nquery 0.1.2 → 0.1.3

data/app/controllers/nquery/public_resources_controller.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Nquery
+  class PublicResourcesController < ActionController::Base
+    include Nquery::Engine.routes.url_helpers
+    include ChartResults
+
+    protect_from_forgery with: :exception
+    layout "nquery/embed"
+
+    helper Nquery::Engine.helpers
+    helper_method :current_nquery_user, :embed_titled?, :embed_bordered?, :embed_theme, :embed_appearance_classes
+
+    after_action :set_embed_headers
+
+    def self.apply_embed_rate_limit(to: self)
+      if to.respond_to?(:rate_limit)
+        to.rate_limit to: 60, within: 1.minute, by: -> { request.remote_ip }
+      else
+        Rails.logger.warn("[nquery] public/embed endpoints are not rate limited; Rails 7.2+ rate_limit is unavailable")
+      end
+    end
+    apply_embed_rate_limit
+
+    private
+
+    def current_nquery_user
+      nil
+    end
+
+    def embed_titled?
+      params[:titled] != "false"
+    end
+
+    def embed_bordered?
+      params[:bordered] != "false"
+    end
+
+    def embed_theme
+      theme = params[:theme].to_s
+      theme.presence_in(%w[night transparent])
+    end
+
+    def embed_appearance_classes
+      classes = ["nq-embed-body"]
+      classes << "nq-embed-untitled" unless embed_titled?
+      classes << "nq-embed-borderless" unless embed_bordered?
+      classes << "nq-embed-theme-#{embed_theme}" if embed_theme
+      classes
+    end
+
+    def set_embed_headers
+      response.headers.delete("X-Frame-Options")
+      response.headers["Content-Security-Policy"] = "frame-ancestors #{frame_ancestors_value}"
+      response.headers["X-Robots-Tag"] = "noindex"
+    end
+
+    def frame_ancestors_value
+      ancestors = Nquery.configuration.embed_frame_ancestors
+      ancestors.present? ? Array(ancestors).join(" ") : "*"
+    end
+
+    def render_unavailable(status:, message: "This visualization is not available.")
+      @unavailable_message = message
+      render template: "nquery/embed/unavailable", status: status
+    end
+
+    def render_forbidden(message = "Invalid or expired embed token")
+      render_unavailable(status: :forbidden, message: message)
+    end
+
+    def load_dashboard_cards(dashboard)
+      dashboard.dashboard_cards
+        .joins(:chart)
+        .merge(Chart.active)
+        .includes(chart: { query: :data_source })
+    end
+  end
+end

data/app/controllers/nquery/queries_controller.rb

@@ -2,55 +2,20 @@
 
 module Nquery
   class QueriesController < ApplicationController
-    before_action :set_query, only: %i[show edit update]
-    before_action :authorize_query_collection!, only: %i[show edit update]
+    before_action :set_query, only: :update
+    before_action :authorize_query_collection!, only: :update
     before_action :set_data_source_for_run, only: %i[run schema]
     before_action :authorize_run_data_source!, only: %i[run schema]
 
-    def new
-      @query = Query.new(statement: "SELECT 1 AS example")
-      @data_sources = DataSource.active.order(:name)
-      @schema_tables = schema_tables
-    end
-
-    def create
-      @query = Query.new(query_params.merge(creator: current_nquery_user))
-      if @query.save
-        redirect_to edit_query_path(@query), notice: "Query created."
-      else
-        @data_sources = DataSource.active.order(:name)
-        @schema_tables = schema_tables
-        render :new, status: :unprocessable_content
-      end
-    end
-
-    def edit
-      @data_sources = DataSource.active.order(:name)
-      @schema_tables = schema_tables
-    end
-
     def update
       if @query.update(query_params)
-        respond_to do |format|
-          format.html { redirect_to edit_query_path(@query), notice: "Query saved." }
-          format.json { render json: { ok: true, notice: "Query saved." } }
-        end
+        render json: { ok: true, notice: "Query saved." }
       else
-        @data_sources = DataSource.active.order(:name)
-        @schema_tables = schema_tables
-        respond_to do |format|
-          format.html { render :edit, status: :unprocessable_content }
-          format.json {
-            render json: { error: @query.errors.full_messages.to_sentence.presence || "Query could not be saved." },
-                   status: :unprocessable_content
-          }
-        end
+        render json: { error: @query.errors.full_messages.to_sentence.presence || "Query could not be saved." },
+               status: :unprocessable_content
       end
     end
 
-    def show
-    end
-
     def run
       result = QueryRunner.new(
         data_source: @data_source,
@@ -91,14 +56,5 @@ module Nquery
     def query_params
       params.require(:query).permit(:name, :statement, :data_source_id, :collection_id)
     end
-
-    def schema_tables
-      data_source = DataSource.first
-      return [] unless data_source
-
-      DataSources::Adapter.for(data_source).tables
-    rescue StandardError
-      []
-    end
   end
 end

data/app/controllers/nquery/sharing/base_controller.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Sharing
+    class BaseController < ApplicationController
+      before_action :set_shareable
+      before_action :authorize_shareable_publish!, only: %i[create update]
+      before_action :authorize_shareable_revoke!, only: %i[destroy]
+
+      private
+
+      def set_shareable
+        @shareable = if params[:chart_id]
+                       Chart.find(params[:chart_id])
+                     else
+                       Dashboard.find(params[:dashboard_id])
+                     end
+      end
+
+      def authorize_shareable_publish!
+        authorize_shareable_collection!
+        return if performed?
+
+        if shareable_missing_data_source?
+          deny_collection_access!(missing_data_source_message)
+          return
+        end
+
+        shareable_data_sources.each do |data_source|
+          authorize_data_source_access!(data_source)
+          return if performed?
+        end
+      end
+
+      def authorize_shareable_revoke!
+        authorize_shareable_collection!
+      end
+
+      def authorize_shareable_collection!
+        return if permission_resolver.admin?
+
+        if @shareable.collection.nil?
+          deny_collection_access!("You do not have permission to access this collection.")
+          return
+        end
+
+        authorize_collection_access!(@shareable.collection, required: :curate)
+      end
+
+      def shareable_charts
+        if @shareable.is_a?(Chart)
+          [@shareable]
+        else
+          @shareable.dashboard_cards
+            .joins(:chart)
+            .merge(Chart.active)
+            .includes(chart: { query: :data_source })
+            .map(&:chart)
+        end
+      end
+
+      def shareable_data_sources
+        shareable_charts.filter_map(&:data_source).uniq
+      end
+
+      def shareable_missing_data_source?
+        shareable_charts.any? { |chart| chart.query && chart.data_source.nil? }
+      end
+
+      def missing_data_source_message
+        if @shareable.is_a?(Chart)
+          "This chart has no data source."
+        else
+          "A chart on this dashboard has no data source."
+        end
+      end
+
+      def sharing_page_path
+        if params[:chart_id] && params[:dashboard_id]
+          embed_dashboard_chart_path(params[:dashboard_id], params[:chart_id])
+        elsif params[:chart_id]
+          embed_chart_path(params[:chart_id])
+        else
+          embed_dashboard_path(params[:dashboard_id])
+        end
+      end
+    end
+  end
+end

data/app/controllers/nquery/sharing/embed_tokens_controller.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Sharing
+    class EmbedTokensController < BaseController
+      def create
+        unless Nquery.configuration.static_embedding_enabled
+          return redirect_to sharing_page_path, alert: "Static embedding is disabled."
+        end
+
+        @shareable.embed_tokens.active.find_each { |token| EmbedTokenService.revoke!(token) }
+        EmbedTokenService.sign(
+          resource_type: @shareable.class.name,
+          resource_id: @shareable.id,
+          creator: current_nquery_user,
+          expires_at: expires_at_from_param
+        )
+        @shareable.update!(enable_embedding: true) unless @shareable.enable_embedding?
+
+        redirect_to sharing_page_path, notice: "Embed token generated."
+      end
+
+      def destroy
+        token = @shareable.embed_tokens.find(params[:id])
+        EmbedTokenService.revoke!(token)
+        redirect_to sharing_page_path, notice: "Embed token revoked."
+      end
+
+      private
+
+      def expires_at_from_param
+        case params[:expires_in]
+        when "1.day" then 1.day.from_now
+        when "30.days" then 30.days.from_now
+        when "never" then nil
+        else 1.hour.from_now
+        end
+      end
+    end
+  end
+end

data/app/controllers/nquery/sharing/embeddings_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Sharing
+    class EmbeddingsController < BaseController
+      def update
+        unless Nquery.configuration.static_embedding_enabled
+          return redirect_to sharing_page_path, alert: "Static embedding is disabled."
+        end
+
+        enabled = Nquery::Boolean.cast(params[:enable_embedding])
+        @shareable.update!(enable_embedding: enabled)
+        redirect_to sharing_page_path, notice: enabled ? "Embedding enabled." : "Embedding disabled."
+      end
+    end
+  end
+end

data/app/controllers/nquery/sharing/public_links_controller.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Sharing
+    class PublicLinksController < BaseController
+      def create
+        unless Nquery.configuration.public_sharing_enabled
+          return redirect_to sharing_page_path, alert: "Public sharing is disabled."
+        end
+
+        @shareable.share_publicly!(user: current_nquery_user)
+        redirect_to sharing_page_path, notice: "Public link created."
+      end
+
+      def destroy
+        @shareable.unshare_publicly!
+        redirect_to sharing_page_path, notice: "Public link removed."
+      end
+    end
+  end
+end

data/app/helpers/nquery/charts_helper.rb

@@ -18,6 +18,10 @@ module Nquery
       dashboard ? embed_dashboard_chart_path(dashboard, chart) : embed_chart_path(chart)
     end
 
+    def dashboard_embed_path(dashboard)
+      embed_dashboard_path(dashboard)
+    end
+
     def chart_archive_path(chart, dashboard: chart_dashboard)
       dashboard ? archive_dashboard_chart_path(dashboard, chart) : archive_chart_path(chart)
     end
@@ -29,5 +33,14 @@ module Nquery
     def chart_builder_chart_types
       Chart::CHART_TYPES - %w[table]
     end
+
+    def chart_builder_data(chart, result: nil)
+      {
+        controller: "chart-builder",
+        query_save_url: chart.query&.persisted? ? query_path(chart.query) : nil,
+        query_run_url: run_queries_path,
+        query_schema_url: schema_queries_path
+      }.tap { |data| data[:initial_result] = result if result.present? }
+    end
   end
 end

data/app/helpers/nquery/sharing_helper.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Nquery
+  module SharingHelper
+    EMBED_EXPIRY_OPTIONS = [
+      ["1 hour", "1.hour"],
+      ["1 day", "1.day"],
+      ["30 days", "30.days"],
+      ["Never", "never"]
+    ].freeze
+
+    def shareable_public_link_path(resource)
+      case resource
+      when Chart
+        chart_dashboard ? dashboard_chart_public_link_path(chart_dashboard, resource) : chart_public_link_path(resource)
+      when Dashboard
+        dashboard_public_link_path(resource)
+      end
+    end
+
+    def shareable_embedding_path(resource)
+      case resource
+      when Chart
+        chart_dashboard ? dashboard_chart_embedding_path(chart_dashboard, resource) : chart_embedding_path(resource)
+      when Dashboard
+        dashboard_embedding_path(resource)
+      end
+    end
+
+    def shareable_embed_tokens_path(resource)
+      case resource
+      when Chart
+        chart_dashboard ? dashboard_chart_embed_tokens_path(chart_dashboard, resource) : chart_embed_tokens_path(resource)
+      when Dashboard
+        dashboard_embed_tokens_path(resource)
+      end
+    end
+
+    def shareable_embed_token_path(resource, token)
+      case resource
+      when Chart
+        if chart_dashboard
+          dashboard_chart_embed_token_path(chart_dashboard, resource, token)
+        else
+          chart_embed_token_path(resource, token)
+        end
+      when Dashboard
+        dashboard_embed_token_path(resource, token)
+      end
+    end
+
+    def can_curate_shareable?(resource)
+      return true if permission_resolver.admin?
+      return false if resource.collection.nil?
+
+      permission_resolver.collection_access(resource.collection) == :curate
+    end
+
+    def share_iframe_snippet(url, height: 600)
+      %(<iframe src="#{url}" width="800" height="#{height}" frameborder="0" loading="lazy"></iframe>)
+    end
+
+    def share_iframe_height(resource)
+      resource.is_a?(Dashboard) ? 800 : 600
+    end
+  end
+end

data/app/javascript/nquery/controllers/chart_preview_controller.js

@@ -1,5 +1,13 @@
 import { Controller } from "@hotwired/stimulus"
 
+function escapeHtml(value) {
+  return String(value)
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+}
+
 function columnIndex(columns, name) {
   const index = columns.indexOf(name)
   return index >= 0 ? index : 0
@@ -72,10 +80,20 @@ export default class extends Controller {
   connect() {
     if (typeof Chart === "undefined") return
 
+    Chart.defaults.font.family = '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif'
+    Chart.defaults.color = document.body.classList.contains("nq-embed-theme-night") ? "#e2e8f0" : "#1e293b"
+
     const demo = this.hasDataValue ? this.dataValue : {
       columns: ["month", "revenue"],
       rows: [["Jan", 1200], ["Feb", 1800], ["Mar", 2400]]
     }
+
+    if (demo.error) {
+      this.element.classList.add("is-error")
+      this.element.innerHTML = `<div class="nq-chart-error">${escapeHtml(demo.error)}</div>`
+      return
+    }
+
     const type = this.typeValue || "bar"
     const xCol = this.hasXValue ? this.xValue : ""
     const yCol = this.hasYValue ? this.yValue : ""
@@ -84,7 +102,7 @@ export default class extends Controller {
       const yIndex = columnIndex(demo.columns || [], yCol || demo.columns?.[1] || demo.columns?.[0])
       const value = demo.rows?.[0]?.[yIndex] ?? "—"
       this.element.classList.add("is-number")
-      this.element.innerHTML = `<div class="nq-number-display">${value}</div>`
+      this.element.innerHTML = `<div class="nq-number-display">${escapeHtml(value)}</div>`
       return
     }
 

data/app/javascript/nquery/controllers/clipboard_controller.js

@@ -0,0 +1,23 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static values = { text: String }
+
+  async copy(event) {
+    event.preventDefault()
+    const button = event.currentTarget
+    const targetSelector = button.dataset.copyTarget
+    const target = targetSelector ? document.querySelector(targetSelector) : null
+    const text = target ? target.textContent : this.textValue
+    const original = button.textContent
+
+    try {
+      await navigator.clipboard.writeText(text.trim())
+      button.textContent = "Copied"
+    } catch {
+      button.textContent = "Copy failed"
+    }
+
+    setTimeout(() => { button.textContent = original }, 1500)
+  }
+}

data/app/models/concerns/nquery/shareable.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Shareable
+    extend ActiveSupport::Concern
+
+    included do
+      resource_class_name = name
+
+      belongs_to :made_public_by, class_name: "Nquery::User", optional: true
+      has_many :embed_tokens, -> { where(resource_type: resource_class_name) },
+               class_name: "Nquery::EmbedToken", foreign_key: :resource_id, dependent: :destroy
+
+      scope :publicly_shared, -> { where.not(public_uuid: nil) }
+      scope :embedding_enabled, -> { where(enable_embedding: true) }
+
+      validates :public_uuid, uniqueness: true, allow_nil: true
+    end
+
+    def publicly_shared?
+      public_uuid.present?
+    end
+
+    def share_publicly!(user:)
+      return self if publicly_shared?
+
+      update!(
+        public_uuid: SecureRandom.uuid,
+        made_public_by: user,
+        public_shared_at: Time.current
+      )
+      self
+    end
+
+    def unshare_publicly!
+      update!(public_uuid: nil, made_public_by: nil, public_shared_at: nil)
+    end
+
+    def active_embed_token
+      embed_tokens.active.order(created_at: :desc).first
+    end
+  end
+end

data/app/models/nquery/chart.rb

@@ -4,12 +4,12 @@ module Nquery
   class Chart < ApplicationRecord
     CHART_TYPES = %w[table number bar line area pie scatter].freeze
 
+    include Shareable
+
     belongs_to :query, class_name: "Nquery::Query", optional: true
     belongs_to :collection, class_name: "Nquery::Collection", optional: true
     belongs_to :creator, class_name: "Nquery::User", optional: true
     has_many :dashboard_cards, class_name: "Nquery::DashboardCard", dependent: :destroy
-    has_many :embed_tokens, -> { where(resource_type: "Nquery::Chart") },
-             class_name: "Nquery::EmbedToken", foreign_key: :resource_id, dependent: :destroy
 
     accepts_nested_attributes_for :query
 
@@ -33,5 +33,17 @@ module Nquery
     def chart_type
       visualization["type"] || "bar"
     end
+
+    def statement
+      query&.statement
+    end
+
+    def statement?
+      query&.statement? || false
+    end
+
+    def data_source
+      query&.data_source
+    end
   end
 end

data/app/models/nquery/dashboard.rb

@@ -2,6 +2,8 @@
 
 module Nquery
   class Dashboard < ApplicationRecord
+    include Shareable
+
     belongs_to :collection, class_name: "Nquery::Collection"
     belongs_to :creator, class_name: "Nquery::User", optional: true
     has_many :dashboard_cards, class_name: "Nquery::DashboardCard", dependent: :destroy

data/app/models/nquery/data_source.rb

@@ -42,7 +42,7 @@ module Nquery
     scope :active, -> { all }
 
     def connection_fields_submitted?
-      ActiveModel::Type::Boolean.new.cast(connection_fields_submitted)
+      Nquery::Boolean.cast(connection_fields_submitted)
     end
 
     def connection_config_hash

data/app/models/nquery/query.rb

@@ -17,6 +17,10 @@ module Nquery
       self.name ||= "Untitled query"
     end
 
+    def statement?
+      statement.present?
+    end
+
     private
 
     def statement_must_be_readonly

data/app/views/layouts/nquery/embed.html.erb

@@ -3,10 +3,12 @@
   <head>
     <title>nquery embed</title>
     <meta name="viewport" content="width=device-width,initial-scale=1">
+    <meta name="robots" content="noindex">
     <%= stylesheet_link_tag "nquery/application" %>
     <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
+    <%= javascript_include_tag "nquery/application", defer: true %>
   </head>
-  <body class="nq-embed-body">
+  <body class="<%= embed_appearance_classes.join(" ") %>">
     <%= yield %>
   </body>
 </html>

data/app/views/nquery/charts/_builder_form.html.erb

@@ -1,13 +1,8 @@
 <% viz = chart.visualization.is_a?(Hash) ? chart.visualization : {} %>
 <% chart_type = viz["type"].presence || "table" %>
 <% active_chart_type = chart_builder_chart_types.include?(chart_type) ? chart_type : "bar" %>
-<% builder_data = {
-     controller: "chart-builder",
-     query_save_url: chart.query&.persisted? ? query_path(chart.query) : nil
-   } %>
-<% builder_data[:initial_result] = result if local_assigns[:result].present? %>
 <%= form_with model: chart, url: form_url, class: "nq-form nq-chart-builder-form", html: {
-      data: builder_data
+      data: chart_builder_data(chart, result: result)
     } do |f| %>
   <%= render "nquery/charts/new_header",
              f: f,

data/app/views/nquery/charts/embed.html.erb

@@ -2,14 +2,8 @@
   <h1>Embed: <%= @chart.name %></h1>
 </div>
 
-<div class="nq-card">
-  <h2>Embed settings</h2>
-  <% if @embed_token %>
-    <p class="nq-muted">Signed embed token (expires <%= @embed_token.expires_at&.to_fs(:long) || "never" %>)</p>
-    <pre class="nq-code"><%= @embed_url %></pre>
-    <h3>Iframe snippet</h3>
-    <pre class="nq-code">&lt;iframe src="<%= @embed_url %>" width="800" height="600" frameborder="0"&gt;&lt;/iframe&gt;</pre>
-  <% else %>
-    <p class="nq-muted">No embed token yet. Generate one from the admin panel (phase 1 UI placeholder).</p>
-  <% end %>
-</div>
+<%= render "nquery/shared/sharing_panel",
+           shareable: @shareable,
+           public_url: @public_url,
+           embed_url: @embed_url,
+           embed_token: @embed_token %>

data/app/views/nquery/charts/new.html.erb

@@ -2,4 +2,5 @@
            chart: @chart,
            form_url: charts_path,
            data_sources: @data_sources,
-           schema: @schema %>
+           schema: @schema,
+           result: nil %>

data/app/views/nquery/dashboard/charts/new.html.erb

@@ -3,4 +3,5 @@
            dashboard: @dashboard,
            form_url: dashboard_charts_path(@dashboard),
            data_sources: @data_sources,
-           schema: @schema %>
+           schema: @schema,
+           result: nil %>

data/app/views/nquery/dashboards/embed.html.erb

@@ -0,0 +1,9 @@
+<div class="nq-page-header">
+  <h1>Embed: <%= @dashboard.name %></h1>
+</div>
+
+<%= render "nquery/shared/sharing_panel",
+           shareable: @shareable,
+           public_url: @public_url,
+           embed_url: @embed_url,
+           embed_token: @embed_token %>