panda-core 0.12.5 → 1.1.0

data/app/components/panda/core/base.rb

@@ -2,24 +2,26 @@
 
 module Panda
   module Core
-    # Base class for all Phlex components in the Panda ecosystem.
+    # Base class for all ViewComponent components in the Panda ecosystem.
     #
     # This base component provides:
-    # - Type-safe properties via Literal
-    # - Tailwind CSS class merging
+    # - Tailwind CSS class merging via TailwindMerge
     # - Attribute merging with sensible defaults
-    # - Rails helper integration
+    # - Rails helper integration (inherited from ViewComponent::Base)
     # - Development-mode debugging comments
     #
     # @example Basic usage
     #   class MyComponent < Panda::Core::Base
-    #     prop :title, String
-    #     prop :variant, Symbol, default: :primary
-    #
-    #     def view_template
-    #       div(**@attrs) { title }
+    #     def initialize(title:, variant: :primary, **attrs)
+    #       @title = title
+    #       @variant = variant
+    #       super(**attrs)
     #     end
     #
+    #     attr_reader :title, :variant
+    #
+    #     private
+    #
     #     def default_attrs
     #       { class: "my-component my-component--#{variant}" }
     #     end
@@ -27,41 +29,42 @@ module Panda
     #
     # @example With attribute merging
     #   # Component definition
-    #   class Button < Panda::Core::Base
-    #     prop :text, String
-    #
-    #     def view_template
-    #       button(**@attrs) { text }
+    #   class ButtonComponent < Panda::Core::Base
+    #     def initialize(text:, **attrs)
+    #       @text = text
+    #       super(**attrs)
     #     end
     #
+    #     attr_reader :text
+    #
+    #     private
+    #
     #     def default_attrs
     #       { class: "btn btn-primary", type: "button" }
     #     end
     #   end
     #
     #   # Usage - user attrs merge with defaults
-    #   render Button.new(text: "Click me", class: "mt-4", type: "submit")
+    #   render ButtonComponent.new(text: "Click me", class: "mt-4", type: "submit")
     #   # => <button type="submit" class="btn btn-primary mt-4">Click me</button>
     #
-    class Base < Phlex::HTML
+    class Base < ViewComponent::Base
       # Frozen instance of TailwindMerge for efficient class merging
       TAILWIND_MERGER = ::TailwindMerge::Merger.new.freeze unless defined?(TAILWIND_MERGER)
 
-      # Enable type-safe properties via Literal
-      extend Literal::Properties
-
-      # Include Rails helpers for routes, etc.
-      include Phlex::Rails::Helpers::Routes
-
-      # Special handling for the attrs property - merges user attributes with defaults
-      # and intelligently handles Tailwind class merging
+      # Initialize the component with user-provided attributes.
+      # Subclasses should call super(**attrs) after setting their own instance variables.
       #
-      # @param value [Hash] User-provided attributes
-      # @return [Hash] Merged attributes with Tailwind classes properly combined
-      prop :attrs, Hash, :**, reader: :private do |value|
-        merge_attrs(value, default_attrs)
+      # @param attrs [Hash] User-provided HTML attributes
+      def initialize(**user_attrs)
+        super()
+        @attrs = merge_attrs(user_attrs, default_attrs)
       end
 
+      private
+
+      attr_reader :attrs
+
       # Merges user-provided attributes with default attributes.
       # Special handling for :class to merge Tailwind classes intelligently.
       #
@@ -102,20 +105,10 @@ module Panda
         {}
       end
 
-      # In development mode, wrap components with HTML comments
-      # showing their class name for easier debugging
-      if Rails.env.development?
-        def before_template
-          class_name = self.class.name
-          comment { "Begin #{class_name}" }
-          super
-        end
-
-        def after_template
-          class_name = self.class.name
-          super
-          comment { "End #{class_name}" }
-        end
+      # ViewComponent automatically renders templates in the same directory
+      # We override call to make it public for testing
+      def call
+        super
       end
     end
   end

data/app/components/panda/core/shared/footer_component.html.erb

@@ -0,0 +1,2 @@
+  </body>
+</html>

data/app/components/panda/core/shared/footer_component.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Shared
+      # Footer component for closing HTML document
+      class FooterComponent < ViewComponent::Base
+      end
+    end
+  end
+end

data/app/components/panda/core/shared/header_component.html.erb

@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html data-theme="<%= Panda::Core::Current&.user&.current_theme || Panda::Core.config.default_theme %>" class="<%= @html_class %>">
+  <head>
+    <title><%= helpers.content_for?(:title) ? helpers.content_for(:title) : (Panda::Core.config.admin_title || "Panda Admin") %></title>
+    <%= helpers.csrf_meta_tags %>
+    <%= helpers.csp_meta_tag %>
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@7.1.0/css/all.min.css">
+    <%= helpers.panda_core_stylesheet %>
+    <link rel="stylesheet" href="/panda-core-assets/vanilla-calendar.css">
+
+    <% if Gem.loaded_specs["chartkick"] %>
+      <script src="/panda-core-assets/chartkick/Chart.bundle.js"></script>
+      <script src="/panda-core-assets/chartkick/chartkick.js"></script>
+    <% end %>
+
+    <!-- ES Module Shims polyfill - must load BEFORE importmap -->
+    <script async src="https://ga.jspm.io/npm:es-module-shims@2.6.2/dist/es-module-shims.js"></script>
+
+    <!-- Panda JavaScript (Core + all registered modules via ModuleRegistry) -->
+    <%= helpers.panda_core_javascript %>
+
+    <% if defined?(Panda::CMS) && helpers.controller.class.name.start_with?("Panda::CMS") %>
+      <%= render "panda/cms/shared/favicons" %>
+    <% end %>
+
+    <% if Panda::Core.config.additional_head_content.respond_to?(:call) %>
+      <%= Panda::Core.config.additional_head_content.call.html_safe %>
+    <% end %>
+
+    <%= helpers.content_for :head %>
+  </head>
+  <body class="overflow-hidden h-full <%= @body_class %>" data-environment="<%= Rails.env %>">

data/app/components/panda/core/shared/header_component.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Shared
+      # Header component for HTML document head
+      # Handles title, meta tags, stylesheets, and JavaScript
+      class HeaderComponent < ViewComponent::Base
+        def initialize(html_class: "", body_class: "", **attrs)
+          super()
+          @html_class = html_class
+          @body_class = body_class
+        end
+
+        attr_reader :html_class, :body_class
+      end
+    end
+  end
+end

data/app/constraints/panda/core/admin_constraint.rb

@@ -4,9 +4,9 @@ module Panda
   module Core
     class AdminConstraint
       def matches?(request)
-        return false unless request.session[:user_id].present?
+        return false unless request.session[Panda::Core::ADMIN_SESSION_KEY].present?
 
-        user = User.find_by(id: request.session[:user_id])
+        user = User.find_by(id: request.session[Panda::Core::ADMIN_SESSION_KEY])
         user&.admin?
       end
     end

data/app/controllers/concerns/panda/core/admin_authorization.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    # Automatic permission enforcement for admin controllers.
+    #
+    # Reads from {PermissionRegistry} to determine which permission is required
+    # for the current controller action, then delegates to +authorize!+ (from
+    # {Authorizable}) to check the configured +authorization_policy+.
+    #
+    # This concern is included in {Admin::BaseController} so all admin
+    # controllers automatically get permission enforcement. No per-controller
+    # configuration is needed — just register permissions in the registry.
+    #
+    # Admin users (+user.admin?+) bypass all checks via {Authorizable#authorize!}.
+    #
+    # == Behavior for unmapped controllers/actions
+    #
+    # * Controller not in registry → access allowed (open by default)
+    # * Action not in registry → access allowed
+    # * Action mapped → +authorize!(permission_key)+ is called
+    #
+    # == Example
+    #
+    #   # Register permissions (in an engine or initializer):
+    #   Panda::Core::PermissionRegistry.register(
+    #     "Panda::CMS::Admin::PagesController",
+    #     index: :edit_content, destroy: :delete_content
+    #   )
+    #
+    #   # Enforcement happens automatically via before_action
+    module AdminAuthorization
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :enforce_registry_permissions!
+      end
+
+      private
+
+      def enforce_registry_permissions!
+        # Admin users bypass all checks (handled by authorize! but skip lookup too)
+        return if current_user&.admin?
+
+        required_permission = Panda::Core::PermissionRegistry.permission_for(
+          self.class.name,
+          action_name.to_sym
+        )
+
+        # No registration = allowed
+        return unless required_permission
+
+        # Delegate to Authorizable#authorize! which checks authorization_policy
+        authorize!(required_permission)
+      end
+    end
+  end
+end

data/app/controllers/concerns/panda/core/authorizable.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    # Authorizable concern for admin controllers.
+    #
+    # Provides a generic authorization layer that delegates permission checks
+    # to the configurable `Panda::Core.config.authorization_policy` lambda.
+    # This allows downstream gems (e.g. panda-cms-pro) to inject RBAC checks
+    # without panda-core needing any knowledge of roles or permissions.
+    #
+    # Usage in controllers:
+    #
+    #   class PagesController < Admin::BaseController
+    #     require_permission :edit_content, only: [:edit, :update]
+    #     require_permission :publish_content, only: [:publish]
+    #   end
+    #
+    # Or manually:
+    #
+    #   def update
+    #     authorize!(:edit_content, @page)
+    #   end
+    #
+    module Authorizable
+      extend ActiveSupport::Concern
+
+      included do
+        helper_method :can? if respond_to?(:helper_method)
+      end
+
+      class_methods do
+        # DSL for declarative permission checks.
+        # Registers a before_action that calls authorize! for the given permission.
+        #
+        # @param permission [Symbol] the permission key to check
+        # @param options [Hash] standard before_action options (only:, except:, etc.)
+        def require_permission(permission, **options)
+          before_action(**options) do
+            authorize!(permission)
+          end
+        end
+      end
+
+      # Check whether the current user is authorized for the given action.
+      #
+      # @param action [Symbol] the action/permission to check
+      # @param resource [Object, nil] optional resource context
+      # @return [Boolean]
+      def authorized_for?(action, resource = nil)
+        return false unless current_user
+
+        # Admin users bypass all authorization checks
+        return true if current_user.admin?
+
+        # Delegate to the configured authorization policy
+        policy = Panda::Core.config.authorization_policy
+        policy.call(current_user, action, resource)
+      end
+
+      # Authorize the current user or render a 403/redirect.
+      #
+      # @param action [Symbol] the action/permission to check
+      # @param resource [Object, nil] optional resource context
+      # @raise renders 403 or redirects if not authorized
+      def authorize!(action, resource = nil)
+        return if authorized_for?(action, resource)
+
+        respond_to do |format|
+          format.html do
+            flash[:error] = "You do not have permission to perform this action."
+            redirect_to(request.referer || panda_core.admin_root_path)
+          end
+          format.json do
+            render json: {error: "Forbidden", status: 403}, status: :forbidden
+          end
+        end
+      end
+
+      # View-layer helper for checking permissions.
+      # Can be used in templates: `if can?(:edit_content)`
+      #
+      # @param action [Symbol] the action/permission to check
+      # @param resource [Object, nil] optional resource context
+      # @return [Boolean]
+      def can?(action, resource = nil)
+        authorized_for?(action, resource)
+      end
+
+      # Check whether the current user is authorized to access the admin panel.
+      # This is called during authentication to allow non-admin users with roles
+      # to access the admin area.
+      #
+      # @return [Boolean]
+      def authorized_for_admin_access?
+        return false unless current_user
+
+        # Admin users always have access
+        return true if current_user.admin?
+
+        # Check the authorization policy for :access_admin
+        policy = Panda::Core.config.authorization_policy
+        policy.call(current_user, :access_admin, nil)
+      end
+    end
+  end
+end

data/app/controllers/panda/core/admin/base_controller.rb

@@ -6,20 +6,31 @@ module Panda
       # Base controller for all admin interfaces across Panda gems
       # Provides authentication, helpers, and hooks for extending functionality
       class BaseController < ::ActionController::Base
+        include Panda::Core::Authorizable
+
         layout "panda/core/admin"
 
         protect_from_forgery with: :exception
 
+        default_form_builder Panda::Core::FormBuilder
+
         # Add flash types for improved alert support with Tailwind
         add_flash_types :success, :warning, :error, :info
 
         # Include helper modules
         helper Panda::Core::SessionsHelper
+        helper Panda::Core::FormHelper
+        helper Panda::Core::FeatureFlagHelper
         helper Panda::Core::AssetHelper if defined?(Panda::Core::AssetHelper)
+        helper Panda::Core::ActiveStorageHelper
 
         before_action :set_current_request_details
         before_action :authenticate_admin_user!
 
+        # Must be included AFTER the authentication before_actions above,
+        # because enforce_registry_permissions! needs current_user to be set.
+        include Panda::Core::AdminAuthorization
+
         helper_method :breadcrumbs
         helper_method :current_user
         helper_method :user_signed_in?
@@ -40,7 +51,9 @@ module Panda
           Panda::Core::Current.user_agent = request.user_agent
           Panda::Core::Current.ip_address = request.ip
           Panda::Core::Current.root = request.base_url
-          Panda::Core::Current.user ||= Panda::Core::User.find_by(id: session[:user_id]) if session[:user_id]
+          Panda::Core::Current.user ||= Panda::Core::User.find_by(id: session[Panda::Core::ADMIN_SESSION_KEY]) if session[Panda::Core::ADMIN_SESSION_KEY]
+
+          track_session_activity if Panda::Core::Current.user
         end
 
         def authenticate_user!
@@ -48,10 +61,25 @@ module Panda
         end
 
         def authenticate_admin_user!
-          return if user_signed_in? && current_user.admin?
+          unless user_signed_in?
+            # Preserve the requested path so it can be restored after authentication.
+            # Skip login/auth paths to avoid redirect loops.
+            admin_prefix = Core.config.admin_path
+            if request.path.start_with?(admin_prefix) &&
+                !request.path.start_with?("#{admin_prefix}/login") &&
+                !request.path.start_with?("#{admin_prefix}/auth/")
+              session[:post_auth_redirect_path] = request.path
+            end
+
+            redirect_to panda_core.admin_login_path,
+              flash: {error: "Please login to view this!"}
+            return
+          end
+
+          return if authorized_for_admin_access?
 
           redirect_to panda_core.admin_login_path,
-            flash: {error: "Please login to view this!"}
+            flash: {error: "You are not authorized to access the admin area."}
         end
 
         # Required for paper_trail and seems as good as convention these days
@@ -62,6 +90,37 @@ module Panda
         def user_signed_in?
           !!Panda::Core::Current.user
         end
+
+        private
+
+        def track_session_activity
+          return unless session.id.present?
+
+          last_tracked = session[:_session_tracked_at]
+          return if last_tracked && Time.current.to_i - last_tracked < 60
+
+          begin
+            Panda::Core::UserSession.find_or_create_by(
+              session_id: session.id.to_s,
+              user: Panda::Core::Current.user
+            ) do |us|
+              us.ip_address = request.remote_ip
+              us.user_agent = request.user_agent
+            end
+            Panda::Core::UserSession.where(
+              session_id: session.id.to_s,
+              user: Panda::Core::Current.user
+            ).update_all(
+              last_active_at: Time.current,
+              active: true
+            )
+            session[:_session_tracked_at] = Time.current.to_i
+          rescue ActiveRecord::RecordNotUnique => e
+            Rails.logger.debug("Session already exists: #{e.message}")
+          rescue => e
+            Rails.logger.debug("Session tracking skipped: #{e.message}")
+          end
+        end
       end
     end
   end

data/app/controllers/panda/core/admin/editor/search_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Admin
+      module Editor
+        class SearchController < ::Panda::Core::Admin::BaseController
+          def index
+            query = params[:search].to_s.strip
+            items = Panda::Core::SearchRegistry.search(query, limit: 10)
+            render json: {success: true, items: items}
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/panda/core/admin/feature_flags_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Admin
+      class FeatureFlagsController < BaseController
+        before_action :set_initial_breadcrumb
+
+        def index
+          @feature_flags = FeatureFlag.order(:key)
+          @grouped_flags = @feature_flags.group_by { |flag| flag.key.split(".").first }
+        end
+
+        def update
+          @feature_flag = FeatureFlag.find(params[:id])
+          FeatureFlag.toggle!(@feature_flag.key)
+
+          new_state = @feature_flag.reload.enabled? ? "enabled" : "disabled"
+          flash[:success] = "Feature flag \"#{@feature_flag.key}\" has been #{new_state}."
+          redirect_to admin_feature_flags_path
+        rescue ActiveRecord::RecordNotFound
+          flash[:alert] = "Feature flag not found."
+          redirect_to admin_feature_flags_path
+        end
+
+        private
+
+        def set_initial_breadcrumb
+          add_breadcrumb "Settings", admin_settings_path
+          add_breadcrumb "Feature Flags", admin_feature_flags_path
+        end
+      end
+    end
+  end
+end

data/app/controllers/panda/core/admin/file_categories_controller.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Admin
+      class FileCategoriesController < BaseController
+        before_action :set_initial_breadcrumb
+        before_action :set_file_category, only: %i[edit update destroy]
+
+        def index
+          @file_categories = FileCategory.roots.ordered.includes(:children)
+        end
+
+        def new
+          @file_category = FileCategory.new
+          add_breadcrumb "New Category"
+        end
+
+        def create
+          @file_category = FileCategory.new(file_category_params)
+
+          if @file_category.save
+            flash[:success] = "File category has been created successfully."
+            redirect_to admin_file_categories_path
+          else
+            add_breadcrumb "New Category"
+            render :new, status: :unprocessable_content
+          end
+        end
+
+        def edit
+          if @file_category.system?
+            flash[:warning] = "System categories cannot be edited."
+            redirect_to admin_file_categories_path
+            return
+          end
+          add_breadcrumb @file_category.name
+        end
+
+        def update
+          if @file_category.system?
+            flash[:warning] = "System categories cannot be edited."
+            redirect_to admin_file_categories_path
+            return
+          end
+
+          if @file_category.update(file_category_params)
+            flash[:success] = "File category has been updated successfully."
+            redirect_to admin_file_categories_path
+          else
+            add_breadcrumb @file_category.name
+            render :edit, status: :unprocessable_content
+          end
+        end
+
+        def destroy
+          if @file_category.system?
+            flash[:warning] = "System categories cannot be deleted."
+          elsif @file_category.destroy
+            flash[:success] = "File category has been deleted successfully."
+          else
+            flash[:error] = @file_category.errors.full_messages.to_sentence
+          end
+
+          redirect_to admin_file_categories_path, status: :see_other
+        end
+
+        private
+
+        def set_initial_breadcrumb
+          add_breadcrumb "File Categories", admin_file_categories_path
+        end
+
+        def set_file_category
+          @file_category = FileCategory.find(params[:id])
+        end
+
+        def file_category_params
+          params.require(:file_category).permit(:name, :icon, :position, :parent_id)
+        end
+      end
+    end
+  end
+end