rivet_cms 0.1.2.pre → 0.3.0

data/app/services/rivet_cms/open_api_generator.rb

@@ -1,245 +1,197 @@
 module RivetCms
+  # Builds an OpenAPI 3 document describing the delivery API for an organization's
+  # content types. Field types map to JSON Schema; references/components/media
+  # expand into nested schemas.
   class OpenApiGenerator
-    class << self
-      def generate
-        Rails.cache.fetch("rivet_cms_api_docs", expires_in: 1.hour) do
-          generate_schema
-        end
-      end
+    # content_types/components narrow the document to a permitted subset;
+    # nil means all. Excluded types must not be referenced either, or the
+    # document would carry $refs to schemas it does not contain.
+    def initialize(organization, base_url: "/api", content_types: nil, components: nil)
+      @organization = organization
+      @base_url = base_url
+      @content_types = content_types
+      @components = components
+    end
 
-      private
-
-      def generate_schema
-        schema = {
-          "openapi" => "3.0.1",
-          "info" => {
-            "title" => "RivetCMS API",
-            "version" => "1.0.0",
-            "description" => "API documentation for content types"
-          },
-          "paths" => generate_paths,
-          "components" => {
-            "schemas" => generate_schemas,
-            "securitySchemes" => {
-              "bearerAuth" => {
-                "type" => "http",
-                "scheme" => "bearer",
-                "bearerFormat" => "JWT"
-              }
-            }
-          },
-          "security" => [
-            { "bearerAuth" => [] }
-          ]
-        }
+    def as_json(*)
+      content_types = (@content_types || @organization.content_types.order(:name)).to_a
 
-        deep_stringify_keys(schema)
-      end
+      {
+        openapi: "3.0.3",
+        info: { title: "RivetCms Delivery API", version: "1.0.0" },
+        servers: [ { url: @base_url } ],
+        components: {
+          securitySchemes: { bearerAuth: { type: "http", scheme: "bearer" } },
+          schemas: content_types.each_with_object({}) { |ct, acc| acc[schema_name(ct)] = document_schema(ct) }
+        },
+        security: [ { bearerAuth: [] } ],
+        paths: content_types.each_with_object({}) { |ct, acc| add_paths(acc, ct) }
+      }
+    end
 
-      def deep_stringify_keys(obj)
-        case obj
-        when Hash
-          obj.each_with_object({}) do |(key, value), result|
-            result[key.to_s] = deep_stringify_keys(value)
-          end
-        when Array
-          obj.map { |item| deep_stringify_keys(item) }
-        else
-          obj
-        end
-      end
+    private
 
-      def generate_paths
-        paths = {}
-        
-        ContentType.all.each do |content_type|
-          if content_type.is_single
-            paths.merge!(generate_single_type_paths(content_type))
-          else
-            paths.merge!(generate_collection_type_paths(content_type))
-          end
-        end
+    def add_paths(paths, content_type)
+      item = "#{@base_url}/#{content_type.slug}"
+      ref = { "$ref" => "#/components/schemas/#{schema_name(content_type)}" }
 
-        paths
-      end
+      paths["#{item}"] = {
+        get: {
+          summary: "List #{content_type.name}",
+          parameters: list_params,
+          responses: { "200" => { description: "A page of documents", content: json_content(list_schema(ref)) } }
+        }
+      }
+      paths["#{item}/{slug}"] = {
+        get: {
+          summary: "Fetch one #{content_type.name} by slug",
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "preview", in: "query", required: false, schema: { type: "boolean" },
+              description: "Requires a preview-scoped token; returns the draft revision." },
+            populate_param,
+            fields_param
+          ],
+          responses: { "200" => { description: "A document", content: json_content(ref) }, "404" => { description: "Not found" } }
+        }
+      }
+    end
+
+    def list_params
+      [
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        { name: "per_page", in: "query", schema: { type: "integer", default: 25, maximum: 100 } },
+        { name: "sort", in: "query", schema: { type: "string" },
+          description: "Field/column, prefix - for descending (e.g. -published_at)." },
+        populate_param,
+        fields_param
+      ]
+    end
+
+    def populate_param
+      { name: "populate", in: "query", schema: { type: "string" },
+        description: "Comma-separated reference field keys to expand one level into full documents, or * for all." }
+    end
+
+    def fields_param
+      { name: "fields", in: "query", schema: { type: "string" },
+        description: "Comma-separated field keys to include in data; also limits which populated fields appear." }
+    end
 
-      def generate_single_type_paths(content_type)
-        {
-          "/api/v1/#{content_type.slug}" => {
-            "get" => {
-              "tags" => [content_type.name],
-              "summary" => "Get #{content_type.name}",
-              "responses" => {
-                "200" => {
-                  "description" => "Returns the #{content_type.name}",
-                  "content" => {
-                    "application/json" => {
-                      "schema" => { "$ref" => "#/components/schemas/#{content_type.slug}" }
-                    }
-                  }
-                }
-              }
-            }
-          }
+    def list_schema(item_ref)
+      {
+        type: "object",
+        properties: {
+          data: { type: "array", items: item_ref },
+          meta: { type: "object", properties: {
+            page: { type: "integer" }, per_page: { type: "integer" },
+            total: { type: "integer" }, total_pages: { type: "integer" }
+          } }
         }
-      end
+      }
+    end
 
-      def generate_collection_type_paths(content_type)
-        {
-          "/api/v1/#{content_type.slug}" => {
-            "get" => {
-              "tags" => [content_type.name],
-              "summary" => "List all #{content_type.name.pluralize}",
-              "parameters" => [
-                {
-                  "name" => "page",
-                  "in" => "query",
-                  "description" => "Page number for pagination",
-                  "schema" => { "type" => "integer", "default" => 1 },
-                  "required" => false
-                },
-                {
-                  "name" => "per_page",
-                  "in" => "query",
-                  "description" => "Number of items per page",
-                  "schema" => { "type" => "integer", "default" => 25 },
-                  "required" => false
-                }
-              ],
-              "responses" => {
-                "200" => {
-                  "description" => "Returns list of #{content_type.name.pluralize}",
-                  "content" => {
-                    "application/json" => {
-                      "schema" => {
-                        "type" => "object",
-                        "properties" => {
-                          "data" => {
-                            "type" => "array",
-                            "items" => { "$ref" => "#/components/schemas/#{content_type.slug}" }
-                          },
-                          "meta" => {
-                            "type" => "object",
-                            "properties" => {
-                              "current_page" => { "type" => "integer" },
-                              "total_pages" => { "type" => "integer" },
-                              "total_count" => { "type" => "integer" }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "/api/v1/#{content_type.slug}/{id}" => {
-            "get" => {
-              "tags" => [content_type.name],
-              "summary" => "Get a specific #{content_type.name}",
-              "parameters" => [
-                {
-                  "name" => "id",
-                  "in" => "path",
-                  "required" => true,
-                  "schema" => { "type" => "string" },
-                  "description" => "The ID of the #{content_type.name} to retrieve"
-                }
-              ],
-              "responses" => {
-                "200" => {
-                  "description" => "Returns the #{content_type.name}",
-                  "content" => {
-                    "application/json" => {
-                      "schema" => { "$ref" => "#/components/schemas/#{content_type.slug}" }
-                    }
-                  }
-                },
-                "404" => {
-                  "description" => "#{content_type.name} not found"
-                }
-              }
-            }
-          }
+    def document_schema(content_type)
+      {
+        type: "object",
+        properties: {
+          id: { type: "string" },
+          slug: { type: "string" },
+          content_type: { type: "string" },
+          state: { type: "string", enum: %w[draft published archived] },
+          data: { type: "object", properties: content_type.fields.kept.ordered.each_with_object({}) { |f, acc| acc[f.key] = field_schema(f) } }
         }
+      }
+    end
+
+    def field_schema(field)
+      case field.field_type
+      when "integer" then { type: "integer" }
+      when "decimal" then { type: "number" }
+      when "boolean" then { type: "boolean" }
+      when "date" then { type: "string", format: "date" }
+      when "datetime" then { type: "string", format: "date-time" }
+      when "enumeration" then enumeration_schema(field)
+      when "reference" then reference_schema(field)
+      when "component" then component_schema(field)
+      when "image", "video", "file"
+        { type: "object", nullable: true, properties: {
+          id: { type: "integer" }, filename: { type: "string" }, content_type: { type: "string" },
+          byte_size: { type: "integer" }, title: { type: "string", nullable: true },
+          alt: { type: "string", nullable: true }, description: { type: "string", nullable: true },
+          url: { type: "string" }
+        } }
+      when "string", "text" then string_schema(field)
+      else { type: "string" }
       end
+    end
 
-      def generate_schemas
-        schemas = {}
-        
-        ContentType.all.each do |content_type|
-          schemas[content_type.slug] = generate_content_type_schema(content_type)
-        end
+    def enumeration_schema(field)
+      choices = Array(field.config&.dig("choices"))
+      choices.any? ? { type: "string", enum: choices } : { type: "string" }
+    end
 
-        schemas
-      end
+    def string_schema(field)
+      pattern = field.config&.dig("pattern")
+      pattern.present? ? { type: "string", pattern: pattern } : { type: "string" }
+    end
 
-      def generate_content_type_schema(content_type)
-        {
-          "type" => "object",
-          "properties" => generate_properties(content_type)
-        }
+    # Shallow {id, slug} by default; when the field's configured target resolves,
+    # a oneOf with the target schema documents the populated shape.
+    # A target outside the generated subset stays shallow: emitting its $ref
+    # would point at a schema this document does not contain.
+    def reference_schema(field)
+      shallow = { type: "object", properties: { id: { type: "string" }, slug: { type: "string" } } }
+      target = @organization.content_types.find_by(id: field.config&.dig("content_type_id"))
+      inner = target && included_type_ids.include?(target.id) ? { oneOf: [ shallow, { "$ref" => "#/components/schemas/#{schema_name(target)}" } ] } : shallow
+      collapse(field, inner)
+    end
+
+    # Same rule: a component outside the subset renders as an opaque object
+    # rather than leaking its field structure.
+    def component_schema(field)
+      component = Component.find_by(id: field.config&.dig("component_id"), organization_id: field.organization_id)
+      inner = if component && included_component_ids.include?(component.id)
+        { type: "object", properties: component.fields.kept.ordered.each_with_object({}) { |f, acc| acc[f.key] = field_schema(f) } }
+      else
+        { type: "object" }
       end
+      collapse(field, inner)
+    end
 
-      def generate_properties(content_type)
-        properties = {
-          "id" => { "type" => "string" },
-          "title" => { "type" => "string" },
-          "slug" => { "type" => "string" },
-          "status" => { 
-            "type" => "string",
-            "enum" => ["draft", "published", "archived"]
-          },
-          "created_at" => { "type" => "string", "format" => "date-time" },
-          "updated_at" => { "type" => "string", "format" => "date-time" }
-        }
+    def included_type_ids
+      @included_type_ids ||= (@content_types || @organization.content_types).map(&:id).to_set
+    end
 
-        content_type.fields.each do |field|
-          properties[field.name] = field_type_to_schema(field)
-        end
+    def included_component_ids
+      @included_component_ids ||= (@components || @organization.components).map(&:id).to_set
+    end
 
-        properties
-      end
+    def collapse(field, schema)
+      field.max_items == 1 ? schema : { type: "array", items: schema }
+    end
+
+    def json_content(schema)
+      { "application/json" => { schema: schema } }
+    end
+
+    # Distinct slugs can produce the same camelized name (top-10 and top10
+    # both yield Top10), so names are deduped once per generation.
+    def schema_name(content_type)
+      schema_names.fetch(content_type.id)
+    end
 
-      def field_type_to_schema(field)
-        case field.field_type
-        when 'string', 'text'
-          { "type" => "string" }
-        when 'integer'
-          { "type" => "integer" }
-        when 'boolean'
-          { "type" => "boolean" }
-        when 'media'
-          {
-            "type" => "object",
-            "properties" => {
-              "url" => { "type" => "string" },
-              "filename" => { "type" => "string" },
-              "content_type" => { "type" => "string" }
-            }
-          }
-        when 'relation'
-          {
-            "type" => "object",
-            "properties" => {
-              "id" => { "type" => "string" },
-              "title" => { "type" => "string" }
-            }
-          }
-        when 'component'
-          {
-            "type" => "object",
-            "properties" => {
-              "id" => { "type" => "string" },
-              "type" => { "type" => "string" },
-              "fields" => { "type" => "object" }
-            }
-          }
-        else
-          { "type" => "string" }
+    def schema_names
+      @schema_names ||= @organization.content_types.order(:id).each_with_object({}) do |ct, map|
+        base = ct.slug.split("-").map(&:capitalize).join
+        name = base
+        suffix = 2
+        while map.value?(name)
+          name = "#{base}_#{suffix}"
+          suffix += 1
         end
+        map[ct.id] = name
       end
     end
   end
-end 
+end

data/app/services/rivet_cms/revision_pruner.rb

@@ -0,0 +1,64 @@
+module RivetCms
+  # Enforces retention for one document: keeps the newest N superseded
+  # published snapshots per locale and destroys the rest. Candidates exclude
+  # the document's live pointers, re-read from the database so a stale
+  # in-memory copy cannot target a revision another request just published,
+  # and pruning is skipped entirely unless a live published revision exists.
+  class RevisionPruner
+    def initialize(document, keep_ids: [])
+      @document = document
+      @keep_ids = Array(keep_ids).compact
+      @destroyed = 0
+    end
+
+    def prune!
+      @destroyed = 0 # defensive: report this run, not a previous one
+      retention = RivetCms.normalized_retention_for(@document)
+      return 0 if retention == :all
+
+      published_id, draft_id = live_pointers
+      return 0 if published_id.nil? # nothing is live: never guess what to keep
+
+      protected_ids = ([ published_id, draft_id ] + @keep_ids).compact
+      live_locale = DocumentRevision.where(id: published_id).pick(:locale)
+
+      # Retention applies per locale so one locale's publishes cannot destroy
+      # another's, and no locale's snapshots become unreachable. A locale with
+      # no live pointer keeps its newest snapshot as that locale's live one.
+      locales.each do |locale|
+        allowance = locale == live_locale ? retention : retention + 1
+        doomed = candidates(protected_ids, locale).order(created_at: :desc, id: :desc).offset(allowance)
+        doomed.each do |revision|
+          Hooks.run(:prune, revision)
+          # destroy returns false when a callback halts it; count what actually
+          # went, so the count and log cannot overstate the work.
+          if revision.destroy
+            @destroyed += 1
+          else
+            Rails.logger&.warn("[RivetCms] could not prune revision #{revision.id}: destroy was halted")
+          end
+        end
+      end
+
+      Rails.logger&.info("[RivetCms] pruned #{@destroyed} superseded revision(s) for document #{@document.id}") if @destroyed.positive?
+      @destroyed
+    end
+
+    private
+
+    # Read live pointers from the database, not the attribute cache
+    def live_pointers
+      Document.where(id: @document.id).pick(:published_revision_id, :draft_revision_id) || [ nil, nil ]
+    end
+
+    def locales
+      @document.revisions.where(state: DocumentRevision.states[:published]).distinct.pluck(:locale)
+    end
+
+    def candidates(protected_ids, locale)
+      @document.revisions
+               .where(state: DocumentRevision.states[:published], locale: locale)
+               .where.not(id: protected_ids)
+    end
+  end
+end

data/app/services/rivet_cms/webhooks.rb

@@ -0,0 +1,61 @@
+module RivetCms
+  # Fans a lifecycle event out to the host-configured webhook endpoints.
+  # RivetCms.webhooks is an array of { url:, events: } hashes; events is
+  # optional and defaults to everything.
+  module Webhooks
+    EVENT_NAMES = { publish: "entry.published" }.freeze
+
+    def self.deliver(event, revision)
+      endpoints_for(event).each do |endpoint|
+        url = endpoint[:url] || endpoint["url"]
+        next if url.blank?
+
+        WebhookDeliveryJob.perform_later(url, payload(event, revision))
+      end
+    end
+
+    def self.endpoints_for(event)
+      name = EVENT_NAMES.fetch(event, event.to_s)
+      Array(RivetCms.webhooks).select do |endpoint|
+        events = endpoint[:events] || endpoint["events"]
+        events.nil? || events.map(&:to_s).include?(name)
+      end
+    end
+
+    def self.payload(event, revision)
+      document = revision.document
+      {
+        event: EVENT_NAMES.fetch(event),
+        document_id: document.prefix_id,
+        slug: document.slug,
+        # with_discarded: publishing into a removed type is reachable from host
+        # code, and the payload should still say which type it was.
+        content_type: ContentType.with_discarded.where(id: document.content_type_id).pick(:slug),
+        organization: document.organization.subdomain,
+        locale: revision.locale,
+        published_at: revision.published_at&.iso8601,
+        author: revision.author_name
+      }
+    end
+
+    # Fails fast at boot so a malformed entry cannot silently disable
+    # delivery (publish-path errors are swallowed by the hook seam).
+    def self.validate_config!
+      Array(RivetCms.webhooks).each do |endpoint|
+        raise ArgumentError, "RivetCms.webhooks entries must be hashes, got #{endpoint.class}" unless endpoint.is_a?(Hash)
+
+        url = endpoint[:url] || endpoint["url"]
+        uri = URI.parse(url.to_s) rescue nil
+        unless uri.is_a?(URI::HTTP) # covers HTTPS (subclass)
+          raise ArgumentError, "RivetCms.webhooks url must be http(s), got #{url.inspect}"
+        end
+
+        events = endpoint[:events] || endpoint["events"]
+        next if events.nil?
+        unless events.is_a?(Array) && (events.map(&:to_s) - EVENT_NAMES.values).empty?
+          raise ArgumentError, "RivetCms.webhooks events must be an array from #{EVENT_NAMES.values.inspect}, got #{events.inspect}"
+        end
+      end
+    end
+  end
+end

data/app/views/layouts/rivet_cms/application.html.erb

@@ -1,49 +1,42 @@
 <!DOCTYPE html>
-<html class="h-full bg-gray-50">
-<head>
-  <title>Rivet CMS</title>
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <%= csrf_meta_tags %>
-  <%= csp_meta_tag %>
+<html data-theme="lofi">
+  <head>
+    <title><%= content_for(:title) || "Rivet CMS" %></title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <meta name="apple-mobile-web-app-capable" content="yes">
+    <meta name="mobile-web-app-capable" content="yes">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
 
-  <%= yield :head %>
+    <link rel="icon" href="/icon.png" type="image/png">
+    <link rel="icon" href="/icon.svg" type="image/svg+xml">
+    <link rel="apple-touch-icon" href="/icon.png">
 
-  <%= javascript_include_tag "rivet_cms", "data-turbo-track": "reload", type: "module" %>
-  <%= stylesheet_link_tag "rivet_cms", "data-turbo-track": "reload", time: Time.now.to_i %>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Archivo:ital,wght@0,400..800;1,400..800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
 
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Passion+One:wght@400;700;900&display=swap" rel="stylesheet">
-  <%= brand_color_css.html_safe %>
-</head>
-<body class="h-full font-sans antialiased text-gray-900">
-  <div class="min-h-full">
-    <!-- Top navigation -->
-    <%= render "rivet_cms/shared/navigation" %>
+    <script>
+      // Apply persisted theme before first paint to avoid a flash
+      try {
+        var stored = localStorage.getItem("rivetTheme");
+        if (stored ? stored === "dark" : matchMedia("(prefers-color-scheme: dark)").matches) {
+          document.documentElement.setAttribute("data-theme", "dark");
+        }
+      } catch (_) {}
+    </script>
 
-    <!-- Flash messages -->
-    <% if flash.any? %>
-      <div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 mt-4">
-        <% flash.each do |type, message| %>
-          <div class="<%= flash_class_for(type) %> p-4 rounded-md mb-4">
-            <div class="flex">
-              <div class="flex-shrink-0">
-                <%= flash_icon_for(type) %>
-              </div>
-              <div class="ml-3">
-                <p class="text-sm font-medium"><%= message %></p>
-              </div>
-            </div>
-          </div>
-        <% end %>
-      </div>
+    <%= stylesheet_link_tag "rivet_cms", media: "all" %>
+    <% RivetCms.admin_stylesheets.each do |name| %>
+      <%= admin_extension_tag :stylesheet, name %>
     <% end %>
-
-    <main>
-      <div class="mx-auto max-w-7xl py-6 sm:px-6 lg:px-8">
-        <%= yield %>
-      </div>
-    </main>
-  </div>
-</body>
+    <%# Extension bundles come after core so window.RivetCMS exists when they run %>
+    <%= javascript_include_tag "rivet_cms", type: "module", defer: true %>
+    <% RivetCms.admin_scripts.each do |name| %>
+      <%= admin_extension_tag :script, name %>
+    <% end %>
+  </head>
+  <body>
+    <%= yield %>
+  </body>
 </html>