trusty-cms 7.1.2 → 7.2

data/spec/helpers/admin/pages_helper_spec.rb

@@ -0,0 +1,84 @@
+require 'spec_helper'
+
+# Exercises Admin::PagesHelper — small presentation helpers used by the page
+# editor (class/filter lookups, meta-error detection, description cleanup,
+# parent-page select options, and the revert confirmation copy).
+describe Admin::PagesHelper, type: :helper do
+  describe '#class_of_page' do
+    it 'returns the assigned page class' do
+      helper.instance_variable_set(:@page, Page.new)
+      expect(helper.class_of_page).to eq(Page)
+    end
+  end
+
+  describe '#filter' do
+    it "returns the first part's filter when parts are present" do
+      part = double('PagePart', filter: 'markdown')
+      helper.instance_variable_set(:@page, double('Page', parts: [part]))
+      expect(helper.filter).to eq('markdown')
+    end
+
+    it 'returns nil when there are no parts' do
+      helper.instance_variable_set(:@page, double('Page', parts: []))
+      expect(helper.filter).to be_nil
+    end
+  end
+
+  describe '#meta_errors?' do
+    # Admin::PagesHelper#meta_errors? is shadowed by ApplicationHelper#meta_errors?
+    # in the view ancestry, so `helper.meta_errors?` would call the wrong one.
+    # Bind this module's implementation to the helper to exercise it directly.
+    def meta_errors?
+      Admin::PagesHelper.instance_method(:meta_errors?).bind(helper).call
+    end
+
+    it 'is true when slug has an error' do
+      page = Page.new
+      page.errors.add(:slug, 'is invalid')
+      helper.instance_variable_set(:@page, page)
+      expect(meta_errors?).to be(true)
+    end
+
+    # NOTE: latent bug — errors[:attr] returns an array, and an empty array is
+    # truthy, so `!!(errors[:slug] or errors[:breadcrumb])` is true even with no
+    # meta errors. This implementation always returns true; characterizing it.
+    it 'also (incorrectly) returns true when there are no meta errors' do
+      helper.instance_variable_set(:@page, Page.new)
+      expect(meta_errors?).to be(true)
+    end
+  end
+
+  describe '#clean_page_description' do
+    it 'strips leading/trailing whitespace and collapses internal runs' do
+      page = double('Page', description: '  hello    world  ')
+      expect(helper.clean_page_description(page)).to eq('hello world')
+    end
+
+    it 'removes tab characters entirely' do
+      page = double('Page', description: "tab\there")
+      expect(helper.clean_page_description(page)).to eq('tabhere')
+    end
+  end
+
+  describe '#parent_page_options' do
+    it 'builds options_for_select from the available parent pages' do
+      home = FactoryBot.create(:home, title: 'Home')
+      child = FactoryBot.create(:page, title: 'Child', slug: 'child', parent: home)
+      current_site = double('Site', homepage_id: home.id)
+      allow(Page).to receive(:parent_pages).with(home.id).and_return([home])
+
+      html = helper.parent_page_options(current_site, child)
+
+      expect(html).to include('Home')
+      expect(html).to include("value=\"#{home.id}\"")
+    end
+  end
+
+  describe '#revert_confirmation_message' do
+    it 'includes the version date and time' do
+      message = helper.revert_confirmation_message(update_date: 'July 29, 2026', update_time: '10:00 AM')
+      expect(message).to include('July 29, 2026')
+      expect(message).to include('10:00 AM')
+    end
+  end
+end

data/spec/helpers/admin/references_helper_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+
+describe Admin::ReferencesHelper, type: :helper do
+  describe '#class_of_page' do
+    it 'defaults to Page when no class_name param is present' do
+      allow(helper).to receive(:params).and_return({})
+      expect(helper.class_of_page).to eq(Page)
+    end
+
+    it 'constantizes the class_name param' do
+      allow(helper).to receive(:params).and_return(class_name: 'FileNotFoundPage')
+      expect(helper.class_of_page).to eq(FileNotFoundPage)
+    end
+  end
+
+  describe '#filter' do
+    it 'is nil for an unknown filter name' do
+      allow(helper).to receive(:params).and_return(filter_name: 'No Such Filter')
+      expect(helper.filter).to be_nil
+    end
+
+    it 'finds a text filter by its filter_name' do
+      HamlFilter # ensure the descendant is autoloaded
+      allow(helper).to receive(:params).and_return(filter_name: 'Haml')
+      expect(helper.filter).to eq(HamlFilter)
+    end
+  end
+
+  describe '#filter_reference' do
+    it 'explains when there is no filter on the page part' do
+      allow(helper).to receive(:params).and_return({})
+      expect(helper.filter_reference).to eq('There is no filter on the current page part.')
+    end
+
+    it 'explains when a filter has no documentation' do
+      HamlFilter
+      allow(helper).to receive(:params).and_return(filter_name: 'Haml')
+      expect(helper.filter_reference).to eq('There is no documentation on this filter.')
+    end
+  end
+
+  describe '#_display_name' do
+    it 'returns the page class display name for tags' do
+      allow(helper).to receive(:params).and_return(type: 'tags')
+      expect(helper._display_name).to eq(Page.display_name)
+    end
+
+    it 'returns the filter name for filters' do
+      HamlFilter
+      allow(helper).to receive(:params).and_return(type: 'filters', filter_name: 'Haml')
+      expect(helper._display_name).to eq('Haml')
+    end
+  end
+end

data/spec/helpers/admin/url_helper_spec.rb

@@ -0,0 +1,71 @@
+require 'spec_helper'
+
+describe Admin::UrlHelper, type: :helper do
+  describe '#format_path' do
+    it 'returns an empty string for a root or empty path' do
+      expect(helper.format_path('')).to eq('')
+      expect(helper.format_path('/')).to eq('')
+    end
+
+    it 'returns "Root" for a single segment' do
+      expect(helper.format_path('foo')).to eq('Root')
+    end
+
+    it 'returns "/" for two segments' do
+      expect(helper.format_path('foo/bar')).to eq('/')
+    end
+
+    it 'returns the middle subpath for deeper paths' do
+      expect(helper.format_path('foo/bar/baz')).to eq('/bar')
+      expect(helper.format_path('foo/bar/baz/qux')).to eq('/bar/baz')
+    end
+  end
+
+  describe '#extract_base_url' do
+    it 'keeps the scheme and host for a normal url' do
+      expect(helper.extract_base_url('http://example.com/some/page')).to eq('http://example.com')
+    end
+
+    it 'preserves the port for localhost urls' do
+      expect(helper.extract_base_url('http://localhost:3000/some/page')).to eq('http://localhost:3000')
+    end
+  end
+
+  describe '#default_route?' do
+    it 'is true for a plain Page' do
+      expect(helper.default_route?(Page.new)).to be(true)
+    end
+
+    it 'is false for a page subclass with no configured route' do
+      expect(helper.default_route?(FileNotFoundPage.new)).to be_falsey
+    end
+  end
+
+  describe '#lookup_page_path' do
+    it 'returns nil when no custom routes are configured' do
+      expect(helper.lookup_page_path(FileNotFoundPage.new)).to be_nil
+    end
+  end
+
+  describe '#build_url' do
+    it 'appends the page path for default-route pages' do
+      page = Page.new
+      allow(page).to receive(:path).and_return('/about')
+
+      expect(helper.build_url('http://example.com', page)).to eq('http://example.com/about')
+    end
+
+    it 'returns nil for a non-default page with no configured path' do
+      expect(helper.build_url('http://example.com', FileNotFoundPage.new)).to be_nil
+    end
+  end
+
+  describe '#generate_page_url' do
+    it 'combines the base url and page path' do
+      page = Page.new
+      allow(page).to receive(:path).and_return('/about')
+
+      expect(helper.generate_page_url('http://example.com/current', page)).to eq('http://example.com/about')
+    end
+  end
+end

data/spec/helpers/application_helper_spec.rb

@@ -0,0 +1,217 @@
+require 'spec_helper'
+
+describe ApplicationHelper, type: :helper do
+  describe 'title and subtitle' do
+    it 'falls back to the default title and subtitle' do
+      allow(helper).to receive(:trusty_config).and_return({})
+
+      expect(helper.title).to eq('Trusty CMS')
+      expect(helper.subtitle).to eq('Publishing for Small Teams')
+      expect(helper.default_page_title).to eq('Trusty CMS - Publishing for Small Teams')
+    end
+
+    it 'uses the configured title and subtitle when present' do
+      allow(helper).to receive(:trusty_config)
+        .and_return('admin.title' => 'My Admin', 'admin.subtitle' => 'My Subtitle')
+
+      expect(helper.title).to eq('My Admin')
+      expect(helper.subtitle).to eq('My Subtitle')
+      expect(helper.default_page_title).to eq('My Admin - My Subtitle')
+    end
+  end
+
+  describe '#logged_in?' do
+    it 'is true when there is a current user' do
+      allow(helper).to receive(:current_user).and_return(User.new)
+      expect(helper.logged_in?).to be(true)
+    end
+
+    it 'is false when there is no current user' do
+      allow(helper).to receive(:current_user).and_return(nil)
+      expect(helper.logged_in?).to be(false)
+    end
+  end
+
+  describe '#admin? and #designer?' do
+    it 'reflects an admin user' do
+      user = instance_double(User, admin?: true, designer?: false)
+      allow(helper).to receive(:current_user).and_return(user)
+
+      expect(helper.admin?).to be(true)
+      expect(helper.designer?).to be(true)
+    end
+
+    it 'treats a designer as a designer but not an admin' do
+      user = instance_double(User, admin?: false, designer?: true)
+      allow(helper).to receive(:current_user).and_return(user)
+
+      expect(helper.admin?).to be(false)
+      expect(helper.designer?).to be(true)
+    end
+
+    it 'is false for both when there is no current user' do
+      allow(helper).to receive(:current_user).and_return(nil)
+
+      expect(helper.admin?).to be_falsey
+      expect(helper.designer?).to be_falsey
+    end
+  end
+
+  describe '#meta_errors? and #meta_label' do
+    it 'reports no meta errors and a "More" label' do
+      expect(helper.meta_errors?).to be(false)
+      expect(helper.meta_label).to eq('More')
+    end
+  end
+
+  describe '#translate_with_default' do
+    it 'returns the given name when there is no translation' do
+      expect(helper.translate_with_default('Some Untranslated Name')).to eq('Some Untranslated Name')
+    end
+  end
+
+  describe '#clean' do
+    it 'collapses duplicate slashes and strips a trailing slash from the path' do
+      expect(helper.clean('http://example.com/a//b/')).to eq('/a/b')
+    end
+  end
+
+  describe '#append_image_extension' do
+    it 'appends .png when no extension is present' do
+      expect(helper.send(:append_image_extension, 'admin/foo')).to eq('admin/foo.png')
+    end
+
+    it 'leaves an existing extension untouched' do
+      expect(helper.send(:append_image_extension, 'admin/foo.gif')).to eq('admin/foo.gif')
+    end
+  end
+
+  describe '#available_locales_select' do
+    it 'prepends a default option with a blank value' do
+      expect(helper.available_locales_select.first.last).to eq('')
+    end
+  end
+
+  describe '#body_classes' do
+    it 'starts as an empty, memoized array' do
+      expect(helper.body_classes).to eq([])
+      helper.body_classes << 'reversed'
+      expect(helper.body_classes).to eq(['reversed'])
+    end
+  end
+
+  describe '#onsubmit_status' do
+    it 'reports a creating status for a new record' do
+      expect(helper.onsubmit_status(Snippet.new)).to match(/creat/i)
+    end
+
+    it 'reports a saving status for a persisted record' do
+      snippet = FactoryBot.create(:snippet, name: 'saved')
+      expect(helper.onsubmit_status(snippet)).to match(/saving/i)
+    end
+  end
+
+  describe '#save_model_button' do
+    it 'labels the button Create for a new record' do
+      html = helper.save_model_button(Snippet.new)
+      expect(html).to include('type="submit"')
+      expect(html).to match(/Create/)
+    end
+
+    it 'labels the button Save Changes for a persisted record' do
+      snippet = FactoryBot.create(:snippet, name: 'persisted')
+      expect(helper.save_model_button(snippet)).to match(/Save Changes/)
+    end
+  end
+
+  describe '#save_model_and_continue_editing_button' do
+    it 'renders a continue submit button' do
+      html = helper.save_model_and_continue_editing_button(Snippet.new)
+      expect(html).to include('name="continue"')
+    end
+  end
+
+  describe '#image' do
+    # Stub image_tag so the test exercises the path-building logic without doing
+    # a real asset-pipeline lookup (which warns for assets not in the pipeline).
+    before { allow(helper).to receive(:image_tag) { |path, _opts| path } }
+
+    it 'builds an admin image path, defaulting the extension to .png' do
+      helper.image('foo', alt: 'Foo')
+      expect(helper).to have_received(:image_tag).with('admin/foo.png', { alt: 'Foo' })
+    end
+
+    it 'keeps an explicit extension' do
+      helper.image('bar.gif')
+      expect(helper).to have_received(:image_tag).with('admin/bar.gif', {})
+    end
+  end
+
+  describe '#timestamp' do
+    it 'localizes the time with the :timestamp format' do
+      time = Time.zone.local(2026, 7, 29, 10, 0, 0)
+      expect(helper.timestamp(time)).to eq(I18n.localize(time, format: :timestamp))
+    end
+  end
+
+  describe '#updated_stamp' do
+    it 'returns nil for a new record' do
+      expect(helper.updated_stamp(Snippet.new)).to be_nil
+    end
+
+    it 'renders an updated line for a persisted record' do
+      snippet = FactoryBot.create(:snippet, name: 'stamped')
+      html = helper.updated_stamp(snippet)
+      expect(html).to include('updated_line')
+    end
+  end
+
+  describe 'asset overrides' do
+    it 'returns no stylesheet overrides when the override files are absent' do
+      expect(helper.stylesheet_overrides).to eq([])
+    end
+
+    it 'returns no javascript overrides when the override file is absent' do
+      expect(helper.javascript_overrides).to eq([])
+    end
+
+    it 'includes the stylesheet override when the file exists' do
+      allow(File).to receive(:exist?).and_return(true)
+      expect(helper.stylesheet_overrides).to eq(['admin/overrides'])
+    end
+
+    it 'includes the javascript override when the file exists' do
+      allow(File).to receive(:exist?).and_return(true)
+      expect(helper.javascript_overrides).to eq(['admin/overrides'])
+    end
+  end
+
+  describe '#current_url?' do
+    it 'matches the current request path' do
+      allow(helper.request).to receive(:original_fullpath).and_return('/admin/pages/1/edit')
+      expect(helper.current_url?('/admin/pages')).to be_truthy
+    end
+
+    it 'does not match an unrelated path' do
+      allow(helper.request).to receive(:original_fullpath).and_return('/admin/snippets')
+      expect(helper.current_url?('/admin/pages')).to be_falsey
+    end
+  end
+
+  describe '#current_tab?' do
+    it 'is true for a tab containing the current url and memoizes it' do
+      item = double('NavItem', relative_url: '/admin/pages')
+      tab = [item]
+      allow(helper).to receive(:current_url?).with('/admin/pages').and_return(true)
+
+      expect(helper.current_tab?(tab)).to be(true)
+      expect(helper.instance_variable_get(:@current_tab)).to eq(tab)
+    end
+  end
+
+  describe '#pagination_for' do
+    it 'returns nil for a collection that is not paginatable' do
+      expect(helper.pagination_for(%w[a b c])).to be_nil
+    end
+  end
+end

data/spec/helpers/scoped_helper_spec.rb

@@ -0,0 +1,60 @@
+require 'spec_helper'
+
+describe ScopedHelper do
+  # ScopedHelper defines #title/#subtitle on its includer (via the included
+  # hook) and reads from #current_site, so mix it into a small host class and
+  # stub current_site rather than fight ApplicationHelper's own title/subtitle.
+  let(:host_class) do
+    Class.new do
+      include ScopedHelper
+      attr_accessor :site
+      def current_site
+        site
+      end
+    end
+  end
+
+  subject(:helper) { host_class.new }
+
+  def site_double(name:, subtitle:)
+    double('site', name: name, subtitle: subtitle)
+  end
+
+  describe '#title' do
+    it 'uses the current site name when present' do
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.title).to eq('My Site')
+    end
+
+    it 'falls back to the configured admin title when the site name is blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.title').and_return('Configured Title')
+      helper.site = site_double(name: '', subtitle: '')
+      expect(helper.title).to eq('Configured Title')
+    end
+
+    it 'falls back to the default when both the site name and config are blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.title').and_return(nil)
+      helper.site = site_double(name: '', subtitle: '')
+      expect(helper.title).to eq('TrustyCMS')
+    end
+  end
+
+  describe '#subtitle' do
+    it 'uses the current site subtitle when present' do
+      helper.site = site_double(name: 'My Site', subtitle: 'My Subtitle')
+      expect(helper.subtitle).to eq('My Subtitle')
+    end
+
+    it 'falls back to the configured admin subtitle when the site subtitle is blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.subtitle').and_return('Configured Subtitle')
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.subtitle).to eq('Configured Subtitle')
+    end
+
+    it 'falls back to the default when both the site subtitle and config are blank' do
+      allow(TrustyCms::Config).to receive(:[]).with('admin.subtitle').and_return(nil)
+      helper.site = site_double(name: 'My Site', subtitle: '')
+      expect(helper.subtitle).to eq('publishing for small teams')
+    end
+  end
+end

data/spec/lib/active_record_extensions_spec.rb

@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+# ActiveRecord::Base monkeypatches. object_id_attr in particular relies on
+# .descendants and generated accessors, so pin its behaviour ahead of any
+# Rails upgrade. Exercised through PagePart, which uses it in production.
+describe 'ActiveRecord extensions' do
+  describe '.object_id_attr' do
+    it 'instantiates the matching descendant for the stored id' do
+      HamlFilter # ensure the descendant is autoloaded
+      part = PagePart.new(filter_id: 'Haml')
+      expect(part.filter).to be_a(HamlFilter)
+    end
+
+    it 'falls back to the base class when no descendant matches' do
+      part = PagePart.new(filter_id: nil)
+      expect(part.filter.class).to eq(TextFilter)
+    end
+
+    it 'memoises the built object until the id changes' do
+      part = PagePart.new(filter_id: nil)
+      first = part.filter
+      expect(part.filter).to equal(first)
+
+      HamlFilter
+      part.filter_id = 'Haml'
+      expect(part.filter).to be_a(HamlFilter)
+    end
+  end
+
+  describe '.validates_path' do
+    let(:model_class) do
+      Class.new(PageField) do
+        validates_path :content
+        def self.name
+          'PathValidatedField'
+        end
+      end
+    end
+
+    it 'is valid when the value resolves to a real page' do
+      page = FactoryBot.create(:page, slug: '/', status_id: Status[:published].id)
+      allow(Page).to receive(:find_by_path).and_return(page)
+
+      record = model_class.new(name: 'ref', content: '/')
+      record.valid?
+      expect(record.errors[:content]).to be_empty
+    end
+
+    it 'adds an error when the path is not found' do
+      allow(Page).to receive(:find_by_path).and_return(nil)
+
+      record = model_class.new(name: 'ref', content: '/missing')
+      record.valid?
+      expect(record.errors[:content]).to be_present
+    end
+
+    it 'adds an error when the path resolves to a FileNotFoundPage' do
+      allow(Page).to receive(:find_by_path).and_return(FileNotFoundPage.new)
+
+      record = model_class.new(name: 'ref', content: '/404')
+      record.valid?
+      expect(record.errors[:content]).to be_present
+    end
+  end
+end

data/spec/lib/login_system_spec.rb

@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+# LoginSystem is TrustyCms's custom role-based authorization layer, mixed into
+# ApplicationController. The class-level access rules are pure logic, so pin
+# them ahead of any Rails upgrade without needing a full request cycle.
+describe LoginSystem do
+  describe 'role-based access (.only_allow_access_to / .user_has_access_to_action?)' do
+    let(:controller_class) do
+      Class.new(ActionController::Base) do
+        include LoginSystem
+        only_allow_access_to :index, :show,
+                             when: %i[admin designer],
+                             denied_message: 'You need editor privileges.'
+      end
+    end
+
+    it 'records the declared permissions per action' do
+      perms = controller_class.controller_permissions[:index]
+      expect(perms[:when]).to eq(%i[admin designer])
+      expect(perms[:denied_message]).to eq('You need editor privileges.')
+    end
+
+    it 'grants access to a user with an allowed role' do
+      expect(controller_class.user_has_access_to_action?(User.new(admin: true), :index)).to be(true)
+      expect(controller_class.user_has_access_to_action?(User.new(designer: true), :show)).to be(true)
+    end
+
+    it 'denies a user without an allowed role' do
+      expect(controller_class.user_has_access_to_action?(User.new, :index)).to be(false)
+    end
+
+    it 'denies an anonymous (nil) user' do
+      expect(controller_class.user_has_access_to_action?(nil, :index)).to be(false)
+    end
+
+    it 'allows any action that has no declared restriction' do
+      expect(controller_class.user_has_access_to_action?(User.new, :unlisted_action)).to be(true)
+    end
+  end
+
+  describe 'conditional access (:if)' do
+    let(:controller_class) do
+      Class.new(ActionController::Base) do
+        include LoginSystem
+        only_allow_access_to :index, if: :allowed?
+        def allowed?
+          true
+        end
+      end
+    end
+
+    it 'delegates to the named predicate on the controller' do
+      expect(controller_class.user_has_access_to_action?(User.new, :index)).to be(true)
+    end
+  end
+
+  # NOTE: .login_required? / .login_required reference `filter_chain`, a Rails
+  # API removed years ago, and would raise NoMethodError if called. They are
+  # dead code today (only commented-out call sites remain), so they are not
+  # exercised here. Flagging for removal or repair rather than pinning.
+end

data/spec/lib/ostruct_spec.rb

@@ -0,0 +1,33 @@
+require 'spec_helper'
+require 'ostruct'
+
+# lib/ostruct.rb reopens OpenStruct (originally patched for a Ruby upgrade) and
+# shadows the stdlib version via the load path. This is exactly the kind of
+# patch a Ruby/Rails upgrade can break, so pin the behaviour we rely on.
+describe 'OpenStruct patch' do
+it 'is the project patch, not the stdlib implementation' do
+  expect(OpenStruct.instance_method(:initialize).source_location.first)
+    .to eq(File.expand_path('../../lib/ostruct.rb', __dir__))
+end
+
+  it 'builds accessors from a hash, symbolizing string keys' do
+    os = OpenStruct.new('a' => 1, :b => 2)
+    expect(os.a).to eq(1)
+    expect(os.b).to eq(2)
+  end
+
+  it 'returns nil for an unset member' do
+    expect(OpenStruct.new.anything).to be_nil
+  end
+
+  it 'assigns and reads a member dynamically' do
+    os = OpenStruct.new
+    os.foo = 'bar'
+    expect(os.foo).to eq('bar')
+  end
+
+  it 'raises ArgumentError when a setter is given the wrong arity' do
+    os = OpenStruct.new
+    expect { os.send(:foo=, 1, 2) }.to raise_error(ArgumentError)
+  end
+end