zena 1.2.7 → 1.2.8

data/History.txt

@@ -1,3 +1,58 @@
+In this history, elements listed with a '~' still need to be documented.
+
+== 1.2.8
+
+* Major changes
+  * Added "update_attributes_without_clone" and "save_without_clone" to update attributes
+    without versioning (used to sync attributes with external app). This does not change
+    timestamps nor version or node author.
+  * Added login retry wait delay on failures.
+  * Added support for 'in home' or 'from home' in sqliss.
+  * Added support for any scope with 'in sub_nodes' (uses fullpath field).
+  ~ Added forced skin setting for sites (overwrites all but ACL skin settings).
+  ~ Added support for profile users.
+  * Added support to edit auth_user (linked user) through node's pseudo attribute 'auth' (admin only) or
+    through 'auth_user'.
+  ~ Created 'manager' user status: can edit users (only through 'auth').
+  ~ Created 'currency' brick to fetch openexchangerates.org exchange rates.
+  * Do not render an older Ajax reply if a newer one has already been received. This fixes the
+    live query confusion.
+  * Fixed loose requirements of httparty and rubyzip preventing installation.
+  * Added 'fsize' method in view to display human readable octet size.
+  ~ Added 'pasteTable' option to disable (by setting false) multi cell paste in grid.
+  ~ Using contenteditable in grid instead of input form. Turn off with contenteditable option.
+  * Fixed grid bug when leaving page while in input field.
+  ~ Implemented 'fulltext match' or 'sphinx match' to use fulltext search in node query.
+  ~ Added 'group_id_to_name' to visitor (enables group name display from node auth settings).
+  ~ Added 'site_readonly' attribute to site with 'site.readonly?' rubyless. Useful for locking site during updates or migrations.
+    
+* Minor changes
+  * Fixed gemspec to not include TextMate helper and selenium plugin.
+  * Fixed xml generated file caching.
+  ~ Added NODE_ID in 'redir' param on node creation (replaced by actual id).
+  * Added fetch_html rubyless method to views (does an HTTP GET and returns body).
+  * Fixed a bug in site alias zafu compilation (wrong home reference).
+  * Fixed anchor in zazen url "":22#foo should link to anchor #foo in node '22'.
+  * Prop eval returning nil for title properly replaces title with class name.
+  * Type ctrl+return to enter a newline inside a grid.
+  * Checking for defined accessors on links before passing to relation proxy (this enables custom code
+    on relation modification without passing through RelationProxy).
+  * Refuses to delete user node unless visitor is a manager.
+  * Marks user as deleted and remove profile if node is destroyed.
+  ~ Enable 'parent_id', 'project_id', 'section_id' Rubyless methods.
+  * Fixed a critical bug related to changing a virtual class' superclass.
+  * Do not trigger Ajax 'loading' unless it takes more then 300 ms (avoid blink).
+  * Fixed tlabel on [input] when there is a default label (should overwride default).
+  * Fixed "<p do='input'..." so that the "p" tag is preserved.
+  * Using shift+enter to insert carriage return in grid.
+  * Improved jobs display.
+  * Fixed a cache handling bug where a page could exist in the filesystem without having a cache entry
+    in the database.
+  * Fixed building templates on the fly with fs_skin on JS call.
+  * Fixed rebuild_fullpath and added link in sites on web interface.
+  * Removing bricks.yml and other initial config files from 'rake zena:assets'.
+  * Request for 'login' page while logged in redirects to home page instead of clearing session (fixes iPhone login issues).
+
 == 1.2.6, 1.2.7 2013-08-16
 
 * Major changes
@@ -5,8 +60,8 @@
   * Added support for wkhtmltopdf (Thanks Jean-Baptiste).
   
 * Minor changes
-  * Added 'cmd' option for pdf brick. <== TODO: Document
-  * Added 'local_ips' option to bricks.yml (used when pdf engine cannot render non-public assets). <== TODO: Document
+  ~ Added 'cmd' option for pdf brick.
+  ~ Added 'local_ips' option to bricks.yml (used when pdf engine cannot render non-public assets).
   * Fixed dependency on newer versions of rails.
   
 == 1.2.5 2013-07-15
@@ -16,14 +71,14 @@
    implies changes to vhost files !
  * WARN: Properties in list context do not resolve with first element anymore. "first" prefix needed.
  * Enable VirtualClass on native classes !
- * Added 'activity' brick which records visitor's last "seen_at" date. <== TODO: Document
- * Support for site alias (other domain pointing to same data) "rake mkalias". <== TODO: Document
+ ~ Added 'activity' brick which records visitor's last "seen_at" date.
+ ~ Support for site alias (other domain pointing to same data) "rake mkalias".
 
 * Minor changes
  * Fixed encode_params in Ajax requests.
  * Fixed cached path in vhost file.
- * Added "uuid" method (generates a unique id). <== TODO: Document
- * Added support for JSON String in [string_hash] <== TODO: Document
+ ~ Added "uuid" method (generates a unique id).
+ ~ Added support for JSON String in [string_hash]
  * Added 'login_info' to Node.
  * Added 'group_names' to User class.
  * Fixed [headers] when 'Status' is set (change to redirect on 300).
@@ -31,10 +86,10 @@
 == 1.2.4 2013-06-13
 
 * Major changes
- * Added class filtering to Acl in 'create' action. <== TODO: Document
+ ~ Added class filtering to Acl in 'create' action.
  * Uploading html files does not transform them into zafu (use .zafu ext for this)
  * Added file upload support from zena remote API.
- * Added 'content_type' regexp to force virtual class on Document creation. <== TODO: Document
+ ~ Added 'content_type' regexp to force virtual class on Document creation.
  * Extended "create group" in vclass to be "allow group" (edit).
  * Added support for [versions_list] to display list of versions and status.
  
@@ -42,7 +97,7 @@
  * Support for raw html in zazen with '<notextile>' or '<html>' tag. Must be allowed with notextile='true' on [zazen] tag.
  * Fixed preview of content with ACL (considering the POST on /zafu as a 'read').
  * Added support for "class not like Image" or "class <> Image" to sqliss.
- * Added url to clear cache with /sites/clear_cache (admin only). <== TODO: Document
+ ~ Added url to clear cache with /sites/clear_cache (admin only).
  * encode_params now supports arrays.
  * Add 'id' to date input.
  * Fixed 404 error.
@@ -64,20 +119,20 @@
  * html_escape all properties by default
  * Better support for Passenger (default deployment method now)
  * Simplified caching (using cachestamp in filename)
- * Added preview='dom_id' to [form]. (Use preview_node to show preview content.) <== TODO: Document
- * Added "in_group" zafu method on visitor. <== TODO: Document
- * Added [upload_field] method to zafu to allow custom upload forms. <== TODO: Document
- * Added support for custom images on nodes with the "img_tag_{mode}" string attribute or the 'img_tag' hash attribute. <== TODO: Document
- * Added support for tag clouds through sqliss (<r:void do='tag_cloud from nodes in site' do='each' join=', '><r:name/> (<r:link_count/>)</r:void>). <== TODO: Document
+ ~ Added preview='dom_id' to [form]. (Use preview_node to show preview content.)
+ ~ Added "in_group" zafu method on visitor.
+ ~ Added [upload_field] method to zafu to allow custom upload forms.
+ ~ Added support for custom images on nodes with the "img_tag_{mode}" string attribute or the 'img_tag' hash attribute.
+ * Added support for tag clouds through sqliss (<r:void do='tag_cloud from nodes in site' do='each' join=', '><r:name/> (<r:link_count/>)</r:void>).
 
 * Minor changes
- * Support for 'lang_list' when creating vhost file <== TODO: Document
- * Support for Range in zafu. <== TODO: Document
- * Added options to query_parse to ignore unwanted parameters <== TODO: Document
- * Added 'hparams' option to only return Hash parameters from params. <== TODO: Document
+ ~ Support for 'lang_list' when creating vhost file
+ ~ Support for Range in zafu.
+ ~ Added options to query_parse to ignore unwanted parameters
+ ~ Added 'hparams' option to only return Hash parameters from params.
  * Fixed query_parse to convert dates to UTC.
  * Fixed form preview inside block.
- * Added unique id to img_tag_{mode} code generated 'UUID'. <== TODO: Document
+ ~ Added unique id to img_tag_{mode} code generated 'UUID'.
  * Added PATH_mode.format and [JS] marker to img_tag_{mode}.
  * Fixed form preview with long text (use POST).
 
@@ -100,12 +155,12 @@
 * Minor changes
  * Fixed label traduction for param.
  * Enable ajax response on Node destroy (use dummy update parameter).
- * Added 'sum' method on array. <===== TODO: Document
+ ~ Added 'sum' method on array.
  * Added 'loading' option to [filter].
  * Added 'master_template' zafu method to access the master template used for compilation.
  * Fixed creation of modules bug.
  * Using latest QueryBuilder (fixes default scope bug).
- * Added 'ssl_on_auth' option to force https after (and during) login. <=== TODO: Document
+ ~ Added 'ssl_on_auth' option to force https after (and during) login.
  * Removing evaluated strings if copy_id is blank.
  * Exporting relations by class name instead of kpath (may differ from site to site).
  * Using any character to build kpath if no character from the class name can be used.
@@ -113,7 +168,7 @@
  * Added support for "target" in [zazen] when rendering links.
  * Fixed kpath propagation to relations on kpath change.
  * Fixed [block] in [block] with [filter] bug.
- * Added support for KPATH_VALUE(ClassName) in custom queries. <==== TODO: Document
+ ~ Added support for KPATH_VALUE(ClassName) in custom queries.
  * Fixed class scoping Contact? when current node is more specialized.
  * Fixed bug on syntax error in Acl query.
  * Fixed cache expire bug (some pages were not properly removed).
@@ -124,7 +179,7 @@
  * Added 'remove_from_db' method to remove a site from the database.
  * Fixed asset caching PLEASE FIX YOUR VHOST FILES: rake zena:create_vhost -s host='xxxxx'.
  * Fixed deadlock_retry (a bug in the error message aborted the retry).
- * Created 'spreadsheet' brick to ease xlsx and csv generation. <===== TODO: Document
+ ~ Created 'spreadsheet' brick to ease xlsx and csv generation.
  * Better JS based grid editor.
 
 * Minor changes
@@ -134,9 +189,9 @@
  * Enabled 'alt_class' to work on multiple elements ([each]).
  * Fixed ajax bugs with dom_ids in nested partials.
  * Better Acl display, comments on relations.
- * Support for 'to_date' on time object with proper timezone translation. <===== TODO: Document
+ ~ Support for 'to_date' on time object with proper timezone translation.
  * Time to 'year' should use timezone.
- * Added tprefix to [select] (with default value) to ease translated options for select. <===== TODO: Document
+ ~ Added tprefix to [select] (with default value) to ease translated options for select.
  * Fixed bug when using [input] checkbox with param.
  * Added jobs list in admin links.
 

data/Rakefile

@@ -26,8 +26,8 @@ begin
     gemspec.rubyforge_project = 'zena'
 
     gemspec.files.exclude 'config/routes.rb'
-    gemspec.files.exclude 'vendor/plugins/selenium-on-rails'
-    gemspec.files.exclude 'vendor/TextMate'
+    gemspec.files.exclude %r{^vendor/plugins/selenium-on-rails}
+    gemspec.files.exclude %r{vendor/TextMate}
 
 
     # Gem dependecies

data/app/controllers/columns_controller.rb

@@ -25,7 +25,7 @@ class ColumnsController < ApplicationController
       end
     end
 
-    @column  = Column.new
+    @column  = Column.new(:versioned => true)
 
     respond_to do |format|
       format.html # index.html.erb
@@ -47,7 +47,7 @@ class ColumnsController < ApplicationController
   # GET /columns/new
   # GET /columns/new.xml
   def new
-    @column = Column.new
+    @column = Column.new(:versioned => true)
 
     respond_to do |format|
       format.html # new.html.erb

data/app/controllers/nodes_controller.rb

@@ -18,7 +18,10 @@ Examples:
 
 =end
 class NodesController < ApplicationController
+  before_filter :check_not_readonly,  :except => [:index, :show, :search, :zafu, :not_found]
+  
   before_filter :check_is_admin,  :only => [:export]
+  
   before_filter :check_api_group
   if Bricks.raw_config['passenger']
     before_filter :escape_path, :only => [:index, :show]
@@ -269,7 +272,10 @@ class NodesController < ApplicationController
       if @node.errors.empty?
         flash.now[:notice] = 'Node was successfully created.'
         format.html {
-          redirect_to  params[:redir] || zen_path(@node, :mode => params[:mode], :new => 'true')
+          if redir = params[:redir]
+            redir = redir.gsub('NODE_ID', @node.zip.to_s)
+          end
+          redirect_to  redir || zen_path(@node, :mode => params[:mode], :new => 'true')
         }
         format.js do
           if params[:zjs]
@@ -320,8 +326,7 @@ class NodesController < ApplicationController
     respond_to do |format|
       format.html do
         if @node.destroy
-          # These flash messages tend to hang around stupidly
-          # flash[:notice] = _("Node destroyed.")
+          flash[:notice] = _("Node destroyed.")
           redirect_to params[:redir] || zen_path(@node.parent)
         else
           flash.now[:notice] = _("Could not destroy node.")
@@ -423,11 +428,18 @@ class NodesController < ApplicationController
     params['node'] ||= {}
     file, file_error = get_attachment
     params['node']['file'] = file if file
-    # Make sure we load the correct version for edited v_lang
-    lang = params['node']['v_lang'] || visitor.lang
-    @node.version(lang)
-    @v_status_before_update = @node.v_status
-    @node.update_attributes_with_transformation(params['node'])
+    
+    #============= [TRANSACTION HERE to prevent double version bug on double submit
+    # This can only fix the issue if Version creation/saving is not done after_commit !!
+    Node.transaction do
+      # Make sure we load the correct version for edited v_lang
+      lang = params['node']['v_lang'] || visitor.lang
+      @node.version(lang)
+      @v_status_before_update = @node.v_status
+      @node.update_attributes_with_transformation(params['node'])
+    end
+    #============= TO HERE TRANSACTION]
+    
     # What is this 'extfile' thing ?
     @node.errors.add('extfile', file_error) if file_error
 
@@ -456,27 +468,8 @@ class NodesController < ApplicationController
               redirect_to params[:redir] || zen_path(@node, :mode => params[:mode])
             end
           else
-            begin
-              if request.referer
-                route = ActionController::Routing::Routes.recognize_path(request.referer[%r{https?://[^/]+(.*)},1])
-              else
-                route = {:action => 'show'}
-              end
-              if route[:action] == 'index'
-                mode = '+index'
-              elsif route[:action] == 'search'
-                mode = '+search'
-              elsif path = route[:path]
-                if path.last =~ Zena::Use::Urls::ALLOWED_REGEXP
-                  zip  = $3
-                  name = $4
-                  mode = $5 == '' ? nil : $5[1..-1]
-                end
-              end
-            rescue ActionController::RoutingError
-              mode = nil
-            end
-            render_and_cache :mode => mode, :cache => false
+            flash[:error] = error_messages_for(:node, :object => @node).html_safe
+            redirect_to zen_path(@node, :mode => params[:mode])
           end
         end # html
 

data/app/controllers/user_sessions_controller.rb

@@ -8,21 +8,41 @@ class UserSessionsController < ApplicationController
 
   # /login
   def new
-    @node = visitor.site.root_node
-    render_and_cache :mode => '+login'
+    # If user is already logged in, redirect to home page
+    if !visitor.is_anon?
+      redirect_to home_path(:prefix => prefix)
+    else
+      @node = visitor.site.root_node
+      render_and_cache :mode => '+login'
+    end
   end
 
   def create
     User.send(:with_scope, :find => {:conditions => ['site_id = ?', visitor.site.id]}) do
+      if user = User.find_by_login(params[:login])
+        # FAIL: 1s, FAIL: 2s, FAIL: 4s, FAIL: 8s, FAIL: 16s, FAIL: 32s, FAIL: 64s
+        wait_in_seconds = 2 ** user.login_attempt_count.to_i
+        elapsed         = Time.now.to_i - user.login_attempted_at.to_i
+        if elapsed < wait_in_seconds
+          w = Time.at(wait_in_seconds - elapsed)
+          msg = _("You need to wait %ih %im %is before any new attempt (%i failed attempts).")
+          flash[:error] = msg % [w.hour, w.min, w.sec, user.login_attempt_count.to_i]
+          return redirect_to login_path
+        end
+      else
+        flash[:error] = _("Invalid login or password.")
+        return redirect_to login_path
+      end
       @user_session = UserSession.new(:login=>params[:login], :password=>params[:password])
       if @user_session.save
-        #flash.now[:notice] = _("Successfully logged in.")
+        # Reset login attempts count
+        Zena::Db.set_attribute(user, 'login_attempt_count', 0)
+        Zena::Db.set_attribute(user, 'login_attempted_at',  nil)
         redirect_to  redirect_after_login
       else
-        flash[:notice] = _("Invalid login or password.")
-        # FIXME: find a better way to lock without blocking the process.
-        # Also lock longer and longer (exponentially).
-        sleep(2)
+        flash[:error] = _("Invalid login or password.")
+        Zena::Db.set_attribute(user, 'login_attempt_count', user.login_attempt_count.to_i + 1)
+        Zena::Db.set_attribute(user, 'login_attempted_at',  Time.now.utc)
         redirect_to login_path
       end
     end
@@ -41,7 +61,7 @@ class UserSessionsController < ApplicationController
       else
         # Keep current host and port settings
         host = host_with_port
-        http = host =~ /:/ ? 'https' : 'http'
+        http = host =~ /:443/ ? 'https' : 'http'
       end
       #flash.now[:notice] = _("Successfully logged out.")
       redirect_to "#{http}://#{host}#{params[:redirect] || home_path(:prefix => prefix)}"
@@ -57,8 +77,13 @@ class UserSessionsController < ApplicationController
       unless site = Site.find_by_host(request.host)
         raise ActiveRecord::RecordNotFound.new("host not found #{request.host}")
       end
-
-      setup_visitor(anonymous_visitor(site), site)
+      
+      if params[:action] == 'new'
+        # keep visitor
+        super
+      else
+        setup_visitor(anonymous_visitor(site), site)
+      end
     end
 
     def redirect_after_login

data/app/controllers/users_controller.rb

@@ -15,7 +15,7 @@ class UsersController < ApplicationController
   # Show the list of users. Rendered in the admin layout.
   def index
     secure!(User) do
-      @users = User.paginate(:all, :order => 'status DESC, login ASC', :page => params[:page], :per_page => 20)
+      @users = User.paginate(:all, :order => 'COALESCE(is_profile,0) DESC, status DESC, login ASC', :page => params[:page], :per_page => 20)
     end
 
     get_groups_list
@@ -151,7 +151,7 @@ class UsersController < ApplicationController
         if params[:user]
           # visitor changing his/her own info : restrict fields
           params[:user].keys.each do |k|
-            params[:user].delete(k) unless [:login, :time_zone, :lang, :password, :time_zone, :retype_password, :old_password].include?(k.to_sym)
+            params[:user].delete(k) unless ['login', 'time_zone', 'lang', 'password', 'time_zone', 'retype_password', 'old_password'].include?(k.to_s)
           end
         end
       else

data/app/controllers/versions_controller.rb

@@ -1,7 +1,7 @@
 require 'differ'
 class VersionsController < ApplicationController
   layout :popup_layout, :except => [:preview, :diff, :show]
-  before_filter :find_version, :verify_access
+  before_filter :find_version, :check_not_readonly, :verify_access
 
   # Display a specific version of a node
   def show
@@ -284,7 +284,7 @@ class VersionsController < ApplicationController
       # make the flash available to rjs helpers
       @flash = flash
       respond_to do |format|
-        format.html { redirect_to params[:redir] || @redirect_url || request.env['HTTP_REFERER'] || {:id => 0}}
+        format.html { redirect_to params[:redir] || @redirect_url || request.env['HTTP_REFERER'] || zen_path(@node)}
         # js = call from 'drive' popup
         format.js   { render :action => 'update' }
       end

data/app/models/group.rb

@@ -21,6 +21,7 @@ class Group < ActiveRecord::Base
   before_save             :do_replace_by
   before_destroy          :check_can_destroy
   belongs_to              :site
+  after_save              :update_dependant_users
 
   # FIXME: test translate_pseudo_id for groups
   def self.translate_pseudo_id(id,sym=:id)
@@ -116,7 +117,9 @@ class Group < ActiveRecord::Base
           errors.add('base', 'you cannot add or remove users from this group')
           return false
         end
-
+        
+        @model_users   = self.users.select {|u| u.is_profile?}
+        model_user_ids = @model_users.map(&:id)
         self.users    = []
         visitor_added = false
         @defined_user_ids.each do |id|
@@ -125,6 +128,9 @@ class Group < ActiveRecord::Base
             next
           end
           self.users << user
+          if user.is_profile?
+            @model_users << user unless model_user_ids.include?(user.id)
+          end
           visitor_added = user[:id] == visitor[:id]
         end
       end
@@ -144,4 +150,12 @@ class Group < ActiveRecord::Base
       end
       return errors.empty?
     end
+    
+    def update_dependant_users
+      if list = @model_users
+        list.each do |u|
+          u.save # Force sync
+        end
+      end
+    end
 end

data/app/models/node.rb

@@ -149,6 +149,9 @@ class Node < ActiveRecord::Base
   include Property::Serialization::JSON
 
   store_properties_in :version
+  
+  invalid_property_failover 'title' => 'INVALID PROPERTY', 'ext' => 'txt', 'content/type' => 'text/plain'
+  
 
   property do |p|
     # Multilingual string index on 'title'
@@ -185,6 +188,7 @@ class Node < ActiveRecord::Base
   before_create      :node_before_create
   after_save         :spread_project_and_section
   after_create       :node_after_create
+  before_destroy     :node_before_destroy
   after_destroy      :node_after_destroy
   attr_protected     :zip, :id, :section_id, :project_id, :publish_from, :created_at, :updated_at
   attr_protected     :site_id
@@ -230,7 +234,9 @@ class Node < ActiveRecord::Base
 
   # we use safe_method because the columns can be null, but the values are never null
   safe_method        :kpath => String, :user_zip => Number, :user_id => Number,
-                     :parent_zip => Number, :project_zip => Number, :section_zip => Number,
+                     :parent_id   => {:class => Number, :method =>  'parent_zip'}, :parent_zip  => Number,
+                     :project_id  => {:class => Number, :method => 'project_zip'}, :project_zip => Number, 
+                     :section_id  => {:class => Number, :method => 'section_zip'}, :section_zip => Number,
                      :ref_lang => String,
                      :position => Number, :rgroup_id => Number,
                      :wgroup_id => Number, :dgroup_id => Number, :custom_base => Boolean,
@@ -244,8 +250,10 @@ class Node < ActiveRecord::Base
                      :versions => {:class => ['Version'], :method => 'zafu_versions'},
                      :version => 'Version', :v_status => Number, :v_lang => String,
                      :v_publish_from => Time, :v_backup => Boolean,
-                     :zip => Number, :parent_id => {:class => Number, :nil => true, :method => 'parent_zip'},
+                     :zip  => Number, :parent_id => {:class => Number, :nil => true, :method => 'parent_zip'},
                      :user => 'User',
+                     :auth_user => {:class => 'User', :nil => true},
+                     :auth      => StringHash,
                      :author => author_proc,
                      :vclass => {:class => 'VirtualClass', :method => 'virtual_class'},
                      :new_record? => Boolean,
@@ -640,7 +648,7 @@ class Node < ActiveRecord::Base
       if attributes['file'] && !(klass.kpath =~ %r{^ND})
         klass = VirtualClass['Document']
       end
-
+      
       if klass.kind_of?(VirtualClass)
         node = secure(klass.real_class) { klass.new_instance(attributes) }
       else
@@ -1037,7 +1045,7 @@ class Node < ActiveRecord::Base
 
   # check inheritance chain through kpath
   def kpath_match?(kpath)
-    vclass.kpath =~ /^#{kpath}/
+    self.kpath =~ /^#{kpath}/
   end
 
   # virtual class
@@ -1472,6 +1480,45 @@ class Node < ActiveRecord::Base
     return nil unless type = virtual_class.safe_method_type([method])
     res = eval(type[:method])
     res ? res.to_s : nil
+  end  
+
+  def auth=(params)
+    return unless visitor.is_manager?
+    if !users = auth_users
+      # Create user
+      user = secure(User) { User.new }
+      users = @auth_users = [user]
+      @auth_user = user
+    end
+    users.each do |user|
+      user.attributes = params
+    end
+    @auth = nil
+  end
+  
+  # Find all users using this node as contact node.
+  def auth_users
+    @auth_users ||= new_record? ? nil : secure(User) { User.all(:conditions => {:node_id => self.id}) }
+  end
+  
+  def auth
+    @auth ||= if l = auth_user
+      h = StringHash.new
+      [:login, :lang, :profile].each do |k|
+        h[k] = auth_user.send(k)
+      end
+      h
+    else
+      {}
+    end
+  end
+  
+  # Find first user using this node as contact node
+  def auth_user
+    @auth_user ||= begin
+      l = auth_users
+      l && l.first
+    end
   end
 
   protected
@@ -1611,7 +1658,8 @@ class Node < ActiveRecord::Base
 
     # Make sure the node is complete before creating it (check parent and project references)
     def validate_node
-      errors.add(:title, "can't be blank") if title.blank?
+      # Make sure title is never blank
+      self.title = vclass.name if title.blank?
 
       if @parent_zip_error
         errors.add('parent_id', @parent_zip_error)
@@ -1663,9 +1711,21 @@ class Node < ActiveRecord::Base
       if vclass.auto_create_discussion
         Discussion.create(:node_id=>self[:id], :lang=>v_lang, :inside => false)
       end
+      
+      update_auth_user
+    end
+    
+    def node_before_destroy
+      if !visitor.is_manager? && auth_users
+        errors.add(:base, 'Cannot destroy: node is a user')
+        false
+      else
+        true
+      end
     end
     
     def node_after_destroy
+      update_auth_user
       sweep_cache
     end
 
@@ -1747,7 +1807,7 @@ class Node < ActiveRecord::Base
       allOK
     end
 
-    # This method is run whenever 'apply' is called.
+    # This method is run whenever 'apply' is called (not on create or destroy).
     def after_all
       return unless super
       if @add_comment
@@ -1762,8 +1822,49 @@ class Node < ActiveRecord::Base
         remove_instance_variable(:@add_comment)
       end
       remove_instance_variable(:@discussion) if defined?(@discussion) # force reload
-
-      true
+      
+      update_auth_user
+    end
+    
+    def update_auth_user
+      if destroyed?
+        if users = auth_users
+          users.each do |user|
+            user.profile_id = nil
+            user.node_id    = nil
+            user.status = User::Status[:deleted]
+            if !user.save
+              user.errors.each do |k,v|
+                errors.add("user[#{k}]", v)
+              end
+            end
+          end
+        end
+        errors.empty?
+      elsif users = auth_users
+        auth_user = users.first
+        if auth_user.new_record? || auth_user.changed?
+          users.each do |user|
+            if user.new_record?
+              # Creating user
+              user.node_id = self.id
+            end
+            
+            if user.login.blank?
+              user.login = title.strip
+            end
+            
+            if !user.save
+              user.errors.each do |k,v|
+                errors.add("user[#{k}]", v)
+              end
+            end
+          end
+        end
+        errors.empty?
+      else
+        true
+      end
     end
 
     def change_klass