rivet_cms 0.1.2.pre → 0.3.0

data/app/controllers/rivet_cms/dashboard_controller.rb

@@ -1,10 +1,60 @@
 module RivetCms
   class DashboardController < ApplicationController
-    def index
-      @content_types = ContentType.order(:name)
-      @recent_contents = Content.order(updated_at: :desc).limit(5)
-      @components = Component.all
-      @content_type = ContentType.new
+    include InertiaProps
+
+    # The dashboard stays reachable by any authenticated user, but every
+    # section's data is filtered through the same can? checks that gate the
+    # section's own pages, so it never leaks what those pages would refuse.
+    def show
+      read_content = can?(:read, :content)
+      read_schema = can?(:read, :schema)
+
+      organization = Current.organization
+      content_types = read_content || read_schema ? organization.content_types.order(:name).to_a : []
+      # Type cards link to entry lists, so they filter through whichever
+      # record-phase read the user holds for that surface
+      content_types = content_types.select { |ct|
+        read_content ? can?(:read, :content, record: ct) : can?(:read, :schema, record: ct)
+      }
+      documents = Document.where(organization: organization).in_visible_types
+      entry_counts = read_content ? documents.group(:content_type_id).count : {}
+
+      stats = {}
+      stats[:entries] = documents.count if read_content
+      if read_schema
+        stats[:content_types] = content_types.size
+        stats[:components] = organization.components.count
+      end
+      read_api = can?(:read, :api)
+      stats[:media_assets] = organization.media_assets.count if can?(:read, :media)
+      stats[:api_tokens] = organization.api_tokens.count if read_api
+
+      render inertia: "Dashboard/Show", props: {
+        stats: stats,
+        has_fields: read_schema && Field.where(content_type_id: content_types.map(&:id)).exists?,
+        recent_documents: recent_documents(documents, read_content),
+        content_types: content_types.map { |content_type|
+          content_type_ref_props(content_type).merge(entry_count: entry_counts.fetch(content_type.id, 0))
+        },
+        api: read_api && read_schema ? { base_path: File.join(root_path, "api") } : nil,
+        permissions: {
+          write_content: can?(:write, :content),
+          write_schema: can?(:write, :schema)
+        }
+      }
+    end
+
+    private
+
+    def recent_documents(documents, read_content)
+      return [] unless read_content
+
+      permitted_documents(documents.includes(:content_type).order(updated_at: :desc).limit(8)).map { |document|
+        document_props(document).merge(
+          content_type_name: document.content_type.name,
+          updated_at: document.updated_at.iso8601
+        )
+      }
     end
   end
 end

data/app/controllers/rivet_cms/documents_controller.rb

@@ -0,0 +1,204 @@
+module RivetCms
+  class DocumentsController < ApplicationController
+    include InertiaProps
+
+    before_action -> { authorize! :read, :content }, only: [ :index, :edit, :new, :trash ]
+    before_action -> { authorize! :write, :content }, except: [ :index, :edit, :trash, :publish, :destroy, :restore, :purge ]
+    # Restore mirrors trash: whoever can put an entry in can take it out,
+    # since restoring flips it back onto the delivery API.
+    before_action -> { authorize! :delete, :content }, only: [ :restore ]
+    before_action -> { authorize! :delete, :content }, only: [ :purge ]
+    before_action -> { authorize! :publish, :content }, only: [ :publish ]
+    before_action -> { authorize! :delete, :content }, only: [ :destroy ]
+    before_action :set_content_type
+    before_action :set_document, only: [ :edit, :update, :destroy, :publish ]
+    before_action :set_trashed_document, only: [ :restore, :purge ]
+    # Record layer: the same gates again, now about the loaded record, so a
+    # policy can grant per-type or per-entry access. The recordless gates
+    # above stay as fail-fast checks that run before anything is loaded.
+    # Member actions check the type as well as the entry, so denying a type
+    # denies its entries even on a direct URL, with the verb matched:
+    # (action, :content, record: type) means "may <action> this type's content".
+    before_action -> { authorize! :read, :content, record: @content_type }, only: [ :index, :new, :trash, :edit ]
+    before_action -> { authorize! :write, :content, record: @content_type }, only: [ :create, :update ]
+    before_action -> { authorize! :publish, :content, record: @content_type }, only: [ :publish ]
+    before_action -> { authorize! :delete, :content, record: @content_type }, only: [ :destroy, :restore, :purge ]
+    before_action -> { authorize! :read, :content, record: @document }, only: [ :edit ]
+    before_action -> { authorize! :write, :content, record: @document }, only: [ :update ]
+    before_action -> { authorize! :publish, :content, record: @document }, only: [ :publish ]
+    before_action -> { authorize! :delete, :content, record: @document }, only: [ :destroy, :restore, :purge ]
+
+    def index
+      documents = @content_type.documents.recent
+      documents = documents.search(params[:q]) if params[:q].present?
+      page = documents.includes(:draft_revision).page(params[:page]).per(25)
+      visible = permitted(page, :read, :content)
+
+      titles = document_titles(visible)
+
+      render inertia: "Documents/Index", props: {
+        content_type: content_type_props(@content_type),
+        q: params[:q].presence,
+        trashed_count: @content_type.documents.with_discarded.discarded.count,
+        trash_path: trash_content_type_documents_path(@content_type),
+        documents: visible.map { |document| document_list_props(document, titles) },
+        pagination: { page: page.current_page, total_pages: page.total_pages }
+      }
+    end
+
+    def new
+      render inertia: "Documents/Edit", props: editor_props(nil)
+    end
+
+    def create
+      document = @content_type.documents.new(slug: params[:slug])
+      document.save!
+      draft = document.revisions.create!(state: :draft, **author_attributes)
+      document.update!(draft_revision: draft)
+      writer = DraftWriter.new(draft).tap { |w| w.write(values_param) }
+
+      audit "entry.created", document
+      redirect_to edit_content_type_document_path(@content_type, document), notice: write_notice(writer, "Draft saved")
+    rescue ActiveRecord::RecordInvalid => e
+      redirect_to new_content_type_document_path(@content_type), inertia: { errors: e.record.errors }
+    end
+
+    def edit
+      render inertia: "Documents/Edit", props: editor_props(@document)
+    end
+
+    def update
+      @document.draft_revision.update!(author_attributes)
+      writer = DraftWriter.new(@document.draft_revision).tap { |w| w.write(values_param) }
+      audit "entry.updated", @document
+      redirect_to edit_content_type_document_path(@content_type, @document), notice: write_notice(writer, "Draft saved")
+    end
+
+    # Publishes what's on screen: the submitted values are written to the
+    # draft first, so unsaved edits are validated instead of the stale draft.
+    def publish
+      draft = @document.draft_revision
+      writer = nil
+      if params.key?(:values)
+        draft.update!(author_attributes)
+        writer = DraftWriter.new(draft).tap { |w| w.write(values_param) }
+      end
+      # The snapshot records who published, which is not always the last editor
+      draft.publish!(publisher: author_attributes[:author], publisher_name: author_attributes[:author_name])
+      audit "entry.published", @document
+      redirect_to edit_content_type_document_path(@content_type, @document), notice: write_notice(writer, "Published")
+    rescue ContentInvalidError => e
+      redirect_to edit_content_type_document_path(@content_type, @document),
+                  inertia: { errors: e.errors.group_by(&:field_key).transform_values { |group| group.map(&:message) } }
+    end
+
+    def destroy
+      @document.discard!
+      audit "entry.trashed", @document
+      # Back to whichever list the delete came from, except the entry's own
+      # editor, whose URL just died with the trashing
+      dead = edit_content_type_document_path(@content_type, @document)
+      redirect_after_trash(dead, content_type_documents_path(@content_type),
+                           notice: "#{@document.slug} was moved to the trash")
+    end
+
+    def trash
+      documents = permitted(@content_type.documents.with_discarded.discarded.order(:deleted_at), :read, :content)
+      titles = document_titles(documents)
+
+      render inertia: "Documents/Trash", props: {
+        content_type: content_type_props(@content_type),
+        documents: documents.map { |document|
+          document_list_props(document, titles).merge(
+            trashed_at: document.deleted_at.iso8601,
+            paths: {
+              restore: restore_content_type_document_path(@content_type, document),
+              purge: purge_content_type_document_path(@content_type, document)
+            }
+          )
+        }
+      }
+    end
+
+    def restore
+      @document.undiscard!
+      audit "entry.restored", @document
+      redirect_to edit_content_type_document_path(@content_type, @document),
+                  notice: "#{@document.slug} was restored"
+    end
+
+    # Permanently destroys one entry and its revisions. Smaller blast radius
+    # than purging a type, so a plain confirmation rather than a typed name.
+    def purge
+      slug = @document.slug
+      Document.transaction do
+        Relation.where(target_document_id: @document.id).delete_all
+        @document.destroy!
+      end
+      audit "entry.purged", @document
+      # Back to whichever trash (global or scoped) the purge came from
+      redirect_back fallback_location: trash_content_type_documents_path(@content_type),
+                    allow_other_host: false, status: :see_other,
+                    notice: "#{slug} was permanently deleted"
+    rescue ActiveRecord::ActiveRecordError => error
+      Rails.logger&.error("[RivetCms] purge failed for document #{@document.id}: #{error.class}")
+      redirect_back fallback_location: trash_content_type_documents_path(@content_type),
+                    allow_other_host: false, status: :see_other,
+                    alert: "#{slug} could not be deleted; nothing was removed"
+    end
+
+    private
+
+    # Dropping a reference is not reversible by restoring the target, so every
+    # path that writes values says so: create, save, and publish alike.
+    def write_notice(writer, base)
+      dropped = writer&.dropped_references.to_i
+      return base if dropped.zero?
+
+      detail = dropped == 1 ? "1 reference was removed because the entry it pointed to is in the trash or was deleted." \
+                            : "#{dropped} references were removed because the entries they pointed to are in the trash or were deleted."
+      "#{base}. #{detail}"
+    end
+
+    def set_content_type
+      @content_type = Current.organization.content_types.find(params[:content_type_id])
+    end
+
+    def set_document
+      @document = @content_type.documents.find(params[:id])
+    end
+
+    def set_trashed_document
+      @document = @content_type.documents.with_discarded.discarded.find(params[:id])
+    end
+
+    def editor_props(document)
+      {
+        content_type: content_type_props(@content_type),
+        fields: @content_type.fields.kept.ordered.map { |field| entry_field_props(field) },
+        document: document ? document_props(document) : nil,
+        values: document ? draft_values(document.draft_revision) : {},
+        reference_options: reference_options,
+        form_paths: { index: content_type_documents_path(@content_type), create: content_type_documents_path(@content_type) }
+      }
+    end
+
+    def reference_options
+      permitted_documents(Document.where(organization: Current.organization).in_visible_types.recent.includes(:content_type))
+        .map { |document| { id: document.id, slug: document.slug, content_type: document.content_type.name } }
+    end
+
+    def values_param
+      params.fetch(:values, {}).permit!.to_h
+    end
+
+    # Content is always attributed. With a signed-in user it's their name;
+    # without one (unconfigured/programmatic) it falls back to "System".
+    def author_attributes
+      @author_attributes ||= begin
+        user = Current.user
+        { author: user, author_name: user ? RivetCms.user_name.call(user).presence || "System" : "System" }
+      end
+    end
+  end
+end

data/app/controllers/rivet_cms/fields_controller.rb

@@ -1,109 +1,112 @@
 module RivetCms
   class FieldsController < ApplicationController
-    before_action :set_content_type
-    before_action :set_field, only: [:edit, :update, :destroy, :update_width]
+    before_action -> { authorize! :delete, :schema }, only: [ :destroy ]
+    before_action -> { authorize! :write, :schema }, except: [ :destroy ]
+    before_action :set_owner
+    before_action :set_field, only: [ :update, :destroy, :toggle_width, :unpair, :pair ]
+    # Record layer: every field action touches its owner's schema, so the
+    # owner is checked for all of them, verb-matched like entries: writes
+    # need :write on the owner, destroy needs :delete. Denying a type or
+    # component denies its fields even on a direct URL.
+    before_action -> { authorize! :write, :schema, record: @owner }, except: [ :destroy ]
+    before_action -> { authorize! :delete, :schema, record: @owner }, only: [ :destroy ]
+    before_action -> { authorize! :write, :schema, record: @field }, only: [ :update, :toggle_width, :unpair, :pair ]
+    before_action -> { authorize! :delete, :schema, record: @field }, only: [ :destroy ]
 
-    # GET /content_types/:content_type_id/fields
-    def index
-      @fields = @content_type.fields.includes(:component).order(:position)
-      @field = @content_type.fields.new
-    end
-
-    # GET /content_types/:content_type_id/fields/new
-    def new
-      @field = @content_type.fields.new
-    end
-
-    # POST /content_types/:content_type_id/fields
     def create
-      @field = @content_type.fields.new(field_params)
+      field = @owner.fields.build(field_params)
+      field.organization = @owner.organization
 
-      if @field.save
-        redirect_to content_type_fields_path(@content_type), notice: "Field was successfully created."
+      if field.save
+        audit "field.created", field
+        redirect_to owner_path, notice: "Field created"
       else
-        respond_to do |format|
-          format.html { render :new, status: :unprocessable_entity }
-          format.turbo_stream { 
-            render turbo_stream: turbo_stream.update("field_form",
-              partial: "form",
-              locals: { content_type: @content_type, field: @field }
-            )
-          }
-        end
+        redirect_to owner_path, inertia: { errors: field.errors }
       end
     end
 
-    # GET /content_types/:content_type_id/fields/:id/edit
-    def edit
-    end
-
-    # PATCH/PUT /content_types/:content_type_id/fields/:id
     def update
       if @field.update(field_params)
-        redirect_to content_type_fields_path(@content_type), notice: "Field was successfully updated."
+        audit "field.updated", @field
+        redirect_to owner_path, notice: "Field updated"
       else
-        respond_to do |format|
-          format.html { render :edit, status: :unprocessable_entity }
-          format.turbo_stream { 
-            render turbo_stream: turbo_stream.update("field_form",
-              partial: "form",
-              locals: { content_type: @content_type, field: @field }
-            )
-          }
-        end
+        redirect_to owner_path, inertia: { errors: @field.errors }
       end
     end
 
-    # DELETE /content_types/:content_type_id/fields/:id
     def destroy
-      @field.destroy
-      redirect_to content_type_fields_path(@content_type), notice: "Field was successfully deleted."
+      @field.discard
+      audit "field.removed", @field
+      redirect_to owner_path, notice: "Field removed"
     end
 
-    # POST /content_types/:content_type_id/fields/update_positions
-    def update_positions
-      if params[:positions].present?
-        ActiveRecord::Base.transaction do
-          params[:positions].each do |position_data|
-            field = @content_type.fields.find_by_prefix_id(position_data[:id])
-            if field
-              field.update!(
-                position: position_data[:position],
-                row_group: position_data[:row_group]
-              )
-            end
-          end
+    def toggle_width
+      new_width = @field.width_full? ? "half" : "full"
+
+      @field.update!(width: new_width)
+
+      # If changed to full width, ensure it's on its own row
+      if new_width == "full"
+        other_fields_on_row = @owner.fields.kept.where(row: @field.row).where.not(id: @field.id)
+        if other_fields_on_row.exists?
+          @field.move_to_own_row!
         end
-        
-        render json: { success: true }
-      else
-        render json: { error: "No positions data provided" }, status: :bad_request
       end
+
+      audit "field.updated", @field, change: "layout"
+      redirect_to owner_path
     end
 
-    # PATCH /content_types/:content_type_id/fields/:id/update_width
-    def update_width
-      width_value = params[:width]
-      if width_value.present? && RivetCms::Field::WIDTHS.include?(width_value)
-        result = @field.update_columns(width: width_value, row_group: nil)
-        render json: { success: true, field: { id: @field.to_param, width: @field.width } }
-      else
-        render json: { error: "Invalid width value" }, status: :unprocessable_entity
+    def unpair
+      @field.unpair!
+      audit "field.updated", @field, change: "layout"
+      redirect_to owner_path
+    end
+
+    def pair
+      other_field = @owner.fields.find(params[:pair_with])
+      # Pairing mutates both fields, so both must pass the record phase
+      authorize! :write, :schema, record: other_field
+
+      # Both fields must be half-width and not already paired
+      if @field.width_half? && other_field.width_half? && !@field.paired? && !other_field.paired?
+        @field.pair_with!(other_field)
+        audit "field.updated", @field, change: "layout"
       end
+
+      redirect_to owner_path
+    end
+
+    def update_layout
+      # The bulk update touches every referenced field, so each must pass the
+      # record phase, not just the owner
+      moved = @owner.fields.where(id: Array(params[:rows]).flatten)
+      moved.each { |field| authorize! :write, :schema, record: field }
+      @owner.fields.update_layout!(params[:rows])
+      audit "schema.layout_updated", @owner
+      redirect_to owner_path
     end
 
     private
 
-    def set_content_type
-      @content_type = ContentType.find(params[:content_type_id])
+    def set_owner
+      @owner = if params[:component_id]
+        Current.organization.components.find(params[:component_id])
+      else
+        Current.organization.content_types.find(params[:content_type_id])
+      end
+    end
+
+    def owner_path
+      @owner.is_a?(Component) ? component_path(@owner) : content_type_path(@owner)
     end
 
     def set_field
-      @field = @content_type.fields.find_by_prefix_id(params[:id])
+      @field = @owner.fields.find(params[:id])
     end
 
     def field_params
-      params.require(:field).permit(:name, :field_type, :required, :component_id, :description, :width, options: {})
+      params.require(:field).permit(:key, :label, :field_type, :description, :required, :width, :min_items, :max_items, config: {})
     end
   end
-end
+end

data/app/controllers/rivet_cms/invitations_controller.rb

@@ -0,0 +1,36 @@
+module RivetCms
+  # Set-password links: signed, expiring, invalidated the moment a password
+  # is set (the token embeds the password salt). No mailers involved; the
+  # admin copies the link and delivers it however they like.
+  class InvitationsController < AuthController
+    before_action :set_user_from_token
+
+    def show
+      render inertia: "Auth/SetPassword", props: { name: @user.name, submit_path: invitation_path(params[:token]) }
+    end
+
+    def update
+      if params[:password].blank?
+        # An empty string is ignored by has_secure_password: update would
+        # "succeed" without setting anything and sign in a pending user
+        return redirect_to invitation_path(params[:token]), inertia: { errors: { password: [ "can't be blank" ] } }
+      end
+
+      if @user.update(password: params[:password])
+        sign_in(@user)
+        redirect_to root_path, notice: "You're in. Welcome to RivetCMS"
+      else
+        redirect_to invitation_path(params[:token]), inertia: { errors: @user.errors }
+      end
+    end
+
+    private
+
+    def set_user_from_token
+      @user = User.find_by_token_for(:password_setup, params[:token])
+      return if @user&.active? && @user.organization == Current.organization
+
+      redirect_to login_path, alert: "That link is no longer valid. Ask an admin for a new one."
+    end
+  end
+end

data/app/controllers/rivet_cms/media_assets_controller.rb

@@ -0,0 +1,76 @@
+module RivetCms
+  class MediaAssetsController < ApplicationController
+    include InertiaProps
+
+    before_action -> { authorize! :read, :media }, only: [ :index ]
+    before_action -> { authorize! :delete, :media }, only: [ :destroy ]
+    before_action -> { authorize! :write, :media }, except: [ :index, :destroy ]
+
+    def index
+      scope = media_assets.recent
+      scope = scope.search(params[:q]) if params[:q].present?
+      scope = scope.where(kind: params[:kind]) if MediaAsset.kinds.key?(params[:kind])
+      page = scope.page(params[:page]).per(48)
+      assets = permitted(page, :read, :media).map { |asset| media_asset_json(asset) }
+
+      respond_to do |format|
+        format.json { render json: assets }
+        format.html do
+          render inertia: "Media/Index", props: {
+            assets: assets,
+            q: params[:q].presence,
+            kind: params[:kind].presence,
+            kinds: media_assets.distinct.order(:kind).pluck(:kind),
+            pagination: { page: page.current_page, total_pages: page.total_pages }
+          }
+        end
+      end
+    end
+
+    def create
+      unless params[:file].respond_to?(:tempfile)
+        return render json: { errors: [ "file is required" ] }, status: :unprocessable_entity
+      end
+
+      asset = MediaAsset.new(file: params[:file])
+
+      if asset.save
+        audit "media.uploaded", asset
+        render json: media_asset_json(asset), status: :created
+      else
+        render json: { errors: asset.errors.full_messages }, status: :unprocessable_entity
+      end
+    end
+
+    def update
+      asset = media_assets.find(params[:id])
+      authorize! :write, :media, record: asset
+      if asset.update(params.permit(:title, :alt, :description))
+        audit "media.updated", asset
+        render json: media_asset_json(asset)
+      else
+        render json: { errors: asset.errors.full_messages }, status: :unprocessable_entity
+      end
+    end
+
+    def destroy
+      asset = media_assets.find(params[:id])
+      authorize! :delete, :media, record: asset
+      if asset.embedded_in_content?
+        return redirect_to media_assets_path, alert: "Media is embedded in content and cannot be deleted"
+      end
+
+      asset.destroy
+      audit "media.deleted", asset
+      redirect_to media_assets_path, notice: "Media deleted"
+    rescue ActiveRecord::InvalidForeignKey
+      redirect_to media_assets_path, alert: "Media is in use by content and cannot be deleted"
+    end
+
+    private
+
+    def media_assets
+      Current.organization.media_assets
+    end
+  end
+end