postnhost 0.1.1 → 0.2.1

data/app/controllers/postnhost/api/base_controller.rb

@@ -0,0 +1,34 @@
+module Postnhost
+  module Api
+    # Bearer-only boundary intentionally excludes host session callbacks.
+    # rubocop:disable-next Rails/ApplicationController
+    class BaseController < ActionController::Base
+      skip_forgery_protection
+      before_action :prevent_caching
+      before_action :authenticate_token!
+
+      private
+
+      attr_reader :api_user
+
+      def authenticate_token!
+        scheme, secret = request.authorization.to_s.split(" ", 2)
+        token = ApiToken.authenticate(secret) if scheme&.casecmp?("Bearer")
+        token = nil if token&.resource.present? && token.resource != request.base_url + request.path
+        @api_user = token&.user
+        return if api_user
+
+        response.set_header("WWW-Authenticate", bearer_challenge)
+        render json: { errors: ["A valid bearer token is required"] }, status: :unauthorized
+      end
+
+      def bearer_challenge
+        'Bearer realm="PostnHost"'
+      end
+
+      def prevent_caching
+        response.set_header("Cache-Control", "no-store")
+      end
+    end
+  end
+end

data/app/controllers/postnhost/api/v1/commands_controller.rb

@@ -0,0 +1,27 @@
+module Postnhost
+  module Api
+    module V1
+      class CommandsController < Api::BaseController
+        def index
+          render json: { commands: Management::Catalog.tools }
+        end
+
+        def schema
+          server = request.base_url + api_v1_commands_path.delete_suffix("/commands")
+          render json: Openapi.document(server:)
+        end
+
+        def create
+          input = params.fetch(:arguments, ActionController::Parameters.new)
+          unless input.is_a?(ActionController::Parameters)
+            render json: { errors: ["arguments must be an object"] }, status: :bad_request
+            return
+          end
+          arguments = input.to_unsafe_h
+          result = Management::Command.call(name: params[:command], arguments:, user: api_user, script_name: request.script_name)
+          render json: { data: result.value, errors: result.errors }, status: result.status
+        end
+      end
+    end
+  end
+end

data/app/controllers/postnhost/api/v1/mcp_controller.rb

@@ -0,0 +1,53 @@
+module Postnhost
+  module Api
+    module V1
+      class McpController < Api::BaseController
+        before_action :validate_transport!
+
+        def create
+          message = JSON.parse(request.raw_post)
+          unless message.is_a?(Hash)
+            render json: { jsonrpc: "2.0", id: nil, error: { code: -32_600, message: "Invalid Request" } }, status: :bad_request
+            return
+          end
+          result = Management::Mcp.new(user: api_user, script_name: request.script_name).call(message)
+          result ? render(json: result) : head(:accepted)
+        rescue JSON::ParserError
+          render json: { jsonrpc: "2.0", id: nil, error: { code: -32_700, message: "Parse error" } }, status: :bad_request
+        end
+
+        def unsupported
+          response.set_header("Allow", "POST")
+          head :method_not_allowed
+        end
+
+        private
+
+        def bearer_challenge
+          %(Bearer resource_metadata="#{postnhost.oauth_resource_metadata_url}", scope="mcp")
+        end
+
+        def validate_transport!
+          origin = request.headers["Origin"]
+          if origin.present? && origin != request.base_url
+            head :forbidden
+            return
+          end
+          version = request.headers["MCP-Protocol-Version"]
+          if version.present? && Management::Mcp::VERSIONS.exclude?(version)
+            head :bad_request
+            return
+          end
+          return unless request.post?
+
+          unless request.media_type == "application/json"
+            head :unsupported_media_type
+            return
+          end
+          accept = request.headers["Accept"].to_s
+          head :not_acceptable unless accept.include?("application/json") && accept.include?("text/event-stream")
+        end
+      end
+    end
+  end
+end

data/app/controllers/postnhost/api_tokens_controller.rb

@@ -0,0 +1,34 @@
+module Postnhost
+  class ApiTokensController < ApplicationController
+    before_action :authenticate_user!
+    before_action :prevent_caching
+    layout "postnhost/product"
+
+    def index
+      @api_tokens = current_user.api_tokens.order(created_at: :desc)
+    end
+
+    def create
+      @api_token, @secret = ApiToken.issue!(user: current_user, **token_params.to_h.symbolize_keys)
+      @api_tokens = current_user.api_tokens.order(created_at: :desc)
+      render :index
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to api_tokens_path, alert: e.record.errors.full_messages.to_sentence
+    end
+
+    def destroy
+      current_user.api_tokens.find(params[:id]).revoke!
+      redirect_to api_tokens_path, notice: "API token revoked."
+    end
+
+    private
+
+    def prevent_caching
+      response.set_header("Cache-Control", "no-store")
+    end
+
+    def token_params
+      params.require(:api_token).permit(:name)
+    end
+  end
+end

data/app/controllers/postnhost/articles/translations_controller.rb

@@ -6,15 +6,8 @@ module Postnhost
     def new; end
 
     def create
-      language_ids = params[:language_ids] || []
-
-      language_ids.each do |language_id|
-        Postnhost::Translation::ArticleVariantJob.perform_later(@article.id, language_id.to_i)
-
-        @article.article_variants.create!(language: Postnhost::Language.find_by(id: language_id.to_i), generating: true)
-      end
-
-      redirect_to article_variants_path(@article)
+      result = Postnhost::Translation::Enqueue.call(record: @article, language_ids: Array(params[:language_ids]).map(&:to_i).uniq)
+      redirect_to article_variants_path(@article), **(result.success? ? {} : { alert: result.errors.to_sentence })
     end
 
     private

data/app/controllers/postnhost/articles_controller.rb

@@ -11,10 +11,9 @@ module Postnhost
       @status = Postnhost::Article.normalize_status(params[:status])
       @sort = Postnhost::Article.normalize_sort(params[:sort])
 
-      articles = current_user.articles
-                             .includes(:language, :article_snapshot)
-                             .with_status(@status)
-                             .sorted_by(@sort)
+      articles = Postnhost::Article.includes(:language, :article_snapshot)
+                                   .with_status(@status)
+                                   .sorted_by(@sort)
 
       @pagy, @articles = pagy(:offset, articles, limit: PAGE_SIZE)
     end
@@ -30,7 +29,7 @@ module Postnhost
       @categories = Postnhost::Category.all
       @users = Postnhost::User.order(:name, :email)
       @languages = Postnhost::Language.order(default: :desc, name: :asc)
-      @articles = current_user.articles.where.not(id: @article.id).order(:title)
+      @articles = Postnhost::Article.where.not(id: @article.id).order(:title)
     end
 
     def update
@@ -45,7 +44,7 @@ module Postnhost
         @categories = Postnhost::Category.all
         @users = Postnhost::User.order(:name, :email)
         @languages = Postnhost::Language.order(default: :desc, name: :asc)
-        @articles = current_user.articles.where.not(id: @article.id).order(:title)
+        @articles = Postnhost::Article.where.not(id: @article.id).order(:title)
         render :edit, status: :unprocessable_content
       end
     end

data/app/controllers/postnhost/categories/translations_controller.rb

@@ -4,15 +4,8 @@ module Postnhost
     before_action :load_category
 
     def create
-      language_ids = params[:language_ids] || []
-
-      language_ids.each do |language_id|
-        Postnhost::Translation::CategoryVariantJob.perform_later(@category.id, language_id.to_i)
-
-        @category.category_variants.create!(language: Postnhost::Language.find_by(id: language_id.to_i), generating: true)
-      end
-
-      redirect_to category_variants_path(@category)
+      result = Postnhost::Translation::Enqueue.call(record: @category, language_ids: Array(params[:language_ids]).map(&:to_i).uniq)
+      redirect_to category_variants_path(@category), **(result.success? ? {} : { alert: result.errors.to_sentence })
     end
 
     private

data/app/controllers/postnhost/management_preview_controller.rb

@@ -0,0 +1,17 @@
+module Postnhost
+  # Used only by Management::Preview for an authenticated in-process render.
+  # There are no routes to this controller.
+  class ManagementPreviewController < Public::ArticlesController
+    helper_method :postnhost
+
+    private
+
+    def postnhost
+      @postnhost ||= ActionDispatch::Routing::RoutesProxy.new(Engine.routes, self, Engine.routes.url_helpers)
+    end
+
+    def current_user
+      request.env.fetch("postnhost.management_user")
+    end
+  end
+end

data/app/controllers/postnhost/oauth/authorizations_controller.rb

@@ -0,0 +1,50 @@
+module Postnhost
+  module Oauth
+    class AuthorizationsController < ApplicationController
+      protect_from_forgery with: :exception
+      before_action :prevent_caching
+      before_action :validate_request!
+      before_action :require_oauth_user!
+      layout "postnhost/product"
+
+      def new; end
+
+      def create
+        result = if params[:decision] == "approve"
+                   { code: OauthGrant.issue!(oauth_client: @client, user: current_user,
+                                             **@oauth_request.slice(:redirect_uri, :resource, :code_challenge).symbolize_keys) }
+                 else
+                   { error: "access_denied" }
+                 end
+        uri = URI.parse(@oauth_request[:redirect_uri])
+        uri.query = [uri.query.presence, { **result, state: @oauth_request[:state] }.to_query].compact.join("&")
+        redirect_to uri.to_s, allow_other_host: true
+      end
+
+      private
+
+      def prevent_caching
+        response.set_header("Cache-Control", "no-store")
+        response.set_header("Referrer-Policy", "no-referrer")
+      end
+
+      def validate_request!
+        @oauth_request = params.permit(:client_id, :redirect_uri, :response_type, :scope, :state,
+                                       :code_challenge, :code_challenge_method, :resource).to_h.with_indifferent_access
+        @client = OauthClient.find_by(client_id: @oauth_request[:client_id])
+        valid = @client&.redirect_uris&.include?(@oauth_request[:redirect_uri]) &&
+                @oauth_request[:response_type] == "code" && @oauth_request[:code_challenge_method] == "S256" &&
+                @oauth_request[:code_challenge].to_s.match?(/\A[A-Za-z0-9_-]{43}\z/) &&
+                @oauth_request[:scope].to_s.in?(["", "mcp"]) && @oauth_request[:resource] == postnhost.api_v1_mcp_url
+        render plain: "Invalid OAuth authorization request", status: :bad_request unless valid
+      end
+
+      def require_oauth_user!
+        return if user_signed_in?
+
+        session[:oauth_return_to] = postnhost.oauth_authorize_path(@oauth_request)
+        authenticate_user!
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/metadata_controller.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Oauth
+    class MetadataController < PublicController
+      def resource
+        render json: {
+          resource: postnhost.api_v1_mcp_url,
+          authorization_servers: [request.base_url + request.script_name],
+          scopes_supported: ["mcp"], bearer_methods_supported: ["header"]
+        }
+      end
+
+      def server
+        render json: {
+          issuer: request.base_url + request.script_name,
+          authorization_endpoint: postnhost.oauth_authorize_url,
+          token_endpoint: postnhost.oauth_token_url,
+          registration_endpoint: postnhost.oauth_register_url,
+          response_types_supported: ["code"], grant_types_supported: ["authorization_code"],
+          token_endpoint_auth_methods_supported: ["none"],
+          code_challenge_methods_supported: ["S256"], scopes_supported: ["mcp"]
+        }
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/public_controller.rb

@@ -0,0 +1,16 @@
+module Postnhost
+  module Oauth
+    # OAuth protocol endpoints do not use CMS sessions for authentication.
+    # rubocop:disable-next Rails/ApplicationController
+    class PublicController < ActionController::Base
+      skip_forgery_protection
+      before_action :prevent_caching
+
+      private
+
+      def prevent_caching
+        response.set_header("Cache-Control", "no-store")
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/registrations_controller.rb

@@ -0,0 +1,29 @@
+module Postnhost
+  module Oauth
+    class RegistrationsController < PublicController
+      def create
+        unless params[:token_endpoint_auth_method].to_s.in?(["", "none"]) &&
+               supported_grants? &&
+               (params[:response_types].nil? || params[:response_types] == ["code"])
+          render json: { error: "invalid_client_metadata" }, status: :bad_request
+          return
+        end
+
+        client = OauthClient.create!(name: params[:client_name].presence || "MCP client", redirect_uris: params[:redirect_uris])
+        render json: {
+          client_id: client.client_id, client_name: client.name, redirect_uris: client.redirect_uris,
+          token_endpoint_auth_method: "none", grant_types: ["authorization_code"], response_types: ["code"]
+        }, status: :created
+      rescue ActiveRecord::RecordInvalid
+        render json: { error: "invalid_client_metadata" }, status: :bad_request
+      end
+
+      private
+
+      def supported_grants?
+        grants = params[:grant_types] || ["authorization_code"]
+        grants.is_a?(Array) && grants.include?("authorization_code") && (grants - %w[authorization_code refresh_token]).empty?
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/tokens_controller.rb

@@ -0,0 +1,19 @@
+module Postnhost
+  module Oauth
+    class TokensController < PublicController
+      def create
+        unless params[:grant_type] == "authorization_code"
+          render json: { error: "unsupported_grant_type" }, status: :bad_request
+          return
+        end
+
+        secret = OauthGrant.exchange(**%i[code client_id redirect_uri resource code_verifier].index_with { |key| params[key].to_s })
+        if secret
+          render json: { access_token: secret, token_type: "Bearer", scope: "mcp" }
+        else
+          render json: { error: "invalid_grant" }, status: :bad_request
+        end
+      end
+    end
+  end
+end

data/app/controllers/postnhost/pages/translations_controller.rb

@@ -6,15 +6,8 @@ module Postnhost
     def new; end
 
     def create
-      language_ids = params[:language_ids] || []
-
-      language_ids.each do |language_id|
-        Postnhost::Translation::PageVariantJob.perform_later(@page.id, language_id.to_i)
-
-        @page.page_variants.create!(language: Postnhost::Language.find_by(id: language_id.to_i), generating: true)
-      end
-
-      redirect_to page_variants_path(@page)
+      result = Postnhost::Translation::Enqueue.call(record: @page, language_ids: Array(params[:language_ids]).map(&:to_i).uniq)
+      redirect_to page_variants_path(@page), **(result.success? ? {} : { alert: result.errors.to_sentence })
     end
 
     private

data/app/controllers/postnhost/sessions_controller.rb

@@ -9,8 +9,9 @@ module Postnhost
       user = Postnhost::User.find_by(email: session_params[:email].to_s.downcase.strip)
 
       if user&.authenticate(session_params[:password].to_s)
+        oauth_return_to = session[:oauth_return_to]
         sign_in(user)
-        redirect_to articles_path
+        redirect_to oauth_return_to || articles_path
       else
         flash.now[:alert] = "Invalid email or password."
         render :new, status: :unprocessable_content

data/app/models/postnhost/api_token.rb

@@ -0,0 +1,26 @@
+require "digest"
+require "securerandom"
+
+module Postnhost
+  class ApiToken < ApplicationRecord
+    belongs_to :user, class_name: "Postnhost::User"
+    validates :name, :token_digest, presence: true
+    validates :token_digest, uniqueness: true
+
+    def self.issue!(user:, name:, resource: nil)
+      secret = "pnh_#{SecureRandom.urlsafe_base64(32)}"
+      token = create!(user:, name:, resource:, token_digest: Digest::SHA256.hexdigest(secret))
+      [token, secret]
+    end
+
+    def self.authenticate(secret)
+      return if secret.blank?
+
+      find_by(token_digest: Digest::SHA256.hexdigest(secret), revoked_at: nil)
+    end
+
+    def revoke!
+      update!(revoked_at: Time.current)
+    end
+  end
+end

data/app/models/postnhost/oauth_client.rb

@@ -0,0 +1,29 @@
+require "uri"
+
+module Postnhost
+  class OauthClient < ApplicationRecord
+    has_many :oauth_grants, class_name: "Postnhost::OauthGrant", dependent: :destroy
+    has_secure_token :client_id, length: 32
+
+    validates :name, presence: true, length: { maximum: 100 }
+    validate :safe_redirect_uris
+
+    private
+
+    def safe_redirect_uris
+      return if redirect_uris.is_a?(Array) && redirect_uris.size.between?(1, 10) && redirect_uris.all? { |value| safe_redirect_uri?(value) }
+
+      errors.add(:redirect_uris, "must contain HTTPS URLs or HTTP loopback URLs")
+    end
+
+    def safe_redirect_uri?(value)
+      return false unless value.is_a?(String) && value.length <= 2048
+
+      uri = URI.parse(value)
+      uri.host.present? && uri.userinfo.nil? && uri.fragment.nil? &&
+        (uri.scheme == "https" || (uri.scheme == "http" && %w[localhost 127.0.0.1 [::1]].include?(uri.host)))
+    rescue URI::InvalidURIError
+      false
+    end
+  end
+end

data/app/models/postnhost/oauth_grant.rb

@@ -0,0 +1,32 @@
+require "base64"
+require "digest"
+
+module Postnhost
+  class OauthGrant < ApplicationRecord
+    belongs_to :oauth_client, class_name: "Postnhost::OauthClient"
+    belongs_to :user, class_name: "Postnhost::User"
+
+    def self.issue!(**attributes)
+      code = SecureRandom.urlsafe_base64(32)
+      create!(**attributes, code_digest: Digest::SHA256.hexdigest(code), expires_at: 5.minutes.from_now)
+      code
+    end
+
+    def self.exchange(code:, client_id:, redirect_uri:, resource:, code_verifier:)
+      return unless code_verifier.match?(/\A[A-Za-z0-9._~-]{43,128}\z/)
+
+      transaction do
+        grant = lock.find_by(code_digest: Digest::SHA256.hexdigest(code))
+        return unless grant&.expires_at&.future? && grant.oauth_client.client_id == client_id &&
+                      grant.redirect_uri == redirect_uri && grant.resource == resource
+
+        challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+        return unless ActiveSupport::SecurityUtils.secure_compare(grant.code_challenge, challenge)
+
+        token = ApiToken.issue!(user: grant.user, name: grant.oauth_client.name, resource: grant.resource)
+        grant.destroy!
+        token.last
+      end
+    end
+  end
+end

data/app/models/postnhost/user.rb

@@ -5,6 +5,9 @@ module Postnhost
 
     self.table_name = "postnhost_users"
 
+    has_many :api_tokens, class_name: "Postnhost::ApiToken", dependent: :destroy
+    has_many :oauth_grants, class_name: "Postnhost::OauthGrant", dependent: :destroy
+
     has_secure_password
 
     mount_uploader :avatar_file, Postnhost::AvatarUploader

data/app/services/postnhost/api/v1/openapi.rb

@@ -0,0 +1,27 @@
+module Postnhost
+  module Api
+    module V1
+      module Openapi
+        def self.document(server:)
+          { openapi: "3.1.0", info: { title: "PostnHost CMS management API", version: "1" }, servers: [{ url: server }],
+            security: [{ bearerAuth: [] }], components: { securitySchemes: { bearerAuth: { type: "http", scheme: "bearer" } } },
+            paths: Management::Catalog.tools.to_h { |tool| ["/commands/#{tool[:name]}", { post: operation(tool) }] } }
+        end
+
+        def self.operation(tool)
+          { operationId: tool[:name], summary: tool[:description],
+            requestBody: { required: true, content: { "application/json" => { schema: { type: "object", required: ["arguments"], properties: { arguments: tool[:inputSchema] } } } } },
+            responses: {
+              "200" => { description: "Command completed. JSON contains data and errors." },
+              "202" => { description: "Translation queued. Poll the variant's generating field." },
+              "400" => { description: "Invalid arguments." }, "401" => { description: "Invalid bearer token." },
+              "404" => { description: "Record not found in the requested scope." },
+              "409" => { description: "Conflicting data or protected action." },
+              "422" => { description: "Validation or publication failure. Bulk results contain per-record failures." },
+              "503" => { description: "Translation queue unavailable. Data identifies queued work and failed_language_ids to retry." }
+            } }
+        end
+      end
+    end
+  end
+end