rails_den 2.0.0

data/lib/rails_den/extensions.rb

@@ -0,0 +1,49 @@
+module RailsDen
+  module Extensions
+    class Error < StandardError; end
+    class InvalidDescriptorError < Error; end
+    class DuplicateRegistrationError < Error; end
+    class IncompatibleVersionError < Error; end
+
+    require "rails_den/extensions/descriptor"
+    require "rails_den/extensions/registry"
+
+    class << self
+      def register_plugin(**attributes)
+        register(type: :plugin, **attributes)
+      end
+
+      def register_theme(**attributes)
+        register(type: :theme, **attributes)
+      end
+
+      def all
+        registry.all
+      end
+
+      def plugins
+        registry.plugins
+      end
+
+      def themes
+        registry.themes
+      end
+
+      def find(key)
+        registry.find(key)
+      end
+
+      private
+
+      def register(**attributes)
+        registry.register(
+          Descriptor.new(**attributes)
+        )
+      end
+
+      def registry
+        @registry ||= Registry.new
+      end
+    end
+  end
+end

data/lib/rails_den/formatters/markdown.rb

@@ -0,0 +1,30 @@
+require "commonmarker"
+
+module RailsDen
+  module Formatters
+    class Markdown
+      def self.call(text)
+        source = text.to_s.encode(Encoding::UTF_8)
+
+        Commonmarker.to_html(
+          source,
+          options: {
+            render: {
+              unsafe: false,
+              hardbreaks: true
+            },
+            extension: {
+              spoiler: true,
+              shortcodes: true
+            }
+          },
+          plugins: {
+            syntax_highlighter: {
+              theme: ""
+            }
+          }
+        )
+      end
+    end
+  end
+end

data/lib/rails_den/formatters/plain_text.rb

@@ -0,0 +1,18 @@
+require "erb"
+
+module RailsDen
+  module Formatters
+    class PlainText
+      def self.call(text)
+        escaped = ERB::Util.html_escape(text.to_s)
+
+        escaped
+          .split(/\n{2,}/)
+          .map do |paragraph|
+            "<p>#{paragraph.gsub("\n", "<br>\n")}</p>"
+          end
+          .join("\n")
+      end
+    end
+  end
+end

data/lib/rails_den/formatting.rb

@@ -0,0 +1,130 @@
+require "action_controller"
+require "nokogiri"
+require "uri"
+require "rails_den/formatters/markdown"
+require "rails_den/formatters/plain_text"
+
+module RailsDen
+  module Formatting
+    ALLOWED_TAGS = %w[
+      p
+      br
+      strong
+      em
+      del
+      blockquote
+      ul
+      ol
+      li
+      h1
+      h2
+      h3
+      h4
+      h5
+      h6
+      a
+      pre
+      code
+      span
+      table
+      thead
+      tbody
+      tr
+      th
+      td
+      hr
+      input
+    ].freeze
+
+    ALLOWED_ATTRIBUTES = %w[
+      href
+      title
+      class
+      aria-label
+      lang
+      start
+      type
+      checked
+      disabled
+    ].freeze
+
+    ALLOWED_URL_SCHEMES = %w[
+      http
+      https
+      mailto
+    ].freeze
+
+    module_function
+
+    def render(text)
+      html = formatter.call(text.to_s)
+
+      sanitize(html)
+    end
+
+    def sanitize(html)
+      html = enforce_url_policy(html)
+
+      ActionController::Base.helpers.sanitize(
+        html,
+        tags: ALLOWED_TAGS,
+        attributes: ALLOWED_ATTRIBUTES
+      )
+    end
+
+    def safe_url?(url)
+      value = url.to_s.strip
+
+      return false if value.empty?
+      return false if value.match?(/\A[\/\\]{2}/)
+
+      return false unless Rails::HTML::Sanitizer.allowed_uri?(value)
+
+      uri = URI.parse(value)
+
+      return true if uri.scheme.nil?
+
+      ALLOWED_URL_SCHEMES.include?(
+        uri.scheme.downcase
+      )
+    rescue URI::InvalidURIError
+      false
+    end
+
+    def enforce_url_policy(html)
+      fragment = Nokogiri::HTML5.fragment(
+        html.to_s
+      )
+
+      fragment.css("[href]").each do |node|
+        href = node["href"].to_s.strip
+
+        if safe_url?(href)
+          node["href"] = href
+        else
+          node.remove_attribute("href")
+        end
+      end
+
+      fragment.to_html
+    end
+
+    def formatter
+      configured_adapter = RailsDen.config.formatting_adapter
+
+      case configured_adapter
+      when :markdown
+        RailsDen::Formatters::Markdown
+      when :plain_text
+        RailsDen::Formatters::PlainText
+      else
+        if configured_adapter.respond_to?(:call)
+          configured_adapter
+        else
+          raise ArgumentError,
+                "Unknown RailsDen formatting adapter: #{configured_adapter.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/rails_den/gamification.rb

@@ -0,0 +1,77 @@
+module RailsDen
+  module Gamification
+    class ConfigurationError < StandardError
+    end
+
+    class NegativeReputationError < StandardError
+    end
+
+    class DedupeCollisionError < StandardError
+    end
+
+    class << self
+      def enabled?
+        boolean_value(
+          :gamification_enabled
+        )
+      end
+
+      def leaderboard_enabled?
+        enabled? &&
+          boolean_value(
+            :leaderboard_enabled
+          )
+      end
+
+      def topic_points
+        nonnegative_integer(
+          :gamification_topic_points
+        )
+      end
+
+      def reply_points
+        nonnegative_integer(
+          :gamification_reply_points
+        )
+      end
+
+      private
+
+      def boolean_value(name)
+        value =
+          RailsDen.config.public_send(
+            name
+          )
+
+        return value if value == true || value == false
+
+        raise ConfigurationError,
+              "RailsDen #{name} must be true or false."
+      end
+
+      def nonnegative_integer(name)
+        value =
+          RailsDen.config.public_send(
+            name
+          )
+
+        integer =
+          case value
+          when Integer
+            value
+          when String
+            stripped = value.strip
+
+            stripped.match?(/\A\d+\z/) ? stripped.to_i : nil
+          end
+
+        if integer.nil? || integer.negative?
+          raise ConfigurationError,
+                "RailsDen #{name} must be a non-negative integer."
+        end
+
+        integer
+      end
+    end
+  end
+end

data/lib/rails_den/import/discourse/backup.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+require "rails_den/import/discourse"
+require "rubygems/package"
+require "tmpdir"
+require "zlib"
+
+module RailsDen
+  module Import
+    module Discourse
+      class Backup
+        ExtractedBackup = Data.define(
+          :root_path,
+          :dump_path
+        )
+
+        SUPPORTED_SUFFIXES = %w[
+          .tar.gz
+          .tgz
+          .sql.gz
+        ].freeze
+
+        def initialize(path:)
+          @path = File.expand_path(path.to_s)
+        end
+
+        def with_extracted
+          validate_source!
+
+          Dir.mktmpdir("rails-den-discourse-import-") do |temporary_root|
+            if sql_gzip?
+              dump_path = File.join(temporary_root, "dump.sql")
+              decompress_gzip(@path, dump_path)
+            else
+              extract_tar_gzip(@path, temporary_root)
+              dump_path = locate_dump!(temporary_root)
+
+              if dump_path.end_with?(".gz")
+                decompressed_path = dump_path.delete_suffix(".gz")
+                decompress_gzip(dump_path, decompressed_path)
+                dump_path = decompressed_path
+              end
+            end
+
+            yield ExtractedBackup.new(
+              root_path: temporary_root,
+              dump_path: dump_path
+            )
+          end
+        end
+
+        private
+
+        def validate_source!
+          unless File.file?(@path)
+            raise ImportError,
+                  "Backup file does not exist: #{@path}"
+          end
+
+          unless SUPPORTED_SUFFIXES.any? { |suffix| @path.end_with?(suffix) }
+            raise ImportError,
+                  "Unsupported backup file. Expected .tar.gz, .tgz, or .sql.gz."
+          end
+        end
+
+        def sql_gzip?
+          @path.end_with?(".sql.gz")
+        end
+
+        def extract_tar_gzip(source_path, destination_root)
+          Zlib::GzipReader.open(source_path) do |gzip|
+            Gem::Package::TarReader.new(gzip) do |tar|
+              tar.each do |entry|
+                destination = safe_destination(
+                  destination_root,
+                  entry.full_name
+                )
+
+                if entry.directory?
+                  FileUtils.mkdir_p(destination)
+                elsif entry.file?
+                  FileUtils.mkdir_p(File.dirname(destination))
+
+                  File.open(destination, "wb") do |file|
+                    IO.copy_stream(entry, file)
+                  end
+                elsif pax_header?(entry)
+                  next
+                else
+                  raise ImportError,
+                        "Backup contains unsupported archive entry: #{entry.full_name}"
+                end
+              end
+            end
+          end
+        rescue Zlib::GzipFile::Error, Gem::Package::TarInvalidError => error
+          raise ImportError,
+                "Backup archive could not be read: #{error.message}"
+        end
+
+        def pax_header?(entry)
+          %w[x g].include?(entry.header.typeflag)
+        end
+
+        def safe_destination(root, archive_name)
+          pathname = Pathname.new(archive_name.to_s)
+
+          if pathname.absolute?
+            raise ImportError,
+                  "Backup contains an unsafe absolute path: #{archive_name}"
+          end
+
+          cleaned_name = pathname.cleanpath.to_s
+
+          if cleaned_name == ".." || cleaned_name.start_with?("../")
+            raise ImportError,
+                  "Backup contains an unsafe path: #{archive_name}"
+          end
+
+          root_path = File.expand_path(root)
+          destination = File.expand_path(cleaned_name, root_path)
+
+          unless destination == root_path ||
+                 destination.start_with?("#{root_path}#{File::SEPARATOR}")
+            raise ImportError,
+                  "Backup contains an unsafe path: #{archive_name}"
+          end
+
+          destination
+        end
+
+        def locate_dump!(root)
+          candidates =
+            Dir
+              .glob(File.join(root, "**", "dump.sql"))
+              .concat(
+                Dir.glob(File.join(root, "**", "dump.sql.gz"))
+              )
+              .uniq
+
+          if candidates.empty?
+            raise ImportError,
+                  "Backup does not contain dump.sql or dump.sql.gz."
+          end
+
+          if candidates.many?
+            raise ImportError,
+                  "Backup contains multiple database dumps and is ambiguous."
+          end
+
+          candidates.first
+        end
+
+        def decompress_gzip(source_path, destination_path)
+          Zlib::GzipReader.open(source_path) do |gzip|
+            File.open(destination_path, "wb") do |file|
+              IO.copy_stream(gzip, file)
+            end
+          end
+        rescue Zlib::GzipFile::Error => error
+          raise ImportError,
+                "Database dump could not be decompressed: #{error.message}"
+        end
+      end
+    end
+  end
+end