tolaria 1.0.0

data/app/controllers/admin/admin_controller.rb

@@ -0,0 +1,21 @@
+class Admin::AdminController < Tolaria::TolariaController
+
+  skip_before_filter :authenticate_admin!, only:[:markdown]
+
+  def root
+    redirect_to(Tolaria.config.default_redirect, status:303)
+  end
+
+  def markdown
+    return render(nothing:true, status:404) unless current_administrator.present?
+    return render(inline:Tolaria.render_markdown(request.raw_post))
+  end
+
+  def help_link
+    @help_link = Tolaria.help_links.find do |help_link|
+      help_link.slug == params[:slug]
+    end or raise ActiveRecord::RecordNotFound
+    return render tolaria_template("help/help_link")
+  end
+
+end

data/app/controllers/admin/sessions_controller.rb

@@ -0,0 +1,112 @@
+class Admin::SessionsController < Tolaria::TolariaController
+
+  skip_before_filter :authenticate_admin!
+
+  # Present the signin form
+
+  def new
+    if current_administrator
+      return redirect_to(Tolaria.config.default_redirect, status:303)
+    end
+    @greeting = random_greeting
+    @admin = Administrator.new
+    return render "admin/session/form", layout:"admin/sessions"
+  end
+
+  # Code request: Dispatch an email with the admin’s passcode, or return JSON errors
+
+  def request_code
+
+    email = params[:administrator].try(:[], :email).to_s.downcase.chomp
+    @administrator = Administrator.find_by_email(email)
+
+    unless @administrator
+      response.status = 404
+      return render json: {
+        status: response.status,
+        error: "That email address couldn’t be found. Contact an existing site administrator if you need an account created for you.",
+      }
+    end
+
+    if @administrator.locked?
+      response.status = 423
+      return render json: {
+        status: response.status,
+        error: %{
+          Your account has made too many requests and has been locked.
+          Please try again after #{Tolaria.config.lockout_duration/60} minutes.
+        }.squish,
+      }
+    end
+
+    if @administrator.send_passcode_email!
+      @administrator.accrue_strike!
+      response.status = 204
+      return render nothing: true
+    else
+      response.status = 500
+      return render json: {
+        status: response.status,
+        error: "An email couldn’t be sent for you. Please try again later."
+      }
+    end
+
+  end
+
+  # Create: Attempt to sign in the admin with the email/passcode combination.
+
+  def create
+
+    email = params[:administrator].try(:[], :email).to_s.downcase.chomp
+    passcode = params[:administrator].try(:[], :passcode).to_s
+
+    @administrator = Administrator.find_by_email(email)
+
+    if @administrator && @administrator.authenticate!(passcode)
+
+      # Auth successful
+      # Set an signed admin cookie with our auth_token
+      cookies.encrypted[:admin_auth_token] = {
+        value: @administrator.auth_token,
+        expires: params[:remember_me].eql?("1") ? 1.year.from_now : nil,
+        secure: Rails.env.production?, # Expect a TLS connection in production
+        httponly: true, # JavaScript should not read this cookie
+      }
+
+      # Redirect to the admin pane
+      return redirect_to(Tolaria.config.default_redirect, status:303)
+
+    else
+
+      # Auth failed
+      flash[:error] = "That passcode wasn’t correct. Please request a new passcode and try again."
+      return redirect_to(admin_new_session_path, status:303)
+
+    end
+
+  end
+
+  # Destroy: Sign out the admin and reset the session
+
+  def destroy
+    cookies.delete(:admin_auth_token)
+    reset_session
+    flash[:success] = "You have successfully signed out."
+    return redirect_to(admin_new_session_path, status:303)
+  end
+
+  protected
+
+  # Returns a random UI greeting.
+  def random_greeting
+    case [1,2,3].sample
+    when 1
+      return "Have we met before?"
+    when 2
+      return "Happy #{Date.current.strftime('%A')}!"
+    when 3
+      return "Hey there! Welcome back."
+    end
+  end
+
+end

data/app/controllers/tolaria/resource_controller.rb

@@ -0,0 +1,132 @@
+class Tolaria::ResourceController < Tolaria::TolariaController
+
+  before_filter :load_managed_class!
+  before_filter :strip_invalid_ransack_params!, only:[:index]
+
+  def index
+    @search = @managed_class.klass.ransack(params[:q])
+    @resources = @search.result
+    if @managed_class.paginated?
+      @resources = @resources.page(params[:page]).per(Tolaria.config.page_size)
+    end
+    unless currently_sorting?
+      @resources = @resources.order(@managed_class.default_order)
+    end
+    return render tolaria_template("tolaria_resource/index")
+  end
+
+  def show
+    @resource = @managed_class.klass.find_by_id(params[:id]) or raise ActiveRecord::RecordNotFound
+    return render tolaria_template("tolaria_resource/show")
+  end
+
+  def new
+    @resource = @managed_class.klass.new
+    return render tolaria_template("tolaria_resource/new")
+  end
+
+  def create
+
+    @resource = @managed_class.klass.new
+    @resource.assign_attributes(resource_params[@managed_class.param_key])
+    display_name = Tolaria.display_name(@resource)
+
+    if @resource.save
+      flash[:success] = "#{random_blingword} You created the #{@managed_class.model_name.human} “#{display_name}”."
+      return redirect_to url_for([:admin, @managed_class.klass])
+    else
+      log_validation_errors!
+      flash.now[:error] = "Your changes couldn’t be saved. Please correct the following errors:"
+      return render tolaria_template("tolaria_resource/new")
+    end
+
+  end
+
+  def edit
+    @resource = @managed_class.klass.find_by_id(params[:id]) or raise ActiveRecord::RecordNotFound
+    return render tolaria_template("tolaria_resource/edit")
+  end
+
+  def update
+
+    @resource = @managed_class.klass.find_by_id(params[:id]) or raise ActiveRecord::RecordNotFound
+    @resource.assign_attributes(resource_params[@managed_class.param_key])
+    display_name = Tolaria.display_name(@resource)
+
+    if @resource.save
+      flash[:success] = "#{random_blingword} You updated the #{@managed_class.model_name.human.downcase} “#{display_name}”."
+      return redirect_to url_for([:admin, @managed_class.klass])
+    else
+      log_validation_errors!
+      flash.now[:error] = "Your changes couldn’t be saved. Please correct the following errors:"
+      return render tolaria_template("tolaria_resource/edit")
+    end
+
+  end
+
+  def destroy
+
+    @resource = @managed_class.klass.find_by_id(params[:id]) or raise ActiveRecord::RecordNotFound
+    display_name = Tolaria.display_name(@resource)
+
+    begin
+      @resource.destroy
+    rescue ActiveRecord::DeleteRestrictionError => e
+      flash[:restricted] = "You cannot delete “#{display_name}” because other items are using it."
+      return redirect_to url_for([:admin, @managed_class.klass])
+    end
+
+    flash[:destructive] = "You deleted the #{@managed_class.model_name.human.downcase} “#{display_name}”."
+    return redirect_to url_for([:admin, @managed_class.klass])
+
+  end
+
+  protected
+
+  # Returns a random positive expression for use in
+  # flash messages
+  def random_blingword
+    ["Done!", "Okay!", "Success!"].sample
+  end
+
+  # Load the Tolaria managed class for this controller
+  def load_managed_class!
+    @managed_class ||= Tolaria.managed_classes.find do |managed_class|
+      self.class.to_s == "Admin::#{managed_class.controller_name}"
+    end
+  end
+
+  # Filters params, allows the default params Tolaria needs
+  # and the configured `permitted_params` from the managed class
+  def resource_params
+    params.permit(
+      *Tolaria.config.permitted_params,
+      @managed_class.param_key => @managed_class.permitted_params
+    )
+  end
+
+  # Some Ransack methods raise exceptions if the `q` param is invalid.
+  # Strip `q` params not created by Ransack
+  def strip_invalid_ransack_params!
+    return true if params[:q].blank?
+    unless params[:q].is_a?(Hash)
+      params.delete(:q)
+    end
+  end
+
+  # Returns true if there is a sorting parameter for Ransack
+  def currently_sorting?
+    params[:q].present? && params[:q][:s].present?
+  end
+
+  # Logs all validation errors for the current resource to the Rails console
+  def log_validation_errors!
+    unless Rails.env.test?
+      puts "#{@resource.class} failed validation and was not saved:"
+      @resource.errors.full_messages.each do |message|
+        puts "  #{message}"
+      end
+    end
+  end
+
+end

data/app/controllers/tolaria/tolaria_controller.rb

@@ -0,0 +1,40 @@
+class Tolaria::TolariaController < ::ApplicationController
+
+  protect_from_forgery
+  before_filter :add_admin_headers!
+  before_filter :authenticate_admin!
+
+  protected
+
+  def add_admin_headers!
+    # Don't use old IE rendering modes
+    response.headers["X-UA-Compatible"] = "IE=edge"
+    # Forbid putting the admin in a frameset/iframe
+    response.headers["X-Frame-Options"] = "DENY"
+    # Strict sniffing and XSS modes for browsers that use these flags
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-XSS-Protection"] = "1; mode=block"
+  end
+
+  def tolaria_template(name)
+    return {
+      template: "admin/#{name}",
+      layout: "admin/admin"
+    }
+  end
+
+  def authenticate_admin!
+    unless current_administrator
+      flash[:error] = "You must log in to continue. Request a passcode below."
+      return redirect_to(admin_new_session_path, status:303)
+    end
+  end
+
+  def current_administrator
+    @current_administrator ||= Administrator.find_by_auth_token(cookies.encrypted[:admin_auth_token])
+  end
+
+  helper_method :current_administrator
+
+end
+

data/app/helpers/admin/table_helper.rb

@@ -0,0 +1,175 @@
+module Admin::TableHelper
+
+  # Returns a `<table class="index-table">` tag with the appropriate wrapper
+  # and the given +content+ or block content inside it.
+  def index_table(content = nil, &block)
+    content_tag :div, class:"index-table-wrap" do
+      content_tag :table, class:"index-table" do
+        content || yield
+      end
+    end
+  end
+
+  # Returns a `<table class="show-table">` tag with the given +content+
+  # or block content inside it.
+  def show_table(content = nil, &block)
+    content_tag :table, class:"show-table" do
+      content || yield
+    end
+  end
+
+  # Returns the following `<tr>`, suitable for use in a `table.show-table`:
+  #
+  #     <tr>
+  #       <th>Field</th>
+  #       <th>Details</th>
+  #     </tr>
+  def show_thead_tr
+    %{<tr><th>Field</th><th>Details</th></tr>}.html_safe
+  end
+
+  # Returns a `<tr>` with two `<td>`s suitable for use in a `table.show-table`.
+  # The given +label+ is placed inside the first `<td>`, while the +value+
+  # is placed in the second `<td>`. Options are forwarded to `content_tag`
+  # for the *second* `<td>`.
+  #
+  # If +label+ is a symbol, it is assumed to be a method on a variable named
+  # `@resource` in the current template, and the `<tr>` is constructed
+  # automatically for you by converting the symbol to a human-readable label
+  # and calling the named method on @resource to get the +value+.
+  #
+  # ==== Signatures
+  #
+  #     # Set the values yourself, and a class on the second `<td>`
+  #     show_tr "Slug", resource.slug, class:"monospace"
+  #
+  #     # Attempt to auto-fill the row based on a method name
+  #     show_tr :slug
+  def show_tr(label, value = nil, options = nil)
+
+    if label.is_a?(Symbol)
+      options = value
+      value = @resource.send(label)
+      label = label.to_s.titleize
+    end
+
+    content = content_tag(:td, class:"show-td-field") do
+      content_tag :span do
+        label
+      end
+    end
+
+    content << content_tag(:td, options) do
+      value.to_s
+    end
+
+    content_tag(:tr) do
+      content
+    end
+
+  end
+
+  # Returns a `<th>` tag, suitable for use inside a `table.index-table`.
+  # +field_or_label+ may be any string, or a symbol naming a model column.
+  # +sort+ may be `true`, `false`, or a symbol. See the signtures below.
+  #
+  # If the column is sortable, the `<th>` will contain a Ransack sort link
+  # that allows the end-user to organize the table by that column.
+  #
+  # ==== Signatures
+  #
+  #    # Create a header that sorts a named column
+  #    index_th(:title, sort:true)
+  #
+  #    # Create a header that sorts a column, with custom label
+  #    index_th("Strange Title", sort: :title)
+  #
+  #    # Create a header that can't be sorted
+  #    index_th("Strange Title", sort:false)
+  def index_th(field_or_label, sort:true)
+
+    case field_or_label
+    when :id
+      display_label = "ID"
+    when Symbol
+      display_label = field_or_label.to_s.humanize.titleize
+    else
+      display_label = field_or_label
+    end
+
+    if sort.is_a?(Symbol)
+      return content_tag(:th, sort_link(@search, sort, display_label), class:"index-th")
+    end
+
+    if sort.eql?(true) && field_or_label.is_a?(Symbol)
+      return content_tag(:th, sort_link(@search, field_or_label, display_label), class:"index-th")
+    end
+
+    return content_tag(:th, display_label, class:"index-th")
+
+  end
+
+  # Returns a `<td>` tag, suitable for use inside a `table.index-table`.
+  # If +method_or_content+ is a symbol, it will call that method on the
+  # given +resource+ to obtain the content of the `<td>`. Otherwise
+  # it expects +method_or_content+ or a passed block to provide suitable string.
+  #
+  # #### Special Options
+  #
+  # - `:image` - A URL to a square image to use in the <td>, floating to the
+  #   left of the content. The image should be a square at least
+  #   14×14px in size.
+  #
+  # Other options are forwarded to `content_tag` for the `<td>`.
+  def index_td(resource, method_or_content, options = {}, &block)
+
+    options = method_or_content if block_given?
+
+    if block_given?
+      content = yield
+    elsif method_or_content.is_a?(Symbol)
+      content = resource.send(method_or_content)
+    else
+      content = method_or_content
+    end
+
+    options[:class] = "index-td #{options[:class]}"
+
+    if image = options.delete(:image)
+      image = image_tag(image, size:"18x18", alt:"")
+    end
+
+    return content_tag(:td, options) do
+      link_to("#{image}#{content}".html_safe, url_for(action:"edit", id:resource.id))
+    end
+
+  end
+
+  # Returns an `index_th` with label `"Actions"` that is not sortable.
+  def actions_th
+    index_th("Actions", sort:false)
+  end
+
+  # Returns a `<td>` tag, suitable for use inside a `table.index-table`.
+  # The tag contains buttons to edit, inspect, and delete the given +resource+.
+  def actions_td(resource)
+
+    links = []
+
+    if @managed_class.allows?(:edit)
+      links << link_to("Edit", url_for(action:"edit", id:resource.id), class:"button -small")
+    end
+
+    if @managed_class.allows?(:show)
+      links << link_to("Inspect", url_for(action:"show", id:resource.id), class:"button -small")
+    end
+
+    if @managed_class.allows?(:destroy)
+      links << link_to("Delete", url_for(action:"destroy", id:resource.id), class: "button -small", method: :delete, :'data-confirm' => deletion_warning(resource))
+    end
+
+    return content_tag(:td, links.join("").html_safe, class:"actions-td")
+
+  end
+
+end