rivet_cms 0.1.2.pre → 0.3.1

data/app/models/rivet_cms/field.rb

@@ -1,82 +1,228 @@
 module RivetCms
   class Field < ApplicationRecord
-    has_prefix_id :fld, minimum_length: RivetCms.configuration.prefixed_ids_length, salt: RivetCms.configuration.prefixed_ids_salt, alphabet: RivetCms.configuration.prefixed_ids_alphabet
+    include SoftDeletable
 
-    # Field widths for form layout
-    WIDTHS = %w[full half].freeze
-    attribute :width, :string, default: 'full'
+    has_prefix_id :fld
+    include OrganizationScoped
 
-    belongs_to :content_type
+    belongs_to :content_type, optional: true
     belongs_to :component, optional: true
-    has_many :field_values, dependent: :destroy
-
-    # Define available field types
-    FIELD_TYPES = %w[string text integer boolean media relation component]
-
-    validates :name, presence: true, uniqueness: { scope: :content_type_id }
-    validates :field_type, presence: true, inclusion: { in: FIELD_TYPES }
-    validates :width, inclusion: { in: WIDTHS }
-    
-    # Default scope to order fields by position
-    default_scope { order(position: :asc) }
-    
-    # Set default position before create
+    has_many :content_values, dependent: :destroy
+
+    # Defaulted here rather than in the DB, since MySQL rejects defaults on
+    # JSON columns; keeps config a hash regardless of adapter.
+    attribute :config, default: -> { {} }
+
+    enum :field_type, {
+      string: 0,
+      text: 1,
+      rich_text: 2,
+      markdown: 3,
+      integer: 4,
+      boolean: 5,
+      image: 6,
+      video: 7,
+      file: 8,
+      reference: 9,
+      component: 10,
+      date: 11,
+      datetime: 12,
+      decimal: 13,
+      enumeration: 14
+    }
+
+    enum :width, { full: "full", half: "half" }, prefix: true
+
+    validates :key, presence: true, format: { with: /\A[a-z][a-z0-9_]*\z/, message: "must be lowercase snake_case" }
+    validates :key, uniqueness: { scope: :content_type_id, conditions: -> { where(deleted_at: nil) } }, if: -> { content_type_id.present? }
+    validates :key, uniqueness: { scope: :component_id, conditions: -> { where(deleted_at: nil) } }, if: -> { component_id.present? }
+    validates :label, presence: true
+    validates :field_type, presence: true
+    validate :belongs_to_one_owner
+    validate :components_cannot_embed_components
+    validate :config_contents
+
+    before_validation :derive_key_from_label, on: :create
     before_create :set_default_position
-    
-    # Field type options for select
+    before_create :set_default_row
+
+    scope :ordered, -> { order(row: :asc, position: :asc) }
+
+    # Human-readable field type labels for UI
+    FIELD_TYPE_LABELS = {
+      "string" => "Short text",
+      "text" => "Long text",
+      "rich_text" => "Rich text",
+      "markdown" => "Markdown",
+      "integer" => "Number",
+      "decimal" => "Decimal",
+      "enumeration" => "Select",
+      "boolean" => "True/False",
+      "image" => "Image",
+      "video" => "Video",
+      "file" => "File",
+      "reference" => "Reference",
+      "component" => "Component",
+      "date" => "Date",
+      "datetime" => "Date & Time"
+    }.freeze
+
+    def field_type_label
+      FIELD_TYPE_LABELS[field_type] || field_type.humanize
+    end
+
     def self.field_types_for_select
-      [
-        ['Short text', 'string'],
-        ['Long text', 'text'],
-        ['Number', 'integer'],
-        ['True/False', 'boolean'],
-        ['Media', 'media'],
-        ['Relation', 'relation'],
-        ['Component', 'component']
-      ]
-    end
-    
-    # Human-readable field type
-    def field_type_name
-      case field_type
-      when 'string' then 'Short text'
-      when 'text' then 'Long text'
-      when 'integer' then 'Number'
-      when 'boolean' then 'True/False'
-      when 'media' then 'Media'
-      when 'relation' then 'Relation'
-      when 'component' then 'Component'
-      else field_type.humanize
+      FIELD_TYPE_LABELS.map { |value, label| [ label, value ] }
+    end
+
+    def attachment?
+      image? || video? || file?
+    end
+
+    def self.reorder!(ordered_ids)
+      transaction do
+        ordered_ids.each_with_index do |id, index|
+          where(id: id).update_all(position: index)
+        end
       end
     end
-    
-    # Update positions for a set of fields
-    def self.update_positions(ordered_ids)
-      return if ordered_ids.blank?
-      
+
+    # Update layout with row structure
+    # rows_config: array of arrays, each inner array contains numeric field
+    # IDs for that row, e.g. [[1], [2, 3], [4]]. Prefixed ids do not resolve
+    # through where(id:) and would silently match nothing.
+    def self.update_layout!(rows_config)
       transaction do
-        ordered_ids.each_with_index do |prefixed_id, index|
-          field = find_by_prefix_id(prefixed_id)
-          field&.update_column(:position, index + 1)
+        rows_config.each_with_index do |field_ids, row_index|
+          field_ids.each_with_index do |field_id, position_in_row|
+            where(id: field_id).update_all(row: row_index, position: position_in_row)
+          end
         end
       end
     end
-    
-    after_commit :invalidate_api_docs_cache
-    
+
+    # Get the other field paired in the same row (if any)
+    def paired_field
+      return nil unless width_half?
+
+      sibling_fields.where(row: row, width: "half").where.not(id: id).first
+    end
+
+    def paired?
+      paired_field.present?
+    end
+
+    # Move this field to its own new row
+    def unpair!
+      return unless paired?
+
+      move_to_own_row!
+    end
+
+    # Move this field to its own new row
+    def move_to_own_row!
+      max_row = sibling_fields.maximum(:row) || 0
+      update!(row: max_row + 1, position: 0)
+    end
+
+    # Pair this field with another field on the same row
+    def pair_with!(other_field)
+      return unless width_half? && other_field.width_half?
+      return if paired? || other_field.paired?
+
+      other_field.update!(row: row, position: 1)
+    end
+
     private
-    
+
+    def sibling_fields
+      scope = content_type_id.present? ? { content_type_id: content_type_id } : { component_id: component_id }
+      self.class.kept.where(scope)
+    end
+
+    def derive_key_from_label
+      return if key.present?
+
+      self.key = label.to_s.parameterize(separator: "_")
+    end
+
+    def components_cannot_embed_components
+      return unless component_id.present? && field_type == "component"
+
+      errors.add(:field_type, "component fields cannot be nested inside components")
+    end
+
+    def config_contents
+      validate_pattern_config
+      validate_choices_config
+    end
+
+    def validate_pattern_config
+      pattern = config&.dig("pattern")
+      return if pattern.blank?
+
+      unless field_type.in?(%w[string text])
+        return errors.add(:config, "pattern is only supported on text fields")
+      end
+
+      if pattern.length > SafePattern::MAX_LENGTH
+        errors.add(:config, "pattern must be #{SafePattern::MAX_LENGTH} characters or less")
+      elsif !SafePattern.valid?(pattern)
+        errors.add(:config, "pattern is not a valid regular expression")
+      end
+    end
+
+    def validate_choices_config
+      choices = config&.dig("choices")
+      return if choices.blank?
+      return errors.add(:config, "choices are only supported on select fields") unless enumeration?
+
+      unless choices.is_a?(Array) && choices.all? { |choice| choice.is_a?(::String) && choice.present? && choice.length <= 255 }
+        return errors.add(:config, "choices must be a list of short text values")
+      end
+
+      errors.add(:config, "choices must be unique") if choices.uniq.length != choices.length
+      errors.add(:config, "allows at most 100 choices") if choices.length > 100
+    end
+
+    def belongs_to_one_owner
+      has_content_type = content_type_id.present? || content_type.present?
+      has_component = component_id.present? || component.present?
+
+      if has_content_type && has_component
+        errors.add(:base, "Field cannot belong to both content_type and component")
+      elsif !has_content_type && !has_component
+        errors.add(:base, "Field must belong to either content_type or component")
+      end
+    end
+
     def set_default_position
-      return if position.present?
-      
-      max_position = content_type.fields.maximum(:position) || 0
+      return if position.present? && position > 0
+
+      max_position = if content_type_id.present?
+        self.class.with_discarded.where(content_type_id: content_type_id).maximum(:position) || 0
+      elsif component_id.present?
+        self.class.with_discarded.where(component_id: component_id).maximum(:position) || 0
+      else
+        0
+      end
+
       self.position = max_position + 1
     end
 
-    def invalidate_api_docs_cache
-      if content_type
-        Rails.cache.delete("rivet_cms_api_docs")
+    def set_default_row
+      # Always set a new row for new fields (don't skip if row is 0)
+      return if persisted? && row.present?
+
+      max_row = if content_type_id.present?
+        self.class.with_discarded.where(content_type_id: content_type_id).maximum(:row) || -1
+      elsif component_id.present?
+        self.class.with_discarded.where(component_id: component_id).maximum(:row) || -1
+      else
+        -1
       end
+
+      self.row = max_row + 1
     end
   end
-end
+end

data/app/models/rivet_cms/media_asset.rb

@@ -0,0 +1,109 @@
+module RivetCms
+  class MediaAsset < ApplicationRecord
+    include OrganizationScoped
+
+    has_prefix_id :media
+
+    has_one_attached :file
+
+    enum :kind, { image: 0, video: 1, file: 2 }
+
+    validates :file, presence: true
+    validate :file_size_within_limit
+    validate :file_type_allowed
+
+    before_save :cache_file_metadata
+
+    scope :recent, -> { order(created_at: :desc) }
+    scope :search, ->(query) {
+      pattern = "%#{sanitize_sql_like(query.downcase)}%"
+      where("LOWER(filename) LIKE :q OR LOWER(title) LIKE :q OR LOWER(alt) LIKE :q", q: pattern)
+    }
+
+    THUMBNAIL_SIZE = [ 480, 480 ].freeze
+
+    def url
+      return nil unless file.attached?
+
+      helpers = Rails.application.routes.url_helpers
+      if RivetCms.media_host.present?
+        helpers.rails_blob_url(file, host: RivetCms.media_host)
+      else
+        helpers.rails_blob_path(file, only_path: true)
+      end
+    end
+
+    # Resized representation for grid/picker cells: a variant for images, a
+    # preview (first page/frame) for PDFs and videos when the host has poppler
+    # or ffmpeg installed. Nil when neither applies so callers fall back to a
+    # glyph. Processing happens lazily on first request.
+    def thumbnail_url
+      return nil unless file.attached?
+
+      representation =
+        if image? && file.blob.variable?
+          file.variant(resize_to_limit: THUMBNAIL_SIZE)
+        elsif file.blob.previewable?
+          file.preview(resize_to_limit: THUMBNAIL_SIZE)
+        end
+      return nil unless representation
+
+      helpers = Rails.application.routes.url_helpers
+      if RivetCms.media_host.present?
+        helpers.rails_representation_url(representation, host: RivetCms.media_host)
+      else
+        helpers.rails_representation_path(representation, only_path: true)
+      end
+    end
+
+    # Rich text embeds media by URL (which contains the blob signed id),
+    # so field references alone don't tell us an asset is in use.
+    def embedded_in_content?
+      return false unless file.attached?
+
+      pattern = file.blob.signed_id.gsub(/[!%_]/) { |c| "!#{c}" }
+      ContentValue.where("text_value LIKE ? ESCAPE '!'", "%#{pattern}%").exists?
+    end
+
+    def self.kind_for(content_type)
+      case content_type.to_s
+      when /\Aimage\// then :image
+      when /\Avideo\// then :video
+      else :file
+      end
+    end
+
+    private
+
+    def file_size_within_limit
+      limit = RivetCms.max_upload_size
+      return unless limit && file.attached?
+      return if file.byte_size <= limit
+
+      errors.add(:file, "is too large (max #{ActiveSupport::NumberHelper.number_to_human_size(limit)})")
+    end
+
+    def file_type_allowed
+      allowed = RivetCms.allowed_media_types
+      return unless allowed && file.attached?
+
+      blob = file.blob
+      blob.identify_without_saving unless blob.identified?
+      return if allowed.include?(blob.content_type)
+
+      errors.add(:file, "type #{blob.content_type} is not allowed")
+    end
+
+    def cache_file_metadata
+      return unless file.attached?
+
+      blob = file.blob
+      blob.identify_without_saving unless blob.identified?
+
+      self.filename = blob.filename.to_s
+      self.content_type = blob.content_type
+      self.byte_size = blob.byte_size
+      self.kind = self.class.kind_for(blob.content_type)
+    end
+  end
+end

data/app/models/rivet_cms/organization.rb

@@ -0,0 +1,46 @@
+module RivetCms
+  class Organization < ApplicationRecord
+    # Organization has no prefix id, so prefixed_ids does not patch its
+    # has_many finders; extend explicitly so find accepts prefixed ids.
+    PREFIXED_FINDERS = PrefixedIds::Finder::ClassMethods
+
+    # content_types is soft-delete scoped, so dependent: :destroy would skip
+    # discarded rows and leave them holding the FK; destroy those explicitly.
+    # Documents are destroyed first because ContentType restricts on them.
+    has_many :content_types, dependent: :destroy, extend: PREFIXED_FINDERS
+    before_destroy :destroy_all_content, prepend: true
+    has_many :components, dependent: :destroy, extend: PREFIXED_FINDERS
+    has_many :categories, dependent: :destroy, extend: PREFIXED_FINDERS
+    has_many :media_assets, dependent: :destroy, extend: PREFIXED_FINDERS
+    has_many :api_tokens, dependent: :destroy, extend: PREFIXED_FINDERS
+    # Built-in auth users hold the org FK; without this, destroy raises on the
+    # restrictive foreign key
+    has_many :users, dependent: :delete_all, extend: PREFIXED_FINDERS
+
+    validates :name, presence: true
+    validates :domain, presence: true, uniqueness: true
+    validates :subdomain, uniqueness: true, allow_blank: true
+
+    private
+
+    # Destroying an organization is a deliberate, total removal, so it clears
+    # the content that ContentType otherwise refuses to cascade, including
+    # rows behind the soft-delete scope.
+    def destroy_all_content
+      types = ContentType.with_discarded.where(organization_id: id)
+      # organization_id, not the type join: that column is what holds the FK
+      # Either column can hold the link if data has drifted, so cover both
+      documents = Document.with_discarded.where(organization_id: id)
+                          .or(Document.with_discarded.where(content_type_id: types.select(:id)))
+      # Relations point at documents by foreign key, so incoming links have to
+      # go before their targets or the cascade order decides whether we crash.
+      Relation.where(target_document_id: documents.select(:id)).delete_all
+      documents.find_each(&:destroy!)
+      types.find_each(&:destroy!)
+    rescue ActiveRecord::RecordNotDestroyed => error
+      # Otherwise destroy returns false with an empty errors hash
+      errors.add(:base, "could not remove content: #{error.message}")
+      throw :abort
+    end
+  end
+end

data/app/models/rivet_cms/relation.rb

@@ -0,0 +1,23 @@
+module RivetCms
+  class Relation < ApplicationRecord
+    include RevisionOwned
+
+    has_prefix_id :rel
+
+    belongs_to :field
+    belongs_to :target_document, class_name: "RivetCms::Document"
+
+    validate :target_in_same_organization
+
+    scope :ordered, -> { order(:position) }
+
+    private
+
+    def target_in_same_organization
+      return if target_document.nil? || owner_organization_id.nil?
+      return if target_document.organization_id == owner_organization_id
+
+      errors.add(:target_document, "must belong to the same organization")
+    end
+  end
+end

data/app/models/rivet_cms/user.rb

@@ -0,0 +1,61 @@
+module RivetCms
+  # Admin account for built-in authentication mode. Dormant when the host
+  # wires its own auth: nothing reads this table unless RivetCms.builtin_auth?
+  #
+  # CE has no roles: every authenticated user can do everything, so this model
+  # carries only identity and sign-in state. Role-based and per-record
+  # permissions are a Pro feature that installs its own policy through the
+  # can? seam and its own tables.
+  #
+  # Accounts are always created by an existing user (or the first-run setup
+  # screen); there is no self-registration. A user created without a password
+  # is pending: they finish through a signed set-password link and cannot sign
+  # in before that. Deactivation, never deletion: audit events and content
+  # attribution reference these rows.
+  class User < ApplicationRecord
+    include OrganizationScoped
+
+    has_prefix_id :usr
+
+    has_secure_password validations: false
+
+    before_validation { self.email = email.to_s.strip.downcase }
+
+    validates :name, presence: true
+    validates :email, presence: true,
+                      format: { with: URI::MailTo::EMAIL_REGEXP },
+                      uniqueness: { scope: :organization_id }
+    validates :password, length: { minimum: 8 }, allow_nil: true
+    validate :password_within_bcrypt_limit
+
+    scope :active, -> { where(active: true) }
+
+    # Invalidated automatically when the password changes (salt rotates)
+    generates_token_for :password_setup, expires_in: 3.days do
+      password_salt
+    end
+
+    def pending?
+      password_digest.nil?
+    end
+
+    def status
+      return "inactive" unless active?
+      return "pending" if pending?
+
+      "active"
+    end
+
+    def can_sign_in?
+      active? && !pending?
+    end
+
+    private
+
+    # BCrypt silently truncates at 72 bytes, which would make two long
+    # passwords sharing a prefix interchangeable; refuse instead
+    def password_within_bcrypt_limit
+      errors.add(:password, "is too long (maximum is 72 bytes)") if password && password.bytesize > 72
+    end
+  end
+end

data/app/serializers/rivet_cms/revision_preloader.rb

@@ -0,0 +1,146 @@
+module RivetCms
+  # Bulk-loads everything RevisionSerializer needs for a set of revisions in a
+  # constant number of queries, regardless of page size. Components cannot nest,
+  # so the owner tree is bounded: revision -> component instances -> values/relations.
+  # When populate_fields are given, target documents' revisions are loaded and
+  # preloaded the same way (one level deep).
+  class RevisionPreloader
+    def initialize(revisions, populate_fields: [], preview: false)
+      @revisions = Array(revisions).compact
+      @populate_field_ids = populate_fields.map(&:id).to_set
+      @preview = preview
+      @values = {}
+      @relations = {}
+      @instances = {}
+      @fields_by_content_type = {}
+      @fields_by_component = {}
+      @target_revision_by_document_id = {}
+      load_all
+    end
+
+    def document_for(revision)
+      revision.document
+    end
+
+    def fields_for_content_type(content_type_id)
+      @fields_by_content_type[content_type_id] || []
+    end
+
+    def fields_for_component(component_id)
+      @fields_by_component[component_id] || []
+    end
+
+    def value(owner, field)
+      @values.dig(owner_key(owner), field.id)
+    end
+
+    def relations(owner, field)
+      @relations.dig(owner_key(owner), field.id) || []
+    end
+
+    def component_instances(owner, field)
+      @instances.dig(owner_key(owner), field.id) || []
+    end
+
+    def target_revision(document_id)
+      @target_revision_by_document_id[document_id]
+    end
+
+    private
+
+    def owner_key(owner)
+      [ owner.class.name, owner.id ]
+    end
+
+    def load_all
+      return if @revisions.empty?
+
+      ActiveRecord::Associations::Preloader.new(records: @revisions, associations: { document: :content_type }).call
+      load_fields_for_content_types(@revisions.map { |revision| revision.document.content_type_id })
+      load_owned(@revisions)
+      load_populate_targets
+    end
+
+    def load_fields_for_content_types(content_type_ids)
+      missing = content_type_ids.uniq - @fields_by_content_type.keys
+      return if missing.empty?
+
+      Field.where(content_type_id: missing).ordered
+        .group_by(&:content_type_id)
+        .each { |ct_id, fields| @fields_by_content_type[ct_id] = fields }
+      missing.each { |ct_id| @fields_by_content_type[ct_id] ||= [] }
+    end
+
+    def load_owned(owners)
+      load_values_and_relations(owners)
+
+      instances = ComponentInstance
+        .where(owner_type: owners.first.class.name, owner_id: owners.map(&:id))
+        .order(:position).includes(:component).to_a
+      group_owned(instances, @instances)
+
+      component_ids = instances.map(&:component_id).uniq
+      if component_ids.any?
+        Field.where(component_id: component_ids).ordered
+          .group_by(&:component_id)
+          .each { |comp_id, fields| @fields_by_component[comp_id] = fields }
+      end
+
+      load_values_and_relations(instances) if instances.any?
+    end
+
+    def load_values_and_relations(owners)
+      owner_type = owners.first.class.name
+      owner_ids = owners.map(&:id)
+
+      values = ContentValue
+        .where(owner_type: owner_type, owner_id: owner_ids)
+        .includes(:field, media_asset: { file_attachment: :blob }).to_a
+      values.group_by { |value| [ value.owner_type, value.owner_id ] }.each do |key, group|
+        @values[key] = group.index_by(&:field_id)
+      end
+
+      relations = Relation
+        .where(owner_type: owner_type, owner_id: owner_ids)
+        .order(:position).includes(target_document: :content_type).to_a
+      group_owned(relations, @relations)
+    end
+
+    def group_owned(records, store)
+      records.group_by { |record| [ record.owner_type, record.owner_id ] }.each do |key, group|
+        store[key] = group.group_by(&:field_id)
+      end
+    end
+
+    def load_populate_targets
+      return if @populate_field_ids.empty?
+
+      targets = @revisions.flat_map { |revision|
+        (@relations[owner_key(revision)] || {})
+          .select { |field_id, _| @populate_field_ids.include?(field_id) }
+          .values.flatten.map(&:target_document)
+      }.compact.uniq # a target can be trashed, leaving the association nil
+
+      revision_id_by_document = targets.each_with_object({}) do |document, map|
+        revision_id = @preview ? (document.draft_revision_id || document.published_revision_id) : document.published_revision_id
+        map[document.id] = revision_id if revision_id
+      end
+      return if revision_id_by_document.empty?
+
+      target_revisions = DocumentRevision.where(id: revision_id_by_document.values).index_by(&:id)
+      documents_by_id = targets.index_by(&:id)
+
+      revision_id_by_document.each do |document_id, revision_id|
+        revision = target_revisions[revision_id]
+        next unless revision
+
+        revision.association(:document).target = documents_by_id[document_id]
+        @target_revision_by_document_id[document_id] = revision
+      end
+
+      loaded = @target_revision_by_document_id.values
+      load_fields_for_content_types(loaded.map { |revision| revision.document.content_type_id })
+      load_owned(loaded)
+    end
+  end
+end