Add RelatedAssetsController: search, attach, detach, reorder

Backend for the asset-picker rebuild -- replaces the plan to dump
every image asset in the system into a hidden, unfiltered browse
panel on every node edit (the actual current behavior, confirmed by
reading nodes/edit.html.erb directly) with a small, name-scoped search
endpoint plus create/destroy/update for attach, detach, and reorder.

No schema change needed -- RelatedAsset already had everything this
requires (asset_id, page_id, an acts_as_list position). search excludes
assets already attached to the page, keeping results meaningfully small
given hundreds of assets total but only a handful per node in practice.
create is find_or_create_by! rather than a bare create!, guarding
against the same asset being attached twice from two separate search
results. update leans on acts_as_list's own insert_at rather than
custom position-shifting logic.

Node#editable_page (autosave || draft || head) is extracted since this
is now its third call site with identical logic -- deliberately not
touching nodes#show, which resolves draft || head without autosave on
purpose, a different and correct semantic for "current committed
state" versus "what's actively being edited."

4 files changed, 143 insertions, 0 deletions

diff --git a/app/controllers/related_assets_controller.rb b/app/controllers/related_assets_controller.rb
new file mode 100644
index 0000000..906c02c
--- /dev/null
+++ b/app/controllers/related_assets_controller.rb
@@ -0,0 +1,50 @@
+class RelatedAssetsController < ApplicationController
+  before_action :login_required
+  before_action :find_node
+
+  def search
+    term = params[:q].to_s.strip
+    if term.blank?
+      render json: []
+      return
+    end
+
+    attached_ids = @node.editable_page.related_assets.pluck(:asset_id)
+    results = Asset.images
+      .where("name ILIKE ?", "%#{term}%")
+      .where.not(id: attached_ids)
+      .limit(10)
+
+    render json: results.map { |a|
+      { id: a.id, name: a.name, thumb_url: a.upload.url(:thumb) }
+    }
+  end
+
+  def create
+    asset = Asset.find(params[:asset_id])
+    related = @node.editable_page.related_assets.find_or_create_by!(asset: asset)
+
+    render json: {
+      id: related.id,
+      asset_id: asset.id,
+      name: asset.name,
+      thumb_url: asset.upload.url(:thumb)
+    }
+  end
+
+  def destroy
+    @node.editable_page.related_assets.find(params[:id]).destroy
+    head :ok
+  end
+
+  def update
+    @node.editable_page.related_assets.find(params[:id]).insert_at(params[:position].to_i)
+    head :ok
+  end
+
+  private
+
+    def find_node
+      @node = Node.find(params[:node_id])
+    end
+end
diff --git a/app/models/node.rb b/app/models/node.rb
index 1d0a089..0361c1e 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -328,6 +328,10 @@ class Node < ApplicationRecord
     unique_path.length == 3 && unique_path[0] == "updates"
   end
 
+  def editable_page
+    autosave || draft || head
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
diff --git a/config/routes.rb b/config/routes.rb
index 92301e5..5d61bae 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -55,6 +55,12 @@ Cccms::Application.routes.draw do
           put :revert
         end
 
+        resources :related_assets, only: [:create, :destroy, :update] do
+          collection do
+            get :search
+          end
+        end
+
         resources :revisions do
           collection do
             post :diff
diff --git a/test/controllers/related_assets_controller_test.rb b/test/controllers/related_assets_controller_test.rb
new file mode 100644
index 0000000..a3082c2
--- /dev/null
+++ b/test/controllers/related_assets_controller_test.rb
@@ -0,0 +1,83 @@
+require 'test_helper'
+
+class RelatedAssetsControllerTest < ActionController::TestCase
+  test "search finds assets by name, excluding ones already attached" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_search_test")
+
+    attached = Asset.create!(:name => "biometrics-scan", :upload_content_type => "image/png")
+    node.draft.assets << attached
+
+    Asset.create!(:name => "biometrics-poster", :upload_content_type => "image/png")
+    Asset.create!(:name => "chaostreff-flyer", :upload_content_type => "image/png")
+
+    get :search, params: { :node_id => node.id, :q => "biometrics" }
+
+    json = JSON.parse(response.body)
+    names = json.map { |a| a["name"] }
+    assert_includes names, "biometrics-poster"
+    assert_not_includes names, "biometrics-scan"
+    assert_not_includes names, "chaostreff-flyer"
+  end
+
+  test "search returns an empty list for a blank term" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_blank_search_test")
+
+    get :search, params: { :node_id => node.id, :q => "" }
+
+    assert_equal [], JSON.parse(response.body)
+  end
+
+  test "create attaches an asset to the node's editable page" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_create_test")
+    asset = Asset.create!(:name => "erfa-photo", :upload_content_type => "image/png")
+
+    post :create, params: { :node_id => node.id, :asset_id => asset.id }
+
+    assert_response :success
+    assert_includes node.draft.reload.related_assets.map(&:asset_id), asset.id
+  end
+
+  test "create does not duplicate an already-attached asset" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_dup_test")
+    asset = Asset.create!(:name => "erfa-photo-2", :upload_content_type => "image/png")
+    node.draft.assets << asset
+
+    post :create, params: { :node_id => node.id, :asset_id => asset.id }
+
+    assert_response :success
+    assert_equal 1, node.draft.reload.related_assets.count
+  end
+
+  test "destroy removes the attached asset" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_destroy_test")
+    asset = Asset.create!(:name => "old-photo", :upload_content_type => "image/png")
+    node.draft.assets << asset
+    related = node.draft.related_assets.first
+
+    delete :destroy, params: { :node_id => node.id, :id => related.id }
+
+    assert_response :success
+    assert_equal 0, node.draft.reload.related_assets.count
+  end
+
+  test "update reorders the attached assets" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "related_assets_reorder_test")
+    first  = Asset.create!(:name => "first-photo", :upload_content_type => "image/png")
+    second = Asset.create!(:name => "second-photo", :upload_content_type => "image/png")
+    node.draft.assets << first
+    node.draft.assets << second
+
+    second_related = node.draft.related_assets.find_by(:asset_id => second.id)
+    patch :update, params: { :node_id => node.id, :id => second_related.id, :position => 1 }
+
+    assert_response :success
+    ordered_asset_ids = node.draft.reload.related_assets.map(&:asset_id)
+    assert_equal [second.id, first.id], ordered_asset_ids
+  end
+end