plum-cms 0.1.0

data/app/javascript/controllers/plum/image_picker_controller.js

@@ -0,0 +1,143 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Reusable image picker. Stores the chosen asset's id in a hidden input and
+// shows a thumbnail preview. "Choose image" opens an inline panel with a grid
+// of the site's assets plus an inline uploader. Works both when rendered from
+// ERB (entry image fields) and when injected by the block editor's JS.
+//
+// data values:
+//   assetsUrl  - GET (json) list of assets [{id,url,filename,folder,alt_text,label}]
+//   uploadUrl  - POST (multipart, json) to create an asset, returns the asset json
+//   value      - initially selected asset id (optional)
+export default class extends Controller {
+  static targets = ["input", "preview", "panel", "grid", "file", "status"]
+  static values = { assetsUrl: String, uploadUrl: String }
+
+  connect() {
+    this.assets = null
+    if (this.inputTarget.value) this.refreshPreviewFromList()
+  }
+
+  toggle(event) {
+    event.preventDefault()
+    this.panelTarget.classList.toggle("hidden")
+    if (!this.panelTarget.classList.contains("hidden")) this.load()
+  }
+
+  close(event) {
+    if (event) event.preventDefault()
+    this.panelTarget.classList.add("hidden")
+  }
+
+  async load() {
+    if (this.assets) return
+    this.setStatus("Loading…")
+    try {
+      const res = await fetch(this.assetsUrlValue, { headers: { Accept: "application/json" } })
+      this.assets = await res.json()
+      this.renderGrid()
+      this.setStatus("")
+    } catch (_e) {
+      this.setStatus("Could not load images.")
+    }
+  }
+
+  renderGrid() {
+    this.gridTarget.innerHTML = ""
+    if (!this.assets.length) {
+      this.setStatus("No images yet — upload one below.")
+      return
+    }
+    this.assets.forEach((asset) => this.gridTarget.appendChild(this.thumb(asset)))
+  }
+
+  thumb(asset) {
+    const btn = document.createElement("button")
+    btn.type = "button"
+    btn.className = "group relative overflow-hidden rounded-md border border-gray-200 hover:border-purple-500 focus:border-purple-500 focus:outline-none"
+    btn.title = asset.label || asset.filename
+    btn.addEventListener("click", () => this.select(asset))
+
+    const img = document.createElement("img")
+    img.src = asset.url
+    img.alt = asset.alt_text || ""
+    img.className = "h-24 w-full object-cover"
+    btn.appendChild(img)
+    return btn
+  }
+
+  select(asset) {
+    this.inputTarget.value = asset.id
+    this.setPreview(asset.url, asset.alt_text)
+    this.inputTarget.dispatchEvent(new Event("input", { bubbles: true }))
+    this.inputTarget.dispatchEvent(new Event("change", { bubbles: true }))
+    this.close()
+  }
+
+  clear(event) {
+    if (event) event.preventDefault()
+    this.inputTarget.value = ""
+    this.setPreview(null)
+    this.inputTarget.dispatchEvent(new Event("input", { bubbles: true }))
+    this.inputTarget.dispatchEvent(new Event("change", { bubbles: true }))
+  }
+
+  async upload(event) {
+    const file = event.target.files && event.target.files[0]
+    if (!file) return
+    this.setStatus("Uploading…")
+    const body = new FormData()
+    body.append("asset[file]", file)
+    try {
+      const res = await fetch(this.uploadUrlValue, {
+        method: "POST",
+        headers: { Accept: "application/json", "X-CSRF-Token": this.csrfToken() },
+        body
+      })
+      if (!res.ok) throw new Error("upload failed")
+      const asset = await res.json()
+      if (this.assets) this.assets.unshift(asset)
+      this.select(asset)
+      this.setStatus("")
+      event.target.value = ""
+    } catch (_e) {
+      this.setStatus("Upload failed. Make sure it's an image.")
+    }
+  }
+
+  refreshPreviewFromList() {
+    // We have an id but not the URL (e.g. block editor restore). Fetch the list
+    // once to resolve the preview.
+    fetch(this.assetsUrlValue, { headers: { Accept: "application/json" } })
+      .then((res) => res.json())
+      .then((assets) => {
+        this.assets = assets
+        const current = assets.find((a) => String(a.id) === String(this.inputTarget.value))
+        if (current) this.setPreview(current.url, current.alt_text)
+      })
+      .catch(() => {})
+  }
+
+  setPreview(url, alt = "") {
+    if (!this.hasPreviewTarget) return
+    if (url) {
+      this.previewTarget.innerHTML = ""
+      const img = document.createElement("img")
+      img.src = url
+      img.alt = alt || ""
+      img.className = "rounded-md object-contain"
+      img.style.cssText = "max-height: 8rem; max-width: 16rem;"
+      this.previewTarget.appendChild(img)
+    } else {
+      this.previewTarget.innerHTML = '<div class="flex h-32 w-full items-center justify-center rounded-md border border-dashed border-gray-300 text-sm text-gray-400">No image selected</div>'
+    }
+  }
+
+  setStatus(text) {
+    if (this.hasStatusTarget) this.statusTarget.textContent = text
+  }
+
+  csrfToken() {
+    return document.querySelector('meta[name="csrf-token"]')?.content || ""
+  }
+}

data/app/javascript/controllers/plum/theme_settings_controller.js

@@ -0,0 +1,17 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = ["select", "panel"]
+
+  connect() {
+    this.update()
+  }
+
+  update() {
+    const selectedHandle = this.selectTarget.value
+
+    this.panelTargets.forEach((panel) => {
+      panel.hidden = panel.getAttribute("data-plum--theme-settings-handle") !== selectedHandle
+    })
+  }
+}

data/app/models/plum/application_record.rb

@@ -0,0 +1,5 @@
+module Plum
+  class ApplicationRecord < ::ApplicationRecord
+    self.abstract_class = true
+  end
+end

data/app/models/plum/asset.rb

@@ -0,0 +1,69 @@
+module Plum
+  class Asset < ApplicationRecord
+    include SiteScoped
+
+    has_one_attached :file
+
+    validates :file, presence: true
+    validate :file_must_be_image
+
+    before_validation :normalize_folder
+
+    def filename
+      file.attached? ? file.filename.to_s : ""
+    end
+
+    def content_type
+      file.content_type if file.attached?
+    end
+
+    def image?
+      content_type.to_s.start_with?("image/")
+    end
+
+    def url
+      return "" unless file.attached?
+
+      Rails.application.routes.url_helpers.rails_blob_path(file, only_path: true)
+    end
+
+    def variant_url(transformations)
+      return url unless file.attached? && file.variable?
+
+      variant = file.variant(transformations)
+      Rails.application.routes.url_helpers.rails_blob_path(variant.processed, only_path: true)
+    rescue StandardError, LoadError
+      url
+    end
+
+    def to_liquid
+      {
+        "id" => id,
+        "url" => url,
+        "thumb" => variant_url(resize_to_fill: [ 300, 300 ]),
+        "small" => variant_url(resize_to_limit: [ 640, 640 ]),
+        "medium" => variant_url(resize_to_limit: [ 1200, 1200 ]),
+        "large" => variant_url(resize_to_limit: [ 2000, 2000 ]),
+        "alt_text" => alt_text.to_s,
+        "caption" => caption.to_s,
+        "filename" => filename,
+        "content_type" => content_type.to_s,
+        "byte_size" => file.attached? ? file.byte_size : nil,
+        "folder" => folder.to_s
+      }
+    end
+
+    private
+
+    def normalize_folder
+      self.folder = folder.to_s.strip.presence
+    end
+
+    def file_must_be_image
+      return unless file.attached?
+      return if image?
+
+      errors.add(:file, "must be an image")
+    end
+  end
+end

data/app/models/plum/content_type.rb

@@ -0,0 +1,35 @@
+module Plum
+  class ContentType < ApplicationRecord
+    include SiteScoped
+
+    FIELD_TYPES = %w[text textarea rich_text image boolean select date relationship blocks].freeze
+
+    has_many :entries, dependent: :destroy
+
+    validates :name, presence: true
+    validates :handle, presence: true, uniqueness: { scope: :site_id }, format: { with: /\A[a-z][a-z0-9_]*\z/ }
+    validate :route_prefix_format
+
+    before_validation :generate_handle, on: :create
+
+    def fields
+      blueprint&.dig("fields") || []
+    end
+
+    def route_prefix
+      blueprint&.dig("route_prefix").presence
+    end
+
+    private
+
+    def generate_handle
+      self.handle = name&.parameterize(separator: "_") if handle.blank?
+    end
+
+    def route_prefix_format
+      return if route_prefix.blank? || route_prefix.match?(/\A[a-z0-9]+(?:-[a-z0-9]+)*\z/)
+
+      errors.add(:blueprint, "route prefix must contain lowercase letters, numbers, and hyphens")
+    end
+  end
+end

data/app/models/plum/entry.rb

@@ -0,0 +1,67 @@
+module Plum
+  class Entry < ApplicationRecord
+    include SiteScoped
+
+    belongs_to :content_type
+    belongs_to :author, class_name: "Plum::User", optional: true
+
+    has_many :entry_terms, dependent: :destroy
+    has_many :terms, through: :entry_terms
+
+    # The page served at "/" — Plum resolves the homepage by this slug
+    # (convention over configuration). Its slug is locked and it can't be
+    # deleted while published, so a non-technical editor can't orphan the home
+    # page by renaming or removing it.
+    HOMEPAGE_SLUG = "home".freeze
+
+    enum :status, { draft: 0, published: 1, scheduled: 2 }
+
+    validates :title, presence: true
+    validates :slug, presence: true, uniqueness: { scope: :site_id }, format: { with: /\A[a-z0-9]+(?:-[a-z0-9]+)*\z/ }
+    validates :status, presence: true
+    validate :homepage_slug_is_unchanged
+
+    before_validation :generate_slug
+    before_validation :set_published_at, if: :published?
+    before_destroy :prevent_homepage_destroy
+
+    scope :live, -> { published.where("published_at <= ?", Time.current) }
+    scope :search, ->(query) {
+      return none if query.blank?
+
+      term = "%#{query}%"
+      where("title LIKE ? OR slug LIKE ?", term, term)
+    }
+
+    def field_value(handle)
+      data&.dig(handle)
+    end
+
+    def homepage?
+      slug == HOMEPAGE_SLUG
+    end
+
+    private
+
+    def generate_slug
+      self.slug = title&.parameterize if slug.blank?
+    end
+
+    def homepage_slug_is_unchanged
+      return unless persisted? && slug_changed? && slug_was == HOMEPAGE_SLUG
+
+      errors.add(:slug, "can't be changed — this is the homepage")
+    end
+
+    def prevent_homepage_destroy
+      return unless homepage?
+
+      errors.add(:base, "The homepage can't be deleted")
+      throw :abort
+    end
+
+    def set_published_at
+      self.published_at ||= Time.current
+    end
+  end
+end

data/app/models/plum/entry_term.rb

@@ -0,0 +1,8 @@
+module Plum
+  class EntryTerm < ApplicationRecord
+    belongs_to :entry
+    belongs_to :term
+
+    validates :term_id, uniqueness: { scope: :entry_id }
+  end
+end

data/app/models/plum/form_definition.rb

@@ -0,0 +1,68 @@
+module Plum
+  class FormDefinition < ApplicationRecord
+    include SiteScoped
+
+    FIELD_TYPES = %w[text email textarea select checkbox].freeze
+    HANDLE_PATTERN = /\A[a-z][a-z0-9_]*\z/
+
+    has_many :form_submissions, dependent: :destroy
+
+    validates :name, presence: true
+    validates :handle, presence: true, uniqueness: { scope: :site_id }, format: { with: HANDLE_PATTERN }
+    validate :fields_are_valid
+
+    before_validation :generate_handle, on: :create
+
+    def form_fields
+      fields || []
+    end
+
+    def field_handles
+      form_fields.filter_map { |field| field["handle"].presence }
+    end
+
+    def to_liquid
+      {
+        "name" => name,
+        "handle" => handle,
+        "fields" => form_fields
+      }
+    end
+
+    private
+
+    def generate_handle
+      self.handle = name&.parameterize(separator: "_") if handle.blank?
+    end
+
+    def fields_are_valid
+      unless form_fields.is_a?(Array)
+        errors.add(:fields, "must be an array")
+        return
+      end
+
+      seen_handles = []
+
+      form_fields.each_with_index do |field, index|
+        validate_field(field, index, seen_handles)
+      end
+    end
+
+    def validate_field(field, index, seen_handles)
+      unless field.is_a?(Hash)
+        errors.add(:fields, "field #{index + 1} must be an object")
+        return
+      end
+
+      handle = field["handle"].to_s
+      type = field["type"].to_s
+
+      errors.add(:fields, "field #{index + 1} handle is required") if handle.blank?
+      errors.add(:fields, "#{handle} handle is invalid") if handle.present? && !handle.match?(HANDLE_PATTERN)
+      errors.add(:fields, "#{handle} handle is duplicated") if handle.present? && seen_handles.include?(handle)
+      errors.add(:fields, "#{handle} type is invalid") unless FIELD_TYPES.include?(type)
+
+      seen_handles << handle if handle.present?
+    end
+  end
+end

data/app/models/plum/form_submission.rb

@@ -0,0 +1,76 @@
+module Plum
+  class FormSubmission < ApplicationRecord
+    include SiteScoped
+
+    belongs_to :form_definition
+
+    validates :data, presence: true
+    validate :required_fields_are_present
+    validate :email_fields_are_valid
+    validate :select_values_are_valid
+
+    before_validation :normalize_data
+
+    def data
+      super || {}
+    end
+
+    def value(key)
+      data&.dig(key)
+    end
+
+    private
+
+    def normalize_data
+      self.data = form_definition.form_fields.each_with_object({}) do |field, normalized|
+        handle = field["handle"].to_s
+        value = data[handle]
+
+        normalized[handle] = normalized_value(field, value)
+      end
+    end
+
+    def normalized_value(field, value)
+      case field["type"]
+      when "checkbox"
+        ActiveModel::Type::Boolean.new.cast(value)
+      else
+        value.to_s.strip
+      end
+    end
+
+    def required_fields_are_present
+      form_definition.form_fields.each do |field|
+        next unless ActiveModel::Type::Boolean.new.cast(field["required"])
+
+        value = data[field["handle"].to_s]
+        next if field["type"] == "checkbox" ? value == true : value.present?
+
+        errors.add(:data, "#{field_label(field)} is required")
+      end
+    end
+
+    def email_fields_are_valid
+      form_definition.form_fields.select { |field| field["type"] == "email" }.each do |field|
+        value = data[field["handle"].to_s]
+        next if value.blank? || URI::MailTo::EMAIL_REGEXP.match?(value)
+
+        errors.add(:data, "#{field_label(field)} must be a valid email")
+      end
+    end
+
+    def select_values_are_valid
+      form_definition.form_fields.select { |field| field["type"] == "select" }.each do |field|
+        value = data[field["handle"].to_s]
+        options = Array(field["options"]).map(&:to_s)
+        next if value.blank? || options.empty? || options.include?(value)
+
+        errors.add(:data, "#{field_label(field)} is invalid")
+      end
+    end
+
+    def field_label(field)
+      field["label"].presence || field["handle"].to_s.humanize
+    end
+  end
+end

data/app/models/plum/global.rb

@@ -0,0 +1,24 @@
+module Plum
+  class Global < ApplicationRecord
+    include SiteScoped
+
+    validates :name, presence: true
+    validates :handle, presence: true, uniqueness: { scope: :site_id }, format: { with: /\A[a-z][a-z0-9_]*\z/ }
+
+    before_validation :generate_handle, on: :create
+
+    def data
+      super || {}
+    end
+
+    def value(key)
+      data&.dig(key)
+    end
+
+    private
+
+    def generate_handle
+      self.handle = name&.parameterize(separator: "_") if handle.blank?
+    end
+  end
+end

data/app/models/plum/nav_item.rb

@@ -0,0 +1,58 @@
+module Plum
+  class NavItem < ApplicationRecord
+    include SiteScoped
+
+    belongs_to :nav_menu
+    belongs_to :parent, class_name: "Plum::NavItem", optional: true
+    belongs_to :entry, optional: true
+    has_many :children, class_name: "Plum::NavItem", foreign_key: :parent_id, dependent: :destroy
+
+    validates :label, presence: true
+    validates :url, presence: true, unless: :entry_id?
+    validate :nav_menu_belongs_to_site
+    validate :entry_belongs_to_site
+    validate :parent_belongs_to_menu
+    validate :parent_does_not_create_cycle
+
+    default_scope { order(:position) }
+
+    def href
+      entry&.slug ? "/#{entry.slug}" : url
+    end
+
+    private
+
+    def nav_menu_belongs_to_site
+      return if nav_menu.blank? || site.blank? || nav_menu.site_id == site_id
+
+      errors.add(:nav_menu, "must belong to the same site")
+    end
+
+    def entry_belongs_to_site
+      return if entry.blank? || site.blank? || entry.site_id == site_id
+
+      errors.add(:entry, "must belong to the same site")
+    end
+
+    def parent_belongs_to_menu
+      return if parent.blank?
+
+      errors.add(:parent, "must belong to the same menu") if parent.nav_menu_id != nav_menu_id
+      errors.add(:parent, "must belong to the same site") if site_id.present? && parent.site_id != site_id
+      errors.add(:parent, "cannot be itself") if parent_id.present? && parent_id == id
+    end
+
+    def parent_does_not_create_cycle
+      ancestor = parent
+
+      while ancestor
+        if ancestor == self
+          errors.add(:parent, "cannot be a descendant")
+          break
+        end
+
+        ancestor = ancestor.parent
+      end
+    end
+  end
+end

data/app/models/plum/nav_menu.rb

@@ -0,0 +1,24 @@
+module Plum
+  class NavMenu < ApplicationRecord
+    include SiteScoped
+
+    has_many :nav_items, dependent: :destroy
+
+    validates :name, presence: true
+    validates :handle, presence: true, uniqueness: { scope: :site_id }, format: { with: /\A[a-z][a-z0-9_]*\z/ }
+
+    before_validation :generate_handle, on: :create
+
+    def items
+      nav_items.where(parent_id: nil).order(:position)
+    end
+
+    alias root_items items
+
+    private
+
+    def generate_handle
+      self.handle = name&.parameterize(separator: "_") if handle.blank?
+    end
+  end
+end