trek 2.1.0 → 2.3.0

data/lib/generators/trek/templates/spec/requests/admin/fragments_spec.rb

@@ -0,0 +1,50 @@
+require "rails_helper"
+
+RSpec.describe "Admin fragments", type: :request do
+  let!(:footer) { fragments.create(key: "footer", namespace: "layout", title: "Footer") }
+
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the fragments" do
+    get admin_fragments_path
+
+    expect(response.body).to include("footer")
+  end
+
+  it "renders the new fragment form" do
+    get new_admin_fragment_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a fragment" do
+    params = { fragment: { key: "tagline", namespace: "home", title: "Tagline" } }
+
+    expect { post admin_fragments_path, params: }.to change(Fragment, :count).by(1)
+  end
+
+  it "refuses a key already used in the namespace" do
+    post admin_fragments_path, params: { fragment: { key: "footer", namespace: "layout", title: "Another footer" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_fragment_path(footer)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a fragment" do
+    patch admin_fragment_path(footer), params: { fragment: { title: "Site footer" } }
+
+    expect(footer.reload.title).to eq("Site footer")
+  end
+
+  it "deletes a fragment" do
+    expect { delete admin_fragment_path(footer) }.to change(Fragment, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/pages_spec.rb

@@ -0,0 +1,47 @@
+require "rails_helper"
+
+RSpec.describe "Admin pages", type: :request do
+  before do
+    seed "cases/page_tree"
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "lists the pages" do
+    get admin_pages_path
+
+    expect(response.body).to include("Company").and include("Our team")
+  end
+
+  it "renders the new page form" do
+    get new_admin_page_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "creates a page" do
+    expect { post admin_pages_path, params: { page: { title: "Contact" } } }.to change(Page, :count).by(1)
+  end
+
+  it "refuses a page without a title" do
+    post admin_pages_path, params: { page: { title: "" } }
+
+    expect(response).to have_http_status(:unprocessable_entity)
+  end
+
+  it "renders the edit form" do
+    get edit_admin_page_path(pages.team)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "updates a page" do
+    patch admin_page_path(pages.team), params: { page: { title: "The team" } }
+
+    expect(pages.team.title).to eq("The team")
+  end
+
+  it "deletes a page" do
+    expect { delete admin_page_path(pages.team) }.to change(Page, :count).by(-1)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/uploads_spec.rb

@@ -0,0 +1,22 @@
+require "rails_helper"
+
+# The endpoints the admin's image and sound fields upload to (`Trek::Form::ImageFieldComponent`,
+# `Trek::Form::SoundFieldComponent`).
+RSpec.describe "Admin uploads", type: :request do
+  before do
+    editor = users.create(role: :editor)
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+  end
+
+  it "stores an uploaded image in the cache and returns its data" do
+    post "/admin/upload/image", params: { file: fixture_file_upload("image.png", "image/png") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+
+  it "stores an uploaded sound in the cache and returns its data" do
+    post "/admin/upload/audio", params: { file: fixture_file_upload("sound.mp3", "audio/mpeg") }
+
+    expect(response.parsed_body["data"]).to include("id", "storage" => "cache")
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/user_password_resets_spec.rb

@@ -0,0 +1,71 @@
+require "rails_helper"
+
+RSpec.describe "Admin password resets", type: :request do
+  let(:editor) { users.create(role: :editor) }
+
+  it "renders the reset request form" do
+    get new_admin_user_password_reset_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "emails a reset link to a privileged user" do
+    expect { post admin_user_password_resets_path, params: { email: editor.email } }
+      .to have_enqueued_mail(Admin::PasswordsMailer, :reset)
+  end
+
+  it "sends nothing for an unknown email" do
+    expect { post admin_user_password_resets_path, params: { email: "nobody@example.com" } }
+      .not_to have_enqueued_mail
+  end
+
+  it "answers an unknown email as a known one, so it can't be used to find accounts" do
+    post admin_user_password_resets_path, params: { email: "nobody@example.com" }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "renders the new password form from a reset link" do
+    get edit_admin_user_password_reset_path(editor.password_reset_token)
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "renders the new password form from an invitation link" do
+    get edit_admin_user_password_reset_path(editor.generate_token_for(:invite))
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "sends an invalid link back to the reset request form" do
+    get edit_admin_user_password_reset_path("not-a-token")
+
+    expect(response).to redirect_to(new_admin_user_password_reset_path)
+  end
+
+  it "sets the new password" do
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "a brand new password" }
+
+    expect(editor.reload.authenticate("a brand new password")).to be_truthy
+  end
+
+  it "signs the user out everywhere" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "a brand new password" }
+
+    expect(editor.user_sessions).to be_empty
+  end
+
+  it "sends a password shorter than 8 characters back to the form" do
+    token = editor.password_reset_token
+    patch admin_user_password_reset_path(token), params: { password: "short" }
+
+    expect(response).to redirect_to(edit_admin_user_password_reset_path(token))
+  end
+
+  it "keeps the old password when the new one is too short" do
+    patch admin_user_password_reset_path(editor.password_reset_token), params: { password: "short" }
+
+    expect(editor.reload.authenticate(users.password)).to be_truthy
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/user_sessions_spec.rb

@@ -0,0 +1,45 @@
+require "rails_helper"
+
+RSpec.describe "Admin sign-in", type: :request do
+  let(:editor) { users.create(role: :editor) }
+
+  it "renders the sign-in form" do
+    get new_admin_user_session_path
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "signs a privileged user in and opens the dashboard" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    follow_redirect!
+
+    expect(response).to have_http_status(:ok)
+  end
+
+  it "refuses a wrong password" do
+    post admin_user_session_path, params: { email: editor.email, password: "not the password" }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "refuses a user who is not privileged" do
+    reader = users.create(role: :reader)
+    post admin_user_session_path, params: { email: reader.email, password: users.password }
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "sends a signed-out visitor to the sign-in form" do
+    get admin_root_path
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+
+  it "signs out" do
+    post admin_user_session_path, params: { email: editor.email, password: users.password }
+    delete admin_user_session_path
+    get admin_root_path
+
+    expect(response).to redirect_to(new_admin_user_session_path)
+  end
+end

data/lib/generators/trek/templates/spec/requests/admin/users_spec.rb

@@ -0,0 +1,99 @@
+require "rails_helper"
+
+RSpec.describe "Admin users", type: :request do
+  let(:admin) { users.create(role: :admin, name: "Ada") }
+  let(:editor) { users.create(role: :editor, name: "Grace") }
+
+  def sign_in(user)
+    post admin_user_session_path, params: { email: user.email, password: users.password }
+  end
+
+  context "when signed in as an admin" do
+    before { sign_in(admin) }
+
+    it "lists the privileged users" do
+      editor
+      get admin_users_path
+
+      expect(response.body).to include("Grace")
+    end
+
+    it "leaves the other users out" do
+      users.create(role: :reader, name: "Linus")
+      get admin_users_path
+
+      expect(response.body).not_to include("Linus")
+    end
+
+    it "renders the new user form" do
+      get new_admin_user_path
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "creates a user and sends them an invitation" do
+      params = { user: { email: "new@example.com", role: "editor", send_invite: "1" } }
+
+      expect { post admin_users_path, params: }
+        .to change(User, :count).by(1).and have_enqueued_mail(AdminMailer, :invite)
+    end
+
+    it "changes a user's role" do
+      patch admin_user_path(editor), params: { user: { role: "admin" } }
+
+      expect(editor.reload.role).to eq("admin")
+    end
+
+    it "deletes a user" do
+      editor
+
+      expect { delete admin_user_path(editor) }.to change(User, :count).by(-1)
+    end
+  end
+
+  context "when signed in as an editor" do
+    before { sign_in(editor) }
+
+    it "is sent back to the dashboard from the users list" do
+      get admin_users_path
+
+      expect(response).to redirect_to(admin_root_path)
+    end
+
+    it "is sent back to the dashboard from another user's profile" do
+      get admin_user_path(admin)
+
+      expect(response).to redirect_to(admin_root_path)
+    end
+
+    it "is told why they were sent back" do
+      get admin_users_path
+
+      expect(flash[:alert]).to eq(I18n.t!("notices.unauthorized"))
+    end
+
+    it "gets a 403 for a JSON request they aren't allowed" do
+      get admin_users_path(format: :json)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it "edits their own profile" do
+      patch admin_user_path(editor), params: { user: { name: "Grace H." } }
+
+      expect(editor.reload.name).to eq("Grace H.")
+    end
+
+    it "cannot change their own role" do
+      patch admin_user_path(editor), params: { user: { role: "admin" } }
+
+      expect(editor.reload.role).to eq("editor")
+    end
+
+    it "switches their admin theme" do
+      patch theme_admin_users_path(format: :turbo_stream), params: { theme: "dark" }
+
+      expect(editor.reload.theme).to eq("dark")
+    end
+  end
+end

data/lib/generators/trek/templates/views/admin/user_password_resets/edit.html.slim

@@ -1,6 +1,6 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_password_reset_path(@token), method: :put do |f|
-    = f.group :password
+    = f.group :password, model_name: User.model_name
       = f.password_field :password,
           required: true,
           autocomplete: "new-password",

data/lib/generators/trek/templates/views/admin/user_password_resets/new.html.slim

@@ -1,6 +1,6 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_password_resets_path do |f|
-    = f.group :email
+    = f.group :email, model_name: User.model_name
       = f.email_field :email,
           required: true,
           autofocus: true,

data/lib/generators/trek/templates/views/admin/user_sessions/new.html.slim

@@ -1,13 +1,13 @@
 = render Trek::GateComponent.new
   = form_with url: admin_user_session_path do |f|
-    = f.group :email
+    = f.group :email, model_name: User.model_name
       = f.email_field :email,
           required: true,
           autofocus: @email.nil?,
           autocomplete: "username",
           value: @email
 
-    = f.group :password
+    = f.group :password, model_name: User.model_name
       = f.password_field :password,
           required: true,
           autofocus: @email.present?,

data/lib/generators/trek/templates/views/admin/users/theme.turbo_stream.slim

@@ -0,0 +1,2 @@
+= turbo_stream.replace Trek::ThemeHelper::THEME_ICON_ID do
+  = theme_icon(Current.user.theme)

data/lib/generators/trek/upgrade/v2_generator.rb

@@ -60,6 +60,9 @@ module Trek
             content.sub!(/^#{key}:\n/, "") if YAML.safe_load(content)&.fetch(key, :absent).nil?
           end
           content.gsub!(/\n{3,}/, "\n\n")
+          # No blank line left at the end where a removed block was: `preapprove_npm_package` appends
+          # its own, and a second run would otherwise collapse the double blank line it makes.
+          content.sub!(/\n+\z/, "\n")
 
           create_file ".yarnrc.yml", content, force: true
         rescue Psych::Exception

data/lib/tasks/trek/attachments.rake

@@ -0,0 +1,18 @@
+namespace :trek do
+  namespace :attachments do
+    desc "Promote Shrine attachments left in the cache storage (DRY_RUN=1 only lists them)"
+    task promote_cached: :environment do
+      # Loads every model, so that all attachments are found
+      Rails.application.eager_load!
+
+      statuses = Hash.new(0)
+
+      Trek::CachedAttachments.new.promote(dry_run: ENV["DRY_RUN"].present?) do |entry|
+        statuses[entry.status] += 1
+        puts [entry.status, "#{entry.record.class.name}##{entry.record.id}.#{entry.name}", entry.file.id].join("\t")
+      end
+
+      puts statuses.empty? ? "No attachment left in the cache storage." : statuses.map { "#{_2} #{_1}" }.join(", ")
+    end
+  end
+end

data/lib/trek/cached_attachments.rb

@@ -0,0 +1,53 @@
+module Trek
+  # Finds the records whose Shrine attachments still point to the temporary cache storage —
+  # files whose promotion was skipped — and promotes those whose cached file still exists.
+  class CachedAttachments
+    Entry = Struct.new(:record, :name, :file, :status, keyword_init: true)
+
+    def self.default_models
+      ActiveRecord::Base.descendants.select do |model|
+        !model.abstract_class? && model == model.base_class && model.table_exists?
+      end
+    end
+
+    def initialize(models = self.class.default_models)
+      @models = models
+    end
+
+    # Yields an Entry per cached attachment, whose status is :promoted, :promotable (dry run),
+    # :missing (the cached file is gone) or :changed (the record changed during promotion).
+    def promote(dry_run: false)
+      return enum_for(:promote, dry_run:) unless block_given?
+
+      each_cached_attachment do |record, name|
+        attacher = record.public_send(:"#{name}_attacher")
+
+        yield Entry.new(record:, name:, file: attacher.file, status: promote_attacher(attacher, dry_run:))
+      end
+    end
+
+    private
+
+    def promote_attacher(attacher, dry_run:)
+      return :missing unless attacher.file.exists?
+      return :promotable if dry_run
+
+      attacher.atomic_promote
+      :promoted
+    rescue Shrine::AttachmentChanged
+      :changed
+    end
+
+    def each_cached_attachment(&)
+      @models.each do |model|
+        model.ancestors.grep(Shrine::Attachment).each do |attachment|
+          name = attachment.attachment_name
+          column = model.connection.quote_column_name(:"#{name}_data")
+          cache_key = attachment.options.fetch(:cache, :cache).to_s
+
+          model.where("#{column}::jsonb ->> 'storage' = ?", cache_key).find_each { |record| yield record, name }
+        end
+      end
+    end
+  end
+end

data/lib/trek/saved_attachments_reload.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Trek
+  # Shrine plugin keeping, across a reload, the attachers whose file was saved with the record.
+  #
+  # Shrine's `activerecord` plugin resets every attacher when the record is reloaded, which is
+  # right for an explicit reload but loses a pending attachment when something reloads the record
+  # *during* the save: closure_tree does exactly that in its `after_save` callback when it
+  # reorders siblings (on create, or when the parent changes) on a numerically ordered tree.
+  # The attacher is then no longer `changed?` when Shrine's `after_commit` runs, so the file is
+  # never promoted from the temporary `cache` storage to `store` and breaks once the cache is
+  # cleaned up.
+  #
+  # An attachment that was *not* saved is still discarded, as on any reload.
+  module SavedAttachmentsReload
+    module ReloadGuard
+      def reload(...)
+        saved_attachers = instance_variables.filter_map do |ivar|
+          attacher = instance_variable_get(ivar)
+          [ivar, attacher.dup] if attacher.is_a?(::Shrine::Attacher) && attacher.changed?
+        end
+
+        super.tap do
+          saved_attachers.each do |ivar, attacher|
+            # Only the attacher whose file is the one now in the column: anything else was
+            # assigned but not saved, and a reload drops it.
+            instance_variable_set(ivar, attacher) if attacher.file == instance_variable_get(ivar).file
+          end
+        end
+      end
+    end
+
+    module AttachmentMethods
+      def included(model)
+        super
+
+        # Prepended rather than included: Shrine's own `reload` is defined on this attachment
+        # module, which the model includes — a prepended module wraps it whatever the order the
+        # model includes its concerns in.
+        model.prepend(ReloadGuard)
+      end
+    end
+  end
+end

data/lib/trek/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Trek
-  VERSION = "2.1.0"
+  VERSION = "2.3.0"
 end

data/lib/trek.rb

@@ -19,12 +19,15 @@ require "shrine"
 require "shrine/plugins/blurhash"
 require "slim-rails"
 require "strip_attributes"
+require "turbo-rails"
 require "view_component"
 require "view_component/form"
 
 module Trek
+  require_relative "trek/cached_attachments"
   require_relative "trek/engine"
   require_relative "trek/i18n_keys_resolver"
+  require_relative "trek/saved_attachments_reload"
   require_relative "trek/typography_formatter"
   require_relative "trek/version"
 

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "A modern content management & back-office system for Ruby on Rails",
   "homepage": "https://trek.etamin.studio",
   "license": "MIT",

data/postcss.config.js

@@ -1,6 +1,42 @@
+// Radix Colors only ship light (`:root, .light-theme`) and dark (`.dark-theme`)
+// variables, with no way to follow the system preference
+// (https://github.com/radix-ui/colors/issues/26). Copy every rule targeting
+// `.dark-theme` into a `prefers-color-scheme: dark` media query, with
+// `.auto-theme` in place of `.dark-theme`. The media query is appended last so
+// it wins over the light defaults, and each rule keeps its enclosing at-rules
+// (e.g. the Display P3 `@supports`/`@media` blocks).
+const DARK_THEME = /\.dark-theme(?![\w-])/;
+const autoDarkTheme = {
+  postcssPlugin: "auto-dark-theme",
+  OnceExit(root, { AtRule }) {
+    const media = new AtRule({
+      name: "media",
+      params: "(prefers-color-scheme: dark)",
+    });
+
+    root.walkRules((rule) => {
+      const selectors = rule.selectors
+        .filter((selector) => DARK_THEME.test(selector))
+        .map((selector) => selector.replace(DARK_THEME, ".auto-theme"));
+      if (!selectors.length) return;
+
+      let node = rule.clone({ selectors });
+      let parent = rule.parent;
+      while (parent.type === "atrule") {
+        node = parent.clone({ nodes: [] }).append(node);
+        parent = parent.parent;
+      }
+      media.append(node);
+    });
+
+    if (media.nodes?.length) root.append(media);
+  },
+};
+
 module.exports = {
   plugins: [
     require("postcss-import"),
+    autoDarkTheme,
     // call the `postcss-modules` plugin ourselves
     require("postcss-modules")({
       generateScopedName: (name, filename, _css) => {

data/trek.gemspec

@@ -39,6 +39,10 @@ Gem::Specification.new do |spec|
   spec.add_dependency "http_accept_language", "~> 2.1"
   spec.add_dependency "i18n-tasks", "~> 1.0"
   spec.add_dependency "image_processing", "~> 1.8"
+  # json 3's `JSON.parse` takes keyword options only, but ActiveSupport (up to 8.1.3.1) passes them
+  # positionally, which breaks `db/schema.rb` for jsonb columns with a default. Lift once Rails
+  # supports json 3 (spec/dummy/generated_files_spec.rb checks the schema dump).
+  spec.add_dependency "json", "< 3"
   spec.add_dependency "kaminari"
   spec.add_dependency "listen"
   spec.add_dependency "lookbook", ">= 2.3.13"
@@ -53,6 +57,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "shrine-blurhash", "~> 0.2"
   spec.add_dependency "slim-rails", "~> 4.0"
   spec.add_dependency "strip_attributes", "~> 2.0"
+  spec.add_dependency "turbo-rails", ">= 1.0"
   spec.add_dependency "view_component", "< 5.0"
   spec.add_dependency "view_component-form", "~> 0.3"
   spec.add_dependency "zeitwerk", "~> 2.6"