labimotion 2.3.0 → 2.4.0.rc11

data/lib/labimotion/libs/ontology_terms.rb

@@ -0,0 +1,227 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'erb'
+
+module Labimotion
+  # Resolve the selectable vocabulary behind an "ontology-select" field.
+  #
+  # A template field pins ONE ontology root (its `ontology_term`); the picker in
+  # chem-generic-ui then offers that root and everything below it. The AI data-fill
+  # needs the same list — otherwise the model invents a plausible-sounding term that
+  # is not in the ontology and the field renders a value the user could never have
+  # chosen themselves.
+  #
+  # The whole subtree arrives in ONE request via `?hierarchicalAncestor=`, rather
+  # than the dozens of round trips a /children walk costs; the result set is the
+  # same terms, de-duplicated (a term with two parents appears twice in a walk).
+  #
+  # What comes back is handed to Labimotion::OntologyStore, which is what actually
+  # keeps it — so the picker and the auto-fill read one list instead of resolving
+  # the same subtree separately.
+  #
+  # Every failure path returns [] — no vocabulary simply means the field falls back
+  # to the free-text behaviour it had before, never a failed fill.
+  class OntologyTerms
+    DEFAULT_BASE_URL = 'https://api.terminology.tib.eu/api/v2'
+    # One page, sized past the largest root anyone points a field at (the biggest
+    # CHMO branch is ~650 terms).
+    PAGE_SIZE = 1000
+    REQUEST_TIMEOUT = 20
+    # Per-field and per-request budgets. A field aimed at a very general root would
+    # otherwise push tens of thousands of labels into the prompt and crowd out the
+    # document the model is supposed to be reading. Both limits SKIP a field rather
+    # than truncate its list: a partial vocabulary is the worst of both worlds — the
+    # missing terms become unproposable AND a correct answer naming one gets thrown
+    # away by validation. Sized well past any real root (the largest CHMO branch is
+    # ~650 terms).
+    MAX_TERMS_PER_FIELD = 1500
+    MAX_TERMS_TOTAL = 3000
+
+    class << self
+      # Selectable labels for one field's `ontology_term`, root included, sorted and
+      # de-duplicated. Accepts the shapes the designer writes: a { 'label', 'value' }
+      # hash, a bare string, or an ARRAY of either (a field may pin several roots).
+      #
+      # @return [Array<String>] [] when nothing is configured, the subtree is beyond
+      #   MAX_TERMS_PER_FIELD, or the service fails
+      def labels_for(ontology_term)
+        roots = parse(ontology_term)
+        return [] if roots.empty?
+
+        labels = roots.flat_map { |root| Labimotion::OntologyStore.labels(root) }
+                      .uniq(&:downcase).sort_by(&:downcase)
+        return labels if labels.size <= MAX_TERMS_PER_FIELD
+
+        log("subtree of #{roots.map { |r| r[:iri] }.join(', ')} has #{labels.size} terms " \
+            "(over #{MAX_TERMS_PER_FIELD}); leaving the field unconstrained")
+        []
+      end
+
+      # Every node of one root's subtree, the root included, as the store keeps
+      # them: { 'iri', 'label', 'description', 'parent' }. The root is selectable
+      # in the picker, so it has to be in the list the model is offered too.
+      #
+      # Two requests: the root is not in its own descendant query.
+      def subtree(root)
+        node = root_node(root)
+        return [] if node.nil?
+
+        nodes = ([node] + descendant_nodes(root)).uniq { |n| n['iri'] }
+        resolve_parents(nodes, node['iri'])
+      end
+
+      # Split a configured ontology_term into [{ ontology:, iri: }, ...]. Mirrors
+      # parseOntologyTerm in chem-generic-ui/src/utils/ontologyApi.js, which is what
+      # actually wrote these strings.
+      def parse(ontology_term)
+        wrap_terms(ontology_term).filter_map { |term| parse_one(term) }
+      end
+
+      # Public because the store records which service a file came from, so a
+      # subtree stored against one host can be told apart from another's.
+      def base_url
+        cfg = (Rails.configuration.labimotion_ai if defined?(Rails) && Rails.respond_to?(:configuration))
+        (cfg.is_a?(Hash) && cfg[:ontology_base_url].presence) ||
+          ENV['LABIMOTION_ONTOLOGY_BASE_URL'].presence ||
+          DEFAULT_BASE_URL
+      rescue StandardError
+        DEFAULT_BASE_URL
+      end
+
+      private
+
+      # A field may pin one term or a list of them. `Array()` would tear the
+      # { 'label', 'value' } hash apart into pairs, so branch explicitly.
+      def wrap_terms(value)
+        return [] if value.nil?
+        return value if value.is_a?(Array)
+
+        [value]
+      end
+
+      def parse_one(term)
+        str = term_to_s(term)
+        return nil if str.empty?
+
+        ontology, iri = split_term(str)
+        return nil if ontology.to_s.empty? || iri.to_s.empty?
+
+        { ontology: ontology.downcase, iri: iri }
+      end
+
+      # A term is stored either as the { 'label' => .., 'value' => .. } hash the
+      # designer's picker writes, or as a bare string.
+      def term_to_s(term)
+        raw = term.is_a?(Hash) ? (term['value'] || term[:value]) : term
+        raw.to_s.strip
+      end
+
+      # "bao:class:<iri>" (what the designer writes) | "ont|<iri>" | a bare OBO IRI.
+      def split_term(str)
+        if (m = str.match(/\A([^:]+):class:(.+)\z/))
+          [m[1], m[2]]
+        elsif (parts = str.split('|')).size == 2
+          [parts[0].strip, parts[1].strip]
+        elsif (m = str.match(%r{obo/([A-Za-z]+)_}))
+          [m[1], str]
+        end
+      end
+
+      def root_node(root)
+        body = get("#{base_url}/ontologies/#{root[:ontology]}/classes/#{double_encode(root[:iri])}")
+        return nil unless body.is_a?(Hash)
+
+        node_from(body, root[:iri])
+      end
+
+      def descendant_nodes(root)
+        url = "#{base_url}/ontologies/#{root[:ontology]}/classes" \
+              "?hierarchicalAncestor=#{encode(root[:iri])}&size=#{PAGE_SIZE}"
+        body = get(url)
+        elements = body.is_a?(Hash) ? body['elements'] : nil
+        return [] unless elements.is_a?(Array)
+
+        elements.filter_map do |entry|
+          next unless entry.is_a?(Hash)
+          # An obsolete term is still served but must not be proposed: the picker
+          # does not offer it either.
+          next if entry['isObsolete']
+
+          node_from(entry)
+        end
+      end
+
+      # `parents` is carried only as far as resolve_parents, which turns the
+      # graph edges into the single one the picker can draw.
+      def node_from(entry, fallback_iri = nil)
+        label = normalize_label(entry['label'])
+        iri = entry['iri'].presence || fallback_iri
+        return nil if label.empty? || iri.blank?
+
+        {
+          'iri' => iri.to_s,
+          'label' => label,
+          'description' => normalize_label(entry['definition']),
+          'parents' => Array(entry['hierarchicalParent']).map(&:to_s)
+        }
+      end
+
+      # An ontology is a graph, not a tree: a term can have several parents, and
+      # only some of them are inside the subtree being stored. Keep the first one
+      # that IS inside so the picker has something to draw, and hang anything
+      # else off the root rather than dropping it — a term reachable from the
+      # root is selectable, whichever way it is reached.
+      def resolve_parents(nodes, root_iri)
+        inside = nodes.to_h { |n| [n['iri'], true] }
+        nodes.map do |node|
+          parents = node.delete('parents')
+          parent =
+            if node['iri'] == root_iri
+              nil
+            else
+              Array(parents).find { |p| p != node['iri'] && inside[p] } || root_iri
+            end
+          node.merge('parent' => parent)
+        end
+      end
+
+      # v2 returns a label as a string, a one-element array, or a language-tagged
+      # object — the same three shapes normalizeLabel handles on the client.
+      def normalize_label(raw)
+        first = raw.is_a?(Array) ? raw.first : raw
+        return '' if first.nil?
+        return first.to_s if first.is_a?(String) || first.is_a?(Numeric)
+
+        first.is_a?(Hash) ? (first['value'] || first[:value]).to_s : ''
+      end
+
+      # Best-effort note in log/labimotion.log; never raises, never blocks a fill.
+      def log(message)
+        Labimotion.logger.warn("OntologyTerms #{message}")
+      rescue StandardError
+        nil
+      end
+
+      def get(url)
+        response = HTTParty.get(url, timeout: REQUEST_TIMEOUT, follow_redirects: false)
+        return nil unless response.code == 200
+
+        JSON.parse(response.body)
+      rescue StandardError => e
+        Labimotion.log_exception(e)
+        nil
+      end
+
+      # A path segment carries the IRI double-encoded (TIB decodes once itself); a
+      # query parameter is encoded exactly once.
+      def double_encode(iri)
+        encode(encode(iri))
+      end
+
+      def encode(str)
+        ERB::Util.url_encode(str.to_s)
+      end
+    end
+  end
+end

data/lib/labimotion/libs/owner_resolver.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# `index_by` below is an ActiveSupport core extension, not plain Ruby. A booted host always
+# has it, so the omission was invisible in production, but relying on the host to have loaded
+# it is luck rather than contract -- and in the gem's own spec process it made this file
+# depend on whether some other spec had required grape first.
+require 'active_support/core_ext/enumerable'
+
+module Labimotion
+  ## OwnerResolver
+  # Builds the `owners:` option the klass entities read, so rendering a grid of N templates
+  # costs one user query instead of N. Deleted users are included on purpose: a template whose
+  # author has left still has to name somebody, otherwise the grid can only say "unknown" and
+  # an administrator has nothing to act on.
+  class OwnerResolver
+    def self.map_for(klasses)
+      map_for_ids(Array(klasses).filter_map { |klass| klass.try(:created_by) })
+    end
+
+    # Same map, from bare user ids — what ShareResolver feeds it, where the ids come from
+    # owner share rows rather than a created_by column.
+    def self.map_for_ids(ids)
+      ids = Array(ids).compact.uniq
+      return {} if ids.empty?
+
+      user_scope.where(id: ids).index_by(&:id)
+    rescue StandardError => e
+      # Ownership is decoration on a list that must still render.
+      Labimotion.log_exception(e)
+      {}
+    end
+
+    # Single-user fallback for the call sites that ask for ownership without preloading a map.
+    # Same soft-delete scope and same "never break the caller" contract as `map_for`.
+    def self.find(user_id)
+      return nil if user_id.blank?
+
+      user_scope.find_by(id: user_id)
+    rescue StandardError => e
+      Labimotion.log_exception(e)
+      nil
+    end
+
+    # `with_deleted` comes from acts_as_paranoid, which the host's User model may not use.
+    def self.user_scope
+      ::User.respond_to?(:with_deleted) ? ::User.with_deleted : ::User
+    end
+    private_class_method :user_scope
+  end
+end

data/lib/labimotion/libs/ownership_audit.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# `constantize` and `underscore` below are ActiveSupport core extensions, not plain Ruby.
+# A booted host always has them, so the omission is invisible in production, but the gem's
+# own spec process does not load them on its own.
+require 'active_support/core_ext/string/inflections'
+require 'labimotion/constants'
+
+module Labimotion
+  ## OwnershipAudit
+  # Reports templates whose `created_by` may no longer name the person who wrote them.
+  #
+  # Why this exists: until the fix in this same change, `upload_klass` merged
+  # `created_by: current_user.id` into the attributes it handed to `validate_klass`, whose
+  # *update* branch then wrote them wholesale — so every re-import of an existing template
+  # reassigned its authorship to whoever re-imported it. The fix stops new damage; it cannot
+  # undo what already happened, and `created_by` is both what the Owner column displays and
+  # what per-template ownership will be seeded from.
+  #
+  # What it can and cannot tell you: a klass revision records `created_by` as the user who
+  # *released* that revision, not the one who created the klass. So a mismatch between a
+  # klass's `created_by` and its earliest revision's is a **signal** that authorship moved,
+  # not proof — a template legitimately first released by a colleague looks the same. This is
+  # a report for a human to read. It gates nothing, changes nothing, and writes nothing.
+  #
+  # Run it from the host:
+  #   bundle exec rails runner 'Labimotion::OwnershipAudit.report'
+  class OwnershipAudit
+    def self.report(io = $stdout)
+      findings = Labimotion::Constants::Klass::ALL.flat_map { |klass_name| findings_for(klass_name) }
+      io.puts(format_report(findings))
+      findings
+    end
+
+    def self.findings_for(klass_name)
+      model = "Labimotion::#{klass_name}".constantize
+      revision_model = "Labimotion::#{klass_name}esRevision".constantize
+      foreign_key = "#{klass_name.underscore}_id"
+
+      model.all.filter_map do |klass|
+        first_revision = revision_model.where(foreign_key => klass.id).order(:created_at).first
+        next if first_revision.nil?
+        next if first_revision.created_by.blank? || klass.created_by == first_revision.created_by
+
+        {
+          klass: klass_name,
+          id: klass.id,
+          label: klass.label,
+          created_by: klass.created_by,
+          first_release_by: first_revision.created_by,
+          first_released_at: first_revision.created_at
+        }
+      end
+    rescue StandardError => e
+      Labimotion.log_exception(e)
+      []
+    end
+
+    def self.format_report(findings)
+      lines = ["Labimotion ownership audit — #{findings.size} template(s) to look at"]
+      lines << 'created_by differs from the user who released the earliest revision. ' \
+               'Expected for templates a colleague first released; suspicious for the rest.'
+      lines << ''
+      findings.each do |f|
+        lines << "#{f[:klass].ljust(13)} ##{f[:id].to_s.ljust(5)} " \
+                 "#{f[:label].to_s[0, 40].ljust(40)} created_by=#{f[:created_by]} " \
+                 "first_release_by=#{f[:first_release_by]} (#{f[:first_released_at]})"
+      end
+      lines.join("\n")
+    end
+    private_class_method :format_report
+  end
+end

data/lib/labimotion/libs/sample_association.rb

@@ -70,7 +70,50 @@ module Labimotion
       []
     end
 
+    ## Link the generic elements referenced by drag_element table columns to the
+    ## owning element, mirroring what layer-level drag_element fields do below.
+    def self.build_table_element(field_tables, current_user, element = nil)
+      els = []
+      return els if element.nil?
+
+      field_tables.each do |field|
+        next unless field['sub_values'].present? && field[Labimotion::Prop::SUBFIELDS].present?
+
+        field_table_elements = field[Labimotion::Prop::SUBFIELDS].select { |ss| ss['type'] == Labimotion::FieldType::DRAG_ELEMENT }
+        next unless field_table_elements.present?
+
+        col_ids = field_table_elements.map { |x| x.values[0] }
+        col_ids.each do |col_id|
+          field['sub_values'].each do |sub_value|
+            next unless sub_value[col_id].present? && sub_value[col_id]['value'].present? && sub_value[col_id]['value']['el_id'].present?
+
+            svalue = sub_value[col_id]['value']
+            sid = svalue['el_id']
+            next if sid == element.id
+
+            # drag_element may link a standard element (reaction, cell_line, ...);
+            # el_id is then NOT a Labimotion::Element id, so an ElementsElement row
+            # would associate an unrelated generic element that shares the id.
+            next if Labimotion::LinkedElement::MODELS.key?(svalue['el_klass'].to_s)
+
+            el = Labimotion::Element.find_by(id: sid)
+            next if el.nil?
+
+            Labimotion::ElementsElement.find_or_create_by(parent_id: element.id, element_id: el.id)
+            els << el.id
+          end
+        end
+      end
+      els
+    rescue StandardError => e
+      Labimotion.log_exception(e, current_user)
+      []
+    end
+
     def self.update_sample_association(properties, current_user, element = nil)
+      # Every element and segment properties save funnels through here, which
+      # makes it the one place guaranteed to see the payload before it is stored.
+      Labimotion::LinkedElement.strip_defaults(properties)
       sds = []
       els = []
       properties[Labimotion::Prop::LAYERS].keys.each do |key|
@@ -99,7 +142,10 @@ module Labimotion
           Labimotion::ElementsSample.find_or_create_by(element_id: element.id, sample_id: subsample.id) if element.present?
         end
         field_tables = properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS].select { |ss| ss['type'] == Labimotion::FieldType::TABLE }
-        sds << Labimotion::SampleAssociation.build_table_sample(field_tables, current_user, element) if element.present?
+        if element.present?
+          sds << Labimotion::SampleAssociation.build_table_sample(field_tables, current_user, element)
+          els << Labimotion::SampleAssociation.build_table_element(field_tables, current_user, element)
+        end
         field_elements = layer[Labimotion::Prop::FIELDS].select { |ss| ss['type'] == Labimotion::FieldType::DRAG_ELEMENT }
         field_elements.each do |field|
           idx = properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS].index(field)
@@ -109,6 +155,11 @@ module Labimotion
           sid = field.dig('value', 'el_id')
           next if element.nil? || sid.blank? || sid == element.id
 
+          # drag_element may link a standard element (reaction, cell_line, ...);
+          # el_id is then NOT a Labimotion::Element id, so an ElementsElement row
+          # would associate an unrelated generic element that shares the id.
+          next if Labimotion::LinkedElement::MODELS.key?(field.dig('value', 'el_klass').to_s)
+
           el = Labimotion::Element.find_by(id: sid)
           next if el.nil?
 

data/lib/labimotion/libs/share_notifier.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module Labimotion
+  # Courtesy notifications for share events (template-sharing.md §7), moved in
+  # from the host's Chemotion::TemplateShareAPI (chem-generic-ui#1040): the gem
+  # writes the share rows, so the gem announces them, and the two-call dance the
+  # Designer used to do (write to the gem, then call the host back to notify)
+  # collapses into the write.
+  #
+  # These messages buy awareness *outside* the Designer only — the toast in the
+  # main ELN. klass_shares is the record and the Designer reads the rows; it
+  # never reads or acks a Message. Nothing here may therefore fail a share:
+  # every public method rescues to nil, and an undeliverable notification is a
+  # notification not sent, never an error. Callers fire after the successful
+  # write and ignore the return value.
+  #
+  # The host models are reached by their bare names and only if they exist:
+  # a host without Message/Channel machinery (or one that has not run the
+  # channel migration) simply sends nothing. The channel is looked up by its
+  # literal subject — referencing Channel::TEMPLATE_SHARE_NOTIFICATION would
+  # raise on hosts whose Channel model predates the constant.
+  module ShareNotifier
+    # Must match the subject the host ELN's channel migration seeds
+    # (add_template_share_notification_channel; channel_type 8, the targeted
+    # per-user delivery branch of generate_notifications).
+    CHANNEL_SUBJECT = 'Template Share Notification'
+
+    # Fired for level changes too — the grant endpoint is an upsert and cannot
+    # tell a fresh share from a level change, so "granted you X access" stays
+    # honest for both.
+    def self.grant(klass:, actor:, user_ids:, level:)
+      label = template_label(klass)
+      ping(
+        actor: actor, user_ids: user_ids,
+        text: "#{actor.name} granted you #{level} access to the template '#{label}'."
+      )
+    rescue StandardError => e
+      Labimotion.log_exception(e, actor)
+      nil
+    end
+
+    def self.transfer(klass:, actor:, user_id:)
+      label = template_label(klass)
+      ping(
+        actor: actor, user_ids: [user_id],
+        text: "#{actor.name} transferred ownership of the template '#{label}' to you."
+      )
+    rescue StandardError => e
+      Labimotion.log_exception(e, actor)
+      nil
+    end
+
+    # The owner to ask: the klass_shares owner row, falling back to the
+    # immutable created_by for an owner-less template. A blank owner matches no
+    # user and channel_type-8 fan-out reaches Persons only, so an Admin owner
+    # gets no toast — they learn about the request when they next open the
+    # Designer, where the rows are the truth. The caller gates on `created`:
+    # the unique index dedupes rows, not messages, so only the ask that wrote
+    # the row earns a ping.
+    def self.request(klass:, actor:)
+      owner_id = Labimotion::KlassShare.owner_row_for(klass)&.shared_with_id ||
+                 klass.created_by
+      return if owner_id.nil?
+
+      label = template_label(klass)
+      ping(
+        actor: actor, user_ids: [owner_id],
+        text: "#{actor.name} asks for access to your template '#{label}'. " \
+              'You can grant it from the Share dialog in the Designer.'
+      )
+    rescue StandardError => e
+      Labimotion.log_exception(e, actor)
+      nil
+    end
+
+    # Plain Ruby, no ActiveSupport (`presence`/`try`): the host models are
+    # optional here, so the module must not assume the host's core extensions
+    # either — with them absent, a notification would silently never send.
+    def self.template_label(klass)
+      read_name(klass, :label) || read_name(klass, :name) || "##{klass.id}"
+    end
+
+    def self.read_name(klass, attribute)
+      return nil unless klass.respond_to?(attribute)
+
+      value = klass.public_send(attribute).to_s
+      value.strip.empty? ? nil : value
+    end
+
+    def self.ping(actor:, user_ids:, text:)
+      return unless defined?(::Message) && defined?(::Channel)
+
+      # Persons only (the fan-out inserts notifications for Persons alone), and
+      # never the actor: granting yourself a toast about your own click is
+      # noise, and a self-transfer is a no-op to announce.
+      recipients = ::User.where(type: 'Person', id: user_ids).ids - [actor.id]
+      return if recipients.empty?
+
+      channel = ::Channel.find_by(subject: CHANNEL_SUBJECT)
+      return if channel.nil?
+
+      ::Message.create_msg_notification(
+        channel_id: channel.id,
+        # The level rides inside message_content: create_msg_notification uses
+        # the content verbatim on this path, so a bare level: kwarg would be
+        # dropped and the toast would fall back to warning styling.
+        message_content: { data: text, level: 'info' },
+        message_from: actor.id,
+        message_to: recipients
+      )
+    end
+    private_class_method :ping, :template_label, :read_name
+  end
+end