ruby_cms 0.2.1.0 → 1.0.0

data/lib/generators/ruby_cms/templates/controllers/admin/media_assets_controller.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+# Media library — list, upload, preview and bulk-manage assets stored in
+# Active Storage.
+#
+# Permission gating runs through +Admin::BaseController#check_permission_for_controller+,
+# which consults +CONTROLLER_PERMISSION_MAP+ (we register +media_assets +→+
+# +:manage_media+ there).
+class Admin::MediaAssetsController < Admin::ApplicationController
+  include AdminPagination
+  include AdminTurboTable
+  include AuditLoggable
+  include AdminBulkActions
+
+  paginates_with_pref :media, default: 30
+
+  before_action { require_permission!(:manage_media) }
+
+  DEFAULT_FOLDERS = %w[general sports events news declarations].freeze
+  SORTS           = %w[recent name size used].freeze
+  VIEWS           = %w[grid list].freeze
+
+  before_action :set_media_asset, only: %i[show edit update destroy]
+
+  def index
+    scope = MediaAsset.all
+    scope = scope.in_folder(params[:folder]) if params[:folder].present? && params[:folder] != "all"
+    scope = scope.search(params[:search])    if params[:search].present?
+    scope = apply_sort(scope, params[:sort])
+
+    @folder         = params[:folder].presence || "all"
+    @sort           = SORTS.include?(params[:sort]) ? params[:sort] : "recent"
+    @view           = VIEWS.include?(params[:view]) ? params[:view] : "grid"
+    @search         = params[:search].to_s
+    @folder_counts  = MediaAsset.folder_counts
+    @folders        = (DEFAULT_FOLDERS + @folder_counts.keys.reject {|k| k == "all" }).uniq
+    @total_size_kb  = MediaAsset.sum(:size_kb)
+    @unused_count   = MediaAsset.unused.count
+    @media_assets   = set_pagination_vars(scope)
+    turbo_render_index
+  end
+
+  def show; end
+
+  def new
+    @media_asset = MediaAsset.new(folder: params[:folder].presence || "general")
+  end
+
+  def create
+    file = params.dig(:media_asset, :file) || params[:file]
+    redirect_to admin_media_assets_path, alert: "Selecteer minstens een bestand om te uploaden." and return if file.blank?
+
+    uploads = Array(file).reject(&:blank?)
+    created = []
+
+    MediaAsset.transaction do
+      uploads.each do |upload|
+        asset = build_asset_from_upload(upload)
+        asset.save!
+        created << asset
+      end
+    end
+
+    created.each do |asset|
+      audit!(:media_uploaded, target: asset, summary: "Uploaded #{asset.name} to #{asset.folder}", meta: { id: asset.id, folder: asset.folder, size_kb: asset.size_kb, kind: asset.kind })
+    end
+
+    redirect_to admin_media_assets_path(folder: params[:folder]),
+                notice: "#{created.size} bestand#{'en' if created.size != 1} geüpload."
+  rescue ActiveRecord::RecordInvalid => e
+    redirect_to admin_media_assets_path, alert: "Upload mislukt: #{e.record.errors.full_messages.to_sentence}"
+  end
+
+  def edit; end
+
+  def update
+    attrs = media_asset_params
+    attrs = attrs.to_h.merge(tags: parse_tags(attrs[:tags])) if attrs[:tags].kind_of?(String)
+
+    if @media_asset.update(attrs)
+      audit!(:media_updated, target: @media_asset, summary: "Updated media #{@media_asset.name}")
+      turbo_redirect_to admin_media_asset_path(@media_asset), notice: "Asset bijgewerkt."
+    else
+      turbo_render_form :edit
+    end
+  end
+
+  def destroy
+    name = @media_asset.name
+    @media_asset.destroy
+    audit!(:media_deleted, target: "MediaAsset:#{name}", summary: "Deleted media #{name}", meta: { id: @media_asset.id })
+    turbo_redirect_to admin_media_assets_path, notice: "Asset verwijderd."
+  end
+
+  def bulk_delete
+    bulk_destroy(MediaAsset, audit: :media_deleted, target_label: "MediaAsset")
+    turbo_redirect_to admin_media_assets_path, notice: "Geselecteerde assets verwijderd."
+  end
+
+  def bulk_move
+    folder = params[:folder].to_s
+    redirect_to admin_media_assets_path, alert: "Geen doel-folder opgegeven." and return if folder.blank?
+
+    bulk_update(MediaAsset, { folder: }, audit: :media_moved, target_label: "MediaAsset")
+    turbo_redirect_to admin_media_assets_path(folder:), notice: "Verplaatst naar #{folder}."
+  end
+
+  # JSON endpoint for a future visual-editor picker.
+  def picker
+    scope = MediaAsset.recent
+    scope = scope.in_folder(params[:folder]) if params[:folder].present? && params[:folder] != "all"
+    scope = scope.search(params[:search])    if params[:search].present?
+    scope = scope.limit(200)
+
+    render json: scope.map {|a|
+      {
+        id: a.id,
+        name: a.name,
+        cdn_url: a.cdn_url,
+        width: a.width,
+        height: a.height,
+        mime_type: a.mime_type,
+        folder: a.folder
+      }
+    }
+  end
+
+  private
+
+  def set_media_asset
+    @media_asset = MediaAsset.find(params[:id])
+  end
+
+  def media_asset_params
+    params.require(:media_asset).permit(:name, :folder, :tags)
+  end
+
+  def apply_sort(scope, sort)
+    case sort
+    when "name" then scope.order(Arel.sql("LOWER(name) ASC"))
+    when "size" then scope.largest
+    when "used" then scope.order(used_count: :desc)
+    else             scope.recent
+    end
+  end
+
+  def parse_tags(raw)
+    raw.to_s.split(",").map {|t| t.strip }.reject(&:blank?)
+  end
+
+  # Build a MediaAsset from an uploaded IO. Computes size/kind/dimensions where
+  # possible and assigns a deterministic tone for the grid tile background.
+  def build_asset_from_upload(upload)
+    blob  = ActiveStorage::Blob.create_and_upload!(io: upload, filename: upload.original_filename, content_type: upload.content_type)
+    mime  = upload.content_type.to_s
+    kind  = MediaAsset.kind_from_mime(mime)
+    name  = upload.original_filename
+
+    width, height = extract_dimensions(upload, kind)
+
+    MediaAsset.new(
+      name: name,
+      folder: params[:folder].presence || "general",
+      kind: kind,
+      mime_type: mime,
+      size_kb: (blob.byte_size.to_f / 1024).ceil,
+      width: width,
+      height: height,
+      tone: MediaAsset.tone_for(name),
+      uploaded_by_id: Current.session&.user&.id,
+      tags: parse_tags(params[:tags])
+    ).tap {|a| a.file.attach(blob) }
+  end
+
+  def extract_dimensions(upload, kind)
+    return [nil, nil] unless kind == "image"
+    return [nil, nil] unless defined?(Vips)
+
+    upload.rewind if upload.respond_to?(:rewind)
+    image = Vips::Image.new_from_buffer(upload.read, "")
+    upload.rewind if upload.respond_to?(:rewind)
+    [image.width, image.height]
+  rescue StandardError
+    [nil, nil]
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/notifications_controller.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Admin
+  class NotificationsController < Admin::ApplicationController
+    def mark_read
+      user = current_user_cms
+      notification = user&.notifications&.find_by(id: params[:id])
+      notification&.mark_as_read
+
+      bust_notifications_cache(user)
+      redirect_target = safe_redirect_target(params[:next])
+      redirect_to redirect_target
+    end
+
+    def mark_all_read
+      user = current_user_cms
+      user&.notifications&.unread&.mark_as_read
+      bust_notifications_cache(user)
+      redirect_back_or_to(admin_root_path)
+    end
+
+    private
+
+    def bust_notifications_cache(user)
+      return unless user
+
+      Rails.cache.delete("admin.notifications.user_#{user.id}")
+    end
+
+    def safe_redirect_target(target)
+      return admin_root_path if target.blank?
+      return target if target.start_with?("/") && !target.start_with?("//")
+
+      admin_root_path
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/passkey_credentials_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Admin
+  class PasskeyCredentialsController < ApplicationController
+    include SudoMode
+    require_recent_authentication
+
+    def index
+      @passkey_credentials = Current.user.passkey_credentials.order(created_at: :desc)
+    end
+
+    def destroy
+      Current.user.passkey_credentials.find(params[:id]).destroy!
+      redirect_to admin_user_path(Current.user, tab: "passkeys"), notice: "Passkey removed."
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/passkey_registrations_controller.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Admin
+  class PasskeyRegistrationsController < ApplicationController
+    include SudoMode
+    require_recent_authentication
+    # Never let a proxy/browser/service-worker cache the challenge options or result.
+    before_action { response.headers["Cache-Control"] = "no-store" }
+
+    # GET — the "name your passkey + register" page.
+    def new
+    end
+
+    # POST /admin/passkey_registration/options — issue WebAuthn creation options.
+    def options
+      user = Current.user
+      create_options = WebAuthn::Credential.options_for_create(
+        user: { id: user.webauthn_id, name: user.email_address, display_name: user.email_address },
+        exclude: user.passkey_credentials.pluck(:external_id),
+        authenticator_selection: { resident_key: "preferred", user_verification: "preferred" }
+      )
+      session[:passkey_registration_challenge] = create_options.challenge
+      render json: create_options
+    end
+
+    # POST /admin/passkey_registration — verify attestation, store credential.
+    def create
+      raw = params[:credential]
+      return render(json: { error: "Missing credential" }, status: :bad_request) if raw.blank?
+
+      webauthn_credential = WebAuthn::Credential.from_create(raw.to_unsafe_h)
+      challenge = session.delete(:passkey_registration_challenge)
+      webauthn_credential.verify(challenge)
+
+      Current.user.passkey_credentials.create!(
+        external_id: webauthn_credential.id,
+        public_key: webauthn_credential.public_key,
+        sign_count: webauthn_credential.sign_count,
+        nickname: params[:nickname].presence || "Passkey",
+        transports: Array(params[:transports]).join(","),
+        last_used_at: nil
+      )
+      render json: { ok: true, redirect: admin_user_path(Current.user, tab: "passkeys") }
+    rescue WebAuthn::Error => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    rescue ArgumentError, JSON::ParserError => e
+      render json: { error: "Invalid credential format" }, status: :bad_request
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/permissions_controller.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module Admin
+  class PermissionsController < Admin::ApplicationController
+    include AdminPagination
+    include AdminTurboTable
+    include AuditLoggable
+    include AdminBulkActions
+
+    paginates_with_pref :permissions, default: 50
+
+    before_action { require_permission!(:manage_permissions) }
+
+    def index
+      base_scope = Permission.all
+      @filter_counts = {
+        all: base_scope.count,
+        assigned: base_scope.joins(:user_permissions).distinct.count,
+        unassigned: base_scope.where.missing(:user_permissions)
+                    .count
+      }
+      @total_permissions_count = @filter_counts[:all]
+
+      @current_filter = %w[all assigned unassigned].include?(params[:filter]) ? params[:filter] : "all"
+
+      assigned_subquery = "(SELECT COUNT(*) FROM user_permissions WHERE user_permissions.permission_id = permissions.id)"
+      collection = Permission.all
+
+      case @current_filter
+      when "assigned"   then collection = collection.where("#{assigned_subquery} > 0")
+      when "unassigned" then collection = collection.where("#{assigned_subquery} = 0")
+      end
+
+      if params[:q].present?
+        search_term = "%#{params[:q].downcase}%"
+        collection = collection.where("LOWER(permissions.key) LIKE ? OR LOWER(permissions.name) LIKE ?",
+                                      search_term, search_term)
+      end
+
+      @sort_column = %w[key name assigned].include?(params[:sort]) ? params[:sort] : "key"
+      @sort_direction = params[:direction] == "desc" ? "desc" : "asc"
+      sort_db_column = {
+        "key" => "permissions.key",
+        "name" => "permissions.name",
+        "assigned" => assigned_subquery
+      }[@sort_column]
+      collection = collection.reorder(Arel.sql("#{sort_db_column} #{@sort_direction}"))
+
+      # Precompute assigned counts so row partial avoids N+1.
+      @assigned_counts = UserPermission.group(:permission_id).count
+      @view = params[:view] == "matrix" ? "matrix" : "list"
+
+      if @view == "matrix"
+        @permissions = collection.to_a
+        @matrix_users = User.order(:email_address).to_a
+        @matrix_grants = UserPermission.pluck(:user_id, :permission_id).to_set
+      else
+        @permissions = paginate_collection(collection)
+      end
+
+      @index ||= Permission.none
+      turbo_render_index
+    end
+
+    def toggle_user
+      permission = Permission.find(params[:id])
+      user = User.find(params[:user_id])
+      link = UserPermission.find_by(user:, permission:)
+
+      if link
+        unless link.destroy
+          msg = link.errors.full_messages.to_sentence
+          return respond_to do |f|
+            f.json { render json: { error: msg }, status: :unprocessable_content }
+            f.html { redirect_to admin_permissions_path(view: "matrix"), alert: msg }
+          end
+        end
+        granted = false
+        audit!(:permission_revoked, target: permission, summary: "Revoked #{permission.key} from #{user.email_address}", meta: { user_id: user.id })
+      else
+        UserPermission.create!(user:, permission:)
+        granted = true
+        audit!(:permission_granted, target: permission, summary: "Granted #{permission.key} to #{user.email_address}", meta: { user_id: user.id })
+      end
+
+      respond_to do |f|
+        f.json { render json: { granted: granted, user_id: user.id, permission_id: permission.id } }
+        f.html { redirect_to admin_permissions_path(view: "matrix"), notice: granted ? "Granted" : "Revoked" }
+      end
+    end
+
+    def create
+      @permission = Permission.new(permission_params)
+      if @permission.save
+        audit!(:permission_created, target: @permission, summary: "Created permission #{@permission.key}")
+        redirect_to admin_permissions_path,
+                    notice: t("ruby_cms.admin.permissions.created")
+      else
+        @permissions = Permission.order(:key)
+        flash.now[:alert] =
+          "Could not create permission: #{@permission.errors.full_messages.to_sentence}"
+        render :index, status: :unprocessable_content
+      end
+    end
+
+    def destroy
+      @permission = Permission.find(params[:id])
+      key = @permission.key
+      unless @permission.destroy
+        return redirect_to admin_permissions_path, alert: @permission.errors.full_messages.to_sentence
+      end
+
+      audit!(:permission_deleted, target: "Permission:#{key}", summary: "Deleted permission #{key}", meta: { key: })
+      redirect_to admin_permissions_path,
+                  notice: t("ruby_cms.admin.permissions.deleted")
+    end
+
+    def bulk_delete
+      count = bulk_destroy(Permission, audit: :permission_deleted, target_label: "Permission")
+      turbo_redirect_to admin_permissions_path,
+                        notice: "#{count} permission(s) #{
+                          t('ruby_cms.admin.permissions.deleted')
+                        }."
+    end
+
+    private
+
+    def permission_params
+      params.expect(permission: %i[key name])
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/redirects_controller.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+require "csv"
+
+class Admin::RedirectsController < Admin::ApplicationController
+  include AdminPagination
+  include AdminTurboTable
+  include AuditLoggable
+  include AdminBulkActions
+
+  paginates_with_pref :redirects, default: 25
+
+  before_action { require_permission!(:manage_redirects) }
+
+  SORTABLE_COLUMNS = {
+    "from"     => :source_path,
+    "to"       => :target_path,
+    "code"     => :status_code,
+    "hits"     => :hits,
+    "lastHit"  => :last_hit_at,
+    "enabled"  => :enabled
+  }.freeze
+
+  before_action :set_redirect, only: [ :show, :edit, :update, :destroy ]
+
+  def index
+    scope = Redirect.all
+    scope = apply_filter(scope)
+    scope = apply_search(scope, params[:search])
+    scope = apply_sort(scope)
+
+    # Single aggregate query — was 5 separate DB hits.
+    agg = Redirect.connection.select_one(<<~SQL)
+      SELECT
+        COUNT(*) AS total,
+        SUM(CASE WHEN enabled THEN 1 ELSE 0 END) AS active,
+        SUM(CASE WHEN NOT enabled THEN 1 ELSE 0 END) AS disabled,
+        SUM(CASE WHEN target_path LIKE 'http%' THEN 1 ELSE 0 END) AS external,
+        COALESCE(SUM(hits), 0) AS total_hits
+      FROM redirects
+    SQL
+    @counts = {
+      all:      agg["total"].to_i,
+      active:   agg["active"].to_i,
+      disabled: agg["disabled"].to_i,
+      external: agg["external"].to_i
+    }
+    @total_hits = agg["total_hits"].to_i
+    @active_filter = filter_value
+    @redirects = set_pagination_vars(scope)
+    turbo_render_index
+  end
+
+  def show
+    redirect_to edit_admin_redirect_path(@redirect)
+  end
+
+  def new
+    @redirect = Redirect.new(status_code: 301, enabled: true)
+  end
+
+  def create
+    @redirect = Redirect.new(redirect_params)
+    if @redirect.save
+      Redirect.bust_cache
+      audit!(:redirect_created, target: @redirect, summary: "Created redirect #{@redirect.source_path} → #{@redirect.target_path} (#{@redirect.status_code})")
+      turbo_redirect_to admin_redirects_path, notice: "Redirect aangemaakt."
+    else
+      turbo_render_form :new
+    end
+  end
+
+  def edit; end
+
+  def update
+    if @redirect.update(redirect_params)
+      Redirect.bust_cache
+      audit!(:redirect_updated, target: @redirect, summary: "Updated redirect #{@redirect.source_path}")
+      turbo_redirect_to admin_redirects_path, notice: "Redirect bijgewerkt."
+    else
+      turbo_render_form :edit
+    end
+  end
+
+  def destroy
+    src = @redirect.source_path
+    @redirect.destroy
+    Redirect.bust_cache
+    audit!(:redirect_deleted, target: "Redirect:#{src}", summary: "Deleted redirect #{src}", meta: { id: @redirect.id })
+    turbo_redirect_to admin_redirects_path, notice: "Redirect verwijderd."
+  end
+
+  def bulk_delete
+    count = bulk_destroy(Redirect, audit: :redirect_deleted, target_label: "Redirect")
+    Redirect.bust_cache
+    turbo_redirect_to admin_redirects_path, notice: "#{count} redirects verwijderd."
+  end
+
+  def bulk_enable
+    count = bulk_update(Redirect, { enabled: true }, audit: :redirect_enabled, target_label: "Redirect")
+    Redirect.bust_cache
+    turbo_redirect_to admin_redirects_path, notice: "#{count} redirects ingeschakeld."
+  end
+
+  def bulk_disable
+    count = bulk_update(Redirect, { enabled: false }, audit: :redirect_disabled, target_label: "Redirect")
+    Redirect.bust_cache
+    turbo_redirect_to admin_redirects_path, notice: "#{count} redirects uitgeschakeld."
+  end
+
+  def import_csv
+    file = params[:file]
+    return redirect_to(admin_redirects_path, alert: "Geen bestand geüpload.") unless file.respond_to?(:read)
+
+    rows = CSV.parse(file.read, headers: true)
+    expected = %w[from to code note]
+    unless rows.headers && (rows.headers - expected).empty? && (expected - rows.headers - %w[note]).empty?
+      return redirect_to(admin_redirects_path, alert: "Header moet zijn: from,to,code,note")
+    end
+
+    inserted = 0
+    rows.each do |row|
+      attrs = {
+        source_path: row["from"],
+        target_path: row["to"],
+        status_code: (row["code"].presence || 301).to_i,
+        note: row["note"]
+      }
+      if Redirect.create(attrs).persisted?
+        inserted += 1
+      end
+    end
+
+    Redirect.bust_cache
+    audit!(:redirect_imported, target: "Redirect (CSV)", summary: "Imported #{inserted} redirect(s) from CSV", meta: { inserted: inserted, total_rows: rows.size })
+    redirect_to admin_redirects_path, notice: "#{inserted} redirects geïmporteerd."
+  rescue CSV::MalformedCSVError => e
+    redirect_to admin_redirects_path, alert: "Ongeldig CSV-bestand: #{e.message}"
+  end
+
+  private
+
+  def set_redirect
+    @redirect = Redirect.find(params[:id])
+  end
+
+  def redirect_params
+    params.require(:redirect).permit(:source_path, :target_path, :status_code, :enabled, :note)
+  end
+
+  def filter_value
+    %w[all active disabled external].include?(params[:filter]) ? params[:filter] : "all"
+  end
+
+  def apply_filter(scope)
+    case filter_value
+    when "active"   then scope.active
+    when "disabled" then scope.disabled
+    when "external" then scope.external
+    else                 scope
+    end
+  end
+
+  def apply_search(scope, term)
+    return scope if term.blank?
+    scope.search(term)
+  end
+
+  def apply_sort(scope)
+    key = params[:sort].to_s
+    col = SORTABLE_COLUMNS[key] || :hits
+    dir = params[:dir].to_s.downcase == "asc" ? :asc : :desc
+    scope.order(col => dir, id: :asc)
+  end
+end