lato_cms 3.2.5 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29cb78070d1a03bb67b5c2ad9c06b212303ae2c390e3b3a2f17b07bbae26f949
-  data.tar.gz: 82dd11dac19e77c935a037561d668be95b6d4cc0a6cb08d53ce1e4eec81445b4
+  metadata.gz: '094c93e8f96929b8abc542b096f60de09e69165f3158c3b17a1bedd0815b3645'
+  data.tar.gz: 77ddc4feb76c37b9d1f6bb5f13230a18cc452a30d4435aee38188fb93853c74d
 SHA512:
-  metadata.gz: e07ea70a61268187c94a66ad273339bed785d0cc3e6f5562624b4924b6e721ff6f01d039e47a1ca9f18de58681b051ac50bbc03bc1ceeefa79dd351f94ff8250
-  data.tar.gz: b39a29416a88c3cace9b780a4a0582b721b5d038df0c0e7b14d6814b48612db14530c8e6bc8259a7fdca30febd8a70e8a290a3fb9ad33b6e4289333c4556e8ad
+  metadata.gz: 91438e0eba689387d221a7f27ceb24fae3b249a3f154e5fff1ceca4f7812242e9278488e247c0f59adad09b30ab5ca02b383b90dc05a8ed3528f32449dc798c2
+  data.tar.gz: 85b62b2734785e61ee3e4b88f74a2b487d6fd6bd6cd533f9a39dfe26bef85b7971dfbe8dc34b9de57c139bc5ee5c8889c8e2b43495e3799049a135cd9540a747

data/README.md

@@ -43,6 +43,31 @@ import "lato_cms/application";
 // ....
 ```
 
+## Media URLs
+
+By default a media URL is an Active Storage **redirect** URL: Rails answers 302 with a
+signed address that expires. On a remote service (S3 and friends) that is what you want —
+the file then comes from the service itself.
+
+On a **disk** service it is the wrong trade: the redirect costs a second request, and its
+target is served `private, must-revalidate`, so no browser, proxy or CDN can keep it. A
+video of a few dozen MB is then downloaded again on every visit, from a thread of your app
+server. Switch the mode:
+
+```ruby
+LatoCms.configure do |config|
+  config.media_url_mode = :proxy
+end
+```
+
+Media URLs (the blob and every variant) then point at Active Storage's proxy controller:
+no redirect, and `Cache-Control: public, immutable`, which a cache in front of the app can
+actually use. The address carries the signature of the blob, so a replaced file is a
+different address and can never be served stale.
+
+Both modes ask for an `inline` disposition: a media of the library is content to show, and
+the default for a video would otherwise turn opening its address into a download.
+
 ## Development
 
 Clone repository, install dependencies, run migrations and start:

data/app/assets/javascripts/lato_cms/controllers/lato_cms_page_preview_controller.js

@@ -6,8 +6,16 @@ export default class extends Controller {
   connect () {
     this.handleComponentChange = this.handleComponentChange.bind(this)
     this.handleIframeLoad = this.handleIframeLoad.bind(this)
+    this.handleMorph = this.handleMorph.bind(this)
 
     document.addEventListener('lato-cms:component-change', this.handleComponentChange)
+    // Actions that re-render the editor server-side (cloning a component from
+    // another locale, editing the page settings) redirect back to this same
+    // URL, which Turbo treats as a page refresh and applies by morphing. Morph
+    // leaves an unchanged <iframe> exactly as it is — the element is never
+    // recreated, so the preview kept showing pre-clone content until a manual
+    // reload. The refresh is asked for explicitly here.
+    document.addEventListener('turbo:morph', this.handleMorph)
 
     if (this.hasIframeTarget) {
       this.iframeTarget.addEventListener('load', this.handleIframeLoad)
@@ -26,6 +34,7 @@ export default class extends Controller {
 
   disconnect () {
     document.removeEventListener('lato-cms:component-change', this.handleComponentChange)
+    document.removeEventListener('turbo:morph', this.handleMorph)
 
     if (this.hasIframeTarget) {
       this.iframeTarget.removeEventListener('load', this.handleIframeLoad)
@@ -109,6 +118,10 @@ export default class extends Controller {
     this.postActiveComponent()
   }
 
+  handleMorph () {
+    this.refresh()
+  }
+
   syncInitiallyOpenComponent () {
     const openCollapse = document.querySelector('#components-accordion .accordion-collapse.show')
     if (!openCollapse) return

data/app/controllers/lato_cms/pages_controller.rb

@@ -114,7 +114,12 @@ module LatoCms
       respond_to do |format|
         if errors.empty?
           format.html { redirect_to lato_cms.pages_show_path(@page), notice: t('lato_cms.fields_saved') }
-          format.json { render json: { message: t('lato_cms.fields_saved'), fields: @page.fields.reload.map(&:as_json) } }
+          # Only the saved component's fields: the editor repaints its media
+          # fields from this list, matching them by persisted field id, which is
+          # unique within a component but not across the page (two components
+          # can both have an "image" field). Handing it the whole page let a
+          # field adopt another component's media, and the next save stored it.
+          format.json { render json: { message: t('lato_cms.fields_saved'), fields: @page.fields.reload.select { |field| field.template_component_id == template_component_id.to_s }.map(&:as_json) } }
         else
           error_messages = errors.map { |e| "#{e[:field_id]}: #{e[:errors].join(', ')}" }.join('; ')
           format.html { redirect_to lato_cms.pages_show_path(@page), alert: error_messages }

data/app/models/lato_cms/media.rb

@@ -154,11 +154,27 @@ module LatoCms
     end
 
     def url
-      Rails.application.routes.url_helpers.rails_blob_path(file, only_path: true) if file.attached?
+      attachment_url(file) if file.attached?
     end
 
     def poster_url
-      Rails.application.routes.url_helpers.rails_blob_path(poster_file, only_path: true) if poster_file.attached?
+      attachment_url(poster_file) if poster_file.attached?
+    end
+
+    # The URL of an attachment or of one of its variants, in the mode the host
+    # app asked for (see LatoCms::Config::MEDIA_URL_MODES).
+    #
+    # `inline` in both modes: a media of the library is content to show — a
+    # picture in a page, a video in a player — and the default disposition of a
+    # video is `attachment`, which turns opening its address into a download.
+    # Whoever wants a download asks for it explicitly, as the panel does.
+    def attachment_url(attachable)
+      helpers = Rails.application.routes.url_helpers
+      if LatoCms.config.media_url_proxy?
+        helpers.rails_storage_proxy_path(attachable, only_path: true, disposition: :inline)
+      else
+        helpers.rails_blob_path(attachable, only_path: true, disposition: :inline)
+      end
     end
 
     # Swaps the underlying file while keeping the same record, so every field
@@ -248,9 +264,7 @@ module LatoCms
     def thumbnail_url
       return nil unless image? && file.attached? && file.variable?
 
-      Rails.application.routes.url_helpers.rails_representation_path(
-        file.variant(resize_to_fill: [200, 200]), only_path: true
-      )
+      attachment_url(file.variant(resize_to_fill: [200, 200]))
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build thumbnail for media #{id}: #{e.message}")
       nil
@@ -263,9 +277,7 @@ module LatoCms
       return nil unless image? && file.attached?
       return url unless file.variable?
 
-      Rails.application.routes.url_helpers.rails_representation_path(
-        file.variant(resize_to_limit: [1200, 1200]), only_path: true
-      )
+      attachment_url(file.variant(resize_to_limit: [1200, 1200]))
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build preview for media #{id}: #{e.message}")
       url
@@ -278,12 +290,11 @@ module LatoCms
     def variant_urls(sizes_config)
       return {} if sizes_config.blank? || !sizes_config.respond_to?(:each_pair) || !file.attached? || !file.variable?
 
-      url_helpers = Rails.application.routes.url_helpers
       sizes_config.each_with_object({}) do |(name, opts), acc|
         transformation = self.class.variant_transformation(opts)
         next if transformation.blank?
 
-        acc[name] = url_helpers.rails_representation_path(file.variant(transformation), only_path: true)
+        acc[name] = attachment_url(file.variant(transformation))
       end
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build image variants for media #{id}: #{e.message}")

data/app/views/lato_cms/pages/_component_accordion.html.erb

@@ -104,10 +104,20 @@
                 <% page_field = component_fields.find { |f| f.field_id == field_id } %>
 
                 <div class="mb-3">
+                  <%# The dom id prefix carries the template component: every
+                      component of the page is rendered at once, and two of them
+                      can expose the same field id (a template mounting one
+                      component twice, or two components both calling their
+                      image field "image"). Without it they shared input ids —
+                      and, for media fields, the picker frame id the selection
+                      event is correlated by, so a media picked in one component
+                      landed in the other as well. Input *names* stay
+                      component-agnostic: each form posts its own component. %>
                   <%= lato_cms_render_field(
                       field_id: field_id,
                       field_config: field_config,
-                      page_field: page_field
+                      page_field: page_field,
+                      dom_id_prefix: "fields_#{tc[:template_component_id]}_#{field_id}"
                     ) %>
                 </div>
               <% end %>

data/lib/lato_cms/config.rb

@@ -3,8 +3,19 @@ module LatoCms
   # This class contains the default configuration of the engine.
   ##
   class Config
-    attr_accessor :locales, :templates_path, :admin_roles, :llm_api_url, :llm_model, :llm_api_key,
-                  :llm_generate_alt_text, :llm_generate_title, :llm_alt_text_prompt, :llm_title_prompt
+    attr_accessor :locales, :templates_path, :admin_roles, :media_url_mode, :llm_api_url, :llm_model,
+                  :llm_api_key, :llm_generate_alt_text, :llm_generate_title, :llm_alt_text_prompt,
+                  :llm_title_prompt
+
+    # How the URLs of media files are built (see LatoCms::Media#url).
+    # - :redirect — Rails answers 302 with a signed URL that expires; on a
+    #   remote service (S3 and friends) the file then comes from the service
+    #   itself, which is what you want there.
+    # - :proxy — the file is served through the app, with no redirect and with
+    #   `Cache-Control: public, immutable`, so browsers and any cache in front
+    #   can keep it. On a disk service this is strictly better: the redirect
+    #   costs a second request and its target can be cached by nobody.
+    MEDIA_URL_MODES = %i[redirect proxy].freeze
 
     # Placeholders substituted at request time in both default and custom LLM
     # prompts (see LatoCms::Media#llm_prompt):
@@ -37,6 +48,11 @@ module LatoCms
       # (create, update, delete) and translation links.
       @admin_roles = { none: 0, operator: 1, admin: 2 }
 
+      # Default is :redirect, which is how it always worked: switching the way
+      # every media URL is built is a decision for the host app, not something
+      # an upgrade should do on its own. See MEDIA_URL_MODES.
+      @media_url_mode = :redirect
+
       # Optional OpenAI-compatible endpoint used to auto-generate alt text and
       # title for uploaded images (see LatoCms::Media#generate_text!). All
       # three must be set for the feature to activate; unset by default.
@@ -56,6 +72,10 @@ module LatoCms
       @llm_title_prompt = nil
     end
 
+    def media_url_proxy?
+      media_url_mode.to_sym == :proxy
+    end
+
     def llm_configured?
       llm_api_url.present? && llm_model.present? && llm_api_key.present?
     end

data/lib/lato_cms/version.rb

@@ -1,3 +1,3 @@
 module LatoCms
-  VERSION = "3.2.5"
+  VERSION = "3.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato_cms
 version: !ruby/object:Gem::Version
-  version: 3.2.5
+  version: 3.3.0
 platform: ruby
 authors:
 - Gregorio Galante