ruby_cms 0.2.1.1 → 1.0.1

data/lib/generators/ruby_cms/templates/controllers/admin/users_controller.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module Admin
+  class UsersController < Admin::ApplicationController
+    include AdminPagination
+    include AdminTurboTable
+    include AuditLoggable
+    include AdminBulkActions
+
+    paginates_with_pref :users, default: 50
+
+    before_action :authorize_users_access
+
+    def index
+      base_scope = user_class.all
+      @filter_counts = base_user_counts(base_scope)
+      @total_users_count = @filter_counts[:all]
+
+      @current_filter = %w[all admin user active inactive].include?(params[:filter]) ? params[:filter] : "all"
+      scope = base_scope
+      case @current_filter
+      when "admin"    then scope = scope.where(admin: true)  if base_scope.column_names.include?("admin")
+      when "user"     then scope = scope.where(admin: false) if base_scope.column_names.include?("admin")
+      when "active"   then scope = scope.where(id: active_user_ids)
+      when "inactive" then scope = scope.where.not(id: active_user_ids)
+      end
+
+      scope = apply_search_filter(scope)
+
+      @sort_column = %w[user role created].include?(params[:sort]) ? params[:sort] : "created"
+      @sort_direction = params[:direction] == "asc" ? "asc" : "desc"
+      sort_db_column = {
+        "user" => user_email_column.to_s,
+        "role" => "admin",
+        "created" => "created_at"
+      }.fetch(@sort_column, "created_at")
+      # Whitelist sort column + direction explicitly so the resulting Arel literal
+      # only ever contains values from a fixed allow-list (no user input).
+      raise ArgumentError, "invalid sort column" unless %w[email_address email admin created_at].include?(sort_db_column)
+
+      direction_sql = @sort_direction == "asc" ? "ASC" : "DESC"
+      scope = scope.reorder(Arel.sql("#{sort_db_column} #{direction_sql}"))
+
+      # Preload associations the row partial touches: permissions.size + latest session.
+      # Without this every rendered row issues 2 extra queries.
+      preload_assocs = []
+      preload_assocs << :permissions if user_class.reflect_on_association(:permissions)
+      preload_assocs << :sessions    if user_class.reflect_on_association(:sessions)
+      scope = scope.includes(*preload_assocs) if preload_assocs.any?
+
+      @users = paginate_collection(scope)
+      @pending_invitations = Invitation.pending.includes(:invited_by).order(created_at: :desc)
+      @active_user_ids = active_user_ids
+      @permission_total = Permission.count
+      turbo_render_index
+    end
+
+    def show
+      @user = user_class.find(params[:id])
+      @user_details = build_user_details(@user)
+      @user_sessions = @user.respond_to?(:sessions) ? @user.sessions.order(updated_at: :desc) : []
+      @user_passkeys = @user.respond_to?(:passkey_credentials) ? @user.passkey_credentials.order(created_at: :desc) : []
+      @user_activity = AuditLogEntry.where(actor_email: user_email_value(@user)).order(created_at: :desc).limit(30)
+      @all_permissions = Permission.order(:key)
+      records = UserPermission.where(user: @user).pluck(:id, :permission_id)
+      @user_permission_id_by_permission = records.to_h { |up_id, perm_id| [ perm_id, up_id ] }
+    end
+
+    def destroy_sessions
+      user = user_class.find(params[:id])
+      count = user.sessions.count
+      user.sessions.destroy_all
+      audit!(:user_sessions_revoked, target: user, summary: "Beëindigde #{count} sessie(s) voor #{audit_user_email(user)}")
+      redirect_to admin_users_path, notice: "#{count} sessie#{'s' unless count == 1} beëindigd"
+    end
+
+    def create
+      user = user_class.new(user_params)
+      if user.save
+        audit!(:user_created, target: user, summary: "Invited user #{audit_user_email(user)}")
+        redirect_to admin_users_path, notice: t("ruby_cms.admin.users.created")
+      else
+        handle_create_failure(user)
+      end
+    end
+
+    def destroy
+      user = user_class.find(params[:id])
+      email = audit_user_email(user)
+      unless user.destroy
+        return redirect_to admin_users_path, alert: user.errors.full_messages.to_sentence.presence || t("ruby_cms.admin.users.deleted")
+      end
+
+      audit!(:user_deleted, target: "User:#{email}", summary: "Deleted user #{email}", meta: { user_id: user.id })
+      redirect_to admin_users_path, notice: t("ruby_cms.admin.users.deleted")
+    end
+
+    def bulk_delete
+      count = bulk_destroy(user_class, audit: :user_deleted, target_label: "User")
+      turbo_redirect_to admin_users_path, notice: "#{count} user(s) #{
+        t('ruby_cms.admin.users.deleted')
+      }."
+    end
+
+    private
+
+    # Allow users to view their own profile without manage_permissions.
+    # Everything else (index, destroy, sessions revoke, create) requires it.
+    def authorize_users_access
+      return if action_name == "show" && params[:id].to_i == current_user_cms&.id
+
+      require_permission!(:manage_permissions)
+    end
+
+    def base_user_counts(scope)
+      counts = { all: scope.count }
+      if scope.column_names.include?("admin")
+        counts[:admin] = scope.where(admin: true).count
+        counts[:user]  = scope.where(admin: false).count
+      else
+        counts[:admin] = 0
+        counts[:user]  = counts[:all]
+      end
+      active = active_user_ids
+      counts[:active]   = scope.where(id: active).count
+      counts[:inactive] = counts[:all] - counts[:active]
+      counts
+    end
+
+    def active_user_ids
+      @active_user_ids ||= if defined?(Session)
+                             Session.where("updated_at > ?", 30.days.ago).distinct.pluck(:user_id)
+      else
+                             []
+      end
+    end
+
+    def build_user_details(user)
+      sessions = user.respond_to?(:sessions) ? user.sessions : nil
+      last_session = sessions&.order(updated_at: :desc)&.first
+      active_count = sessions ? sessions.where("updated_at > ?", 30.minutes.ago).count : 0
+      invited_via = Invitation.accepted.includes(:invited_by).where(email: user_email_value(user)).order(accepted_at: :desc).first
+      {
+        joined_at: user.respond_to?(:created_at) ? user.created_at : nil,
+        last_ip: last_session&.ip_address,
+        last_user_agent: last_session&.user_agent,
+        last_seen_at: last_session&.updated_at,
+        active_sessions: active_count,
+        total_sessions: sessions ? sessions.count : 0,
+        invited_by: invited_via&.invited_by&.email_address,
+        is_active: active_user_ids.include?(user.id)
+      }
+    end
+
+    def user_email_value(user)
+      user.respond_to?(:email_address) ? user.email_address : user.try(:email)
+    end
+
+    def apply_search_filter(collection)
+      return collection if params[:q].blank?
+
+      collection.where(build_search_conditions)
+    end
+
+    def build_search_conditions
+      search_term = "%#{params[:q].downcase}%"
+      email_attr = user_email_column
+      conditions = [ "LOWER(#{email_attr}) LIKE ?" ]
+      values = [ search_term ]
+
+      if numeric_query?
+        conditions << "id = ?"
+        values << params[:q].to_i
+      end
+
+      [ conditions.join(" OR "), *values ]
+    end
+
+    def user_email_column
+      user_class.column_names.include?("email_address") ? :email_address : :email
+    end
+
+    def numeric_query?
+      params[:q] =~ /^\d+$/
+    end
+
+    def handle_create_failure(user)
+      @users = user_class.order(:id).limit(100)
+      flash.now[:alert] = t(
+        "ruby_cms.admin.users.could_not_create",
+        errors: user.errors.full_messages.to_sentence
+      )
+      render :index, status: :unprocessable_content
+    end
+
+    def user_class
+      Object.const_get(Rails.application.config.ruby_cms.user_class_name.presence || "User")
+    end
+
+    def audit_user_email(user)
+      return user.email_address if user.respond_to?(:email_address)
+      return user.email         if user.respond_to?(:email)
+
+      "User##{user.id}"
+    end
+
+    def user_params
+      email_attr = user_class.column_names.include?("email_address") ? :email_address : :email
+      password_attrs = if user_class.column_names.include?("password")
+                         %i[
+                           password
+                           password_confirmation
+                         ]
+      else
+                         []
+      end
+      params.expect(user: [ email_attr, *password_attrs ])
+    end
+  end
+end

data/lib/generators/ruby_cms/templates/controllers/admin/visitor_errors_controller.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module Admin
+  class VisitorErrorsController < Admin::ApplicationController
+    include AdminPagination
+    include AdminTurboTable
+    include AuditLoggable
+    include AdminBulkActions
+
+    paginates_with_pref :visitor_errors, default: 25
+
+    before_action { require_permission!(:manage_visitor_errors) }
+    before_action :set_visitor_error, only: %i[show resolve unresolve]
+
+    def index
+      by_resolved = VisitorError.group(:resolved).count
+      open_count     = by_resolved[false].to_i
+      resolved_count = by_resolved[true].to_i
+      @filter_counts = {
+        all: open_count + resolved_count,
+        open: open_count,
+        resolved: resolved_count
+      }
+
+      @current_filter = %w[all open resolved].include?(params[:filter]) ? params[:filter] : "all"
+      scope = VisitorError.recent
+      case @current_filter
+      when "open"     then scope = scope.where(resolved: false)
+      when "resolved" then scope = scope.where(resolved: true)
+      end
+
+      # legacy resolved param support
+      if params[:resolved].present? && params[:filter].blank?
+        scope = scope.where(resolved: params[:resolved] == "true")
+        @current_filter = params[:resolved] == "true" ? "resolved" : "open"
+      end
+
+      scope = apply_search_filter(scope)
+      scope = apply_error_type_filter(scope)
+
+      @sort_column = %w[time page error status].include?(params[:sort]) ? params[:sort] : "time"
+      @sort_direction = params[:direction] == "asc" ? "asc" : "desc"
+      sort_db_column = {
+        "time" => "created_at",
+        "page" => "request_path",
+        "error" => "error_class",
+        "status" => "resolved"
+      }[@sort_column]
+      scope = scope.reorder(Arel.sql("#{sort_db_column} #{@sort_direction}"))
+
+      @visitor_errors = set_pagination_vars(scope)
+      turbo_render_index
+    end
+
+    def show; end
+
+    def resolve
+      @visitor_error.resolve!
+      @visitor_error.save!
+      audit!(:visitor_error_resolved, target: @visitor_error, summary: "Resolved #{@visitor_error.error_class} on #{@visitor_error.request_path}")
+      redirect_to admin_visitor_errors_path,
+                  notice: t("ruby_cms.admin.visitor_errors.resolved")
+    end
+
+    def unresolve
+      @visitor_error.reopen!
+      @visitor_error.save!
+      audit!(:visitor_error_unresolved, target: @visitor_error, summary: "Reopened #{@visitor_error.error_class} on #{@visitor_error.request_path}")
+      redirect_to admin_visitor_errors_path,
+                  notice: t("ruby_cms.admin.visitor_errors.unresolved", default: "Markeer als open")
+    end
+
+    def bulk_delete
+      count = bulk_destroy(VisitorError, audit: :visitor_error_deleted, target_label: "VisitorError", soft: true)
+      redirect_to admin_visitor_errors_path,
+                  notice: t("ruby_cms.admin.visitor_errors.bulk_deleted", count:)
+    end
+
+    def bulk_mark_as_resolved
+      count = bulk_update(VisitorError, { resolved: true }, audit: :visitor_error_resolved, target_label: "VisitorError")
+      redirect_to admin_visitor_errors_path,
+                  notice: t("ruby_cms.admin.visitor_errors.bulk_resolved", count:)
+    end
+
+    def bulk_mark_as_unresolved
+      count = bulk_update(VisitorError, { resolved: false }, audit: :visitor_error_unresolved, target_label: "VisitorError")
+      redirect_to admin_visitor_errors_path,
+                  notice: t("ruby_cms.admin.visitor_errors.bulk_unresolved", default: "#{count} fout(en) heropend", count: count)
+    end
+
+    private
+
+    def set_visitor_error
+      @visitor_error = VisitorError.find(params[:id])
+    end
+
+    def apply_search_filter(scope)
+      return scope if params[:search].blank?
+
+      scope.search_by_term(sanitize_search_term(params[:search]))
+    end
+
+    def apply_error_type_filter(scope)
+      return scope if params[:error_type].blank?
+
+      term = sanitize_search_term(params[:error_type])
+      scope.where("error_class ILIKE ?", "%#{term}%")
+    end
+
+    def sanitize_search_term(term)
+      term.to_s.strip.gsub(/[%_\\]/, "").truncate(100)
+    end
+  end
+end