quick_admin 0.1.0

data/app/controllers/quick_admin/dashboard_controller.rb

@@ -0,0 +1,20 @@
+module QuickAdmin
+  class DashboardController < ApplicationController
+    def index
+      @resources_count = {}
+      
+      QuickAdmin.resources.each do |name, resource|
+        begin
+          if resource.model_class
+            @resources_count[name] = resource.model_class.count
+          else
+            @resources_count[name] = 0
+          end
+        rescue => e
+          @resources_count[name] = 0
+          Rails.logger.warn "QuickAdmin: Could not count #{name}: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/app/controllers/quick_admin/resources_controller.rb

@@ -0,0 +1,229 @@
+require 'ostruct'
+
+module QuickAdmin
+  class ResourcesController < ApplicationController
+    before_action :set_resource_config
+    before_action :set_resource, only: %i[show edit update destroy attachment]
+
+    def index
+      @pagy, @resources = pagy(filtered_resources, items: QuickAdmin.config.per_page)
+      
+      respond_to do |format|
+        format.html
+        if params[:search].present? || params[:filter].present?
+          format.turbo_stream
+          format.any { render :index, formats: :turbo_stream }
+        end
+      end
+    end
+
+    def attachment
+      field = params[:field]
+      attachment_ref = @resource.public_send(field) if @resource.respond_to?(field)
+      @blob = if params[:signed_id].present?
+                begin
+                  ActiveStorage::Blob.find_signed(params[:signed_id])
+                rescue ActiveSupport::MessageVerifier::InvalidSignature
+                  nil
+                end
+              else
+                attachment_ref&.blob
+              end
+
+      respond_to do |format|
+        format.html { render :attachment }
+        format.turbo_stream { render :attachment }
+      end
+    rescue => e
+      Rails.logger.error "Attachment error: #{e.message}"
+      @blob = nil
+      respond_to do |format|
+        format.html { render :attachment }
+        format.turbo_stream { render :attachment }
+      end
+    end
+
+    def show; end
+
+    def new
+      @resource = resource_class.new
+    end
+
+    def create
+      @resource = resource_class.new(resource_params)
+      
+      if @resource.save
+        respond_to do |format|
+          format.html { redirect_to quick_admin.resources_path(resource_name), notice: 'Record created successfully.' }
+          format.turbo_stream { refresh_resources_list }
+          format.any { refresh_resources_list; render :create, formats: :turbo_stream }
+        end
+      else
+        respond_to do |format|
+          format.html { render :new }
+          format.turbo_stream { render :new }
+        end
+      end
+    end
+
+    def edit; end
+
+    def update
+      if @resource.update(resource_params)
+        respond_to do |format|
+          format.html { redirect_to quick_admin.resources_path(resource_name), notice: 'Record updated successfully.' }
+          format.turbo_stream { refresh_resources_list }
+          format.any { refresh_resources_list; render :update, formats: :turbo_stream }
+        end
+      else
+        respond_to do |format|
+          format.html { render :edit }
+          format.turbo_stream { render :edit }
+        end
+      end
+    end
+
+    def destroy
+      @resource.destroy
+      respond_to do |format|
+        format.html { redirect_to quick_admin.resources_path(resource_name), notice: 'Record deleted successfully.' }
+        format.turbo_stream { refresh_resources_list }
+        format.any { refresh_resources_list; render :destroy, formats: :turbo_stream }
+      end
+    end
+
+    def bulk_destroy
+      ids = params[:ids] || []
+      resource_class.where(id: ids).destroy_all
+      
+      respond_to do |format|
+        format.html { redirect_to quick_admin.resources_path(resource_name), notice: "#{ids.count} records deleted successfully." }
+        format.turbo_stream { refresh_resources_list }
+        format.any { refresh_resources_list; render :bulk_destroy, formats: :turbo_stream }
+      end
+    end
+
+    private
+
+    def set_resource_config
+      @resource_config = QuickAdmin.resources[resource_name]
+      return if @resource_config&.model_class
+
+      redirect_to quick_admin.root_path, alert: "Resource '#{resource_name}' not found or model not available"
+    end
+
+    def set_resource
+      @resource = resource_class.find(params[:id])
+    end
+
+    def resource_name
+      params[:resource_name] || params[:id]
+    end
+
+    def resource_class
+      @resource_config.model_class
+    end
+
+    # Applies search, filter, and sort parameters to the resource collection.
+    # All user inputs are properly sanitized to prevent SQL injection.
+    #
+    # @return [ActiveRecord::Relation] filtered and sorted collection
+    def filtered_resources
+      resources = resource_class.all
+      
+      # Apply search - uses parameterized queries to prevent SQL injection
+      if params[:search].present? && @resource_config.searchable_fields.any?
+        search_term = "%#{params[:search].to_s.downcase}%"
+        # Quote column names to prevent SQL injection
+        quote_col = resource_class.connection.method(:quote_column_name)
+        search_sql = @resource_config.searchable_fields.map do |field|
+          "LOWER(#{quote_col.call(field)}) LIKE :search"
+        end.join(' OR ')
+        resources = resources.where(search_sql, search: search_term)
+      end
+      
+      # Apply filters
+      if params[:filter].present?
+        params[:filter].each do |field, value|
+          next if value.blank?
+
+          column = resource_class.columns_hash[field]
+          if column
+            case column.type
+            when :boolean
+              boolean_value = value == 'true'
+              resources = resources.where(field => boolean_value)
+            when :date, :datetime, :timestamp
+              begin
+                day = Date.parse(value)
+              rescue ArgumentError
+                day = nil
+              end
+              next unless day
+              if column.type == :date
+                resources = resources.where(field => day)
+              else
+                # filter by whole day for datetime/timestamp
+                resources = resources.where(field => day.beginning_of_day..day.end_of_day)
+              end
+            else
+              resources = resources.where(field => value)
+            end
+          else
+            resources = resources.where(field => value)
+          end
+        end
+      end
+      
+      # Apply sorting
+      if params[:sort].present? && @resource_config.fields.include?(params[:sort])
+        direction = params[:direction] == 'desc' ? 'desc' : 'asc'
+        # Sanitize column name to prevent SQL injection
+        sort_column = resource_class.connection.quote_column_name(params[:sort])
+        resources = resources.order(Arel.sql("#{sort_column} #{direction}"))
+      else
+        resources = resources.order(:id)
+      end
+      
+      resources
+    end
+
+    # Returns strong parameters for the resource.
+    # Only allows whitelisted fields specified in resource configuration.
+    # Falls back to all configured fields if no editable fields are specified.
+    #
+    # @return [ActionController::Parameters] permitted parameters
+    def resource_params
+      permitted_fields = @resource_config.editable_fields
+      permitted_fields = @resource_config.fields if permitted_fields.empty?
+      
+      params.require(resource_name.singularize.to_sym).permit(permitted_fields)
+    end
+
+    def refresh_resources_list
+      @pagy, @resources = pagy(filtered_resources, items: QuickAdmin.config.per_page)
+    end
+
+    def pagy(collection, items:)
+      # Simple pagination implementation
+      page = [params.fetch(:page, 1).to_i, 1].max
+      offset = (page - 1) * items
+      
+      total_count = collection.count
+      total_pages = (total_count.to_f / items).ceil
+      
+      paginated_collection = collection.limit(items).offset(offset)
+      
+      pagy_object = OpenStruct.new(
+        page: page,
+        items: items,
+        count: total_count,
+        pages: total_pages,
+        prev: page > 1 ? page - 1 : nil,
+        next: page < total_pages ? page + 1 : nil
+      )
+      
+      [pagy_object, paginated_collection]
+    end
+  end
+end

data/app/helpers/quick_admin/application_helper.rb

@@ -0,0 +1,141 @@
+module QuickAdmin
+  module ApplicationHelper
+    def display_field_value(resource, field)
+      value = resource.send(field)
+      
+      case value
+      when NilClass
+        content_tag(:span, "—", class: "null-value")
+      when TrueClass, FalseClass
+        content_tag(:span, value ? "Yes" : "No", class: "boolean-value #{value}")
+      when Time, DateTime
+        value.strftime("%Y-%m-%d %H:%M")
+      when Date
+        value.strftime("%Y-%m-%d")
+      when ActiveStorage::Attached::One
+        if value.attached?
+          blob = value.blob
+          if value.image?
+            thumb = image_tag(main_app.rails_blob_path(blob, only_path: true), class: "thumbnail", size: "50x50")
+            link_to(thumb, quick_admin.resource_attachment_path(resource_name, resource.id, field, blob.signed_id), data: { turbo_frame: "modal" })
+          else
+            link_to(blob.filename, main_app.rails_blob_path(blob, only_path: true), target: "_blank", class: "file-link")
+          end
+        else
+          content_tag(:span, "No file", class: "null-value")
+        end
+      when ActiveStorage::Attached::Many
+        if value.attached?
+          content_tag(:div, class: "attachments") do
+            value.map do |attachment|
+              blob = attachment.blob
+              if attachment.image?
+                thumb = image_tag(main_app.rails_blob_path(blob, only_path: true), class: "thumbnail", size: "50x50")
+                link_to(thumb, quick_admin.resource_attachment_path(resource_name, resource.id, field, blob.signed_id), data: { turbo_frame: "modal" })
+              else
+                link_to(blob.filename, main_app.rails_blob_path(blob, only_path: true), target: "_blank", class: "file-link")
+              end
+            end.join(" ").html_safe
+          end
+        else
+          content_tag(:span, "No files", class: "null-value")
+        end
+      when String
+        if value.length > 100
+          content_tag(:div, class: "truncated-text") do
+            content_tag(:span, truncate(value, length: 100)) +
+            content_tag(:button, "Show more", 
+                       class: "btn btn-link btn-sm", 
+                       data: { action: "click->text-expander#toggle" })
+          end
+        else
+          simple_format(value)
+        end
+      else
+        value.to_s
+      end
+    end
+
+    def render_form_field(form, resource, field)
+      column = resource.class.columns_hash[field]
+      
+      case column&.type
+      when :boolean
+        content_tag(:div, class: "form-check") do
+          form.check_box(field, class: "form-check-input") +
+          form.label(field, field.humanize, class: "form-check-label")
+        end
+      when :text
+        if QuickAdmin.config.trix_enabled? && QuickAdmin.config.text_editor == :trix
+          form.rich_text_area(field, class: "form-control")
+        else
+          form.text_area(field, class: "form-control", rows: 4)
+        end
+      when :date
+        form.date_field(field, class: "form-control")
+      when :datetime, :timestamp
+        form.datetime_local_field(field, class: "form-control")
+      when :integer, :bigint
+        form.number_field(field, class: "form-control")
+      when :decimal, :float
+        form.number_field(field, step: :any, class: "form-control")
+      else
+        # Check if it's a file field (Active Storage)
+        if resource.class.reflect_on_attachment(field)
+          if resource.class.reflect_on_attachment(field).macro == :has_many_attached
+            form.file_field(field, multiple: true, class: "form-control", accept: file_accept_types)
+          else
+            form.file_field(field, class: "form-control", accept: file_accept_types)
+          end
+        else
+          form.text_field(field, class: "form-control")
+        end
+      end
+    end
+
+    def filter_options_for_field(model_class, field)
+      return [] unless model_class.respond_to?(:column_names)
+      
+      column = model_class.columns_hash[field]
+      case column&.type
+      when :boolean
+        [['True', 'true'], ['False', 'false']]
+      when :string
+        model_class.distinct.pluck(field).compact.uniq.map { |v| [v.to_s, v.to_s] }
+      when :date, :datetime, :timestamp
+        dates = model_class.where.not(field => nil).order(field => :desc).limit(200).pluck(field)
+        days = dates.map { |d| d.to_date }.uniq.first(10)
+        days.map { |day| [day.strftime('%Y-%m-%d'), day.strftime('%Y-%m-%d')] }
+      else
+        values = model_class.distinct.pluck(field).compact.uniq
+        values.map { |v| [v.to_s, v.to_s] }
+      end
+    rescue
+      []
+    end
+
+    def sort_direction(field)
+      if params[:sort] == field && params[:direction] == 'asc'
+        'desc'
+      else
+        'asc'
+      end
+    end
+
+    def file_accept_types
+      "image/*,application/pdf,.doc,.docx,.txt"
+    end
+
+    def resource_name
+      params[:resource_name] || params[:id]
+    end
+
+    def current_resource_name
+      resource_name
+    end
+
+    def current_resource_config
+      @resource_config
+    end
+  end
+end

data/app/views/layouts/quick_admin/application.html.erb

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title><%= QuickAdmin.config.app_name %></title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    
+    <%= stylesheet_link_tag "quick_admin/application", "data-turbo-track": "reload" %>
+    <%= javascript_importmap_tags if respond_to?(:javascript_importmap_tags) %>
+    <%= javascript_include_tag "quick_admin/application", "data-turbo-track": "reload", defer: true %>
+  </head>
+
+  <body>
+    <div class="quick-admin-container">
+      <nav class="quick-admin-nav">
+        <div class="nav-header">
+          <%= link_to QuickAdmin.config.app_name, quick_admin.root_path, class: "nav-brand" %>
+        </div>
+        
+        <ul class="nav-menu">
+          <li><%= link_to "Dashboard", quick_admin.root_path, class: "nav-link" %></li>
+          <% @quick_admin_resources.each do |name, resource| %>
+            <li><%= link_to resource.display_name, quick_admin.resources_path(name), class: "nav-link" %></li>
+          <% end %>
+        </ul>
+      </nav>
+
+      <main class="quick-admin-main">
+        <% flash.each do |type, message| %>
+          <div class="alert alert-<%= type == 'notice' ? 'success' : 'danger' %>" data-auto-dismiss="true">
+            <%= message %>
+            <button type="button" class="alert-close">&times;</button>
+          </div>
+        <% end %>
+
+        <%= yield %>
+      </main>
+    </div>
+  </body>
+</html>

data/app/views/quick_admin/dashboard/index.html.erb

@@ -0,0 +1,36 @@
+<div class="dashboard">
+  <h1>Dashboard</h1>
+  
+  <div class="dashboard-stats">
+    <% @resources_count.each do |name, count| %>
+      <% resource = QuickAdmin.resources[name] %>
+      <div class="stat-card">
+        <h3><%= resource.display_name %></h3>
+        <div class="stat-number"><%= count %></div>
+        <div class="stat-actions">
+          <%= link_to "View All", quick_admin.resources_path(name), class: "btn btn-primary" %>
+          <%= link_to "Add New", quick_admin.new_resource_path(name), class: "btn btn-secondary" %>
+        </div>
+      </div>
+    <% end %>
+  </div>
+
+  <% if @resources_count.empty? %>
+    <div class="empty-state">
+      <h2>No Resources Configured</h2>
+      <p>Configure your admin resources in your Rails application to get started.</p>
+      <pre class="code-example">
+# config/initializers/quick_admin.rb
+QuickAdmin.configure do |config|
+  config.mount_path = '/admin'
+end
+
+QuickAdmin.resource :user do |r|
+  r.fields :name, :email, :created_at
+  r.searchable :name, :email
+  r.editable :name, :email
+end
+      </pre>
+    </div>
+  <% end %>
+</div>

data/app/views/quick_admin/resources/_form.html.erb

@@ -0,0 +1,39 @@
+<% 
+  # Handle resource_name parameter
+  resource_name_param = defined?(resource_name) ? resource_name : @resource_config.model_name
+%>
+
+<%= form_with model: [QuickAdmin::Engine, resource_name_param.singularize.to_sym, resource], 
+              url: resource.persisted? ? quick_admin.resource_path(resource_name_param, resource) : quick_admin.resources_path(resource_name_param),
+              method: resource.persisted? ? :patch : :post,
+              local: false,
+              class: "resource-form" do |form| %>
+  
+  <% if resource.errors.any? %>
+    <div class="form-errors">
+      <h4><%= pluralize(resource.errors.count, "error") %> prohibited this record from being saved:</h4>
+      <ul>
+        <% resource.errors.full_messages.each do |message| %>
+          <li><%= message %></li>
+        <% end %>
+      </ul>
+    </div>
+  <% end %>
+
+  <% editable_fields = @resource_config.editable_fields.any? ? @resource_config.editable_fields : @resource_config.fields %>
+  <% editable_fields.each do |field| %>
+    <% column = resource.class.columns_hash[field] %>
+    <div class="form-group">
+      <% unless column&.type == :boolean %>
+        <%= form.label field, field.humanize, class: "form-label" %>
+      <% end %>
+      <%= render_form_field(form, resource, field) %>
+    </div>
+  <% end %>
+
+  <div class="form-actions">
+    <%= form.submit resource.persisted? ? "Update #{@resource_config.model_name.singularize.humanize}" : "Create #{@resource_config.model_name.singularize.humanize}", 
+                    class: "btn btn-primary" %>
+    <button type="button" class="btn btn-secondary" onclick="document.getElementById('modal').innerHTML = ''; document.body.style.overflow = '';">Cancel</button>
+  </div>
+<% end %>

data/app/views/quick_admin/resources/_pagination.html.erb

@@ -0,0 +1,29 @@
+<div class="pagination-wrapper">
+  <div class="pagination-info">
+    Showing <%= (@pagy.page - 1) * @pagy.items + 1 %> to 
+    <%= [@pagy.page * @pagy.items, @pagy.count].min %> of 
+    <%= @pagy.count %> results
+  </div>
+  
+  <% if @pagy.pages > 1 %>
+    <nav class="pagination-nav">
+      <% if @pagy.prev %>
+        <%= link_to "← Previous", 
+                    quick_admin.resources_path(resource_name, page: @pagy.prev, **request.query_parameters.except('page')), 
+                    class: "pagination-link",
+                    data: { turbo_frame: "resources_list" } %>
+      <% end %>
+      
+      <span class="pagination-current">
+        Page <%= @pagy.page %> of <%= @pagy.pages %>
+      </span>
+      
+      <% if @pagy.next %>
+        <%= link_to "Next →", 
+                    quick_admin.resources_path(resource_name, page: @pagy.next, **request.query_parameters.except('page')), 
+                    class: "pagination-link",
+                    data: { turbo_frame: "resources_list" } %>
+      <% end %>
+    </nav>
+  <% end %>
+</div>

data/app/views/quick_admin/resources/_resource_row.html.erb

@@ -0,0 +1,32 @@
+<% 
+  # Handle resource_name parameter
+  resource_name_param = defined?(resource_name) ? resource_name : params[:resource_name]
+%>
+
+<tr class="resource-row" id="resource_<%= resource.id %>">
+  <td>
+    <input type="checkbox" name="ids[]" value="<%= resource.id %>" 
+           data-bulk-actions="item">
+  </td>
+  <% @resource_config.fields.each do |field| %>
+    <td>
+      <%= display_field_value(resource, field) %>
+    </td>
+  <% end %>
+  <td class="actions">
+    <%= link_to "View", quick_admin.resource_path(resource_name_param, resource), 
+                class: "btn btn-sm btn-info",
+                data: { turbo_frame: "modal" } %>
+    <%= link_to "Edit", quick_admin.edit_resource_path(resource_name_param, resource), 
+                class: "btn btn-sm btn-warning",
+                data: { turbo_frame: "modal" } %>
+    <%= link_to "Delete", quick_admin.resource_path(resource_name_param, resource),
+                class: "btn btn-sm btn-danger",
+                data: {
+                  turbo_method: :delete,
+                  turbo_confirm: "Are you sure?",
+                  confirm: "Are you sure?",
+                  turbo_frame: "_top"
+                } %>
+  </td>
+</tr>

data/app/views/quick_admin/resources/_resources_list.html.erb

@@ -0,0 +1,58 @@
+<% 
+  # Set local variables to instance variables if they're available
+  resource_config = @resource_config
+  resource_name_param = defined?(resource_name) ? resource_name : params[:resource_name]
+%>
+
+<div class="table-container">
+  <% if resources.any? %>
+    <%= form_with url: quick_admin.bulk_destroy_resources_path(resource_name_param), 
+                  method: :delete, local: false, 
+                  data: { bulk_actions: "form", turbo_confirm: "Are you sure?" },
+                  class: "bulk-form" do |f| %>
+      
+      <div class="bulk-actions">
+        <label class="bulk-select">
+          <input type="checkbox" data-bulk-actions="toggle-all">
+          Select All
+        </label>
+        <button type="submit" class="btn btn-danger" data-bulk-actions="submit" disabled>
+          Delete Selected
+        </button>
+      </div>
+
+      <table class="resources-table">
+        <thead>
+          <tr>
+            <th></th>
+            <% resource_config.fields.each do |field| %>
+              <th>
+                <%= link_to field.humanize, 
+                            quick_admin.resources_path(resource_name_param, sort: field, direction: sort_direction(field)),
+                            data: { turbo_frame: "resources_list" },
+                            class: "sortable #{'sorted' if params[:sort] == field}" %>
+              </th>
+            <% end %>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody id="resources_tbody">
+          <% resources.each do |resource| %>
+            <%= render "resource_row", resource: resource, resource_name: resource_name_param %>
+          <% end %>
+        </tbody>
+      </table>
+    <% end %>
+
+    <div class="pagination">
+      <%= render "pagination", pagy: pagy %>
+    </div>
+  <% else %>
+    <div class="empty-state">
+      <p>No <%= resource_config.display_name.downcase %> found.</p>
+      <%= link_to "Add the first #{resource_config.model_name.singularize.humanize}", 
+                  quick_admin.new_resource_path(resource_name_param), 
+                  class: "btn btn-primary" %>
+    </div>
+  <% end %>
+</div>

data/app/views/quick_admin/resources/attachment.html.erb

@@ -0,0 +1,21 @@
+<turbo-frame id="modal">
+  <div class="modal-overlay" onclick="document.getElementById('modal').innerHTML = ''; document.body.style.overflow = '';">
+    <div class="modal-content" onclick="event.stopPropagation()">
+      <div class="modal-header">
+        <h2>Preview</h2>
+        <button type="button" class="modal-close" onclick="document.getElementById('modal').innerHTML = ''; document.body.style.overflow = '';">&times;</button>
+      </div>
+      <div class="modal-body">
+        <% if @blob&.image? %>
+          <%= image_tag main_app.rails_blob_path(@blob, only_path: true), alt: "Attachment preview", style: "width: 100%; height: auto;" %>
+        <% elsif @blob %>
+          <p>
+            <%= link_to @blob.filename, main_app.rails_blob_path(@blob, only_path: true), target: "_blank", class: "file-link" %>
+          </p>
+        <% else %>
+          <p class="null-value">No attachment found.</p>
+        <% end %>
+      </div>
+    </div>
+  </div>
+</turbo-frame>

data/app/views/quick_admin/resources/bulk_destroy.turbo_stream.erb

@@ -0,0 +1,4 @@
+<%= turbo_stream.update "modal", "" %>
+<%= turbo_stream.update "resources_list" do %>
+  <%= render "resources_list", resources: @resources, pagy: @pagy %>
+<% end %>

data/app/views/quick_admin/resources/create.turbo_stream.erb

@@ -0,0 +1,9 @@
+<%= turbo_stream.update "modal", "" %>
+<%= turbo_stream.update "resources_list" do %>
+  <%= render "resources_list", resources: @resources, pagy: @pagy %>
+<% end %>
+<%= turbo_stream.append "body" do %>
+  <div class="flash-message alert alert-success" style="position: fixed; top: 20px; right: 20px; z-index: 9999;" data-auto-dismiss="true">
+    Record created successfully!
+  </div>
+<% end %>

data/app/views/quick_admin/resources/destroy.turbo_stream.erb

@@ -0,0 +1,4 @@
+<%= turbo_stream.update "modal", "" %>
+<%= turbo_stream.update "resources_list" do %>
+  <%= render "resources_list", resources: @resources, pagy: @pagy %>
+<% end %>