shiplog 0.1.0

data/app/controllers/shiplog/admin/entries_controller.rb

@@ -0,0 +1,55 @@
+module Shiplog
+  module Admin
+    class EntriesController < ApplicationController
+      PER_PAGE = 50
+      MAX_PAGE = 100_000
+
+      before_action :set_entry, only: %i[edit update]
+
+      def index
+        @status = Entry.statuses.key(params[:status].to_s) || "draft"
+        @kind = Entry.kinds.key(params[:kind].to_s)
+        @page = page_number
+        scope = Entry.where(status: @status)
+        scope = scope.where(kind: @kind) if @kind
+        records = scope.includes(:subject).order(updated_at: :desc, id: :desc)
+          .offset((@page - 1) * PER_PAGE).limit(PER_PAGE + 1).to_a
+        @more = records.size > PER_PAGE
+        @entries = records.first(PER_PAGE)
+        preload_repositories(@entries)
+      end
+
+      def edit
+      end
+
+      def update
+        if @entry.update(entry_params)
+          redirect_to root_path, notice: t("shiplog.admin.entries.saved")
+        else
+          render :edit, status: :unprocessable_content
+        end
+      end
+
+      private
+
+      # Every subject type (issue, pull request, commit) belongs to a repository; load them once per type.
+      def preload_repositories(entries)
+        entries.filter_map(&:subject).group_by(&:class).each_value do |subjects|
+          ActiveRecord::Associations::Preloader.new(records: subjects, associations: :repository).call
+        end
+      end
+
+      def set_entry
+        @entry = Entry.find(params[:id])
+      end
+
+      def entry_params
+        params.expect(entry: %i[title body released_on])
+      end
+
+      def page_number
+        Integer(params[:page].to_s, 10, exception: false).to_i.clamp(1, MAX_PAGE)
+      end
+    end
+  end
+end

data/app/controllers/shiplog/admin/syncs_controller.rb

@@ -0,0 +1,21 @@
+module Shiplog
+  module Admin
+    class SyncsController < ApplicationController
+      DELIVERIES_SHOWN = 20
+
+      def show
+        repositories = Repository.where(full_name: Shiplog.config.repositories).index_by(&:full_name)
+        @repositories = Shiplog.config.repositories.map { |full_name| [ full_name, repositories[full_name] ] }
+        @deliveries = WebhookDelivery.order(received_at: :desc, id: :desc).limit(DELIVERIES_SHOWN)
+        @webhook_secret_missing = Shiplog.config.webhook_secret.blank?
+        @github_token_missing = Shiplog.config.resolved_github_token.blank?
+      end
+
+      def create
+        SyncJob.perform_later
+        ScanChangesJob.perform_later if params[:scan] == "1"
+        redirect_to sync_path, notice: t("shiplog.admin.sync.queued")
+      end
+    end
+  end
+end

data/app/controllers/shiplog/application_controller.rb

@@ -0,0 +1,5 @@
+module Shiplog
+  class ApplicationController < ActionController::Base
+    helper Shiplog::FrontendHelper
+  end
+end

data/app/controllers/shiplog/changelogs_controller.rb

@@ -0,0 +1,24 @@
+module Shiplog
+  class ChangelogsController < PublicController
+    PER_PAGE = 30
+    MAX_PAGE = 100_000
+
+    def show
+      @page = page_number
+      scope = Entry.approved.where(kind: %w[feature change]).where.not(released_on: nil)
+        .order(released_on: :desc, approved_at: :desc, id: :desc)
+      records = scope.offset((@page - 1) * PER_PAGE).limit(PER_PAGE + 1).to_a
+      return head(:not_found) if @page > 1 && records.empty?
+
+      @older = records.size > PER_PAGE
+      @months = records.first(PER_PAGE).group_by { |entry| entry.released_on.beginning_of_month }
+      fresh_when etag: [ *shiplog_etag_parts, @page, @older, @months.values.flatten.map { |entry| [ entry.id, entry.updated_at ] } ]
+    end
+
+    private
+
+    def page_number
+      Integer(params[:page].to_s, 10, exception: false).to_i.clamp(1, MAX_PAGE)
+    end
+  end
+end

data/app/controllers/shiplog/frontends_controller.rb

@@ -0,0 +1,21 @@
+module Shiplog
+  class FrontendsController < ApplicationController
+    ASSET_DIRECTORY = Engine.root.join("app/frontend/shiplog")
+    ASSETS = {
+      "shiplog.css" => { path: ASSET_DIRECTORY.join("shiplog.css"), type: "text/css" },
+      "admin.css" => { path: ASSET_DIRECTORY.join("admin.css"), type: "text/css" },
+      "board.js" => { path: ASSET_DIRECTORY.join("board.js"), type: "text/javascript" }
+    }.freeze
+
+    # The version segment busts caches; stale versions are 404 so they are never cached as the current file.
+    skip_after_action :verify_same_origin_request, raise: false
+
+    def show
+      return head(:not_found) unless params[:version] == Shiplog::VERSION
+
+      asset = ASSETS[params[:name].to_s] or return head(:not_found)
+      expires_in 1.year, public: true, immutable: true
+      send_file asset[:path], type: asset[:type], disposition: :inline
+    end
+  end
+end

data/app/controllers/shiplog/public_controller.rb

@@ -0,0 +1,19 @@
+module Shiplog
+  # Parent controller for the public pages. The parent class is resolved when this
+  # file loads, so `config.public_parent_controller` must be set in an initializer
+  # (config/initializers/shiplog.rb), not later at runtime.
+  class PublicController < Shiplog.config.public_parent_controller.constantize
+    helper Shiplog::FrontendHelper
+    helper Shiplog::StylingHelper
+    helper Shiplog::HostRoutesHelper
+    layout -> { Shiplog.config.public_layout }
+
+    private
+
+    # What the rendered markup depends on besides the data: the locale, the gem version and the styling
+    # config. Host parent controllers rendering per-user layout content should declare `etag { current_user&.id }`.
+    def shiplog_etag_parts
+      [ I18n.locale, Shiplog::VERSION, Shiplog.config.classes.hash, Shiplog.config.stylesheet ]
+    end
+  end
+end

data/app/controllers/shiplog/roadmaps_controller.rb

@@ -0,0 +1,14 @@
+module Shiplog
+  class RoadmapsController < PublicController
+    def show
+      @columns = Roadmap.new(published_only: true).columns
+      fresh_when etag: [ *shiplog_etag_parts, etag_for(@columns) ]
+    end
+
+    private
+
+    def etag_for(columns)
+      columns.transform_values { |items| items.map { |item| [ item.entry.id, item.entry.updated_at ] } }
+    end
+  end
+end

data/app/controllers/shiplog/webhooks_controller.rb

@@ -0,0 +1,121 @@
+module Shiplog
+  class WebhooksController < ActionController::Base
+    MAX_BODY_BYTES = 25.megabytes
+
+    skip_forgery_protection
+    layout false
+
+    before_action :disable_session
+    before_action :read_body_within_limit
+    before_action :require_secret
+    before_action :verify_signature
+    before_action :require_delivery_id
+
+    def create
+      payload = parse_payload or return head(:bad_request)
+      event = request.headers["X-GitHub-Event"].to_s
+      return head(:ok) if event == "ping"
+
+      delivery = record_delivery(event, payload) or return head(:accepted)
+      enqueue_refreshes(delivery, event, payload)
+    end
+
+    private
+
+    def disable_session
+      request.session_options[:skip] = true
+    end
+
+    # Reads the body once, never more than the cap plus one byte; the result is reused for signature and parsing.
+    def read_body_within_limit
+      return head :content_too_large if request.content_length.to_i > MAX_BODY_BYTES
+
+      # Content-Length may be absent (chunked) or wrong; check what was actually received.
+      @body = request.body.read(MAX_BODY_BYTES + 1).to_s
+      request.body.rewind
+      head :content_too_large if @body.bytesize > MAX_BODY_BYTES
+    end
+
+    def require_delivery_id
+      head :bad_request if delivery_id.blank?
+    end
+
+    def delivery_id
+      request.headers["X-GitHub-Delivery"].to_s
+    end
+
+    def require_secret
+      head :service_unavailable if Shiplog.config.webhook_secret.blank?
+    end
+
+    def verify_signature
+      signature = WebhookSignature.new(
+        secret: Shiplog.config.webhook_secret.to_s,
+        body: @body,
+        header: request.headers["X-Hub-Signature-256"]
+      )
+      head :unauthorized unless signature.valid?
+    end
+
+    def parse_payload
+      payload = JSON.parse(@body)
+      payload if payload.is_a?(Hash)
+    rescue JSON::ParserError
+      nil
+    end
+
+    # Returns the delivery to process: a new one, or an earlier one that failed (error, never processed).
+    def record_delivery(event, payload)
+      WebhookDelivery.create!(
+        delivery_id: delivery_id,
+        event: event,
+        action: payload["action"],
+        repository_full_name: payload.dig("repository", "full_name"),
+        received_at: Time.current
+      )
+    rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid
+      retry_failed_delivery
+    end
+
+    # Claims atomically (clearing the error) so concurrent redeliveries do not both reprocess.
+    def retry_failed_delivery
+      failed = WebhookDelivery.where(delivery_id: delivery_id, processed_at: nil).where.not(error: nil)
+      delivery = failed.first
+      # Known gap: if the process dies after this claim but before processed_at is set, the delivery stays stuck;
+      # the scheduled SyncJob repairs the data.
+      delivery if delivery && failed.where(id: delivery.id).update_all(error: nil, updated_at: Time.current) == 1
+    end
+
+    def enqueue_refreshes(delivery, event, payload)
+      refresh_targets(event, payload).each { |target| RefreshJob.perform_later(*target) }
+      delivery.update!(processed_at: Time.current)
+      head :accepted
+    rescue => error
+      delivery.update(error: "#{error.class}: #{error.message}")
+      head :internal_server_error
+    end
+
+    def refresh_targets(event, payload)
+      targets =
+        case event
+        when "issues" then [ [ payload.dig("repository", "full_name"), "issue", payload.dig("issue", "number") ] ]
+        when "pull_request" then [ [ payload.dig("repository", "full_name"), "pull_request", payload.dig("pull_request", "number") ] ]
+        when "sub_issues" then sub_issue_targets(payload)
+        else []
+        end
+      targets.filter_map { |repo, kind, number| [ Shiplog.config.repository_configured?(repo), kind, number ] if number }
+        .select(&:first).uniq
+    end
+
+    def sub_issue_targets(payload)
+      here = payload.dig("repository", "full_name")
+      if payload["action"].to_s.start_with?("parent_issue")
+        [ [ here, "issue", payload.dig("sub_issue", "number") ],
+          [ payload.dig("parent_issue_repo", "full_name"), "issue", payload.dig("parent_issue", "number") ] ]
+      else
+        [ [ here, "issue", payload.dig("parent_issue", "number") ],
+          [ payload.dig("sub_issue_repo", "full_name"), "issue", payload.dig("sub_issue", "number") ] ]
+      end
+    end
+  end
+end

data/app/frontend/shiplog/admin.css

@@ -0,0 +1,137 @@
+/*
+ * Shiplog admin. Everything lives in the `shiplog` cascade layer and is scoped under .shiplog-admin,
+ * so it neither leaks into nor is unexpectedly overridden by a host admin. Unlayered host CSS wins.
+ *
+ * Inside a host layout the admin inherits the host's text colour and uses surfaces and borders mixed
+ * from currentColor, so it suits light and dark hosts. Only the standalone chrome
+ * (`.shiplog-admin--standalone`), which paints the page background, follows prefers-color-scheme.
+ *
+ * Variables (set them on :root or .shiplog-admin):
+ *   --shiplog-admin-fg, -muted, -bg, -surface, -border, -accent
+ */
+@layer shiplog {
+  /* Host-safe defaults. */
+  .shiplog-admin {
+    --sa-fg: var(--shiplog-admin-fg, currentColor);
+    --sa-muted: var(--shiplog-admin-muted, color-mix(in srgb, currentColor 65%, transparent));
+    --sa-bg: var(--shiplog-admin-bg, color-mix(in srgb, currentColor 6%, transparent));
+    --sa-surface: var(--shiplog-admin-surface, transparent);
+    --sa-border: var(--shiplog-admin-border, color-mix(in srgb, currentColor 22%, transparent));
+    --sa-accent: var(--shiplog-admin-accent, #2f81f7);
+  }
+
+  /* The standalone chrome owns the page background, so it picks its own light and dark palette. */
+  .shiplog-admin.shiplog-admin--standalone {
+    --sa-fg: var(--shiplog-admin-fg, #1f2328);
+    --sa-muted: var(--shiplog-admin-muted, #59636e);
+    --sa-bg: var(--shiplog-admin-bg, #f6f8fa);
+    --sa-surface: var(--shiplog-admin-surface, #ffffff);
+    --sa-border: var(--shiplog-admin-border, #d1d9e0);
+    --sa-accent: var(--shiplog-admin-accent, #0969da);
+  }
+
+  @media (prefers-color-scheme: dark) {
+    .shiplog-admin.shiplog-admin--standalone {
+      --sa-fg: var(--shiplog-admin-fg, #e6edf3);
+      --sa-muted: var(--shiplog-admin-muted, #9198a1);
+      --sa-bg: var(--shiplog-admin-bg, #0d1117);
+      --sa-surface: var(--shiplog-admin-surface, #151b23);
+      --sa-border: var(--shiplog-admin-border, #3d444d);
+      --sa-accent: var(--shiplog-admin-accent, #4493f8);
+    }
+  }
+
+  .shiplog-admin {
+    color: var(--sa-fg);
+    line-height: 1.5;
+  }
+
+  /* Only the engine's own layout paints the page; inside a host layout the host owns background and font. */
+  .shiplog-admin--standalone {
+    background: var(--sa-bg);
+    font-family: system-ui, -apple-system, "Segoe UI", sans-serif;
+    min-height: 100vh;
+  }
+
+  .shiplog-admin a { color: var(--sa-accent); }
+
+  .shiplog-admin .shiplog-admin-nav {
+    background: var(--sa-surface);
+    border-bottom: 1px solid var(--sa-border);
+    padding: 0.75rem 1rem;
+  }
+
+  .shiplog-admin .shiplog-admin-nav--sub { background: none; border-bottom: 0; padding: 0 0 0.75rem; }
+
+  .shiplog-admin .shiplog-admin-nav__list { display: flex; gap: 1.25rem; list-style: none; margin: 0; padding: 0; }
+
+  .shiplog-admin .shiplog-admin__main { margin: 0 auto; max-width: 80rem; padding: 1.5rem 1rem; }
+
+  .shiplog-admin .shiplog-admin__flash { border: 1px solid var(--sa-border); border-radius: 0.375rem; padding: 0.5rem 0.75rem; }
+  .shiplog-admin .shiplog-admin__flash--alert { border-color: #cf222e; }
+
+  .shiplog-admin .shiplog-admin__title { font-size: 1.5rem; margin: 0 0 1rem; }
+  .shiplog-admin .shiplog-admin__muted { color: var(--sa-muted); font-size: 0.875rem; }
+  .shiplog-admin .shiplog-admin__empty { color: var(--sa-muted); }
+
+  .shiplog-admin .shiplog-admin-filters { display: flex; flex-wrap: wrap; gap: 0.5rem 2rem; margin-bottom: 1rem; }
+  .shiplog-admin .shiplog-admin-filters__list { display: flex; gap: 0.75rem; list-style: none; margin: 0; padding: 0; }
+  .shiplog-admin .shiplog-admin-filters__link[aria-current] { color: var(--sa-fg); font-weight: 600; text-decoration: none; }
+
+  .shiplog-admin .shiplog-admin-table { background: var(--sa-surface); border: 1px solid var(--sa-border); border-collapse: collapse; width: 100%; }
+  .shiplog-admin .shiplog-admin-table th,
+  .shiplog-admin .shiplog-admin-table td { border-bottom: 1px solid var(--sa-border); padding: 0.5rem 0.75rem; text-align: left; vertical-align: top; }
+  .shiplog-admin .shiplog-admin-table__actions { display: flex; gap: 0.5rem; }
+  .shiplog-admin .shiplog-admin-table__actions form { margin: 0; }
+
+  .shiplog-admin .shiplog-admin-pagination { display: flex; justify-content: space-between; margin-top: 1rem; }
+  .shiplog-admin .shiplog-admin-pagination__next { margin-left: auto; }
+
+  .shiplog-admin .shiplog-badge {
+    background: var(--sa-bg);
+    border: 1px solid var(--sa-border);
+    border-radius: 1rem;
+    font-size: 0.75rem;
+    padding: 0.0625rem 0.5rem;
+  }
+  .shiplog-admin .shiplog-badge--warning { border-color: #bf8700; color: #9a6700; }
+  .shiplog-admin .shiplog-badge--error { border-color: #cf222e; color: #cf222e; }
+
+  .shiplog-admin .shiplog-button {
+    background: var(--sa-surface);
+    border: 1px solid var(--sa-border);
+    border-radius: 0.375rem;
+    color: var(--sa-fg);
+    cursor: pointer;
+    display: inline-block;
+    font: inherit;
+    padding: 0.25rem 0.75rem;
+    text-decoration: none;
+  }
+  .shiplog-admin .shiplog-button--primary { background: var(--sa-accent); border-color: var(--sa-accent); color: #fff; }
+
+  .shiplog-admin .shiplog-admin-split { display: grid; gap: 1.5rem; grid-template-columns: repeat(auto-fit, minmax(20rem, 1fr)); }
+  .shiplog-admin .shiplog-admin-panel { background: var(--sa-surface); border: 1px solid var(--sa-border); border-radius: 0.5rem; padding: 1rem; }
+  .shiplog-admin .shiplog-admin-panel h2 { font-size: 1.125rem; margin-top: 0; }
+  .shiplog-admin .shiplog-admin-form label { display: block; font-weight: 600; margin-bottom: 0.25rem; }
+  .shiplog-admin .shiplog-admin-form input[type=text],
+  .shiplog-admin .shiplog-admin-form textarea { box-sizing: border-box; font: inherit; width: 100%; }
+  .shiplog-admin .shiplog-admin-actions { border-top: 1px solid var(--sa-border); display: grid; gap: 0.75rem; margin-top: 1rem; padding-top: 1rem; }
+  .shiplog-admin .shiplog-admin-inline-form { display: flex; flex-wrap: wrap; gap: 0.5rem; }
+  .shiplog-admin .shiplog-admin-source { background: var(--sa-bg); overflow-x: auto; padding: 0.75rem; white-space: pre-wrap; word-break: break-word; }
+
+  .shiplog-admin .shiplog-board { display: grid; gap: 1rem; grid-template-columns: repeat(auto-fit, minmax(16rem, 1fr)); }
+  .shiplog-admin .shiplog-board__title { font-size: 1.125rem; margin: 0 0 0.5rem; }
+  .shiplog-admin .shiplog-board__column { display: flex; flex-direction: column; }
+  .shiplog-admin .shiplog-board__column .shiplog-board__cards { flex: 1; }
+  .shiplog-admin .shiplog-board__cards { display: grid; align-content: start; gap: 0.5rem; min-height: 6rem; padding: 0.5rem; background: var(--sa-bg); border: 1px dashed var(--sa-border); border-radius: 0.5rem; }
+  .shiplog-admin .shiplog-card { background: var(--sa-surface); border: 1px solid var(--sa-border); border-radius: 0.375rem; cursor: grab; padding: 0.5rem 0.75rem; }
+  .shiplog-admin .shiplog-card--dragging { opacity: 0.5; }
+  .shiplog-admin .shiplog-card__title { font-size: 0.9375rem; margin: 0 0 0.25rem; }
+  .shiplog-admin .shiplog-card__meta { color: var(--sa-muted); font-size: 0.8125rem; margin: 0 0 0.5rem; }
+  .shiplog-admin .shiplog-card__form { align-items: center; display: flex; gap: 0.375rem; margin-bottom: 0.25rem; }
+  .shiplog-admin .shiplog-card__label { font-size: 0.8125rem; }
+
+  /* The engine layout's own body (not scoped: it is not inside .shiplog-admin). */
+  .shiplog-admin-body { margin: 0; }
+}

data/app/frontend/shiplog/board.js

@@ -0,0 +1,77 @@
+const board = document.querySelector("[data-board-url]")
+
+if (board) {
+  // Host layouts may not render csrf_meta_tags, so the board element carries the token as a fallback.
+  const csrfToken = document.querySelector("meta[name=csrf-token]")?.content ?? board.dataset.csrfToken
+  let dragged = null
+  let origin = null
+  let dropped = false
+
+  // The whole column section (heading included) is a drop target; cards live in its [data-column] list.
+  const listFor = (target) => target.closest?.("section")?.querySelector("[data-column]") ?? null
+
+  const save = async (list, card) => {
+    const issueIds = [...list.querySelectorAll(".shiplog-card")].map((el) => Number(el.dataset.issueId))
+    const response = await fetch(board.dataset.boardUrl, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json", "Accept": "application/json", "X-CSRF-Token": csrfToken },
+      body: JSON.stringify({ column: list.dataset.column, moved_id: Number(card.dataset.issueId), issue_ids: issueIds })
+    })
+    if (!response.ok) return window.location.reload()
+
+    // The server renders the moved card as a reload would (Pinned badge, column select, Unpin).
+    const { card: html } = await response.json()
+    const template = document.createElement("template")
+    template.innerHTML = html.trim()
+    card.replaceWith(template.content.firstElementChild)
+  }
+
+  const cardAfter = (list, y) => {
+    const cards = [...list.querySelectorAll(".shiplog-card:not(.shiplog-card--dragging)")]
+    return cards.find((card) => {
+      const box = card.getBoundingClientRect()
+      return y < box.top + box.height / 2
+    })
+  }
+
+  const restore = () => {
+    const { parent, nextSibling } = origin
+    parent.insertBefore(dragged, nextSibling?.parentNode === parent ? nextSibling : null)
+  }
+
+  board.addEventListener("dragstart", (event) => {
+    const card = event.target.closest?.(".shiplog-card")
+    if (!card) return
+    dragged = card
+    origin = { parent: card.parentNode, nextSibling: card.nextSibling }
+    dropped = false
+    event.dataTransfer.setData("text/plain", card.dataset.issueId)
+    event.dataTransfer.effectAllowed = "move"
+    card.classList.add("shiplog-card--dragging")
+  })
+
+  board.addEventListener("dragend", () => {
+    if (!dragged) return
+    dragged.classList.remove("shiplog-card--dragging")
+    if (!dropped) restore()
+    dragged = null
+    origin = null
+    dropped = false
+  })
+
+  board.addEventListener("dragover", (event) => {
+    const list = listFor(event.target)
+    if (!dragged || !list) return
+    event.preventDefault()
+    event.dataTransfer.dropEffect = "move"
+    list.insertBefore(dragged, cardAfter(list, event.clientY) ?? null)
+  })
+
+  board.addEventListener("drop", (event) => {
+    const list = listFor(event.target)
+    if (!dragged || !list) return
+    event.preventDefault()
+    dropped = true
+    save(list, dragged).catch(() => window.location.reload())
+  })
+}