zena 0.15.0

data/app/models/template_content.rb

@@ -0,0 +1,112 @@
+class TemplateContent < ActiveRecord::Base
+  include RubyLess::SafeClass
+  safe_attribute  :tkpath, :skin_name, :mode, :klass
+  safe_method     :ext => String, :format => String, :content_type => String, :filename => String
+  #attr_public  :file ?
+
+  attr_protected :tkpath
+  belongs_to :node
+  belongs_to :site
+  before_validation :template_content_before_validation
+  validate   :validate_template_content
+
+  extend  Zena::Acts::Multiversion
+  act_as_content
+
+  def preload_version(v)
+    # dummy called by Version
+  end
+
+  def ext
+    'zafu'
+  end
+
+  # We need this because 'format' is a Kernel method and we do not want it to be called instead of getting the attribute.
+  def format
+    self[:format]
+  end
+
+  def ext=(s)
+    # ignore (needed for compatibility with DocumentContent)
+  end
+
+  def content_type
+    "text/zafu"
+  end
+
+  def size(format=nil)
+    version.text.size
+  end
+
+  def filename
+    version.node.filename
+  end
+
+  def content_type=(s)
+    # ignore
+  end
+
+  # pre-load version
+  def version=(v)
+    @version = v
+  end
+
+  def file=(file)
+    @new_file = file
+    version.text = file.read
+  end
+
+  def file(mode=nil)
+    @new_file ||= StringIO.new(version.text)
+  end
+
+  def version
+    @version ||= node.version
+  end
+
+  def can_destroy?
+    0 == self.class.count_by_sql("SELECT COUNT(*) FROM versions WHERE node_id = #{self[:node_id]}")
+  end
+
+  # Return true if the version would be edited by the attributes
+  # TODO: DRY this (and other code) with DocumentContent.
+  def would_edit?(new_attrs)
+    new_attrs.each do |k,v|
+      if k == 'file'
+        return true if (v.respond_to?(:size) ? v.size : File.size(v.path)) != self.size
+        same = v.read(24) == self.file.read(24) && v.read == self.file.read
+        v.rewind
+        self.file.rewind
+        return true if !same
+      elsif type = self.class.safe_method_type([k])
+        return true if field_changed?(k, self.send(type[:method]), v)
+      end
+    end
+    false
+  end
+
+  private
+    def template_content_before_validation
+      self[:skin_name] = node.section.name
+      self[:mode]  = nil if self[:mode ].blank?
+      self[:klass] = nil if self[:klass].blank?
+      unless self[:klass]
+        # this template is not meant to be accessed directly (partial used for inclusion)
+        self[:tkpath] = nil
+        self[:mode]   = nil
+        self[:format] = nil
+      end
+    end
+
+    def validate_template_content
+      if klass_changed? && klass
+        errors.add('format', "can't be blank") unless format
+        # this is a master template (found when choosing the template for rendering)
+        if klass = Node.get_class(self[:klass])
+          self[:tkpath] = klass.kpath
+        else
+          errors.add('klass', 'invalid')
+        end
+      end
+    end
+end

data/app/models/template_version.rb

@@ -0,0 +1,37 @@
+=begin rdoc
+This class stores version text for Template. See Version for details.
+
+=== Content
+
+Uses TemplateContent.
+=end
+class TemplateVersion < Version
+  validates_presence_of       :content
+
+
+  # TODO: test
+  def self.content_class
+    TemplateContent
+  end
+
+  # TODO: test
+  def content
+    return @content if @content
+    @content = content_class.find_by_node_id(self[:node_id])
+
+    unless @content
+      # create new content
+      @content = content_class.new
+      @redaction_content = @content
+      @content[:site_id] = node[:site_id]
+    end
+    @content.node = node
+    @content
+  end
+
+  # TODO: test
+  def redaction_content
+    content
+  end
+
+end

data/app/models/text_document.rb

@@ -0,0 +1,162 @@
+=begin rdoc
+Any document that can be edited as text (html file, script, source code) is a text document. The file content is not stored in an external file. It is kept in the version text. This means that the content of such a document can be edited by editing the version's text.
+
+=== Version
+
+The version class used by text documents is the TextDocumentVersion.
+
+=== Content
+
+Content (file data) is stored in the TextDocumentVersion. The content class (TextDocumentContent) is responsible for faking the exitence of a real file.
+=end
+class TextDocument < Document
+  class << self
+    # Return true if a new text document can be created with the content_type. Used by the superclass Document to choose the corret subclass when creating a new object.
+    def accept_content_type?(content_type)
+      (content_type =~ /^(text)/ && TYPE_TO_EXT[content_type.chomp] != ['rtf']) || (content_type =~ /x-javascript/)
+    end
+
+    def version_class
+      TextDocumentVersion
+    end
+  end
+
+
+  def can_parse_assets?
+    return ['text/css'].include?(version.content.content_type)
+  end
+
+  # Parse text content and replace all reference to relative urls ('img/footer.png') by their zen_path ('/en/image34.png')
+  def parse_assets(text, helper, key)
+    if key == 'v_text' && version.content.content_type == 'text/css'
+      res = text.dup
+      # use skin as root
+      skin = section
+
+      # not in a Skin. Cannot replace assets in CSS.
+      # error
+      unless skin.kind_of?(Skin)
+        errors.add('base', 'Cannot parse assets if not in a Skin.')
+        return text
+      end
+
+      current_folder = parent.fullpath
+
+      res.gsub!(/url\(\s*(.*?)\s*\)/) do
+        match, src = $&, $1
+        if src =~ /('|")(.*?)\1/
+          quote, src = $1, $2
+        else
+          quote = "'"
+        end
+        if src[0..6] == 'http://'
+          match
+        elsif src =~ %r{/\w\w/.*?(\d+)(_\w+|)\.\w+(\?\d+|)}
+          # already parsed
+          zip, mode, stamp = $1, $2, $3
+          if src_node = secure(Node) { Node.find_by_zip(zip) }
+            if mode.blank?
+              # no cachestamp, we need it
+              "url(#{quote}#{helper.send(:data_path, src_node)}#{quote})"
+            else
+              "url(#{quote}#{helper.send(:data_path, src_node, :mode => mode[1..-1])}#{quote})"
+            end
+          else
+            # ok
+            "url(#{quote}#{src}#{quote})"
+          end
+        else
+          if new_src = helper.send(:template_url_for_asset, :src => src, :current_folder=>current_folder, :parse_assets => true)
+            "url(#{quote}#{new_src}#{quote})"
+          else
+            errors.add('base', "could not find asset #{src.inspect}")
+            "url(#{quote}#{src}#{quote})"
+          end
+        end
+      end
+    else
+      # unknown type
+      super
+    end
+    res
+  end
+
+  # Parse text and replace absolute urls ('/en/image30.jpg') by their relative value in the current skin ('img/bird.jpg')
+  def unparse_assets(text, helper, key)
+    if key == 'v_text' && version.content.content_type == 'text/css'
+      res = text.dup
+      # use parent as relative root
+      current_folder = parent.fullpath
+
+      res.gsub!(/url\(('|")(.*?)\1\)/) do
+        if $2[0..6] == 'http://'
+          $&
+        else
+          quote, url   = $1, $2
+          if url =~ /\A\/\w\w.*?(\d+)(_\w+|)\./
+            zip, mode = $1, $2
+            unless asset = secure(Node) { Node.find_by_zip(zip) }
+              errors.add('base', "could not find asset node #{zip}")
+              "url(#{quote}#{url}#{quote})"
+            end
+            if asset.fullpath =~ /\A#{current_folder}\/(.+)/
+              "url(#{quote}#{$1}#{mode}.#{asset.version.content.ext}#{quote})"
+            else
+              "url(#{quote}/#{asset.fullpath}#{mode}.#{asset.version.content.ext}#{quote})"
+            end
+          else
+            # bad format
+            errors.add('base', "cannot unparse asset url #{url.inspect}")
+            "url(#{quote}#{url}#{quote})"
+          end
+        end
+      end
+      res
+    else
+      super
+    end
+  end
+
+  # List of keys to export in a zml file. "v_text" is ignored since it's exported in a separate file.
+  def export_keys
+    h = super
+    h[:zazen].delete('v_text')
+    h
+  end
+
+  # List of keys which need transformations
+  def parse_keys
+    (super + (version.content.content_type == 'text/css' ? ['v_text'] : [])).uniq
+  end
+
+  # Return the code language used for syntax highlighting.
+  def content_lang
+    ctype = version.content.content_type
+    if ctype =~ /^text\/(.*)/
+      case $1
+      when 'x-ruby-script'
+        'ruby'
+      when 'html', 'zafu'
+        'zafu'
+      else
+        $1
+      end
+    else
+      nil
+    end
+  end
+
+  private
+
+    # Overwrite superclass (DocumentContent) behavior
+    def valid_file
+      return true
+    end
+
+    def document_before_validation
+      super
+      content = version.content
+      content[:content_type] ||= 'text/plain'
+      content[:ext]  ||= 'txt'
+    end
+end

data/app/models/text_document_content.rb

@@ -0,0 +1,46 @@
+class TextDocumentContent < DocumentContent
+
+  def file=(aFile)
+    super
+    version.text = @new_file.read
+  end
+
+  def file(mode=nil)
+    @loaded_file ||= @new_file || StringIO.new(version.text)
+  end
+
+  # Return document file size (= version's text size).
+  def size(format=nil)
+    version.text.size
+  end
+
+  def filename
+    version.node.filename
+  end
+
+  private
+
+  def valid_file
+    true # overwrite superclass behaviour
+  end
+
+  # called before_save. Replace behaviour of TextDocuments.
+  def content_before_save
+    self[:type] = self.class.to_s # make sure the type is set in case no sub-classes are loaded.
+
+    if @new_file
+      # nothing to do
+    elsif !new_record? && (old = DocumentContent.find(self[:id])).name != self[:name]
+      # TODO: clear cache
+    end
+  end
+
+  def make_file(path, data)
+    # TODO: raise error
+  end
+
+  def destroy_file
+    # TODO: clear cache
+    # TODO: set content_id of versions whose content_id was self[:version_id]
+  end
+end

data/app/models/text_document_version.rb

@@ -0,0 +1,21 @@
+=begin rdoc
+This is the version used by TextDocument. It behave exactly like its superclass (DocumentVersion) except for the content class, set to TextDocumentContent.
+=end
+class TextDocumentVersion < DocumentVersion
+  before_save :parse_assets_before_save
+
+  def self.content_class
+    TextDocumentContent
+  end
+
+  private
+    def parse_assets_before_save
+      if text_changed? && content.content_type == 'text/css'
+        # Dummy controller so we have access to urls. Any better idea gladly welcome.
+        helper = ApplicationController.new
+        helper.instance_variable_set(:@visitor, visitor)
+        self.text = node.parse_assets(self.text, helper, 'v_text')
+      end
+    end
+
+end

data/app/models/user.rb

@@ -0,0 +1,412 @@
+require 'digest/sha1'
+require 'tzinfo'
+=begin rdoc
+There are two special users in each site :
+[anon] Anonymous user. Used to set defaults for newly created users.
+[su] This user has full access to all the content in zena. He/she can read/write/destroy
+      about anything. Even private content can be read/edited/removed by su. <em>This user should
+      only be used for emergency purpose</em>. This is why an ugly warning is shown on all pages when
+      logged in as su.
+
+If you want to give administrative rights to a user, simply put him/her into the _admin_ group.
+
+Users have access rights defined by the groups they belong to. They also have a 'status' indicating the kind of
+things they can/cannot do :
++:user+::        (60): can read/write/publish
++:commentator+:: (40): can write comments
++:moderated+::   (30): can write moderated comments
++:reader+::      (20): can only read
++:deleted+::     ( 0): cannot login
+
+TODO: when a user is 'destroyed', pass everything he owns to another user or just mark the user as 'deleted'...
+=end
+class User < ActiveRecord::Base
+  include RubyLess::SafeClass
+  safe_attribute          :login, :name, :first_name, :email, :time_zone, :created_at, :updated_at
+  safe_method             :initials => String, :fullname => String, :status => Number, :status_name => String
+
+  zafu_context            :contact => "Contact"
+  attr_accessible         :login, :password, :lang, :first_name, :name, :email, :time_zone, :status, :group_ids, :site_ids
+  attr_accessor           :visited_node_ids
+  attr_accessor           :ip
+
+  belongs_to              :site
+  belongs_to              :contact, :dependent => :destroy
+  has_and_belongs_to_many :groups
+  has_many                :nodes
+  has_many                :versions
+
+  before_validation       :user_before_validation
+  validate                :valid_groups
+  validate                :valid_user
+  validates_uniqueness_of :login, :scope => :site_id
+
+  before_destroy          :dont_destroy_protected_users
+  validates_presence_of   :site_id
+  before_create           :create_contact
+
+  def contact_with_secure
+    @contact ||= secure(Contact) { contact_without_secure }
+  end
+  alias_method_chain :contact, :secure
+
+  Status = {
+    :su          => 80,
+    :admin       => 60,  # can create other users, manage site, etc
+    :user        => 50,  # can write articles + publish (depends on access rights)
+    :commentator => 40,  # can write comments
+    :moderated   => 30,  # can write comments (moderated)
+    :reader      => 20,  # can read
+    :deleted     => 0,
+  }.freeze
+  Num_to_status = Hash[*Status.map{|k,v| [v,k]}.flatten].freeze
+
+
+  class << self
+    # Returns the logged in user or nil if login and password do not match or if the user has no login access to the given host.
+    def login(login, password, host)
+      make_visitor :login => login, :password => password, :host => host
+    end
+
+    # Return the logged in visitor from the session[:user] or the anonymous user if id is nil or does not match
+    def make_visitor(opts)
+      raise ActiveRecord::RecordNotFound.new("host not found #{opts[:host]}") unless
+            site = opts[:site] || Site.find_by_host(opts[:host])
+
+      if opts[:id]        # session[:user]
+        conditions = ['users.id = ?', opts[:id]]
+      elsif opts[:login]  # login
+        return nil if opts[:password].blank?
+        conditions = ['login = ? AND password = ?',opts[:login], hash_password(opts[:password])]
+      else                # anonymous
+        conditions = ['users.id = ?', site[:anon_id]]
+      end
+
+      user = site.users.find(:first, :conditions => conditions)
+
+      if !user && opts[:id]
+        return make_visitor(:site => site) # anonymous user
+      end
+      return nil unless user
+      user.site = site
+      user.visit(site)
+      user.visit(user)
+
+      if user.reader?
+        unless Thread.current.respond_to?(:visitor)
+          class << Thread.current
+            attr_accessor :visitor
+          end
+        end
+        Thread.current.visitor = user
+      elsif !user.is_anon? && opts[:id]
+        # not a reader, refuse login
+        return make_visitor(:site => site)
+      else
+        # anon is not a reader, refuse anonymous user
+        nil
+      end
+    end
+
+    # Do not store clear passwords in the database (salted hash) :
+    def hash_password(string)
+      Digest::SHA1.hexdigest((string || '') + PASSWORD_SALT)
+    end
+
+    # Creates a new user without setting the defaults (used to create the first users of the site). Use
+    # new instead.
+    alias new_no_defaults new
+
+    # Creates a new user with the defaults set from the anonymous user.
+    def new(attrs={})
+      new_attrs = attrs.dup
+      anon = visitor.site.anon
+
+      # Set new user defaults based on the anonymous user.
+      [:lang, :time_zone, :status].each do |sym|
+        new_attrs[sym] = anon.send(sym) if attrs[sym].blank? && attrs[sym.to_s].blank?
+      end
+      super(new_attrs)
+    end
+  end
+
+  # Each time a node is found using secure (Zena::Acts::Secure or Zena::Acts::SecureNode), this method is
+  # called to set the visitor in the found object. This is also used to keep track of the opened nodes
+  # when rendering a page for the cache so we can know when to expire the cache.
+  def visit(obj, opts={})
+    if obj.kind_of? Node
+      obj.visitor = self #explicit visit
+      # keep track of the nodes connected to this visit to build the 'expire_with' list
+      visited_node_ids << obj[:id]
+    end
+  end
+
+  def visited_node_ids
+    @visited_node_ids ||= []
+  end
+
+  def fullname
+    (first_name ? (first_name + " ") : '') + name.to_s
+  end
+
+  def initials
+    fullname.split(" ").map {|w| w[0..0].capitalize}.join("")
+  end
+
+  def email
+    self[:email] || ""
+  end
+
+  # Store the password, using SHA1. You should change the default value of PASSWORD_SALT (in Zena::ROOT/lib/zena.rb). This makes it harder to use
+  # rainbow tables to find clear passwords from hashed values.
+  def password=(string)
+    if string.blank?
+      self[:password] = nil
+    elsif string && string.length > 4
+      self[:password] = User.hash_password(string)
+    else
+      @password_too_short = true
+    end
+  end
+
+  # Never display the password (even the hash) outside.
+  def password
+    ""
+  end
+
+  # Test password
+  def password_is?(str)
+    self[:password] == User.hash_password(str)
+  end
+
+  def status_name
+    Num_to_status[status].to_s
+  end
+
+  # Return true if the user is in the admin group or if the user is the super user.
+  def is_admin?
+    is_su? || status.to_i >= User::Status[:admin]
+  end
+
+  # Return true if the user is the anonymous user for the current visited site
+  def is_anon?
+    # tested in site_test
+    current_site.anon_id == self[:id] && (!new_record? || self[:login].nil?) # (when creating a new site, anon_id == nil)
+  end
+
+  # Return true if the user is the super user for the current visited site
+  def is_su?
+    # tested in site_test
+    current_site.su_id == self[:id]
+  end
+
+  # Return true if the user's status is high enough to start editing nodes.
+  def user?
+    status >= User::Status[:user]
+  end
+
+  # Return true if the user's status is high enough to write comments.
+  def commentator?
+    status >= User::Status[:moderated]
+  end
+
+  # Return true if the user's comments should be moderated.
+  def moderated?
+    status < User::Status[:commentator]
+  end
+
+  # Return true if the user's status is high enough to read. This is basically the same as
+  # not deleted?.
+  # TODO: test
+  def reader?
+    status >= User::Status[:reader]
+  end
+
+  # Return true if the user is deleted and should not be allowed to login.
+  # TODO: test
+  def deleted?
+    status == User::Status[:deleted]
+  end
+
+  # Returns a list of the group ids separated by commas for the user (this is used mainly in SQL clauses).
+  def group_ids
+    @group_ids ||= if is_admin?
+      current_site.groups.map{|g| g[:id]}
+    else
+      groups.find(:all, :order=>'name').map{ |g| g[:id] }
+    end
+  end
+
+  # Define the groups the user belongs to.
+  def group_ids=(list)
+    # We have to do our own method to avoid rails loading groups which will not be secured.
+    @defined_group_ids = list
+  end
+
+  def time_zone=(tz)
+    self[:time_zone] = tz.blank? ? nil : tz
+    @tz = nil
+  end
+
+  #TODO: test
+  # return only the ids of the groups really set (not all groups for admin or the like)
+  def group_set_ids
+    @group_set_ids ||= groups.map{|g| g[:id]}
+  end
+
+  # TODO: test
+  def tz
+    @tz ||= TZInfo::Timezone.get(self[:time_zone] || "UTC")
+  rescue TZInfo::InvalidTimezoneIdentifier
+    @tz = TZInfo::Timezone.get("UTC")
+  end
+
+  def comments_to_publish
+    if is_su?
+      # su can view all
+      secure(Comment) { Comment.find(:all, :conditions => ['status = ?', Zena::Status[:prop]]) }
+    else
+      secure(Comment) { Comment.find(:all, :select=>'comments.*, nodes.name', :from=>'comments, nodes, discussions',
+                   :conditions => ['comments.status = ? AND discussions.node_id = nodes.id AND comments.discussion_id = discussions.id AND nodes.dgroup_id IN (?)', Zena::Status[:prop], visitor.group_ids]) }
+    end
+  end
+
+  # List all versions proposed for publication that the user has the right to publish.
+  def to_publish
+    secure(Version) { Version.find(:all, :conditions => ['status = ? AND nodes.dgroup_id IN (?)', Zena::Status[:prop], visitor.group_ids]) }
+  end
+
+  # List all versions owned that are currently being written (status= +red+)
+  def redactions
+    secure(Version) { Version.find(:all, :conditions => ['status = ? AND versions.user_id = ?', Zena::Status[:red], self.id]) }
+  end
+
+  # List all versions owned that are currently being proposed (status= +prop+)
+  def proposed
+    secure(Version) { Version.find(:all, :conditions => ['status = ? AND versions.user_id = ?', Zena::Status[:prop], self.id]) }
+  end
+
+  private
+    def create_contact
+      return unless visitor.site[:root_id] # do not try to create a contact if the root node is not created yet
+
+      @contact = secure!(Contact) { Contact.new(
+        # owner is the user except for anonymous and super user.
+        # TODO: not sure this is a good idea...
+        :user_id       => (self[:id] == current_site[:anon_id] || self[:id] == current_site[:su_id]) ? visitor[:id] : self[:id],
+        :v_title       => (name.blank? || first_name.blank?) ? login : fullname,
+        :c_first_name  => first_name,
+        :c_name        => (name || login ),
+        :c_email       => email,
+        :v_status      => Zena::Status[:pub]
+      )}
+      @contact[:parent_id] = current_site[:root_id]
+
+      unless @contact.save
+        # What do we do with this error ?
+        raise Zena::InvalidRecord, "Could not create contact node for user #{self.id} in site #{site_id} (#{@contact.errors.map{|k,v| [k,v]}.join(', ')})"
+      end
+
+      unless @contact.publish_from
+        raise Zena::InvalidRecord, "Could not publish contact node for user #{user_id} in site #{site_id} (#{@contact.errors.map{|k,v| [k,v]}.join(', ')})"
+      end
+
+      self[:contact_id] = @contact[:id]
+    end
+
+    # Set user defaults.
+    def user_before_validation
+      return true if current_site.being_created?
+
+      self[:site_id] = visitor.site[:id]
+
+      if new_record?
+        self.status = current_site.anon.status if status.blank?
+        self.lang   = current_site.anon.lang   if lang.blank?
+      elsif status.blank?
+        self.status   = current_site.anon.status
+      end
+
+      if login.blank? && !is_anon?
+        self.login = name
+      end
+    end
+
+    # Returns the current site (self = visitor) or the visitor's site
+    # FIXME: remove and use 'site'
+    def current_site
+      @site || visitor.site
+    end
+
+    # Validates that anon user does not have a login, that other users have a password
+    # and that the login is unique for the sites the user belongs to.
+    def valid_user
+      self[:site_id] = visitor.site[:id]
+
+      if !current_site.being_created? && !visitor.is_admin? && visitor[:id] != self[:id]
+        errors.add('base', 'You do not have the rights to do this.')
+        return false
+      end
+
+      errors.add('lang', 'not available') unless current_site.lang_list.include?(lang)
+
+      if is_anon?
+        # Anonymous user *must* have an empty login
+        self[:login]    = nil
+        self[:password] = nil
+      else
+        if new_record?
+          # Refuse to add a user in a site if already a user with same login.
+          errors.add(:password, "can't be blank") if self[:password].nil? || self[:password] == ""
+        else
+          # get old password
+          old = User.find(self[:id])
+          self[:password] = old[:password] if self[:password].nil? || self[:password] == ""
+          errors.add(:login, "can't be blank") if self[:login].blank?
+          errors.add(:status, 'You do not have the rights to do this.') if self[:id] == visitor[:id] && old.is_admin? && self.status.to_i != old.status
+        end
+      end
+
+      if self[:time_zone]
+        begin
+          TZInfo::Timezone.get(self[:time_zone])
+        rescue
+          errors.add(:time_zone, 'invalid')
+        end
+      end
+
+      if @password_too_short
+        errors.add(:password, 'too short')
+        remove_instance_variable :@password_too_short
+      end
+    end
+
+    # Make sure all users are in the _public_ and _site_ groups. Make sure
+    # the user only belongs to groups in the same site.
+    def valid_groups #:doc:
+      g_ids = @defined_group_ids || (new_record? ? [] : group_set_ids)
+      g_ids.reject! { |g| g.blank? }
+      g_ids << current_site.public_group_id
+      g_ids << current_site.site_group_id unless is_anon?
+      g_ids.uniq!
+      g_ids.compact!
+      self.groups = []
+      g_ids.each do |id|
+        group = Group.find(id)
+        unless current_site.being_created? || group.site_id == self.site_id
+          errors.add('group', 'not found')
+          next
+        end
+        self.groups << group
+      end
+    end
+
+    # Do not allow destruction of the site's special users.
+    def dont_destroy_protected_users #:doc:
+      raise Zena::AccessViolation, "su and Anonymous users cannot be destroyed !" if current_site.protected_user_ids.include?(id)
+    end
+
+    def old
+      @old ||= self.class.find(self[:id])
+    end
+end