open_blog 0.1.0

data/lib/open_blog/findings/record_checks.rb

@@ -0,0 +1,94 @@
+require "uri"
+require "commonmarker"
+
+module OpenBlog
+  module Findings
+    module RecordChecks
+      class << self
+        def build
+          [
+            check(:description_absent, "T8", "Add a description for readers and search results.", "description") { |post, _| description(post).blank? },
+            check(:title_duplicate, "T7", "Another published post uses this title.", "title") { |post, _| other_posts(post).exists?(title: post.title) },
+            check(:description_duplicate, "T8", "Another published post uses this search description.", "search_description") { |post, _| duplicate_description?(post) },
+            check(:category_absent, "T21", "Choose a category for this post.", "category") { |post, _| primary_categories? && post.category.nil? },
+            check(:category_description_absent, "T21", "Add an introduction to this category.", "category.description") { |post, _| primary_categories? && post.category && post.category.description.blank? },
+            check(:faq_question_duplicate, nil, "An FAQ question appears more than once.", ->(_, _, index) { "faq[#{index}].question" }) { |post, _| duplicate_question(post) },
+            check(:faq_markup_in_answer, "E19", "FAQ answers display plain text; remove formatting markup.", ->(_, _, index) { "faq[#{index}].answer" }) { |post, _| markup_answer(post) },
+            check(:faq_in_body, nil, "Move this FAQ section into the post's FAQ entries to avoid duplicate content.", "body") { |post, _| post.markdown? && FaqExtraction.contains_faq_heading?(post.body_markdown) },
+            check(:author_default_used, "E1", "This post uses the configured default author.", "author") { |_, context| context[:author_default_used] },
+            check(:provenance_unknown, "E18", "Specify whether AI contributed to this post.", "provenance") { |post, _| post.provenance_unknown? },
+            check(:approval_absent, "E18", "This revision has no approval confirming its facts.", "approval") { |post, _| approval_absent?(post) },
+            check(:approval_incomplete, "E18", "The supplied approval says its facts were not checked.", "approval.facts_checked") { |_, context| context[:approval_incomplete] },
+            check(:connections_not_declared, "E21, E22", "Record any relevant relationships, including an explicit declaration of none.", "connections") { |post, _| !post.connection_declarations.exists? },
+            check(:responsible_party_absent, "E4", "Configure a page naming the person or organization responsible for the blog.") { |_, _| OpenBlog.policy_url(:responsible_party).blank? },
+            check(:canonical_off_site, "T5", "This canonical URL points outside the blog's configured origin.", "canonical_url") { |post, _| canonical_off_site?(post) },
+            check(:slug_changed, "T4", "The previous public URL now redirects to this post.", "slug") { |_, context| context[:slug_changed] },
+            check(:social_image_absent, "T17", "Choose a social image, cover image, or blog default image.", "social_image") { |post, _| post.cover_image_id.nil? && post.social_image_id.nil? && OpenBlog.config.default_social_image_url.blank? }
+          ]
+        end
+
+        private
+
+        def check(code, rule, message, location = nil, &predicate)
+          Check.new(code: code, rule: rule, message: message, location: location, &predicate)
+        end
+
+        def other_posts(post)
+          Post.listed.where.not(id: post.id)
+        end
+
+        def description(post)
+          post.search_description.presence || post.description
+        end
+
+        def duplicate_description?(post)
+          value = description(post)
+          value.present? && other_posts(post).pluck(:description, :search_description).any? do |editorial, search|
+            (search.presence || editorial) == value
+          end
+        end
+
+        def primary_categories?
+          OpenBlog.config.primary_list_type == :categories
+        end
+
+        def duplicate_question(post)
+          seen = []
+          post.faq_list.each_with_index do |entry, index|
+            question = entry[:question].to_s.unicode_normalize(:nfc).strip.downcase
+            return index if seen.include?(question)
+            seen << question
+          end
+          nil
+        end
+
+        def markup_answer(post)
+          post.faq_list.index { |entry| markup?(Commonmarker.parse(entry[:answer].to_s), entry[:answer].to_s) }
+        end
+
+        def markup?(node, source)
+          if node.type == :link
+            return true if source.match?(/[\[<]/)
+          elsif !%i[document paragraph text softbreak linebreak].include?(node.type)
+            return true
+          end
+          node.each.any? { |child| markup?(child, source) }
+        end
+
+        def approval_absent?(post)
+          return false if post.provenance_human_written? || (!post.published? && !post.scheduled?)
+          identifier = post.published? ? post.public_revision&.identifier : post.current_revision_identifier
+          !identifier || !post.approvals.joins(:revision).exists?(facts_checked: true, open_blog_revisions: { identifier: identifier })
+        end
+
+        def canonical_off_site?(post)
+          return false if post.canonical_url.blank? || OpenBlog.config.public_base_url.blank?
+          canonical, base = [ post.canonical_url, OpenBlog.config.public_base_url ].map { |value| URI.parse(value) }
+          [ canonical.scheme, canonical.host&.downcase, canonical.port ] != [ base.scheme, base.host&.downcase, base.port ]
+        rescue URI::InvalidURIError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/open_blog/findings/registry.rb

@@ -0,0 +1,18 @@
+module OpenBlog
+  module Findings
+    class Registry
+      def initialize
+        @checks = {}
+      end
+
+      def register(check)
+        @checks[check.code] = check
+        self
+      end
+
+      def for(post, context: {})
+        @checks.values.flat_map { |check| check.call(post, context: context) }
+      end
+    end
+  end
+end

data/lib/open_blog/findings.rb

@@ -0,0 +1,27 @@
+require_relative "findings/check"
+require_relative "findings/registry"
+require_relative "findings/record_checks"
+require_relative "findings/body_checks"
+require_relative "findings/link_check"
+
+module OpenBlog
+  module Findings
+    class << self
+      def registry
+        @registry ||= Registry.new.tap do |registry|
+          RecordChecks.build.each { |check| registry.register(check) }
+          BodyChecks.build.each { |check| registry.register(check) }
+          registry.register(LinkCheck.new)
+        end
+      end
+
+      def register(check)
+        registry.register(check)
+      end
+
+      def for(post, context: {})
+        registry.for(post, context: context.dup)
+      end
+    end
+  end
+end

data/lib/open_blog/image_fetch.rb

@@ -0,0 +1,115 @@
+require "net/http"
+require "resolv"
+require "ipaddr"
+require "timeout"
+require "stringio"
+require "marcel"
+
+module OpenBlog
+  class ImageFetch
+    TIMEOUT = 10
+    REDIRECTS = [ 301, 302, 303, 307, 308 ].freeze
+    NONPUBLIC_V4 = %w[0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
+      172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16
+      198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4].map { |range| IPAddr.new(range) }.freeze
+    GLOBAL_V6 = IPAddr.new("2000::/3")
+    NONPUBLIC_V6 = %w[2001::/23 2001:db8::/32 2002::/16 3fff::/20].map { |range| IPAddr.new(range) }.freeze
+    class DeadlineExceeded < StandardError; end
+
+    def self.call(url, max_bytes: OpenBlog.config.max_image_bytes, policy: OpenBlog.config.image_fetch_policy)
+      new(max_bytes: max_bytes, policy: policy).call(url)
+    end
+
+    def initialize(max_bytes:, policy:)
+      raise Error::ImageNotPermitted unless max_bytes.is_a?(Integer) && max_bytes.positive? && %i[public_only open].include?(policy)
+      @max_bytes, @policy = max_bytes, policy
+    end
+
+    def call(url)
+      @deadline = monotonic + TIMEOUT
+      Timeout.timeout(TIMEOUT, DeadlineExceeded) do
+        uri = parse_url(url)
+        redirects = 0
+        loop do
+          addresses = Resolv.getaddresses(uri.hostname)
+          raise Error::ImageNotPermitted if addresses.empty?
+          addresses.each { |address| permitted_address!(address) } unless @policy == :open
+          status, location, bytes = download(uri, addresses.first)
+          if REDIRECTS.include?(status)
+            raise Error::ImageNotPermitted if redirects >= 3 || location.nil?
+            uri = parse_url(URI.join(uri.to_s, location).to_s)
+            redirects += 1
+          else
+            raise Error::ImageNotPermitted unless status.between?(200, 299)
+            type = Marcel::MimeType.for(StringIO.new(bytes))
+            raise Error::ImageNotPermitted if type == "image/svg+xml" || !OpenBlog.config.image_content_types.include?(type)
+            filename = File.basename(URI::DEFAULT_PARSER.unescape(uri.path).tr("\\", "/"))
+            filename = "image" if filename.blank? || %w[/ . ..].include?(filename)
+            return { io: StringIO.new(bytes), content_type: type, filename: filename }
+          end
+        end
+      end
+    rescue URI::InvalidURIError, IPAddr::InvalidAddressError, Resolv::ResolvError, SocketError,
+      SystemCallError, IOError, EOFError, Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError,
+      Timeout::Error, DeadlineExceeded, OpenSSL::SSL::SSLError, ArgumentError
+      raise Error::ImageNotPermitted
+    end
+
+    private
+
+    def parse_url(value)
+      raise Error::ImageNotPermitted unless value.is_a?(String)
+      uri = URI.parse(value)
+      unless uri.is_a?(URI::HTTP) && uri.hostname.present? && uri.userinfo.nil? && !uri.hostname.include?("%")
+        raise Error::ImageNotPermitted
+      end
+      uri.fragment = nil
+      uri
+    end
+
+    def permitted_address!(address)
+      ip = IPAddr.new(address).native
+      public = if ip.ipv4?
+        NONPUBLIC_V4.none? { |range| range.include?(ip) }
+      else
+        GLOBAL_V6.include?(ip) && NONPUBLIC_V6.none? { |range| range.include?(ip) }
+      end
+      raise Error::ImageNotPermitted unless public
+    end
+
+    def download(uri, address)
+      http = Net::HTTP.new(uri.hostname, uri.port, nil)
+      http.ipaddr = address
+      http.use_ssl = uri.scheme == "https"
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.verify_hostname = true
+      http.max_retries = 0
+      http.open_timeout = http.read_timeout = http.write_timeout = remaining
+      request = Net::HTTP::Get.new(uri.request_uri, "Accept-Encoding" => "identity")
+      bytes = +"".b
+      result = nil
+      http.start do |connection|
+        connection.request(request) do |response|
+          response.read_body do |chunk|
+            raise Error::ImageNotPermitted if bytes.bytesize + chunk.bytesize > @max_bytes
+            bytes << chunk
+            http.read_timeout = remaining
+          end
+          result = [ response.code.to_i, response["location"], bytes ]
+        end
+      end
+      remaining
+      result
+    end
+
+    def remaining
+      seconds = @deadline - monotonic
+      raise DeadlineExceeded unless seconds.positive?
+      seconds
+    end
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/open_blog/image_import.rb

@@ -0,0 +1,164 @@
+require "delegate"
+require "digest"
+require "stringio"
+require "tempfile"
+require "marcel"
+
+module OpenBlog
+  class ImageImport
+    def self.prepare(input)
+      return prepare_url(input[:url] || input["url"]) if input.is_a?(Hash) && input.keys.map(&:to_s) == [ "url" ]
+      unless input.is_a?(Hash) && input.keys.map(&:to_s) == [ "signed_id" ]
+        raise Error::ImageNotPermitted
+      end
+      signed_id = input[:signed_id] || input["signed_id"]
+      raise Error::ImageNotPermitted unless signed_id.is_a?(String) && signed_id.present?
+      blob = ActiveStorage::Blob.find_signed!(signed_id)
+      new(blob).prepare
+    rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound, ActiveStorage::FileNotFoundError
+      raise Error::ImageNotPermitted
+    end
+
+    def self.prepare_url(url)
+      fetched = ImageFetch.call(url, max_bytes: OpenBlog.config.max_image_bytes, policy: OpenBlog.config.image_fetch_policy)
+      prepared = prepare_upload(fetched.fetch(:io), filename: fetched.fetch(:filename), content_type: fetched.fetch(:content_type))
+      Prepared.new(nil, prepared.attributes.merge(source_url: url), bytes: prepared.bytes)
+    ensure
+      fetched&.fetch(:io)&.close
+    end
+
+    def self.prepare_upload(io, filename:, content_type:)
+      unless io.respond_to?(:read) && filename.is_a?(String) && filename.present? && !filename.include?("\0")
+        raise Error::ImageNotPermitted
+      end
+      filename = ActiveStorage::Filename.new(filename.tr("\\", "/").split("/").last.to_s).sanitized
+      raise Error::ImageNotPermitted if filename.blank?
+      bytes = +"".b
+      io.rewind if io.respond_to?(:rewind)
+      limit = OpenBlog.config.max_image_bytes
+      loop do
+        chunk = io.read([ 64 * 1024, limit - bytes.bytesize + 1 ].min)
+        break if chunk.nil? || chunk.empty?
+        bytes << chunk
+        raise Error::ImageNotPermitted if bytes.bytesize > limit
+      end
+      source = ActiveStorage::Blob.new(filename: filename, content_type: content_type, byte_size: bytes.bytesize)
+      new(source).prepare_bytes(bytes.freeze, uploaded: true)
+    rescue IOError, SystemCallError
+      raise Error::ImageNotPermitted
+    end
+
+    def initialize(blob)
+      @blob = blob
+    end
+
+    def prepare
+      permitted!(@blob.content_type)
+      limit = OpenBlog.config.max_image_bytes
+      raise Error::ImageNotPermitted if @blob.byte_size > limit
+      bytes = +"".b
+      @blob.download do |chunk|
+        raise Error::ImageNotPermitted if bytes.bytesize + chunk.bytesize > limit
+        bytes << chunk
+      end
+      unless bytes.bytesize == @blob.byte_size && Digest::MD5.base64digest(bytes) == @blob.checksum
+        raise Error::ImageNotPermitted
+      end
+      prepare_bytes(bytes)
+    end
+
+    def prepare_bytes(bytes, uploaded: false)
+      permitted!(@blob.content_type)
+      content_type = Marcel::MimeType.for(StringIO.new(bytes))
+      permitted!(content_type)
+      raise Error::ImageNotPermitted unless content_type == @blob.content_type
+      source = ReadOnlySource.new(@blob, bytes)
+      analyzer = ActiveStorage.analyzers.find { |candidate| candidate.accept?(source) }
+      raise Error::ImageNotPermitted unless analyzer
+      metadata = analyzer.new(source).metadata
+      dimensions = metadata.symbolize_keys.slice(:width, :height)
+      unless dimensions.size == 2 && dimensions.values.all? { |value| value.is_a?(Integer) && value.positive? }
+        raise Error::ImageNotPermitted
+      end
+      Prepared.new(uploaded ? nil : @blob, { sha256: Digest::SHA256.hexdigest(bytes), filename: @blob.filename.to_s,
+        byte_size: bytes.bytesize, content_type: content_type, **dimensions }, bytes: uploaded ? bytes : nil)
+    end
+
+    private
+
+    def permitted!(content_type)
+      unless content_type != "image/svg+xml" && OpenBlog.config.image_content_types.include?(content_type)
+        raise Error::ImageNotPermitted
+      end
+    end
+
+    class ReadOnlySource < SimpleDelegator
+      def initialize(blob, bytes)
+        super(blob)
+        @bytes = bytes
+      end
+
+      def open(tmpdir: nil, **)
+        Tempfile.create([ "open-blog-image", File.extname(filename.to_s) ], tmpdir, binmode: true) do |file|
+          file.write(@bytes)
+          file.rewind
+          yield file
+        end
+      end
+    end
+
+    class Prepared
+      attr_reader :attributes, :bytes
+
+      def initialize(blob, attributes, bytes: nil)
+        @blob, @attributes, @bytes = blob, attributes.freeze, bytes
+      end
+
+      def image
+        @image ||= Image.find_by(sha256: attributes[:sha256]) || Image.new(attributes)
+      end
+
+      def persist(uploaded_by: nil)
+        Image.transaction(requires_new: true) do
+          existing = Image.find_by(sha256: attributes[:sha256])
+          next existing if existing
+          next persist_upload(uploaded_by) unless @blob
+          blob = ActiveStorage::Blob.lock.find(@blob.id)
+          existing = Image.find_by(sha256: attributes[:sha256])
+          next existing if existing
+          fields = %w[key service_name checksum byte_size content_type]
+          unless blob.attributes.slice(*fields) == @blob.attributes.slice(*fields)
+            raise Error::ImageNotPermitted
+          end
+          blob.update!(metadata: blob.metadata.merge("identified" => true, "analyzed" => true,
+            "width" => attributes[:width], "height" => attributes[:height]))
+          record = Image.new(attributes.merge(uploaded_by: uploaded_by))
+          record.file = blob
+          record.save!
+          record
+        end
+      rescue ActiveRecord::RecordNotUnique
+        Image.find_by!(sha256: attributes[:sha256])
+      rescue ActiveRecord::RecordInvalid => error
+        errors = error.record.errors.details
+        if error.record.is_a?(Image) && errors.keys == [ :sha256 ] && errors[:sha256].all? { |detail| detail[:error] == :taken }
+          existing = Image.find_by(sha256: attributes[:sha256])
+          return existing if existing
+        end
+        raise Error::ImageNotPermitted
+      rescue ActiveRecord::RecordNotFound
+        raise Error::ImageNotPermitted
+      end
+      private
+
+      def persist_upload(uploaded_by)
+        record = Image.new(attributes.merge(uploaded_by: uploaded_by))
+        record.file = { io: StringIO.new(bytes), filename: attributes[:filename], content_type: attributes[:content_type],
+          identify: false, metadata: { "identified" => true, "analyzed" => true,
+            "width" => attributes[:width], "height" => attributes[:height] } }
+        record.save!
+        record
+      end
+    end
+  end
+end

data/lib/open_blog/image_resolution.rb

@@ -0,0 +1,171 @@
+require "digest"
+require "uri"
+
+module OpenBlog
+  class ImageResolution
+    PAYLOAD_FIELDS = %w[url sha256 alt role].freeze
+
+    def self.prepare(attributes:, post: nil)
+      attributes = attributes.symbolize_keys
+      format = attributes.fetch(:body_format, post&.body_format || OpenBlog.config.default_body_format).to_s
+      unless OpenBlog.config.body_formats.map(&:to_s).include?(format)
+        raise Error::BodyFormatNotPermitted
+      end
+      body = attributes.key?(:body) ? attributes[:body] : (format == "rich_text" ? post&.rich_body&.body : post&.body_markdown)
+      raise Error::ValidationFailed.new(details: [ "body" ]) unless body.nil? || body.is_a?(String) || body.is_a?(ActionText::Content)
+      text = format == "rich_text" ? ActionText::Content.new(body.to_s).to_html : body.to_s
+      digest = source_digest(text, format)
+      if post && !attributes.key?(:body) && !attributes.key?(:body_format) && post.body_image_source_digest == digest
+        return Prepared.new(digest, post.body_image_manifest.deep_dup, {}, sources(text, format), reuse_current: true)
+      end
+      build(text, format, external: true)
+    end
+
+    def self.prepare_inputs(attributes)
+      %i[cover_image social_image].each_with_object({}) do |field, prepared|
+        value = attributes[field] || attributes[field.to_s]
+        if value.is_a?(Hash) && (value.keys.map(&:to_s) & %w[signed_id url]).any?
+          prepared[field] = ImageImport.prepare(value)
+        end
+      end
+    end
+
+    def self.source_digest(text, format)
+      Digest::SHA256.hexdigest("#{format}\0#{text}")
+    end
+
+    def self.fingerprint(post)
+      source_digest(post.body_for_payload, post.body_format)
+    end
+
+    def self.fetch_external(url)
+      fetched = ImageFetch.call(url)
+      Digest::SHA256.hexdigest(fetched.fetch(:io).read)
+    rescue Error::ImageNotPermitted
+      nil
+    ensure
+      fetched&.fetch(:io)&.close
+    end
+
+    def self.native!(post)
+      return if post.body_image_source_digest == fingerprint(post)
+      build(post.body_for_payload, post.body_format, external: false).materialize(post)
+    end
+
+    def self.body_images(post)
+      entries = if post.body_image_source_digest == fingerprint(post)
+        post.body_image_manifest
+      else
+        build(post.body_for_payload, post.body_format, external: false, import: false).entries
+      end
+      entries.map { |entry| entry.slice(*PAYLOAD_FIELDS) }
+    end
+
+    def self.image_for_attachment(blob, post: nil)
+      return unless blob.is_a?(ActiveStorage::Blob)
+      image = Image.joins(:file_attachment).find_by(active_storage_attachments: { blob_id: blob.id })
+      return image if image
+      entry = post&.body_image_manifest&.find { |candidate| candidate["blob_id"] == blob.id }
+      Image.new(entry.fetch("image_attributes")) if entry && entry["image_attributes"]
+    end
+
+    def self.image_for_url(url, post: nil)
+      prefix = "#{OpenBlog.mount_path.chomp('/')}/media/"
+      match = url.to_s.match(/\A#{Regexp.escape(prefix)}([0-9a-f]{64})\//)
+      return unless match
+      Image.find_by(sha256: match[1]) || begin
+        entry = post&.body_image_manifest&.find { |candidate| candidate["sha256"] == match[1] }
+        Image.new(entry.fetch("image_attributes")) if entry && entry["image_attributes"]
+      end
+    end
+
+    def self.build(text, format, external:, import: true)
+      imports = {}
+      source_entries = sources(text, format)
+      entries = source_entries.filter_map do |source|
+        blob = source[:blob]
+        image = blob ? image_for_attachment(blob) : image_for_url(source[:url])
+        if blob && !image && import
+          prepared = imports[blob.id] ||= ImageImport.prepare(signed_id: blob.signed_id)
+          image = prepared.image
+        end
+        next if blob && !image
+        url = image ? image.path : source[:url]
+        sha = image&.sha256 || (external && URI.parse(url).host ? fetch_external(url) : nil) || ""
+        entry = { "url" => url, "sha256" => sha, "alt" => source[:alt].to_s, "role" => "body" }
+        if blob
+          entry["blob_id"] = blob.id
+          entry["image_attributes"] = image.attributes.slice("sha256", "filename", "content_type", "byte_size", "width", "height")
+        end
+        entry
+      end
+      Prepared.new(source_digest(text, format), entries, imports, source_entries)
+    end
+    private_class_method :build
+
+    def self.sources(text, format)
+      html = format == "markdown" ? Renderer::Markdown.render(text) : text
+      fragment = Nokogiri::HTML5.fragment(html)
+      attachments = {}
+      prefix = "/open-blog-prepared-attachment/"
+      urls = fragment.css("img[src]").map { |node| node["src"] }
+      prefix += "x/" while urls.any? { |url| url.start_with?(prefix) }
+      fragment.css("action-text-attachment").each_with_index do |node, index|
+        attachable = ActionText::Attachable.from_node(node)
+        next node.remove unless attachable.is_a?(ActiveStorage::Blob) && attachable.content_type.start_with?("image/")
+        image = Nokogiri::XML::Node.new("img", fragment.document)
+        image["src"] = "#{prefix}#{index}"
+        image["alt"] = node["alt"].presence || PlainText.from_html(node["caption"].to_s)
+        attachments[image["src"]] = attachable
+        node.replace(image)
+      end
+      document = Renderer::Sanitizer.call(fragment.to_html)
+      Renderer::Sanitizer.restore!(document).css("img[src]").map do |node|
+        blob = attachments[node["src"]]
+        { url: blob ? nil : node["src"], alt: node["alt"], blob: blob }
+      end
+    end
+    private_class_method :sources
+
+    class Prepared
+      attr_reader :entries
+
+      def initialize(digest, entries, imports, sources, reuse_current: false)
+        @digest, @entries, @imports, @sources = digest, entries, imports, sources
+        @reuse_current = reuse_current
+      end
+
+      def verify!(post)
+        current = ImageResolution.fingerprint(post)
+        return if current == @digest
+        sources = ImageResolution.send(:sources, post.body_for_payload, post.body_format)
+        unless sources == @sources
+          raise Error::ValidationFailed.new(details: [ "body" ])
+        end
+        @digest = current
+      end
+
+      def preview(post)
+        verify!(post)
+        post.body_image_source_digest = @digest
+        post.body_image_manifest = entries.deep_dup
+      end
+
+      def materialize(post, actor: nil)
+        if @reuse_current && post.body_image_source_digest == ImageResolution.fingerprint(post)
+          @digest = post.body_image_source_digest
+          @entries = post.body_image_manifest.deep_dup
+          @sources = ImageResolution.send(:sources, post.body_for_payload, post.body_format)
+        end
+        verify!(post)
+        images = @imports.transform_values { |prepared| prepared.persist(uploaded_by: actor) }
+        @entries = entries.map do |entry|
+          image = images[entry["blob_id"]]
+          image ? entry.merge("url" => image.path, "sha256" => image.sha256,
+            "image_attributes" => image.attributes.slice("sha256", "filename", "content_type", "byte_size", "width", "height")) : entry
+        end
+        preview(post)
+      end
+    end
+  end
+end

data/lib/open_blog/instructions.rb

@@ -0,0 +1,7 @@
+module OpenBlog
+  APPROVAL_INSTRUCTION = "Show the final text to the user before publication and ask once whether they approve that exact version and have checked its facts. Include the preview link for unpublished content. Record approval only from an actual answer: send the user's name, facts_checked with their stated true or false value, and the reviewed draft's revision_identifier. For an approved public edit without a saved draft identifier, send the complete reviewed content and inline approval with the user's name and facts_checked answer, omitting approval.revision_identifier so the operation binds it to the new revision. Never attach the old public identifier to changed text. Compare the returned content with the reviewed version and report any unexpected difference. If no answer was given, omit approval. Never invent a review or a fact-check. When text changes after approval, show the new version and ask again.".freeze
+  PROVENANCE_INSTRUCTION = "Set provenance to ai_assisted if AI authored or rewrote any content, or human_written only when a person wrote all of it.".freeze
+  ADOPTION_INSTRUCTION = "Ask whether the original system has an approval record for the imported article. Use imported_approval only with its reviewer, original time, evidence, and the person confirming that it covers this content. Otherwise, record a declaration only when the user supplies the reviewer, approval time, facts_checked answer, declaration date, and their own name. Ask for a declared first publication date when historical evidence is missing, and place that answer in declaration.declared_first_published_at. Do not send approval in an adoption request or invent historical evidence or declarations.".freeze
+  APPROVAL_POINTER = "This operation does not release a post revision and does not require editorial approval. Before blog_publish_post, blog_update_post, or blog_correct_post, show the final version and ask the user to approve it and confirm whether its facts were checked.".freeze
+  DRAFT_INSTRUCTION = "Saving a draft requires no approval. Share its preview link when requesting approval to publish.".freeze
+end

data/lib/open_blog/json_feed.rb

@@ -0,0 +1,36 @@
+module OpenBlog
+  class JsonFeed
+    def initialize(posts:, base_url:, feed_path:, title:, category: nil)
+      @posts, @base_url, @feed_path, @title, @category = posts, base_url.chomp("/"), feed_path, title, category
+    end
+
+    def to_h
+      home_path = @category ? ReaderQueries.category_path(@category) : OpenBlog.mount_path
+      { version: "https://jsonfeed.org/version/1.1", title: @title,
+        home_page_url: "#{@base_url}#{home_path}", feed_url: "#{@base_url}#{@feed_path}",
+        authors: [ { name: OpenBlog.config.publisher&.fetch(:name, nil) || OpenBlog.config.site_name } ],
+        items: @posts.map { |post| item(post) } }
+    end
+
+    def to_json(*arguments)
+      to_h.to_json(*arguments)
+    end
+
+    private
+
+    def item(post)
+      url = post.url(base: @base_url)
+      entry = { id: url, url: url, title: post.title, summary: post.description,
+        authors: [ { name: post.author_name, url: "#{@base_url}#{ReaderQueries.author_path(post.author)}" } ],
+        date_modified: ReaderDates.feed_updated_at(post).iso8601 }
+      published = ReaderDates.published_at(post)
+      entry[:date_published] = published.iso8601 if published
+      if OpenBlog.config.feed_content == :full
+        entry[:content_html] = Renderer.render(post).to_s
+      else
+        entry[:content_text] = post.description
+      end
+      entry
+    end
+  end
+end