rivet_cms 0.1.2.pre → 0.3.0

data/app/models/rivet_cms/api_token.rb

@@ -0,0 +1,64 @@
+require "digest"
+require "securerandom"
+
+module RivetCms
+  class ApiToken < ApplicationRecord
+    include OrganizationScoped
+
+    has_prefix_id :tok
+
+    enum :scope, { published: 0, preview: 1 }
+
+    validates :name, presence: true
+    validates :token_digest, presence: true, uniqueness: true
+    validates :token_last4, presence: true
+
+    scope :recent, -> { order(created_at: :desc) }
+
+    # Set only on the record returned by generate!; the secret is never stored.
+    attr_reader :plaintext
+
+    def self.digest(raw)
+      Digest::SHA256.hexdigest(raw.to_s)
+    end
+
+    def self.generate!(name:, scope: :published, organization: RivetCms::Current.organization, expires_at: nil)
+      raw = SecureRandom.hex(32)
+      token = create!(
+        name: name,
+        scope: scope,
+        organization: organization,
+        expires_at: expires_at,
+        token_digest: digest(raw),
+        token_last4: raw.last(4)
+      )
+      token.instance_variable_set(:@plaintext, raw)
+      token
+    end
+
+    # Global lookup — org is derived from the token, not scoped by the caller.
+    def self.authenticate(raw)
+      return nil if raw.blank?
+
+      token = find_by(token_digest: digest(raw))
+      return nil if token.nil? || token.expired?
+
+      token
+    end
+
+    def expired?
+      expires_at.present? && expires_at.past?
+    end
+
+    # Throttled so the delivery API doesn't write to this row on every request.
+    def touch_used!
+      return if last_used_at && last_used_at > 10.minutes.ago
+
+      update_column(:last_used_at, Time.current)
+    end
+
+    def masked
+      "••••#{token_last4}"
+    end
+  end
+end

data/app/models/rivet_cms/category.rb

@@ -0,0 +1,20 @@
+module RivetCms
+  class Category < ApplicationRecord
+    has_prefix_id :cat
+    include OrganizationScoped
+
+    has_many :components, dependent: :restrict_with_error
+
+    validates :name, presence: true
+    validates :slug, presence: true, uniqueness: { scope: :organization_id }
+    validates :system, inclusion: { in: [ true, false ] }
+
+    scope :system_categories, -> { where(system: true) }
+    scope :custom_categories, -> { where(system: false) }
+    scope :ordered, -> { order(:position) }
+
+    def destroyable?
+      !system? && components.empty?
+    end
+  end
+end

data/app/models/rivet_cms/component.rb

@@ -1,4 +1,14 @@
 module RivetCms
   class Component < ApplicationRecord
+    include Sluggable
+
+    has_prefix_id :comp
+    include OrganizationScoped
+    include HasFields
+
+    belongs_to :category
+
+    validates :name, presence: true
+    validates :slug, uniqueness: { scope: :organization_id }
   end
 end

data/app/models/rivet_cms/component_instance.rb

@@ -0,0 +1,27 @@
+module RivetCms
+  class ComponentInstance < ApplicationRecord
+    include RevisionOwned
+
+    has_prefix_id :cmpi
+
+    belongs_to :field
+    belongs_to :component
+
+    has_many :content_values, as: :owner, dependent: :destroy
+    has_many :relations, as: :owner, dependent: :destroy
+    has_many :component_instances, as: :owner, dependent: :destroy
+
+    validate :component_in_same_organization
+
+    scope :ordered, -> { order(:position) }
+
+    private
+
+    def component_in_same_organization
+      return if component.nil? || owner_organization_id.nil?
+      return if component.organization_id == owner_organization_id
+
+      errors.add(:component, "must belong to the same organization")
+    end
+  end
+end

data/app/models/rivet_cms/content_type.rb

@@ -1,40 +1,53 @@
 module RivetCms
   class ContentType < ApplicationRecord
-    has_prefix_id :content_type, minimum_length: RivetCms.configuration.prefixed_ids_length, salt: RivetCms.configuration.prefixed_ids_salt, alphabet: RivetCms.configuration.prefixed_ids_alphabet
+    include Sluggable
 
-    has_many :contents, dependent: :destroy
-    has_many :fields, dependent: :destroy
+    has_prefix_id :ctype
+    include OrganizationScoped
+    include HasFields
+    include SoftDeletable
+
+    # Deleting a type must never cascade into content. Discarding hides the
+    # type and its entries; a real destroy is refused while entries exist, so
+    # there is no path from one click to a wiped library.
+    has_many :documents, dependent: :restrict_with_error
+    # documents is soft-delete scoped, so restrict_with_error cannot see a
+    # trashed entry; without this a destroy would slip past it into an FK error.
+    before_destroy :restrict_when_entries_remain, prepend: true
 
     validates :name, presence: true
-    validates :slug, presence: true
-    validates :slug, format: { with: /\A[a-z0-9\-]+\z/, message: "can only contain lowercase letters, numbers, and hyphens" }
-    
-    # Default to collection type (is_single = false)
-    after_initialize :set_default_type, if: :new_record?
+    # The unique index spans removed rows too, so a removed type keeps its slug
+    # reserved and restoring one can never collide with something created since.
+    validates :slug, uniqueness: { scope: :organization_id }
+    validate :slug_not_held_by_removed_type
+    validates :single, inclusion: { in: [ true, false ] }
 
-    after_commit :invalidate_api_docs_cache
+    scope :singles, -> { where(single: true) }
+    scope :collections, -> { where(single: false) }
 
     def collection?
-      !is_single
-    end
-
-    def single?
-      is_single
-    end
-
-    # For compatibility with existing views
-    def is_collection
-      !is_single
+      !single?
     end
 
     private
 
-    def set_default_type
-      self.is_single = false if self.is_single.nil?
+    def restrict_when_entries_remain
+      return unless Document.with_discarded.where(content_type_id: id).exists?
+
+      errors.add(:base, :"restrict_dependent_destroy.has_many", record: Document.model_name.human.downcase.pluralize)
+      throw :abort
     end
 
-    def invalidate_api_docs_cache
-      Rails.cache.delete("rivet_cms_api_docs")
+    # Rails' uniqueness validator ignores the kept default scope, so a slug held
+    # by a removed type does produce "has already been taken". Declared after it
+    # so that baffling message can be replaced with one that says what to do.
+    def slug_not_held_by_removed_type
+      return if slug.blank?
+      return if persisted? && !slug_changed?
+      return unless self.class.with_discarded.discarded.exists?(organization_id: organization_id, slug: slug)
+
+      errors.delete(:slug, :taken)
+      errors.add(:slug, "belongs to a removed content type; restore that type instead of recreating it")
     end
   end
 end

data/app/models/rivet_cms/content_value.rb

@@ -1,4 +1,23 @@
 module RivetCms
   class ContentValue < ApplicationRecord
+    include RevisionOwned
+    include TypedValue
+
+    has_prefix_id :val
+
+    belongs_to :field
+    belongs_to :media_asset, class_name: "RivetCms::MediaAsset", optional: true
+
+    validates :field_id, uniqueness: { scope: [ :owner_type, :owner_id ] }
+    validate :media_asset_matches_owner_organization
+
+    private
+
+    def media_asset_matches_owner_organization
+      return if media_asset.nil? || owner_organization_id.nil?
+      return if media_asset.organization_id == owner_organization_id
+
+      errors.add(:media_asset, "must belong to the same organization")
+    end
   end
 end

data/app/models/rivet_cms/current.rb

@@ -0,0 +1,6 @@
+module RivetCms
+  class Current < ActiveSupport::CurrentAttributes
+    attribute :organization
+    attribute :user
+  end
+end

data/app/models/rivet_cms/document.rb

@@ -0,0 +1,71 @@
+module RivetCms
+  class Document < ApplicationRecord
+    include OrganizationScoped
+    include SoftDeletable
+
+    has_prefix_id :doc
+
+    belongs_to :content_type
+    belongs_to :published_revision, class_name: "RivetCms::DocumentRevision", optional: true
+    belongs_to :draft_revision, class_name: "RivetCms::DocumentRevision", optional: true
+    has_many :revisions, class_name: "RivetCms::DocumentRevision", dependent: :destroy
+
+    before_validation :assign_singleton_key
+    before_destroy :detach_revisions, prepend: true
+
+    # Unscoped like ContentType: a trashed entry keeps its slug reserved so
+    # restoring it can never collide with something created since.
+    validates :slug, presence: true, uniqueness: { scope: :content_type_id }
+    # Guarded by slug_changed? so entries created before this rule can still
+    # save and publish; the format applies once someone touches the slug.
+    validates :slug, format: { with: Sluggable::SLUG_FORMAT, message: "must be lowercase alphanumeric with hyphens" }, if: :slug_changed?
+    validates :singleton_key, uniqueness: { scope: :content_type_id }, if: -> { singleton_key.present? }
+    validate :slug_not_held_by_trashed_entry
+    validate :singleton_not_held_by_trashed_entry
+    validate :content_type_in_same_organization
+
+    scope :recent, -> { order(created_at: :desc) }
+    # ContentType is soft-deletable, so a document can outlive its type's
+    # visibility; cross-type queries must exclude those or content_type is nil.
+    scope :in_visible_types, -> { where(content_type_id: ContentType.select(:id)) }
+    scope :search, ->(query) { where("LOWER(#{table_name}.slug) LIKE ?", "%#{sanitize_sql_like(query.downcase)}%") }
+
+    private
+
+    def assign_singleton_key
+      self.singleton_key = content_type&.single? ? "singleton" : nil
+    end
+
+    def detach_revisions
+      update_columns(published_revision_id: nil, draft_revision_id: nil)
+    end
+
+    # Like ContentType, the uniqueness validators ignore the kept scope, so a
+    # trashed entry produces "has already been taken". Replace that with a
+    # message that points at the trash.
+    def slug_not_held_by_trashed_entry
+      return if slug.blank?
+      return if persisted? && !slug_changed?
+      return unless self.class.with_discarded.discarded.exists?(content_type_id: content_type_id, slug: slug)
+
+      errors.delete(:slug, :taken)
+      errors.add(:slug, "belongs to an entry in the trash; restore that entry instead of recreating it")
+    end
+
+    def singleton_not_held_by_trashed_entry
+      return if singleton_key.blank?
+      return if persisted? && !singleton_key_changed?
+      return unless self.class.with_discarded.discarded.exists?(content_type_id: content_type_id, singleton_key: singleton_key)
+
+      errors.delete(:singleton_key, :taken)
+      errors.add(:base, "This single's entry is in the trash; restore it instead of creating a new one")
+    end
+
+    def content_type_in_same_organization
+      return if content_type.nil? || organization.nil?
+      return if content_type.organization == organization
+
+      errors.add(:content_type, "must belong to the same organization")
+    end
+  end
+end

data/app/models/rivet_cms/document_revision.rb

@@ -0,0 +1,128 @@
+module RivetCms
+  class ContentInvalidError < StandardError
+    attr_reader :errors
+
+    def initialize(errors)
+      @errors = errors
+      super("content is invalid: #{errors.map(&:message).join(', ')}")
+    end
+  end
+
+  # Raised when content is written or published into a content type that has
+  # been removed. Its entries are kept but no longer served, so they must not
+  # be edited or republished until the type is restored.
+  class RemovedContentTypeError < StandardError; end
+
+  # Raised when a revision is written or published while its entry sits in the
+  # trash. Document's kept scope makes revision.document nil, so without this
+  # every such path would NoMethodError instead of saying what is wrong.
+  class TrashedEntryError < StandardError; end
+
+  class DocumentRevision < ApplicationRecord
+    has_prefix_id :rev
+
+    belongs_to :document
+    # The reference stays optional so deleting a host user doesn't orphan or
+    # block revisions; author_name is the durable attribution and is required.
+    belongs_to :author, polymorphic: true, optional: true
+
+    validates :author_name, presence: true
+
+    has_many :content_values, as: :owner, dependent: :destroy
+    has_many :relations, as: :owner, dependent: :destroy
+    has_many :component_instances, as: :owner, dependent: :destroy
+
+    enum :state, { draft: 0, published: 1, archived: 2 }
+
+    scope :ordered, -> { order(created_at: :desc, id: :desc) }
+
+    # publisher attributes the snapshot to whoever published it, which is not
+    # always the person who last saved the draft.
+    def publish!(publisher: nil, publisher_name: nil)
+      raise TrashedEntryError, "entry is in the trash; restore it before publishing" if document.nil?
+      raise RemovedContentTypeError, "content type was removed; restore it before publishing" unless ContentType.exists?(id: document.content_type_id)
+
+      validator = ContentValidator.new(self).validate
+      raise ContentInvalidError, validator.errors unless validator.valid?
+
+      snapshot = transaction do
+        published = document.revisions.create!(
+          locale: locale,
+          schema_version: schema_version,
+          author: publisher_name.present? ? publisher : author,
+          author_name: publisher_name.presence || author_name,
+          state: :published,
+          published_at: Time.current
+        )
+        self.class.copy_owned_into(self, published)
+        document.update!(published_revision: published)
+        # keep_ids protects the source: republishing an old snapshot as a
+        # rollback should not destroy the snapshot it rolled back to.
+        RevisionPruner.new(document, keep_ids: [ id ]).prune!
+        published
+      end
+
+      # Hooks fire only once the write is durable, even under an outer
+      # transaction; the gem requires Rails 7.2+ for this guarantee
+      ActiveRecord.after_all_transactions_commit { Hooks.run(:publish, snapshot) }
+      snapshot
+    end
+
+    # Replaces the target draft's owned records with the source's.
+    # copy_owned_into alone cannot do this: content values would collide on
+    # their per-field uniqueness and relations and component instances would
+    # silently duplicate. This is the primitive a revision-history rollback
+    # builds on.
+    #
+    # requires_new opens a savepoint so a failed copy cannot leave the target
+    # empty when a caller rescues inside its own transaction. Values for
+    # soft-deleted fields are left alone, since the copy cannot restore them
+    # and undiscard is expected to recover them.
+    def self.restore_owned_into(source, target)
+      raise ArgumentError, "cannot restore a revision into itself" if source.id == target.id
+      raise ArgumentError, "restore target must be a draft revision" unless target.draft?
+
+      transaction(requires_new: true) do
+        target.content_values.where(field_id: Field.select(:id)).destroy_all
+        target.relations.where(field_id: Field.select(:id)).destroy_all
+        target.component_instances.where(field_id: Field.select(:id)).destroy_all
+        copy_owned_into(source, target)
+      end
+      target
+    end
+
+    # Snapshots carry kept-field data only: a soft-deleted field's values may
+    # linger on the draft (undiscard recovers them), but copying them would
+    # fail the clone's field association, which resolves through Field's
+    # kept-only default scope.
+    def self.copy_owned_into(source, target)
+      source.content_values.where(field_id: Field.select(:id)).find_each do |cv|
+        clone = target.content_values.build(field_id: cv.field_id, media_asset_id: cv.media_asset_id)
+        ContentValue::VALUE_COLUMNS.each { |col| clone[col] = cv[col] }
+        clone.save!
+      end
+
+      # Same shape as the kept-field filter: a trashed target would fail the
+      # clone's required belongs_to, so it is dropped rather than raising.
+      # For restore_owned_into that drop is permanent: the copied draft loses
+      # the link even if the target later leaves the trash. A rollback UI
+      # should count these and tell the user, as DraftWriter does.
+      source.relations.where(field_id: Field.select(:id), target_document_id: Document.select(:id)).find_each do |relation|
+        target.relations.create!(
+          field_id: relation.field_id,
+          target_document_id: relation.target_document_id,
+          position: relation.position
+        )
+      end
+
+      source.component_instances.where(field_id: Field.select(:id)).find_each do |instance|
+        clone = target.component_instances.create!(
+          field_id: instance.field_id,
+          component_id: instance.component_id,
+          position: instance.position
+        )
+        copy_owned_into(instance, clone)
+      end
+    end
+  end
+end

data/app/models/rivet_cms/entry.rb

@@ -0,0 +1,73 @@
+module RivetCms
+  # Read-only view of one serialized document, as returned by the Ruby content
+  # helpers. Field values are reachable as methods (entry.title), via [] for
+  # keys that collide with real methods (entry[:slug]), or through #data.
+  class Entry
+    def initialize(serialized)
+      @hash = serialized
+    end
+
+    def id
+      @hash[:id]
+    end
+
+    def slug
+      @hash[:slug]
+    end
+
+    def content_type
+      @hash[:content_type]
+    end
+
+    def state
+      @hash[:state]
+    end
+
+    def data
+      @hash[:data] || {}
+    end
+
+    def to_h
+      @hash
+    end
+
+    def published?
+      state.to_s == "published"
+    end
+
+    def [](key)
+      wrap(data[key.to_s])
+    end
+
+    def key?(key)
+      data.key?(key.to_s)
+    end
+
+    def method_missing(name, *args, &block)
+      key = name.to_s
+      return wrap(data[key]) if args.empty? && block.nil? && data.key?(key)
+
+      super
+    end
+
+    def respond_to_missing?(name, include_private = false)
+      data.key?(name.to_s) || super
+    end
+
+    def inspect
+      "#<RivetCms::Entry #{content_type}/#{slug} (#{state})>"
+    end
+
+    private
+
+    # Populated references become nested entries; everything else (scalars,
+    # media hashes, component hashes, shallow refs) passes through untouched.
+    def wrap(value)
+      case value
+      when Hash then value.key?(:data) ? Entry.new(value) : value
+      when Array then value.map { |item| wrap(item) }
+      else value
+      end
+    end
+  end
+end

data/app/models/rivet_cms/entry_collection.rb

@@ -0,0 +1,41 @@
+module RivetCms
+  # Enumerable page of entries with the pagination numbers host views need.
+  class EntryCollection
+    include Enumerable
+
+    attr_reader :page, :per_page, :total, :total_pages
+
+    def initialize(entries, page: 1, per_page: entries.size, total: entries.size, total_pages: 1)
+      @entries = entries
+      @page = page
+      @per_page = per_page
+      @total = total
+      @total_pages = total_pages
+    end
+
+    def each(&block)
+      @entries.each(&block)
+    end
+
+    def to_a
+      @entries.dup
+    end
+
+    def size
+      @entries.size
+    end
+    alias length size
+
+    def [](index)
+      @entries[index]
+    end
+
+    def empty?
+      @entries.empty?
+    end
+
+    def inspect
+      "#<RivetCms::EntryCollection size=#{size} page=#{page}/#{total_pages} total=#{total}>"
+    end
+  end
+end