rivet_cms 0.1.2.pre → 0.3.0

data/lib/rivet_cms/seeds.rb

@@ -0,0 +1,264 @@
+# Content-type templates: reusable schema (content types, fields, components,
+# categories) that a host app can load into an organization as a starting point.
+# Templates live in db/seeds/templates and are applied idempotently, so loading
+# the same template twice upserts rather than duplicating — safe in production.
+module RivetCms
+  module Seeds
+    TEMPLATES_PATH = "db/seeds/templates/*.rb".freeze
+
+    class << self
+      def registry
+        @registry ||= {}
+      end
+
+      # Called by each template file to register its definition block.
+      def template(name, &block)
+        registry[name.to_s] = block
+      end
+
+      def available
+        load_definitions
+        registry.keys.sort
+      end
+
+      # Apply one, several, or all templates to an organization. Returns the
+      # builders that ran.
+      def load!(organization:, only: nil)
+        load_definitions
+        names = Array(only).map(&:to_s).reject(&:empty?)
+        names = registry.keys if names.empty?
+
+        RivetCms::Current.set(organization: organization) do
+          names.map { |name| apply(name, organization) }
+        end
+      end
+
+      def resolve_organization(domain = nil)
+        org = if domain.present?
+          RivetCms::Organization.find_by(domain: domain)
+        else
+          RivetCms::Organization.find_by(default: true) || RivetCms::Organization.first
+        end
+        return org if org
+
+        raise "No organization found#{domain.present? ? " for domain #{domain}" : ''}. Create one first."
+      end
+
+      private
+
+      def load_definitions
+        return if @loaded
+
+        Dir[RivetCms::Engine.root.join(TEMPLATES_PATH)].sort.each { |file| require file }
+        @loaded = true
+      end
+
+      def apply(name, organization)
+        block = registry.fetch(name) { raise ArgumentError, "unknown template: #{name}" }
+        builder = Builder.new(organization)
+        builder.instance_eval(&block)
+        builder.commit
+      end
+    end
+
+    # Collects field definitions inside a content_type/component block.
+    class FieldSet
+      SCALAR_TYPES = %i[string text rich_text markdown integer decimal enumeration boolean image video file date datetime].freeze
+
+      attr_reader :definitions
+
+      def initialize
+        @definitions = []
+      end
+
+      SCALAR_TYPES.each do |type|
+        define_method(type) do |key, **opts|
+          add(type, key, opts)
+        end
+      end
+
+      def reference(key, to:, **opts)
+        add(:reference, key, opts.merge(to: to))
+      end
+
+      def component(key, use:, **opts)
+        add(:component, key, opts.merge(use: use))
+      end
+
+      private
+
+      def add(type, key, opts)
+        @definitions << opts.merge(type: type, key: key.to_s)
+      end
+    end
+
+    # Applies a template's declarations to the database for one organization.
+    class Builder
+      def initialize(organization)
+        @organization = organization
+        @categories = []
+        @components = []
+        @content_types = []
+        @category_index = {}
+        @component_index = {}
+        @content_type_index = {}
+      end
+
+      def category(name, slug: nil, system: false, position: 0)
+        @categories << { name: name, slug: slug || name.parameterize, system: system, position: position }
+      end
+
+      def component(name, category:, slug: nil, description: nil, &block)
+        fields = FieldSet.new
+        fields.instance_eval(&block) if block
+        @components << { name: name, slug: slug || name.parameterize, category: category, description: description, fields: fields.definitions }
+      end
+
+      def content_type(name, slug:, description: nil, single: false, &block)
+        fields = FieldSet.new
+        fields.instance_eval(&block) if block
+        @content_types << { name: name, slug: slug, description: description, single: single, fields: fields.definitions }
+      end
+
+      # Shells first (so references and component fields can resolve regardless of
+      # declaration order), then fields.
+      def commit
+        RivetCms::ApplicationRecord.transaction do
+          @categories.each { |attrs| upsert_category(attrs) }
+          component_records = @components.map { |attrs| upsert_component(attrs) }
+          content_type_records = @content_types.map { |attrs| upsert_content_type(attrs) }
+
+          @components.each_with_index { |attrs, i| build_fields(component_records[i], attrs[:fields]) }
+          @content_types.each_with_index { |attrs, i| build_fields(content_type_records[i], attrs[:fields]) if content_type_records[i] }
+        end
+        self
+      end
+
+      private
+
+      def upsert_category(attrs)
+        category = RivetCms::Category.find_or_initialize_by(organization: @organization, slug: attrs[:slug])
+        category.name = attrs[:name]
+        category.system = attrs[:system] if attrs.key?(:system)
+        category.position = attrs[:position] || category.position || 0
+        category.save!
+        @category_index[attrs[:slug]] = category
+        @category_index[attrs[:name]] = category
+        category
+      end
+
+      def resolve_category(name)
+        @category_index[name] || @category_index[name.to_s.parameterize] ||
+          upsert_category(name: name, slug: name.to_s.parameterize)
+      end
+
+      def upsert_component(attrs)
+        component = RivetCms::Component.find_or_initialize_by(organization: @organization, slug: attrs[:slug])
+        component.name = attrs[:name]
+        component.description = attrs[:description]
+        component.category = resolve_category(attrs[:category])
+        component.save!
+        @component_index[attrs[:slug]] = component
+        @component_index[attrs[:name]] = component
+        component
+      end
+
+      def upsert_content_type(attrs)
+        # with_discarded so a removed type is recognised rather than colliding
+        # with its reserved slug. A removal is deliberate, so seeding leaves it
+        # alone instead of silently restoring it and its entries.
+        content_type = RivetCms::ContentType.with_discarded.find_or_initialize_by(organization: @organization, slug: attrs[:slug])
+        # Skipped entirely, not just left undiscarded: keeping it out of the
+        # index stops build_fields rewriting its schema. Reference fields
+        # pointing at it are dropped by build_fields rather than seeded broken.
+        return nil if content_type.discarded?
+
+        content_type.name = attrs[:name]
+        content_type.description = attrs[:description]
+        content_type.single = attrs[:single] || false
+        content_type.save!
+        @content_type_index[attrs[:slug]] = content_type
+        content_type
+      end
+
+      def build_fields(owner, definitions)
+        # A reference to a removed type cannot be seeded, so its definition is
+        # dropped alongside the field it would have produced; layout_rows pairs
+        # the two lists positionally and must not see a gap.
+        definitions = definitions.reject { |definition| removed_reference?(definition) }
+        return if definitions.empty?
+
+        owner_key = owner.is_a?(RivetCms::ContentType) ? :content_type_id : :component_id
+        records = definitions.map { |definition| upsert_field(owner, owner_key, definition) }
+        RivetCms::Field.update_layout!(layout_rows(definitions, records))
+      end
+
+      def removed_reference?(definition)
+        return false unless definition[:type] == :reference
+
+        lookup_content_type(definition[:to]).nil?
+      end
+
+      def upsert_field(owner, owner_key, definition)
+        field = RivetCms::Field.with_discarded.find_or_initialize_by(owner_key => owner.id, key: definition[:key])
+        field.assign_attributes(field_attributes(definition).merge(organization: @organization, deleted_at: nil))
+        field.save!
+        field
+      end
+
+      def field_attributes(definition)
+        attributes = {
+          label: definition[:label] || definition[:key].titleize,
+          field_type: definition[:type],
+          required: definition.fetch(:required, false),
+          description: definition[:description],
+          width: definition[:width] == :half ? "half" : "full",
+          config: definition[:config] || {},
+          min_items: definition[:min_items],
+          max_items: definition[:max_items]
+        }
+
+        case definition[:type]
+        when :reference
+          attributes[:config] = { "content_type_id" => lookup_content_type(definition[:to]).id }
+        when :component
+          attributes[:config] = { "component_id" => lookup_component(definition[:use]).id }
+        end
+
+        attributes
+      end
+
+      # nil when the target exists but has been removed; raises only when the
+      # template names a type that was never seeded at all.
+      def lookup_content_type(slug)
+        found = @content_type_index[slug] || RivetCms::ContentType.find_by(organization: @organization, slug: slug)
+        return found if found
+        return nil if RivetCms::ContentType.with_discarded.exists?(organization: @organization, slug: slug)
+
+        raise ArgumentError, "reference target content type not found: #{slug}"
+      end
+
+      def lookup_component(name)
+        @component_index[name] || @component_index[name.to_s.parameterize] ||
+          RivetCms::Component.find_by(organization: @organization, slug: name.to_s.parameterize) ||
+          raise(ArgumentError, "component not found: #{name}")
+      end
+
+      # Pair consecutive half-width fields onto one row; everything else gets its own.
+      def layout_rows(definitions, records)
+        rows = []
+        i = 0
+        while i < definitions.length
+          if definitions[i][:width] == :half && definitions[i + 1] && definitions[i + 1][:width] == :half
+            rows << [ records[i].id, records[i + 1].id ]
+            i += 2
+          else
+            rows << [ records[i].id ]
+            i += 1
+          end
+        end
+        rows
+      end
+    end
+  end
+end

data/lib/rivet_cms/version.rb

@@ -1,3 +1,3 @@
 module RivetCms
-  VERSION = "0.1.2.pre"
+  VERSION = "0.3.0"
 end

data/lib/rivet_cms.rb

@@ -1,47 +1,304 @@
 require "rivet_cms/version"
-require "rivet_cms/routes"
 require "rivet_cms/engine"
+require "rivet_cms/safe_pattern"
+require "rivet_cms/hooks"
+require "rivet_cms/audit"
+require "rivet_cms/navigation"
+require "rivet_cms/access_check"
+require "bcrypt"
+require "image_processing"
+require "prefixed_ids"
+require "kaminari"
+require "inertia_rails"
 
 module RivetCms
-  class Error < StandardError; end
-
   class << self
-    def configuration
-      @configuration ||= Configuration.new
+    # Hard ceiling for library uploads (bytes); hosts can override in an initializer.
+    attr_accessor :max_upload_size
+
+    # MIME types the media library accepts, checked against the sniffed type,
+    # not the client-declared one. nil disables the check. SVG is excluded by
+    # default because scripted SVGs are an XSS vector; hosts that trust their
+    # editors can append "image/svg+xml".
+    attr_accessor :allowed_media_types
+
+    # Host (e.g. "https://cms.example.com") used to build absolute media URLs
+    # in the public API. When nil, URLs are relative paths.
+    attr_accessor :media_host
+
+    # Basic webhook endpoints: [{ url: "https://...", events: %w[entry.published] }].
+    # events is optional (defaults to all). Delivered by WebhookDeliveryJob;
+    # no signing or retries.
+    attr_accessor :webhooks
+
+    # Add a sidebar item; see RivetCms::Navigation for the full contract.
+    def register_nav(key, **options)
+      Navigation.register(key, **options)
     end
 
-    def configuration=(config)
-      @configuration = config
+    # Extra admin bundles the layout emits after core's tags. An extension's
+    # precompiled JS loads in order and can register its pages on
+    # window.RivetCMS before the admin app boots.
+    def register_admin_script(name)
+      raise ArgumentError, "asset name required" if name.to_s.strip.empty?
+
+      admin_scripts << name.to_s unless admin_scripts.include?(name.to_s)
     end
+
+    def register_admin_stylesheet(name)
+      raise ArgumentError, "asset name required" if name.to_s.strip.empty?
+
+      admin_stylesheets << name.to_s unless admin_stylesheets.include?(name.to_s)
+    end
+
+    def admin_scripts
+      @admin_scripts ||= []
+    end
+
+    def admin_stylesheets
+      @admin_stylesheets ||= []
+    end
+
+    attr_writer :admin_scripts, :admin_stylesheets
+
+    # Subscribe to a lifecycle event; see RivetCms::Hooks for the event list
+    # and the key: contract for reload-safe registration.
+    #   RivetCms.on(:publish) { |revision| ... }
+    def on(event, callable = nil, key: nil, &block)
+      Hooks.on(event, callable, key: key, &block)
+    end
+
+    # When true the delivery API allows anonymous reads of published content.
+    # When false (default) every request needs an API token. A preview-scoped
+    # token is always required to read drafts, regardless of this setting.
+    attr_accessor :public_api
+
+    # How many superseded published revisions to keep per document. The
+    # default :all never deletes anything: pruning is something a host opts
+    # into, because unbounded storage is a visible problem you can fix later
+    # and deleted content is not. Set an integer to prune on publish. The
+    # current published revision and the working draft are never pruned.
+    attr_reader :revision_retention
+
+    # Validated at assignment: a bad value here would otherwise surface as a
+    # failed publish, or worse, silently mean 0 and destroy history.
+    def revision_retention=(value)
+      @revision_retention = normalize_retention(value)
+    end
+
+    # Retention for one document. Override to vary by organization or content
+    # type; the scalar config is the default resolver.
+    def retention_for(_document)
+      revision_retention
+    end
+
+    # What the pruner actually reads: an override is validated the same way
+    # the config setter is, so a bad override cannot silently destroy history.
+    def normalized_retention_for(document)
+      normalize_retention(retention_for(document))
+    end
+
+    # Authorization seam: receives one RivetCms::AccessCheck and returns a
+    # boolean; default allow. check.action is :read, :write, :publish, or
+    # :delete; check.resource is a coarse domain (:content, :schema, :media,
+    # :api). The vocabulary grows over time, so policies should allowlist
+    # known pairs and deny anything unrecognized. A raising policy denies
+    # (fail closed) and logs. Governs the admin UI only; the delivery API
+    # is token-gated separately.
+    attr_accessor :can
+
+    # Authentication is delegated to the host app. See the initializer template
+    # (rails g rivet_cms:install) for a full example.
+    attr_accessor :parent_controller
+    attr_accessor :authenticate
+    attr_accessor :current_user
+    attr_accessor :user_name
+    attr_accessor :user_email
+    attr_accessor :login_path
+    attr_accessor :logout_path
+    attr_accessor :logout_method
+
+    def configure
+      yield self
+    end
+
+    # Ruby content helpers — read CMS content directly from host-app code with
+    # the same semantics and options as the delivery API (sort, date filters,
+    # pagination, populate, fields, preview).
+
+    # Published entries of a content type. Options mirror the API's list
+    # params; populate accepts an array of keys or :all.
+    def entries(type_slug, organization: nil, **options)
+      content_type = find_content_type!(type_slug, organization)
+      query = ContentQuery.new(content_type, **options)
+      populate = query.populate_fields
+
+      page = query.documents
+      revisions = page.map(&:published_revision)
+      preload = RevisionPreloader.new(revisions, populate_fields: populate)
+
+      wrapped = revisions.map do |revision|
+        Entry.new(RevisionSerializer.new(revision, fields: query.field_keys, populate: populate, preload: preload).as_json)
+      end
+      EntryCollection.new(wrapped, page: page.current_page, per_page: page.limit_value,
+                                   total: page.total_count, total_pages: page.total_pages)
+    end
+
+    # One entry by slug, or nil. preview: true serves the draft when present
+    # (Ruby callers are trusted host code — no token gate).
+    def entry(type_slug, entry_slug, organization: nil, preview: false, populate: nil, fields: nil)
+      content_type = find_content_type!(type_slug, organization)
+      document = content_type.documents.find_by(slug: entry_slug)
+      serialize_document(content_type, document, preview: preview, populate: populate, fields: fields)
+    end
+
+    # The one entry of a single-type content type, or nil.
+    def single(type_slug, organization: nil, preview: false, populate: nil, fields: nil)
+      content_type = find_content_type!(type_slug, organization)
+      document = content_type.documents.find_by(singleton_key: "singleton") || content_type.documents.first
+      serialize_document(content_type, document, preview: preview, populate: populate, fields: fields)
+    end
+
+    # Built-in authentication is the default: it is active exactly while the
+    # host has not configured its own authenticate lambda. Setting one (as
+    # every existing host integration does) opts out entirely.
+    def builtin_auth?
+      authenticate.equal?(DEFAULT_AUTHENTICATE)
+    end
+
+    # First-run setup protection. Outside development/test the setup screen
+    # requires a code that is printed to the server log, so only someone with
+    # server access can claim a fresh deployment. Set explicitly to require a
+    # chosen code in every environment (or to share it out of band).
+    attr_writer :setup_code
+
+    # Derived, not memoized: memoizing would make the explicit-config check
+    # below true after any read
+    def setup_code
+      @setup_code || Digest::SHA256.hexdigest("#{Rails.application.secret_key_base}:rivet-cms-setup")[0, 12]
+    end
+
+    def setup_code_required?
+      !(Rails.env.development? || Rails.env.test?) || @setup_code.present?
+    end
+
+    private
+
+    # Values above this are a misconfiguration, not a retention policy, and a
+    # large enough offset makes the prune query fail at publish time.
+    MAX_RETENTION = 1_000_000
+
+    def normalize_retention(value)
+      return :all if value == :all || (value.to_s.casecmp("all").zero? rescue false)
+      # Compare the class directly: ActiveSupport::Duration answers both is_a?
+      # and instance_of? for Integer, so 90.days would otherwise slip through
+      # and silently mean 7,776,000 revisions.
+      return value if value.class == Integer && !value.negative? && value <= MAX_RETENTION
+      # Base 10 explicitly: Integer("0010") would otherwise read as octal
+      return Integer(value, 10) if value.is_a?(String) && value.match?(/\A\d+\z/) && Integer(value, 10) <= MAX_RETENTION
+
+      raise ArgumentError,
+            "RivetCms.revision_retention must be :all or an Integer between 0 and #{MAX_RETENTION}, " \
+            "got #{value.inspect}. Time-based retention is not supported."
+    end
+
+    def find_content_type!(type_slug, organization)
+      org = organization || Current.organization ||
+            Organization.find_by(default: true) || Organization.first
+      raise ContentQuery::Error, "no organization available" if org.nil?
+
+      org.content_types.find_by(slug: type_slug.to_s) ||
+        raise(ContentQuery::Error, "unknown content type: #{type_slug}")
+    end
+
+    def serialize_document(content_type, document, preview:, populate:, fields:)
+      return nil if document.nil?
+
+      revision = preview ? (document.draft_revision || document.published_revision) : document.published_revision
+      return nil if revision.nil?
+
+      query = ContentQuery.new(content_type, populate: populate, fields: fields)
+      populate_fields = query.populate_fields
+      preload = RevisionPreloader.new([ revision ], populate_fields: populate_fields, preview: preview)
+      Entry.new(RevisionSerializer.new(revision, fields: query.field_keys, populate: populate_fields,
+                                                 preview: preview, preload: preload).as_json)
+    end
+  end
+
+  self.max_upload_size = 100 * 1024 * 1024
+  self.allowed_media_types = %w[
+    image/png image/jpeg image/gif image/webp image/avif
+    video/mp4 video/webm video/quicktime
+    audio/mpeg audio/wav audio/ogg
+    application/pdf application/zip
+    text/plain text/csv
+    application/msword application/vnd.openxmlformats-officedocument.wordprocessingml.document
+    application/vnd.ms-excel application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+  ]
+  self.media_host = nil
+  self.public_api = false
+  self.webhooks = []
+  self.revision_retention = 0
+
+  self.parent_controller = "ActionController::Base"
+  self.login_path = nil
+  self.logout_path = nil
+  self.logout_method = "delete"
+
+  # authenticate returns truthy to allow the request and falsy to deny it; the
+  # engine turns a denial into a redirect to login_path or a 403 (a lambda may
+  # also render/redirect itself). Unconfigured means built-in authentication:
+  # this lambda is an identity sentinel for builtin_auth? and is never called
+  # (the controller branches to the built-in session flow first). Fails
+  # closed if something ever invokes it anyway.
+  DEFAULT_AUTHENTICATE = ->(_controller) { false }
+  self.authenticate = DEFAULT_AUTHENTICATE
+
+  self.current_user = ->(_controller) { nil }
+
+  # Default policy: allow everything. CE has no permission system, so any
+  # authenticated user can do anything in both built-in and host-auth mode.
+  # Installing config.can replaces this wholesale; that is the seam Pro's
+  # role and record-scoped permissions attach through.
+  self.can = ->(_check) { true }
+
+  self.user_name = lambda do |user|
+    %i[full_name name display_name email email_address].each do |attr|
+      next unless user.respond_to?(attr)
+
+      value = user.public_send(attr)
+      return value.to_s if value.present?
+    end
+    nil
   end
 
-  def self.configure
-    self.configuration ||= Configuration.new
-    yield(configuration) if block_given?
-    validate_user_class(configuration.user_class)
+  self.user_email = lambda do |user|
+    %i[email email_address].each do |attr|
+      next unless user.respond_to?(attr)
+
+      value = user.public_send(attr)
+      return value.to_s if value.present?
+    end
+    nil
   end
 
-  class Configuration
-    attr_accessor :user_class, :image_variants, :default_roles, :current_user_method, 
-                  :prefixed_ids_length, :prefixed_ids_salt, :prefixed_ids_alphabet,
-                  :sign_out_path
-
-    def initialize
-      @user_class = "RivetCmsAuth::User"
-      @image_variants = {
-        thumbnail: { width: 100, height: 100, resize: "fit" },
-        medium: { width: 800, height: 600, resize: "limit" }
-      }
-      @default_roles = %w[admin editor contributor]
-      @current_user_method = "current_user"
-      @prefixed_ids_length = 32
-      @prefixed_ids_salt = "rivet-cms-#{Rails.env}"
-      @prefixed_ids_alphabet = "0123456789abcdefghijklmnopqrstuvwxyz"
-      @sign_out_path = if defined?(RivetCmsAuth::Engine)
-        lambda { RivetCmsAuth::Engine.routes.url_helpers.auth_sign_out_path }
-      else
-        "/"  # Default to root if no auth engine
-      end
+  # Digest of the precompiled admin assets, used as the Inertia asset version
+  # so clients do a full reload when the gem ships a new build. Recomputed each
+  # request in development so a rebuild auto-reloads the browser; memoized
+  # elsewhere (assets are static at runtime).
+  def self.asset_version
+    return compute_asset_version if Rails.env.development?
+
+    @asset_version ||= compute_asset_version
+  end
+
+  def self.compute_asset_version
+    build_path = Engine.root.join("app/assets/builds")
+    asset_digests = %w[rivet_cms.js rivet_cms.css].filter_map do |filename|
+      asset = build_path.join(filename)
+      Digest::MD5.file(asset).hexdigest if asset.exist?
     end
+
+    asset_digests.any? ? Digest::MD5.hexdigest([ VERSION, *asset_digests ].join(":")) : VERSION
   end
 end

data/lib/tasks/rivet_cms_tasks.rake

@@ -1,4 +1,18 @@
-# desc "Explaining what the task does"
-# task :rivet_cms do
-#   # Task goes here
-# end
+require "rivet_cms/seeds"
+
+namespace :rivet_cms do
+  desc "Load content-type templates into an organization (TEMPLATES=blog,pages ORG=example.com)"
+  task seed: :environment do
+    org = RivetCms::Seeds.resolve_organization(ENV["ORG"])
+    names = ENV["TEMPLATES"]&.split(",")&.map(&:strip)&.reject(&:empty?)
+
+    RivetCms::Seeds.load!(organization: org, only: names)
+    loaded = names || RivetCms::Seeds.available
+    puts "Loaded #{loaded.size} template(s) into #{org.name}: #{loaded.join(', ')}"
+  end
+
+  desc "List available content-type templates"
+  task templates: :environment do
+    RivetCms::Seeds.available.each { |name| puts name }
+  end
+end