only: %i[ index children export_markdown show slide_view ]
     before_action :enforce_creatives_login_policy, only: %i[ index children export_markdown show slide_view ]
-    before_action :set_creative, only: %i[ show edit update destroy request_permission parent_suggestions slide_view unconvert ]
+    before_action :set_creative, only: %i[ show edit update destroy parent_suggestions slide_view request_permission unconvert contexts update_contexts update_metadata ]
 
     def index
       respond_to do |format|
@@ -138,29 +143,14 @@ module Collavre
               progress_html: view_context.render_creative_progress(@creative),
               depth: depth,
               prompt: @creative.prompt_for(Current.user),
-              has_children: children_count > 0
+              has_children: children_count > 0,
+              data: @creative.effective_origin(Set.new).data
             }
           end
         end
       end
     end
 
-    def slide_view
-      unless @creative.has_permission?(Current.user, :read)
-        if Current.user
-          redirect_to creatives_path, alert: t("collavre.creatives.errors.no_permission")
-        else
-          request_authentication
-        end
-        return
-      end
-
-      @slide_ids = []
-      @root_depth = @creative.ancestors.count
-      build_slide_ids(@creative)
-      render layout: "collavre/slide"
-    end
-
     def new
       @creative = Creative.new
       if params[:parent_id].present?
@@ -244,173 +234,92 @@ module Collavre
       end
     end
 
-    def destroy
-      parent = @creative.parent
-      unless @creative.has_permission?(Current.user, :admin)
-        redirect_to @creative, alert: t("collavre.creatives.errors.no_permission") and return
-      end
-      Creatives::DestroyService.new(
-        creative: @creative,
-        user: Current.user,
-        delete_with_children: params[:delete_with_children].present?
-      ).call
-    end
-
-    def request_permission
-      creative = @creative.effective_origin
-      if creative.user == Current.user || creative.has_permission?(Current.user, :read)
-        return head :unprocessable_entity
-      end
+    def contexts
+      creative = @creative.effective_origin(Set.new)
+      own_ids = creative.context_ids - [ creative.id ]
+      inherited_ids = (creative.effective_context_ids - own_ids - [ creative.id ]).uniq
+      own_creatives = Creative.where(id: own_ids).index_by(&:id)
+      inherited_creatives = Creative.where(id: inherited_ids).index_by(&:id)
 
-      short_title = helpers.strip_tags(creative.effective_origin.description).truncate(10)
-
-      InboxItem.create!(
-        owner: creative.user,
-        message_key: "inbox.permission_requested",
-        message_params: { user: Current.user.display_name, short_title: short_title },
-        link: creative_url(
-          creative,
-          Rails.application.config.action_mailer.default_url_options.merge(share_request: Current.user.email)
-        )
-      )
-
-      head :ok
-    end
+      disabled_ids = Array(creative.data&.dig("disabled_context_ids"))
 
+      own = own_ids.filter_map do |cid|
+        c = own_creatives[cid]
+        next unless c
 
+        { id: c.id, description: c.creative_snippet, inherited: false, disabled: disabled_ids.include?(cid) }
+      end
 
-    def reorder
-      dragged_ids = Array(params[:dragged_ids]).map(&:presence).compact
-      target_id = params[:target_id]
-      direction = params[:direction]
+      inherited = inherited_ids.filter_map do |cid|
+        c = inherited_creatives[cid]
+        next unless c
 
-      if dragged_ids.any?
-        reorderer.reorder_multiple(
-          dragged_ids: dragged_ids,
-          target_id: target_id,
-          direction: direction
-        )
-      else
-        reorderer.reorder(
-          dragged_id: params[:dragged_id],
-          target_id: target_id,
-          direction: direction
-        )
+        { id: c.id, description: c.creative_snippet, inherited: true, disabled: disabled_ids.include?(cid) }
       end
-      head :ok
-    rescue ::Creatives::Reorderer::Error
-      head :unprocessable_entity
-    end
-
-    def link_drop
-      result = reorderer.link_drop(
-        dragged_id: params[:dragged_id],
-        target_id: params[:target_id],
-        direction: params[:direction]
-      )
-
-      new_creative = result.new_creative
-      level = new_creative.ancestors.count + 1
-      nodes = build_tree(
-        [ new_creative ],
-        params: params,
-        expanded_state_map: {},
-        level: level
-      )
 
       render json: {
-        nodes: nodes,
-        creative_id: new_creative.id,
-        parent_id: result.parent&.id,
-        direction: result.direction
+        contexts: inherited + own,
+        can_manage: creative.has_permission?(Current.user, :admin),
+        disabled_self_context: creative.data&.dig("disabled_self_context") == true
       }
-    rescue ::Creatives::Reorderer::Error
-      head :unprocessable_entity
-    end
-
-    def append_as_parent
-      @parent_creative = Creative.find_by(id: params[:parent_id]).parent
-      redirect_to new_creative_path(parent_id: @parent_creative&.id, child_id: params[:parent_id], tags: params[:tags])
     end
 
-    def append_below
-      target = Creative.find_by(id: params[:creative_id])
-      redirect_to new_creative_path(parent_id: target&.parent_id, after_id: target&.id, tags: params[:tags])
-    end
-
-    def children
-      parent = Creative.find(params[:id])
-      effective = parent.effective_origin
-      # user_id for expanded_state lookup - use owner's state for anonymous users
-      state_user_id = Current.user&.id || effective.user_id
-
-      # HTTP caching disabled for children endpoint:
-      # Response depends on child updates, permission changes (CreativeSharesCache),
-      # and CreativeExpandedState. Tracking all dependencies reliably is expensive
-      # (requires descendant_ids query). Stale 304 responses could leak data after
-      # permission revocation. Re-enable when a cheap version key mechanism exists.
-      # Use private + no-store to prevent any caching (proxy or browser).
-      response.headers["Cache-Control"] = "private, no-store"
-
-      has_filters = params[:tags].present? || params[:min_progress].present? || params[:max_progress].present?
-      if has_filters
-        result = ::Creatives::IndexQuery.new(user: Current.user, params: params.merge(id: params[:id])).call
-        render_children_json(parent, state_user_id, result.allowed_creative_ids, result.progress_map)
-      else
-        render_children_json(parent, state_user_id, nil, nil)
+    def update_contexts
+      creative = @creative.effective_origin(Set.new)
+      unless creative.has_permission?(Current.user, :admin)
+        render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden
+        return
       end
-    end
 
-    def unconvert
-      base_creative = @creative.effective_origin
-      parent = base_creative.parent
-      if parent.nil?
-        render json: { error: t("collavre.creatives.index.unconvert_no_parent") }, status: :unprocessable_entity and return
+      current_data = (creative.data || {}).dup
+      current_data["context_ids"] = Array(params[:context_ids]).map(&:to_i) if params.key?(:context_ids)
+      current_data["disabled_context_ids"] = Array(params[:disabled_context_ids]).map(&:to_i) if params.key?(:disabled_context_ids)
+      current_data.delete("disabled_context_ids") if current_data["disabled_context_ids"]&.empty?
+      if params.key?(:disabled_self_context)
+        if ActiveModel::Type::Boolean.new.cast(params[:disabled_self_context])
+          current_data["disabled_self_context"] = true
+        else
+          current_data.delete("disabled_self_context")
+        end
       end
 
-      unless parent.has_permission?(Current.user, :feedback)
-        render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
+      if creative.update(data: current_data)
+        head :ok
+      else
+        render json: { errors: creative.errors.full_messages }, status: :unprocessable_entity
       end
+    end
 
-      unless base_creative.has_permission?(Current.user, :admin)
-        render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden and return
+    def update_metadata
+      creative = @creative.effective_origin(Set.new)
+      unless creative.has_permission?(Current.user, :write)
+        render json: { error: t("collavre.creatives.errors.no_permission") }, status: :forbidden
+        return
       end
 
-      markdown = helpers.render_creative_tree_markdown([ base_creative ])
-      comment = nil
-
-      ActiveRecord::Base.transaction do
-        comment = parent.effective_origin.comments.create!(content: markdown, user: Current.user)
-        base_creative.descendants.each(&:destroy!)
-        base_creative.destroy!
+      new_data = begin
+        JSON.parse(params[:data])
+      rescue JSON::ParserError => e
+        render json: { error: "Invalid JSON: #{e.message}" }, status: :unprocessable_entity
+        return
       end
-
-      render json: { comment_id: comment.id }, status: :created
-    rescue ActiveRecord::RecordInvalid => e
-      render json: { error: e.record.errors.full_messages.to_sentence }, status: :unprocessable_entity
-    end
-
-    def export_markdown
-      creatives = if params[:parent_id]
-        parent_creative = Creative.find(params[:parent_id])
-        effective_origin = parent_creative.effective_origin
-        unless parent_creative.has_permission?(Current.user, :read) &&
-               effective_origin.has_permission?(Current.user, :read)
-          render plain: t("collavre.creatives.errors.no_permission"), status: :forbidden and return
-        end
-        [ effective_origin ]
+      if creative.update(data: new_data)
+        head :ok
       else
-        Creative.where(parent_id: nil).map(&:effective_origin).uniq.select do |creative|
-          creative.has_permission?(Current.user, :read)
-        end
+        render json: { errors: creative.errors.full_messages }, status: :unprocessable_entity
       end
+    end
 
-      if creatives.empty?
-        render plain: t("collavre.creatives.errors.no_permission"), status: :forbidden and return
+    def destroy
+      parent = @creative.parent
+      unless @creative.has_permission?(Current.user, :admin)
+        redirect_to @creative, alert: t("collavre.creatives.errors.no_permission") and return
       end
-
-      markdown = helpers.render_creative_tree_markdown(creatives)
-      send_data markdown, filename: "creatives.md", type: "text/markdown"
+      Creatives::DestroyService.new(
+        creative: @creative,
+        user: Current.user,
+        delete_with_children: params[:delete_with_children].present?
+      ).call
     end
 
     private
@@ -449,18 +358,6 @@ module Collavre
           params[:unassigned].present?
       end
 
-      def build_slide_ids(node)
-        return unless node.has_permission?(Current.user, :read)
-
-        @slide_ids << node.id
-        children = node.children.order(:sequence)
-        if node.origin_id.present?
-          linked_children = node.linked_children
-          children = (children + linked_children).uniq.sort_by(&:sequence)
-        end
-        children.each { |child| build_slide_ids(child) }
-      end
-
       def serialize_creatives(collection)
         if params[:simple].present?
           collection.map { |c| { id: c.id, description: c.effective_description(nil, false), progress: c.progress } }
@@ -473,27 +370,6 @@ module Collavre
         @reorderer ||= ::Creatives::Reorderer.new(user: Current.user)
       end
 
-      def render_children_json(parent, user_id, allowed_ids, progress_map)
-        expanded_state_map = CreativeExpandedState
-                                .where(user_id: user_id, creative_id: parent.id)
-                                .first&.expanded_status || {}
-        children = parent.children_with_permission(Current.user)
-
-        level = params[:level].to_i
-        json_level = level.zero? ? 1 : level
-        render json: {
-          creatives: build_tree(
-            children,
-            params: params,
-            expanded_state_map: expanded_state_map,
-            level: json_level,
-            select_mode: params[:select_mode] == "1",
-            allowed_creative_ids: allowed_ids,
-            progress_map: progress_map
-          )
-        }
-      end
-
       def enforce_creatives_login_policy
         if SystemSetting.creatives_login_required?
           require_authentication

data/app/controllers/collavre/google_auth_controller.rb

@@ -40,6 +40,9 @@ module Collavre
       tz = request.env["omniauth.params"] && request.env["omniauth.params"]["timezone"]
       user.update(timezone: tz) if tz.present? && user.timezone != tz
 
+      return_to = session[:return_to_after_authenticating]
+      reset_session
+      session[:return_to_after_authenticating] = return_to if return_to
       start_new_session_for(user)
       redirect_to after_authentication_url
     end

data/app/controllers/collavre/invites_controller.rb

@@ -8,7 +8,8 @@ module Collavre
       permission = params[:permission] || :read
       invitation = Invitation.create!(inviter: Current.user,
                                       creative: creative,
-                                      permission: permission)
+                                      permission: permission,
+                                      email: params[:email].presence)
       render json: { url: invite_url(token: invitation.generate_token_for(:invite)) }
     end
 

data/app/controllers/collavre/sessions_controller.rb

@@ -28,6 +28,9 @@ module Collavre
         if user.email_verified?
           user.reset_failed_login_attempts!
           handle_invitation_for(user) if params[:invite_token].present?
+          return_to = session[:return_to_after_authenticating]
+          reset_session
+          session[:return_to_after_authenticating] = return_to if return_to
           start_new_session_for user
           tz = params[:timezone]
           user.update(timezone: tz) if tz.present? && user.timezone != tz

data/app/controllers/collavre/topics_controller.rb

@@ -3,10 +3,13 @@ module Collavre
     before_action :set_creative
 
     def index
-      can_manage = @creative.has_permission?(Current.user, :admin) || @creative.user == Current.user
+      is_owner = @creative.user == Current.user
+      can_manage = @creative.has_permission?(Current.user, :admin) || is_owner
+      can_create_topic = can_manage || @creative.has_permission?(Current.user, :write)
       render json: {
         topics: @creative.topics.order(:created_at),
-        can_manage: can_manage
+        can_manage: can_manage,
+        can_create_topic: can_create_topic
       }
     end
 
@@ -63,6 +66,40 @@ module Collavre
       head :no_content
     end
 
+    def move
+      unless @creative.has_permission?(Current.user, :admin) || @creative.user == Current.user
+        render json: { error: I18n.t("collavre.topics.no_permission") }, status: :forbidden and return
+      end
+
+      topic = @creative.topics.find(params[:id])
+      target_creative = Creative.find(params[:target_creative_id]).effective_origin
+
+      unless target_creative.has_permission?(Current.user, :write) || target_creative.user == Current.user
+        render json: { error: I18n.t("collavre.topics.move.no_target_permission") }, status: :forbidden and return
+      end
+
+      # Check for duplicate topic name in target creative
+      if target_creative.topics.where(name: topic.name).exists?
+        render json: { error: I18n.t("collavre.topics.move.duplicate_name", name: topic.name) }, status: :unprocessable_entity and return
+      end
+
+      Topic.transaction do
+        topic.comments.update_all(creative_id: target_creative.id)
+        topic.update!(creative: target_creative)
+      end
+
+      TopicsChannel.broadcast_to(
+        @creative,
+        { action: "deleted", topic_id: topic.id }
+      )
+      TopicsChannel.broadcast_to(
+        target_creative,
+        { action: "created", topic: topic.slice(:id, :name) }
+      )
+
+      render json: { success: true, topic: topic.slice(:id, :name), target_creative_id: target_creative.id }
+    end
+
     def reorder
       unless @creative.has_permission?(Current.user, :admin) || @creative.user == Current.user
         render json: { error: I18n.t("collavre.topics.no_permission") }, status: :forbidden and return