rails_den 2.0.0

data/lib/rails_den/onebox/renderer.rb

@@ -0,0 +1,403 @@
+require "active_support/core_ext/string/output_safety"
+require "erb"
+require "uri"
+
+module RailsDen
+  module Onebox
+    class Renderer
+      STANDARD_WEB_PORTS = [
+        80,
+        443
+      ].freeze
+
+      EMBED_SANDBOX =
+        "allow-scripts allow-same-origin allow-presentation".freeze
+
+      EMBED_ALLOW =
+        "autoplay; encrypted-media; fullscreen; picture-in-picture".freeze
+
+      def self.call(result)
+        new(result).call
+      end
+
+      def initialize(result)
+        @result = result
+      end
+
+      def call
+        return empty_html unless valid_result?
+
+        if renderable_embed?
+          render_embed
+        else
+          render_card
+        end
+      end
+
+      private
+
+      attr_reader :result
+
+      def valid_result?
+        result.is_a?(
+          RailsDen::Onebox::Result
+        ) && target_url
+      end
+
+      def render_card
+        html = +""
+
+        html << %(<aside class="#{card_classes}">)
+        html << opening_link
+        html << render_card_image
+        html << %(<div class="rails-den-onebox-content">)
+        html << render_provider
+        html << render_title
+        html << render_description
+        html << render_meta
+        html << %(</div>)
+        html << %(</a>)
+        html << %(</aside>)
+
+        safe_html(html)
+      end
+
+      def render_embed
+        html = +""
+
+        html << %(<aside class="#{embed_classes}">)
+
+        html <<
+          %(<div class="rails-den-onebox-embed-frame">)
+
+        html <<
+          %(<iframe src="#{h(embed_url)}")
+
+        html <<
+          %( title="#{h(embed_title)}")
+
+        html <<
+          %( loading="lazy")
+
+        html <<
+          %( referrerpolicy="strict-origin-when-cross-origin")
+
+        html <<
+          %( sandbox="#{h(EMBED_SANDBOX)}")
+
+        html <<
+          %( allow="#{h(EMBED_ALLOW)}")
+
+        html <<
+          %( allowfullscreen></iframe>)
+
+        html << %(</div>)
+
+        html <<
+          %(<div class="rails-den-onebox-embed-footer">)
+
+        html << opening_link(
+          class_name:
+            "rails-den-onebox-embed-link"
+        )
+
+        html << h(display_title)
+        html << %(</a>)
+
+        html <<
+          %(<span class="rails-den-onebox-provider">)
+
+        html << h(result.provider_name)
+        html << %(</span>)
+        html << %(</div>)
+        html << %(</aside>)
+
+        safe_html(html)
+      end
+
+      def render_card_image
+        url = card_image_url
+
+        return "" unless url
+
+        alt =
+          result
+            .metadata
+            .fetch(
+              :image_alt,
+              ""
+            )
+
+        html = +""
+
+        html <<
+          %(<div class="rails-den-onebox-image">)
+
+        html <<
+          %(<img src="#{h(url)}")
+
+        html <<
+          %( alt="#{h(alt)}")
+
+        html <<
+          %( loading="lazy")
+
+        html <<
+          %( referrerpolicy="no-referrer">)
+
+        html << %(</div>)
+
+        html
+      end
+
+      def render_provider
+        html = +""
+
+        html <<
+          %(<div class="rails-den-onebox-provider">)
+
+        html << h(result.provider_name)
+        html << %(</div>)
+
+        html
+      end
+
+      def render_title
+        html = +""
+
+        html <<
+          %(<div class="rails-den-onebox-title">)
+
+        html << h(display_title)
+        html << %(</div>)
+
+        html
+      end
+
+      def render_description
+        value =
+          result.description.to_s.strip
+
+        return "" if value.empty?
+
+        html = +""
+
+        html <<
+          %(<div class="rails-den-onebox-description">)
+
+        html << h(value)
+        html << %(</div>)
+
+        html
+      end
+
+      def render_meta
+        values = []
+
+        author =
+          result.author_name.to_s.strip
+
+        values << author unless author.empty?
+
+        published =
+          result.published_at.to_s.strip
+
+        values << published unless published.empty?
+
+        return "" if values.empty?
+
+        html = +""
+
+        html <<
+          %(<div class="rails-den-onebox-meta">)
+
+        html <<
+          h(
+            values.join(" · ")
+          )
+
+        html << %(</div>)
+
+        html
+      end
+
+      def opening_link(
+        class_name:
+          "rails-den-onebox-link"
+      )
+        %(<a class="#{h(class_name)}" ) +
+          %(href="#{h(target_url)}" ) +
+          %(target="_blank" ) +
+          %(rel="nofollow ugc noopener noreferrer">)
+      end
+
+      def display_title
+        title =
+          result.title.to_s.strip
+
+        return title unless title.empty?
+
+        target_url
+      end
+
+      def card_classes
+        [
+          "rails-den-onebox",
+          "rails-den-onebox-card",
+          kind_class
+        ].join(" ")
+      end
+
+      def embed_classes
+        [
+          "rails-den-onebox",
+          "rails-den-onebox-embed",
+          kind_class
+        ].join(" ")
+      end
+
+      def kind_class
+        kind =
+          result
+            .kind
+            .to_s
+            .downcase
+            .gsub(
+              /[^a-z0-9_-]+/,
+              "-"
+            )
+            .gsub(
+              /\A-+|-+\z/,
+              ""
+            )
+
+        kind = "link" if kind.empty?
+
+        "rails-den-onebox-kind-#{kind}"
+      end
+
+      def target_url
+        @target_url ||=
+          first_safe_web_url(
+            result.canonical_url,
+            result.url
+          )
+      end
+
+      def card_image_url
+        first_safe_https_url(
+          result.image_url,
+          result.thumbnail_url
+        )
+      end
+
+      def embed_url
+        @embed_url ||=
+          safe_https_url(
+            result.embed_url
+          )
+      end
+
+      def renderable_embed?
+        return false unless embed_url
+
+        EmbedPolicy.allowed?(
+          embed_url,
+          additional_hosts:
+            verified_embed_hosts
+        )
+      end
+
+      def verified_embed_hosts
+        metadata =
+          result.metadata
+
+        return [] unless metadata.respond_to?(
+          :dig
+        )
+
+        Array(
+          metadata.dig(
+            :rails_den,
+            :verified_embed_hosts
+          )
+        )
+      end
+
+      def embed_title
+        title =
+          result.title.to_s.strip
+
+        return title unless title.empty?
+
+        "Embedded content from #{result.provider_name}"
+      end
+
+      def first_safe_web_url(*values)
+        values.each do |value|
+          url = safe_web_url(value)
+
+          return url if url
+        end
+
+        nil
+      end
+
+      def first_safe_https_url(*values)
+        values.each do |value|
+          url = safe_https_url(value)
+
+          return url if url
+        end
+
+        nil
+      end
+
+      def safe_https_url(value)
+        url = safe_web_url(value)
+
+        return unless url
+
+        uri = URI.parse(url)
+
+        return unless uri.scheme == "https"
+
+        url
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def safe_web_url(value)
+        candidate =
+          value.to_s.strip
+
+        return if candidate.empty?
+        return unless Url.web?(candidate)
+
+        uri = URI.parse(candidate)
+
+        return unless STANDARD_WEB_PORTS.include?(
+          uri.port
+        )
+
+        uri.to_s
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def h(value)
+        ERB::Util.html_escape(
+          value.to_s
+        )
+      end
+
+      def safe_html(value)
+        value.html_safe
+      end
+
+      def empty_html
+        "".html_safe
+      end
+    end
+  end
+end

data/lib/rails_den/onebox/result.rb

@@ -0,0 +1,86 @@
+module RailsDen
+  module Onebox
+    class Result
+      ATTRIBUTES = %i[
+        url
+        canonical_url
+        kind
+        provider_name
+        provider_url
+        title
+        description
+        author_name
+        author_url
+        site_name
+        image_url
+        thumbnail_url
+        embed_url
+        html
+        width
+        height
+        published_at
+        metadata
+      ].freeze
+
+      attr_reader(*ATTRIBUTES)
+
+      def initialize(
+        url:,
+        provider_name:,
+        canonical_url: nil,
+        kind: :link,
+        provider_url: nil,
+        title: nil,
+        description: nil,
+        author_name: nil,
+        author_url: nil,
+        site_name: nil,
+        image_url: nil,
+        thumbnail_url: nil,
+        embed_url: nil,
+        html: nil,
+        width: nil,
+        height: nil,
+        published_at: nil,
+        metadata: {}
+      )
+        raise ArgumentError, "url is required" if url.to_s.strip.empty?
+
+        if provider_name.to_s.strip.empty?
+          raise ArgumentError,
+                "provider_name is required"
+        end
+
+        @url = url.to_s
+        @canonical_url = canonical_url
+        @kind = kind.to_sym
+        @provider_name = provider_name.to_s
+        @provider_url = provider_url
+        @title = title
+        @description = description
+        @author_name = author_name
+        @author_url = author_url
+        @site_name = site_name
+        @image_url = image_url
+        @thumbnail_url = thumbnail_url
+        @embed_url = embed_url
+        @html = html
+        @width = width
+        @height = height
+        @published_at = published_at
+        @metadata = metadata.dup.freeze
+
+        freeze
+      end
+
+      def to_h
+        ATTRIBUTES.to_h do |attribute|
+          [
+            attribute,
+            public_send(attribute)
+          ]
+        end
+      end
+    end
+  end
+end

data/lib/rails_den/onebox/synchronizer.rb

@@ -0,0 +1,161 @@
+module RailsDen
+  module Onebox
+    class Synchronizer
+      def self.call(post)
+        new(post).call
+      end
+
+      def initialize(post)
+        unless post.is_a?(RailsDen::Post)
+          raise ArgumentError,
+                "post must be a RailsDen::Post"
+        end
+
+        @post = post
+      end
+
+      def call
+        return [] unless RailsDen.config.onebox_enabled
+
+        urls =
+          Extractor.call(post.body)
+
+        entries_to_resolve = []
+
+        post.with_lock do
+          existing_entries =
+            post.onebox_entries.reload.to_a
+
+          desired_positions =
+            urls.each_with_index.to_h
+
+          retained_entries =
+            remove_obsolete_entries(
+              existing_entries,
+              desired_positions
+            )
+
+          shift_positions_if_needed(
+            retained_entries,
+            desired_positions,
+            urls.length
+          )
+
+          entries_by_url =
+            retained_entries.index_by(
+              &:source_url
+            )
+
+          urls.each_with_index do |url, position|
+            entry =
+              entries_by_url[url]
+
+            if entry
+              synchronize_existing_entry(
+                entry,
+                position,
+                entries_to_resolve
+              )
+            else
+              entries_to_resolve <<
+                post.onebox_entries.create!(
+                  source_url: url,
+                  position: position
+                )
+            end
+          end
+        end
+
+        entries_to_resolve
+      end
+
+      private
+
+      attr_reader :post
+
+      def remove_obsolete_entries(
+        existing_entries,
+        desired_positions
+      )
+        existing_entries.each_with_object([]) do |entry, retained|
+          if desired_positions.key?(
+            entry.source_url
+          )
+            retained << entry
+          else
+            entry.destroy!
+          end
+        end
+      end
+
+      def shift_positions_if_needed(
+        entries,
+        desired_positions,
+        desired_count
+      )
+        needs_shift =
+          entries.any? do |entry|
+            desired_positions.fetch(
+              entry.source_url
+            ) != entry.position
+          end
+
+        return unless needs_shift
+        return if entries.empty?
+
+        maximum_position =
+          entries
+            .map(&:position)
+            .compact
+            .max
+            .to_i
+
+        offset =
+          maximum_position +
+          desired_count +
+          1
+
+        entries.each do |entry|
+          entry.update_columns(
+            position:
+              entry.position + offset
+          )
+        end
+      end
+
+      def synchronize_existing_entry(
+        entry,
+        position,
+        entries_to_resolve
+      )
+        if entry.position != position
+          entry.update!(
+            position: position
+          )
+        end
+
+        if entry.resolved?
+          synchronize_resolved_entry(
+            entry,
+            entries_to_resolve
+          )
+        elsif entry.failed?
+          entry.mark_pending!
+          entries_to_resolve << entry
+        else
+          entries_to_resolve << entry
+        end
+      end
+
+      def synchronize_resolved_entry(
+        entry,
+        entries_to_resolve
+      )
+        return unless entry.expired?
+
+        entry.mark_pending!
+        entries_to_resolve << entry
+      end
+    end
+  end
+end

data/lib/rails_den/onebox/url.rb

@@ -0,0 +1,35 @@
+require "uri"
+
+module RailsDen
+  module Onebox
+    module Url
+      WEB_SCHEMES = %w[
+        http
+        https
+      ].freeze
+
+      module_function
+
+      def web?(value)
+        candidate = value.to_s.strip
+
+        return false if candidate.empty?
+        return false if candidate.start_with?("//")
+        return false if candidate.start_with?("\\\\")
+
+        uri = URI.parse(candidate)
+
+        return false unless WEB_SCHEMES.include?(
+          uri.scheme.to_s.downcase
+        )
+
+        return false if uri.host.to_s.empty?
+        return false if uri.userinfo
+
+        true
+      rescue URI::InvalidURIError
+        false
+      end
+    end
+  end
+end