wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
2.6 KiB
Ruby
75 lines
2.6 KiB
Ruby
module Api
|
|
# Everything about who has access to a document. Owner only.
|
|
class SharesController < BaseController
|
|
before_action :require_authentication
|
|
before_action :load_owned_document
|
|
|
|
# GET /api/documents/:document_id/share
|
|
def show
|
|
render json: share_json
|
|
end
|
|
|
|
# POST /api/documents/:document_id/share/links { role }
|
|
# One active link per role: creating one replaces (revokes) the previous.
|
|
def create_link
|
|
role = params.require(:role)
|
|
return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless ShareLink.roles.key?(role)
|
|
@doc.transaction do
|
|
@doc.share_links.active.where(role:).find_each(&:revoke!)
|
|
@doc.share_links.create!(role:, created_by: Current.user)
|
|
end
|
|
render json: share_json
|
|
end
|
|
|
|
# DELETE /api/documents/:document_id/share/links/:id
|
|
def revoke_link
|
|
@doc.share_links.active.find(params[:id]).revoke!
|
|
render json: share_json
|
|
end
|
|
|
|
# POST /api/documents/:document_id/share/invitations { email, role }
|
|
def invite
|
|
role = params.require(:role)
|
|
return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless MagicLink.roles.key?(role)
|
|
link = MagicLink.issue!(email: params.require(:email), purpose: :invitation, document: @doc, role:, invited_by: Current.user)
|
|
if link.email == Current.user.email
|
|
link.destroy!
|
|
return render(json: { error: "self_invite" }, status: :unprocessable_entity)
|
|
end
|
|
AuthMailer.invitation(link, link.token).deliver_later
|
|
render json: share_json
|
|
end
|
|
|
|
# PATCH /api/documents/:document_id/share/members/:user_id { role }
|
|
def update_member
|
|
m = @doc.document_memberships.find_by!(user_id: params[:user_id])
|
|
m.update!(role: params.require(:role))
|
|
render json: share_json
|
|
end
|
|
|
|
# DELETE /api/documents/:document_id/share/members/:user_id
|
|
def remove_member
|
|
@doc.document_memberships.where(user_id: params[:user_id]).delete_all
|
|
render json: share_json
|
|
end
|
|
|
|
private
|
|
|
|
def load_owned_document
|
|
@doc = Current.user.owned_documents.find(params[:document_id])
|
|
end
|
|
|
|
def share_json
|
|
{
|
|
links: @doc.share_links.active.order(:created_at).map(&:as_json),
|
|
members: @doc.document_memberships.includes(:user).order(:created_at).map do |m|
|
|
{ user_id: m.user_id, name: m.user.name, email: m.user.email, role: m.role, source: m.source }
|
|
end,
|
|
invitations: MagicLink.usable.invitation.where(document: @doc).order(:created_at).map do |i|
|
|
{ email: i.email, role: i.role, expires_at: i.expires_at.iso8601 }
|
|
end
|
|
}
|
|
end
|
|
end
|
|
end
|