From b547decd1f85b43d5fb9e86cd7462b455059b1d1 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Mon, 6 Jul 2026 06:05:06 +0200
Subject: Add preview_token to pages

New column + unique index, plus ensure_preview_token!/revoke_preview_token!
on Page. Generated lazily (only when explicitly requested) rather than
via has_secure_token's default auto-generate-on-create, so a live,
shareable secret isn't silently minted for every page ever created.
---
 app/models/page.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'app')

diff --git a/app/models/page.rb b/app/models/page.rb
index 20461bf..4d1e94a 100644
--- a/app/models/page.rb
+++ b/app/models/page.rb
@@ -136,6 +136,15 @@ class Page < ApplicationRecord
     "/#{node.unique_name}"
   end
 
+  def ensure_preview_token!
+    update!(preview_token: SecureRandom.urlsafe_base64(24)) unless preview_token.present?
+    preview_token
+  end
+
+  def revoke_preview_token!
+    update!(preview_token: nil)
+  end
+
   def clone_attributes_from page
     return nil unless page
 
-- 
cgit v1.3