rivet_cms 0.1.2.pre → 0.3.0

data/app/assets/stylesheets/rivet_cms/application.tailwind.css

@@ -1,25 +1,148 @@
-@layer base {
-  :root {
-    /* Brand color variables will be set dynamically */
-    --color-brand-50: '';
-    --color-brand-100: '';
-    --color-brand-200: '';
-    --color-brand-300: '';
-    --color-brand-400: '';
-    --color-brand-500: '';
-    --color-brand-600: '';
-    --color-brand-700: '';
-    --color-brand-800: '';
-    --color-brand-900: '';
-    --color-brand-950: '';
-  }
-}
-
-@import url('https://fonts.googleapis.com/css2?family=Passion+One:wght@400;700;900&display=swap');
-
 @import "tailwindcss";
-@import "./brand_colors";
+@source "../../../javascript";
+@plugin "daisyui" {
+    themes: light --default, dark --prefersdark, lofi;
+}
 
 @theme {
-  --font-passion-one: "Passion One", sans-serif; 
-}
+    --font-sans: "Archivo", ui-sans-serif, system-ui, sans-serif;
+    --font-mono: "JetBrains Mono", ui-monospace, SFMono-Regular, monospace;
+}
+
+/* Steel ramp from the RivetCMS design system; orange is wordmark-only */
+:root {
+    --steel-0: #ffffff;
+    --steel-1: #f7f7f6;
+    --steel-2: #efefed;
+    --steel-3: #dededb;
+    --steel-4: #b8b8b3;
+    --steel-5: #8e8e88;
+    --steel-6: #5a5a55;
+    --steel-7: #3a3a38;
+    --steel-8: #262624;
+    --steel-9: #171716;
+    --steel-10: #101010;
+    --orange-5: #ff5c00;
+    --shadow-card: 0 1px 2px rgba(16, 16, 16, 0.07);
+    --shadow-raised: 0 2px 6px rgba(16, 16, 16, 0.11);
+    --shadow-overlay: 0 8px 28px rgba(16, 16, 16, 0.2);
+}
+
+/* Design tokens shared by every theme: compact controls, unified radii */
+html[data-theme] {
+    --size-field: 0.21875rem;    /* md controls: 35px tall instead of 40px */
+    --size-selector: 0.21875rem; /* checkboxes, toggles, badges scale down to match */
+    --radius-field: 0.5rem;
+    --radius-selector: 0.375rem;
+    --radius-box: 0.75rem;
+    --border: 1px;
+    --depth: 0;
+    --noise: 0;
+    font-family: var(--font-sans);
+}
+
+/* Flat buttons that drop 1px on press */
+.btn:not(:disabled, .btn-disabled):active {
+    transform: translateY(1px);
+}
+
+html[data-theme="lofi"] {
+    --color-base-100: var(--steel-0);
+    --color-base-200: var(--steel-1);
+    --color-base-300: var(--steel-3);
+    --color-base-content: var(--steel-9);
+    --color-primary: var(--steel-9);
+    --color-primary-content: #ffffff;
+    --color-secondary: var(--steel-6);
+    --color-secondary-content: #ffffff;
+    --color-accent: var(--steel-7);
+    --color-accent-content: #ffffff;
+    --color-neutral: var(--steel-8);
+    --color-neutral-content: #ffffff;
+    --color-info: #3a6ea5;
+    --color-info-content: #ffffff;
+    --color-success: #2f7d46;
+    --color-success-content: #ffffff;
+    --color-warning: #c98a00;
+    --color-warning-content: #101010;
+    --color-error: #c8351f;
+    --color-error-content: #ffffff;
+}
+
+html[data-theme="dark"] {
+    --color-base-100: var(--steel-9);
+    --color-base-200: var(--steel-10);
+    --color-base-300: var(--steel-7);
+    --color-base-content: #f2f2f0;
+    --color-primary: var(--steel-1);
+    --color-primary-content: var(--steel-9);
+    --color-secondary: var(--steel-4);
+    --color-secondary-content: var(--steel-9);
+    --color-accent: var(--steel-3);
+    --color-accent-content: var(--steel-9);
+    --color-neutral: var(--steel-2);
+    --color-neutral-content: var(--steel-9);
+    --color-info: #6d9bc9;
+    --color-info-content: #101010;
+    --color-success: #5aa672;
+    --color-success-content: #101010;
+    --color-warning: #d9a63a;
+    --color-warning-content: #101010;
+    --color-error: #d96a52;
+    --color-error-content: #101010;
+}
+
+/* Focus: single 1px accent border instead of DaisyUI's offset outline */
+.input:focus, .input:focus-within,
+.textarea:focus, .textarea:focus-within,
+.select:focus, .select:focus-within,
+.file-input:focus, .file-input:focus-within {
+    outline: none;
+    border-color: var(--color-primary);
+    box-shadow: none;
+}
+
+/* Rendered rich text / markdown preview — themed with base tokens, not prose gray */
+.rivet-prose { line-height: 1.7; }
+.rivet-prose :where(h1) { font-size: 1.4rem; font-weight: 700; margin: 1rem 0 0.5rem; }
+.rivet-prose :where(h2) { font-size: 1.2rem; font-weight: 700; margin: 0.9rem 0 0.5rem; }
+.rivet-prose :where(h3) { font-size: 1.05rem; font-weight: 600; margin: 0.75rem 0 0.4rem; }
+.rivet-prose :where(p) { margin: 0.5rem 0; }
+.rivet-prose :where(ul) { list-style: disc; padding-left: 1.4rem; margin: 0.5rem 0; }
+.rivet-prose :where(ol) { list-style: decimal; padding-left: 1.4rem; margin: 0.5rem 0; }
+.rivet-prose :where(li) { margin: 0.2rem 0; }
+.rivet-prose :where(blockquote) { border-left: 3px solid var(--color-base-300); padding-left: 0.75rem; margin: 0.5rem 0; color: color-mix(in oklab, var(--color-base-content) 70%, transparent); }
+.rivet-prose :where(code) { font-family: var(--font-mono); font-size: 0.85em; background: var(--color-base-200); padding: 0.1em 0.3em; border-radius: 0.25rem; }
+.rivet-prose :where(pre) { background: var(--color-base-200); padding: 0.75rem; border-radius: 0.5rem; overflow-x: auto; margin: 0.5rem 0; }
+.rivet-prose :where(pre code) { background: none; padding: 0; }
+.rivet-prose :where(a) { color: var(--color-primary); text-decoration: underline; }
+.rivet-prose :where(> :first-child) { margin-top: 0; }
+.rivet-prose :where(> :last-child) { margin-bottom: 0; }
+.rivet-prose::after { content: ""; display: table; clear: both; }
+.rivet-prose :where(img) { max-width: 100%; }
+
+dl {
+    font-size: var(--text-sm);
+    dt {
+        font-weight: var(--font-weight-bold);
+        margin-top: calc(var(--spacing)*4);
+    }
+}
+
+label:has(+ input:required):after {
+    content: " *"
+}
+
+input:user-invalid, .field_with_errors input {
+    @apply input-error;
+}
+
+label:has(+ input:user-invalid), .field_with_errors label {
+    @apply text-error;
+}
+
+/* Literal color: ::backdrop cannot be trusted to inherit custom properties,
+   so a variable-backed utility silently fails in some browsers */
+dialog::backdrop {
+    background-color: rgb(0 0 0 / 0.4);
+}

data/app/controllers/concerns/rivet_cms/inertia_props.rb

@@ -0,0 +1,239 @@
+module RivetCms
+  # Serializes models into plain hashes for Inertia page props.
+  # Paths are included server-side so the React app never needs to know
+  # where the engine is mounted.
+  module InertiaProps
+    private
+
+    def content_type_props(content_type)
+      {
+        id: content_type.id,
+        param: content_type.to_param,
+        name: content_type.name,
+        slug: content_type.slug,
+        description: content_type.description,
+        single: content_type.single?,
+        paths: {
+          show: content_type_path(content_type),
+          update: content_type_path(content_type),
+          destroy: content_type_path(content_type),
+          fields: content_type_fields_path(content_type),
+          update_layout: update_layout_content_type_fields_path(content_type),
+          documents: content_type_documents_path(content_type),
+          new_document: new_content_type_document_path(content_type)
+        }
+      }
+    end
+
+    # Identity a content page needs, without schema detail or management paths
+    def content_type_ref_props(content_type)
+      {
+        id: content_type.id,
+        param: content_type.to_param,
+        name: content_type.name,
+        slug: content_type.slug,
+        single: content_type.single?,
+        paths: {
+          show: content_type_path(content_type),
+          documents: content_type_documents_path(content_type),
+          new_document: new_content_type_document_path(content_type)
+        }
+      }
+    end
+
+    def field_props(field)
+      {
+        id: field.id,
+        param: field.to_param,
+        key: field.key,
+        label: field.label,
+        field_type: field.field_type,
+        field_type_label: field.field_type_label,
+        description: field.description,
+        required: field.required?,
+        width: field.width,
+        row: field.row,
+        position: field.position,
+        paired: field.paired?,
+        min_items: field.min_items,
+        max_items: field.max_items,
+        config: field.config || {},
+        paths: field_paths(field)
+      }
+    end
+
+    def field_paths(field)
+      if field.component_id
+        component = field.component
+        {
+          update: component_field_path(component, field),
+          destroy: component_field_path(component, field),
+          toggle_width: toggle_width_component_field_path(component, field),
+          pair: pair_component_field_path(component, field),
+          unpair: unpair_component_field_path(component, field)
+        }
+      else
+        content_type = field.content_type
+        {
+          update: content_type_field_path(content_type, field),
+          destroy: content_type_field_path(content_type, field),
+          toggle_width: toggle_width_content_type_field_path(content_type, field),
+          pair: pair_content_type_field_path(content_type, field),
+          unpair: unpair_content_type_field_path(content_type, field)
+        }
+      end
+    end
+
+    def document_props(document)
+      {
+        id: document.id,
+        param: document.to_param,
+        slug: document.slug,
+        published: document.published_revision_id.present?,
+        paths: {
+          edit: edit_content_type_document_path(document.content_type, document),
+          update: content_type_document_path(document.content_type, document),
+          publish: publish_content_type_document_path(document.content_type, document),
+          destroy: content_type_document_path(document.content_type, document)
+        }
+      }
+    end
+
+    # Display titles for a page of documents: each type's first string field,
+    # read from the draft revisions in one query. Keyed by revision id (a
+    # revision only holds values for its own type's fields).
+    def document_titles(documents)
+      type_ids = documents.map(&:content_type_id).uniq
+      title_field_ids = Field.kept.where(content_type_id: type_ids, field_type: "string").ordered
+                             .group_by(&:content_type_id).filter_map { |_, fields| fields.first&.id }
+      revision_ids = documents.filter_map(&:draft_revision_id)
+      return {} if title_field_ids.empty? || revision_ids.empty?
+
+      ContentValue.where(owner_type: "RivetCms::DocumentRevision", owner_id: revision_ids, field_id: title_field_ids)
+                  .pluck(:owner_id, :string_value).to_h
+    end
+
+    def document_list_props(document, titles)
+      document_props(document).merge(
+        title: document.draft_revision_id && titles[document.draft_revision_id],
+        author: document.draft_revision&.author_name,
+        updated_at: document.updated_at.iso8601
+      )
+    end
+
+    def entry_field_props(field)
+      {
+        key: field.key,
+        label: field.label,
+        field_type: field.field_type,
+        field_type_label: field.field_type_label,
+        description: field.description,
+        required: field.required?,
+        width: field.width,
+        row: field.row,
+        position: field.position,
+        min_items: field.min_items,
+        max_items: field.max_items,
+        config: field.config || {},
+        component: embedded_component_props(field)
+      }
+    end
+
+    def embedded_component_props(field)
+      return nil unless field.field_type == "component"
+
+      component = Component.find_by(id: field.config&.dig("component_id"), organization_id: field.organization_id)
+      return nil unless component
+
+      { id: component.id, name: component.name, fields: component.fields.kept.ordered.map { |f| entry_field_props(f) } }
+    end
+
+    def draft_values(revision)
+      return {} if revision.nil?
+
+      owner_values(revision, revision.document.content_type.fields.kept)
+    end
+
+    def owner_values(owner, fields)
+      values_by_field = owner.content_values
+        .includes(:field, media_asset: { file_attachment: :blob })
+        .index_by(&:field_id)
+      relations_by_field = owner.relations.order(:position).group_by(&:field_id)
+      instances_by_field = owner.component_instances.includes(component: :fields).order(:position).group_by(&:field_id)
+
+      fields.each_with_object({}) do |field, values|
+        values[field.key] = editable_value(field, values_by_field, relations_by_field, instances_by_field)
+      end
+    end
+
+    def editable_value(field, values_by_field, relations_by_field, instances_by_field)
+      case field.field_type
+      when "reference"
+        relations_by_field.fetch(field.id, []).map(&:target_document_id)
+      when "component"
+        instances_by_field.fetch(field.id, []).map do |instance|
+          { values: owner_values(instance, instance.component.fields.kept) }
+        end
+      when "image", "video", "file"
+        media_asset_json(values_by_field[field.id]&.media_asset)
+      else
+        values_by_field[field.id]&.value
+      end
+    end
+
+    def media_asset_json(asset)
+      return nil unless asset
+
+      {
+        id: asset.id,
+        kind: asset.kind,
+        filename: asset.filename,
+        content_type: asset.content_type,
+        byte_size: asset.byte_size,
+        title: asset.title,
+        alt: asset.alt,
+        description: asset.description,
+        created_at: asset.created_at&.iso8601,
+        url: asset.url,
+        thumbnail_url: asset.thumbnail_url,
+        paths: { update: media_asset_path(asset), destroy: media_asset_path(asset) }
+      }
+    end
+
+    def api_token_json(token)
+      {
+        id: token.id,
+        name: token.name,
+        scope: token.scope,
+        masked: token.masked,
+        last_used_at: token.last_used_at,
+        expires_at: token.expires_at,
+        created_at: token.created_at,
+        paths: { destroy: api_token_path(token) }
+      }
+    end
+
+    def component_props(component)
+      {
+        id: component.id,
+        param: component.to_param,
+        name: component.name,
+        slug: component.slug,
+        description: component.description,
+        category_id: component.category_id,
+        category_name: component.category&.name,
+        paths: {
+          show: component_path(component),
+          update: component_path(component),
+          destroy: component_path(component),
+          fields: component_fields_path(component),
+          update_layout: update_layout_component_fields_path(component)
+        }
+      }
+    end
+
+    def category_props(category)
+      { id: category.id, name: category.name }
+    end
+  end
+end

data/app/controllers/rivet_cms/api_docs_controller.rb

@@ -0,0 +1,47 @@
+module RivetCms
+  class ApiDocsController < ApplicationController
+    include InertiaProps
+
+    before_action -> { authorize! :read, :api }
+    # The docs render every type's fields, the same data /content_types gates
+    before_action -> { authorize! :read, :schema }
+
+    def show
+      content_types = permitted_types
+
+      render inertia: "Api/Index", props: {
+        base_url: api_base_url,
+        public_api: RivetCms.public_api,
+        content_types: content_types.map { |ct| api_reference_props(ct) },
+        doc_paths: { openapi: api_openapi_path, tokens: api_tokens_path }
+      }
+    end
+
+    def spec
+      generator = OpenApiGenerator.new(Current.organization, base_url: api_base_url, content_types: permitted_types,
+                                       components: permitted(Current.organization.components, :read, :schema))
+      send_data JSON.pretty_generate(generator.as_json), type: :json, disposition: "attachment", filename: "openapi.json"
+    end
+
+    private
+
+    # Both renderings expose full field schemas, so both filter through the
+    # record phase like the /content_types page itself
+    def permitted_types
+      permitted(Current.organization.content_types.order(:name), :read, :schema)
+    end
+
+    def api_base_url
+      "#{request.base_url}/api"
+    end
+
+    def api_reference_props(content_type)
+      {
+        name: content_type.name,
+        slug: content_type.slug,
+        single: content_type.single?,
+        fields: content_type.fields.kept.ordered.map { |f| { key: f.key, type: f.field_type, required: f.required? } }
+      }
+    end
+  end
+end

data/app/controllers/rivet_cms/api_tokens_controller.rb

@@ -0,0 +1,43 @@
+module RivetCms
+  class ApiTokensController < ApplicationController
+    include InertiaProps
+
+    before_action -> { authorize! :read, :api }, only: [ :index ]
+    before_action -> { authorize! :write, :api }, except: [ :index, :destroy ]
+    before_action -> { authorize! :delete, :api }, only: [ :destroy ]
+    # Tokens read content through the delivery API, so minting one requires
+    # content read; otherwise a content-denied user could escalate via a token.
+    before_action -> { authorize! :read, :content }, only: [ :create ]
+
+    def index
+      render inertia: "ApiTokens/Index", props: {
+        tokens: permitted(api_tokens.recent, :read, :api).map { |token| api_token_json(token) },
+        new_token: flash[:new_token]
+      }
+    end
+
+    def create
+      scope = params[:scope].presence_in(%w[published preview]) || "published"
+      token = ApiToken.generate!(name: params[:name].to_s, scope: scope)
+      audit "api_token.created", token, scope: scope
+      flash[:new_token] = token.plaintext
+      redirect_to api_tokens_path, notice: "API token created — copy it now; it won't be shown again."
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to api_tokens_path, alert: e.record.errors.full_messages.to_sentence
+    end
+
+    def destroy
+      token = api_tokens.find(params[:id])
+      authorize! :delete, :api, record: token
+      token.destroy
+      audit "api_token.revoked", token
+      redirect_to api_tokens_path, notice: "API token revoked"
+    end
+
+    private
+
+    def api_tokens
+      Current.organization.api_tokens
+    end
+  end
+end