panda-core 0.12.5 → 1.1.0

data/lib/panda/core/oauth_providers.rb

@@ -1,6 +1,25 @@
 module Panda
   module Core
     module OAuthProviders
+      # Provider metadata for display purposes
+      PROVIDER_INFO = {
+        microsoft_graph: {
+          name: "Microsoft",
+          icon: "fa-brands fa-microsoft",
+          color: "#00a4ef"
+        },
+        google_oauth2: {
+          name: "Google",
+          icon: "fa-brands fa-google",
+          color: "#4285f4"
+        },
+        github: {
+          name: "GitHub",
+          icon: "fa-brands fa-github",
+          color: "#333"
+        }
+      }.freeze
+
       def self.setup
         providers = []
 
@@ -27,6 +46,14 @@ module Panda
 
         providers
       end
+
+      def self.info(provider)
+        PROVIDER_INFO[provider.to_sym] || {
+          name: provider.to_s.titleize,
+          icon: "fa-solid fa-circle-user",
+          color: "#6b7280"
+        }
+      end
     end
   end
 end

data/lib/panda/core/permission_registry.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    # Registry for controller-level permission requirements.
+    #
+    # Gems and host apps register which permissions are needed for each
+    # controller action. The {AdminAuthorization} concern reads this registry
+    # at request time to enforce access control.
+    #
+    # == Usage
+    #
+    #   # In a gem engine (config.to_prepare or initializer):
+    #   Panda::Core::PermissionRegistry.register(
+    #     "Panda::CMS::Admin::PagesController",
+    #     index: :edit_content,
+    #     edit: :edit_content,
+    #     destroy: :delete_content
+    #   )
+    #
+    #   # In a host app initializer:
+    #   Panda::Core::PermissionRegistry.register(
+    #     "Admin::HealthcareProvidersController",
+    #     index: :manage_providers,
+    #     destroy: :manage_providers
+    #   )
+    #
+    # Actions not registered are allowed for any authenticated admin user.
+    # Controllers not registered are also allowed (open by default).
+    #
+    # == How enforcement works
+    #
+    # The {AdminAuthorization} concern calls {.permission_for} to look up
+    # the required permission, then delegates to +authorize!+ (from
+    # {Authorizable}) which checks +config.authorization_policy+.
+    #
+    # Without panda-cms-pro, the default policy is +user.admin?+ — so only
+    # admins pass permission checks. With Pro loaded, the policy uses the
+    # role system, allowing non-admin users with the right permissions.
+    class PermissionRegistry
+      class << self
+        # Register permission requirements for a controller.
+        #
+        # Merges with any previously registered permissions for the same
+        # controller, so multiple gems can contribute to the same controller.
+        #
+        # @param controller_name [String] Fully-qualified controller class name
+        # @param permissions [Hash{Symbol => Symbol}] action → permission_key mapping
+        def register(controller_name, **permissions)
+          registry[controller_name] = (registry[controller_name] || {}).merge(permissions)
+        end
+
+        # Look up the required permission for a specific controller action.
+        #
+        # @param controller_name [String] Fully-qualified controller class name
+        # @param action [Symbol] The controller action name
+        # @return [Symbol, nil] The required permission key, or nil if not registered
+        def permission_for(controller_name, action)
+          registry.dig(controller_name, action)
+        end
+
+        # Return all registered permissions for a controller.
+        #
+        # @param controller_name [String] Fully-qualified controller class name
+        # @return [Hash{Symbol => Symbol}, nil] action → permission_key mapping
+        def permissions_for(controller_name)
+          registry[controller_name]
+        end
+
+        # Return the full registry (deep copy).
+        # @return [Hash]
+        def all
+          registry.transform_values(&:dup)
+        end
+
+        # Clear all registrations (for test isolation).
+        def reset!
+          @registry = {}
+        end
+
+        private
+
+        def registry
+          @registry ||= {}
+        end
+      end
+    end
+  end
+end

data/lib/panda/core/search_registry.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    class SearchRegistry
+      @providers = []
+
+      class << self
+        attr_reader :providers
+
+        # Register a search provider (idempotent — overwrites any existing provider with the same name)
+        # @param name [String] Provider name (e.g., "pages", "posts")
+        # @param search_class [Class] Class that responds to .editor_search(query, limit:)
+        #   and optionally .admin_search(query, limit:) for richer global search results
+        def register(name:, search_class:)
+          @providers.reject! { |p| p[:name] == name }
+          @providers << {name: name, search_class: search_class}
+        end
+
+        # Search all registered providers (editor format)
+        # @param query [String] Search query
+        # @param limit [Integer] Max results per provider
+        # @return [Array<Hash>] Array of { href:, name:, description: }
+        def search(query, limit: 5)
+          return [] if query.blank?
+
+          @providers.flat_map do |provider|
+            provider[:search_class].editor_search(query, limit: limit)
+          rescue => e
+            Rails.logger.warn("[panda-core] Search provider #{provider[:name]} failed: #{e.message}") if defined?(Rails.logger)
+            []
+          end
+        end
+
+        # Search all registered providers (admin format with grouping)
+        # @param query [String] Search query
+        # @param limit [Integer] Max results per provider
+        # @return [Hash] { groups: [{ name:, icon:, results: [{ href:, name:, description: }] }] }
+        def admin_search(query, limit: 5)
+          return {groups: []} if query.blank?
+
+          groups = @providers.filter_map do |provider|
+            klass = provider[:search_class]
+            next unless klass.respond_to?(:admin_search)
+
+            results = klass.admin_search(query, limit: limit)
+            next if results.empty?
+
+            config = klass.respond_to?(:searchable_config) ? klass.searchable_config : {}
+            {
+              name: config[:group] || provider[:name].to_s.titleize,
+              icon: config[:icon],
+              results: results
+            }
+          rescue => e
+            Rails.logger.warn("[panda-core] Admin search provider #{provider[:name]} failed: #{e.message}") if defined?(Rails.logger)
+            nil
+          end
+
+          {groups: groups}
+        end
+
+        def reset!
+          @providers = []
+        end
+      end
+    end
+  end
+end

data/lib/panda/core/seeds/file_categories.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Seeds
+      module FileCategories
+        DEFAULTS = [
+          {name: "Media Library", slug: "media-library", icon: "fa-solid fa-photo-film", position: 0},
+          {name: "Page Images", slug: "page-images", icon: "fa-solid fa-file-image", position: 1},
+          {name: "Post Images", slug: "post-images", icon: "fa-solid fa-newspaper", position: 2},
+          {name: "User Avatars", slug: "user-avatars", icon: "fa-solid fa-user-circle", position: 3},
+          {name: "Website Avatars", slug: "website-avatars", icon: "fa-solid fa-users", position: 4},
+          {name: "Form Uploads", slug: "form-uploads", icon: "fa-solid fa-file-arrow-up", position: 5},
+          {name: "Social Media", slug: "social-media", icon: "fab fa-instagram", position: 6}
+        ].freeze
+
+        def self.seed!
+          DEFAULTS.each do |attrs|
+            Panda::Core::FileCategory.find_or_create_by!(slug: attrs[:slug]) do |category|
+              category.name = attrs[:name]
+              category.icon = attrs[:icon]
+              category.position = attrs[:position]
+              category.system = true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/panda/core/shared/inflections_config.rb

@@ -9,13 +9,9 @@ module Panda
         extend ActiveSupport::Concern
 
         included do
-          # Load inflections early to ensure proper constant resolution
           initializer "panda.inflections", before: :load_config_initializers do
             ActiveSupport::Inflector.inflections(:en) do |inflect|
-              inflect.acronym "CMS"
-              inflect.acronym "SEO"
-              inflect.acronym "AI"
-              inflect.acronym "UUID"
+              Panda::Core::ACRONYMS.each { |acronym| inflect.acronym acronym }
             end
           end
         end

data/lib/panda/core/testing/rails_helper.rb

@@ -16,6 +16,32 @@ require "shoulda/matchers"
 require "capybara"
 require "capybara/rspec"
 require "puma"
+require "action_controller/test_case"
+require "view_component/test_helpers"
+require_relative "view_component_test_controller"
+
+# Configure ViewComponent to use our test controller
+if defined?(ViewComponent) && Rails.application && Rails.application.config.respond_to?(:view_component)
+  Rails.application.config.view_component.test_controller = "ViewComponentTestController"
+end
+
+# Ensure test schema is up to date, auto-registering engine migration versions
+# that db:schema:load doesn't track. When schema:load creates tables from
+# schema.rb, it only records the max version in schema_migrations. Engine
+# migrations appear as "pending" even though their columns already exist.
+begin
+  ActiveRecord::Migration.maintain_test_schema!
+rescue ActiveRecord::PendingMigrationError
+  sm = ActiveRecord::SchemaMigration.new(ActiveRecord::Base.connection_pool)
+  existing = sm.versions.map(&:to_i).to_set
+  migrator = ActiveRecord::MigrationContext.new(ActiveRecord::Migrator.migrations_paths)
+  missing = migrator.migrations.map(&:version).reject { |v| existing.include?(v) }
+  if missing.any?
+    missing.each { |v| sm.create_version(v.to_s) }
+  else
+    raise
+  end
+end
 
 # Configure fixtures
 ActiveRecord::FixtureSet.context_class.send :include, ActiveSupport::Testing::TimeHelpers
@@ -75,6 +101,13 @@ RSpec.configure do |config|
     config.include Rails::Controller::Testing::Integration, type: :controller
   end
 
+  # ViewComponent testing support (if view_component is available)
+  if defined?(ViewComponent::TestHelpers)
+    config.include ViewComponent::TestHelpers, type: :component
+    config.include Capybara::RSpecMatchers, type: :component
+    config.include Panda::Core::AssetHelper, type: :component
+  end
+
   # Reset column information before suite
   config.before(:suite) do
     if defined?(Panda::Core::User)
@@ -163,6 +196,60 @@ RSpec.configure do |config|
   # OmniAuth test mode
   OmniAuth.config.test_mode = true if defined?(OmniAuth)
 
+  # Stub Panda Core helpers for component tests
+  config.before(:each, type: :component) do
+    if defined?(ViewComponent::TestHelpers)
+      allow_any_instance_of(ActionView::Base).to receive(:panda_core_stylesheet).and_return("")
+      allow_any_instance_of(ActionView::Base).to receive(:panda_core_javascript).and_return("")
+      allow_any_instance_of(ActionView::Base).to receive(:csrf_meta_tags).and_return("")
+      allow_any_instance_of(ActionView::Base).to receive(:csp_meta_tag).and_return("")
+      allow_any_instance_of(ActionView::Base).to receive(:controller).and_return(
+        double(
+          class: double(name: "Test"),
+          protect_against_forgery?: false,
+          content_security_policy?: false
+        )
+      )
+
+      # Stub link_to and button_to to avoid routing complexity in component tests
+      allow_any_instance_of(ActionView::Base).to receive(:link_to) do |*args, &block|
+        href = args[0].is_a?(Hash) ? "#" : args[0]
+        options = args.find { |a| a.is_a?(Hash) } || {}
+        css_class = options[:class] || ""
+        content = block ? block.call : args[1] || href
+        "<a href=\"#{href}\" class=\"#{css_class}\">#{content}</a>".html_safe
+      end
+
+      allow_any_instance_of(ActionView::Base).to receive(:button_to) do |*args, &block|
+        args[0]
+        options = args[1] || {}
+        css_class = options[:class] || ""
+        content = block ? block.call : "Button"
+        id_attr = options[:id] ? " id=\"#{options[:id]}\"" : ""
+        "<button class=\"#{css_class}\"#{id_attr}>#{content}</button>".html_safe
+      end
+
+      # Stub panda_core routes to return simple paths
+      panda_core_routes = double("panda_core_routes")
+      allow(panda_core_routes).to receive(:admin_logout_path).and_return("/admin/logout")
+      allow(panda_core_routes).to receive(:admin_my_profile_path).and_return("/admin/my_profile")
+      allow_any_instance_of(ActionView::Base).to receive(:panda_core).and_return(panda_core_routes)
+
+      # Stub current_user
+      mock_user = double(
+        "User",
+        name: "Test User",
+        avatar: double(attached?: false),
+        image_url: ""
+      )
+      allow_any_instance_of(ActionView::Base).to receive(:current_user).and_return(mock_user)
+
+      # Stub main_app routes
+      main_app_routes = double(url_for: "/test")
+      allow_any_instance_of(ActionView::Base).to receive(:main_app).and_return(main_app_routes)
+    end
+  end
+
   # DatabaseCleaner configuration
   config.around(:each) do |example|
     DatabaseCleaner.strategy = (example.metadata[:type] == :system) ? :truncation : :transaction

data/lib/panda/core/testing/support/authentication_test_helpers.rb

@@ -18,30 +18,34 @@ module Panda
       def create_admin_user(attributes = {})
         ensure_columns_loaded
         admin_id = "8f481fcb-d9c8-55d7-ba17-5ea5d9ed8b7a"
-        Panda::Core::User.find_or_create_by!(id: admin_id) do |user|
-          user.email = attributes[:email] || "admin@example.com"
-          user.name = attributes[:name] || "Admin User"
-          user.image_url = attributes[:image_url] || default_image_url
-          user.admin = attributes[:admin] || true
-          # Only set OAuth fields if they exist on the model
-          user.uid = attributes[:uid] || "admin_oauth_uid_123" if user.respond_to?(:uid=)
-          user.provider = attributes[:provider] || "google_oauth2" if user.respond_to?(:provider=)
-        end
+        user = Panda::Core::User.find_or_initialize_by(id: admin_id)
+        user.email = attributes[:email] || "admin@example.com"
+        user.name = attributes[:name] || "Admin User"
+        user.image_url = attributes[:image_url] || default_image_url
+        user.admin = attributes.fetch(:admin, true)
+        user.enabled = attributes.fetch(:enabled, true) if user.respond_to?(:enabled=)
+        # Only set OAuth fields if they exist on the model
+        user.uid = attributes[:uid] || "admin_oauth_uid_123" if user.respond_to?(:uid=)
+        user.provider = attributes[:provider] || "google_oauth2" if user.respond_to?(:provider=)
+        user.save! if user.new_record? || user.changed?
+        user
       end
 
       # Create a regular user with fixed ID for consistent fixture references
       def create_regular_user(attributes = {})
         ensure_columns_loaded
         regular_id = "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
-        Panda::Core::User.find_or_create_by!(id: regular_id) do |user|
-          user.email = attributes[:email] || "user@example.com"
-          user.name = attributes[:name] || "Regular User"
-          user.image_url = attributes[:image_url] || default_image_url(dark: true)
-          user.admin = attributes[:admin] || false
-          # Only set OAuth fields if they exist on the model
-          user.uid = attributes[:uid] || "user_oauth_uid_456" if user.respond_to?(:uid=)
-          user.provider = attributes[:provider] || "google_oauth2" if user.respond_to?(:provider=)
-        end
+        user = Panda::Core::User.find_or_initialize_by(id: regular_id)
+        user.email = attributes[:email] || "user@example.com"
+        user.name = attributes[:name] || "Regular User"
+        user.image_url = attributes[:image_url] || default_image_url(dark: true)
+        user.admin = attributes.fetch(:admin, false)
+        user.enabled = attributes.fetch(:enabled, true) if user.respond_to?(:enabled=)
+        # Only set OAuth fields if they exist on the model
+        user.uid = attributes[:uid] || "user_oauth_uid_456" if user.respond_to?(:uid=)
+        user.provider = attributes[:provider] || "google_oauth2" if user.respond_to?(:provider=)
+        user.save! if user.new_record? || user.changed?
+        user
       end
 
       # Backwards compatibility with fixture access patterns

data/lib/panda/core/testing/support/system/cuprite_helpers.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "pathname"
+require "shellwords"
 
 # Helper methods for Cuprite-based system tests
 #
@@ -74,9 +74,9 @@ module Panda
               File.binwrite(File.join(png_dir, "frame-%05d.png" % i), Base64.decode64(data))
             end
 
-            system <<~CMD
-              ffmpeg -y -framerate 8 -pattern_type glob -i '#{png_dir}/*.png' -c:v libx264 -pix_fmt yuv420p '#{path}'
-            CMD
+            escaped_png_dir = Shellwords.escape(File.join(png_dir, "*.png"))
+            escaped_path = Shellwords.escape(path.to_s)
+            system("ffmpeg -y -framerate 8 -pattern_type glob -i #{escaped_png_dir} -c:v libx264 -pix_fmt yuv420p #{escaped_path}")
           end
 
           puts "🎥 Saved video: #{path}"

data/lib/panda/core/testing/view_component_test_controller.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Simple controller for ViewComponent testing
+class ViewComponentTestController < ActionController::Base
+  # Disable CSRF protection for test controller
+  # This is intentional as this controller is only used for component testing
+  protect_from_forgery with: :null_session
+
+  # Include necessary helpers
+  include Rails.application.routes.url_helpers if defined?(Rails.application)
+
+  # Set up a basic layout
+  layout false
+
+  # Make helpers available
+  def helpers
+    ActionController::Base.helpers
+  end
+end

data/lib/panda/core/version.rb

@@ -2,6 +2,6 @@
 
 module Panda
   module Core
-    VERSION = "0.12.5"
+    VERSION = "1.1.0"
   end
 end

data/lib/panda/core/widget_registry.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    class WidgetRegistry
+      @widgets = []
+
+      class << self
+        attr_reader :widgets
+
+        # Register a dashboard widget.
+        # Duplicate labels are replaced (last registration wins).
+        # @param label [String] Widget label (used for identification and deduplication)
+        # @param component [Proc] Lambda receiving user, returns an instantiated component
+        # @param visible [Proc, nil] Lambda receiving user, hides widget when false
+        # @param position [Integer] Sort order (lower numbers appear first)
+        def register(label, component:, visible: nil, position: 0)
+          widget = {label: label, component: component, visible: visible, position: position}
+          if (index = @widgets.index { |w| w[:label] == label })
+            @widgets[index] = widget
+          else
+            @widgets << widget
+          end
+        end
+
+        # Build the widget list for the current user.
+        # Combines the legacy admin_dashboard_widgets lambda with registered widgets.
+        # @param user [Object] The current user
+        # @return [Array] Instantiated widget components
+        def build(user)
+          # Legacy backward-compatible widgets from the lambda
+          legacy = Panda::Core.config.admin_dashboard_widgets&.call(user) || []
+
+          # Registered widgets — filter by visibility, sort by position, instantiate
+          registered = @widgets
+            .select { |w| w[:visible].nil? || w[:visible].call(user) }
+            .sort_by { |w| w[:position] }
+            .map { |w| w[:component].call(user) }
+
+          legacy + registered
+        end
+
+        # Clear all registrations (for test isolation).
+        def reset!
+          @widgets = []
+        end
+      end
+    end
+  end
+end

data/lib/panda/core.rb

@@ -4,18 +4,19 @@ require "rails"
 # require "active_support/core_ext/module/attribute_accessors"
 
 # Load inflections early so they're available for generators
-# This must happen before any code tries to camelize/classify strings
-# containing "cms", "seo", "ai", or "uuid"
 require "active_support/inflector"
-ActiveSupport::Inflector.inflections(:en) do |inflect|
-  inflect.acronym "CMS"
-  inflect.acronym "SEO"
-  inflect.acronym "AI"
-  inflect.acronym "UUID"
-end
 
 module Panda
   module Core
+    # Single source of truth for acronyms used across all Panda gems.
+    # Referenced by Shared::InflectionsConfig (engine initializer) and
+    # applied eagerly below for generator/CLI contexts.
+    ACRONYMS = %w[CMS CSV SEO AI URL UUID].freeze
+
+    # Session key for storing authenticated Panda Core admin user ID
+    # Namespaced to avoid conflicts with host application user sessions
+    ADMIN_SESSION_KEY = :panda_core_user_id
+
     def self.root
       File.expand_path("../..", __FILE__)
     end
@@ -25,8 +26,16 @@ module Panda
   end
 end
 
+# Apply acronyms eagerly for generators and CLI contexts
+ActiveSupport::Inflector.inflections(:en) do |inflect|
+  Panda::Core::ACRONYMS.each { |acronym| inflect.acronym acronym }
+end
+
 require_relative "core/version"
 require_relative "core/configuration"
+require_relative "core/navigation_registry"
+require_relative "core/permission_registry"
+require_relative "core/widget_registry"
 require_relative "core/asset_loader"
 require_relative "core/debug"
 require_relative "core/services/base_service"

data/lib/tasks/panda/core/file_categories.rake

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+namespace :panda do
+  namespace :core do
+    namespace :file_categories do
+      desc "Seed default file categories"
+      task seed: [:environment] do
+        require "panda/core/seeds/file_categories"
+        Panda::Core::Seeds::FileCategories.seed!
+        puts "Default file categories seeded."
+      end
+
+      desc "Categorize existing blobs based on their attachments"
+      task categorize_existing: [:environment] do
+        require "panda/core/seeds/file_categories"
+        Panda::Core::Seeds::FileCategories.seed!
+
+        categorizer = Panda::Core::FileCategorizer.new
+        categorized = 0
+        skipped = 0
+
+        ActiveStorage::Blob.find_each do |blob|
+          if Panda::Core::FileCategorization.exists?(blob_id: blob.id)
+            skipped += 1
+            next
+          end
+
+          attachment = ActiveStorage::Attachment.where(blob_id: blob.id).first
+          if attachment
+            categorizer.categorize_attachment(attachment)
+          else
+            categorizer.categorize_blob(blob, category_slug: "media-library")
+          end
+          categorized += 1
+        end
+
+        puts "Categorized #{categorized} blobs, skipped #{skipped} already-categorized."
+      end
+    end
+  end
+end