lato_cms 3.0.6 → 3.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbcd0c46e947f128bf5c6334e7729fbbbe12682c3b2e89d4442bb7b1a73528a4
-  data.tar.gz: 040ad879939068be79b8078a3a011a40f49f8a35f7539e9d791904b4148df4c2
+  metadata.gz: 73f72c7845f56b80f62423a1709a3ea8d5bd80813d8c61b4eaf6af2b353d660c
+  data.tar.gz: f222800a0be54f4e7022ecebfe6259515e56fd82554d1784d7bf55fa1a65074e
 SHA512:
-  metadata.gz: 1644c351792d4ced7526999d47f250ebb09b3fd5f9de897818465bfa37e00b7623af635309a589b5fb8001ef5d7021c11f7e854738c6054eb719398dc46f8d98
-  data.tar.gz: 39131b5dd434621e95a147d27287c0479e06ca42f086f73906f185e0a0b64086bc134234315400dc56a6ef20dfab49a867a102eec522f4d41c5e986c9cf9c2f0
+  metadata.gz: 59fa3bb5a49ce31a770192a6708c59f95313d44896bb493bf0d009b523f950d8f3165609b38da4dbfa4c239c9e6f7d44f2f8bcd870c7d01c4a3b147d11877c7b
+  data.tar.gz: 2d31910d84e7df094b4c85ae3f790bcd8e47e2c66dd7cfd472f9c2fde5016b85b1fbb9de1c7a12a86e8946ea527ab0fe8d8434d6e3ab1e5683df9d1fb402731d

data/app/controllers/lato_cms/application_controller.rb

@@ -4,9 +4,11 @@ module LatoCms
     layout 'lato/application'
     before_action :authenticate_session
     before_action :authenticate_group
-    before_action :authenticate_lato_cms_admin
+    before_action :authenticate_lato_cms_access
     before_action { active_sidebar(:lato_cms); active_navbar(:lato_cms) }
 
+    helper_method :lato_cms_admin?
+
     def index
       redirect_to lato_cms.pages_path
     end
@@ -17,10 +19,23 @@ module LatoCms
       @query_pages ||= LatoCms::Page.for_lato_spaces_group(@session.get(:spaces_group_id))
     end
 
-    def authenticate_lato_cms_admin
-      return true if @session.user&.lato_cms_admin
+    # Section-level guard: any CMS role (operator or admin) may enter.
+    def authenticate_lato_cms_access
+      return true if @session.user&.lato_cms_access?
 
       redirect_to lato.root_path, alert: t('lato_cms.unauthorized_section')
     end
+
+    # Action-level guard for page management and translation links: admin only.
+    def authenticate_lato_cms_admin
+      return true if lato_cms_admin?
+
+      redirect_to lato_cms.pages_path, alert: t('lato_cms.unauthorized_action')
+    end
+
+    # Exposed to views to conditionally render admin-only controls.
+    def lato_cms_admin?
+      @session.user&.lato_cms_admin? || false
+    end
   end
 end

data/app/controllers/lato_cms/pages_controller.rb

@@ -1,6 +1,16 @@
 module LatoCms
   class PagesController < ApplicationController
+    # Page management and translation links are reserved to the admin role.
+    # Operators keep read access plus field editing and component toggles.
+    ADMIN_ONLY_ACTIONS = %i[
+      create create_action
+      update update_action
+      destroy_action
+      translations link_translation_action unlink_translation_action
+    ].freeze
+
     before_action { active_sidebar(:lato_cms_pages) }
+    before_action :authenticate_lato_cms_admin, only: ADMIN_ONLY_ACTIONS
 
     def index
       pages = query_pages

data/app/views/lato_cms/pages/index.html.erb

@@ -13,7 +13,7 @@
   </div>
   <div class="card-body">
     <%= lato_index @pages,
-      custom_actions: {
+      custom_actions: lato_cms_admin? ? {
         create: {
           path: lato_cms.pages_create_path,
           icon: 'bi bi-plus',
@@ -25,7 +25,7 @@
             action_title: t('lato_cms.page_create_title')
           }
         }
-      },
+      } : {},
       pagination_options: [10, 20, 50, 100]
     %>
   </div>

data/app/views/lato_cms/pages/show.html.erb

@@ -20,8 +20,10 @@
             <i class="bi bi-globe fs-1 mb-3"></i>
             <p class="mb-1"><%= t('lato_cms.show_no_preview_title') %></p>
             <p class="small"><%= t('lato_cms.show_no_preview_description').html_safe %></p>
-            <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-primary mt-2',
-              data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+            <% if lato_cms_admin? %>
+              <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-primary mt-2',
+                data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+            <% end %>
           </div>
         </div>
       <% end %>
@@ -35,7 +37,7 @@
           <div class="d-flex align-items-center gap-2">
             <%= lato_cms_page_locale_dropdown(@page) %>
             <span class="vr"></span>
-            <%= lato_cms_page_actions_dropdown(@page, show_edit: true, show_translations: true, show_delete: true, hide_show: true) %>
+            <%= lato_cms_page_actions_dropdown(@page, show_edit: lato_cms_admin?, show_translations: lato_cms_admin?, show_delete: lato_cms_admin?, hide_show: true) %>
             <span class="vr"></span>
             <button class="btn btn-sm btn-outline-primary d-none"
                     title="<%= t('lato_cms.show_hide_panel_tooltip') %>"
@@ -59,15 +61,19 @@
               <i class="bi bi-file-earmark-code fs-1 mb-3 d-block"></i>
               <p class="mb-1"><%= t('lato_cms.show_no_template_title') %></p>
               <p class="small"><%= t('lato_cms.show_no_template_description') %></p>
-              <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-primary mt-2',
-                data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+              <% if lato_cms_admin? %>
+                <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-primary mt-2',
+                  data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+              <% end %>
             </div>
           <% elsif !@page.template_available? %>
             <div class="alert alert-warning">
               <i class="bi bi-exclamation-triangle me-1"></i>
               <%= t('lato_cms.show_template_unavailable', template_id: @page.template_id) %>
-              <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-warning ms-2',
-                data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+              <% if lato_cms_admin? %>
+                <%= link_to t('lato_cms.show_edit_settings_cta'), lato_cms.pages_update_path(@page), class: 'btn btn-sm btn-outline-warning ms-2',
+                  data: { lato_action_target: 'trigger', turbo_frame: dom_id(@page, 'form'), action_title: t('lato_cms.page_update_title') } %>
+              <% end %>
             </div>
             <% existing_fields = @page.fields.group_by(&:template_component_id) %>
             <% if existing_fields.any? %>

data/config/locales/en.yml

@@ -1,5 +1,13 @@
 en:
+  activerecord:
+    attributes:
+      lato/user:
+        lato_cms_admin_role: Lato CMS role
   lato_cms:
+    admin_roles:
+      none: No access
+      operator: Operator
+      admin: Administrator
     cta_show: Show
     cta_edit: Edit
     cta_update: Update
@@ -11,6 +19,7 @@ en:
     fields_saved: Fields saved successfully
     page_deleted: Page deleted successfully
     unauthorized_section: You do not have access to this section.
+    unauthorized_action: You do not have permission to perform this action.
     page_delete_failed: Failed to delete page
     api_page_not_found: Page not found
     pages_index_title: Pages

data/config/locales/it.yml

@@ -1,5 +1,13 @@
 it:
+  activerecord:
+    attributes:
+      lato/user:
+        lato_cms_admin_role: Ruolo Lato CMS
   lato_cms:
+    admin_roles:
+      none: Nessun accesso
+      operator: Operatore
+      admin: Amministratore
     cta_show: Visualizza
     cta_edit: Modifica
     cta_update: Aggiorna
@@ -11,6 +19,7 @@ it:
     fields_saved: Campi salvati con successo
     page_deleted: Pagina eliminata con successo
     unauthorized_section: Non hai accesso a questa sezione.
+    unauthorized_action: Non hai i permessi per eseguire questa azione.
     page_delete_failed: Impossibile eliminare la pagina
     api_page_not_found: Pagina non trovata
     pages_index_title: Pagine

data/db/migrate/20260712092241_change_lato_cms_admin_to_lato_cms_admin_role_on_lato_user.rb

@@ -0,0 +1,18 @@
+class ChangeLatoCmsAdminToLatoCmsAdminRoleOnLatoUser < ActiveRecord::Migration[8.1]
+  def up
+    add_column :lato_users, :lato_cms_admin_role, :integer, default: 0, null: false
+
+    # Backfill: true -> 1, false/nil -> 0 (already the column default)
+    execute 'UPDATE lato_users SET lato_cms_admin_role = 1 WHERE lato_cms_admin = 1'
+
+    remove_column :lato_users, :lato_cms_admin
+  end
+
+  def down
+    add_column :lato_users, :lato_cms_admin, :boolean, default: false
+
+    execute 'UPDATE lato_users SET lato_cms_admin = 1 WHERE lato_cms_admin_role = 1'
+
+    remove_column :lato_users, :lato_cms_admin_role
+  end
+end

data/lib/lato_cms/config.rb

@@ -3,11 +3,18 @@ module LatoCms
   # This class contains the default configuration of the engine.
   ##
   class Config
-    attr_accessor :locales, :templates_path
+    attr_accessor :locales, :templates_path, :admin_roles
 
     def initialize
       @locales = [:en]
       @templates_path = 'config/lato_cms'
+
+      # Admin roles exposed on Lato::User#lato_cms_admin_role and rendered
+      # as a select by lato_users. Ordered map of role key => integer value;
+      # labels are resolved via i18n (lato_cms.admin_roles.<key>).
+      # `operator` has read/edit access; `admin` also manages pages
+      # (create, update, delete) and translation links.
+      @admin_roles = { none: 0, operator: 1, admin: 2 }
     end
   end
 end

data/lib/lato_cms/engine.rb

@@ -9,5 +9,32 @@ module LatoCms
     initializer "lato_cms.precompile" do |app|
       app.config.assets.precompile << "lato_cms_manifest.js"
     end
+
+    # Expose the CMS admin role options on the shared Lato::User model.
+    # lato_users (when mounted) discovers the `lato_cms_admin_role` column by
+    # convention and calls this method to build the role selector. Defined
+    # here so it works regardless of whether lato_users is installed.
+    config.to_prepare do
+      Lato::User.class_eval do
+        # Role options for the lato_cms_admin_role permission.
+        # Returns [[label, value], ...] with labels resolved at call time.
+        def self.lato_cms_admin_role_options
+          LatoCms.config.admin_roles.map do |key, value|
+            [I18n.t("lato_cms.admin_roles.#{key}"), value]
+          end
+        end
+
+        # True when the user can access the CMS section (operator or admin).
+        def lato_cms_access?
+          lato_cms_admin_role.to_i.positive?
+        end
+
+        # True when the user has the admin role: full page management
+        # (create, update, delete) and translation links.
+        def lato_cms_admin?
+          lato_cms_admin_role.to_i >= LatoCms.config.admin_roles.fetch(:admin, 0)
+        end
+      end
+    end
   end
 end

data/lib/lato_cms/version.rb

@@ -1,3 +1,3 @@
 module LatoCms
-  VERSION = "3.0.6"
+  VERSION = "3.0.7"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato_cms
 version: !ruby/object:Gem::Version
-  version: 3.0.6
+  version: 3.0.7
 platform: ruby
 authors:
 - Gregorio Galante
@@ -148,6 +148,7 @@ files:
 - db/migrate/20260320070819_create_lato_cms_pages.rb
 - db/migrate/20260323171241_create_lato_cms_page_fields.rb
 - db/migrate/20260705000000_add_translation_group_id_to_lato_cms_pages.rb
+- db/migrate/20260712092241_change_lato_cms_admin_to_lato_cms_admin_role_on_lato_user.rb
 - lib/lato_cms.rb
 - lib/lato_cms/config.rb
 - lib/lato_cms/engine.rb