ruby_cms 0.2.1.1 → 1.0.0

data/lib/generators/ruby_cms/templates/controllers/admin/security_controller.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+class Admin::SecurityController < Admin::ApplicationController
+  include AdminPagination
+  include AuditLoggable
+
+  cms_page :security
+  before_action :set_date_range
+  before_action :validate_date_range
+
+  def index
+    load_dashboard_stats
+    load_security_events
+    load_ip_blocklist
+
+    render_ip_blocklist_frame if ip_blocklist_frame?
+  end
+
+  def create_ip_blocklist_entry
+    @ip_blocklist_entry = IpBlocklist.new(ip_blocklist_params)
+
+    if @ip_blocklist_entry.save
+      audit!(:ip_blocklisted, target: "IpBlocklist:#{@ip_blocklist_entry.ip_address}", summary: "Blocklisted IP #{@ip_blocklist_entry.ip_address}", meta: { ip: @ip_blocklist_entry.ip_address, note: @ip_blocklist_entry.note })
+      handle_blocklist_success("IP-adres toegevoegd aan de blocklist.")
+    else
+      handle_blocklist_failure
+    end
+  end
+
+  def destroy_ip_blocklist_entry
+    entry = IpBlocklist.find(params[:id])
+    ip = entry.ip_address
+    entry.destroy
+    audit!(:ip_blocklist_removed, target: "IpBlocklist:#{ip}", summary: "Removed IP #{ip} from blocklist", meta: { ip: })
+    handle_blocklist_success("IP-adres verwijderd van de blocklist.")
+  end
+
+  private
+
+  def load_dashboard_stats
+    stats = SecurityService
+            .new(@start_date, @end_date, @time_period)
+            .dashboard_stats
+
+    stats.each { |key, value| instance_variable_set("@#{key}", value) }
+  end
+
+  def load_security_events
+    @event_type_filter = params[:event_type]
+
+    @security_events =
+      filter_blocked_ips(filtered_security_events)
+      .order(time: :desc)
+      .includes(:user)
+
+    @security_events = set_pagination_vars(@security_events, per_page: 25)
+  end
+
+  def filtered_security_events
+    return base_security_events unless valid_event_type_filter?
+
+    base_security_events.where(name: @event_type_filter)
+  end
+
+  def base_security_events
+    @base_security_events ||= Ahoy::Event.where(
+      time: @date_range,
+      name: SecurityTracker::EVENT_TYPES
+    )
+  end
+
+  def valid_event_type_filter?
+    @event_type_filter.present? &&
+      SecurityTracker::EVENT_TYPES.include?(@event_type_filter)
+  end
+
+  def load_ip_blocklist
+    @blocked_ips = set_pagination_vars(IpBlocklist.ordered, per_page: 10)
+    @ip_blocklist_entry = IpBlocklist.new
+  end
+
+  def filter_blocked_ips(events)
+    events.where.not(ip_address: IpBlocklist.select(:ip_address))
+          .or(events.where(ip_address: nil))
+  end
+
+  def handle_blocklist_success(message)
+    load_ip_blocklist
+
+    if ip_blocklist_frame?
+      render "ip_blocklist_content", layout: false, status: :ok
+    else
+      redirect_to admin_security_index_path(
+        page: params[:page],
+        anchor: "ip-blocklist"
+      ), notice: message
+    end
+  end
+
+  def handle_blocklist_failure
+    load_ip_blocklist
+
+    if ip_blocklist_frame?
+      render "ip_blocklist_content", layout: false, status: :unprocessable_content
+    else
+      flash.now[:alert] = "Toevoegen mislukt. Controleer het IP-adres."
+      render :index, status: :unprocessable_content
+    end
+  end
+
+  def ip_blocklist_frame?
+    turbo_frame_request? &&
+      request.headers["Turbo-Frame"] == "ip_blocklist_content"
+  end
+
+  def render_ip_blocklist_frame
+    render "ip_blocklist_content", layout: false
+  end
+
+  def set_date_range
+    @time_period = params[:time_period] || "week"
+
+    @date_range, @period_label =
+      case @time_period
+      when "today"
+        [ Date.current.all_day, "Today" ]
+      when "month"
+        [ 1.month.ago..Time.current, "This Month" ]
+      else
+        [ 1.week.ago..Time.current, "This Week" ]
+      end
+
+    @start_date = @date_range.begin.to_date
+    @end_date   = @date_range.end.to_date
+  end
+
+  def validate_date_range
+    return if @start_date <= @end_date && @end_date <= Date.current
+
+    redirect_to admin_security_index_path, alert: "Invalid date range"
+  end
+
+  def ip_blocklist_params
+    params.require(:ip_blocklist).permit(:ip_address, :note)
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/settings_controller.rb

@@ -0,0 +1,298 @@
+# frozen_string_literal: true
+
+module Admin
+  class SettingsController < Admin::ApplicationController
+    include AuditLoggable
+
+    before_action { require_permission!(:manage_admin) }
+
+    def index
+      RubyCms::Settings.ensure_defaults!
+
+      @registry_entries = sorted_registry_entries
+      @categories = @registry_entries.map { |e| e.category.to_s }.uniq
+      @active_tab = resolve_active_tab(params[:tab], @categories)
+      @entries_for_tab = @active_tab == "overview" ? [] : @registry_entries.select { |entry| entry.category.to_s == @active_tab }
+
+      # Preload all Preference rows for this tab in one query before .get loop.
+      # Without this each entry triggers a SELECT (N+1).
+      RubyCms::Settings.preload_keys(@entries_for_tab.map { |e| e.key.to_s })
+
+      @values = @entries_for_tab.to_h do |entry|
+        [ entry.key, RubyCms::Settings.get(entry.key, default: entry.default) ]
+      end
+
+      # Preload Preference timestamps for entries in this tab (avoids N+1 in view).
+      @pref_updated_at = if @entries_for_tab.any?
+                           keys = @entries_for_tab.map { |e| e.key.to_s }
+                           Preference.where(key: keys).pluck(:key, :updated_at).to_h
+      else
+                           {}
+      end
+
+      load_overview_data if @active_tab == "overview"
+    end
+
+    def update
+      updated_keys = apply_updates(extract_updates)
+      updated_keys = apply_nav_order_update(updated_keys)
+
+      if updated_keys.any?
+        audit!(
+          :settings_updated,
+          target: "Settings",
+          summary: "Updated #{updated_keys.size} setting(s): #{updated_keys.join(', ').truncate(200)}",
+          meta: { keys: updated_keys }
+        )
+      end
+
+      respond_with_update_success(updated_keys)
+    rescue StandardError => e
+      respond_with_update_failure(e)
+    end
+
+    def reset_defaults
+      RubyCms::SettingsRegistry.seed_defaults!
+
+      RubyCms::SettingsRegistry.each do |entry|
+        RubyCms::Settings.set(entry.key, entry.default)
+      end
+
+      audit!(:settings_reset, target: "Settings", summary: "Reset all settings to defaults")
+      redirect_to admin_settings_path(redirect_settings_params),
+                  notice: t("ruby_cms.admin.settings.defaults_reset")
+    end
+
+    # Dedicated endpoint for saving nav order. Stores a JSON hash so cross-section moves
+    # (an item dragged from main → settings) are persisted as a section override.
+    def update_nav_order
+      payload = nav_order_payload_from_raw_body
+      if payload["main"].blank? && payload["settings"].blank?
+        return render json: {
+                        success: false,
+                        error: "nav_order_main and nav_order_bottom required"
+                      },
+                      status: :unprocessable_content
+      end
+
+      rec = Preference.find_or_initialize_by(key: "nav_order")
+      rec.category = "navigation" if rec.new_record?
+      rec.value_type = "json"
+      rec.value = payload.to_json
+      rec.save!
+      render json: { success: true, updated_keys: [ "nav_order" ], updated_count: 1 }
+    rescue StandardError => e
+      render json: { success: false, error: e.message }, status: :unprocessable_content
+    end
+
+    private
+
+    def nav_order_payload_from_raw_body
+      # Prefer parsed params (Rails JSON middleware already consumed the body for application/json POSTs).
+      main_param   = params[:nav_order_main]
+      bottom_param = params[:nav_order_bottom]
+      groups_param = params[:nav_order_groups]
+      data =
+        if main_param.present? || bottom_param.present? || groups_param.present?
+          { "nav_order_main" => main_param, "nav_order_bottom" => bottom_param, "nav_order_groups" => groups_param }
+        else
+          body = request.raw_post.presence || begin
+            request.body.rewind if request.body.respond_to?(:rewind)
+            request.body.read
+          end
+          body.present? ? JSON.parse(body) : {}
+        end
+      data = {} unless data.kind_of?(Hash)
+      raw_groups = data["nav_order_groups"] || data[:nav_order_groups] || {}
+      raw_groups = raw_groups.to_unsafe_h if raw_groups.respond_to?(:to_unsafe_h)
+      groups_hash = raw_groups.kind_of?(Hash) ? raw_groups.transform_keys(&:to_s).transform_values { |v| Array(v).map(&:to_s) } : {}
+      {
+        "main" => Array(data["nav_order_main"] || data[:nav_order_main]).map(&:to_s),
+        "settings" => Array(data["nav_order_bottom"] || data[:nav_order_bottom]).map(&:to_s),
+        "groups" => groups_hash
+      }
+    rescue JSON::ParserError
+      { "main" => [], "settings" => [], "groups" => {} }
+    end
+
+    # Kept for legacy update path (form POST to settings#update)
+    def nav_order_from_raw_body
+      payload = nav_order_payload_from_raw_body
+      Array(payload["main"]) + Array(payload["settings"])
+    end
+
+    def redirect_settings_params
+      { tab: params[:tab].presence || default_tab }.tap do |h|
+        h[:nav_sub] = params[:nav_sub].presence if params[:tab].to_s == "navigation"
+      end
+    end
+
+    # Persist nav order so it survives reload. Uses Preference directly so we hit the same row Settings.get reads.
+    def persist_nav_order(order)
+      return unless order.kind_of?(Array) && order.any?
+
+      Preference.set("nav_order", order)
+    end
+
+    # For JSON PATCH, Rails may wrap body under :settings (or leave at root). Body stream can be
+    # consumed by the parser so we try params first, then rewind and read raw body.
+    def nav_order_arrays_from_request
+      main = nav_order_param(:nav_order_main)
+      bottom = nav_order_param(:nav_order_bottom)
+      if main.nil? && bottom.nil? && request.content_mime_type&.symbol == :json
+        data = parsed_json_body
+        main, bottom = nav_order_arrays_from_json(data) if data
+      end
+      [
+        main.kind_of?(Array) ? main.map(&:to_s) : Array(main).map(&:to_s),
+        bottom.kind_of?(Array) ? bottom.map(&:to_s) : Array(bottom).map(&:to_s)
+      ]
+    end
+
+    def nav_order_param(key)
+      key_s = key.to_s
+      # Root (symbol or string)
+      params[key].presence || params[key_s].presence ||
+        # Common Rails JSON wrapper
+        params.dig(:settings, key).presence || params.dig(:settings, key_s).presence ||
+        params.dig("settings", key).presence || params.dig("settings", key_s).presence
+    end
+
+    def parsed_json_body
+      body = nil
+      if request.body.respond_to?(:rewind)
+        request.body.rewind
+        body = request.body.read
+      end
+      body = request.raw_post if body.blank? && body != false
+      return nil if body.blank?
+
+      JSON.parse(body)
+    rescue JSON::ParserError
+      nil
+    end
+
+    def sorted_registry_entries
+      RubyCms::SettingsRegistry
+        .entries
+        .values
+        .sort_by { |entry| [ entry.category.to_s, entry.key.to_s ] }
+    end
+
+    def resolve_active_tab(tab_param, categories)
+      requested = tab_param.to_s
+      return "overview" if requested.blank? || requested == "overview"
+      return requested if categories.include?(requested)
+
+      "overview"
+    end
+
+    def default_tab
+      "overview"
+    end
+
+    def load_overview_data
+      @recent_changes = Preference.where.not(key: "nav_order")
+                                  .order(updated_at: :desc)
+                                  .limit(6)
+      @system_info = {
+        rails: Rails.version,
+        ruby: RUBY_VERSION,
+        env: Rails.env,
+        db: safe_db_info,
+        cache: Rails.cache.class.name.demodulize,
+        registry: RubyCms::SettingsRegistry.entries.size,
+        prefs: Preference.count
+      }
+    end
+
+    def safe_db_info
+      adapter = begin
+        ActiveRecord::Base.connection_db_config.adapter
+      rescue StandardError
+        "unknown"
+      end
+      "#{adapter}"
+    rescue StandardError
+      "unknown"
+    end
+
+    def extract_updates
+      if params[:preferences].present?
+        params.require(:preferences).to_unsafe_h
+      elsif params[:key].present?
+        { params[:key].to_s => params[:value] }
+      else
+        {}
+      end
+    end
+
+    def apply_updates(updates)
+      updates.filter_map do |key, value|
+        entry = RubyCms::SettingsRegistry.fetch(key)
+        next unless entry
+
+        RubyCms::Settings.set(entry.key, value)
+        entry.key
+      end
+    end
+
+    def apply_nav_order_update(updated_keys)
+      nav_main, nav_bottom = nav_order_arrays_from_request
+      return updated_keys if nav_main.blank? && nav_bottom.blank?
+
+      order = (nav_main + nav_bottom).map(&:to_s)
+      persist_nav_order(order)
+      updated_keys + [ "nav_order" ]
+    end
+
+    def respond_with_update_success(updated_keys)
+      respond_to do |format|
+        format.html do
+          redirect_to admin_settings_path(redirect_settings_params),
+                      notice: t("ruby_cms.admin.settings.updated_many",
+                                default: "#{updated_keys.size} setting(s) updated.")
+        end
+
+        format.json do
+          render json: {
+            success: true,
+            updated_keys: updated_keys,
+            updated_count: updated_keys.size
+          }
+        end
+      end
+    end
+
+    def respond_with_update_failure(error)
+      respond_to do |format|
+        format.html do
+          redirect_to admin_settings_path(redirect_settings_params),
+                      alert: error.message
+        end
+
+        format.json do
+          render json: { success: false, error: error.message }, status: :unprocessable_content
+        end
+      end
+    end
+
+    def nav_order_from_raw_hash(data)
+      main = data["nav_order_main"]
+      bottom = data["nav_order_bottom"]
+      main = Array(main).map(&:to_s) if main
+      bottom = Array(bottom).map(&:to_s) if bottom
+      (main || []) + (bottom || [])
+    end
+
+    def nav_order_arrays_from_json(data)
+      main = data.dig("settings", "nav_order_main") ||
+             data["nav_order_main"].presence ||
+             data[:nav_order_main].presence
+      bottom = data.dig("settings", "nav_order_bottom") ||
+               data["nav_order_bottom"].presence ||
+               data[:nav_order_bottom].presence
+      [ main, bottom ]
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/system_health_controller.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Admin
+  class SystemHealthController < Admin::ApplicationController
+    before_action { require_permission!(:manage_system_health) }
+
+    def index
+      @health = Admin::HealthCheck.call
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/trash_controller.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Recover-or-purge UI for discarded records.
+#
+# Lists items per model that respond to .discarded scope, grouped by model.
+# Supports per-row restore (#undiscard) and permanent delete (#destroy).
+module Admin
+  class TrashController < Admin::ApplicationController
+    include AuditLoggable
+
+    before_action { require_permission!(:manage_admin) }
+
+    # Models we expose in the trash UI. Each must `include Discard::Model`.
+    DISCARDABLE = {
+      "visitor_errors"   => "VisitorError",
+      "content_blocks"   => "ContentBlock",
+      "redirects"        => "Redirect"
+    }.freeze
+
+    def index
+      @groups = DISCARDABLE.filter_map do |slug, class_name|
+        klass = class_name.safe_constantize
+        next unless klass&.respond_to?(:discarded)
+
+        items = klass.discarded.order(discarded_at: :desc).limit(50)
+        next if items.empty?
+
+        { slug: slug, klass: klass, label: class_name.titleize, items: items }
+      end
+      @total = @groups.sum { |g| g[:items].size }
+    end
+
+    # POST /admin/trash/:model/:id/restore
+    def restore
+      record = locate_record
+      return redirect_to(admin_trash_path, alert: "Niet gevonden.") unless record
+
+      record.undiscard
+      audit!(:trashed_item_restored, target: record, summary: "Restored #{record.class.name}##{record.id}")
+      redirect_to admin_trash_path, notice: "Hersteld."
+    end
+
+    # DELETE /admin/trash/:model/:id
+    def destroy
+      record = locate_record
+      return redirect_to(admin_trash_path, alert: "Niet gevonden.") unless record
+
+      label = "#{record.class.name}##{record.id}"
+      record.destroy
+      audit!(:trashed_item_purged, target: label, summary: "Purged #{label}", meta: { id: record.id })
+      redirect_to admin_trash_path, notice: "Permanent verwijderd."
+    end
+
+    private
+
+    def locate_record
+      klass = DISCARDABLE[params[:model]]&.safe_constantize
+      klass&.discarded&.find_by(id: params[:id])
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/user_permissions_controller.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Admin
+  class UserPermissionsController < Admin::ApplicationController
+    include AuditLoggable
+    include AdminBulkActions
+
+    before_action { require_permission!(:manage_permissions) }
+    before_action :set_user
+
+    def index
+      @permissions = Permission.order(:key)
+      @user_permissions = if @user
+                            UserPermission.where(user: @user)
+                                          .includes(:permission)
+      else
+                            []
+      end
+    end
+
+    def create
+      if params[:template].present?
+        apply_template
+      else
+        grant_individual_permission
+      end
+    end
+
+    def destroy
+      up = UserPermission.find_by!(user: @user, id: params[:id])
+      key = up.permission&.key
+      unless up.destroy
+        return redirect_to admin_user_permissions_path(@user), alert: up.errors.full_messages.to_sentence
+      end
+
+      audit!(:permission_revoked, target: "Permission:#{key}", summary: "Revoked #{key} from #{audit_user_email}", meta: { user_id: @user.id, permission_key: key })
+      redirect_to admin_user_permissions_path(@user),
+                  notice: t("ruby_cms.admin.user_permissions.revoked")
+    end
+
+    def bulk_delete
+      ids = Array(params[:item_ids]).filter_map(&:to_i)
+      user_permissions = UserPermission.where(user: @user, id: ids)
+      keys = user_permissions.includes(:permission).map { |up| up.permission&.key }.compact
+      count = user_permissions.count
+      user_permissions.destroy_all
+      audit!(:permission_revoked, target: "User:#{audit_user_email}", summary: "Revoked #{count} permission(s) from #{audit_user_email}", meta: { user_id: @user.id, count: count, permission_keys: keys })
+      redirect_to admin_user_permissions_path(@user),
+                  notice: "#{count} permission(s) #{
+                    t('ruby_cms.admin.user_permissions.revoked')
+                  }."
+    end
+
+    private
+
+    def set_user
+      @user = user_class.find(params[:user_id])
+    end
+
+    def user_class
+      Object.const_get(Rails.application.config.ruby_cms.user_class_name.presence || "User")
+    end
+
+    def apply_template
+      template_key = params[:template].to_sym
+      UserPermission.where(user: @user).destroy_all
+      Permission.apply_template!(@user, template_key)
+      @user.make_admin! if @user.respond_to?(:make_admin!) && !@user.admin?
+      audit!(:permission_template_applied, target: "User:#{audit_user_email}", summary: "Applied #{template_key} template to #{audit_user_email}", meta: { user_id: @user.id, template: template_key })
+      redirect_to admin_user_permissions_path(@user),
+                  notice: "Applied #{Permission.templates.dig(template_key, :label)} template."
+    rescue ArgumentError => e
+      redirect_to admin_user_permissions_path(@user), alert: e.message
+    end
+
+    def grant_individual_permission
+      permission = Permission.find(params[:permission_id])
+      UserPermission.find_or_create_by!(user: @user, permission: permission)
+      audit!(:permission_granted, target: "Permission:#{permission.key}", summary: "Granted #{permission.key} to #{audit_user_email}", meta: { user_id: @user.id, permission_key: permission.key })
+      redirect_to admin_user_permissions_path(@user),
+                  notice: t("ruby_cms.admin.user_permissions.granted")
+    rescue ActiveRecord::RecordInvalid
+      redirect_to admin_user_permissions_path(@user),
+                  alert: t("ruby_cms.admin.user_permissions.could_not_grant")
+    end
+
+    def audit_user_email
+      @user.respond_to?(:email_address) ? @user.email_address : "User##{@user.id}"
+    end
+  end
+end