postnhost 0.1.1 → 0.2.1

data/app/services/postnhost/management/settings_actions.rb

@@ -0,0 +1,64 @@
+module Postnhost
+  module Management
+    class SettingsActions < BaseService
+      include Postnhost::Settings::NavigationManageable
+
+      def initialize(action:, record:, arguments:)
+        @action = action
+        @record = record
+        @arguments = arguments
+      end
+
+      def call
+        return upload if action.start_with?("upload_")
+
+        if %w[remove_logo remove_og_image].include?(action)
+          field = action == "remove_logo" ? :site_logo : :og_image
+          record.update!(field => nil)
+          return record
+        end
+
+        validate_locale!
+        case action
+        when "get_navigation"
+          @setting = record
+          @selected_navigation_locale_key = arguments.fetch("locale")
+          @default_navigation_locale_key = Language.blog_default&.html_lang || I18n.default_locale.to_s
+          @navigation = record.current_navigation
+          { tree: navigation_tree_for_editor, targets: navigation_target_options }
+        when "replace_navigation"
+          tree = arguments.fetch("tree")
+          record.current_navigation.replace_tree!(tree:, locale_key: arguments.fetch("locale"))
+          { navigation: record.current_navigation.navigation_items.to_a }
+        when "get_translations"
+          Settings::I18nOverrides.editable_translations_for_locale(arguments.fetch("locale"), record.locale_overrides)
+        when "update_translations"
+          overrides = Settings::I18nOverrides.merge_locale_overrides(record.locale_overrides, arguments.fetch("locale"), arguments.fetch("translations"))
+          record.update!(locale_overrides: overrides)
+          record
+        else
+          raise ArgumentError, "Unsupported action"
+        end
+      end
+
+      private
+
+      attr_reader :action, :record, :arguments
+
+      def validate_locale!
+        raise ArgumentError, "Locale must belong to a configured language" unless Language.exists?(html_lang: arguments["locale"])
+      end
+
+      def upload
+        file = Upload.open(arguments.fetch("file"))
+        if action == "upload_image"
+          result = record.upload_inline_image(file)
+          return result[:success] ? success({ url: result[:url] }) : failure(result[:error])
+        end
+        field = { "upload_cover" => :cover_image, "upload_avatar" => :avatar_file, "upload_logo" => :site_logo, "upload_og_image" => :og_image }.fetch(action)
+        record.update!(field => file)
+        { url: record.public_send(field).url }
+      end
+    end
+  end
+end

data/app/services/postnhost/management/upload.rb

@@ -0,0 +1,18 @@
+require "base64"
+require "stringio"
+
+module Postnhost
+  module Management
+    module Upload
+      def self.open(payload)
+        filename = payload.fetch("filename")
+        raise ArgumentError, "Invalid filename" if filename.blank? || filename != File.basename(filename) || filename.include?("\\")
+
+        file = StringIO.new(Base64.strict_decode64(payload.fetch("base64")))
+        file.define_singleton_method(:original_filename) { filename }
+        file.define_singleton_method(:content_type) { payload.fetch("content_type") }
+        file
+      end
+    end
+  end
+end

data/app/services/postnhost/translation/enqueue.rb

@@ -0,0 +1,59 @@
+module Postnhost
+  module Translation
+    class Enqueue < BaseService
+      def initialize(record:, language_ids:)
+        @record = record
+        @language_ids = language_ids
+      end
+
+      def call
+        return success({ variants: [], job_ids: [] }) if language_ids.empty?
+
+        kind = record.class.model_name.element
+        return failure("Publish the source before generating translations") if record.respond_to?(:published?) && !record.published?
+
+        languages = language_ids.map { |id| Language.find(id) }
+        primary_id = record.respond_to?(:language_id) ? record.language_id : Language.blog_default&.id
+        return failure("Cannot translate into the source language") if languages.any? { |language| language.id == primary_id }
+
+        variants = record.class.transaction do
+          languages.map { |language| record.public_send("#{kind}_variants").create!(language:, generating: true) }
+        end
+        enqueue_variants(variants, Translation.const_get("#{kind.camelize}VariantJob", false))
+      rescue ActiveRecord::RecordInvalid => e
+        failure(e.record.errors.full_messages)
+      rescue ActiveRecord::RecordNotFound
+        failure("Language not found", status: :not_found)
+      end
+
+      private
+
+      attr_reader :record, :language_ids
+
+      def enqueue_variants(variants, job_class)
+        jobs = []
+        variants.each do |variant|
+          job = enqueue(job_class, variant)
+          unless job
+            unqueued = variants.drop(jobs.size)
+            unqueued.each(&:destroy!)
+            return ServiceResult.new(
+              value: { variants: variants.take(jobs.size), job_ids: jobs.map(&:job_id), failed_language_ids: unqueued.map(&:language_id) },
+              errors: ["Could not queue all translations. Retry the failed languages."], status: :service_unavailable
+            )
+          end
+          jobs << job
+        end
+        success({ variants:, job_ids: jobs.map(&:job_id) }, status: :accepted)
+      end
+
+      def enqueue(job_class, variant)
+        job = job_class.new(record.id, variant.language_id)
+        job_class.perform_later(job)
+      rescue StandardError => e
+        Rails.logger.error("Postnhost translation enqueue failed (#{e.class})")
+        job if job&.successfully_enqueued?
+      end
+    end
+  end
+end

data/app/views/layouts/postnhost/_sidebar.html.erb

@@ -58,6 +58,13 @@
             <span class="text-sm font-medium">Settings</span>
           <% end %>
 
+          <%= link_to api_tokens_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{controller_name == 'api_tokens' ? 'bg-white text-gray-900' : ''}" do %>
+            <div class="flex-shrink-0 <%= controller_name == 'api_tokens' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700' %>">
+              <%= icon("code-bracket", css_class: "h-5 w-5") %>
+            </div>
+            <span class="text-sm font-medium">API &amp; MCP</span>
+          <% end %>
+
           <%= link_to edit_template_path, class: "group flex items-center space-x-3 text-gray-700 hover:text-gray-900 hover:bg-white font-medium px-3 py-2.5 rounded-xl transition-all duration-200 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'bg-white text-gray-900' : ''}" do %>
             <div class="flex-shrink-0 #{current_page?(edit_template_path) || controller_name == 'templates' ? 'text-gray-900' : 'text-gray-500 group-hover:text-gray-700'}">
               <%= icon("eye", css_class: "h-5 w-5") %>

data/app/views/postnhost/api_tokens/index.html.erb

@@ -0,0 +1,92 @@
+<% content_for :title, "API & MCP" %>
+<% content_for :head do %>
+  <meta name="turbo-cache-control" content="no-cache">
+<% end %>
+
+<div class="space-y-8">
+  <%= render "postnhost/shared/elements/page_header", title: "API & MCP access", description: "Connect agents and integrations to your CMS." %>
+
+  <% if @secret.present? %>
+    <section class="rounded-2xl border border-green-200 bg-green-50 p-6 space-y-3" aria-label="New token">
+      <div class="flex items-center gap-2 text-green-800">
+        <%= icon("check-circle", css_class: "h-5 w-5") %>
+        <h2 class="font-medium">Token created</h2>
+      </div>
+      <p class="text-sm text-green-800">Copy this token now. It is shown only once.</p>
+      <code class="block rounded-xl border border-green-200 bg-white p-4 text-sm text-gray-900 break-all select-all"><%= @secret %></code>
+    </section>
+  <% end %>
+
+  <div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
+    <section class="lg:col-span-2 <%= form_card_classes %>" aria-labelledby="create-token-title">
+      <div>
+        <h2 id="create-token-title" class="text-lg font-medium text-gray-900">Create an access token</h2>
+        <p class="mt-2 text-sm text-gray-500">Tokens grant your CMS permissions. Give each integration its own token so you can revoke access separately.</p>
+      </div>
+      <%= form_with scope: :api_token, url: api_tokens_path, data: { turbo: false }, class: "space-y-6" do |form| %>
+        <div>
+          <%= form.label :name, class: form_label_classes %>
+          <%= form.text_field :name, required: true, placeholder: "e.g. Writing agent", class: form_input_classes %>
+        </div>
+        <%= form.submit "Create token", class: button_classes %>
+      <% end %>
+    </section>
+
+    <section class="<%= form_card_classes %>" aria-labelledby="connection-title">
+      <div>
+        <h2 id="connection-title" class="text-lg font-medium text-gray-900">Connection details</h2>
+        <p class="mt-2 text-sm text-gray-500">Connect an MCP client by signing in through your browser, or use a token for the management API.</p>
+      </div>
+      <dl class="space-y-5">
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Management API · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_commands_url %></code></dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">MCP · v1</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_mcp_url %></code></dd>
+          <dd class="mt-2 text-xs text-gray-500">Connect using Streamable HTTP and OAuth. Access remains active until revoked.</dd>
+        </div>
+        <div>
+          <dt class="text-sm font-medium text-gray-700">Authorization header</dt>
+          <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code>Bearer &lt;your-token&gt;</code></dd>
+        </div>
+      </dl>
+    </section>
+  </div>
+
+  <section class="space-y-4" aria-labelledby="access-tokens-title">
+    <div>
+      <h2 id="access-tokens-title" class="text-lg font-medium text-gray-900">Access tokens</h2>
+      <p class="mt-2 text-sm text-gray-500">Manage the tokens you have created for your account.</p>
+    </div>
+    <% if @api_tokens.any? %>
+      <%= render "postnhost/shared/elements/table_container", headers: [
+        { text: "Token", class: "col-span-8" },
+        { text: "Actions", class: "col-span-4 text-right" }
+      ] do %>
+        <% @api_tokens.each do |token| %>
+          <div class="<%= table_row_classes %>">
+            <div class="grid grid-cols-12 gap-4 items-center">
+              <div class="col-span-8 min-w-0 space-y-2">
+                <p class="font-medium text-gray-900 break-words"><%= token.name %></p>
+                <% if token.revoked_at? %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :gray) %>">Revoked</span>
+                <% else %>
+                  <span class="inline-flex <%= stats_badge_classes(variant: :green) %>">Active</span>
+                <% end %>
+              </div>
+              <div class="col-span-4 flex justify-end">
+                <% unless token.revoked_at? %>
+                  <%= button_to "Revoke", api_token_path(token), method: :delete, class: button_classes(variant: :danger) %>
+                <% end %>
+              </div>
+            </div>
+          </div>
+        <% end %>
+      <% end %>
+    <% else %>
+      <%= render "postnhost/shared/elements/empty_state", icon: "code-bracket", title: "No access tokens", description: "Create a token above to connect your first agent or integration." %>
+    <% end %>
+  </section>
+</div>

data/app/views/postnhost/oauth/authorizations/new.html.erb

@@ -0,0 +1,18 @@
+<% content_for :title, "Connect MCP" %>
+
+<section class="max-w-xl space-y-6" aria-labelledby="oauth-title">
+  <h1 id="oauth-title" class="text-xl font-medium text-gray-900">Connect <%= @client.name %>?</h1>
+  <p class="text-gray-700">This application will be able to read and manage your CMS content and settings, including publishing and deleting content.</p>
+  <p class="text-sm text-gray-500">Access remains active until you revoke it in API &amp; MCP.</p>
+  <dl class="space-y-2">
+    <dt class="text-sm font-medium text-gray-700">Application callback</dt>
+    <dd class="text-sm text-gray-700 break-all"><%= @oauth_request[:redirect_uri] %></dd>
+  </dl>
+  <%= form_with url: oauth_authorize_path, data: { turbo: false }, class: "flex gap-3" do |form| %>
+    <% @oauth_request.each do |key, value| %>
+      <%= hidden_field_tag key, value %>
+    <% end %>
+    <%= form.button "Connect", name: "decision", value: "approve", class: button_classes %>
+    <%= form.button "Cancel", name: "decision", value: "deny", class: button_classes(variant: :secondary) %>
+  <% end %>
+</section>

data/config/routes.rb

@@ -33,6 +33,16 @@ Postnhost::Engine.routes.draw do
   end
 
   # Admin routes
+  namespace :oauth do
+    get "resource_metadata", to: "metadata#resource"
+    get "server_metadata", to: "metadata#server"
+    get "authorize", to: "authorizations#new"
+    post "authorize", to: "authorizations#create"
+    post "register", to: "registrations#create"
+    post "token", to: "tokens#create"
+  end
+
+  resources :api_tokens, only: %i[index create destroy]
   resource :onboarding, only: %i[show update], controller: "onboarding"
   resource :session, only: %i[new create destroy], controller: "sessions"
   resources :users, only: %i[index new create edit update destroy] do
@@ -106,6 +116,17 @@ Postnhost::Engine.routes.draw do
     resources :site_scripts, only: %i[create update destroy], controller: "settings/site_scripts"
   end
 
+  # Management API and MCP
+  namespace :api do
+    namespace :v1 do
+      get "openapi", to: "commands#schema", as: :openapi
+      get "commands", to: "commands#index", as: :commands
+      post "commands/:command", to: "commands#create", as: :command
+      post "mcp", to: "mcp#create", as: :mcp
+      match "mcp", to: "mcp#unsupported", via: %i[get delete]
+    end
+  end
+
   # Public static pages from host app views:
   # app/views/postnhost/static_pages/*.html.erb
   get "/:slug", to: "public/static_pages#show", as: :public_static_page

data/db/migrate/20261008120000_create_api_tokens.rb

@@ -0,0 +1,12 @@
+class CreateApiTokens < ActiveRecord::Migration[7.2]
+  def change
+    create_table :postnhost_api_tokens do |t|
+      t.references :user, null: false, foreign_key: { to_table: :postnhost_users }
+      t.string :name, null: false
+      t.string :token_digest, null: false
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :postnhost_api_tokens, :token_digest, unique: true
+  end
+end

data/db/migrate/20261025120000_add_mcp_oauth.rb

@@ -0,0 +1,23 @@
+class AddMcpOauth < ActiveRecord::Migration[7.2]
+  def change
+    create_table :postnhost_oauth_clients do |t|
+      t.string :client_id, null: false
+      t.string :name, null: false
+      t.json :redirect_uris, null: false
+      t.timestamps
+    end
+    add_index :postnhost_oauth_clients, :client_id, unique: true
+
+    create_table :postnhost_oauth_grants do |t|
+      t.references :oauth_client, null: false, foreign_key: { to_table: :postnhost_oauth_clients }
+      t.references :user, null: false, foreign_key: { to_table: :postnhost_users }
+      t.string :code_digest, null: false
+      t.string :code_challenge, null: false
+      t.string :redirect_uri, null: false
+      t.string :resource, null: false
+      t.datetime :expires_at, null: false
+    end
+    add_index :postnhost_oauth_grants, :code_digest, unique: true
+    add_column :postnhost_api_tokens, :resource, :string
+  end
+end

data/lib/postnhost/engine.rb

@@ -1,7 +1,14 @@
+require_relative "oauth_discovery"
+
 module Postnhost
   class Engine < ::Rails::Engine
     isolate_namespace Postnhost
 
+    initializer "postnhost.oauth" do |app|
+      app.middleware.use Postnhost::OauthDiscovery
+      app.config.filter_parameters += %i[code code_verifier access_token]
+    end
+
     # Initialize configuration before other initializers
     initializer "postnhost.configuration", before: :load_config_initializers do
       Postnhost.configure

data/lib/postnhost/oauth_discovery.rb

@@ -0,0 +1,22 @@
+module Postnhost
+  # Well-known discovery lives at the origin even when the engine is mounted at /blog.
+  class OauthDiscovery
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      path = env["PATH_INFO"]
+      if env["REQUEST_METHOD"] == "GET" && path.match?(%r{\A/\.well-known/oauth-authorization-server(?:/.*)?\z})
+        status, headers, body = @app.call(env)
+        return [status, headers, body] unless status == 404
+
+        body.close if body.respond_to?(:close)
+        mount = path.delete_prefix("/.well-known/oauth-authorization-server")
+        return @app.call(env.merge("PATH_INFO" => "#{mount}/oauth/server_metadata"))
+      end
+
+      @app.call(env)
+    end
+  end
+end

data/lib/postnhost/version.rb

@@ -1,3 +1,3 @@
 module Postnhost
-  VERSION = "0.1.1"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: postnhost
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.1
 platform: ruby
 authors:
 - Kirill Shevchenko
@@ -323,6 +323,10 @@ files:
 - app/controllers/concerns/postnhost/settings/navigation_manageable.rb
 - app/controllers/concerns/postnhost/settings/schema_manageable.rb
 - app/controllers/concerns/postnhost/users/schema_manageable.rb
+- app/controllers/postnhost/api/base_controller.rb
+- app/controllers/postnhost/api/v1/commands_controller.rb
+- app/controllers/postnhost/api/v1/mcp_controller.rb
+- app/controllers/postnhost/api_tokens_controller.rb
 - app/controllers/postnhost/application_controller.rb
 - app/controllers/postnhost/article_variants_controller.rb
 - app/controllers/postnhost/articles/cover_images_controller.rb
@@ -333,6 +337,12 @@ files:
 - app/controllers/postnhost/categories_controller.rb
 - app/controllers/postnhost/category_variants_controller.rb
 - app/controllers/postnhost/languages_controller.rb
+- app/controllers/postnhost/management_preview_controller.rb
+- app/controllers/postnhost/oauth/authorizations_controller.rb
+- app/controllers/postnhost/oauth/metadata_controller.rb
+- app/controllers/postnhost/oauth/public_controller.rb
+- app/controllers/postnhost/oauth/registrations_controller.rb
+- app/controllers/postnhost/oauth/tokens_controller.rb
 - app/controllers/postnhost/onboarding_controller.rb
 - app/controllers/postnhost/page_variants_controller.rb
 - app/controllers/postnhost/pages/images_controller.rb
@@ -399,6 +409,7 @@ files:
 - app/models/concerns/postnhost/primary_language_guard.rb
 - app/models/concerns/postnhost/public_revision_touch.rb
 - app/models/concerns/postnhost/schema_localizable.rb
+- app/models/postnhost/api_token.rb
 - app/models/postnhost/application_record.rb
 - app/models/postnhost/article.rb
 - app/models/postnhost/article_author.rb
@@ -410,6 +421,8 @@ files:
 - app/models/postnhost/language.rb
 - app/models/postnhost/navigation.rb
 - app/models/postnhost/navigation_item.rb
+- app/models/postnhost/oauth_client.rb
+- app/models/postnhost/oauth_grant.rb
 - app/models/postnhost/page.rb
 - app/models/postnhost/page_variant.rb
 - app/models/postnhost/public_site_revision.rb
@@ -426,9 +439,21 @@ files:
 - app/models/postnhost/template.rb
 - app/models/postnhost/user.rb
 - app/models/postnhost/version.rb
+- app/services/postnhost/api/v1/openapi.rb
 - app/services/postnhost/base_service.rb
 - app/services/postnhost/constraints/public_locale_constraint.rb
 - app/services/postnhost/constraints/public_route_constraint.rb
+- app/services/postnhost/management/catalog.rb
+- app/services/postnhost/management/command.rb
+- app/services/postnhost/management/content_actions.rb
+- app/services/postnhost/management/input.rb
+- app/services/postnhost/management/mcp.rb
+- app/services/postnhost/management/preview.rb
+- app/services/postnhost/management/resources.rb
+- app/services/postnhost/management/schema_fields.rb
+- app/services/postnhost/management/serializer.rb
+- app/services/postnhost/management/settings_actions.rb
+- app/services/postnhost/management/upload.rb
 - app/services/postnhost/onboarding/step_processor.rb
 - app/services/postnhost/onboarding/steps/base.rb
 - app/services/postnhost/onboarding/steps/choose_languages.rb
@@ -465,6 +490,7 @@ files:
 - app/services/postnhost/translation/article_variant_translator.rb
 - app/services/postnhost/translation/category_variant_translator.rb
 - app/services/postnhost/translation/content_translator.rb
+- app/services/postnhost/translation/enqueue.rb
 - app/services/postnhost/translation/openai_llm_client.rb
 - app/services/postnhost/translation/page_variant_translator.rb
 - app/uploaders/base_uploader.rb
@@ -486,6 +512,7 @@ files:
 - app/views/layouts/postnhost/public_header/_dashboard_sign_in.html.erb
 - app/views/layouts/postnhost/public_header/_language_switcher.html.erb
 - app/views/layouts/postnhost/public_header/_logo.html.erb
+- app/views/postnhost/api_tokens/index.html.erb
 - app/views/postnhost/article_variants/_variants_list.html.erb
 - app/views/postnhost/article_variants/edit.html.erb
 - app/views/postnhost/article_variants/index.html.erb
@@ -517,6 +544,7 @@ files:
 - app/views/postnhost/languages/index.html.erb
 - app/views/postnhost/languages/new.html.erb
 - app/views/postnhost/languages/show.html.erb
+- app/views/postnhost/oauth/authorizations/new.html.erb
 - app/views/postnhost/onboarding/_post_install_checklist.html.erb
 - app/views/postnhost/onboarding/_step_1.html.erb
 - app/views/postnhost/onboarding/_step_2.html.erb
@@ -669,6 +697,8 @@ files:
 - db/migrate/20260528000002_create_page_variants.rb
 - db/migrate/20260709090000_create_snapshots.rb
 - db/migrate/20260726130000_create_site_scripts.rb
+- db/migrate/20261008120000_create_api_tokens.rb
+- db/migrate/20261025120000_add_mcp_oauth.rb
 - lib/generators/postnhost/install/install_generator.rb
 - lib/generators/postnhost/install/templates/carrierwave.rb
 - lib/generators/postnhost/install/templates/postnhost.rb
@@ -683,6 +713,7 @@ files:
 - lib/postnhost/css_build.rb
 - lib/postnhost/css_scope.rb
 - lib/postnhost/engine.rb
+- lib/postnhost/oauth_discovery.rb
 - lib/postnhost/sample_data.rb
 - lib/postnhost/settings/i18n_overrides.rb
 - lib/postnhost/settings/i18n_patch.rb