1 files changed, 211 insertions, 7 deletions

diff --git a/app/models/node.rb b/app/models/node.rb
index 717f5b4..a440c2f 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -4,17 +4,23 @@ class Node < ApplicationRecord
 
   # Associations
   has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
-  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy, optional: true
-  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy, optional: true
+  has_many    :node_actions, :dependent => :nullify
+  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, optional: true
+  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, optional: true
+  # Autosave pages carry no node_id, so has_many :pages does not cover
+  # them -- this dependent: :destroy is their only cleanup on node destroy.
   belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
+
   has_many    :permissions, :dependent => :destroy
   has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
   # Callbacks
-  after_create  :initialize_empty_page
-  before_save   :check_for_changed_slug
-  after_save    :update_unique_names_of_children
+  after_create   :initialize_empty_page
+  before_save    :check_for_changed_slug
+  after_save     :update_unique_names_of_children
+  before_destroy :refuse_destroy_with_children
+  before_destroy :refuse_destroying_trash_node
 
   # Validations
   validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? || slug.blank? }
@@ -22,6 +28,21 @@ class Node < ApplicationRecord
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
+  validate :reserved_slug_stays_reserved
+  validate :no_head_inside_trash
+  validates :default_template_name,
+            :inclusion   => { :in => ->(_) { Page.custom_templates } },
+            :allow_blank => true,
+            :if          => :default_template_name_changed?
+
+  # Everything outside the Trash subtree, the Trash node included.
+  # Relies on unique_name being authoritative for tree position --
+  # the same trust public routing places in it.
+  scope :not_in_trash, -> {
+    where.not(:unique_name => CccConventions::TRASH_SLUG)
+      .where("unique_name NOT LIKE ?", "#{CccConventions::TRASH_SLUG}/%")
+  }
+
   # Class methods
 
   # Returns a page for a given node. If no revision is supplied, it returns
@@ -48,6 +69,19 @@ class Node < ApplicationRecord
     nil
   end
 
+  # The Trash container node. Lazily self-creating and idempotent, so
+  # every environment acquires it on first touch.
+  # Never call from validations. the positional predicates below
+  # exist for that.
+  def self.trash
+    root.children.find_by(:slug => CccConventions::TRASH_SLUG) ||
+      root.children.create!(:slug => CccConventions::TRASH_SLUG).tap do |node|
+        Globalize.with_locale(I18n.default_locale) do
+          node.draft.update!(:title => "Trash")
+        end
+      end
+  end
+
   # Instance Methods
 
   # Acquires (or reaffirms) the editing lock without creating a draft or
@@ -194,6 +228,10 @@ class Node < ApplicationRecord
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
+    if in_trash? || trash_node?
+      raise ActiveRecord::RecordInvalid.new(self), "Cannot publish a node in the Trash"
+    end
+
     path_before = self.unique_name
 
     ActiveRecord::Base.transaction do
@@ -258,6 +296,117 @@ class Node < ApplicationRecord
     end
   end
 
+
+  # Moves this node and its subtree into the Trash. Demotes every head
+  # in the subtree first (aggregators and search operate on heads
+  # regardless of tree position); where a node has no draft, the former
+  # head becomes its draft so content stays editable and restorable --
+  # otherwise the former head remains a plain revision. One log entry,
+  # at the root, carrying the leaving-public-view snapshot.
+  def trash! current_user = nil
+    return nil if in_trash?
+    raise ActiveRecord::RecordInvalid.new(self), "The Trash node itself cannot be trashed" if trash_node?
+
+    ActiveRecord::Base.transaction do
+      path_before        = unique_name
+      was_published      = head_id.present?
+      final_published_at = head&.published_at
+
+      demoted = 0
+      ([self] + descendants.to_a).each do |node|
+        next unless node.head_id
+        former        = node.head
+        node.head     = nil
+        node.draft_id = former.id if node.draft_id.nil?
+        node.save!
+        demoted += 1
+      end
+
+      self.reload
+      move_to_child_of(Node.trash)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+      unlock!
+
+      metadata = { :path => { "from" => path_before, "to" => unique_name } }
+      metadata[:was_published]      = true if was_published
+      metadata[:final_published_at] = final_published_at.iso8601 if final_published_at
+      metadata[:demoted_heads]      = demoted if demoted > 0
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "trash", **metadata)
+      self
+    end
+  end
+
+  # Returns the node to the living tree under a chosen parent. The
+  # subtree comes back exactly as it sits in the Trash: all drafts,
+  # nothing published. Republication is a separate, witnessed act
+  # per node.
+  def restore_from_trash! new_parent, current_user = nil
+    return nil unless in_trash?
+
+    if new_parent.nil? || new_parent == self || descendants.include?(new_parent) ||
+       new_parent.trash_node? || new_parent.in_trash?
+      raise ActiveRecord::RecordInvalid.new(self), "Restore target must be a living node"
+    end
+
+    ActiveRecord::Base.transaction do
+      path_before = unique_name
+      move_to_child_of(new_parent)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "restore_from_trash",
+                          :path => { "from" => path_before, "to" => unique_name })
+      self
+    end
+  end
+
+  # Final deletion -- only from inside the Trash. Removes the whole
+  # subtree, deepest first, each node through a real destroy! so every
+  # per-node cascade runs (the categorical difference from the old
+  # delete_all nuke). refuse_destroy_with_children on bare destroy is
+  # untouched
+  # One log entry at the root, per the subtree rule, written before the
+  # rows die.
+  def destroy_from_trash! current_user = nil
+    raise ActiveRecord::RecordInvalid.new(self), "Nodes are only destroyed from the Trash" unless in_trash?
+
+    ActiveRecord::Base.transaction do
+      doomed = self_and_descendants_ordered_with_level
+                 .sort_by { |_, level| -level }
+                 .map(&:first)
+
+      metadata = { :path => unique_name }
+      metadata[:destroyed_descendants] = doomed.size - 1 if doomed.size > 1
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy", **metadata)
+      doomed.each(&:destroy!)
+    end
+  end
+
+  # The most recent trash entry. Its path.from is the restore hint.
+  def last_trash_entry
+    node_actions.where(:action => "trash").order(:occurred_at => :desc, :id => :desc).first
+  end
+
+  # The node's pre-trash parent, if a living node still answers to
+  # that path. Nil when the parent was itself trashed (its unique_name
+  # changed) or deleted; a different node that has since taken over
+  # the path is a legitimate suggestion.
+  def suggested_restore_parent
+    from = last_trash_entry&.metadata&.dig("path", "from")
+    return nil unless from
+
+    parent_path = from.rpartition("/").first
+    return Node.root if parent_path.empty?
+
+    candidate = Node.find_by(:unique_name => parent_path)
+    candidate unless candidate.nil? || candidate.in_trash? || candidate.trash_node?
+  end
+
   # returns an array with all parts of a unique_name rather than a string
   def unique_path
     unique_name.to_s.split("/")
@@ -269,7 +418,7 @@ class Node < ApplicationRecord
   end
 
   def computed_unique_name
-    path = path_to_root[1..-1].join("/") # excluding root
+    path_to_root[1..-1].join("/") # excluding root
   end
 
   def current_unique_name
@@ -313,6 +462,20 @@ class Node < ApplicationRecord
     autosave || draft || head
   end
 
+  def trash_node?
+    parent&.root? && slug == CccConventions::TRASH_SLUG
+  end
+
+  # Inside the Trash subtree. False for the Trash node itself.
+  def in_trash?
+    current = parent
+    while current
+      return true if current.trash_node?
+      current = current.parent
+    end
+    false
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -353,7 +516,7 @@ class Node < ApplicationRecord
   end
 
   def self.drafts_and_autosaves(current_user_id: nil)
-    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL")
+    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL").not_in_trash
     return scope.order("updated_at DESC") unless current_user_id
 
     scope.order(
@@ -361,6 +524,15 @@ class Node < ApplicationRecord
     )
   end
 
+  # Nodes are never destroyed recursively
+  # Descendants must be removed or reparented individually first.
+  # The Trash feature will be the ordinary path to deletion.
+  def refuse_destroy_with_children
+    return unless children.exists?
+    errors.add(:base, "Cannot destroy a node that still has children")
+    throw :abort
+  end
+
   def self.recently_changed
     includes(:head).where(
       "pages.updated_at < ? AND pages.updated_at > ? AND nodes.parent_id IS NOT NULL",
@@ -417,4 +589,36 @@ class Node < ApplicationRecord
         end
       end
     end
+
+  private
+
+    def reserved_slug_stays_reserved
+      if parent&.root? && !trash_node_already_me?
+        errors.add(:slug, "is reserved for the Trash") if slug == CccConventions::TRASH_SLUG
+        errors.add(:staged_slug, "is reserved for the Trash") if staged_slug == CccConventions::TRASH_SLUG
+      end
+
+      if persisted? && slug_was == CccConventions::TRASH_SLUG && Node.find(id).trash_node?
+        errors.add(:slug, "of the Trash node cannot change") if slug_changed?
+        errors.add(:parent_id, "of the Trash node cannot change") if parent_id_changed?
+        errors.add(:staged_slug, "must stay empty on the Trash node") if staged_slug.present?
+        errors.add(:staged_parent_id, "must stay empty on the Trash node") if staged_parent_id.present?
+      end
+    end
+
+    def trash_node_already_me?
+      existing = Node.root&.children&.find_by(:slug => CccConventions::TRASH_SLUG)
+      existing.nil? || existing.id == id
+    end
+
+    def no_head_inside_trash
+      return unless head_id.present?
+      errors.add(:head_id, "cannot exist inside the Trash") if in_trash? || trash_node?
+    end
+
+    def refuse_destroying_trash_node
+      return unless trash_node?
+      errors.add(:base, "The Trash node cannot be destroyed")
+      throw :abort
+    end
 end