rivet_cms 0.1.2.pre → 0.3.0

data/lib/generators/rivet_cms/install/templates/initializer.rb

@@ -0,0 +1,77 @@
+# Without configuration RivetCms handles sign-in itself: the first visit
+# creates the first admin account, and the Users page invites more. CE has no
+# roles; every signed-in user can do everything (role and record-scoped
+# permissions are a RivetCMS Pro feature). Nothing below is required.
+#
+# To use your application's authentication instead (Devise, the Rails 8
+# authentication generator, custom sessions), wire the lambdas below;
+# configuring `authenticate` disables the built-in login and Users page.
+#
+# RivetCms.configure do |config|
+#   # Engine controllers inherit from this class, making your auth filters and
+#   # helpers available. Point it at a slim controller if your
+#   # ApplicationController carries many before_actions.
+#   config.parent_controller = "ApplicationController"
+#
+#   # Return truthy to allow the request, falsy to deny it. On denial RivetCms
+#   # redirects browsers to login_path (or 403s) and returns 401 to the SPA — so
+#   # a boolean check is enough and fails CLOSED. (You may also render/redirect
+#   # yourself for custom handling; the engine respects a response you've made.)
+#   config.authenticate = ->(controller) { controller.send(:user_signed_in?) } # Devise example
+#   # Devise's authenticate_user! also works (returns the user, redirects on failure):
+#   # config.authenticate = ->(controller) { controller.send(:authenticate_user!) }
+#
+#   # The signed-in host user (or nil). Used for revision authorship and the
+#   # header identity display.
+#   config.current_user = ->(controller) { controller.send(:current_user) }
+#
+#   # How to display a user. Defaults try full_name/name/display_name/email.
+#   # config.user_name  = ->(user) { user.full_name }
+#   # config.user_email = ->(user) { user.email }
+#
+#   # Where the admin frontend sends the browser when a session expires (401).
+#   config.login_path = "/users/sign_in"
+#
+#   # Renders a Log out button in the admin header, submitted as a real form
+#   # (with _method) so DELETE routes work. nil hides the button.
+#   config.logout_path = "/users/sign_out"
+#   config.logout_method = "delete"
+#
+#   # Media/upload settings:
+#   # config.max_upload_size = 100 * 1024 * 1024
+#   # config.media_host = "https://cms.example.com"
+#   #
+#   # Thumbnails need system binaries (all optional, see README): libvips for
+#   # images, poppler-utils for PDF previews, ffmpeg for video previews.
+#   #
+#   # MIME types the media library accepts (checked against the sniffed type).
+#   # Defaults to common image/video/audio/document types; SVG is excluded
+#   # because scripted SVGs can carry XSS. Set to nil to allow anything.
+#   # config.allowed_media_types += %w[image/svg+xml]
+#
+#   # Superseded published revisions to keep per document. The default :all
+#   # never deletes anything; set an integer to prune on publish (0 keeps only
+#   # the live snapshot). The live snapshot and working draft are never pruned.
+#   # config.revision_retention = :all
+#
+#   # Authorization: receives a RivetCms::AccessCheck (user, action, resource,
+#   # organization, record), returns a boolean; default allow. Actions: :read,
+#   # :write, :publish, :delete. Resources: :content, :schema, :media, :api.
+#   # Allowlist known pairs and deny the rest; the vocabulary grows in minor
+#   # releases.
+#   # config.can = ->(check) { check.user&.admin? || check.action == :read }
+#
+#   # Delivery API: false (default) requires an API token; true allows anonymous
+#   # reads of published content. Preview (draft) reads always need a token.
+#   # config.public_api = false
+#
+#   # Lifecycle hooks: run host code when content changes. Hooks fire after
+#   # the database commit and receive the published snapshot revision.
+#   # RivetCms.on(:publish) { |revision| Rails.cache.delete("nav") }
+#
+#   # Webhooks: POST a JSON payload to each endpoint on matching events
+#   # (events omitted = all events). Delivered async via ActiveJob.
+#   # config.webhooks = [
+#   #   { url: "https://example.com/deploy-hook", events: %w[entry.published] }
+#   # ]
+# end

data/lib/rivet_cms/access_check.rb

@@ -0,0 +1,12 @@
+module RivetCms
+  # Immutable description of one authorization check, passed to RivetCms.can.
+  # Checks run in two phases: first with record nil, before anything loads
+  # ("is this action available to the user at all", also drives the sidebar),
+  # then again with record set to the loaded entry, content type, field,
+  # component, media asset, or API token. Fields may be ADDED in minor
+  # releases; policies should read only the fields they need and treat
+  # unknown action/resource symbols as deny, since the vocabulary grows.
+  AccessCheck = Struct.new(:user, :action, :resource, :organization, :record, keyword_init: true)
+
+  class AccessDenied < StandardError; end
+end

data/lib/rivet_cms/audit.rb

@@ -0,0 +1,43 @@
+module RivetCms
+  # One observability stream over every admin mutation, fired as the :audit
+  # hook. Named events (:publish, :prune) are behavior hooks carrying rich
+  # domain objects for a specific moment; :audit is uniform who/what/when
+  # data for consumers that want all of it (audit logs, activity feeds,
+  # SIEM pipelines).
+  #
+  #   RivetCms.on(:audit) do |event|
+  #     AuditRow.create!(action: event.action, subject: event.subject_id, ...)
+  #   end
+  #
+  # The payload is plain values plus the actor object; subscribers must
+  # tolerate unknown actions, since the vocabulary grows in minor releases.
+  # CE audits admin UI mutations; console and seed changes are not recorded.
+  AuditEvent = Struct.new(:action, :subject_type, :subject_id, :subject_label,
+                          :organization_id, :actor, :metadata, :at, keyword_init: true)
+
+  module Audit
+    class << self
+      def record(action, subject:, actor:, organization:, metadata: {})
+        event = AuditEvent.new(
+          action: action.to_s,
+          subject_type: subject.class.name.demodulize.underscore,
+          subject_id: subject.try(:prefix_id) || subject.id,
+          subject_label: label_for(subject),
+          organization_id: organization&.id,
+          actor: actor,
+          metadata: metadata,
+          at: Time.current
+        )
+        Hooks.run(:audit, event)
+        event
+      end
+
+      private
+
+      def label_for(subject)
+        (subject.try(:name) || subject.try(:label) || subject.try(:slug) ||
+         subject.try(:title) || subject.try(:filename))&.to_s
+      end
+    end
+  end
+end

data/lib/rivet_cms/engine.rb

@@ -1,37 +1,43 @@
-# lib/rivet_cms/engine.rb
-require "image_processing"
-require "prefixed_ids"
-require "kaminari"
-require "turbo-rails"
-require "stimulus-rails"
-require "rivet_cms/routes"
-
 module RivetCms
   class Engine < ::Rails::Engine
     isolate_namespace RivetCms
 
-    # Configure internationalization before the engine loads
-    config.before_configuration do
-      config.i18n.load_path += Dir[File.join(File.dirname(__FILE__), '..', 'config', 'locales', '**', '*.yml')]
-    end
-
-    # Set up testing and factory configurations
     config.generators do |g|
       g.test_framework :rspec
       g.fixture_replacement :factory_bot
-      g.factory_bot dir: 'spec/factories'
+      g.factory_bot dir: "spec/factories"
     end
 
-    def self.add_routes(&block)
-      RivetCms::Routes.add_routes(&block)
+    # CE webhooks ride the same lifecycle seam host apps use
+    initializer "rivet_cms.webhooks" do
+      RivetCms::Hooks.on(:publish, key: :rivet_cms_webhooks) { |revision| RivetCms::Webhooks.deliver(:publish, revision) }
     end
 
-    def self.append_routes(&block)
-      RivetCms::Routes.append_routes(&block)
+    # Host initializers have run by now; a bad webhook entry should stop
+    # boot, not silently drop deliveries behind the hook seam's rescue.
+    config.after_initialize do
+      RivetCms::Webhooks.validate_config!
     end
 
-    def self.draw_routes(&block)
-      RivetCms::Routes.draw_routes(&block)
+    # Run engine migrations from the host app without requiring
+    # `rails rivet_cms:install:migrations`.
+    initializer "rivet_cms.append_migrations" do |app|
+      config.paths["db/migrate"].expanded.each do |expanded_path|
+        unless app.config.paths["db/migrate"].expanded.include?(expanded_path)
+          app.config.paths["db/migrate"] << expanded_path
+        end
+      end
+    end
+
+    # Register the precompiled admin bundles for Sprockets, which (unlike
+    # Propshaft) only precompiles an explicit list. Without this a Sprockets
+    # host raises AssetNotFound in production. The Array guard means it fires
+    # only under Sprockets; Propshaft precompiles the builds directory anyway.
+    initializer "rivet_cms.assets" do |app|
+      next unless app.config.respond_to?(:assets)
+
+      precompile = app.config.assets.precompile
+      app.config.assets.precompile |= %w[rivet_cms.js rivet_cms.css] if precompile.is_a?(Array)
     end
   end
-end
+end

data/lib/rivet_cms/hooks.rb

@@ -0,0 +1,106 @@
+module RivetCms
+  # Lifecycle event registry: the extension seam host apps (and the Pro
+  # engine) attach through. Subscribers must not raise into the publish
+  # path; failures are logged and swallowed.
+  #
+  #   RivetCms::Hooks.on(:publish) { |revision| ... }
+  #
+  # Registration is idempotent per key: re-registering with the same key
+  # replaces the previous handler instead of adding a duplicate. Anonymous
+  # handlers key on their own identity, which is stable when registration
+  # happens in an initializer (runs once per boot). Code that registers from
+  # a reloadable context (e.g. to_prepare) must pass an explicit key, or
+  # every reload adds another copy:
+  #
+  #   RivetCms::Hooks.on(:publish, key: :sitemap) { |revision| ... }
+  #
+  # Subscribers run in registration order; there is no ordering API, so no
+  # subscriber may depend on running before or after another.
+  #
+  # Extensions can define their own events before subscribing or firing:
+  #
+  #   RivetCms::Hooks.register_event(:unpublish)
+  #
+  # Built-in events:
+  #   :publish - a document revision was published (fires after commit,
+  #              receives the published snapshot revision)
+  #   :prune   - a superseded revision is about to be destroyed by retention
+  #              (fires inside the publish transaction, before the delete, so
+  #              a subscriber can archive it elsewhere first)
+  #   :audit   - an admin mutation happened (receives a RivetCms::AuditEvent;
+  #              see RivetCms::Audit for the payload contract)
+  module Hooks
+    BUILT_IN_EVENTS = %i[publish prune audit].freeze
+    MUTEX = Mutex.new
+
+    class << self
+      def register_event(event)
+        mutex.synchronize { known_events << event.to_sym }
+        event.to_sym
+      end
+
+      def events
+        mutex.synchronize { known_events.to_a }
+      end
+
+      def on(event, callable = nil, key: nil, &block)
+        handler = callable || block
+        raise ArgumentError, "handler required" if handler.nil?
+
+        mutex.synchronize do
+          raise ArgumentError, "unknown event: #{event} (register_event it first)" unless known_events.include?(event)
+
+          registry[event][key || handler] = handler
+        end
+        handler
+      end
+
+      def run(event, *args)
+        handlers = mutex.synchronize { registry.key?(event) ? registry[event].values : [] }
+        handlers.each do |handler|
+          handler.call(*args)
+        rescue => error
+          Rails.logger&.error("[RivetCms] #{event} hook failed: #{error.class}: #{error.message}")
+        end
+      end
+
+      # Test-only: capture subscriptions so an example can register handlers
+      # and hand the registry back exactly as it found it.
+      def snapshot
+        mutex.synchronize { registry.transform_values(&:dup) }
+      end
+
+      def restore(snapshot)
+        return if snapshot.nil? # never mistake a failed snapshot for "no subscribers"
+
+        mutex.synchronize do
+          @registry = Hash.new { |hash, event| hash[event] = {} }
+          snapshot&.each { |event, handlers| @registry[event] = handlers.dup }
+        end
+      end
+
+      # Test-only: wipes ALL subscribers including the engine's boot-time
+      # registrations (initializers do not rerun). Pair with snapshot/restore.
+      def reset!
+        mutex.synchronize do
+          @registry = nil
+          @known_events = nil
+        end
+      end
+
+      private
+
+      def mutex
+        MUTEX
+      end
+
+      def registry
+        @registry ||= Hash.new { |hash, event| hash[event] = {} }
+      end
+
+      def known_events
+        @known_events ||= Set.new(BUILT_IN_EVENTS)
+      end
+    end
+  end
+end

data/lib/rivet_cms/navigation.rb

@@ -0,0 +1,111 @@
+module RivetCms
+  # Admin sidebar registry: the seam the Pro engine adds nav items through.
+  # Core registers its own items here too, so every item, core or extension,
+  # goes through the same can? filter and a denied user never sees a link
+  # that would 403.
+  #
+  #   RivetCms::Navigation.register :audit_log,
+  #     label: "Audit Log",
+  #     section: "Manage",
+  #     icon: :content,
+  #     requires: [:read, :content],
+  #     path: -> { audit_log_path },
+  #     position: 80
+  #
+  # path is either a string or a lambda instance_exec'd in the controller, so
+  # engine route helpers work directly. requires is [action, resource] for
+  # can?, or nil for always visible. icon names one of the built-in sidebar
+  # icons; unknown names render a neutral dot. Items sort by position across
+  # sections; a section appears where its lowest-position item falls.
+  # Re-registering a key replaces the item, so registration is reload-safe.
+  module Navigation
+    Item = Struct.new(:key, :label, :section, :icon, :requires, :path, :position, :exact, :badge, :visible, keyword_init: true)
+
+    MUTEX = Mutex.new
+
+    class << self
+      def register(key, label:, section:, path:, icon: nil, requires: nil, position: 100, exact: false, badge: nil, visible: nil)
+        raise ArgumentError, "label required" if label.to_s.strip.empty?
+        raise ArgumentError, "path must be a String or callable" unless path.is_a?(String) || path.respond_to?(:call)
+        # Class equality, not is_a?: ActiveSupport::Duration answers is_a?(Integer)
+        raise ArgumentError, "position must be an Integer" unless position.class == Integer
+        raise ArgumentError, "badge must be callable" unless badge.nil? || badge.respond_to?(:call)
+        raise ArgumentError, "visible must be callable" unless visible.nil? || visible.respond_to?(:call)
+        unless requires.nil? || (requires.is_a?(Array) && requires.size == 2 && requires.all? { |part| part.respond_to?(:to_sym) })
+          raise ArgumentError, "requires must be nil or [action, resource]"
+        end
+
+        item = Item.new(
+          key: key.to_sym, label: label.to_s, section: section.to_s, icon: icon&.to_sym,
+          requires: requires&.map(&:to_sym), path: path, position: position, exact: exact == true,
+          badge: badge, visible: visible
+        )
+        mutex.synchronize { registry[item.key] = item }
+        item
+      end
+
+      def unregister(key)
+        mutex.synchronize { registry.delete(key.to_sym) }
+      end
+
+      def items
+        mutex.synchronize { registry.values.sort_by.with_index { |item, index| [ item.position, index ] } }
+      end
+
+      # Test-only: capture registrations so an example can add items and hand
+      # the registry back exactly as it found it.
+      def snapshot
+        mutex.synchronize { registry.dup }
+      end
+
+      def restore(snapshot)
+        return if snapshot.nil? # never mistake a failed snapshot for "no items"
+
+        mutex.synchronize { @registry = snapshot.dup }
+      end
+
+      private
+
+      def mutex
+        MUTEX
+      end
+
+      def registry
+        @registry ||= {}
+      end
+    end
+
+    # Core items carry the same gates their index actions enforce, so hiding
+    # and denying can never disagree.
+    register :dashboard, label: "Dashboard", section: "", icon: :dashboard,
+             path: -> { root_path }, position: 10, exact: true
+    register :content, label: "Content", section: "Manage", icon: :content,
+             requires: [ :read, :content ], path: -> { content_path }, position: 20
+    register :content_types, label: "Content Types", section: "Manage", icon: :content_types,
+             requires: [ :read, :schema ], path: -> { content_types_path }, position: 30
+    register :components, label: "Components", section: "Manage", icon: :components,
+             requires: [ :read, :schema ], path: -> { components_path }, position: 40
+    register :media, label: "Media", section: "Manage", icon: :media,
+             requires: [ :read, :media ], path: -> { media_assets_path }, position: 50
+    # The badge counts what the trash page would show this user: entries
+    # always (the item itself is content-gated), removed types only with
+    # schema read, mirroring the page's sections. Within a domain the count
+    # is an aggregate, not filtered per record, like stat counts.
+    register :trash, label: "Trash", section: "Manage", icon: :trash,
+             requires: [ :read, :content ], path: -> { trash_path }, position: 55,
+             badge: -> {
+               count = Document.with_discarded.discarded.in_visible_types.where(organization: Current.organization).count
+               count += ContentType.with_discarded.discarded.where(organization: Current.organization).count if can?(:read, :schema)
+               count
+             }
+    # Only exists in built-in auth mode; hosts with their own auth manage
+    # users in their own admin
+    register :users, label: "Users", section: "Manage", icon: :users,
+             requires: [ :read, :users ], path: -> { users_path }, position: 58,
+             visible: -> { RivetCms.builtin_auth? }
+    register :api, label: "API", section: "Deliver", icon: :api,
+             requires: [ :read, :api ], path: -> { api_docs_path }, position: 60
+    register :api_tokens, label: "API Tokens", section: "Deliver", icon: :api_tokens,
+             requires: [ :read, :api ], path: -> { api_tokens_path }, position: 70
+  end
+end

data/lib/rivet_cms/safe_pattern.rb

@@ -0,0 +1,40 @@
+module RivetCms
+  # Compiles and matches admin-supplied regex patterns without letting a
+  # pathological pattern hang the process. Ruby 3.2+ supports a per-regexp
+  # timeout; on older Rubies patterns still work, bounded only by MAX_LENGTH.
+  module SafePattern
+    MAX_LENGTH = 200
+    TIMEOUT_SECONDS = 1
+
+    class << self
+      def valid?(source)
+        return false if source.to_s.length > MAX_LENGTH
+
+        compile(source)
+        true
+      rescue RegexpError, ArgumentError
+        false
+      end
+
+      def match?(source, value)
+        compile(source).match?(value.to_s)
+      rescue RegexpError, ArgumentError
+        false
+      rescue => error
+        raise unless defined?(Regexp::TimeoutError) && error.is_a?(Regexp::TimeoutError)
+
+        false
+      end
+
+      private
+
+      def compile(source)
+        if Regexp.respond_to?(:timeout)
+          Regexp.new(source.to_s, timeout: TIMEOUT_SECONDS)
+        else
+          Regexp.new(source.to_s)
+        end
+      end
+    end
+  end
+end