lesli 5.1.12 → 5.1.13

data/app/models/concerns/lesli/items/attachments.rb

@@ -0,0 +1,88 @@
+=begin
+
+Lesli
+
+Copyright (c) 2026, Lesli Technologies, S. A.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see http://www.gnu.org/licenses/.
+
+Lesli · Ruby on Rails SaaS Development Framework.
+
+Made with ♥ by LesliTech
+Building a better future, one line of code at a time.
+
+@contact  hello@lesli.tech
+@website  https://www.lesli.tech
+@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
+
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// ·
+=end
+
+module Lesli
+    module Items
+        module Attachments
+            extend ActiveSupport::Concern
+            include Lesli::Items::Ownership
+
+            included do
+                class_attribute :lesli_attachments_class, instance_accessor: false
+                lesli_attachments_setup
+            end
+
+            class_methods do
+                def is_lesli_attachable?
+                    true
+                end
+
+                def lesli_attachments_setup(
+                    use: nil,
+                    as: :attachable,
+                    association_name: :attachments
+                )
+                    klass = if use
+                        use.to_s.constantize
+                    else
+                        "#{name.deconstantize}::Items::Attachment".constantize
+                    end
+
+                    self.lesli_attachments_class = klass
+
+                    expected_table = lesli_expected_attachments_table_name_for(klass)
+                    klass.table_name = expected_table if klass.table_name != expected_table
+
+                    has_many(
+                        association_name,
+                        -> { order(created_at: :desc) },
+                        as: as,
+                        class_name: klass.name,
+                        dependent: :destroy
+                    )
+                rescue NameError
+                    raise NameError,
+                        "Attachment class not found for #{name}. " \
+                        "Expected #{name.deconstantize}::Items::Attachment or pass `use:`"
+                end
+
+                private
+
+                def lesli_expected_attachments_table_name_for(klass)
+                    parts = klass.name.split("::").map(&:underscore)
+                    parts.join("_").pluralize
+                end
+            end
+
+        end
+    end
+end

data/app/models/concerns/lesli/items/discussions.rb

@@ -34,9 +34,13 @@ module Lesli
     module Items
         module Discussions
             extend ActiveSupport::Concern
+            include Lesli::Items::Ownership
 
             included do
                 class_attribute :lesli_discussions_class, instance_accessor: false
+                class_attribute :lesli_discussions_association_name,
+                    instance_accessor: false,
+                    default: :discussions
                 lesli_discussions_setup
             end
 
@@ -47,8 +51,7 @@ module Lesli
                     true
                 end
 
-                # Automatically sets the associations to the
-                # engine model that is implementing the task items
+                # Resolve the concrete discussion model for the engine.
                 def lesli_discussions_setup(use: nil, as: :discussable, association_name: :discussions)
                     klass = if use
                         use.to_s.constantize
@@ -57,6 +60,7 @@ module Lesli
                     end
 
                     self.lesli_discussions_class = klass
+                    self.lesli_discussions_association_name = association_name.to_sym
 
                     # ✅ Auto-fix table name (works even when engine defines table_name_prefix)
                     expected_table = lesli_expected_discussions_table_name_for(klass)
@@ -65,13 +69,8 @@ module Lesli
                         klass.table_name = expected_table
                     end
 
-                    # Set associations
-                    # Example:
-                    # class LesliSupport::Ticket 
-                    #     has_many :lesli_support_tasks
-                    # end
                     has_many(association_name,
-                        -> { where(deleted_at: nil).order(created_at: :desc) },
+                        -> { order(created_at: :desc, id: :desc) },
                         as: as,
                         class_name: klass.name,
                         dependent: :destroy)
@@ -79,14 +78,29 @@ module Lesli
 
                 private
 
-                # Build: "lesli_support_item_activities" from "LesliSupport::Item::Activity"
+                # Build: "lesli_support_items_discussions" from
+                # "LesliSupport::Items::Discussion"
                 #
                 # We DO NOT rely on ActiveRecord's table_name_prefix, because that’s what breaks your case.
                 def lesli_expected_discussions_table_name_for(klass)
-                    parts = klass.name.split("::").map(&:underscore) # ["lesli_support", "item", "discussion"]
-                    "#{parts.join('_').pluralize}"                   # "lesli_support_item_discussions"
+                    parts = klass.name.split("::").map(&:underscore)
+                    "#{parts.join('_').pluralize}"
                 end
             end
+
+            def add_comment!(author:, message:)
+                discussion_association.create!(
+                    author: author,
+                    account: lesli_item_account,
+                    message: message
+                )
+            end
+
+            private
+
+            def discussion_association
+                public_send(self.class.lesli_discussions_association_name)
+            end
         end
     end
 end

data/app/models/concerns/lesli/items/ownership.rb

@@ -0,0 +1,27 @@
+module Lesli
+    module Items
+        module Ownership
+            extend ActiveSupport::Concern
+
+            # Item records use the same account as their parent resource. For
+            # engine resources this is an Engine::Account; Core resources may
+            # return Lesli::Account directly.
+            def lesli_item_account
+                account
+            end
+
+            def lesli_item_accessible_by?(user)
+                return false if user.blank?
+
+                item_account = lesli_item_account
+                core_account = if item_account.respond_to?(:account)
+                    item_account.account
+                else
+                    item_account
+                end
+
+                core_account == user.account
+            end
+        end
+    end
+end

data/app/models/concerns/lesli/items/tasks.rb

@@ -34,9 +34,13 @@ module Lesli
     module Items
         module Tasks
             extend ActiveSupport::Concern
+            include Lesli::Items::Ownership
 
             included do
                 class_attribute :lesli_tasks_class, instance_accessor: false
+                class_attribute :lesli_tasks_association_name,
+                    instance_accessor: false,
+                    default: :tasks
                 lesli_tasks_setup
             end
 
@@ -57,6 +61,7 @@ module Lesli
                     end
 
                     self.lesli_tasks_class = klass
+                    self.lesli_tasks_association_name = association_name.to_sym
 
                     # ✅ Auto-fix table name (works even when engine defines table_name_prefix)
                     expected_table = lesli_expected_task_table_name_for(klass)
@@ -71,25 +76,40 @@ module Lesli
                     #     has_many :lesli_support_tasks
                     # end
                     has_many(association_name,
-                        -> { where(deleted_at: nil).order(created_at: :desc) },
+                        -> { order(created_at: :desc) },
                         as: as,
                         class_name: klass.name,
                         dependent: :destroy)
                 rescue NameError
                     raise NameError,
-                    "Task class not found for #{name}. Expected #{name.deconstantize}::Task or pass `use:`"
+                    "Task class not found for #{name}. Expected #{name.deconstantize}::Items::Task or pass `use:`"
                 end
 
                 private
 
-                # Build: "lesli_support_item_activities" from "LesliSupport::Item::Activity"
+                # Build "lesli_support_items_tasks" from
+                # "LesliSupport::Items::Task".
                 #
-                # We DO NOT rely on ActiveRecord's table_name_prefix, because that’s what breaks your case.
+                # Do not rely on Active Record's table_name_prefix here.
                 def lesli_expected_task_table_name_for(klass)
-                    parts = klass.name.split("::").map(&:underscore) # ["lesli_support", "item", "task"]
-                    "#{parts.join('_').pluralize}"                   # "lesli_support_item_tasks"
+                    parts = klass.name.split("::").map(&:underscore)
+                    parts.join("_").pluralize
                 end
             end
+
+            def add_task!(creator:, title:)
+                task_association.create!(
+                    user: creator,
+                    account: lesli_item_account,
+                    title: title
+                )
+            end
+
+            private
+
+            def task_association
+                public_send(self.class.lesli_tasks_association_name)
+            end
         end
     end
 end

data/app/models/concerns/lesli/user_extensions.rb

@@ -94,22 +94,18 @@ module Lesli
             subject:nil # resource related to the log
             )
 
-            return unless defined?(LesliAudit) && respond_to?(:logs)
+            return unless defined?(LesliAudit::ActivityAudit)
 
-            self.logs.create!({
+            LesliAudit::ActivityAudit.record_user!(
+                user: self,
                 engine: engine,
                 source: source,
                 action: action,
-
                 operation: operation,
                 description: description,
                 session_id: session_id,
-
-                subject_type: subject&.class&.name,
-                subject_id: subject&.id,
-
-                account: self&.account&.audit
-            })
+                subject: subject
+            )
         end
     end
 end

data/app/models/lesli/account.rb

@@ -45,26 +45,21 @@ module Lesli
         has_many :settings
         has_many :locations
         has_many :currencies
-        has_many :requests, class_name: "LesliAudit::AccountRequest"
-        has_many :logs, class_name: "LesliAudit::AccountLog"
 
 
         # third-party engines associations
-        has_one :bell, class_name: "LesliBell::Account"
-        has_one :help, class_name: "LesliHelp::Account"
-        has_one :audit, class_name: "LesliAudit::Account"
-        has_one :admin, class_name: "LesliAdmin::Account"
-        has_one :guard, class_name: "LesliGuard::Account"
-        has_one :shield, class_name: "LesliShield::Account"
+        has_one :bell, class_name: "LesliBell::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :admin, class_name: "LesliAdmin::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :audit, class_name: "LesliAudit::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :shield, class_name: "LesliShield::Account", foreign_key: :account_id, inverse_of: :account
         has_one :letter, class_name: "LesliLetter::Account"
         has_one :papers, class_name: "LesliPapers::Account"
-        has_one :support, class_name: "LesliSupport::Account"
-        has_one :contacts, class_name: "LesliContacts::Account"
-        has_one :calendar, class_name: "LesliCalendar::Account"
-        has_one :dashboard, class_name: "LesliDashboard::Account"
-        
+        has_one :mailer, class_name: "LesliMailer::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :support, class_name: "LesliSupport::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :contacts, class_name: "LesliContacts::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :calendar, class_name: "LesliCalendar::Account", foreign_key: :account_id, inverse_of: :account
+        has_one :dashboard, class_name: "LesliDashboard::Account", foreign_key: :account_id, inverse_of: :account
 
-        validates :status, presence: true
 
         # account statuses
         enum :status, {
@@ -83,6 +78,7 @@ module Lesli
 
         # required a name for the lesli account
         validates :name, :presence => true
+        validates :status, presence: true
 
 
         # initializers for new accounts

data/app/models/lesli/items/activity.rb

@@ -34,9 +34,32 @@ module Lesli
     module Items
         class Activity < ApplicationRecord
             self.abstract_class = true
-            belongs_to :user, class_name: "Lesli::User"
-            belongs_to :account, class_name: "Lesli::Account"
+
+            # Activity ownership contract:
+            # - subject is the resource affected by the event.
+            # - actor is the Lesli user who performed the event. The existing
+            #   user_id column is kept as the foreign key.
+            # - account is declared by the concrete engine model.
+            # - activity_code is a semantic event name, not a column name.
+            belongs_to :actor, class_name: "Lesli::User", foreign_key: :user_id
             belongs_to :subject, polymorphic: true
+
+            validate :metadata_is_an_object
+            validates :activity_type, presence: true
+            validates :activity_code,
+                presence: true,
+                format: {
+                    with: /\A[a-z][a-z0-9_]*\z/,
+                    message: "must be a semantic snake_case event name"
+                }
+
+            private
+
+            def metadata_is_an_object
+                return if metadata.is_a?(Hash)
+
+                errors.add(:metadata, "must be a JSON object")
+            end
         end
     end
 end

data/app/models/lesli/items/attachment.rb

@@ -0,0 +1,117 @@
+=begin
+
+Lesli
+
+Copyright (c) 2026, Lesli Technologies, S. A.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see http://www.gnu.org/licenses/.
+
+Lesli · Ruby on Rails SaaS Development Framework.
+
+Made with ♥ by LesliTech
+Building a better future, one line of code at a time.
+
+@contact  hello@lesli.tech
+@website  https://www.lesli.tech
+@license  GPLv3 http://www.gnu.org/licenses/gpl-3.0.en.html
+
+// · ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~     ~·~
+// ·
+=end
+
+module Lesli
+    module Items
+        class Attachment < ApplicationLesliRecord
+            DEFAULT_MAX_FILE_SIZE = 25.megabytes
+            DEFAULT_CONTENT_TYPES = %w[
+                application/pdf
+                application/msword
+                application/vnd.ms-excel
+                application/vnd.ms-powerpoint
+                application/vnd.openxmlformats-officedocument.presentationml.presentation
+                application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                application/zip
+                image/gif
+                image/jpeg
+                image/png
+                image/webp
+                text/csv
+                text/plain
+            ].freeze
+
+            self.abstract_class = true
+
+            class_attribute :lesli_attachment_max_file_size,
+                instance_accessor: false,
+                default: DEFAULT_MAX_FILE_SIZE
+            class_attribute :lesli_attachment_content_types,
+                instance_accessor: false,
+                default: DEFAULT_CONTENT_TYPES
+
+            belongs_to :user, class_name: "Lesli::User"
+            belongs_to :attachable, polymorphic: true
+
+            has_one_attached :file
+
+            validates :label, length: { maximum: 255 }, allow_blank: true
+            validates :category, length: { maximum: 100 }, allow_blank: true
+            validate :file_is_attached
+            validate :file_size_is_allowed
+            validate :file_type_is_allowed
+
+            def display_name
+                label.presence || file.filename.to_s
+            end
+
+            private
+
+            def file_is_attached
+                return if file.attached?
+
+                errors.add(
+                    :file,
+                    I18n.t("lesli.items.attachments.errors.required")
+                )
+            end
+
+            def file_size_is_allowed
+                return unless file.attached?
+                return if file.blob.byte_size <= self.class.lesli_attachment_max_file_size
+
+                errors.add(
+                    :file,
+                    I18n.t(
+                        "lesli.items.attachments.errors.too_large",
+                        size: ActiveSupport::NumberHelper.number_to_human_size(
+                            self.class.lesli_attachment_max_file_size
+                        )
+                    )
+                )
+            end
+
+            def file_type_is_allowed
+                return unless file.attached?
+                return if self.class.lesli_attachment_content_types.include?(
+                    file.blob.content_type
+                )
+
+                errors.add(
+                    :file,
+                    I18n.t("lesli.items.attachments.errors.unsupported_type")
+                )
+            end
+        end
+    end
+end

data/app/models/lesli/items/discussion.rb

@@ -2,9 +2,13 @@ module Lesli
     module Items
         class Discussion < ApplicationRecord
             self.abstract_class = true
-            belongs_to :user, class_name: "Lesli::User"
-            belongs_to :account, class_name: "Lesli::Account"
+
+            belongs_to :author,
+                class_name: "Lesli::User",
+                foreign_key: :user_id
             belongs_to :discussable, polymorphic: true
+
+            validates :message, presence: true
         end
     end
 end

data/app/models/lesli/items/task.rb

@@ -34,9 +34,11 @@ module Lesli
     module Items
         class Task < ApplicationRecord
             self.abstract_class = true
+
             belongs_to :user, class_name: "Lesli::User"
-            belongs_to :account, class_name: "Lesli::Account"
             belongs_to :taskable, polymorphic: true
+
+            validates :title, presence: true
         end
     end
 end

data/app/models/lesli/user.rb

@@ -41,17 +41,6 @@ module Lesli
             uniqueness: true
         );
 
-        # devise implementation
-        devise( 
-            :database_authenticatable,
-            :registerable,
-            :rememberable,
-            :recoverable,
-            :validatable,
-            :confirmable,
-            :trackable
-        );
-
         # users belongs to an account only... 
         belongs_to :account, optional: true
 
@@ -64,20 +53,22 @@ module Lesli
         # users data extensions
         has_many :tokens
         has_many :settings
-        has_many :sessions, class_name: 'LesliShield::User::Session'
 
-        
-        # Users can have many roles and too many privileges through the roles
+        # Authentication and authorization records are implemented by
+        # LesliShield. These associations remain explicit here because they
+        # are part of the public API used throughout the platform.
+        has_many :sessions, class_name: "LesliShield::User::Session"
         has_many :user_roles, class_name: "LesliShield::User::Role"
         has_many :roles,       through: :user_roles, source: :role
         has_many :privileges,  through: :roles
 
-
-        # allow save duplicated users to execute callbacks
-        def save(*args)
-            super()
-            rescue ActiveRecord::RecordNotUnique => error
-        end
+        # Audit records are implemented by LesliAudit. The associations are
+        # declared here because requests, journals, and logs form part of the
+        # user API consumed by the platform.
+        has_many :requests, class_name: "LesliAudit::UserRequest", foreign_key: :user_id, inverse_of: :user
+        has_many :journals, class_name: "LesliAudit::UserJournal", foreign_key: :user_id, inverse_of: :user
+        has_many :logs, class_name: "LesliAudit::UserLog", foreign_key: :user_id, inverse_of: :user
+        has_many :account_logs, class_name: "LesliAudit::AccountLog", foreign_key: :user_id, inverse_of: :user
 
         before_create :before_create_user
 
@@ -86,7 +77,7 @@ module Lesli
         def before_create_user
             self.uid ||= loop do
                 candidate = generate_resource_uid(prefix:'LID')
-                break candidate unless self.account&.users&.exists?(uid: candidate)
+                break candidate unless self.class.exists?(uid: candidate)
             end
         end
 

data/app/views/lesli/abouts/welcome.html.erb

@@ -272,12 +272,9 @@
         </div>
 
         <nav class="welcome-access" aria-label="Application access">
-            <% unless defined?(LesliShield) %>
-                <%= link_to("Open applications", "/apps") unless defined?(LesliDashboard) %>
-            <% end %>
             <% if defined?(LesliShield) %>
-                <%= link_to("Open applications", "/apps") if user_signed_in? && !defined?(LesliDashboard) %>
-                <%= link_to("Open dashboard", "/dashboard") if user_signed_in? && defined?(LesliDashboard) %>
+                <%= link_to("Applications", "/lesli/apps") if user_signed_in? %>
+                <%= link_to("Dashboard", "/dashboard") if user_signed_in? && defined?(LesliDashboard) %>
                 <%= link_to("Log out", "/logout") if user_signed_in? %>
                 <%= link_to("Log in", "/login") unless user_signed_in? %>
             <% end %>

data/app/views/lesli/errors/not_found.html.erb

@@ -1,32 +1,18 @@
-<style>
-.error-404 .material-symbols {
-    font-size: 8rem;
-    color: rgb(190,190,190);
-}
-.error-404 h2 {
-    font-size: 2rem;
-    color: #3d211b;
-}
-
-.error-404 p {
-    font-size: 1.4rem;
-    font-weight: 300;
-}
-</style>
 <%= render(LesliView::Layout::Container.new("accounts")) do %>
-    <section class="hero is-medium error-404">
-        <div class="hero-body has-text-centered">
+    <section class="px-4 py-24 sm:px-6 sm:py-36" aria-labelledby="not-found-title">
+        <div class="mx-auto max-w-2xl text-center">
 
-            <div class="mb-6">
+            <div class="mb-6" aria-hidden="true">
                 <%= render(LesliView::Elements::Empty.new(text:nil)) %>
             </div>
 
-            <h2 class="mb-4">404 <%= I18n.t("lesli.shared.message_error_not_found") %></h2>
+            <h2 id="not-found-title" class="mb-4 text-[2rem] font-semibold leading-tight text-[#3d211b]">
+                404 <%= I18n.t("lesli.shared.message_error_not_found") %>
+            </h2>
 
-            <p>
+            <p class="text-[1.4rem] font-light leading-relaxed text-neutral-700">
                 <%= @message %>
             </p>
         </div>
     </section>
 <% end %>
-