panda-core 0.2.3 → 0.4.1

data/config/initializers/panda_core.rb

@@ -1,10 +1,46 @@
 Panda::Core.configure do |config|
+  config.admin_path = "/admin"
+
+  config.login_page_title = "Panda Admin"
+  config.admin_title = "Panda Admin"
+
+  # Configure authentication providers
+  # Uncomment and configure the providers you want to use
+  # Don't forget to add the corresponding gems (e.g., omniauth-google-oauth2)
+  #
+  # config.authentication_providers = {
+  #   google_oauth2: {
+  #     enabled: true,
+  #     name: "Google",  # Display name for the button
+  #     icon: "google",  # FontAwesome icon name (optional, auto-detected if not specified)
+  #     path_name: "google",  # Optional: Override URL path (default uses strategy name)
+  #                            # e.g., "google" gives /admin/auth/google instead of /admin/auth/google_oauth2
+  #     client_id: Rails.application.credentials.dig(:google, :client_id),
+  #     client_secret: Rails.application.credentials.dig(:google, :client_secret),
+  #     options: {
+  #       scope: "email,profile",
+  #       prompt: "select_account",
+  #       hd: "yourdomain.com" # Specify your domain here if you want to restrict admin logins
+  #     }
+  #   }
+  # }
+
+  # Configure the session token cookie name
+  config.session_token_cookie = :panda_session
+
   # Configure the user class for the application
-  # config.user_class = "User"
+  config.user_class = "Panda::Core::User"
+
+  # Configure the user identity class for the application
+  config.user_identity_class = "Panda::Core::UserIdentity"
 
   # Configure the storage provider (default: :active_storage)
   # config.storage_provider = :active_storage
 
   # Configure the cache store (default: :memory_store)
   # config.cache_store = :memory_store
+
+  # Configure EditorJS tools (optional)
+  # config.editor_js_tools = []
+  # config.editor_js_tool_config = {}
 end

data/config/routes.rb

@@ -1,6 +1,7 @@
 Panda::Core::Engine.routes.draw do
-  # Use the configured admin path (defaults to "/admin")
-  admin_path = Panda::Core.configuration.admin_path.delete_prefix("/")
+  # Get admin_path from configuration
+  # Default to "/admin" if not yet configured
+  admin_path = (Panda::Core.config.admin_path || "/admin").delete_prefix("/")
 
   scope path: admin_path, as: "admin" do
     get "/login", to: "admin/sessions#new", as: :login
@@ -12,11 +13,10 @@ Panda::Core::Engine.routes.draw do
     get "/auth/failure", to: "admin/sessions#failure", as: :auth_failure
     delete "/logout", to: "admin/sessions#destroy", as: :logout
 
-    constraints Panda::Core::AdminConstraint.new do
-      get "/", to: "admin/dashboard#show", as: :root
+    # Dashboard and admin routes - authentication handled by AdminController
+    get "/", to: "admin/dashboard#show", as: :root
 
-      # Profile management
-      resource :my_profile, only: %i[edit update], controller: "admin/my_profile", path: "my_profile"
-    end
+    # Profile management
+    resource :my_profile, only: %i[edit update], controller: "admin/my_profile", path: "my_profile"
   end
 end

data/db/migrate/20250810120000_add_current_theme_to_panda_core_users.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddCurrentThemeToPandaCoreUsers < ActiveRecord::Migration[7.1]
+  def change
+    add_column :panda_core_users, :current_theme, :string unless column_exists?(:panda_core_users, :current_theme)
+  end
+end

data/lib/generators/panda/core/install_generator.rb

@@ -23,7 +23,7 @@ module Panda
       end
 
       def create_initializer
-        template "initializer.rb", "config/initializers/panda_core.rb"
+        template "initializer.rb", "config/initializers/panda.rb"
       end
 
       def mount_engine
@@ -33,14 +33,8 @@ module Panda
         route 'mount Panda::Core::Engine => "/"'
       end
 
-      def copy_migrations
-        return if options[:skip_migrations]
-        return unless options[:orm] == "active_record"
-
-        migrations_path = File.expand_path("../../../../db/migrate", __dir__)
-        Dir.glob("#{migrations_path}/*.rb").each do |migration|
-          migration_template migration, "db/migrate/#{File.basename(migration)}"
-        end
+      def show_readme
+        readme "README" if behavior == :invoke
       end
     end
   end

data/lib/generators/panda/core/templates/README

@@ -0,0 +1,25 @@
+===============================================================================
+
+Panda Core has been installed!
+
+Next steps:
+
+1. Install and run migrations:
+
+   rails panda:core:install:migrations
+   rails db:migrate
+
+2. Configure authentication providers in config/initializers/panda.rb
+   (Uncomment and configure the providers you want to use)
+
+3. Add the required OAuth gems to your Gemfile:
+
+   gem 'omniauth-google-oauth2'  # For Google authentication
+   gem 'omniauth-microsoft_graph' # For Microsoft authentication
+   gem 'omniauth-github'         # For GitHub authentication
+
+4. Configure your OAuth credentials in Rails credentials:
+
+   rails credentials:edit
+
+===============================================================================

data/lib/generators/panda/core/templates/initializer.rb

@@ -1,4 +1,28 @@
 Panda::Core.configure do |config|
+  config.admin_path = "/admin"
+
+  config.login_page_title = "Panda Admin"
+  config.admin_title = "Panda Admin"
+
+  # Configure authentication providers
+  # Uncomment and configure the providers you want to use
+  # Don't forget to add the corresponding gems (e.g., omniauth-google-oauth2)
+  #
+  # config.authentication_providers = {
+  #   google_oauth2: {
+  #     enabled: true,
+  #     name: "Google",  # Display name for the button
+  #     icon: "google",  # FontAwesome icon name (optional, auto-detected if not specified)
+  #     client_id: Rails.application.credentials.dig(:google, :client_id),
+  #     client_secret: Rails.application.credentials.dig(:google, :client_secret),
+  #     options: {
+  #       scope: "email,profile",
+  #       prompt: "select_account",
+  #       hd: "yourdomain.com" # Specify your domain here if you want to restrict admin logins
+  #     }
+  #   }
+  # }
+
   # Configure the session token cookie name
   config.session_token_cookie = :panda_session
 
@@ -13,4 +37,8 @@ Panda::Core.configure do |config|
 
   # Configure the cache store (default: :memory_store)
   # config.cache_store = :memory_store
+
+  # Configure EditorJS tools (optional)
+  # config.editor_js_tools = []
+  # config.editor_js_tool_config = {}
 end

data/lib/panda/core/asset_loader.rb

@@ -105,9 +105,19 @@ module Panda
             end
 
           else
-            # Development mode - use importmap
+            # Development mode - use importmap for JS and static CSS
             tags = []
             tags << javascript_include_tag("panda/core/application", type: "module")
+
+            # Add CSS if available
+            css_path = development_css_url
+            if css_path
+              css_attrs = {
+                rel: "stylesheet",
+                href: css_path
+              }
+              tags << tag(:link, css_attrs)
+            end
           end
           tags.join("\n").html_safe
         end
@@ -144,11 +154,16 @@ module Panda
         end
 
         def development_css_url
-          return unless compiled_assets_available?
-
+          # Try versioned file first
           version = asset_version
-          css_file = "/panda-core-assets/panda-core-#{version}.css"
-          File.exist?(Rails.root.join("public#{css_file}")) ? css_file : nil
+          versioned_file = "/panda-core-assets/panda-core-#{version}.css"
+          return versioned_file if File.exist?(Rails.public_path.join("panda-core-assets", "panda-core-#{version}.css"))
+
+          # Fall back to unversioned file (always available from engine's public directory)
+          unversioned_file = "/panda-core-assets/panda-core.css"
+          return unversioned_file if File.exist?(Panda::Core::Engine.root.join("public", "panda-core-assets", "panda-core.css"))
+
+          nil
         end
 
         def asset_version
@@ -193,9 +208,9 @@ module Panda
           end.compact.join(" ")
 
           if content || block_given?
-            "<#{name}#{attrs.present? ? " #{attrs}" : ""}>#{content || (block_given? ? yield : "")}</#{name}>"
+            "<#{name}#{" #{attrs}" if attrs.present?}>#{content || (block_given? ? yield : "")}</#{name}>"
           else
-            "<#{name}#{attrs.present? ? " #{attrs}" : ""}><#{name}>"
+            "<#{name}#{" #{attrs}" if attrs.present?}><#{name}>"
           end
         end
 
@@ -208,7 +223,7 @@ module Panda
             end
           end.compact.join(" ")
 
-          "<#{name}#{attrs.present? ? " #{attrs}" : ""} />"
+          "<#{name}#{" #{attrs}" if attrs.present?} />"
         end
 
         def javascript_include_tag(source, options = {})

data/lib/panda/core/configuration.rb

@@ -19,8 +19,10 @@ module Panda
         :authorization_policy,
         :additional_user_params,
         :available_themes,
+        :default_theme,
         :login_logo_path,
         :login_page_title,
+        :admin_title,
         :initial_admin_breadcrumb,
         :dashboard_redirect_path
 
@@ -36,9 +38,35 @@ module Panda
         @session_token_cookie = :panda_session
         @authentication_providers = {}
         @admin_path = "/admin"
+        @default_theme = "default"
 
-        # Hook system for extending admin UI
-        @admin_navigation_items = ->(user) { [] }
+        # Hook system for extending admin UI with sensible defaults
+        @admin_navigation_items = ->(user) {
+          items = [
+            {
+              label: "Dashboard",
+              path: @admin_path,
+              icon: "fa-solid fa-house"
+            }
+          ]
+
+          # Add CMS navigation if available
+          if defined?(Panda::CMS)
+            items << {
+              label: "Content",
+              path: "#{@admin_path}/cms",
+              icon: "fa-solid fa-file-lines"
+            }
+          end
+
+          items << {
+            label: "My Profile",
+            path: "#{@admin_path}/my_profile/edit",
+            icon: "fa-solid fa-user"
+          }
+
+          items
+        }
         @admin_dashboard_widgets = ->(user) { [] }
         @user_attributes = []
         @user_associations = []
@@ -48,26 +76,30 @@ module Panda
         @additional_user_params = []
         @available_themes = [["Default", "default"], ["Sky", "sky"]]
         @login_logo_path = nil
-        @login_page_title = "Sign in to your account"
+        @login_page_title = "Panda Admin"
+        @admin_title = "Panda Admin"
         @initial_admin_breadcrumb = nil  # Proc that returns [label, path]
         @dashboard_redirect_path = nil  # Path to redirect to after login (defaults to admin_root_path)
       end
     end
 
     class << self
-      attr_writer :configuration
+      attr_writer :config
 
-      def configuration
-        @configuration ||= Configuration.new
+      def config
+        @config ||= Configuration.new
       end
 
       def configure
-        yield(configuration)
+        yield(config)
       end
 
-      def reset_configuration!
-        @configuration = Configuration.new
+      def reset_config!
+        @config = Configuration.new
       end
+
+      # Alias for backward compatibility with test expectations
+      alias_method :reset_configuration!, :reset_config!
     end
   end
 end

data/lib/panda/core/debug.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Panda
+  module Core
+    module Debug
+      class << self
+        # Check if debug mode is enabled via PANDA_DEBUG environment variable
+        def enabled?
+          ENV["PANDA_DEBUG"].to_s.downcase == "true" || ENV["PANDA_DEBUG"] == "1"
+        end
+
+        # Log a debug message if debug mode is enabled
+        def log(message, prefix: "PANDA")
+          return unless enabled?
+
+          timestamp = Time.current.strftime("%Y-%m-%d %H:%M:%S")
+          puts "[#{prefix} DEBUG #{timestamp}] #{message}"
+        end
+
+        # Log an object with pretty printing (using awesome_print if available)
+        def inspect(object, label: nil, prefix: "PANDA")
+          return unless enabled?
+
+          timestamp = Time.current.strftime("%Y-%m-%d %H:%M:%S")
+          header = label ? "#{label}: " : ""
+
+          puts "\n[#{prefix} DEBUG #{timestamp}] #{header}"
+          if defined?(AwesomePrint)
+            ap object
+          else
+            pp object
+          end
+          puts
+        end
+
+        # Enable HTTP debugging for Net::HTTP requests
+        def enable_http_debug!
+          return unless enabled? || ENV["DEBUG_HTTP"].to_s.downcase == "true"
+
+          require "net/http"
+          Net::HTTP.set_debug_output($stdout)
+          log("HTTP debugging enabled - all HTTP requests will be logged")
+        end
+      end
+    end
+  end
+end

data/lib/panda/core/engine.rb

@@ -13,11 +13,24 @@ module Panda
       config.eager_load_namespaces << Panda::Core::Engine
 
       # Add engine's app directories to autoload paths
+      # Note: Only add the root directories, not nested subdirectories
+      # Zeitwerk will automatically discover nested modules from these roots
       config.autoload_paths += Dir[root.join("app", "models")]
       config.autoload_paths += Dir[root.join("app", "controllers")]
       config.autoload_paths += Dir[root.join("app", "builders")]
       config.autoload_paths += Dir[root.join("app", "components")]
 
+      # Make files in public available to the main app (e.g. /panda-core-assets/panda-logo.png)
+      config.app_middleware.use(
+        Rack::Static,
+        urls: ["/panda-core-assets"],
+        root: Panda::Core::Engine.root.join("public"),
+        header_rules: [
+          # Disable caching in development for instant CSS updates
+          [:all, {"Cache-Control" => Rails.env.development? ? "no-cache, no-store, must-revalidate" : "public, max-age=31536000"}]
+        ]
+      )
+
       config.generators do |g|
         g.test_framework :rspec
         g.fixture_replacement :factory_bot
@@ -32,34 +45,95 @@ module Panda
         end
       end
 
-      initializer "panda_core.configuration" do |app|
+      initializer "panda_core.config" do |app|
         # Configuration is already initialized with defaults in Configuration class
       end
 
+      # Add importmap paths from the engine
+      initializer "panda_core.importmap", before: "importmap" do |app|
+        if app.config.respond_to?(:importmap)
+          # Create a new array if frozen
+          app.config.importmap.paths = app.config.importmap.paths.dup if app.config.importmap.paths.frozen?
+
+          # Add our paths
+          app.config.importmap.paths << root.join("config/importmap.rb")
+
+          # Handle cache sweepers similarly
+          if app.config.importmap.cache_sweepers.frozen?
+            app.config.importmap.cache_sweepers = app.config.importmap.cache_sweepers.dup
+          end
+          app.config.importmap.cache_sweepers << root.join("app/javascript")
+        end
+      end
+
       initializer "panda_core.omniauth" do |app|
         # Mount OmniAuth at configurable admin path
         app.middleware.use OmniAuth::Builder do
           # Configure OmniAuth to use the configured admin path
           configure do |config|
-            config.path_prefix = "#{Panda::Core.configuration.admin_path}/auth"
-            # Allow POST requests for request phase (required for CSRF protection)
-            config.allowed_request_methods = [:get, :post]
+            config.path_prefix = "#{Panda::Core.config.admin_path}/auth"
+            # POST-only for CSRF protection (CVE-2015-9284)
+            # All login forms use POST via form_tag method: "post"
+            config.allowed_request_methods = [:post]
           end
 
-          Panda::Core.configuration.authentication_providers.each do |provider_name, settings|
+          Panda::Core.config.authentication_providers.each do |provider_name, settings|
+            # Build provider options, allowing custom path name override
+            provider_options = settings[:options] || {}
+
+            # If path_name is specified, use it to override the default strategy name in URLs
+            if settings[:path_name].present?
+              provider_options = provider_options.merge(name: settings[:path_name])
+            end
+
             case provider_name.to_s
             when "microsoft_graph"
-              provider :microsoft_graph, settings[:client_id], settings[:client_secret], settings[:options] || {}
+              provider :microsoft_graph, settings[:client_id], settings[:client_secret], provider_options
             when "google_oauth2"
-              provider :google_oauth2, settings[:client_id], settings[:client_secret], settings[:options] || {}
+              provider :google_oauth2, settings[:client_id], settings[:client_secret], provider_options
             when "github"
-              provider :github, settings[:client_id], settings[:client_secret], settings[:options] || {}
+              provider :github, settings[:client_id], settings[:client_secret], provider_options
             when "developer"
               provider :developer if Rails.env.development?
             end
           end
         end
       end
+
+      # Load Phlex base component after Rails application is initialized
+      # This ensures Rails.application.routes is available
+      initializer "panda_core.phlex_base", after: :load_config_initializers do
+        require "phlex"
+        require "phlex-rails"
+        require "literal"
+        require "tailwind_merge"
+
+        # Load the base component
+        require root.join("app/components/panda/core/base")
+      end
+
+      # Set up ViewComponent and Lookbook previews
+      initializer "panda_core.view_component" do |app|
+        app.config.view_component.preview_paths ||= []
+        app.config.view_component.preview_paths << root.join("spec/components/previews")
+
+        # Add preview directories to autoload paths in development
+        if Rails.env.development?
+          # Handle frozen autoload_paths array
+          if app.config.autoload_paths.frozen?
+            app.config.autoload_paths = app.config.autoload_paths.dup
+          end
+          app.config.autoload_paths << root.join("spec/components/previews")
+        end
+      end
+
+      # Create AdminController alias after controllers are loaded
+      # This allows other gems to inherit from Panda::Core::AdminController
+      initializer "panda_core.admin_controller_alias", after: :load_config_initializers do
+        ActiveSupport.on_load(:action_controller_base) do
+          Panda::Core.const_set(:AdminController, Panda::Core::Admin::BaseController) unless Panda::Core.const_defined?(:AdminController)
+        end
+      end
     end
   end
 end

data/lib/panda/core/version.rb

@@ -2,6 +2,6 @@
 
 module Panda
   module Core
-    VERSION = "0.2.3"
+    VERSION = "0.4.1"
   end
 end

data/lib/panda/core.rb

@@ -13,4 +13,5 @@ end
 require_relative "core/version"
 require_relative "core/configuration"
 require_relative "core/asset_loader"
+require_relative "core/debug"
 require_relative "core/engine" if defined?(Rails)