feat(controllers): extend posts_controller with publish and unpublish

examples/blog/app/controllers/posts_controller.rb

@@ -287,4 +287,65 @@ class PostsController < ApplicationController
     flash[:notice] = t('posts.restored_notice', id: post.id)
     redirect url_for(:trash_posts)
   rescue Prism::Orm::RecordNotFound
+    respond_not_found(t('posts.not_found'))
+  end
+
+  # `published!`/`draft!` come straight from Post's `enum :status` (see the
+  # model) - they set the column and save() in one call, so this action is
+  # nothing but "find, authorize like an edit, flip the status".
+  def publish
+    post = Post.find_by!(slug: params['slug'])
+    authorize(post, :update?)
+    post.published!
+    flash[:notice] = t('posts.published_notice', id: post.id)
+    redirect url_for(:post, slug: post.to_param)
+  rescue Prism::Orm::RecordNotFound
+    respond_not_found(t('posts.not_found'))
+  end
+
+  def unpublish
+    post = Post.find_by!(slug: params['slug'])
+    authorize(post, :update?)
+    post.draft!
+    flash[:notice] = t('posts.unpublished_notice', id: post.id)
+    redirect url_for(:post, slug: post.to_param)
+  rescue Prism::Orm::RecordNotFound
+    respond_not_found(t('posts.not_found'))
+  end
+
+  # Post#acts_as_list is scoped by `featured` (see the model) - moving a
+  # post that ISN'T currently featured is harmless (it just reorders it
+  # inside the unused non-featured group) but pointless, so both actions
+  # redirect back to the SAME featured=1 view the reorder links only ever
+  # appear on, regardless of which group the post actually belongs to.
+  def move_up
+    post = Post.find_by!(slug: params['slug'])
+    authorize(post, :update?)
+    post.move_higher
+    redirect "#{url_for(:posts)}?featured=1"
+  rescue Prism::Orm::RecordNotFound
+    respond_not_found(t('posts.not_found'))
+  end
+
+  def move_down
+    post = Post.find_by!(slug: params['slug'])
+    authorize(post, :update?)
+    post.move_lower
+    redirect "#{url_for(:posts)}?featured=1"
+  rescue Prism::Orm::RecordNotFound
+    respond_not_found(t('posts.not_found'))
+  end
+
+  private
+
+  def store_cover(upload)
+    return nil unless upload.is_a?(Prism::UploadedFile)
+    return nil if upload.original_filename.to_s.empty?
+
+    uploads_dir = File.join(APP_ROOT, 'public', 'uploads')
+    FileUtils.mkdir_p(uploads_dir)
+    safe_name = "#{Time.now.strftime('%Y%m%d%H%M%S')}-#{upload.original_filename.gsub(/[^a-zA-Z0-9_.-]/, '_')}"
+    File.binwrite(File.join(uploads_dir, safe_name), upload.read)
+    safe_name
+  end
 end