pageflow 17.0.5 → 17.2.0

data/app/controllers/concerns/pageflow/quota_verification.rb

@@ -1,4 +1,5 @@
 module Pageflow
+  # @api private
   module QuotaVerification
     extend ActiveSupport::Concern
 
@@ -9,10 +10,10 @@ module Pageflow
             redirect_back fallback_location: admin_root_path, alert: t('pageflow.quotas.exhausted')
           end
           format.json do
-            render(:status => :forbidden,
-                   :json => {
-                     :error_message => exception.message,
-                     :quota_name => exception.quota.name
+            render(status: :forbidden,
+                   json: {
+                     error_message: exception.message,
+                     quota_name: exception.quota.name
                    })
           end
         end

data/app/controllers/pageflow/admin/initial_passwords_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Admin
+    # @api private
     class InitialPasswordsController < Devise::PasswordsController
       layout 'active_admin_logged_out'
       helper ActiveAdmin::ViewHelpers

data/app/controllers/pageflow/application_controller.rb

@@ -2,11 +2,15 @@ require 'cancan'
 require 'state_machines'
 
 module Pageflow
+  # @api private
   class ApplicationController < ActionController::Base
     layout 'pageflow/application'
 
     before_action do
-      I18n.locale = current_user.try(:locale) || locale_from_accept_language_header || I18n.default_locale
+      I18n.locale =
+        current_user.try(:locale) ||
+        locale_from_accept_language_header ||
+        I18n.default_locale
     end
 
     # Prevent CSRF attacks by raising an exception.
@@ -22,15 +26,9 @@ module Pageflow
 
     rescue_from ActiveRecord::RecordNotFound do |exception|
       debug_log_with_backtrace(exception)
+
       respond_to do |format|
-        format.html do
-          begin
-            render file: Rails.public_path.join('pageflow', 'error_pages', '404.html'), status: :not_found
-          rescue ActionView::MissingTemplate => exception
-            debug_log_with_backtrace(exception)
-            head :not_found
-          end
-        end
+        format.html { render_static_404_error_page }
         format.any { head :not_found }
       end
     end
@@ -38,7 +36,7 @@ module Pageflow
     rescue_from CanCan::AccessDenied do |exception|
       debug_log_with_backtrace(exception)
       respond_to do |format|
-        format.html { redirect_to main_app.admin_root_path, :alert => t('pageflow.unauthorized') }
+        format.html { redirect_to main_app.admin_root_path, alert: t('pageflow.unauthorized') }
         format.any(:json, :css) { head :forbidden }
       end
     end
@@ -46,7 +44,9 @@ module Pageflow
     rescue_from StateMachines::InvalidTransition do |exception|
       debug_log_with_backtrace(exception)
       respond_to do |format|
-        format.html { redirect_to main_app.admin_root_path, :alert => t('pageflow.invalid_transition') }
+        format.html do
+          redirect_to main_app.admin_root_path, alert: t('pageflow.invalid_transition')
+        end
         format.json { head :bad_request }
       end
     end
@@ -57,18 +57,18 @@ module Pageflow
       @current_ability ||= Ability.new(current_user)
     end
 
-    def after_sign_in_path_for(resource_or_scope)
-      root_url(:protocol => 'http')
-    end
-
-    def after_sign_out_path_for(resource_or_scope)
-      root_url(:protocol => 'http')
-    end
-
     def locale_from_accept_language_header
       http_accept_language.compatible_language_from(I18n.available_locales)
     end
 
+    def render_static_404_error_page
+      render file: Rails.public_path.join('pageflow', 'error_pages', '404.html'),
+             status: :not_found
+    rescue ActionView::MissingTemplate => e
+      debug_log_with_backtrace(e)
+      head :not_found
+    end
+
     def debug_log_with_backtrace(exception)
       Rails.logger.debug exception
       backtrace = ''

data/app/controllers/pageflow/chapters_controller.rb

@@ -1,4 +1,5 @@
 module Pageflow
+  # @api private
   class ChaptersController < Pageflow::ApplicationController
     respond_to :json
 
@@ -67,8 +68,8 @@ module Pageflow
       configuration = params.require(:chapter)[:configuration].try(:permit!) || {}
 
       params.require(:chapter)
-        .permit(:position, :title)
-        .merge(configuration: configuration)
+            .permit(:position, :title)
+            .merge(configuration:)
     end
   end
 end

data/app/controllers/pageflow/edit_locks_controller.rb

@@ -1,4 +1,5 @@
 module Pageflow
+  # @api private
   class EditLocksController < Pageflow::ApplicationController
     before_action :authenticate_user!
 
@@ -11,7 +12,7 @@ module Pageflow
 
       entry.snapshot(creator: current_user) unless entry.feature_state('no_edit_lock_snapshot')
 
-      respond_with(entry.reload.edit_lock, :location => entry_edit_lock_url(entry))
+      respond_with(entry.reload.edit_lock, location: entry_edit_lock_url(entry))
     end
 
     def update
@@ -30,7 +31,7 @@ module Pageflow
     protected
 
     def edit_lock_params
-      params.permit(:edit_lock => [:force, :id]).fetch(:edit_lock, {})
+      params.permit(edit_lock: [:force, :id]).fetch(:edit_lock, {})
     end
   end
 end

data/app/controllers/pageflow/editor/encoding_confirmations_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Editor
+    # @api private
     class EncodingConfirmationsController < Pageflow::ApplicationController
       respond_to :json
 

data/app/controllers/pageflow/editor/entries_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Editor
+    # @api private
     class EntriesController < Pageflow::ApplicationController
       layout 'pageflow/editor'
 
@@ -49,8 +50,9 @@ module Pageflow
           .permit(:title, :summary, :credits,
                   :share_url, :share_image_id, :share_image_x, :share_image_y,
                   :locale, :author, :publisher, :keywords, :theme_name,
+                  :structured_data_type_name,
                   share_providers: {})
-          .merge(configuration: configuration)
+          .merge(configuration:)
       end
     end
   end

data/app/controllers/pageflow/editor/entry_publications_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Editor
+    # @api private
     class EntryPublicationsController < Pageflow::ApplicationController
       respond_to :json
 

data/app/controllers/pageflow/editor/file_folders_controller.rb

@@ -0,0 +1,80 @@
+module Pageflow
+  module Editor
+    # @api private
+    class FileFoldersController < Pageflow::ApplicationController
+      respond_to :json
+
+      before_action :authenticate_user!
+
+      def index
+        entry = DraftEntry.find(params[:entry_id])
+
+        authorize!(:use_files, entry.to_model)
+        @file_folders = folders(entry)
+
+        respond_with(:editor, @file_folders)
+      end
+
+      def create
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:edit, entry.to_model)
+        verify_edit_lock!(entry)
+
+        @file_folder = entry.create_folder!(create_params)
+
+        respond_with(:editor, @file_folder)
+      rescue ActiveRecord::RecordInvalid => e
+        debug_log_with_backtrace(e)
+        head :unprocessable_entity
+      end
+
+      def update
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:edit, entry.to_model)
+        verify_edit_lock!(entry)
+
+        folder(entry).update!(update_params)
+
+        head(:no_content)
+      rescue ActiveRecord::RecordInvalid => e
+        debug_log_with_backtrace(e)
+        head :unprocessable_entity
+      end
+
+      def destroy
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:edit, entry.to_model)
+        verify_edit_lock!(entry)
+
+        folder = folder(entry)
+        return head(:unprocessable_entity) unless folder.empty?
+
+        folder.destroy
+
+        head(:no_content)
+      end
+
+      private
+
+      def folder(entry)
+        folders(entry).find(params[:id])
+      end
+
+      def folders(entry)
+        FileFolder.all_for_revision(entry.draft)
+      end
+
+      def create_params
+        file_folder_params.permit(:name, :parent_folder_perma_id)
+      end
+
+      def update_params
+        file_folder_params.permit(:name, :parent_folder_perma_id)
+      end
+
+      def file_folder_params
+        params.require(:file_folder)
+      end
+    end
+  end
+end

data/app/controllers/pageflow/editor/file_import_controller.rb

@@ -26,7 +26,7 @@ module Pageflow
 
           FileImportJob.perform_later(file_import.id, file_importer_credentials)
 
-          {file: file, source_url: file_params[:url]}
+          {file:, source_url: file_params[:url]}
         end
       end
 
@@ -54,12 +54,13 @@ module Pageflow
 
       def files_params
         params
-          .permit(files: [:file_name,
+          .permit(files: [:display_name,
                           :rights,
                           :content_type,
                           :file_size,
                           :url,
-                          configuration: [:alt, :source_url]])
+                          :folder_perma_id,
+                          {configuration: [:alt, :source_url]}])
           .require(:files)
       end
 

data/app/controllers/pageflow/editor/files_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Editor
+    # @api private
     class FilesController < Pageflow::ApplicationController
       respond_to :json
 
@@ -30,9 +31,7 @@ module Pageflow
 
       def reuse
         entry = DraftEntry.find(params[:entry_id])
-        other_entry = DraftEntry.find(file_reuse_params[:other_entry_id])
-
-        file_reuse = FileReuse.new(entry, other_entry, file_type, file_reuse_params[:file_id])
+        file_reuse = build_file_reuse(entry)
 
         authorize!(:edit, entry.to_model)
         authorize!(:use, file_reuse.file.to_model)
@@ -75,6 +74,9 @@ module Pageflow
         file.update!(update_params)
 
         head(:no_content)
+      rescue ActiveRecord::RecordInvalid => e
+        debug_log_with_backtrace(e)
+        head :unprocessable_entity
       end
 
       def destroy
@@ -91,18 +93,26 @@ module Pageflow
       private
 
       def create_params
-        file_params.permit(:file_name, :content_type, :file_size)
-          .merge(file_configuration_params)
-          .merge(file_parent_file_params)
-          .merge(file_custom_params)
+        file_params.permit(:display_name, :content_type, :file_size, :folder_perma_id)
+                   .merge(file_configuration_params)
+                   .merge(file_parent_file_params)
+                   .merge(file_custom_params)
+      end
+
+      def build_file_reuse(entry)
+        FileReuse.new(entry,
+                      DraftEntry.find(file_reuse_params[:other_entry_id]),
+                      file_type,
+                      file_reuse_params[:file_id],
+                      folder_perma_id: file_reuse_params[:folder_perma_id])
       end
 
       def file_reuse_params
-        params.require(:file_reuse).permit(:other_entry_id, :file_id)
+        params.require(:file_reuse).permit(:other_entry_id, :file_id, :folder_perma_id)
       end
 
       def update_params
-        file_configuration_params
+        file_configuration_params.merge(file_params.permit(:display_name, :folder_perma_id))
       end
 
       def file_configuration_params
@@ -110,7 +120,7 @@ module Pageflow
 
         file_params
           .permit(:rights)
-          .merge(configuration: configuration)
+          .merge(configuration:)
       end
 
       def file_parent_file_params

data/app/controllers/pageflow/editor/oembeds_controller.rb

@@ -0,0 +1,21 @@
+module Pageflow
+  module Editor
+    # @api private
+    class OembedsController < Pageflow::ApplicationController
+      respond_to :json
+
+      before_action :authenticate_user!
+
+      def show
+        provider = Pageflow.config.oembed_providers.find_by_name!(params[:provider])
+        oembed_response = provider.get(params[:url])
+
+        render json: oembed_response.fields
+      rescue Pageflow::OembedProviderNotFoundError
+        head :unprocessable_entity
+      rescue OEmbed::NotFound
+        head :not_found
+      end
+    end
+  end
+end

data/app/controllers/pageflow/editor/widgets_controller.rb

@@ -1,5 +1,6 @@
 module Pageflow
   module Editor
+    # @api private
     class WidgetsController < Pageflow::ApplicationController
       respond_to :json
 

data/app/controllers/pageflow/entries_controller.rb

@@ -6,21 +6,37 @@ module Pageflow
     include EntryPasswordProtection
 
     def index
-      site = Site.for_request(request).with_home_url.first!
+      site = Site.for_request(request).first!
 
-      redirect_to(site.home_url, allow_other_host: true)
+      entry = PublishedEntry.find_by_permalink(
+        directory: '',
+        slug: '',
+        scope: site.entries
+      )
+
+      if entry
+        respond_to do |format|
+          format.html { handle_public_entry_request(entry) }
+        end
+      elsif site.home_url.present?
+        redirect_to(site.home_url, allow_other_host: true)
+      else
+        raise ActiveRecord::RecordNotFound
+      end
     end
 
     def show
       respond_to do |format|
         format.html do
-          entry = find_by_permalink || find_by_slug
+          entry = find_by_permalink
 
-          return if redirect_according_to_entry_redirect(entry)
-          return if redirect_according_to_public_https_mode
-          return unless check_entry_password_protection(entry)
+          return if !entry && redirect_according_to_permalink_redirect
 
-          delegate_to_entry_type_frontend_app!(entry)
+          entry ||= find_by_slug!
+
+          handle_public_entry_request(entry)
+        rescue ActiveRecord::RecordNotFound
+          render_custom_or_static_404_error_page
         end
       end
     end
@@ -49,7 +65,7 @@ module Pageflow
       entry = PublishedEntry.find(params[:id], entry_request_scope)
       index = params[:page_index].split('-').first.to_i
 
-      redirect_to(short_entry_path(entry.to_model, :anchor => entry.pages[index].try(:perma_id)))
+      redirect_to(short_entry_path(entry.to_model, anchor: entry.pages[index].try(:perma_id)))
     end
 
     protected
@@ -62,7 +78,7 @@ module Pageflow
       )
     end
 
-    def find_by_slug
+    def find_by_slug!
       PublishedEntry.find(params[:id], entry_request_scope)
     end
 
@@ -70,22 +86,52 @@ module Pageflow
       Pageflow.config.public_entry_request_scope.call(Entry, request)
     end
 
-    def redirect_according_to_entry_redirect(entry)
-      return unless (redirect_location = entry_redirect(entry))
+    def handle_public_entry_request(entry)
+      config = Pageflow.config_for(entry)
+
+      return if redirect_according_to_entry_redirect(entry, config)
+      return if redirect_according_to_public_https_mode
+      return unless check_entry_password_protection(entry)
 
-      redirect_to(redirect_location, status: :moved_permanently, allow_other_host: true)
+      delegate_to_entry_type_frontend_app!(entry, config:)
     end
 
-    def entry_redirect(entry)
-      Pageflow.config.public_entry_redirect.call(entry, request)
+    def redirect_according_to_permalink_redirect
+      entry = PublishedEntry.find_by_permalink_redirect(
+        directory: params[:directory],
+        slug: params[:id],
+        site: Site.for_request(request)
+      )
+
+      return false unless entry
+
+      redirect_to(EntriesHelper::PrettyUrl.build(pageflow, entry),
+                  status: :moved_permanently,
+                  allow_other_host: true)
+      true
     end
 
-    def delegate_to_entry_type_frontend_app!(entry)
-      EntriesControllerEnvHelper.add_entry_info_to_env(request.env, entry: entry, mode: :published)
+    def redirect_according_to_entry_redirect(entry, config)
+      return false unless (redirect_location = config.public_entry_redirect.call(entry, request))
+
+      redirect_to(redirect_location, status: :moved_permanently, allow_other_host: true)
+      true
+    end
+
+    def delegate_to_entry_type_frontend_app!(entry, config:, override_status: nil)
+      EntriesControllerEnvHelper.add_entry_info_to_env(request.env,
+                                                       entry:,
+                                                       mode: :published,
+                                                       embed: params[:embed].present?)
+
+      delegate_to_rack_app!(entry.entry_type.frontend_app) do |result|
+        status, headers, body = result
 
-      delegate_to_rack_app!(entry.entry_type.frontend_app) do |_status, headers, _body|
         allow_iframe_for_embed(headers)
-        apply_cache_control(entry, headers)
+        apply_additional_headers(entry, config, headers)
+        apply_cache_control(entry, config, headers)
+
+        [override_status || status, headers, body]
       end
     end
 
@@ -93,13 +139,31 @@ module Pageflow
       headers.except!('X-Frame-Options') if params[:embed]
     end
 
-    def apply_cache_control(entry, headers)
-      config = Pageflow.config_for(entry)
-
+    def apply_cache_control(entry, config, headers)
       return if config.public_entry_cache_control_header.blank?
       return if entry.password_protected?
 
       headers['Cache-Control'] = config.public_entry_cache_control_header
     end
+
+    def apply_additional_headers(entry, config, headers)
+      headers.merge!(
+        config.additional_public_entry_headers.for(entry, request)
+      )
+    end
+
+    def render_custom_or_static_404_error_page
+      site = Site.for_request(request).first
+
+      if site&.custom_404_entry&.published_without_password_protection?
+        entry = PublishedEntry.new(site.custom_404_entry)
+        config = Pageflow.config_for(entry)
+
+        delegate_to_entry_type_frontend_app!(entry, config:, override_status: 404)
+      else
+        # Fallback to ApplicationController's handler method
+        render_static_404_error_page
+      end
+    end
   end
 end

data/app/controllers/pageflow/feeds_controller.rb

@@ -6,7 +6,7 @@ module Pageflow
       return head 404 unless site.feeds_enabled?
 
       @feed = EntriesFeed.for(
-        site: site,
+        site:,
         locale: params[:locale]
       )
 

data/app/controllers/pageflow/files_controller.rb

@@ -1,4 +1,5 @@
 module Pageflow
+  # @api private
   class FilesController < Pageflow::ApplicationController
     include PublicHttpsMode
     include EntryPasswordProtection

data/app/controllers/pageflow/pages_controller.rb

@@ -1,4 +1,5 @@
 module Pageflow
+  # @api private
   class PagesController < Pageflow::ApplicationController
     respond_to :json
 
@@ -43,7 +44,7 @@ module Pageflow
 
       authorize!(:destroy, page)
       verify_edit_lock!(page.chapter.entry)
-      page.chapter.entry.snapshot(:creator => current_user)
+      page.chapter.entry.snapshot(creator: current_user)
 
       page.destroy
 
@@ -54,7 +55,8 @@ module Pageflow
 
     def page_params
       configuration = params.require(:page)[:configuration].try(:permit!) || {}
-      params.require(:page).permit(:template, :position, :title).merge(:configuration => configuration)
+      params.require(:page).permit(:template, :position,
+                                   :title).merge(configuration:)
     end
   end
 end

data/app/controllers/pageflow/review/comment_thread_reads_controller.rb

@@ -0,0 +1,30 @@
+module Pageflow
+  module Review
+    # @api private
+    class CommentThreadReadsController < Pageflow::ApplicationController
+      respond_to :json
+      before_action :authenticate_user!
+
+      def create
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:read, entry.to_model)
+
+        CommentThreadRead.mark(entry: entry.to_model,
+                               user: current_user,
+                               comment_thread_perma_ids: known_perma_ids(entry))
+
+        head :no_content
+      end
+
+      private
+
+      # Guards against read records piling up for comment threads that
+      # do not exist in the entry.
+      def known_perma_ids(entry)
+        entry.comment_threads
+             .where(perma_id: params.fetch(:comment_thread_perma_ids, []))
+             .pluck(:perma_id)
+      end
+    end
+  end
+end

data/app/controllers/pageflow/review/comment_threads_controller.rb

@@ -0,0 +1,60 @@
+module Pageflow
+  module Review
+    # @api private
+    class CommentThreadsController < Pageflow::ApplicationController
+      respond_to :json
+      before_action :authenticate_user!
+
+      def index
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:read, entry.to_model)
+
+        @comment_threads = entry.comment_threads.includes(:resolver, comments: :creator)
+        @read_at_by_perma_id =
+          CommentThreadRead.read_at_by_perma_id(entry: entry.to_model, user: current_user)
+      end
+
+      def create
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:read, entry.to_model)
+
+        @comment_thread = entry.comment_threads.build(thread_params)
+        @comment_thread.creator = current_user
+
+        first_comment = @comment_thread.comments.build(first_comment_params)
+        first_comment.creator = current_user
+
+        @comment_thread.save!
+        render :create, status: :created
+      end
+
+      def update
+        entry = DraftEntry.find(params[:entry_id])
+        authorize!(:read, entry.to_model)
+
+        @comment_thread = entry.comment_threads.find(params[:id])
+
+        if ActiveModel::Type::Boolean.new.cast(params[:comment_thread][:resolved])
+          @comment_thread.resolve(current_user)
+        else
+          @comment_thread.unresolve
+        end
+
+        render :create
+      end
+
+      private
+
+      def thread_params
+        permitted = params.require(:comment_thread)
+                          .permit(:subject_type, :subject_id, :section_perma_id)
+        permitted[:subject_range] = params[:comment_thread][:subject_range]&.permit!
+        permitted
+      end
+
+      def first_comment_params
+        params.require(:comment_thread).require(:comment).permit(:body, :quote)
+      end
+    end
+  end
+end