upload_d_n_d 0.9.4 → 0.10.0

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: upload_d_n_d
 version: !ruby/object:Gem::Version
-  version: 0.9.4
+  version: 0.10.0
 platform: ruby
 authors:
 - Pierre Cherbero
@@ -65,7 +65,6 @@ files:
 - app/controllers/upload_d_n_d/base_attachments_controller.rb
 - app/controllers/upload_d_n_d/temporary_attachments_controller.rb
 - app/helpers/upload_d_n_d/application_helper.rb
-- app/helpers/upload_d_n_d/controllers/helpers.rb
 - app/javascript/upload_d_n_d/controllers/preview_controller.js
 - app/javascript/upload_d_n_d/controllers/uploads_controller.js
 - app/javascript/upload_d_n_d/index.js
@@ -92,7 +91,6 @@ files:
 - lib/generators/upload_d_n_d/policy_generator.rb
 - lib/generators/upload_d_n_d/templates/POST_INSTALL
 - lib/generators/upload_d_n_d/templates/concerns/controllers_uploadable.rb
-- lib/generators/upload_d_n_d/templates/concerns/upload_authorization.rb
 - lib/generators/upload_d_n_d/templates/concerns/uploadable.rb
 - lib/generators/upload_d_n_d/templates/controller.rb.tt
 - lib/generators/upload_d_n_d/templates/helpers/upload_helper.rb
@@ -114,16 +112,17 @@ files:
 - lib/upload_d_n_d/controllers/uploadable.rb
 - lib/upload_d_n_d/engine.rb
 - lib/upload_d_n_d/field_constraints.rb
-- lib/upload_d_n_d/field_reference.rb
 - lib/upload_d_n_d/file_validator.rb
 - lib/upload_d_n_d/js_link.rb
 - lib/upload_d_n_d/mime_types.rb
 - lib/upload_d_n_d/orphan_blobs.rb
 - lib/upload_d_n_d/rejected_blob.rb
 - lib/upload_d_n_d/session_id.rb
+- lib/upload_d_n_d/signed_target.rb
 - lib/upload_d_n_d/uploadable.rb
 - lib/upload_d_n_d/version.rb
 - package.json
+- styles.css
 homepage: https://github.com/Peyochanchan/upload_d_n_d
 licenses:
 - MIT

data/app/helpers/upload_d_n_d/controllers/helpers.rb

@@ -1,21 +0,0 @@
-# lib/upload_d_n_d/controllers/helpers.rb
-module UploadDND
-  module Controllers
-    module Helpers
-      extend ActiveSupport::Concern
-
-      def attach_upload_d_n_d_files(record, attribute_name)
-        # On cherche les fichiers temporaires liés à cette session
-        temps = UploadDND::TemporaryAttachment.where(
-          session_id: UploadDND::SessionId.for(session),
-          attribute_name: attribute_name
-        )
-
-        temps.each do |temp|
-          record.send(attribute_name).attach(temp.blob)
-          temp.destroy # On nettoie après attachement
-        end
-      end
-    end
-  end
-end

data/lib/generators/upload_d_n_d/templates/concerns/upload_authorization.rb

@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-module UploadDND
-  module UploadAuthorization
-    extend ActiveSupport::Concern
-
-    included do
-      before_action :authorize_upload!, only: [ :create ]
-      before_action :authorize_destroy!, only: [ :destroy ]
-    end
-
-    private
-
-    # Vérifie si l'utilisateur peut uploader sur cet attribut
-    # Peut être surchargée dans votre controller
-    def authorize_upload!
-      # Si vous utilisez Pundit
-      if defined?(Pundit)
-        authorize_with_pundit
-      # Si vous utilisez CanCanCan
-      elsif defined?(CanCan)
-        authorize_with_cancan
-      else
-        # Autorisation par défaut : l'utilisateur doit être connecté
-        authorize_basic_upload!
-      end
-    end
-
-    # Vérifie si l'utilisateur peut supprimer ce fichier
-    def authorize_destroy!
-      if defined?(Pundit)
-        authorize @temp_attachment || @attachment
-      elsif defined?(CanCan)
-        authorize! :destroy, @temp_attachment || @attachment
-      else
-        authorize_basic_destroy!
-      end
-    end
-
-    # Autorisation basique : utilisateur connecté
-    def authorize_basic_upload!
-      return if current_user.present?
-
-      render json: { error: "Vous devez être connecté pour uploader des fichiers" },
-             status: :unauthorized
-    end
-
-    def authorize_basic_destroy!
-      # Vérifie que le fichier appartient à la session ou à l'utilisateur
-      return if owner_matches_current_user?
-
-      render json: { error: "Vous ne pouvez pas supprimer ce fichier" },
-             status: :forbidden
-    end
-
-    def authorize_with_pundit
-      record = find_or_build_record
-      authorize record, :update?
-    end
-
-    def authorize_with_cancan
-      record = find_or_build_record
-      authorize! :update, record
-    end
-
-    def owner_matches_current_user?
-      if @temp_attachment
-        @temp_attachment.session_id == UploadDND::SessionId.for(session) ||
-          @temp_attachment.user_id == current_user&.id
-      elsif @attachment
-        @attachment.record.user_id == current_user&.id if @attachment.record.respond_to?(:user_id)
-      end
-    end
-
-    def find_or_build_record
-      if params[:record_gid].present?
-        GlobalID::Locator.locate(params[:record_gid])
-      else
-        # Pour les uploads temporaires, on ne peut pas vraiment autoriser
-        # car le record n'existe pas encore
-        nil
-      end
-    end
-
-    def current_user
-      # À adapter selon votre système d'authentification
-      # Par défaut, on suppose que vous utilisez Devise ou similaire
-      respond_to?(:current_user, true) ? super : nil
-    end
-  end
-end

data/lib/upload_d_n_d/field_reference.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module UploadDND
-  # Référence signée d'un champ (modèle + attribut), émise par le composant et
-  # renvoyée au dépôt : le serveur retrouve les limites du champ sans faire
-  # confiance au client. Elle ne porte pas les limites elles-mêmes : le modèle
-  # reste la seule autorité.
-  module FieldReference
-    PURPOSE = :upload_d_n_d_field
-
-    class Invalid < UploadDND::Error; end
-
-    class << self
-      def generate(model_class, attribute_name)
-        verifier.generate([ model_class.name, attribute_name.to_s ], purpose: PURPOSE)
-      end
-
-      # @raise [Invalid] signature fausse, autre attribut, modèle ou attachment inconnu
-      # @return [UploadDND::FieldConstraints]
-      def constraints(token, attribute_name)
-        model_name, attribute = verified(token)
-        raise Invalid unless attribute.present? && attribute == attribute_name.to_s
-
-        model_class = model_name.to_s.safe_constantize
-        raise Invalid unless model_class.respond_to?(:reflect_on_attachment) && model_class.reflect_on_attachment(attribute)
-
-        FieldConstraints.for(model_class, attribute)
-      end
-
-      private
-
-      def verified(token)
-        payload = verifier.verified(token.to_s, purpose: PURPOSE)
-        payload.is_a?(Array) && payload.size == 2 ? payload : raise(Invalid)
-      rescue ActiveSupport::MessageVerifier::InvalidSignature, ArgumentError
-        raise Invalid
-      end
-
-      def verifier
-        Rails.application.message_verifier("upload_d_n_d/field_reference")
-      end
-    end
-  end
-end