formblocks 0.1.0

data/app/controllers/formblocks/application_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Formblocks
+  # Root of the engine's PUBLIC surface: the assets and the form pages. These
+  # stay on a plain ActionController::Base deliberately — a visitor filling
+  # in a form must not be routed through a host's admin controller.
+  #
+  # The admin's root is DashboardController, where
+  # `config.base_controller_class` applies.
+  class ApplicationController < ActionController::Base
+    include RequestContext
+
+    helper Formblocks::ApplicationHelper
+    protect_from_forgery with: :exception
+  end
+end

data/app/controllers/formblocks/assets_controller.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Formblocks
+  # Serves the engine's CSS and JavaScript as plain same-origin files (see
+  # Formblocks::Assets). Same-origin matters: under a `script-src 'self'`
+  # CSP an external script from the app's own host is always allowed.
+  class AssetsController < ApplicationController
+    # Static, no user data; without this Rails' cross-origin JavaScript
+    # guard refuses to serve a script to a plain <script src> request.
+    skip_forgery_protection
+
+    # The URLs carry a content fingerprint (?v=<md5>), so stale code is
+    # structurally impossible: new code means a new URL. The canonical
+    # fingerprinted URL gets long-lived caching; anything else only
+    # ETag-revalidates.
+    def show
+      source, content_type = Assets.lookup(params[:name])
+      return head :not_found unless source
+
+      fingerprint = Assets.fingerprint(params[:name])
+      expires_in 1.year, public: true if params[:v] == fingerprint
+      return unless stale?(etag: [Formblocks::VERSION, fingerprint])
+
+      render plain: source, content_type:
+    end
+  end
+end

data/app/controllers/formblocks/blocks_controller.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Formblocks
+  class BlocksController < DashboardController
+    before_action :set_form, :set_page
+    before_action :set_block, only: %i[update destroy move]
+
+    # Adds a block of `params[:kind]` from the palette, with its defaults.
+    def create
+      klass = Block.find_kind(params[:kind])
+      return head :unprocessable_content unless @page.allowed_block_classes.include?(klass)
+
+      block = @page.blocks.create!(klass.default_attributes.merge(type: klass.name))
+      redirect_to builder_path(dom_id(block)), status: :see_other
+    rescue ArgumentError
+      head :bad_request
+    end
+
+    # Autosaved from the builder. A text edit answers 204 so the field keeps
+    # focus; an upload re-renders the card so the new image shows.
+    def update
+      if @block.update(block_params)
+        if !turbo_request?
+          redirect_to builder_path(dom_id(@block)), status: :see_other
+        elsif rerender_after_update?
+          render turbo_stream: replace_block
+        else
+          head :no_content
+        end
+      elsif turbo_request?
+        render turbo_stream: replace_block, status: :unprocessable_content
+      else
+        redirect_to builder_path(dom_id(@block)), alert: @block.errors.full_messages.to_sentence, status: :see_other
+      end
+    end
+
+    def destroy
+      @block.destroy!
+      respond_to do |format|
+        format.turbo_stream { render turbo_stream: turbo_stream.remove(dom_id(@block)) }
+        format.html { redirect_to builder_path(dom_id(@page)), status: :see_other }
+      end
+    end
+
+    def move
+      @block.move(params[:direction])
+      redirect_to builder_path(dom_id(@block)), status: :see_other
+    end
+
+    # Drag-and-drop order for the whole page: `ids` in their new order.
+    def reorder
+      @page.reorder_blocks(params[:ids])
+      head :no_content
+    end
+
+    private
+
+    def set_page
+      @page = @form.pages.find(params.expect(:page_id))
+    end
+
+    def set_block
+      @block = @page.blocks.find(params.expect(:id))
+    end
+
+    def block_params
+      permitted = %i[label placeholder help_text content required options_text key]
+      permitted += %i[image remove_image] if Formblocks.attachments?
+      params.expect(block: [*permitted])
+    end
+
+    def rerender_after_update?
+      Formblocks.attachments? && @block.image? &&
+        (params.dig(:block, :image).present? || params.dig(:block, :remove_image).present?)
+    end
+
+    def replace_block
+      turbo_stream.replace(dom_id(@block), partial: 'formblocks/blocks/block', locals: { block: @block })
+    end
+  end
+end

data/app/controllers/formblocks/dashboard_controller.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Formblocks
+  # Root of the ADMIN surface: the forms list, the builder, responses and
+  # settings.
+  #
+  # Inherits from `config.base_controller_class` — by default a plain
+  # ActionController::Base, which is why `authorize_admin` exists. Point it at
+  # the controller your own admin already inherits from and the builder picks
+  # up that stack wholesale: your layout, helpers, authentication, and
+  # whatever request context your before_actions establish.
+  class DashboardController < Formblocks.base_controller
+    include RequestContext
+    include ActionView::RecordIdentifier
+
+    helper Formblocks::ApplicationHelper
+
+    # A host base controller brings its own layout, and declaring one here
+    # would override it. So the gem only claims the layout when it owns the
+    # decision: no host base controller, or a host that named an
+    # `admin_layout` explicitly.
+    layout :formblocks_admin_layout unless superclass != ActionController::Base &&
+                                           Formblocks.config.admin_layout == Configuration::DEFAULT_ADMIN_LAYOUT
+
+    before_action :require_admin
+
+    # A host base controller has configured CSRF already; declaring it twice
+    # would run the check twice.
+    protect_from_forgery with: :exception if superclass == ActionController::Base
+
+    private
+
+    def set_form
+      @form = tenant_forms.find(params[:form_id] || params[:id])
+    end
+
+    def builder_path(anchor = nil)
+      edit_form_path(@form, anchor:)
+    end
+  end
+end

data/app/controllers/formblocks/forms_controller.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Formblocks
+  class FormsController < DashboardController
+    before_action :set_form, except: %i[index new create]
+
+    def index
+      @forms = tenant_forms.newest_first
+    end
+
+    def new
+      @templates = Formblocks.config.templates
+    end
+
+    # The builder.
+    def edit
+      @pages = @form.pages.includes(:blocks)
+    end
+
+    def create
+      template = Formblocks.config.templates[params[:template].to_s] if params[:template].present?
+      @form = if template
+                Form.from_template(template, tenant: current_tenant)
+              else
+                Form.new(title: t('formblocks.forms.new.untitled'), tenant: current_tenant)
+              end
+      @form.save!
+      redirect_to edit_form_path(@form), notice: t('formblocks.flash.form_created')
+    end
+
+    def settings; end
+
+    def update
+      if @form.update(form_params)
+        redirect_to settings_form_path(@form), notice: t('formblocks.flash.form_updated'), status: :see_other
+      else
+        render :settings, status: :unprocessable_content
+      end
+    end
+
+    def destroy
+      @form.destroy!
+      redirect_to forms_path, notice: t('formblocks.flash.form_deleted'), status: :see_other
+    end
+
+    def duplicate
+      copy = @form.duplicate
+      redirect_to edit_form_path(copy), notice: t('formblocks.flash.form_duplicated'), status: :see_other
+    end
+
+    def publish
+      @form.publish!
+      redirect_to published_form_path(@form), status: :see_other
+    end
+
+    def unpublish
+      @form.unpublish!
+      redirect_to edit_form_path(@form), notice: t('formblocks.flash.form_unpublished'), status: :see_other
+    end
+
+    def published; end
+
+    private
+
+    def form_params
+      permitted = %i[title slug primary_color button_text_color]
+      permitted += %i[logo remove_logo] if Formblocks.attachments?
+      params.expect(form: [*permitted])
+    end
+  end
+end

data/app/controllers/formblocks/pages_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Formblocks
+  class PagesController < DashboardController
+    before_action :set_form
+    before_action :set_page, only: %i[update destroy move]
+
+    def create
+      page = @form.pages.create!(kind: 'step')
+      @form.resequence_pages!
+      redirect_to builder_path(dom_id(page)), status: :see_other
+    end
+
+    # The page's button text, autosaved from the builder.
+    def update
+      if @page.update(page_params)
+        turbo_request? ? head(:no_content) : redirect_to(builder_path(dom_id(@page)), status: :see_other)
+      else
+        head :unprocessable_content
+      end
+    end
+
+    def destroy
+      @page.destroy! if @page.step? && @form.steps.size > 1
+      @form.resequence_pages!
+      redirect_to builder_path, status: :see_other
+    end
+
+    def move
+      @page.move(params[:direction])
+      redirect_to builder_path(dom_id(@page)), status: :see_other
+    end
+
+    private
+
+    def set_page
+      @page = @form.pages.find(params.expect(:id))
+    end
+
+    def page_params
+      params.expect(page: [:button_text])
+    end
+  end
+end

data/app/controllers/formblocks/public/forms_controller.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module Formblocks
+  module Public
+    # The visitor-facing pages: the form, its submission, and the thank-you
+    # page. Routed by the host app (see `mount_formblocks`), so URL helpers go
+    # through `main_app`.
+    class FormsController < Formblocks::ApplicationController
+      layout 'formblocks/public'
+
+      before_action :set_form
+
+      # Throttle submissions per IP so one visitor or bot cannot flood the
+      # responses. Rails' own limiter, backed by Rails.cache. Tune or disable
+      # via config.rate_limit — read once when the controller loads, so set
+      # it in an initializer.
+      if Formblocks.config.rate_limit
+        rate_limit(**Formblocks.config.rate_limit, only: :create, with: -> { render_rate_limited })
+      end
+
+      def show
+        @response = @form.responses.new
+        @referrer = clean_page_url(request.referer)
+      end
+
+      def create
+        @referrer = clean_page_url(params[:fb_referrer])
+        # The honeypot: a field no human sees. Bots fill it; we pretend it
+        # worked and save nothing.
+        return redirect_to(thanks_path, status: :see_other) if params[:fb_website].present?
+
+        @response = @form.responses.new(page_url: @referrer, user_agent: request.user_agent.to_s.first(500),
+                                        locale: I18n.locale.to_s)
+        @response.fill(params.fetch(:answers, {}).to_unsafe_h)
+
+        if @response.save
+          redirect_to thanks_path, status: :see_other
+        else
+          render :show, status: :unprocessable_content
+        end
+      end
+
+      def thanks
+        @page = @form.thank_you_page
+      end
+
+      private
+
+      # Drafts are visible only to admins previewing them (?preview=1).
+      def set_form
+        @form = Form.includes(pages: :blocks).find_by(slug: params[:slug])
+        return if @form && (@form.published? || preview?)
+
+        render :not_found, status: :not_found
+      end
+
+      def preview?
+        params[:preview].present? && Formblocks.admin?(request)
+      end
+
+      def thanks_path
+        main_app.formblocks_form_thanks_path(@form.slug, preview: params[:preview].presence)
+      end
+
+      # The form again, answers kept, with the message where the errors go.
+      def render_rate_limited
+        @referrer = clean_page_url(params[:fb_referrer])
+        @response = @form.responses.new.fill(params.fetch(:answers, {}).to_unsafe_h)
+        @rate_limited = true
+        render :show, status: :too_many_requests
+      end
+    end
+  end
+end

data/app/controllers/formblocks/responses_controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Formblocks
+  class ResponsesController < DashboardController
+    PER_PAGE = 50
+
+    before_action :set_form
+    before_action :set_response, only: %i[show destroy]
+
+    def index
+      respond_to do |format|
+        format.html do
+          @page = [params[:page].to_i, 1].max
+          @responses = @form.responses.newest_first.offset((@page - 1) * PER_PAGE).limit(PER_PAGE + 1).to_a
+          @more = @responses.size > PER_PAGE
+          @responses = @responses.first(PER_PAGE)
+          @columns = @form.input_blocks.select(&:visible?).first(3)
+        end
+        format.csv do
+          export = CsvExport.new(@form)
+          send_data export.generate, filename: export.filename, type: 'text/csv'
+        end
+      end
+    end
+
+    def show; end
+
+    def destroy
+      @response.destroy!
+      redirect_to form_responses_path(@form), notice: t('formblocks.flash.response_deleted'), status: :see_other
+    end
+
+    private
+
+    def set_response
+      @response = @form.responses.find(params.expect(:id))
+    end
+  end
+end

data/app/controllers/formblocks/settings_controller.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Formblocks
+  # The tenant's brand defaults, one page.
+  class SettingsController < DashboardController
+    before_action :set_setting
+
+    def show; end
+
+    def update
+      if @setting.update(setting_params)
+        redirect_to settings_path, notice: t('formblocks.flash.settings_updated'), status: :see_other
+      else
+        render :show, status: :unprocessable_content
+      end
+    end
+
+    private
+
+    def set_setting
+      @setting = Setting.for_tenant(current_tenant)
+    end
+
+    def setting_params
+      permitted = %i[primary_color button_text_color]
+      permitted += %i[logo remove_logo] if Formblocks.attachments?
+      params.expect(setting: [*permitted])
+    end
+  end
+end

data/app/helpers/formblocks/application_helper.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Formblocks
+  module ApplicationHelper
+    ICONS = {
+      plus: '<path d="M12 5v14M5 12h14"/>',
+      trash: '<path d="M3 6h18M8 6V4h8v2M19 6l-1 14H6L5 6M10 11v6M14 11v6"/>',
+      up: '<path d="M12 19V5M5 12l7-7 7 7"/>',
+      down: '<path d="M12 5v14M19 12l-7 7-7-7"/>',
+      grip: '<circle cx="9" cy="6" r="1.5"/><circle cx="15" cy="6" r="1.5"/><circle cx="9" cy="12" r="1.5"/>' \
+            '<circle cx="15" cy="12" r="1.5"/><circle cx="9" cy="18" r="1.5"/><circle cx="15" cy="18" r="1.5"/>',
+      check: '<circle cx="12" cy="12" r="10"/><path d="M8 12l3 3 5-6"/>',
+      copy: '<rect x="9" y="9" width="12" height="12" rx="2"/><path d="M5 15V5a2 2 0 0 1 2-2h10"/>',
+      external: '<path d="M14 4h6v6M20 4l-9 9M19 14v5a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1V6a1 1 0 0 1 1-1h5"/>',
+      back: '<path d="M19 12H5M12 19l-7-7 7-7"/>',
+      download: '<path d="M12 3v12M6 11l6 6 6-6M4 21h16"/>',
+      duplicate: '<rect x="8" y="8" width="12" height="12" rx="2"/>' \
+                 '<path d="M16 8V6a2 2 0 0 0-2-2H6a2 2 0 0 0-2 2v8a2 2 0 0 0 2 2h2"/>'
+    }.freeze
+
+    # Wraps an admin view in the engine's shell (assets, nav, flash). The block
+    # is captured here, in the view's own context, so its lazy `t('.key')`
+    # lookups resolve against the view — inside `render layout:` they would
+    # resolve against the shell partial instead.
+    def fb_admin_shell(&)
+      render 'formblocks/shared/admin', content: capture(&)
+    end
+
+    # True for a stored attachment — not one that was just assigned and then
+    # refused by validation, which has no URL yet.
+    def fb_stored?(attachment)
+      Formblocks.attachments? && attachment.attached? && attachment.blob&.persisted?
+    end
+
+    # Stylesheet and module script for a bundle (:admin or :public), with
+    # fingerprinted same-origin URLs served by the engine itself.
+    def formblocks_assets(bundle)
+      stylesheet = stylesheet_link_tag(formblocks_asset_url("#{bundle}.css"), 'data-turbo-track': 'reload')
+      script = javascript_include_tag(formblocks_asset_url("#{bundle}.js"), type: 'module',
+                                                                            'data-turbo-track': 'reload', nonce: true)
+      safe_join([stylesheet, script], "\n")
+    end
+
+    def formblocks_asset_url(name)
+      formblocks.engine_asset_path(name, v: Formblocks::Assets.fingerprint(name))
+    end
+
+    # A nonced <style> setting the brand custom properties, so no element
+    # needs an inline style attribute (which a strict style-src refuses).
+    # The colors are validated on save; this re-checks them on the way into
+    # a <style> tag, so nothing but a hex color can ever land there.
+    def formblocks_brand_style(form)
+      primary = fb_hex_color(form.effective_primary_color, Formblocks::Configuration.new.default_primary_color)
+      text = fb_hex_color(form.effective_button_text_color, Formblocks::Configuration.new.default_button_text_color)
+      css = ".fb-brand { --fb-primary: #{primary}; --fb-primary-text: #{text}; }"
+      content_tag(:style, css.html_safe, nonce: content_security_policy_nonce) # rubocop:disable Rails/OutputSafety
+    end
+
+    def fb_hex_color(value, fallback)
+      value.to_s.match?(Formblocks::Form::COLOR_FORMAT) ? value.to_s : fallback
+    end
+
+    def fb_icon(name, **options)
+      body = ICONS.fetch(name)
+      options[:class] = ['fb-icon', options[:class]].compact.join(' ')
+      tag.svg(body.html_safe, # rubocop:disable Rails/OutputSafety
+              viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', 'stroke-width': '2',
+              'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'aria-hidden': 'true', **options)
+    end
+
+    def fb_status_badge(form)
+      tag.span(t("formblocks.status.#{form.status}"), class: "fb-badge fb-badge--#{form.status}")
+    end
+
+    # Where visitors reach the form.
+    def fb_public_url(form, **)
+      main_app.formblocks_form_url(form.slug, **)
+    end
+
+    def fb_public_base_url
+      "#{request.base_url}#{Formblocks.config.public_path.to_s.chomp('/')}"
+    end
+
+    # Attachments are served by the host's Active Storage routes.
+    def fb_attachment_url(attachment)
+      main_app.url_for(attachment)
+    end
+
+    def fb_time(time)
+      tag.time(l(time, format: :short), datetime: time.iso8601, title: l(time, format: :long))
+    end
+  end
+end

data/app/models/concerns/formblocks/attachable.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Formblocks
+  # `attachable :logo` — an Active Storage image attachment with a
+  # `remove_logo` flag and size/type validation. A no-op when the host has no
+  # Active Storage (or turned attachments off), so the models still load.
+  module Attachable
+    extend ActiveSupport::Concern
+
+    class_methods do
+      def attachable(name)
+        return unless Formblocks.attachments?
+
+        has_one_attached name, service: Formblocks.config.storage_service
+        attribute :"remove_#{name}", :boolean, default: false
+
+        validate { validate_attachable(name) }
+        after_save do
+          attachment = public_send(name)
+          attachment.purge if public_send(:"remove_#{name}") && attachment.attached?
+        end
+      end
+    end
+
+    private
+
+    # Only a freshly assigned upload is checked; what is already stored was
+    # checked when it came in.
+    def validate_attachable(name)
+      attachment = public_send(name)
+      return unless attachment.attached? && attachment.blob&.new_record?
+
+      unless attachment.content_type.to_s.start_with?('image/')
+        errors.add(name,
+                   I18n.t('formblocks.errors.not_an_image'))
+      end
+      return if attachment.byte_size.to_i <= Formblocks.config.max_upload_size
+
+      errors.add(name,
+                 I18n.t('formblocks.errors.file_too_large', size: Formblocks.config.max_upload_size / (1024 * 1024)))
+    end
+  end
+end

data/app/models/formblocks/application_record.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Formblocks
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end