comfortable_media_surfer 3.0.0

data/gemfiles/7.1.gemfile

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+git_source(:github) { |repo| "https://github.com/#{repo}.git" }
+
+gemspec path: '../'
+
+gem 'rails', '~> 7.1.0', '>= 7.1.1'
+
+group :development, :test do
+  gem 'autoprefixer-rails', '~> 10.4.16.0'
+  gem 'byebug',             '~> 11.1.0', platforms: %i[mri mingw x64_mingw]
+  gem 'image_processing',   '>= 1.12.0'
+  gem 'sqlite3',            '~> 1.6.7'
+end
+
+group :test do
+  gem 'brakeman',                 '~> 6.1.2'
+  gem 'bundler-audit',            '~> 0.9.1'
+  gem 'coveralls_reborn',         '~> 0.28.0', require: false
+  gem 'cuprite',                  '>= 0.15'
+  gem 'equivalent-xml',           '~> 0.6.0'
+  gem 'minitest',                 '>= 5.23.0'
+  gem 'minitest-reporters',       '>= 1.6.1'
+  gem 'mocha',                    '>= 2.3.0', require: false
+  gem 'rails-controller-testing', '~> 1.0.5'
+  gem 'rubocop',                  '~> 1.63.0', require: false
+  gem 'rubocop-minitest'
+  gem 'rubocop-rails'
+  gem 'simplecov', '~> 0.22.0', require: false
+end

data/gemfiles/7.2.gemfile

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+git_source(:github) { |repo| "https://github.com/#{repo}.git" }
+
+gemspec path: '../'
+
+gem 'rails', '~> 7.2.0', '>= 7.2.2'
+
+group :development, :test do
+  gem 'autoprefixer-rails', '~> 10.4.16.0'
+  gem 'byebug',             '~> 11.1.0', platforms: %i[mri mingw x64_mingw]
+  gem 'image_processing',   '>= 1.12.0'
+  gem 'sqlite3',            '~> 1.6.7'
+end
+
+group :test do
+  gem 'brakeman',                 '~> 6.1.2'
+  gem 'bundler-audit',            '~> 0.9.1'
+  gem 'coveralls_reborn',         '~> 0.28.0', require: false
+  gem 'cuprite',                  '>= 0.15'
+  gem 'equivalent-xml',           '~> 0.6.0'
+  gem 'minitest',                 '>= 5.23.0'
+  gem 'minitest-reporters',       '>= 1.6.1'
+  gem 'mocha',                    '>= 2.3.0', require: false
+  gem 'rails-controller-testing', '~> 1.0.5'
+  gem 'rubocop',                  '~> 1.63.0', require: false
+  gem 'rubocop-minitest'
+  gem 'rubocop-rails'
+  gem 'simplecov', '~> 0.22.0', require: false
+end

data/lib/comfortable_media_surfer/access_control/admin_authentication.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module ComfortableMediaSurfer::AccessControl
+  module AdminAuthentication
+    # Set username and password in config/initializers/comfortable_media_surfer.rb
+    # Like this:
+    #   ComfortableMediaSurfer::AccessControl::AdminAuthentication.username = 'myname'
+    #   ComfortableMediaSurfer::AccessControl::AdminAuthentication.password = 'mypassword'
+
+    mattr_accessor  :username,
+                    :password
+
+    # Simple http_auth. When implementing some other form of authentication
+    # this method should return +true+ if everything is great, or redirect user
+    # to some other page, thus denying access to cms admin section.
+    def authenticate
+      authenticate_or_request_with_http_basic do |username, password|
+        self.username == username && self.password == password
+      end
+    end
+  end
+end

data/lib/comfortable_media_surfer/access_control/admin_authorization.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module ComfortableMediaSurfer::AccessControl
+  module AdminAuthorization
+    # By default there's no authorization of any kind
+    def authorize
+      true
+    end
+  end
+end

data/lib/comfortable_media_surfer/access_control/public_authentication.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module ComfortableMediaSurfer::AccessControl
+  module PublicAuthentication
+    # By defaut all published pages are accessible
+    def authenticate
+      true
+    end
+  end
+end

data/lib/comfortable_media_surfer/access_control/public_authorization.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module ComfortableMediaSurfer::AccessControl
+  module PublicAuthorization
+    # By default there's no authorization of any kind
+    def authorize
+      true
+    end
+  end
+end

data/lib/comfortable_media_surfer/configuration.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+class ComfortableMediaSurfer::Configuration
+  # Don't like ComfortableMediaSurfer? Set it to whatever you like. :(
+  attr_accessor :cms_title
+
+  # Controller that is inherited from CmsAdmin::BaseController
+  # 'ApplicationController' is the default
+  attr_accessor :admin_base_controller
+
+  # Controller that Comfy::Cms::BaseController will inherit from
+  # 'ApplicationController' is the default
+  attr_accessor :public_base_controller
+
+  # Module that will handle authentication to access cms-admin area
+  attr_accessor :admin_auth
+
+  # Module that will handle authorization against admin cms resources
+  attr_accessor :admin_authorization
+
+  # Module that will handle authentication for public pages
+  attr_accessor :public_auth
+
+  # Module that will handle authorization against public resources
+  attr_accessor :public_authorization
+
+  # When arriving at /cms-admin you may chose to redirect to arbirtary path,
+  # for example '/cms-admin/users'
+  attr_accessor :admin_route_redirect
+
+  # With each page load, files will be synched with the database. Database entries are
+  # destroyed if there's no corresponding file. Seeds are disabled by default.
+  attr_accessor :enable_seeds
+
+  # Path where seeds can be located.
+  attr_accessor :seeds_path
+
+  # Number of revisions kept. Default is 25. If you wish to disable: set this to 0.
+  attr_accessor :revisions_limit
+
+  # Locale definitions. If you want to define your own locale merge
+  # {:locale => 'Locale Title'} with this.
+  attr_accessor :locales
+
+  # Admin interface will respect the locale of the site being managed. However you can
+  # force it to English by setting this to `:en`
+  attr_accessor :admin_locale
+
+  # A class that is included as a sweeper to admin base controller if it's set
+  attr_accessor :admin_cache_sweeper
+
+  # Not allowing erb code to be run inside page content. False by default.
+  # @return [Boolean]
+  attr_accessor :allow_erb
+
+  # Whitelist of all helper methods that can be used via {{cms:helper}} tag. By default
+  # all helpers are allowed except `eval`, `send`, `call` and few others. Empty array
+  # will prevent rendering of all helpers.
+  attr_accessor :allowed_helpers
+
+  # Whitelist of partials paths that can be used via {{cms:partial}} tag. All partials
+  # are accessible by default. Empty array will prevent rendering of all partials.
+  attr_accessor :allowed_partials
+
+  # Whitelist of template paths that can be used via {{cms:template}} tag. All templates
+  # are accessible by default. Empty array will prevent rendering of all templates.
+  attr_accessor :allowed_templates
+
+  # Site aliases, if you want to have aliases for your site. Good for harmonizing
+  # production env with dev/testing envs.
+  # e.g. config.site_aliases = {'host.com' => 'host.inv', 'host_a.com' => ['host.lvh.me', 'host.dev']}
+  # Default is nil (not used)
+  attr_accessor :hostname_aliases
+
+  # Reveal partials that can be overwritten in the admin area.
+  # Default is false.
+  attr_accessor :reveal_cms_partials
+
+  # Auto-setting parameter derived from the routes
+  attr_accessor :public_cms_path
+
+  # Customize returned content from `page.to_json`
+  # Default is set to `methods: [:content], except: [:content_cache]`
+  # For example: include fragments into json data with `config.page_to_json_options = { include: [:fragments] }`
+  attr_accessor :page_to_json_options
+
+  # Configuration defaults
+  def initialize
+    @cms_title              = 'ComfortableMediaSurfer CMS Engine'
+    @admin_base_controller  = 'ApplicationController'
+    @public_base_controller = 'ApplicationController'
+    @admin_auth             = 'ComfortableMediaSurfer::AccessControl::AdminAuthentication'
+    @admin_authorization    = 'ComfortableMediaSurfer::AccessControl::AdminAuthorization'
+    @public_auth            = 'ComfortableMediaSurfer::AccessControl::PublicAuthentication'
+    @public_authorization   = 'ComfortableMediaSurfer::AccessControl::PublicAuthorization'
+    @seed_data_path         = nil
+    @admin_route_redirect   = ''
+    @enable_sitemap         = true
+    @enable_seeds           = false
+    @seeds_path             = File.expand_path('db/cms_seeds', Rails.root)
+    @revisions_limit        = 25
+    @locales                = {
+      'ar' => 'عربي',
+      'ca' => 'Català',
+      'cs' => 'Česky',
+      'da' => 'Dansk',
+      'de' => 'Deutsch',
+      'en' => 'English',
+      'es' => 'Español',
+      'fi' => 'Suomi',
+      'fr' => 'Français',
+      'gr' => 'Ελληνικά',
+      'hr' => 'Hrvatski',
+      'it' => 'Italiano',
+      'ja' => '日本語',
+      'nb' => 'Norsk',
+      'nl' => 'Nederlands',
+      'pl' => 'Polski',
+      'pt-BR' => 'Português Brasileiro',
+      'ru' => 'Русский',
+      'sk' => 'Slovensky',
+      'sv' => 'Svenska',
+      'tr' => 'Türkçe',
+      'uk' => 'Українська',
+      'zh-CN' => '简体中文',
+      'zh-TW' => '正體中文'
+    }
+    @admin_locale         = nil
+    @admin_cache_sweeper  = nil
+    @allow_erb            = false
+    @allowed_helpers      = nil
+    @allowed_partials     = nil
+    @hostname_aliases     = nil
+    @reveal_cms_partials  = false
+    @public_cms_path      = nil
+    @page_to_json_options = { methods: [:content], except: [:content_cache] }
+  end
+end

data/lib/comfortable_media_surfer/content/block.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# wtf does this mean
+# it means that all nodes between this must be moved into here
+# {{cms:block}} some content {{cms:end_block}}
+class ComfortableMediaSurfer::Content::Block < ComfortableMediaSurfer::Content::Tag
+  attr_writer :nodes
+
+  def nodes
+    @nodes ||= []
+  end
+end

data/lib/comfortable_media_surfer/content/params_parser.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require 'strscan'
+
+class ComfortableMediaSurfer::Content::ParamsParser
+  class Error < StandardError; end
+
+  STRING_LITERAL  = %r{'[^']*'|"[^"]*"}
+  IDENTIFIER      = %r{[a-z0-9][\w\-/.]*}i
+  HASH_KEY        = %r{#{IDENTIFIER}:}
+  COMMA           = %r{,}
+  HASH_OPEN       = %r{\{}
+  HASH_CLOSE      = %r{\}}
+  ARRAY_OPEN      = %r{\[}
+  ARRAY_CLOSE     = %r{\]}
+  INTEGER         = %r{\b[0-9]+\b}i
+
+  # @param <String> string
+  def initialize(string = '')
+    @string = string
+  end
+
+  # Takes CMS content tag parameters and converts them into array of strings,
+  # hashes and arrays.
+  #
+  # @return [Array<String, {String => String}>]
+  # @raise [Error] if the given `text` is malformed.
+  #
+  # @example
+  #   new("a, b, c").parse
+  #   #=> ["a", "b", "c"]
+  #
+  #   new("a, b: c, d: e").parse
+  #   #=> ["a", {"b" => "c", "d" => "e"}]
+  #
+  #   new("a, b: {c: [d, e]}").parse
+  #   #=> ["a", {"b" => {"c" => ["d", "e"]}}]
+  #
+  def params
+    @tokens = tokenize(@string)
+    parse_params
+  end
+
+private
+
+  # Contructs root-level list of arguments sent via content tag
+  def parse_params
+    params = []
+    while (token = @tokens.shift)
+      params << parse_value(token)
+    end
+    params
+  end
+
+  # Gets token value. Will trigger parsing of hash and array structures
+  def parse_value(token)
+    case token&.first
+    when :string
+      token[1]
+    when :hash_key
+      @tokens.unshift(token)
+      parse_hash
+    when :hash_open
+      parse_hash
+    when :array_open
+      parse_array
+    else
+      raise Error, "Invalid params: #{@string}"
+    end
+  end
+
+  # Hash constructor method. Will handle nested hashes as well
+  def parse_hash
+    opens = 1
+    hash = {}
+
+    while (token = @tokens.shift)
+      case token&.first
+      when :hash_key
+        hash[token[1]] = parse_value(@tokens.shift)
+      when :hash_close
+        opens -= 1
+      when :hash_open
+        opens += 1
+      else
+        raise Error, "Invalid params: #{@string}"
+      end
+
+      return hash if opens.zero?
+    end
+
+    # We're can't really detect unclosed hashes as we can construct them without
+    # opening brakets. For example, `a: b, c: d` is same as `{a: b, c: d}` and
+    # `{a: b, c: d` is also ends up to be a valid hash. It will error out if
+    # unclosed hash is followed by some other unexpected token. Like: `{a: b, c`
+    hash
+  end
+
+  # Array construction method. Will handle nested arrays
+  def parse_array
+    opens = 1
+    array = []
+    while (token = @tokens.shift)
+      case token&.first
+      when :array_close
+        opens -= 1
+      else
+        array << parse_value(token)
+      end
+
+      return array if opens.zero?
+    end
+
+    raise Error, "Unclosed array param: #{@string}"
+  end
+
+  # Tokenizing input string into a list of touples
+  # Also args_string is stripped of "smart" quotes coming from wysiwyg
+  #
+  # @param [String] args_string
+  # @return [Array<String>] tokens
+  def tokenize(args_string)
+    args_string = args_string.tr('“”‘’', %q(""''))
+    ss = StringScanner.new(args_string)
+    tokens = []
+    loop do
+      ss.skip(%r{\s*})
+      break if ss.eos?
+
+      # commas are just separators like spaces
+      next if ss.scan(COMMA)
+
+      tokens <<
+        if    (t = ss.scan(STRING_LITERAL)) then [:string, t[1...-1]]
+        elsif (t = ss.scan(HASH_KEY))       then [:hash_key, t[0...-1]]
+        elsif (t = ss.scan(INTEGER))        then [:string, t.to_i]
+        elsif (t = ss.scan(IDENTIFIER))     then [:string, t]
+        elsif (t = ss.scan(HASH_OPEN))      then [:hash_open, t]
+        elsif (t = ss.scan(HASH_CLOSE))     then [:hash_close, t]
+        elsif (t = ss.scan(ARRAY_OPEN))     then [:array_open, t]
+        elsif (t = ss.scan(ARRAY_CLOSE))    then [:array_close, t]
+        else
+          raise Error, "Unexpected char: #{ss.getch}"
+        end
+    end
+
+    tokens
+  end
+end

data/lib/comfortable_media_surfer/content/renderer.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require 'strscan'
+
+# Processing content follows these stages:
+#
+#   string        - Text with tags. like this: "some {{cms:fragment content}} text"
+#   tokenization  - Splits string into a list of strings and hashes that define tags
+#                   Example: ["some ", {tag_class: "fragment", tag_params: ""}, " text"]
+#   nodefying     - Initializes Tag instances from tag hashes and returns list
+#                   like this: ["some ", (FragmentTagInstance), " text"]
+#   rendering     - Recursively iterates through nodes. Tag instances get their
+#                   `render` method called. Result of that is tokenized, nodefied
+#                   and rendered once again until there are no tags to expand.
+#                   Resulting list is flattened and joined into a final rendered string.
+#
+class ComfortableMediaSurfer::Content::Renderer
+  class SyntaxError < StandardError; end
+  class Error < StandardError; end
+
+  MAX_DEPTH = 100
+
+  # tags are in this format: {{ cms:tag_class params }}
+  TAG_REGEX = %r{\{\{\s*?cms:(?<class>\w+)(?<params>.*?)\}\}}
+
+  class << self
+    # @return [Hash<String, Class<ComfortableMediaSurfer::Content::Tag>>]
+    def tags
+      @tags ||= {}
+    end
+
+    # @param [String] name
+    # @param [Class<ComfortableMediaSurfer::Content::Tag>] klass
+    def register_tag(name, klass)
+      tags[name.to_s] = klass
+    end
+  end
+
+  # @param [Comfy::Cms::WithFragments, nil] context
+  def initialize(context)
+    @context = context
+    @depth   = 0
+  end
+
+  # This is how we render content out. Takes context (cms page) and content
+  # nodes
+  # @param [Array<String, ComfortableMediaSurfer::Content::Tag>]
+  # @param [Boolean] allow_erb
+  def render(nodes, allow_erb = ComfortableMediaSurfer.config.allow_erb)
+    if (@depth += 1) > MAX_DEPTH
+      raise Error, 'Deep tag nesting or recursive nesting detected'
+    end
+
+    nodes.map do |node|
+      case node
+      when String
+        sanitize_erb(node, allow_erb)
+      else
+        tokens  = tokenize(node.render)
+        nodes   = nodes(tokens)
+        render(nodes, allow_erb || node.allow_erb?)
+      end
+    end.flatten.join
+  end
+
+  def sanitize_erb(string, allow_erb)
+    if allow_erb
+      string.to_s
+    else
+      string.to_s.gsub('<%', '&lt;%').gsub('%>', '%&gt;')
+    end
+  end
+
+  # Splitting text with tags into tokens we can process down the line
+  # @return [Array<String, {Symbol => String}>]
+  def tokenize(string)
+    tokens = []
+    ss = StringScanner.new(string.to_s)
+    while (string = ss.scan_until(TAG_REGEX))
+      text = string.sub(ss[0], '')
+      tokens << text unless text.empty?
+      tokens << {
+        tag_class: ss[:class],
+        tag_params: ss[:params].strip,
+        source: ss[0]
+      }
+    end
+    text = ss.rest
+    tokens << text if text.present?
+    tokens
+  end
+
+  # Constructing node tree for content. It's a list of strings and tags with
+  # their own `nodes` method that has array of strings and tags with their own
+  # `nodes` method that... you get the idea.
+  # @param [Array<String, {Symbol => String}>] tokens
+  # @return [Array<String, ComfortableMediaSurfer::Content::Tag>]
+  def nodes(tokens)
+    nodes = [[]]
+    tokens.each do |token|
+      case token
+
+      # tag signature
+      when Hash
+        case tag_class = token[:tag_class]
+
+        # This handles {{cms:end}} tag. Stopping collecting block nodes.
+        when 'end'
+          if nodes.count == 1
+            raise SyntaxError, 'closing unopened block'
+          end
+
+          nodes.pop
+
+        else
+          # @type [Class<ComfortableMediaSurfer::Content::Tag>]
+          klass = self.class.tags[tag_class] ||
+                  raise(SyntaxError, "Unrecognized tag: #{token[:source]}")
+
+          # @type [ComfortableMediaSurfer::Content::Tag]
+          tag = klass.new(
+            context: @context,
+            params: ComfortableMediaSurfer::Content::ParamsParser.new(token[:tag_params]).params,
+            source: token[:source]
+          )
+          nodes.last << tag
+
+          # If it's a block tag we start collecting nodes into it
+          if tag.is_a?(ComfortableMediaSurfer::Content::Block)
+            nodes << tag.nodes
+          end
+        end
+
+      # text
+      else
+        nodes.last << token
+      end
+    end
+
+    if nodes.count > 1
+      raise SyntaxError, 'unclosed block detected'
+    end
+
+    nodes.flatten
+  end
+end

data/lib/comfortable_media_surfer/content/tag.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+class ComfortableMediaSurfer::Content::Tag
+  class Error < StandardError; end
+
+  # @type [Comfy::Cms::WithFragments]
+  attr_reader :context
+
+  # @type [Array<String, {String => String}>] params
+  attr_reader :params
+
+  # @type [String, nil] source
+  attr_reader :source
+
+  # @param [Comfy::Cms::WithFragments] context
+  # @param [Array<String, {String => String}>] params
+  # @param [String, nil] source
+  def initialize(context:, params: [], source: nil)
+    @context  = context
+    @params   = params
+    @source   = source
+  end
+
+  # Making sure we don't leak erb from tags by accident.
+  # Tag classes can override this, like partials/helpers tags.
+  def allow_erb?
+    ComfortableMediaSurfer.config.allow_erb
+  end
+
+  # Normally it's a {(String)}. However, if tag content has tags,
+  # we need to expand them and that produces potentially more stuff.
+  # @return [Array<String, ComfortableMediaSurfer::Content::Tag>]
+  def nodes
+    template  = ComfortableMediaSurfer::Content::Renderer.new(@context)
+    tokens    = template.tokenize(content)
+    template.nodes(tokens)
+  end
+
+  # @return [String]
+  def content
+    raise Error, 'This is a base class. It holds no content'
+  end
+
+  # @return [String]
+  def render
+    content
+  end
+end

data/lib/comfortable_media_surfer/content/tags/asset.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+# This tag allows for linking of js and css content defined on the layout.
+# Looks something like this:
+#   {{cms:asset layout_identifier, type: css, as: tag}}
+#
+# `type` - css | js - what we're outputting here
+# `as`   - url (default) | tag - output url or wrap it in the appropriate tag
+#
+class ComfortableMediaSurfer::Content::Tags::Asset < ComfortableMediaSurfer::Content::Tag
+  attr_reader :identifier, :type, :as
+
+  def initialize(context:, params: [], source: nil)
+    super
+
+    options = params.extract_options!
+    @identifier = params[0]
+    @type       = options['type']
+    @as         = options['as'] || 'url'
+
+    return if @identifier.present?
+
+    raise Error, 'Missing layout identifier for asset tag'
+  end
+
+  def layout
+    @layout ||= context.site.layouts.find_by(identifier: @identifier)
+  end
+
+  def content
+    return '' unless layout
+
+    base = ComfortableMediaSurfer.config.public_cms_path || ''
+    unless base.ends_with?('/')
+      base += '/'
+    end
+
+    case @type
+    when 'css'
+      out = "#{base}cms-css/#{context.site.id}/#{@identifier}/#{layout.cache_buster}.css"
+      if @as == 'tag'
+        out = "<link href='#{out}' media='screen' rel='stylesheet' type='text/css' />"
+      end
+      out
+    when 'js'
+      out = "#{base}cms-js/#{context.site.id}/#{@identifier}/#{layout.cache_buster}.js"
+      if @as == 'tag'
+        out = "<script src='#{out}' type='text/javascript'></script>"
+      end
+      out
+    end
+  end
+end
+
+ComfortableMediaSurfer::Content::Renderer.register_tag(
+  :asset, ComfortableMediaSurfer::Content::Tags::Asset
+)