helios-press 0.2 → 0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff787a0ede62265b58f025dbcd37aab9b35203b691cd74252dfd6df108669fc2
-  data.tar.gz: 505c0b5583ebbb5c8277fcd2a295abcc12747c3cb1462ec770e53ccf29acdcd4
+  metadata.gz: 3ea59768263242ec8f88e1bd68e8d33f67f4b5a313d32626ac735632be159672
+  data.tar.gz: f2aa7c604191d1e340f18c1c9cf980d6f988407deff6127953a023572bcd1ef6
 SHA512:
-  metadata.gz: fee9b6adf0321cf285cd49c2eda7446771c62e5b57a183962efcdf513026a82187602832fa1a8597c3e5aaa47790fc9dd6ca7944170541d2eeb949cce8710486
-  data.tar.gz: dfec9a5447b75c2536d8548daa69c530ba1db54d30e6fdffcec2bcfc0447d3ee129b57642ab0d9e67196aa33d6847f1958924aaf020bec6205fb297746ff5141
+  metadata.gz: fa4299b094dca0fc56ef35d1c930146cabbf6020bc4561f7482c140a1d9fac88a995f56a18a7aa53da51331f03e1b75e9d4d88f3c26c66b52968594673567752
+  data.tar.gz: 6e804a7772de4fe2f6b29ed41b1f111bede76ef00b86e39e3215bf07f311ac30344e28cafde50df2e11e5878dc843cd585272536bfc4bd9bb43634a1168c6352

data/README.md

@@ -89,9 +89,12 @@ mount Helios::Press::Admin::Engine, at: "/admin/press"
 
 ## JavaScript Setup
 
-Register the Stimulus controllers in your host app:
+Register the Stimulus controllers in your host app. You **must** also import `trix` and `@rails/actiontext` — without these imports, the rich text editor will not render in text blocks:
 
 ```javascript
+import 'trix'
+import '@rails/actiontext'
+
 import {
   HeliosPressBlocksController,
   HeliosPressTextBlockController,
@@ -107,7 +110,7 @@ application.register("helios-press-image-block", HeliosPressImageBlockController
 - `sortablejs`
 - `@hotwired/stimulus`
 - `@rails/activestorage`
-- `trix` and `@rails/actiontext`
+- `trix` and `@rails/actiontext` — **required** for text block editing
 
 ### Vite
 
@@ -157,11 +160,31 @@ POST to your mounted API path with `X-API-Key` header:
   "slug": "my-post-title",
   "description": "Meta description",
   "keywords": "keyword1, keyword2",
-  "body_html": "<p>Post content...</p>",
-  "published": true
+  "body_html": "<p>Post content with <img src=\"https://example.com/photo.jpg\"> tags...</p>",
+  "published": true,
+  "images": [
+    {
+      "reference_key": "hero1",
+      "url": "https://example.com/hero.jpg",
+      "alt": "Hero image",
+      "caption": "Photo credit: Example"
+    }
+  ]
 }
 ```
 
+### Image Ingestion
+
+When a post is ingested via the API, all images in `body_html` are automatically downloaded, stored via ActiveStorage (e.g., to S3), and the `<img>` src attributes are rewritten to local proxy URLs. This ensures no external image hotlinking in published posts.
+
+Two modes are supported:
+
+1. **Explicit references**: Use `src="helios://image/<reference_key>"` in your `body_html` and provide the actual download URL in the `images` array. The ingestor matches them by `reference_key`.
+
+2. **Auto-import**: Any `src="https://..."` URL in `body_html` is automatically downloaded. Images are deduplicated by a SHA256 hash of the URL path (ignoring query strings/signatures), so re-ingesting the same image with different signed URLs won't create duplicates.
+
+Images are stored as `BlockImage` records with ActiveStorage attachments and served via `rails_storage_proxy_path`. Failed downloads are logged and skipped (soft failure — the original src is preserved).
+
 ## License
 
 Proprietary. All rights reserved.

data/app/controllers/helios/press/api/posts_controller.rb

@@ -2,7 +2,7 @@ module Helios
   module Press
     module Api
       class PostsController < Helios::Press::Api::BaseController
-        # POST /api/v1/posts
+        # POST /api/press/posts
         # Upsert a post by external_id. Payload shape:
         # {
         #   "external_id":       "helios-blog-post-draft-4821",
@@ -10,9 +10,18 @@ module Helios
         #   "slug":              "...",
         #   "keywords":          "...",
         #   "description":       "...",
-        #   "body_html":         "...",
-        #   "published":         true
+        #   "body_html":         "<p>Content with <img src=\"https://...\"> tags...</p>",
+        #   "published":         true,
+        #   "images":            [
+        #     { "reference_key": "hero1", "url": "https://...", "alt": "...", "caption": "..." }
+        #   ]
         # }
+        #
+        # Images in body_html are automatically downloaded, stored via ActiveStorage,
+        # and their src attributes rewritten to local proxy URLs. Two modes:
+        #   1. Explicit: use src="helios://image/<reference_key>" in body_html and
+        #      provide the download URL in the images array.
+        #   2. Auto: any src="https://..." in body_html is downloaded automatically.
         def create
           external_id = params[:external_id].to_s
           return render json: { error: "external_id is required" }, status: :bad_request if external_id.blank?
@@ -27,19 +36,16 @@ module Helios
             published: ActiveModel::Type::Boolean.new.cast(params[:published])
           )
 
-          # If body_html is provided, create/update a single text block with the content
+          post.save!
+
           if params[:body_html].present?
-            if post.persisted?
-              # Update or create the first text block
-              text_block = post.blocks.find_by(block_type: "text") || post.blocks.build(block_type: "text", position: 0)
-              text_block.content = params[:body_html]
-            else
-              post.blocks.build(block_type: "text", position: 0, content: params[:body_html])
-            end
+            ingestor = ImageIngestor.new(post)
+            ingestor.call(
+              body_html: params[:body_html],
+              images_payload: params[:images] || []
+            )
           end
 
-          post.save!
-
           render json: {
             ok: true,
             id: post.id,

data/app/models/helios/press/block_image.rb

@@ -8,7 +8,11 @@ module Helios
       has_one_attached :file
 
       validates :position, presence: true, numericality: { only_integer: true, greater_than_or_equal_to: 0 }
-      validates :file, presence: true
+      validates :file, presence: true, unless: :reference_key?
+
+      def reference_key?
+        reference_key.present?
+      end
 
       acts_as_list scope: :block
 

data/app/services/helios/press/image_ingestor.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "nokogiri"
+require "uri"
+require "digest"
+
+module Helios
+  module Press
+    # Downloads remote images referenced in ingested post HTML, stores them via
+    # ActiveStorage, and rewrites the body HTML so <img> src attributes point at
+    # locally-hosted ActiveStorage proxy URLs.
+    #
+    # Supports two modes:
+    #   1. Explicit references: src="helios://image/<reference_key>" paired with
+    #      an images_payload array containing download URLs.
+    #   2. Auto-import: any remaining src="https://..." URLs are downloaded,
+    #      deduplicated by a SHA256 of the URL path.
+    class ImageIngestor
+      class FetchError < StandardError; end
+
+      MAX_BYTES = 15.megabytes
+
+      def initialize(post)
+        @post = post
+      end
+
+      # images_payload: Array of Hashes
+      #   [{ "reference_key" => "abc123", "url" => "https://...", "alt" => "...", "caption" => "..." }]
+      def call(body_html:, images_payload: [])
+        ensure_text_block!
+        upsert_inline_images(images_payload)
+        rewritten = rewrite_body_html(body_html)
+        text_block.content = rewritten
+        text_block.save!
+        rewritten
+      end
+
+      private
+
+      attr_reader :post
+
+      def text_block
+        @text_block ||= post.blocks.find_by(block_type: "text") ||
+                        post.blocks.build(block_type: "text", position: 0)
+      end
+
+      def ensure_text_block!
+        text_block # trigger lazy init
+      end
+
+      def image_block
+        @image_block ||= post.blocks.find_by(block_type: "image_container") ||
+                         post.blocks.create!(block_type: "image_container", position: 1)
+      end
+
+      def upsert_inline_images(payload)
+        return if payload.blank?
+
+        payload.each do |entry|
+          key = entry["reference_key"].presence
+          next unless key
+
+          bi = image_block.block_images.find_or_initialize_by(reference_key: key)
+          bi.caption = entry["caption"].to_s if entry["caption"].present?
+          bi.position ||= (image_block.block_images.maximum(:position) || 0) + 1
+
+          if bi.file.attached?
+            bi.save! if bi.changed?
+            next
+          end
+
+          blob = fetch_as_blob(entry["url"])
+          unless blob
+            Rails.logger.warn("Helios::Press::ImageIngestor: skipping #{key} — blob fetch failed")
+            next
+          end
+
+          bi.file.attach(blob)
+          bi.save!
+        end
+      end
+
+      def rewrite_body_html(html)
+        return html if html.blank?
+
+        doc = Nokogiri::HTML.fragment(html)
+        doc.css("img").each do |img|
+          src = img["src"].to_s
+
+          if src.start_with?("helios://image/")
+            key = src.delete_prefix("helios://image/")
+            bi = image_block.block_images.find_by(reference_key: key)
+            next unless bi&.file&.attached?
+
+            img["src"] = proxy_path(bi.file)
+            img["alt"] = bi.caption if bi.caption.present? && img["alt"].blank?
+          elsif src.match?(%r{\Ahttps?://}i)
+            bi = import_remote_image(src, alt: img["alt"].to_s)
+            next unless bi&.file&.attached?
+
+            img["src"] = proxy_path(bi.file)
+          end
+        end
+
+        doc.to_html
+      end
+
+      def import_remote_image(url, alt: "")
+        uri = URI.parse(url)
+        key = "auto_#{Digest::SHA256.hexdigest(uri.path.to_s)[0, 16]}"
+
+        bi = image_block.block_images.find_or_initialize_by(reference_key: key)
+        bi.caption = alt if alt.present? && bi.caption.blank?
+        bi.position ||= (image_block.block_images.maximum(:position) || 0) + 1
+
+        if bi.file.attached?
+          bi.save! if bi.changed?
+          return bi
+        end
+
+        blob = fetch_as_blob(url)
+        unless blob
+          Rails.logger.warn("Helios::Press::ImageIngestor: skipping remote image #{url} — blob fetch failed")
+          return nil
+        end
+
+        bi.file.attach(blob)
+        bi.save!
+        bi
+      rescue StandardError => e
+        Rails.logger.error("Helios::Press::ImageIngestor: failed to import #{url} — #{e.class}: #{e.message}")
+        nil
+      end
+
+      def proxy_path(attachment)
+        Rails.application.routes.url_helpers.rails_storage_proxy_path(attachment, only_path: true)
+      end
+
+      def fetch_as_blob(url)
+        uri = URI.parse(url)
+        return nil unless uri.is_a?(URI::HTTP) || uri.is_a?(URI::HTTPS)
+
+        response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+          http.open_timeout = 10
+          http.read_timeout = 30
+          http.request(Net::HTTP::Get.new(uri))
+        end
+
+        raise FetchError, "HTTP #{response.code} fetching #{url}" unless response.is_a?(Net::HTTPSuccess)
+        raise FetchError, "Image too large: #{response.body.bytesize}" if response.body.bytesize > MAX_BYTES
+
+        filename = File.basename(uri.path.presence || "image")
+        filename = "image.jpg" if filename.blank? || filename == "/"
+
+        ActiveStorage::Blob.create_and_upload!(
+          io: StringIO.new(response.body),
+          filename: filename,
+          content_type: response["content-type"] || "application/octet-stream"
+        )
+      rescue StandardError => e
+        Rails.logger.error("Helios::Press::ImageIngestor: failed to fetch #{url} — #{e.class}: #{e.message}")
+        nil
+      end
+    end
+  end
+end

data/db/migrate/20250510000001_create_helios_press_posts.rb

@@ -1,6 +1,8 @@
 class CreateHeliosPressPosts < ActiveRecord::Migration[8.0]
   def change
-    create_table :helios_press_posts do |t|
+    primary_key_type, foreign_key_type = primary_and_foreign_key_types
+
+    create_table :helios_press_posts, id: primary_key_type do |t|
       t.string :name, null: false
       t.string :slug, null: false
       t.text :description
@@ -15,4 +17,14 @@ class CreateHeliosPressPosts < ActiveRecord::Migration[8.0]
     add_index :helios_press_posts, :external_id, unique: true
     add_index :helios_press_posts, :published
   end
+
+  private
+
+  def primary_and_foreign_key_types
+    config = Rails.configuration.generators
+    setting = config.options[config.orm][:primary_key_type]
+    primary_key_type = setting || :primary_key
+    foreign_key_type = setting || :bigint
+    [primary_key_type, foreign_key_type]
+  end
 end

data/db/migrate/20250510000002_create_helios_press_blocks.rb

@@ -1,7 +1,9 @@
 class CreateHeliosPressBlocks < ActiveRecord::Migration[8.0]
   def change
-    create_table :helios_press_blocks do |t|
-      t.references :post, null: false, foreign_key: { to_table: :helios_press_posts }
+    primary_key_type, foreign_key_type = primary_and_foreign_key_types
+
+    create_table :helios_press_blocks, id: primary_key_type do |t|
+      t.references :post, null: false, foreign_key: { to_table: :helios_press_posts }, type: foreign_key_type
       t.string :block_type, null: false
       t.integer :position, null: false
       t.integer :columns, default: 3
@@ -11,4 +13,14 @@ class CreateHeliosPressBlocks < ActiveRecord::Migration[8.0]
 
     add_index :helios_press_blocks, [:post_id, :position]
   end
+
+  private
+
+  def primary_and_foreign_key_types
+    config = Rails.configuration.generators
+    setting = config.options[config.orm][:primary_key_type]
+    primary_key_type = setting || :primary_key
+    foreign_key_type = setting || :bigint
+    [primary_key_type, foreign_key_type]
+  end
 end

data/db/migrate/20250510000003_create_helios_press_block_images.rb

@@ -1,7 +1,9 @@
 class CreateHeliosPressBlockImages < ActiveRecord::Migration[8.0]
   def change
-    create_table :helios_press_block_images do |t|
-      t.references :block, null: false, foreign_key: { to_table: :helios_press_blocks }
+    primary_key_type, foreign_key_type = primary_and_foreign_key_types
+
+    create_table :helios_press_block_images, id: primary_key_type do |t|
+      t.references :block, null: false, foreign_key: { to_table: :helios_press_blocks }, type: foreign_key_type
       t.integer :position, null: false
       t.text :caption
 
@@ -10,4 +12,14 @@ class CreateHeliosPressBlockImages < ActiveRecord::Migration[8.0]
 
     add_index :helios_press_block_images, [:block_id, :position]
   end
+
+  private
+
+  def primary_and_foreign_key_types
+    config = Rails.configuration.generators
+    setting = config.options[config.orm][:primary_key_type]
+    primary_key_type = setting || :primary_key
+    foreign_key_type = setting || :bigint
+    [primary_key_type, foreign_key_type]
+  end
 end

data/db/migrate/20250526000001_add_image_ingestion_to_helios_press.rb

@@ -0,0 +1,6 @@
+class AddImageIngestionToHeliosPress < ActiveRecord::Migration[8.0]
+  def change
+    add_column :helios_press_block_images, :reference_key, :string
+    add_index :helios_press_block_images, [:block_id, :reference_key], unique: true
+  end
+end

data/lib/helios/press/version.rb

@@ -1,5 +1,5 @@
 module Helios
   module Press
-    VERSION = "0.2"
+    VERSION = "0.4"
   end
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: helios-press
 version: !ruby/object:Gem::Version
-  version: '0.2'
+  version: '0.4'
 platform: ruby
 authors:
 - Jason Fleetwood-Boldt
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -37,6 +38,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: nokogiri
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.13'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.13'
 - !ruby/object:Gem::Dependency
   name: helios-videos
   requirement: !ruby/object:Gem::Requirement
@@ -97,6 +112,7 @@ files:
 - app/models/helios/press/block.rb
 - app/models/helios/press/block_image.rb
 - app/models/helios/press/post.rb
+- app/services/helios/press/image_ingestor.rb
 - app/views/helios/press/admin/blocks/_block.html.erb
 - app/views/helios/press/admin/blocks/_image_block.html.erb
 - app/views/helios/press/admin/blocks/_image_item.html.erb
@@ -121,6 +137,7 @@ files:
 - db/migrate/20250510000001_create_helios_press_posts.rb
 - db/migrate/20250510000002_create_helios_press_blocks.rb
 - db/migrate/20250510000003_create_helios_press_block_images.rb
+- db/migrate/20250526000001_add_image_ingestion_to_helios_press.rb
 - lib/helios-press.rb
 - lib/helios/press.rb
 - lib/helios/press/configuration.rb
@@ -133,6 +150,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/heliosdev-shop/helios-press
   source_code_uri: https://github.com/heliosdev-shop/helios-press
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -147,7 +165,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: Multi-block blog post editor for Rails with drag-to-reorder
 test_files: []