rails_den 2.0.0

data/app/controllers/rails_den/application_controller.rb

@@ -0,0 +1,218 @@
+module RailsDen
+  class ApplicationController < RailsDen.config.parent_controller.constantize
+    layout "rails_den/application"
+
+    prepend_before_action :authenticate_rails_den_user!
+    before_action :enforce_rails_den_account_access!
+    before_action :prepend_rails_den_theme_view_path
+    before_action :record_rails_den_page_view
+    before_action :load_global_advertising_placements,
+                  if: -> { request.format.html? }
+
+    helper_method :current_rails_den_user,
+                  :rails_den_user_signed_in?,
+                  :rails_den_role_keys,
+                  :rails_den_has_role?,
+                  :rails_den_administrator?,
+                  :rails_den_can_moderate_post?,
+                  :rails_den_can_edit_post?,
+                  :rails_den_can_delete_post?,
+                  :rails_den_can_restore_post?,
+                  :rails_den_can_view_post_history?,
+                  :rails_den_can_react_to_post?,
+                  :rails_den_active_theme
+
+    def current_rails_den_user
+      if RailsDen.config.current_user_resolver
+        instance_exec(&RailsDen.config.current_user_resolver)
+      else
+        send(RailsDen.config.current_user_method)
+      end
+    end
+
+    def rails_den_user_signed_in?
+      current_rails_den_user.present?
+    end
+
+    def rails_den_role_keys
+      return @rails_den_role_keys if defined?(@rails_den_role_keys)
+
+      @rails_den_role_keys =
+        RailsDen::RoleResolver.call(
+          user: current_rails_den_user
+        )
+    end
+
+    def rails_den_has_role?(role)
+      rails_den_role_keys.include?(
+        role.to_s
+      )
+    end
+
+    def rails_den_administrator?
+      rails_den_has_role?(
+        :administrator
+      )
+    end
+
+    def rails_den_can_moderate_post?(post)
+      return false unless rails_den_user_signed_in?
+
+      RailsDen::PermissionResolver.allowed?(
+        user: current_rails_den_user,
+        capability: :moderate,
+        board: post.topic.board
+      )
+    end
+
+    def rails_den_can_edit_post?(post)
+      return false unless rails_den_user_signed_in?
+      return false if post.deleted?
+
+      post.author == current_rails_den_user ||
+        rails_den_can_moderate_post?(post)
+    end
+
+    def rails_den_can_delete_post?(post)
+      return false unless rails_den_user_signed_in?
+      return false if post.deleted?
+
+      rails_den_can_moderate_post?(post) ||
+        (
+          post.author == current_rails_den_user &&
+          !post.opening_post?
+        )
+    end
+
+    def rails_den_can_restore_post?(post)
+      return false unless rails_den_user_signed_in?
+      return false unless post.deleted?
+
+      rails_den_can_moderate_post?(post) ||
+        (
+          post.author == current_rails_den_user &&
+          post.deleted_by == current_rails_den_user
+        )
+    end
+
+    def rails_den_can_view_post_history?(post)
+      RailsDen.config.public_revision_history ||
+        rails_den_can_moderate_post?(post)
+    end
+
+    def rails_den_can_react_to_post?(post)
+      rails_den_user_signed_in? &&
+        !post.deleted? &&
+        post.author != current_rails_den_user &&
+        RailsDen::RestrictionResolver.can_participate?(
+          user: current_rails_den_user
+        )
+    end
+
+    def rails_den_active_theme
+      return @rails_den_active_theme if defined?(@rails_den_active_theme)
+
+      @rails_den_active_theme = RailsDen::Themes.active
+    end
+
+    def authenticate_rails_den_user!
+      return if rails_den_user_signed_in?
+
+      if RailsDen.config.authentication_handler
+        instance_exec(
+          &RailsDen.config.authentication_handler
+        )
+      else
+        send(
+          RailsDen.config.authentication_method
+        )
+      end
+    end
+
+    def require_rails_den_participation!
+      return if RailsDen::RestrictionResolver.can_participate?(
+        user: current_rails_den_user
+      )
+
+      head :forbidden
+    end
+
+    private
+
+    def prepend_rails_den_theme_view_path
+      theme = rails_den_active_theme
+      prepend_view_path(theme.view_path.to_s) if theme&.view_path
+    end
+
+    def load_global_advertising_placements
+      @rails_den_advertising_configuration =
+        AdvertisingConfiguration.first
+
+      @rails_den_ad_network_code =
+        @rails_den_advertising_configuration&.ad_network_code&.presence
+
+      @rails_den_community_sponsorship =
+        CommunitySponsorship
+          .includes(:sponsor)
+          .active_on(Date.current)
+          .first
+    end
+
+    def load_contextual_sponsorship(board)
+      @contextual_sponsorship =
+        BoardSponsorship
+          .includes(:sponsor)
+          .active_on(Date.current)
+          .find_by(board: board)
+
+      if @contextual_sponsorship
+        @contextual_sponsorship_label =
+          "Board Sponsor"
+      else
+        @contextual_sponsorship =
+          CategorySponsorship
+            .includes(:sponsor)
+            .active_on(Date.current)
+            .find_by(
+              category: board.category
+            )
+
+        if @contextual_sponsorship
+          @contextual_sponsorship_label =
+            "Category Sponsor"
+        end
+      end
+    end
+
+    def enforce_rails_den_account_access!
+      return unless rails_den_user_signed_in?
+      return if RailsDen::RestrictionResolver.can_access?(
+        user: current_rails_den_user
+      )
+
+      state =
+        RailsDen::RestrictionResolver.account_state(
+          user: current_rails_den_user
+        )
+
+      render plain:
+               "Your community access is #{state}.",
+             status: :forbidden
+    end
+
+    def record_rails_den_page_view
+      return unless rails_den_page_navigation?
+      return unless rails_den_user_signed_in?
+
+      ReaderVisit.record_page_view!(
+        reader: current_rails_den_user
+      )
+    end
+
+    def rails_den_page_navigation?
+      request.get? &&
+        request.format.html? &&
+        !request.xhr?
+    end
+  end
+end

data/app/controllers/rails_den/attachments_controller.rb

@@ -0,0 +1,128 @@
+module RailsDen
+  class AttachmentsController < ApplicationController
+    SAFE_INLINE_IMAGE_TYPES = {
+      "jpg" => "image/jpeg",
+      "jpeg" => "image/jpeg",
+      "png" => "image/png",
+      "gif" => "image/gif",
+      "webp" => "image/webp"
+    }.freeze
+
+    def show
+      post =
+        find_viewable_post
+
+      attachment =
+        post.attachments.find(
+          params[:id]
+        )
+
+      inline =
+        inline_requested? &&
+        safe_inline_image?(attachment)
+
+      prepare_attachment_headers
+
+      send_data(
+        attachment.blob.download,
+        filename: attachment.filename.to_s,
+        type: response_content_type(
+          attachment,
+          inline:
+        ),
+        disposition:
+          inline ? "inline" : "attachment"
+      )
+    end
+
+    private
+
+    def find_viewable_post
+      post =
+        Post
+          .includes(
+            topic: {
+              board: :category
+            }
+          )
+          .find(
+            params[:post_id]
+          )
+
+      unless post.topic_id ==
+             params[:topic_id].to_i
+        raise ActiveRecord::RecordNotFound
+      end
+
+      readable_content =
+        ReadableCommunityContent.new(
+          viewer: current_rails_den_user
+        )
+
+      unless readable_content.post_readable?(
+        post
+      )
+        raise ActiveRecord::RecordNotFound
+      end
+
+      post
+    end
+
+    def inline_requested?
+      params[:disposition] ==
+        "inline"
+    end
+
+    def safe_inline_image?(attachment)
+      extension =
+        File
+          .extname(
+            attachment.filename.to_s
+          )
+          .delete_prefix(".")
+          .downcase
+
+      expected_content_type =
+        SAFE_INLINE_IMAGE_TYPES[
+          extension
+        ]
+
+      return false if expected_content_type.blank?
+
+      attachment
+        .blob
+        .content_type
+        .to_s
+        .downcase ==
+        expected_content_type
+    end
+
+    def response_content_type(
+      attachment,
+      inline:
+    )
+      if inline
+        attachment.blob.content_type
+      else
+        "application/octet-stream"
+      end
+    end
+
+    def prepare_attachment_headers
+      response.headers[
+        "Cache-Control"
+      ] =
+        "private, no-store"
+
+      response.headers[
+        "Pragma"
+      ] =
+        "no-cache"
+
+      response.headers[
+        "X-Content-Type-Options"
+      ] =
+        "nosniff"
+    end
+  end
+end

data/app/controllers/rails_den/board_follows_controller.rb

@@ -0,0 +1,119 @@
+module RailsDen
+  class BoardFollowsController < ApplicationController
+    def create
+      @board = find_readable_board
+
+      result = board_following.follow
+
+      respond_to do |format|
+        format.html do
+          redirect_to board_path(@board),
+                      status: :see_other,
+                      notice: follow_notice(result)
+        end
+
+        format.json do
+          render json: {
+            following: true,
+            changed: result.changed,
+            board_id: @board.id
+          },
+                 status: result.changed ? :created : :ok
+        end
+      end
+    rescue ActiveRecord::RecordInvalid => error
+      render_validation_error(error)
+    end
+
+    def destroy
+      @board = find_readable_board
+
+      result = board_following.unfollow
+
+      respond_to do |format|
+        format.html do
+          redirect_to board_path(@board),
+                      status: :see_other,
+                      notice: unfollow_notice(result)
+        end
+
+        format.json do
+          render json: {
+            following: false,
+            changed: result.changed,
+            board_id: @board.id
+          },
+                 status: :ok
+        end
+      end
+    rescue ActiveRecord::RecordInvalid => error
+      render_validation_error(error)
+    end
+
+    private
+
+    def find_readable_board
+      board =
+        Board.find(
+          params[:board_id]
+        )
+
+      readable_content =
+        ReadableCommunityContent.new(
+          viewer: current_rails_den_user
+        )
+
+      unless readable_content.board_readable?(
+        board
+      )
+        raise ActiveRecord::RecordNotFound
+      end
+
+      board
+    end
+
+    def board_following
+      BoardFollowing.new(
+        board: @board,
+        follower: current_rails_den_user
+      )
+    end
+
+    def follow_notice(result)
+      key =
+        if result.changed
+          "rails_den.board_follows.followed_notice"
+        else
+          "rails_den.board_follows.already_following_notice"
+        end
+
+      I18n.t(key)
+    end
+
+    def unfollow_notice(result)
+      key =
+        if result.changed
+          "rails_den.board_follows.unfollowed_notice"
+        else
+          "rails_den.board_follows.already_unfollowed_notice"
+        end
+
+      I18n.t(key)
+    end
+
+    def render_validation_error(error)
+      respond_to do |format|
+        format.html do
+          head :unprocessable_entity
+        end
+
+        format.json do
+          render json: {
+            errors: error.record.errors.full_messages
+          },
+                 status: :unprocessable_entity
+        end
+      end
+    end
+  end
+end

data/app/controllers/rails_den/board_read_states_controller.rb

@@ -0,0 +1,36 @@
+module RailsDen
+  class BoardReadStatesController < ApplicationController
+    def update
+      board = find_readable_board
+
+      board.mark_read!(
+        reader: current_rails_den_user
+      )
+
+      redirect_to board_path(board),
+                  notice: "Board marked read."
+    end
+
+    private
+
+    def find_readable_board
+      board =
+        Board.find(
+          params[:board_id]
+        )
+
+      readable_content =
+        ReadableCommunityContent.new(
+          viewer: current_rails_den_user
+        )
+
+      unless readable_content.board_readable?(
+        board
+      )
+        raise ActiveRecord::RecordNotFound
+      end
+
+      board
+    end
+  end
+end

data/app/controllers/rails_den/boards_controller.rb

@@ -0,0 +1,103 @@
+module RailsDen
+  class BoardsController < ApplicationController
+    skip_before_action :authenticate_rails_den_user!
+
+    def show
+      @board =
+        Board.find(
+          params[:id]
+        )
+
+      readable_content =
+        ReadableCommunityContent.new(
+          viewer: current_rails_den_user
+        )
+
+      unless readable_content.board_readable?(
+        @board
+      )
+        raise ActiveRecord::RecordNotFound
+      end
+
+      @board_presence =
+        RailsDen::Presence::BoardSummary.call(
+          board: @board,
+          viewer: current_rails_den_user
+        )
+
+      load_contextual_sponsorship(@board)
+
+      @board_following =
+        rails_den_user_signed_in? &&
+        @board.board_follows.exists?(
+          follower: current_rails_den_user
+        )
+
+      @topics =
+        readable_content
+          .topics
+          .where(board: @board)
+          .includes(:tags)
+          .order(
+            pinned: :desc,
+            created_at: :desc,
+            id: :desc
+          )
+          .to_a
+
+      @last_posts_by_topic_id =
+        @topics.each_with_object({}) do |topic, result|
+          result[topic.id] =
+            topic.last_visible_post
+        end
+
+      @topic_presence_map =
+        RailsDen::Presence::PageMap.call(
+          posts:
+            @last_posts_by_topic_id
+              .values
+              .compact,
+          viewer: current_rails_den_user
+        )
+
+      @topic_bookmarks_by_topic_id =
+        if rails_den_user_signed_in?
+          Bookmark
+            .where(
+              bookmarker: current_rails_den_user,
+              bookmarkable_type: "RailsDen::Topic",
+              bookmarkable_id: @topics.map(&:id)
+            )
+            .index_by(&:bookmarkable_id)
+        else
+          {}
+        end
+
+      @unread_counts_by_topic_id =
+        if rails_den_user_signed_in?
+          TopicUnreadCounts.call(
+            topics: @topics,
+            reader: current_rails_den_user
+          )
+        else
+          {}
+        end
+
+      @new_post_counts_by_topic_id =
+        if rails_den_user_signed_in?
+          reader_visit =
+            ReaderVisit.find_by(
+              reader: current_rails_den_user
+            )
+
+          TopicNewPostCounts.call(
+            topics: @topics,
+            reader: current_rails_den_user,
+            since: reader_visit&.previous_visit_at
+          )
+        else
+          {}
+        end
+    end
+  end
+end

data/app/controllers/rails_den/bookmarks_controller.rb

@@ -0,0 +1,91 @@
+module RailsDen
+  class BookmarksController < ApplicationController
+    before_action :load_bookmark, only: %i[update destroy]
+
+    def index
+      load_list
+    end
+
+    def update
+      ensure_bookmark_readable!
+
+      if @bookmark.update(bookmark_params)
+        redirect_to bookmarks_path(page: normalized_return_page)
+      else
+        @editing_bookmark_id = @bookmark.id
+        actual_page = BookmarkList.page_for(bookmarker: current_rails_den_user, bookmark: @bookmark)
+        load_list(page: actual_page, include_bookmark: @bookmark)
+        render :index, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      target = @bookmark.bookmarkable
+      @bookmark.destroy!
+
+      respond_to do |format|
+        format.html { redirect_after_destroy(target) }
+        format.json { render json: { html: render_control(target) } }
+      end
+    end
+
+    private
+
+    def load_bookmark
+      @bookmark = Bookmark.where(bookmarker: current_rails_den_user).find(params[:id])
+    end
+
+    def bookmark_params
+      params.require(:bookmark).permit(:note)
+    end
+
+    def normalized_return_page
+      [params[:page].to_i, 1].max
+    end
+
+    def load_list(page: params[:page], include_bookmark: nil)
+      result = BookmarkList.call(bookmarker: current_rails_den_user, page: page)
+      @bookmarks = result.bookmarks
+      @page = result.page
+      @total_pages = result.total_pages
+      @post_pages = result.post_pages
+      return unless include_bookmark
+
+      matching_index = @bookmarks.index { |bookmark| bookmark.id == include_bookmark.id }
+      if matching_index
+        @bookmarks[matching_index] = include_bookmark
+      else
+        raise ActiveRecord::RecordNotFound
+      end
+    end
+
+    def redirect_after_destroy(target)
+      case params[:origin]
+      when "topic"
+        return redirect_to bookmarks_path(page: normalized_return_page) unless target.is_a?(Topic)
+
+        options = {}
+        options[:page] = target.normalized_posts_page(params[:page]) if params[:page].present?
+        redirect_to topic_path(target, **options)
+      when "post"
+        return redirect_to bookmarks_path(page: normalized_return_page) unless target.is_a?(Post)
+
+        redirect_to topic_path(target.topic, page: target.topic.posts_page_for(target), anchor: "post-#{target.id}")
+      else
+        redirect_to bookmarks_path(page: normalized_return_page)
+      end
+    end
+
+    def render_control(target)
+      partial = target.is_a?(Topic) ? "topic_control" : "post_control"
+      render_to_string(partial: "rails_den/bookmarks/#{partial}", formats: [:html], locals: { (target.is_a?(Topic) ? :topic : :post) => target, bookmark: nil })
+    end
+
+    def ensure_bookmark_readable!
+      readable = ReadableCommunityContent.new(viewer: current_rails_den_user)
+      target = @bookmark.bookmarkable
+      allowed = target.is_a?(Topic) ? readable.topic_readable?(target) : readable.post_readable?(target)
+      raise ActiveRecord::RecordNotFound unless allowed
+    end
+  end
+end