wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.0 KiB
Ruby
29 lines
1.0 KiB
Ruby
module Api
|
|
class BaseController < ApplicationController
|
|
# the app sends the CSRF token from the page's meta tag as X-CSRF-Token
|
|
protect_from_forgery with: :exception
|
|
|
|
rescue_from ActiveRecord::RecordNotFound do
|
|
render json: { error: "not_found" }, status: :not_found
|
|
end
|
|
rescue_from ActiveRecord::RecordInvalid do |e|
|
|
render json: { error: "invalid", messages: e.record.errors.full_messages }, status: :unprocessable_entity
|
|
end
|
|
rescue_from ActionController::InvalidAuthenticityToken do
|
|
render json: { error: "csrf" }, status: :unprocessable_entity
|
|
end
|
|
|
|
private
|
|
|
|
# a share link token, for visitors (with or without account) who got the link
|
|
def share_token = request.headers["X-Share-Token"].presence
|
|
|
|
# identifies the lock holder: one browser tab
|
|
def client_id = request.headers["X-Client-Id"].to_s[0, 64].presence || "anon"
|
|
|
|
def lock_holder = "#{Current.user&.id || 'anon'}:#{client_id}"
|
|
|
|
def holder_name = Current.user&.name || "Jemand mit dem Link"
|
|
end
|
|
end
|