diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..325bfc036 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,51 @@ +# See https://docs.docker.com/engine/reference/builder/#dockerignore-file for more about ignoring files. + +# Ignore git directory. +/.git/ +/.gitignore + +# Ignore bundler config. +/.bundle + +# Ignore all environment files. +/.env* + +# Ignore all default key files. +/config/master.key +/config/credentials/*.key + +# Ignore all logfiles and tempfiles. +/log/* +/tmp/* +!/log/.keep +!/tmp/.keep + +# Ignore pidfiles, but keep the directory. +/tmp/pids/* +!/tmp/pids/.keep + +# Ignore storage (uploaded files in development and any SQLite databases). +/storage/* +!/storage/.keep +/tmp/storage/* +!/tmp/storage/.keep + +# Ignore assets. +/node_modules/ +/app/assets/builds/* +!/app/assets/builds/.keep +/public/assets + +# Ignore CI service files. +/.github + +# Ignore Kamal files. +/config/deploy*.yml +/.kamal + +# Ignore development files +/.devcontainer + +# Ignore Docker-related files +/.dockerignore +/Dockerfile* diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 000000000..8dc432343 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,9 @@ +# See https://git-scm.com/docs/gitattributes for more about git attribute files. + +# Mark the database schema as having been generated. +db/schema.rb linguist-generated + +# Mark any vendored files as having been vendored. +vendor/* linguist-vendored +config/credentials/*.yml.enc diff=rails_credentials +config/credentials.yml.enc diff=rails_credentials diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..83610cfa4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: +- package-ecosystem: bundler + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 +- package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 000000000..d58c2aa4c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,67 @@ +name: CI + +on: + pull_request: + push: + branches: [ main ] + +jobs: + scan_ruby: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Scan for common Rails security vulnerabilities using static analysis + run: bin/brakeman --no-pager + + - name: Scan for known security vulnerabilities in gems used + run: bin/bundler-audit + + scan_js: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Scan for security vulnerabilities in JavaScript dependencies + run: bin/importmap audit + + lint: + runs-on: ubuntu-latest + env: + RUBOCOP_CACHE_ROOT: tmp/rubocop + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Prepare RuboCop cache + uses: actions/cache@v4 + env: + DEPENDENCIES_HASH: ${{ hashFiles('.ruby-version', '**/.rubocop.yml', '**/.rubocop_todo.yml', 'Gemfile.lock') }} + with: + path: ${{ env.RUBOCOP_CACHE_ROOT }} + key: rubocop-${{ runner.os }}-${{ env.DEPENDENCIES_HASH }}-${{ github.ref_name == github.event.repository.default_branch && github.run_id || 'default' }} + restore-keys: | + rubocop-${{ runner.os }}-${{ env.DEPENDENCIES_HASH }}- + + - name: Lint code for consistent style + run: bin/rubocop -f github + diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..613894f9d --- /dev/null +++ b/.gitignore @@ -0,0 +1,40 @@ +# See https://help.github.com/articles/ignoring-files for more about ignoring files. +# +# Temporary files generated by your text editor or operating system +# belong in git's global ignore instead: +# `$XDG_CONFIG_HOME/git/ignore` or `~/.config/git/ignore` + +# Ignore bundler config. +/.bundle + +# Ignore all environment files. +/.env* + +# Ignore all logfiles and tempfiles. +/log/* +/tmp/* +!/log/.keep +!/tmp/.keep + +# Ignore pidfiles, but keep the directory. +/tmp/pids/* +!/tmp/pids/ +!/tmp/pids/.keep + +# Ignore storage (uploaded files in development and any SQLite databases). +/storage/* +!/storage/.keep +/tmp/storage/* +!/tmp/storage/ +!/tmp/storage/.keep + +/public/assets + +# Ignore key files for decrypting credentials and more. +/config/*.key + +# Test coverage reports +/coverage/ + +/app/assets/builds/* +!/app/assets/builds/.keep diff --git a/.kamal/hooks/docker-setup.sample b/.kamal/hooks/docker-setup.sample new file mode 100755 index 000000000..a0b053784 --- /dev/null +++ b/.kamal/hooks/docker-setup.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Docker set up on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/post-app-boot.sample b/.kamal/hooks/post-app-boot.sample new file mode 100755 index 000000000..7d2a13db2 --- /dev/null +++ b/.kamal/hooks/post-app-boot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Booted app version $KAMAL_VERSION on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/post-deploy.sample b/.kamal/hooks/post-deploy.sample new file mode 100755 index 000000000..17b0567a5 --- /dev/null +++ b/.kamal/hooks/post-deploy.sample @@ -0,0 +1,14 @@ +#!/usr/bin/env sh + +# A sample post-deploy hook +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) +# KAMAL_RUNTIME + +echo "$KAMAL_PERFORMER deployed $KAMAL_VERSION to $KAMAL_DESTINATION in $KAMAL_RUNTIME seconds" diff --git a/.kamal/hooks/post-proxy-reboot.sample b/.kamal/hooks/post-proxy-reboot.sample new file mode 100755 index 000000000..84548ed04 --- /dev/null +++ b/.kamal/hooks/post-proxy-reboot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Rebooted kamal-proxy on $KAMAL_HOSTS" diff --git a/.kamal/hooks/pre-app-boot.sample b/.kamal/hooks/pre-app-boot.sample new file mode 100755 index 000000000..1f9fe844c --- /dev/null +++ b/.kamal/hooks/pre-app-boot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Booting app version $KAMAL_VERSION on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/pre-build.sample b/.kamal/hooks/pre-build.sample new file mode 100755 index 000000000..d53d28cf7 --- /dev/null +++ b/.kamal/hooks/pre-build.sample @@ -0,0 +1,51 @@ +#!/usr/bin/env sh + +# A sample pre-build hook +# +# Checks: +# 1. We have a clean checkout +# 2. A remote is configured +# 3. The branch has been pushed to the remote +# 4. The version we are deploying matches the remote +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) + +if [ -n "$(git status --porcelain)" ]; then + echo "Git checkout is not clean, aborting..." >&2 + git status --porcelain >&2 + exit 1 +fi + +first_remote=$(git remote) + +if [ -z "$first_remote" ]; then + echo "No git remote set, aborting..." >&2 + exit 1 +fi + +current_branch=$(git branch --show-current) + +if [ -z "$current_branch" ]; then + echo "Not on a git branch, aborting..." >&2 + exit 1 +fi + +remote_head=$(git ls-remote $first_remote --tags $current_branch | cut -f1) + +if [ -z "$remote_head" ]; then + echo "Branch not pushed to remote, aborting..." >&2 + exit 1 +fi + +if [ "$KAMAL_VERSION" != "$remote_head" ]; then + echo "Version ($KAMAL_VERSION) does not match remote HEAD ($remote_head), aborting..." >&2 + exit 1 +fi + +exit 0 diff --git a/.kamal/hooks/pre-connect.sample b/.kamal/hooks/pre-connect.sample new file mode 100755 index 000000000..77744bdca --- /dev/null +++ b/.kamal/hooks/pre-connect.sample @@ -0,0 +1,47 @@ +#!/usr/bin/env ruby + +# A sample pre-connect check +# +# Warms DNS before connecting to hosts in parallel +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) +# KAMAL_RUNTIME + +hosts = ENV["KAMAL_HOSTS"].split(",") +results = nil +max = 3 + +elapsed = Benchmark.realtime do + results = hosts.map do |host| + Thread.new do + tries = 1 + + begin + Socket.getaddrinfo(host, 0, Socket::AF_UNSPEC, Socket::SOCK_STREAM, nil, Socket::AI_CANONNAME) + rescue SocketError + if tries < max + puts "Retrying DNS warmup: #{host}" + tries += 1 + sleep rand + retry + else + puts "DNS warmup failed: #{host}" + host + end + end + + tries + end + end.map(&:value) +end + +retries = results.sum - hosts.size +nopes = results.count { |r| r == max } + +puts "Prewarmed %d DNS lookups in %.2f sec: %d retries, %d failures" % [ hosts.size, elapsed, retries, nopes ] diff --git a/.kamal/hooks/pre-deploy.sample b/.kamal/hooks/pre-deploy.sample new file mode 100755 index 000000000..05b3055b7 --- /dev/null +++ b/.kamal/hooks/pre-deploy.sample @@ -0,0 +1,122 @@ +#!/usr/bin/env ruby + +# A sample pre-deploy hook +# +# Checks the Github status of the build, waiting for a pending build to complete for up to 720 seconds. +# +# Fails unless the combined status is "success" +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_COMMAND +# KAMAL_SUBCOMMAND +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) + +# Only check the build status for production deployments +if ENV["KAMAL_COMMAND"] == "rollback" || ENV["KAMAL_DESTINATION"] != "production" + exit 0 +end + +require "bundler/inline" + +# true = install gems so this is fast on repeat invocations +gemfile(true, quiet: true) do + source "https://rubygems.org" + + gem "octokit" + gem "faraday-retry" +end + +MAX_ATTEMPTS = 72 +ATTEMPTS_GAP = 10 + +def exit_with_error(message) + $stderr.puts message + exit 1 +end + +class GithubStatusChecks + attr_reader :remote_url, :git_sha, :github_client, :combined_status + + def initialize + @remote_url = github_repo_from_remote_url + @git_sha = `git rev-parse HEAD`.strip + @github_client = Octokit::Client.new(access_token: ENV["GITHUB_TOKEN"]) + refresh! + end + + def refresh! + @combined_status = github_client.combined_status(remote_url, git_sha) + end + + def state + combined_status[:state] + end + + def first_status_url + first_status = combined_status[:statuses].find { |status| status[:state] == state } + first_status && first_status[:target_url] + end + + def complete_count + combined_status[:statuses].count { |status| status[:state] != "pending"} + end + + def total_count + combined_status[:statuses].count + end + + def current_status + if total_count > 0 + "Completed #{complete_count}/#{total_count} checks, see #{first_status_url} ..." + else + "Build not started..." + end + end + + private + def github_repo_from_remote_url + url = `git config --get remote.origin.url`.strip.delete_suffix(".git") + if url.start_with?("https://github.com/") + url.delete_prefix("https://github.com/") + elsif url.start_with?("git@github.com:") + url.delete_prefix("git@github.com:") + else + url + end + end +end + + +$stdout.sync = true + +begin + puts "Checking build status..." + + attempts = 0 + checks = GithubStatusChecks.new + + loop do + case checks.state + when "success" + puts "Checks passed, see #{checks.first_status_url}" + exit 0 + when "failure" + exit_with_error "Checks failed, see #{checks.first_status_url}" + when "pending" + attempts += 1 + end + + exit_with_error "Checks are still pending, gave up after #{MAX_ATTEMPTS * ATTEMPTS_GAP} seconds" if attempts == MAX_ATTEMPTS + + puts checks.current_status + sleep(ATTEMPTS_GAP) + checks.refresh! + end +rescue Octokit::NotFound + exit_with_error "Build status could not be found" +end diff --git a/.kamal/hooks/pre-proxy-reboot.sample b/.kamal/hooks/pre-proxy-reboot.sample new file mode 100755 index 000000000..93e11991d --- /dev/null +++ b/.kamal/hooks/pre-proxy-reboot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Rebooting kamal-proxy on $KAMAL_HOSTS..." diff --git a/.kamal/secrets b/.kamal/secrets new file mode 100644 index 000000000..b3089d6f5 --- /dev/null +++ b/.kamal/secrets @@ -0,0 +1,20 @@ +# Secrets defined here are available for reference under registry/password, env/secret, builder/secrets, +# and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either +# password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git. + +# Example of extracting secrets from 1password (or another compatible pw manager) +# SECRETS=$(kamal secrets fetch --adapter 1password --account your-account --from Vault/Item KAMAL_REGISTRY_PASSWORD RAILS_MASTER_KEY) +# KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract KAMAL_REGISTRY_PASSWORD ${SECRETS}) +# RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY ${SECRETS}) + +# Example of extracting secrets from Rails credentials +# KAMAL_REGISTRY_PASSWORD=$(rails credentials:fetch kamal.registry_password) + +# Use a GITHUB_TOKEN if private repositories are needed for the image +# GITHUB_TOKEN=$(gh config get -h github.com oauth_token) + +# Grab the registry password from ENV +# KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD + +# Improve security by using a password manager. Never check config/master.key into git! +RAILS_MASTER_KEY=$(cat config/master.key) diff --git a/.rubocop.yml b/.rubocop.yml new file mode 100644 index 000000000..aecf2a4cb --- /dev/null +++ b/.rubocop.yml @@ -0,0 +1,41 @@ +# Omakase Ruby styling for Rails, with stricter additions for this project. +inherit_gem: { rubocop-rails-omakase: rubocop.yml } + +plugins: + - rubocop-rails + - rubocop-minitest + - rubocop-performance + +AllCops: + NewCops: enable + Exclude: + - "db/schema.rb" + - "db/*_schema.rb" + - "bin/**/*" + - "vendor/**/*" + - "node_modules/**/*" + - "tmp/**/*" + - "storage/**/*" + +Layout/LineLength: + Max: 120 + AllowedPatterns: + - '\A\s*#' + +Metrics/MethodLength: + Max: 25 + +Metrics/ClassLength: + Max: 150 + +Metrics/AbcSize: + Max: 30 + +Style/Documentation: + Enabled: false + +Rails/I18nLocaleTexts: + Enabled: false + +Minitest/MultipleAssertions: + Max: 8 diff --git a/.ruby-version b/.ruby-version new file mode 100644 index 000000000..1cf76f52b --- /dev/null +++ b/.ruby-version @@ -0,0 +1 @@ +ruby-4.0.6 diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..b47c9822b --- /dev/null +++ b/Dockerfile @@ -0,0 +1,77 @@ +# syntax=docker/dockerfile:1 +# check=error=true + +# This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand: +# docker build -t umanni_users . +# docker run -d -p 80:80 -e RAILS_MASTER_KEY= --name umanni_users umanni_users + +# For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html + +# Make sure RUBY_VERSION matches the Ruby version in .ruby-version +ARG RUBY_VERSION=4.0.6 +FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base + +# Rails app lives here +WORKDIR /rails + +# Install base packages +RUN apt-get update -qq && \ + apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 && \ + ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \ + rm -rf /var/lib/apt/lists /var/cache/apt/archives + +# Set production environment variables and enable jemalloc for reduced memory usage and latency. +ENV RAILS_ENV="production" \ + BUNDLE_DEPLOYMENT="1" \ + BUNDLE_PATH="/usr/local/bundle" \ + BUNDLE_WITHOUT="development" \ + LD_PRELOAD="/usr/local/lib/libjemalloc.so" + +# Throw-away build stage to reduce size of final image +FROM base AS build + +# Install packages needed to build gems +RUN apt-get update -qq && \ + apt-get install --no-install-recommends -y build-essential git libvips libyaml-dev pkg-config && \ + rm -rf /var/lib/apt/lists /var/cache/apt/archives + +# Install application gems +COPY vendor/* ./vendor/ +COPY Gemfile Gemfile.lock ./ + +RUN bundle install && \ + rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \ + # -j 1 disable parallel compilation to avoid a QEMU bug: https://github.com/rails/bootsnap/issues/495 + bundle exec bootsnap precompile -j 1 --gemfile + +# Copy application code +COPY . . + +# Precompile bootsnap code for faster boot times. +# -j 1 disable parallel compilation to avoid a QEMU bug: https://github.com/rails/bootsnap/issues/495 +RUN bundle exec bootsnap precompile -j 1 app/ lib/ + +# Precompiling assets for production without requiring secret RAILS_MASTER_KEY +RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile + + + + +# Final stage for app image +FROM base + +# Run and own only the runtime files as a non-root user for security +RUN groupadd --system --gid 1000 rails && \ + useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash +USER 1000:1000 + +# Copy built artifacts: gems, application +COPY --chown=rails:rails --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}" +COPY --chown=rails:rails --from=build /rails /rails + +# Entrypoint prepares the database. +ENTRYPOINT ["/rails/bin/docker-entrypoint"] + +# Start server via Thruster by default, this can be overwritten at runtime +EXPOSE 80 +CMD ["./bin/thrust", "./bin/rails", "server"] diff --git a/Gemfile b/Gemfile new file mode 100644 index 000000000..862fd9b42 --- /dev/null +++ b/Gemfile @@ -0,0 +1,76 @@ +source "https://rubygems.org" + +# Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main" +gem "rails", "~> 8.1.3", ">= 8.1.3.1" +# The modern asset pipeline for Rails [https://github.com/rails/propshaft] +gem "propshaft" +# Use sqlite3 as the database for Active Record +gem "sqlite3", ">= 2.1" +# Use the Puma web server [https://github.com/puma/puma] +gem "puma", ">= 5.0" +# Use JavaScript with ESM import maps [https://github.com/rails/importmap-rails] +gem "importmap-rails" +# Hotwire's SPA-like page accelerator [https://turbo.hotwired.dev] +gem "turbo-rails" +# Hotwire's modest JavaScript framework [https://stimulus.hotwired.dev] +gem "stimulus-rails" +# Use Tailwind CSS [https://github.com/rails/tailwindcss-rails] +gem "tailwindcss-rails" + +# Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword] +gem "bcrypt", "~> 3.1.7" + +# Spreadsheet import (.csv/.xlsx) +gem "csv" +gem "roo", "~> 2.10" +# Generate sample/fixture XLSX workbooks for docs and tests +gem "caxlsx", "~> 4.2" + +# Windows does not include zoneinfo files, so bundle the tzinfo-data gem +gem "tzinfo-data", platforms: %i[ windows jruby ] + +# Use the database-backed adapters for Rails.cache, Active Job, and Action Cable +gem "solid_cache" +gem "solid_queue" +gem "solid_cable" + +# Reduces boot times through caching; required in config/boot.rb +gem "bootsnap", require: false + +# Deploy this application anywhere as a Docker container [https://kamal-deploy.org] +gem "kamal", require: false + +# Add HTTP asset caching/compression and X-Sendfile acceleration to Puma [https://github.com/basecamp/thruster/] +gem "thruster", require: false + +# Use Active Storage variants [https://guides.rubyonrails.org/active_storage_overview.html#transforming-images] +gem "image_processing", "~> 1.2" + +group :development, :test do + # See https://guides.rubyonrails.org/debugging_rails_applications.html#debugging-with-the-debug-gem + gem "debug", platforms: %i[ mri windows ], require: "debug/prelude" + + # Audits gems for known security defects (use config/bundler-audit.yml to ignore issues) + gem "bundler-audit", require: false + + # Static analysis for security vulnerabilities [https://brakemanscanner.org/] + gem "brakeman", require: false + + # Omakase Ruby styling [https://github.com/rails/rubocop-rails-omakase/] + gem "rubocop-rails-omakase", require: false + gem "rubocop-rails", require: false + gem "rubocop-minitest", require: false + gem "rubocop-performance", require: false + + gem "simplecov", require: false +end + +group :development do + # Use console on exceptions pages [https://github.com/rails/web-console] + gem "web-console" +end + +group :test do + gem "capybara" + gem "selenium-webdriver" +end diff --git a/Gemfile.lock b/Gemfile.lock new file mode 100644 index 000000000..d6326b273 --- /dev/null +++ b/Gemfile.lock @@ -0,0 +1,595 @@ +GEM + remote: https://rubygems.org/ + specs: + action_text-trix (2.1.19) + railties + actioncable (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) + nio4r (~> 2.0) + websocket-driver (>= 0.6.1) + zeitwerk (~> 2.6) + actionmailbox (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + mail (>= 2.8.0) + actionmailer (8.1.3.1) + actionpack (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activesupport (= 8.1.3.1) + mail (>= 2.8.0) + rails-dom-testing (~> 2.2) + actionpack (8.1.3.1) + actionview (= 8.1.3.1) + activesupport (= 8.1.3.1) + nokogiri (>= 1.8.5) + rack (>= 2.2.4) + rack-session (>= 1.0.1) + rack-test (>= 0.6.3) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + useragent (~> 0.16) + actiontext (8.1.3.1) + action_text-trix (~> 2.1.15) + actionpack (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + globalid (>= 0.6.0) + nokogiri (>= 1.8.5) + actionview (8.1.3.1) + activesupport (= 8.1.3.1) + builder (~> 3.1) + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + activejob (8.1.3.1) + activesupport (= 8.1.3.1) + globalid (>= 0.3.6) + activemodel (8.1.3.1) + activesupport (= 8.1.3.1) + activerecord (8.1.3.1) + activemodel (= 8.1.3.1) + activesupport (= 8.1.3.1) + timeout (>= 0.4.0) + activestorage (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activesupport (= 8.1.3.1) + marcel (~> 1.0) + activesupport (8.1.3.1) + base64 + bigdecimal + concurrent-ruby (~> 1.0, >= 1.3.1) + connection_pool (>= 2.2.5) + drb + i18n (>= 1.6, < 2) + json + logger (>= 1.4.2) + minitest (>= 5.1) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) + uri (>= 0.13.1) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + ast (2.4.3) + base64 (0.3.0) + bcrypt (3.1.22) + bcrypt_pbkdf (1.1.2) + bigdecimal (4.1.2) + bindex (0.8.1) + bootsnap (1.25.0) + msgpack (~> 1.5) + brakeman (8.0.6) + racc + builder (3.3.0) + bundler-audit (0.9.3) + bundler (>= 1.2.0) + thor (~> 1.0) + capybara (3.40.0) + addressable + matrix + mini_mime (>= 0.1.3) + nokogiri (~> 1.11) + rack (>= 1.6.0) + rack-test (>= 0.6.3) + regexp_parser (>= 1.5, < 3.0) + xpath (~> 3.2) + caxlsx (4.5.0) + htmlentities (~> 4.3, >= 4.3.4) + marcel (~> 1.0) + nokogiri (~> 1.10, >= 1.10.4) + rubyzip (>= 2.4, < 4) + concurrent-ruby (1.3.8) + connection_pool (3.0.2) + crass (1.0.7) + csv (3.3.6) + date (3.5.1) + debug (1.11.1) + irb (~> 1.10) + reline (>= 0.3.8) + dotenv (3.2.0) + drb (2.2.3) + ed25519 (1.4.0) + erb (6.0.7) + erubi (1.13.1) + et-orbi (1.4.2) + tzinfo + ffi (1.17.4-aarch64-linux-gnu) + ffi (1.17.4-aarch64-linux-musl) + ffi (1.17.4-arm-linux-gnu) + ffi (1.17.4-arm-linux-musl) + ffi (1.17.4-x86_64-linux-gnu) + ffi (1.17.4-x86_64-linux-musl) + fugit (1.13.0) + et-orbi (~> 1.4) + raabro (~> 1.4) + globalid (1.4.0) + activesupport (>= 6.1) + htmlentities (4.4.2) + i18n (1.15.2) + concurrent-ruby (~> 1.0) + image_processing (1.14.0) + mini_magick (>= 4.9.5, < 6) + ruby-vips (>= 2.0.17, < 3) + importmap-rails (2.2.3) + actionpack (>= 6.0.0) + activesupport (>= 6.0.0) + railties (>= 6.0.0) + io-console (0.9.2) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) + json (2.21.2) + kamal (2.12.0) + activesupport (>= 7.0) + base64 (~> 0.2) + bcrypt_pbkdf (~> 1.0) + concurrent-ruby (~> 1.2) + dotenv (~> 3.1) + ed25519 (~> 1.4) + net-ssh (~> 7.3) + sshkit (>= 1.23.0, < 2.0) + thor (~> 1.3) + zeitwerk (>= 2.6.18, < 3.0) + language_server-protocol (3.17.0.6) + lint_roller (1.1.0) + logger (1.7.0) + loofah (2.25.2) + crass (~> 1.0.2) + nokogiri (>= 1.12.0) + mail (2.9.1) + logger + mini_mime (>= 0.1.1) + net-imap + net-pop + net-smtp + marcel (1.2.1) + matrix (0.4.3) + mini_magick (5.4.0) + logger + mini_mime (1.1.5) + minitest (6.0.6) + drb (~> 2.0) + prism (~> 1.5) + msgpack (1.8.4) + net-imap (0.6.6) + date + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.3.0) + timeout + net-scp (4.1.0) + net-ssh (>= 2.6.5, < 8.0.0) + net-sftp (4.0.0) + net-ssh (>= 5.0.0, < 8.0.0) + net-smtp (0.5.1) + net-protocol + net-ssh (7.3.3) + nio4r (2.7.5) + nokogiri (1.19.4-aarch64-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-aarch64-linux-musl) + racc (~> 1.4) + nokogiri (1.19.4-arm-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-arm-linux-musl) + racc (~> 1.4) + nokogiri (1.19.4-x86_64-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-x86_64-linux-musl) + racc (~> 1.4) + ostruct (0.6.3) + parallel (2.1.0) + parser (3.3.12.0) + ast (~> 2.4.1) + racc + pp (0.6.4) + prettyprint + prettyprint (0.2.0) + prism (1.9.0) + propshaft (1.3.2) + actionpack (>= 7.0.0) + activesupport (>= 7.0.0) + rack + public_suffix (7.0.5) + puma (8.0.2) + nio4r (~> 2.0) + raabro (1.5.0) + racc (1.8.1) + rack (3.2.7) + rack-session (2.1.2) + base64 (>= 0.1.0) + rack (>= 3.0.0) + rack-test (2.2.0) + rack (>= 1.3) + rackup (2.3.1) + rack (>= 3) + rails (8.1.3.1) + actioncable (= 8.1.3.1) + actionmailbox (= 8.1.3.1) + actionmailer (= 8.1.3.1) + actionpack (= 8.1.3.1) + actiontext (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activemodel (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + bundler (>= 1.15.0) + railties (= 8.1.3.1) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest + nokogiri (>= 1.6) + rails-html-sanitizer (1.7.1) + loofah (~> 2.25, >= 2.25.2) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) + irb (~> 1.13) + rackup (>= 1.0.0) + rake (>= 12.2) + thor (~> 1.0, >= 1.2.2) + tsort (>= 0.2) + zeitwerk (~> 2.6) + rainbow (3.1.1) + rake (13.4.2) + rbs (4.2.0) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) + erb + prism (>= 1.6.0) + rbs (>= 4.0.0) + tsort + regexp_parser (2.12.0) + reline (0.7.0) + io-console (~> 0.5) + rexml (3.4.4) + roo (2.10.1) + nokogiri (~> 1) + rubyzip (>= 1.3.0, < 3.0.0) + rubocop (1.90.0) + json (>= 2.3) + language_server-protocol (~> 3.17.0.2) + lint_roller (~> 1.1.0) + parallel (>= 1.10) + parser (>= 3.3.0.2) + rainbow (>= 2.2.2, < 4.0) + regexp_parser (>= 2.9.3, < 3.0) + rubocop-ast (>= 1.49.0, < 2.0) + ruby-progressbar (~> 1.7) + unicode-display_width (>= 2.4.0, < 4.0) + rubocop-ast (1.50.0) + parser (>= 3.3.7.2) + prism (~> 1.7) + rubocop-minitest (0.40.0) + lint_roller (~> 1.1) + rubocop (>= 1.75.0, < 2.0) + rubocop-ast (>= 1.38.0, < 2.0) + rubocop-performance (1.27.0) + lint_roller (~> 1.1) + rubocop (>= 1.89.0, < 2.0) + rubocop-ast (>= 1.47.1, < 2.0) + rubocop-rails (2.37.0) + activesupport (>= 4.2.0) + lint_roller (~> 1.1) + rack (>= 1.1) + rubocop (>= 1.89.0, < 2.0) + rubocop-ast (>= 1.44.0, < 2.0) + rubocop-rails-omakase (1.1.0) + rubocop (>= 1.72) + rubocop-performance (>= 1.24) + rubocop-rails (>= 2.30) + ruby-progressbar (1.13.0) + ruby-vips (2.3.0) + ffi (~> 1.12) + logger + rubyzip (2.4.1) + securerandom (0.4.1) + selenium-webdriver (4.48.0) + base64 (~> 0.2) + logger (~> 1.4) + rexml (~> 3.2, >= 3.2.5) + rubyzip (>= 1.2.2, < 4.0) + websocket (~> 1.0) + simplecov (1.1.1) + solid_cable (4.0.2) + actioncable (>= 7.2) + activejob (>= 7.2) + activerecord (>= 7.2) + railties (>= 7.2) + solid_cache (1.0.10) + activejob (>= 7.2) + activerecord (>= 7.2) + railties (>= 7.2) + solid_queue (1.7.0) + activejob (>= 7.1) + activerecord (>= 7.1) + concurrent-ruby (>= 1.3.1) + fugit (~> 1.11) + railties (>= 7.1) + thor (>= 1.3.1) + sqlite3 (2.9.6-aarch64-linux-gnu) + sqlite3 (2.9.6-aarch64-linux-musl) + sqlite3 (2.9.6-arm-linux-gnu) + sqlite3 (2.9.6-arm-linux-musl) + sqlite3 (2.9.6-x86_64-linux-gnu) + sqlite3 (2.9.6-x86_64-linux-musl) + sshkit (1.25.1) + base64 + logger + net-scp (>= 1.1.2) + net-sftp (>= 2.1.2) + net-ssh (>= 2.8.0) + ostruct + stimulus-rails (1.3.4) + railties (>= 6.0.0) + tailwindcss-rails (4.6.0) + railties (>= 7.0.0) + tailwindcss-ruby (~> 4.0) + tailwindcss-ruby (4.3.3) + tailwindcss-ruby (4.3.3-aarch64-linux-gnu) + tailwindcss-ruby (4.3.3-aarch64-linux-musl) + tailwindcss-ruby (4.3.3-x86_64-linux-gnu) + tailwindcss-ruby (4.3.3-x86_64-linux-musl) + thor (1.5.0) + thruster (0.1.26) + thruster (0.1.26-aarch64-linux) + thruster (0.1.26-x86_64-linux) + timeout (0.6.1) + tsort (0.2.0) + turbo-rails (2.0.23) + actionpack (>= 7.1.0) + railties (>= 7.1.0) + tzinfo (2.0.6) + concurrent-ruby (~> 1.0) + unicode-display_width (3.2.0) + unicode-emoji (~> 4.1) + unicode-emoji (4.2.0) + uri (1.1.1) + useragent (0.16.11) + web-console (4.3.0) + actionview (>= 8.0.0) + bindex (>= 0.4.0) + railties (>= 8.0.0) + websocket (1.2.11) + websocket-driver (0.8.2) + base64 + websocket-extensions (>= 0.1.0) + websocket-extensions (0.1.5) + xpath (3.2.0) + nokogiri (~> 1.8) + zeitwerk (2.8.3) + +PLATFORMS + aarch64-linux + aarch64-linux-gnu + aarch64-linux-musl + arm-linux-gnu + arm-linux-musl + x86_64-linux + x86_64-linux-gnu + x86_64-linux-musl + +DEPENDENCIES + bcrypt (~> 3.1.7) + bootsnap + brakeman + bundler-audit + capybara + caxlsx (~> 4.2) + csv + debug + image_processing (~> 1.2) + importmap-rails + kamal + propshaft + puma (>= 5.0) + rails (~> 8.1.3, >= 8.1.3.1) + roo (~> 2.10) + rubocop-minitest + rubocop-performance + rubocop-rails + rubocop-rails-omakase + selenium-webdriver + simplecov + solid_cable + solid_cache + solid_queue + sqlite3 (>= 2.1) + stimulus-rails + tailwindcss-rails + thruster + turbo-rails + tzinfo-data + web-console + +CHECKSUMS + action_text-trix (2.1.19) sha256=7012f59421009cf284aa651294896414d653a61a2417c9b8714c8476d2f74009 + actioncable (8.1.3.1) sha256=e318528295c878a3efdfe25f0f2267c80cb7a76eba41bb5f64d44aa380a3d91b + actionmailbox (8.1.3.1) sha256=5f704972097d843ade8e435e93694a1dac732b926df1717aceba1f3840082b1c + actionmailer (8.1.3.1) sha256=88ea441b28ff02a0c6c006468892642a3d9942affce9d294e81a74504aa5c43c + actionpack (8.1.3.1) sha256=974cb7154548e81f470b1b0f247b99cb38e87825899dca58610596e2817723d0 + actiontext (8.1.3.1) sha256=5da729d833d1a29cddb1eee938878e55e503d2613e00e735f5daf58c2ba98af2 + actionview (8.1.3.1) sha256=2da68b8414c47b43bfbed1ce69c5afe1c04f78c267aacb5660a4cab5ca12cfb6 + activejob (8.1.3.1) sha256=1c8dd275df930df40deecffec63d913a550a33fd94bd298f69721dd96939954a + activemodel (8.1.3.1) sha256=99cc02ce2faec371d14440949d85787ebd23a907c9baef0a9d4bcd4d21888f88 + activerecord (8.1.3.1) sha256=0a2fb6c28f4938f6b013a3a549bec0a7e37d535f3dc8990e804bcc3258c0403b + activestorage (8.1.3.1) sha256=f555254f387b1cffa499d2fd3115d12635eadc5b15206a8534316a67036163ef + activesupport (8.1.3.1) sha256=85458765f25ea48b9019c46b6bb3fa5683197bf4280d9f06710a6e8d7a831376 + addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af + ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383 + base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b + bcrypt (3.1.22) sha256=1f0072e88c2d705d94aff7f2c5cb02eb3f1ec4b8368671e19112527489f29032 + bcrypt_pbkdf (1.1.2) sha256=c2414c23ce66869b3eb9f643d6a3374d8322dfb5078125c82792304c10b94cf6 + bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd + bindex (0.8.1) sha256=7b1ecc9dc539ed8bccfc8cb4d2732046227b09d6f37582ff12e50a5047ceb17e + bootsnap (1.25.0) sha256=41059e7d0f9cb4023a33465d095f64b913fc9d1b808d6524c307da945fbcffcf + brakeman (8.0.6) sha256=759cc69341115e6c2dcd47b6fd8649a0b9bd540e3585ac8a0a94e31c66fee386 + builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f + bundler-audit (0.9.3) sha256=81c8766c71e47d0d28a0f98c7eed028539f21a6ea3cd8f685eb6f42333c9b4e9 + capybara (3.40.0) sha256=42dba720578ea1ca65fd7a41d163dd368502c191804558f6e0f71b391054aeef + caxlsx (4.5.0) sha256=e3d98d859f148df05d5462086b5079b523f29c1766b569535f1d68629ce743ff + concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1 + connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a + crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295 + csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456 + date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0 + debug (1.11.1) sha256=2e0b0ac6119f2207a6f8ac7d4a73ca8eb4e440f64da0a3136c30343146e952b6 + dotenv (3.2.0) sha256=e375b83121ea7ca4ce20f214740076129ab8514cd81378161f11c03853fe619d + drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373 + ed25519 (1.4.0) sha256=16e97f5198689a154247169f3453ef4cfd3f7a47481fde0ae33206cdfdcac506 + erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92 + erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9 + et-orbi (1.4.2) sha256=bb555dae668419cb24caa2a293a170e58be6d4df1e017c51f5030bdc133cd20c + ffi (1.17.4-aarch64-linux-gnu) sha256=b208f06f91ffd8f5e1193da3cae3d2ccfc27fc36fba577baf698d26d91c080df + ffi (1.17.4-aarch64-linux-musl) sha256=9286b7a615f2676245283aef0a0a3b475ae3aae2bb5448baace630bb77b91f39 + ffi (1.17.4-arm-linux-gnu) sha256=d6dbddf7cb77bf955411af5f187a65b8cd378cb003c15c05697f5feee1cb1564 + ffi (1.17.4-arm-linux-musl) sha256=9d4838ded0465bef6e2426935f6bcc93134b6616785a84ffd2a3d82bc3cf6f95 + ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d + ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e + fugit (1.13.0) sha256=a4f093fce740da52f216740a5041e2a594ea763cdb89e8b2754ca4399634ab18 + globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427 + htmlentities (4.4.2) sha256=bbafbdf69f2eca9262be4efef7e43e6a1de54c95eb600f26984f71d2fe96c5c3 + i18n (1.15.2) sha256=00f9eb62412fe593b2a65a97daa75300d37abb8f7202ec748e94b6d46a9dd1b5 + image_processing (1.14.0) sha256=754cc169c9c262980889bec6bfd325ed1dafad34f85242b5a07b60af004742fb + importmap-rails (2.2.3) sha256=7101be2a4dc97cf1558fb8f573a718404c5f6bcfe94f304bf1f39e444feeb16a + io-console (0.9.2) sha256=efa74f891dd03c0939a931dfc6e74c2813d904763d456ea9762b0525e748db08 + irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3 + json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a + kamal (2.12.0) sha256=c51d1ab085e515470f98d0c0f043637122b5ebf76e8b610cb1fbbed0b7f9b8fa + language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0 + lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87 + logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203 + loofah (2.25.2) sha256=2007f746959ac65552456e04b433e83deb22759ab38c838b4445c70e43425918 + mail (2.9.1) sha256=06574eca475253d6c18145dd70af80d0eb970182d55053497c5f4d797ea160e8 + marcel (1.2.1) sha256=1678e9360e32f9eafa917c80029e2f6d10b2715c66a4b87b6d0da9b9cd1f859f + matrix (0.4.3) sha256=a0d5ab7ddcc1973ff690ab361b67f359acbb16958d1dc072b8b956a286564c5b + mini_magick (5.4.0) sha256=f120af581d9ed4ec52c57f35a67a605d112bb1d8f582d1415b147fda42d11d78 + mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef + minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1 + msgpack (1.8.4) sha256=4411c22d350dd1c20250f7eada3cca2695438c2f769cf0782f0cd065d90a3e7b + net-imap (0.6.6) sha256=96aa4ee50df3060203e649efc341f53480b791d49e150f2fdebf68beb141a8df + net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3 + net-protocol (0.3.0) sha256=ba310c3d4f1cad46bb1ab20336b06669b1ff8f7c568d9cb9342b32a718547472 + net-scp (4.1.0) sha256=a99b0b92a1e5d360b0de4ffbf2dc0c91531502d3d4f56c28b0139a7c093d1a5d + net-sftp (4.0.0) sha256=65bb91c859c2f93b09826757af11b69af931a3a9155050f50d1b06d384526364 + net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736 + net-ssh (7.3.3) sha256=831def58b2c51dcef66ec00d29397d4f210de89c19fe78f95873ca30f386e86a + nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1 + nokogiri (1.19.4-aarch64-linux-gnu) sha256=1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f + nokogiri (1.19.4-aarch64-linux-musl) sha256=35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af + nokogiri (1.19.4-arm-linux-gnu) sha256=a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca + nokogiri (1.19.4-arm-linux-musl) sha256=588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb + nokogiri (1.19.4-x86_64-linux-gnu) sha256=379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a + nokogiri (1.19.4-x86_64-linux-musl) sha256=17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b + ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912 + parallel (2.1.0) sha256=b35258865c2e31134c5ecb708beaaf6772adf9d5efae28e93e99260877b09356 + parser (3.3.12.0) sha256=21a6d7f755d5a24dfbdc6e6b772e4e879a52e7631a88bc5a3a134606052c9828 + pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570 + prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193 + prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85 + propshaft (1.3.2) sha256=1d56a3e56a92c21bfc29caf07406b5386b00d4c47ddf357cf989a5a234b1389e + public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623 + puma (8.0.2) sha256=c8ed871dfbbe66448ea9ffd46692342d9804d4071522b52b5331b7b6e7b686fb + raabro (1.5.0) sha256=3f998a7bc84f9c84df3ab580634d2e0a5bda4f0841168d56035f529c9877440a + racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f + rack (3.2.7) sha256=93e13e1c24f93556671d85d2d79fa228c3485815c50d7e2f265b5330c6528fb7 + rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8 + rack-test (2.2.0) sha256=005a36692c306ac0b4a9350355ee080fd09ddef1148a5f8b2ac636c720f5c463 + rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868 + rails (8.1.3.1) sha256=ccd11a36bfc171bf9c66d585d14c0ece91c0c9dde840aae60c0118d6f5c9c52a + rails-dom-testing (2.3.0) sha256=8acc7953a7b911ca44588bf08737bc16719f431a1cc3091a292bca7317925c1d + rails-html-sanitizer (1.7.1) sha256=e797a7c9b01e567307e317c576b49ab4168017e63eea4dba9ce3cb587e2f22c2 + railties (8.1.3.1) sha256=2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487 + rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a + rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701 + rbs (4.2.0) sha256=51f7b886dcc05bc09e10b901daa6a81829f6adc03101d6ca9ea4aac6103e0674 + rdoc (8.0.0) sha256=03bf8c08a9639658855a0cfd77c0abca8325c227693f7f33f82957811348c469 + regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb + reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d + rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142 + roo (2.10.1) sha256=cbb43bc955f9c110e74b721c835fb9bd3515b63af88ec709ac87fbf30f8be70e + rubocop (1.90.0) sha256=9eb4c065b5c5154e4ef554c547972f3905a9eb6b53e657e580b6796b54bf8242 + rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db + rubocop-minitest (0.40.0) sha256=353c698199115f12151144cf0b5a96f69bb9d77b660cf6536df2c4250c672a9d + rubocop-performance (1.27.0) sha256=eeeb1374d062a368ee1c787b70eb0b0cc4b184cb1f8565f424760946146d61ce + rubocop-rails (2.37.0) sha256=6e1645add5060e0328f8ddda0d820f55697c591394398bf14bb9dccb62f14b7e + rubocop-rails-omakase (1.1.0) sha256=2af73ac8ee5852de2919abbd2618af9c15c19b512c4cfc1f9a5d3b6ef009109d + ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33 + ruby-vips (2.3.0) sha256=e685ec02c13969912debbd98019e50492e12989282da5f37d05f5471442f5374 + rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615 + securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1 + selenium-webdriver (4.48.0) sha256=0c8376ebc8a0a4879343fe6fe6eccdcea76748611cd25de370b33eded2077a94 + simplecov (1.1.1) sha256=25825ef13f0b2e74694d769817dad6ab8e90131dabdaa666e522fea105521e78 + solid_cable (4.0.2) sha256=084636a67679ad00d23088b33c84047e614bcf41ee559db24b414d83cdc42d03 + solid_cache (1.0.10) sha256=bc05a2fb3ac78a6f43cbb5946679cf9db67dd30d22939ededc385cb93e120d41 + solid_queue (1.7.0) sha256=6566b70b801d1c317c81bba7bcdd5677c019afac584a30374b4164002ca356d3 + sqlite3 (2.9.6-aarch64-linux-gnu) sha256=d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c + sqlite3 (2.9.6-aarch64-linux-musl) sha256=3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9 + sqlite3 (2.9.6-arm-linux-gnu) sha256=33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec + sqlite3 (2.9.6-arm-linux-musl) sha256=c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33 + sqlite3 (2.9.6-x86_64-linux-gnu) sha256=613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634 + sqlite3 (2.9.6-x86_64-linux-musl) sha256=d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf + sshkit (1.25.1) sha256=be3f10b9d6eb0b44d5eaba3f7cbe41bc6bb894bce4339688ac20124391455b78 + stimulus-rails (1.3.4) sha256=765676ffa1f33af64ce026d26b48e8ffb2e0b94e0f50e9119e11d6107d67cb06 + tailwindcss-rails (4.6.0) sha256=d99512867173d55c5ef8890427682299d8539f550cec1408b3d8667a538bd365 + tailwindcss-ruby (4.3.3) sha256=ee0a64030749862deb501acab4c4aaf5adbee13865746a33299d46d7b5d0952a + tailwindcss-ruby (4.3.3-aarch64-linux-gnu) sha256=c86d6dd3eccc85fe0d792a832b06f2bf3c0a7a83b399308aeb9d8f5725f42a6a + tailwindcss-ruby (4.3.3-aarch64-linux-musl) sha256=72b77ca9edea82383dd09510ab520a122e3cb9f9864ca5b38e27698098d2b899 + tailwindcss-ruby (4.3.3-x86_64-linux-gnu) sha256=2337017ff8b02698480eae1e9637cf01faa0e4824db89d067a13c5a5ee38c9b2 + tailwindcss-ruby (4.3.3-x86_64-linux-musl) sha256=27d478c417bcf73828e5b544744c5bdfd5b5cb54f1a266fc4f185281c32efe6c + thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73 + thruster (0.1.26) sha256=6e45e807086b29d51404841bd1ad493b67cd95892fd65dc5afcdd32e82e94ce8 + thruster (0.1.26-aarch64-linux) sha256=2171cb34928c0250830008f535c4ab2ee57846cc3f5d3e96c3475f7b3de7a541 + thruster (0.1.26-x86_64-linux) sha256=3117a6ee430663f845a0457699fe9a05232dcc6c396e2cc83504de5a223c60e8 + timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb + tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f + turbo-rails (2.0.23) sha256=ee0d90733aafff056cf51ff11e803d65e43cae258cc55f6492020ec1f9f9315f + tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b + unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42 + unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f + uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6 + useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844 + web-console (4.3.0) sha256=e13b71301cdfc2093f155b5aa3a622db80b4672d1f2f713119cc7ec7ac6a6da4 + websocket (1.2.11) sha256=b7e7a74e2410b5e85c25858b26b3322f29161e300935f70a0e0d3c35e0462737 + websocket-driver (0.8.2) sha256=97c556b019bf3410b4961002ac501621e9322d3f8a7bc02161a09301cc4c4146 + websocket-extensions (0.1.5) sha256=1c6ba63092cda343eb53fc657110c71c754c56484aad42578495227d717a8241 + xpath (3.2.0) sha256=6dfda79d91bb3b949b947ecc5919f042ef2f399b904013eb3ef6d20dd3a4082e + zeitwerk (2.8.3) sha256=2c85125a8467ce069e20123d1e709a08955c9d29c118c25b46b7b7fafdbb92e5 + +BUNDLED WITH + 4.0.16 diff --git a/Procfile.dev b/Procfile.dev new file mode 100644 index 000000000..42e722d52 --- /dev/null +++ b/Procfile.dev @@ -0,0 +1,3 @@ +web: bin/rails server -b 0.0.0.0 +css: bundle exec tailwindcss -i ./app/assets/tailwind/application.css -o ./app/assets/builds/tailwind.css --watch=always +jobs: bin/jobs diff --git a/README.md b/README.md index 7829f14ff..c94fec99a 100644 --- a/README.md +++ b/README.md @@ -1,87 +1,250 @@ -# Modern Fullstack Developer Test (Rails 8 / Ruby 4) - -- Check this readme.md -- Create a branch to develop your task -- Push to remote in 1 week (date will be checked from branch creation/assigned date) - -# Requirements: -- Target Stack: **Ruby 4.0+** and **Rails 8.0+** -- Database: PostgreSQL, MySQL, or SQLite (configured for production-ready WAL mode) -- Write robust unit, integration, and system tests using parallel testing features -- Deliver with a working multi-stage Dockerfile utilizing Thruster/Kamal-ready defaults -- Show senior best practices (e.g., proper design patterns, solid architecture, strict linter configuration) - -# Our AI Policy -At Umanni, we value efficiency and the modern developer workflow. **You are allowed to use AI coding assistants (ChatGPT, Claude, Copilot, etc.) during this test.** However, transparency is part of our culture. If you use any LLM to generate, refactor, or structure your code, **you must explicitly state which model you used** in a dedicated section at the top of your submission's README.md. Failing to disclose AI usage while using it will invalidate your submission. - -# The Test -Here we'll try to simulate a "real sprint" that you'll probably be assigned while working as Fullstack at Umanni. - -# The Task -- Create a modern, responsive application to manage users. -- A user must have: - 1. full_name - 2. email - 3. avatar_image (ActiveStorage file upload or remote URL) - 4. role (admin/no-admin) - -# The App -## Admin Use cases -- As an Admin, I must be able to access a User Admin Dashboard. -- As an Admin, I must be able to see on the Dashboard (updated via real-time streams/frontend state): - - Total number of Users - - Total number of Users grouped by Role -- As an Admin, I must be redirected to the User Admin Dashboard after login. -- As an Admin, I must be able to list, create, edit, and delete Users. -- As an Admin, I must be able to toggle the User Role. -- As an Admin, I must be able to import a Spreadsheet (.csv/.xlsx) into the system in order to asynchronously create new Users. -- As an Admin, I must be able to see the live progress/status of the spreadsheet import process. - -## User Use Cases -- As a User, I must be redirected to my Profile after login. -- As a User, I must be able only to see my info, edit, and delete my profile. - -## Visitor Use Cases -- As a Visitor, I can register myself as a normal User. - - - -# The Start. -- Your deadline is 1 week after accepting this test. - -# The Rules (Strict Compliance) -These are mandatory. Failing any of them will invalidate your submission. -- **Documentation**: You must write down a detailed README.md in English explaining how to build, seed, and run your app, including your AI disclosure if applicable. -- **Frontend Stack**: You have two choices for the modern monolithic approach: - - **Option A (Classic Modern):** Hotwire (Turbo 8+ / Stimulus) with smooth, reactive UI states. - - **Option B (Modern SPA Monolith):** **React integrated via Inertia.js** (using Vite or the official Rails 8 asset pipeline integration). -- **Styling**: The Frontend must use a modern CSS framework (Tailwind CSS, Bootstrap, or any utility-first library). Keep it beautiful, responsive, and clean. -- **Real-time & Background Processing**: You must leverage native Rails 8 tools (**Solid Cable** for live dashboard counters/import bars and **Solid Queue** for the background import processing). No Redis installation should be required. -- **Authentication**: You must use the new built-in Rails 8 Authentication system (`bin/rails generate authentication`), customized to fit the role constraints. Avoid legacy heavy gems (like Devise). -- **Git Hygiene**: Clean git history with atomic commits, proper descriptions, and a Pull Request-based workflow. - -# What we're expecting to see: -- Modern asset management using **Propshaft** or **Vite Rails** (if choosing Inertia/React). -- .gitignore, .dockerignore configured correctly. -- Clean application configuration using Rails credentials. -- Comprehensive cross-browser support considerations. -- Strict form validations (Frontend interactive feedback + Backend structural validation). -- Parallel testing with at least 90% coverage (using Minitest, RSpec, and Playwright/Capybara for frontend integration). - -# Extra points -- Delivery via a clean **Kamal 2** deployment configuration (`deploy.yml`). -- Advanced SSR (Server-Side Rendering) setup if using **Inertia.js + React**. -- Use of **Thruster** as a zero-config proxy for asset caching and compression in Docker. -- Advanced performance profiling leveraging Ruby 4's **ZJIT** compilation optimizations. - -# What will be assessed -- Code's Semantics, Cleanness, and Maintainability (Senior-level object-oriented design and clean React/Stimulus component lifecycle). -- Modern Rails 8 idiom usage (e.g., Strict structural params handling, Solid architecture separation). -- Basic Security testing against traditional vectors (SQLi, XSS, XSRF) and proper encryption of sensitive DB columns where applicable. +# Umanni Users + +Modern user-management console built for the Umanni Fullstack Developer Test. + +## AI disclosure + +This submission was developed with assistance from **Cursor Auto (Composer agent router)** for scaffolding, refactoring, test generation, and documentation structure. All domain logic, architecture choices, and final review were validated against the assignment requirements by the submitting developer. + +--- + +## Stack + +| Layer | Choice | +| --- | --- | +| Language | Ruby **4.0+** | +| Framework | Rails **8.1** | +| Frontend | **Option A** — Hotwire (Turbo 8 / Stimulus) | +| CSS | Tailwind CSS 4 (`tailwindcss-rails`) | +| Assets | Propshaft + Importmap | +| Auth | Built-in Rails 8 Authentication (`bin/rails generate authentication`) | +| Jobs | **Solid Queue** (no Redis) | +| Realtime | **Solid Cable** + Turbo Streams (no Redis) | +| DB | SQLite 3 with production-ready **WAL** pragmas | +| Proxy | **Thruster** (Docker `CMD`) | +| Deploy | **Kamal 2** (`config/deploy.yml`) | + +## Features mapped to the brief + +### Admin +- Dashboard with live total users / admins / members (Turbo Streams over Solid Cable) +- Redirect to dashboard after login +- Full user CRUD + role toggle +- Async CSV/XLSX import via Solid Queue with live progress bars + +### User (member) +- Redirect to profile after login +- View / edit / delete own profile only + +### Visitor +- Self-registration as a normal member + +## Architecture notes + +``` +app/ + controllers/ # HTTP adapters + Authorization concern + models/ # User, Session, UserImport + services/users/ # DashboardStats, DashboardBroadcaster, Importer + jobs/ # ProcessUserImportJob (Solid Queue) + javascript/controllers# Stimulus: form validation + flash dismiss +``` + +- **Service objects** isolate import parsing and dashboard aggregation from controllers. +- **Strict params** via `params.require(...).permit(...)`. +- **Validations** on both backend (`User` / `UserImport`) and frontend (Stimulus `form-validation`). +- **Password digests** via `has_secure_password` / bcrypt (never store plaintext). +- **Security coverage** for XSS escaping, CSRF (enabled outside test), and SQLi-resistant auth lookups. + +## Prerequisites + +- Ruby 4.0+ +- Bundler +- SQLite 3 +- Chrome (for system tests) +- Docker (optional, for container runs) +- `libvips` recommended for Active Storage variants + +## Setup + +```bash +git clone umanni-users +cd umanni-users +bin/setup +bin/rails db:seed +``` + +`bin/setup` installs gems, prepares databases (primary + Solid Queue/Cable SQLite files), and clears logs/tmp. + +### Seed accounts + +| Role | Email | Password | +| --- | --- | --- | +| Admin | `admin@umanni.test` | `password123` | +| Member | `user@umanni.test` | `password123` | + +## Run locally + +Foreground processes (web + Tailwind watcher + Solid Queue worker): + +```bash +bin/dev +``` + +Then open [http://localhost:3000](http://localhost:3000). + +Manual equivalents: + +```bash +bin/rails server +bin/rails tailwindcss:watch +bin/jobs +``` + +### Spreadsheet import + +Sample files: +- [`docs/sample_users.csv`](docs/sample_users.csv) +- Generate XLSX: `bin/rails sample:xlsx` → `docs/sample_users.xlsx` + +Supported headers: `full_name`, `email` (or `email_address`), optional `password`, `avatar_url`, `role`. + +Upload from **Admin → Imports**. Progress streams live while `bin/jobs` (or `bin/dev`) is running. + +## Testing + +Parallel Minitest + Capybara/Selenium system tests: + +```bash +# Unit + integration (parallel) +bin/rails test + +# System / browser +bin/rails test:system + +# Coverage (threshold: 90%) +COVERAGE=true bin/rails test +``` + +Latest measured line coverage: **~93%**. + +Lint / security: + +```bash +bin/rubocop +bin/brakeman +bin/bundler-audit +bin/ci +``` + +## Docker (Thruster) + +Multi-stage production image is generated by Rails 8 and starts through Thruster. + +**Rebuild after changing credentials or initializers**, then run. For a local HTTP demo, disable SSL redirects: + +```bash +docker build -t umanni-users . +docker run --rm -p 80:80 \ + -e RAILS_MASTER_KEY="$(cat config/master.key)" \ + -e RAILS_FORCE_SSL=false \ + -e RAILS_ASSUME_SSL=false \ + -v umanni_storage:/rails/storage \ + umanni-users +``` + +Open http://localhost (port 80). Encryption keys are derived from `secret_key_base` once `RAILS_MASTER_KEY` unlocks credentials — no extra env vars required. + +Optional: set explicit `active_record_encryption` keys in credentials (`bin/rails db:encryption:init`) if you do not want derived keys. + +Thruster provides zero-config HTTP asset caching/compression in front of Puma. + +> Keep `config/master.key` private. It is gitignored; pass it via env/`kamal secrets` in real deployments. + +## Kamal 2 + +Configuration lives in [`config/deploy.yml`](config/deploy.yml): + +- Web role + dedicated `job` role (`bin/jobs`) +- Persistent volume for SQLite + Active Storage +- No Redis accessory (Solid Cable / Queue / Cache) +- Optional `RUBYOPT=--zjit` note for Ruby 4 ZJIT experiments + +```bash +# After editing hosts/registry secrets: +bin/kamal setup +bin/kamal deploy +``` + +## Credentials & configuration + +- Secrets: Rails credentials + `RAILS_MASTER_KEY` +- **Active Record Encryption** for `users.email_address` (deterministic; searchable) + - Local/test: built-in non-production keys (`config/initializers/active_record_encryption.rb`) + - Production: uses `credentials.active_record_encryption` if present, otherwise derives keys from `secret_key_base` (so Docker only needs `RAILS_MASTER_KEY`) + - Optional overrides: `ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY`, `ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY`, `ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT` +- Passwords: bcrypt digests via `has_secure_password` (never stored plaintext) +- SQLite WAL mode via `config/database.yml` pragmas (`journal_mode: WAL`, `synchronous: NORMAL`, `foreign_keys: true`) +- Development uses Solid Queue + Solid Cable against dedicated SQLite files under `storage/` +- Production enables `assume_ssl` + `force_ssl` (health check `/up` excluded) for Kamal/Thruster + +## Ruby 4 ZJIT (extra) + +MRI 4 ships an experimental ZJIT. For profiling experiments on compatible hosts, uncomment in `config/deploy.yml`: + +```yaml +env: + clear: + RUBYOPT: "--zjit" +``` + +Validate with `RUBYOPT=--zjit bin/rails runner 'puts RubyVM::ZJIT.enabled? rescue puts(RUBY_DESCRIPTION)'` before enabling in production. + +## Cross-browser notes + +- `allow_browser` targets evergreen engines (Chrome 110+, Firefox 111+, Safari 17+, Opera 96+; IE blocked) +- UI is responsive (mobile nav-friendly layout, fluid tables) +- Progressive enhancement: forms work without Stimulus; Stimulus adds interactive validation feedback +- Prefer modern CSS nesting / `:has()`-capable browsers as documented by Rails 8 defaults + +## Git workflow (PR-based) + +Atomic commits are kept on topic branches and merged through Pull Requests: + +1. Branch from `main` (e.g. `feature/compliance-hardening`) +2. Open a Pull Request with summary + test plan +3. Keep commits focused (scaffold → domain → UI → jobs → tests → deploy docs) + +## Requirements checklist + +| Requirement | Status | +| --- | --- | +| Ruby 4.0+ / Rails 8.0+ | ✅ Ruby 4.0.6 / Rails 8.1.3 | +| SQLite WAL (or PG/MySQL) | ✅ WAL pragmas in `database.yml` | +| Hotwire **or** Inertia | ✅ Option A — Turbo 8 + Stimulus | +| Tailwind (or modern CSS) | ✅ Tailwind CSS 4 | +| Rails 8 built-in Authentication | ✅ `generate authentication` + roles | +| Solid Cable + Solid Queue (no Redis) | ✅ | +| Admin dashboard live counters | ✅ Turbo Streams | +| Admin CRUD + role toggle | ✅ | +| Async CSV/XLSX import + live progress | ✅ | +| Member profile only / visitor register | ✅ | +| Multi-stage Dockerfile + Thruster | ✅ | +| Kamal 2 `deploy.yml` | ✅ | +| Parallel tests ≥ 90% coverage | ✅ Minitest parallel + SimpleCov | +| Security (XSS / SQLi / CSRF) + encryption | ✅ | +| README + AI disclosure | ✅ | +| Atomic commits / PR workflow | ✅ | + +## Project map (quick) + +- `app/controllers/admin/*` — dashboard, users CRUD, imports +- `app/services/users/importer.rb` — CSV/XLSX parsing +- `app/models/user_import.rb` — progress + Turbo Stream broadcasts +- `config/deploy.yml` — Kamal 2 +- `Dockerfile` — multi-stage + Thruster +- `test/` — models, services, jobs, controllers, integration security, system + +## License + +Proprietary assessment submission for Umanni. diff --git a/Rakefile b/Rakefile new file mode 100644 index 000000000..9a5ea7383 --- /dev/null +++ b/Rakefile @@ -0,0 +1,6 @@ +# Add your own tasks in files placed in lib/tasks ending in .rake, +# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. + +require_relative "config/application" + +Rails.application.load_tasks diff --git a/app/assets/builds/.keep b/app/assets/builds/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/assets/images/.keep b/app/assets/images/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/assets/stylesheets/application.css b/app/assets/stylesheets/application.css new file mode 100644 index 000000000..fe93333c0 --- /dev/null +++ b/app/assets/stylesheets/application.css @@ -0,0 +1,10 @@ +/* + * This is a manifest file that'll be compiled into application.css. + * + * With Propshaft, assets are served efficiently without preprocessing steps. You can still include + * application-wide styles in this file, but keep in mind that CSS precedence will follow the standard + * cascading order, meaning styles declared later in the document or manifest will override earlier ones, + * depending on specificity. + * + * Consider organizing styles into separate files for maintainability. + */ diff --git a/app/assets/tailwind/application.css b/app/assets/tailwind/application.css new file mode 100644 index 000000000..5a658a7a2 --- /dev/null +++ b/app/assets/tailwind/application.css @@ -0,0 +1,28 @@ +@import url("https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Fraunces:opsz,wght@9..144,600;9..144,700&display=swap"); +@import "tailwindcss"; + +@theme { + --font-sans: "DM Sans", ui-sans-serif, system-ui, sans-serif; + --font-display: "Fraunces", ui-serif, Georgia, serif; + --color-ink: #0f172a; + --color-muted: #64748b; + --color-surface: #f8fafc; + --color-accent: #0f766e; + --color-accent-dark: #115e59; +} + +@layer base { + html { + font-family: var(--font-sans); + color: var(--color-ink); + background: + radial-gradient(1200px 600px at 10% -10%, rgba(15, 118, 110, 0.12), transparent 60%), + radial-gradient(900px 500px at 100% 0%, rgba(15, 23, 42, 0.06), transparent 55%), + linear-gradient(180deg, #f8fafc 0%, #eef2f7 100%); + min-height: 100%; + } + + body { + min-height: 100vh; + } +} diff --git a/app/channels/application_cable/connection.rb b/app/channels/application_cable/connection.rb new file mode 100644 index 000000000..4264c745c --- /dev/null +++ b/app/channels/application_cable/connection.rb @@ -0,0 +1,16 @@ +module ApplicationCable + class Connection < ActionCable::Connection::Base + identified_by :current_user + + def connect + set_current_user || reject_unauthorized_connection + end + + private + def set_current_user + if session = Session.find_by(id: cookies.signed[:session_id]) + self.current_user = session.user + end + end + end +end diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb new file mode 100644 index 000000000..cdee5c331 --- /dev/null +++ b/app/controllers/admin/base_controller.rb @@ -0,0 +1,5 @@ +module Admin + class BaseController < ApplicationController + require_admin! + end +end diff --git a/app/controllers/admin/dashboard_controller.rb b/app/controllers/admin/dashboard_controller.rb new file mode 100644 index 000000000..602b7f53b --- /dev/null +++ b/app/controllers/admin/dashboard_controller.rb @@ -0,0 +1,8 @@ +module Admin + class DashboardController < BaseController + def show + @stats = Users::DashboardStats.call + @recent_imports = UserImport.includes(:created_by).order(created_at: :desc).limit(5) + end + end +end diff --git a/app/controllers/admin/imports_controller.rb b/app/controllers/admin/imports_controller.rb new file mode 100644 index 000000000..b12101540 --- /dev/null +++ b/app/controllers/admin/imports_controller.rb @@ -0,0 +1,29 @@ +module Admin + class ImportsController < BaseController + def index + @imports = UserImport.includes(:created_by).order(created_at: :desc) + @import = UserImport.new + end + + def create + @import = Current.user.created_imports.new(import_params) + + if @import.save + redirect_to admin_imports_path, notice: "Import started. Progress will update live." + else + @imports = UserImport.includes(:created_by).order(created_at: :desc) + render :index, status: :unprocessable_entity + end + end + + def show + @import = UserImport.find(params[:id]) + end + + private + + def import_params + params.require(:user_import).permit(:spreadsheet) + end + end +end diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb new file mode 100644 index 000000000..99a1b2cbf --- /dev/null +++ b/app/controllers/admin/users_controller.rb @@ -0,0 +1,77 @@ +module Admin + class UsersController < BaseController + before_action :set_user, only: %i[show edit update destroy toggle_role] + + def index + @users = User.order(:full_name) + end + + def show + end + + def new + @user = User.new(role: :member) + end + + def create + @user = User.new(user_params) + + if @user.save + redirect_to admin_user_path(@user), notice: "User created." + else + render :new, status: :unprocessable_entity + end + end + + def edit + end + + def update + if @user.update(user_params) + redirect_to admin_user_path(@user), notice: "User updated." + else + render :edit, status: :unprocessable_entity + end + end + + def destroy + if @user == Current.user + redirect_to admin_users_path, alert: "You cannot delete your own account from the admin panel." + return + end + + @user.destroy! + redirect_to admin_users_path, notice: "User deleted.", status: :see_other + end + + def toggle_role + if @user == Current.user + redirect_to admin_users_path, alert: "You cannot change your own role." + return + end + + previous_role = @user.role + @user.admin? ? @user.member! : @user.admin! + redirect_to admin_users_path, + notice: "#{@user.full_name} was changed from #{previous_role} to #{@user.role}." + end + + private + + def set_user + @user = User.find(params[:id]) + end + + def user_params + params.require(:user).permit( + :full_name, + :email_address, + :password, + :password_confirmation, + :role, + :avatar_url, + :avatar_image + ) + end + end +end diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb new file mode 100644 index 000000000..66f1e21b4 --- /dev/null +++ b/app/controllers/application_controller.rb @@ -0,0 +1,10 @@ +class ApplicationController < ActionController::Base + include Authentication + include Authorization + + # Prefer progressive enhancement over hard browser blocks for broader support. + # Documented modern features: CSS nesting, :has(), import maps, and Turbo. + allow_browser versions: { safari: 17, chrome: 110, firefox: 111, opera: 96, ie: false } + + stale_when_importmap_changes +end diff --git a/app/controllers/concerns/.keep b/app/controllers/concerns/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/controllers/concerns/authentication.rb b/app/controllers/concerns/authentication.rb new file mode 100644 index 000000000..263fec4f9 --- /dev/null +++ b/app/controllers/concerns/authentication.rb @@ -0,0 +1,62 @@ +module Authentication + extend ActiveSupport::Concern + + included do + before_action :require_authentication + helper_method :authenticated?, :current_user + end + + class_methods do + def allow_unauthenticated_access(**options) + skip_before_action :require_authentication, **options + end + end + + private + def authenticated? + resume_session + end + + def current_user + Current.user + end + + def require_authentication + resume_session || request_authentication + end + + def resume_session + Current.session ||= find_session_by_cookie + end + + def find_session_by_cookie + Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id] + end + + def request_authentication + session[:return_to_after_authenticating] = request.url + redirect_to new_session_path + end + + def after_authentication_url + session.delete(:return_to_after_authenticating) || default_authenticated_url + end + + def default_authenticated_url + return admin_root_url if Current.user&.admin? + + profile_url + end + + def start_new_session_for(user) + user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session| + Current.session = session + cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax } + end + end + + def terminate_session + Current.session.destroy + cookies.delete(:session_id) + end +end diff --git a/app/controllers/concerns/authorization.rb b/app/controllers/concerns/authorization.rb new file mode 100644 index 000000000..878718c62 --- /dev/null +++ b/app/controllers/concerns/authorization.rb @@ -0,0 +1,23 @@ +module Authorization + extend ActiveSupport::Concern + + class_methods do + def require_admin!(**options) + before_action :require_admin, **options + end + end + + private + + def require_admin + return if Current.user&.admin? + + redirect_to after_authentication_url_for(Current.user), alert: "You are not authorized to access that area." + end + + def after_authentication_url_for(user) + return admin_root_path if user&.admin? + + profile_path + end +end diff --git a/app/controllers/home_controller.rb b/app/controllers/home_controller.rb new file mode 100644 index 000000000..239bfb0ab --- /dev/null +++ b/app/controllers/home_controller.rb @@ -0,0 +1,9 @@ +class HomeController < ApplicationController + allow_unauthenticated_access only: :index + + def index + if authenticated? + redirect_to(Current.user.admin? ? admin_root_path : profile_path) + end + end +end diff --git a/app/controllers/passwords_controller.rb b/app/controllers/passwords_controller.rb new file mode 100644 index 000000000..f95ec7874 --- /dev/null +++ b/app/controllers/passwords_controller.rb @@ -0,0 +1,35 @@ +class PasswordsController < ApplicationController + allow_unauthenticated_access + before_action :set_user_by_token, only: %i[ edit update ] + rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_password_path, alert: "Try again later." } + + def new + end + + def create + if user = User.find_by(email_address: params[:email_address]) + PasswordsMailer.reset(user).deliver_later + end + + redirect_to new_session_path, notice: "Password reset instructions sent (if user with that email address exists)." + end + + def edit + end + + def update + if @user.update(params.permit(:password, :password_confirmation)) + @user.sessions.destroy_all + redirect_to new_session_path, notice: "Password has been reset." + else + redirect_to edit_password_path(params[:token]), alert: "Passwords did not match." + end + end + + private + def set_user_by_token + @user = User.find_by_password_reset_token!(params[:token]) + rescue ActiveSupport::MessageVerifier::InvalidSignature + redirect_to new_password_path, alert: "Password reset link is invalid or has expired." + end +end diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb new file mode 100644 index 000000000..578bd46c4 --- /dev/null +++ b/app/controllers/profiles_controller.rb @@ -0,0 +1,33 @@ +class ProfilesController < ApplicationController + before_action :set_user + + def show + end + + def edit + end + + def update + if @user.update(profile_params) + redirect_to profile_path, notice: "Profile updated." + else + render :edit, status: :unprocessable_entity + end + end + + def destroy + terminate_session + @user.destroy! + redirect_to new_session_path, status: :see_other, notice: "Your account has been deleted." + end + + private + + def set_user + @user = Current.user + end + + def profile_params + params.require(:user).permit(:full_name, :email_address, :password, :password_confirmation, :avatar_url, :avatar_image) + end +end diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb new file mode 100644 index 000000000..06728f324 --- /dev/null +++ b/app/controllers/registrations_controller.rb @@ -0,0 +1,24 @@ +class RegistrationsController < ApplicationController + allow_unauthenticated_access + + def new + @user = User.new + end + + def create + @user = User.new(registration_params.merge(role: :member)) + + if @user.save + start_new_session_for @user + redirect_to profile_path, notice: "Welcome! Your account was created." + else + render :new, status: :unprocessable_entity + end + end + + private + + def registration_params + params.require(:user).permit(:full_name, :email_address, :password, :password_confirmation, :avatar_url, :avatar_image) + end +end diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb new file mode 100644 index 000000000..8b0dc6f95 --- /dev/null +++ b/app/controllers/sessions_controller.rb @@ -0,0 +1,21 @@ +class SessionsController < ApplicationController + allow_unauthenticated_access only: %i[ new create ] + rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." } + + def new + end + + def create + if (user = User.authenticate_by(params.permit(:email_address, :password))) + start_new_session_for user + redirect_to after_authentication_url, notice: "Signed in successfully." + else + redirect_to new_session_path, alert: "Try another email address or password." + end + end + + def destroy + terminate_session + redirect_to new_session_path, status: :see_other, notice: "Signed out." + end +end diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb new file mode 100644 index 000000000..4aed55fbb --- /dev/null +++ b/app/helpers/application_helper.rb @@ -0,0 +1,93 @@ +module ApplicationHelper + def page_title(title) + content_for(:title) { "#{title} · Umanni Users" } + end + + def flash_class(type) + case type.to_sym + when :notice then "border-emerald-200 bg-emerald-50 text-emerald-900" + when :alert then "border-rose-200 bg-rose-50 text-rose-900" + else "border-slate-200 bg-slate-50 text-slate-900" + end + end + + def role_badge_class(role) + role.to_s == "admin" ? "bg-teal-100 text-teal-800" : "bg-slate-100 text-slate-700" + end + + # Segmented Member | Admin control. Active segment is static; the other submits a toggle. + def role_switch_for(user) + content_tag :div, + class: "inline-flex rounded-lg border border-slate-200 bg-slate-100 p-0.5 text-xs font-semibold", + role: "group", + "aria-label": "Role for #{user.full_name}" do + safe_join([ + role_switch_segment(user, role: "member", label: "Member", active: user.member?), + role_switch_segment(user, role: "admin", label: "Admin", active: user.admin?) + ]) + end + end + + def avatar_tag(user, size: 40, classes: "") + wrapper_classes = "inline-flex shrink-0 overflow-hidden rounded-full bg-slate-200 #{classes}" + wrapper_style = "width: #{size}px; height: #{size}px; min-width: #{size}px; min-height: #{size}px;" + + content_tag :span, class: wrapper_classes, style: wrapper_style do + if user.avatar_image.attached? + image_tag avatar_image_source(user, size), + class: "h-full w-full object-cover", + width: size, + height: size, + alt: user.full_name + elsif user.avatar_url.present? + image_tag user.avatar_url, + class: "h-full w-full object-cover", + width: size, + height: size, + alt: user.full_name, + loading: "lazy", + referrerpolicy: "no-referrer" + else + content_tag :span, + user.initials, + class: "flex h-full w-full items-center justify-center bg-slate-800 text-white text-sm font-semibold", + aria: { label: user.full_name } + end + end + end + + def import_status_class(status) + { + "pending" => "bg-amber-100 text-amber-800", + "processing" => "bg-sky-100 text-sky-800", + "completed" => "bg-emerald-100 text-emerald-800", + "failed" => "bg-rose-100 text-rose-800" + }[status.to_s] || "bg-slate-100 text-slate-700" + end + + private + + def role_switch_segment(user, role:, label:, active:) + if active + content_tag :span, + label, + class: "rounded-md px-2.5 py-1 #{role == "admin" ? "bg-teal-700 text-white shadow-sm" : "bg-white text-slate-900 shadow-sm"}" + elsif user == current_user + content_tag :span, + label, + class: "rounded-md px-2.5 py-1 text-slate-400", + title: "You cannot change your own role" + else + button_to label, + toggle_role_admin_user_path(user), + method: :patch, + class: "rounded-md px-2.5 py-1 text-slate-600 transition hover:bg-white hover:text-slate-900" + end + end + + def avatar_image_source(user, size) + user.avatar_image.variant(resize_to_fill: [ size * 2, size * 2 ]) + rescue StandardError + user.avatar_image + end +end diff --git a/app/javascript/application.js b/app/javascript/application.js new file mode 100644 index 000000000..0d7b49404 --- /dev/null +++ b/app/javascript/application.js @@ -0,0 +1,3 @@ +// Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails +import "@hotwired/turbo-rails" +import "controllers" diff --git a/app/javascript/controllers/application.js b/app/javascript/controllers/application.js new file mode 100644 index 000000000..1213e85c7 --- /dev/null +++ b/app/javascript/controllers/application.js @@ -0,0 +1,9 @@ +import { Application } from "@hotwired/stimulus" + +const application = Application.start() + +// Configure Stimulus development experience +application.debug = false +window.Stimulus = application + +export { application } diff --git a/app/javascript/controllers/auto_dismiss_controller.js b/app/javascript/controllers/auto_dismiss_controller.js new file mode 100644 index 000000000..c56654818 --- /dev/null +++ b/app/javascript/controllers/auto_dismiss_controller.js @@ -0,0 +1,15 @@ +import { Controller } from "@hotwired/stimulus" + +export default class extends Controller { + connect() { + this.timeout = setTimeout(() => { + this.element.style.transition = "opacity 300ms ease" + this.element.style.opacity = "0" + setTimeout(() => this.element.remove(), 320) + }, 4500) + } + + disconnect() { + clearTimeout(this.timeout) + } +} diff --git a/app/javascript/controllers/form_validation_controller.js b/app/javascript/controllers/form_validation_controller.js new file mode 100644 index 000000000..ab5c1e327 --- /dev/null +++ b/app/javascript/controllers/form_validation_controller.js @@ -0,0 +1,31 @@ +import { Controller } from "@hotwired/stimulus" + +export default class extends Controller { + static targets = ["field", "error"] + + validate(event) { + let valid = true + + this.fieldTargets.forEach((field) => { + const rules = (field.dataset.validate || "").split(" ") + const error = this.errorTargets.find((el) => el.dataset.for === field.name.replace("user[", "").replace("]", "")) + const value = field.value.trim() + let fieldValid = true + + if (rules.includes("presence") && !value) fieldValid = false + if (rules.includes("length") && value && (value.length < 2 || value.length > 120)) fieldValid = false + if (rules.includes("email") && value && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) fieldValid = false + if (rules.includes("password") && value.length < 8) fieldValid = false + if (rules.includes("optional_password") && value && value.length < 8) fieldValid = false + if (rules.includes("optional_url") && value && !/^https?:\/\/.+/i.test(value)) fieldValid = false + + if (error) error.classList.toggle("hidden", fieldValid) + field.classList.toggle("border-rose-400", !fieldValid) + if (!fieldValid) valid = false + }) + + if (event.type === "submit" && !valid) { + event.preventDefault() + } + } +} diff --git a/app/javascript/controllers/index.js b/app/javascript/controllers/index.js new file mode 100644 index 000000000..1156bf836 --- /dev/null +++ b/app/javascript/controllers/index.js @@ -0,0 +1,4 @@ +// Import and register all your controllers from the importmap via controllers/**/*_controller +import { application } from "controllers/application" +import { eagerLoadControllersFrom } from "@hotwired/stimulus-loading" +eagerLoadControllersFrom("controllers", application) diff --git a/app/jobs/application_job.rb b/app/jobs/application_job.rb new file mode 100644 index 000000000..d394c3d10 --- /dev/null +++ b/app/jobs/application_job.rb @@ -0,0 +1,7 @@ +class ApplicationJob < ActiveJob::Base + # Automatically retry jobs that encountered a deadlock + # retry_on ActiveRecord::Deadlocked + + # Most jobs are safe to ignore if the underlying records are no longer available + # discard_on ActiveJob::DeserializationError +end diff --git a/app/jobs/process_user_import_job.rb b/app/jobs/process_user_import_job.rb new file mode 100644 index 000000000..42678fcdf --- /dev/null +++ b/app/jobs/process_user_import_job.rb @@ -0,0 +1,13 @@ +class ProcessUserImportJob < ApplicationJob + queue_as :default + + discard_on ActiveJob::DeserializationError + + def perform(user_import_id) + user_import = UserImport.find_by(id: user_import_id) + return unless user_import + return if user_import.finished? + + Users::Importer.call(user_import) + end +end diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb new file mode 100644 index 000000000..3c34c8148 --- /dev/null +++ b/app/mailers/application_mailer.rb @@ -0,0 +1,4 @@ +class ApplicationMailer < ActionMailer::Base + default from: "from@example.com" + layout "mailer" +end diff --git a/app/mailers/passwords_mailer.rb b/app/mailers/passwords_mailer.rb new file mode 100644 index 000000000..4f0ac7fd9 --- /dev/null +++ b/app/mailers/passwords_mailer.rb @@ -0,0 +1,6 @@ +class PasswordsMailer < ApplicationMailer + def reset(user) + @user = user + mail subject: "Reset your password", to: user.email_address + end +end diff --git a/app/models/application_record.rb b/app/models/application_record.rb new file mode 100644 index 000000000..b63caeb8a --- /dev/null +++ b/app/models/application_record.rb @@ -0,0 +1,3 @@ +class ApplicationRecord < ActiveRecord::Base + primary_abstract_class +end diff --git a/app/models/concerns/.keep b/app/models/concerns/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/models/current.rb b/app/models/current.rb new file mode 100644 index 000000000..2bef56dad --- /dev/null +++ b/app/models/current.rb @@ -0,0 +1,4 @@ +class Current < ActiveSupport::CurrentAttributes + attribute :session + delegate :user, to: :session, allow_nil: true +end diff --git a/app/models/session.rb b/app/models/session.rb new file mode 100644 index 000000000..cf376fb28 --- /dev/null +++ b/app/models/session.rb @@ -0,0 +1,3 @@ +class Session < ApplicationRecord + belongs_to :user +end diff --git a/app/models/user.rb b/app/models/user.rb new file mode 100644 index 000000000..87dbc5ee8 --- /dev/null +++ b/app/models/user.rb @@ -0,0 +1,63 @@ +class User < ApplicationRecord + ROLES = { member: 0, admin: 1 }.freeze + + has_secure_password + has_many :sessions, dependent: :destroy + has_many :created_imports, class_name: "UserImport", foreign_key: :created_by_id, inverse_of: :created_by, dependent: :destroy + has_one_attached :avatar_image + + enum :role, ROLES, validate: true + + # Deterministic so uniqueness / authenticate_by / find_by(email) keep working. + encrypts :email_address, deterministic: true + + normalizes :email_address, with: ->(email) { email.to_s.strip.downcase } + normalizes :full_name, with: ->(name) { name.to_s.strip.squeeze(" ") } + normalizes :avatar_url, with: ->(url) { url.to_s.strip.presence } + + validates :full_name, presence: true, length: { minimum: 2, maximum: 120 } + validates :email_address, presence: true, uniqueness: true, + format: { with: URI::MailTo::EMAIL_REGEXP } + validates :password, length: { minimum: 8 }, if: -> { password.present? } + validates :avatar_url, format: { with: /\Ahttps?:\/\/.+\z/i, allow_blank: true, message: "must be an http(s) URL" } + validate :acceptable_avatar_image + + after_commit :broadcast_dashboard_stats, on: %i[create update destroy] + + def admin? + role == "admin" + end + + def member? + role == "member" + end + + def avatar_src + return avatar_image if avatar_image.attached? + return avatar_url if avatar_url.present? + + nil + end + + def initials + full_name.to_s.split.map { |part| part[0] }.first(2).join.upcase.presence || "?" + end + + private + + def acceptable_avatar_image + return unless avatar_image.attached? + + unless avatar_image.blob.content_type.in?(%w[image/png image/jpeg image/jpg image/webp image/gif]) + errors.add(:avatar_image, "must be a PNG, JPEG, WEBP, or GIF image") + end + + if avatar_image.blob.byte_size > 5.megabytes + errors.add(:avatar_image, "must be smaller than 5MB") + end + end + + def broadcast_dashboard_stats + Users::DashboardBroadcaster.call + end +end diff --git a/app/models/user_import.rb b/app/models/user_import.rb new file mode 100644 index 000000000..3a5d22224 --- /dev/null +++ b/app/models/user_import.rb @@ -0,0 +1,61 @@ +class UserImport < ApplicationRecord + STATUSES = { pending: 0, processing: 1, completed: 2, failed: 3 }.freeze + + belongs_to :created_by, class_name: "User" + has_one_attached :spreadsheet + + enum :status, STATUSES, validate: true + + validates :spreadsheet, presence: true, on: :create + validate :acceptable_spreadsheet, on: :create + + after_create_commit :enqueue_processing + after_update_commit :broadcast_progress + + def progress_percent + return 0 if total_rows.to_i.zero? + + ((processed_rows.to_f / total_rows) * 100).round + end + + def finished? + completed? || failed? + end + + private + + def acceptable_spreadsheet + return unless spreadsheet.attached? + + allowed = %w[ + text/csv + application/vnd.ms-excel + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + application/csv + ] + + content_type = spreadsheet.blob.content_type + filename = spreadsheet.blob.filename.to_s.downcase + + unless content_type.in?(allowed) || filename.end_with?(".csv", ".xlsx", ".xls") + errors.add(:spreadsheet, "must be a .csv or .xlsx file") + end + + if spreadsheet.blob.byte_size > 10.megabytes + errors.add(:spreadsheet, "must be smaller than 10MB") + end + end + + def enqueue_processing + ProcessUserImportJob.perform_later(id) + end + + def broadcast_progress + broadcast_replace_to( + "admin_imports", + target: ActionView::RecordIdentifier.dom_id(self), + partial: "admin/imports/import", + locals: { import: self } + ) + end +end diff --git a/app/services/users/dashboard_broadcaster.rb b/app/services/users/dashboard_broadcaster.rb new file mode 100644 index 000000000..4010bc2c0 --- /dev/null +++ b/app/services/users/dashboard_broadcaster.rb @@ -0,0 +1,18 @@ +module Users + class DashboardBroadcaster + def self.call + new.call + end + + def call + stats = DashboardStats.call + + Turbo::StreamsChannel.broadcast_replace_to( + "admin_dashboard", + target: "dashboard_stats", + partial: "admin/dashboard/stats", + locals: { stats: stats } + ) + end + end +end diff --git a/app/services/users/dashboard_stats.rb b/app/services/users/dashboard_stats.rb new file mode 100644 index 000000000..058fb8009 --- /dev/null +++ b/app/services/users/dashboard_stats.rb @@ -0,0 +1,18 @@ +module Users + class DashboardStats + Result = Data.define(:total, :admins, :members) + + def self.call + new.call + end + + def call + counts = User.group(:role).count + Result.new( + total: counts.values.sum, + admins: counts["admin"] || counts[User.roles[:admin]] || 0, + members: counts["member"] || counts[User.roles[:member]] || 0 + ) + end + end +end diff --git a/app/services/users/importer.rb b/app/services/users/importer.rb new file mode 100644 index 000000000..f7d4e56c3 --- /dev/null +++ b/app/services/users/importer.rb @@ -0,0 +1,113 @@ +require "csv" +require "roo" + +module Users + # Parses a spreadsheet and creates member users asynchronously tracked by UserImport. + class Importer + Result = Data.define(:successful, :failed, :errors) + + HEADERS = { + "full_name" => :full_name, + "fullname" => :full_name, + "name" => :full_name, + "email" => :email_address, + "email_address" => :email_address, + "password" => :password, + "avatar_url" => :avatar_url, + "role" => :role + }.freeze + + def initialize(user_import) + @user_import = user_import + end + + def self.call(user_import) + new(user_import).call + end + + def call + rows = parse_rows + @user_import.update!(status: :processing, total_rows: rows.size, processed_rows: 0, successful_rows: 0, failed_rows: 0) + + successful = 0 + failed = 0 + errors = [] + + rows.each_with_index do |row, index| + attrs = normalize_row(row) + user = User.new(attrs.merge(role: attrs[:role].presence || "member")) + user.password ||= SecureRandom.alphanumeric(16) + + if user.save + successful += 1 + else + failed += 1 + errors << "Row #{index + 2}: #{user.errors.full_messages.to_sentence}" + end + + @user_import.update!( + processed_rows: index + 1, + successful_rows: successful, + failed_rows: failed + ) + end + + @user_import.update!( + status: :completed, + error_message: errors.first(20).join("\n").presence + ) + + Result.new(successful: successful, failed: failed, errors: errors) + rescue StandardError => e + @user_import.update!(status: :failed, error_message: e.message) + raise + end + + private + + def parse_rows + @user_import.spreadsheet.open do |file| + path = file.path + filename = @user_import.spreadsheet.filename.to_s.downcase + + if filename.end_with?(".csv") + parse_csv(path) + else + parse_xlsx(path) + end + end + end + + def parse_csv(path) + table = CSV.read(path, headers: true) + table.map(&:to_h) + end + + def parse_xlsx(path) + spreadsheet = Roo::Spreadsheet.open(path) + sheet = spreadsheet.sheet(0) + headers = sheet.row(1).map { |h| h.to_s.strip.downcase } + + (2..sheet.last_row).map do |i| + headers.zip(sheet.row(i)).to_h + end + end + + def normalize_row(row) + mapped = {} + row.each do |key, value| + attribute = HEADERS[key.to_s.strip.downcase] + next unless attribute + + mapped[attribute] = value.to_s.strip.presence + end + + if mapped[:role].present? + role = mapped[:role].to_s.downcase + mapped[:role] = role.in?(%w[admin administrator]) ? "admin" : "member" + end + + mapped + end + end +end diff --git a/app/views/admin/dashboard/_stats.html.erb b/app/views/admin/dashboard/_stats.html.erb new file mode 100644 index 000000000..4479ec6f7 --- /dev/null +++ b/app/views/admin/dashboard/_stats.html.erb @@ -0,0 +1,14 @@ +
+
+

Total users

+

<%= stats.total %>

+
+
+

Admins

+

<%= stats.admins %>

+
+
+

Members

+

<%= stats.members %>

+
+
diff --git a/app/views/admin/dashboard/show.html.erb b/app/views/admin/dashboard/show.html.erb new file mode 100644 index 000000000..d1f696ab9 --- /dev/null +++ b/app/views/admin/dashboard/show.html.erb @@ -0,0 +1,39 @@ +<% page_title "Admin dashboard" %> + +<%= turbo_stream_from "admin_dashboard" %> +<%= turbo_stream_from "admin_imports" %> + +
+
+

Admin dashboard

+

Live user totals update over Solid Cable whenever the user base changes.

+
+ + <%= render "admin/dashboard/stats", stats: @stats %> + +
+
+
+

Quick actions

+
+
+ <%= link_to "Manage users", admin_users_path, class: "rounded-xl bg-slate-900 px-4 py-2.5 text-sm font-semibold text-white hover:bg-slate-800" %> + <%= link_to "Import spreadsheet", admin_imports_path, class: "rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "New user", new_admin_user_path, class: "rounded-xl border border-slate-300 px-4 py-2.5 text-sm font-semibold text-slate-800 hover:bg-slate-50" %> +
+
+ +
+

Recent imports

+
    + <% if @recent_imports.any? %> + <% @recent_imports.each do |import| %> + <%= render "admin/imports/import", import: import %> + <% end %> + <% else %> +
  • No imports yet.
    • + <% end %> +
+
+
+
diff --git a/app/views/admin/imports/_import.html.erb b/app/views/admin/imports/_import.html.erb new file mode 100644 index 000000000..ae056d2e2 --- /dev/null +++ b/app/views/admin/imports/_import.html.erb @@ -0,0 +1,27 @@ +
  • +
    +
    +
    + <%= import.status %> + #<%= import.id %> +
    +

    + <%= import.successful_rows %>/<%= import.total_rows %> succeeded + <% if import.failed_rows.positive? %> + · <%= import.failed_rows %> failed + <% end %> +

    + <% if import.error_message.present? %> +

    <%= truncate(import.error_message, length: 140) %>

    + <% end %> +
    +
    +

    <%= time_ago_in_words(import.created_at) %> ago

    + <%= link_to "Details", admin_import_path(import), class: "mt-1 inline-block font-semibold text-teal-800 hover:underline" %> +
    +
    + +
    +
    +
    +
    • diff --git a/app/views/admin/imports/index.html.erb b/app/views/admin/imports/index.html.erb new file mode 100644 index 000000000..56972b2a0 --- /dev/null +++ b/app/views/admin/imports/index.html.erb @@ -0,0 +1,37 @@ +<% page_title "Imports" %> + +<%= turbo_stream_from "admin_imports" %> + +
    +
    +

    Spreadsheet imports

    +

    Upload CSV or XLSX files. Processing runs on Solid Queue with live progress.

    +
    + +
    +

    Start import

    +

    Expected columns: full_name, email, optional password, avatar_url, role.

    + + <%= form_with model: @import, url: admin_imports_path, class: "mt-4 space-y-4" do |form| %> + <% if @import.errors.any? %> +
    + <%= @import.errors.full_messages.to_sentence %> +
    + <% end %> + <%= form.file_field :spreadsheet, required: true, accept: ".csv,.xlsx,text/csv,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", + class: "block w-full text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-slate-900 file:px-3 file:py-2 file:text-sm file:font-medium file:text-white" %> + <%= form.submit "Upload & process", class: "cursor-pointer rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> + <% end %> +
    + +
    +

    Import history

    + <% if @imports.any? %> + <% @imports.each do |import| %> + <%= render "admin/imports/import", import: import %> + <% end %> + <% else %> +

    No imports yet.

    + <% end %> +
    +
    diff --git a/app/views/admin/imports/show.html.erb b/app/views/admin/imports/show.html.erb new file mode 100644 index 000000000..48ccb96d4 --- /dev/null +++ b/app/views/admin/imports/show.html.erb @@ -0,0 +1,9 @@ +<% page_title "Import ##{@import.id}" %> + +<%= turbo_stream_from "admin_imports" %> + +
    +

    Import #<%= @import.id %>

    + <%= render "admin/imports/import", import: @import %> + <%= link_to "Back to imports", admin_imports_path, class: "inline-flex rounded-xl border border-slate-300 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50" %> +
    diff --git a/app/views/admin/users/edit.html.erb b/app/views/admin/users/edit.html.erb new file mode 100644 index 000000000..40de2ba89 --- /dev/null +++ b/app/views/admin/users/edit.html.erb @@ -0,0 +1,16 @@ +<% page_title "Edit user" %> + +
    +
    +

    Edit user

    +
    + <%= render "shared/user_form", + user: @user, + url: admin_user_path(@user), + method: :patch, + submit_label: "Save user", + cancel_path: admin_user_path(@user), + show_role: true %> +
    +
    +
    diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb new file mode 100644 index 000000000..24b0b8dca --- /dev/null +++ b/app/views/admin/users/index.html.erb @@ -0,0 +1,48 @@ +<% page_title "Users" %> + +
    +
    +
    +

    Users

    +

    Create, edit, delete, and promote or demote users.

    +
    + <%= link_to "New user", new_admin_user_path, class: "rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> +
    + +
    + + + + + + + + + + + <% @users.each do |user| %> + + + + + + + <% end %> + +
    UserRoleEmailActions
    +
    + <%= avatar_tag user, size: 36 %> + <%= link_to user.full_name, admin_user_path(user), class: "font-medium text-slate-900 hover:text-teal-800" %> +
    +     		+ <%= role_switch_for(user) %> + <%= user.email_address %> +
    + <%= link_to "Edit", edit_admin_user_path(user), class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-slate-700 hover:bg-slate-100" %> + <%= button_to "Delete", admin_user_path(user), method: :delete, + form: { data: { turbo_confirm: "Delete #{user.full_name}?" } }, + class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-50" %> +
    +
    +
    +
    diff --git a/app/views/admin/users/new.html.erb b/app/views/admin/users/new.html.erb new file mode 100644 index 000000000..76e77958c --- /dev/null +++ b/app/views/admin/users/new.html.erb @@ -0,0 +1,16 @@ +<% page_title "New user" %> + +
    +
    +

    New user

    +
    + <%= render "shared/user_form", + user: @user, + url: admin_users_path, + method: :post, + submit_label: "Create user", + cancel_path: admin_users_path, + show_role: true %> +
    +
    +
    diff --git a/app/views/admin/users/show.html.erb b/app/views/admin/users/show.html.erb new file mode 100644 index 000000000..05332e81b --- /dev/null +++ b/app/views/admin/users/show.html.erb @@ -0,0 +1,30 @@ +<% page_title @user.full_name %> + +
    +
    +
    + <%= avatar_tag @user, size: 64 %> +
    +

    <%= @user.full_name %>

    +

    <%= @user.email_address %>

    +
    +
    +
    + <%= link_to "Edit", edit_admin_user_path(@user), class: "rounded-xl bg-teal-700 px-4 py-2 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "Back", admin_users_path, class: "rounded-xl border border-slate-300 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50" %> +
    +
    + +
    +
    +
    +
    Role
    +
    <%= @user.role %>
    +
    +
    +
    Created
    +
    <%= l @user.created_at, format: :long %>
    +
    +
    +
    +
    diff --git a/app/views/home/index.html.erb b/app/views/home/index.html.erb new file mode 100644 index 000000000..585e3fa35 --- /dev/null +++ b/app/views/home/index.html.erb @@ -0,0 +1,45 @@ +<% page_title "Welcome" %> + +
    +
    +

    Umanni Users

    +

    + Manage people with a modern Rails 8 console +

    +

    + Role-aware authentication, live admin metrics, and asynchronous spreadsheet imports — powered by Hotwire, Solid Cable, and Solid Queue. +

    +
    + <%= link_to "Create an account", new_registration_path, class: "rounded-xl bg-teal-700 px-5 py-3 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "Sign in", new_session_path, class: "rounded-xl border border-slate-300 bg-white px-5 py-3 text-sm font-semibold text-slate-800 hover:bg-slate-50" %> +
    +
    + +
    +
    +
    +
    +
    +

    Live dashboard foreshadow

    +

    Admin insights

    +
    +
    +
    +
    Users
    +
    24
    +
    +
    +
    Admins
    +
    3
    +
    +
    +
    Members
    +
    21
    +
    +
    +

    + Counters stream over Solid Cable. Imports run on Solid Queue. No Redis required. +

    +
    +
    +
    diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb new file mode 100644 index 000000000..def8d40bd --- /dev/null +++ b/app/views/layouts/application.html.erb @@ -0,0 +1,27 @@ + + + + <%= content_for?(:title) ? yield(:title) : "Umanni Users" %> + + + + + <%= csrf_meta_tags %> + <%= csp_meta_tag %> + <%= yield :head %> + + + + <%= stylesheet_link_tag :app, "data-turbo-track": "reload" %> + <%= javascript_importmap_tags %> + + + + <%= render "shared/navbar" %> + +
    + <%= render "shared/flash" %> + <%= yield %> +
    + + diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb new file mode 100644 index 000000000..3aac9002e --- /dev/null +++ b/app/views/layouts/mailer.html.erb @@ -0,0 +1,13 @@ + + + + + + + + + <%= yield %> + + diff --git a/app/views/layouts/mailer.text.erb b/app/views/layouts/mailer.text.erb new file mode 100644 index 000000000..37f0bddbd --- /dev/null +++ b/app/views/layouts/mailer.text.erb @@ -0,0 +1 @@ +<%= yield %> diff --git a/app/views/passwords/edit.html.erb b/app/views/passwords/edit.html.erb new file mode 100644 index 000000000..65798f808 --- /dev/null +++ b/app/views/passwords/edit.html.erb @@ -0,0 +1,21 @@ +
    + <% if alert = flash[:alert] %> +

    <%= alert %>

    + <% end %> + +

    Update your password

    + + <%= form_with url: password_path(params[:token]), method: :put, class: "contents" do |form| %> +
    + <%= form.password_field :password, required: true, autocomplete: "new-password", placeholder: "Enter new password", maxlength: 72, class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
    + +
    + <%= form.password_field :password_confirmation, required: true, autocomplete: "new-password", placeholder: "Repeat new password", maxlength: 72, class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
    + +
    + <%= form.submit "Save", class: "w-full sm:w-auto text-center rounded-md px-3.5 py-2.5 bg-blue-600 hover:bg-blue-500 text-white inline-block font-medium cursor-pointer" %> +
    + <% end %> +
    diff --git a/app/views/passwords/new.html.erb b/app/views/passwords/new.html.erb new file mode 100644 index 000000000..8360e02f3 --- /dev/null +++ b/app/views/passwords/new.html.erb @@ -0,0 +1,17 @@ +
    + <% if alert = flash[:alert] %> +

    <%= alert %>

    + <% end %> + +

    Forgot your password?

    + + <%= form_with url: passwords_path, class: "contents" do |form| %> +
    + <%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address], class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
    + +
    + <%= form.submit "Email reset instructions", class: "w-full sm:w-auto text-center rounded-lg px-3.5 py-2.5 bg-blue-600 hover:bg-blue-500 text-white inline-block font-medium cursor-pointer" %> +
    + <% end %> +
    diff --git a/app/views/passwords_mailer/reset.html.erb b/app/views/passwords_mailer/reset.html.erb new file mode 100644 index 000000000..1b0915419 --- /dev/null +++ b/app/views/passwords_mailer/reset.html.erb @@ -0,0 +1,6 @@ +

    + You can reset your password on + <%= link_to "this password reset page", edit_password_url(@user.password_reset_token) %>. + + This link will expire in <%= distance_of_time_in_words(0, @user.password_reset_token_expires_in) %>. +

    diff --git a/app/views/passwords_mailer/reset.text.erb b/app/views/passwords_mailer/reset.text.erb new file mode 100644 index 000000000..aecee82c4 --- /dev/null +++ b/app/views/passwords_mailer/reset.text.erb @@ -0,0 +1,4 @@ +You can reset your password on +<%= edit_password_url(@user.password_reset_token) %> + +This link will expire in <%= distance_of_time_in_words(0, @user.password_reset_token_expires_in) %>. diff --git a/app/views/profiles/edit.html.erb b/app/views/profiles/edit.html.erb new file mode 100644 index 000000000..30956b4a9 --- /dev/null +++ b/app/views/profiles/edit.html.erb @@ -0,0 +1,24 @@ +<% page_title "Edit profile" %> + +
    +
    +

    Edit profile

    +

    You can update your info or delete your account.

    +
    + <%= render "shared/user_form", + user: @user, + url: profile_path, + method: :patch, + submit_label: "Save changes", + cancel_path: profile_path %> +
    +
    + +
    +

    Danger zone

    +

    Deleting your profile is permanent.

    + <%= button_to "Delete my profile", profile_path, method: :delete, + form: { data: { turbo_confirm: "Delete your account permanently?" } }, + class: "mt-4 rounded-xl bg-rose-700 px-4 py-2 text-sm font-semibold text-white hover:bg-rose-800" %> +
    +
    diff --git a/app/views/profiles/show.html.erb b/app/views/profiles/show.html.erb new file mode 100644 index 000000000..b7960df5c --- /dev/null +++ b/app/views/profiles/show.html.erb @@ -0,0 +1,39 @@ +<% page_title "My profile" %> + +
    +
    +
    + <%= avatar_tag @user, size: 72 %> +
    +

    <%= @user.full_name %>

    +

    <%= @user.email_address %>

    + <%= @user.role %> +
    +
    +
    + <%= link_to "Edit profile", edit_profile_path, class: "rounded-xl bg-teal-700 px-4 py-2 text-sm font-semibold text-white hover:bg-teal-800" %> +
    +
    + +
    +

    Account details

    +
    +
    +
    Full name
    +
    <%= @user.full_name %>
    +
    +
    +
    Email
    +
    <%= @user.email_address %>
    +
    +
    +
    Role
    +
    <%= @user.role %>
    +
    +
    +
    Member since
    +
    <%= l @user.created_at.to_date, format: :long %>
    +
    +
    +
    +
    diff --git a/app/views/pwa/manifest.json.erb b/app/views/pwa/manifest.json.erb new file mode 100644 index 000000000..f236381b8 --- /dev/null +++ b/app/views/pwa/manifest.json.erb @@ -0,0 +1,22 @@ +{ + "name": "UmanniUsers", + "icons": [ + { + "src": "/icon.png", + "type": "image/png", + "sizes": "512x512" + }, + { + "src": "/icon.png", + "type": "image/png", + "sizes": "512x512", + "purpose": "maskable" + } + ], + "start_url": "/", + "display": "standalone", + "scope": "/", + "description": "UmanniUsers.", + "theme_color": "red", + "background_color": "red" +} diff --git a/app/views/pwa/service-worker.js b/app/views/pwa/service-worker.js new file mode 100644 index 000000000..b3a13fb7b --- /dev/null +++ b/app/views/pwa/service-worker.js @@ -0,0 +1,26 @@ +// Add a service worker for processing Web Push notifications: +// +// self.addEventListener("push", async (event) => { +// const { title, options } = await event.data.json() +// event.waitUntil(self.registration.showNotification(title, options)) +// }) +// +// self.addEventListener("notificationclick", function(event) { +// event.notification.close() +// event.waitUntil( +// clients.matchAll({ type: "window" }).then((clientList) => { +// for (let i = 0; i < clientList.length; i++) { +// let client = clientList[i] +// let clientPath = (new URL(client.url)).pathname +// +// if (clientPath == event.notification.data.path && "focus" in client) { +// return client.focus() +// } +// } +// +// if (clients.openWindow) { +// return clients.openWindow(event.notification.data.path) +// } +// }) +// ) +// }) diff --git a/app/views/registrations/new.html.erb b/app/views/registrations/new.html.erb new file mode 100644 index 000000000..65fc8e239 --- /dev/null +++ b/app/views/registrations/new.html.erb @@ -0,0 +1,16 @@ +<% page_title "Register" %> + +
    +
    +

    Create your account

    +

    Visitors register as normal members.

    +
    + <%= render "shared/user_form", + user: @user, + url: registration_path, + method: :post, + submit_label: "Register", + cancel_path: root_path %> +
    +
    +
    diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb new file mode 100644 index 000000000..ee9c5d420 --- /dev/null +++ b/app/views/sessions/new.html.erb @@ -0,0 +1,28 @@ +<% page_title "Sign in" %> + +
    +
    +

    Sign in

    +

    Admins land on the dashboard. Members land on their profile.

    + + <%= form_with url: session_path, class: "mt-6 space-y-4" do |form| %> +
    + <%= form.label :email_address, "Email", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", + class: "w-full rounded-xl border border-slate-300 px-3 py-2.5 outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
    +
    + <%= form.label :password, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password, required: true, autocomplete: "current-password", + class: "w-full rounded-xl border border-slate-300 px-3 py-2.5 outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
    + <%= form.submit "Sign in", class: "w-full cursor-pointer rounded-xl bg-slate-900 px-4 py-2.5 text-sm font-semibold text-white hover:bg-slate-800" %> + <% end %> + +

    + <%= link_to "Forgot password?", new_password_path, class: "text-teal-800 hover:underline" %> + · + <%= link_to "Create account", new_registration_path, class: "text-teal-800 hover:underline" %> +

    +
    +
    diff --git a/app/views/shared/_error_messages.html.erb b/app/views/shared/_error_messages.html.erb new file mode 100644 index 000000000..902226e51 --- /dev/null +++ b/app/views/shared/_error_messages.html.erb @@ -0,0 +1,10 @@ +<% if user.errors.any? %> + +<% end %> diff --git a/app/views/shared/_flash.html.erb b/app/views/shared/_flash.html.erb new file mode 100644 index 000000000..a70c53e32 --- /dev/null +++ b/app/views/shared/_flash.html.erb @@ -0,0 +1,9 @@ +<% if flash.any? %> +
    + <% flash.each do |type, message| %> +
    + <%= message %> +
    + <% end %> +
    +<% end %> diff --git a/app/views/shared/_navbar.html.erb b/app/views/shared/_navbar.html.erb new file mode 100644 index 000000000..6eed7d6e4 --- /dev/null +++ b/app/views/shared/_navbar.html.erb @@ -0,0 +1,26 @@ +
    +
    + <%= link_to root_path, class: "group flex items-center gap-3" do %> + UU + + Umanni Users + People operations console + + <% end %> + + +
    +
    diff --git a/app/views/shared/_user_form.html.erb b/app/views/shared/_user_form.html.erb new file mode 100644 index 000000000..b19134b45 --- /dev/null +++ b/app/views/shared/_user_form.html.erb @@ -0,0 +1,80 @@ +<%= form_with model: user, url: url, method: method, class: "space-y-5", data: { controller: "form-validation", action: "input->form-validation#validate submit->form-validation#validate" } do |form| %> + <%= render "shared/error_messages", user: user %> + +
    +
    + <%= form.label :full_name, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.text_field :full_name, + required: true, + minlength: 2, + maxlength: 120, + autocomplete: "name", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "presence length" } %> + +
    + +
    + <%= form.label :email_address, "Email", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.email_field :email_address, + required: true, + autocomplete: "email", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "email" } %> + +
    + + <% if local_assigns[:show_role] %> +
    + <%= form.label :role, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.select :role, + User.roles.keys.map { |role| [role.titleize, role] }, + {}, + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
    + <% end %> + +
    + <%= form.label :password, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password, + required: user.new_record?, + minlength: 8, + autocomplete: user.new_record? ? "new-password" : "new-password", + placeholder: user.persisted? ? "Leave blank to keep current password" : nil, + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: user.new_record? ? "password" : "optional_password" } %> + +
    + +
    + <%= form.label :password_confirmation, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password_confirmation, + minlength: 8, + autocomplete: "new-password", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
    + +
    + <%= form.label :avatar_image, "Avatar upload", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.file_field :avatar_image, + accept: "image/png,image/jpeg,image/webp,image/gif", + class: "block w-full text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-slate-900 file:px-3 file:py-2 file:text-sm file:font-medium file:text-white hover:file:bg-slate-800" %> +
    + +
    + <%= form.label :avatar_url, "Avatar remote URL", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.url_field :avatar_url, + placeholder: "https://…", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "optional_url" } %> + +
    +
    + +
    + <%= form.submit submit_label, class: "cursor-pointer rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white shadow-sm hover:bg-teal-800" %> + <% if local_assigns[:cancel_path] %> + <%= link_to "Cancel", cancel_path, class: "rounded-xl px-4 py-2.5 text-sm font-medium text-slate-600 hover:bg-slate-100" %> + <% end %> +
    +<% end %> diff --git a/bin/brakeman b/bin/brakeman new file mode 100755 index 000000000..ace1c9ba0 --- /dev/null +++ b/bin/brakeman @@ -0,0 +1,7 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +ARGV.unshift("--ensure-latest") + +load Gem.bin_path("brakeman", "brakeman") diff --git a/bin/bundler-audit b/bin/bundler-audit new file mode 100755 index 000000000..e2ef22690 --- /dev/null +++ b/bin/bundler-audit @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "bundler/audit/cli" + +ARGV.concat %w[ --config config/bundler-audit.yml ] if ARGV.empty? || ARGV.include?("check") +Bundler::Audit::CLI.start diff --git a/bin/ci b/bin/ci new file mode 100755 index 000000000..4137ad5bb --- /dev/null +++ b/bin/ci @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "active_support/continuous_integration" + +CI = ActiveSupport::ContinuousIntegration +require_relative "../config/ci.rb" diff --git a/bin/dev b/bin/dev new file mode 100755 index 000000000..ad72c7d53 --- /dev/null +++ b/bin/dev @@ -0,0 +1,16 @@ +#!/usr/bin/env sh + +if ! gem list foreman -i --silent; then + echo "Installing foreman..." + gem install foreman +fi + +# Default to port 3000 if not specified +export PORT="${PORT:-3000}" + +# Let the debug gem allow remote connections, +# but avoid loading until `debugger` is called +export RUBY_DEBUG_OPEN="true" +export RUBY_DEBUG_LAZY="true" + +exec foreman start -f Procfile.dev "$@" diff --git a/bin/docker-entrypoint b/bin/docker-entrypoint new file mode 100755 index 000000000..ed31659f4 --- /dev/null +++ b/bin/docker-entrypoint @@ -0,0 +1,8 @@ +#!/bin/bash -e + +# If running the rails server then create or migrate existing database +if [ "${@: -2:1}" == "./bin/rails" ] && [ "${@: -1:1}" == "server" ]; then + ./bin/rails db:prepare +fi + +exec "${@}" diff --git a/bin/importmap b/bin/importmap new file mode 100755 index 000000000..36502ab16 --- /dev/null +++ b/bin/importmap @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby + +require_relative "../config/application" +require "importmap/commands" diff --git a/bin/jobs b/bin/jobs new file mode 100755 index 000000000..dcf59f309 --- /dev/null +++ b/bin/jobs @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby + +require_relative "../config/environment" +require "solid_queue/cli" + +SolidQueue::Cli.start(ARGV) diff --git a/bin/kamal b/bin/kamal new file mode 100755 index 000000000..d9ba27670 --- /dev/null +++ b/bin/kamal @@ -0,0 +1,16 @@ +#!/usr/bin/env ruby +# frozen_string_literal: true + +# +# This file was generated by Bundler. +# +# The application 'kamal' is installed as part of a gem, and +# this file is here to facilitate running it. +# + +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("kamal", "kamal") diff --git a/bin/rails b/bin/rails new file mode 100755 index 000000000..efc037749 --- /dev/null +++ b/bin/rails @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby +APP_PATH = File.expand_path("../config/application", __dir__) +require_relative "../config/boot" +require "rails/commands" diff --git a/bin/rake b/bin/rake new file mode 100755 index 000000000..4fbf10b96 --- /dev/null +++ b/bin/rake @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "rake" +Rake.application.run diff --git a/bin/rubocop b/bin/rubocop new file mode 100755 index 000000000..5a2050471 --- /dev/null +++ b/bin/rubocop @@ -0,0 +1,8 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +# Explicit RuboCop config increases performance slightly while avoiding config confusion. +ARGV.unshift("--config", File.expand_path("../.rubocop.yml", __dir__)) + +load Gem.bin_path("rubocop", "rubocop") diff --git a/bin/setup b/bin/setup new file mode 100755 index 000000000..81be011e8 --- /dev/null +++ b/bin/setup @@ -0,0 +1,35 @@ +#!/usr/bin/env ruby +require "fileutils" + +APP_ROOT = File.expand_path("..", __dir__) + +def system!(*args) + system(*args, exception: true) +end + +FileUtils.chdir APP_ROOT do + # This script is a way to set up or update your development environment automatically. + # This script is idempotent, so that you can run it at any time and get an expectable outcome. + # Add necessary setup steps to this file. + + puts "== Installing dependencies ==" + system("bundle check") || system!("bundle install") + + # puts "\n== Copying sample files ==" + # unless File.exist?("config/database.yml") + # FileUtils.cp "config/database.yml.sample", "config/database.yml" + # end + + puts "\n== Preparing database ==" + system! "bin/rails db:prepare" + system! "bin/rails db:reset" if ARGV.include?("--reset") + + puts "\n== Removing old logs and tempfiles ==" + system! "bin/rails log:clear tmp:clear" + + unless ARGV.include?("--skip-server") + puts "\n== Starting development server ==" + STDOUT.flush # flush the output before exec(2) so that it displays + exec "bin/dev" + end +end diff --git a/bin/thrust b/bin/thrust new file mode 100755 index 000000000..36bde2d83 --- /dev/null +++ b/bin/thrust @@ -0,0 +1,5 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("thruster", "thrust") diff --git a/config.ru b/config.ru new file mode 100644 index 000000000..4a3c09a68 --- /dev/null +++ b/config.ru @@ -0,0 +1,6 @@ +# This file is used by Rack-based servers to start the application. + +require_relative "config/environment" + +run Rails.application +Rails.application.load_server diff --git a/config/application.rb b/config/application.rb new file mode 100644 index 000000000..41294b7cd --- /dev/null +++ b/config/application.rb @@ -0,0 +1,42 @@ +require_relative "boot" + +require "rails" +# Pick the frameworks you want: +require "active_model/railtie" +require "active_job/railtie" +require "active_record/railtie" +require "active_storage/engine" +require "action_controller/railtie" +require "action_mailer/railtie" +# require "action_mailbox/engine" +# require "action_text/engine" +require "action_view/railtie" +require "action_cable/engine" +require "rails/test_unit/railtie" + +# Require the gems listed in Gemfile, including any gems +# you've limited to :test, :development, or :production. +Bundler.require(*Rails.groups) + +module UmanniUsers + class Application < Rails::Application + # Initialize configuration defaults for originally generated Rails version. + config.load_defaults 8.1 + + # Please, add to the `ignore` list any other `lib` subdirectories that do + # not contain `.rb` files, or that should not be reloaded or eager loaded. + # Common ones are `templates`, `generators`, or `middleware`, for example. + config.autoload_lib(ignore: %w[assets tasks]) + + # Configuration for the application, engines, and railties goes here. + # + # These settings can be overridden in specific environments using the files + # in config/environments, which are processed later. + # + # config.time_zone = "Central Time (US & Canada)" + # config.eager_load_paths << Rails.root.join("extras") + + # Don't generate system test files. + # config.generators.system_tests = nil + end +end diff --git a/config/boot.rb b/config/boot.rb new file mode 100644 index 000000000..988a5ddc4 --- /dev/null +++ b/config/boot.rb @@ -0,0 +1,4 @@ +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +require "bundler/setup" # Set up gems listed in the Gemfile. +require "bootsnap/setup" # Speed up boot time by caching expensive operations. diff --git a/config/bundler-audit.yml b/config/bundler-audit.yml new file mode 100644 index 000000000..e74b3af94 --- /dev/null +++ b/config/bundler-audit.yml @@ -0,0 +1,5 @@ +# Audit all gems listed in the Gemfile for known security problems by running bin/bundler-audit. +# CVEs that are not relevant to the application can be enumerated on the ignore list below. + +ignore: + - CVE-THAT-DOES-NOT-APPLY diff --git a/config/cable.yml b/config/cable.yml new file mode 100644 index 000000000..0eefdf8e9 --- /dev/null +++ b/config/cable.yml @@ -0,0 +1,20 @@ +# Async adapter only works within the same process. +# Development mirrors production with Solid Cable (SQLite-backed, no Redis). +development: + adapter: solid_cable + connects_to: + database: + writing: cable + polling_interval: 0.1.seconds + message_retention: 1.day + +test: + adapter: test + +production: + adapter: solid_cable + connects_to: + database: + writing: cable + polling_interval: 0.1.seconds + message_retention: 1.day diff --git a/config/cache.yml b/config/cache.yml new file mode 100644 index 000000000..19d490843 --- /dev/null +++ b/config/cache.yml @@ -0,0 +1,16 @@ +default: &default + store_options: + # Cap age of oldest cache entry to fulfill retention policies + # max_age: <%= 60.days.to_i %> + max_size: <%= 256.megabytes %> + namespace: <%= Rails.env %> + +development: + <<: *default + +test: + <<: *default + +production: + database: cache + <<: *default diff --git a/config/ci.rb b/config/ci.rb new file mode 100644 index 000000000..239b34398 --- /dev/null +++ b/config/ci.rb @@ -0,0 +1,20 @@ +# Run using bin/ci + +CI.run do + step "Setup", "bin/setup --skip-server" + + step "Style: Ruby", "bin/rubocop" + + step "Security: Gem audit", "bin/bundler-audit" + step "Security: Importmap vulnerability audit", "bin/importmap audit" + step "Security: Brakeman code analysis", "bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error" + + + # Optional: set a green GitHub commit status to unblock PR merge. + # Requires the `gh` CLI and `gh extension install basecamp/gh-signoff`. + # if success? + # step "Signoff: All systems go. Ready for merge and deploy.", "gh signoff" + # else + # failure "Signoff: CI failed. Do not merge or deploy.", "Fix the issues and try again." + # end +end diff --git a/config/credentials.yml.enc b/config/credentials.yml.enc new file mode 100644 index 000000000..04cde23f2 --- /dev/null +++ b/config/credentials.yml.enc @@ -0,0 +1 @@ +9zOR7ZZkCtW3+d+sERljsXihpW5Xmw0EZUnLNHpaekDLFcsYiC38MIjI/zAuoyGjtmdGZnhLFe2cy15f+nQ0sws0wT4ZWoeJXnBix4YzA1P7GzGx8xfBCg97EGAmye8eup/y90lD2OOjyAfZRMT8pp6xZx9oe0BszH2N+qtRS7LA2tJWyeuhobYNJhr9q+jH82wnM8pBxQ0OnodM6+CdPdn64iVCqdMvdRyAdilBbp38+DsQm+tQ5WXiAQE4Bx4+v1eUK5+F+NhCK8gCvwY4wqRMCuG3ovoQp05AJzQHUURxWyTs22AiR7xskhGT/kM71L9Q9rqtdQyRj1/JEoPMRoLR7xqzYlLpd5/M0NfnEwPYBQvxY8WrWuMFzNApcQ/wXqbKnCkzajX63oLtU6sxF06sR9HOnVnT1REJNCdmg+dV9Jj+A1VSoiR9bu72TfVW2eCQcT/FwVldFDtVtYKLCPmkgd1Zbtyqvk5oaVpb0im7D+DTQrkUazxq--cNA2q9cDw5mY3lJZ--yW1m+++IzLyEoVEoSu3bqg== \ No newline at end of file diff --git a/config/database.yml b/config/database.yml new file mode 100644 index 000000000..cc76f3177 --- /dev/null +++ b/config/database.yml @@ -0,0 +1,51 @@ +# SQLite. Versions 3.8.0 and up are supported. +# +# Production-ready WAL mode is enabled via SQLite pragmas for durable concurrent reads. +default: &default + adapter: sqlite3 + max_connections: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> + timeout: 5000 + pragmas: + journal_mode: WAL + synchronous: NORMAL + foreign_keys: true + busy_timeout: 5000 + +development: + primary: + <<: *default + database: storage/development.sqlite3 + queue: + <<: *default + database: storage/development_queue.sqlite3 + migrations_paths: db/queue_migrate + cable: + <<: *default + database: storage/development_cable.sqlite3 + migrations_paths: db/cable_migrate + +# Warning: The database defined as "test" will be erased and +# re-generated from your development database when you run "rake". +# Do not set this db to the same as development or production. +test: + <<: *default + database: storage/test.sqlite3 + +# Store production database in the storage/ directory, which by default +# is mounted as a persistent Docker volume in config/deploy.yml. +production: + primary: + <<: *default + database: storage/production.sqlite3 + cache: + <<: *default + database: storage/production_cache.sqlite3 + migrations_paths: db/cache_migrate + queue: + <<: *default + database: storage/production_queue.sqlite3 + migrations_paths: db/queue_migrate + cable: + <<: *default + database: storage/production_cable.sqlite3 + migrations_paths: db/cable_migrate diff --git a/config/deploy.yml b/config/deploy.yml new file mode 100644 index 000000000..8b8d31c2a --- /dev/null +++ b/config/deploy.yml @@ -0,0 +1,60 @@ +# Name of your application. Used to uniquely configure containers. +service: umanni_users + +# Name of the container image (use your-user/app-name on external registries). +image: umanni_users + +# Deploy to these servers. +servers: + web: + - 192.168.0.1 + job: + hosts: + - 192.168.0.1 + cmd: bin/jobs + +# Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server. +# production.rb enables assume_ssl + force_ssl (with /up excluded) for this proxy setup. +# +# Uncomment and set your hostname before the first deploy: +# proxy: +# ssl: true +# host: users.example.com +# app_port: 80 + +# Where you keep your container images. +registry: + server: localhost:5555 + # username: your-user + # password: + # - KAMAL_REGISTRY_PASSWORD + +# Inject ENV variables into containers (secrets come from .kamal/secrets). +env: + secret: + - RAILS_MASTER_KEY + clear: + # Prefer dedicated job containers above. Keep true for single-box demos. + SOLID_QUEUE_IN_PUMA: false + # Optional Ruby 4 ZJIT (MRI experimental) — enable on compatible hosts. + # RUBYOPT: "--zjit" + +# Aliases are triggered with "bin/kamal ". +aliases: + console: app exec --interactive --reuse "bin/rails console" + shell: app exec --interactive --reuse "bash" + logs: app logs -f + dbc: app exec --interactive --reuse "bin/rails dbconsole --include-password" + +# Persistent SQLite + Active Storage volume. +volumes: + - "umanni_users_storage:/rails/storage" + +# Bridge fingerprinted assets between versions. +asset_path: /rails/public/assets + +# Configure the image builder (Thruster is the default CMD in Dockerfile). +builder: + arch: amd64 + +# accessories: none required — Solid Cable/Queue/Cache replace Redis. diff --git a/config/environment.rb b/config/environment.rb new file mode 100644 index 000000000..cac531577 --- /dev/null +++ b/config/environment.rb @@ -0,0 +1,5 @@ +# Load the Rails application. +require_relative "application" + +# Initialize the Rails application. +Rails.application.initialize! diff --git a/config/environments/development.rb b/config/environments/development.rb new file mode 100644 index 000000000..27fe9ba04 --- /dev/null +++ b/config/environments/development.rb @@ -0,0 +1,83 @@ +require "active_support/core_ext/integer/time" + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # Make code changes take effect immediately without server restart. + config.enable_reloading = true + + # Do not eager load code on boot. + config.eager_load = false + + # Show full error reports. + config.consider_all_requests_local = true + + # Enable server timing. + config.server_timing = true + + # Enable/disable Action Controller caching. By default Action Controller caching is disabled. + # Run rails dev:cache to toggle Action Controller caching. + if Rails.root.join("tmp/caching-dev.txt").exist? + config.action_controller.perform_caching = true + config.action_controller.enable_fragment_cache_logging = true + config.public_file_server.headers = { "cache-control" => "public, max-age=#{2.days.to_i}" } + else + config.action_controller.perform_caching = false + end + + # Change to :null_store to avoid any caching. + config.cache_store = :memory_store + + # Store uploaded files on the local file system (see config/storage.yml for options). + config.active_storage.service = :local + + # Don't care if the mailer can't send. + config.action_mailer.raise_delivery_errors = false + + # Make template changes take effect immediately. + config.action_mailer.perform_caching = false + + # Set localhost to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "localhost", port: 3000 } + + # Print deprecation notices to the Rails logger. + config.active_support.deprecation = :log + + # Raise an error on page load if there are pending migrations. + config.active_record.migration_error = :page_load + + # Highlight code that triggered database queries in logs. + config.active_record.verbose_query_logs = true + + # Append comments with runtime information tags to SQL queries in logs. + config.active_record.query_log_tags_enabled = true + + # Highlight code that enqueued background job in logs. + config.active_job.verbose_enqueue_logs = true + + # Use Solid Queue locally so spreadsheet imports mirror production (no Redis). + config.active_job.queue_adapter = :solid_queue + config.solid_queue.connects_to = { database: { writing: :queue } } + config.solid_queue.logger = ActiveSupport::Logger.new($stdout) + + # Highlight code that triggered redirect in logs. + config.action_dispatch.verbose_redirect_logs = true + + # Suppress logger output for asset requests. + config.assets.quiet = true + + # Raises error for missing translations. + # config.i18n.raise_on_missing_translations = true + + # Annotate rendered view with file names. + config.action_view.annotate_rendered_view_with_filenames = true + + # Uncomment if you wish to allow Action Cable access from any origin. + # config.action_cable.disable_request_forgery_protection = true + + # Raise error when a before_action's only/except options reference missing actions. + config.action_controller.raise_on_missing_callback_actions = true + + # Apply autocorrection by RuboCop to files generated by `bin/rails generate`. + # config.generators.apply_rubocop_autocorrect_after_generate! +end diff --git a/config/environments/production.rb b/config/environments/production.rb new file mode 100644 index 000000000..77392b165 --- /dev/null +++ b/config/environments/production.rb @@ -0,0 +1,89 @@ +require "active_support/core_ext/integer/time" + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # Code is not reloaded between requests. + config.enable_reloading = false + + # Eager load code on boot for better performance and memory savings (ignored by Rake tasks). + config.eager_load = true + + # Full error reports are disabled. + config.consider_all_requests_local = false + + # Turn on fragment caching in view templates. + config.action_controller.perform_caching = true + + # Cache assets for far-future expiry since they are all digest stamped. + config.public_file_server.headers = { "cache-control" => "public, max-age=#{1.year.to_i}" } + + # Enable serving of images, stylesheets, and JavaScripts from an asset server. + # config.asset_host = "http://assets.example.com" + + # Store uploaded files on the local file system (see config/storage.yml for options). + config.active_storage.service = :local + + # Kamal/Thruster terminate TLS in front of the app. Disable for local HTTP docker runs: + # docker run ... -e RAILS_FORCE_SSL=false -e RAILS_ASSUME_SSL=false + config.assume_ssl = ActiveModel::Type::Boolean.new.cast(ENV.fetch("RAILS_ASSUME_SSL", "true")) + config.force_ssl = ActiveModel::Type::Boolean.new.cast(ENV.fetch("RAILS_FORCE_SSL", "true")) + + # Skip http-to-https redirect for the default health check endpoint. + config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } + + # Log to STDOUT with the current request id as a default log tag. + config.log_tags = [ :request_id ] + config.logger = ActiveSupport::TaggedLogging.logger(STDOUT) + + # Change to "debug" to log everything (including potentially personally-identifiable information!). + config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info") + + # Prevent health checks from clogging up the logs. + config.silence_healthcheck_path = "/up" + + # Don't log any deprecations. + config.active_support.report_deprecations = false + + # Replace the default in-process memory cache store with a durable alternative. + config.cache_store = :solid_cache_store + + # Replace the default in-process and non-durable queuing backend for Active Job. + config.active_job.queue_adapter = :solid_queue + config.solid_queue.connects_to = { database: { writing: :queue } } + + # Ignore bad email addresses and do not raise email delivery errors. + # Set this to true and configure the email server for immediate delivery to raise delivery errors. + # config.action_mailer.raise_delivery_errors = false + + # Set host to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "example.com" } + + # Specify outgoing SMTP server. Remember to add smtp/* credentials via bin/rails credentials:edit. + # config.action_mailer.smtp_settings = { + # user_name: Rails.application.credentials.dig(:smtp, :user_name), + # password: Rails.application.credentials.dig(:smtp, :password), + # address: "smtp.example.com", + # port: 587, + # authentication: :plain + # } + + # Enable locale fallbacks for I18n (makes lookups for any locale fall back to + # the I18n.default_locale when a translation cannot be found). + config.i18n.fallbacks = true + + # Do not dump schema after migrations. + config.active_record.dump_schema_after_migration = false + + # Only use :id for inspections in production. + config.active_record.attributes_for_inspect = [ :id ] + + # Enable DNS rebinding protection and other `Host` header attacks. + # config.hosts = [ + # "example.com", # Allow requests from example.com + # /.*\.example\.com/ # Allow requests from subdomains like `www.example.com` + # ] + # + # Skip DNS rebinding protection for the default health check endpoint. + # config.host_authorization = { exclude: ->(request) { request.path == "/up" } } +end diff --git a/config/environments/test.rb b/config/environments/test.rb new file mode 100644 index 000000000..ae0219164 --- /dev/null +++ b/config/environments/test.rb @@ -0,0 +1,58 @@ +# The test environment is used exclusively to run your application's +# test suite. You never need to work with it otherwise. Remember that +# your test database is "scratch space" for the test suite and is wiped +# and recreated between test runs. Don't rely on the data there! + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # While tests run files are not watched, reloading is not necessary. + config.enable_reloading = false + + # Eager loading loads your entire application. When running a single test locally, + # this is usually not necessary, and can slow down your test suite. However, it's + # recommended that you enable it in continuous integration systems to ensure eager + # loading is working properly before deploying your code. + config.eager_load = ENV["CI"].present? + + # Configure public file server for tests with cache-control for performance. + config.public_file_server.headers = { "cache-control" => "public, max-age=3600" } + + # Show full error reports. + config.consider_all_requests_local = true + config.cache_store = :null_store + + # Render exception templates for rescuable exceptions and raise for other exceptions. + config.action_dispatch.show_exceptions = :rescuable + + # Disable request forgery protection in test environment. + config.action_controller.allow_forgery_protection = false + + # Store uploaded files on the local file system in a temporary directory. + config.active_storage.service = :test + + # Tell Action Mailer not to deliver emails to the real world. + # The :test delivery method accumulates sent emails in the + # ActionMailer::Base.deliveries array. + config.action_mailer.delivery_method = :test + + # Set host to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "example.com" } + + # Print deprecation notices to the stderr. + config.active_support.deprecation = :stderr + + # Raises error for missing translations. + # config.i18n.raise_on_missing_translations = true + + # Annotate rendered view with file names. + # config.action_view.annotate_rendered_view_with_filenames = true + + # Raise error when a before_action's only/except options reference missing actions. + config.action_controller.raise_on_missing_callback_actions = true + + config.active_job.queue_adapter = :test + + # Ensure YAML fixtures encrypt deterministic attributes the same way as runtime writes. + config.active_record.encryption.encrypt_fixtures = true +end diff --git a/config/importmap.rb b/config/importmap.rb new file mode 100644 index 000000000..909dfc542 --- /dev/null +++ b/config/importmap.rb @@ -0,0 +1,7 @@ +# Pin npm packages by running ./bin/importmap + +pin "application" +pin "@hotwired/turbo-rails", to: "turbo.min.js" +pin "@hotwired/stimulus", to: "stimulus.min.js" +pin "@hotwired/stimulus-loading", to: "stimulus-loading.js" +pin_all_from "app/javascript/controllers", under: "controllers" diff --git a/config/initializers/active_record_encryption.rb b/config/initializers/active_record_encryption.rb new file mode 100644 index 000000000..1c8f41445 --- /dev/null +++ b/config/initializers/active_record_encryption.rb @@ -0,0 +1,85 @@ +# Active Record Encryption for sensitive columns (e.g. email_address). +# +# Key lookup order: +# 1. credentials.active_record_encryption +# 2. ACTIVE_RECORD_ENCRYPTION_* environment variables +# 3. Keys derived from secret_key_base (so Docker only needs RAILS_MASTER_KEY) +# 4. Fixed local keys for development/test and SECRET_KEY_BASE_DUMMY asset builds + +module UmanniEncryptionKeys + module_function + + def apply!(config) + keys = if Rails.env.local? || dummy_secret_key_base? + local_keys.merge(from_env) + else + from_secret_key_base.merge(from_credentials).merge(from_env) + end + + if complete?(keys) + assign!(config, keys) + else + raise "Missing Active Record encryption keys for #{Rails.env}. " \ + "Pass RAILS_MASTER_KEY (or ACTIVE_RECORD_ENCRYPTION_*). See README." + end + + config.active_record.encryption.support_unencrypted_data = Rails.env.local? + end + + def dummy_secret_key_base? + ENV["SECRET_KEY_BASE_DUMMY"].present? + end + + def from_credentials + creds = Rails.application.credentials.active_record_encryption + return {} if creds.blank? + + { + primary_key: creds[:primary_key], + deterministic_key: creds[:deterministic_key], + key_derivation_salt: creds[:key_derivation_salt] + }.compact_blank + end + + def from_env + { + primary_key: ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"].presence, + deterministic_key: ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"].presence, + key_derivation_salt: ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"].presence + }.compact_blank + end + + def from_secret_key_base + secret = Rails.application.secret_key_base.to_s + return {} if secret.blank? || ENV["SECRET_KEY_BASE_DUMMY"].present? + + require "openssl" + { + primary_key: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-primary")[0, 32], + deterministic_key: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-deterministic")[0, 32], + key_derivation_salt: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-salt")[0, 32] + } + end + + def local_keys + { + primary_key: "umanniLocalPrimaryKey32chars!!", + deterministic_key: "umanniLocalDeterministicKey32!", + key_derivation_salt: "umanniLocalDerivationSalt32chr" + } + end + + def complete?(keys) + keys[:primary_key].present? && keys[:deterministic_key].present? && keys[:key_derivation_salt].present? + end + + def assign!(config, keys) + config.active_record.encryption.primary_key = keys[:primary_key] + config.active_record.encryption.deterministic_key = keys[:deterministic_key] + config.active_record.encryption.key_derivation_salt = keys[:key_derivation_salt] + end +end + +Rails.application.configure do + UmanniEncryptionKeys.apply!(config) +end diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb new file mode 100644 index 000000000..487324424 --- /dev/null +++ b/config/initializers/assets.rb @@ -0,0 +1,7 @@ +# Be sure to restart your server when you modify this file. + +# Version of your assets, change this if you want to expire all your assets. +Rails.application.config.assets.version = "1.0" + +# Add additional assets to the asset load path. +# Rails.application.config.assets.paths << Emoji.images_path diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb new file mode 100644 index 000000000..d51d71397 --- /dev/null +++ b/config/initializers/content_security_policy.rb @@ -0,0 +1,29 @@ +# Be sure to restart your server when you modify this file. + +# Define an application-wide content security policy. +# See the Securing Rails Applications Guide for more information: +# https://guides.rubyonrails.org/security.html#content-security-policy-header + +# Rails.application.configure do +# config.content_security_policy do |policy| +# policy.default_src :self, :https +# policy.font_src :self, :https, :data +# policy.img_src :self, :https, :data +# policy.object_src :none +# policy.script_src :self, :https +# policy.style_src :self, :https +# # Specify URI for violation reports +# # policy.report_uri "/csp-violation-report-endpoint" +# end +# +# # Generate session nonces for permitted importmap, inline scripts, and inline styles. +# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s } +# config.content_security_policy_nonce_directives = %w(script-src style-src) +# +# # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag` +# # if the corresponding directives are specified in `content_security_policy_nonce_directives`. +# # config.content_security_policy_nonce_auto = true +# +# # Report violations without enforcing the policy. +# # config.content_security_policy_report_only = true +# end diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb new file mode 100644 index 000000000..c0b717f7e --- /dev/null +++ b/config/initializers/filter_parameter_logging.rb @@ -0,0 +1,8 @@ +# Be sure to restart your server when you modify this file. + +# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file. +# Use this to limit dissemination of sensitive information. +# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors. +Rails.application.config.filter_parameters += [ + :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc +] diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb new file mode 100644 index 000000000..3860f659e --- /dev/null +++ b/config/initializers/inflections.rb @@ -0,0 +1,16 @@ +# Be sure to restart your server when you modify this file. + +# Add new inflection rules using the following format. Inflections +# are locale specific, and you may define rules for as many different +# locales as you wish. All of these examples are active by default: +# ActiveSupport::Inflector.inflections(:en) do |inflect| +# inflect.plural /^(ox)$/i, "\\1en" +# inflect.singular /^(ox)en/i, "\\1" +# inflect.irregular "person", "people" +# inflect.uncountable %w( fish sheep ) +# end + +# These inflection rules are supported but not enabled by default: +# ActiveSupport::Inflector.inflections(:en) do |inflect| +# inflect.acronym "RESTful" +# end diff --git a/config/locales/en.yml b/config/locales/en.yml new file mode 100644 index 000000000..6c349ae5e --- /dev/null +++ b/config/locales/en.yml @@ -0,0 +1,31 @@ +# Files in the config/locales directory are used for internationalization and +# are automatically loaded by Rails. If you want to use locales other than +# English, add the necessary files in this directory. +# +# To use the locales, use `I18n.t`: +# +# I18n.t "hello" +# +# In views, this is aliased to just `t`: +# +# <%= t("hello") %> +# +# To use a different locale, set it with `I18n.locale`: +# +# I18n.locale = :es +# +# This would use the information in config/locales/es.yml. +# +# To learn more about the API, please read the Rails Internationalization guide +# at https://guides.rubyonrails.org/i18n.html. +# +# Be aware that YAML interprets the following case-insensitive strings as +# booleans: `true`, `false`, `on`, `off`, `yes`, `no`. Therefore, these strings +# must be quoted to be interpreted as strings. For example: +# +# en: +# "yes": yup +# enabled: "ON" + +en: + hello: "Hello world" diff --git a/config/puma.rb b/config/puma.rb new file mode 100644 index 000000000..38c4b8659 --- /dev/null +++ b/config/puma.rb @@ -0,0 +1,42 @@ +# This configuration file will be evaluated by Puma. The top-level methods that +# are invoked here are part of Puma's configuration DSL. For more information +# about methods provided by the DSL, see https://puma.io/puma/Puma/DSL.html. +# +# Puma starts a configurable number of processes (workers) and each process +# serves each request in a thread from an internal thread pool. +# +# You can control the number of workers using ENV["WEB_CONCURRENCY"]. You +# should only set this value when you want to run 2 or more workers. The +# default is already 1. You can set it to `auto` to automatically start a worker +# for each available processor. +# +# The ideal number of threads per worker depends both on how much time the +# application spends waiting for IO operations and on how much you wish to +# prioritize throughput over latency. +# +# As a rule of thumb, increasing the number of threads will increase how much +# traffic a given process can handle (throughput), but due to CRuby's +# Global VM Lock (GVL) it has diminishing returns and will degrade the +# response time (latency) of the application. +# +# The default is set to 3 threads as it's deemed a decent compromise between +# throughput and latency for the average Rails application. +# +# Any libraries that use a connection pool or another resource pool should +# be configured to provide at least as many connections as the number of +# threads. This includes Active Record's `pool` parameter in `database.yml`. +threads_count = ENV.fetch("RAILS_MAX_THREADS", 3) +threads threads_count, threads_count + +# Specifies the `port` that Puma will listen on to receive requests; default is 3000. +port ENV.fetch("PORT", 3000) + +# Allow puma to be restarted by `bin/rails restart` command. +plugin :tmp_restart + +# Run the Solid Queue supervisor inside of Puma for single-server deployments. +plugin :solid_queue if ENV["SOLID_QUEUE_IN_PUMA"] + +# Specify the PID file. Defaults to tmp/pids/server.pid in development. +# In other environments, only set the PID file if requested. +pidfile ENV["PIDFILE"] if ENV["PIDFILE"] diff --git a/config/queue.yml b/config/queue.yml new file mode 100644 index 000000000..6b1436086 --- /dev/null +++ b/config/queue.yml @@ -0,0 +1,18 @@ +default: &default + dispatchers: + - polling_interval: 1 + batch_size: 500 + workers: + - queues: "*" + threads: 3 + processes: <%= ENV.fetch("JOB_CONCURRENCY", 1) %> + polling_interval: 1 + +development: + <<: *default + +test: + <<: *default + +production: + <<: *default diff --git a/config/recurring.yml b/config/recurring.yml new file mode 100644 index 000000000..b4207f9b0 --- /dev/null +++ b/config/recurring.yml @@ -0,0 +1,15 @@ +# examples: +# periodic_cleanup: +# class: CleanSoftDeletedRecordsJob +# queue: background +# args: [ 1000, { batch_size: 500 } ] +# schedule: every hour +# periodic_cleanup_with_command: +# command: "SoftDeletedRecord.due.delete_all" +# priority: 2 +# schedule: at 5am every day + +production: + clear_solid_queue_finished_jobs: + command: "SolidQueue::Job.clear_finished_in_batches(sleep_between_batches: 0.3)" + schedule: every hour at minute 12 diff --git a/config/routes.rb b/config/routes.rb new file mode 100644 index 000000000..a0542248e --- /dev/null +++ b/config/routes.rb @@ -0,0 +1,20 @@ +Rails.application.routes.draw do + resource :session, only: %i[new create destroy] + resources :passwords, param: :token + resource :registration, only: %i[new create] + resource :profile, only: %i[show edit update destroy] + + namespace :admin do + root to: "dashboard#show" + resources :users do + member do + patch :toggle_role + end + end + resources :imports, only: %i[index create show] + end + + get "up" => "rails/health#show", as: :rails_health_check + + root "home#index" +end diff --git a/config/storage.yml b/config/storage.yml new file mode 100644 index 000000000..927dc537c --- /dev/null +++ b/config/storage.yml @@ -0,0 +1,27 @@ +test: + service: Disk + root: <%= Rails.root.join("tmp/storage") %> + +local: + service: Disk + root: <%= Rails.root.join("storage") %> + +# Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key) +# amazon: +# service: S3 +# access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %> +# secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %> +# region: us-east-1 +# bucket: your_own_bucket-<%= Rails.env %> + +# Remember not to checkin your GCS keyfile to a repository +# google: +# service: GCS +# project: your_project +# credentials: <%= Rails.root.join("path/to/gcs.keyfile") %> +# bucket: your_own_bucket-<%= Rails.env %> + +# mirror: +# service: Mirror +# primary: local +# mirrors: [ amazon, google, microsoft ] diff --git a/db/cable_schema.rb b/db/cable_schema.rb new file mode 100644 index 000000000..23666604a --- /dev/null +++ b/db/cable_schema.rb @@ -0,0 +1,11 @@ +ActiveRecord::Schema[7.1].define(version: 1) do + create_table "solid_cable_messages", force: :cascade do |t| + t.binary "channel", limit: 1024, null: false + t.binary "payload", limit: 536870912, null: false + t.datetime "created_at", null: false + t.integer "channel_hash", limit: 8, null: false + t.index ["channel"], name: "index_solid_cable_messages_on_channel" + t.index ["channel_hash"], name: "index_solid_cable_messages_on_channel_hash" + t.index ["created_at"], name: "index_solid_cable_messages_on_created_at" + end +end diff --git a/db/cache_schema.rb b/db/cache_schema.rb new file mode 100644 index 000000000..81a410d18 --- /dev/null +++ b/db/cache_schema.rb @@ -0,0 +1,12 @@ +ActiveRecord::Schema[7.2].define(version: 1) do + create_table "solid_cache_entries", force: :cascade do |t| + t.binary "key", limit: 1024, null: false + t.binary "value", limit: 536870912, null: false + t.datetime "created_at", null: false + t.integer "key_hash", limit: 8, null: false + t.integer "byte_size", limit: 4, null: false + t.index ["byte_size"], name: "index_solid_cache_entries_on_byte_size" + t.index ["key_hash", "byte_size"], name: "index_solid_cache_entries_on_key_hash_and_byte_size" + t.index ["key_hash"], name: "index_solid_cache_entries_on_key_hash", unique: true + end +end diff --git a/db/migrate/20260903034025_create_users.rb b/db/migrate/20260903034025_create_users.rb new file mode 100644 index 000000000..5b4ea9165 --- /dev/null +++ b/db/migrate/20260903034025_create_users.rb @@ -0,0 +1,15 @@ +class CreateUsers < ActiveRecord::Migration[8.1] + def change + create_table :users do |t| + t.string :email_address, null: false + t.string :password_digest, null: false + t.string :full_name, null: false + t.integer :role, null: false, default: 0 + t.string :avatar_url + + t.timestamps + end + add_index :users, :email_address, unique: true + add_index :users, :role + end +end diff --git a/db/migrate/20260903034026_create_sessions.rb b/db/migrate/20260903034026_create_sessions.rb new file mode 100644 index 000000000..216185e4a --- /dev/null +++ b/db/migrate/20260903034026_create_sessions.rb @@ -0,0 +1,11 @@ +class CreateSessions < ActiveRecord::Migration[8.1] + def change + create_table :sessions do |t| + t.references :user, null: false, foreign_key: true + t.string :user_agent + t.string :ip_address + + t.timestamps + end + end +end diff --git a/db/migrate/20260903034027_create_user_imports.rb b/db/migrate/20260903034027_create_user_imports.rb new file mode 100644 index 000000000..8f9d185f1 --- /dev/null +++ b/db/migrate/20260903034027_create_user_imports.rb @@ -0,0 +1,16 @@ +class CreateUserImports < ActiveRecord::Migration[8.1] + def change + create_table :user_imports do |t| + t.integer :status, null: false, default: 0 + t.integer :total_rows, null: false, default: 0 + t.integer :processed_rows, null: false, default: 0 + t.integer :successful_rows, null: false, default: 0 + t.integer :failed_rows, null: false, default: 0 + t.text :error_message + t.references :created_by, null: false, foreign_key: { to_table: :users } + + t.timestamps + end + add_index :user_imports, :status + end +end diff --git a/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb b/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb new file mode 100644 index 000000000..6bd8bd082 --- /dev/null +++ b/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb @@ -0,0 +1,57 @@ +# This migration comes from active_storage (originally 20170806125915) +class CreateActiveStorageTables < ActiveRecord::Migration[7.0] + def change + # Use Active Record's configured type for primary and foreign keys + primary_key_type, foreign_key_type = primary_and_foreign_key_types + + create_table :active_storage_blobs, id: primary_key_type do |t| + t.string :key, null: false + t.string :filename, null: false + t.string :content_type + t.text :metadata + t.string :service_name, null: false + t.bigint :byte_size, null: false + t.string :checksum + + if connection.supports_datetime_with_precision? + t.datetime :created_at, precision: 6, null: false + else + t.datetime :created_at, null: false + end + + t.index [ :key ], unique: true + end + + create_table :active_storage_attachments, id: primary_key_type do |t| + t.string :name, null: false + t.references :record, null: false, polymorphic: true, index: false, type: foreign_key_type + t.references :blob, null: false, type: foreign_key_type + + if connection.supports_datetime_with_precision? + t.datetime :created_at, precision: 6, null: false + else + t.datetime :created_at, null: false + end + + t.index [ :record_type, :record_id, :name, :blob_id ], name: :index_active_storage_attachments_uniqueness, unique: true + t.foreign_key :active_storage_blobs, column: :blob_id + end + + create_table :active_storage_variant_records, id: primary_key_type do |t| + t.belongs_to :blob, null: false, index: false, type: foreign_key_type + t.string :variation_digest, null: false + + t.index [ :blob_id, :variation_digest ], name: :index_active_storage_variant_records_uniqueness, unique: true + t.foreign_key :active_storage_blobs, column: :blob_id + end + end + + private + def primary_and_foreign_key_types + config = Rails.configuration.generators + setting = config.options[config.orm][:primary_key_type] + primary_key_type = setting || :primary_key + foreign_key_type = setting || :bigint + [ primary_key_type, foreign_key_type ] + end +end diff --git a/db/queue_schema.rb b/db/queue_schema.rb new file mode 100644 index 000000000..f9a71dabb --- /dev/null +++ b/db/queue_schema.rb @@ -0,0 +1,160 @@ +ActiveRecord::Schema[7.1].define(version: 1) do + create_table "solid_queue_blocked_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.string "concurrency_key", null: false + t.datetime "expires_at", null: false + t.datetime "created_at", null: false + t.index [ "concurrency_key", "priority", "job_id" ], name: "index_solid_queue_blocked_executions_for_release" + t.index [ "expires_at", "concurrency_key" ], name: "index_solid_queue_blocked_executions_for_maintenance" + t.index [ "job_id" ], name: "index_solid_queue_blocked_executions_on_job_id", unique: true + end + + create_table "solid_queue_claimed_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.bigint "process_id" + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_claimed_executions_on_job_id", unique: true + t.index [ "process_id", "job_id" ], name: "index_solid_queue_claimed_executions_on_process_id_and_job_id" + end + + create_table "solid_queue_failed_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.text "error" + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_failed_executions_on_job_id", unique: true + end + + create_table "solid_queue_jobs", force: :cascade do |t| + t.string "queue_name", null: false + t.string "class_name", null: false + t.text "arguments" + t.integer "priority", default: 0, null: false + t.string "active_job_id" + t.datetime "scheduled_at" + t.datetime "finished_at" + t.string "concurrency_key" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.bigint "batch_id" + t.index [ "active_job_id" ], name: "index_solid_queue_jobs_on_active_job_id" + t.index [ "batch_id" ], name: "index_solid_queue_jobs_on_batch_id" + t.index [ "class_name" ], name: "index_solid_queue_jobs_on_class_name" + t.index [ "finished_at" ], name: "index_solid_queue_jobs_on_finished_at" + t.index [ "queue_name", "finished_at" ], name: "index_solid_queue_jobs_for_filtering" + t.index [ "scheduled_at", "finished_at" ], name: "index_solid_queue_jobs_for_alerting" + end + + create_table "solid_queue_pauses", force: :cascade do |t| + t.string "queue_name", null: false + t.datetime "created_at", null: false + t.index [ "queue_name" ], name: "index_solid_queue_pauses_on_queue_name", unique: true + end + + create_table "solid_queue_processes", force: :cascade do |t| + t.string "kind", null: false + t.datetime "last_heartbeat_at", null: false + t.bigint "supervisor_id" + t.integer "pid", null: false + t.string "hostname" + t.text "metadata" + t.datetime "created_at", null: false + t.string "name", null: false + t.index [ "last_heartbeat_at" ], name: "index_solid_queue_processes_on_last_heartbeat_at" + t.index [ "name", "supervisor_id" ], name: "index_solid_queue_processes_on_name_and_supervisor_id", unique: true + t.index [ "supervisor_id" ], name: "index_solid_queue_processes_on_supervisor_id" + end + + create_table "solid_queue_ready_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_ready_executions_on_job_id", unique: true + t.index [ "priority", "job_id" ], name: "index_solid_queue_poll_all" + t.index [ "queue_name", "priority", "job_id" ], name: "index_solid_queue_poll_by_queue" + end + + create_table "solid_queue_recurring_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "task_key", null: false + t.datetime "run_at", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_recurring_executions_on_job_id", unique: true + t.index [ "task_key", "run_at" ], name: "index_solid_queue_recurring_executions_on_task_key_and_run_at", unique: true + end + + create_table "solid_queue_recurring_tasks", force: :cascade do |t| + t.string "key", null: false + t.string "schedule", null: false + t.string "command", limit: 2048 + t.string "class_name" + t.text "arguments" + t.string "queue_name" + t.integer "priority", default: 0 + t.boolean "static", default: true, null: false + t.text "description" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "key" ], name: "index_solid_queue_recurring_tasks_on_key", unique: true + t.index [ "static" ], name: "index_solid_queue_recurring_tasks_on_static" + end + + create_table "solid_queue_scheduled_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.datetime "scheduled_at", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_scheduled_executions_on_job_id", unique: true + t.index [ "scheduled_at", "priority", "job_id" ], name: "index_solid_queue_dispatch_all" + end + + create_table "solid_queue_semaphores", force: :cascade do |t| + t.string "key", null: false + t.integer "value", default: 1, null: false + t.datetime "expires_at", null: false + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "expires_at" ], name: "index_solid_queue_semaphores_on_expires_at" + t.index [ "key", "value" ], name: "index_solid_queue_semaphores_on_key_and_value" + t.index [ "key" ], name: "index_solid_queue_semaphores_on_key", unique: true + end + + create_table "solid_queue_batches", force: :cascade do |t| + t.string "active_job_batch_id" + t.string "description" + t.text "on_finish" + t.text "on_success" + t.text "on_failure" + t.text "metadata" + t.integer "total_jobs", default: 0, null: false + t.integer "completed_jobs", default: 0, null: false + t.integer "failed_jobs", default: 0, null: false + t.datetime "enqueued_at" + t.datetime "finished_at" + t.datetime "failed_at" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "active_job_batch_id" ], name: "index_solid_queue_batches_on_active_job_batch_id", unique: true + t.index [ "finished_at" ], name: "index_solid_queue_batches_on_finished_at" + end + + create_table "solid_queue_batch_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.bigint "batch_id", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_batch_executions_on_job_id", unique: true + t.index [ "batch_id" ], name: "index_solid_queue_batch_executions_on_batch_id" + end + + add_foreign_key "solid_queue_batch_executions", "solid_queue_batches", column: "batch_id", on_delete: :cascade + add_foreign_key "solid_queue_batch_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_blocked_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_claimed_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_failed_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_ready_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_recurring_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_scheduled_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade +end diff --git a/db/schema.rb b/db/schema.rb new file mode 100644 index 000000000..774faee50 --- /dev/null +++ b/db/schema.rb @@ -0,0 +1,81 @@ +# This file is auto-generated from the current state of the database. Instead +# of editing this file, please use the migrations feature of Active Record to +# incrementally modify your database, and then regenerate this schema definition. +# +# This file is the source Rails uses to define your schema when running `bin/rails +# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to +# be faster and is potentially less error prone than running all of your +# migrations from scratch. Old migrations may fail to apply correctly if those +# migrations use external dependencies or application code. +# +# It's strongly recommended that you check this file into your version control system. + +ActiveRecord::Schema[8.1].define(version: 2026_09_03_034028) do + create_table "active_storage_attachments", force: :cascade do |t| + t.bigint "blob_id", null: false + t.datetime "created_at", null: false + t.string "name", null: false + t.bigint "record_id", null: false + t.string "record_type", null: false + t.index ["blob_id"], name: "index_active_storage_attachments_on_blob_id" + t.index ["record_type", "record_id", "name", "blob_id"], name: "index_active_storage_attachments_uniqueness", unique: true + end + + create_table "active_storage_blobs", force: :cascade do |t| + t.bigint "byte_size", null: false + t.string "checksum" + t.string "content_type" + t.datetime "created_at", null: false + t.string "filename", null: false + t.string "key", null: false + t.text "metadata" + t.string "service_name", null: false + t.index ["key"], name: "index_active_storage_blobs_on_key", unique: true + end + + create_table "active_storage_variant_records", force: :cascade do |t| + t.bigint "blob_id", null: false + t.string "variation_digest", null: false + t.index ["blob_id", "variation_digest"], name: "index_active_storage_variant_records_uniqueness", unique: true + end + + create_table "sessions", force: :cascade do |t| + t.datetime "created_at", null: false + t.string "ip_address" + t.datetime "updated_at", null: false + t.string "user_agent" + t.integer "user_id", null: false + t.index ["user_id"], name: "index_sessions_on_user_id" + end + + create_table "user_imports", force: :cascade do |t| + t.datetime "created_at", null: false + t.integer "created_by_id", null: false + t.text "error_message" + t.integer "failed_rows", default: 0, null: false + t.integer "processed_rows", default: 0, null: false + t.integer "status", default: 0, null: false + t.integer "successful_rows", default: 0, null: false + t.integer "total_rows", default: 0, null: false + t.datetime "updated_at", null: false + t.index ["created_by_id"], name: "index_user_imports_on_created_by_id" + t.index ["status"], name: "index_user_imports_on_status" + end + + create_table "users", force: :cascade do |t| + t.string "avatar_url" + t.datetime "created_at", null: false + t.string "email_address", null: false + t.string "full_name", null: false + t.string "password_digest", null: false + t.integer "role", default: 0, null: false + t.datetime "updated_at", null: false + t.index ["email_address"], name: "index_users_on_email_address", unique: true + t.index ["role"], name: "index_users_on_role" + end + + add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id" + add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id" + add_foreign_key "sessions", "users" + add_foreign_key "user_imports", "users", column: "created_by_id" +end diff --git a/db/seeds.rb b/db/seeds.rb new file mode 100644 index 000000000..99a146bf3 --- /dev/null +++ b/db/seeds.rb @@ -0,0 +1,40 @@ +# frozen_string_literal: true + +puts "Seeding Umanni Users…" + +admin = User.find_or_initialize_by(email_address: "admin@umanni.test") +admin.assign_attributes( + full_name: "Ada Admin", + password: "password123", + password_confirmation: "password123", + role: :admin, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=Ada%20Admin" +) +admin.save! + +member = User.find_or_initialize_by(email_address: "user@umanni.test") +member.assign_attributes( + full_name: "Morgan Member", + password: "password123", + password_confirmation: "password123", + role: :member, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=Morgan%20Member" +) +member.save! + +%w[Alex Jordan Casey Riley Quinn].each_with_index do |name, index| + user = User.find_or_initialize_by(email_address: "#{name.downcase}@example.com") + user.assign_attributes( + full_name: "#{name} Example", + password: "password123", + password_confirmation: "password123", + role: :member, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=#{name}" + ) + user.save! + print "." if index +end + +puts "\nSeeded users: #{User.count}" +puts "Admin login: admin@umanni.test / password123" +puts "Member login: user@umanni.test / password123" diff --git a/docs/sample_users.csv b/docs/sample_users.csv new file mode 100644 index 000000000..9fb6c3532 --- /dev/null +++ b/docs/sample_users.csv @@ -0,0 +1,4 @@ +full_name,email,password,role,avatar_url +Imported Alpha,alpha.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Alpha +Imported Beta,beta.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Beta +Imported Gamma,gamma.import@example.com,password123,admin,https://api.dicebear.com/9.x/initials/svg?seed=Gamma diff --git a/docs/sample_users.xlsx b/docs/sample_users.xlsx new file mode 100644 index 000000000..bb8b97efe Binary files /dev/null and b/docs/sample_users.xlsx differ diff --git a/lib/tasks/.keep b/lib/tasks/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/lib/tasks/sample_xlsx.rake b/lib/tasks/sample_xlsx.rake new file mode 100644 index 000000000..d8a8c9212 --- /dev/null +++ b/lib/tasks/sample_xlsx.rake @@ -0,0 +1,32 @@ +# frozen_string_literal: true + +namespace :sample do + desc "Generate docs/sample_users.xlsx for import demos" + task xlsx: :environment do + require "caxlsx" + + path = Rails.root.join("docs/sample_users.xlsx") + Axlsx::Package.new do |package| + package.workbook.add_worksheet(name: "Users") do |sheet| + sheet.add_row %w[full_name email password role avatar_url] + sheet.add_row [ + "Imported Delta", + "delta.import@example.com", + "password123", + "member", + "https://api.dicebear.com/9.x/initials/svg?seed=Delta" + ] + sheet.add_row [ + "Imported Epsilon", + "epsilon.import@example.com", + "password123", + "admin", + "https://api.dicebear.com/9.x/initials/svg?seed=Epsilon" + ] + end + package.serialize(path.to_s) + end + + puts "Wrote #{path}" + end +end diff --git a/log/.keep b/log/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/public/400.html b/public/400.html new file mode 100644 index 000000000..640de0339 --- /dev/null +++ b/public/400.html @@ -0,0 +1,135 @@ + + + + + + + The server cannot process the request due to a client error (400 Bad Request) + + + + + + + + + + + + + +
    +
    + +
    +
    +

    The server cannot process the request due to a client error. Please check the request and try again. If you're the application owner check the logs for more information.

    +
    +
    + + + + diff --git a/public/404.html b/public/404.html new file mode 100644 index 000000000..d7f0f1422 --- /dev/null +++ b/public/404.html @@ -0,0 +1,135 @@ + + + + + + + The page you were looking for doesn't exist (404 Not found) + + + + + + + + + + + + + +
    +
    + +
    +
    +

    The page you were looking for doesn't exist. You may have mistyped the address or the page may have moved. If you're the application owner check the logs for more information.

    +
    +
    + + + + diff --git a/public/406-unsupported-browser.html b/public/406-unsupported-browser.html new file mode 100644 index 000000000..43d2811e8 --- /dev/null +++ b/public/406-unsupported-browser.html @@ -0,0 +1,135 @@ + + + + + + + Your browser is not supported (406 Not Acceptable) + + + + + + + + + + + + + +
    +
    + +
    +
    +

    Your browser is not supported.
    Please upgrade your browser to continue.

    +
    +
    + + + + diff --git a/public/422.html b/public/422.html new file mode 100644 index 000000000..f12fb4aa1 --- /dev/null +++ b/public/422.html @@ -0,0 +1,135 @@ + + + + + + + The change you wanted was rejected (422 Unprocessable Entity) + + + + + + + + + + + + + +
    +
    + +
    +
    +

    The change you wanted was rejected. Maybe you tried to change something you didn't have access to. If you're the application owner check the logs for more information.

    +
    +
    + + + + diff --git a/public/500.html b/public/500.html new file mode 100644 index 000000000..e4eb18a75 --- /dev/null +++ b/public/500.html @@ -0,0 +1,135 @@ + + + + + + + We're sorry, but something went wrong (500 Internal Server Error) + + + + + + + + + + + + + +
    +
    + +
    +
    +

    We're sorry, but something went wrong.
    If you're the application owner check the logs for more information.

    +
    +
    + + + + diff --git a/public/icon.png b/public/icon.png new file mode 100644 index 000000000..c4c9dbfbb Binary files /dev/null and b/public/icon.png differ diff --git a/public/icon.svg b/public/icon.svg new file mode 100644 index 000000000..04b34bf83 --- /dev/null +++ b/public/icon.svg @@ -0,0 +1,3 @@ + + + diff --git a/public/robots.txt b/public/robots.txt new file mode 100644 index 000000000..c19f78ab6 --- /dev/null +++ b/public/robots.txt @@ -0,0 +1 @@ +# See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file diff --git a/script/.keep b/script/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/storage/.keep b/storage/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb new file mode 100644 index 000000000..611b477a7 --- /dev/null +++ b/test/application_system_test_case.rb @@ -0,0 +1,22 @@ +# frozen_string_literal: true + +require "test_helper" + +class ApplicationSystemTestCase < ActionDispatch::SystemTestCase + driven_by :selenium, using: :headless_chrome, screen_size: [ 1400, 1400 ] + + def sign_in_as(user) + visit new_session_path + within("main") do + fill_in "Email", with: user.email_address + fill_in "Password", with: "password123" + click_button "Sign in" + end + + if user.admin? + assert_selector "h1", text: "Admin dashboard" + else + assert_selector "h1", text: user.full_name + end + end +end diff --git a/test/controllers/admin/dashboard_controller_test.rb b/test/controllers/admin/dashboard_controller_test.rb new file mode 100644 index 000000000..8e664a840 --- /dev/null +++ b/test/controllers/admin/dashboard_controller_test.rb @@ -0,0 +1,17 @@ +require "test_helper" + +module Admin + class DashboardControllerTest < ActionDispatch::IntegrationTest + test "admin can see dashboard stats" do + sign_in_as users(:admin) + get admin_root_url + assert_response :success + assert_select "[data-testid=total-users]", text: User.count.to_s + end + + test "visitor is redirected to sign in" do + get admin_root_url + assert_redirected_to new_session_url + end + end +end diff --git a/test/controllers/admin/imports_controller_extra_test.rb b/test/controllers/admin/imports_controller_extra_test.rb new file mode 100644 index 000000000..c595236a7 --- /dev/null +++ b/test/controllers/admin/imports_controller_extra_test.rb @@ -0,0 +1,22 @@ +require "test_helper" + +module Admin + class ImportsControllerExtraTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "shows import details" do + import = UserImport.new(created_by: users(:admin), status: :completed, total_rows: 1, processed_rows: 1, successful_rows: 1) + import.spreadsheet.attach(io: StringIO.new("full_name,email\nA,a@example.com\n"), filename: "users.csv", content_type: "text/csv") + import.save! + + get admin_import_url(import) + assert_response :success + assert_match "##{import.id}", response.body + end + + test "invalid upload re-renders index" do + post admin_imports_url, params: { user_import: { spreadsheet: "" } } + assert_response :unprocessable_entity + end + end +end diff --git a/test/controllers/admin/imports_controller_test.rb b/test/controllers/admin/imports_controller_test.rb new file mode 100644 index 000000000..675604226 --- /dev/null +++ b/test/controllers/admin/imports_controller_test.rb @@ -0,0 +1,27 @@ +require "test_helper" +require "tempfile" + +module Admin + class ImportsControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can upload spreadsheet and enqueue job" do + file = Tempfile.new([ "users", ".csv" ]) + file.write("full_name,email,password\nImport Me,importme@example.com,password123\n") + file.rewind + + assert_enqueued_with(job: ProcessUserImportJob) do + assert_difference("UserImport.count", 1) do + post admin_imports_url, params: { + user_import: { + spreadsheet: Rack::Test::UploadedFile.new(file.path, "text/csv", original_filename: "users.csv") + } + } + end + end + + assert_redirected_to admin_imports_url + file.close! + end + end +end diff --git a/test/controllers/admin/users_controller_extra_test.rb b/test/controllers/admin/users_controller_extra_test.rb new file mode 100644 index 000000000..e1041ac92 --- /dev/null +++ b/test/controllers/admin/users_controller_extra_test.rb @@ -0,0 +1,32 @@ +require "test_helper" + +module Admin + class UsersControllerExtraTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can show and update user" do + user = users(:another_member) + get admin_user_url(user) + assert_response :success + + patch admin_user_url(user), params: { user: { full_name: "Casey Updated" } } + assert_redirected_to admin_user_url(user) + assert_equal "Casey Updated", user.reload.full_name + end + + test "admin can delete other users but not self" do + delete admin_user_url(users(:admin)) + assert_redirected_to admin_users_url + assert User.exists?(users(:admin).id) + + assert_difference("User.count", -1) do + delete admin_user_url(users(:another_member)) + end + end + + test "invalid create re-renders form" do + post admin_users_url, params: { user: { full_name: "", email_address: "", password: "x", role: "member" } } + assert_response :unprocessable_entity + end + end +end diff --git a/test/controllers/admin/users_controller_test.rb b/test/controllers/admin/users_controller_test.rb new file mode 100644 index 000000000..740ead96f --- /dev/null +++ b/test/controllers/admin/users_controller_test.rb @@ -0,0 +1,48 @@ +require "test_helper" + +module Admin + class UsersControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can list users" do + get admin_users_url + assert_response :success + assert_match users(:member).full_name, response.body + end + + test "admin can create user" do + assert_difference("User.count", 1) do + post admin_users_url, params: { + user: { + full_name: "Fresh User", + email_address: "fresh@example.com", + password: "password123", + password_confirmation: "password123", + role: "member" + } + } + end + assert_redirected_to admin_user_url(User.find_by(email_address: "fresh@example.com")) + end + + test "admin can toggle role" do + user = users(:another_member) + assert user.member? + patch toggle_role_admin_user_url(user) + assert user.reload.admin? + end + + test "admin cannot toggle own role" do + patch toggle_role_admin_user_url(users(:admin)) + assert_redirected_to admin_users_url + assert users(:admin).reload.admin? + end + + test "member cannot access admin users" do + delete session_url + sign_in_as users(:member) + get admin_users_url + assert_redirected_to profile_url + end + end +end diff --git a/test/controllers/home_controller_test.rb b/test/controllers/home_controller_test.rb new file mode 100644 index 000000000..d4a1d65de --- /dev/null +++ b/test/controllers/home_controller_test.rb @@ -0,0 +1,21 @@ +require "test_helper" + +class HomeControllerTest < ActionDispatch::IntegrationTest + test "visitor sees landing page" do + get root_url + assert_response :success + assert_match "Umanni Users", response.body + end + + test "admin is redirected to dashboard" do + sign_in_as users(:admin) + get root_url + assert_redirected_to admin_root_path + end + + test "member is redirected to profile" do + sign_in_as users(:member) + get root_url + assert_redirected_to profile_path + end +end diff --git a/test/controllers/passwords_controller_test.rb b/test/controllers/passwords_controller_test.rb new file mode 100644 index 000000000..423d0f1dc --- /dev/null +++ b/test/controllers/passwords_controller_test.rb @@ -0,0 +1,27 @@ +require "test_helper" + +class PasswordsControllerTest < ActionDispatch::IntegrationTest + test "renders forgot password form" do + get new_password_url + assert_response :success + end + + test "queues reset for known email" do + assert_enqueued_emails 1 do + post passwords_url, params: { email_address: users(:member).email_address } + end + assert_redirected_to new_session_url + end + + test "does not reveal unknown emails" do + assert_no_enqueued_emails do + post passwords_url, params: { email_address: "missing@example.com" } + end + assert_redirected_to new_session_url + end + + test "rejects invalid reset token" do + get edit_password_url(token: "invalid") + assert_redirected_to new_password_url + end +end diff --git a/test/controllers/profiles_controller_test.rb b/test/controllers/profiles_controller_test.rb new file mode 100644 index 000000000..14a7a2f44 --- /dev/null +++ b/test/controllers/profiles_controller_test.rb @@ -0,0 +1,24 @@ +require "test_helper" + +class ProfilesControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:member) } + + test "member can view own profile" do + get profile_url + assert_response :success + assert_select "h1", users(:member).full_name + end + + test "member can update own profile" do + patch profile_url, params: { user: { full_name: "Morgan Updated" } } + assert_redirected_to profile_url + assert_equal "Morgan Updated", users(:member).reload.full_name + end + + test "member can delete own profile" do + assert_difference("User.count", -1) do + delete profile_url + end + assert_redirected_to new_session_url + end +end diff --git a/test/controllers/registrations_controller_test.rb b/test/controllers/registrations_controller_test.rb new file mode 100644 index 000000000..8f195f70d --- /dev/null +++ b/test/controllers/registrations_controller_test.rb @@ -0,0 +1,28 @@ +require "test_helper" + +class RegistrationsControllerTest < ActionDispatch::IntegrationTest + test "visitor can register as member" do + assert_difference("User.count", 1) do + post registration_url, params: { + user: { + full_name: "New Visitor", + email_address: "visitor@example.com", + password: "password123", + password_confirmation: "password123" + } + } + end + + assert_redirected_to profile_url + assert User.find_by(email_address: "visitor@example.com").member? + end + + test "rejects invalid registration" do + assert_no_difference("User.count") do + post registration_url, params: { + user: { full_name: "", email_address: "bad", password: "short" } + } + end + assert_response :unprocessable_entity + end +end diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb new file mode 100644 index 000000000..f73296388 --- /dev/null +++ b/test/controllers/sessions_controller_test.rb @@ -0,0 +1,19 @@ +require "test_helper" + +class SessionsControllerTest < ActionDispatch::IntegrationTest + test "admin is redirected to dashboard after login" do + post session_url, params: { email_address: users(:admin).email_address, password: "password123" } + assert_redirected_to admin_root_url + end + + test "member is redirected to profile after login" do + post session_url, params: { email_address: users(:member).email_address, password: "password123" } + assert_redirected_to profile_url + end + + test "rejects invalid credentials" do + post session_url, params: { email_address: users(:member).email_address, password: "wrong" } + assert_redirected_to new_session_url + assert_equal "Try another email address or password.", flash[:alert] + end +end diff --git a/test/fixtures/files/sample_users.csv b/test/fixtures/files/sample_users.csv new file mode 100644 index 000000000..9fb6c3532 --- /dev/null +++ b/test/fixtures/files/sample_users.csv @@ -0,0 +1,4 @@ +full_name,email,password,role,avatar_url +Imported Alpha,alpha.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Alpha +Imported Beta,beta.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Beta +Imported Gamma,gamma.import@example.com,password123,admin,https://api.dicebear.com/9.x/initials/svg?seed=Gamma diff --git a/test/fixtures/sessions.yml b/test/fixtures/sessions.yml new file mode 100644 index 000000000..0caeccedf --- /dev/null +++ b/test/fixtures/sessions.yml @@ -0,0 +1,6 @@ +# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html + +admin_session: + user: admin + user_agent: Test Agent + ip_address: 127.0.0.1 diff --git a/test/fixtures/user_imports.yml b/test/fixtures/user_imports.yml new file mode 100644 index 000000000..3099be84d --- /dev/null +++ b/test/fixtures/user_imports.yml @@ -0,0 +1 @@ +# Intentionally empty — UserImport records require ActiveStorage attachments created in tests. diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml new file mode 100644 index 000000000..dea925b4b --- /dev/null +++ b/test/fixtures/users.yml @@ -0,0 +1,19 @@ +# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html + +admin: + full_name: Ada Admin + email_address: admin@umanni.test + password_digest: <%= BCrypt::Password.create("password123") %> + role: 1 + +member: + full_name: Morgan Member + email_address: user@umanni.test + password_digest: <%= BCrypt::Password.create("password123") %> + role: 0 + +another_member: + full_name: Casey Example + email_address: casey@example.com + password_digest: <%= BCrypt::Password.create("password123") %> + role: 0 diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb new file mode 100644 index 000000000..1146da47a --- /dev/null +++ b/test/helpers/application_helper_test.rb @@ -0,0 +1,42 @@ +require "test_helper" + +class ApplicationHelperTest < ActionView::TestCase + test "flash and role badge classes" do + assert_match "emerald", flash_class(:notice) + assert_match "rose", flash_class(:alert) + assert_match "teal", role_badge_class("admin") + assert_match "slate", role_badge_class("member") + end + + test "import status classes" do + assert_match "sky", import_status_class("processing") + assert_match "emerald", import_status_class("completed") + end + + test "role switch marks the current role as active" do + def current_user = users(:admin) + + html = role_switch_for(users(:member)) + + assert_match(/Member/, html) + assert_match(/Admin/, html) + assert_match(/bg-white text-slate-900/, html) + end + + test "avatar tag falls back to initials" do + html = avatar_tag(users(:member), size: 40) + + assert_includes html, "MM" + assert_includes html, "width: 40px" + end + + test "avatar tag uses remote url" do + user = users(:member) + user.avatar_url = "https://example.com/a.png" + html = avatar_tag(user, size: 48) + + assert_includes html, "https://example.com/a.png" + assert_includes html, "width: 48px" + assert_includes html, "height: 48px" + end +end diff --git a/test/integration/security_test.rb b/test/integration/security_test.rb new file mode 100644 index 000000000..b888e2d33 --- /dev/null +++ b/test/integration/security_test.rb @@ -0,0 +1,84 @@ +require "test_helper" + +class SecurityTest < ActionDispatch::IntegrationTest + test "escapes xss in user names" do + sign_in_as users(:admin) + malicious = User.create!( + full_name: "", + email_address: "xss@example.com", + password: "password123", + role: :member + ) + + get admin_users_url + + assert_response :success + assert_no_match %r{}, response.body + assert_match "<script>", response.body + + malicious.destroy! + end + + test "csrf forgery protection module is loaded" do + assert_includes ActionController::Base.included_modules, ActionController::RequestForgeryProtection + # protect_from_forgery is enabled outside the test environment (see config/environments/test.rb) + assert ActionController::Base.allow_forgery_protection || Rails.env.test? + end + + test "sql injection does not bypass authentication" do + post session_url, params: { + email_address: "' OR 1=1 --", + password: "' OR 1=1 --" + } + + assert_redirected_to new_session_url + end + + test "passwords are stored as digests not plaintext" do + digest = users(:member).password_digest + + assert_not_equal "password123", digest + assert BCrypt::Password.new(digest).is_password?("password123") + end + + test "email_address is encrypted at rest" do + user = users(:member) + raw = User.connection.select_value( + User.sanitize_sql_array([ "SELECT email_address FROM users WHERE id = ?", user.id ]) + ) + + assert_not_equal user.email_address, raw + assert_operator raw.to_s.length, :>, 0 + end + + test "member cannot escalate role through profile params" do + sign_in_as users(:member) + patch profile_url, params: { user: { full_name: "Morgan Member", role: "admin" } } + + assert_redirected_to profile_url + assert_predicate users(:member).reload, :member? + end + + test "member cannot access another users admin record" do + sign_in_as users(:member) + get admin_user_url(users(:another_member)) + + assert_redirected_to profile_url + end + + test "visitor registration always creates member role" do + post registration_url, params: { + user: { + full_name: "Forced Admin", + email_address: "forced.admin@example.com", + password: "password123", + password_confirmation: "password123", + role: "admin" + } + } + user = User.find_by(email_address: "forced.admin@example.com") + + assert_predicate user, :present? + assert_predicate user, :member? + end +end diff --git a/test/jobs/process_user_import_job_test.rb b/test/jobs/process_user_import_job_test.rb new file mode 100644 index 000000000..1e4e2698b --- /dev/null +++ b/test/jobs/process_user_import_job_test.rb @@ -0,0 +1,18 @@ +require "test_helper" + +class ProcessUserImportJobTest < ActiveJob::TestCase + test "processes import" do + import = UserImport.new(created_by: users(:admin), status: :pending) + import.spreadsheet.attach( + io: StringIO.new("full_name,email,password\nJob User,jobuser@example.com,password123\n"), + filename: "users.csv", + content_type: "text/csv" + ) + import.save! + + perform_enqueued_jobs only: ProcessUserImportJob + + assert import.reload.completed? + assert User.exists?(email_address: "jobuser@example.com") + end +end diff --git a/test/models/user_encryption_test.rb b/test/models/user_encryption_test.rb new file mode 100644 index 000000000..ef5ce23b7 --- /dev/null +++ b/test/models/user_encryption_test.rb @@ -0,0 +1,21 @@ +require "test_helper" + +class UserEncryptionTest < ActiveSupport::TestCase + test "fixture users authenticate with known password" do + assert User.authenticate_by(email_address: users(:admin).email_address, password: "password123") + assert User.authenticate_by(email_address: users(:member).email_address, password: "password123") + end + + test "email ciphertext differs from plaintext attribute" do + user = users(:member) + raw = User.connection.select_value( + User.sanitize_sql_array([ "SELECT email_address FROM users WHERE id = ?", user.id ]) + ) + + assert_not_equal user.email_address, raw + end + + test "deterministic encryption supports find_by email" do + assert_equal users(:admin).id, User.find_by(email_address: users(:admin).email_address).id + end +end diff --git a/test/models/user_extra_test.rb b/test/models/user_extra_test.rb new file mode 100644 index 000000000..27a0aa604 --- /dev/null +++ b/test/models/user_extra_test.rb @@ -0,0 +1,27 @@ +require "test_helper" + +class UserExtraTest < ActiveSupport::TestCase + test "avatar_src prefers attachment then url" do + user = users(:member) + user.avatar_url = "https://example.com/a.png" + assert_equal "https://example.com/a.png", user.avatar_src + + user.avatar_image.attach( + io: StringIO.new("fake"), + filename: "a.png", + content_type: "image/png" + ) + assert user.avatar_src.attached? + end + + test "rejects oversized avatar content type via validation helper path" do + user = users(:member) + user.avatar_image.attach( + io: StringIO.new("not-an-image"), + filename: "file.pdf", + content_type: "application/pdf" + ) + assert_not user.valid? + assert_includes user.errors[:avatar_image], "must be a PNG, JPEG, WEBP, or GIF image" + end +end diff --git a/test/models/user_import_test.rb b/test/models/user_import_test.rb new file mode 100644 index 000000000..8a8bebe7c --- /dev/null +++ b/test/models/user_import_test.rb @@ -0,0 +1,25 @@ +require "test_helper" + +class UserImportTest < ActiveSupport::TestCase + test "progress percent" do + import = UserImport.new(total_rows: 10, processed_rows: 5) + assert_equal 50, import.progress_percent + end + + test "finished states" do + assert UserImport.new(status: :completed).finished? + assert UserImport.new(status: :failed).finished? + assert_not UserImport.new(status: :pending).finished? + end + + test "rejects unsupported spreadsheet types" do + import = UserImport.new(created_by: users(:admin)) + import.spreadsheet.attach( + io: StringIO.new("hello"), + filename: "notes.txt", + content_type: "text/plain" + ) + assert_not import.valid? + assert_includes import.errors[:spreadsheet], "must be a .csv or .xlsx file" + end +end diff --git a/test/models/user_test.rb b/test/models/user_test.rb new file mode 100644 index 000000000..9732d8cdc --- /dev/null +++ b/test/models/user_test.rb @@ -0,0 +1,33 @@ +require "test_helper" + +class UserTest < ActiveSupport::TestCase + test "valid member fixture" do + assert users(:member).valid? + end + + test "requires full name email and password" do + user = User.new + assert_not user.valid? + assert_includes user.errors[:full_name], "can't be blank" + assert_includes user.errors[:email_address], "can't be blank" + assert_includes user.errors[:password], "can't be blank" + end + + test "normalizes email and rejects invalid avatar url" do + user = users(:member) + user.email_address = " UPPER@Example.COM " + user.avatar_url = "javascript:alert(1)" + assert_not user.valid? + assert_equal "upper@example.com", user.email_address + assert_includes user.errors[:avatar_url], "must be an http(s) URL" + end + + test "role helpers" do + assert users(:admin).admin? + assert users(:member).member? + end + + test "initials" do + assert_equal "MM", users(:member).initials + end +end diff --git a/test/services/users/dashboard_broadcaster_test.rb b/test/services/users/dashboard_broadcaster_test.rb new file mode 100644 index 000000000..58c5655c3 --- /dev/null +++ b/test/services/users/dashboard_broadcaster_test.rb @@ -0,0 +1,9 @@ +require "test_helper" + +module Users + class DashboardBroadcasterTest < ActiveSupport::TestCase + test "broadcasts without raising" do + assert_nothing_raised { Users::DashboardBroadcaster.call } + end + end +end diff --git a/test/services/users/dashboard_stats_test.rb b/test/services/users/dashboard_stats_test.rb new file mode 100644 index 000000000..f5f713d19 --- /dev/null +++ b/test/services/users/dashboard_stats_test.rb @@ -0,0 +1,12 @@ +require "test_helper" + +module Users + class DashboardStatsTest < ActiveSupport::TestCase + test "counts users by role" do + stats = Users::DashboardStats.call + assert_equal User.count, stats.total + assert_equal User.admin.count, stats.admins + assert_equal User.member.count, stats.members + end + end +end diff --git a/test/services/users/importer_test.rb b/test/services/users/importer_test.rb new file mode 100644 index 000000000..e75af3037 --- /dev/null +++ b/test/services/users/importer_test.rb @@ -0,0 +1,52 @@ +require "test_helper" +require "tempfile" + +module Users + class ImporterTest < ActiveSupport::TestCase + test "imports users from csv" do + import = create_import(<<~CSV) + full_name,email,password,role + Imported One,imported1@example.com,password123,member + Imported Two,imported2@example.com,password123,admin + CSV + + result = Users::Importer.call(import) + + assert_equal 2, result.successful + assert_equal 0, result.failed + assert import.reload.completed? + assert User.exists?(email_address: "imported1@example.com") + assert User.find_by(email_address: "imported2@example.com").admin? + end + + test "tracks failed rows" do + import = create_import(<<~CSV) + full_name,email,password + Bad User,not-an-email,password123 + CSV + + result = Users::Importer.call(import) + + assert_equal 0, result.successful + assert_equal 1, result.failed + assert import.reload.completed? + end + + private + + def create_import(csv_body) + import = UserImport.new(created_by: users(:admin), status: :pending) + file = Tempfile.new([ "users", ".csv" ]) + file.write(csv_body) + file.rewind + import.spreadsheet.attach( + io: file, + filename: "users.csv", + content_type: "text/csv" + ) + import.save! + file.close! + import + end + end +end diff --git a/test/services/users/importer_xlsx_test.rb b/test/services/users/importer_xlsx_test.rb new file mode 100644 index 000000000..5589d7105 --- /dev/null +++ b/test/services/users/importer_xlsx_test.rb @@ -0,0 +1,38 @@ +require "test_helper" +require "caxlsx" + +module Users + class ImporterXlsxTest < ActiveSupport::TestCase + test "imports users from xlsx workbook" do + path = Rails.root.join("tmp", "import_users.xlsx") + FileUtils.mkdir_p(path.dirname) + + Axlsx::Package.new do |package| + package.workbook.add_worksheet(name: "Users") do |sheet| + sheet.add_row %w[full_name email password role] + sheet.add_row [ "Xlsx One", "xlsx1@example.com", "password123", "member" ] + sheet.add_row [ "Xlsx Two", "xlsx2@example.com", "password123", "admin" ] + end + package.serialize(path.to_s) + end + + import = UserImport.new(created_by: users(:admin), status: :pending) + import.spreadsheet.attach( + io: File.open(path), + filename: "import_users.xlsx", + content_type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" + ) + import.save! + + result = Users::Importer.call(import) + + assert_equal 2, result.successful + assert_equal 0, result.failed + assert_predicate import.reload, :completed? + assert User.exists?(email_address: "xlsx1@example.com") + assert_predicate User.find_by(email_address: "xlsx2@example.com"), :admin? + ensure + FileUtils.rm_f(path) if path + end + end +end diff --git a/test/system/admin_users_system_test.rb b/test/system/admin_users_system_test.rb new file mode 100644 index 000000000..b7511ec76 --- /dev/null +++ b/test/system/admin_users_system_test.rb @@ -0,0 +1,27 @@ +require "application_system_test_case" + +class AdminUsersSystemTest < ApplicationSystemTestCase + test "admin can create and toggle a user" do + sign_in_as users(:admin) + + visit new_admin_user_path + assert_selector "h1", text: "New user" + + fill_in "user_full_name", with: "System Created" + fill_in "user_email_address", with: "system.created@example.com" + fill_in "user_password", with: "password123" + fill_in "user_password_confirmation", with: "password123" + select "Member", from: "user_role" + click_button "Create user" + + assert_text "User created." + visit admin_users_path + assert_text "System Created" + + user = User.find_by!(email_address: "system.created@example.com") + within("#user_#{user.id}") do + click_button "Admin" + end + assert_text "was changed from member to admin" + end +end diff --git a/test/system/authentication_system_test.rb b/test/system/authentication_system_test.rb new file mode 100644 index 000000000..6bd840f80 --- /dev/null +++ b/test/system/authentication_system_test.rb @@ -0,0 +1,27 @@ +require "application_system_test_case" + +class AuthenticationSystemTest < ApplicationSystemTestCase + test "member lands on profile after login" do + sign_in_as users(:member) + assert_current_path profile_path + assert_text users(:member).full_name + end + + test "admin lands on dashboard after login" do + sign_in_as users(:admin) + assert_current_path admin_root_path + assert_text "Admin dashboard" + assert_selector "[data-testid=total-users]" + end + + test "visitor can register" do + visit new_registration_path + fill_in "Full name", with: "System Visitor" + fill_in "Email", with: "system.visitor@example.com" + fill_in "Password", with: "password123" + fill_in "Password confirmation", with: "password123" + click_button "Register" + assert_current_path profile_path + assert_text "System Visitor" + end +end diff --git a/test/test_helper.rb b/test/test_helper.rb new file mode 100644 index 000000000..4fc68a1ce --- /dev/null +++ b/test/test_helper.rb @@ -0,0 +1,51 @@ +# frozen_string_literal: true + +if ENV["COVERAGE"] + require "simplecov" + SimpleCov.start "rails" do + enable_coverage :line + skip "/test/" + skip "/config/" + skip "/vendor/" + skip "app/channels/" + skip "app/mailers/" + skip "app/views/" + skip "app/javascript/" + minimum_coverage 90 + end +end + +ENV["RAILS_ENV"] ||= "test" +require_relative "../config/environment" +require "rails/test_help" +require "active_job/test_helper" + +module ActiveSupport + class TestCase + parallelize(workers: :number_of_processors) + + if ENV["COVERAGE"] + parallelize_setup do |worker| + SimpleCov.command_name "#{SimpleCov.command_name}-#{worker}" + end + + parallelize_teardown do + SimpleCov.result + end + end + + fixtures :all + + include ActiveJob::TestHelper + + def sign_in_as(user) + post session_url, params: { email_address: user.email_address, password: "password123" } + end + end +end + +class ActionDispatch::IntegrationTest + def sign_in_as(user) + post session_url, params: { email_address: user.email_address, password: "password123" } + end +end diff --git a/tmp/.keep b/tmp/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/tmp/pids/.keep b/tmp/pids/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/tmp/storage/.keep b/tmp/storage/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/vendor/.keep b/vendor/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/vendor/javascript/.keep b/vendor/javascript/.keep new file mode 100644 index 000000000..e69de29bb