plum-cms 0.1.0

data/app/controllers/plum/cp/assets_controller.rb

@@ -0,0 +1,84 @@
+module Plum
+  module Cp
+    class AssetsController < BaseController
+      include Plum::Cp::AssetsHelper
+
+      before_action :set_asset, only: [ :edit, :update, :destroy ]
+      before_action :require_editor, only: [ :new, :create, :edit, :update, :destroy ]
+
+      def index
+        @assets = asset_scope.order(created_at: :desc)
+        @asset = asset_scope.build
+
+        respond_to do |format|
+          format.html
+          format.json { render json: @assets.map { |asset| asset_json(asset) } }
+        end
+      end
+
+      def new
+        @asset = asset_scope.build
+      end
+
+      def create
+        @asset = asset_scope.build(asset_params)
+
+        if @asset.save
+          respond_to do |format|
+            format.html { redirect_to cp_assets_path, notice: "Asset uploaded" }
+            format.json { render json: asset_json(@asset), status: :created }
+          end
+        else
+          respond_to do |format|
+            format.html do
+              @assets = asset_scope.order(created_at: :desc)
+              render :index, status: :unprocessable_entity
+            end
+            format.json { render json: { errors: @asset.errors.full_messages }, status: :unprocessable_entity }
+          end
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        if @asset.update(asset_params)
+          redirect_to cp_assets_path, notice: "Asset updated"
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @asset.destroy
+        redirect_to cp_assets_path, notice: "Asset deleted"
+      end
+
+      private
+
+      def asset_scope
+        current_site.assets.with_attached_file
+      end
+
+      def set_asset
+        @asset = asset_scope.find(params[:id])
+      end
+
+      def asset_params
+        params.require(:asset).permit(:file, :alt_text, :caption, :folder)
+      end
+
+      def asset_json(asset)
+        {
+          id: asset.id,
+          url: asset.url,
+          filename: asset.filename,
+          folder: asset.folder.to_s,
+          alt_text: asset.alt_text.to_s,
+          label: plum_asset_label(asset)
+        }
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/base_controller.rb

@@ -0,0 +1,45 @@
+module Plum
+  module Cp
+    class BaseController < Plum::ApplicationController
+      layout "plum/cp"
+      helper AssetsHelper
+      helper ThemeSettingsHelper
+
+      before_action :require_login
+      helper_method :cp_prefix
+
+      private
+
+      def cp_prefix
+        @cp_prefix ||= cp_root_path.chomp("/")
+      end
+
+      def require_login
+        return if Plum.authorized?(self)
+
+        if Plum.configuration.authorize_with == :plum
+          redirect_to login_path, alert: "Please log in to continue"
+        else
+          head :forbidden
+        end
+      end
+
+      def require_role(*roles)
+        return unless Plum.configuration.authorize_with == :plum
+
+        user = Plum.current_user(self)
+        return if user&.respond_to?(:role) && roles.map(&:to_s).include?(user.role.to_s)
+
+        redirect_to cp_root_path, alert: "You don't have permission to do that"
+      end
+
+      def require_editor
+        require_role(:editor, :admin)
+      end
+
+      def require_admin
+        require_role(:admin)
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/content_types_controller.rb

@@ -0,0 +1,59 @@
+module Plum
+  module Cp
+    class ContentTypesController < BaseController
+      before_action :set_content_type, only: [ :show, :edit, :update, :destroy ]
+      before_action :require_admin, only: [ :new, :create, :edit, :update, :destroy ]
+
+      def index
+        @content_types = ContentType.for_site(current_site)
+      end
+
+      def show
+        @entries = @content_type.entries.order(updated_at: :desc)
+      end
+
+      def new
+        @content_type = current_site.content_types.build
+      end
+
+      def create
+        @content_type = current_site.content_types.build(content_type_params)
+        if @content_type.save
+          redirect_to cp_content_type_path(@content_type), notice: "Content type created"
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        if @content_type.update(content_type_params)
+          redirect_to cp_content_type_path(@content_type), notice: "Content type updated"
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @content_type.destroy
+        redirect_to cp_content_types_path, notice: "Content type deleted"
+      end
+
+      private
+
+      def set_content_type
+        @content_type = current_site.content_types.find(params[:id])
+      end
+
+      def content_type_params
+        permitted = params.require(:content_type).permit(:name, :handle, :singleton, :icon, :blueprint)
+        if permitted[:blueprint].is_a?(String)
+          permitted[:blueprint] = JSON.parse(permitted[:blueprint]) rescue {}
+        end
+        permitted
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/dashboard_controller.rb

@@ -0,0 +1,10 @@
+module Plum
+  module Cp
+    class DashboardController < BaseController
+      def show
+        @content_types = ContentType.for_site(current_site)
+        @recent_entries = Entry.for_site(current_site).includes(:content_type).order(updated_at: :desc).limit(10)
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/entries_controller.rb

@@ -0,0 +1,240 @@
+module Plum
+  module Cp
+    class EntriesController < BaseController
+      ALLOWED_RICH_TEXT_TAGS = %w[
+        a action-text-attachment blockquote br code em figcaption figure
+        h1 h2 h3 hr img li ol p pre s strong table tbody td th thead tr ul
+      ].freeze
+      ALLOWED_RICH_TEXT_ATTRIBUTES = %w[
+        alt caption content-type filename filesize height href presentation
+        rel sgid src target title url width
+      ].freeze
+
+      before_action :set_content_type
+      before_action :set_entry, only: [ :edit, :update, :destroy ]
+      before_action :set_form_collections, only: [ :new, :create, :edit, :update ]
+      before_action :require_editor, only: [ :new, :create, :edit, :update, :destroy ]
+
+      def index
+        @entries = @content_type.entries.order(updated_at: :desc)
+      end
+
+      def new
+        @entry = @content_type.entries.build(status: :draft, site: current_site)
+      end
+
+      def create
+        @entry = @content_type.entries.build(entry_params)
+        @entry.site = current_site
+        @entry.author = current_user if current_user.is_a?(Plum::User)
+
+        if save_entry(@entry)
+          redirect_to edit_cp_content_type_entry_path(@content_type, @entry), notice: "Entry created"
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        @entry.assign_attributes(entry_params)
+
+        if save_entry(@entry)
+          redirect_to edit_cp_content_type_entry_path(@content_type, @entry), notice: "Entry updated"
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @entry.destroy
+        redirect_to cp_content_type_entries_path(@content_type), notice: "Entry deleted"
+      end
+
+      private
+
+      def set_content_type
+        @content_type = current_site.content_types.find(params[:content_type_id])
+      end
+
+      def set_entry
+        @entry = @content_type.entries.find(params[:id])
+      end
+
+      def set_form_collections
+        @assets = current_site.assets.with_attached_file.order(created_at: :desc)
+        @theme = current_site.theme
+        @relationship_entries_by_field = relationship_fields.each_with_object({}) do |field, entries_by_field|
+          entries_by_field[field["handle"].to_s] = relationship_entry_scope(@entry, field).order(:title)
+        end
+        @taxonomy_terms_by_field = taxonomy_fields.each_with_object({}) do |field, terms_by_field|
+          taxonomy = current_site.taxonomies.find_by(handle: field["taxonomy"].to_s)
+          terms_by_field[field["handle"].to_s] = taxonomy ? taxonomy.terms.ordered : []
+        end
+      end
+
+      def entry_params
+        permitted = params.require(:entry).permit(:title, :slug, :status, :published_at)
+        if params[:entry][:data].is_a?(ActionController::Parameters)
+          permitted[:data] = params[:entry][:data].permit!.to_h
+        end
+        permitted
+      end
+
+      def save_entry(entry)
+        return false unless entry.valid?
+        return false unless attach_uploaded_image_fields(entry)
+
+        entry.save.tap { |saved| sync_entry_terms(entry) if saved }
+      end
+
+      def sync_entry_terms(entry)
+        submitted_ids = Array(params.dig(:entry, :term_ids)).map(&:to_i).select(&:positive?)
+        valid_ids = Plum::Term.where(id: submitted_ids, site: current_site).pluck(:id)
+        entry.term_ids = valid_ids
+      end
+
+      def attach_uploaded_image_fields(entry)
+        image_uploads = params.dig(:entry, :image_uploads)
+        unless image_uploads.respond_to?(:[])
+          return normalize_entry_data_fields(entry)
+        end
+
+        image_fields.each do |field|
+          handle = field["handle"].to_s
+          upload = image_uploads[handle]
+          next if upload.blank?
+
+          asset = current_site.assets.build(
+            file: upload,
+            alt_text: default_asset_alt_text(entry, field),
+            folder: field["folder"].presence || @content_type.handle
+          )
+
+          unless asset.save
+            entry.errors.add(:base, "#{field_label(field)} #{asset.errors.full_messages.to_sentence}")
+            return false
+          end
+
+          entry.data ||= {}
+          entry.data[handle] = asset.id
+        end
+
+        normalize_entry_data_fields(entry)
+      end
+
+      def normalize_entry_data_fields(entry)
+        entry.data ||= {}
+
+        @content_type.fields.each do |field|
+          handle = field["handle"].to_s
+          next if handle.blank?
+
+          value = entry.data[handle]
+          entry.data[handle] = normalized_field_value(entry, field, value)
+          return false if entry.errors.any?
+        end
+
+        true
+      end
+
+      def normalized_field_value(entry, field, value)
+        case field["type"]
+        when "boolean"
+          ActiveModel::Type::Boolean.new.cast(value)
+        when "checkboxes"
+          Array(value).select(&:present?)
+        when "image"
+          value.present? ? value.to_i : nil
+        when "rich_text"
+          value
+        when "relationship"
+          normalized_relationship_value(entry, field, value)
+        when "blocks"
+          normalized_blocks_value(value)
+        else
+          value
+        end
+      end
+
+      def normalized_relationship_value(entry, field, value)
+        return nil if value.blank?
+
+        related_entry = relationship_entry_scope(entry, field).find_by(id: value.to_i)
+        return related_entry.id if related_entry
+
+        entry.errors.add(:base, "#{field_label(field)} is not a valid entry")
+        nil
+      end
+
+      # A blocks field is submitted as a JSON string from the block editor. We
+      # parse it and normalize each block instance to { id, type, fields }.
+      def normalized_blocks_value(value)
+        parsed = value.is_a?(String) ? safe_parse_blocks(value) : value
+        return [] unless parsed.is_a?(Array)
+
+        parsed.filter_map do |block|
+          block = block.to_h if block.respond_to?(:to_h)
+          next unless block.is_a?(Hash)
+
+          type = block["type"].to_s
+          next if type.blank?
+
+          fields = block["fields"]
+          fields = fields.to_h if fields.respond_to?(:to_h)
+
+          {
+            "id" => block["id"].presence || SecureRandom.uuid,
+            "type" => type,
+            "fields" => fields.is_a?(Hash) ? fields : {}
+          }
+        end
+      end
+
+      def safe_parse_blocks(value)
+        JSON.parse(value)
+      rescue JSON::ParserError
+        []
+      end
+
+      def sanitized_rich_text(value)
+        Rails::HTML5::SafeListSanitizer.new.sanitize(
+          value.to_s,
+          tags: ALLOWED_RICH_TEXT_TAGS,
+          attributes: ALLOWED_RICH_TEXT_ATTRIBUTES
+        )
+      end
+
+      def image_fields
+        @content_type.fields.select { |field| field["type"] == "image" && field["handle"].present? }
+      end
+
+      def relationship_fields
+        @content_type.fields.select { |field| field["type"] == "relationship" && field["handle"].present? }
+      end
+
+      def taxonomy_fields
+        @content_type.fields.select { |field| field["type"] == "taxonomy" && field["handle"].present? }
+      end
+
+      def relationship_entry_scope(entry, field)
+        site = entry&.site || current_site
+        scope = Entry.for_site(site).includes(:content_type)
+        target_handle = field["content_type"].to_s.strip.presence
+        return scope unless target_handle
+
+        scope.joins(:content_type).where(ContentType.table_name => { handle: target_handle })
+      end
+
+      def field_label(field)
+        field["label"].presence || field["handle"].to_s.humanize
+      end
+
+      def default_asset_alt_text(entry, field)
+        field["label"].present? ? "#{entry.title} #{field['label']}" : entry.title
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/form_definitions_controller.rb

@@ -0,0 +1,105 @@
+module Plum
+  module Cp
+    class FormDefinitionsController < BaseController
+      helper_method :form_fields_json
+
+      before_action :set_form_definition, only: [ :show, :edit, :update, :destroy ]
+      before_action :require_editor, only: [ :new, :create, :edit, :update, :destroy ]
+
+      def index
+        @form_definitions = current_site.form_definitions.includes(:form_submissions).order(:name)
+      end
+
+      def show
+        @submissions = @form_definition.form_submissions.order(created_at: :desc)
+      end
+
+      def new
+        @form_definition = current_site.form_definitions.build(fields: [])
+      end
+
+      def create
+        @form_definition = current_site.form_definitions.build(form_definition_params)
+
+        if assign_fields(@form_definition) && @form_definition.save
+          redirect_to cp_form_definition_path(@form_definition), notice: "Form created"
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        @form_definition.assign_attributes(form_definition_params)
+
+        if assign_fields(@form_definition) && @form_definition.save
+          redirect_to cp_form_definition_path(@form_definition), notice: "Form updated"
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @form_definition.destroy
+        redirect_to cp_form_definitions_path, notice: "Form deleted"
+      end
+
+      private
+
+      def set_form_definition
+        @form_definition = current_site.form_definitions.find(params[:id])
+      end
+
+      def form_definition_params
+        params.require(:form_definition).permit(:name, :handle, :notification_email)
+      end
+
+      def assign_fields(form_definition)
+        @fields_json = params.dig(:form_definition, :fields_json)
+        form_definition.fields = normalized_fields(@fields_json)
+        true
+      rescue JSON::ParserError
+        form_definition.errors.add(:fields, "must be valid JSON")
+        false
+      end
+
+      def normalized_fields(raw_json)
+        parsed = JSON.parse(raw_json.presence || '{"fields":[]}')
+        fields = parsed.is_a?(Hash) ? parsed["fields"] : parsed
+        Array(fields).filter_map { |field| normalized_field(field) }
+      end
+
+      def normalized_field(field)
+        return unless field.is_a?(Hash)
+
+        handle = field["handle"].to_s.strip
+        return if handle.blank?
+
+        {
+          "handle" => handle,
+          "type" => normalized_field_type(field["type"]),
+          "label" => field["label"].to_s.strip.presence || handle.humanize,
+          "required" => ActiveModel::Type::Boolean.new.cast(field["required"]),
+          "options" => normalized_options(field["options"])
+        }
+      end
+
+      def normalized_field_type(type)
+        type = type.to_s
+        FormDefinition::FIELD_TYPES.include?(type) ? type : "text"
+      end
+
+      def normalized_options(options)
+        Array(options).flat_map { |value| value.to_s.split(",") }.map(&:strip).reject(&:blank?)
+      end
+
+      def form_fields_json(form_definition)
+        return @fields_json if defined?(@fields_json) && @fields_json.present?
+
+        JSON.pretty_generate({ fields: form_definition.form_fields })
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/form_submissions_controller.rb

@@ -0,0 +1,26 @@
+module Plum
+  module Cp
+    class FormSubmissionsController < BaseController
+      before_action :set_form_definition
+      before_action :set_form_submission
+
+      def show
+      end
+
+      def destroy
+        @form_submission.destroy
+        redirect_to cp_form_definition_path(@form_definition), notice: "Submission deleted"
+      end
+
+      private
+
+      def set_form_definition
+        @form_definition = current_site.form_definitions.find(params[:form_definition_id])
+      end
+
+      def set_form_submission
+        @form_submission = @form_definition.form_submissions.find(params[:id])
+      end
+    end
+  end
+end

data/app/controllers/plum/cp/globals_controller.rb

@@ -0,0 +1,84 @@
+module Plum
+  module Cp
+    class GlobalsController < BaseController
+      helper_method :global_data_json
+
+      before_action :set_global, only: [ :show, :edit, :update, :destroy ]
+      before_action :require_editor, only: [ :new, :create, :edit, :update, :destroy ]
+
+      def index
+        @globals = current_site.globals.order(:name)
+      end
+
+      def show
+      end
+
+      def new
+        @global = current_site.globals.build(data: {})
+      end
+
+      def create
+        @global = current_site.globals.build(global_params)
+
+        if assign_data(@global) && @global.save
+          redirect_to cp_global_path(@global), notice: "Global created"
+        else
+          render :new, status: :unprocessable_entity
+        end
+      end
+
+      def edit
+      end
+
+      def update
+        @global.assign_attributes(global_params)
+
+        if assign_data(@global) && @global.save
+          redirect_to cp_global_path(@global), notice: "Global updated"
+        else
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
+      def destroy
+        @global.destroy
+        redirect_to cp_globals_path, notice: "Global deleted"
+      end
+
+      private
+
+      def set_global
+        @global = current_site.globals.find(params[:id])
+      end
+
+      def global_params
+        params.require(:global).permit(:name, :handle)
+      end
+
+      def assign_data(global)
+        @data_json = params.dig(:global, :data_json)
+        global.data = parse_data_json(@data_json)
+        true
+      rescue JSON::ParserError
+        global.errors.add(:data, "must be valid JSON")
+        false
+      rescue TypeError
+        global.errors.add(:data, "must be a JSON object")
+        false
+      end
+
+      def parse_data_json(raw_json)
+        data = JSON.parse(raw_json.presence || "{}")
+        raise TypeError unless data.is_a?(Hash)
+
+        data
+      end
+
+      def global_data_json(global)
+        return @data_json if defined?(@data_json) && @data_json.present?
+
+        JSON.pretty_generate(global.data)
+      end
+    end
+  end
+end