rivet_cms 0.1.1.pre → 0.3.0

data/app/controllers/rivet_cms/sessions_controller.rb

@@ -0,0 +1,122 @@
+module RivetCms
+  class SessionsController < AuthController
+    LOGIN_ATTEMPT_LIMIT = 10
+    LOGIN_ATTEMPT_WINDOW = 5.minutes
+
+    # Memoized on the class, computed on first use so BCrypt is referenced at
+    # request time (after bcrypt is required), never at load time
+    def self.dummy_digest
+      @dummy_digest ||= BCrypt::Password.create("rivet-cms-timing-equalizer").to_s
+    end
+
+    def new
+      return redirect_to root_path if builtin_session_user
+      return redirect_to setup_path if users.none?
+
+      render inertia: "Auth/Login", props: { submit_path: login_path }
+    end
+
+    def create
+      # Reserve an attempt atomically BEFORE authenticating, so a parallel
+      # burst cannot slip every request through BCrypt before any counter
+      # reaches the limit. The increment is the reservation.
+      unless reserve_attempt
+        return redirect_to login_path,
+                           inertia: { errors: { base: [ "Too many attempts. Wait a few minutes and try again" ] } }
+      end
+
+      user = users.active.find_by(email: submitted_email)
+      if user&.can_sign_in? && user.authenticate(params[:password].to_s)
+        release_reservation_on_success
+        sign_in(user)
+        redirect_to root_path
+      else
+        equalize_timing unless user&.can_sign_in?
+        # Failure keeps its reservation; that is the point of the counters
+        redirect_to login_path, inertia: { errors: { base: [ "That email and password combination does not work" ] } }
+      end
+    end
+
+    def destroy
+      reset_session
+      redirect_to login_path, status: :see_other
+    end
+
+    private
+
+    # A BCrypt comparison runs on every login attempt, so an attacker cannot
+    # tell known emails (expensive compare) from unknown ones (fast return)
+    # by timing; only its cost matters, never its content.
+    def equalize_timing
+      BCrypt::Password.new(self.class.dummy_digest).is_password?(params[:password].to_s)
+    end
+
+    # Two independent counters guard login: one per source IP, one per target
+    # account (scoped by organization, so the same email in another tenant is
+    # a separate counter). See reserve_attempt for the ordering that keeps the
+    # two from corrupting each other, and release_reservation_on_success for
+    # what a successful login does and does not clear.
+    #
+    # This needs a shared, incrementing cache (Redis, Memcached) to bind
+    # multiple workers; on a per-process MemoryStore it is per-worker, and on
+    # the NullStore it does nothing. It is a floor, not a replacement for
+    # rack-attack or a WAF at the edge.
+    def submitted_email
+      params[:email].to_s.strip.downcase
+    end
+
+    def ip_throttle_key
+      "rivet_cms:login_attempts:ip:#{request.remote_ip}"
+    end
+
+    def account_throttle_key(email = submitted_email)
+      "rivet_cms:login_attempts:account:#{Current.organization&.id}:#{email}"
+    end
+
+    # Reserve one IP attempt, then one account attempt, checking each before
+    # reserving the next. Returns false (throttled) without ever touching the
+    # account counter once the IP is over limit, so a blocked IP cannot lock
+    # arbitrary accounts. If the account is over limit, the IP reservation
+    # this request just made is released, so an already-locked account does
+    # not drain the shared IP budget.
+    def reserve_attempt
+      return false if over_limit?(bump(ip_throttle_key))
+
+      if over_limit?(bump(account_throttle_key))
+        unbump(ip_throttle_key)
+        return false
+      end
+      true
+    end
+
+    def over_limit?(count)
+      # nil (NullStore) means throttling is disabled, never over limit
+      count && count > LOGIN_ATTEMPT_LIMIT
+    end
+
+    # A success proves ownership of this account, so clear its counter; but it
+    # only releases this request's own IP reservation, never the whole IP
+    # history, so one account's success cannot erase IP-wide spray protection.
+    def release_reservation_on_success
+      unbump(ip_throttle_key)
+      Rails.cache.delete(account_throttle_key)
+    end
+
+    def bump(key)
+      # increment is atomic on stores that support it; it seeds the key on a
+      # real store, and returns nil on the NullStore (throttling disabled)
+      Rails.cache.increment(key, 1, expires_in: LOGIN_ATTEMPT_WINDOW)
+    end
+
+    # Release a reservation only if it is still live. A bare decrement on an
+    # expired key recreates it as a non-expiring -1, a permanent counter that
+    # later increments accumulate on and can eventually lock the IP forever.
+    # The exist? check skips that; expires_in bounds the entry anyway if the
+    # key expires in the race between the check and the decrement.
+    def unbump(key)
+      return unless Rails.cache.exist?(key)
+
+      Rails.cache.decrement(key, 1, expires_in: LOGIN_ATTEMPT_WINDOW)
+    end
+  end
+end

data/app/controllers/rivet_cms/setup_controller.rb

@@ -0,0 +1,60 @@
+module RivetCms
+  # First-run screen: with no users at all, the first visit creates the owner
+  # account. Gone the moment one user exists; never a registration form.
+  #
+  # Outside development/test a fresh deployment cannot be claimed by whoever
+  # finds it first: setup demands a code that is written to the server log
+  # (or configured via RivetCms.setup_code), so claiming requires server
+  # access. The Jenkins initial-password pattern.
+  class SetupController < AuthController
+    before_action :ensure_first_run
+
+    def new
+      log_setup_code
+      render inertia: "Auth/Setup", props: { submit_path: setup_path, requires_code: RivetCms.setup_code_required? }
+    end
+
+    def create
+      unless setup_code_valid?
+        return redirect_to setup_path,
+                           inertia: { errors: { base: [ "That setup code is not right. It is printed in the server log." ] } }
+      end
+      if params[:password].blank?
+        # has_secure_password ignores an empty string entirely, which would
+        # otherwise create a passwordless owner and sign them in
+        return redirect_to setup_path, inertia: { errors: { password: [ "can't be blank" ] } }
+      end
+
+      user = users.new(user_params)
+
+      if user.save
+        sign_in(user)
+        redirect_to root_path, notice: "Welcome to RivetCMS"
+      else
+        redirect_to setup_path, inertia: { errors: user.errors }
+      end
+    end
+
+    private
+
+    def ensure_first_run
+      redirect_to login_path if users.any?
+    end
+
+    def setup_code_valid?
+      return true unless RivetCms.setup_code_required?
+
+      ActiveSupport::SecurityUtils.secure_compare(params[:setup_code].to_s, RivetCms.setup_code)
+    end
+
+    def log_setup_code
+      return unless RivetCms.setup_code_required?
+
+      Rails.logger&.info("[RivetCms] First-run setup code: #{RivetCms.setup_code}")
+    end
+
+    def user_params
+      params.permit(:name, :email, :password)
+    end
+  end
+end

data/app/controllers/rivet_cms/trash_controller.rb

@@ -0,0 +1,68 @@
+module RivetCms
+  # One place to find everything trashed, so recovering does not depend on
+  # remembering which content type something belonged to. Entries of removed
+  # types are represented by their type below: restoring the type brings its
+  # entries back with it.
+  class TrashController < ApplicationController
+    include InertiaProps
+
+    before_action -> { authorize! :read, :content }
+
+    def show
+      scope = trashed_entries
+      if params[:type].present?
+        scope = scope.joins(:content_type).where(rivet_cms_content_types: { slug: params[:type] })
+      end
+      scope = scope.search(params[:q]) if params[:q].present?
+      page = scope.includes(:content_type, :draft_revision).order(deleted_at: :desc).page(params[:page]).per(25)
+      entries = permitted_documents(page)
+      titles = document_titles(entries)
+
+      render inertia: "Trash/Show", props: {
+        documents: entries.map { |document|
+          document_list_props(document, titles).merge(
+            content_type_name: document.content_type.name,
+            trashed_at: document.deleted_at.iso8601,
+            paths: {
+              restore: restore_content_type_document_path(document.content_type, document),
+              purge: purge_content_type_document_path(document.content_type, document)
+            }
+          )
+        },
+        q: params[:q].presence,
+        type: params[:type].presence,
+        # Filter options come from what is actually trashed, like media kinds
+        types: filter_types,
+        pagination: { page: page.current_page, total_pages: page.total_pages },
+        content_types: removed_content_types
+      }
+    end
+
+    private
+
+    def trashed_entries
+      Document.with_discarded.discarded.in_visible_types.where(organization: Current.organization)
+    end
+
+    def filter_types
+      permitted(ContentType.where(id: trashed_entries.distinct.select(:content_type_id)).order(:name), :read, :content)
+        .map { |content_type| { slug: content_type.slug, name: content_type.name } }
+    end
+
+    # Removed types are schema data; without schema read the section is empty
+    def removed_content_types
+      return [] unless can?(:read, :schema)
+
+      removed = permitted(ContentType.with_discarded.discarded.where(organization: Current.organization).order(:deleted_at), :read, :schema)
+      entry_counts = Document.with_discarded.where(content_type_id: removed.map(&:id)).group(:content_type_id).count
+
+      removed.map { |content_type|
+        content_type_props(content_type).merge(
+          removed_at: content_type.deleted_at.iso8601,
+          documents_count: entry_counts.fetch(content_type.id, 0),
+          paths: { restore: restore_content_type_path(content_type), purge: purge_content_type_path(content_type) }
+        )
+      }
+    end
+  end
+end

data/app/controllers/rivet_cms/users_controller.rb

@@ -0,0 +1,117 @@
+module RivetCms
+  # User management for built-in authentication mode. Hidden and denied under
+  # host auth. CE has no roles, so this is add / edit / deactivate only; every
+  # user can do everything. Users are deactivated, never deleted, since audit
+  # events and content attribution reference them.
+  #
+  # The authorize! :users gates below pass for everyone under CE's allow-all
+  # policy; they are the seam through which Pro restricts user management to
+  # its own roles.
+  class UsersController < ApplicationController
+    before_action :ensure_builtin_mode
+    before_action -> { authorize! :read, :users }, only: [ :index ]
+    before_action -> { authorize! :write, :users }, except: [ :index ]
+    before_action :set_user, except: [ :index, :create ]
+    before_action -> { authorize! :write, :users, record: @user }, except: [ :index, :create ]
+
+    def index
+      render inertia: "Users/Index", props: {
+        users: users.order(:created_at).map { |user| user_props(user) },
+        invite_link: flash[:invite_link]
+      }
+    end
+
+    def create
+      user = users.new(user_params)
+
+      if user.save
+        audit "user.created", user
+        flash[:invite_link] = invitation_url(user.generate_token_for(:password_setup))
+        redirect_to users_path, notice: "#{user.name} was added. Share the sign-in link below; it is shown only once."
+      else
+        redirect_to users_path, inertia: { errors: user.errors }
+      end
+    end
+
+    def update
+      if @user.update(user_params)
+        audit "user.updated", @user
+        redirect_to users_path, notice: "#{@user.name} was updated"
+      else
+        redirect_to users_path, inertia: { errors: @user.errors }
+      end
+    end
+
+    def deactivate
+      if @user == Current.user
+        return redirect_to users_path, alert: "You cannot deactivate your own account"
+      end
+
+      locked_out = User.transaction do
+        # Lock every user who can actually sign in (active with a password) so
+        # two concurrent deactivations serialize instead of both seeing "one
+        # other can still sign in" and leaving nobody who can. Pending
+        # invitees have no password and do not count. (No-op on SQLite,
+        # honored on Postgres/MySQL.)
+        signin_ids = users.active.where.not(password_digest: nil).order(:id).lock.pluck(:id)
+        next true if signin_ids.include?(@user.id) && (signin_ids - [ @user.id ]).empty?
+
+        @user.update!(active: false)
+        false
+      end
+
+      if locked_out
+        return redirect_to users_path, alert: "At least one active user must remain, or no one could sign in"
+      end
+
+      audit "user.deactivated", @user
+      redirect_to users_path, notice: "#{@user.name} was deactivated and can no longer sign in"
+    end
+
+    def reactivate
+      @user.update!(active: true)
+      audit "user.reactivated", @user
+      redirect_to users_path, notice: "#{@user.name} was reactivated"
+    end
+
+    def reset_link
+      flash[:invite_link] = invitation_url(@user.generate_token_for(:password_setup))
+      redirect_to users_path, notice: "New sign-in link for #{@user.name}; it is shown only once."
+    end
+
+    private
+
+    def ensure_builtin_mode
+      head :not_found unless RivetCms.builtin_auth?
+    end
+
+    def users
+      User.where(organization: Current.organization)
+    end
+
+    def set_user
+      @user = users.find(params[:id])
+    end
+
+    def user_params
+      params.permit(:name, :email)
+    end
+
+    def user_props(user)
+      {
+        id: user.prefix_id,
+        name: user.name,
+        email: user.email,
+        status: user.status,
+        yourself: user == Current.user,
+        created_at: user.created_at.iso8601,
+        paths: {
+          update: user_path(user),
+          deactivate: deactivate_user_path(user),
+          reactivate: reactivate_user_path(user),
+          reset_link: reset_link_user_path(user)
+        }
+      }
+    end
+  end
+end

data/app/helpers/rivet_cms/application_helper.rb

@@ -1,7 +1,17 @@
 module RivetCms
   module ApplicationHelper
-    include RivetCms::BrandColorHelper
-    include RivetCms::SignOutHelper
-    include RivetCms::FlashHelper
+    # Fails open on the page, closed on the asset: a registered extension
+    # bundle that cannot be resolved is logged and skipped instead of 500ing
+    # every admin page. Matches the can? posture of degrading rather than
+    # taking the whole admin down over an initializer typo.
+    def admin_extension_tag(kind, name)
+      case kind
+      when :script then javascript_include_tag(name, type: "module", defer: true)
+      when :stylesheet then stylesheet_link_tag(name, media: "all")
+      end
+    rescue StandardError => error
+      Rails.logger&.error("[RivetCms] admin #{kind} #{name.inspect} could not be rendered (skipping): #{error.class}: #{error.message}")
+      nil
+    end
   end
 end

data/app/helpers/rivet_cms/components_helper.rb

@@ -0,0 +1,4 @@
+module RivetCms
+  module ComponentsHelper
+  end
+end

data/app/helpers/rivet_cms/content_types_helper.rb

@@ -0,0 +1,4 @@
+module RivetCms
+  module ContentTypesHelper
+  end
+end

data/app/helpers/rivet_cms/dashboard_helper.rb

@@ -0,0 +1,4 @@
+module RivetCms
+  module DashboardHelper
+  end
+end

data/app/jobs/rivet_cms/webhook_delivery_job.rb

@@ -0,0 +1,35 @@
+require "net/http"
+
+module RivetCms
+  # Basic CE webhook delivery: one POST, JSON body, short timeouts, no
+  # signing. Any failure (connection error or non-2xx response) raises, so
+  # retry behavior uniformly follows the host's queue adapter defaults.
+  class WebhookDeliveryJob < ApplicationJob
+    # Webhook URLs are often capability URLs (tokens in path or query):
+    # keep them out of job argument logs, and log only the host on failure.
+    self.log_arguments = false
+
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 10
+    WRITE_TIMEOUT = 10
+
+    class DeliveryError < StandardError; end
+
+    def perform(url, payload)
+      uri = URI.parse(url)
+      http = Net::HTTP.new(uri.hostname, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = OPEN_TIMEOUT
+      http.read_timeout = READ_TIMEOUT
+      http.write_timeout = WRITE_TIMEOUT
+
+      request = Net::HTTP::Post.new(uri.request_uri, "Content-Type" => "application/json", "User-Agent" => "RivetCMS/#{RivetCms::VERSION}")
+      request.body = payload.to_json
+      response = http.request(request)
+
+      unless response.is_a?(Net::HTTPSuccess)
+        raise DeliveryError, "webhook to #{uri.host} responded #{response.code}"
+      end
+    end
+  end
+end

data/app/models/concerns/rivet_cms/has_fields.rb

@@ -0,0 +1,31 @@
+module RivetCms
+  # Shared by content types and components. The fields association is
+  # soft-delete scoped (kept only), so dependent: :destroy would leave
+  # discarded fields holding the FK — destroy those explicitly on delete.
+  module HasFields
+    extend ActiveSupport::Concern
+
+    included do
+      has_many :fields, dependent: :destroy
+      before_destroy :destroy_discarded_fields, prepend: true
+    end
+
+    def all_fields
+      fields.with_discarded
+    end
+
+    def active_fields
+      fields
+    end
+
+    def discarded_fields
+      fields.with_discarded.discarded
+    end
+
+    private
+
+    def destroy_discarded_fields
+      discarded_fields.destroy_all
+    end
+  end
+end

data/app/models/concerns/rivet_cms/organization_scoped.rb

@@ -0,0 +1,17 @@
+module RivetCms
+  module OrganizationScoped
+    extend ActiveSupport::Concern
+
+    included do
+      belongs_to :organization
+      before_validation :assign_default_organization
+      validates :organization, presence: true
+    end
+
+    private
+
+    def assign_default_organization
+      self.organization ||= RivetCms::Current.organization
+    end
+  end
+end

data/app/models/concerns/rivet_cms/revision_owned.rb

@@ -0,0 +1,36 @@
+module RivetCms
+  class RevisionImmutableError < StandardError; end
+
+  module RevisionOwned
+    extend ActiveSupport::Concern
+
+    included do
+      belongs_to :owner, polymorphic: true
+      before_update :guard_published_owner!
+      validate :field_matches_owner_organization
+    end
+
+    def owning_revision
+      node = owner
+      node = node.owner while node.is_a?(ComponentInstance)
+      node if node.is_a?(DocumentRevision)
+    end
+
+    def owner_organization_id
+      owning_revision&.document&.organization_id
+    end
+
+    private
+
+    def guard_published_owner!
+      raise RevisionImmutableError, "cannot modify a published revision" if owning_revision&.published?
+    end
+
+    def field_matches_owner_organization
+      return if field.nil? || owner_organization_id.nil?
+      return if field.organization_id == owner_organization_id
+
+      errors.add(:field, "must belong to the same organization")
+    end
+  end
+end

data/app/models/concerns/rivet_cms/sluggable.rb

@@ -0,0 +1,38 @@
+module RivetCms
+  module Sluggable
+    extend ActiveSupport::Concern
+
+    SLUG_FORMAT = /\A[a-z0-9]+(?:-[a-z0-9]+)*\z/
+
+    included do
+      before_validation :generate_slug, if: -> { slug.blank? && respond_to?(:name) && name.present? }
+
+      validates :slug, presence: true,
+                       format: { with: SLUG_FORMAT, message: "must be lowercase alphanumeric with hyphens" }
+    end
+
+    private
+
+    def generate_slug
+      base_slug = name.parameterize
+      self.slug = unique_slug(base_slug)
+    end
+
+    def unique_slug(base_slug)
+      slug = base_slug
+      counter = 1
+      scope = self.class.unscoped.where.not(id: id)
+
+      if respond_to?(:organization_id) && organization_id.present?
+        scope = scope.where(organization_id: organization_id)
+      end
+
+      while scope.exists?(slug: slug)
+        slug = "#{base_slug}-#{counter}"
+        counter += 1
+      end
+
+      slug
+    end
+  end
+end

data/app/models/concerns/rivet_cms/soft_deletable.rb

@@ -0,0 +1,42 @@
+module RivetCms
+  module SoftDeletable
+    extend ActiveSupport::Concern
+
+    included do
+      scope :kept, -> { where(deleted_at: nil) }
+      scope :discarded, -> { where.not(deleted_at: nil) }
+
+      default_scope { kept }
+    end
+
+    class_methods do
+      def with_discarded
+        unscope(where: :deleted_at)
+      end
+    end
+
+    def discard
+      update(deleted_at: Time.current)
+    end
+
+    def discard!
+      update!(deleted_at: Time.current)
+    end
+
+    def undiscard
+      update(deleted_at: nil)
+    end
+
+    def undiscard!
+      update!(deleted_at: nil)
+    end
+
+    def discarded?
+      deleted_at.present?
+    end
+
+    def kept?
+      deleted_at.nil?
+    end
+  end
+end

data/app/models/concerns/rivet_cms/typed_value.rb

@@ -0,0 +1,51 @@
+module RivetCms
+  module TypedValue
+    extend ActiveSupport::Concern
+
+    VALUE_COLUMNS = %i[
+      string_value text_value integer_value boolean_value
+      decimal_value datetime_value date_value json_value
+    ].freeze
+
+    SCALAR_COLUMN = {
+      "string" => :string_value,
+      "text" => :text_value,
+      "rich_text" => :text_value,
+      "markdown" => :text_value,
+      "integer" => :integer_value,
+      "decimal" => :decimal_value,
+      "enumeration" => :string_value,
+      "boolean" => :boolean_value,
+      "date" => :date_value,
+      "datetime" => :datetime_value
+    }.freeze
+
+    def value
+      return media_asset if field&.attachment?
+
+      column = value_column
+      column ? self[column] : nil
+    end
+
+    def value=(raw)
+      if field&.attachment?
+        self.media_asset = MediaAsset.find_by(id: extract_media_asset_id(raw))
+        return
+      end
+
+      column = value_column
+      self[column] = raw if column
+    end
+
+    private
+
+    def extract_media_asset_id(raw)
+      raw = raw["id"] || raw[:id] if raw.is_a?(Hash)
+      raw.presence
+    end
+
+    def value_column
+      SCALAR_COLUMN[field&.field_type]
+    end
+  end
+end