plum-cms 0.2.1 → 0.2.3

data/app/services/plum/config_sync.rb

@@ -0,0 +1,252 @@
+require "yaml"
+
+module Plum
+  # Config-as-code (phase 1): the content model lives as YAML files in the
+  # host repo and syncs into the database, like db:migrate for content types.
+  #
+  #   plum/content_types/posts.yml  ->  Plum::ContentType (blueprint)
+  #   plum/fieldsets/seo.yml        ->  Plum::Fieldset
+  #
+  # Files are the source of truth; `apply` upserts the DB from them, `export`
+  # writes the DB back out (bootstrap + CP write-back later), and `check`
+  # reports drift for CI. Content (entries, terms, assets) is never touched.
+  class ConfigSync
+    Result = Struct.new(:created, :updated, :unchanged, :deleted, keyword_init: true) do
+      def summary
+        "#{created.length} created, #{updated.length} updated, #{unchanged.length} unchanged, #{deleted.length} deleted"
+      end
+    end
+
+    class DriftError < StandardError; end
+    class UnsafePruneError < StandardError; end
+
+    CONTENT_TYPE_DIR = "content_types".freeze
+    FIELDSET_DIR = "fieldsets".freeze
+
+    def self.export(site:, dir:)
+      new(site: site, dir: dir).export
+    end
+
+    def self.apply(site:, dir:, prune: false, force: false)
+      new(site: site, dir: dir).apply(prune: prune, force: force)
+    end
+
+    def self.check(site:, dir:)
+      new(site: site, dir: dir).check
+    end
+
+    def initialize(site:, dir:)
+      @site = site
+      @dir = Pathname(dir)
+    end
+
+    # DB -> files. Mirrors the database exactly: stale files for handles that
+    # no longer exist are removed.
+    def export
+      written = []
+      written += export_kind(CONTENT_TYPE_DIR, content_types.order(:handle)) { |record| content_type_config(record) }
+      written += export_kind(FIELDSET_DIR, fieldsets.order(:handle)) { |record| fieldset_config(record) }
+      written
+    end
+
+    # Files -> DB. Upserts by handle inside a transaction. Deleting requires
+    # prune: true, and deleting a content type that still has entries
+    # additionally requires force: true.
+    def apply(prune: false, force: false)
+      result = Result.new(created: [], updated: [], unchanged: [], deleted: [])
+
+      site.transaction do
+        apply_content_types(result)
+        apply_fieldsets(result)
+        prune_missing(result, force: force) if prune
+      end
+
+      result
+    end
+
+    # Returns human-readable drift lines; empty means files and DB agree.
+    def check
+      drift = []
+      drift += check_kind(CONTENT_TYPE_DIR, content_types)
+      drift += check_kind(FIELDSET_DIR, fieldsets)
+      drift
+    end
+
+    private
+
+    attr_reader :site, :dir
+
+    # Fresh relations every time — going through site.content_types would
+    # cache the association on the site instance and hide later DB changes
+    # from repeated check/apply calls.
+    def content_types
+      ContentType.for_site(site)
+    end
+
+    def fieldsets
+      Fieldset.for_site(site)
+    end
+
+    def export_kind(subdir, records)
+      path = dir.join(subdir)
+      path.mkpath
+      keep = []
+
+      records.each do |record|
+        file = path.join("#{record.handle}.yml")
+        file.write(yaml_for(yield(record)))
+        keep << file
+      end
+
+      path.glob("*.yml").each { |file| file.delete unless keep.include?(file) }
+      keep
+    end
+
+    def apply_content_types(result)
+      each_config(CONTENT_TYPE_DIR) do |config, file|
+        record = content_types.find_or_initialize_by(handle: config.fetch("handle"))
+        record.site = site if record.new_record?
+        record.name = config["name"]
+        record.icon = config["icon"]
+        record.singleton = config["singleton"] unless config["singleton"].nil?
+        record.blueprint = merged_blueprint(record, config)
+        track(result, record, file)
+      end
+    end
+
+    def apply_fieldsets(result)
+      each_config(FIELDSET_DIR) do |config, file|
+        record = fieldsets.find_or_initialize_by(handle: config.fetch("handle"))
+        record.site = site if record.new_record?
+        record.name = config["name"]
+        record.fields = config["fields"] || []
+        track(result, record, file)
+      end
+    end
+
+    # Blueprint keys the files don't know about are preserved so config
+    # written by newer Plum versions survives a sync from older files.
+    def merged_blueprint(record, config)
+      blueprint = (record.blueprint || {}).deep_dup
+      blueprint["fields"] = config["fields"] || []
+      if config["route_prefix"].present?
+        blueprint["route_prefix"] = config["route_prefix"]
+      else
+        blueprint.delete("route_prefix")
+      end
+      blueprint
+    end
+
+    def track(result, record, file)
+      if record.new_record?
+        record.save!
+        result.created << record.handle
+      elsif record.changed?
+        record.save!
+        result.updated << record.handle
+      else
+        result.unchanged << record.handle
+      end
+    rescue ActiveRecord::RecordInvalid => e
+      raise ActiveRecord::RecordInvalid.new(e.record), "#{file.basename}: #{e.message}"
+    end
+
+    def prune_missing(result, force:)
+      file_handles = handles_in(CONTENT_TYPE_DIR)
+      content_types.where.not(handle: file_handles).find_each do |record|
+        if record.entries.exists? && !force
+          raise UnsafePruneError,
+                "Content type '#{record.handle}' has #{record.entries.count} entries; " \
+                "re-run with FORCE=1 to delete them"
+        end
+        record.destroy!
+        result.deleted << record.handle
+      end
+
+      fieldsets.where.not(handle: handles_in(FIELDSET_DIR)).find_each do |record|
+        record.destroy!
+        result.deleted << record.handle
+      end
+    end
+
+    def handles_in(subdir)
+      handles = []
+      each_config(subdir) { |config, _file| handles << config.fetch("handle") }
+      handles
+    end
+
+    def check_kind(subdir, records)
+      drift = []
+      configs = {}
+      each_config(subdir) { |config, _file| configs[config.fetch("handle")] = config }
+
+      db = records.index_by(&:handle)
+      configs.each do |handle, config|
+        record = db[handle]
+        if record.nil?
+          drift << "#{subdir}/#{handle}: in files but not in the database"
+        elsif normalize(subdir, config_for(subdir, record)) != normalize(subdir, config)
+          drift << "#{subdir}/#{handle}: files and database differ"
+        end
+      end
+      (db.keys - configs.keys).each do |handle|
+        drift << "#{subdir}/#{handle}: in the database but not in files"
+      end
+      drift
+    end
+
+    def config_for(subdir, record)
+      subdir == CONTENT_TYPE_DIR ? content_type_config(record) : fieldset_config(record)
+    end
+
+    # Key order and empty-vs-absent values must not register as drift.
+    def normalize(subdir, config)
+      if subdir == CONTENT_TYPE_DIR
+        {
+          "name" => config["name"].to_s,
+          "handle" => config["handle"].to_s,
+          "icon" => config["icon"].presence,
+          "singleton" => !!config["singleton"],
+          "route_prefix" => config["route_prefix"].presence,
+          "fields" => config["fields"] || []
+        }
+      else
+        {
+          "name" => config["name"].to_s,
+          "handle" => config["handle"].to_s,
+          "fields" => config["fields"] || []
+        }
+      end
+    end
+
+    def content_type_config(record)
+      config = {
+        "name" => record.name,
+        "handle" => record.handle,
+        "icon" => record.icon,
+        "singleton" => record.singleton,
+        "route_prefix" => record.route_prefix,
+        "fields" => record.fields
+      }
+      config.reject { |_key, value| value.nil? }
+    end
+
+    def fieldset_config(record)
+      { "name" => record.name, "handle" => record.handle, "fields" => record.fields || [] }
+    end
+
+    def each_config(subdir)
+      dir.join(subdir).glob("*.yml").sort.each do |file|
+        config = YAML.safe_load(file.read, aliases: true)
+        raise DriftError, "#{file} is not a YAML mapping" unless config.is_a?(Hash)
+
+        config["handle"] ||= file.basename(".yml").to_s
+        yield config, file
+      end
+    end
+
+    def yaml_for(config)
+      config.to_yaml
+    end
+  end
+end

data/app/services/plum/draft_diff.rb

@@ -0,0 +1,177 @@
+module Plum
+  # Field-by-field comparison between an entry's live content and its working
+  # draft, tokenized for git-style rendering (equal / deleted / inserted
+  # segments). Rich text is compared as readable text, structured fields as
+  # pretty-printed JSON.
+  class DraftDiff
+    # Beyond this many differing tokens, fall back to a wholesale
+    # replaced-block diff instead of an O(n*m) LCS table.
+    TOKEN_LIMIT = 1500
+
+    FieldChange = Struct.new(:handle, :label, :segments, keyword_init: true)
+
+    def initialize(entry)
+      @entry = entry
+      @content_type = entry.content_type
+    end
+
+    def changes
+      @changes ||= build_changes
+    end
+
+    def any?
+      changes.any?
+    end
+
+    # Word-level diff as [[op, text], ...] with op in :eq/:del/:ins.
+    # Whitespace is kept as tokens so spacing survives reconstruction.
+    def self.word_diff(old_text, new_text)
+      a = tokenize(old_text)
+      b = tokenize(new_text)
+
+      prefix = common_prefix_length(a, b)
+      suffix = common_suffix_length(a, b, prefix)
+      middle_a = a[prefix...(a.length - suffix)]
+      middle_b = b[prefix...(b.length - suffix)]
+
+      segments = []
+      segments << [ :eq, a.first(prefix).join ] if prefix.positive?
+      segments.concat(diff_middle(middle_a, middle_b))
+      segments << [ :eq, a.last(suffix).join ] if suffix.positive?
+      merge_segments(segments)
+    end
+
+    private
+
+    attr_reader :entry, :content_type
+
+    def build_changes
+      list = []
+
+      if entry.draft_title.to_s != entry.title.to_s
+        list << FieldChange.new(handle: "title", label: "Title",
+                                segments: self.class.word_diff(entry.title.to_s, entry.draft_title.to_s))
+      end
+
+      live_data = entry.data.to_h
+      draft_data = entry.draft_data.to_h["data"] || {}
+
+      (live_data.keys | draft_data.keys).each do |handle|
+        field = field_definition(handle)
+        live = normalize(live_data[handle], field)
+        draft = normalize(draft_data.key?(handle) ? draft_data[handle] : live_data[handle], field)
+        next if live == draft
+
+        list << FieldChange.new(handle: handle, label: label_for(handle, field),
+                                segments: self.class.word_diff(live, draft))
+      end
+
+      list
+    end
+
+    def field_definition(handle)
+      content_type.fields.find { |field| field["handle"].to_s == handle }
+    end
+
+    def label_for(handle, field)
+      field&.dig("label").presence || handle.humanize
+    end
+
+    def normalize(value, field)
+      case value
+      when nil then ""
+      when Hash, Array then JSON.pretty_generate(value)
+      when String
+        field&.dig("type") == "rich_text" ? html_to_text(value) : value
+      else value.to_s
+      end
+    end
+
+    def html_to_text(html)
+      text = html.gsub(%r{<(br|/p|/h[1-6]|/li|/blockquote|/div|/tr|/figcaption)[^>]*>}i, "\n")
+      text = ActionController::Base.helpers.strip_tags(text).to_s
+      text.split("\n").map(&:strip).join("\n").gsub(/\n{3,}/, "\n\n").strip
+    end
+
+    class << self
+      private
+
+      def tokenize(text)
+        text.to_s.scan(/\S+|\s+/)
+      end
+
+      def common_prefix_length(a, b)
+        limit = [ a.length, b.length ].min
+        (0...limit).each { |i| return i if a[i] != b[i] }
+        limit
+      end
+
+      def common_suffix_length(a, b, prefix)
+        limit = [ a.length, b.length ].min - prefix
+        (0...limit).each { |i| return i if a[a.length - 1 - i] != b[b.length - 1 - i] }
+        limit
+      end
+
+      def diff_middle(a, b)
+        return [] if a.empty? && b.empty?
+        return [ [ :ins, b.join ] ] if a.empty?
+        return [ [ :del, a.join ] ] if b.empty?
+        if a.length > TOKEN_LIMIT || b.length > TOKEN_LIMIT
+          return [ [ :del, a.join ], [ :ins, b.join ] ]
+        end
+
+        lcs_segments(a, b)
+      end
+
+      # Standard LCS dynamic program with backtracking; inputs are bounded by
+      # TOKEN_LIMIT after prefix/suffix trimming.
+      def lcs_segments(a, b)
+        rows = a.length + 1
+        cols = b.length + 1
+        table = Array.new(rows) { Array.new(cols, 0) }
+
+        (a.length - 1).downto(0) do |i|
+          (b.length - 1).downto(0) do |j|
+            table[i][j] = if a[i] == b[j]
+              table[i + 1][j + 1] + 1
+            else
+              [ table[i + 1][j], table[i][j + 1] ].max
+            end
+          end
+        end
+
+        segments = []
+        i = 0
+        j = 0
+        while i < a.length && j < b.length
+          if a[i] == b[j]
+            segments << [ :eq, a[i] ]
+            i += 1
+            j += 1
+          elsif table[i + 1][j] >= table[i][j + 1]
+            segments << [ :del, a[i] ]
+            i += 1
+          else
+            segments << [ :ins, b[j] ]
+            j += 1
+          end
+        end
+        segments.concat(a[i..].map { |token| [ :del, token ] })
+        segments.concat(b[j..].map { |token| [ :ins, token ] })
+        segments
+      end
+
+      def merge_segments(segments)
+        segments.each_with_object([]) do |(op, text), merged|
+          next if text.empty?
+
+          if merged.last && merged.last[0] == op
+            merged.last[1] += text
+          else
+            merged << [ op, text.dup ]
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/plum/form_renderer.rb

@@ -24,11 +24,22 @@ module Plum
 
     def hidden_inputs
       [
-        hidden_input(form["csrf_param"], form["csrf_token"]),
+        honeypot_input,
         hidden_input("return_to", form["return_to"])
       ].compact.join("\n  ")
     end
 
+    # Spam trap instead of a CSRF token: tokens are per-session, which would
+    # both break under static caching and force a session cookie onto every
+    # visitor. Bots fill this in; humans never see it.
+    def honeypot_input
+      <<~HTML.strip
+        <div style="position:absolute;left:-9999px;top:-9999px" aria-hidden="true">
+          <input type="text" name="form_submission[website]" tabindex="-1" autocomplete="off">
+        </div>
+      HTML
+    end
+
     def fields_html
       Array(form["fields"]).map { |field| field_html(field) }.join("\n  ")
     end

data/app/services/plum/liquid_context.rb

@@ -125,8 +125,6 @@ module Plum
           "handle" => form.handle,
           "fields" => form.form_fields,
           "action" => public_form_path(form),
-          "csrf_token" => form_authenticity_token,
-          "csrf_param" => "authenticity_token",
           "return_to" => controller.request.fullpath
         }
       end

data/app/views/layouts/plum/cp.html.erb

@@ -8,7 +8,7 @@
   <%= favicon_link_tag "plum-mark.svg", type: "image/svg+xml" %>
   <%= stylesheet_link_tag "plum/control_panel", "data-turbo-track": "reload" %>
   <%= stylesheet_link_tag "lexxy", "data-turbo-track": "reload" %>
-  <%= javascript_importmap_tags %>
+  <%= javascript_importmap_tags(importmap: Plum.importmap || Rails.application.importmap) %>
   <script type="module">import "plum/application"</script>
   <style>
     :root {

data/app/views/layouts/plum/session.html.erb

@@ -7,7 +7,7 @@
   <%= csp_meta_tag %>
   <%= favicon_link_tag "plum-mark.svg", type: "image/svg+xml" %>
   <%= stylesheet_link_tag "plum/control_panel", "data-turbo-track": "reload" %>
-  <%= javascript_importmap_tags %>
+  <%= javascript_importmap_tags(importmap: Plum.importmap || Rails.application.importmap) %>
   <style>
     :root { --plum-accent: <%= Plum.configuration.cp_accent_color %>; }
     .bg-purple-600 { background-color: var(--plum-accent) !important; }

data/app/views/layouts/plum/write.html.erb

@@ -0,0 +1,140 @@
+<!DOCTYPE html>
+<html lang="en" class="h-full">
+<head>
+  <title>Writing — <%= Plum.configuration.cp_name %></title>
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+  <%= favicon_link_tag "plum-mark.svg", type: "image/svg+xml" %>
+  <%= stylesheet_link_tag "plum/control_panel", "data-turbo-track": "reload" %>
+  <%= stylesheet_link_tag "lexxy", "data-turbo-track": "reload" %>
+  <%= javascript_importmap_tags(importmap: Plum.importmap || Rails.application.importmap) %>
+  <script type="module">import "plum/application"</script>
+  <style>
+    :root { --plum-accent: <%= Plum.configuration.cp_accent_color %>; }
+
+    body.plum-write {
+      background: #faf9f7;
+      color: #1f2937;
+    }
+
+    .plum-write-bar {
+      position: fixed;
+      inset: 0 0 auto 0;
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      padding: 0.875rem 1.5rem;
+      background: linear-gradient(to bottom, rgba(250,249,247,0.97), rgba(250,249,247,0.85) 70%, rgba(250,249,247,0));
+      z-index: 10;
+      opacity: 0.35;
+      transition: opacity 0.25s ease;
+    }
+    .plum-write-bar:hover, .plum-write-bar:focus-within,
+    .plum-write-bar.plum-write-bar--active { opacity: 1; }
+
+    .plum-write-save-state {
+      display: inline-flex;
+      align-items: center;
+      gap: 0.45rem;
+      padding: 0.3rem 0.75rem;
+      border-radius: 9999px;
+      font-size: 0.8125rem;
+      font-weight: 500;
+      color: #6b7280;
+      background: rgba(0,0,0,0.04);
+      transition: color 0.2s ease, background 0.2s ease;
+    }
+    .plum-write-save-state::before {
+      content: "";
+      width: 0.5rem;
+      height: 0.5rem;
+      border-radius: 9999px;
+      background: #9ca3af;
+      flex-shrink: 0;
+      transition: background 0.2s ease;
+    }
+    .plum-write-save-state[data-state="dirty"]::before { background: #f59e0b; }
+    .plum-write-save-state[data-state="saving"]::before {
+      background: #f59e0b;
+      animation: plum-write-pulse 1s ease-in-out infinite;
+    }
+    .plum-write-save-state[data-state="saved"] { color: #047857; background: #ecfdf5; }
+    .plum-write-save-state[data-state="saved"]::before { background: #10b981; }
+    .plum-write-save-state[data-state="error"] { color: #b91c1c; background: #fef2f2; }
+    .plum-write-save-state[data-state="error"]::before { background: #ef4444; }
+
+    @keyframes plum-write-pulse {
+      50% { opacity: 0.3; }
+    }
+
+    .plum-write-page {
+      max-width: 44rem;
+      margin: 0 auto;
+      padding: 6.5rem 1.5rem 40vh;
+    }
+
+    .plum-write-title {
+      width: 100%;
+      border: 0;
+      background: transparent;
+      resize: none;
+      overflow: hidden;
+      font-family: "Iowan Old Style", "Palatino Linotype", Palatino, Georgia, serif;
+      font-size: 2.75rem;
+      line-height: 1.15;
+      font-weight: 700;
+      color: #111827;
+      outline: none;
+      padding: 0;
+    }
+    .plum-write-title::placeholder { color: #d1d5db; }
+
+    .plum-write-body { margin-top: 2rem; }
+    .plum-write-body lexxy-editor {
+      display: block;
+      border: 0;
+      background: transparent;
+      box-shadow: none;
+    }
+    .plum-write-body .lexxy-content,
+    .plum-write-body lexxy-editor [contenteditable] {
+      font-family: "Iowan Old Style", "Palatino Linotype", Palatino, Georgia, serif;
+      font-size: 1.3125rem;
+      line-height: 1.8;
+      color: #1f2937;
+      min-height: 55vh;
+      border: 0 !important;
+      box-shadow: none !important;
+      background: transparent !important;
+      padding: 0;
+      outline: none;
+    }
+    .plum-write-body lexxy-toolbar {
+      position: sticky;
+      top: 0;
+      opacity: 0.25;
+      transition: opacity 0.25s ease;
+      background: transparent;
+      border: 0;
+    }
+    .plum-write-body:hover lexxy-toolbar,
+    .plum-write-body:focus-within lexxy-toolbar { opacity: 1; }
+
+    .plum-write-status {
+      position: fixed;
+      right: 1.5rem;
+      bottom: 1.25rem;
+      display: flex;
+      gap: 1rem;
+      font-size: 0.75rem;
+      letter-spacing: 0.02em;
+      color: #9ca3af;
+      z-index: 10;
+    }
+  </style>
+</head>
+<body class="plum-write h-full">
+  <%= yield %>
+</body>
+</html>

data/app/views/plum/cp/dashboard/show.html.erb

@@ -1,6 +1,13 @@
-<div class="mb-8">
-  <h1 class="text-2xl font-bold text-gray-900">Dashboard</h1>
-  <p class="mt-1 text-sm text-gray-500">Welcome back<%= ", #{current_user_label}" if current_user_label %></p>
+<div class="mb-8 flex items-start justify-between">
+  <div>
+    <h1 class="text-2xl font-bold text-gray-900">Dashboard</h1>
+    <p class="mt-1 text-sm text-gray-500">Welcome back<%= ", #{current_user_label}" if current_user_label %></p>
+  </div>
+  <% if Plum::StaticCache.enabled? %>
+    <%= button_to "Clear page cache", cp_static_cache_path, method: :delete,
+        data: { turbo_confirm: "Clear the cached pages for this site? They re-render on the next visit." },
+        class: "px-4 py-2 border border-gray-300 rounded-md shadow-sm text-sm font-medium text-gray-700 bg-white hover:bg-gray-50 cursor-pointer" %>
+  <% end %>
 </div>
 
 <div class="grid grid-cols-1 md:grid-cols-3 gap-6 mb-8">

data/app/views/plum/cp/entries/_form.html.erb

@@ -17,7 +17,7 @@
           <div class="space-y-6">
             <div>
               <%= f.label :title, class: "block text-sm font-medium text-gray-700" %>
-              <%= f.text_field :title, class: "mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-purple-500 focus:border-purple-500" %>
+              <%= f.text_field :title, value: entry.draft_title, class: "mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-purple-500 focus:border-purple-500" %>
             </div>
 
             <div>
@@ -35,7 +35,7 @@
           <% @content_type.fields.each do |field| %>
             <% field_handle = field["handle"].to_s %>
             <% field_id = "entry_data_#{field_handle.parameterize}" %>
-            <% field_value = entry.data&.dig(field_handle) %>
+            <% field_value = entry.draft_field_value(field_handle) %>
             <% field_value = field["default"] if entry.new_record? && field_value.nil? && field.key?("default") %>
             <% condition = field["condition"].presence %>
             <div class="<%= 'border-b border-gray-200 pb-2 pt-4' if field['type'] == 'section' %>" style="grid-column: span <%= field['type'] == 'section' ? 12 : (field['width'].presence || 12) %> / span <%= field['type'] == 'section' ? 12 : (field['width'].presence || 12) %>;"<% if condition %> data-field-condition="<%= condition.to_json %>"<% end %>>