labimotion 2.3.0 → 2.4.0.rc11

data/lib/labimotion/apis/user_klass_settings_api.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'labimotion/version'
+
+module Labimotion
+  # Per-user, per-klass UI settings API (toolbar Overview/Arrange visibility, and
+  # the default inline attributes of a linked element).
+  # Every route is scoped to the authenticated user via created_by, so a user
+  # only ever reads/writes their own setting; no klass-edit permission needed.
+  class UserKlassSettingsAPI < Grape::API
+    helpers Labimotion::ParamHelpers
+
+    helpers do
+      def settings_scope
+        Labimotion::UserKlassSetting.where(created_by: current_user.id)
+      end
+
+      # Only the sub-settings actually present in the request are written, so a
+      # save carrying just one of them leaves the other untouched. Absent reads
+      # as "leave alone"; an empty linked_el_attrs array reads as "clear".
+      def submitted_settings(settings)
+        settings = (settings || {}).transform_keys(&:to_s)
+        toolbar = settings[Labimotion::Constants::UserKlassSetting::TOOLBAR]
+        attrs = settings[Labimotion::Constants::UserKlassSetting::LINKED_EL_ATTRS]
+        {}.tap do |result|
+          result[Labimotion::Constants::UserKlassSetting::TOOLBAR] = toolbar if toolbar.is_a?(Hash)
+          if attrs.is_a?(Array)
+            result[Labimotion::Constants::UserKlassSetting::LINKED_EL_ATTRS] = normalize_linked_el_attrs(attrs)
+          end
+        end
+      end
+
+      # Persist only the identity of each attribute. The values are resolved live
+      # on every load, and the label is refreshed from the template alongside them.
+      def normalize_linked_el_attrs(attrs)
+        attrs.filter_map do |attr|
+          attr = attr.transform_keys(&:to_s) if attr.respond_to?(:transform_keys)
+          next unless attr.is_a?(Hash) && attr['key'].present?
+
+          { 'source' => attr['source'], 'key' => attr['key'], 'label' => attr['label'] }
+        end
+      end
+    end
+
+    resource :user_klass_settings do
+      desc 'Fetch the current user UI setting for a klass'
+      params do
+        requires :klass, type: String, values: Labimotion::Constants::Klass::USER_SETTINGS, desc: 'Klass type'
+        requires :identifier, type: String, desc: 'Klass identifier'
+      end
+      get 'fetch' do
+        error!('401 Unauthorized', 401) unless current_user
+
+        record = settings_scope.find_by(klass: params[:klass], klass_identifier: params[:identifier])
+        data = record ? Labimotion::UserKlassSettingEntity.represent(record) : nil
+        { mc: 'ss00', data: data }
+      rescue StandardError => e
+        Labimotion.log_exception(e, current_user)
+        { mc: 'se00', msg: e.message, data: nil }
+      end
+
+      desc 'Upsert the current user UI setting for a klass'
+      params do
+        use :user_klass_settings_save
+      end
+      post 'save' do
+        error!('401 Unauthorized', 401) unless current_user
+
+        record = settings_scope.find_or_initialize_by(
+          klass: params[:klass], klass_identifier: params[:klass_identifier]
+        )
+        record.klass_label = params[:klass_label] if params[:klass_label]
+        record.created_by ||= current_user.id
+        record.settings = (record.settings || {}).merge(submitted_settings(params[:settings]))
+        record.save!
+        { mc: 'ss00', data: Labimotion::UserKlassSettingEntity.represent(record) }
+      rescue StandardError => e
+        Labimotion.log_exception(e, current_user)
+        { mc: 'se00', msg: e.message, data: {} }
+      end
+
+      desc 'List all UI settings of the current user'
+      get 'list' do
+        error!('401 Unauthorized', 401) unless current_user
+
+        { mc: 'ss00', data: Labimotion::UserKlassSettingEntity.represent(settings_scope.to_a) }
+      rescue StandardError => e
+        Labimotion.log_exception(e, current_user)
+        { mc: 'se00', msg: e.message, data: [] }
+      end
+    end
+  end
+end

data/lib/labimotion/conf.rb

@@ -3,4 +3,9 @@
 ## Labimotion Configuration
 module Labimotion
   KLASSES_JSON = Rails.root.join('public', 'klasses.json').to_s.freeze # Rails.root.join('app/packs/klasses.json').to_s.freeze
+
+  # One JSON file per ontology root, holding the subtree an "ontology-select"
+  # field may offer. Sits under the host's public/ontologies, which the ELN
+  # already gitignores and already lets this gem write to (see KLASSES_JSON).
+  ONTOLOGY_ROOTS_DIR = Rails.public_path.join('ontologies', 'roots').to_s.freeze
 end

data/lib/labimotion/constants.rb

@@ -17,6 +17,14 @@ module Labimotion
       CV = 'Cyclic Voltammetry'
     end
 
+    # The element cover selection (labimotion#259): cap and source vocabulary
+    # of `metadata.cover_images` entries. Mirrored by the chem-generic-ui
+    # cover-image picker (chem-generic-ui#1050) — keep them in sync.
+    module CoverImage
+      SOURCES = %w[attachment analysis].freeze
+      MAX = 3
+    end
+
     module Mapper
       NMR_CONFIG = ::File.join(__dir__, 'libs', 'data', 'mapper', 'Source.json').freeze
       WIKI_CONFIG = ::File.join(__dir__, 'libs', 'data', 'mapper', 'Chemwiki.json').freeze
@@ -27,6 +35,62 @@ module Labimotion
       SEGMENT = 'SegmentKlass'
       DATASET = 'DatasetKlass'
       ALL = [ELEMENT, SEGMENT, DATASET].freeze
+
+      # Standard ELN elements (sample, reaction, molecule, ...) have no klass
+      # model. Per-user settings that key on one use this pseudo-type, with the
+      # permit-target key itself as the klass identifier — see
+      # Labimotion::UserKlassSetting.
+      PERMIT_TARGET = 'PermitTarget'
+      USER_SETTINGS = [ELEMENT, SEGMENT, DATASET, PERMIT_TARGET].freeze
+    end
+
+    # The independent sub-settings held side by side in
+    # user_klass_settings.settings. A save writes only the ones it carries.
+    #
+    # Named for the table: these are the sub-keys of a per-user, per-KLASS row.
+    # The per-user, klass-independent settings are a different table with its own
+    # key list — see UserSettingKey below.
+    module UserKlassSetting
+      TOOLBAR = 'toolbar'
+      LINKED_EL_ATTRS = 'linked_el_attrs'
+    end
+
+    # The `key` column of user_settings: one row per user per key, each owning an
+    # independent `settings` jsonb. A feature claims a key here and nothing else
+    # in the table can disturb it, which is the point of splitting by row rather
+    # than sharing one blob — a large layer library and a stored credential have
+    # no reason to be rewritten by each other's saves.
+    module UserSettingKey
+      # Per-user AI settings: model, personal API key (encrypted), provider
+      # endpoint. Read and written through Labimotion::UserAiSettings.
+      AI = 'ai'
+      # A user's own layers — visible to them alone, not published to a template.
+      MY_LAYERS = 'my_layers'
+    end
+
+    # The independent sub-settings held side by side in a KLASS's own `settings`
+    # jsonb (element_klasses / segment_klasses / dataset_klasses). A save
+    # shallow-merges, so writing one never disturbs the others.
+    module KlassSetting
+      LAYER_FUNCTIONS = 'layer_functions'
+      COVER_IMAGE = 'cover_image'
+      # Template-specific guidance for the AI data auto-fill, written by the
+      # designer and read by Labimotion::AiTemplate.fill.
+      AI_FILL_PROMPT = 'ai_fill_prompt'
+    end
+
+    # The designer-right families as keyed in `users.generic_admin` (host-owned jsonb) and
+    # read by authenticate_admin!. FAMILY_OF answers which family gates a klass type.
+    module Family
+      ELEMENT = 'elements'
+      SEGMENT = 'segments'
+      DATASET = 'datasets'
+      ALL = [ELEMENT, SEGMENT, DATASET].freeze
+      FAMILY_OF = {
+        Klass::ELEMENT => ELEMENT,
+        Klass::SEGMENT => SEGMENT,
+        Klass::DATASET => DATASET
+      }.freeze
     end
   end
 end

data/lib/labimotion/entities/application_entity.rb

@@ -8,6 +8,14 @@ module Labimotion
     # Common condition for fields that should not be displayed in list views
     DISPLAYED_IN_LIST_CONDITION = { unless: :displayed_in_list }.freeze
 
+    # Ownership is opt-in per call site and deliberately does NOT reuse `displayed_in_list`.
+    # That option is passed as `true` on the payloads submitted to the central Template Hub
+    # (labimotion_hub_api.rb:76, :103), so keying ownership on it would ship local user
+    # identity off-instance; and it is hardcoded `false` on all three Designer list endpoints,
+    # which are the only places ownership is wanted. Off by default, so `download_klass`
+    # exports and Hub submissions stay clean without having to opt out.
+    WITH_OWNERSHIP_CONDITION = { if: :with_ownership }.freeze
+
     # ISO 8601. A zone *name* (strftime '%Z', e.g. "UTC") is not a valid ISO zone designator, so
     # clients parsing it with moment.js fall back to `new Date()` — engine-specific behaviour.
     ELN_TIMESTAMP_FORMAT = '%Y-%m-%dT%H:%M:%S%z'

data/lib/labimotion/entities/eln_element_entity.rb

@@ -68,6 +68,12 @@ module Labimotion
             object.properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS][idx] =
               set_table(field, field_table_samples, Labimotion::Prop::SAMPLE)
           end
+
+          field_table_elements = field[Labimotion::Prop::SUBFIELDS].select { |ss| ss['type'] == Labimotion::FieldType::DRAG_ELEMENT }
+          if field_table_elements.present?
+            object.properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS][idx] =
+              Labimotion::Serializer.set_table_element(field, field_table_elements)
+          end
         end
       end
       object.properties

data/lib/labimotion/entities/generic_klass_entity.rb

@@ -9,6 +9,132 @@ module Labimotion
     expose :properties_template, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose :properties_release, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose :metadata, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
+    expose :settings, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose_timestamps(timestamp_fields: %i[released_at created_at updated_at sync_time])
+
+    expose :created_by, **WITH_OWNERSHIP_CONDITION
+    expose :owner, **WITH_OWNERSHIP_CONDITION
+
+    # The capability block the grid and toolbars key off — never the raw level, so a policy
+    # change is one edit to ShareResolver::REQUIRED_LEVEL and every button follows. Exposed
+    # only when the list endpoint preloaded a share context: absent on exports and Hub
+    # submissions by construction (same reasoning as WITH_OWNERSHIP_CONDITION), and absent on
+    # hosts that have not run the klass_shares migration, whose payloads stay byte-identical
+    # to Phase 0.
+    expose :current_user_permission, if: :share_context
+    # Plain symbols rather than ShareResolver::REQUIRED_LEVEL.keys: referencing that constant
+    # in the class body would chain-autoload KlassShare (an ActiveRecord model) just to load
+    # this entity, which the gem's Rails-less spec harness cannot do. The blocks only run when
+    # a share context was preloaded, so inside them the constants are safe.
+    %i[write release release_minor deactivate destroy manage].each do |action|
+      expose "can_#{action}", if: :share_context do |object, options|
+        context = options[:share_context]
+        key = Labimotion::KlassShare.key_of(object)
+        level = context[:levels][key]
+        if context[:admin]
+          # Administrator = implicit owner everywhere.
+          true
+        elsif !context[:has_owner].include?(key)
+          # Owner-less templates keep the legacy designer-wide rights (permanent fallback) —
+          # which the ungated lists' non-designer readers never held, so the grid must not
+          # offer them buttons the server will 401.
+          (context[:legacy] || {})[key.split(':').first] == true
+        else
+          !level.nil? && level >= Labimotion::ShareResolver::REQUIRED_LEVEL[action]
+        end
+      end
+    end
+
+    # How many people are waiting for access to this template, for the owner only — everyone
+    # else reads 0, because ShareResolver scopes the count to the requesting user's own owner
+    # rows and nobody else can act on it. It rides the payload the grid already fetches, so
+    # the Share button stays coloured across a reload without a call of its own. A block for
+    # the same reason as the capabilities above: naming KlassShare in the class body would
+    # chain-autoload an ActiveRecord model into the Rails-less spec harness. Absent without a
+    # share context, exactly like its neighbours.
+    expose :pending_request_count, if: :share_context do |object, options|
+      (options[:share_context][:pending_requests] || {})[Labimotion::KlassShare.key_of(object)] || 0
+    end
+
+    # `state` is what the grid badges on: a template whose owner left the institute has nobody
+    # to ask, which is the case ownership transfer exists to resolve.
+    #
+    # With a share context the owner is the permission_level=30 share row — the transferable
+    # right — and `created_by` stays exposed above as immutable provenance; the two diverge
+    # permanently after the first transfer. Without a context (host not migrated, or an
+    # endpoint that predates shares) the Phase 0 behaviour stands: `created_by` is the owner.
+    def owner
+      return owner_from_share if share_context
+
+      owner_from_created_by
+    end
+
+    # The level label, or nil when the user has no row at all. Note the fourth answer:
+    # `'requested'` — a level-0 row is a standing access request, not access, so a client
+    # must compare the level rather than test this string for truthiness.
+    def current_user_permission
+      level = share_context[:levels][Labimotion::KlassShare.key_of(object)]
+      level && Labimotion::KlassShare::LEVELS.key(level)&.to_s
+    end
+
+    private
+
+    def share_context
+      options[:share_context]
+    end
+
+    def owner_from_share
+      ref = share_context[:owners][Labimotion::KlassShare.key_of(object)]
+      return nil if ref.nil? && !share_context[:has_owner].include?(Labimotion::KlassShare.key_of(object))
+      # The ref keeps the share row's user id even when the user record cannot be resolved,
+      # so the transfer flow still knows who the row points at.
+      return { id: ref&.id, name: nil, name_abbreviation: nil, state: 'unknown' } if ref.nil? || ref.user.nil?
+
+      user_hash(ref.id, ref.user)
+    end
+
+    def owner_from_created_by
+      user_id = object.created_by
+      return nil if user_id.blank?
+
+      user = owners_map[user_id] || Labimotion::OwnerResolver.find(user_id)
+      return { id: user_id, name: nil, name_abbreviation: nil, state: 'unknown' } if user.nil?
+
+      user_hash(user_id, user)
+    end
+
+    def user_hash(user_id, user)
+      {
+        id: user_id,
+        name: user.name,
+        name_abbreviation: user.name_abbreviation,
+        state: owner_state(user)
+      }
+    end
+
+    def owners_map
+      options[:owners] || {}
+    end
+
+    # All three columns are host-owned and none is guaranteed: `deleted_at` only exists if the
+    # host's User is acts_as_paranoid (the same assumption OwnerResolver guards),
+    # `account_active` postdates some deployments, and `type` is there only on an STI User.
+    # A missing column means "nothing says otherwise", not a 500 on the whole Designer grid.
+    def owner_state(user)
+      return 'deleted' if user.respond_to?(:deleted_at) && user.deleted_at.present?
+      # `account_active` is nil on accounts predating the column and on non-Person types;
+      # only an explicit false means deactivated.
+      return 'deactivated' if user.respond_to?(:account_active) && user.account_active == false
+      # An admin-owned template has an owner who is neither gone nor disabled, so it read
+      # `active` and appeared in no banner list — yet a designer refused on it is told by
+      # `sc11` to ask that owner, and the request comes back 422: ELN's channel_type-8 fan-out
+      # inserts notifications for `type = 'Person'` only. Nothing told anyone that a transfer
+      # is what this template needs. Ordered last of the three: a deleted or deactivated admin
+      # is deleted or deactivated first. A blank `type` counts as unnotifiable too, because
+      # that same `type = 'Person'` filter skips it just as surely.
+      return 'unnotifiable' if user.respond_to?(:type) && user.type != 'Person'
+
+      'active'
+    end
   end
 end

data/lib/labimotion/entities/klass_share_entity.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'labimotion/entities/application_entity'
+module Labimotion
+  # One collaborator row in the Share modal. Exposes both the integer level and its label so
+  # the frontend neither hardcodes the numeric mapping nor loses the ordering the integers
+  # carry. The user block mirrors the owner block on GenericKlassEntity, `state` included —
+  # a share held by a departed user renders greyed out, it is never deleted (the account can
+  # be undeleted, and its shares should come back with it).
+  class KlassShareEntity < Labimotion::ApplicationEntity
+    expose :id, :klass_type, :klass_id, :created_by
+    expose :permission
+    expose :permission_level_value, as: :permission_level
+    expose :user
+    expose_timestamps(timestamp_fields: %i[created_at])
+
+    def permission
+      value = object.permission_level
+      value.is_a?(Integer) ? Labimotion::KlassShare::LEVELS.key(value)&.to_s : value.to_s
+    end
+
+    def permission_level_value
+      object.level
+    end
+
+    def user
+      resolved = options[:users]&.[](object.shared_with_id) ||
+                 Labimotion::OwnerResolver.find(object.shared_with_id)
+      return { id: object.shared_with_id, name: nil, name_abbreviation: nil, state: 'unknown' } if resolved.nil?
+
+      {
+        id: object.shared_with_id,
+        name: resolved.name,
+        name_abbreviation: resolved.name_abbreviation,
+        state: user_state(resolved)
+      }
+    end
+
+    private
+
+    def user_state(user)
+      return 'deleted' if user.respond_to?(:deleted_at) && user.deleted_at.present?
+      return 'deactivated' if user.respond_to?(:account_active) && user.account_active == false
+
+      'active'
+    end
+  end
+end

data/lib/labimotion/entities/properties_entity.rb

@@ -20,6 +20,7 @@ module Labimotion
 
     def process_fields(key, layer)
       process_sample_and_molecule_fields(key, layer)
+      process_linked_attr_fields(key, layer)
       process_reaction_fields(key, layer)
       process_table_fields(key, layer)
       # process_voc_fields(key, layer)
@@ -32,6 +33,18 @@ module Labimotion
       end
     end
 
+    # Resolve the linked attributes a user chose to surface inline on a drag field
+    # (stored as value['el_attrs']). Only the selection is persisted; the current
+    # values are refreshed here from the linked element on every load. Works for
+    # drag_element (generic element or any permit-target type) as well as
+    # drag_sample / drag_molecule.
+    def process_linked_attr_fields(key, layer)
+      select_fields(layer, [Labimotion::FieldType::DRAG_ELEMENT, Labimotion::FieldType::DRAG_SAMPLE,
+                            Labimotion::FieldType::DRAG_MOLECULE]).each do |field, idx|
+        update_linked_attr_field(key, field, idx)
+      end
+    end
+
     def process_reaction_fields(key, layer)
       select_fields(layer, [Labimotion::FieldType::SYS_REACTION]).each do |field, idx|
         update_reaction_field(key, field, idx)
@@ -80,6 +93,61 @@ module Labimotion
                          })
     end
 
+    def update_linked_attr_field(key, field, idx)
+      return unless field['value'].is_a?(Hash)
+
+      attrs = field.dig('value', 'el_attrs')
+      el_klass = field.dig('value', 'el_klass')
+      el_id = field.dig('value', 'el_id')
+      el_type = field.dig('value', 'el_type')
+      linked = Labimotion::LinkedElement.new(el_klass, el_id, el_type)
+
+      # A missing el_attrs means the user never picked anything for this link, so
+      # their My LabIMotion default applies. An explicit [] means they picked none
+      # — the two must not collapse, or clearing a selection would not stick.
+      from_default = attrs.nil?
+      attrs = default_linked_attrs(el_klass, el_type) if from_default
+      return unless attrs.is_a?(Array) && attrs.present?
+      return unless object.properties.dig(Labimotion::Prop::LAYERS, key, Labimotion::Prop::FIELDS, idx,
+                                          'value').present?
+
+      resolved = linked.resolve(attrs)
+      resolved = resolved.map { |attr| mark_default(attr) } if from_default
+      object.properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS][idx]['value']['el_attrs'] = resolved
+    end
+
+    def mark_default(attr)
+      attr.is_a?(Hash) ? attr.merge(Labimotion::LinkedElement::IS_DEFAULT => true) : attr
+    end
+
+    # Keyed by what the drag field itself stores — el_klass for a generic element
+    # or a standard type, el_type for drag_molecule, which omits el_klass. Read
+    # straight off the preloaded map rather than via LinkedElement#target_key, so
+    # a field with no default costs no query.
+    def default_linked_attrs(el_klass, el_type)
+      map = default_linked_attrs_map
+      return [] if map.empty?
+
+      map[el_klass.to_s] || map[el_type.to_s] || []
+    end
+
+    # The current user's defaults for every linked target, loaded once per
+    # represented object. Skipped when no user is in scope (this entity is also
+    # rendered from contexts that pass none, e.g. Hub submissions and exports) and
+    # for list views, which don't render the inline attributes and would otherwise
+    # pay the lookup once per row.
+    def default_linked_attrs_map
+      return @default_linked_attrs_map if defined?(@default_linked_attrs_map)
+
+      user_id = options[:current_user]&.id
+      @default_linked_attrs_map =
+        if user_id.blank? || displayed_in_list?
+          {}
+        else
+          Labimotion::UserKlassSetting.linked_el_attrs_by_el_klass(user_id)
+        end
+    end
+
     def update_reaction_field(key, field, idx)
       return unless field['value'].is_a?(Hash)
 
@@ -116,10 +184,18 @@ module Labimotion
       field_table_samples = field[Labimotion::Prop::SUBFIELDS].select do |ss|
         ss['type'] == Labimotion::FieldType::DRAG_SAMPLE
       end
-      return unless field_table_samples.present?
+      if field_table_samples.present?
+        object.properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS][idx] =
+          set_table(field, field_table_samples, Labimotion::Prop::SAMPLE)
+      end
+
+      field_table_elements = field[Labimotion::Prop::SUBFIELDS].select do |ss|
+        ss['type'] == Labimotion::FieldType::DRAG_ELEMENT
+      end
+      return unless field_table_elements.present?
 
       object.properties[Labimotion::Prop::LAYERS][key][Labimotion::Prop::FIELDS][idx] =
-        set_table(field, field_table_samples, Labimotion::Prop::SAMPLE)
+        Labimotion::Serializer.set_table_element(field, field_table_elements)
     end
 
     def update_voc_field(key, field, idx)

data/lib/labimotion/entities/segment_entity.rb

@@ -9,9 +9,17 @@ module Labimotion
     expose :properties, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose :properties_release, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
     expose :metadata, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
+    expose :settings, **DISPLAYED_IN_LIST_CONDITION, anonymize_with: {}
 
     def klass_label
       object.segment_klass.label
     end
+
+    # Saved segments are serialized without their klass, so surface the
+    # template-scoped settings here; guarded for hosts not yet migrated.
+    def settings
+      klass = object.segment_klass
+      klass.respond_to?(:settings) ? klass.settings || {} : {}
+    end
   end
 end

data/lib/labimotion/entities/user_klass_setting_entity.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require 'labimotion/entities/application_entity'
+module Labimotion
+  # Per-user, per-klass UI setting entity
+  class UserKlassSettingEntity < Labimotion::ApplicationEntity
+    expose :id, :klass, :klass_identifier, :klass_label, :settings
+    expose_timestamps(timestamp_fields: %i[created_at])
+  end
+end