collavre 0.5.0 → 0.7.0

data/app/controllers/collavre/users_controller.rb

@@ -1,408 +1,9 @@
 module Collavre
   class UsersController < ApplicationController
-    allow_unauthenticated_access only: %i[new create exists]
-    before_action -> { enforce_auth_provider!(:email) }, only: [ :new, :create ]
-    before_action :require_system_admin!, only: [ :index, :grant_system_admin, :revoke_system_admin, :unlock, :lock ]
-
-    def new
-      @user = Collavre::User.new
-      if params[:invite_token].present?
-        @invitation = Collavre::Invitation.find_by_token_for(:invite, params[:invite_token])
-        @user.email = @invitation&.email
-      end
-    end
-
-    def create
-      @user = Collavre::User.new(user_params)
-      Collavre::Invitation.transaction do
-        if params[:invite_token].present?
-          invitation = Collavre::Invitation.find_by_token_for(:invite, params[:invite_token])
-          if invitation
-            @invitation = invitation
-            @user.email = invitation.email
-          end
-        end
-        if @user.save
-          if invitation
-            invitation.update(accepted_at: Time.current)
-            Collavre::CreativeShare.create!(
-              creative: invitation.creative,
-              user: @user,
-              permission: invitation.permission,
-              shared_by: invitation.inviter
-            )
-            Collavre::Contact.ensure(user: invitation.inviter, contact_user: @user)
-            invitation.creative.create_linked_creative_for_user(@user)
-          end
-          Collavre::EmailVerificationMailer.verify(@user).deliver_later
-          session.delete(:return_to_after_authenticating)
-          redirect_to new_session_path, notice: I18n.t("collavre.users.new.success_sign_up")
-        else
-          render :new, status: :unprocessable_entity
-        end
-      rescue ActiveSupport::MessageVerifier::InvalidSignature
-        flash.now[:alert] = I18n.t("collavre.invites.invalid")
-        render :new, status: :unprocessable_entity
-      end
-    end
-
-    def exists
-      user = Collavre::User.find_by(email: params[:email])
-      render json: { exists: user.present? }
-    end
-
-    def new_ai
-      @available_tools = load_available_tools
-
-      if params[:copy_from].present?
-        source = Collavre::User.find_by(id: params[:copy_from])
-        if source&.ai_user? && source.created_by_id == Current.user.id
-          @copy_source = source
-          @copy_name = "#{source.name} (copy)"
-        end
-      end
-    end
-
-    def create_ai
-      ai_id = params[:ai_id].to_s.strip.downcase
-      email = "#{ai_id}@ai.local"
-      searchable = ActiveModel::Type::Boolean.new.cast(params.fetch(:searchable, false))
-
-      @user = Collavre::User.new(
-        name: params[:name],
-        email: email,
-        password: SecureRandom.hex(36),
-        system_prompt: params[:system_prompt],
-        llm_vendor: params[:llm_vendor].presence || "google",
-        llm_model: params[:llm_model],
-        llm_api_key: params[:llm_api_key],
-        gateway_url: params[:gateway_url],
-        tools: params[:tools] || [],
-        searchable: searchable,
-        email_verified_at: Time.current,
-        created_by_id: Current.user.id,
-        routing_expression: params[:routing_expression]
-      )
-      @user.agent_conf = params[:agent_conf] if @user.respond_to?(:agent_conf=) && params[:agent_conf].present?
-
-      if @user.save
-        Collavre::Contact.ensure(user: Current.user, contact_user: @user)
-        redirect_to user_path(Current.user, tab: "contacts"), notice: I18n.t("collavre.users.create_ai.success")
-      else
-        flash.now[:alert] = @user.errors.full_messages.to_sentence
-        @available_tools = load_available_tools
-        render :new_ai, status: :unprocessable_entity
-      end
-    end
-
-    def edit_ai
-      @user = Collavre::User.find(params[:id])
-      unless @user.ai_user?
-        redirect_to user_path(@user), alert: I18n.t("collavre.users.edit_ai.not_an_ai")
-        return
-      end
-
-      @available_tools = load_available_tools
-    end
-
-    def update_ai
-      @user = Collavre::User.find(params[:id])
-      unless @user.ai_user?
-        redirect_to user_path(@user), alert: I18n.t("collavre.users.edit_ai.not_an_ai")
-        return
-      end
-
-      allowed = Current.user.system_admin? ||
-                (@user.ai_user? && @user.created_by_id == Current.user.id)
-
-      unless allowed
-        fallback = user_path(Current.user, tab: "contacts")
-        redirect_back fallback_location: fallback, alert: I18n.t("collavre.users.destroy.not_authorized")
-        return
-      end
-
-      ai_params = params.require(:user).permit(:name, :system_prompt, :llm_vendor, :llm_model, :llm_api_key, :gateway_url, :searchable, :routing_expression, :agent_conf, tools: [])
-
-      if @user.update(ai_params)
-        redirect_to edit_ai_user_path(@user), notice: I18n.t("collavre.users.update_ai.success")
-      else
-        @available_tools = load_available_tools
-        flash.now[:alert] = @user.errors.full_messages.to_sentence
-        render :edit_ai, status: :unprocessable_entity
-      end
-    end
-
-    def search
-      term = params[:q].to_s.strip.downcase
-
-      if term.blank? && params[:scope] != "contacts"
-        return render json: []
-      end
-
-      creative = Collavre::Creative.find_by(id: params[:creative_id])
-
-      if creative.present? && !creative.has_permission?(Current.user, :read)
-        head :forbidden and return
-      end
-
-      scope = if params[:scope] == "contacts" && Current.user
-        # Include both contacts and searchable users (e.g., AI agents with searchable=true)
-        contact_ids = Current.user.contact_users.select(:id)
-        searchable_ids = Collavre::User.where(searchable: true).select(:id)
-        Collavre::User.where(id: contact_ids).or(Collavre::User.where(id: searchable_ids))
-      else
-        Collavre::User.mentionable_for(creative)
-      end
-
-      users = scope
-      if term.present?
-        users = users.where("LOWER(users.email) LIKE :term OR LOWER(users.name) LIKE :term", term: "#{term}%")
-      end
-
-      limit = params[:limit].to_i
-      limit = 20 if limit <= 0
-      limit = 50 if limit > 50
-
-      user_ids = users.select(:id).distinct.limit(limit).pluck(:id)
-      users = Collavre::User.where(id: user_ids)
-      render json: users.map { |u| { id: u.id, name: u.display_name, email: u.email, avatar_url: view_context.user_avatar_url(u, size: 20) } }
-    end
-
-    def index
-      @users = Collavre::User.includes(:sessions, :devices)
-    end
-
-    def show
-      @user = Collavre::User.find(params[:id])
-      @active_tab = params[:tab].presence || "profile"
-      if Current.user
-        prepare_contacts
-      else
-        @contacts = Collavre::Contact.none
-        @contact_page = 1
-        @total_contact_pages = 1
-        @last_login_map = {}
-        @shared_by_me = {}
-        @shared_with_me = {}
-      end
-    end
-
-    def destroy
-      @user = Collavre::User.find(params[:id])
-
-      if @user == Current.user
-        redirect_to users_path, alert: I18n.t("collavre.users.destroy.cannot_delete_self")
-        return
-      end
-
-      allowed = Current.user.system_admin? ||
-                (@user.ai_user? && @user.created_by_id == Current.user.id)
-
-      unless allowed
-        fallback = user_path(Current.user, tab: "contacts")
-        redirect_back fallback_location: fallback, alert: I18n.t("collavre.users.destroy.not_authorized")
-        return
-      end
-
-      if @user.destroy
-        fallback = Current.user.system_admin? ? users_path : user_path(Current.user, tab: "contacts")
-        redirect_back fallback_location: fallback, notice: I18n.t("collavre.users.destroy.success")
-      else
-        redirect_to users_path, alert: I18n.t("collavre.users.destroy.failure")
-      end
-    end
-
-    def grant_system_admin
-      @user = Collavre::User.find(params[:id])
-
-      if @user.update(system_admin: true)
-        redirect_to users_path, notice: I18n.t("collavre.users.system_admin.granted")
-      else
-        redirect_to users_path, alert: I18n.t("collavre.users.system_admin.failed")
-      end
-    end
-
-    def revoke_system_admin
-      @user = Collavre::User.find(params[:id])
-
-      if @user.update(system_admin: false)
-        redirect_to users_path, notice: I18n.t("collavre.users.system_admin.revoked")
-      else
-        redirect_to users_path, alert: I18n.t("collavre.users.system_admin.failed")
-      end
-    end
-
-    def unlock
-      @user = Collavre::User.find(params[:id])
-      @user.unlock_account!
-      redirect_to users_path, notice: I18n.t("collavre.users.unlock.success", name: @user.display_name)
-    end
-
-    def lock
-      @user = Collavre::User.find(params[:id])
-      if @user == Current.user
-        redirect_to users_path, alert: I18n.t("collavre.users.lock.cannot_lock_self")
-        return
-      end
-      @user.lock_account!
-      redirect_to users_path, notice: I18n.t("collavre.users.lock.success", name: @user.display_name)
-    end
-
-    def update
-      @user = Collavre::User.find(params[:id])
-      if @user.update(profile_params)
-        redirect_to user_path(@user), notice: I18n.t("collavre.users.profile_updated")
-      else
-        render :show, status: :unprocessable_entity
-      end
-    end
-
-    def notification_settings
-      if Current.user.update(notification_settings_params)
-        head :no_content
-      else
-        render json: { errors: Current.user.errors.full_messages }, status: :unprocessable_entity
-      end
-    end
-
-    def edit_password
-      @user = Collavre::User.find(params[:id])
-    end
-
-    def passkeys
-      @user = Collavre::User.find(params[:id])
-
-      unless @user == Current.user || Current.user.system_admin?
-        redirect_to user_path(Current.user), alert: I18n.t("collavre.users.destroy.not_authorized")
-      end
-    end
-
-    def update_password
-      @user = Collavre::User.find(params[:id])
-      if @user.authenticate(params[:user][:current_password])
-        if @user.update(user_params)
-          redirect_to user_path(@user), notice: I18n.t("collavre.users.password_updated")
-        else
-          flash.now[:alert] = I18n.t("collavre.users.password_update_failed")
-          render :edit_password, status: :unprocessable_entity
-        end
-      else
-        @user.errors.add(:current_password, I18n.t("collavre.users.current_password_incorrect"))
-        flash.now[:alert] = I18n.t("collavre.users.password_update_failed")
-        render :edit_password, status: :unprocessable_entity
-      end
-    end
-
-    private
-
-    def load_available_tools
-      Collavre::McpService.available_tools(Current.user).map do |tool|
-        {
-          name: tool[:name],
-          description: tool[:description],
-          parameters: tool[:params]
-        }
-      end
-    end
-
-    def prepare_contacts
-      per_page = 10
-      @contact_page = [ params[:contact_page].to_i, 1 ].max
-
-      creative_shares = Collavre::CreativeShare.arel_table
-      creatives = Collavre::Creative.arel_table
-
-      user_creative_origins_sql = Collavre::Creative
-        .where(user_id: Current.user.id)
-        .select("COALESCE(origin_id, id) AS origin_id")
-        .to_sql
-
-      shared_by_me_scope = Collavre::CreativeShare
-        .joins(:creative)
-        .where.not(permission: Collavre::CreativeShare.permissions[:no_access])
-        .where(
-          creative_shares[:shared_by_id].eq(Current.user.id)
-            .or(
-              creative_shares[:shared_by_id].eq(nil).and(creatives[:user_id].eq(Current.user.id))
-            )
-            .or(
-              creatives[:id].in(Arel.sql("(#{user_creative_origins_sql})"))
-            )
-        )
-
-      shared_with_me_scope = Collavre::CreativeShare
-        .joins(:creative)
-        .where(user_id: Current.user.id)
-        .where.not(permission: Collavre::CreativeShare.permissions[:no_access])
-
-      contact_ids_sql = [
-        Current.user.contacts.select("contact_user_id AS user_id").to_sql,
-        shared_by_me_scope.select("creative_shares.user_id AS user_id").to_sql,
-        shared_with_me_scope.select("COALESCE(creative_shares.shared_by_id, creatives.user_id) AS user_id").to_sql
-      ].join(" UNION ")
-
-      contact_users_relation = Collavre::User.where(
-        id: Collavre::User.from("(#{contact_ids_sql}) AS contact_ids").select(:user_id)
-      )
-
-      @total_contacts = contact_users_relation.count
-      @total_contact_pages = [ (@total_contacts.to_f / per_page).ceil, 1 ].max
-      paged_users = contact_users_relation
-        .includes(avatar_attachment: :blob)
-        .order(:name, :id)
-        .offset((@contact_page - 1) * per_page)
-        .limit(per_page)
-
-      existing_contacts = Current.user.contacts.includes(contact_user: [ avatar_attachment: :blob ]).index_by(&:contact_user_id)
-      @contacts = paged_users.map do |user|
-        existing_contacts[user.id] || Collavre::Contact.new(user: Current.user, contact_user: user)
-      end
-
-      @last_login_map = Collavre::Session.where(user_id: paged_users.map(&:id)).group(:user_id).maximum(:updated_at)
-
-      shares_from_me = shared_by_me_scope
-        .where(user_id: paged_users.map(&:id))
-        .includes(:creative)
-
-      @shared_by_me = shares_from_me.group_by(&:user_id).transform_values { |shares| shares.map(&:creative) }
-
-      shares_to_me = Collavre::CreativeShare
-        .joins(:creative)
-        .where(user_id: Current.user.id)
-        .where.not(permission: Collavre::CreativeShare.permissions[:no_access])
-        .where(
-          creative_shares[:shared_by_id].in(paged_users.map(&:id))
-            .or(creative_shares[:shared_by_id].eq(nil).and(creatives[:user_id].in(paged_users.map(&:id))))
-        )
-        .includes(:creative)
-
-      @shared_with_me = shares_to_me.group_by(&:sharer_id)
-                                    .transform_values { |shares| shares.map(&:creative) }
-    end
-
-    def user_params
-      params.require(:user).permit(:email, :password, :password_confirmation, :name)
-    end
-
-    def profile_params
-      params.require(:user).permit(
-        :avatar,
-        :avatar_url,
-        :display_level,
-        :completion_mark,
-        :theme,
-        :name,
-        :notifications_enabled,
-        :calendar_id,
-        :timezone,
-        :locale
-      ).tap do |p|
-        p[:locale] = normalize_supported_locale(p[:locale]) if p.key?(:locale)
-      end
-    end
-
-    def notification_settings_params
-      params.require(:user).permit(:notifications_enabled)
-    end
+    include UsersController::Registration
+    include UsersController::AiUserManagement
+    include UsersController::ContactManagement
+    include UsersController::AdminOperations
+    include UsersController::ProfileAndSettings
   end
 end

data/app/controllers/concerns/collavre/comments/approval_actions.rb

@@ -0,0 +1,108 @@
+module Collavre
+  module Comments
+    module ApprovalActions
+      extend ActiveSupport::Concern
+
+      def approve
+        status = @comment.approval_status(Current.user)
+        if status != :ok
+          error_key = case status
+          when :invalid_action_format then "collavre.comments.approve_invalid_format"
+          when :missing_action then "collavre.comments.approve_missing_action"
+          when :missing_approver then "collavre.comments.approve_missing_approver"
+          when :admin_required then "collavre.comments.approve_admin_required"
+          else "collavre.comments.approve_not_allowed"
+          end
+          http_status = case status
+          when :invalid_action_format, :missing_action, :missing_approver
+                          :unprocessable_entity
+          else
+                          :forbidden
+          end
+          render json: { error: I18n.t(error_key) }, status: http_status and return
+        end
+
+        begin
+          ::Comments::ActionExecutor.new(comment: @comment, executor: Current.user).call
+          @comment = Comment.with_attached_images.includes(:comment_reactions, :comment_versions, :selected_version).find(@comment.id)
+          render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
+        rescue ::Comments::ActionExecutor::ExecutionError => e
+          render json: { error: e.message }, status: :unprocessable_entity
+        end
+      end
+
+      def update_action
+        # Initial checks outside the lock
+        executed_error = false
+        update_success = false
+        approver_mismatch_error = false
+        status_error_key = nil
+        status_http_status = nil
+        validation_error_message = nil
+
+        @comment.with_lock do
+          @comment.reload
+
+          status_in_lock = @comment.approval_status(Current.user)
+          # Allow repairing invalid format if user is approver
+          if status_in_lock == :invalid_action_format
+            if @comment.approver_id == Current.user&.id
+              status_in_lock = :ok
+            else
+              status_in_lock = :not_allowed
+            end
+          end
+
+          if status_in_lock != :ok
+            approver_mismatch_error = true
+            status_error_key = case status_in_lock
+            when :invalid_action_format then "collavre.comments.approve_invalid_format"
+            when :missing_action then "collavre.comments.approve_missing_action"
+            when :missing_approver then "collavre.comments.approve_missing_approver"
+            when :admin_required then "collavre.comments.approve_admin_required"
+            else "collavre.comments.approve_not_allowed"
+            end
+            status_http_status = case status_in_lock
+            when :invalid_action_format, :missing_action, :missing_approver
+                            :unprocessable_entity
+            else
+                            :forbidden
+            end
+          elsif @comment.action_executed_at.present?
+            executed_error = true
+          else
+            action_payload = params.dig(:comment, :action)
+            if action_payload.blank?
+              validation_error_message = I18n.t("collavre.comments.approve_missing_action")
+            else
+              begin
+                validator = ::Comments::ActionValidator.new(comment: @comment)
+                parsed_payload = validator.validate!(action_payload)
+                normalized_action = JSON.pretty_generate(parsed_payload)
+                update_success = @comment.update(action: normalized_action)
+              rescue ::Comments::ActionValidator::ValidationError => e
+                validation_error_message = e.message
+              end
+            end
+          end
+        end
+
+        if approver_mismatch_error
+          render json: { error: I18n.t(status_error_key) }, status: status_http_status
+        elsif validation_error_message
+          render json: { error: validation_error_message }, status: :unprocessable_entity
+        elsif executed_error
+          render json: { error: I18n.t("collavre.comments.approve_already_executed") }, status: :unprocessable_entity
+        elsif update_success
+          @comment = Comment.with_attached_images.includes(:comment_reactions, :comment_versions, :selected_version).find(@comment.id)
+          render partial: "collavre/comments/comment", locals: { comment: @comment, current_topic_id: current_topic_context }
+        else
+          error_message = @comment.errors.full_messages.to_sentence.presence || I18n.t("collavre.comments.action_update_error")
+          render json: { error: error_message }, status: :unprocessable_entity
+        end
+      rescue ::Comments::ActionValidator::ValidationError => e
+        render json: { error: e.message }, status: :unprocessable_entity
+      end
+    end
+  end
+end

data/app/controllers/concerns/collavre/comments/batch_operations.rb

@@ -0,0 +1,55 @@
+module Collavre
+  module Comments
+    module BatchOperations
+      extend ActiveSupport::Concern
+
+      MAX_BATCH_DELETE = 100
+
+      def batch_destroy
+        comment_ids = Array(params[:comment_ids]).map(&:to_i).uniq.first(MAX_BATCH_DELETE)
+        if comment_ids.empty?
+          render json: { error: I18n.t("collavre.comments.batch_delete_no_selection") }, status: :unprocessable_entity and return
+        end
+
+        is_admin = @creative.has_permission?(Current.user, :admin)
+        is_creative_owner = @creative.user == Current.user
+
+        visible_scope = @creative.comments.where(
+          "comments.private = ? OR comments.user_id = ? OR comments.approver_id = ?",
+          false, Current.user.id, Current.user.id
+        )
+        comments = visible_scope.where(id: comment_ids).to_a
+
+        if comments.length != comment_ids.length
+          render json: { error: I18n.t("collavre.comments.batch_delete_not_found") }, status: :not_found and return
+        end
+
+        # Check permissions: user must own all comments, or be admin/creative owner
+        unless is_admin || is_creative_owner
+          unauthorized = comments.reject { |c| c.user == Current.user }
+          if unauthorized.any?
+            render json: { error: I18n.t("collavre.comments.not_owner") }, status: :forbidden and return
+          end
+        end
+
+        Comment.where(id: comments.map(&:id)).destroy_all
+
+        head :no_content
+      end
+
+      def move
+        result = CommentMoveService.new(creative: @creative, user: Current.user).call(
+          comment_ids: params[:comment_ids],
+          target_creative_id: params[:target_creative_id],
+          target_topic_id: params[:target_topic_id]
+        )
+        render json: result
+      rescue CommentMoveService::MoveError => e
+        status = e.message == I18n.t("collavre.comments.move_not_allowed") ? :forbidden : :unprocessable_entity
+        render json: { error: e.message }, status: status
+      rescue ActiveRecord::RecordInvalid => e
+        render json: { error: e.record.errors.full_messages.to_sentence.presence || I18n.t("collavre.comments.move_error") }, status: :unprocessable_entity
+      end
+    end
+  end
+end

data/app/controllers/concerns/collavre/comments/conversion.rb

@@ -0,0 +1,46 @@
+module Collavre
+  module Comments
+    module Conversion
+      extend ActiveSupport::Concern
+
+      def convert
+        unless can_convert_comment?
+          render json: { error: I18n.t("collavre.comments.convert_not_allowed") }, status: :forbidden and return
+        end
+
+        created_creatives = ::MarkdownImporter.import(
+          @comment.content,
+          parent: @creative,
+          user: @creative.user,
+          create_root: true
+        )
+
+        primary_creative = created_creatives.first
+        system_message = build_convert_system_message(primary_creative) if primary_creative
+
+        @comment.destroy
+
+        if system_message.present?
+          Current.set(session: nil) do
+            @creative.comments.create!(content: system_message, user: nil)
+          end
+        end
+
+        head :no_content
+      end
+
+      private
+
+      def can_convert_comment?
+        @comment.user == Current.user || @creative.has_permission?(Current.user, :admin)
+      end
+
+      def build_convert_system_message(creative)
+        title = helpers.strip_tags(creative.description).to_s.strip
+        title = I18n.t("collavre.comments.convert_system_message_default_title") if title.blank?
+        url = creative_path(creative)
+        I18n.t("collavre.comments.convert_system_message", title: title, url: url)
+      end
+    end
+  end
+end

data/app/controllers/concerns/collavre/users_controller/admin_operations.rb

@@ -0,0 +1,74 @@
+module Collavre
+  module UsersController::AdminOperations
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :require_system_admin!, only: [ :index, :grant_system_admin, :revoke_system_admin, :unlock, :lock ]
+    end
+
+    def index
+      @users = Collavre::User.includes(:sessions, :devices)
+    end
+
+    def destroy
+      @user = Collavre::User.find(params[:id])
+
+      if @user == Current.user
+        redirect_to users_path, alert: I18n.t("collavre.users.destroy.cannot_delete_self")
+        return
+      end
+
+      allowed = Current.user.system_admin? ||
+                (@user.ai_user? && @user.created_by_id == Current.user.id)
+
+      unless allowed
+        fallback = user_path(Current.user, tab: "contacts")
+        redirect_back fallback_location: fallback, alert: I18n.t("collavre.users.destroy.not_authorized")
+        return
+      end
+
+      if @user.destroy
+        fallback = Current.user.system_admin? ? users_path : user_path(Current.user, tab: "contacts")
+        redirect_back fallback_location: fallback, notice: I18n.t("collavre.users.destroy.success")
+      else
+        redirect_to users_path, alert: I18n.t("collavre.users.destroy.failure")
+      end
+    end
+
+    def grant_system_admin
+      @user = Collavre::User.find(params[:id])
+
+      if @user.update(system_admin: true)
+        redirect_to users_path, notice: I18n.t("collavre.users.system_admin.granted")
+      else
+        redirect_to users_path, alert: I18n.t("collavre.users.system_admin.failed")
+      end
+    end
+
+    def revoke_system_admin
+      @user = Collavre::User.find(params[:id])
+
+      if @user.update(system_admin: false)
+        redirect_to users_path, notice: I18n.t("collavre.users.system_admin.revoked")
+      else
+        redirect_to users_path, alert: I18n.t("collavre.users.system_admin.failed")
+      end
+    end
+
+    def unlock
+      @user = Collavre::User.find(params[:id])
+      @user.unlock_account!
+      redirect_to users_path, notice: I18n.t("collavre.users.unlock.success", name: @user.display_name)
+    end
+
+    def lock
+      @user = Collavre::User.find(params[:id])
+      if @user == Current.user
+        redirect_to users_path, alert: I18n.t("collavre.users.lock.cannot_lock_self")
+        return
+      end
+      @user.lock_account!
+      redirect_to users_path, notice: I18n.t("collavre.users.lock.success", name: @user.display_name)
+    end
+  end
+end