your_platform 0.0.1 → 0.0.2

data/app/controllers/officers_controller.rb

@@ -0,0 +1,28 @@
+class OfficersController < ApplicationController
+  
+  # Required params:
+  #   - group_id or page_id
+  #   - name
+  #
+  def create_officers_group
+    @structureable = secure_structureable
+    authorize! :create_officers_group_for, @structureable
+    
+    @officers_group = @structureable.officers_parent.child_groups.create name: params[:name]
+    
+    respond_to do |format|
+      format.html { redirect_to @structureable }
+      format.json { render json: @officers_group.attributes.merge({
+        officers_group_entry_html: render_to_string(partial: 'officers/officers_group_entry', formats: [:html], handlers: [:haml], layout: false, locals: {officer_group: @officers_group, structureable: @structureable})
+      })}
+    end
+  end
+  
+  private
+  
+  def secure_structureable
+    return Group.find(params[:group_id]) if params[:group_id].present?
+    return Page.find(params[:page_id]) if params[:page_id].present?
+  end
+  
+end

data/app/controllers/pages_controller.rb

@@ -0,0 +1,67 @@
+class PagesController < ApplicationController
+
+  load_and_authorize_resource
+  skip_authorize_resource only: [:create]
+  
+  respond_to :html, :json
+
+  def show
+    if @page
+      current_user.try(:update_last_seen_activity, "sieht sich Informationen an: #{@page.title}", @page)
+
+      if @page.redirect_to
+        target = @page.redirect_to
+        
+        # In order to avoid multiple redirects, we force https manually here
+        # in production.
+        #
+        target.merge!({protocol: "https://"}) if target.kind_of?(Hash) && Rails.env.production?
+        
+        redirect_to target
+        return
+      end
+
+      @blog_entries = @page.blog_entries.limit(10)
+
+      @title = @page.title
+      @navable = @page
+      @page = @page.becomes(Page)  # rather than BlogPost etc.
+    end
+    metric_logger.log_event @page.attributes, type: :show_page
+    respond_with @page
+  end
+
+  def update
+    params[:blog_post] ||= params[:page]  # required for blog posts in respond_with_bip
+    @page.update_attributes params[ :page ]
+    respond_with_bip(@page)
+  end
+  
+  def create
+    if secure_parent
+      @association = secure_parent.child_pages
+      authorize! :create_page_for, secure_parent
+    else
+      @association = Page
+      authorize! :create, Page
+    end
+    @new_page = @association.create( title: I18n.t(:new_page) )
+    @new_page.author = current_user
+    @new_page.save
+    redirect_to @new_page
+  end
+  
+private
+
+  def secure_parent
+    # params[:parent_type] ||= params[:page][:parent_type] if params[:page]
+    # params[:parent_id] ||= params[:page][:parent_id] if params[:page]
+    params[:parent_type] ||= 'Page' if params[:parent_id]
+    secure_parent_type.constantize.find(params[:parent_id]) if secure_parent_type && params[:parent_id].present?
+  end
+  
+  def secure_parent_type
+    params[:parent_type] if params[:parent_type].in? ['Page', 'Group']
+  end
+
+end

data/app/controllers/posts_controller.rb

@@ -0,0 +1,81 @@
+class PostsController < ApplicationController
+  
+  authorize_resource
+  skip_authorize_resource only: [:new, :create]
+  
+  def index
+    @group = Group.find(params[:group_id]) if params[:group_id].present?
+    @posts = @group.posts.order('sent_at DESC') if @group
+    @title = t :current_posts
+    @navable = @group
+  end
+
+  def show
+    @post = Post.find(params[:id])
+    @title = @post.subject
+    @navable = @post.group
+  end
+  
+  def new
+    @group = Group.find params[:group_id] if params[:group_id].present?
+    authorize! :create_post_for, @group
+    @navable = @group
+  end
+  
+  def create
+    raise 'no group given' unless params[:group_id].present?
+    @group = Group.find params[:group_id]
+    authorize! :create_post_for, @group
+
+    @text = params[:text]
+    @subject = params[:subject]
+    
+    if params[:recipient] == 'me'
+      @recipients = [current_user]
+    else
+      if params[:valid_from].present?
+        @memberships = @group.memberships.started_after(params[:valid_from].to_datetime)
+        @recipients = @group.members.where(dag_links: {id: @memberships.map(&:id)})
+        raise 'validation error: the number of recipients does not match.' if @recipients.count != params[:recipients_count].to_i
+      else
+        @recipients = @group.members
+      end
+    end
+    
+    @send_counter = 0
+    @recipients.each do |recipient|
+      if recipient.email.present?
+        begin
+          PostMailer.post_email(@text, [recipient], @subject, current_user).deliver 
+          @send_counter += 1
+        rescue Net::SMTPFatalError, Net::SMTPSyntaxError => error
+          logger.debug error
+          # Something is wrong with the recipient's mail.
+          # If the recipient's mails does not work, we'll delete it for the moment.
+          #
+          # TODO: Fancy mechanism that marks the mail as invalid.
+          # But the new mechanism has to ensure that we don't send emails to invalid addresses.
+          # Otherwise, the server could suffer from penalties.
+          #
+          logger.warn "SMTP Error on #{recipient.email}. Removing this email permanently."
+          logger.warn error.message
+          recipient.profile_fields_by_type("ProfileFieldTypes::Email").first.destroy
+        end
+      end
+    end
+    logger.info "Sent group email to #{@send_counter} recipients."
+    
+    if params[:recipient] != 'me'
+      Post.create! subject: @subject, text: @text, group_id: @group.id, author_user_id: current_user.id, sent_at: Time.zone.now
+    end
+    
+    respond_to do |format|
+      format.html do
+        flash[:notice] = "Nachricht wurde an #{@send_counter} Empfänger versandt."
+        redirect_to group_url(@group)
+      end
+      format.json { render json: {recipients_count: @send_counter} }
+    end
+    
+  end
+end

data/app/controllers/profile_fields_controller.rb

@@ -0,0 +1,132 @@
+class ProfileFieldsController < ApplicationController
+
+  prepend_before_filter :load_profileable, :only => :create
+  load_and_authorize_resource
+  respond_to :json, :js
+
+  def create
+    type = secure_profile_field_type || 'ProfileFieldTypes::Custom'
+    @profile_field = @profile_field.becomes(type.constantize)
+    @profile_field.profileable = @profileable
+    @profile_field.label = params[:label] if params[:label].present?
+    @profile_field.save if @profile_field.changed?
+    respond_to do |format|
+      format.js
+    end
+  end
+
+  def update
+    if current_user == @profile_field.profileable
+      current_user.update_last_seen_activity("pflegt sein eigenes Profil", current_user)
+    else
+      title = @profile_field.profileable.title
+      current_user.update_last_seen_activity("bearbeitet ein Profil: #{title}", @profile_field.profileable)
+    end
+    
+    @profile_field = ProfileField.find(params[:id])
+    profile_field_class = ProfileField if @profile_field.type.blank?
+    profile_field_class ||= ProfileField.possible_types.find { |possible_type| possible_type.to_s == @profile_field.type }
+    if profile_field_class.nil?
+      raise "security interrupt: '#{@profile_field.type}' is no permitted profileable object type."
+    end
+    @profile_field = @profile_field.becomes(profile_field_class)
+    updated = @profile_field.update_attributes(params[:profile_field])
+    respond_with_bip @profile_field
+  end
+  
+  def destroy
+    respond_with @profile_field.destroy
+  end
+  
+  private
+  
+  def load_profileable
+    if params[ :section ].present?
+      @section = params[ :section ]
+    end
+    if params[ :profileable_type ].present? && params[ :profileable_id ].present?
+      @profileable = secure_profileable_type.constantize.find( params[ :profileable_id ] )
+    elsif params[ :profileable_type ].blank? and params[ :profileable_id ].blank?
+      raise "Profileable type and id are missing!"
+    elsif params[ :profileable_type ].blank?
+      raise "Profileable type is missing!"
+    else
+      raise "Profileable id is missing!"
+    end
+  end
+  
+  def secure_profileable_type
+    if not params[:profileable_type].in? ["User", "Group"]
+      raise "security interrupt: '#{params[:profileable_type]}' is no permitted profileable object type."
+    end
+    params[:profileable_type]
+  end
+  
+  def secure_profile_field_type
+    if not params[:profile_field][:type].in? ([''] + ProfileField.possible_types.map(&:to_s))
+      raise "security interrupt: '#{params[:profile_field][:type]}' is not a permitted profile field type."
+    end
+    params[:profile_field][:type]
+  end
+    
+
+#   before_filter        :find_profileable
+# #  before_filter        :load_profile_field_as_instance_variable
+# #  respond_to           :html, :json
+#   respond_to           :json
+#   layout               false
+# 
+#   def index
+#     @profile_fields = @profileable.profile_fields if @profileable
+#     @profile_fields ||= ProfileField.find_all_by_parent_id( params[ :parent_id ] ) if params[ :parent_id ]
+#     respond_with @profile_fields.to_json( include: [ :children ] )
+#   end
+# 
+#   def show
+#     respond_with ProfileField.find( params[ :id ] )
+#   end
+# 
+# 
+#   def update
+#     respond_with ProfileField.update( params[ :id ], params[ :profile_field ] )
+# #    @profile_field.update_attributes( params[ :profile_field ] )
+# #    respond_to do |format|
+# #      format.json { respond_with_bip( @profile_field ) }
+# #    end
+# #    #respond_with @profile_field
+# #    #render action: 'show'
+#   end
+# 
+#   def destroy
+#     # For compatibility reasons, this is messy, now:
+#     # This would be the REST response, compatible to angular js:
+# #    respond_with ProfileField.destroy( params[ :id ] )  
+# 
+#     # And this is needed for the current interface, because then a js template
+#     # is rendered and sent back to the client (in order to hide the deleted
+#     # elements).
+#     # @profile_field.destroy
+# 
+#     # And this would be the HTML response:
+# #    redirect_to profileable #controller: 'users', action: 'show', id: user_id
+#   end
+# 
+#   private
+# 
+#   def find_profileable
+#     if params[ :profileable_type ].present? && params[ :profileable_id ].present?
+#       @profileable = params[ :profileable_type ].constantize.find( params[ :profileable_id ] )
+#     end
+#   end
+# 
+# #
+# #  def load_profile_field_as_instance_variable
+# #    id = params[ :id ]
+# #    if id
+# #      @profile_field = ProfileField.find_by_id( id )
+# #    else
+# #      @profile_field = ProfileField.new
+# #    end
+# #  end
+
+end

data/app/controllers/root_controller.rb

@@ -0,0 +1,35 @@
+class RootController < ApplicationController
+  
+  before_filter :redirect_to_setup_if_needed
+  before_filter :redirect_to_sign_in_if_signed_out, :find_and_authorize_page
+
+  def index
+    current_user.try(:update_last_seen_activity, "sieht sich die Startseite an", @page)
+    @navable = @page
+    @blog_entries = @page.blog_entries
+    
+    render "pages/show"
+  end
+  
+  
+private
+
+  def redirect_to_setup_if_needed
+    if User.count == 0
+      @need_setup = true
+      redirect_to setup_path
+    end
+  end
+  
+  def redirect_to_sign_in_if_signed_out
+    redirect_to sign_in_path unless current_user or @need_setup
+  end
+
+  def find_and_authorize_page
+    @page = Page.find_intranet_root
+    @navable = @page
+    reload_ability
+    authorize! :show, @page
+  end
+  
+end

data/app/controllers/search_controller.rb

@@ -0,0 +1,149 @@
+class SearchController < ApplicationController
+
+  # https://github.com/ryanb/cancan/wiki/Ensure-Authorization
+  skip_authorization_check
+
+  def index
+    query_string = params[ :query ]
+    if query_string.present?
+      
+      # log search query for metrics analysis
+      #
+      metric_logger.log_event({query: query_string}, type: :search)
+      current_user.try(:update_last_seen_activity, "sucht gerade etwas", nil)
+
+      # browse users, pages, groups and events
+      #
+      q = "%" + query_string.gsub( ' ', '%' ) + "%"
+      @users = User.where("CONCAT(first_name, ' ', last_name) LIKE ?", q)
+        .order('last_name', 'first_name')
+      @pages = Page.where("title like ? OR content like ?", q, q)
+        .order('title')
+      @groups = Group.where( "name like ?", q )
+      @events = Event.where("name like ?", q).order('start_at DESC')
+
+      # browse profile fields
+      #
+      profile_fields = ProfileField.where("value like ? or label like ?", q, q).collect do |profile_field|
+        profile_field.parent || profile_field
+      end.uniq
+      profile_fields.each do |profile_field|
+        if profile_field.profileable.kind_of? User
+          @users << profile_field.profileable
+        elsif profile_field.profileable.kind_of? Group
+          @groups << profile_field.profileable
+        end
+      end
+      
+      # browse attachments
+      #
+      attachments = Attachment.where("title like ? or description like ?", q, q).where(parent_type: 'Page')
+      @pages += attachments.collect { |attachment| attachment.parent }
+      
+      # eleminiate duplicate results
+      #
+      @users.uniq!
+      @pages.uniq!
+      @groups.uniq!
+      @events.uniq!
+
+      # AUTHORIZATION
+      #
+      @users = filter_by_authorization(@users)
+      @pages = filter_by_authorization(@pages)
+      @groups = filter_by_authorization(@groups)
+      @events = filter_by_authorization(@events)
+
+      @results = @users + @pages + @groups + @events
+      if @results.count == 1
+        redirect_to @results.first
+      end
+      
+      if @results.count < 100
+        @large_map_address_fields = @results.collect do |result|
+          result.profile_fields.where(type: "ProfileFieldTypes::Address") if result.respond_to? :profile_fields
+        end.flatten - [nil]
+      end
+
+      @pages = nil if @pages.count == 0
+      @users = nil if @users.count == 0
+      @groups = nil if @groups.count == 0
+      @events = nil if @events.count == 0
+      @results = nil if @results.count == 0
+
+    end
+    @navable = Page.find_intranet_root
+    @title = "Suche: #{query_string}"
+
+  end
+  
+  # This action results in a redirection to the search result
+  # considered to be a lucky guess.
+  #
+  #     /search/guess?query=FooBar
+  #     would redirect to the Page with the title "FooBar".
+  #
+  def lucky_guess
+    query_string = params[:query]
+    if query_string.present?
+      @result = Event.where(name: query_string).limit(1).first
+      @result ||= Page.where(title: query_string).limit(1).first
+      @result ||= Group.where(name: query_string).limit(1).first
+      @result ||= User.find_by_name(query_string)
+      @result ||= User.find_by_title(query_string)
+      if @result
+        redirect_to @result if can? :read, @result
+      else
+        redirect_to :action => :index, query: query_string
+      end
+    else
+      redirect_to :action => :index
+    end
+  end
+  
+  # This returns title and body of a preview field (quick search).
+  #
+  def preview
+    @object = find_preview_object(params[:query])
+    respond_to do |format|
+      format.json do
+        if @object
+          preview_template = "search/preview_#{@object.class.name.underscore}" # e.g. preview_user
+          render json: {
+            :title => 'Suchergebnis',
+            :body => render_to_string(partial: preview_template, locals: {query: params['query'], obj: @object}, formats: ['html'])
+          }
+        else
+          head :no_content
+        end
+      end
+    end
+  end
+
+  private
+
+  def filter_by_authorization( resources )
+    resources.select do |resource|
+      can? :read, resource
+    end
+  end
+  
+  def find_preview_object(query_string)
+    object = nil
+    if query_string.present?
+      like_query_string = "%" + query_string.gsub( ' ', '%' ) + "%"
+    
+      # The order of these assignments determines the priority.
+      #
+      object = Corporation.where(token: query_string).limit(1).first
+      object ||= User.where(last_name: query_string).limit(1).first
+      object ||= Page.where("title like ?", like_query_string).limit(1).first
+      object ||= Group.where("name like ?", like_query_string).limit(1).first
+      object ||= User.where("CONCAT(first_name, ' ', last_name) LIKE ?", like_query_string).limit(1).first
+
+      object = nil unless can? :read, object
+    end
+    return object
+  end
+
+end