thredded 0.4.0 → 0.5.0

data/app/helpers/thredded/urls_helper.rb

@@ -40,18 +40,20 @@ module Thredded
     end
 
     # @param post [Post, PrivatePost]
+    # @param user [Thredded.user_class] the current user
     # @return [String] URL of the topic page with the post anchor.
-    def post_url(post, params = {})
+    def post_url(post, user:, **params)
       params = params.dup
       params[:anchor] ||= ActionView::RecordIdentifier.dom_id(post)
-      params[:page] ||= post.page
+      params[:page] ||= post.private_topic_post? ? post.page : post.page(user: user)
       topic_url(post.postable, params)
     end
 
     # @param post [Post, PrivatePost]
+    # @param user [Thredded.user_class] the current user
     # @return [String] path to the topic page with the post anchor.
-    def post_path(post, params = {})
-      post_url(post, params.merge(only_path: true))
+    def post_path(post, user:, **params)
+      post_url(post, params.merge(user: user, only_path: true))
     end
 
     # @param post [Post, PrivatePost]
@@ -65,7 +67,7 @@ module Thredded
     end
 
     # @param post [Post, PrivatePost]
-    # @return [String] path to the DELETE PATCH PUT POST endpoint.
+    # @return [String] path to the DELETE endpoint.
     def delete_post_path(post)
       if post.private_topic_post?
         private_topic_private_post_path(post.postable, post)

data/app/jobs/thredded/auto_follow_and_notify_job.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+module Thredded
+  class AutoFollowAndNotifyJob < ::ActiveJob::Base
+    queue_as :default
+
+    def perform(post_id)
+      post = Post.find(post_id)
+
+      AutofollowMentionedUsers.new(post).run
+      NotifyFollowingUsers.new(post).run
+    end
+  end
+end

data/app/jobs/thredded/notify_private_topic_users_job.rb

@@ -3,10 +3,9 @@ module Thredded
   class NotifyPrivateTopicUsersJob < ::ActiveJob::Base
     queue_as :default
 
-    def perform(private_topic_id)
-      private_topic = Thredded::PrivateTopic.find(private_topic_id)
-
-      NotifyPrivateTopicUsers.new(private_topic).run
+    def perform(private_post_id)
+      private_post = Thredded::PrivatePost.find(private_post_id)
+      NotifyPrivateTopicUsers.new(private_post).run
     end
   end
 end

data/app/mailer_previews/thredded/post_mailer_preview.rb

@@ -2,8 +2,8 @@
 module Thredded
   # Previews for the PostMailer
   class PostMailerPreview < BaseMailerPreview
-    def at_notification
-      PostMailer.at_notification(
+    def post_notification
+      PostMailer.post_notification(
         mock_post(content: mock_content(mention_users: %w(glebm joel))),
         %w(glebm@test.com joel@test.com)
       )

data/app/mailers/thredded/post_mailer.rb

@@ -2,10 +2,10 @@
 require_dependency 'thredded/topic_email_view'
 module Thredded
   class PostMailer < Thredded::BaseMailer
-    def at_notification(post_id, emails)
+    def post_notification(post_id, emails)
       @post                = find_record Post, post_id
       email_details        = TopicEmailView.new(@post.postable)
-      headers['X-SMTPAPI'] = email_details.smtp_api_tag('at_notification')
+      headers['X-SMTPAPI'] = email_details.smtp_api_tag('post_notification')
 
       mail from:     email_details.no_reply,
            to:       email_details.no_reply,

data/app/models/concerns/thredded/content_moderation_state.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+module Thredded
+  # Moderation state of a piece of content, such as a Topic or a Post.
+  # Requires an integer moderation_state column, a user_id column, and a user_detail association on the including class.
+  # @api private
+  module ContentModerationState
+    extend ActiveSupport::Concern
+    include ModerationState
+
+    included do
+      before_validation :set_default_moderation_state, on: :create
+
+      scope :moderation_state_visible_to_user, (lambda do |user|
+        # @type [Arel::Table]
+        table = arel_table
+        # @type [Arel::Nodes::Node]
+        visible_to_all =
+          if Thredded.content_visible_while_pending_moderation
+            table[:moderation_state].not_eq(moderation_states[:blocked])
+          else
+            table[:moderation_state].eq(moderation_states[:approved])
+          end
+        where(
+          if user && !user.thredded_anonymous?
+            visible_to_all.or(table[:user_id].eq(user.id))
+          else
+            visible_to_all
+          end
+        )
+      end)
+    end
+
+    # Whether this is visible to anyone based on the moderation state.
+    def moderation_state_visible_to_all?
+      if Thredded.content_visible_while_pending_moderation
+        !blocked?
+      else
+        approved?
+      end
+    end
+
+    # Whether this is visible to the given user based on the moderation state.
+    def moderation_state_visible_to_user?(user)
+      moderation_state_visible_to_all? || (!user.thredded_anonymous? && user_id == user.id)
+    end
+
+    private
+
+    def set_default_moderation_state
+      self.moderation_state ||= user_detail.moderation_state
+    end
+  end
+end

data/app/models/concerns/thredded/moderation_state.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+module Thredded
+  # Defines a moderation_state enum
+  # Requires an integer moderation_state column on the including class.
+  module ModerationState
+    extend ActiveSupport::Concern
+
+    included do
+      enum moderation_state: %i(pending_moderation approved blocked)
+      validates :moderation_state, presence: true
+    end
+  end
+end

data/app/models/concerns/thredded/post_common.rb

@@ -1,42 +1,9 @@
 # frozen_string_literal: true
+require_dependency 'thredded/content_formatter'
 module Thredded
   module PostCommon
     extend ActiveSupport::Concern
 
-    WHITELIST_TRANSFORMERS = HTML::Pipeline::SanitizationFilter::WHITELIST[:transformers] + [
-      lambda do |env|
-        node = env[:node]
-
-        a_tags = node.css('a')
-        a_tags.each do |a_tag|
-          if a_tag['href'].starts_with? 'http'
-            a_tag['target'] = '_blank'
-            a_tag['rel'] = 'nofollow noopener'
-          end
-        end
-      end
-    ].freeze
-
-    WHITELIST_ELEMENTS = HTML::Pipeline::SanitizationFilter::WHITELIST[:elements] + %w(
-      iframe span
-    ).freeze
-
-    WHITELIST = HTML::Pipeline::SanitizationFilter::WHITELIST.deep_merge(
-      elements: WHITELIST_ELEMENTS,
-      transformers: WHITELIST_TRANSFORMERS,
-      attributes: {
-        'a' => %w(href rel),
-        'iframe' => %w(src width height frameborder allowfullscreen sandbox seamless),
-        'span' => %w(class),
-      },
-      add_attributes: {
-        'iframe' => {
-          'seamless' => 'seamless',
-          'sandbox' => 'allow-forms allow-scripts',
-        }
-      }
-    ).freeze
-
     included do
       paginates_per 50
 
@@ -49,11 +16,6 @@ module Thredded
       scope :order_oldest_first, -> { order(id: :asc) }
 
       after_commit :update_parent_last_user_and_timestamp, on: [:create, :destroy]
-      after_commit :notify_at_users, on: [:create, :update]
-    end
-
-    def page(per_page: self.class.default_per_page)
-      1 + postable.posts.where('id < ?', id).count / per_page
     end
 
     def avatar_url
@@ -61,35 +23,12 @@ module Thredded
     end
 
     # @param view_context [Object] the context of the rendering view.
+    # @return [String] formatted and sanitized html-safe post content.
     def filtered_content(view_context)
-      pipeline = HTML::Pipeline.new(content_pipeline_filters, content_pipeline_options)
-      result = pipeline.call(content, view_context: view_context)
-      result[:output].to_s.html_safe
-    end
-
-    protected
-
-    # @return [Array<HTML::Pipeline::Filter]>]
-    def content_pipeline_filters
-      [
-        HTML::Pipeline::VimeoFilter,
-        HTML::Pipeline::YoutubeFilter,
-        HTML::Pipeline::BbcodeFilter,
-        HTML::Pipeline::MarkdownFilter,
-        HTML::Pipeline::SanitizationFilter,
-        HTML::Pipeline::AtMentionFilter,
-        HTML::Pipeline::EmojiFilter,
-        HTML::Pipeline::AutolinkFilter,
-      ]
-    end
-
-    # @return [Hash] options for HTML::Pipeline.new
-    def content_pipeline_options
-      {
-        asset_root: Rails.application.config.action_controller.asset_host || '',
-        post:       self,
-        whitelist:  WHITELIST,
-      }
+      Thredded::ContentFormatter.new(
+        view_context,
+        users_provider: -> (names) { readers_from_user_names(names) }
+      ).format_content(content)
     end
 
     private
@@ -103,9 +42,5 @@ module Thredded
                   end
       postable.update!(last_user_id: last_post.user_id, updated_at: last_post.created_at)
     end
-
-    def notify_at_users
-      AtNotifierJob.perform_later(self.class.name, id)
-    end
   end
 end

data/app/models/concerns/thredded/topic_common.rb

@@ -47,24 +47,39 @@ module Thredded
           .merge(reads_class.where(reads[:id].eq(nil).or(reads[:read_at].lt(topics[:updated_at]))))
       end
 
+      private
+
+      # @param user [Thredded.user_class]
+      # @return [ByPostableLookup]
+      def read_states_by_postable_hash(user)
+        read_states = reflect_on_association(:user_read_states).klass
+          .where(user_id: user.id, postable_id: current_scope.map(&:id))
+        Thredded::TopicCommon::CachingHash.from_relation(read_states)
+      end
+
+      public
+
       # @param user [Thredded.user_class]
       # @return [Array<[TopicCommon, UserTopicReadStateCommon]>]
       def with_read_states(user)
         null_read_state = Thredded::NullUserTopicReadState.new
         return current_scope.zip([null_read_state]) if user.thredded_anonymous?
-        read_state_by_topic_id =
-          reflect_on_association(:user_read_states).klass
-            .where(user_id: user.id, postable_id: current_scope.map(&:id))
-            .group_by(&:postable_id)
-        current_scope.map do |topic|
-          read_state = read_state_by_topic_id[topic.id]
-          if read_state
-            read_state = read_state[0]
-            read_state.postable = topic
-          end
-          [topic, read_state || null_read_state]
+        read_states_by_postable = read_states_by_postable_hash(user)
+        current_scope.map do |postable|
+          [postable, read_states_by_postable[postable] || null_read_state]
         end
       end
     end
+
+    class CachingHash < Hash
+      def self.from_relation(postable_relation)
+        self[postable_relation.map { |related| [related.postable_id, related] }]
+      end
+
+      # lookup related item by postable and set the inverse lookup
+      def [](postable)
+        super(postable.id).tap { |related| related.postable = postable if related }
+      end
+    end
   end
 end

data/app/models/concerns/thredded/user_topic_read_state_common.rb

@@ -26,6 +26,10 @@ module Thredded
         return unless !state.read_at? || state.read_at < post.updated_at
         state.update!(read_at: post.updated_at, page: post_page)
       end
+
+      def read_on_first_post!(user, topic)
+        create!(user: user, postable: topic, read_at: Time.zone.now, page: 1)
+      end
     end
   end
 end

data/app/models/thredded/messageboard.rb

@@ -47,6 +47,8 @@ module Thredded
                foreign_key: :messageboard_group_id,
                class_name: 'Thredded::MessageboardGroup'
 
+    has_many :post_moderation_records, inverse_of: :messageboard, dependent: :delete_all
+
     default_scope { where(closed: false).order(topics_count: :desc) }
 
     scope :top_level_messageboards, -> { where(group: nil) }

data/app/models/thredded/post.rb

@@ -2,6 +2,7 @@
 module Thredded
   class Post < ActiveRecord::Base
     include PostCommon
+    include ContentModerationState
 
     belongs_to :user,
                class_name: Thredded.user_class,
@@ -17,18 +18,41 @@ module Thredded
                primary_key:   :user_id,
                foreign_key:   :user_id,
                counter_cache: true
+    has_many :moderation_records,
+             class_name: 'Thredded::PostModerationRecord',
+             dependent: :nullify
 
     validates :messageboard_id, presence: true
 
+    after_commit :auto_follow_and_notify, on: [:create, :update]
+
+    # @param [Integer] per_page
+    # @param [Thredded.user_class] user
+    def page(per_page: self.class.default_per_page, user:)
+      readable_posts = PostPolicy::Scope.new(user, postable.posts).resolve
+      1 + readable_posts.where(postable.posts.arel_table[:id].lt(id)).count / per_page
+    end
+
     def private_topic_post?
       false
     end
 
+    def user_detail
+      super || build_user_detail
+    end
+
     # @return [ActiveRecord::Relation<Thredded.user_class>] users from the list of user names that can read this post.
     def readers_from_user_names(user_names)
       DbTextSearch::CaseInsensitive
         .new(Thredded.user_class.thredded_messageboards_readers([messageboard]), Thredded.user_name_column)
         .in(user_names)
     end
+
+    def auto_follow_and_notify
+      # need to do this in-process so that it appears to them immediately
+      UserTopicFollow.create_unless_exists(user.id, postable_id, :posted)
+      # everything else can happen later
+      AutoFollowAndNotifyJob.perform_later(id)
+    end
   end
 end

data/app/models/thredded/post_moderation_record.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+module Thredded
+  class PostModerationRecord < ActiveRecord::Base
+    include ModerationState
+    # Rails 4 doesn't support enum _prefix
+    if Rails::VERSION::MAJOR >= 5
+      enum previous_moderation_state: moderation_states, _prefix: :previous
+    end
+    validates :previous_moderation_state, presence: true
+
+    belongs_to :messageboard, inverse_of: :post_moderation_records
+    validates :messageboard_id, presence: true
+    belongs_to :post, inverse_of: :moderation_records
+    belongs_to :post_user, class_name: Thredded.user_class, inverse_of: :thredded_post_moderation_records
+    belongs_to :moderator, class_name: Thredded.user_class, inverse_of: :thredded_post_moderation_records
+
+    validates_each :moderation_state do |record, attr, value|
+      if record.previous_moderation_state == value
+        record.errors.add attr, "Post moderation_state is already #{value}"
+      end
+    end
+
+    # @param [Thredded.user_class] moderator
+    # @param [Thredded::Post] post
+    # @param [Symbol, String] previous_moderation_state
+    # @param [Symbol, String] moderation_state
+    # @return [Thredded::PostModerationRecord] the newly created persisted record
+    def self.record!(moderator:, post:, previous_moderation_state:, moderation_state:)
+      # Rails 4 doesn't support enum _prefix
+      if Rails::VERSION::MAJOR < 5
+        previous_moderation_state = moderation_states[previous_moderation_state.to_s]
+      end
+      create!(
+        previous_moderation_state: previous_moderation_state,
+        moderation_state:          moderation_state,
+        moderator:                 moderator,
+        post:                      post,
+        post_content:              post.content,
+        post_user:                 post.user,
+        post_user_name:            post.user.send(Thredded.user_name_column),
+        messageboard_id:           post.messageboard_id,
+      )
+    end
+  end
+end

data/app/models/thredded/private_post.rb

@@ -15,15 +15,30 @@ module Thredded
                primary_key: :user_id,
                foreign_key: :user_id
 
+    after_commit :notify_users, on: [:create]
+
+    # @param [Integer] per_page
+    def page(per_page: self.class.default_per_page)
+      1 + postable.posts.where(postable.posts.arel_table[:id].lt(id)).count / per_page
+    end
+
     def private_topic_post?
       true
     end
 
+    def user_detail
+      super || build_user_detail
+    end
+
     # @return [ActiveRecord::Relation<Thredded.user_class>] users from the list of user names that can read this post.
     def readers_from_user_names(user_names)
       DbTextSearch::CaseInsensitive
         .new(postable.users, Thredded.user_name_column)
         .in(user_names)
     end
+
+    def notify_users
+      Thredded::NotifyPrivateTopicUsersJob.perform_later(id)
+    end
   end
 end