From 51629c5c42270a346885057a441095c964101cc1 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Tue, 30 Jun 2026 03:55:42 +0200
Subject: Fix events CRUD for standalone events and add events to admin menu

- event_params now permits title, description, is_primary
- event_information helper lists all node.events, not just the first
- Occurrence.generate handles nil node (standalone events)
- Page.aggregate order_by title uses correlated subquery to avoid
  GROUP BY conflict with tag-filter path; order_direction whitelisted
  to ASC/DESC to prevent SQL injection
- Events link added to admin menu bar
- events/index shows title, is_primary; drops latitude/longitude columns
---
 app/controllers/events_controller.rb |  2 +-
 app/helpers/nodes_helper.rb          | 20 +++++++++-----------
 app/models/occurrence.rb             |  2 +-
 app/models/page.rb                   |  8 ++++----
 app/views/admin/_menu.html.erb       |  1 +
 app/views/events/index.html.erb      |  8 ++++----
 6 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb
index f50da3eb..3a60cf93 100644
--- a/app/controllers/events_controller.rb
+++ b/app/controllers/events_controller.rb
@@ -94,6 +94,6 @@ class EventsController < ApplicationController
   private
 
     def event_params
-      params.require(:event).permit(:start_time, :end_time, :rrule, :custom_rrule, :allday, :url, :latitude, :longitude, :node_id, :location)
+      params.require(:event).permit(:title, :description, :is_primary, :start_time, :end_time, :rrule, :custom_rrule, :allday, :url, :latitude, :longitude, :node_id, :location)
     end
 end
diff --git a/app/helpers/nodes_helper.rb b/app/helpers/nodes_helper.rb
index d88d12ab..4293628d 100644
--- a/app/helpers/nodes_helper.rb
+++ b/app/helpers/nodes_helper.rb
@@ -30,19 +30,17 @@ module NodesHelper
   end
 
   def event_information
-    if @node.events.first
-      event = @node.events.first
+    events = @node.events.order(:start_time)
+    items = events.map do |event|
       safe_join([
-        "#{event.start_time.to_fs(:db)} - #{event.end_time.to_fs(:db)} > ",
-        link_to('show', event_path(event)),
-        ' > ',
-        link_to('edit', edit_event_path(event))
-      ])
-    else
-      safe_join([
-        'no event attached > ',
-        link_to('add', new_event_path(:node_id => @node.id))
+        "#{event.start_time&.to_fs(:db)} - #{event.end_time&.to_fs(:db)} > ",
+        link_to('edit', edit_event_path(event)),
       ])
     end
+    safe_join([
+      safe_join(items, ' | '),
+      ' > ',
+      link_to('add event', new_event_path(:node_id => @node.id))
+    ])
   end
 end
diff --git a/app/models/occurrence.rb b/app/models/occurrence.rb
index 143124f5..777be24c 100644
--- a/app/models/occurrence.rb
+++ b/app/models/occurrence.rb
@@ -35,7 +35,7 @@ class Occurrence < ApplicationRecord
       self.create(
         :start_time => occurrence,
         :end_time   => (occurrence + duration),
-        :node_id    => node.id,
+        :node_id    => node&.id,
         :event_id   => event.id
       )
     end
diff --git a/app/models/page.rb b/app/models/page.rb
index 385b3f64..c982c2e0 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -63,15 +63,15 @@ class Page < ApplicationRecord
       end
     end
 
+    direction = %w[ASC DESC].include?(options[:order_direction]&.upcase) ? options[:order_direction].upcase : "ASC"
+
     if options[:order_by] == "title"
       return scope
-        .joins(:translations)
-        .where(page_translations: { locale: I18n.locale })
-        .order("page_translations.title #{options[:order_direction]}")
+        .order(Arel.sql("(SELECT pt.title FROM page_translations pt WHERE pt.page_id = pages.id AND pt.locale = #{ActiveRecord::Base.connection.quote(I18n.locale.to_s)}) #{direction}"))
         .paginate(:page => page, :per_page => options[:limit])
     end
 
-    scope.order("#{options[:order_by]} #{options[:order_direction]}")
+    scope.order("#{options[:order_by]} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end
 
diff --git a/app/views/admin/_menu.html.erb b/app/views/admin/_menu.html.erb
index 6dba085b..c87c5f70 100644
--- a/app/views/admin/_menu.html.erb
+++ b/app/views/admin/_menu.html.erb
@@ -4,5 +4,6 @@
 <a href="#" onclick="admin_search.display_toggle(); return false;">search</a>
 <%= link_to 'Nodes', nodes_path, selected?('nodes') %>
 <%= link_to 'Assets', assets_path, selected?('assets') %>
+<%= link_to 'Events', events_path, selected?('events') %>
 <%= link_to 'User', users_path, selected?('users') %>
 <%= link_to 'Navigation', menu_items_path, selected?('menu_items') %> &gt;&nbsp;
diff --git a/app/views/events/index.html.erb b/app/views/events/index.html.erb
index 19b21ce8..064fa860 100644
--- a/app/views/events/index.html.erb
+++ b/app/views/events/index.html.erb
@@ -2,27 +2,27 @@
 
 <table>
   <tr>
+    <th>Title</th>
+    <th>Is primary</th>
     <th>Start time</th>
     <th>End time</th>
     <th>Rrule</th>
     <th>Custom rrule</th>
     <th>Allday</th>
     <th>Url</th>
-    <th>Latitude</th>
-    <th>Longitude</th>
     <th>Node</th>
   </tr>
 
 <% @events.each do |event| %>
   <tr>
+    <td><%=h event.display_title %></td>
+    <td><%=h event.is_primary %></td>
     <td><%=h event.start_time %></td>
     <td><%=h event.end_time %></td>
     <td><%=h event.rrule %></td>
     <td><%=h event.custom_rrule %></td>
     <td><%=h event.allday %></td>
     <td><%=h event.url %></td>
-    <td><%=h event.latitude %></td>
-    <td><%=h event.longitude %></td>
     <td><%=h event.node_id %></td>
     <td><%= link_to 'Show', event %></td>
     <td><%= link_to 'Edit', edit_event_path(event) %></td>
-- 
cgit v1.3