moduler 0.2.0 → 0.4.0

data/app/components/moduler/form/textarea_component.html.erb

@@ -0,0 +1,14 @@
+<div class="mt-2">
+  <% if @options.key?(:label) %>
+    <%= @form.label @name, @options[:label], class: "block text-sm text-slate-500" %>
+  <% end %>
+  <div class="mt-2">
+    <%= @form.text_area @name, class: "mt-1 w-full rounded-md border border-slate-300 px-3 py-2 text-sm text-slate-900 focus:border-slate-900 focus:outline-none focus:ring-1 focus:ring-slate-900" %>
+  </div>
+  <% if @options.key?(:description) %>
+    <p class="mt-1 text-xs text-gray-400"><%= @options[:description] %></p>
+  <% end %>
+  <% if @form.error?(@name) %>
+    <%= @form.error(@name, class: "text-red-500 text-sm mt-1") %>
+  <% end %>
+</div>

data/app/components/moduler/form/textarea_component.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Moduler
+  class Form::TextareaComponent < ViewComponent::Base
+    def initialize(form, name, options = {})
+      @form = form
+      @name = name
+      @options = options
+    end
+  end
+end

data/app/components/moduler/form/wysiwyg_component.html.erb

@@ -0,0 +1,30 @@
+<div class="mt-2">
+  <% if @options.key?(:label) %>
+    <%= @form.label @name, @options[:label], class: "block text-sm text-slate-500" %>
+  <% end %>
+  <%= tag.div class: "mt-2", data: controller_data do %>
+    <div class="flex flex-wrap gap-1 rounded-t-md border border-b-0 border-slate-300 bg-slate-50 px-2 py-1.5">
+      <% ACTIONS.each do |action, style| %>
+        <button type="button" data-action="click->wysiwyg#<%= action %>" class="rounded px-2 py-1 text-sm text-slate-700 hover:bg-slate-200 <%= style %>"><%= t("moduler.components.form.wysiwyg.action.#{action.to_s.underscore}") %></button>
+      <% end %>
+      <% if upload? %>
+        <button type="button" data-action="click->wysiwyg#upload" class="rounded px-2 py-1 text-sm text-slate-700 hover:bg-slate-200"><%= t("moduler.components.form.wysiwyg.action.upload") %></button>
+      <% end %>
+    </div>
+    <%= @form.text_area @name, rows: rows,
+          data: { wysiwyg_target: "markup", action: "input->wysiwyg#render keydown->wysiwyg#insertTab" },
+          class: "block w-full border border-slate-300 px-3 py-2 font-mono text-sm text-slate-900 focus:border-slate-900 focus:outline-none focus:ring-1 focus:ring-slate-900" %>
+    <div class="prose prose-sm prose-slate prose-100 rounded-b-md border border-t-0 border-slate-300 bg-slate-50 px-4 py-3 prose-img:w-full prose-img:max-w-5xl" data-wysiwyg-target="viewer"></div>
+    <% if upload? %>
+      <% attached_signed_ids.each do |signed_id| %>
+        <%= hidden_field_tag attachments_field_name, signed_id, id: nil %>
+      <% end %>
+    <% end %>
+  <% end %>
+  <% if @options.key?(:description) %>
+    <p class="mt-1 text-xs text-gray-400"><%= @options[:description] %></p>
+  <% end %>
+  <% if @form.error?(@name) %>
+    <%= @form.error(@name, class: "text-red-500 text-sm mt-1") %>
+  <% end %>
+</div>

data/app/components/moduler/form/wysiwyg_component.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Moduler
+  class Form::WysiwygComponent < ViewComponent::Base
+    ACTIONS = {
+      bold: "font-semibold",
+      italic: "italic",
+      h1: "font-semibold",
+      h2: "font-semibold",
+      h3: "font-semibold",
+      quote: "",
+      code: "font-mono",
+      ul: "",
+      ol: "",
+      fencedCode: "font-mono",
+      link: "",
+      image: ""
+    }.freeze
+
+    def initialize(form, name, options = {})
+      @form = form
+      @name = name
+      @options = options
+    end
+
+    def rows
+      @options.fetch(:rows, 14)
+    end
+
+    # Name of the has_many_attached association that receives uploaded images,
+    # `attachments: false` disables uploading.
+    def attachments
+      @options.fetch(:attachments, :images)
+    end
+
+    def upload?
+      attachments.present? && @form.object.respond_to?(attachments)
+    end
+
+    def attachments_field_name
+      "#{@form.object_name}[#{attachments}][]"
+    end
+
+    # Assigning has_many_attached replaces existing attachments, so already attached
+    # blobs are submitted again together with the newly uploaded ones. Blobs rejected
+    # by validation are not persisted, so they have no signed id and are skipped.
+    def attached_signed_ids
+      @form.object.public_send(attachments).map(&:blob).select(&:persisted?).map(&:signed_id)
+    end
+
+    def controller_data
+      data = { controller: "wysiwyg" }
+      return data unless upload?
+
+      data.merge(
+        wysiwyg_direct_upload_url_value: helpers.main_app.rails_direct_uploads_path,
+        wysiwyg_blob_url_value: helpers.main_app.rails_service_blob_path(":signed_id", ":filename"),
+        wysiwyg_attachments_field_name_value: attachments_field_name
+      )
+    end
+  end
+end

data/app/components/moduler/list_component.html.erb

@@ -0,0 +1,15 @@
+<div class="mt-6 flex-1">
+  <% if @collection.any? %>
+    <ul id="<%= @options[:id] %>" role="list" class="divide-y divide-slate-100 rounded-lg border border-slate-200 bg-white">
+      <%= content %>
+    </ul>
+  <% else %>
+    <p class="rounded-lg border border-dashed border-slate-300 px-4 py-8 text-center text-sm text-slate-500"><%= empty_message %></p>
+  <% end %>
+</div>
+
+<% if paginated? %>
+  <div class="mt-4 flex justify-end">
+    <%= helpers.paginate @collection %>
+  </div>
+<% end %>

data/app/components/moduler/list_component.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Moduler
+  class ListComponent < ViewComponent::Base
+    def initialize(collection, options = {})
+      @collection = collection
+      @options = options
+    end
+
+    def empty_message
+      @options.fetch(:empty) { t("moduler.components.list.empty") }
+    end
+
+    def paginated?
+      @collection.respond_to?(:total_pages)
+    end
+  end
+end

data/app/components/moduler/list_item_component.html.erb

@@ -0,0 +1,23 @@
+<li id="<%= @options[:id] %>" class="flex items-center justify-between gap-4 px-4 py-4 sm:px-5">
+  <div class="min-w-0">
+    <div class="flex flex-wrap items-center gap-2">
+      <p class="truncate text-sm font-semibold text-gray-900"><%= @title %></p>
+
+      <% badges.each do |badge| %>
+        <%= badge %>
+      <% end %>
+    </div>
+
+    <% if meta? %>
+      <p class="mt-1 text-xs text-slate-400"><%= meta %></p>
+    <% end %>
+  </div>
+
+  <% if actions? %>
+    <div class="flex shrink-0 items-center gap-2">
+      <% actions.each do |action| %>
+        <%= action %>
+      <% end %>
+    </div>
+  <% end %>
+</li>

data/app/components/moduler/list_item_component.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Moduler
+  class ListItemComponent < ViewComponent::Base
+    renders_many :badges, Moduler::BadgeComponent
+    renders_one :meta
+    renders_many :actions
+
+    def initialize(title, options = {})
+      @title = title
+      @options = options
+    end
+  end
+end

data/app/components/moduler/page_header_component.html.erb

@@ -0,0 +1,16 @@
+<div class="mb-6 flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
+  <div>
+    <h1 class="text-base font-semibold text-gray-900"><%= @title %></h1>
+    <% if @options.key?(:description) %>
+      <p class="mt-1 text-sm text-slate-500"><%= @options[:description] %></p>
+    <% end %>
+  </div>
+
+  <% if actions? %>
+    <div class="flex shrink-0 items-center gap-2">
+      <% actions.each do |action| %>
+        <%= action %>
+      <% end %>
+    </div>
+  <% end %>
+</div>

data/app/components/moduler/page_header_component.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Moduler
+  class PageHeaderComponent < ViewComponent::Base
+    renders_many :actions
+
+    def initialize(title, options = {})
+      @title = title
+      @options = options
+    end
+  end
+end

data/app/components/moduler/sidebar_action_component.html.erb

@@ -0,0 +1,5 @@
+<% if active? %>
+  <%= link_to @action, @route, class: "rounded-md px-3 py-2 bg-slate-100 font-medium text-gray-900" %>
+<% else %>
+  <%= link_to @action, @route, class: "rounded-md px-3 py-2 text-slate-500 hover:bg-slate-50 hover:text-gray-900" %>
+<% end %>

data/app/components/moduler/sidebar_action_component.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Moduler
+  class SidebarActionComponent < ViewComponent::Base
+    def initialize(action, route, expected_controller)
+      @action = action
+      @route = route
+      @expected_controller = expected_controller
+    end
+
+    def active?
+      controller_path.eql?(@expected_controller)
+    end
+  end
+end

data/app/controllers/concerns/moduler/authentication.rb

@@ -28,7 +28,9 @@ module Moduler
     end
 
     def find_session_by_cookie
-      Session.find_by(id: cookies.signed[:session_id], signed_out_at: nil) if cookies.signed[:session_id]
+      if cookies.signed[:session_id]
+        Session.active.find_by(id: cookies.signed[:session_id], signed_in_at: Session::LIFETIME.ago..)
+      end
     end
 
     def request_authentication
@@ -42,7 +44,13 @@ module Moduler
     def start_new_session_for(user)
       user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip, signed_in_at: Time.current).tap do |session|
         Current.session = session
-        cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }
+        cookies.signed[:session_id] = {
+          value: session.id,
+          expires: Session::LIFETIME.from_now,
+          httponly: true,
+          same_site: :lax,
+          secure: Rails.env.production?
+        }
       end
     end
 

data/app/controllers/moduler/administration/application_controller.rb

@@ -0,0 +1,7 @@
+module Moduler
+  module Administration
+    class ApplicationController < ::Moduler::ApplicationController
+      after_action :verify_authorized
+    end
+  end
+end

data/app/controllers/moduler/administration/articles_controller.rb

@@ -0,0 +1,57 @@
+module Moduler
+  module Administration
+    class ArticlesController < ApplicationController
+      before_action -> { authorize([ :moduler, :administration, :article ]) }
+      before_action :set_article, only: %i[ edit update destroy ]
+
+      def index
+        @filter, @articles = QueryFilter.new(Article, permitted_filter_parameters).call
+      end
+
+      def new
+        @article = Article.new
+      end
+
+      def create
+        @article = Article.new(permitted_parameters)
+
+        if @article.save
+          redirect_to moduler.administration_articles_path, notice: t(".notice")
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit; end
+
+      def update
+        if @article.update(permitted_parameters)
+          redirect_to moduler.administration_articles_path, notice: t(".notice")
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @article.destroy!
+
+        redirect_to moduler.administration_articles_path, status: :see_other, notice: t(".notice")
+      end
+
+      private
+
+      def set_article
+        @article = Article.find(params[:id])
+        authorize(@article, policy_class: ArticlePolicy)
+      end
+
+      def permitted_parameters
+        params.expect(article: [ :path, :title, :description, :keywords, :content, images: [] ])
+      end
+
+      def permitted_filter_parameters
+        (params.permit(filter: %i[ query ])[:filter] || {}).merge(params.permit(:page))
+      end
+    end
+  end
+end

data/app/controllers/moduler/administration/home_controller.rb

@@ -0,0 +1,9 @@
+module Moduler
+  module Administration
+    class HomeController < ApplicationController
+      before_action -> { authorize([ :moduler, :administration, :home ]) }
+
+      def index; end
+    end
+  end
+end

data/app/controllers/moduler/administration/sessions_controller.rb

@@ -0,0 +1,34 @@
+module Moduler
+  module Administration
+    class SessionsController < ApplicationController
+      before_action -> { authorize([ :moduler, :administration, :session ]) }
+      before_action :set_session, only: %i[ destroy ]
+
+      def index
+        @filter, @sessions = QueryFilter.new(Session.includes(:user), permitted_filter_parameters).call
+      end
+
+      def destroy
+        @session.touch(:signed_out_at)
+
+        if @session == Current.session
+          cookies.delete(:session_id)
+          redirect_to moduler.new_session_path, status: :see_other
+        else
+          redirect_to moduler.administration_sessions_path, status: :see_other, notice: t(".notice")
+        end
+      end
+
+      private
+
+      def set_session
+        @session = Session.active.find(params[:id])
+        authorize(@session, policy_class: SessionPolicy)
+      end
+
+      def permitted_filter_parameters
+        (params.permit(filter: %i[ query ])[:filter] || {}).merge(params.permit(:page))
+      end
+    end
+  end
+end

data/app/controllers/moduler/administration/users_controller.rb

@@ -0,0 +1,56 @@
+module Moduler
+  module Administration
+    class UsersController < ApplicationController
+      before_action -> { authorize([ :moduler, :administration, :user ]) }
+      before_action :set_user, only: %i[ edit update ]
+
+      def index
+        @filter, @users = QueryFilter.new(User, permitted_filter_parameters).call
+      end
+
+      def new
+        @user = User.new
+      end
+
+      def create
+        @user = User.new(permitted_parameters)
+
+        if @user.save
+          redirect_to moduler.administration_users_path, notice: t(".notice")
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        if @user.update(permitted_update_parameters)
+          redirect_to moduler.administration_users_path, notice: t(".notice")
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      private
+
+      def set_user
+        @user = User.find(params[:id])
+        authorize(@user, policy_class: UserPolicy)
+      end
+
+      def permitted_parameters
+        params.expect(user: %i[ email_address role password ])
+      end
+
+      def permitted_update_parameters
+        params.expect(user: %i[ email_address role ])
+      end
+
+      def permitted_filter_parameters
+        (params.permit(filter: %i[ query ])[:filter] || {}).merge(params.permit(:page))
+      end
+    end
+  end
+end

data/app/controllers/moduler/application_controller.rb

@@ -1,7 +1,22 @@
 module Moduler
   class ApplicationController < ActionController::Base
     include Authentication
+    include Pundit::Authorization
 
     default_form_builder FormBuilder
+
+    rescue_from Pundit::NotAuthorizedError, with: :not_authorized
+
+    helper_method :current_user
+
+    private
+
+    def current_user
+      Current.user
+    end
+
+    def not_authorized
+      redirect_to moduler.root_path, alert: t("moduler.flash.not_authorized")
+    end
   end
 end

data/app/controllers/moduler/articles_controller.rb

@@ -0,0 +1,15 @@
+module Moduler
+  class ArticlesController < ApplicationController
+    layout "moduler/articles"
+
+    allow_unauthenticated_access
+
+    def index
+      @articles = Article.order(created_at: :desc).page(params[:page])
+    end
+
+    def show
+      @article = Article.find_by!(path: params[:path])
+    end
+  end
+end

data/app/controllers/moduler/profile/sessions/revocation_controller.rb

@@ -0,0 +1,14 @@
+module Moduler
+  module Profile
+    module Sessions
+      class RevocationController < ApplicationController
+        def destroy
+          Current.user.sessions.active.update_all(signed_out_at: Time.current)
+          cookies.delete(:session_id)
+
+          redirect_to moduler.new_session_path, status: :see_other
+        end
+      end
+    end
+  end
+end

data/app/controllers/moduler/profile/sessions_controller.rb

@@ -0,0 +1,21 @@
+module Moduler
+  module Profile
+    class SessionsController < ApplicationController
+      def index
+        @sessions = Current.user.sessions.order(created_at: :desc).page(params[:page]).per(10)
+      end
+
+      def destroy
+        session = Current.user.sessions.active.find(params[:id])
+        session.touch(:signed_out_at)
+
+        if session == Current.session
+          cookies.delete(:session_id)
+          redirect_to moduler.new_session_path, status: :see_other
+        else
+          redirect_to moduler.profile_sessions_path, status: :see_other
+        end
+      end
+    end
+  end
+end

data/app/controllers/moduler/profile_controller.rb

@@ -0,0 +1,27 @@
+module Moduler
+  class ProfileController < ApplicationController
+    def edit
+      @user = Current.user
+    end
+
+    def update
+      @user = Current.user
+
+      @user.assign_attributes(permitted_parameters)
+
+      if @user.save(context: :self_service_update)
+        @user.sessions.active.where.not(id: Current.session.id).update_all(signed_out_at: Time.current) if @user.saved_change_to_password_digest?
+
+        redirect_to moduler.edit_profile_path, notice: t(".notice")
+      else
+        render :edit, status: :unprocessable_entity
+      end
+    end
+
+    private
+
+    def permitted_parameters
+      params.expect(user: %i[ password_challenge password password_confirmation ])
+    end
+  end
+end

data/app/controllers/moduler/sessions_controller.rb

@@ -2,6 +2,13 @@ module Moduler
   class SessionsController < ApplicationController
     allow_unauthenticated_access only: %i[ new create ]
 
+    rate_limit to: 10, within: 3.minutes, only: :create,
+      with: -> { redirect_to moduler.new_session_path, alert: t("moduler.sessions.create.rate_limited") }
+
+    rate_limit to: 5, within: 3.minutes, only: :create,
+      by: -> { params.dig(:user, :email_address) },
+      with: -> { redirect_to moduler.new_session_path, alert: t("moduler.sessions.create.rate_limited") }
+
     def new
       if authenticated?
         redirect_to after_authentication_url
@@ -26,7 +33,7 @@ module Moduler
 
     def destroy
       terminate_session
-      redirect_to moduler.new_session_path
+      redirect_to moduler.new_session_path, status: :see_other
     end
   end
 end

data/app/controllers/moduler/users_controller.rb

@@ -2,6 +2,13 @@ module Moduler
   class UsersController < ApplicationController
     allow_unauthenticated_access only: %i[ new create ]
 
+    rate_limit to: 10, within: 3.minutes, only: :create,
+      with: -> { redirect_to moduler.new_user_path, alert: t("moduler.users.create.rate_limited") }
+
+    rate_limit to: 5, within: 3.minutes, only: :create,
+      by: -> { params.dig(:user, :email_address) },
+      with: -> { redirect_to moduler.new_user_path, alert: t("moduler.users.create.rate_limited") }
+
     def new
       if authenticated?
         redirect_to after_authentication_url

data/app/filters/application_filter.rb

@@ -0,0 +1,41 @@
+class ApplicationFilter
+  include ActiveModel::Model
+  include ActiveModel::Dirty
+  include ActiveModel::Attributes
+
+  class << self
+    def modifiers
+      @modifiers ||= []
+    end
+  end
+
+  def initialize(scope, parameters, options = {})
+    super(parameters)
+
+    @scope = scope
+    @options = options
+  end
+
+  def call
+    [ filter, results ]
+  end
+
+  private
+
+  def filter
+    return self unless changed?
+
+    tap(&:valid?)
+  end
+
+  def results
+    return @scope.none.page(1) if !changed? && @options.fetch(:allow_empty, false)
+    return @scope.none.page(1) if invalid?
+
+    self.class.modifiers.each do |modifier|
+      @scope = modifier.call(@scope, self) || @scope
+    end
+
+    @scope
+  end
+end

data/app/filters/query_filter.rb

@@ -0,0 +1,18 @@
+class QueryFilter < ApplicationFilter
+  attribute :query, :string
+  attribute :page, :integer
+
+  validates :query, length: { maximum: 100 }
+
+  modifiers << proc do |scope, filter|
+    scope.page(filter.page).per(10)
+  end
+
+  modifiers << proc do |scope, _filter|
+    scope.order(created_at: :desc)
+  end
+
+  modifiers << proc do |scope, filter|
+    scope.search_by_query(filter.query) if filter.query.present?
+  end
+end

data/app/lib/moduler/form_builder.rb

@@ -5,7 +5,7 @@ module Moduler
 
       @template.content_tag :div, **options do
         @object.errors[field].first
-      end.html_safe
+      end
     end
 
     def full_error(field, options = {})
@@ -13,7 +13,7 @@ module Moduler
 
       @template.content_tag :div, **options do
         @object.errors.full_messages_for(field).first
-      end.html_safe
+      end
     end
 
     def error?(field)