thredded 0.2.2 → 0.3.0

data/app/models/concerns/thredded/post_common.rb

@@ -1,105 +1,110 @@
+# frozen_string_literal: true
 module Thredded
   module PostCommon
     extend ActiveSupport::Concern
+
+    WHITELIST_TRANSFORMERS = HTML::Pipeline::SanitizationFilter::WHITELIST[:transformers] + [
+      lambda do |env|
+        node = env[:node]
+
+        a_tags = node.css('a')
+        a_tags.each do |a_tag|
+          if a_tag['href'].starts_with? 'http'
+            a_tag['target'] = '_blank'
+            a_tag['rel'] = 'nofollow noopener'
+          end
+        end
+      end
+    ].freeze
+
+    WHITELIST_ELEMENTS = HTML::Pipeline::SanitizationFilter::WHITELIST[:elements] + [
+      'iframe',
+    ].freeze
+
+    WHITELIST = HTML::Pipeline::SanitizationFilter::WHITELIST.deep_merge(
+      elements: WHITELIST_ELEMENTS,
+      transformers: WHITELIST_TRANSFORMERS,
+      attributes: {
+        'a' => %w(href rel),
+        'iframe' => %w(src width height frameborder allowfullscreen sandbox seamless)
+      },
+      add_attributes: {
+        'iframe' => {
+          'seamless' => 'seamless',
+          'sandbox' => 'allow-same-origin allow-forms allow-scripts'
+        }
+      }
+    ).freeze
+
     included do
       paginates_per 50
 
-      belongs_to :user, class_name: Thredded.user_class
       delegate :email, to: :user, prefix: true, allow_nil: true
 
       has_many :post_notifications, as: :post, dependent: :destroy
 
       validates :content, presence: true
 
-      after_create :update_parent_last_user_and_timestamp
+      scope :order_oldest_first, -> { order(id: :asc) }
+
+      after_commit :update_parent_last_user_and_timestamp, on: [:create, :destroy]
       after_commit :notify_at_users, on: [:create, :update]
+    end
 
-      extend ClassMethods
+    def page(per_page: self.class.default_per_page)
+      1 + postable.posts.where('id < ?', id).count / per_page
     end
 
     def avatar_url
       Thredded.avatar_url.call(user)
     end
 
-    def user_anonymous?
-      user.try(:thredded_anonymous?)
-    end
-
     # @param view_context [Object] the context of the rendering view.
     def filtered_content(view_context)
-      pipeline = HTML::Pipeline.new(
-        [
-          html_filter_for_pipeline,
-          HTML::Pipeline::SanitizationFilter,
-          HTML::Pipeline::AtMentionFilter,
-          HTML::Pipeline::EmojiFilter,
-          HTML::Pipeline::AutolinkFilter,
-        ], context_options)
-
+      pipeline = HTML::Pipeline.new(content_pipeline_filters, content_pipeline_options)
       result = pipeline.call(content, view_context: view_context)
       result[:output].to_s.html_safe
     end
 
-    private
+    protected
+
+    # @return [Array<HTML::Pipeline::Filter]>]
+    def content_pipeline_filters
+      [
+        HTML::Pipeline::VimeoFilter,
+        HTML::Pipeline::YoutubeFilter,
+        HTML::Pipeline::BbcodeFilter,
+        HTML::Pipeline::MarkdownFilter,
+        HTML::Pipeline::SanitizationFilter,
+        HTML::Pipeline::AtMentionFilter,
+        HTML::Pipeline::EmojiFilter,
+        HTML::Pipeline::AutolinkFilter,
+      ]
+    end
 
-    def context_options
+    # @return [Hash] options for HTML::Pipeline.new
+    def content_pipeline_options
       {
         asset_root: Rails.application.config.action_controller.asset_host || '',
         post:       self,
-        whitelist:  sanitize_whitelist
+        whitelist:  WHITELIST,
       }
     end
 
-    def sanitize_whitelist
-      HTML::Pipeline::SanitizationFilter::WHITELIST.deep_merge(
-        attributes:   {
-          'code'       => ['class'],
-          'img'        => %w(src class width height),
-          'blockquote' => ['class'],
-        },
-        transformers: [(lambda do |env|
-          node      = env[:node]
-          node_name = env[:node_name]
-
-          return if env[:is_whitelisted] || !node.element?
-          return if node_name != 'iframe'
-          return if (node['src'] =~ %r{\A(https?:)?//(?:www\.)?youtube(?:-nocookie)?\.com/}).nil?
-
-          Sanitize.node!(
-            node,
-            elements:   %w(iframe),
-            attributes: {
-              'iframe' => %w(allowfullscreen frameborder height src width)
-            }
-          )
-
-          { node_whitelist: [node] }
-        end)]
-      )
-    end
-
-    def html_filter_for_pipeline
-      if filter == 'bbcode'
-        HTML::Pipeline::BbcodeFilter
-      else
-        HTML::Pipeline::MarkdownFilter
-      end
-    end
+    private
 
     def update_parent_last_user_and_timestamp
-      return unless postable && user
-
-      postable.update!(last_user: user, updated_at: Time.zone.now)
+      return if postable.destroyed?
+      last_post = if destroyed?
+                    postable.posts.order_oldest_first.select(:user_id, :created_at).last
+                  else
+                    self
+                  end
+      postable.update!(last_user_id: last_post.user_id, updated_at: last_post.created_at)
     end
 
     def notify_at_users
       AtNotifierJob.perform_later(self.class.name, id)
     end
-
-    module ClassMethods
-      def filters
-        %w(bbcode markdown)
-      end
-    end
   end
 end

data/app/models/concerns/thredded/topic_common.rb

@@ -1,16 +1,15 @@
+# frozen_string_literal: true
 module Thredded
   module TopicCommon
     extend ActiveSupport::Concern
     included do
-      paginates_per 50 if self.respond_to?(:paginates_per)
+      paginates_per 50 if respond_to?(:paginates_per)
 
-      belongs_to :user,
-                 class_name: Thredded.user_class
       belongs_to :last_user,
-                 class_name: Thredded.user_class,
+                 class_name:  Thredded.user_class,
                  foreign_key: 'last_user_id'
 
-      scope :order_latest_first, -> { order(updated_at: :desc, id: :desc) }
+      scope :order_recently_updated_first, -> { order(updated_at: :desc, id: :desc) }
       scope :on_page, -> page_num { page(page_num).per(30) }
 
       validates_presence_of :hash_id
@@ -38,9 +37,33 @@ module Thredded
     end
 
     module ClassMethods
-      def decorate
-        all.map do |topic|
-          TopicDecorator.new(topic)
+      # @param user [Thredded.user_class]
+      # @return [ActiveRecord::Relation]
+      def unread(user)
+        topics      = arel_table
+        reads_class = reflect_on_association(:user_read_states).klass
+        reads       = reads_class.arel_table
+        joins(topics.join(reads, Arel::Nodes::OuterJoin)
+                .on(topics[:id].eq(reads[:postable_id]).and(reads[:user_id].eq(user.id))).join_sources)
+          .merge(reads_class.where(reads[:id].eq(nil).or(reads[:read_at].lt(topics[:updated_at]))))
+      end
+
+      # @param user [Thredded.user_class]
+      # @return [Array<[TopicCommon, UserTopicReadStateCommon]>]
+      def with_read_states(user)
+        null_read_state = Thredded::NullUserTopicReadState.new
+        return current_scope.zip([null_read_state]) if user.thredded_anonymous?
+        read_state_by_topic_id =
+          reflect_on_association(:user_read_states).klass
+            .where(user_id: user.id, postable_id: current_scope.map(&:id))
+            .group_by(&:postable_id)
+        current_scope.map do |topic|
+          read_state = read_state_by_topic_id[topic.id]
+          if read_state
+            read_state = read_state[0]
+            read_state.postable = topic
+          end
+          [topic, read_state || null_read_state]
         end
       end
     end

data/app/models/concerns/thredded/user_topic_read_state_common.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+module Thredded
+  module UserTopicReadStateCommon
+    extend ActiveSupport::Concern
+    included do
+      extend ClassMethods
+      validates :user_id, uniqueness: { scope: :postable_id }
+    end
+
+    # @return [Boolean]
+    def read?
+      postable.updated_at <= read_at
+    end
+
+    module ClassMethods
+      # @param user_id [Fixnum]
+      # @param topic_id [Fixnum]
+      # @param post [Thredded::PostCommon]
+      # @param post_page [Fixnum]
+      def touch!(user_id, topic_id, post, post_page)
+        # TODO: Switch to upsert once Travis supports PostgreSQL 9.5.
+        # Travis issue: https://github.com/travis-ci/travis-ci/issues/4264
+        # Upsert gem: https://github.com/seamusabshere/upsert
+        state = where(user_id: user_id, postable_id: topic_id).first_or_initialize
+        fail ArgumentError, "expected post_page >= 1, given #{post_page.inspect}" if post_page < 1
+        return unless !state.read_at? || state.read_at < post.updated_at
+        state.update!(read_at: post.updated_at, page: post_page)
+      end
+    end
+  end
+end

data/app/models/thredded/category.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Thredded
   class Category < ActiveRecord::Base
     extend FriendlyId

data/app/models/thredded/messageboard.rb

@@ -1,50 +1,49 @@
+# frozen_string_literal: true
 module Thredded
   class Messageboard < ActiveRecord::Base
-    FILTERS = %w(markdown bbcode)
-
     extend FriendlyId
-    friendly_id :name, use: :slugged
+    friendly_id :slug_candidates,
+                use:            [:slugged, :reserved],
+                # Avoid route conflicts
+                reserved_words: ::Thredded::FriendlyIdReservedWordsAndPagination.new(
+                  %w(messageboards preferences private-topics autocomplete-users theme-preview)
+                )
 
-    validates :filter, inclusion: { in: FILTERS }, presence: true
     validates :name, uniqueness: true, length: { maximum: 60 }, presence: true
-    validates :slug, exclusion: { in: %w(private-topics) }
     validates :topics_count, numericality: true
 
     has_many :categories, dependent: :destroy
-    has_many :notification_preferences, dependent: :destroy
+    has_many :user_messageboard_preferences, dependent: :destroy
     has_many :posts, dependent: :destroy
-    has_many :topics, dependent: :destroy
-    has_many :user_details, through: :posts
+    has_many :topics, dependent: :destroy, inverse_of: :messageboard
+    has_one :latest_topic, -> { order_recently_updated_first },
+            class_name: 'Thredded::Topic'
 
+    has_many :user_details, through: :posts
     has_many :messageboard_users,
-             class_name: 'Thredded::MessageboardUser',
-             inverse_of: :messageboard,
+             inverse_of:  :messageboard,
              foreign_key: :thredded_messageboard_id
     has_many :recently_active_user_details,
              -> { merge(Thredded::MessageboardUser.recently_active) },
              class_name: 'Thredded::UserDetail',
-             through: :messageboard_users,
-             source: :user_detail
+             through:    :messageboard_users,
+             source:     :user_detail
     has_many :recently_active_users,
              class_name: Thredded.user_class,
-             through: :recently_active_user_details,
-             source: :user
+             through:    :recently_active_user_details,
+             source:     :user
 
     default_scope { where(closed: false).order(topics_count: :desc) }
 
-    def self.decorate
-      all.map do |messageboard|
-        MessageboardDecorator.new(messageboard)
-      end
-    end
-
-    def preferences_for(user)
-      @preferences_for ||=
-        notification_preferences.where(user_id: user).first_or_create
+    def latest_user
+      latest_topic.last_user
     end
 
-    def decorate
-      MessageboardDecorator.new(self)
+    def slug_candidates
+      [
+        :name,
+        [:name, '-board']
+      ]
     end
   end
 end

data/app/models/thredded/messageboard_user.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Thredded
   # The state of a user with regards to a messageboard, such as the last time the user was active (visited)
   # the messageboard.

data/app/models/thredded/null_preference.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Thredded
   class NullPreference
     def notify_on_mention

data/app/models/thredded/null_user.rb

@@ -1,9 +1,4 @@
-require_relative './user_permissions/read/all'
-require_relative './user_permissions/write/none'
-require_relative './user_permissions/message/readers_of_writeable_boards'
-require_relative './user_permissions/moderate/none'
-require_relative './user_permissions/admin/none'
-
+# frozen_string_literal: true
 module Thredded
   class NullUser
     include ::Thredded::UserPermissions::Read::All

data/app/models/thredded/null_user_topic_read_state.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+module Thredded
+  class NullUserTopicReadState
+    def page
+      1
+    end
+
+    def read?
+      false
+    end
+  end
+end

data/app/models/thredded/post.rb

@@ -1,7 +1,11 @@
+# frozen_string_literal: true
 module Thredded
   class Post < ActiveRecord::Base
     include PostCommon
 
+    belongs_to :user,
+               class_name: Thredded.user_class,
+               inverse_of: :thredded_posts
     belongs_to :messageboard,
                counter_cache: true
     belongs_to :postable,
@@ -15,7 +19,6 @@ module Thredded
                counter_cache: true
 
     validates :messageboard_id, presence: true
-    before_validation :set_filter_from_messageboard
 
     def private_topic_post?
       false
@@ -23,15 +26,9 @@ module Thredded
 
     # @return [ActiveRecord::Relation<Thredded.user_class>] users from the list of user names that can read this post.
     def readers_from_user_names(user_names)
-      DbTextSearch::CaseInsensitiveEq
+      DbTextSearch::CaseInsensitive
         .new(Thredded.user_class.thredded_messageboards_readers([messageboard]), Thredded.user_name_column)
-        .find(user_names)
-    end
-
-    private
-
-    def set_filter_from_messageboard
-      self.filter = messageboard.filter if messageboard
+        .in(user_names)
     end
   end
 end

data/app/models/thredded/post_notification.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module Thredded
   # Keeps track of post notifications that have been sent already.
   class PostNotification < ActiveRecord::Base

data/app/models/thredded/private_post.rb

@@ -1,7 +1,11 @@
+# frozen_string_literal: true
 module Thredded
   class PrivatePost < ActiveRecord::Base
     include PostCommon
 
+    belongs_to :user,
+               class_name: Thredded.user_class,
+               inverse_of: :thredded_private_posts
     belongs_to :postable,
                class_name:    'Thredded::PrivateTopic',
                inverse_of:    :posts,
@@ -17,9 +21,9 @@ module Thredded
 
     # @return [ActiveRecord::Relation<Thredded.user_class>] users from the list of user names that can read this post.
     def readers_from_user_names(user_names)
-      DbTextSearch::CaseInsensitiveEq
+      DbTextSearch::CaseInsensitive
         .new(postable.users, Thredded.user_name_column)
-        .find(user_names)
+        .in(user_names)
     end
   end
 end