9 files changed, 248 insertions, 111 deletions

diff --git a/config/application.rb b/config/application.rb
index 0be3396..5ec3e8f 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -17,6 +17,7 @@ module Cccms
     config.time_zone = 'Berlin'
 
     config.i18n.default_locale = :de
+    config.i18n.available_locales = [:de, :en]
     config.i18n.fallbacks = { en: [:en, :de] }
 
     config.filter_parameters += [:password, :password_confirmation]
diff --git a/config/environments/test.rb b/config/environments/test.rb
index bb89065..08fcefa 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -42,6 +42,8 @@ Rails.application.configure do
   # Print deprecation notices to the stderr.
   config.active_support.deprecation = :stderr
 
+  config.active_record.verify_foreign_keys_for_fixtures = false
+
   # Raises error for missing translations.
   # config.i18n.raise_on_missing_translations = true
 
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index d51d713..1569942 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -4,26 +4,29 @@
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header
 
-# Rails.application.configure do
-#   config.content_security_policy do |policy|
-#     policy.default_src :self, :https
-#     policy.font_src    :self, :https, :data
-#     policy.img_src     :self, :https, :data
-#     policy.object_src  :none
-#     policy.script_src  :self, :https
-#     policy.style_src   :self, :https
-#     # Specify URI for violation reports
-#     # policy.report_uri "/csp-violation-report-endpoint"
-#   end
-#
-#   # Generate session nonces for permitted importmap, inline scripts, and inline styles.
-#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-#   config.content_security_policy_nonce_directives = %w(script-src style-src)
-#
-#   # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`
-#   # if the corresponding directives are specified in `content_security_policy_nonce_directives`.
-#   # config.content_security_policy_nonce_auto = true
-#
-#   # Report violations without enforcing the policy.
-#   # config.content_security_policy_report_only = true
-# end
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src    :self
+    policy.script_src     :self
+    policy.style_src      :self, :unsafe_inline
+    policy.img_src        :self, :data
+    policy.font_src       :self
+    policy.object_src     :none
+    policy.frame_ancestors :none
+    policy.base_uri       :self
+    policy.form_action    :self
+    policy.report_uri     "/csp_reports"
+  end
+
+  # Per-request nonce; script-src only. style-src keeps unsafe_inline
+  # deliberately: TinyMCE emits img[style] in body content and the
+  # public layout carries style attributes -- CSS injection is a
+  # low-yield channel, script-src is where the protection lives.
+  config.content_security_policy_nonce_generator  = ->(request) { SecureRandom.base64(16) }
+  config.content_security_policy_nonce_directives = %w[script-src]
+
+  # Report-only: nothing blocks. Enforcement is a later, deliberate
+  # flip once the reports have mapped reality (admin inline scripts,
+  # legacy hotlinked images in old bodies, embeds).
+  config.content_security_policy_report_only = true
+end
diff --git a/config/initializers/ensure_search_vector_trigger.rb b/config/initializers/ensure_search_vector_trigger.rb
new file mode 100644
index 0000000..a750e9c
--- /dev/null
+++ b/config/initializers/ensure_search_vector_trigger.rb
@@ -0,0 +1,7 @@
+Rails.application.config.after_initialize do
+  begin
+    Page.ensure_search_vector_trigger! if Page.connection.table_exists?(:page_translations)
+  rescue ActiveRecord::NoDatabaseError, ActiveRecord::ConnectionNotEstablished, PG::ConnectionBad
+    # Database doesn't exist yet -- e.g. mid `rails db:create`. Nothing to install yet.
+  end
+end
diff --git a/config/initializers/error_log.rb b/config/initializers/error_log.rb
new file mode 100644
index 0000000..74117cb
--- /dev/null
+++ b/config/initializers/error_log.rb
@@ -0,0 +1,20 @@
+# Every controller-level exception (the 500s) in one lean file,
+# independent of the base log level -- log/production.log can stay
+# quiet without losing error visibility.
+if Rails.env.production?
+  error_logger = ActiveSupport::Logger.new(Rails.root.join("log", "errors.log"))
+
+  ActiveSupport::Notifications.subscribe("process_action.action_controller") do |*, payload|
+    if (exception = payload[:exception_object])
+      status = ActionDispatch::ExceptionWrapper.status_code_for_exception(exception.class.name)
+      next if status < 500
+
+      error_logger.error(
+        "#{Time.now.iso8601} [#{status}] #{payload[:controller]}##{payload[:action]} #{payload[:path]} " \
+        "-- #{exception.class}: #{exception.message}\n    " +
+        Array(exception.backtrace).first(5).join("\n    ")
+      )
+    end
+  end
+end
+
diff --git a/config/initializers/rails_icons.rb b/config/initializers/rails_icons.rb
new file mode 100644
index 0000000..1503db7
--- /dev/null
+++ b/config/initializers/rails_icons.rb
@@ -0,0 +1,16 @@
+RailsIcons.configure do |config|
+  config.default_library = "tabler"
+  config.default_variant = "outline" # Set a default variant for all libraries
+
+  # Override Tabler defaults
+  # config.libraries.tabler.default_variant = "" # Set a default variant for Tabler
+  # config.libraries.tabler.exclude_variants = [] # Exclude specific variants
+
+  # config.libraries.tabler.regular.default.css = "size-6"
+  # config.libraries.tabler.solid.default.css = "size-6"
+  # config.libraries.tabler.solid.default.data = {}
+
+  # config.libraries.tabler.outline.default.css = "size-6"
+  # config.libraries.tabler.outline.default.stroke_width = "2"
+  # config.libraries.tabler.outline.default.data = {}
+end
diff --git a/config/locales/de.yml b/config/locales/de.yml
index 5f77d79..f64f6cd 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -7,6 +7,19 @@ de:
   sponsors: Sponsoren
   show_tag_headline: "Seiten mit dem Tag:"
   old_ccc_de: das alte ccc.de
+  event_schedule_time: "um %{time} Uhr"
+  event_schedule_unrecognized: "Termin-Regel nicht automatisch lesbar"
+  event_schedule_none: "Kein Termin"
+  open_days: "Offene Tage"
+  open_days_label: "Offene Tage"
+  upcoming_events: "Weitere Termine"
+  open_today: "Das Chaos, lokal und heute offen"
+  published: "veröffentlicht"
+  published_by: "veröffentlicht durch %{editor}"
+  last_edited: "zuletzt bearbeitet"
+  last_edited_by: "zuletzt bearbeitet durch %{editor}"
+  editor_self: "du"
+  publisher_self: "dich"
   date:
     formats:
       default: "%d.%m.%Y"
@@ -22,7 +35,6 @@ de:
       - :day
       - :month
       - :year
-
   time:
     formats:
       default: "%A, %e. %B %Y, %H:%M Uhr"
@@ -34,42 +46,6 @@ de:
     am: "vormittags"
     pm: "nachmittags"
 
-  datetime:
-    distance_in_words:
-      half_a_minute: 'eine halbe Minute'
-      less_than_x_seconds:
-        zero: 'weniger als 1 Sekunde'
-        one: 'weniger als 1 Sekunde'
-        other: 'weniger als {{count}} Sekunden'
-      x_seconds:
-        one: '1 Sekunde'
-        other: '{{count}} Sekunden'
-      less_than_x_minutes:
-        zero: 'weniger als 1 Minute'
-        one: 'weniger als eine Minute'
-        other: 'weniger als {{count}} Minuten'
-      x_minutes:
-        one: '1 Minute'
-        other: '{{count}} Minuten'
-      about_x_hours:
-        one: 'etwa 1 Stunde'
-        other: 'etwa {{count}} Stunden'
-      x_days:
-        one: '1 Tag'
-        other: '{{count}} Tage'
-      about_x_months:
-        one: 'etwa 1 Monat'
-        other: 'etwa {{count}} Monate'
-      x_months:
-        one: '1 Monat'
-        other: '{{count}} Monate'
-      about_x_years:
-        one: 'etwa 1 Jahr'
-        other: 'etwa {{count}} Jahre'
-      over_x_years:
-        one: 'mehr als 1 Jahr'
-        other: 'mehr als {{count}} Jahre'
-
   number:
     format:
       precision: 2
@@ -98,31 +74,45 @@ de:
       sentence_connector: "und"
       skip_last_comma: true
 
-  activerecord:
-    errors:
-      template:
-        header:
-          one: 1 error prohibited this {{model}} from being saved
-          other: "{{count}} errors prohibited this {{model}} from being saved"
-        body: "There were problems with the following fields:"
+  will_paginate:
+    previous_label: "&#8592; Zurück"
+    previous_aria_label: "Vorherige Seite"
+    next_label: "Weiter &#8594;"
+    next_aria_label: "Nächste Seite"
+    page_gap: "&hellip;"
+    container_aria_label: "Seitennavigation"
+    page_aria_label: "Seite %{page}"
 
-      messages:
-        inclusion: "is not included in the list"
-        exclusion: "is reserved"
-        invalid: "is invalid"
-        confirmation: "doesn't match confirmation"
-        accepted: "must be accepted"
-        empty: "can't be empty"
-        blank: "can't be blank"
-        too_long: "is too long (maximum is {{count}} characters)"
-        too_short: "is too short (minimum is {{count}} characters)"
-        wrong_length: "is the wrong length (should be {{count}} characters)"
-        taken: "has already been taken"
-        not_a_number: "is not a number"
-        greater_than: "must be greater than {{count}}"
-        greater_than_or_equal_to: "must be greater than or equal to {{count}}"
-        equal_to: "must be equal to {{count}}"
-        less_than: "must be less than {{count}}"
-        less_than_or_equal_to: "must be less than or equal to {{count}}"
-        odd: "must be odd"
-        even: "must be even"
+  node_actions:
+    heading: "Letzte Änderungen"
+    show_all: "Alle Einträge zeigen"
+    backfilled: "rekonstruiert"
+    show_changes: "Änderungen an Übersetzungen"
+    view_revision: "Diese Revision ansehen"
+    unknown: "%{actor} hat %{action} auf %{subject} ausgeführt"
+    publish: "%{actor} hat %{revision} von %{subject} veröffentlicht"
+    publish_rollback: "%{actor} hat %{subject} auf %{revision} zurückgesetzt"
+    publish_first: "%{actor} hat %{subject} zum ersten Mal veröffentlicht"
+    publish_first_with_author: "%{actor} hat %{subject} zum ersten Mal veröffentlicht (Autor: %{author})"
+    create: "%{actor} hat %{subject} unter %{path} angelegt"
+    move: "%{actor} hat %{subject} von %{from} nach %{to} verschoben"
+    discard_autosave: "%{actor} hat ungespeicherte Änderungen an %{subject} verworfen"
+    destroy_draft: "%{actor} hat den Entwurf von %{subject} verworfen"
+    locale_added: "Übersetzung angelegt, Titel \"%{title}\""
+    locale_removed: "Übersetzung entfernt, letzter Titel \"%{title}\""
+    abstract_changed: "Abstract geändert"
+    body_changed: "Text geändert"
+    revision_new: "eine neue Revision"
+    revision_earlier: "eine frühere Revision"
+    node_history: "Chronik"
+    detail_title: "Titel „%{from}“ → „%{to}“"
+    detail_author: "Autor %{from} → %{to}"
+    detail_tags: "Tags %{from} → %{to}"
+    template_changed: "Template geändert"
+    assets_changed: "Bildliste geändert"
+    trash: "%{actor} hat %{subject} in den Papierkorb verschoben (vorher unter %{from})"
+    restore_from_trash: "%{actor} hat %{subject} aus dem Papierkorb nach %{to} wiederhergestellt"
+    destroy: "%{actor} hat %{subject} endgültig gelöscht (zuletzt unter %{path})"
+    revision_created: "angelegt am %{date} von %{actor}"
+    revision_published: "veröffentlicht am %{date} von %{actor}"
+    revision_restored: "wiederhergestellt am %{date} von %{actor}"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 2458d4d..8a8acc1 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -8,7 +8,63 @@ en:
   hello: "Hello world"
   show_tag_headline: "Pages tagged with:"
   old_ccc_de: the old ccc.de
+  event_schedule_time: "at %{time}"
+  event_schedule_unrecognized: "Schedule not automatically readable"
+  event_schedule_none: "No schedule"
+  open_days: "Open days"
+  open_days_label: "Open days"
+  upcoming_events: "Upcoming events"
+  open_today: "Open today"
+  published: "published"
+  published_by: "published by %{editor}"
+  last_edited: "last edited"
+  last_edited_by: "last edited by %{editor}"
+  publisher_self: "you"
+  editor_self: "you"
 
   time:
     formats:
       ccc: "%d %B, %Y %H:%M"
+
+  will_paginate:
+    previous_label: "&#8592; Previous"
+    previous_aria_label: "Previous page"
+    next_label: "Next &#8594;"
+    next_aria_label: "Next page"
+    page_gap: "&hellip;"
+    container_aria_label: "Pagination"
+    page_aria_label: "Page %{page}"
+
+  node_actions:
+    heading: "Action log"
+    show_all: "Show all entries"
+    backfilled: "backfilled"
+    show_changes: "translation changes"
+    view_revision: "view this revision"
+    unknown: "%{actor} did %{action} on %{subject}"
+    publish: "%{actor} published %{revision} of %{subject}"
+    publish_rollback: "%{actor} rolled %{subject} back to %{revision}"
+    publish_first: "%{actor} published %{subject} for the first time"
+    publish_first_with_author: "%{actor} published %{subject} for the first time (author: %{author})"
+    create: "%{actor} created %{subject} at %{path}"
+    move: "%{actor} moved %{subject} from %{from} to %{to}"
+    discard_autosave: "%{actor} discarded unsaved changes on %{subject}"
+    destroy_draft: "%{actor} discarded the draft of %{subject}"
+    locale_added: "translation added, titled \"%{title}\""
+    locale_removed: "translation removed, last titled \"%{title}\""
+    abstract_changed: "abstract changed"
+    body_changed: "body changed"
+    revision_new: "a new revision"
+    revision_earlier: "an earlier revision"
+    node_history: "node history"
+    detail_title: "title \"%{from}\" → \"%{to}\""
+    detail_author: "author %{from} → %{to}"
+    detail_tags: "tags %{from} → %{to}"
+    template_changed: "template changed"
+    assets_changed: "attached images changed"
+    trash: "%{actor} moved %{subject} to the Trash (was at %{from})"
+    restore_from_trash: "%{actor} restored %{subject} from the Trash to %{to}"
+    destroy: "%{actor} permanently deleted %{subject} (last at %{path})"
+    revision_created: "created %{date} by %{actor}"
+    revision_published: "published %{date} by %{actor}"
+    revision_restored: "restored %{date} by %{actor}"
diff --git a/config/routes.rb b/config/routes.rb
index a7775b3..6ddf48c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -9,6 +9,8 @@ Cccms::Application.routes.draw do
       defaults: { page_path: ['home'] },
       constraints: { locale: /de|en/ }
 
+  post 'csp_reports' => 'csp_reports#create'
+
   # All application routes are scoped under an optional two-letter locale
   # prefix: /de/... and /en/... Both forms are valid; the prefix is omitted
   # for the default locale (:de) in generated URLs via default_url_options
@@ -20,41 +22,81 @@ Cccms::Application.routes.draw do
   scope '(:locale)', locale: /de|en/ do
 
     resources :tags
-    resources :occurrences
-    resources :events
 
-    resources :pages do
-      member do
-        get :preview
-        put :sort_images
+    resources :events do
+      collection do
+        get :without_node
       end
     end
 
-    resources :nodes do
-      member do
-        put :unlock
-        put :publish
-      end
+    get  'pages/:id/preview',     to: 'pages#preview',     as: :preview_page
+    put  'pages/:id/sort_images', to: 'pages#sort_images', as: :sort_images_page
+
+    get 'preview/:token', to: 'shared_previews#show', as: :shared_preview
 
-      resources :revisions do
+    scope '/admin' do
+      resources :assets
+
+      resources :nodes do
         collection do
-          post :diff
+          get 'tags/:tags', action: :tags, as: :tags, constraints: { tags: /[^\/]+/ }
+          get :parameterize_preview
+          get :drafts
+          get :recent
+          get :mine
+          get :chapters
+          get :sitemap
+          get :trashed
         end
+
         member do
-          put :restore
+          put :unlock
+          put :publish
+          put :generate_shared_preview
+          put :revoke_shared_preview
+          put :autosave
+          put :revert
+          put :trash
+          put :restore_from_trash
+        end
+
+        resources :translations, controller: 'page_translations',
+          param: :translation_locale,
+          constraints: { translation_locale: /en/ },
+          only: [:show, :edit, :update, :destroy] do
+          member do
+            put :autosave
+          end
+        end
+
+        resources :related_assets, only: [:create, :destroy, :update] do
+          collection do
+            get :search
+          end
+        end
+
+        resources :revisions do
+          collection do
+            post :diff
+            get  :diff
+          end
+          member do
+            put :restore
+          end
         end
       end
-    end
 
-    scope '/admin' do
-      resources :assets
+      match ''                 => 'admin#index',            :as => :admin,                  :via => :get
+      match 'search'           => 'admin#search',           :as => :admin_search,           :via => :get
+      match 'menu_search'      => 'admin#menu_search',      :as => :admin_menu_search,      :via => :get
+      match 'conventions'      => 'admin#conventions',      :as => :admin_conventions,      :via => :get
+      match 'dashboard_search' => 'admin#dashboard_search', :as => :admin_dashboard_search, :via => :get
+      match 'log'              => 'node_actions#index',     :as => :admin_log,              :via => :get
+      match 'boom'             => 'admin#boom',             :as => :admin_boom,             :via => :get
     end
 
     match '/logout'      => 'sessions#destroy', :as => :logout,       :via => :delete
     match '/login'       => 'sessions#new',     :as => :login,        :via => :get
-    match 'admin'        => 'admin#index',      :as => :admin,        :via => :get
-    match 'admin/search' => 'admin#search',     :as => :admin_search, :via => :get
-    match 'admin/menu_search' => 'admin#menu_search', :as => :admin_menu_search, :via => :get
     match 'search'       => 'search#index',     :as => :search,       :via => :get
 
     resources :users
@@ -67,11 +109,11 @@ Cccms::Application.routes.draw do
 
     resource :session
 
-    get  'rss/updates',         :to => 'rss#updates', :as => :rss
-    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed,
+    get  'rss/updates',         :to => 'rss#updates', :as => :rss,      :defaults => { :format => :xml }
+    get  'rss/updates.:format', :to => 'rss#updates', :as => :rss_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml|rdf/ }
-    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag
-    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed,
+    get  'rss/tags/:tag/updates',         :to => 'rss#tag_updates', :as => :rss_tag, :defaults => { :format => :xml }
+    get  'rss/tags/:tag/updates.:format', :to => 'rss#tag_updates', :as => :rss_tag_feed, :defaults => { :format => :xml },
            :constraints => { :format => /xml/ }
 
     match 'galleries/*page_path' => 'content#render_gallery', :via => :get