HOLD: Import stories from a WordPress export CSV with an admin preview UI

AGENTS.md

@@ -49,15 +49,15 @@ This codebase (Rails 8.1)
 | Directory | Purpose | Count |
 |---|---|---|
 | `app/models/` | ActiveRecord models | ~78 files |
-| `app/services/` | Service objects and POROs (e.g. `MoneyFormatter` for currency display) | ~28 files |
+| `app/services/` | Service objects and POROs (e.g. `MoneyFormatter` for currency display) | ~29 files |
 | `app/jobs/` | SolidQueue background jobs | 3 files |
 | `app/models/concerns/` | Shared model modules | 15 concerns |
 
 ### Presentation
 
 | Directory | Purpose | Count |
 |---|---|---|
-| `app/controllers/` | Rails controllers (admin/, events/) | ~70 files |
+| `app/controllers/` | Rails controllers (admin/, events/) | ~74 files |
 | `app/views/` | ERB templates | ~504 files |
 | `app/decorators/` | Draper decorators for view logic | ~38 files |
 | `app/policies/` | ActionPolicy authorization rules | ~49 files |
@@ -190,6 +190,7 @@ end
 - `FormBuilderService` — Builds configurable forms from composable sections with per-field visibility
 - `ModelDeduper` — Deduplication logic
 - `RichTextMigrator` — Rich text migration utility
+- `StoryImporter` — Imports stories from a WordPress Posts Export CSV (idea per row, connected published Story for published rows)
 - `DisplayImagePresenter` — Image display logic
 - `ScholarshipsGrouping` (presenter) — Groups scholarships into the index's funder → grant → recipient hierarchy; grant-free awards collect under a trailing "Unfunded" group
 
@@ -338,12 +339,12 @@ Custom colors defined in `app/frontend/stylesheets/application.tailwind.css`:
 |---|---|---|
 | `spec/models/` | ~58 | Model unit tests |
 | `spec/views/` | ~73 | View template tests |
-| `spec/requests/` | ~47 | HTTP request/integration tests |
+| `spec/requests/` | ~68 | HTTP request/integration tests |
 | `spec/system/` | ~25 | End-to-end browser tests (Capybara) |
 | `spec/routing/` | ~13 | Route definition tests |
 | `spec/policies/` | ~9 | Authorization policy tests |
 | `spec/decorators/` | ~10 | Decorator tests |
-| `spec/services/` | ~12 | Service object tests |
+| `spec/services/` | ~17 | Service object tests |
 | `spec/mailers/` | ~5 | Mailer tests |
 | `spec/helpers/` | ~1 | Helper tests |
 | `spec/factories/` | ~53 | FactoryBot factory definitions |
@@ -419,8 +420,13 @@ RuboCop linting on PRs and pushes to main.
 
 ## Rake Tasks
 
-Located in `lib/tasks/` (4 files):
+Located in `lib/tasks/` (9 files):
 - `dev.rake` — Development database seeding from XML/CSV
 - `rhino_migrator.rake` — Rich text editor migration
 - `attachment_report.rake` — Attachment reporting
 - `migrate_internal_id_to_filemaker_code.rake` — FileMaker code migration
+- `import_stories.rake` — Imports stories from a WordPress Posts Export CSV (`StoryImporter`)
+- `convert_age_ranges.rake` — Age range conversion
+- `legacy_user_permissions_to_comments.rake` — Migrate legacy user permissions into comments
+- `migrate_workshop_logs.rake` — Workshop log migration
+- `migrate_sectors.rake` — Sector data migration

app/controllers/story_imports_controller.rb

@@ -0,0 +1,63 @@
+class StoryImportsController < ApplicationController
+  # Admin-only flow for importing stories from a WordPress Posts Export CSV.
+  #
+  #   new     → upload form
+  #   create  → dry-run preview of what would be created (nothing written)
+  #   confirm → run the real import against the stashed file
+  #
+  # The uploaded CSV is stashed as an ActiveStorage blob between the preview
+  # and confirm steps (it is too large for the cookie session). The blob is
+  # purged once the import runs.
+
+  def new
+    authorize! Story, to: :import?
+  end
+
+  def create
+    authorize! Story, to: :import?
+
+    file = params[:file]
+    return redirect_to(new_story_import_path, alert: "Choose a CSV file to import.") if file.blank?
+    return redirect_to(new_story_import_path, alert: "That file is not a CSV.") unless csv?(file)
+
+    @filename = file.original_filename
+    @blob = ActiveStorage::Blob.create_and_upload!(
+      io: file.open, filename: @filename, content_type: "text/csv"
+    )
+    @result = run_import(file.path, dry_run: true)
+    render :create
+  rescue CSV::MalformedCSVError, ArgumentError => e
+    @blob&.purge
+    redirect_to new_story_import_path, alert: "Could not read that CSV: #{e.message}"
+  end
+
+  def confirm
+    authorize! Story, to: :import?
+
+    blob = ActiveStorage::Blob.find_signed!(params[:signed_id])
+    result = blob.open { |tempfile| run_import(tempfile.path, dry_run: false) }
+    blob.purge
+
+    redirect_to stories_path, notice: import_notice(result)
+  rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+    redirect_to new_story_import_path,
+                alert: "That upload is no longer available — please choose the file again."
+  end
+
+  private
+
+  def run_import(path, dry_run:)
+    StoryImporter.new(csv_path: path, import_user: current_user, dry_run: dry_run).call
+  end
+
+  def csv?(file)
+    file.original_filename.to_s.downcase.end_with?(".csv") ||
+      file.content_type.to_s.in?(%w[text/csv application/csv application/vnd.ms-excel])
+  end
+
+  def import_notice(result)
+    "Import complete — #{result.ideas_created} story ideas and " \
+      "#{result.stories_created} connected stories created" \
+      "#{" (#{result.skipped.size} rows skipped)" if result.skipped.any?}."
+  end
+end

app/policies/story_policy.rb

@@ -9,6 +9,11 @@ def show?
     admin? || record.publicly_visible? || (authenticated? && record.published?)
   end
 
+  # Bulk import from a WordPress export CSV — admins only.
+  def import?
+    admin?
+  end
+
   # Scoping
   # See https://actionpolicy.evilmartians.io/#/scoping
   #