wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
891 B
Ruby
28 lines
891 B
Ruby
# "Anyone with the link" access. The token is the secret part of the URL
|
|
# (/d/<document id>#k=<token>). It is stored in plain text so the owner can
|
|
# copy the link again at any time; the document content next to it in the
|
|
# same database is no less sensitive.
|
|
class ShareLink < ApplicationRecord
|
|
belongs_to :document
|
|
belongs_to :created_by, class_name: "User"
|
|
has_many :document_memberships, dependent: :delete_all
|
|
|
|
enum :role, { viewer: 0, editor: 1 }, validate: true
|
|
|
|
scope :active, -> { where(revoked_at: nil) }
|
|
|
|
before_validation(on: :create) { self.token ||= SecureRandom.urlsafe_base64(24) }
|
|
|
|
# Revoking also removes the access people got through this link.
|
|
def revoke!
|
|
transaction do
|
|
update!(revoked_at: Time.current)
|
|
document_memberships.delete_all
|
|
end
|
|
end
|
|
|
|
def as_json(*)
|
|
{ id:, role:, token:, created_at: created_at.iso8601 }
|
|
end
|
|
end
|