droom 0.4.3 → 0.5.3

data/app/controllers/droom/documents_controller.rb

@@ -2,32 +2,20 @@ module Droom
   class DocumentsController < Droom::EngineController
     respond_to :html, :js, :json
     layout :no_layout_if_pjax
-  
-    before_filter :authenticate_user!
-    # before_filter :require_admin!, :except => [:index, :show]
-    before_filter :get_folder
-    before_filter :find_documents, :only => [:index]
-    before_filter :get_document, :only => [:show, :edit, :update, :destroy]
-    before_filter :build_document, :only => [:new, :create]
+
+    before_filter :get_folder, :except => [:index]
+    load_and_authorize_resource :document, :class => Droom::Document, :through => :folder, :shallow => true
     
     def index
+      @documents = @documents.matching(params[:q]) unless params[:q].blank?
+      @documents = paginated(@documents)
       respond_with @documents do |format|
         format.js { render :partial => 'droom/documents/documents' }
       end
     end
-  
+    
     def show
       if @document.file
-        # master documents are stored in private S3 buckets
-        # To keep the documents secure, we: 
-        # * publish them only through this controller (so no S3 links appear on the page)
-        # * deliver them only to authenticated users
-        # * delivery by redirecting to a URL that expires in ten minutes
-        #
-        # We could channel all file delivery through this controller and may do so in future but it
-        # creates a nasty performance bottleneck. For now the redirect approach seems more robust 
-        # and the expiring URLs sufficiently obscure.
-        #
         redirect_to @document.file.expiring_url(Time.now + 600)
       else
         raise ActiveRecord::RecordNotFound
@@ -39,7 +27,6 @@ module Droom
     end
 
     def create
-      @document.update_attributes(params[:document])
       @document.save!
       render :partial => 'created'
     end
@@ -49,7 +36,6 @@ module Droom
     end
     
     def update
-      @document.update_attributes(params[:document])
       @document.save!
       render :partial => 'listing', :object => @document.with_event
     end
@@ -58,50 +44,16 @@ module Droom
       @document.destroy
       head :ok
     end
+
+  protected
     
+    def document_params
+      params.require(:document).permit(:name, :file, :description, :folder_id)
+    end
     
-  protected
     def get_folder
-      @folder = Droom::Folder.find_by_id(params[:folder_id])
+      @folder = Droom::Folder.find(params[:folder_id])
     end
     
-    def build_document
-      @document = @folder.documents.build(params[:document])
-    end
-
-    def get_document
-      @document = @folder.documents.find(params[:id])
-    end
-
-    def find_documents
-      sort_orders = {
-        'asc' => "ASC",
-        'desc' => "DESC"
-      }
-      @order = sort_orders[params[:order]] || "DESC"
-
-      sort_parameters = {
-        'name' => "droom_documents.name #{@order}",
-        'filename' => "droom_documents.file_file_name #{@order}",
-        'filesize' => "droom_documents.file_file_size #{@order}",
-        'created' => "droom_documents.created_at #{@order}",
-        'event' => "event_name #{@order}",
-        'category' => "case when category_name is null then 1 else 0 end #{@order}, category_name #{@order}"
-      }
-      params[:sort] = 'created' unless sort_parameters[params[:sort]]
-      @sort = params[:sort]
-      @show = params[:show] || 10
-      @page = params[:page] || 1
-      
-      if current_user.admin?
-        @documents = Droom::Document.scoped({})
-      else
-        @documents = Droom::Document.visible_to(@current_person)
-      end
-
-      @documents = @documents.matching(params[:q]) unless params[:q].blank?
-      @documents = @documents.order(sort_parameters[@sort]).page(@page).per(@show)
-    end
-
   end
 end

data/app/controllers/droom/dropbox_tokens_controller.rb

@@ -1,4 +1,5 @@
-# This is a RESTful dropbox authentication controller. The access_token is treated as a resource.
+# This is a more or less RESTful dropbox authentication controller.
+# The access_token is treated as a resource.
 # Later it might be generalised to handle other oauth tokens.
 
 require 'dropbox_sdk'
@@ -7,10 +8,9 @@ module Droom
   class DropboxTokensController < Droom::EngineController
     respond_to :html, :js, :json
     layout :no_layout_if_pjax
-    before_filter :authenticate_user!
-
     before_filter :get_token, :only => [:show, :destroy]
     skip_before_filter :verify_authenticity_token, :only => :create
+    skip_authorization_check
     
     def new
       dbsession = DropboxSession.new(Droom.dropbox_app_key, Droom.dropbox_app_secret)
@@ -22,7 +22,6 @@ module Droom
       if params[:oauth_token]
         dbsession = DropboxSession.deserialize(session[:dropbox_session])
         response = dbsession.get_access_token
-        Rails.logger.warn ">>> get_access_token: #{response.inspect}"
         @dropbox_token = current_user.dropbox_tokens.create(:access_token => response.key, :access_token_secret => response.secret)
         session[:dropbox_session] = dbsession.serialize
         flash[:panel] = 'dropbox'

data/app/controllers/droom/engine_controller.rb

@@ -2,31 +2,59 @@ require 'dropbox_sdk'
 
 module Droom
   class EngineController < ::ApplicationController
+    helper Droom::DroomHelper
 
-    before_filter :authenticate_user!
-    before_filter :note_current_user
+    rescue_from "CanCan::AccessDenied", :with => :not_allowed
     
-  protected
-
-    def require_admin!
-      raise Droom::PermissionDenied unless current_user && current_user.admin?
+    def current_ability
+      @current_ability ||= Droom::Ability.new(current_user)
     end
     
-    def current_person
-      current_user.person if user_signed_in?
+  protected
+        
+    def paginated(collection, default_show=10, default_page=1)
+      @show = (params[:show] || default_show).to_i
+      @page = (params[:page] || default_page).to_i
+      collection.page(@page).per(@show)
     end
     
+    def not_allowed(exception)
+      respond_to do |format|
+        format.html { render :file => "#{Rails.root}/public/403.html", :status => 403, :layout => false }
+        format.js { head :forbidden }
+        format.json { head :forbidden }
+      end
+    end
+
     def no_layout_if_pjax
-      if request.headers['X-PJAX'] || request.format == 'js'
+      if pjax?
         false
       else
         Droom.layout
       end
     end
     
-    def note_current_user
-      Droom::User.current = current_user
+    def pjax?
+      request.headers['X-PJAX']
     end
     
+    def set_access_control_headers
+      headers['Access-Control-Allow-Origin'] = '*'
+      headers["Access-Control-Allow-Headers"] = %w{Origin Accept Content-Type X-Requested-With X-CSRF-Token}.join(",")
+      headers["Access-Control-Allow-Methods"] = %{GET PATCH POST}
+    end
+
+    def set_pagination_headers
+      if results = instance_variable_get("@#{name_from_controller}")
+        if results.respond_to? :total_count
+          headers["X-Pagination"] = {
+            limit: results.limit_value,
+            offset: results.offset_value,
+            total_count: results.total_count
+          }.to_json
+        end
+      end
+    end
+
   end
 end

data/app/controllers/droom/events_controller.rb

@@ -1,65 +1,49 @@
+require 'tod'
+
 module Droom
   class EventsController < Droom::EngineController
     require "uri"
-    require "ri_cal"
-    respond_to :html, :json, :rss, :ics, :js, :zip
+    require "icalendar"
+    respond_to :html, :json, :ics, :js
     layout :no_layout_if_pjax
-
-    before_filter :authenticate_user!
-    before_filter :require_admin!, :except => [:index, :show]
-    before_filter :numerical_parameters
-    before_filter :get_event, :only => [:show, :edit, :update, :destroy]
-    before_filter :find_or_create_calendar, :only => :new
-    before_filter :build_event, :only => [:new, :create]
-    before_filter :get_calendar, :only => [:index, :calendar]
-    before_filter :find_events, :only => [:index, :calendar]
+    
+    before_filter :get_events, :only => [:index]
+    before_filter :composite_dates, :only => [:update, :create]
+    before_filter :build_event, :only => [:create]
+    load_and_authorize_resource
 
     def index
       respond_with @events do |format|
-        format.js {
-          render :partial => 'droom/events/events'
-        }
+        format.js { render :partial => 'droom/events/events' }
       end
     end
 
     def calendar
-      respond_with @events do |format|
-        format.js {
-          render :partial => 'droom/events/calendar'
-        }
-      end
+      respond_with @events
     end
 
     def show
       respond_with @event do |format|
-        format.js { 
-          render :partial => 'droom/events/event' 
-        }
-        format.zip { 
-          send_file @event.documents_zipped.path, :type => 'application/zip', :disposition => 'attachment', :filename => "#{@event.slug}.zip"
-        }
+        format.js { render :partial => 'droom/events/event' }
+        format.zip { send_file @event.documents_zipped.path, :type => 'application/zip', :disposition => 'attachment', :filename => "#{@event.slug}.zip" }
       end
     end
 
     def new
+      @event.start = Time.zone.now.change(hour: 10)
       respond_with @event
     end
 
     def create
       if @event.save
-        render :partial => "created"
+        render :partial => "event"
       else
         respond_with @event
       end
     end
 
-    def edit
-      
-    end
-
     def update
-      @event.update_attributes(params[:event])
-      if @event.save
+      if @event.update_attributes(event_params)
         render :partial => "event"
       else
         respond_with @event
@@ -72,64 +56,58 @@ module Droom
     end
 
   protected
-
-    def build_event
-      params[:event] ||= {}
-      params[:event][:calendar_id] ||= @calendar.id if @calendar
-      @event = Droom::Event.new({:start => Time.now.floor(30.minutes)}.merge(params[:event]))
-    end
-
-    def get_event
-      @event = Droom::Event.find(params[:id])
-    end
-
-    def find_events
-      if params[:direction] == 'past'
-        @events = @calendar.events.past.order('start DESC')
-        @direction = "past"
-      else
-        @events = @calendar.events.future_and_current.order('start ASC')
-        @direction = "future"
+  
+    def get_events
+      events = Droom::Event.accessible_by(current_ability)
+      if Droom.separate_calendars?
+        events = events.in_calendar(Droom::Calendar.default_calendar)
       end
-      unless current_user.admin?
-        if current_person
-          @events = @events.visible_to(current_person)
-        else
-          @events = @events.all_public
-        end
+      if params[:year].present?
+        @year = params[:year].to_i
+        @events = paginated(events.in_year(@year).order('start ASC'))
+      elsif params[:direction] == 'past'
+        @direction = 'past'
+        @events = paginated(events.past.order('start DESC'))
+      else
+        @direction = 'future'
+        @events = paginated(events.future_and_current.order('start ASC'))
       end
-      
-      @show = params[:show] || 10
-      @page = params[:page] || 1
-      @events = @events.page(@page).per(@show)
-    end
-
-    def get_calendar
-      @calendar = Droom::Calendar.find_by_id(params[:calendar_id]) || find_or_create_calendar
-    end
-
-    def find_or_create_calendar
-      name = if Droom.required_calendar_names.include?(params[:calendar]) then params[:calendar] else "main" end
-      @calendar = Droom::Calendar.find_or_create_by_name(name)
     end
-
-    # months can be passed around either as names or numbers
-    # any date part can be 'now' or 'next' for ease of linking
-    # and everything is converted to_i to save clutter later
-    def month_names
-      ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"]
+    
+    def build_event
+      @event = Droom::Event.new(event_params)
+      @event.created_by = current_user
     end
-
-    def numerical_parameters
-      if params[:month] && month_names.include?(params[:month].titlecase)
-        params[:month] = month_names.index(params[:month].titlecase)
-      end
-      [:year, :month, :mday].select{|p| params[p] }.each do |p|
-        params[p] = Date.today.send(p) if params[p] == 'now'
-        params[p] = (Date.today + 1.send(p == :mday ? :day : p)).send(p) if params[p] == 'next'
-        params[p] = params[p].to_i
+    
+    # NB. the stored timezone parameter is just an interface convenience: we use it to check boxes in the form. 
+    # The event start and finish dates are stored as datetimes with zones.
+    #
+    def composite_dates
+      if params[:event]
+        if params[:event][:start_date].present?
+          # We adjust the given datetimes so that they are considered to happen in the given zone, if there is one. 
+          # If none is given, everything happen within the configured time zone for the application.
+          date = Time.zone.parse(params[:event][:start_date])
+          timezone = ActiveSupport::TimeZone.new(params[:event][:timezone]) if params[:event][:timezone].present?
+          timezone ||= Time.zone
+          
+          # This is done without changing the apparent time: it is already correct with the given zone and no translation is required.
+          date = date.change(offset: timezone) if timezone
+          if params[:event][:start_time].present?
+            start_time = TimeOfDay.parse(params[:event][:start_time])
+            params[:event][:start] = start_time.on(date, timezone)
+          end
+          if params[:event][:finish_time].present?
+            finish_time = TimeOfDay.parse(params[:event][:finish_time])
+            params[:event][:finish] = finish_time.on(date, timezone)
+          end
+        end
       end
     end
+    
+    def event_params
+      params.require(:event).permit(:name, :description, :event_set_id, :event_type_id, :calendar_id, :all_day, :master_id, :url, :start, :finish, :timezone, :venue_id, :venue_name)
+    end
 
   end
 end

data/app/controllers/droom/folders_controller.rb

@@ -1,14 +1,14 @@
 module Droom
   class FoldersController < Droom::EngineController
-    respond_to :html, :json, :js, :zip
+    respond_to :html, :json, :js
     layout :no_layout_if_pjax
   
-    before_filter :authenticate_user!
-    before_filter :find_folders, :only => [:index]
-    before_filter :get_folder, :only => [:show, :edit, :update, :destroy, :dropbox]
-    before_filter :build_folder, :only => [:new, :create]
+    before_filter :get_root_folders, :only => [:index]
+    before_filter :get_parent_folder, :only => [:new, :create]
+    load_and_authorize_resource
     
     def index
+      @folders = @folders.populated unless current_user.admin?
       respond_with @folders do |format|
         format.js {
           render :partial => 'droom/folders/folders'
@@ -21,9 +21,6 @@ module Droom
         format.js { 
           render :partial => 'droom/folders/folder' 
         }
-        format.zip { 
-          send_file @folder.documents_zipped.path, :type => 'application/zip', :disposition => 'attachment', :filename => "#{@folder.slug}.zip"
-        }
       end
     end
     
@@ -32,7 +29,7 @@ module Droom
     end
 
     def create
-      @folder.update_attributes(params[:folder])
+      @folder.update_attributes(folder_params)
       respond_with @folder do |format|
         format.js { render :partial => "droom/folders/folder" }
       end
@@ -43,7 +40,11 @@ module Droom
     end
     
     def update
-      @folder.update_attributes(params[:folder])
+      if @folder.update_attributes(folder_params)
+        Rails.logger.warn "√√  folder updated: #{@folder.inspect}"
+      else
+        Rails.logger.warn "xx  folder save problems: #{@folder.errors.to_a.inspect}"
+      end
       respond_with @folder do |format|
         format.js { render :partial => "droom/folders/folder" }
       end
@@ -59,48 +60,37 @@ module Droom
       render :partial => "folder"
     end
 
-    def dav
-      @folder.copy_to_dav
-      respond_with @folder
-    end
-    
     def with_parent
       
     end
     
   protected
-    
-    def build_folder
-      if @parent = Droom::Folder.find_by_id(params[:folder_id])
-        @folder = @parent.children.build(params[:folder])
-      else
-        @folder = Droom::Folder.new(params[:folder])
-      end
+  
+    def folder_params
+      params.require(:folder).permit(:name, :slug, :parent_id)
     end
-
-    def get_folder
-      @folder = Droom::Folder.find(params[:id])
+    
+    def get_root_folders
+      @folders = Droom::Folder.roots
     end
-
-    def find_folders
-      if current_user.admin?
-        @folders = Droom::Folder.roots
+    
+    def get_parent_folder
+      if @parent = Droom::Folder.find_by(id: params[:folder_id])
+        @folder = @parent.children.build
       else
-        @folders = Droom::Folder.visible_to(current_user.person).roots.populated
+        @folder = Droom::Folder.new
       end
     end
-    
+ 
     def get_folder_tree
-      @folders = current_user.admin? ? Droom::Folder.all : Droom::Folder.visible_to(current_user.person).populated
-      @roots = []
-      @children = @folders.each_with_object({}) do |folder, hash|
-        parent = folder.parent_id || 'root'
-        hash[parent] ||= []
-        hash[parent] << folder
+      @child_map = Droom::Folder.non_roots.each_with_object({}) do |f, children|
+        children[f.parent_id] ||= []
+        children[f.parent_id].push(f)
+      end
+      @document_map = Droom::Document.all.each_with_object({}) do |d, contents|
+        contents[d.folder_id] ||= []
+        contents[d.folder_id].push(d)
       end
-      @roots = @children['root']
     end
-    
-    
   end
 end