upload_d_n_d 0.9.1

data/app/jobs/upload_d_n_d/purge_rejected_blob_job.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module UploadDND
+  # Purge un blob refusé (cf. UploadDND::RejectedBlob).
+  #
+  # Contrairement à ActiveStorage::PurgeJob, revérifie au moment de
+  # l'exécution que le blob n'a toujours aucun attachment : il a pu être
+  # rattaché entre le refus et l'exécution du job (nouvel essai réussi avec le
+  # même signed_id). L'âge n'est pas revérifié : il a été contrôlé au refus, et
+  # le délai de la file ne doit pas empêcher la purge.
+  class PurgeRejectedBlobJob < ApplicationJob
+    queue_as { ActiveStorage.queues[:purge] }
+
+    retry_on ActiveRecord::Deadlocked, attempts: 10, wait: :polynomially_longer
+
+    def perform(blob_id)
+      blob = ActiveStorage::Blob.find_by(id: blob_id)
+      return unless blob
+      return unless UploadDND::RejectedBlob.unattached?(blob)
+
+      blob.purge
+    end
+  end
+end

data/app/models/upload_d_n_d/application_record.rb

@@ -0,0 +1,5 @@
+module UploadDND
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/upload_d_n_d/temporary_attachment.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+module UploadDND
+  class TemporaryAttachment < ApplicationRecord
+    self.table_name = "upload_d_n_d_temporary_attachments"
+
+    # Association avec ActiveStorage
+    has_one_attached :blob
+
+    # Validations
+    validates :session_id, presence: true
+    validates :attribute_name, presence: true
+
+    # Scopes
+    scope :for_session, ->(session_id) { where(session_id: session_id) }
+    scope :for_attribute, ->(attribute_name) { where(attribute_name: attribute_name) }
+    scope :for_user, ->(user_id) { where(user_id: user_id) }
+    scope :expired, -> {
+      retention_days = UploadDND.configuration.temporary_files_retention || 7
+      where("created_at < ?", retention_days.days.ago)
+    }
+    # Eager load blob attachments to prevent N+1 queries
+    scope :with_blobs, -> { includes(blob_attachment: :blob) }
+
+    # Callbacks
+    before_destroy :purge_blob
+
+    # Méthodes de classe
+    class << self
+      # Nettoie les fichiers temporaires expirés
+      # À appeler via un job cron ou Sidekiq
+      def cleanup_expired!
+        expired.find_each do |attachment|
+          attachment.destroy
+        end
+      end
+
+      # Attache tous les fichiers temporaires d'une session à un record
+      #
+      # @param session_id [String] l'ID de session
+      # @param record [ApplicationRecord] le record cible
+      # @param attribute_map [Hash] mapping des attributs (optionnel)
+      #
+      # @example
+      #   TemporaryAttachment.attach_to_record(
+      #     session.id.to_s,
+      #     @user,
+      #     { 'avatar' => :avatar, 'documents' => :documents }
+      #   )
+      def attach_to_record(session_id, record, attribute_map = {})
+        for_session(session_id).find_each do |temp_attachment|
+          source_attr = temp_attachment.attribute_name
+          target_attr = attribute_map[source_attr]&.to_s || source_attr
+
+          # SÉCURITÉ : attribute_name vient du client — seul un attachment
+          # déclaré sur le modèle est résolu, jamais une méthode quelconque.
+          attachment = UploadDND::AttachmentLookup.find(record, target_attr)
+          unless attachment
+            temp_attachment.destroy
+            next
+          end
+
+          blob_attachment = temp_attachment.blob_attachment
+          if blob_attachment.nil? || temp_attachment.violates_constraints_of?(record, target_attr)
+            temp_attachment.destroy
+            next
+          end
+
+          if attachment.is_a?(ActiveStorage::Attached::Many)
+            blob_attachment.update!(record: record, name: target_attr)
+          elsif attachment.is_a?(ActiveStorage::Attached::One)
+            if attachment.attached?
+              temp_attachment.destroy
+              next
+            end
+            blob_attachment.update!(record: record, name: target_attr)
+          end
+
+          temp_attachment.reload
+          temp_attachment.destroy
+        end
+      end
+    end
+
+    # Méthodes d'instance
+
+    # Le transfert vers le record ne passe pas par la validation du modèle :
+    # les limites du champ cible sont vérifiées ici. Couvre aussi un dépôt
+    # fait sans référence de champ (limites globales seulement).
+    def violates_constraints_of?(record, attribute_name)
+      violation = UploadDND::FieldConstraints.for(record.class, attribute_name).violation(blob.blob)
+      return false unless violation
+
+      Rails.logger.warn "UploadDND: temporary file #{id} refused on transfer to " \
+                        "#{record.class}##{attribute_name} - #{violation}"
+      true
+    end
+    def filename
+      blob.blob.filename.to_s if blob.attached?
+    end
+
+    def content_type
+      blob.blob.content_type if blob.attached?
+    end
+
+    def byte_size
+      blob.blob.byte_size if blob.attached?
+    end
+
+    def url
+      # polymorphic_url respecte config.active_storage.resolve_model_to_route
+      # de l'app hôte (:rails_storage_redirect par défaut, :rails_storage_proxy
+      # pour servir les blobs en same-origin — CSP stricte, bucket externe).
+      # only_path: true explicite : la forme _path ne le propage pas aux
+      # routes `resolve` d'ActiveStorage hors contexte de requête.
+      Rails.application.routes.url_helpers.polymorphic_url(blob.blob, only_path: true) if blob.attached?
+    end
+
+    private
+
+    def purge_blob
+      # Si l'attachment ActiveStorage a été "déplacé" vers un autre record,
+      # `blob_attachment` sera nil (après reload) -> on ne purge rien.
+      return unless blob_attachment
+
+      blob.purge if blob.attached?
+    end
+  end
+end

data/app/views/upload_d_n_d/shared/_file_icon.html.erb

@@ -0,0 +1,9 @@
+<%# Icône selon le type de fichier. Surchargez ce partial dans votre app
+    (app/views/upload_d_n_d/shared/_file_icon.html.erb) pour personnaliser. %>
+<% if blob.image? %>
+  <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"/><path d="M14 2v5a1 1 0 0 0 1 1h5"/><circle cx="10" cy="12" r="2"/><path d="m20 17-1.296-1.296a2.41 2.41 0 0 0-3.408 0L9 22"/></svg>
+<% elsif blob.content_type == 'application/pdf' %>
+  <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"/><path d="M14 2v5a1 1 0 0 0 1 1h5"/><path d="M10 9H8"/><path d="M16 13H8"/><path d="M16 17H8"/></svg>
+<% else %>
+  <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6 22a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h8a2.4 2.4 0 0 1 1.704.706l3.588 3.588A2.4 2.4 0 0 1 20 8v12a2 2 0 0 1-2 2z"/><path d="M14 2v5a1 1 0 0 0 1 1h5"/></svg>
+<% end %>

data/app/views/upload_d_n_d/shared/_files_list.html.erb

@@ -0,0 +1,63 @@
+<div id="udnd_files_list_<%= attribute_name %>" class="udnd-files-list">
+  <% attachments = record&.send(attribute_name) %>
+  <% if attachments.present? && attachments.attached? %>
+    <ul class="udnd-file-items">
+      <%
+        # Récupère les attachments ActiveStorage (pas les blobs)
+        attachment_list = if attachments.respond_to?(:each)
+          attachments # has_many_attached retourne déjà les attachments
+        else
+          [attachments] # has_one_attached, on met dans un array
+        end
+      %>
+      <% attachment_list.each do |attachment| %>
+        <% blob = attachment.blob %>
+        <li class="udnd-file-item" id="<%= dom_id(attachment) %>">
+          <div class="udnd-file-info">
+            <span class="udnd-file-icon">
+              <%= render "upload_d_n_d/shared/file_icon", blob: blob %>
+            </span>
+            <div class="udnd-file-details">
+              <span class="udnd-filename"><%= blob.filename.to_s.truncate(30) %></span>
+              <span class="udnd-filesize"><%= number_to_human_size(blob.byte_size) %></span>
+            </div>
+          </div>
+
+          <% delete_url = udnd_remove_file_url(record, attachment, attribute_name) %>
+
+          <div class="udnd-file-actions">
+            <%# Bouton de prévisualisation (images et PDFs uniquement) %>
+            <% if blob.image? || blob.content_type == 'application/pdf' %>
+              <button type="button"
+                      class="udnd-btn-preview"
+                      data-controller="upload-d-n-d--preview"
+                      data-action="click->upload-d-n-d--preview#open"
+                      data-preview-url="<%= main_app.polymorphic_path(blob, disposition: "inline") %>"
+                      data-preview-filename="<%= blob.filename %>"
+                      data-preview-content-type="<%= blob.content_type %>"
+                      data-preview-i18n-unavailable="<%= t('upload_d_n_d.javascript.preview.unavailable') %>"
+                      data-preview-i18n-download="<%= t('upload_d_n_d.javascript.preview.download') %>"
+                      data-preview-i18n-close="<%= t('upload_d_n_d.javascript.preview.close') %>"
+                      title="<%= t('upload_d_n_d.preview_file') %>"
+                      aria-label="<%= t('upload_d_n_d.preview_file') %> : <%= blob.filename %>">
+                <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"/><circle cx="12" cy="12" r="3"/></svg>
+              </button>
+            <% end %>
+
+            <%# Bouton de suppression %>
+            <button type="button"
+                    class="udnd-btn-remove"
+                    data-action="click->upload-d-n-d--uploads#confirmDelete"
+                    data-url="<%= delete_url %>"
+                    title="<%= t('upload_d_n_d.delete_file') %>"
+                    aria-label="<%= t('upload_d_n_d.delete_file') %> : <%= blob.filename %>">
+              <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></svg>
+            </button>
+          </div>
+        </li>
+      <% end %>
+    </ul>
+  <% else %>
+    <p class="udnd-no-files"><%= t('upload_d_n_d.no_files', default: 'Aucun fichier') %></p>
+  <% end %>
+</div>

data/app/views/upload_d_n_d/shared/_temp_files_list.html.erb

@@ -0,0 +1,53 @@
+<%# app/views/upload_d_n_d/shared/_temp_files_list.html.erb %>
+<div id="udnd_files_list_<%= attribute_name %>" class="udnd-files-list">
+  <% if files.any? %>
+    <ul class="udnd-file-items">
+      <% files.each do |temp_attachment| %>
+        <% blob = temp_attachment.blob.blob %>
+        <li class="udnd-file-item" id="temp_<%= temp_attachment.id %>">
+          <div class="udnd-file-info">
+            <span class="udnd-file-icon">
+              <%= render "upload_d_n_d/shared/file_icon", blob: blob %>
+            </span>
+            <div class="udnd-file-details">
+              <span class="udnd-filename"><%= blob.filename.to_s.truncate(30) %></span>
+              <span class="udnd-filesize"><%= number_to_human_size(blob.byte_size) %></span>
+            </div>
+          </div>
+
+          <div class="udnd-file-actions">
+            <%# Bouton de prévisualisation (images et PDFs uniquement) %>
+            <% if blob.image? || blob.content_type == 'application/pdf' %>
+              <button type="button"
+                      class="udnd-btn-preview"
+                      data-controller="upload-d-n-d--preview"
+                      data-action="click->upload-d-n-d--preview#open"
+                      data-preview-url="<%= main_app.polymorphic_path(blob, disposition: "inline") %>"
+                      data-preview-filename="<%= blob.filename %>"
+                      data-preview-content-type="<%= blob.content_type %>"
+                      data-preview-i18n-unavailable="<%= t('upload_d_n_d.javascript.preview.unavailable') %>"
+                      data-preview-i18n-download="<%= t('upload_d_n_d.javascript.preview.download') %>"
+                      data-preview-i18n-close="<%= t('upload_d_n_d.javascript.preview.close') %>"
+                      title="<%= t('upload_d_n_d.preview_file') %>"
+                      aria-label="<%= t('upload_d_n_d.preview_file') %> : <%= blob.filename %>">
+                <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"/><circle cx="12" cy="12" r="3"/></svg>
+              </button>
+            <% end %>
+
+            <%# Bouton de suppression %>
+            <button type="button"
+                    class="udnd-btn-remove"
+                    data-action="click->upload-d-n-d--uploads#confirmDelete"
+                    data-url="<%= UploadDND::Engine.routes.url_helpers.temporary_attachment_path(temp_attachment) %>"
+                    title="<%= t('upload_d_n_d.delete_file') %>"
+                    aria-label="<%= t('upload_d_n_d.delete_file') %> : <%= blob.filename %>">
+              <svg class="udnd-icon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></svg>
+            </button>
+          </div>
+        </li>
+      <% end %>
+    </ul>
+  <% else %>
+    <p class="udnd-no-files"><%= t('upload_d_n_d.no_files', default: 'Aucun fichier sélectionné') %></p>
+  <% end %>
+</div>

data/config/importmap.rb

@@ -0,0 +1,5 @@
+# Point d'entrée principal : import "upload_d_n_d" dans application.js
+pin "upload_d_n_d", to: "upload_d_n_d/index.js"
+
+# Pins individuels (pour import sélectif si besoin)
+pin_all_from File.expand_path("../app/javascript/upload_d_n_d/controllers", __dir__), under: "upload_d_n_d/controllers"

data/config/initializers/inflections.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# Acronymes de l'app
+# Permet notamment de constantiser correctement `upload_dnd/*` en `UploadDND::*`
+ActiveSupport::Inflector.inflections(:en) do |inflect|
+  inflect.acronym "DND"
+end
+
+ActiveSupport::Inflector.inflections(:fr) do |inflect|
+  inflect.acronym "DND"
+end

data/config/locales/upload_d_n_d.en.yml

@@ -0,0 +1,80 @@
+en:
+  upload_d_n_d:
+    drag_and_drop: "Drag and drop your files here or click to select"
+    no_files: "No files"
+    progress: "Upload progress"
+    preview_file: "Preview"
+    delete_file: "Delete"
+
+    errors:
+      blob_not_found: "File not found"
+      blob_already_attached: "This file is already in use elsewhere. Please upload it again."
+      corrupted: "The file appears to be corrupted or modified"
+      unrepresentable: "The file cannot be processed"
+      unauthorized: "You are not authorized to update this file"
+      invalid_type: "Invalid file type. Accepted formats: %{types}"
+      too_large: "File exceeds maximum size of %{max_size}"
+      suspicious_type: "The actual file type does not match the declared type"
+      mime_detection_failed: "Unable to verify file type."
+      bad_request: "Invalid request."
+      invalid_field_reference: "Invalid file field. Please reload the page."
+      max_files_exceeded: "You cannot add more than %{max} files"
+      file_not_found_or_denied: "File not found or access denied"
+      save_failed: "Save failed: %{errors}"
+      invalid_attribute: "Attribute %{attribute} does not exist"
+      not_active_storage_attachment: "Attribute %{attribute} is not an ActiveStorage attachment"
+      record_gid_required: "The record_gid parameter is required to attach to an existing record. Use /temporary_attachments for uploads without a record."
+      missing_params: "Missing parameters"
+      invalid_attribute_name: "Invalid attribute name"
+      invalid_blob_signature: "Invalid blob signature"
+      record_not_found: "Record not found"
+      upload_error: "An error occurred during upload"
+      authentication_required: "You must be logged in to upload files"
+      invalid_file_token: "Invalid file token"
+      rate_limited: "Too many requests. Please wait %{seconds} seconds."
+
+    success:
+      file_added: "File added successfully"
+      file_removed: "File removed successfully"
+      file_uploaded: "File uploaded successfully"
+
+    confirmations:
+      delete_file: "Are you sure you want to delete this file?"
+      replace_file: "A file is already attached. Do you want to replace it?"
+
+    javascript:
+      alerts:
+        single_file_only:
+          title: "Single file only"
+          text: "You can only upload one file for this field."
+        upload_error:
+          title: "Error"
+          text: "Unable to upload file"
+        file_too_large:
+          title: "Too large"
+          text: "Max: %{max_size}MB"
+        empty_file:
+          title: "Empty file"
+          text: "File cannot be empty"
+        invalid_format:
+          title: "Invalid format"
+          text: "Accepted: %{accepted_types}"
+        suspicious_type:
+          title: "Suspicious file type"
+          text: "The actual file type does not match the extension"
+        attach_error:
+          title: "Error"
+          text: "Unable to attach file"
+        delete_error:
+          title: "Error"
+          text: "Unable to delete file"
+      confirms:
+        delete_file:
+          title: "Delete?"
+          text: "Do you really want to remove this file?"
+          confirm_button: "Delete"
+          cancel_button: "Cancel"
+      preview:
+        unavailable: "Preview not available for this file type"
+        download: "Download file"
+        close: "Close"

data/config/locales/upload_d_n_d.fr.yml

@@ -0,0 +1,80 @@
+fr:
+  upload_d_n_d:
+    drag_and_drop: "Glissez-déposez vos fichiers ici ou cliquez pour sélectionner"
+    no_files: "Aucun fichier"
+    progress: "Progression de l'upload"
+    preview_file: "Aperçu"
+    delete_file: "Supprimer"
+
+    errors:
+      blob_not_found: "Fichier non trouvé"
+      blob_already_attached: "Ce fichier est déjà utilisé ailleurs. Déposez-le à nouveau."
+      corrupted: "Le fichier semble corrompu ou modifié"
+      unrepresentable: "Le fichier n'est pas traitable"
+      unauthorized: "Vous n'êtes pas autorisé à modifier ce fichier"
+      invalid_type: "Type de fichier non accepté. Formats autorisés : %{types}"
+      too_large: "Le fichier dépasse la taille maximale de %{max_size}"
+      suspicious_type: "Le type réel du fichier ne correspond pas au type déclaré"
+      mime_detection_failed: "Impossible de vérifier le type de fichier."
+      bad_request: "Requête invalide."
+      invalid_field_reference: "Champ de fichier invalide. Rechargez la page."
+      max_files_exceeded: "Vous ne pouvez pas ajouter plus de %{max} fichiers"
+      file_not_found_or_denied: "Fichier non trouvé ou accès refusé"
+      save_failed: "Erreur lors de l'enregistrement : %{errors}"
+      invalid_attribute: "L'attribut %{attribute} n'existe pas"
+      not_active_storage_attachment: "L'attribut %{attribute} n'est pas un attachment ActiveStorage"
+      record_gid_required: "Le paramètre record_gid est requis pour attacher à un record existant. Utilisez /temporary_attachments pour les uploads sans record."
+      missing_params: "Paramètres manquants"
+      invalid_attribute_name: "Nom d'attribut invalide"
+      invalid_blob_signature: "Signature du blob invalide"
+      record_not_found: "Enregistrement non trouvé"
+      upload_error: "Une erreur est survenue lors de l'upload"
+      authentication_required: "Vous devez être connecté pour uploader des fichiers"
+      invalid_file_token: "Token de fichier invalide"
+      rate_limited: "Trop de requêtes. Veuillez patienter %{seconds} secondes."
+
+    success:
+      file_added: "Fichier ajouté avec succès"
+      file_removed: "Fichier supprimé avec succès"
+      file_uploaded: "Fichier uploadé avec succès"
+
+    confirmations:
+      delete_file: "Êtes-vous sûr de vouloir supprimer ce fichier ?"
+      replace_file: "Un fichier est déjà attaché. Voulez-vous le remplacer ?"
+
+    javascript:
+      alerts:
+        single_file_only:
+          title: "Un seul fichier autorisé"
+          text: "Vous ne pouvez uploader qu'un seul fichier pour ce champ."
+        upload_error:
+          title: "Erreur"
+          text: "Impossible d'uploader le fichier"
+        file_too_large:
+          title: "Trop volumineux"
+          text: "Max: %{max_size}MB"
+        empty_file:
+          title: "Fichier vide"
+          text: "Le fichier ne peut pas être vide"
+        invalid_format:
+          title: "Format invalide"
+          text: "Acceptés: %{accepted_types}"
+        suspicious_type:
+          title: "Type de fichier suspect"
+          text: "Le type réel du fichier ne correspond pas à l'extension"
+        attach_error:
+          title: "Erreur"
+          text: "Impossible d'attacher le fichier"
+        delete_error:
+          title: "Erreur"
+          text: "Impossible de supprimer le fichier"
+      confirms:
+        delete_file:
+          title: "Supprimer ?"
+          text: "Voulez-vous vraiment retirer ce fichier ?"
+          confirm_button: "Supprimer"
+          cancel_button: "Annuler"
+      preview:
+        unavailable: "Aperçu non disponible pour ce type de fichier"
+        download: "Télécharger le fichier"
+        close: "Fermer"

data/config/routes.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+UploadDND::Engine.routes.draw do
+  # Routes pour les attachments
+  resources :attachments, only: [ :create, :destroy ]
+
+  # Routes pour les attachments temporaires
+  resources :temporary_attachments, only: [ :index, :create, :destroy ]
+  # Purge de tous les fichiers temporaires de la session pour un attribut
+  # (ex: bouton « Annuler » d'un formulaire de création)
+  delete "temporary_attachments", to: "temporary_attachments#purge", as: :purge_temporary_attachments
+end