9 files changed, 1044 insertions, 144 deletions

diff --git a/app/models/concerns/file_attachment.rb b/app/models/concerns/file_attachment.rb
index 0e99fa2..613a6f0 100644
--- a/app/models/concerns/file_attachment.rb
+++ b/app/models/concerns/file_attachment.rb
@@ -23,9 +23,10 @@ module FileAttachment
   extend ActiveSupport::Concern
 
   STYLES = {
-    medium:   { geometry: "300x300>",  format: nil },
-    thumb:    { geometry: "100x100>",  format: nil },
-    headline: { geometry: "460x250!",  format: nil }
+    medium:   { args: ["-resize", "300x300>"] },
+    thumb:    { args: ["-resize", "100x100>"] },
+    headline: { args: ["-resize", "460x250^", "-gravity", "center", "-extent", "460x250"] },
+    large:    { args: ["-resize", "1600x1600>"] }
   }.freeze
 
   IMAGE_CONTENT_TYPES    = %w[image/jpeg image/gif image/png image/webp].freeze
@@ -80,7 +81,7 @@ module FileAttachment
     STYLES.each do |style, options|
       dest_path = file_path(style)
       FileUtils.mkdir_p(File.dirname(dest_path))
-      system("magick", original_path, "-resize", options[:geometry], dest_path)
+      system("magick", original_path, *options[:args], dest_path)
     end
   end
 
diff --git a/app/models/concerns/nested_tree.rb b/app/models/concerns/nested_tree.rb
new file mode 100644
index 0000000..befcdb3
--- /dev/null
+++ b/app/models/concerns/nested_tree.rb
@@ -0,0 +1,78 @@
+# app/models/concerns/nested_tree.rb
+#
+# Minimal parent_id-based replacement for the tree-traversal subset of
+# awesome_nested_set actually used by this app (descendants, ancestors,
+# level, root, move_to_child_of)
+module NestedTree
+  extend ActiveSupport::Concern
+
+  included do
+    belongs_to :parent, class_name: name, foreign_key: :parent_id, optional: true, inverse_of: :children
+    has_many :children, -> { order(:id) }, class_name: name, foreign_key: :parent_id, inverse_of: :parent
+  end
+
+  class_methods do
+    def root
+      roots.first
+    end
+
+    def roots
+      where(parent_id: nil)
+    end
+
+    def valid?
+      # Every non-root row's parent_id must point at a real, existing row.
+      where.not(parent_id: nil).where.missing(:parent).none?
+    end
+  end
+
+  def root?
+    parent_id.nil?
+  end
+
+  def ancestors
+    result = []
+    current = parent
+    while current
+      result << current
+      current = current.parent
+    end
+    result
+  end
+
+  def level
+    ancestors.size
+  end
+
+  def descendants
+    ids = []
+    queue = self.class.where(parent_id: id).pluck(:id)
+    until queue.empty?
+      ids.concat(queue)
+      queue = self.class.where(parent_id: queue).pluck(:id)
+    end
+    self.class.where(id: ids)
+  end
+
+  def self_and_descendants
+    self.class.where(id: [id] + descendants.pluck(:id))
+  end
+
+  def self_and_descendants_ordered_with_level
+    nodes = [self] + descendants.to_a
+    children_by_parent = nodes.group_by(&:parent_id)
+    children_by_parent.each_value { |list| list.sort_by!(&:id) }
+
+    result = []
+    visit = ->(node, level) do
+      result << [node, level]
+      (children_by_parent[node.id] || []).each { |child| visit.call(child, level + 1) }
+    end
+    visit.call(self, 0)
+    result
+  end
+
+  def move_to_child_of(new_parent)
+    update!(parent_id: new_parent.id)
+  end
+end
diff --git a/app/models/concerns/rrule_humanizer.rb b/app/models/concerns/rrule_humanizer.rb
new file mode 100644
index 0000000..07141c1
--- /dev/null
+++ b/app/models/concerns/rrule_humanizer.rb
@@ -0,0 +1,130 @@
+module RruleHumanizer
+  extend ActiveSupport::Concern
+
+  WEEKDAY_NAMES = {
+    de: { "MO"=>"Montag","TU"=>"Dienstag","WE"=>"Mittwoch","TH"=>"Donnerstag","FR"=>"Freitag","SA"=>"Samstag","SU"=>"Sonntag" },
+    en: { "MO"=>"Monday","TU"=>"Tuesday","WE"=>"Wednesday","TH"=>"Thursday","FR"=>"Friday","SA"=>"Saturday","SU"=>"Sunday" }
+  }.freeze
+
+  WEEKDAY_NAMES_ADVERBIAL = {
+    de: { "MO"=>"montags","TU"=>"dienstags","WE"=>"mittwochs","TH"=>"donnerstags","FR"=>"freitags","SA"=>"samstags","SU"=>"sonntags" }
+  }.freeze
+
+  WEEKDAY_NAMES_ABBR = {
+    de: { "MO"=>"Mo","TU"=>"Di","WE"=>"Mi","TH"=>"Do","FR"=>"Fr","SA"=>"Sa","SU"=>"So" }
+  }.freeze
+
+  ORDINAL_NAMES = {
+    de: { 1=>"ersten", 2=>"zweiten", 3=>"dritten", 4=>"vierten", 5=>"fünften", -1=>"letzten", -2=>"vorletzten" },
+    en: { 1=>"first", 2=>"second", 3=>"third", 4=>"fourth", 5=>"fifth", -1=>"last", -2=>"second-to-last" }
+  }.freeze
+
+  MONTH_NAMES = {
+    de: %w[Januar Februar März April Mai Juni Juli August September Oktober November Dezember],
+    en: %w[January February March April May June July August September October November December]
+  }.freeze
+
+  def humanize_rrule(locale = I18n.locale)
+    return nil if rrule.blank?
+    parts = Hash[rrule.split(";").map { |p| p.split("=", 2) }]
+    return nil if parts["COUNT"] || parts["UNTIL"] # old one-off data, don't guess
+
+    freq, interval, byday, bymonth = parts["FREQ"], parts["INTERVAL"].to_i, parts["BYDAY"], parts["BYMONTH"]
+    loc = locale.to_sym
+    weekdays = WEEKDAY_NAMES[loc] || WEEKDAY_NAMES[:en]
+    ordinals = ORDINAL_NAMES[loc] || ORDINAL_NAMES[:en]
+    months   = MONTH_NAMES[loc]   || MONTH_NAMES[:en]
+
+    byday_values = byday&.split(",")
+    days = byday_values&.map do |d|
+     if d =~ /^(-?\d+)([A-Z]{2})$/
+        "#{ordinals[$1.to_i]} #{weekdays[$2]}"
+      else
+        weekdays[d]
+      end
+    end
+
+    excluded_monthly_ordinal = nil
+    excluded_monthly_weekday = nil
+    selected_monthly_ordinals = nil
+    selected_monthly_weekday = nil
+    if freq == "MONTHLY" && byday_values.present?
+      ordinal_days = byday_values.map { |d| d.match(/^([1-5])([A-Z]{2})$/) }
+      if ordinal_days.all?
+        positions = ordinal_days.map { |match| match[1].to_i }.uniq.sort
+        weekdays_in_rule = ordinal_days.map { |match| match[2] }.uniq
+        if weekdays_in_rule.size == 1
+          selected_monthly_ordinals = positions
+          selected_monthly_weekday = weekdays_in_rule.first
+          missing_positions = (1..5).to_a - positions
+          if positions.size == 4 && missing_positions.size == 1
+            excluded_monthly_ordinal = missing_positions.first
+            excluded_monthly_weekday = selected_monthly_weekday
+          end
+        end
+      end
+    end
+
+    join_ordinals = lambda do |ordinal_values, conjunction|
+      names = ordinal_values.map { |ordinal| ordinals[ordinal] }
+      names.size > 1 ? "#{names[0..-2].join(', ')} #{conjunction} #{names.last}" : names.first
+    end
+
+    base =
+      case loc
+      when :de
+        case freq
+        when "WEEKLY"
+          if days
+            if interval == 2
+              adverbial = byday.split(",").map { |d| WEEKDAY_NAMES_ADVERBIAL[:de][d] }
+              "Alle zwei Wochen #{adverbial.join(' und ')}"
+            else
+              "Jeden #{days.join(' und ')}"
+            end
+          else
+            interval == 2 ? "Alle zwei Wochen" : "Wöchentlich"
+          end
+        when "MONTHLY"
+          if excluded_monthly_ordinal
+            "Jeden #{weekdays[excluded_monthly_weekday]} im Monat, außer dem #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Jeden #{join_ordinals.call(selected_monthly_ordinals, 'und')} #{weekdays[selected_monthly_weekday]} im Monat"
+          else
+            days ? "Jeden #{days.join(' und ')} im Monat" : "Monatlich"
+          end
+        end
+      else
+        case freq
+        when "WEEKLY"
+          days ? "#{interval == 2 ? 'Every other' : 'Every'} #{days.join(' and ')}" : (interval == 2 ? "Every other week" : "Weekly")
+        when "MONTHLY"
+          if excluded_monthly_ordinal
+            "Every #{weekdays[excluded_monthly_weekday]} of the month, except the #{ordinals[excluded_monthly_ordinal]} #{weekdays[excluded_monthly_weekday]}"
+          elsif selected_monthly_ordinals
+            "Every #{join_ordinals.call(selected_monthly_ordinals, 'and')} #{weekdays[selected_monthly_weekday]} of the month"
+          else
+            days ? "Every #{days.join(' and ')} of the month" : "Monthly"
+          end
+        end
+      end
+    return nil unless base
+
+    if bymonth
+      included = bymonth.split(",").map(&:to_i)
+      missing = ((1..12).to_a - included)
+      if missing.size == 1
+        excluded_name = months[missing.first - 1]
+        base += (loc == :de ? ", außer im #{excluded_name}" : ", except in #{excluded_name}")
+      end
+      # more than one missing month: bymonth pattern more complex than we handle, leave base as-is silently
+    end
+
+    base
+  end
+
+  def self.wday_abbr(time, locale)
+    code = %w[SU MO TU WE TH FR SA][time.wday]
+    (WEEKDAY_NAMES_ABBR[locale.to_sym] || WEEKDAY_NAMES_ABBR[:de])[code]
+  end
+end
diff --git a/app/models/event.rb b/app/models/event.rb
index 94a22e3..b8651a8 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -1,25 +1,27 @@
 class Event < ApplicationRecord
-  
-  # Associations
-  
-  has_many    :occurrences
-  belongs_to  :node
-  
-  # Callbacks
-  
-  after_save  :generate_occurences
-  
-  # Instance Methods
-  
+  include RruleHumanizer
+
+  belongs_to :node, optional: true
+  has_many   :occurrences, dependent: :destroy
+  acts_as_taggable_on :tags
+
+  validates :title, presence: true, unless: -> { node_id.present? }
+
+  after_save :generate_occurrences
+
   def occurrences_in_range start_time, end_time
     self.occurrences.where(
       "start_time > ? AND end_time < ?",
       start_time, end_time
     )
-  end 
+  end
+
+  def display_title
+    title.presence || node&.head&.title || "Untitled event"
+  end
 
   private
-    def generate_occurences
+    def generate_occurrences
       Occurrence.generate self
     end
 end
diff --git a/app/models/node.rb b/app/models/node.rb
index 92ecc12..b5b18a1 100644
--- a/app/models/node.rb
+++ b/app/models/node.rb
@@ -1,35 +1,47 @@
 class Node < ApplicationRecord
   # Mixins and Plugins
-  acts_as_nested_set
+  include NestedTree
 
   # Associations
   has_many    :pages, -> { order("revision ASC") }, :dependent => :destroy
-  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, :dependent => :destroy, optional: true
-  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, :dependent => :destroy, optional: true
+  has_many    :node_actions, :dependent => :nullify
+  belongs_to  :head,  :class_name => "Page",  :foreign_key => :head_id, optional: true
+  belongs_to  :draft, :class_name => "Page",  :foreign_key => :draft_id, optional: true
+  # Autosave pages carry no node_id, so has_many :pages does not cover
+  # them -- this dependent: :destroy is their only cleanup on node destroy.
+  belongs_to  :autosave, :class_name => "Page", :foreign_key => :autosave_id, :dependent => :destroy, optional: true
+
   has_many    :permissions, :dependent => :destroy
-  has_one     :event, :dependent => :destroy
+  has_many    :events, :dependent => :destroy
   belongs_to  :lock_owner, :class_name => "User", :foreign_key => :locking_user_id, optional: true
 
   # Callbacks
-  after_create  :initialize_empty_page
-  before_save   :check_for_changed_slug
-  after_save    :update_unique_names_of_children
+  after_create   :initialize_empty_page
+  before_save    :check_for_changed_slug
+  after_save     :update_unique_names_of_children
+  before_destroy :refuse_destroy_with_children
+  before_destroy :refuse_destroying_trash_node
 
   # Validations
-  validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? }
+  validates_length_of     :slug, :within => 1..255,    :unless => -> { parent_id.nil? || slug.blank? }
   validates_presence_of   :slug,                       :unless => -> { parent_id.nil? }
   validates_uniqueness_of :slug, :scope => :parent_id, :unless => -> { parent_id.nil? }
   validates_presence_of   :parent_id,                  :unless => -> { Node.root.nil? }
 
-  validate :borders       # This should never ever happen.
+  validate :reserved_slug_stays_reserved
+  validate :no_head_inside_trash
+  validates :default_template_name,
+            :inclusion => { :in => ->(_) { Page.custom_templates } },
+            :allow_nil => true,
+            :if        => :default_template_name_changed?
 
-  # Index for Fulltext Search
-  # define_index do
-  #   indexes head.translations.title
-  #   indexes slug
-  #   indexes unique_name
-  #   indexes head.translations.body
-  # end
+  # Everything outside the Trash subtree, the Trash node included.
+  # Relies on unique_name being authoritative for tree position --
+  # the same trust public routing places in it.
+  scope :not_in_trash, -> {
+    where.not(:unique_name => CccConventions::TRASH_SLUG)
+      .where("unique_name NOT LIKE ?", "#{CccConventions::TRASH_SLUG}/%")
+  }
 
   # Class methods
 
@@ -57,30 +69,116 @@ class Node < ApplicationRecord
     nil
   end
 
+  # The Trash container node. Lazily self-creating and idempotent, so
+  # every environment acquires it on first touch.
+  # Never call from validations. the positional predicates below
+  # exist for that.
+  def self.trash
+    root.children.find_by(:slug => CccConventions::TRASH_SLUG) ||
+      root.children.create!(:slug => CccConventions::TRASH_SLUG).tap do |node|
+        Globalize.with_locale(I18n.default_locale) do
+          node.draft.update!(:title => "Trash")
+        end
+      end
+  end
+
   # Instance Methods
 
-  def find_or_create_draft current_user
-    self.wipe_draft!
-    if draft && self.lock_owner == current_user
-      draft
-    elsif draft && self.lock_owner.nil?
+  # Acquires (or reaffirms) the editing lock without creating a draft or
+  # an autosave -- both are now deferred until there is real content to
+  # hold.
+  def lock_for_editing! current_user
+    if self.lock_owner.nil? || self.lock_owner == current_user
       lock_for! current_user
-      draft.user    = current_user if draft.user.nil?
-      draft.editor  = current_user
-      draft.save
-      draft
-    elsif draft && self.lock_owner != current_user
+      if self.draft
+        self.draft.user = current_user if self.draft.user.nil?
+        self.draft.editor = current_user
+        self.draft.save!
+      end
+      self
+    else
       raise(
         LockedByAnotherUser,
         "Page is locked by another user who is working on it! " \
-        "Last modification: #{draft.updated_at.to_fs(:db)}"
+        "Last modification: #{(self.autosave || self.draft || self.head).updated_at.to_fs(:db)}"
       )
+    end
+  end
+
+  # Creates or updates the autosave buffer from the given attributes.
+  # Autosave rows are never associated to the node via node_id -- they
+  # must never appear in self.pages / the revisions list, which is the
+  # whole reason autosave exists as a separate, unversioned layer.
+  def autosave! attributes, current_user
+    assert_locked_by! current_user
+
+    unless self.autosave
+      self.autosave = Page.create!(:editor => current_user)
+      self.autosave.clone_attributes_from(self.draft || self.head) if self.draft || self.head
+      self.save!
+    end
+    self.autosave.assign_attributes(attributes)
+    self.autosave.save!
+    self.autosave
+  end
+
+  # Promotes the current autosave into the draft (creating the draft if
+  # none exists yet) and destroys the autosave afterward. This is what
+  # the explicit "Save" action does; it never creates a new revision --
+  # same as any other in-place draft edit. The new draft is created via
+  # self.pages.create! rather than by repointing the autosave's own
+  # node_id, because acts_as_list assigns the revision number at create
+  # time, scoped to node_id -- a page created with node_id nil and
+  # reassigned afterward would carry a wrong or missing revision number.
+  def save_draft! current_user
+    assert_locked_by! current_user
+    return unless self.autosave
+
+    if self.draft
+      preserved_published_at = self.draft.published_at
+      self.draft.clone_attributes_from self.autosave
+      self.draft.published_at = preserved_published_at
+      self.draft.user_id = self.autosave.user_id if self.autosave.user_id
+      self.draft.editor  = current_user
+      self.draft.save!
     else
-      lock_for! current_user
-      create_new_draft current_user
+      empty_page = self.pages.create!
+      empty_page.clone_attributes_from self.autosave
+      empty_page.user         = self.autosave.user_id ? self.autosave.user : (self.head ? self.head.user : current_user)
+      empty_page.editor       = current_user
+      empty_page.published_at = self.head.published_at if self.head
+      empty_page.save!
+      self.draft = empty_page
+      self.save!
+    end
+
+    self.autosave.destroy
+    self.autosave_id = nil
+    self.save!
+    self.draft.reload
+  end
+
+  def resolve_page_reference ref
+    case ref.to_s
+    when "head" then head
+    when "draft" then draft
+    when "autosave" then autosave
+    else pages.find_by_revision(ref)
     end
   end
 
+  # Which layer-pairs are meaningful to compare right now, given this
+  # node's actual state. Head vs autosave only shows up when no draft
+  # sits between them -- with a draft present, autosave is compared
+  # against the draft, never past it straight to head.
+  def available_layer_pairs
+    pairs = []
+    pairs << [:head, :draft]     if head && draft
+    pairs << [:draft, :autosave] if draft && autosave
+    pairs << [:head, :autosave]  if head && autosave && !draft
+    pairs
+  end
+
   def create_new_draft user
     empty_page        = self.pages.create!
     empty_page.user   = (self.head ? self.head.user : user)
@@ -94,67 +192,221 @@ class Node < ApplicationRecord
     self.draft.reload
   end
 
-  def publish_draft!
+  # Discards exactly the topmost non-empty layer -- autosave if present,
+  # else draft -- and reveals whatever's beneath it. Releases the lock
+  # only once nothing is left to protect (no draft survives); leaves it
+  # alone whenever a draft remains, since #edit still has real content
+  # open.
+  def revert! current_user
+    assert_locked_by! current_user
+
+    if self.autosave
+      self.autosave.destroy
+      self.autosave_id = nil
+      self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "discard_autosave")
+    elsif self.draft && self.head
+      self.draft.destroy
+      self.draft_id = nil
+      self.save!
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy_draft")
+    end
+
+    self.unlock! unless self.draft
+    self.reload
+  end
+
+  def staged_slug=(value)
+    if head.blank?
+      self.slug = value
+    else
+      super
+    end
+  end
+
+  def publish_draft! current_user = nil
     # Return nil if nothing to publish and no staged changes
     return nil unless self.draft || staged_slug || staged_parent_id
 
-    if self.draft
-      self.head = self.draft
-      self.head.published_at ||= Time.now
-      self.head.save!
-      self.draft = nil
+    if in_trash? || trash_node?
+      raise ActiveRecord::RecordInvalid.new(self), "Cannot publish a node in the Trash"
     end
 
-    if staged_slug && (staged_slug != slug)
-      self.slug = staged_slug
-      self.staged_slug = nil
+    path_before = self.unique_name
+
+    ActiveRecord::Base.transaction do
+      if self.draft
+        outgoing_head = self.head
+        self.head = self.draft
+        self.head.published_at ||= Time.now
+        self.head.save!
+        self.draft = nil
+
+        NodeAction.record!(:node => self, :page => self.head, :user => current_user,
+                            :action => "publish", :via => "draft",
+                            **NodeAction.head_diff(outgoing_head, self.head))
+      end
+
+      if staged_slug && (staged_slug != slug)
+        self.slug = staged_slug
+        self.staged_slug = nil
+      end
+
+      if staged_parent_id && (staged_parent_id != parent_id)
+        new_parent = Node.find(staged_parent_id)
+
+        if new_parent == self || self.descendants.include?(new_parent)
+          raise ActiveRecord::RecordInvalid.new(self), "Cannot move a node under itself or one of its own descendants"
+        end
+
+        self.staged_parent_id = nil
+        self.save!
+        self.move_to_child_of(new_parent)
+      else
+        unless self.save
+          raise ActiveRecord::RecordInvalid.new(self)
+        end
+      end
+
+      self.reload
+      self.update_unique_name
+      self.send(:update_unique_names_of_children)
+      if self.unique_name != path_before
+        NodeAction.record!(:node => self, :user => current_user, :action => "move",
+                            :path => { "from" => path_before, "to" => self.unique_name })
+      end
+      self.unlock!
+      self
     end
+  end
 
-    if staged_parent_id && (staged_parent_id != parent_id)
-      new_parent = Node.find(staged_parent_id)
-      self.staged_parent_id = nil
+  def restore_revision! revision, current_user = nil
+    page = self.pages.find_by_revision(revision)
+    return nil unless page
+
+    ActiveRecord::Base.transaction do
+      outgoing_head = self.head
+      self.head = page
       self.save!
-      self.move_to_child_of(new_parent)
-    else
-      unless self.save
-        raise ActiveRecord::RecordInvalid.new(self)
-      end
+
+      NodeAction.record!(:node => self, :page => page, :user => current_user,
+                          :action => "publish", :via => "revision",
+                          **NodeAction.head_diff(outgoing_head, page))
+      self
     end
+  end
 
-    self.reload
-    self.update_unique_name
-    self.send(:update_unique_names_of_children)
-    self.unlock!
-    self
+
+  # Moves this node and its subtree into the Trash. Demotes every head
+  # in the subtree first (aggregators and search operate on heads
+  # regardless of tree position); where a node has no draft, the former
+  # head becomes its draft so content stays editable and restorable --
+  # otherwise the former head remains a plain revision. One log entry,
+  # at the root, carrying the leaving-public-view snapshot.
+  def trash! current_user = nil
+    return nil if in_trash?
+    raise ActiveRecord::RecordInvalid.new(self), "The Trash node itself cannot be trashed" if trash_node?
+
+    ActiveRecord::Base.transaction do
+      path_before        = unique_name
+      was_published      = head_id.present?
+      final_published_at = head&.published_at
+
+      demoted = 0
+      ([self] + descendants.to_a).each do |node|
+        next unless node.head_id
+        former        = node.head
+        node.head     = nil
+        node.draft_id = former.id if node.draft_id.nil?
+        node.save!
+        demoted += 1
+      end
+
+      self.reload
+      move_to_child_of(Node.trash)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+      unlock!
+
+      metadata = { :path => { "from" => path_before, "to" => unique_name } }
+      metadata[:was_published]      = true if was_published
+      metadata[:final_published_at] = final_published_at.iso8601 if final_published_at
+      metadata[:demoted_heads]      = demoted if demoted > 0
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "trash", **metadata)
+      self
+    end
   end
 
-  # removes a draft and the lock if it is older than a day and still
-  # identical to head
-  def wipe_draft!
-    unless self.draft
-      self.unlock!
-      return
+  # Returns the node to the living tree under a chosen parent. The
+  # subtree comes back exactly as it sits in the Trash: all drafts,
+  # nothing published. Republication is a separate, witnessed act
+  # per node.
+  def restore_from_trash! new_parent, current_user = nil
+    return nil unless in_trash?
+
+    if new_parent.nil? || new_parent == self || descendants.include?(new_parent) ||
+       new_parent.trash_node? || new_parent.in_trash?
+      raise ActiveRecord::RecordInvalid.new(self), "Restore target must be a living node"
     end
-    return unless self.head
-    return unless self.draft.updated_at < 1.day.ago
-    return if self.head.has_changes_to? self.draft
 
-    self.draft.destroy
-    self.draft_id = nil
-    self.unlock!
-    self.save!
-    self.reload
+    ActiveRecord::Base.transaction do
+      path_before = unique_name
+      move_to_child_of(new_parent)
+      self.reload
+      update_unique_name
+      send(:update_unique_names_of_children)
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "restore_from_trash",
+                          :path => { "from" => path_before, "to" => unique_name })
+      self
+    end
   end
 
-  def restore_revision! revision
-    if page = self.pages.find_by_revision(revision)
-      self.head = page
-      self.save
-    else
-      nil
+  # Final deletion -- only from inside the Trash. Removes the whole
+  # subtree, deepest first, each node through a real destroy! so every
+  # per-node cascade runs (the categorical difference from the old
+  # delete_all nuke). refuse_destroy_with_children on bare destroy is
+  # untouched
+  # One log entry at the root, per the subtree rule, written before the
+  # rows die.
+  def destroy_from_trash! current_user = nil
+    raise ActiveRecord::RecordInvalid.new(self), "Nodes are only destroyed from the Trash" unless in_trash?
+
+    ActiveRecord::Base.transaction do
+      doomed = self_and_descendants_ordered_with_level
+                 .sort_by { |_, level| -level }
+                 .map(&:first)
+
+      metadata = { :path => unique_name }
+      metadata[:destroyed_descendants] = doomed.size - 1 if doomed.size > 1
+
+      NodeAction.record!(:node => self, :user => current_user, :action => "destroy", **metadata)
+      doomed.each(&:destroy!)
     end
   end
 
+  # The most recent trash entry. Its path.from is the restore hint.
+  def last_trash_entry
+    node_actions.where(:action => "trash").order(:occurred_at => :desc, :id => :desc).first
+  end
+
+  # The node's pre-trash parent, if a living node still answers to
+  # that path. Nil when the parent was itself trashed (its unique_name
+  # changed) or deleted; a different node that has since taken over
+  # the path is a legitimate suggestion.
+  def suggested_restore_parent
+    from = last_trash_entry&.metadata&.dig("path", "from")
+    return nil unless from
+
+    parent_path = from.rpartition("/").first
+    return Node.root if parent_path.empty?
+
+    candidate = Node.find_by(:unique_name => parent_path)
+    candidate unless candidate.nil? || candidate.in_trash? || candidate.trash_node?
+  end
+
   # returns an array with all parts of a unique_name rather than a string
   def unique_path
     unique_name.to_s.split("/")
@@ -165,9 +417,12 @@ class Node < ApplicationRecord
     parent.nil? ? [slug] : parent.path_to_root.push(slug)
   end
 
+  def computed_unique_name
+    path_to_root[1..-1].join("/") # excluding root
+  end
+
   def current_unique_name
-    path = path_to_root[1..-1] # excluding root
-    self.unique_name = path.join("/")
+    self.unique_name = computed_unique_name
   end
 
   def update_unique_name
@@ -203,6 +458,24 @@ class Node < ApplicationRecord
     unique_path.length == 3 && unique_path[0] == "updates"
   end
 
+  def editable_page
+    autosave || draft || head
+  end
+
+  def trash_node?
+    parent&.root? && slug == CccConventions::TRASH_SLUG
+  end
+
+  # Inside the Trash subtree. False for the Trash node itself.
+  def in_trash?
+    current = parent
+    while current
+      return true if current.trash_node?
+      current = current.parent
+    end
+    false
+  end
+
   # Returns immutable node id for all new nodes so that the atom feed entry ids
   # stay the same eventhough the slug or positions changes.
   # Can be removed after a year or so ;)
@@ -220,12 +493,68 @@ class Node < ApplicationRecord
       .distinct
   end
 
+  # This one is for admin-only views, where finding a draft is the point.
+  # Substring match on whichever of head/draft is present.
+  def self.editor_search(term)
+    words = term.to_s.split(/\s+/).reject(&:blank?)
+    return none if words.empty?
+
+    conditions = []
+    binds = {}
+
+    words.each_with_index do |word, i|
+      key = "term#{i}"
+      binds[key.to_sym] = "%#{sanitize_sql_like(word)}%"
+      conditions << "(head_translations.title ILIKE :#{key} OR head_translations.abstract ILIKE :#{key} " \
+                    "OR draft_translations.title ILIKE :#{key} OR draft_translations.abstract ILIKE :#{key})"
+    end
+
+    joins("LEFT JOIN page_translations head_translations ON head_translations.page_id = nodes.head_id")
+      .joins("LEFT JOIN page_translations draft_translations ON draft_translations.page_id = nodes.draft_id")
+      .where(conditions.join(" AND "), binds)
+      .distinct
+  end
+
+  def self.drafts_and_autosaves(current_user_id: nil)
+    scope = where("draft_id IS NOT NULL OR autosave_id IS NOT NULL").not_in_trash
+    return scope.order("updated_at DESC") unless current_user_id
+
+    scope.order(
+      Arel.sql(sanitize_sql_array(["CASE WHEN locking_user_id = ? THEN 0 ELSE 1 END, updated_at DESC", current_user_id]))
+    )
+  end
+
+  # Nodes are never destroyed recursively
+  # Descendants must be removed or reparented individually first.
+  # The Trash feature will be the ordinary path to deletion.
+  def refuse_destroy_with_children
+    return unless children.exists?
+    errors.add(:base, "Cannot destroy a node that still has children")
+    throw :abort
+  end
+
+  def self.recently_changed
+    includes(:head).where(
+      "pages.updated_at < ? AND pages.updated_at > ? AND nodes.parent_id IS NOT NULL",
+      Time.now, Time.now - 14.days
+    ).order("pages.updated_at desc").references(:head)
+  end
+
   protected
     def lock_for! current_user
       self.lock_owner = current_user
       self.save
     end
 
+    def assert_locked_by! current_user
+      return if self.lock_owner == current_user
+      raise(
+        LockedByAnotherUser,
+        "Page is locked by another user who is working on it! " \
+        "Last modification: #{(self.autosave || self.draft || self.head).updated_at.to_fs(:db)}"
+      )
+    end
+
     # Creates an empty page and associates it to the given node. This means
     # freshly created node has an empty draft. A user can create nodes as he
     # wants to which will not appear on the public page until the author edits
@@ -246,10 +575,13 @@ class Node < ApplicationRecord
     # Watch out recursion ahead! update_unique_name itself triggers this
     # after_save callback which invokes update_unique_name on its children.
     # Hopefully until no childrens occur
+    #
+    # Queries parent_id directly rather than the NestedTree#children
+    # association out of habit from the old awesome_nested_set-avoidance
+    # workaround - no longer strictly necessary now that children is
+    # equally safe, but left as-is since it already works correctly.
     def update_unique_names_of_children
       unless root?
-        # Use parent_id-based traversal instead of lft/rgt descendants
-        # due to awesome_nested_set not refreshing parent lft/rgt in memory
         Node.where(:parent_id => self.id).each do |child|
           child.reload
           child.update_unique_name
@@ -258,9 +590,35 @@ class Node < ApplicationRecord
       end
     end
 
-    def borders
-      if lft && rgt && (lft > rgt)
-        errors.add("Fuck!. lft should never be smaller than rgt")
+  private
+
+    def reserved_slug_stays_reserved
+      if parent&.root? && !trash_node_already_me?
+        errors.add(:slug, "is reserved for the Trash") if slug == CccConventions::TRASH_SLUG
+        errors.add(:staged_slug, "is reserved for the Trash") if staged_slug == CccConventions::TRASH_SLUG
       end
+
+      if persisted? && slug_was == CccConventions::TRASH_SLUG && Node.find(id).trash_node?
+        errors.add(:slug, "of the Trash node cannot change") if slug_changed?
+        errors.add(:parent_id, "of the Trash node cannot change") if parent_id_changed?
+        errors.add(:staged_slug, "must stay empty on the Trash node") if staged_slug.present?
+        errors.add(:staged_parent_id, "must stay empty on the Trash node") if staged_parent_id.present?
+      end
+    end
+
+    def trash_node_already_me?
+      existing = Node.root&.children&.find_by(:slug => CccConventions::TRASH_SLUG)
+      existing.nil? || existing.id == id
+    end
+
+    def no_head_inside_trash
+      return unless head_id.present?
+      errors.add(:head_id, "cannot exist inside the Trash") if in_trash? || trash_node?
+    end
+
+    def refuse_destroying_trash_node
+      return unless trash_node?
+      errors.add(:base, "The Trash node cannot be destroyed")
+      throw :abort
     end
 end
diff --git a/app/models/node_action.rb b/app/models/node_action.rb
new file mode 100644
index 0000000..13bd5ba
--- /dev/null
+++ b/app/models/node_action.rb
@@ -0,0 +1,169 @@
+class NodeAction < ApplicationRecord
+  belongs_to :node, optional: true
+  belongs_to :page, optional: true
+  belongs_to :user, optional: true
+
+  validates :action, presence: true
+  validates :occurred_at, presence: true
+
+  # == Metadata contract ==
+  #
+  # metadata is written once at creation, never updated. It is the
+  # single place anything that must survive deletion of the referenced
+  # rows lives; node_id/page_id/user_id are lookup and ordering only.
+  # All keys are strings. Pairs are always {"from" => x, "to" => y}.
+  # Optional pairs only when the sides differ; booleans only when
+  # true; required keys always present. Titles and names are read
+  # pinned to I18n.default_locale unless inside a locale-keyed block.
+  #
+  # Baseline, every entry (written here, not by call sites):
+  #   "username"                 -- actor's login at write time
+  #   "human_readable_node_name" -- node title, default locale
+  #
+  # "create":
+  #   "title" -- initial title, flat string (NOT a pair)
+  #   "path"  -- unique path at creation, flat string. Historical
+  #              value only; never a join key.
+  #
+  # "publish" (any promotion to head; diff computed BEFORE head is
+  # re-pointed, over the union of both pages' locales, by head_diff --
+  # shared with the backfill):
+  #   "via"    -- "draft" | "revision" (rollback). Always written;
+  #               absent means a pre-contract entry.
+  #   "title"  -- pair, always; "from" null on first publish
+  #   "author" -- pair, when the byline changed (incl. first publish)
+  #   "tags"   -- pair of arrays, when changed
+  #   "assets_changed", "template_changed",
+  #   "abstract_changed", "body_changed"
+  #            -- the last two for the default locale; page_id links
+  #               to the revision for the real diff (never stored)
+  #   "translation_diff" -- only when a non-default locale differs:
+  #     { "<locale>" => {
+  #         "status" -- "added" | "removed" | "changed"
+  #         "title"  -- pair, only when it differs; "from" null when
+  #                     added, "to" null when removed
+  #         "abstract_changed", "body_changed" -- status "changed" only
+  #     } }
+  #
+  # "move" (reparent and/or path change; one entry at the subtree
+  # root, descendants get none):
+  #   "path" -- pair
+  #
+  # "trash" (subtree into the Trash; every head in the subtree is
+  # demoted first; one entry at the root; snapshots the
+  # leaving-public-view state, since Trash holds no heads and destroy
+  # can no longer know):
+  #   "path"               -- pair; "from" doubles as the restore hint
+  #   "was_published"      -- boolean
+  #   "demoted_heads"      -- integer count, only when positive
+  #   "final_published_at" -- ISO8601 string, only when present
+  #
+  # "restore_from_trash" (reparent back to a living node; returns as
+  # drafts, republication is a separate witnessed act):
+  #   "path" -- pair
+  #
+  # "destroy" (only from inside the Trash, never with children; the
+  # entry is written in the same transaction before the row dies):
+  #   "path" -- final path, flat string (create-symmetric)
+  #   "destroyed_descendants" -- integer, only when positive; one entry
+  #                              at the root, per the subtree rule.
+  #
+  # Reserved: "demote" (via "trash" | "depublish") for an explicit
+  # depublish workflow, if ever built.
+  #
+  # Backfilled entries mirror this vocabulary; diff content is
+  # computed, only actor (page.editor) and occurred_at are inferred,
+  # inferred_from names the heuristic ("from_node_created_at",
+  # "from_page_revision"). Null = witnessed live.
+  #
+  # The "locale" column is written by no verb; retained.
+  #
+  # This log records; it does not undo. No IP, session, or user
+  # agent, ever. Success only.
+
+  def self.record!(node:, action:, user: nil, page: nil, locale: nil,
+                    occurred_at: nil, inferred_from: nil, **extra)
+    create!(
+      :node          => node,
+      :page          => page,
+      :user          => user,
+      :action        => action,
+      :locale        => locale,
+      :occurred_at   => occurred_at || Time.now,
+      :inferred_from => inferred_from,
+      :metadata      => {
+        "username"                 => user&.login,
+        "human_readable_node_name" => Globalize.with_locale(I18n.default_locale) {
+                                        node&.head&.title || node&.draft&.title
+                                      },
+      }.merge(extra.stringify_keys)
+    )
+  end
+
+  # Computes the publish-entry diff between an outgoing head and the
+  # page replacing it, in the exact metadata shape the contract above
+  # specifies. Pure function of its two arguments -- shared verbatim by
+  # publish_draft!, restore_revision!, and the backfill task. Reads
+  # translation rows directly, never locale-dependent accessors, so a
+  # fallback value is never mistaken for real content. Returns
+  # symbol-keyed top level for splatting into record!; nested keys are
+  # strings and jsonb serialization stringifies the rest at write time.
+  def self.head_diff old_page, new_page
+    default = I18n.default_locale
+
+    title_of = ->(page) { page&.translations&.find_by(:locale => default)&.title }
+    diff = { :title => { "from" => title_of.call(old_page),
+                         "to"   => title_of.call(new_page) } }
+    unless old_page
+      diff[:author] = { "from" => nil, "to" => new_page.user&.login } if new_page.user
+      return diff
+    end
+
+    old_author, new_author = old_page.user&.login, new_page.user&.login
+    diff[:author] = { "from" => old_author, "to" => new_author } if old_author != new_author
+
+    old_tags, new_tags = old_page.tag_list.sort, new_page.tag_list.sort
+    diff[:tags] = { "from" => old_tags, "to" => new_tags } if old_tags != new_tags
+
+    diff[:template_changed] = true if old_page.template_name != new_page.template_name
+    diff[:assets_changed]   = true if old_page.assets.map(&:id) != new_page.assets.map(&:id)
+
+    old_t = old_page.translations.find_by(:locale => default)
+    new_t = new_page.translations.find_by(:locale => default)
+    diff[:abstract_changed] = true if old_t&.abstract != new_t&.abstract
+    diff[:body_changed]     = true if old_t&.body != new_t&.body
+
+    locales = (old_page.translated_locales | new_page.translated_locales) - [default]
+    translation_diff = {}
+
+    locales.sort_by(&:to_s).each do |locale|
+      o = old_page.translations.find_by(:locale => locale)
+      n = new_page.translations.find_by(:locale => locale)
+
+      if o.nil?
+        translation_diff[locale.to_s] = { "status" => "added",
+                                          "title" => { "from" => nil, "to" => n.title } }
+      elsif n.nil?
+        translation_diff[locale.to_s] = { "status" => "removed",
+                                          "title" => { "from" => o.title, "to" => nil } }
+      elsif o.title != n.title || o.abstract != n.abstract || o.body != n.body
+        entry = { "status" => "changed" }
+        entry["title"]            = { "from" => o.title, "to" => n.title } if o.title != n.title
+        entry["abstract_changed"] = true if o.abstract != n.abstract
+        entry["body_changed"]     = true if o.body != n.body
+        translation_diff[locale.to_s] = entry
+      end
+    end
+
+    diff[:translation_diff] = translation_diff if translation_diff.any?
+    diff
+  end
+
+  def actor_name
+    metadata["username"] || "unknown"
+  end
+
+  def subject_name
+    metadata["human_readable_node_name"] || node&.unique_name || "deleted node"
+  end
+end
diff --git a/app/models/occurrence.rb b/app/models/occurrence.rb
index 3baf447..c6a2380 100644
--- a/app/models/occurrence.rb
+++ b/app/models/occurrence.rb
@@ -1,19 +1,19 @@
-# TODO Make a gem out of the c wrapper
 require 'chaos_calendar'
 
 class Occurrence < ApplicationRecord
   
   # Associations
   
-  belongs_to :node
+  belongs_to :node,  optional: true
   belongs_to :event
-  
+
   # Class Methods
   
   def self.find_in_range start_time, end_time
-    includes(:node)
-      .where("start_time > ? AND end_time < ?", start_time, end_time)
-      .order("start_time")
+    joins(:event)
+      .includes(:node)
+      .where("occurrences.start_time > ? AND occurrences.end_time < ?", start_time, end_time)
+      .order("occurrences.start_time")
   end
 
   def self.find_next
@@ -27,6 +27,7 @@ class Occurrence < ApplicationRecord
   # event are then calculated and created.
   def self.generate event
     self.where(:event_id => event.id).delete_all
+    return if event.start_time.nil?
     
     node        = event.node
     duration    = (event.end_time - event.start_time)
@@ -36,7 +37,7 @@ class Occurrence < ApplicationRecord
       self.create(
         :start_time => occurrence,
         :end_time   => (occurrence + duration),
-        :node_id    => node.id,
+        :node_id    => node&.id,
         :event_id   => event.id
       )
     end
@@ -49,10 +50,11 @@ class Occurrence < ApplicationRecord
   # Return value is always an array of Time objects.
   def self.generate_dates event
     if event.rrule && !event.rrule.empty?
-      ChaosCalendar::occurrences( 
+      ChaosCalendar::occurrences_for_timezone( 
         event.start_time, 
         (Time.now + 5.years), 
-        event.rrule
+        event.rrule,
+        Time.zone.tzinfo.identifier
       )
     else
       [event.start_time]
@@ -64,7 +66,7 @@ class Occurrence < ApplicationRecord
   # Instance Methods
   
   def summary
-    node.head.title
+    node&.head&.title || event.display_title
   end
-  
+
 end
diff --git a/app/models/page.rb b/app/models/page.rb
index e6baf20..c4d66fc 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -11,11 +11,21 @@ class Page < ApplicationRecord
 
   translates :title, :abstract, :body # Globalize2
 
+  # Template names render as filesystem paths; only names actually
+  # present in the public template directory are acceptable. Validated
+  # only on change so legacy rows whose template file has since
+  # vanished stay saveable -- valid_template already falls back to
+  # standard_template for those at render time.
+  validates :template_name,
+            :inclusion => { :in => ->(_) { Page.custom_templates } },
+            :allow_nil => true,
+            :if        => :template_name_changed?
+
   # Associations
   belongs_to :node, optional: true
   belongs_to :user, optional: true
   belongs_to :editor, :class_name => "User", optional: true
-  has_many   :related_assets
+  has_many   :related_assets, :dependent => :destroy
   has_many   :assets, -> { order("position ASC") }, :through => :related_assets
 
   # Named scopes
@@ -63,7 +73,24 @@ class Page < ApplicationRecord
       end
     end
 
-    scope.order("#{options[:order_by]} #{options[:order_direction]}")
+    if options[:node] && options[:children] == "direct"
+      scope = scope.where(nodes: { parent_id: options[:node].id })
+    elsif options[:node] && options[:children] == "all"
+      scope = scope.where(nodes: { id: options[:node].descendants.pluck(:id) })
+    end
+
+    direction = %w[ASC DESC].include?(options[:order_direction]&.upcase) ? options[:order_direction].upcase : "ASC"
+
+    if options[:order_by] == "title"
+      return scope
+        .order(Arel.sql("(SELECT pt.title FROM page_translations pt WHERE pt.page_id = pages.id AND pt.locale = #{ActiveRecord::Base.connection.quote(I18n.locale.to_s)}) #{direction}"))
+        .paginate(:page => page, :per_page => options[:limit])
+    end
+
+    column = options[:order_by].to_s.sub(/\Apages\./, "")
+    column = "id" unless %w[id published_at created_at updated_at].include?(column)
+
+    scope.order("pages.#{column} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end
 
@@ -73,6 +100,27 @@ class Page < ApplicationRecord
     end
   end
 
+  def self.non_default_locales
+    I18n.available_locales - [:root, I18n.default_locale]
+  end
+
+  # One row per non-default locale, read from the actual translation
+  # row -- never through the locale-dependent accessor, so a locale
+  # with no real translation yet reports as absent rather than quietly
+  # showing a fallback value borrowed from another locale.
+  def translation_summary
+    Page.non_default_locales.map do |locale|
+      translation = translations.find_by(:locale => locale)
+      {
+        :locale     => locale,
+        :exists     => translation.present?,
+        :title      => translation&.title,
+        :updated_at => translation&.updated_at,
+        :outdated   => translation.present? && outdated_translations?(:locale => locale)
+      }
+    end
+  end
+
   def self.untranslated(options = {:locale => :de})
     PageTranslation.all.group_by(&:page_id).select do |k,v|
       v.size == 1 && v.map{|x| x.locale}.include?(options[:locale])
@@ -128,22 +176,47 @@ class Page < ApplicationRecord
     "/#{node.unique_name}"
   end
 
+  def ensure_preview_token!
+    update!(preview_token: SecureRandom.urlsafe_base64(24)) unless preview_token.present?
+    preview_token
+  end
+
+  def revoke_preview_token!
+    update!(preview_token: nil)
+  end
+
   def clone_attributes_from page
     return nil unless page
 
     self.reload
+    page.translations.reload
 
     # Clone untranslated attributes
     self.tag_list         = page.tag_list
     self.template_name  ||= page.template_name
     self.published_at     = page.published_at
 
-    # Getting rid of the auto-generated empty translations
-    self.translations.delete_all
+    # Clone translated attributes -- update each locale in place rather
+    # than delete-and-recreate, so a locale whose content is genuinely
+    # unchanged keeps its real created_at/updated_at instead of looking
+    # freshly touched on every single save (which was silently defeating
+    # Page.find_with_outdated_translations' whole staleness comparison).
+    # search_vector is excluded deliberately: it's DB-trigger-maintained
+    # from title/abstract, not real content, and comparing a precomputed
+    # tsvector risked a false "changed" from representation noise alone.
+    source_locales = page.translations.map(&:locale)
+    self.translations.where.not(:locale => source_locales).destroy_all
 
-    # Clone translated attributes
-    page.translations.each do |translation|
-      self.translations.create!(translation.attributes.except("id", "page_id", "created_at", "updated_at"))
+    page.translations.each do |source_translation|
+      attrs = source_translation.attributes.except("id", "page_id", "created_at", "updated_at", "search_vector")
+      mine  = self.translations.find_by(:locale => source_translation.locale)
+
+      if mine
+        changed_attrs = attrs.reject { |k, v| mine.public_send(k) == v }
+        mine.update!(changed_attrs) if changed_attrs.any?
+      else
+        self.translations.create!(attrs)
+      end
     end
 
     # Clone asset references
@@ -152,6 +225,54 @@ class Page < ApplicationRecord
     self.save
   end
 
+  def diff_against other, view: :inline, locale: nil
+    if locale
+      mine, theirs = translations.find_by(:locale => locale), other.translations.find_by(:locale => locale)
+      my_title, my_abstract, my_body          = mine&.title,   mine&.abstract,   mine&.body
+      their_title, their_abstract, their_body = theirs&.title, theirs&.abstract, theirs&.body
+    else
+      my_title, my_abstract, my_body          = title, abstract, body
+      their_title, their_abstract, their_body = other.title, other.abstract, other.body
+    end
+
+    text_diffs =
+      if view == :side_by_side
+        {
+          title:    HtmlWordDiff.side_by_side(their_title.to_s,    my_title.to_s),
+          abstract: HtmlWordDiff.side_by_side(their_abstract.to_s, my_abstract.to_s),
+          body:     HtmlWordDiff.side_by_side(their_body.to_s,     my_body.to_s)
+        }
+      else
+        {
+          title:    HtmlWordDiff.inline(their_title.to_s,    my_title.to_s),
+          abstract: HtmlWordDiff.inline(their_abstract.to_s, my_abstract.to_s),
+          body:     HtmlWordDiff.inline(their_body.to_s,     my_body.to_s)
+        }
+      end
+
+    text_diffs.merge(
+      tags:          { added: tag_list.to_a - other.tag_list.to_a, removed: other.tag_list.to_a - tag_list.to_a },
+      template_name: { from: other.template_name, to: template_name, changed: template_name != other.template_name },
+      assets:        { added: assets.to_a - other.assets.to_a, removed: other.assets.to_a - assets.to_a }
+    )
+  end
+
+  def locale_diff_summary other
+    (translated_locales | other.translated_locales).sort_by(&:to_s).map do |locale|
+      mine   = translations.find_by(:locale => locale)
+      theirs = other.translations.find_by(:locale => locale)
+      {
+        :locale       => locale,
+        :exists_here  => mine.present?,
+        :exists_there => theirs.present?,
+        :changed      => mine.present? != theirs.present? ||
+                          mine&.title != theirs&.title ||
+                          mine&.abstract != theirs&.abstract ||
+                          mine&.body != theirs&.body
+      }
+    end
+  end
+
   def public?
     published_at.nil? ? true : published_at < Time.now
   end
@@ -208,46 +329,60 @@ class Page < ApplicationRecord
 
   end
 
+  # Installs (or re-installs) the trigger that keeps page_translations'
+  # search_vector in sync. Idempotent, safe to call on every boot.
+  # search_vector is populated by a raw Postgres trigger, not anything
+  # Rails' schema dumper can represent -- a database rebuilt from
+  # schema.rb rather than replayed migrations silently loses it.
+  def self.ensure_search_vector_trigger!
+    connection.execute(<<~SQL)
+      CREATE OR REPLACE FUNCTION page_translations_search_vector_update()
+      RETURNS trigger AS $$
+      BEGIN
+        NEW.search_vector := to_tsvector(
+          'simple',
+          coalesce(NEW.title, '') || ' ' ||
+          coalesce(NEW.abstract, '') || ' ' ||
+          coalesce(NEW.body, '')
+        );
+        RETURN NEW;
+      END;
+      $$ LANGUAGE plpgsql;
+
+      CREATE OR REPLACE TRIGGER page_translations_search_vector_trigger
+      BEFORE INSERT OR UPDATE ON page_translations
+      FOR EACH ROW EXECUTE PROCEDURE page_translations_search_vector_update();
+    SQL
+  end
+
   private
 
     def set_page_title
-      if title.nil?
-        title = "Untitled"
-      end
+      self.title = "Untitled" if title.nil?
     end
 
     def set_template
-      if node && node.update?
-        self.template_name = "update"
-      end
+      return if template_name.present?
+      self.template_name = node&.default_template_name || (node&.update? ? "update" : nil)
     end
 
     def rewrite_links_in_body
-      begin
-        if self.body
-          tmp_body    = "<div>#{self.body}</div>"
-          xml_string  = XML::Parser.string( tmp_body )
-          xml_doc     = xml_string.parse
-          links       = xml_doc.find("//a[not(starts-with(@href, 'http://'))]")
-          links       = links.reject { |l| l[:href] =~ /system\/uploads/ }
-          locales     = I18n.available_locales.reject {|l| l == :root}
+      return unless self.body
 
-          links.each do |link|
-            unless locales.include? link[:href].slice(1,2).to_sym
-              unless link[:href] =~ /sytem\/uploads/
-                link[:href] = link[:href].sub(/^\//, "/#{I18n.locale}/")
-              end
-            end
-          end
+      doc = Nokogiri::HTML::DocumentFragment.parse(self.body)
+      locales = I18n.available_locales.reject { |l| l == :root }
 
-          tmp_body = xml_doc.to_s.gsub(/(\n\<div\>|\<\/div\>\n)/, "")
-          tmp_body.gsub!("<?xml version=\"1.0\" encoding=\"UTF-8\"?>", "")
+      doc.css('a').each do |link|
+        href = link['href']
+        next unless href
+        next if href.start_with?('http://', 'https://')
+        next if href =~ /system\/uploads/
 
-          self.body = tmp_body
+        unless locales.include?(href.slice(1, 2)&.to_sym)
+          link['href'] = href.sub(/^\//, "/#{I18n.locale}/")
         end
-      rescue
-        nil
       end
-    end
 
+      self.body = doc.to_html
+    end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 92ac33a..5e47ae7 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,6 +1,10 @@
 require 'digest/sha1'
 
 class User < ApplicationRecord
+  has_secure_password(validations: false)
+
+  alias_method :authenticate_bcrypt, :authenticate
+
   # Mixins and Plugins
   include Authentication
   include Authentication::ByPassword
@@ -23,9 +27,30 @@ class User < ApplicationRecord
 
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
-    return nil if login.blank? || password.blank?
-    u = find_by_login(login) # need to get the salt
-    u && u.authenticated?(password) ? u : nil
+    return if login.blank? || password.blank?
+
+    user = find_by(login: login)
+    return unless user
+
+    user&.authenticate(password)
+  end
+
+  def authenticate(password)
+    if password_digest.present?
+      return self if authenticate_bcrypt(password)
+      return nil
+    end
+
+    return nil unless authenticate_legacy(password)
+
+    transaction do
+      self.password = password
+      self.crypted_password = nil
+      self.salt = nil
+      save!(validate: false)
+    end
+
+    self
   end
 
   # TODO: Do we really want to have downcase logins only?