pageflow 0.11.4 → 12.0.0.rc1

data/README.md

@@ -12,7 +12,9 @@ For a high level introduction and example Pageflow stories see
 
 * [Getting Started](https://github.com/codevise/pageflow/wiki/Getting-Started)
 * [Guides](https://github.com/codevise/pageflow/blob/master/doc/index.md)
-* [Theme Settings](http://codevise.github.io/pageflow/theme/master/)
+* [JavaScript API Reference](https://doclets.io/codevise/pageflow/master)
+* [Theme API Reference](http://codevise.github.io/pageflow/theme/master/)
+* [List of Plugins](https://github.com/codevise/pageflow/wiki/List-of-Plugins)
 
 ## Updating
 
@@ -41,13 +43,15 @@ Pageflow assumes the following choice of libraries:
 * [Resque](https://github.com/resque/resque) for background jobs
 * [FriendlyId](https://github.com/norman/friendly_id) for pretty URLs
 * [Paperclip](https://github.com/thoughtbot/paperclip) for attachment handling
-* [Backbone](http://backbonejs.org/) [Marionette](http://marionettejs.com/) for client side development
+* [Backbone](http://backbonejs.org/) [Marionette](http://marionettejs.com/) for the editor
+* [React](https://facebook.github.io/react/)/[Redux](http://redux.js.org/) for the frontend
 
 ## Requirements
 
 Pageflow runs in environments with:
 
 * Ruby >= 2.1
+* Node >= 6.9.5
 * Rails 4.2
 * Redis server (for Resque)
 * A database server supported by Active Record (tested with MySQL)
@@ -83,7 +87,7 @@ Add this line to your application's Gemfile:
     # Gemfile
     gem 'pageflow'
 
-    # Required for Rails 4.1:
+    # Required for Rails 4.2 compatibility
     gem 'state_machine', git: 'https://github.com/codevise/state_machine.git'
 
 Run bundler to install dependencies:

data/Rakefile

@@ -26,3 +26,5 @@ load 'rails/tasks/engine.rake' if File.exists?(APP_RAKEFILE)
 load File.expand_path('lib/tasks/pageflow_tasks.rake', File.dirname(__FILE__))
 
 Bundler::GemHelper.install_tasks
+
+task 'release:prepare' => 'pageflow:node_package:build'

data/admins/pageflow/accounts.rb

@@ -1,21 +1,38 @@
 module Pageflow
   ActiveAdmin.register Account, :as => 'Account' do
-    menu :priority => 3
+    menu priority: 3,
+         if: proc { authorized?(:index, :accounts) }
 
     config.batch_actions = false
 
     index do
       column :name do |account|
-        link_to account.name, admin_account_path(account)
+        if authorized?(:read, account)
+          link_to(account.name,
+                  admin_account_path(account),
+                  data: {id: account.id})
+        else
+          account.name
+        end
       end
       column :entries_count do |account|
-        account.entries_count
+        account.entries_count if authorized?(:read, account)
       end
       column :users_count do |account|
-        account.users_count
+        account.memberships.size if authorized?(:read, account)
+      end
+      account_memberships = current_user.memberships.on_accounts
+      account_roles = account_memberships.each_with_object({}) do |membership, roles|
+        roles[membership.entity_id] = membership.role
+      end
+      if authorized?(:see_own_role_on, :accounts)
+        column :own_role do |account|
+          own_role = account_roles[account.id]
+          membership_role_with_tooltip(own_role, scope: 'own_account_role')
+        end
       end
       column :default_theming do |account|
-        account.default_theming.theme_name
+        account.default_theming.theme_name if authorized?(:read, account)
       end
     end
 
@@ -27,15 +44,17 @@ module Pageflow
       render 'account_details', :account => account
       render 'theming_details', :account => account
 
-      tabs_view(Pageflow.config.admin_resource_tabs.find_by_resource(:theming),
-                :i18n => 'pageflow.admin.resource_tabs',
-                :build_args => [account.default_theming])
+      tabs_view(Pageflow.config.admin_resource_tabs.find_by_resource(account.default_theming),
+                i18n: 'pageflow.admin.resource_tabs',
+                authorize: :see_theming_admin_tab,
+                build_args: [account.default_theming])
     end
 
     controller do
       helper Pageflow::Admin::FeaturesHelper
       helper Pageflow::Admin::WidgetsHelper
       helper Pageflow::Admin::FormHelper
+      helper Pageflow::Admin::MembershipsHelper
       helper ThemesHelper
 
       def new

data/admins/pageflow/entry.rb

@@ -1,6 +1,6 @@
 module Pageflow
-  ActiveAdmin.register Entry, :as => 'Entry' do
-    menu :priority => 1
+  ActiveAdmin.register Entry, as: 'Entry' do
+    menu priority: 1
 
     config.batch_actions = false
 
@@ -14,11 +14,15 @@ module Pageflow
       column I18n.t('pageflow.admin.entries.members'), class: 'members' do |entry|
         entry_user_badge_list(entry)
       end
-      if authorized?(:read, Account)
+      if authorized?(:see, :accounts)
         column :account, sortable: 'account_id' do |entry|
-          link_to(entry.account.name,
-                  admin_account_path(entry.account),
-                  data: {id: entry.account.id})
+          if authorized?(:read, entry.account)
+            link_to(entry.account.name,
+                    admin_account_path(entry.account),
+                    data: {id: entry.account.id})
+          else
+            entry.account.name
+          end
         end
       end
       column :created_at
@@ -26,7 +30,7 @@ module Pageflow
       column :published_at, sortable: 'pageflow_revisions.published_at'
 
       column class: 'buttons' do |entry|
-        if authorized?(:edit, Entry)
+        if authorized?(:edit, entry)
           icon_link_to(pageflow.edit_entry_path(entry),
                        tooltip: I18n.t('pageflow.admin.entries.editor_hint'),
                        class: 'editor')
@@ -45,33 +49,46 @@ module Pageflow
     end
 
     filter :title
-    filter :account, if: ->(_) { authorized?(:read, Account) }
+    filter :account,
+           if: ->(_) { authorized?(:index, :accounts) },
+           collection: -> { Account.accessible_by(current_ability, :read) }
     filter :created_at
     filter :edited_at
     filter :first_published_at
     filter :published_revision_published_at, as: :date_range
-    filter :with_publication_state, as: :select, collection: -> { collection_for_entry_publication_states }
-
-    sidebar :folders, :only => :index do
-      text_node(link_to(I18n.t('pageflow.admin.entries.add_folder'), new_admin_folder_path, :class => 'new'))
-      grouped_folder_list(Folder.includes(:account).accessible_by(Ability.new(current_user), :read),
-                          :class => authorized?(:manage, Folder) ? 'editable' : nil,
-                          :active_id => params[:folder_id],
-                          :grouped_by_accounts => authorized?(:read, Account))
+    filter :with_publication_state,
+           as: :select,
+           collection: -> { collection_for_entry_publication_states }
+
+    sidebar :folders, only: :index do
+      text_node(link_to(I18n.t('pageflow.admin.entries.add_folder'),
+                        new_admin_folder_path,
+                        class: 'new'))
+      grouped_folder_list(Folder.accessible_by(current_ability, :read).includes(:account),
+                          active_id: params[:folder_id],
+                          grouped_by_accounts: authorized?(:see, :accounts))
     end
 
     form do |f|
       f.inputs do
-        f.input :title, :hint => I18n.t('pageflow.admin.entries.title_hint')
-        if authorized?(:read, Account)
-          f.input :account, :include_blank => false
+        f.input :title, hint: I18n.t('pageflow.admin.entries.title_hint')
 
-          unless f.object.new_record?
-            f.input :theming, :include_blank => false
-          end
+        if authorized?(:update_account_on, resource)
+          f.input :account,
+                  collection: eligible_accounts,
+                  include_blank: false,
+                  input_html: {class: 'entry_account_input'}
+        end
+
+        if authorized?(:update_theming_on, resource) && !f.object.new_record?
+          f.input :theming, collection: eligible_themings, include_blank: false
         end
-        if authorized?(:manage, Folder)
-          f.input :folder, :collection => collection_for_folders(f.object.account), :include_blank => true
+
+        if authorized?(:configure_folder_for, resource)
+          folder_collection = collection_for_folders(resource.account, resource.folder)
+          f.input(:folder,
+                  collection: folder_collection,
+                  include_blank: true) unless folder_collection.empty?
         end
 
         Pageflow.config_for(f.object).admin_form_inputs.build(:entry, f)
@@ -80,7 +97,7 @@ module Pageflow
     end
 
     action_item(:depublish, only: :show) do
-      if authorized?(:publish, Entry) && entry.published?
+      if authorized?(:publish, entry) && entry.published?
         button_to(I18n.t('pageflow.admin.entries.depublish'),
                   pageflow.current_entry_revisions_path(entry),
                   method: :delete,
@@ -105,46 +122,48 @@ module Pageflow
       end
     end
 
-    member_action :duplicate, :method => :post do
+    member_action :duplicate, method: :post do
       entry = Entry.find(params[:id])
       authorize!(:duplicate, entry)
       new_entry = entry.duplicate
       redirect_to(edit_admin_entry_path(new_entry))
     end
 
-    member_action :snapshot, :method => :post do
+    member_action :snapshot, method: :post do
       entry = Entry.find(params[:id])
       authorize!(:snapshot, entry)
-      entry.snapshot(:creator => current_user, :type => 'user')
+      entry.snapshot(creator: current_user, type: 'user')
       redirect_to(admin_entry_path(entry))
     end
 
     member_action :preview do
       entry = Entry.find(params[:id])
-      authorize!(:show, entry.draft)
+      authorize!(:read, entry.draft)
       redirect_to(pageflow.revision_path(entry.draft))
     end
 
-    show :title => :title do |entry|
-      render 'attributes_table', :entry => entry
-      render 'links', :entry => entry
+    show title: :title do |entry|
+      render 'attributes_table', entry: entry
+      render 'links', entry: entry
 
-      tabs_view(Pageflow.config.admin_resource_tabs.find_by_resource(:entry),
-                :i18n => 'pageflow.admin.resource_tabs',
-                :authorize => true,
-                :build_args => [entry])
+      tabs_view(Pageflow.config.admin_resource_tabs.find_by_resource(entry),
+                i18n: 'pageflow.admin.resource_tabs',
+                authorize: :see_entry_admin_tab,
+                build_args: [entry])
     end
 
     controller do
       helper FoldersHelper
       helper EntriesHelper
-      helper Pageflow::Admin::EntriesHelper
-      helper Pageflow::Admin::FeaturesHelper
-      helper Pageflow::Admin::RevisionsHelper
-      helper Pageflow::Admin::FormHelper
+      helper EmbedCodeHelper
+      helper Admin::EntriesHelper
+      helper Admin::FeaturesHelper
+      helper Admin::FormHelper
+      helper Admin::MembershipsHelper
+      helper Admin::RevisionsHelper
 
       after_build do |entry|
-        entry.account ||= current_user.account
+        entry.account ||= account_policy_scope.entry_creatable.first || Account.first
         entry.theming ||= entry.account.default_theming
       end
 
@@ -155,7 +174,7 @@ module Pageflow
       end
 
       def scoped_collection
-        result = super.includes(:theming, :account, :users, :published_revision).references(:published_revision)
+        result = super.includes(:theming, :account, {memberships: :user}, :published_revision).references(:published_revision)
         params.key?(:folder_id) ? result.where(folder_id: params[:folder_id]) : result
       end
 
@@ -171,23 +190,87 @@ module Pageflow
 
       private
 
+      def account_policy_scope
+        AccountPolicy::Scope.new(current_user, Account)
+      end
+
+      def theming_policy_scope
+        ThemingPolicy::Scope.new(current_user, Theming)
+      end
+
       def permitted_attributes
         result = [:title]
-
-        target = params[:id] ? resource : current_user.account
+        target = if !params[:id] && current_user.admin?
+                   Account.first
+                 elsif params[:id]
+                   resource
+                 else
+                   current_user.accounts.first
+                 end
         result += Pageflow.config_for(target).admin_form_inputs.permitted_attributes_for(:entry)
+        result += permitted_account_attributes
+
+        if params[:id]
+          result << :folder_id if authorized?(:configure_folder_for, resource)
+        end
+
+        if params[:id]
+          accounts = resource.account
+        else
+          accounts = account_policy_scope.themings_accessible
+        end
+
+        result += permitted_theming_attributes(accounts)
 
-        result += [:account_id, :theming_id] if authorized?(:read, Account)
-        result << :folder_id if authorized?(:manage, Folder)
         result
       end
 
       def permit_feature_states(attributes)
-        if authorized?(:read, Account)
+        if params[:id] && authorized?(:update_feature_configuration_on, resource)
           feature_states = params[:entry][:feature_states].try(:permit!)
           attributes.merge!(feature_states: feature_states || {})
         end
       end
+
+      def permitted_theming_attributes(accounts)
+        if (create_or_new_action? || authorized?(:update_theming_on, resource)) &&
+           theming_params_present? && theming_in_allowed_themings_for?(accounts)
+          [:theming_id]
+        else
+          []
+        end
+      end
+
+      def theming_params_present?
+        params[:entry] && params[:entry][:theming_id]
+      end
+
+      def create_or_new_action?
+        [:create, :new].include?(action_name.to_sym)
+      end
+
+      def theming_in_allowed_themings_for?(accounts)
+        theming_policy_scope.themings_allowed_for(accounts)
+          .include?(Theming.find(params[:entry][:theming_id]))
+      end
+
+      def permitted_account_attributes
+        if account_params_present? &&
+           (action_name.to_sym == :create || legally_moving_entry_to_other_account)
+          [:account_id]
+        else
+          []
+        end
+      end
+
+      def legally_moving_entry_to_other_account
+        action_name.to_sym == :update && authorized?(:update_account_on, resource) &&
+          account_policy_scope.entry_movable.include?(Account.find(params[:entry][:account_id]))
+      end
+
+      def account_params_present?
+        params[:entry] && params[:entry][:account_id]
+      end
     end
   end
 end

data/admins/pageflow/folder.rb

@@ -1,58 +1,69 @@
 module Pageflow
-  ActiveAdmin.register Folder, :as => 'Folder' do
+  ActiveAdmin.register Folder, as: 'Folder' do
     menu false
 
-    # TODO
     actions :new, :create, :edit, :update, :destroy
 
     form do |f|
       f.inputs do
-        if authorized?(:read, Account) && f.object.new_record?
-          f.input :account, :include_blank => false
+        if authorized?(:show_account_selection_on, resource) && f.object.new_record?
+          f.input :account,
+                  collection: AccountPolicy::Scope.new(current_user, Account).folder_addable,
+                  include_blank: false
         end
         f.input :name
       end
       f.actions do
         f.action(:submit)
-        f.action(:cancel, :wrapper_html => {:class => 'cancel'})
+        f.action(:cancel, wrapper_html: {class: 'cancel'})
       end
     end
 
     controller do
-      def build_new_resource
-        super.tap do |folder|
-          folder.account ||= current_user.account
-        end
+      after_build do |folder|
+        folder.account ||= account_policy_scope.folder_addable.first || Account.first
       end
 
       def create
-        super do |success, failure|
+        super do |success|
           success.html { redirect_to(admin_entries_path) }
         end
       end
 
       def update
-        super do |success, failure|
-          success.html { redirect_to(admin_entries_path(:folder_id => resource.id)) }
+        super do |success, _failure|
+          success.html { redirect_to(admin_entries_path(folder_id: resource.id)) }
         end
       end
 
       def destroy
-        super do |success, failure|
+        super do |success, _failure|
           success.html { redirect_to(admin_entries_path) }
         end
       end
 
       def permitted_params
-        result = params.permit(:folder => [:name, :account_id])
-        restrict_attributes(params[:id], result[:folder]) if result[:folder]
+        result = params.permit(folder: [:name, :account_id])
+        restrict_attributes(result[:folder]) if result[:folder]
         result
       end
 
       private
 
-      def restrict_attributes(id, attributes)
-        attributes.except!(:account_id) if !authorized?(:read, Account) || id.present?
+      def account_policy_scope
+        AccountPolicy::Scope.new(current_user, Account)
+      end
+
+      def restrict_attributes(attributes)
+        if params[:folder] && params[:folder][:account_id] &&
+           AccountPolicy::Scope.new(current_user, Account)
+            .folder_addable.exists?(params[:folder][:account_id]) &&
+           action_name.to_sym == :create
+
+          attributes
+        else
+          attributes.except!(:account_id)
+        end
       end
     end
   end