wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
3.3 KiB
Ruby
88 lines
3.3 KiB
Ruby
module Api
|
|
# Server documents. Listing and creating need an account; reading and
|
|
# writing a single document also work with just a share link token.
|
|
class DocumentsController < BaseController
|
|
before_action :require_authentication, only: %i[index create]
|
|
before_action :load_document, except: %i[index create]
|
|
|
|
# GET /api/documents -- owned + shared with me
|
|
def index
|
|
user = Current.user
|
|
memberships = user.document_memberships.index_by(&:document_id)
|
|
docs = user.accessible_documents.includes(:owner, :updated_by).order(content_updated_at: :desc)
|
|
render json: {
|
|
documents: docs.map { |d| d.meta_json(role: d.owner_id == user.id ? :owner : memberships[d.id]&.role) }
|
|
}
|
|
end
|
|
|
|
# POST /api/documents { title, content } -- also used to upload a local document
|
|
def create
|
|
doc = Current.user.owned_documents.create!(
|
|
title: params.require(:title), content: content_param, updated_by: Current.user
|
|
)
|
|
render json: { document: doc.meta_json(role: :owner) }, status: :created
|
|
end
|
|
|
|
# GET /api/documents/:id[?known_version=n]
|
|
# With known_version: just the metadata when nothing changed since.
|
|
def show
|
|
touch_membership
|
|
meta = @doc.meta_json(role: @role).merge(lock: @doc.lock_info(lock_holder))
|
|
if params[:known_version].present? && params[:known_version].to_i == @doc.version
|
|
render json: { document: meta, unchanged: true }
|
|
else
|
|
render json: { document: meta.merge(content: @doc.content) }
|
|
end
|
|
end
|
|
|
|
# PATCH /api/documents/:id { title } and/or { content, base_version }
|
|
def update
|
|
return forbidden unless Document.role_at_least?(@role, :editor)
|
|
if params.key?(:content)
|
|
return render(json: { error: "locked", holder_name: @doc.lock_holder_name }, status: :locked) if @doc.locked_by_other?(lock_holder)
|
|
@doc.with_lock do
|
|
if params.require(:base_version).to_i != @doc.version
|
|
return render(json: { error: "conflict", version: @doc.version }, status: :conflict)
|
|
end
|
|
@doc.update!(content: content_param, version: @doc.version + 1,
|
|
content_updated_at: Time.current, updated_by: Current.user)
|
|
end
|
|
end
|
|
@doc.update!(title: params[:title]) if params[:title].present?
|
|
render json: { document: @doc.meta_json(role: @role) }
|
|
end
|
|
|
|
# DELETE /api/documents/:id -- the owner deletes it; anyone else leaves it
|
|
def destroy
|
|
if @role == :owner
|
|
@doc.destroy!
|
|
elsif Current.user
|
|
@doc.document_memberships.where(user: Current.user).delete_all
|
|
else
|
|
return forbidden
|
|
end
|
|
head :no_content
|
|
end
|
|
|
|
private
|
|
|
|
def load_document
|
|
@doc = Document.find(params[:id])
|
|
@role = @doc.role_for(user: Current.user, token: share_token)
|
|
raise ActiveRecord::RecordNotFound unless @role # 404, not 403: don't confirm it exists
|
|
end
|
|
|
|
def content_param
|
|
c = params.require(:content)
|
|
c.is_a?(String) ? c : c.to_unsafe_h.to_json
|
|
end
|
|
|
|
def touch_membership
|
|
return unless Current.user
|
|
@doc.document_memberships.where(user: Current.user).update_all(last_opened_at: Time.current)
|
|
end
|
|
|
|
def forbidden = render(json: { error: "forbidden" }, status: :forbidden)
|
|
end
|
|
end
|