spontaneous 0.2.0.beta1 → 0.2.0.beta2

data/lib/spontaneous/rack/asset_server.rb

@@ -0,0 +1,20 @@
+module Spontaneous::Rack
+  # Sprockets (2.9.0) doesn't include charset information in the content-type
+  # header. This wrapper class proxies all requests to a Sprockets enviroment
+  # and adds in a charset setting to the content-type header of all responses
+  class AssetServer
+    def initialize(environment, charset = "UTF-8")
+      @environment, @charset = environment, charset
+    end
+
+    def call(env)
+      force_encoding(*@environment.call(env))
+    end
+
+    def force_encoding(status, headers, body)
+      content_type = headers["Content-Type"]
+      headers.update("Content-Type" => "#{content_type}; charset=#{@charset}")
+      [status, headers, body]
+    end
+  end
+end

data/lib/spontaneous/rack/back/alias.rb

@@ -0,0 +1,46 @@
+module Spontaneous::Rack::Back
+  class Alias < Base
+    get '/:schema_id/:id/:box_id' do
+      klass = content_model.schema.to_class(params[:schema_id])
+      if klass.alias?
+        content_for_request do |content, box|
+          options = {}
+          if (query = params[:query])
+            options[:search] = Regexp.new(query, Regexp::IGNORECASE)
+          end
+          targets = klass.targets(content, box, options).map { |t|
+            { :id => t.id,
+              :title => t.alias_title,
+              :icon => t.exported_alias_icon }
+          }
+          json({
+            :pages => 1,
+            :total => targets.length,
+            :page => 1,
+            :targets => targets
+          })
+        end
+      end
+    end
+
+    post '/:id/:box_id' do
+      content_for_request(true) do |content, box|
+        type = content_model.schema.to_class(params[:alias_id])
+        position = (params[:position] || 0).to_i
+        if box.writable?(user, type)
+          instance = type.for_target(params[:target_id])
+          if instance
+            box.insert(position, instance)
+            content.save
+            json({
+              :position => position,
+              :entry => instance.entry.export(user)
+            })
+          end
+        else
+          forbidden!
+        end
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/application_assets.rb

@@ -0,0 +1,28 @@
+require 'sprockets'
+
+module Spontaneous::Rack::Back
+  class ApplicationAssets < Base
+    def initialize(app, charset = "UTF-8")
+      css, js = %w(css js).map { |d| build_asset_handler(d, charset) }
+      assets = Spontaneous::Rack::CacheableFile.new(Spontaneous.root / "public/@spontaneous/assets")
+      @app = ::Rack::Builder.app do
+        use Spontaneous::Rack::Static, :root => Spontaneous.application_dir, :urls => %W(/static)
+        map("/assets") { run assets }
+        map("/css")    { run css }
+        map("/js")     { run js }
+        run app
+      end
+    end
+
+    def call(env)
+      @app.call(env)
+    end
+
+    def build_asset_handler(dir, charset)
+      environment = ::Sprockets::Environment.new(Spontaneous.application_dir ) do |env|
+        env.append_path("#{dir}")
+      end
+      Spontaneous::Rack::AssetServer.new(environment, charset)
+    end
+  end
+end

data/lib/spontaneous/rack/back/base.rb

@@ -0,0 +1,34 @@
+module Spontaneous::Rack
+  module Back
+    class Base < ServerBase
+      helpers  Helpers
+
+      set :views, Proc.new { Spontaneous.application_dir + '/views' }
+
+      def content_model
+        Spontaneous::Content
+      end
+
+      def update_fields(model, field_data)
+        return unless field_data
+        Spontaneous::Field.update_asynchronously(model, field_data, user)
+        json(model)
+      end
+
+      def content_for_request(lock = false)
+        content_model.db.transaction do
+          dataset = lock ? content_model.for_update : content_model
+          content = dataset.get(params[:id])
+          halt 404 if content.nil?
+          content.current_editor = user
+          if box_id = content_model.schema.uids[params[:box_id]]
+            box = content.boxes.detect { |b| b.schema_id == box_id }
+            yield(content, box)
+          else
+            yield(content)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/changes.rb

@@ -0,0 +1,19 @@
+module Spontaneous::Rack::Back
+  class Changes < Base
+    before do
+      forbidden! unless user.level.can_publish?
+    end
+
+    get '/?' do
+      json(Spontaneous::Change)
+    end
+
+    post '/?' do
+      ids = params[:page_ids]
+      halt 400 if ids.blank? || ids.empty?
+      pages = ids.map(&:to_i)
+      Spontaneous::Site.publish_pages(pages)
+      json({})
+    end
+  end
+end

data/lib/spontaneous/rack/back/content.rb

@@ -0,0 +1,54 @@
+module Spontaneous::Rack::Back
+  class Content < Base
+    put '/:id/?:box_id?' do
+      content_for_request(true) do |content, box|
+        target = content
+        if box
+          forbidden! unless box.writable?(user)
+          target = box
+        end
+        update_fields(target, params[:field])
+      end
+    end
+
+    post '/:id/:box_id/:type_name' do
+      content_for_request(true) do |content, box|
+        position = (params[:position] || 0).to_i
+        type = content_model.schema.to_class(params[:type_name])#.constantize
+
+        forbidden! unless box.writable?(user, type)
+        instance = type.new(:created_by => user)
+        box.insert(position, instance)
+        content.save
+        json({
+          :position => position,
+          :entry => instance.entry.export(user)
+        })
+      end
+    end
+
+    delete '/:id' do
+      content_for_request(true) do |content|
+        forbidden! unless content.box.writable?(user)
+        content.destroy
+        json({})
+      end
+    end
+
+    patch '/:id/toggle' do
+      content_for_request(true) do |content|
+        forbidden! unless content.box && content.box.writable?(user)
+        content.toggle_visibility!
+        json({:id => content.id, :hidden => (content.hidden? ? true : false) })
+      end
+    end
+
+    patch '/:id/position/:position' do
+      content_for_request(true) do |content|
+        forbidden! unless content.box.writable?(user)
+        content.update_position(params[:position].to_i)
+        json( {:message => 'OK'} )
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/events.rb

@@ -0,0 +1,38 @@
+require 'spontaneous/simultaneous'
+
+module Spontaneous::Rack::Back
+  class Events < Base
+    def self.messenger
+      @messenger ||= build_messenger
+    end
+
+    def self.build_messenger
+      messenger = ::Spontaneous::Rack::EventSource.new
+      # Find a way to move this into a more de-centralised place
+      # at some point we are going to want to have some configurable, extendable
+      # list of event handlers
+      begin
+        ::Simultaneous.on_event("publish_progress") { |event|
+          messenger.deliver_event(event)
+        }
+        ::Simultaneous.on_event("page_lock_status") { |event|
+          messenger.deliver_event(event)
+        }
+      rescue => e
+        logger.error "Error while connecting to Simultaneous server"
+        logger.error e.inspect
+      end
+      messenger
+    end
+
+    get '/?', :provides => 'text/event-stream' do
+      headers 'X-Accel-Buffering' =>  'no'
+      stream(:keep_open) do |out|
+        messenger = self.class.messenger
+        out.errback  { messenger.delete(out) }
+        out.callback { messenger.delete(out) }
+        messenger << out
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/field.rb

@@ -0,0 +1,37 @@
+module Spontaneous::Rack::Back
+  class Field < Base
+    # Should be a GET as it changes no state but the request can need a lot
+    # of data which is best done outside of the query string
+    post '/conflicts/:id/?:box_id?' do
+      content_for_request(true) do |content, box|
+        generate_conflict_list(box || content)
+      end
+    end
+
+    get '/options/:field_sid/:id/?:box_id?' do
+      content_for_request do |content, box|
+        field = (box || content).fields.sid(params[:field_sid])
+        json(field.option_list)
+      end
+    end
+
+    def generate_conflict_list(content)
+      field_versions = params[:fields]
+      conflicts = []
+      field_versions.each do |schema_id, version|
+        field = content.fields.sid(schema_id)
+        if field.matches_version?(version.to_i)
+          conflicts << field
+        end
+      end
+      if conflicts.empty?
+        200
+      else
+        errors = conflicts.map  do |field|
+          [field.schema_id.to_s, [field.version, field.conflicted_value]]
+        end
+        [409, json(Hash[errors])]
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/file.rb

@@ -0,0 +1,118 @@
+module Spontaneous::Rack::Back
+  module File
+    class Simple < Base
+      put '/:id/?:box_id?' do
+        content_for_request(true) do |content, box|
+          target = box || content
+          file = params[:file]
+          field = target.fields.sid(params['field'])
+          forbidden! unless target.field_writable?(user, field.name)
+          # version = params[:version].to_i
+          # if version == field.version
+          Spontaneous::Field.set_asynchronously(field, file, user)
+          json(field.export(user))
+          # else
+          #   errors = [[field.schema_id.to_s, [field.version, field.conflicted_value]]]
+          #   [409, json(Hash[errors])]
+          # end
+        end
+      end
+
+      post '/:id/:box_id' do
+        content_for_request(true) do |content, box|
+          file = params['file']
+          type = box.type_for_mime_type(file[:type])
+          if type
+            forbidden! unless box.writable?(user, type)
+            position = 0
+            instance = type.new
+            box.insert(position, instance)
+            field = instance.field_for_mime_type(file[:type])
+            Spontaneous::Field.set_asynchronously(field, file, user)
+            content.save
+            json({
+              :position => position,
+              :entry => instance.entry.export(user)
+            })
+          end
+        end
+      end
+    end
+
+    class Sharded < Base
+      get '/:sha1' do
+        shard = Spontaneous.shard_path(params[:sha1])
+        if ::File.file?(shard)
+          # touch the shard file so that clean up routines can delete unmodified files
+          # without affecting any uploads in progresss
+          FileUtils.touch(shard)
+          200
+        else
+          404
+        end
+      end
+
+      post '/:sha1' do
+        file = params[:file]
+        uploaded_hash = Spontaneous::Media.digest(file[:tempfile].path)
+        if uploaded_hash == params[:sha1] # rand(10000) % 2 == 0 # use to test shard re-uploading
+          shard_path = Spontaneous.shard_path(params[:sha1])
+          FileUtils.mv(file[:tempfile].path, shard_path)
+          200
+        else
+          ::Rack::Utils.status_code(:conflict) #409
+        end
+      end
+
+      put '/:id/?:box_id?' do
+        content_for_request(true) do |content, box|
+          target = box || content
+          replace_with_shard(target, content.id)
+        end
+      end
+
+      def replace_with_shard(target, target_id)
+        field = target.fields.sid(params[:field])
+        forbidden! unless target.field_writable?(user, field.name)
+        # version = params[:version].to_i
+        # if version == field.version
+        Spontaneous::Media.combine_shards(params[:shards]) do |combined|
+          Spontaneous::Field.set_asynchronously(field, {
+            :filename => params[:filename],
+            :tempfile => combined
+          }, user)
+        end
+        json(field.export(user))
+      end
+
+      # TODO: remove duplication here
+      post '/:id/:box_id' do
+        content_for_request(true) do |content, box|
+          type = box.type_for_mime_type(params[:mime_type])
+          if type
+            forbidden! unless box.writable?(user, type)
+            position = 0
+            instance = type.new
+            box.insert(position, instance)
+            field = instance.field_for_mime_type(params[:mime_type])
+            Spontaneous::Media.combine_shards(params[:shards]) do |combined|
+              Spontaneous::Field.set_asynchronously(field, {
+                :filename => params[:filename],
+                :tempfile => combined
+              }, user)
+              content.save
+              # field.value = {
+              #   :filename => params[:filename],
+              #   :tempfile => combined
+              # }
+            end
+            json({
+              :position => position,
+              :entry => instance.entry.export(user)
+            })
+          end
+        end
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/helpers.rb

@@ -0,0 +1,71 @@
+module Spontaneous::Rack::Back
+  module TemplateHelpers
+    include Spontaneous::Rack::Constants
+
+    def application_assets
+      @application_assets_compiler ||= Spontaneous::Asset::AppCompiler.new(Spontaneous.gem_dir, Spontaneous.root)
+    end
+
+    def style_url(style)
+      asset_url(style, "css")
+    end
+
+    def script_url(script)
+      asset_url(script, "js")
+    end
+
+    def asset_url(file, type)
+      file = "#{file}.#{type}" unless file =~ /\.#{type}$/
+
+
+      if (compiled_asset = application_assets.manifest.assets[file])
+        return "#{NAMESPACE}/assets/#{compiled_asset}"
+      end
+      # TODO: use the sprockets environment to append a modification time to the non-compiled URL
+      "#{NAMESPACE}/#{type}/#{file}"
+    end
+
+    def script_list(scripts)
+      scripts.map do |script|
+        script = "#{script}.js" unless script =~ /\.js$/
+        src = script_url(script)
+        size = 0
+        if (asset = application_assets.manifest.files[::File.basename(src)])
+          size = asset["size"]
+        else
+          src = "#{NAMESPACE}/js/#{script}"
+          path = Spontaneous.application_dir("/js/#{script}")
+          size = ::File.size(path)
+        end
+        [src, size]
+      end.to_json
+    end
+  end
+
+  module Helpers
+    include Spontaneous::Rack::Constants
+
+    def json(response)
+      content_type 'application/json', :charset => 'utf-8'
+      response.serialise_http(user)
+    end
+
+
+    def forbidden!
+      halt 403#, "You do not have the necessary permissions to update the '#{name}' field"
+    end
+
+
+    def api_key
+      request.cookies[AUTH_COOKIE]
+    end
+
+    def user
+      env[ACTIVE_USER]
+    end
+
+    def show_login_page(locals = {})
+      halt(401, erb(:login, :views => Spontaneous.application_dir('/views'), :locals => locals))
+    end
+  end
+end

data/lib/spontaneous/rack/back/index.rb

@@ -0,0 +1,16 @@
+module Spontaneous::Rack::Back
+  class Index < Base
+    include TemplateHelpers
+
+    # Matches either:
+    #   /@spontaneous
+    #   /@spontaneous/
+    #   /@spontaneous/xxx/edit
+    #   /@spontaneous/xxx/preview
+    #
+    # where xxx is a numeric id
+    get %r{\A(/?|/(\d+/?.*)?)\z} do
+      erb :index
+    end
+  end
+end

data/lib/spontaneous/rack/back/login.rb

@@ -0,0 +1,47 @@
+module Spontaneous::Rack::Back
+  class Login < Base
+    include TemplateHelpers
+
+    def set_authentication_cookie(key)
+      response.set_cookie(AUTH_COOKIE, {
+        :value => key.key_id,
+        :path => '/',
+        :secure => request.ssl?,
+        :httponly => true,
+        :expires => (Time.now + SESSION_LIFETIME)
+      })
+    end
+
+    def unset_authentication_cookie
+      response.delete_cookie(AUTH_COOKIE, {
+        :path => '/',
+        :secure => request.ssl?,
+        :httponly => true
+      })
+    end
+
+    post "/login" do
+      login = params[:user][:login]
+      password = params[:user][:password]
+      origin = "#{NAMESPACE}#{params[:origin]}"
+      if key = Spontaneous::Permissions::User.authenticate(login, password, env["REMOTE_ADDR"])
+        set_authentication_cookie(key)
+        if request.xhr?
+          json({
+            :key => key.key_id,
+            :redirect => origin
+          })
+        else
+          redirect origin, 302
+        end
+      else
+        show_login_page( :login => login, :failed => true )
+      end
+    end
+
+    delete "/logout" do
+      unset_authentication_cookie
+      401
+    end
+  end
+end

data/lib/spontaneous/rack/back/map.rb

@@ -0,0 +1,24 @@
+module Spontaneous::Rack::Back
+  class Map < Base
+    get '/?:id?' do
+      last_modified(Spontaneous::Site.modified_at)
+      map = Spontaneous::Site.map(params[:id])
+      if map
+        json(map)
+      else
+        404
+      end
+    end
+
+    get '/path*' do
+      last_modified(Spontaneous::Site.modified_at)
+      if content_model::Page.count == 0
+        406
+      else
+        path = params[:splat].first
+        page = Spontaneous::Site[path]
+        json Spontaneous::Site.map(page.id)
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/page.rb

@@ -0,0 +1,46 @@
+module Spontaneous::Rack::Back
+  class Page < Base
+    get '/:id' do
+      content_for_request { |content| json(content)}
+    end
+
+    put '/:id/slug' do
+      content_for_request(true) do |content|
+        if params[:slug].nil? or params[:slug].empty?
+          406 # Not Acceptable
+        else
+          content.slug = params[:slug]
+          if content.siblings.detect { |s| s.slug == content.slug }
+            409 # Conflict
+          else
+            content.save
+            json({:path => content.path, :slug => content.slug })
+          end
+        end
+      end
+    end
+
+    get '/:id/slug/unavailable' do
+      content_for_request do |content|
+        json(content.siblings.map { |c| c.slug })
+      end
+    end
+
+    put '/:id/slug/sync' do
+      content_for_request do |page|
+        page.sync_slug_to_title
+        page.save
+        json({:path => page.path, :slug => page.slug })
+      end
+    end
+
+    put '/:id/uid' do
+      forbidden! unless user.developer?
+      content_for_request(true) do |content|
+        content.uid = params[:uid]
+        content.save
+        json({:uid => content.uid })
+      end
+    end
+  end
+end

data/lib/spontaneous/rack/back/preview.rb

@@ -0,0 +1,43 @@
+module Spontaneous::Rack::Back
+  class Preview < Base
+    include Spontaneous::Rack::Public
+
+
+    # In preview mode we want to find pages even if they're
+    # invisible.
+    def find_page_by_path(path)
+      Spontaneous::Content.scope do
+        Spontaneous::Site.by_path(path)
+      end
+    end
+
+    # Redirect to the edit UI if a preview page is being accessed directly
+    def ensure_edit_preview(path)
+      referer = env['HTTP_REFERER']
+      return true if Spontaneous.development? || referer || params.key?('preview')
+      home = find_page_by_path(path)
+      redirect "#{NAMESPACE}/#{home.id}/preview"
+      false
+    end
+
+    # Forward all GETs to the page resolution method
+    get '*' do
+      path = params[:splat][0]
+      ensure_edit_preview(path) && render_path(path)
+    end
+
+    # Forward all POSTs to the page resolution method
+    post '*' do
+      render_path(params[:splat][0])
+    end
+
+    # Override the S::Rack::Public method to add in some cache-busting headers
+    def render_page(page, format = :html, local_params = {})
+      now = Time.now.to_formatted_s(:rfc822)
+      response.headers[HTTP_EXPIRES] = now
+      response.headers[HTTP_LAST_MODIFIED] = now
+      response.headers[HTTP_CACHE_CONTROL] = HTTP_NO_CACHE
+      super
+    end
+  end # Preview
+end

data/lib/spontaneous/rack/back/schema.rb

@@ -0,0 +1,30 @@
+module Spontaneous::Rack::Back
+  class Schema < Base
+    # Use the CSRF verification step separately from the main app
+    # because it conflicts with the Index application:
+    # The index application needs to load without CSRF validation
+    # and the Schema app needs CSRF validation
+    # but the Schema app has be before Index in the stack
+    use Spontaneous::Rack::Middleware::CSRF::Verification
+
+    def schema
+      Spontaneous.schema
+    end
+
+    post "/delete" do
+      begin
+        schema.apply_fix(:delete, params[:uid])
+      rescue Spot::SchemaModificationError # ignore remaining errors - they will be fixed later
+      end
+      redirect(params[:origin])
+    end
+
+    post "/rename" do
+      begin
+        schema.apply_fix(:rename, params[:uid], params[:ref])
+      rescue Spot::SchemaModificationError => e # ignore remaining errors - they will be fixed later
+      end
+      redirect(params[:origin])
+    end
+  end
+end