RubyGems - panda-core - Versions diffs - 0.12.2 → 1.1.0 - Mend

panda-core 0.12.2 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (255) hide show

data/app/views/panda/core/shared/_header.html.erb CHANGED Viewed

@@ -1,22 +1,4 @@
-<!DOCTYPE html>
-<html data-theme="<%= Panda::Core::Current&.user&.current_theme || Panda::Core.config.default_theme %>" class="<%= local_assigns[:html_class] || "" %>">
-  <head>
-    <title><%= content_for?(:title) ? yield(:title) : (Panda::Core.config.admin_title || "Panda Admin") %></title>
-    <%= csrf_meta_tags %>
-    <%= csp_meta_tag %>
-    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@7.1.0/css/all.min.css">
-    <%= panda_core_stylesheet %>
-    <!-- ES Module Shims polyfill - must load BEFORE importmap -->
-    <script async src="https://ga.jspm.io/npm:es-module-shims@2.6.2/dist/es-module-shims.js"></script>
-    <!-- Panda JavaScript (Core + all registered modules via ModuleRegistry) -->
-    <%= panda_core_javascript %>
-    <% if defined?(Panda::CMS) && controller.class.name.start_with?("Panda::CMS") %>
-      <%= render "panda/cms/shared/favicons" %>
-    <% end %>
-    <%= yield :head %>
-  </head>
-  <body class="overflow-hidden h-full <%= local_assigns[:body_class] || "" %>" data-environment="<%= Rails.env %>">
+<%= render Panda::Core::Shared::HeaderComponent.new(
+  html_class: local_assigns[:html_class] || "",
+  body_class: local_assigns[:body_class] || ""
+) %>

data/config/brakeman.ignore CHANGED Viewed

@@ -1,51 +1,88 @@
 {
   "ignored_warnings": [
     {
-      "warning_type": "Command Injection",
-      "warning_code": 14,
-      "fingerprint": "29d5b60b583fc98e293f6ac47f153bbf5db48a03963f8c9a7711bd251ecf2d81",
-      "check_name": "Execute",
-      "message": "Possible command injection",
-      "file": "lib/panda/core/testing/support/system/cuprite_helpers.rb",
-      "line": 78,
-      "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
-      "code": "system(\"ffmpeg -y -framerate 8 -pattern_type glob -i '#{File.join(dir, \"frames\")}/*.png' -c:v libx264 -pix_fmt yuv420p '#{capybara_artifacts_dir.join(\"#{example.metadata[:full_description].parameterize}.mp4\")}'\\n\")",
+      "warning_type": "Cross-Site Request Forgery",
+      "warning_code": 86,
+      "fingerprint": "fdf51189b80e32937b18aea1d088b9de2397d9a958f4a961030b37ebeae4e53d",
+      "check_name": "ForgerySetting",
+      "message": "`protect_from_forgery` should be configured with `with: :exception`",
+      "file": "lib/panda/core/testing/view_component_test_controller.rb",
+      "line": 7,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/",
+      "code": "protect_from_forgery(:with => :null_session)",
       "render_path": null,
       "location": {
-        "type": "method",
-        "class": "Panda::Core::Testing::CupriteHelpers",
-        "method": "record_video!"
+        "type": "controller",
+        "controller": "ViewComponentTestController"
       },
-      "user_input": "File.join(dir, \"frames\")",
+      "user_input": null,
       "confidence": "Medium",
       "cwe_id": [
-        77
+        352
       ],
-      "note": "This does not use user input and is based on environment variables and the current folder"
+      "note": ""
     },
     {
-      "warning_type": "Command Injection",
-      "warning_code": 14,
-      "fingerprint": "d3c339f054cbd511956e04eaf8763bc722bd2e4559a1c1fec58749abef9792cd",
-      "check_name": "Execute",
-      "message": "Possible command injection",
-      "file": "lib/panda/core/testing/support/system/chrome_verification.rb",
-      "line": 43,
-      "link": "https://brakemanscanner.org/docs/warning_types/command_injection/",
-      "code": "Process.spawn(*[BrowserPath.resolve, v.nil? ? (\"--#{k}\") : (\"--#{k}=#{v}\"), \"about:blank\"], :out => (File::NULL), :err => (File::NULL))",
+      "warning_type": "Mass Assignment",
+      "warning_code": 105,
+      "fingerprint": "7b32da2eebb702da28834b0ac77f1a3801b9abb4b09527ce7726070b5d91ee7a",
+      "check_name": "PermitAttributes",
+      "message": "Potentially dangerous key allowed for mass assignment",
+      "file": "app/controllers/panda/core/admin/users_controller.rb",
+      "line": 169,
+      "link": "https://brakemanscanner.org/docs/warning_types/mass_assignment/",
+      "code": "params.require(:user).permit(:name, :email, :admin, :internal)",
       "render_path": null,
       "location": {
         "type": "method",
-        "class": "Panda::Core::Testing::Support::System::ChromeVerification",
-        "method": "s(:self).verify!"
+        "class": "Panda::Core::Admin::UsersController",
+        "method": "user_params"
       },
-      "user_input": "k",
-      "confidence": "Medium",
+      "user_input": ":admin",
+      "confidence": "High",
+      "cwe_id": [
+        915
+      ],
+      "note": "Admin-only controller behind authenticate_admin_user! - only admins can modify user roles and metadata"
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "46a409fd77a42e7e6db3d8c22a494fa102be16bb04ca613494baf0e3f75710e8",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/panda/core/admin/users/edit.html.erb",
+      "line": 41,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_scripting/",
+      "code": "Panda::Core.config.admin_user_edit_content.call(User.find(params[:id]), f, self)",
+      "render_path": null,
+      "location": null,
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "cwe_id": [
+        79
+      ],
+      "note": "Hook content is controlled by the host application developer, not user input. The raw call is intentional to render host-provided HTML."
+    },
+    {
+      "warning_type": "Cross-Site Scripting",
+      "warning_code": 2,
+      "fingerprint": "f60426d4ca96ba191b9a49da3b27193b2dc00fdcb93574037165d98b3dbab0d4",
+      "check_name": "CrossSiteScripting",
+      "message": "Unescaped parameter value",
+      "file": "app/views/panda/core/admin/users/show.html.erb",
+      "line": 36,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_scripting/",
+      "code": "Panda::Core.config.admin_user_show_content.call(User.find(params[:id]), self)",
+      "render_path": null,
+      "location": null,
+      "user_input": "params[:id]",
+      "confidence": "Weak",
       "cwe_id": [
-        77
+        79
       ],
-      "note": "Chrome verification uses a fixed set of browser flags from CHROME_FLAGS constant; no user input is accepted"
+      "note": "Hook content is controlled by the host application developer, not user input. The raw call is intentional to render host-provided HTML."
     }
   ],
-  "brakeman_version": "7.1.1"
+  "brakeman_version": "8.0.4"
 }

data/config/importmap.rb CHANGED Viewed

@@ -9,20 +9,22 @@ pin "panda/core/controllers/theme_form_controller", to: "/panda/core/controllers
 pin "panda/core/controllers/image_cropper_controller", to: "/panda/core/controllers/image_cropper_controller.js"
 pin "panda/core/tailwindplus-elements", to: "/panda/core/tailwindplus-elements.js"
-# Base JavaScript dependencies for Panda Core (vendored for reliability)
+# Base JavaScript dependencies for Panda Core (all vendored for reliability)
 pin "@hotwired/stimulus", to: "/panda/core/vendor/@hotwired--stimulus.js", preload: true # @3.2.2
-pin "@hotwired/turbo", to: "/panda/core/vendor/@hotwired--turbo.js", preload: true # @8.0.18
-pin "@rails/actioncable/src", to: "/panda/core/vendor/@rails--actioncable--src.js", preload: true # @8.0.201
+pin "@hotwired/turbo", to: "/panda/core/vendor/@hotwired--turbo.js", preload: true # @8.0.23
+pin "@rails/actioncable/src", to: "/panda/core/vendor/@rails--actioncable--src.js", preload: true # @8.1.300
 pin "tailwindcss-stimulus-components", to: "/panda/core/tailwindcss-stimulus-components.js" # @6.1.3
-# Font Awesome icons (from CDN)
-pin "@fortawesome/fontawesome-free", to: "https://ga.jspm.io/npm:@fortawesome/fontawesome-free@7.1.0/js/all.js"
+# Font Awesome icons (vendored)
+pin "@fortawesome/fontawesome-free", to: "/panda/core/vendor/@fortawesome--fontawesome-free@7.2.0.js" # @7.2.0
-# Tailwind Plus Elements - Vanilla JS interactive components (from CDN)
+# Tailwind Plus Elements - Vanilla JS interactive components (vendored)
 # Provides: Autocomplete, Command palette, Dialog, Disclosure, Dropdown menu, Popover, Select, Tabs
-# Note: Using esm.sh instead of jsdelivr for better ES module support
-pin "@tailwindplus/elements", to: "https://esm.sh/@tailwindplus/elements@1", preload: false
+pin "@tailwindplus/elements", to: "/panda/core/vendor/@tailwindplus--elements@1.0.22.js", preload: false # @1.0.22
-# Cropper.js - Image cropping library (via esm.sh for reliable ES module support)
-pin "cropperjs", to: "https://esm.sh/cropperjs@1.6.2"
-# Note: Cropper.css is loaded separately via stylesheet_link_tag in views that use cropper
+# Cropper.js - Image cropping library (vendored)
+# Note: v2.x uses Web Components — no separate CSS file needed
+pin "cropperjs", to: "/panda/core/vendor/cropperjs@2.1.0.js" # @2.1.0
+# Vanilla Calendar Pro - Date picker library (vendored)
+pin "vanilla-calendar-pro", to: "/panda/core/vendor/vanilla-calendar-pro.js" # @3.1.0

data/config/routes.rb CHANGED Viewed

@@ -16,17 +16,64 @@ Panda::Core::Engine.routes.draw do
     # Dashboard and admin routes - authentication handled by AdminController
     get "/", to: "admin/dashboard#show", as: :root
+    # Global admin search
+    get "/search", to: "admin/search#index", as: :search
+    # Editor search endpoint for link-autocomplete
+    namespace :editor, module: "admin/editor" do
+      get :search, to: "search#index", as: :search
+    end
     # Profile management
-    resource :my_profile, only: %i[show edit update], controller: "admin/my_profile", path: "my_profile"
+    resource :my_profile, only: %i[show edit update], controller: "admin/my_profile", path: "my_profile" do
+      resource :logins, only: [:show], controller: "admin/my_profile/logins"
+    end
     # Settings
     resource :settings, only: [:show], controller: "admin/settings"
+    # User management
+    resources :users, only: %i[index show edit update], controller: "admin/users" do
+      member do
+        patch :enable
+        patch :disable
+        get :activity
+        get :sessions
+        delete "sessions/:session_id", action: :revoke_session, as: :revoke_session
+      end
+      collection do
+        post :invite
+        post :bulk_action
+      end
+    end
+    # File management
+    resources :files, controller: "admin/files"
+    # File category management
+    resources :file_categories, only: %i[index new create edit update destroy], controller: "admin/file_categories"
+    # Feature flag management
+    resources :feature_flags, only: %i[index update], controller: "admin/feature_flags"
+    # Tags
+    resources :tags, only: %i[index new create edit update destroy], controller: "admin/tags"
+    # CSV Import
+    resources :import_sessions, only: %i[index new create show], controller: "admin/import_sessions" do
+      member do
+        get :column_map
+        patch :update_mapping
+        get :preview
+        post :import
+      end
+    end
     # Test-only authentication endpoint (available in development and test environments)
     # This bypasses OAuth for faster, more reliable test execution
     # Development: Used by Capybara system tests which run Rails server in development mode
     # Test: Used by controller/request tests
-    unless Rails.env.production?
+    if Rails.env.development? || Rails.env.test?
       get "/test_login/:user_id", to: "admin/test_sessions#create", as: :test_login
       post "/test_sessions", to: "admin/test_sessions#create", as: :test_sessions
     end

data/db/migrate/20260202171614_create_panda_core_file_categories.rb ADDED Viewed

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+class CreatePandaCoreFileCategories < ActiveRecord::Migration[7.1]
+  def change
+    create_table :panda_core_file_categories, id: :uuid do |t|
+      t.string :name, null: false
+      t.string :slug, null: false
+      t.references :parent, type: :uuid, foreign_key: {to_table: :panda_core_file_categories}
+      t.boolean :system, null: false, default: false
+      t.string :icon
+      t.integer :position, null: false, default: 0
+      t.timestamps
+    end
+    add_index :panda_core_file_categories, :slug, unique: true
+    add_index :panda_core_file_categories, :position
+    create_table :panda_core_file_categorizations, id: :uuid do |t|
+      t.references :file_category, null: false, type: :uuid,
+        foreign_key: {to_table: :panda_core_file_categories}
+      t.bigint :blob_id, null: false
+      t.timestamps
+    end
+    add_index :panda_core_file_categorizations, %i[file_category_id blob_id],
+      unique: true, name: :idx_file_categorizations_on_category_and_blob
+    add_index :panda_core_file_categorizations, :blob_id
+    add_foreign_key :panda_core_file_categorizations, :active_storage_blobs, column: :blob_id
+  end
+end

data/db/migrate/20260203000001_add_user_management_fields_to_panda_core_users.rb ADDED Viewed

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+class AddUserManagementFieldsToPandaCoreUsers < ActiveRecord::Migration[8.1]
+  def change
+    change_table :panda_core_users, bulk: true do |t|
+      t.boolean :enabled, default: true, null: false
+      t.datetime :last_login_at
+      t.string :last_login_ip
+      t.integer :login_count, default: 0, null: false
+      t.uuid :invited_by_id
+      t.string :invitation_token
+      t.datetime :invitation_sent_at
+      t.datetime :invitation_accepted_at
+    end
+    add_index :panda_core_users, :invitation_token, unique: true
+    add_index :panda_core_users, :invited_by_id
+    add_index :panda_core_users, :enabled
+    add_foreign_key :panda_core_users, :panda_core_users, column: :invited_by_id
+  end
+end

data/db/migrate/20260203000002_create_panda_core_user_activities.rb ADDED Viewed

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+class CreatePandaCoreUserActivities < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_user_activities, id: :uuid do |t|
+      t.uuid :user_id, null: false
+      t.string :action, null: false
+      t.string :resource_type
+      t.uuid :resource_id
+      t.jsonb :metadata, default: {}
+      t.string :ip_address
+      t.string :user_agent
+      t.timestamps
+      t.index :user_id
+      t.index [:resource_type, :resource_id]
+      t.index :action
+      t.index :created_at
+    end
+    add_foreign_key :panda_core_user_activities, :panda_core_users, column: :user_id
+  end
+end

data/db/migrate/20260203000003_create_panda_core_user_sessions.rb ADDED Viewed

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+class CreatePandaCoreUserSessions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_user_sessions, id: :uuid do |t|
+      t.uuid :user_id, null: false
+      t.string :session_id, null: false
+      t.string :ip_address
+      t.string :user_agent
+      t.datetime :last_active_at
+      t.boolean :active, default: true, null: false
+      t.datetime :revoked_at
+      t.uuid :revoked_by_id
+      t.timestamps
+      t.index :session_id, unique: true
+      t.index :user_id
+      t.index :active
+    end
+    add_foreign_key :panda_core_user_sessions, :panda_core_users, column: :user_id
+    add_foreign_key :panda_core_user_sessions, :panda_core_users, column: :revoked_by_id, on_delete: :nullify
+  end
+end

data/db/migrate/20260207100000_create_panda_core_presences.rb ADDED Viewed

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+class CreatePandaCorePresences < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_presences, id: :uuid do |t|
+      t.string :presenceable_type, null: false
+      t.uuid :presenceable_id, null: false
+      t.uuid :user_id, null: false
+      t.datetime :last_seen_at, null: false
+      t.timestamps
+    end
+    add_index :panda_core_presences, [:presenceable_type, :presenceable_id, :user_id],
+      unique: true, name: "index_unique_presence"
+    add_index :panda_core_presences, [:presenceable_type, :presenceable_id],
+      name: "index_presences_on_presenceable"
+    add_index :panda_core_presences, :user_id
+    add_index :panda_core_presences, :last_seen_at
+    add_foreign_key :panda_core_presences, :panda_core_users, column: :user_id
+  end
+end

data/db/migrate/20260213000001_fix_active_storage_attachments_record_id_type.rb ADDED Viewed

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+class FixActiveStorageAttachmentsRecordIdType < ActiveRecord::Migration[8.1]
+  def up
+    return unless table_exists?(:active_storage_attachments)
+    column = columns(:active_storage_attachments).find { |c| c.name == "record_id" }
+    return if column.nil? || column.sql_type == "character varying"
+    # Remove orphaned attachments where UUID was silently cast to 0
+    execute <<~SQL
+      DELETE FROM active_storage_attachments WHERE record_id = 0
+    SQL
+    # Drop the unique index before changing the column type
+    remove_index :active_storage_attachments,
+      name: "index_active_storage_attachments_uniqueness",
+      if_exists: true
+    change_column :active_storage_attachments, :record_id, :string, null: false
+    add_index :active_storage_attachments,
+      [:record_type, :record_id, :name, :blob_id],
+      unique: true,
+      name: "index_active_storage_attachments_uniqueness"
+  end
+  def down
+    return unless table_exists?(:active_storage_attachments)
+    remove_index :active_storage_attachments,
+      name: "index_active_storage_attachments_uniqueness",
+      if_exists: true
+    change_column :active_storage_attachments, :record_id, :bigint,
+      null: false,
+      using: "record_id::bigint"
+    add_index :active_storage_attachments,
+      [:record_type, :record_id, :name, :blob_id],
+      unique: true,
+      name: "index_active_storage_attachments_uniqueness"
+  end
+end

data/db/migrate/20260217000001_create_panda_core_feature_flags.rb ADDED Viewed

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+class CreatePandaCoreFeatureFlags < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_feature_flags, id: :uuid do |t|
+      t.string :key, null: false
+      t.boolean :enabled, null: false, default: false
+      t.string :description
+      t.timestamps
+    end
+    add_index :panda_core_feature_flags, :key, unique: true
+  end
+end

data/db/migrate/20260303000001_add_metadata_to_panda_core_users.rb ADDED Viewed

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+class AddMetadataToPandaCoreUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :panda_core_users, :metadata, :jsonb, default: {}, null: false
+    if ActiveRecord::Base.connection.adapter_name == "PostgreSQL"
+      add_index :panda_core_users, :metadata, using: :gin, name: "index_panda_core_users_on_metadata"
+    end
+  end
+end

data/db/migrate/20260310000001_create_panda_core_tags.rb ADDED Viewed

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+class CreatePandaCoreTags < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_tags, id: :uuid do |t|
+      t.string :tenant_type
+      t.string :tenant_id
+      t.string :name, null: false
+      t.string :colour
+      t.integer :taggings_count, default: 0, null: false
+      t.timestamps
+      t.index [:tenant_type, :tenant_id]
+      t.index [:tenant_type, :tenant_id, :name], unique: true, name: :idx_panda_core_tags_on_tenant_and_name
+    end
+    create_table :panda_core_taggings, id: :uuid do |t|
+      t.references :tag, null: false, type: :uuid, foreign_key: {to_table: :panda_core_tags}
+      t.string :taggable_type, null: false
+      t.string :taggable_id, null: false
+      t.timestamps
+      t.index [:taggable_type, :taggable_id], name: :idx_panda_core_taggings_on_taggable
+      t.index [:tag_id, :taggable_type, :taggable_id], unique: true, name: :idx_panda_core_taggings_unique
+    end
+  end
+end

data/db/migrate/20260310000002_create_panda_core_import_sessions.rb ADDED Viewed

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+class CreatePandaCoreImportSessions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :panda_core_import_sessions, id: :uuid do |t|
+      t.string :importable_type, null: false
+      t.string :tenant_type
+      t.bigint :tenant_id
+      t.uuid :user_id, null: false
+      t.string :status, null: false, default: "pending"
+      t.jsonb :column_mapping, default: {}, null: false
+      t.integer :total_rows, default: 0, null: false
+      t.integer :processed_rows, default: 0, null: false
+      t.integer :imported_count, default: 0, null: false
+      t.integer :skipped_count, default: 0, null: false
+      t.integer :error_count, default: 0, null: false
+      t.jsonb :errors_log, default: [], null: false
+      t.datetime :started_at
+      t.datetime :completed_at
+      t.timestamps
+      t.index [:tenant_type, :tenant_id]
+      t.index :status
+      t.index :user_id
+    end
+    add_foreign_key :panda_core_import_sessions, :panda_core_users, column: :user_id
+  end
+end

data/lib/generators/panda/core/install_generator.rb ADDED Viewed

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+module Panda
+  module Core
+    module Generators
+      class InstallGenerator < Rails::Generators::Base
+        source_root File.expand_path("templates", __dir__)
+        desc "Install Panda Core: create the initializer and copy migrations"
+        def copy_initializer
+          template "panda.rb", "config/initializers/panda.rb"
+        end
+        def copy_migrations
+          rake "panda_core:install:migrations"
+        end
+        def show_readme
+          say ""
+          say "Panda Core installed!", :green
+          say ""
+          say "Next steps:"
+          say "  1. Edit config/initializers/panda.rb to configure authentication"
+          say "  2. Run: rails db:migrate"
+          say "  3. Add gem 'panda-cms' to your Gemfile for CMS functionality"
+          say ""
+        end
+      end
+    end
+  end
+end

data/lib/generators/panda/core/templates/panda.rb ADDED Viewed

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+Panda::Core.configure do |config|
+  # Path prefix for admin routes (e.g. "/admin", "/manage")
+  config.admin_path = "/admin"
+  # Title shown on the login page
+  config.login_page_title = "Admin"
+  # Title shown in the admin navigation bar
+  config.admin_title = "<%= Rails.application.class.module_parent_name %> Admin"
+  # Authentication providers
+  # Add the corresponding OmniAuth gem for each provider you enable
+  # (e.g. omniauth-google-oauth2, omniauth-github, omniauth-microsoft_graph).
+  #
+  # In development, GitHub OAuth works out of the box with shared dev credentials
+  # (restricted to localhost:3000). For production, add your own credentials via
+  # `rails credentials:edit`.
+  #
+  # The "developer" provider is built into OmniAuth and only active in
+  # development — it shows a simple form to enter a name and email.
+  #
+  # config.authentication_providers = {
+  #   github: {
+  #     enabled: true,
+  #     name: "GitHub",
+  #     client_id: if Rails.env.development?
+  #                  "Ov23liFMGyVvRrpuvyTT" # Shared Panda dev app (localhost:3000 only)
+  #                else
+  #                  Rails.application.credentials.dig(:github, :client_id)
+  #                end,
+  #     client_secret: if Rails.env.development?
+  #                      "394a7024d7dd9c0ee0c8540768331d59d9e22477"
+  #                    else
+  #                      Rails.application.credentials.dig(:github, :client_secret)
+  #                    end
+  #   },
+  #   developer: {
+  #     enabled: true,
+  #     name: "Developer Login"
+  #   }
+  # }
+  # Session cookie name
+  config.session_token_cookie = :panda_session
+  # User model classes (usually left as defaults)
+  config.user_class = "Panda::Core::User"
+  config.user_identity_class = "Panda::Core::UserIdentity"
+end
+# Uncomment after adding gem "panda-cms" to your Gemfile:
+# Panda::CMS.configure do |config|
+#   # Require login to view the public site
+#   config.require_login_to_view = false
+# end
+# Uncomment after adding gem "panda-editor" to your Gemfile:
+# Panda::Editor.configure do |config|
+#   # Additional EditorJS tools to load
+#   # config.editor_js_tools = []
+# end

data/lib/panda/core/asset_loader.rb CHANGED Viewed

@@ -45,7 +45,7 @@ module Panda
           # In production, prefer local compiled assets over GitHub
           # Only use GitHub assets when explicitly enabled or when local assets aren't available
-          if Rails.env.production?
+          if Rails.env.production? || Rails.env.staging?
             # Check if compiled assets exist locally
             return false if compiled_assets_available?
@@ -161,8 +161,11 @@ module Panda
             css_files = Dir[assets_dir.join("panda-core-*.css")].reject { |f| File.symlink?(f) }
             if css_files.any?
-              # Return the most recently created file
-              latest = css_files.max_by { |f| File.basename(f)[/\d+/].to_i }
+              # Return the file with the highest semantic version
+              latest = css_files.max_by { |f|
+                version_str = File.basename(f).match(/panda-core-(.+)\.css/)&.captures&.first || "0"
+                Gem::Version.new(version_str)
+              }
               return "/panda-core-assets/#{File.basename(latest)}"
             end
           else

data/lib/panda/core/authentication.rb CHANGED Viewed

@@ -11,7 +11,7 @@ module Panda
       def current_user
         return @current_user if defined?(@current_user)
-        @current_user = User.find_by(id: session[:user_id]) if session[:user_id]
+        @current_user = User.find_by(id: session[Panda::Core::ADMIN_SESSION_KEY]) if session[Panda::Core::ADMIN_SESSION_KEY]
       end
       def require_authentication
@@ -23,12 +23,12 @@ module Panda
       end
       def sign_in(user)
-        session[:user_id] = user.id
+        session[Panda::Core::ADMIN_SESSION_KEY] = user.id
         @current_user = user
       end
       def sign_out
-        session.delete(:user_id)
+        session.delete(Panda::Core::ADMIN_SESSION_KEY)
         @current_user = nil
       end
     end