droom 0.4.3 → 0.5.3

data/app/assets/stylesheets/droom/_toolbar.css.sass

@@ -18,14 +18,8 @@
   header
     display: block
     float: left
-    background: #eee
     position: relative
     z-index: 1
-    background-image: linear-gradient(bottom, rgb(238, 238, 238) 0%, rgb(255, 255, 255) 100%)
-    background-image: -o-linear-gradient(bottom, rgb(238, 238, 238) 0%, rgb(255, 255, 255) 100%)
-    background-image: -moz-linear-gradient(bottom, rgb(238, 238, 238) 0%, rgb(255, 255, 255) 100%)
-    background-image: -webkit-linear-gradient(bottom, rgb(238, 238, 238) 0%, rgb(255, 255, 255) 100%)
-    background-image: -ms-linear-gradient(bottom, rgb(238, 238, 238) 0%, rgb(255, 255, 255) 100%)
     font-size: 0
 
   .commands

data/app/assets/stylesheets/droom/_variables.css.sass

@@ -1,3 +1,4 @@
+$coolgrey00: #f7f5f3
 $coolgrey0: #f2f0ed
 $coolgrey1: #e2e1dd
 $coolgrey2: #d6d6d4
@@ -12,9 +13,10 @@ $coolgrey10: #616265
 $coolgrey11: #4d4e53
 $black6: #52555f
 $rubine: #d1005d
-$blue: #00afdb
+$blue: #2c91c9
 $green: #74b87a
 $warmred: #ff625b
+$reddish: #d34a4a
 $darkred: #b92a23
 $purple: #a27ec3
 $red: #ed1c24
@@ -28,7 +30,7 @@ $palest: #f2f0ed !default
 $page: #ffffff
 $text: $dark
 $link: $red
-$hover: $palered
+$hover: $reddish
 $active: #8c8d8e
 $visited: $link
 $input: $dark

data/app/controllers/droom/agenda_categories_controller.rb

@@ -2,23 +2,15 @@ module Droom
   class AgendaCategoriesController < Droom::EngineController
     respond_to :html, :js
     layout :no_layout_if_pjax
-    before_filter :get_event
-    before_filter :get_agenda_category, :only => [:destroy, :edit, :update]
-    before_filter :build_agenda_category, :only => [:new, :create]
 
-  protected
-
-    def get_event
-      @event = Droom::Event.find(params[:event_id])
-    end
+    load_and_authorize_resource :event
+    load_and_authorize_resource :agenda_category, :through => :event
 
-    def get_agenda_category
-      @agenda_category = @event.agenda_categories.find(params[:id])
+  protected
+  
+    def agenda_category_parameters
+      params.require(:agenda_category).permit(:event_id, :category_id)
     end
     
-    def build_agenda_category
-      @agenda_category = @event.agenda_categories.build(params[:agenda_category])
-    end
-
   end
 end

data/app/controllers/droom/api/api_controller.rb

@@ -0,0 +1,56 @@
+module Droom::Api
+  class ApiController < Droom::EngineController
+
+    respond_to :json
+    before_filter :set_access_control_headers
+    skip_before_filter :authenticate_user!
+    skip_before_filter :require_data_room_permission
+    skip_before_action :verify_authenticity_token
+    
+    rescue_from "ActiveRecord::RecordNotFound", with: :not_found
+    rescue_from "Droom::Error", with: :blew_up
+
+    def current_ability
+      @current_ability ||= Droom::Ability.new(current_user)
+    end
+
+  protected
+    
+    def assert_local_request
+      raise CanCan::AccessDenied if (Rails.env.production? || Rails.env.staging?) && (request.host != 'localhost' || request.port != Settings.api_port)
+    end
+
+    def not_found(exception)
+      render json: { errors: exception.message }.to_json, status: :not_found
+    end
+
+    def not_allowed(exception)
+      render json: { errors: "You do not have permission to access that resource" }.to_json, status: :forbidden
+    end
+
+    def blew_up(exception)
+      render json: { errors: exception.message }.to_json, status: :internal_server_error
+    end
+    
+    def echo_auth
+      Rails.logger.warn "??? token_and_options: #{ActionController::HttpAuthentication::Token.token_and_options(request).inspect}"
+      Rails.logger.warn "    token auth header is #{request.headers["HTTP_AUTHORIZATION"]}"
+    end
+
+    def echo_user_status
+      Rails.logger.warn ">>> user_signed_in? is #{user_signed_in?.inspect}"
+      if user_signed_in?
+        Rails.logger.warn "    current_user is #{current_user.inspect}"
+        Rails.logger.warn "    permissions: is #{current_user.permission_codes.inspect}"
+      end
+    end
+    
+    def name_from_controller
+      params[:controller].sub("Controller", "").underscore.split('/').last
+    end
+    
+    def api_controller?
+      true
+    end
+  end
+end

data/app/controllers/droom/api/events_controller.rb

@@ -0,0 +1,74 @@
+module Droom::Api
+  class EventsController < Droom::Api::ApiController
+
+    before_filter :get_events, only: [:index]
+    before_filter :find_or_create_event, only: [:create]
+    load_and_authorize_resource find_by: :uuid, class: "Droom::Event"
+    
+    def index
+      render json: @events
+    end
+
+    def show
+      render json: @event
+    end
+
+    def update
+      @event.update_attributes(event_params)
+      render json: @event
+    end
+
+    def create
+      if @event && @event.persisted?
+        render json: @event
+      else
+        render json: {
+          errors: @event.errors.to_a
+        }
+      end
+    end
+
+    def destroy
+      @event.destroy
+      head :ok
+    end
+
+  protected
+
+    def find_or_create_event
+      if params[:event]
+        if params[:event][:uid].present?
+          @event = Droom::User.where(uid: params[:event][:uid]).first
+        end
+        if params[:event][:email].present?
+          @event ||= Droom::User.where(email: params[:event][:email]).first
+        end
+      end
+      @event ||= Droom::User.create(event_params)
+    end
+
+    def get_events
+      events = Droom::User.in_name_order
+      
+      if params[:q].present?
+        @fragments = params[:q].split(/\s+/)
+        @fragments.each { |frag| events = events.matching(frag) }
+      end
+
+      @events = events
+
+      # @show = params[:show] || 20
+      # @page = params[:page] || 1
+      # if @show == 'all'
+      #   @events = events
+      # else
+      #   @events = events.page(@page).per(@show)
+      # end
+    end
+
+    def event_params
+      params.require(:event).permit(:name, :description, :event_set_id, :calendar_id, :all_day, :url, :start, :finish, :timezone, :venue_id, :venue_name)
+    end
+
+  end
+end

data/app/controllers/droom/api/users_controller.rb

@@ -0,0 +1,92 @@
+module Droom::Api
+  class UsersController < Droom::Api::ApiController
+
+    before_filter :assert_local_request
+
+    before_filter :get_users, only: [:index]
+    before_filter :find_or_create_user, only: [:create]
+    load_resource find_by: :uid, class: "Droom::User"
+    
+    def index
+      render json: @users
+    end
+
+    def show
+      render json: @user
+    end
+  
+    # This is a almost always a preliminary call at the initial auth stage, 
+    # so the client is not yet setting auth headers. We look for a token in params too.
+    #
+    def authenticate
+      token = params[:tok]
+      if @user = Droom::User.find_by(authentication_token: token)
+        render json: @user
+      else
+        head :unauthorized
+      end
+    end
+  
+    # deauth is used to achieve single-sign-out. It changes the auth token and session id
+    # so that neither the data room session cookie nor the domain auth cookie can identify a user.
+    #
+    def deauthenticate
+      token = params[:tok]
+      if @user = Droom::User.find_by(authentication_token: token)
+        @user.clear_session_id!
+        @user.reset_authentication_token!
+        render json: @user
+      else
+        head :unauthorized
+      end
+    end
+  
+    def update
+      @user.update_attributes(user_params)
+      render json: @user
+    end
+
+    def create
+      if @user && @user.persisted?
+        render json: @user
+      else
+        render json: { errors: @user.errors.to_a }
+      end
+    end
+
+    def destroy
+      @user.destroy
+      head :ok
+    end
+
+  protected
+
+    def find_or_create_user
+      if params[:user]
+        if params[:user][:uid].present?
+          @user = Droom::User.where(uid: params[:user][:uid]).first
+        end
+        if params[:user][:email].present?
+          @user ||= Droom::User.where(email: params[:user][:email]).first
+        end
+      end
+      params = user_params
+      @user ||= Droom::User.create(user_params)
+    end
+
+    def get_users
+      @users = Droom::User.in_name_order
+      @users = @users.where(person_uid: params[:person_uid]) if params[:person_uid].present?
+      @users = @users.matching_in_col(:family_name, params[:name_q]) if params[:name_q].present?
+      @users = @users.matching_in_col(:email, params[:email_q]) if params[:email_q].present?
+      @users = @users.matching(params[:q]) if params[:q].present?
+      @users = @users.limit(params[:limit]) if params[:limit].present?
+      @users
+    end
+
+    def user_params
+      params.require(:user).permit(:uid, :person_uid, :title, :family_name, :given_name, :chinese_name, :honours, :email, :phone, :description, :address, :post_code, :country_code, :mobile, :organisation_id, :female, :defer_confirmation, :send_confirmation, :password, :password_confirmation, :confirmed, :confirmed_at, :image)
+    end
+
+  end
+end

data/app/controllers/droom/api/venues_controller.rb

@@ -0,0 +1,71 @@
+module Droom::Api
+  class VenuesController < Droom::Api::ApiController
+    before_filter :get_venues, only: [:index]
+    before_filter :find_or_create_venue, only: [:create]
+    load_resource find_by: :slug, class: "Droom::Venue"
+    # after_filter :set_pagination_headers, only: [:index]
+    
+    def index
+      render json: @venues
+    end
+
+    def show
+      render json: @venue
+    end
+
+    def update
+      @venue.update_attributes(venue_params)
+      render json: @venue
+    end
+
+    def create
+      render json: @venue
+    end
+
+    def destroy
+      @venue.destroy
+      head :ok
+    end
+
+  protected
+
+    def find_or_create_venue
+      if params[:venue]
+        if params[:venue][:slug].present?
+          @venue = Droom::Venue.where(slug: params[:venue][:slug]).first
+        end
+        if params[:venue][:name].present?
+          @venue ||= Droom::Venue.where(name: params[:venue][:name]).first
+        end
+      end
+      @venue ||= Droom::Venue.create(venue_params)
+    end
+    
+    def build_venue
+      @venue = Droom::Venue.new
+    end
+
+    def get_venues
+      venues = Droom::Venue.in_name_order
+      
+      if params[:q].present?
+        @fragments = params[:q].split(/\s+/)
+        @fragments.each { |frag| venues = venues.matching(frag) }
+      end
+      @venues = venues
+
+      # @show = params[:show] || 20
+      # @page = params[:page] || 1
+      # if @show == 'all'
+      #   @venues = venues
+      # else
+      #   @venues = venues.page(@page).per(@show) 
+      # end
+    end
+
+    def venue_params
+      params.require(:venue).permit(:name, :lat, :lng, :address, :post_code, :country_code)
+    end
+
+  end
+end

data/app/controllers/droom/calendars_controller.rb

@@ -3,10 +3,7 @@ module Droom
     respond_to :html, :json, :rss, :ics
     layout :no_layout_if_pjax
 
-    before_filter :authenticate_user!
-    before_filter :get_calendar, :only => :show
-    before_filter :get_calendars, :only => :index
-    before_filter :require_admin!, :except => :show
+    load_and_authorize_resource
 
     def show
       respond_with @calendar
@@ -17,13 +14,10 @@ module Droom
     end
 
   protected
-
-    def get_calendars
-      @calendars = Droom::Calendar.all
+  
+    def calendar_parameters
+      params.require(:calendar).permit(:events_private, :documents_private)
     end
 
-    def get_calendar
-      @calendar = Droom::Calendar.find(params[:id])
-    end
   end
 end

data/app/controllers/droom/{user_confirmations_controller.rb → confirmations_controller.rb}

@@ -1,13 +1,16 @@
 module Droom
-  class UserConfirmationsController < Devise::ConfirmationsController
+  class ConfirmationsController < Devise::ConfirmationsController
 
     # If user not yet confirmed, show password form (rather than just confirming, as is normal)
     # If already confirmed, allow devise to do whatever a devise does.
     #
     def show
-      if self.resource = resource_class.find_by_id_and_confirmation_token(params[:id], params[:confirmation_token])
-        redirect_to after_sign_in_path_for(resource) if resource.confirmed?
-        # or we render user_confirmations/show
+      if self.resource = resource_class.confirm_by_token(params[:confirmation_token])
+        if resource.confirmed?
+          redirect_to after_sign_in_path_for(resource) 
+        else
+          render
+        end
       elsif user_signed_in?
         redirect_to after_sign_in_path_for(current_user)
       else
@@ -46,9 +49,7 @@ module Droom
   protected
   
     def permitted_params
-      params[:user].slice(:forename, :name, :password, :password_confirmation)
-      # for rails 4
-      #params.require(:user).permit(:first_name, :last_name, :password, :password_confirmation)
+      params.require(:user).permit(:family_name, :given_name, :chinese_name, :password, :password_confirmation)
     end
 
   end

data/app/controllers/droom/dashboard_controller.rb

@@ -1,29 +1,12 @@
 module Droom
   class DashboardController < Droom::EngineController
     respond_to :html, :js
-    layout :normal_unless_pjax
-  
-    before_filter :authenticate_user!  
+    layout :no_layout_if_pjax
+    skip_authorization_check
     
     def index
-      @panel = session[:panel] || "search"
-      session[:panel] = nil
-      render
-    end
-    
-    def page
       
     end
     
-  protected
-  
-    def normal_unless_pjax
-      if request.headers['X-PJAX']
-        false
-      else
-        Droom.layout
-      end
-    end
-    
   end
 end