lesli 5.1.12 → 5.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1ca8550e901343c90ed0df6cdc090a8b29f87a54ee7134abebd136a849cffdf
-  data.tar.gz: c10a1829fdb3e28275ac11cecbd7fdbebfbb1928822fc750670014193f421fdd
+  metadata.gz: e42093c64425af9e68a26e106d438eee2e69c11ead091011ad26eff30b940282
+  data.tar.gz: 5e56a9246828d3efe4e36354d7fe754a4556af9a0befd4ea9a6169614b94b521
 SHA512:
-  metadata.gz: d3e7367ac43dfe1cc2261b19e3692d445a36dcb667ad4abe57ac78a9cb98b3f6bcbb66920bf45378d54d4c344be4aa1c4a262b68ae9480d16671d2ff52f85de7
-  data.tar.gz: a07ba625e2e585085564c740629ce0635901a8604934836f3d670768854303c90e2aa731a11577ab7d3bdc0c5bebc3f90d3c665e3eb0a4da76dbeb3b214f6bb8
+  metadata.gz: a7f90e00184b49ffac1f366897ae89ddbd0dbe6e488aa4952d018f432a6e73f2399f9c8fd3f9b670dbb6d1bff2b6a1660f73a79eb146f5fb08ceed7e5efb2a5b
+  data.tar.gz: 69a092763f5a8e0c55c03bd7d68aa68b511cc8a5f6bd60aedfdef9fbc601501319f12555f3c95d908e354292d3285d3289c91c01e803d72ed09669775b2f7446

data/Rakefile

@@ -5,3 +5,6 @@ APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
 load "rails/tasks/engine.rake"
 
 require "bundler/gem_tasks"
+
+desc "Run engine tests through the dummy Rails application"
+task test: "app:test"

data/app/assets/stylesheets/lesli/application.css

@@ -1,8 +1,9 @@
-@charset "UTF-8";
-/*
+/*! tailwindcss v4.3.3 | MIT License | https://tailwindcss.com */
+/*!
+
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -29,3 +30,42 @@ Building a better future, one line of code at a time.
 // · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
 // · 
 */
+@layer theme, utilities;
+@layer theme {
+  :root, :host {
+    --spacing: 0.25rem;
+  }
+}
+@layer utilities {
+  .grid {
+    display: grid;
+  }
+  .hidden {
+    display: none;
+  }
+  .grid-cols-1 {
+    grid-template-columns: repeat(1, minmax(0, 1fr));
+  }
+  .gap-5 {
+    gap: calc(var(--spacing) * 5);
+  }
+  .py-6 {
+    padding-block: calc(var(--spacing) * 6);
+  }
+  @media (width >= 40rem) {
+    .sm\:grid-cols-2 {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+    .sm\:gap-6 {
+      gap: calc(var(--spacing) * 6);
+    }
+    .sm\:py-8 {
+      padding-block: calc(var(--spacing) * 8);
+    }
+  }
+  @media (width >= 64rem) {
+    .lg\:grid-cols-4 {
+      grid-template-columns: repeat(4, minmax(0, 1fr));
+    }
+  }
+}

data/app/controllers/lesli/application_devise_controller.rb

@@ -1,8 +1,12 @@
+# frozen_string_literal: true
+
 =begin
 
 Lesli
 
-Copyright (c) 2025, Lesli Technologies, S. A.
+Lesli
+
+Copyright (c) 2026, Lesli Technologies, S. A.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -31,17 +35,17 @@ Building a better future, one line of code at a time.
 =end
 
 module Lesli
+    # Shared parent for authentication controllers rendered with the public
+    # Lesli application shell. LesliShield configures Devise to use this class.
     class ApplicationDeviseController < ApplicationController
         include Lesli::ResponderInterface
         include Lesli::RequesterInterface
         include LesliAudit::LoggerInterface if defined?(LesliAudit)
-        
-        layout "lesli/layouts/application-devise"
 
-        #before_action :set_locale_public
+        layout "lesli/layouts/application-devise"
 
         def initialize
-            @lesli = { 
+            @lesli = {
                 company: {
                     name: Lesli.config.company[:name]
                 }

data/app/controllers/lesli/application_lesli_controller.rb

@@ -40,6 +40,10 @@ module Lesli
         include LesliShield::AuthenticationInterface if defined?(LesliShield)
         include LesliShield::AuthorizationInterface if defined?(LesliShield)
 
+        # Controllers from isolated engines inherit this controller, but Rails
+        # does not automatically expose Lesli's helpers to their views.
+        helper Lesli::Engine.helpers
+
         protect_from_forgery with: :exception
 
         before_action :set_locale 

data/app/controllers/lesli/items/attachments_controller.rb

@@ -0,0 +1,200 @@
+=begin
+
+Lesli
+
+Copyright (c) 2026, Lesli Technologies, S. A.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see http://www.gnu.org/licenses/.
+
+Lesli · Ruby on Rails SaaS Development Framework.
+
+Made with ♥ by LesliTech
+Building a better future, one line of code at a time.
+
+@contact  hello@lesli.tech
+@website  https://www.lesli.tech
+@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
+
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// ·
+=end
+
+module Lesli
+    module Items
+        class AttachmentsController < ApplicationLesliController
+            include ActiveStorage::SetCurrent
+
+            before_action :set_attachable, only: %i[index create]
+            before_action :set_attachment, only: %i[show destroy]
+
+            def index
+                attachments = @attachable.attachments.with_attached_file
+                respond_with_lesli(json: attachments.map { |attachment| attachment_payload(attachment) })
+            end
+
+            def show
+                return respond_with_not_found unless @attachment.file.attached?
+
+                redirect_to(
+                    @attachment.file.url(
+                        expires_in: 5.minutes,
+                        disposition: :attachment,
+                        filename: @attachment.file.filename
+                    ),
+                    allow_other_host: true
+                )
+            end
+
+            def create
+                attachment = @attachable.attachments.build(attachment_params)
+                attachment.user = current_user
+                attachment.account = @attachable.lesli_item_account
+
+                if attachment.save
+                    refresh_attachments
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_success(
+                                I18n.t("lesli.items.attachments.created")
+                            ),
+                            attachments_stream
+                        ],
+                        json: attachment_payload(attachment),
+                        redirect: return_path
+                    )
+                else
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_danger(
+                                attachment.errors.full_messages.to_sentence
+                            ),
+                            attachments_stream(attachment: attachment)
+                        ],
+                        json: { errors: attachment.errors },
+                        redirect: return_path,
+                        status: :unprocessable_content
+                    )
+                end
+            end
+
+            def destroy
+                attachable = @attachment.attachable
+
+                if @attachment.destroy
+                    @attachable = attachable
+                    refresh_attachments
+                    respond_with_lesli(
+                        turbo: [
+                            stream_notification_success(
+                                I18n.t("lesli.items.attachments.deleted")
+                            ),
+                            attachments_stream
+                        ],
+                        json: { message: I18n.t("lesli.items.attachments.deleted") },
+                        redirect: return_path
+                    )
+                else
+                    respond_with_lesli(
+                        turbo: stream_notification_danger(
+                            @attachment.errors.full_messages.to_sentence
+                        ),
+                        json: { errors: @attachment.errors },
+                        redirect: return_path,
+                        status: :unprocessable_content
+                    )
+                end
+            end
+
+            private
+
+            def attachment_class
+                self.class.module_parent.const_get("Attachment")
+            end
+
+            def attachable_class
+                allowed_attachable_classes.find do |klass|
+                    klass.name == params.require(:attachable_type)
+                end || raise(
+                    ActiveRecord::RecordNotFound,
+                    "Unauthorized attachable type"
+                )
+            end
+
+            def allowed_attachable_classes
+                []
+            end
+
+            def set_attachable
+                @attachable = attachable_class.find(params.require(:attachable_id))
+                ensure_attachable_access!(@attachable)
+            end
+
+            def set_attachment
+                @attachment = attachment_class
+                    .with_attached_file
+                    .find(params[:id])
+                ensure_attachable_access!(@attachment.attachable)
+            end
+
+            def ensure_attachable_access!(attachable)
+                allowed = attachable.respond_to?(:lesli_item_accessible_by?) &&
+                    attachable.lesli_item_accessible_by?(current_user)
+
+                raise ActiveRecord::RecordNotFound unless allowed
+            end
+
+            def attachment_params
+                params.require(scope_key).permit(:file, :label, :category)
+            end
+
+            def scope_key
+                ActiveSupport::Inflector.underscore(attachment_class.name).tr("/", "_")
+            end
+
+            def attachment_payload(attachment)
+                {
+                    id: attachment.id,
+                    label: attachment.label,
+                    category: attachment.category,
+                    filename: attachment.file.filename.to_s,
+                    content_type: attachment.file.blob.content_type,
+                    byte_size: attachment.file.blob.byte_size,
+                    created_at: attachment.created_at,
+                    user: {
+                        id: attachment.user_id,
+                        name: attachment.user.name
+                    }
+                }
+            end
+
+            def attachments_stream(attachment: nil)
+                turbo_stream.replace(
+                    helpers.dom_id(@attachable, :attachments)
+                ) do
+                    LesliView::Items::Attachments
+                        .new(@attachable, attachment: attachment)
+                        .render_in(view_context)
+                end
+            end
+
+            def refresh_attachments
+                @attachable.attachments.reset
+            end
+
+            def return_path
+                request.referer.presence || root_path
+            end
+        end
+    end
+end

data/app/controllers/lesli/items/discussions_controller.rb

@@ -33,93 +33,120 @@ Building a better future, one line of code at a time.
 module Lesli
     module Items
         class DiscussionsController < ApplicationLesliController
-            before_action :set_discussion, only: %i[show update]
-            before_action :set_discussable, only: %i[index create]
-
-            def index
-                @discussions = discussion_class
-                    .where(account: current_user.account)
-                    .order(created_at: :desc)
-                respond_with_lesli(json: @discussions)
+            before_action :set_discussable, only: :create
+
+            def create
+                comment = @discussable.add_comment!(
+                    author: current_user,
+                    message: discussion_params[:message]
+                )
+                refresh_discussions
+
+                message = I18n.t("lesli.items.discussions.created")
+                respond_with_lesli(
+                    turbo: [
+                        stream_notification_success(message),
+                        discussions_stream
+                    ],
+                    json: {
+                        message: message,
+                        comment: comment_payload(comment)
+                    },
+                    status: :created
+                )
+            rescue ActiveRecord::RecordInvalid => error
+                respond_with_comment_errors(error.record)
             end
 
-            def show
+            private
+
+            def discussable_class
+                allowed_discussable_classes.find do |klass|
+                    klass.name == params.require(:discussable_type)
+                end || raise(
+                    ActiveRecord::RecordNotFound,
+                    "Unauthorized discussable type"
+                )
             end
 
-            def create
-                discussion = discussion_class.new(discussion_params)
-
-                discussion.user = current_user
-                discussion.account = current_user.account
-                discussion.discussable = @discussable if @discussable
-
-                if discussion.save
-                    respond_with_lesli(:turbo => [
-                        stream_notification_success("Discussion created"),
-                        turbo_stream.prepend("#{scope_key}-lesli-items-discussions-list") do
-                            LesliView::Items::Discussion.new(discussion).render_in(view_context)
-                        end
-                    ])
-                else
-                    respond_with_lesli(
-                        :turbo => stream_notification_danger(discussion.errors.full_messages)
-                    )
-                end
+            def allowed_discussable_classes
+                []
             end
 
-            def update
-                @discussion.done = true
-                @discussion.save
-                respond_with_lesli(:turbo => [
-                    stream_notification_success("Discussion updated #{@discussable}"),
-                    turbo_stream.replace(helpers.dom_id(@discussion, scope_key)) do 
-                        LesliView::Items::Discussion.new(@discussion, scope_key).render_in(view_context)
-                    end
-                ])
+            def set_discussable
+                @discussable = discussable_class.find(
+                    params.require(:discussable_id)
+                )
+                ensure_discussable_access!(@discussable)
             end
 
-            private
+            def ensure_discussable_access!(discussable)
+                allowed = discussable.respond_to?(:lesli_item_accessible_by?) &&
+                    discussable.lesli_item_accessible_by?(current_user)
 
-            # return a key to identify the engine where the tasks are running
-            def scope_key = ActiveSupport::Inflector.underscore(discussion_class.name).tr("/", "_")
+                raise ActiveRecord::RecordNotFound unless allowed
+            end
 
-            # return the discussion class including the engine where the tasks are running
-            def discussion_class = self.class.module_parent.const_get("Discussion")
+            def discussion_class
+                @discussable.class.lesli_discussions_class
+            end
 
-            # validate we invoke only models that implements Lesli::Item::Discussions concern
-            def validate_discussable discussable
+            def scope_key
+                ActiveSupport::Inflector
+                    .underscore(discussion_class.name)
+                    .tr("/", "_")
+            end
 
-                # 1. Attempt to resolve the class safely
-                klass = discussable.safe_constantize
+            def discussion_params
+                params.require(scope_key.to_sym).permit(:message)
+            end
 
-                # 2. VALIDATION: Check if the class is allowed to be discussable
-                # We check if the class exists AND if it includes your specific discussable trait
-                unless klass && klass.respond_to?(:is_lesli_taskable?) && klass.is_lesli_commentable?
-                    render json: { error: "Unauthorized discussable type" }, status: :forbidden and return
-                end
+            def refresh_discussions
+                association_name =
+                    @discussable.class.lesli_discussions_association_name
 
-                klass
+                @discussable.public_send(association_name).reset
             end
 
-            def set_discussion
-                @discussion = discussion_class.where(account: current_user.account).find(params[:id])
+            def discussions_stream(comment: nil)
+                turbo_stream.replace(
+                    helpers.dom_id(@discussable, :discussions)
+                ) do
+                    LesliView::Items::Discussions
+                        .new(@discussable, comment: comment)
+                        .render_in(view_context)
+                end
             end
 
-            # Permite filtrar/crear para un actionable específico:
-            # params: actionable_type=LesliSupport::Ticket&actionable_id=123
-            def set_discussable
-                type = params[:discussable_type].presence
-                id   = params[:discussable_id].presence
-                return if type.blank? || id.blank?
-
-                discussable = validate_discussable(type)
-
-                # 3. Execution: Now it is safe to query
-                @discussable = discussable.where(account: current_user.account).find_by(id: id)
+            def comment_payload(comment)
+                {
+                    id: comment.id,
+                    message: comment.message,
+                    discussable_type: comment.discussable_type,
+                    discussable_id: comment.discussable_id,
+                    author: {
+                        id: comment.user_id,
+                        name: comment.author.name
+                    },
+                    created_at: comment.created_at,
+                    updated_at: comment.updated_at
+                }
             end
 
-            def discussion_params
-                params.require(scope_key.to_sym).permit(:message)
+            def respond_with_comment_errors(comment)
+                refresh_discussions
+                message = I18n.t("lesli.items.discussions.invalid")
+                respond_with_lesli(
+                    turbo: [
+                        stream_notification_danger(message),
+                        discussions_stream(comment: comment)
+                    ],
+                    json: {
+                        message: message,
+                        errors: comment.errors
+                    },
+                    status: :unprocessable_content
+                )
             end
         end
     end