panda-core 0.12.2 → 1.1.0

data/app/controllers/panda/core/admin/tags_controller.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Admin
+      class TagsController < BaseController
+        before_action :set_initial_breadcrumb
+        before_action :set_tag, only: %i[edit update destroy]
+
+        def index
+          tenant = resolve_tenant
+          @tags = Tag.for_tenant(tenant).ordered
+
+          if params[:q].present?
+            @tags = @tags.search_by_name(params[:q])
+          end
+
+          respond_to do |format|
+            format.html
+            format.json { render json: @tags.limit(10).map { |t| {id: t.id, name: t.name, colour: t.display_colour} } }
+          end
+        end
+
+        def new
+          @tag = Tag.new
+        end
+
+        def create
+          tenant = resolve_tenant
+          @tag = Tag.new(tag_params.merge(tenant: tenant))
+
+          if @tag.save
+            redirect_to admin_tags_path, success: "Tag created."
+          else
+            render :new, status: :unprocessable_entity
+          end
+        end
+
+        def edit
+        end
+
+        def update
+          if @tag.update(tag_params)
+            redirect_to admin_tags_path, success: "Tag updated."
+          else
+            render :edit, status: :unprocessable_entity
+          end
+        end
+
+        def destroy
+          @tag.destroy
+          redirect_to admin_tags_path, success: "Tag deleted."
+        end
+
+        private
+
+        def set_tag
+          @tag = Tag.for_tenant(resolve_tenant).find(params[:id])
+        end
+
+        def tag_params
+          params.require(:tag).permit(:name, :colour)
+        end
+
+        def set_initial_breadcrumb
+          add_breadcrumb "Settings", admin_settings_path
+          add_breadcrumb "Tags", admin_tags_path
+        end
+
+        def resolve_tenant
+          return ActsAsTenant.current_tenant if defined?(ActsAsTenant) && ActsAsTenant.current_tenant
+          nil
+        end
+      end
+    end
+  end
+end

data/app/controllers/panda/core/admin/test_sessions_controller.rb

@@ -18,19 +18,18 @@ module Panda
         def create
           user = Panda::Core::User.find(params[:user_id])
 
-          # Check if user is admin (mimics real OAuth behavior)
-          unless user.admin?
-            # Non-admin users are redirected to login with error (mimics real OAuth flow)
+          # Mirror real SessionsController: admin users always pass,
+          # non-admin users checked via authorization_policy
+          policy = Panda::Core.config.authorization_policy
+          unless user.admin? || policy.call(user, :access_admin, nil)
             flash[:alert] = "You do not have permission to access the admin area."
-            # Keep flash for one more request to survive redirect in tests
             flash.keep(:alert) if Rails.env.test?
-            # Use string path since route helpers aren't available in ActionController::Base
             redirect_to "#{Panda::Core.config.admin_path || "/admin"}/login", allow_other_host: false, status: :found
             return
           end
 
           # Set session (mimics real OAuth callback)
-          session[:user_id] = user.id
+          session[Panda::Core::ADMIN_SESSION_KEY] = user.id
           Panda::Core::Current.user = user
 
           # Support custom redirect path for test flexibility

data/app/controllers/panda/core/admin/users_controller.rb

@@ -0,0 +1,184 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Admin
+      class UsersController < BaseController
+        before_action :set_initial_breadcrumb
+        before_action :set_user, only: %i[show edit update enable disable activity sessions revoke_session]
+
+        def index
+          @users = User.with_attached_avatar
+          @users = @users.search(params[:search]) if params[:search].present?
+
+          case params[:status]
+          when "enabled" then @users = @users.enabled
+          when "disabled" then @users = @users.disabled
+          when "invited" then @users = @users.invited
+          end
+
+          case params[:role]
+          when "admin" then @users = @users.admins
+          when "user" then @users = @users.where(User.admin_column => false)
+          end
+
+          @users = User.apply_metadata_filters(@users, params)
+
+          @users = case params[:sort]
+          when "name" then @users.order(name: sort_direction)
+          when "email" then @users.order(email: sort_direction)
+          when "last_login" then @users.order(last_login_at: sort_direction)
+          when "created" then @users.order(created_at: sort_direction)
+          else @users.order(name: :asc)
+          end
+
+          @page = [params.fetch(:page, 1).to_i, 1].max
+          @per_page = 25
+          @total_count = @users.count
+          @total_pages = (@total_count.to_f / @per_page).ceil
+          @users = @users.offset((@page - 1) * @per_page).limit(@per_page)
+        end
+
+        def show
+          add_breadcrumb @user.name, admin_user_path(@user)
+          @recent_activity = @user.user_activities.recent.limit(5)
+          @active_sessions = @user.user_sessions.active_sessions.recent
+          @active_sessions_count = @active_sessions.size
+        end
+
+        def edit
+          add_breadcrumb @user.name, admin_user_path(@user)
+          add_breadcrumb "Edit", edit_admin_user_path(@user)
+        end
+
+        def update
+          if @user.update(user_params)
+            if (hook = Panda::Core.config.admin_user_after_update)
+              hook.call(@user, params, current_user)
+            end
+            UserActivity.log!(user: current_user, action: "updated_user", resource: @user, request: request)
+            flash[:success] = "User has been updated successfully."
+            redirect_to admin_users_path
+          else
+            add_breadcrumb @user.name, admin_user_path(@user)
+            add_breadcrumb "Edit", edit_admin_user_path(@user)
+            render :edit, status: :unprocessable_content
+          end
+        end
+
+        def invite
+          result = InviteUserService.call(
+            email: params[:email],
+            name: params[:name],
+            invited_by: current_user,
+            admin: params[:admin] == "true"
+          )
+
+          if result.success?
+            if (hook = Panda::Core.config.after_user_invited)
+              hook.call(result.payload[:user], params, current_user)
+            end
+            flash[:success] = "Invitation sent to #{params[:email]}."
+          else
+            flash[:error] = result.errors.join(", ")
+          end
+          redirect_to admin_users_path
+        end
+
+        def enable
+          @user.enable!
+          UserActivity.log!(user: current_user, action: "enabled_user", resource: @user, request: request)
+          flash[:success] = "#{@user.name} has been enabled."
+          redirect_to admin_user_path(@user)
+        end
+
+        def disable
+          if @user == current_user
+            flash[:error] = "You cannot disable your own account."
+            redirect_to admin_user_path(@user)
+            return
+          end
+
+          @user.disable!
+          UserActivity.log!(user: current_user, action: "disabled_user", resource: @user, request: request)
+          flash[:success] = "#{@user.name} has been disabled."
+          redirect_to admin_user_path(@user)
+        end
+
+        def bulk_action
+          user_ids = Array(params[:user_ids]).map(&:to_s)
+          user_ids = user_ids.select { |id| id.match?(/\A[0-9a-f-]{36}\z/i) }
+
+          return redirect_to admin_users_path, alert: "No valid users selected." if user_ids.blank?
+
+          case params[:bulk_action]
+          when "enable"
+            enabled_count = User.where(id: user_ids).update_all(enabled: true)
+            flash[:success] = "#{enabled_count} user(s) enabled."
+          when "disable"
+            disabled_count = User.where(id: user_ids).where.not(id: current_user.id).update_all(enabled: false)
+            flash[:success] = "#{disabled_count} user(s) disabled (excluding yourself)."
+          else
+            flash[:error] = "Unknown action."
+          end
+          redirect_to admin_users_path
+        end
+
+        def activity
+          add_breadcrumb @user.name, admin_user_path(@user)
+          add_breadcrumb "Activity", activity_admin_user_path(@user)
+          @activities = @user.user_activities.recent
+          @page = [params.fetch(:page, 1).to_i, 1].max
+          @per_page = 25
+          @total_count = Rails.cache.fetch(["user_activities_count", @user.id], expires_in: 5.minutes) do
+            @activities.count
+          end
+          @total_pages = (@total_count.to_f / @per_page).ceil
+          @activities = @activities.offset((@page - 1) * @per_page).limit(@per_page)
+        end
+
+        def sessions
+          add_breadcrumb @user.name, admin_user_path(@user)
+          add_breadcrumb "Sessions", sessions_admin_user_path(@user)
+          @sessions = @user.user_sessions.recent
+          @page = [params.fetch(:page, 1).to_i, 1].max
+          @per_page = 25
+          @total_count = @sessions.count
+          @total_pages = (@total_count.to_f / @per_page).ceil
+          @sessions = @sessions.offset((@page - 1) * @per_page).limit(@per_page)
+          @active_sessions = @user.user_sessions.active_sessions.recent
+          @revoked_sessions = @user.user_sessions.revoked_sessions.recent
+        end
+
+        def revoke_session
+          session_record = @user.user_sessions.find(params[:session_id])
+          session_record.revoke!(admin: current_user)
+          UserActivity.log!(
+            user: current_user, action: "revoked_session", resource: @user,
+            request: request, metadata: {session_id: session_record.id}
+          )
+          flash[:success] = "Session revoked."
+          redirect_back fallback_location: admin_user_path(@user)
+        end
+
+        private
+
+        def set_initial_breadcrumb
+          add_breadcrumb "Users", admin_users_path
+        end
+
+        def set_user
+          @user = User.find(params[:id])
+        end
+
+        def user_params
+          params.require(:user).permit(:name, :email, :admin, :internal)
+        end
+
+        def sort_direction
+          %w[asc desc].include?(params[:direction]) ? params[:direction].to_sym : :asc
+        end
+      end
+    end
+  end
+end

data/app/controllers/panda/core/application_controller.rb

@@ -8,18 +8,30 @@ module Panda
       before_action :set_current_request_details
       before_action :initialize_breadcrumbs
 
+      # Prioritize markdown format for AI tools (Rails 8.1+)
+      # When Claude Code sends "Accept: text/markdown, text/html, */*", Rails would serve HTML by default.
+      # This reorders formats to prioritize markdown when it's the first accepted format.
+      before_action :prioritize_markdown_format
+
       helper_method :current_user, :user_signed_in?, :breadcrumbs
 
       add_flash_types :success, :error, :warning, :info
 
       private
 
+      # Prioritize markdown format when it's the first accepted format
+      # This ensures AI tools like Claude Code receive markdown responses instead of HTML
+      def prioritize_markdown_format
+        return unless request.accepts.first&.to_s == "text/markdown"
+        request.formats = [:md, :html]
+      end
+
       def set_current_request_details
         Current.request_id = request.uuid
         Current.user_agent = request.user_agent
         Current.ip_address = request.ip
         Current.root = "#{request.protocol}#{request.host_with_port}"
-        Current.user = User.find_by(id: session[:user_id]) if session[:user_id]
+        Current.user = User.find_by(id: session[Panda::Core::ADMIN_SESSION_KEY]) if session[Panda::Core::ADMIN_SESSION_KEY]
       end
 
       def authenticate_user!

data/app/helpers/panda/core/active_storage_helper.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module ActiveStorageHelper
+      # Generates a URL for an ActiveStorage variant, compatible with both Rails 7.x and 8.1+.
+      #
+      # In Rails 8.1+, both url_for(variant) and image_tag(variant) break because
+      # VariantWithRecord no longer implements to_model. This helper constructs the
+      # representation proxy path directly from the blob and variation, avoiding
+      # all polymorphic routing that relies on to_model.
+      #
+      # @param variant [ActiveStorage::VariantWithRecord] The variant to generate a URL for
+      # @return [String, nil] The URL path, or nil if generation fails
+      def variant_representation_url(variant)
+        blob = variant.blob
+        "/rails/active_storage/representations/proxy/#{blob.signed_id}/#{variant.variation.key}/#{blob.filename}"
+      rescue => e
+        Rails.logger.warn "[Panda] Failed to generate variant URL (#{e.class}): #{e.message}"
+        nil
+      end
+    end
+  end
+end

data/app/helpers/panda/core/feature_flag_helper.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module FeatureFlagHelper
+      def feature_flag_enabled?(key)
+        Panda::Core::FeatureFlag.enabled?(key)
+      end
+    end
+  end
+end

data/app/helpers/panda/core/form_helper.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module FormHelper
+      # Wraps form_with to apply consistent admin form styling across all Panda engines.
+      # Sets the custom FormBuilder and applies default CSS classes for padding/layout.
+      def panda_form_with(**options, &)
+        options[:builder] = Panda::Core::FormBuilder
+        options[:class] = ["block visible", options[:class]].compact.join(" ")
+        form_with(**options, &)
+      end
+    end
+  end
+end

data/app/javascript/panda/core/controllers/avatar_upload_controller.js

@@ -0,0 +1,73 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Connects to data-controller="avatar-upload"
+export default class extends Controller {
+  static targets = ["input", "preview", "placeholder", "fileInfo", "fileName", "fileSize"]
+
+  connect() {
+    this.originalPreviewSrc = this.hasPreviewTarget ? this.previewTarget.src : null
+    this.hadOriginalAvatar = this.hasPreviewTarget && !this.previewTarget.classList.contains("hidden")
+  }
+
+  handleFileSelect() {
+    const file = this.inputTarget.files[0]
+    if (!file || !file.type.startsWith("image/")) return
+
+    const reader = new FileReader()
+    reader.onload = (e) => {
+      // Show preview image, hide placeholder
+      if (this.hasPreviewTarget) {
+        this.previewTarget.src = e.target.result
+        this.previewTarget.classList.remove("hidden")
+      }
+      if (this.hasPlaceholderTarget) {
+        this.placeholderTarget.classList.add("hidden")
+      }
+
+      // Show file info
+      if (this.hasFileInfoTarget) {
+        this.fileInfoTarget.classList.remove("hidden")
+      }
+      if (this.hasFileNameTarget) {
+        this.fileNameTarget.textContent = file.name
+      }
+      if (this.hasFileSizeTarget) {
+        this.fileSizeTarget.textContent = this.formatFileSize(file.size)
+      }
+    }
+    reader.readAsDataURL(file)
+  }
+
+  remove() {
+    // Clear file input
+    this.inputTarget.value = ""
+
+    // Restore original state
+    if (this.hadOriginalAvatar && this.hasPreviewTarget) {
+      this.previewTarget.src = this.originalPreviewSrc
+      this.previewTarget.classList.remove("hidden")
+      if (this.hasPlaceholderTarget) {
+        this.placeholderTarget.classList.add("hidden")
+      }
+    } else {
+      // No original avatar — show placeholder
+      if (this.hasPreviewTarget) {
+        this.previewTarget.classList.add("hidden")
+      }
+      if (this.hasPlaceholderTarget) {
+        this.placeholderTarget.classList.remove("hidden")
+      }
+    }
+
+    // Hide file info
+    if (this.hasFileInfoTarget) {
+      this.fileInfoTarget.classList.add("hidden")
+    }
+  }
+
+  formatFileSize(bytes) {
+    if (bytes < 1024) return `${bytes} B`
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
+  }
+}

data/app/javascript/panda/core/controllers/clipboard_controller.js

@@ -0,0 +1,119 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Handles copy-to-clipboard and reveal/mask for secret values like API tokens.
+//
+// Usage:
+//   <div data-controller="clipboard"
+//        data-clipboard-secret-value="the-full-token"
+//        data-clipboard-masked-value="true">
+//     <span data-clipboard-target="display">...</span>
+//     <button data-action="click->clipboard#toggleReveal" data-clipboard-target="revealButton">
+//       <i data-clipboard-target="revealIcon" class="fa-solid fa-eye"></i>
+//       <span data-clipboard-target="revealText">Reveal</span>
+//     </button>
+//     <button data-action="click->clipboard#copy" data-clipboard-target="copyButton">
+//       <i data-clipboard-target="copyIcon" class="fa-solid fa-copy"></i>
+//       <span data-clipboard-target="copyText">Copy</span>
+//     </button>
+//   </div>
+export default class extends Controller {
+  static values = {
+    secret: String,
+    masked: { type: Boolean, default: true }
+  }
+
+  static targets = [
+    "display",
+    "revealButton",
+    "revealIcon",
+    "revealText",
+    "copyButton",
+    "copyIcon",
+    "copyText"
+  ]
+
+  connect() {
+    this._feedbackTimeout = null
+    this.updateDisplay()
+  }
+
+  disconnect() {
+    if (this._feedbackTimeout) {
+      clearTimeout(this._feedbackTimeout)
+      this._feedbackTimeout = null
+    }
+  }
+
+  toggleReveal() {
+    this.maskedValue = !this.maskedValue
+    this.updateDisplay()
+  }
+
+  updateDisplay() {
+    if (this.hasDisplayTarget) {
+      this.displayTarget.textContent = this.maskedValue ? this.maskedSecret : this.secretValue
+    }
+
+    if (this.hasRevealIconTarget) {
+      this.revealIconTarget.className = this.maskedValue
+        ? "fa-solid fa-eye"
+        : "fa-solid fa-eye-slash"
+    }
+
+    if (this.hasRevealTextTarget) {
+      this.revealTextTarget.textContent = this.maskedValue ? "Reveal" : "Hide"
+    }
+  }
+
+  copy() {
+    navigator.clipboard.writeText(this.secretValue).then(() => {
+      this.showCopiedFeedback()
+    }).catch((err) => {
+      console.error("Failed to copy:", err)
+    })
+  }
+
+  showCopiedFeedback() {
+    if (!this.hasCopyButtonTarget) return
+
+    // Clear any pending feedback timeout from a previous copy
+    if (this._feedbackTimeout) {
+      clearTimeout(this._feedbackTimeout)
+    }
+
+    const button = this.copyButtonTarget
+    if (!this._originalClasses) {
+      this._originalClasses = button.className
+    }
+
+    // Update icon and text
+    if (this.hasCopyIconTarget) {
+      this.copyIconTarget.className = "fa-solid fa-check"
+    }
+    if (this.hasCopyTextTarget) {
+      this.copyTextTarget.textContent = "Copied!"
+    }
+
+    // Swap to success style
+    button.className = "shrink-0 btn btn-success transition"
+
+    // Restore after 2 seconds
+    this._feedbackTimeout = setTimeout(() => {
+      this._feedbackTimeout = null
+      button.className = this._originalClasses
+      if (this.hasCopyIconTarget) {
+        this.copyIconTarget.className = "fa-solid fa-copy"
+      }
+      if (this.hasCopyTextTarget) {
+        this.copyTextTarget.textContent = "Copy"
+      }
+    }, 2000)
+  }
+
+  get maskedSecret() {
+    const secret = this.secretValue
+    if (!secret || secret.length === 0) return ""
+    if (secret.length <= 4) return "\u2022".repeat(secret.length)
+    return "\u2022".repeat(12) + secret.slice(-4)
+  }
+}

data/app/javascript/panda/core/controllers/collapsible_item_controller.js

@@ -0,0 +1,45 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = ["body", "icon", "summary"]
+  static values = { expanded: { type: Boolean, default: false } }
+
+  connect() {
+    this.render()
+  }
+
+  toggle(event) {
+    // Don't toggle if clicking a button, link, input, select, or drag handle inside the header
+    if (event.target.closest("button, a, input, select, textarea, [data-sortable-handle]")) return
+
+    this.expandedValue = !this.expandedValue
+    this.render()
+  }
+
+  // No-op action to stop event propagation from nested buttons
+  noop() {}
+
+  render() {
+    if (this.hasBodyTarget) {
+      if (this.expandedValue) {
+        this.bodyTarget.style.maxHeight = this.bodyTarget.scrollHeight + "px"
+        this.bodyTarget.style.opacity = "1"
+      } else {
+        this.bodyTarget.style.maxHeight = "0px"
+        this.bodyTarget.style.opacity = "0"
+      }
+    }
+
+    if (this.hasIconTarget) {
+      this.iconTarget.style.transform = this.expandedValue ? "rotate(180deg)" : "rotate(0deg)"
+    }
+  }
+
+  // Update summary text from a form input event
+  updateSummary(event) {
+    if (this.hasSummaryTarget) {
+      const value = event.target.value.trim()
+      this.summaryTarget.textContent = value || this.summaryTarget.dataset.placeholder || "New item"
+    }
+  }
+}