trek 2.5.0 → 2.6.0

data/app/components/trek/form/image_field_component/image_field_component.html.slim

@@ -31,12 +31,3 @@
               size: :narrow,
               data: remove_button_data_attributes,
             )
-          / The uploaded file itself, the preview being a thumbnail
-          = render Trek::ButtonComponent.new( \
-              text: t("admin.actions.see_original"),
-              size: :narrow,
-              href: image.url,
-              target: "_blank",
-              rel: "noopener",
-            ) do |button|
-            - button.with_icon("trek/external")

data/app/components/trek/form/image_field_component.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "content_disposition"
+
 module Trek
   module Form
     class ImageFieldComponent < ViewComponent::Form::FileFieldComponent
@@ -16,16 +18,29 @@ module Trek
 
       private
 
+      # The thumbnail, with links opening the uploaded file in a new tab and downloading it. A file just picked,
+      # not yet saved, has no URL: the JS replaces the preview with its own thumbnail.
       def preview
-        if image&.exists?
-          # TODO: connect panel
-          # link_to edit_admin_image_path(image.id),
-          #         'data-action': "admin--layout#openPanelWhenLoaded",
-          #         'data-turbo-frame': "admin--layout-panel" do
-          image_tag image_url, loading: "lazy"
-          # end
-        else
-          render Trek::IconComponent.new("trek/pic")
+        return render(Trek::IconComponent.new("trek/pic")) unless image&.exists?
+
+        tag.div(class: class_for("original")) do
+          safe_join([
+            image_tag(image_url, loading: "lazy", alt: ""),
+            tag.div(class: class_for("original-actions")) do
+              safe_join([
+                original_link(image.url, "trek/external", t("admin.actions.see_original"),
+                  target: "_blank", rel: "noopener"),
+                original_link(download_url, "trek/download", t("admin.actions.download_original"),
+                  download: image.original_filename.to_s)
+              ])
+            end
+          ])
+        end
+      end
+
+      def original_link(url, icon, label, **options)
+        link_to url, class: class_for("original-action"), title: label, "aria-label": label, **options do
+          render Trek::IconComponent.new(icon, aria_hidden: true)
         end
       end
 
@@ -33,6 +48,18 @@ module Trek
         Trek::ThumbnailHelper.thumbnail_url(image, 300, 150)
       end
 
+      # The `download` attribute only applies to a file on the admin's own host. On S3, the file is served from
+      # the bucket's host, so it's a URL signed to answer as an attachment: signed for the bucket itself, without
+      # the `url_options` host (a CDN's), and valid for a day, as the page may stay open a while.
+      def download_url
+        image.url(
+          public: false,
+          host: nil,
+          expires_in: 1.day.to_i,
+          response_content_disposition: ContentDisposition.attachment(image.original_filename)
+        )
+      end
+
       def image
         object.public_send(:"#{method_name}")
       end

data/app/content/trek/content/cleaner.rb

@@ -0,0 +1,53 @@
+module Trek
+  module Content
+    # Removes from a document what rendering skips (Paragraph, ListItem, BulletList, OrderedList): empty
+    # paragraphs, empty list items, and lists left without items. Trek::Contentable calls it before saving.
+    #
+    # The document stays one the editor can open, without the schema adding anything back: an empty
+    # document keeps one paragraph, a list item keeps its first paragraph, which it needs before a nested
+    # list, and a node left with only empty paragraphs, like a quote, is kept as it was. Whatever the schema
+    # doesn't know, node types or attributes of other Tiptap extensions, is kept.
+    class Cleaner
+      LISTS = %i[bullet_list ordered_list].freeze
+
+      # A Prosemirror::Document, cleaned
+      def call(document)
+        root = document.root
+        content = clean_content(root.content)
+        content = [Prosemirror::Node.new(type: :paragraph)] if content.empty?
+        Prosemirror::Document.new(content == root.content ? root : root.with(content:), schema: document.schema)
+      end
+
+      private
+
+      def clean_content(nodes)
+        nodes.filter_map { |node| clean(node) }
+      end
+
+      # The node, cleaned, or nil to remove it
+      def clean(node)
+        return if empty_paragraph?(node)
+        return node if node.text? || node.content.empty?
+        return clean_list_item(node) if node.type == :list_item
+
+        content = clean_content(node.content)
+        return content.presence && node.with(content:) if LISTS.include?(node.type)
+        return node if content.empty? || content == node.content
+
+        node.with(content:)
+      end
+
+      def clean_list_item(item)
+        return if ListItem.empty?(item)
+
+        first, *rest = item.content
+        content = [empty_paragraph?(first) ? first : clean(first), *clean_content(rest)]
+        content == item.content ? item : item.with(content:)
+      end
+
+      def empty_paragraph?(node)
+        node.type == :paragraph && node.content.empty?
+      end
+    end
+  end
+end

data/app/content/trek/content/document.rb

@@ -19,8 +19,8 @@ module Trek
         @record = record
       end
 
-      def to_phlex
-        Renderer.new(self)
+      def to_phlex(heading_ids: false)
+        Renderer.new(self, heading_ids:)
       end
 
       class Renderer < Prosemirror::HTMLRenderer

data/app/content/trek/content/prompts_block.rb

@@ -9,13 +9,12 @@ module Trek
       prop :href, _String?
       prop :target, _String?
       prop :title, _String?
-      prop :color, _String?(/\A[\w-]+\z/)
 
       def view_template
         href = @href.present? && safe_url(@href)
         return if !href || @text.blank?
 
-        a(href:, target: @target, title: @title, data_color: @color) { @text }
+        a(href:, target: @target, title: @title) { @text }
       end
     end
   end

data/app/content/trek/content.rb

@@ -20,6 +20,12 @@ module Trek
         @default_schema = nil
       end
 
+      # The content without what rendering skips (see Cleaner), as a Hash. Problems with the content are
+      # reported when it's rendered, not when it's cleaned.
+      def clean(json)
+        Cleaner.new.call(schema.with_options(on_invalid: nil).parse(json)).to_h
+      end
+
       def default_schema
         Prosemirror::Schema.tiptap(
           case: :camel,

data/app/controllers/concerns/trek/reorderable.rb

@@ -13,14 +13,12 @@ module Trek
       def reorder
         authorize!
         objects = reorderable_objects.index_by(&:id)
+        ordered = reorder_params.sort_by { |_id, index| index }.filter_map { |id, _index| objects[id.to_i] }
 
-        # Saving the positions one record at a time repeats acts_as_list's queries: Prosopite, in
-        # development and test, would take them for an N+1
+        # Saving the records one at a time repeats queries, which Prosopite, in development and test, would
+        # take for an N+1
         without_n_plus_one_detection do
-          reorder_params.each do |id, position|
-            object = objects[id.to_i]
-            object.update(position:) unless object.position == position
-          end
+          model.transaction { without_list_updates { place_in_order(ordered) } }
         end
 
         redirect_to reorder_success_redirect, notice: reorder_notice
@@ -49,6 +47,26 @@ module Trek
       [:admin, *model_collection_route]
     end
 
+    # The JS posts the whole list in its new order. A tree ordered by closure_tree (`numeric_order`, which
+    # gives `append_sibling`) renumbers the siblings at each save: the first record takes the place of the
+    # current first one, and each other record goes after the previous one. Otherwise, each record gets its
+    # position from the top of the list, 1 unless acts_as_list's `top_of_list` says otherwise.
+    def place_in_order(ordered)
+      if ordered.first.respond_to?(:append_sibling)
+        current_first = ordered.min_by(&:position)
+        current_first.prepend_sibling(ordered.first) unless current_first == ordered.first
+        ordered.each_cons(2) { |previous, object| previous.append_sibling(object) }
+      else
+        top = ordered.first.respond_to?(:acts_as_list_top) ? ordered.first.acts_as_list_top : 0
+        ordered.each.with_index(top) { |object, position| object.update(position:) unless object.position == position }
+      end
+    end
+
+    # acts_as_list would shift the other records at each save, moving those already placed
+    def without_list_updates(&)
+      model.respond_to?(:acts_as_list_no_update) ? model.acts_as_list_no_update(&) : yield
+    end
+
     def without_n_plus_one_detection(&)
       defined?(Prosopite) ? Prosopite.pause(&) : yield
     end

data/app/controllers/trek/csp_reports_controller.rb

@@ -17,6 +17,8 @@ module Trek
     # A report is a few hundred bytes; the Reporting API may group a few
     MAX_BODY = 64.kilobytes
     NEW_VIOLATIONS_PER_HOUR = 20
+    # AppSignal drops a tag of 256 characters or more, without a warning
+    TAG_LENGTH = 255
 
     # Browsers send no CSRF token; the endpoint only logs and reports, with no session nor user
     skip_forgery_protection
@@ -40,10 +42,21 @@ module Trek
       ::Appsignal.report_error(CspViolation.new(violation.to_s)) do
         ::Appsignal.set_namespace("csp")
         ::Appsignal.set_action(incident(violation))
-        ::Appsignal.add_tags(page: violation.page, disposition: violation.disposition)
+        ::Appsignal.add_tags(tags(violation))
       end
     end
 
+    # What tells the violation apart, within its incident: where, what, and in which browser
+    def tags(violation)
+      {
+        page: violation.page,
+        disposition: violation.disposition,
+        source: violation.source,
+        sample: violation.sample,
+        user_agent: request.user_agent
+      }.compact_blank.transform_values { |value| value.truncate(TAG_LENGTH) }
+    end
+
     # AppSignal groups the violations by action: the directive and the blocked origin
     def incident(violation)
       "#{violation.directive} #{violation.blocked}"

data/app/controllers/trek/panels/prompts_controller.rb

@@ -34,7 +34,7 @@ module Trek
       end
 
       def object_params
-        params.require(:prompt).permit(:turbo_frame_id, :color, :href, :text, :target, :title)
+        params.require(:prompt).permit(:turbo_frame_id, :href, :text, :target, :title)
       end
     end
   end

data/app/controllers/trek/resource_controller.rb

@@ -37,9 +37,9 @@ module Trek
         else
           format.html do
             flash.now[:alert] = t("admin.errors.message", count: @object.errors.count)
-            render :new, status: :unprocessable_entity
+            render :new, status: :unprocessable_content
           end
-          format.json { render json: @object.errors, status: :unprocessable_entity }
+          format.json { render json: @object.errors, status: :unprocessable_content }
         end
       end
     end
@@ -54,9 +54,9 @@ module Trek
         else
           format.html do
             flash.now[:alert] = t("admin.errors.message", count: @object.errors.count)
-            render :edit, status: :unprocessable_entity
+            render :edit, status: :unprocessable_content
           end
-          format.json { render json: @object.errors, status: :unprocessable_entity }
+          format.json { render json: @object.errors, status: :unprocessable_content }
         end
       end
     end
@@ -66,7 +66,7 @@ module Trek
       unless @object.destroy
         return respond_to do |format|
           format.html { redirect_back_or_to [:admin, @object], alert: @object.errors.full_messages.to_sentence }
-          format.json { render json: @object.errors, status: :unprocessable_entity }
+          format.json { render json: @object.errors, status: :unprocessable_content }
         end
       end
 

data/app/jobs/trek/purge_expired_sessions_job.rb

@@ -3,11 +3,12 @@
 module Trek
   # Deletes the signed-in browsers past their idle timeout or lifetime (Trek::Users::SessionLifetime):
   # they can't sign anyone in anymore. Schedule it daily with the app's Active Job backend, e.g. a
-  # GoodJob cron entry.
+  # GoodJob cron entry. Purges User::Session, or the session model named, e.g. a public account's
+  # ("Customer::Session").
   # rubocop:disable Rails/ApplicationJob -- the gem can't rely on the host app's ApplicationJob
   class PurgeExpiredSessionsJob < ActiveJob::Base
-    def perform
-      ::User::Session.expired.in_batches(of: 1000).delete_all
+    def perform(session_class = "User::Session")
+      session_class.constantize.expired.in_batches(of: 1000).delete_all
     end
   end
   # rubocop:enable Rails/ApplicationJob

data/app/models/concerns/trek/contentable.rb

@@ -2,6 +2,10 @@ module Trek
   module Contentable
     extend ActiveSupport::Concern
 
+    included do
+      before_validation :clean_content
+    end
+
     def parsed_content
       return if content.blank?
 
@@ -20,8 +24,9 @@ module Trek
       content_document&.to_html
     end
 
+    # The plain text, with its blocks separated by a blank line and its hard breaks by a newline
     def content_text
-      content_document&.text_content
+      content_document&.to_text
     end
 
     def prosemirror_content?
@@ -31,5 +36,14 @@ module Trek
       else false
       end
     end
+
+    private
+
+    # Before saving, removes what rendering skips: empty paragraphs, empty list items and lists left empty
+    # (Trek::Content::Cleaner). The content editor submits the content as a JSON string: it's stored as a
+    # document. Translated content is cleaned in the current locale.
+    def clean_content
+      self.content = Trek::Content.clean(parsed_content) if prosemirror_content?
+    end
   end
 end

data/app/models/concerns/trek/users/sign_in_code.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Trek
+  module Users
+    # A one-time code emailed to sign in, or to confirm a new email address: 6 digits, valid for
+    # `validity` (10 minutes), for `max_attempts` tries (5), then single use. Stored as an HMAC of the
+    # code keyed on the app's secret_key_base, never in clear. Kept by email rather than by account,
+    # so an email without an account gets one too: asking for a code answers the same whether or not
+    # the email has an account (ANSSI guide on passwords, R14), and verifying it creates the account.
+    #
+    # A new code for an email replaces its earlier ones for the same purpose. Needs the `email`,
+    # `purpose`, `code_digest`, `attempts` and `expires_at` columns, and the account's foreign key for
+    # an email change.
+    module SignInCode
+      extend ActiveSupport::Concern
+
+      PURPOSES = %w[sign_in email_change].freeze
+      LENGTH = 6
+
+      included do
+        class_attribute :validity, default: 10.minutes
+        class_attribute :max_attempts, default: 5
+
+        # The code in clear, on the record `issue` returns only: for the email, never stored.
+        attribute :code, :string
+
+        normalizes :email, with: ->(email) { email.strip.downcase }
+
+        validates :email, presence: true
+        validates :purpose, inclusion: { in: PURPOSES }
+
+        scope :expired, -> { where(expires_at: ...Time.current) }
+      end
+
+      class_methods do
+        # A new code for `email`, replacing the earlier ones for `purpose`. Its `code` is the one to send.
+        def issue(email, purpose: "sign_in", **attributes)
+          code = SecureRandom.random_number(10**LENGTH).to_s.rjust(LENGTH, "0")
+
+          transaction do
+            where(email: normalize_value_for(:email, email), purpose:).delete_all
+            # Codes nobody used: they can't sign anyone in anymore
+            expired.delete_all
+            create!(email:, purpose:, code_digest: code_digest(code), expires_at: validity.from_now, **attributes)
+          end.tap { it.code = code }
+        end
+
+        # The code of `email` for `purpose` when `code` matches it, used up; nil otherwise. Every try
+        # counts, the right one included, and a code past max_attempts can't sign in anymore.
+        def redeem(email, code, purpose: "sign_in", **attributes)
+          record = where(email: normalize_value_for(:email, email), purpose:, **attributes)
+            .where(expires_at: Time.current..).order(created_at: :desc).first
+          return unless record
+
+          # Counted in the database first, so parallel tries can't go past max_attempts
+          counted = where(id: record.id).where(attempts: ...max_attempts).update_all("attempts = attempts + 1") # rubocop:disable Rails/SkipsModelValidations
+          return if counted.zero?
+          return unless ActiveSupport::SecurityUtils.secure_compare(record.code_digest, code_digest(code.to_s.gsub(/\D/, "")))
+
+          # Single use: only one of parallel right tries gets it
+          record if where(id: record.id).delete_all == 1
+        end
+
+        def code_digest(code)
+          OpenSSL::HMAC.hexdigest("SHA256", Rails.application.key_generator.generate_key("trek/sign_in_codes"), code)
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/trek/users/sign_in_lockout.rb

@@ -10,7 +10,8 @@ module Trek
     #
     # While locked, signing in fails even with the right password, and the attempts don't count. A
     # successful sign-in or a new password (e.g. through a reset) unlocks it. The user is emailed
-    # when it first locks (`sign_in_lockout_email`).
+    # when it first locks (`sign_in_lockout_email`), by `sign_in_lockout_mailer`'s `sign_in_locked`
+    # (AdminMailer).
     #
     # Needs the `failed_sign_in_count` and `sign_in_locked_until` columns.
     module SignInLockout
@@ -21,6 +22,7 @@ module Trek
         class_attribute :sign_in_lockout_duration, default: 1.minute
         class_attribute :sign_in_lockout_max, default: 1.hour
         class_attribute :sign_in_lockout_email, default: true
+        class_attribute :sign_in_lockout_mailer, default: "AdminMailer"
 
         before_save :unlock_sign_in, if: :password_digest_changed?
       end
@@ -41,7 +43,7 @@ module Trek
         update_column(:sign_in_locked_until, sign_in_lockout_delay.from_now) # rubocop:disable Rails/SkipsModelValidations
         # Once per series of failures, not on each failure that extends it
         first_lockout = failed_sign_in_count == sign_in_lockout_after
-        AdminMailer.sign_in_locked(self).deliver_later if sign_in_lockout_email && first_lockout
+        sign_in_lockout_mailer.constantize.sign_in_locked(self).deliver_later if sign_in_lockout_email && first_lockout
       end
 
       def record_successful_sign_in!

data/app/views/trek/panels/links/_form.html.slim

@@ -20,10 +20,8 @@ h1.c-trek--layout-panel-title = t("admin.panels.links.form.title")
     = f.select :target,
                 options_for_select(@object.class::TARGETS, @object.target)
 
-  / TODO: re-enable when tiptap supports `title`
-  / see https://github.com/ueberdosis/tiptap/pull/2204
-  / = f.group :title
-  /   = f.text_field :title
+  = f.group :title
+    = f.text_field :title
 
   = render Trek::Form::ActionsComponent.new do |c|
     ruby:

data/app/views/trek/panels/prompts/create.turbo_stream.slim

@@ -7,7 +7,6 @@
       data-trek--form--content-editor-target="contentInserter"
     )
       prompts-block(
-        color=@object.color
         href=@object.href
         target=@object.target
         text=@object.text

data/config/locales/trek.en.yml

@@ -6,23 +6,23 @@ en:
         alt: Alternative text
         credit: Credit
         file: Image
-        size: Size
-        text: Caption
+        size: Display width
+        text: Image caption
       trek/content_editor/link:
-        href: Address
-        target: Open in
-        text: Text
+        href: Link to
+        target: Open this link in…
+        text: Link text
         title: Title
       trek/content_editor/prompt:
-        href: Address
-        target: Open in
-        text: Text
+        href: Link to
+        target: Open this link in…
+        text: Button text
         title: Title
     options:
       trek/content_editor/image:
         size:
           default: As wide as the text
-          larger: Wider
+          larger: Extends past the sides
   activerecord:
     attributes:
       audit_log:
@@ -94,6 +94,7 @@ en:
       browse: Browse…
       cancel: Cancel
       delete: Delete
+      download_original: Download original
       edit: Edit
       logout: Log out
       manage: Manage
@@ -178,6 +179,7 @@ en:
         intro: Fragment
       update:
         success: Fragment updated
+    jobs: Background jobs
     metadata: Metadata
     navigation: Navigation
     pages:
@@ -228,6 +230,9 @@ en:
         success: Passkey added
       destroy:
         success: Passkey deleted
+    password_renewals:
+      create:
+        success: Every user will have to choose a new password
     passwords_mailer:
       reset:
         subject: Reset your password
@@ -289,8 +294,6 @@ en:
         last_used: Last used %{time} ago
         never_used: Never used
         title: Sign in without a password
-      require_password_renewal:
-        success: Every user will have to choose a new password
       search:
         alert: No user found with email
       sessions:
@@ -324,6 +327,18 @@ en:
   errors:
     messages:
       disposable: is a disposable email address, use a permanent one
+  helpers:
+    hint:
+      trek/content_editor/image:
+        alt: For accessibility and SEO, describe what the image shows, without repeating the caption
+        credit: The author's name
+        text: Shown under the image
+      trek/content_editor/link:
+        href: Choose a page or enter a URL
+        title: Shown on hover, useful for accessibility and SEO
+      trek/content_editor/prompt:
+        href: Choose a page or enter a URL
+        title: Shown on hover, useful for accessibility and SEO
   notices:
     authentication_needed: Please log in
     password_renewal_needed: "Your password must be renewed: choose a new one"

data/config/locales/trek.fr.yml

@@ -6,23 +6,23 @@ fr:
         alt: Texte alternatif
         credit: Crédit
         file: Image
-        size: Taille
-        text: Légende
+        size: Largeur d'affichage
+        text: Légende de l'image
       trek/content_editor/link:
-        href: Adresse
-        target: Ouvrir dans
-        text: Texte
+        href: Lien vers
+        target: Ouvrir ce lien dans…
+        text: Texte du lien
         title: Titre
       trek/content_editor/prompt:
-        href: Adresse
-        target: Ouvrir dans
-        text: Texte
+        href: Lien vers
+        target: Ouvrir ce lien dans…
+        text: Texte du bouton
         title: Titre
     options:
       trek/content_editor/image:
         size:
           default: Comme la colonne de texte
-          larger: Plus large
+          larger: Dépasse sur les côtés
   activerecord:
     attributes:
       audit_log:
@@ -94,6 +94,7 @@ fr:
       browse: Parcourir…
       cancel: Annuler
       delete: Supprimer
+      download_original: Télécharger l'original
       edit: Éditer
       logout: Se déconnecter
       manage: Gérer
@@ -187,6 +188,7 @@ fr:
         intro: Fragment
       update:
         success: Fragment mis à jour
+    jobs: Tâches de fond
     metadata: Métadonnées
     navigation: Navigation
     pages:
@@ -237,6 +239,9 @@ fr:
         success: Clé d'accès ajoutée
       destroy:
         success: Clé d'accès supprimée
+    password_renewals:
+      create:
+        success: Chaque utilisateur devra choisir un nouveau mot de passe
     passwords_mailer:
       reset:
         subject: Nouveau mot de passe
@@ -298,8 +303,6 @@ fr:
         last_used: Utilisée il y a %{time}
         never_used: Jamais utilisée
         title: Se connecter sans mot de passe
-      require_password_renewal:
-        success: Chaque utilisateur devra choisir un nouveau mot de passe
       search:
         alert: Utilisateur non trouvé avec cette adresse e-mail
       sessions:
@@ -333,6 +336,18 @@ fr:
   errors:
     messages:
       disposable: est une adresse e-mail jetable, utilisez-en une permanente
+  helpers:
+    hint:
+      trek/content_editor/image:
+        alt: Pour l'accessibilité et le référencement, décrire le contenu de l'image, sans répéter le texte de la légende
+        credit: Indiquer le nom de l'auteur
+        text: Sera affichée sous l'image
+      trek/content_editor/link:
+        href: Choisir une page ou entrer une URL
+        title: Affiché au survol, utile pour l'accessibilité et le référencement
+      trek/content_editor/prompt:
+        href: Choisir une page ou entrer une URL
+        title: Affiché au survol, utile pour l'accessibilité et le référencement
   notices:
     authentication_needed: Veuillez vous connecter
     password_renewal_needed: "Votre mot de passe doit être renouvelé : choisissez-en un nouveau"

data/docs/.vitepress/config.mjs

@@ -53,9 +53,11 @@ export default defineConfig({
           text: 'Guides',
           items: [
             { text: 'How to customize Trek', link: '/customize' },
+            { text: 'Content editor', link: '/content-editor' },
             { text: 'Deploying to Scalingo', link: '/deploy' },
             { text: 'IP addresses behind a proxy', link: '/proxies' },
-            { text: 'Security and compliance', link: '/security' }
+            { text: 'Security and compliance', link: '/security' },
+            { text: 'Background jobs', link: '/background-jobs' }
           ]
         },
         {
@@ -77,6 +79,7 @@ export default defineConfig({
             { text: 'Scaffold', link: '/reference/generators/scaffold' },
             { text: 'Taxonomies', link: '/reference/generators/taxonomies' },
             { text: 'Audit log', link: '/reference/generators/audit-log' },
+            { text: 'Public accounts', link: '/reference/generators/public-accounts' },
             { text: 'Security headers', link: '/reference/generators/security-headers' }
           ]
         },