Fix events CRUD for standalone events and add events to admin menu

- event_params now permits title, description, is_primary
- event_information helper lists all node.events, not just the first
- Occurrence.generate handles nil node (standalone events)
- Page.aggregate order_by title uses correlated subquery to avoid
  GROUP BY conflict with tag-filter path; order_direction whitelisted
  to ASC/DESC to prevent SQL injection
- Events link added to admin menu bar
- events/index shows title, is_primary; drops latitude/longitude columns

2 files changed, 5 insertions, 5 deletions

diff --git a/app/models/occurrence.rb b/app/models/occurrence.rb
index 143124f..777be24 100644
--- a/app/models/occurrence.rb
+++ b/app/models/occurrence.rb
@@ -35,7 +35,7 @@ class Occurrence < ApplicationRecord
       self.create(
         :start_time => occurrence,
         :end_time   => (occurrence + duration),
-        :node_id    => node.id,
+        :node_id    => node&.id,
         :event_id   => event.id
       )
     end
diff --git a/app/models/page.rb b/app/models/page.rb
index 385b3f6..c982c2e 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -63,15 +63,15 @@ class Page < ApplicationRecord
       end
     end
 
+    direction = %w[ASC DESC].include?(options[:order_direction]&.upcase) ? options[:order_direction].upcase : "ASC"
+
     if options[:order_by] == "title"
       return scope
-        .joins(:translations)
-        .where(page_translations: { locale: I18n.locale })
-        .order("page_translations.title #{options[:order_direction]}")
+        .order(Arel.sql("(SELECT pt.title FROM page_translations pt WHERE pt.page_id = pages.id AND pt.locale = #{ActiveRecord::Base.connection.quote(I18n.locale.to_s)}) #{direction}"))
         .paginate(:page => page, :per_page => options[:limit])
     end
 
-    scope.order("#{options[:order_by]} #{options[:order_direction]}")
+    scope.order("#{options[:order_by]} #{direction}")
       .paginate(:page => page, :per_page => options[:limit])
   end