open_blog 0.1.0

data/app/controllers/open_blog/api/v1/authors_controller.rb

@@ -0,0 +1,62 @@
+module OpenBlog
+  module Api
+    module V1
+      class AuthorsController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Author.all, :authors, AuthorSerializer)
+        end
+
+        def create
+          require_scope!(:write)
+          save_author(Author.new, status: :created)
+        end
+
+        def update
+          require_scope!(:write)
+          save_author(Author.find(params[:id]), status: :ok)
+        end
+
+        private
+
+        def save_author(record, status:)
+          input = input_fields!(*ApiFields::AUTHOR)
+          text_fields!(input, :name, :slug, :type, :bio, :url, :host_reference)
+          if input.key?(:profile_urls)
+            invalid!(:profile_urls) unless input[:profile_urls].is_a?(Array) && input[:profile_urls].all? { |url| url.is_a?(String) }
+          end
+          avatar_sent = input.key?(:avatar)
+          avatar = input.delete(:avatar)
+          input[:author_type] = input.delete(:type) if input.key?(:type)
+          record.assign_attributes(input)
+          raise ActiveRecord::RecordInvalid, record unless record.valid?
+          prepared, image = prepare_avatar(avatar) if avatar_sent && avatar
+          Author.transaction do
+            record.reload.lock! if record.persisted?
+            record.assign_attributes(input)
+            image = prepared.persist(uploaded_by: actor.name) if prepared
+            if avatar_sent
+              invalid!(:avatar) if image && !image.file.attached?
+              record.avatar = image&.file&.blob
+            end
+            record.save!
+          end
+          render json: AuthorSerializer.call(record), status: status
+        end
+
+        def prepare_avatar(input)
+          invalid!(:avatar) unless input.is_a?(Hash)
+          unknown = input.keys - %i[image_id signed_id url]
+          raise Error::UnknownField.new(details: unknown.map { |field| "avatar.#{field}" }) if unknown.any?
+          invalid!(:avatar) unless input.size == 1
+          if input.key?(:image_id)
+            invalid!(:avatar) unless input[:image_id].is_a?(Integer)
+            [ nil, Image.find(input[:image_id]) ]
+          else
+            [ ImageImport.prepare(input), nil ]
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/base_controller.rb

@@ -0,0 +1,100 @@
+module OpenBlog
+  module Api
+    module V1
+      class BaseController < ActionController::API
+        include ActionController::HttpAuthentication::Token::ControllerMethods
+        before_action :prevent_caching!
+        before_action :authenticate!
+        before_action :limit_requests!
+        wrap_parameters false
+
+        rescue_from OpenBlog::Error, with: :render_error
+        rescue_from ActiveRecord::RecordNotFound do
+          render_error(Error::NotFound.new)
+        end
+        rescue_from ActionDispatch::Http::Parameters::ParseError, ActionController::BadRequest do
+          render_error(Error::ValidationFailed.new(details: [ "body" ]))
+        end
+
+        # Rails 8.0 has no limiter scope keyword. Only the exact current API
+        # controller prefix is replaced; all other cache keys pass through.
+        class SharedLimitStore
+          def initialize(store, controller_path)
+            @store = store
+            @prefix = "rate-limit:#{controller_path}:"
+          end
+
+          def increment(key, amount, **options)
+            normalized = key.start_with?(@prefix) ? "rate-limit:open_blog/api:#{key.delete_prefix(@prefix)}" : key
+            @store.increment(normalized, amount, **options)
+          end
+        end
+
+        # Used by trusted Ruby callers on a fresh controller instance. This state
+        # is never read from HTTP parameters, headers or a caller-provided Rack env.
+        def dispatch_internal(action, request, response, actor:)
+          raise Error::Unauthenticated unless actor
+          @internal_actor = actor
+          dispatch(action, request, response)
+        ensure
+          @internal_actor = nil
+        end
+        private :dispatch_internal
+
+        private
+
+        attr_reader :actor
+
+        def prevent_caching!
+          response.headers["Cache-Control"] = "no-store"
+        end
+
+        def authenticate!
+          @actor = @internal_actor || Authentication.actor_for(request)
+          raise Error::Unauthenticated unless actor
+        end
+
+        def require_scope!(scope)
+          raise Error::ScopeRequired.new(details: [ scope.to_s ]) unless actor.scopes.include?(scope.to_s)
+        end
+
+        def limit_requests!
+          return if @internal_actor
+          options = { to: OpenBlog.config.api_rate_limit.fetch(:to), within: OpenBlog.config.api_rate_limit.fetch(:within),
+            by: -> { actor.id }, with: -> { raise Error::RateLimited }, store: OpenBlog.config.rate_limit_store, name: nil }
+          if method(:rate_limiting).parameters.any? { |kind, name| kind == :keyreq && name == :scope }
+            options[:scope] = "open_blog/api"
+          else
+            options[:store] = SharedLimitStore.new(options[:store], controller_path)
+          end
+          rate_limiting(**options)
+        end
+
+        def input_fields!(*allowed)
+          input = request.query_parameters.merge(request.request_parameters)
+          unknown = input.keys.map(&:to_s) - allowed.flatten.map(&:to_s)
+          raise Error::UnknownField.new(details: unknown) if unknown.any?
+          input.deep_symbolize_keys
+        end
+
+        def find_post!
+          identity = (params[:post_id] || params[:id]).to_s
+          post = Post.find_by(id: identity) if identity.match?(/\A\d+\z/)
+          post ||= Post.find_by(slug: identity)
+          post || raise(Error::NotFound)
+        end
+
+        def render_result(result, status: nil)
+          return render_error(result.error) unless result.success?
+          status ||= result.post&.scheduled? ? :accepted : (result.created ? :created : :ok)
+          render json: WriteResultSerializer.call(result, base_url: request.base_url), status: status
+        end
+
+        def render_error(error)
+          prevent_caching!
+          render json: ErrorSerializer.call(error), status: error.status
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/categories_controller.rb

@@ -0,0 +1,33 @@
+module OpenBlog
+  module Api
+    module V1
+      class CategoriesController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Category.all, :categories, CategorySerializer)
+        end
+
+        def create
+          require_scope!(:write)
+          render json: CategorySerializer.call(Category.create!(attributes)), status: :created
+        end
+
+        def update
+          require_scope!(:write)
+          record = Category.find(params[:id])
+          record.update!(attributes)
+          render json: CategorySerializer.call(record)
+        end
+
+        private
+
+        def attributes
+          input = input_fields!(*ApiFields::CATEGORY)
+          text_fields!(input, :name, :slug, :description)
+          invalid!(:position) if input.key?(:position) && (!input[:position].is_a?(Integer) || !(-2_147_483_648..2_147_483_647).cover?(input[:position]))
+          input
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/connections_controller.rb

@@ -0,0 +1,45 @@
+module OpenBlog
+  module Api
+    module V1
+      class ConnectionsController < BaseController
+        def create
+          require_scope!(:publish)
+          input = input_fields!(*ApiFields::CONNECTION)
+          validate_input!(input)
+          now = Time.current
+          result = Operation.run(post: find_post!, actor: actor.name, now: now) do |post, _created|
+            post.connection_declarations.create!(input.merge(declared_on: input.fetch(:declared_on, now.to_date), recorded_by: actor.name))
+            { revision: nil, publication: nil, approval: nil }
+          end
+          render_result(result, status: :ok)
+        end
+
+        private
+
+        def validate_input!(input)
+          invalid!(:connections) unless input[:connections].is_a?(Array)
+          input[:connections].each do |entry|
+            invalid!(:connections) unless entry.is_a?(Hash)
+            unknown = entry.keys - %i[party relation]
+            raise Error::UnknownField.new(details: unknown.map { |key| "connections.#{key}" }) if unknown.any?
+            invalid!(:connections) unless %i[party relation].all? { |key| entry[key].is_a?(String) && entry[key].present? }
+          end
+          invalid!(:third_party_paid) unless [ true, false ].include?(input[:third_party_paid])
+          invalid!(:declared_by) unless input[:declared_by].is_a?(String) && input[:declared_by].present?
+          if input.key?(:declared_on)
+            invalid!(:declared_on) unless input[:declared_on].is_a?(String) && input[:declared_on].match?(/\A\d{4}-\d{2}-\d{2}\z/)
+            begin
+              input[:declared_on] = Date.iso8601(input[:declared_on])
+            rescue Date::Error
+              invalid!(:declared_on)
+            end
+          end
+        end
+
+        def invalid!(field)
+          raise Error::ValidationFailed.new(details: [ field.to_s ])
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/doctor_controller.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  module Api
+    module V1
+      class DoctorController < BaseController
+        def show
+          require_scope!(:read)
+          input_fields!
+          render json: DoctorSerializer.call(Doctor.run)
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/faq_extractions_controller.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  module Api
+    module V1
+      class FaqExtractionsController < BaseController
+        def create
+          require_scope!(:read)
+          input = input_fields!(*ApiFields::EXTRACTION)
+          render json: ExtractionResultSerializer.call(FaqExtraction.call(body: input[:body], standalone_questions: input.fetch(:standalone_questions, [])))
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/findings_controller.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  module Api
+    module V1
+      class FindingsController < BaseController
+        def show
+          require_scope!(:read)
+          input_fields!
+          render json: FindingsSerializer.call(Findings.for(find_post!))
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/images_controller.rb

@@ -0,0 +1,22 @@
+module OpenBlog
+  module Api
+    module V1
+      class ImagesController < BaseController
+        def create
+          require_scope!(:write)
+          input = input_fields!(*ApiFields::IMAGE)
+          raise Error::ImageNotPermitted unless input.size == 1
+          image = if input.key?(:url)
+            Image.from_url(input[:url], uploaded_by: actor.name)
+          else
+            file = input[:file]
+            raise Error::ImageNotPermitted unless file.is_a?(ActionDispatch::Http::UploadedFile)
+            Image.from_upload(file.tempfile, filename: file.original_filename,
+              content_type: file.content_type, uploaded_by: actor.name)
+          end
+          render json: ImageSerializer.call(image), status: :created
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/pages_controller.rb

@@ -0,0 +1,67 @@
+module OpenBlog
+  module Api
+    module V1
+      class PagesController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Page.all, :pages, ->(page) { PageSerializer.call(page, base_url: request.base_url) })
+        end
+
+        def show
+          require_scope!(:read)
+          input_fields!
+          page = Page.find_by!(kind: params[:kind])
+          render json: PageSerializer.call(page, base_url: request.base_url)
+        end
+
+        def update
+          require_scope!(:write)
+          input = page_attributes
+          now = Time.current
+          attempts = 0
+          begin
+            page, created = Page.transaction(requires_new: true) do
+              current = Page.lock.find_by(kind: params[:kind]) || Page.new(kind: params[:kind])
+              require_scope!(:publish) if current.status == "published" || input[:status] == "published"
+              created = current.new_record?
+              current.assign_attributes(input)
+              current.approved_on = now.to_date if input[:approved_by].present? && !input.key?(:approved_on)
+              current.save!
+              [ current, created ]
+            end
+          rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => error
+            collision = error.is_a?(ActiveRecord::RecordNotUnique) ||
+              (error.record.new_record? && error.record.errors.details[:kind].any? { |detail| detail[:error] == :taken })
+            raise unless collision
+            attempts += 1
+            retry if attempts == 1
+            raise Error::ValidationFailed.new(details: [ "kind" ])
+          end
+          render json: PageSerializer.call(page, base_url: request.base_url), status: created ? :created : :ok
+        end
+
+        private
+
+        def page_attributes
+          input = input_fields!(*ApiFields::SITE_PAGE)
+          %i[title body slug].each do |field|
+            invalid!(field) if input.key?(field) && !input[field].is_a?(String)
+          end
+          invalid!(:approved_by) if input.key?(:approved_by) && !input[:approved_by].nil? && !input[:approved_by].is_a?(String)
+          invalid!(:status) if input.key?(:status) && !%w[draft published].include?(input[:status])
+          if input.key?(:approved_on) && !input[:approved_on].nil?
+            value = input[:approved_on]
+            invalid!(:approved_on) unless value.is_a?(String) && value.match?(/\A\d{4}-\d{2}-\d{2}\z/)
+            begin
+              input[:approved_on] = Date.iso8601(value)
+            rescue Date::Error
+              invalid!(:approved_on)
+            end
+          end
+          input[:body_markdown] = input.delete(:body) if input.key?(:body)
+          input
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/posts_controller.rb

@@ -0,0 +1,114 @@
+module OpenBlog
+  module Api
+    module V1
+      class PostsController < BaseController
+        WRITE_FIELDS = ApiFields::POST_WRITE
+        NESTED_FIELDS = ApiFields::POST_NESTED
+
+        def index
+          require_scope!(:read)
+          render json: ApiPostQuery.call(input_fields!(*ApiPostQuery::FILTERS), base_url: request.base_url)
+        end
+
+        def show
+          require_scope!(:read)
+          input_fields!
+          render json: PostSerializer.call(find_post!, base_url: request.base_url)
+        end
+
+        def create
+          attributes = write_attributes(publish_field: true)
+          publishing = attributes.delete(:publish) == true
+          operation = publishing ? Publish : SaveDraft
+          render_result operation.call(attributes, actor: actor.name, authorize: authorization(publishing: publishing))
+        end
+
+        def update
+          attributes = write_attributes
+          result = WritePost.call(attributes, post: find_post!, actor: actor.name, now: Time.current,
+            publish: :preserve, authorize: authorization)
+          render_result(result, status: :ok)
+        end
+
+        def publish
+          require_scope!(:publish)
+          render_result Publish.call(write_attributes, post: find_post!, actor: actor.name,
+            authorize: authorization(publishing: true))
+        end
+
+        def unpublish
+          require_scope!(:publish)
+          input_fields!
+          render_result Unpublish.call(find_post!, actor: actor.name)
+        end
+
+        def destroy
+          require_scope!(:publish)
+          attributes = input_fields!(*ApiFields::REMOVE)
+          if attributes[:redirect_to].is_a?(String) && attributes[:redirect_to].match?(Post::SLUG_PATTERN)
+            attributes[:redirect_to] = "#{OpenBlog.mount_path.chomp('/')}/#{attributes[:redirect_to]}"
+          end
+          result = Remove.call(find_post!, actor: actor.name, **attributes)
+          if result.success? && result.post.destroyed?
+            head :no_content
+          else
+            render_result(result, status: :ok)
+          end
+        end
+
+        private
+
+        def authorization(publishing: false)
+          ->(post) { require_scope!(publishing || post.scheduled? || post.published? ? :publish : :write) }
+        end
+
+        def write_attributes(publish_field: false)
+          attributes = input_fields!(*(publish_field ? WRITE_FIELDS + [ :publish ] : WRITE_FIELDS))
+          if attributes.key?(:publish) && ![ true, false ].include?(attributes[:publish])
+            raise Error::ValidationFailed.new(details: [ "publish" ])
+          end
+          if attributes.key?(:author) && !attributes[:author].is_a?(String) && !attributes[:author].is_a?(Hash)
+            raise Error::ValidationFailed.new(details: [ "author" ])
+          end
+          NESTED_FIELDS.each do |field, allowed|
+            values = field == :faq && attributes[field].is_a?(Array) ? attributes[field] : [ attributes[field] ]
+            values.each do |value|
+              next unless value.is_a?(Hash)
+              unknown = value.keys - allowed
+              raise Error::UnknownField.new(details: unknown.map { |key| "#{field}.#{key}" }) if unknown.any?
+            end
+          end
+          connections = attributes.dig(:connections, :connections) if attributes[:connections].is_a?(Hash)
+          if connections.is_a?(Array)
+            connections.each do |entry|
+              next unless entry.is_a?(Hash)
+              unknown = entry.keys - %i[party relation]
+              raise Error::UnknownField.new(details: unknown.map { |key| "connections.connections.#{key}" }) if unknown.any?
+            end
+          end
+          ApiFields.validate_post_images!(attributes)
+          validate_connections!(attributes[:connections]) if attributes.key?(:connections)
+          attributes
+        end
+
+        def validate_connections!(input)
+          invalid = -> { raise Error::ValidationFailed.new(details: [ "connections" ]) }
+          invalid.call unless input.is_a?(Hash) && input[:connections].is_a?(Array)
+          invalid.call unless input[:declared_by].is_a?(String) && input[:declared_by].present?
+          input[:connections].each do |entry|
+            invalid.call unless entry.is_a?(Hash) && %i[party relation].all? { |key| entry[key].is_a?(String) && entry[key].present? }
+          end
+          if input.key?(:declared_on)
+            value = input[:declared_on]
+            invalid.call unless value.is_a?(String) && value.match?(/\A\d{4}-\d{2}-\d{2}\z/)
+            begin
+              input[:declared_on] = Date.iso8601(value)
+            rescue Date::Error
+              invalid.call
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/previews_controller.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  module Api
+    module V1
+      class PreviewsController < BaseController
+        def show
+          require_scope!(:read)
+          input_fields!
+          render json: PreviewSerializer.call(find_post!, base_url: request.base_url)
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/records_controller.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  module Api
+    module V1
+      class RecordsController < BaseController
+        def show
+          require_scope!(:read)
+          input_fields!
+          render json: RecordsSerializer.call(find_post!)
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/redirects_controller.rb

@@ -0,0 +1,51 @@
+module OpenBlog
+  module Api
+    module V1
+      class RedirectsController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Redirect.all, :redirects, RedirectSerializer)
+        end
+
+        def create
+          require_scope!(:publish)
+          input = input_fields!(*ApiFields::REDIRECT)
+          text_fields!(input, :old_path, :new_path, :occurred_on)
+          old = input[:old_path]
+          invalid!(:old_path) unless old.is_a?(String) && old.start_with?("/") && !old.start_with?("//") && !old.match?(/[\s?#]/)
+          invalid!(:post_id) if input.key?(:post_id) && !input[:post_id].nil? && !input[:post_id].is_a?(Integer)
+          date = input.key?(:occurred_on) ? parse_date(input[:occurred_on]) : Date.current
+          record = Redirect.transaction do
+            Post.lock.find(input[:post_id]) if input[:post_id]
+            RedirectTarget.synchronize do
+              prefix = "#{OpenBlog.mount_path.chomp('/')}/"
+              slug = old.delete_prefix(prefix)
+              raise Error::SlugReserved if old.start_with?(prefix) && Post.exists?(slug: slug)
+              target = RedirectTarget.call(input[:new_path], from: old)
+              row = Redirect.create!(old_path: old, new_path: target, occurred_on: date, source: "manual", post_id: input[:post_id])
+              Redirect.where(new_path: old).where.not(id: row.id).find_each { |incoming| incoming.update!(new_path: target) }
+              row
+            end
+          end
+          render json: RedirectSerializer.call(record), status: :created
+        end
+
+        def destroy
+          require_scope!(:publish)
+          input_fields!
+          RedirectTarget.synchronize { Redirect.find(params[:id]).destroy! }
+          head :no_content
+        end
+
+        private
+
+        def parse_date(value)
+          invalid!(:occurred_on) unless value.is_a?(String) && value.match?(/\A\d{4}-\d{2}-\d{2}\z/)
+          Date.iso8601(value)
+        rescue Date::Error
+          invalid!(:occurred_on)
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/report_controller.rb

@@ -0,0 +1,20 @@
+module OpenBlog
+  module Api
+    module V1
+      class ReportController < BaseController
+        def show
+          require_scope!(:read)
+          input = input_fields!(*ApiFields::REPORT, :format)
+          format = input.delete(:format) || params[:format]
+          raise Error::ValidationFailed.new(details: [ "format" ]) unless format.nil? || %w[json text].include?(format)
+          report = SurfaceReport.run(**input)
+          if format == "text" || (format.nil? && request.accepts.first == Mime[:text])
+            render plain: report.to_text
+          else
+            render json: report.to_h
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/resources_controller.rb

@@ -0,0 +1,39 @@
+module OpenBlog
+  module Api
+    module V1
+      class ResourcesController < BaseController
+        rescue_from ActiveRecord::RecordInvalid do |error|
+          render_error(Error::ValidationFailed.new(details: error.record.errors.attribute_names.map(&:to_s)))
+        end
+        rescue_from ActiveRecord::RecordNotUnique do
+          render_error(Error::ValidationFailed.new(details: [ "slug" ]))
+        end
+
+        private
+
+        def list(relation, name, serializer)
+          input = input_fields!(*ApiFields::PAGE)
+          page = integer_parameter(input, :page, 1)
+          per_page = [ integer_parameter(input, :per_page, 25), 100 ].min
+          render json: { name => relation.order(:id).offset((page - 1) * per_page).limit(per_page).map { |record| serializer.call(record) },
+            page: page, per_page: per_page, total: relation.count }
+        end
+
+        def integer_parameter(input, name, default)
+          return default unless input.key?(name)
+          value = input[name]
+          invalid!(name) unless (value.is_a?(String) || value.is_a?(Integer)) && value.to_s.match?(/\A[1-9]\d{0,8}\z/)
+          value.to_i
+        end
+
+        def text_fields!(input, *fields)
+          fields.each { |field| invalid!(field) if input.key?(field) && !input[field].nil? && !input[field].is_a?(String) }
+        end
+
+        def invalid!(field)
+          raise Error::ValidationFailed.new(details: [ field.to_s ])
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/series_controller.rb

@@ -0,0 +1,32 @@
+module OpenBlog
+  module Api
+    module V1
+      class SeriesController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Series.all, :series, SeriesSerializer)
+        end
+
+        def create
+          require_scope!(:write)
+          render json: SeriesSerializer.call(Series.create!(attributes)), status: :created
+        end
+
+        def update
+          require_scope!(:write)
+          record = Series.find(params[:id])
+          record.update!(attributes)
+          render json: SeriesSerializer.call(record)
+        end
+
+        private
+
+        def attributes
+          input = input_fields!(*ApiFields::SERIES)
+          text_fields!(input, :name, :slug, :description)
+          input
+        end
+      end
+    end
+  end
+end

data/app/controllers/open_blog/api/v1/tags_controller.rb

@@ -0,0 +1,12 @@
+module OpenBlog
+  module Api
+    module V1
+      class TagsController < ResourcesController
+        def index
+          require_scope!(:read)
+          list(Tag.all, :tags, TagSerializer)
+        end
+      end
+    end
+  end
+end