Add public preview links for drafts

Lets editors share a draft with people outside the admin system, via a
random per-page token rather than an enumerable id - /preview/<token>.
shared_previews#show is intentionally unauthenticated. Redirects to the
real public URL once the page is published. Surfaced on nodes#show
(Admin Preview + Public Preview, next to Public Link) as generate/revoke
buttons.

3 files changed, 48 insertions, 0 deletions

diff --git a/app/controllers/nodes_controller.rb b/app/controllers/nodes_controller.rb
index 380a659..69aa268 100644
--- a/app/controllers/nodes_controller.rb
+++ b/app/controllers/nodes_controller.rb
@@ -104,6 +104,24 @@ class NodesController < ApplicationController
     redirect_to node_path(@node)
   end
 
+  def generate_shared_preview
+    @node = Node.find(params[:id])
+    if @node.draft
+      @node.draft.ensure_preview_token!
+      flash[:notice] = "Shareable preview link created - see below."
+    else
+      flash[:notice] = "Create or edit a draft first - shared preview links are only available for pages with an active draft."
+    end
+    redirect_to node_path(@node)
+  end
+
+  def revoke_shared_preview
+    @node = Node.find(params[:id])
+    @node.draft.revoke_preview_token! if @node.draft
+    flash[:notice] = "Shareable preview link revoked."
+    redirect_to node_path(@node)
+  end
+
   def parameterize_preview
     render plain: slug_for(params[:title])
   end
diff --git a/app/controllers/shared_previews_controller.rb b/app/controllers/shared_previews_controller.rb
new file mode 100644
index 0000000..a8a540f
--- /dev/null
+++ b/app/controllers/shared_previews_controller.rb
@@ -0,0 +1,13 @@
+class SharedPreviewsController < ApplicationController
+  def show
+    @page = Page.find_by!(preview_token: params[:token])
+
+    if @page.node && @page.node.head_id == @page.id
+      redirect_to node_path(@page.node)
+      return
+    end
+
+    response.headers['X-Robots-Tag'] = 'noindex'
+    render template: @page.valid_template, layout: "application"
+  end
+end
diff --git a/app/views/nodes/show.html.erb b/app/views/nodes/show.html.erb
index c533a55..d63df86 100644
--- a/app/views/nodes/show.html.erb
+++ b/app/views/nodes/show.html.erb
@@ -12,6 +12,23 @@
       <td class="description">Public Link</td>
       <td><%= link_to @page.public_link, content_url(@node.unique_path) %></td>
     </tr>
+    <% if @node.draft %>
+    <tr>
+      <td class="description">Admin Preview</td>
+      <td><%= link_to preview_page_path(@node.draft), preview_page_path(@node.draft) %></td>
+    </tr>
+    <tr>
+      <td class="description">Public Preview</td>
+      <td>
+        <% if @node.draft.preview_token.present? %>
+          <%= link_to shared_preview_path(token: @node.draft.preview_token), shared_preview_url(token: @node.draft.preview_token), target: "_blank", rel: "noopener" %>
+          <%= button_to 'Revoke', revoke_shared_preview_node_path(@node), method: :put, form: { data: { confirm: "Revoke this preview link? Anyone currently using it will immediately lose access." } } %>
+        <% else %>
+          <%= button_to 'Create public preview link', generate_shared_preview_node_path(@node), method: :put %>
+        <% end %>
+      </td>
+    </tr>
+    <% end %>
     <tr>
       <td class="description">Author</td>
       <td><%= @page.user.try(:login) %></td>