From 503b336f455d8c1b2c717b5937e1f2adf92179ea Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 01/12] chore: bootstrap Rails 8.1 app with Propshaft, Tailwind, and Solid adapters Co-authored-by: Cursor --- .dockerignore | 51 ++ .gitattributes | 9 + .github/dependabot.yml | 12 + .github/workflows/ci.yml | 67 ++ .gitignore | 40 ++ .rubocop.yml | 41 ++ .ruby-version | 1 + Dockerfile | 77 +++ Gemfile | 74 +++ Gemfile.lock | 586 ++++++++++++++++++ Procfile.dev | 3 + Rakefile | 6 + app/assets/builds/.keep | 0 app/assets/images/.keep | 0 app/assets/stylesheets/application.css | 10 + app/assets/tailwind/application.css | 28 + app/controllers/application_controller.rb | 10 + app/controllers/concerns/.keep | 0 app/controllers/concerns/authentication.rb | 62 ++ app/controllers/concerns/authorization.rb | 23 + app/helpers/application_helper.rb | 54 ++ app/javascript/application.js | 3 + app/javascript/controllers/application.js | 9 + app/javascript/controllers/index.js | 4 + app/jobs/application_job.rb | 7 + app/mailers/application_mailer.rb | 4 + app/mailers/passwords_mailer.rb | 6 + app/models/application_record.rb | 3 + app/models/concerns/.keep | 0 app/views/layouts/application.html.erb | 27 + app/views/layouts/mailer.html.erb | 13 + app/views/layouts/mailer.text.erb | 1 + app/views/pwa/manifest.json.erb | 22 + app/views/pwa/service-worker.js | 26 + bin/brakeman | 7 + bin/bundler-audit | 6 + bin/ci | 6 + bin/dev | 16 + bin/docker-entrypoint | 8 + bin/importmap | 4 + bin/jobs | 6 + bin/kamal | 16 + bin/rails | 4 + bin/rake | 4 + bin/rubocop | 8 + bin/setup | 35 ++ bin/thrust | 5 + config.ru | 6 + config/application.rb | 42 ++ config/boot.rb | 4 + config/bundler-audit.yml | 5 + config/cable.yml | 20 + config/cache.yml | 16 + config/ci.rb | 20 + config/database.yml | 51 ++ config/environment.rb | 5 + config/environments/development.rb | 83 +++ config/environments/production.rb | 90 +++ config/environments/test.rb | 55 ++ config/importmap.rb | 7 + config/initializers/assets.rb | 7 + .../initializers/content_security_policy.rb | 29 + .../initializers/filter_parameter_logging.rb | 8 + config/initializers/inflections.rb | 16 + config/locales/en.yml | 31 + config/puma.rb | 42 ++ config/queue.yml | 18 + config/recurring.yml | 15 + config/routes.rb | 20 + config/storage.yml | 27 + db/cable_schema.rb | 11 + db/cache_schema.rb | 12 + db/queue_schema.rb | 160 +++++ lib/tasks/.keep | 0 log/.keep | 0 public/400.html | 135 ++++ public/404.html | 135 ++++ public/406-unsupported-browser.html | 135 ++++ public/422.html | 135 ++++ public/500.html | 135 ++++ public/icon.png | Bin 0 -> 4166 bytes public/icon.svg | 3 + public/robots.txt | 1 + script/.keep | 0 storage/.keep | 0 tmp/.keep | 0 tmp/pids/.keep | 0 tmp/storage/.keep | 0 vendor/.keep | 0 vendor/javascript/.keep | 0 90 files changed, 2883 insertions(+) create mode 100644 .dockerignore create mode 100644 .gitattributes create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/ci.yml create mode 100644 .gitignore create mode 100644 .rubocop.yml create mode 100644 .ruby-version create mode 100644 Dockerfile create mode 100644 Gemfile create mode 100644 Gemfile.lock create mode 100644 Procfile.dev create mode 100644 Rakefile create mode 100644 app/assets/builds/.keep create mode 100644 app/assets/images/.keep create mode 100644 app/assets/stylesheets/application.css create mode 100644 app/assets/tailwind/application.css create mode 100644 app/controllers/application_controller.rb create mode 100644 app/controllers/concerns/.keep create mode 100644 app/controllers/concerns/authentication.rb create mode 100644 app/controllers/concerns/authorization.rb create mode 100644 app/helpers/application_helper.rb create mode 100644 app/javascript/application.js create mode 100644 app/javascript/controllers/application.js create mode 100644 app/javascript/controllers/index.js create mode 100644 app/jobs/application_job.rb create mode 100644 app/mailers/application_mailer.rb create mode 100644 app/mailers/passwords_mailer.rb create mode 100644 app/models/application_record.rb create mode 100644 app/models/concerns/.keep create mode 100644 app/views/layouts/application.html.erb create mode 100644 app/views/layouts/mailer.html.erb create mode 100644 app/views/layouts/mailer.text.erb create mode 100644 app/views/pwa/manifest.json.erb create mode 100644 app/views/pwa/service-worker.js create mode 100755 bin/brakeman create mode 100755 bin/bundler-audit create mode 100755 bin/ci create mode 100755 bin/dev create mode 100755 bin/docker-entrypoint create mode 100755 bin/importmap create mode 100755 bin/jobs create mode 100755 bin/kamal create mode 100755 bin/rails create mode 100755 bin/rake create mode 100755 bin/rubocop create mode 100755 bin/setup create mode 100755 bin/thrust create mode 100644 config.ru create mode 100644 config/application.rb create mode 100644 config/boot.rb create mode 100644 config/bundler-audit.yml create mode 100644 config/cable.yml create mode 100644 config/cache.yml create mode 100644 config/ci.rb create mode 100644 config/database.yml create mode 100644 config/environment.rb create mode 100644 config/environments/development.rb create mode 100644 config/environments/production.rb create mode 100644 config/environments/test.rb create mode 100644 config/importmap.rb create mode 100644 config/initializers/assets.rb create mode 100644 config/initializers/content_security_policy.rb create mode 100644 config/initializers/filter_parameter_logging.rb create mode 100644 config/initializers/inflections.rb create mode 100644 config/locales/en.yml create mode 100644 config/puma.rb create mode 100644 config/queue.yml create mode 100644 config/recurring.yml create mode 100644 config/routes.rb create mode 100644 config/storage.yml create mode 100644 db/cable_schema.rb create mode 100644 db/cache_schema.rb create mode 100644 db/queue_schema.rb create mode 100644 lib/tasks/.keep create mode 100644 log/.keep create mode 100644 public/400.html create mode 100644 public/404.html create mode 100644 public/406-unsupported-browser.html create mode 100644 public/422.html create mode 100644 public/500.html create mode 100644 public/icon.png create mode 100644 public/icon.svg create mode 100644 public/robots.txt create mode 100644 script/.keep create mode 100644 storage/.keep create mode 100644 tmp/.keep create mode 100644 tmp/pids/.keep create mode 100644 tmp/storage/.keep create mode 100644 vendor/.keep create mode 100644 vendor/javascript/.keep diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..325bfc036 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,51 @@ +# See https://docs.docker.com/engine/reference/builder/#dockerignore-file for more about ignoring files. + +# Ignore git directory. +/.git/ +/.gitignore + +# Ignore bundler config. +/.bundle + +# Ignore all environment files. +/.env* + +# Ignore all default key files. +/config/master.key +/config/credentials/*.key + +# Ignore all logfiles and tempfiles. +/log/* +/tmp/* +!/log/.keep +!/tmp/.keep + +# Ignore pidfiles, but keep the directory. +/tmp/pids/* +!/tmp/pids/.keep + +# Ignore storage (uploaded files in development and any SQLite databases). +/storage/* +!/storage/.keep +/tmp/storage/* +!/tmp/storage/.keep + +# Ignore assets. +/node_modules/ +/app/assets/builds/* +!/app/assets/builds/.keep +/public/assets + +# Ignore CI service files. +/.github + +# Ignore Kamal files. +/config/deploy*.yml +/.kamal + +# Ignore development files +/.devcontainer + +# Ignore Docker-related files +/.dockerignore +/Dockerfile* diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 000000000..8dc432343 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,9 @@ +# See https://git-scm.com/docs/gitattributes for more about git attribute files. + +# Mark the database schema as having been generated. +db/schema.rb linguist-generated + +# Mark any vendored files as having been vendored. +vendor/* linguist-vendored +config/credentials/*.yml.enc diff=rails_credentials +config/credentials.yml.enc diff=rails_credentials diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..83610cfa4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: +- package-ecosystem: bundler + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 +- package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 10 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 000000000..d58c2aa4c --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,67 @@ +name: CI + +on: + pull_request: + push: + branches: [ main ] + +jobs: + scan_ruby: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Scan for common Rails security vulnerabilities using static analysis + run: bin/brakeman --no-pager + + - name: Scan for known security vulnerabilities in gems used + run: bin/bundler-audit + + scan_js: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Scan for security vulnerabilities in JavaScript dependencies + run: bin/importmap audit + + lint: + runs-on: ubuntu-latest + env: + RUBOCOP_CACHE_ROOT: tmp/rubocop + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + + - name: Prepare RuboCop cache + uses: actions/cache@v4 + env: + DEPENDENCIES_HASH: ${{ hashFiles('.ruby-version', '**/.rubocop.yml', '**/.rubocop_todo.yml', 'Gemfile.lock') }} + with: + path: ${{ env.RUBOCOP_CACHE_ROOT }} + key: rubocop-${{ runner.os }}-${{ env.DEPENDENCIES_HASH }}-${{ github.ref_name == github.event.repository.default_branch && github.run_id || 'default' }} + restore-keys: | + rubocop-${{ runner.os }}-${{ env.DEPENDENCIES_HASH }}- + + - name: Lint code for consistent style + run: bin/rubocop -f github + diff --git a/.gitignore b/.gitignore new file mode 100644 index 000000000..613894f9d --- /dev/null +++ b/.gitignore @@ -0,0 +1,40 @@ +# See https://help.github.com/articles/ignoring-files for more about ignoring files. +# +# Temporary files generated by your text editor or operating system +# belong in git's global ignore instead: +# `$XDG_CONFIG_HOME/git/ignore` or `~/.config/git/ignore` + +# Ignore bundler config. +/.bundle + +# Ignore all environment files. +/.env* + +# Ignore all logfiles and tempfiles. +/log/* +/tmp/* +!/log/.keep +!/tmp/.keep + +# Ignore pidfiles, but keep the directory. +/tmp/pids/* +!/tmp/pids/ +!/tmp/pids/.keep + +# Ignore storage (uploaded files in development and any SQLite databases). +/storage/* +!/storage/.keep +/tmp/storage/* +!/tmp/storage/ +!/tmp/storage/.keep + +/public/assets + +# Ignore key files for decrypting credentials and more. +/config/*.key + +# Test coverage reports +/coverage/ + +/app/assets/builds/* +!/app/assets/builds/.keep diff --git a/.rubocop.yml b/.rubocop.yml new file mode 100644 index 000000000..aecf2a4cb --- /dev/null +++ b/.rubocop.yml @@ -0,0 +1,41 @@ +# Omakase Ruby styling for Rails, with stricter additions for this project. +inherit_gem: { rubocop-rails-omakase: rubocop.yml } + +plugins: + - rubocop-rails + - rubocop-minitest + - rubocop-performance + +AllCops: + NewCops: enable + Exclude: + - "db/schema.rb" + - "db/*_schema.rb" + - "bin/**/*" + - "vendor/**/*" + - "node_modules/**/*" + - "tmp/**/*" + - "storage/**/*" + +Layout/LineLength: + Max: 120 + AllowedPatterns: + - '\A\s*#' + +Metrics/MethodLength: + Max: 25 + +Metrics/ClassLength: + Max: 150 + +Metrics/AbcSize: + Max: 30 + +Style/Documentation: + Enabled: false + +Rails/I18nLocaleTexts: + Enabled: false + +Minitest/MultipleAssertions: + Max: 8 diff --git a/.ruby-version b/.ruby-version new file mode 100644 index 000000000..1cf76f52b --- /dev/null +++ b/.ruby-version @@ -0,0 +1 @@ +ruby-4.0.6 diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..b47c9822b --- /dev/null +++ b/Dockerfile @@ -0,0 +1,77 @@ +# syntax=docker/dockerfile:1 +# check=error=true + +# This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand: +# docker build -t umanni_users . +# docker run -d -p 80:80 -e RAILS_MASTER_KEY= --name umanni_users umanni_users + +# For a containerized dev environment, see Dev Containers: https://guides.rubyonrails.org/getting_started_with_devcontainer.html + +# Make sure RUBY_VERSION matches the Ruby version in .ruby-version +ARG RUBY_VERSION=4.0.6 +FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base + +# Rails app lives here +WORKDIR /rails + +# Install base packages +RUN apt-get update -qq && \ + apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 && \ + ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \ + rm -rf /var/lib/apt/lists /var/cache/apt/archives + +# Set production environment variables and enable jemalloc for reduced memory usage and latency. +ENV RAILS_ENV="production" \ + BUNDLE_DEPLOYMENT="1" \ + BUNDLE_PATH="/usr/local/bundle" \ + BUNDLE_WITHOUT="development" \ + LD_PRELOAD="/usr/local/lib/libjemalloc.so" + +# Throw-away build stage to reduce size of final image +FROM base AS build + +# Install packages needed to build gems +RUN apt-get update -qq && \ + apt-get install --no-install-recommends -y build-essential git libvips libyaml-dev pkg-config && \ + rm -rf /var/lib/apt/lists /var/cache/apt/archives + +# Install application gems +COPY vendor/* ./vendor/ +COPY Gemfile Gemfile.lock ./ + +RUN bundle install && \ + rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \ + # -j 1 disable parallel compilation to avoid a QEMU bug: https://github.com/rails/bootsnap/issues/495 + bundle exec bootsnap precompile -j 1 --gemfile + +# Copy application code +COPY . . + +# Precompile bootsnap code for faster boot times. +# -j 1 disable parallel compilation to avoid a QEMU bug: https://github.com/rails/bootsnap/issues/495 +RUN bundle exec bootsnap precompile -j 1 app/ lib/ + +# Precompiling assets for production without requiring secret RAILS_MASTER_KEY +RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile + + + + +# Final stage for app image +FROM base + +# Run and own only the runtime files as a non-root user for security +RUN groupadd --system --gid 1000 rails && \ + useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash +USER 1000:1000 + +# Copy built artifacts: gems, application +COPY --chown=rails:rails --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}" +COPY --chown=rails:rails --from=build /rails /rails + +# Entrypoint prepares the database. +ENTRYPOINT ["/rails/bin/docker-entrypoint"] + +# Start server via Thruster by default, this can be overwritten at runtime +EXPOSE 80 +CMD ["./bin/thrust", "./bin/rails", "server"] diff --git a/Gemfile b/Gemfile new file mode 100644 index 000000000..1a62b6ee6 --- /dev/null +++ b/Gemfile @@ -0,0 +1,74 @@ +source "https://rubygems.org" + +# Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main" +gem "rails", "~> 8.1.3", ">= 8.1.3.1" +# The modern asset pipeline for Rails [https://github.com/rails/propshaft] +gem "propshaft" +# Use sqlite3 as the database for Active Record +gem "sqlite3", ">= 2.1" +# Use the Puma web server [https://github.com/puma/puma] +gem "puma", ">= 5.0" +# Use JavaScript with ESM import maps [https://github.com/rails/importmap-rails] +gem "importmap-rails" +# Hotwire's SPA-like page accelerator [https://turbo.hotwired.dev] +gem "turbo-rails" +# Hotwire's modest JavaScript framework [https://stimulus.hotwired.dev] +gem "stimulus-rails" +# Use Tailwind CSS [https://github.com/rails/tailwindcss-rails] +gem "tailwindcss-rails" + +# Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword] +gem "bcrypt", "~> 3.1.7" + +# Spreadsheet import (.csv/.xlsx) +gem "csv" +gem "roo", "~> 2.10" + +# Windows does not include zoneinfo files, so bundle the tzinfo-data gem +gem "tzinfo-data", platforms: %i[ windows jruby ] + +# Use the database-backed adapters for Rails.cache, Active Job, and Action Cable +gem "solid_cache" +gem "solid_queue" +gem "solid_cable" + +# Reduces boot times through caching; required in config/boot.rb +gem "bootsnap", require: false + +# Deploy this application anywhere as a Docker container [https://kamal-deploy.org] +gem "kamal", require: false + +# Add HTTP asset caching/compression and X-Sendfile acceleration to Puma [https://github.com/basecamp/thruster/] +gem "thruster", require: false + +# Use Active Storage variants [https://guides.rubyonrails.org/active_storage_overview.html#transforming-images] +gem "image_processing", "~> 1.2" + +group :development, :test do + # See https://guides.rubyonrails.org/debugging_rails_applications.html#debugging-with-the-debug-gem + gem "debug", platforms: %i[ mri windows ], require: "debug/prelude" + + # Audits gems for known security defects (use config/bundler-audit.yml to ignore issues) + gem "bundler-audit", require: false + + # Static analysis for security vulnerabilities [https://brakemanscanner.org/] + gem "brakeman", require: false + + # Omakase Ruby styling [https://github.com/rails/rubocop-rails-omakase/] + gem "rubocop-rails-omakase", require: false + gem "rubocop-rails", require: false + gem "rubocop-minitest", require: false + gem "rubocop-performance", require: false + + gem "simplecov", require: false +end + +group :development do + # Use console on exceptions pages [https://github.com/rails/web-console] + gem "web-console" +end + +group :test do + gem "capybara" + gem "selenium-webdriver" +end diff --git a/Gemfile.lock b/Gemfile.lock new file mode 100644 index 000000000..e3ed40589 --- /dev/null +++ b/Gemfile.lock @@ -0,0 +1,586 @@ +GEM + remote: https://rubygems.org/ + specs: + action_text-trix (2.1.19) + railties + actioncable (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) + nio4r (~> 2.0) + websocket-driver (>= 0.6.1) + zeitwerk (~> 2.6) + actionmailbox (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + mail (>= 2.8.0) + actionmailer (8.1.3.1) + actionpack (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activesupport (= 8.1.3.1) + mail (>= 2.8.0) + rails-dom-testing (~> 2.2) + actionpack (8.1.3.1) + actionview (= 8.1.3.1) + activesupport (= 8.1.3.1) + nokogiri (>= 1.8.5) + rack (>= 2.2.4) + rack-session (>= 1.0.1) + rack-test (>= 0.6.3) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + useragent (~> 0.16) + actiontext (8.1.3.1) + action_text-trix (~> 2.1.15) + actionpack (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + globalid (>= 0.6.0) + nokogiri (>= 1.8.5) + actionview (8.1.3.1) + activesupport (= 8.1.3.1) + builder (~> 3.1) + erubi (~> 1.11) + rails-dom-testing (~> 2.2) + rails-html-sanitizer (~> 1.6) + activejob (8.1.3.1) + activesupport (= 8.1.3.1) + globalid (>= 0.3.6) + activemodel (8.1.3.1) + activesupport (= 8.1.3.1) + activerecord (8.1.3.1) + activemodel (= 8.1.3.1) + activesupport (= 8.1.3.1) + timeout (>= 0.4.0) + activestorage (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activesupport (= 8.1.3.1) + marcel (~> 1.0) + activesupport (8.1.3.1) + base64 + bigdecimal + concurrent-ruby (~> 1.0, >= 1.3.1) + connection_pool (>= 2.2.5) + drb + i18n (>= 1.6, < 2) + json + logger (>= 1.4.2) + minitest (>= 5.1) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) + uri (>= 0.13.1) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + ast (2.4.3) + base64 (0.3.0) + bcrypt (3.1.22) + bcrypt_pbkdf (1.1.2) + bigdecimal (4.1.2) + bindex (0.8.1) + bootsnap (1.25.0) + msgpack (~> 1.5) + brakeman (8.0.6) + racc + builder (3.3.0) + bundler-audit (0.9.3) + bundler (>= 1.2.0) + thor (~> 1.0) + capybara (3.40.0) + addressable + matrix + mini_mime (>= 0.1.3) + nokogiri (~> 1.11) + rack (>= 1.6.0) + rack-test (>= 0.6.3) + regexp_parser (>= 1.5, < 3.0) + xpath (~> 3.2) + concurrent-ruby (1.3.8) + connection_pool (3.0.2) + crass (1.0.7) + csv (3.3.6) + date (3.5.1) + debug (1.11.1) + irb (~> 1.10) + reline (>= 0.3.8) + dotenv (3.2.0) + drb (2.2.3) + ed25519 (1.4.0) + erb (6.0.7) + erubi (1.13.1) + et-orbi (1.4.2) + tzinfo + ffi (1.17.4-aarch64-linux-gnu) + ffi (1.17.4-aarch64-linux-musl) + ffi (1.17.4-arm-linux-gnu) + ffi (1.17.4-arm-linux-musl) + ffi (1.17.4-x86_64-linux-gnu) + ffi (1.17.4-x86_64-linux-musl) + fugit (1.13.0) + et-orbi (~> 1.4) + raabro (~> 1.4) + globalid (1.4.0) + activesupport (>= 6.1) + i18n (1.15.2) + concurrent-ruby (~> 1.0) + image_processing (1.14.0) + mini_magick (>= 4.9.5, < 6) + ruby-vips (>= 2.0.17, < 3) + importmap-rails (2.2.3) + actionpack (>= 6.0.0) + activesupport (>= 6.0.0) + railties (>= 6.0.0) + io-console (0.9.2) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) + json (2.21.2) + kamal (2.12.0) + activesupport (>= 7.0) + base64 (~> 0.2) + bcrypt_pbkdf (~> 1.0) + concurrent-ruby (~> 1.2) + dotenv (~> 3.1) + ed25519 (~> 1.4) + net-ssh (~> 7.3) + sshkit (>= 1.23.0, < 2.0) + thor (~> 1.3) + zeitwerk (>= 2.6.18, < 3.0) + language_server-protocol (3.17.0.6) + lint_roller (1.1.0) + logger (1.7.0) + loofah (2.25.2) + crass (~> 1.0.2) + nokogiri (>= 1.12.0) + mail (2.9.1) + logger + mini_mime (>= 0.1.1) + net-imap + net-pop + net-smtp + marcel (1.2.1) + matrix (0.4.3) + mini_magick (5.4.0) + logger + mini_mime (1.1.5) + minitest (6.0.6) + drb (~> 2.0) + prism (~> 1.5) + msgpack (1.8.4) + net-imap (0.6.6) + date + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.3.0) + timeout + net-scp (4.1.0) + net-ssh (>= 2.6.5, < 8.0.0) + net-sftp (4.0.0) + net-ssh (>= 5.0.0, < 8.0.0) + net-smtp (0.5.1) + net-protocol + net-ssh (7.3.3) + nio4r (2.7.5) + nokogiri (1.19.4-aarch64-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-aarch64-linux-musl) + racc (~> 1.4) + nokogiri (1.19.4-arm-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-arm-linux-musl) + racc (~> 1.4) + nokogiri (1.19.4-x86_64-linux-gnu) + racc (~> 1.4) + nokogiri (1.19.4-x86_64-linux-musl) + racc (~> 1.4) + ostruct (0.6.3) + parallel (2.1.0) + parser (3.3.12.0) + ast (~> 2.4.1) + racc + pp (0.6.4) + prettyprint + prettyprint (0.2.0) + prism (1.9.0) + propshaft (1.3.2) + actionpack (>= 7.0.0) + activesupport (>= 7.0.0) + rack + public_suffix (7.0.5) + puma (8.0.2) + nio4r (~> 2.0) + raabro (1.5.0) + racc (1.8.1) + rack (3.2.7) + rack-session (2.1.2) + base64 (>= 0.1.0) + rack (>= 3.0.0) + rack-test (2.2.0) + rack (>= 1.3) + rackup (2.3.1) + rack (>= 3) + rails (8.1.3.1) + actioncable (= 8.1.3.1) + actionmailbox (= 8.1.3.1) + actionmailer (= 8.1.3.1) + actionpack (= 8.1.3.1) + actiontext (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activemodel (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) + bundler (>= 1.15.0) + railties (= 8.1.3.1) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest + nokogiri (>= 1.6) + rails-html-sanitizer (1.7.1) + loofah (~> 2.25, >= 2.25.2) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) + irb (~> 1.13) + rackup (>= 1.0.0) + rake (>= 12.2) + thor (~> 1.0, >= 1.2.2) + tsort (>= 0.2) + zeitwerk (~> 2.6) + rainbow (3.1.1) + rake (13.4.2) + rbs (4.2.0) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) + erb + prism (>= 1.6.0) + rbs (>= 4.0.0) + tsort + regexp_parser (2.12.0) + reline (0.7.0) + io-console (~> 0.5) + rexml (3.4.4) + roo (2.10.1) + nokogiri (~> 1) + rubyzip (>= 1.3.0, < 3.0.0) + rubocop (1.90.0) + json (>= 2.3) + language_server-protocol (~> 3.17.0.2) + lint_roller (~> 1.1.0) + parallel (>= 1.10) + parser (>= 3.3.0.2) + rainbow (>= 2.2.2, < 4.0) + regexp_parser (>= 2.9.3, < 3.0) + rubocop-ast (>= 1.49.0, < 2.0) + ruby-progressbar (~> 1.7) + unicode-display_width (>= 2.4.0, < 4.0) + rubocop-ast (1.50.0) + parser (>= 3.3.7.2) + prism (~> 1.7) + rubocop-minitest (0.40.0) + lint_roller (~> 1.1) + rubocop (>= 1.75.0, < 2.0) + rubocop-ast (>= 1.38.0, < 2.0) + rubocop-performance (1.27.0) + lint_roller (~> 1.1) + rubocop (>= 1.89.0, < 2.0) + rubocop-ast (>= 1.47.1, < 2.0) + rubocop-rails (2.37.0) + activesupport (>= 4.2.0) + lint_roller (~> 1.1) + rack (>= 1.1) + rubocop (>= 1.89.0, < 2.0) + rubocop-ast (>= 1.44.0, < 2.0) + rubocop-rails-omakase (1.1.0) + rubocop (>= 1.72) + rubocop-performance (>= 1.24) + rubocop-rails (>= 2.30) + ruby-progressbar (1.13.0) + ruby-vips (2.3.0) + ffi (~> 1.12) + logger + rubyzip (2.4.1) + securerandom (0.4.1) + selenium-webdriver (4.48.0) + base64 (~> 0.2) + logger (~> 1.4) + rexml (~> 3.2, >= 3.2.5) + rubyzip (>= 1.2.2, < 4.0) + websocket (~> 1.0) + simplecov (1.1.1) + solid_cable (4.0.2) + actioncable (>= 7.2) + activejob (>= 7.2) + activerecord (>= 7.2) + railties (>= 7.2) + solid_cache (1.0.10) + activejob (>= 7.2) + activerecord (>= 7.2) + railties (>= 7.2) + solid_queue (1.7.0) + activejob (>= 7.1) + activerecord (>= 7.1) + concurrent-ruby (>= 1.3.1) + fugit (~> 1.11) + railties (>= 7.1) + thor (>= 1.3.1) + sqlite3 (2.9.6-aarch64-linux-gnu) + sqlite3 (2.9.6-aarch64-linux-musl) + sqlite3 (2.9.6-arm-linux-gnu) + sqlite3 (2.9.6-arm-linux-musl) + sqlite3 (2.9.6-x86_64-linux-gnu) + sqlite3 (2.9.6-x86_64-linux-musl) + sshkit (1.25.1) + base64 + logger + net-scp (>= 1.1.2) + net-sftp (>= 2.1.2) + net-ssh (>= 2.8.0) + ostruct + stimulus-rails (1.3.4) + railties (>= 6.0.0) + tailwindcss-rails (4.6.0) + railties (>= 7.0.0) + tailwindcss-ruby (~> 4.0) + tailwindcss-ruby (4.3.3) + tailwindcss-ruby (4.3.3-aarch64-linux-gnu) + tailwindcss-ruby (4.3.3-aarch64-linux-musl) + tailwindcss-ruby (4.3.3-x86_64-linux-gnu) + tailwindcss-ruby (4.3.3-x86_64-linux-musl) + thor (1.5.0) + thruster (0.1.26) + thruster (0.1.26-aarch64-linux) + thruster (0.1.26-x86_64-linux) + timeout (0.6.1) + tsort (0.2.0) + turbo-rails (2.0.23) + actionpack (>= 7.1.0) + railties (>= 7.1.0) + tzinfo (2.0.6) + concurrent-ruby (~> 1.0) + unicode-display_width (3.2.0) + unicode-emoji (~> 4.1) + unicode-emoji (4.2.0) + uri (1.1.1) + useragent (0.16.11) + web-console (4.3.0) + actionview (>= 8.0.0) + bindex (>= 0.4.0) + railties (>= 8.0.0) + websocket (1.2.11) + websocket-driver (0.8.2) + base64 + websocket-extensions (>= 0.1.0) + websocket-extensions (0.1.5) + xpath (3.2.0) + nokogiri (~> 1.8) + zeitwerk (2.8.3) + +PLATFORMS + aarch64-linux + aarch64-linux-gnu + aarch64-linux-musl + arm-linux-gnu + arm-linux-musl + x86_64-linux + x86_64-linux-gnu + x86_64-linux-musl + +DEPENDENCIES + bcrypt (~> 3.1.7) + bootsnap + brakeman + bundler-audit + capybara + csv + debug + image_processing (~> 1.2) + importmap-rails + kamal + propshaft + puma (>= 5.0) + rails (~> 8.1.3, >= 8.1.3.1) + roo (~> 2.10) + rubocop-minitest + rubocop-performance + rubocop-rails + rubocop-rails-omakase + selenium-webdriver + simplecov + solid_cable + solid_cache + solid_queue + sqlite3 (>= 2.1) + stimulus-rails + tailwindcss-rails + thruster + turbo-rails + tzinfo-data + web-console + +CHECKSUMS + action_text-trix (2.1.19) sha256=7012f59421009cf284aa651294896414d653a61a2417c9b8714c8476d2f74009 + actioncable (8.1.3.1) sha256=e318528295c878a3efdfe25f0f2267c80cb7a76eba41bb5f64d44aa380a3d91b + actionmailbox (8.1.3.1) sha256=5f704972097d843ade8e435e93694a1dac732b926df1717aceba1f3840082b1c + actionmailer (8.1.3.1) sha256=88ea441b28ff02a0c6c006468892642a3d9942affce9d294e81a74504aa5c43c + actionpack (8.1.3.1) sha256=974cb7154548e81f470b1b0f247b99cb38e87825899dca58610596e2817723d0 + actiontext (8.1.3.1) sha256=5da729d833d1a29cddb1eee938878e55e503d2613e00e735f5daf58c2ba98af2 + actionview (8.1.3.1) sha256=2da68b8414c47b43bfbed1ce69c5afe1c04f78c267aacb5660a4cab5ca12cfb6 + activejob (8.1.3.1) sha256=1c8dd275df930df40deecffec63d913a550a33fd94bd298f69721dd96939954a + activemodel (8.1.3.1) sha256=99cc02ce2faec371d14440949d85787ebd23a907c9baef0a9d4bcd4d21888f88 + activerecord (8.1.3.1) sha256=0a2fb6c28f4938f6b013a3a549bec0a7e37d535f3dc8990e804bcc3258c0403b + activestorage (8.1.3.1) sha256=f555254f387b1cffa499d2fd3115d12635eadc5b15206a8534316a67036163ef + activesupport (8.1.3.1) sha256=85458765f25ea48b9019c46b6bb3fa5683197bf4280d9f06710a6e8d7a831376 + addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af + ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383 + base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b + bcrypt (3.1.22) sha256=1f0072e88c2d705d94aff7f2c5cb02eb3f1ec4b8368671e19112527489f29032 + bcrypt_pbkdf (1.1.2) sha256=c2414c23ce66869b3eb9f643d6a3374d8322dfb5078125c82792304c10b94cf6 + bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd + bindex (0.8.1) sha256=7b1ecc9dc539ed8bccfc8cb4d2732046227b09d6f37582ff12e50a5047ceb17e + bootsnap (1.25.0) sha256=41059e7d0f9cb4023a33465d095f64b913fc9d1b808d6524c307da945fbcffcf + brakeman (8.0.6) sha256=759cc69341115e6c2dcd47b6fd8649a0b9bd540e3585ac8a0a94e31c66fee386 + builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f + bundler-audit (0.9.3) sha256=81c8766c71e47d0d28a0f98c7eed028539f21a6ea3cd8f685eb6f42333c9b4e9 + capybara (3.40.0) sha256=42dba720578ea1ca65fd7a41d163dd368502c191804558f6e0f71b391054aeef + concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1 + connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a + crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295 + csv (3.3.6) sha256=aba61e7e507a66f03d45cb1f3c4b6359861c3504038b422962875dce099e4456 + date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0 + debug (1.11.1) sha256=2e0b0ac6119f2207a6f8ac7d4a73ca8eb4e440f64da0a3136c30343146e952b6 + dotenv (3.2.0) sha256=e375b83121ea7ca4ce20f214740076129ab8514cd81378161f11c03853fe619d + drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373 + ed25519 (1.4.0) sha256=16e97f5198689a154247169f3453ef4cfd3f7a47481fde0ae33206cdfdcac506 + erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92 + erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9 + et-orbi (1.4.2) sha256=bb555dae668419cb24caa2a293a170e58be6d4df1e017c51f5030bdc133cd20c + ffi (1.17.4-aarch64-linux-gnu) sha256=b208f06f91ffd8f5e1193da3cae3d2ccfc27fc36fba577baf698d26d91c080df + ffi (1.17.4-aarch64-linux-musl) sha256=9286b7a615f2676245283aef0a0a3b475ae3aae2bb5448baace630bb77b91f39 + ffi (1.17.4-arm-linux-gnu) sha256=d6dbddf7cb77bf955411af5f187a65b8cd378cb003c15c05697f5feee1cb1564 + ffi (1.17.4-arm-linux-musl) sha256=9d4838ded0465bef6e2426935f6bcc93134b6616785a84ffd2a3d82bc3cf6f95 + ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d + ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e + fugit (1.13.0) sha256=a4f093fce740da52f216740a5041e2a594ea763cdb89e8b2754ca4399634ab18 + globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427 + i18n (1.15.2) sha256=00f9eb62412fe593b2a65a97daa75300d37abb8f7202ec748e94b6d46a9dd1b5 + image_processing (1.14.0) sha256=754cc169c9c262980889bec6bfd325ed1dafad34f85242b5a07b60af004742fb + importmap-rails (2.2.3) sha256=7101be2a4dc97cf1558fb8f573a718404c5f6bcfe94f304bf1f39e444feeb16a + io-console (0.9.2) sha256=efa74f891dd03c0939a931dfc6e74c2813d904763d456ea9762b0525e748db08 + irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3 + json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a + kamal (2.12.0) sha256=c51d1ab085e515470f98d0c0f043637122b5ebf76e8b610cb1fbbed0b7f9b8fa + language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0 + lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87 + logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203 + loofah (2.25.2) sha256=2007f746959ac65552456e04b433e83deb22759ab38c838b4445c70e43425918 + mail (2.9.1) sha256=06574eca475253d6c18145dd70af80d0eb970182d55053497c5f4d797ea160e8 + marcel (1.2.1) sha256=1678e9360e32f9eafa917c80029e2f6d10b2715c66a4b87b6d0da9b9cd1f859f + matrix (0.4.3) sha256=a0d5ab7ddcc1973ff690ab361b67f359acbb16958d1dc072b8b956a286564c5b + mini_magick (5.4.0) sha256=f120af581d9ed4ec52c57f35a67a605d112bb1d8f582d1415b147fda42d11d78 + mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef + minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1 + msgpack (1.8.4) sha256=4411c22d350dd1c20250f7eada3cca2695438c2f769cf0782f0cd065d90a3e7b + net-imap (0.6.6) sha256=96aa4ee50df3060203e649efc341f53480b791d49e150f2fdebf68beb141a8df + net-pop (0.1.2) sha256=848b4e982013c15b2f0382792268763b748cce91c9e91e36b0f27ed26420dff3 + net-protocol (0.3.0) sha256=ba310c3d4f1cad46bb1ab20336b06669b1ff8f7c568d9cb9342b32a718547472 + net-scp (4.1.0) sha256=a99b0b92a1e5d360b0de4ffbf2dc0c91531502d3d4f56c28b0139a7c093d1a5d + net-sftp (4.0.0) sha256=65bb91c859c2f93b09826757af11b69af931a3a9155050f50d1b06d384526364 + net-smtp (0.5.1) sha256=ed96a0af63c524fceb4b29b0d352195c30d82dd916a42f03c62a3a70e5b70736 + net-ssh (7.3.3) sha256=831def58b2c51dcef66ec00d29397d4f210de89c19fe78f95873ca30f386e86a + nio4r (2.7.5) sha256=6c90168e48fb5f8e768419c93abb94ba2b892a1d0602cb06eef16d8b7df1dca1 + nokogiri (1.19.4-aarch64-linux-gnu) sha256=1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f + nokogiri (1.19.4-aarch64-linux-musl) sha256=35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af + nokogiri (1.19.4-arm-linux-gnu) sha256=a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca + nokogiri (1.19.4-arm-linux-musl) sha256=588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb + nokogiri (1.19.4-x86_64-linux-gnu) sha256=379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a + nokogiri (1.19.4-x86_64-linux-musl) sha256=17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b + ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912 + parallel (2.1.0) sha256=b35258865c2e31134c5ecb708beaaf6772adf9d5efae28e93e99260877b09356 + parser (3.3.12.0) sha256=21a6d7f755d5a24dfbdc6e6b772e4e879a52e7631a88bc5a3a134606052c9828 + pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570 + prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193 + prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85 + propshaft (1.3.2) sha256=1d56a3e56a92c21bfc29caf07406b5386b00d4c47ddf357cf989a5a234b1389e + public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623 + puma (8.0.2) sha256=c8ed871dfbbe66448ea9ffd46692342d9804d4071522b52b5331b7b6e7b686fb + raabro (1.5.0) sha256=3f998a7bc84f9c84df3ab580634d2e0a5bda4f0841168d56035f529c9877440a + racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f + rack (3.2.7) sha256=93e13e1c24f93556671d85d2d79fa228c3485815c50d7e2f265b5330c6528fb7 + rack-session (2.1.2) sha256=595434f8c0c3473ae7d7ac56ecda6cc6dfd9d37c0b2b5255330aa1576967ffe8 + rack-test (2.2.0) sha256=005a36692c306ac0b4a9350355ee080fd09ddef1148a5f8b2ac636c720f5c463 + rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868 + rails (8.1.3.1) sha256=ccd11a36bfc171bf9c66d585d14c0ece91c0c9dde840aae60c0118d6f5c9c52a + rails-dom-testing (2.3.0) sha256=8acc7953a7b911ca44588bf08737bc16719f431a1cc3091a292bca7317925c1d + rails-html-sanitizer (1.7.1) sha256=e797a7c9b01e567307e317c576b49ab4168017e63eea4dba9ce3cb587e2f22c2 + railties (8.1.3.1) sha256=2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487 + rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a + rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701 + rbs (4.2.0) sha256=51f7b886dcc05bc09e10b901daa6a81829f6adc03101d6ca9ea4aac6103e0674 + rdoc (8.0.0) sha256=03bf8c08a9639658855a0cfd77c0abca8325c227693f7f33f82957811348c469 + regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb + reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d + rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142 + roo (2.10.1) sha256=cbb43bc955f9c110e74b721c835fb9bd3515b63af88ec709ac87fbf30f8be70e + rubocop (1.90.0) sha256=9eb4c065b5c5154e4ef554c547972f3905a9eb6b53e657e580b6796b54bf8242 + rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db + rubocop-minitest (0.40.0) sha256=353c698199115f12151144cf0b5a96f69bb9d77b660cf6536df2c4250c672a9d + rubocop-performance (1.27.0) sha256=eeeb1374d062a368ee1c787b70eb0b0cc4b184cb1f8565f424760946146d61ce + rubocop-rails (2.37.0) sha256=6e1645add5060e0328f8ddda0d820f55697c591394398bf14bb9dccb62f14b7e + rubocop-rails-omakase (1.1.0) sha256=2af73ac8ee5852de2919abbd2618af9c15c19b512c4cfc1f9a5d3b6ef009109d + ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33 + ruby-vips (2.3.0) sha256=e685ec02c13969912debbd98019e50492e12989282da5f37d05f5471442f5374 + rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615 + securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1 + selenium-webdriver (4.48.0) sha256=0c8376ebc8a0a4879343fe6fe6eccdcea76748611cd25de370b33eded2077a94 + simplecov (1.1.1) sha256=25825ef13f0b2e74694d769817dad6ab8e90131dabdaa666e522fea105521e78 + solid_cable (4.0.2) sha256=084636a67679ad00d23088b33c84047e614bcf41ee559db24b414d83cdc42d03 + solid_cache (1.0.10) sha256=bc05a2fb3ac78a6f43cbb5946679cf9db67dd30d22939ededc385cb93e120d41 + solid_queue (1.7.0) sha256=6566b70b801d1c317c81bba7bcdd5677c019afac584a30374b4164002ca356d3 + sqlite3 (2.9.6-aarch64-linux-gnu) sha256=d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c + sqlite3 (2.9.6-aarch64-linux-musl) sha256=3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9 + sqlite3 (2.9.6-arm-linux-gnu) sha256=33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec + sqlite3 (2.9.6-arm-linux-musl) sha256=c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33 + sqlite3 (2.9.6-x86_64-linux-gnu) sha256=613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634 + sqlite3 (2.9.6-x86_64-linux-musl) sha256=d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf + sshkit (1.25.1) sha256=be3f10b9d6eb0b44d5eaba3f7cbe41bc6bb894bce4339688ac20124391455b78 + stimulus-rails (1.3.4) sha256=765676ffa1f33af64ce026d26b48e8ffb2e0b94e0f50e9119e11d6107d67cb06 + tailwindcss-rails (4.6.0) sha256=d99512867173d55c5ef8890427682299d8539f550cec1408b3d8667a538bd365 + tailwindcss-ruby (4.3.3) sha256=ee0a64030749862deb501acab4c4aaf5adbee13865746a33299d46d7b5d0952a + tailwindcss-ruby (4.3.3-aarch64-linux-gnu) sha256=c86d6dd3eccc85fe0d792a832b06f2bf3c0a7a83b399308aeb9d8f5725f42a6a + tailwindcss-ruby (4.3.3-aarch64-linux-musl) sha256=72b77ca9edea82383dd09510ab520a122e3cb9f9864ca5b38e27698098d2b899 + tailwindcss-ruby (4.3.3-x86_64-linux-gnu) sha256=2337017ff8b02698480eae1e9637cf01faa0e4824db89d067a13c5a5ee38c9b2 + tailwindcss-ruby (4.3.3-x86_64-linux-musl) sha256=27d478c417bcf73828e5b544744c5bdfd5b5cb54f1a266fc4f185281c32efe6c + thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73 + thruster (0.1.26) sha256=6e45e807086b29d51404841bd1ad493b67cd95892fd65dc5afcdd32e82e94ce8 + thruster (0.1.26-aarch64-linux) sha256=2171cb34928c0250830008f535c4ab2ee57846cc3f5d3e96c3475f7b3de7a541 + thruster (0.1.26-x86_64-linux) sha256=3117a6ee430663f845a0457699fe9a05232dcc6c396e2cc83504de5a223c60e8 + timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb + tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f + turbo-rails (2.0.23) sha256=ee0d90733aafff056cf51ff11e803d65e43cae258cc55f6492020ec1f9f9315f + tzinfo (2.0.6) sha256=8daf828cc77bcf7d63b0e3bdb6caa47e2272dcfaf4fbfe46f8c3a9df087a829b + unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42 + unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f + uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6 + useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844 + web-console (4.3.0) sha256=e13b71301cdfc2093f155b5aa3a622db80b4672d1f2f713119cc7ec7ac6a6da4 + websocket (1.2.11) sha256=b7e7a74e2410b5e85c25858b26b3322f29161e300935f70a0e0d3c35e0462737 + websocket-driver (0.8.2) sha256=97c556b019bf3410b4961002ac501621e9322d3f8a7bc02161a09301cc4c4146 + websocket-extensions (0.1.5) sha256=1c6ba63092cda343eb53fc657110c71c754c56484aad42578495227d717a8241 + xpath (3.2.0) sha256=6dfda79d91bb3b949b947ecc5919f042ef2f399b904013eb3ef6d20dd3a4082e + zeitwerk (2.8.3) sha256=2c85125a8467ce069e20123d1e709a08955c9d29c118c25b46b7b7fafdbb92e5 + +BUNDLED WITH + 4.0.16 diff --git a/Procfile.dev b/Procfile.dev new file mode 100644 index 000000000..c7cf64525 --- /dev/null +++ b/Procfile.dev @@ -0,0 +1,3 @@ +web: bin/rails server +css: bin/rails tailwindcss:watch +jobs: bin/jobs diff --git a/Rakefile b/Rakefile new file mode 100644 index 000000000..9a5ea7383 --- /dev/null +++ b/Rakefile @@ -0,0 +1,6 @@ +# Add your own tasks in files placed in lib/tasks ending in .rake, +# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. + +require_relative "config/application" + +Rails.application.load_tasks diff --git a/app/assets/builds/.keep b/app/assets/builds/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/assets/images/.keep b/app/assets/images/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/assets/stylesheets/application.css b/app/assets/stylesheets/application.css new file mode 100644 index 000000000..fe93333c0 --- /dev/null +++ b/app/assets/stylesheets/application.css @@ -0,0 +1,10 @@ +/* + * This is a manifest file that'll be compiled into application.css. + * + * With Propshaft, assets are served efficiently without preprocessing steps. You can still include + * application-wide styles in this file, but keep in mind that CSS precedence will follow the standard + * cascading order, meaning styles declared later in the document or manifest will override earlier ones, + * depending on specificity. + * + * Consider organizing styles into separate files for maintainability. + */ diff --git a/app/assets/tailwind/application.css b/app/assets/tailwind/application.css new file mode 100644 index 000000000..5a658a7a2 --- /dev/null +++ b/app/assets/tailwind/application.css @@ -0,0 +1,28 @@ +@import url("https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;1,9..40,400&family=Fraunces:opsz,wght@9..144,600;9..144,700&display=swap"); +@import "tailwindcss"; + +@theme { + --font-sans: "DM Sans", ui-sans-serif, system-ui, sans-serif; + --font-display: "Fraunces", ui-serif, Georgia, serif; + --color-ink: #0f172a; + --color-muted: #64748b; + --color-surface: #f8fafc; + --color-accent: #0f766e; + --color-accent-dark: #115e59; +} + +@layer base { + html { + font-family: var(--font-sans); + color: var(--color-ink); + background: + radial-gradient(1200px 600px at 10% -10%, rgba(15, 118, 110, 0.12), transparent 60%), + radial-gradient(900px 500px at 100% 0%, rgba(15, 23, 42, 0.06), transparent 55%), + linear-gradient(180deg, #f8fafc 0%, #eef2f7 100%); + min-height: 100%; + } + + body { + min-height: 100vh; + } +} diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb new file mode 100644 index 000000000..66f1e21b4 --- /dev/null +++ b/app/controllers/application_controller.rb @@ -0,0 +1,10 @@ +class ApplicationController < ActionController::Base + include Authentication + include Authorization + + # Prefer progressive enhancement over hard browser blocks for broader support. + # Documented modern features: CSS nesting, :has(), import maps, and Turbo. + allow_browser versions: { safari: 17, chrome: 110, firefox: 111, opera: 96, ie: false } + + stale_when_importmap_changes +end diff --git a/app/controllers/concerns/.keep b/app/controllers/concerns/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/controllers/concerns/authentication.rb b/app/controllers/concerns/authentication.rb new file mode 100644 index 000000000..263fec4f9 --- /dev/null +++ b/app/controllers/concerns/authentication.rb @@ -0,0 +1,62 @@ +module Authentication + extend ActiveSupport::Concern + + included do + before_action :require_authentication + helper_method :authenticated?, :current_user + end + + class_methods do + def allow_unauthenticated_access(**options) + skip_before_action :require_authentication, **options + end + end + + private + def authenticated? + resume_session + end + + def current_user + Current.user + end + + def require_authentication + resume_session || request_authentication + end + + def resume_session + Current.session ||= find_session_by_cookie + end + + def find_session_by_cookie + Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id] + end + + def request_authentication + session[:return_to_after_authenticating] = request.url + redirect_to new_session_path + end + + def after_authentication_url + session.delete(:return_to_after_authenticating) || default_authenticated_url + end + + def default_authenticated_url + return admin_root_url if Current.user&.admin? + + profile_url + end + + def start_new_session_for(user) + user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session| + Current.session = session + cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax } + end + end + + def terminate_session + Current.session.destroy + cookies.delete(:session_id) + end +end diff --git a/app/controllers/concerns/authorization.rb b/app/controllers/concerns/authorization.rb new file mode 100644 index 000000000..878718c62 --- /dev/null +++ b/app/controllers/concerns/authorization.rb @@ -0,0 +1,23 @@ +module Authorization + extend ActiveSupport::Concern + + class_methods do + def require_admin!(**options) + before_action :require_admin, **options + end + end + + private + + def require_admin + return if Current.user&.admin? + + redirect_to after_authentication_url_for(Current.user), alert: "You are not authorized to access that area." + end + + def after_authentication_url_for(user) + return admin_root_path if user&.admin? + + profile_path + end +end diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb new file mode 100644 index 000000000..6d6e5ea61 --- /dev/null +++ b/app/helpers/application_helper.rb @@ -0,0 +1,54 @@ +module ApplicationHelper + def page_title(title) + content_for(:title) { "#{title} · Umanni Users" } + end + + def flash_class(type) + case type.to_sym + when :notice then "border-emerald-200 bg-emerald-50 text-emerald-900" + when :alert then "border-rose-200 bg-rose-50 text-rose-900" + else "border-slate-200 bg-slate-50 text-slate-900" + end + end + + def role_badge_class(role) + role.to_s == "admin" ? "bg-teal-100 text-teal-800" : "bg-slate-100 text-slate-700" + end + + def avatar_tag(user, size: 40, classes: "") + dimension = "w-[#{size}px] h-[#{size}px]" + if user.avatar_image.attached? + image_tag avatar_image_source(user, size), + class: "#{dimension} rounded-full object-cover #{classes}", + alt: user.full_name + elsif user.avatar_url.present? + image_tag user.avatar_url, + class: "#{dimension} rounded-full object-cover #{classes}", + alt: user.full_name, + loading: "lazy", + referrerpolicy: "no-referrer" + else + content_tag :span, + user.initials, + class: "#{dimension} inline-flex items-center justify-center rounded-full bg-slate-800 text-white text-sm font-semibold #{classes}", + aria: { label: user.full_name } + end + end + + def import_status_class(status) + { + "pending" => "bg-amber-100 text-amber-800", + "processing" => "bg-sky-100 text-sky-800", + "completed" => "bg-emerald-100 text-emerald-800", + "failed" => "bg-rose-100 text-rose-800" + }[status.to_s] || "bg-slate-100 text-slate-700" + end + + private + + def avatar_image_source(user, size) + user.avatar_image.variant(resize_to_fill: [ size * 2, size * 2 ]) + rescue StandardError + user.avatar_image + end +end diff --git a/app/javascript/application.js b/app/javascript/application.js new file mode 100644 index 000000000..0d7b49404 --- /dev/null +++ b/app/javascript/application.js @@ -0,0 +1,3 @@ +// Configure your import map in config/importmap.rb. Read more: https://github.com/rails/importmap-rails +import "@hotwired/turbo-rails" +import "controllers" diff --git a/app/javascript/controllers/application.js b/app/javascript/controllers/application.js new file mode 100644 index 000000000..1213e85c7 --- /dev/null +++ b/app/javascript/controllers/application.js @@ -0,0 +1,9 @@ +import { Application } from "@hotwired/stimulus" + +const application = Application.start() + +// Configure Stimulus development experience +application.debug = false +window.Stimulus = application + +export { application } diff --git a/app/javascript/controllers/index.js b/app/javascript/controllers/index.js new file mode 100644 index 000000000..1156bf836 --- /dev/null +++ b/app/javascript/controllers/index.js @@ -0,0 +1,4 @@ +// Import and register all your controllers from the importmap via controllers/**/*_controller +import { application } from "controllers/application" +import { eagerLoadControllersFrom } from "@hotwired/stimulus-loading" +eagerLoadControllersFrom("controllers", application) diff --git a/app/jobs/application_job.rb b/app/jobs/application_job.rb new file mode 100644 index 000000000..d394c3d10 --- /dev/null +++ b/app/jobs/application_job.rb @@ -0,0 +1,7 @@ +class ApplicationJob < ActiveJob::Base + # Automatically retry jobs that encountered a deadlock + # retry_on ActiveRecord::Deadlocked + + # Most jobs are safe to ignore if the underlying records are no longer available + # discard_on ActiveJob::DeserializationError +end diff --git a/app/mailers/application_mailer.rb b/app/mailers/application_mailer.rb new file mode 100644 index 000000000..3c34c8148 --- /dev/null +++ b/app/mailers/application_mailer.rb @@ -0,0 +1,4 @@ +class ApplicationMailer < ActionMailer::Base + default from: "from@example.com" + layout "mailer" +end diff --git a/app/mailers/passwords_mailer.rb b/app/mailers/passwords_mailer.rb new file mode 100644 index 000000000..4f0ac7fd9 --- /dev/null +++ b/app/mailers/passwords_mailer.rb @@ -0,0 +1,6 @@ +class PasswordsMailer < ApplicationMailer + def reset(user) + @user = user + mail subject: "Reset your password", to: user.email_address + end +end diff --git a/app/models/application_record.rb b/app/models/application_record.rb new file mode 100644 index 000000000..b63caeb8a --- /dev/null +++ b/app/models/application_record.rb @@ -0,0 +1,3 @@ +class ApplicationRecord < ActiveRecord::Base + primary_abstract_class +end diff --git a/app/models/concerns/.keep b/app/models/concerns/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb new file mode 100644 index 000000000..def8d40bd --- /dev/null +++ b/app/views/layouts/application.html.erb @@ -0,0 +1,27 @@ + + + + <%= content_for?(:title) ? yield(:title) : "Umanni Users" %> + + + + + <%= csrf_meta_tags %> + <%= csp_meta_tag %> + <%= yield :head %> + + + + <%= stylesheet_link_tag :app, "data-turbo-track": "reload" %> + <%= javascript_importmap_tags %> + + + + <%= render "shared/navbar" %> + +
+ <%= render "shared/flash" %> + <%= yield %> +
+ + diff --git a/app/views/layouts/mailer.html.erb b/app/views/layouts/mailer.html.erb new file mode 100644 index 000000000..3aac9002e --- /dev/null +++ b/app/views/layouts/mailer.html.erb @@ -0,0 +1,13 @@ + + + + + + + + + <%= yield %> + + diff --git a/app/views/layouts/mailer.text.erb b/app/views/layouts/mailer.text.erb new file mode 100644 index 000000000..37f0bddbd --- /dev/null +++ b/app/views/layouts/mailer.text.erb @@ -0,0 +1 @@ +<%= yield %> diff --git a/app/views/pwa/manifest.json.erb b/app/views/pwa/manifest.json.erb new file mode 100644 index 000000000..f236381b8 --- /dev/null +++ b/app/views/pwa/manifest.json.erb @@ -0,0 +1,22 @@ +{ + "name": "UmanniUsers", + "icons": [ + { + "src": "/icon.png", + "type": "image/png", + "sizes": "512x512" + }, + { + "src": "/icon.png", + "type": "image/png", + "sizes": "512x512", + "purpose": "maskable" + } + ], + "start_url": "/", + "display": "standalone", + "scope": "/", + "description": "UmanniUsers.", + "theme_color": "red", + "background_color": "red" +} diff --git a/app/views/pwa/service-worker.js b/app/views/pwa/service-worker.js new file mode 100644 index 000000000..b3a13fb7b --- /dev/null +++ b/app/views/pwa/service-worker.js @@ -0,0 +1,26 @@ +// Add a service worker for processing Web Push notifications: +// +// self.addEventListener("push", async (event) => { +// const { title, options } = await event.data.json() +// event.waitUntil(self.registration.showNotification(title, options)) +// }) +// +// self.addEventListener("notificationclick", function(event) { +// event.notification.close() +// event.waitUntil( +// clients.matchAll({ type: "window" }).then((clientList) => { +// for (let i = 0; i < clientList.length; i++) { +// let client = clientList[i] +// let clientPath = (new URL(client.url)).pathname +// +// if (clientPath == event.notification.data.path && "focus" in client) { +// return client.focus() +// } +// } +// +// if (clients.openWindow) { +// return clients.openWindow(event.notification.data.path) +// } +// }) +// ) +// }) diff --git a/bin/brakeman b/bin/brakeman new file mode 100755 index 000000000..ace1c9ba0 --- /dev/null +++ b/bin/brakeman @@ -0,0 +1,7 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +ARGV.unshift("--ensure-latest") + +load Gem.bin_path("brakeman", "brakeman") diff --git a/bin/bundler-audit b/bin/bundler-audit new file mode 100755 index 000000000..e2ef22690 --- /dev/null +++ b/bin/bundler-audit @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "bundler/audit/cli" + +ARGV.concat %w[ --config config/bundler-audit.yml ] if ARGV.empty? || ARGV.include?("check") +Bundler::Audit::CLI.start diff --git a/bin/ci b/bin/ci new file mode 100755 index 000000000..4137ad5bb --- /dev/null +++ b/bin/ci @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "active_support/continuous_integration" + +CI = ActiveSupport::ContinuousIntegration +require_relative "../config/ci.rb" diff --git a/bin/dev b/bin/dev new file mode 100755 index 000000000..ad72c7d53 --- /dev/null +++ b/bin/dev @@ -0,0 +1,16 @@ +#!/usr/bin/env sh + +if ! gem list foreman -i --silent; then + echo "Installing foreman..." + gem install foreman +fi + +# Default to port 3000 if not specified +export PORT="${PORT:-3000}" + +# Let the debug gem allow remote connections, +# but avoid loading until `debugger` is called +export RUBY_DEBUG_OPEN="true" +export RUBY_DEBUG_LAZY="true" + +exec foreman start -f Procfile.dev "$@" diff --git a/bin/docker-entrypoint b/bin/docker-entrypoint new file mode 100755 index 000000000..ed31659f4 --- /dev/null +++ b/bin/docker-entrypoint @@ -0,0 +1,8 @@ +#!/bin/bash -e + +# If running the rails server then create or migrate existing database +if [ "${@: -2:1}" == "./bin/rails" ] && [ "${@: -1:1}" == "server" ]; then + ./bin/rails db:prepare +fi + +exec "${@}" diff --git a/bin/importmap b/bin/importmap new file mode 100755 index 000000000..36502ab16 --- /dev/null +++ b/bin/importmap @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby + +require_relative "../config/application" +require "importmap/commands" diff --git a/bin/jobs b/bin/jobs new file mode 100755 index 000000000..dcf59f309 --- /dev/null +++ b/bin/jobs @@ -0,0 +1,6 @@ +#!/usr/bin/env ruby + +require_relative "../config/environment" +require "solid_queue/cli" + +SolidQueue::Cli.start(ARGV) diff --git a/bin/kamal b/bin/kamal new file mode 100755 index 000000000..d9ba27670 --- /dev/null +++ b/bin/kamal @@ -0,0 +1,16 @@ +#!/usr/bin/env ruby +# frozen_string_literal: true + +# +# This file was generated by Bundler. +# +# The application 'kamal' is installed as part of a gem, and +# this file is here to facilitate running it. +# + +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("kamal", "kamal") diff --git a/bin/rails b/bin/rails new file mode 100755 index 000000000..efc037749 --- /dev/null +++ b/bin/rails @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby +APP_PATH = File.expand_path("../config/application", __dir__) +require_relative "../config/boot" +require "rails/commands" diff --git a/bin/rake b/bin/rake new file mode 100755 index 000000000..4fbf10b96 --- /dev/null +++ b/bin/rake @@ -0,0 +1,4 @@ +#!/usr/bin/env ruby +require_relative "../config/boot" +require "rake" +Rake.application.run diff --git a/bin/rubocop b/bin/rubocop new file mode 100755 index 000000000..5a2050471 --- /dev/null +++ b/bin/rubocop @@ -0,0 +1,8 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +# Explicit RuboCop config increases performance slightly while avoiding config confusion. +ARGV.unshift("--config", File.expand_path("../.rubocop.yml", __dir__)) + +load Gem.bin_path("rubocop", "rubocop") diff --git a/bin/setup b/bin/setup new file mode 100755 index 000000000..81be011e8 --- /dev/null +++ b/bin/setup @@ -0,0 +1,35 @@ +#!/usr/bin/env ruby +require "fileutils" + +APP_ROOT = File.expand_path("..", __dir__) + +def system!(*args) + system(*args, exception: true) +end + +FileUtils.chdir APP_ROOT do + # This script is a way to set up or update your development environment automatically. + # This script is idempotent, so that you can run it at any time and get an expectable outcome. + # Add necessary setup steps to this file. + + puts "== Installing dependencies ==" + system("bundle check") || system!("bundle install") + + # puts "\n== Copying sample files ==" + # unless File.exist?("config/database.yml") + # FileUtils.cp "config/database.yml.sample", "config/database.yml" + # end + + puts "\n== Preparing database ==" + system! "bin/rails db:prepare" + system! "bin/rails db:reset" if ARGV.include?("--reset") + + puts "\n== Removing old logs and tempfiles ==" + system! "bin/rails log:clear tmp:clear" + + unless ARGV.include?("--skip-server") + puts "\n== Starting development server ==" + STDOUT.flush # flush the output before exec(2) so that it displays + exec "bin/dev" + end +end diff --git a/bin/thrust b/bin/thrust new file mode 100755 index 000000000..36bde2d83 --- /dev/null +++ b/bin/thrust @@ -0,0 +1,5 @@ +#!/usr/bin/env ruby +require "rubygems" +require "bundler/setup" + +load Gem.bin_path("thruster", "thrust") diff --git a/config.ru b/config.ru new file mode 100644 index 000000000..4a3c09a68 --- /dev/null +++ b/config.ru @@ -0,0 +1,6 @@ +# This file is used by Rack-based servers to start the application. + +require_relative "config/environment" + +run Rails.application +Rails.application.load_server diff --git a/config/application.rb b/config/application.rb new file mode 100644 index 000000000..41294b7cd --- /dev/null +++ b/config/application.rb @@ -0,0 +1,42 @@ +require_relative "boot" + +require "rails" +# Pick the frameworks you want: +require "active_model/railtie" +require "active_job/railtie" +require "active_record/railtie" +require "active_storage/engine" +require "action_controller/railtie" +require "action_mailer/railtie" +# require "action_mailbox/engine" +# require "action_text/engine" +require "action_view/railtie" +require "action_cable/engine" +require "rails/test_unit/railtie" + +# Require the gems listed in Gemfile, including any gems +# you've limited to :test, :development, or :production. +Bundler.require(*Rails.groups) + +module UmanniUsers + class Application < Rails::Application + # Initialize configuration defaults for originally generated Rails version. + config.load_defaults 8.1 + + # Please, add to the `ignore` list any other `lib` subdirectories that do + # not contain `.rb` files, or that should not be reloaded or eager loaded. + # Common ones are `templates`, `generators`, or `middleware`, for example. + config.autoload_lib(ignore: %w[assets tasks]) + + # Configuration for the application, engines, and railties goes here. + # + # These settings can be overridden in specific environments using the files + # in config/environments, which are processed later. + # + # config.time_zone = "Central Time (US & Canada)" + # config.eager_load_paths << Rails.root.join("extras") + + # Don't generate system test files. + # config.generators.system_tests = nil + end +end diff --git a/config/boot.rb b/config/boot.rb new file mode 100644 index 000000000..988a5ddc4 --- /dev/null +++ b/config/boot.rb @@ -0,0 +1,4 @@ +ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__) + +require "bundler/setup" # Set up gems listed in the Gemfile. +require "bootsnap/setup" # Speed up boot time by caching expensive operations. diff --git a/config/bundler-audit.yml b/config/bundler-audit.yml new file mode 100644 index 000000000..e74b3af94 --- /dev/null +++ b/config/bundler-audit.yml @@ -0,0 +1,5 @@ +# Audit all gems listed in the Gemfile for known security problems by running bin/bundler-audit. +# CVEs that are not relevant to the application can be enumerated on the ignore list below. + +ignore: + - CVE-THAT-DOES-NOT-APPLY diff --git a/config/cable.yml b/config/cable.yml new file mode 100644 index 000000000..0eefdf8e9 --- /dev/null +++ b/config/cable.yml @@ -0,0 +1,20 @@ +# Async adapter only works within the same process. +# Development mirrors production with Solid Cable (SQLite-backed, no Redis). +development: + adapter: solid_cable + connects_to: + database: + writing: cable + polling_interval: 0.1.seconds + message_retention: 1.day + +test: + adapter: test + +production: + adapter: solid_cable + connects_to: + database: + writing: cable + polling_interval: 0.1.seconds + message_retention: 1.day diff --git a/config/cache.yml b/config/cache.yml new file mode 100644 index 000000000..19d490843 --- /dev/null +++ b/config/cache.yml @@ -0,0 +1,16 @@ +default: &default + store_options: + # Cap age of oldest cache entry to fulfill retention policies + # max_age: <%= 60.days.to_i %> + max_size: <%= 256.megabytes %> + namespace: <%= Rails.env %> + +development: + <<: *default + +test: + <<: *default + +production: + database: cache + <<: *default diff --git a/config/ci.rb b/config/ci.rb new file mode 100644 index 000000000..239b34398 --- /dev/null +++ b/config/ci.rb @@ -0,0 +1,20 @@ +# Run using bin/ci + +CI.run do + step "Setup", "bin/setup --skip-server" + + step "Style: Ruby", "bin/rubocop" + + step "Security: Gem audit", "bin/bundler-audit" + step "Security: Importmap vulnerability audit", "bin/importmap audit" + step "Security: Brakeman code analysis", "bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error" + + + # Optional: set a green GitHub commit status to unblock PR merge. + # Requires the `gh` CLI and `gh extension install basecamp/gh-signoff`. + # if success? + # step "Signoff: All systems go. Ready for merge and deploy.", "gh signoff" + # else + # failure "Signoff: CI failed. Do not merge or deploy.", "Fix the issues and try again." + # end +end diff --git a/config/database.yml b/config/database.yml new file mode 100644 index 000000000..cc76f3177 --- /dev/null +++ b/config/database.yml @@ -0,0 +1,51 @@ +# SQLite. Versions 3.8.0 and up are supported. +# +# Production-ready WAL mode is enabled via SQLite pragmas for durable concurrent reads. +default: &default + adapter: sqlite3 + max_connections: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> + timeout: 5000 + pragmas: + journal_mode: WAL + synchronous: NORMAL + foreign_keys: true + busy_timeout: 5000 + +development: + primary: + <<: *default + database: storage/development.sqlite3 + queue: + <<: *default + database: storage/development_queue.sqlite3 + migrations_paths: db/queue_migrate + cable: + <<: *default + database: storage/development_cable.sqlite3 + migrations_paths: db/cable_migrate + +# Warning: The database defined as "test" will be erased and +# re-generated from your development database when you run "rake". +# Do not set this db to the same as development or production. +test: + <<: *default + database: storage/test.sqlite3 + +# Store production database in the storage/ directory, which by default +# is mounted as a persistent Docker volume in config/deploy.yml. +production: + primary: + <<: *default + database: storage/production.sqlite3 + cache: + <<: *default + database: storage/production_cache.sqlite3 + migrations_paths: db/cache_migrate + queue: + <<: *default + database: storage/production_queue.sqlite3 + migrations_paths: db/queue_migrate + cable: + <<: *default + database: storage/production_cable.sqlite3 + migrations_paths: db/cable_migrate diff --git a/config/environment.rb b/config/environment.rb new file mode 100644 index 000000000..cac531577 --- /dev/null +++ b/config/environment.rb @@ -0,0 +1,5 @@ +# Load the Rails application. +require_relative "application" + +# Initialize the Rails application. +Rails.application.initialize! diff --git a/config/environments/development.rb b/config/environments/development.rb new file mode 100644 index 000000000..27fe9ba04 --- /dev/null +++ b/config/environments/development.rb @@ -0,0 +1,83 @@ +require "active_support/core_ext/integer/time" + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # Make code changes take effect immediately without server restart. + config.enable_reloading = true + + # Do not eager load code on boot. + config.eager_load = false + + # Show full error reports. + config.consider_all_requests_local = true + + # Enable server timing. + config.server_timing = true + + # Enable/disable Action Controller caching. By default Action Controller caching is disabled. + # Run rails dev:cache to toggle Action Controller caching. + if Rails.root.join("tmp/caching-dev.txt").exist? + config.action_controller.perform_caching = true + config.action_controller.enable_fragment_cache_logging = true + config.public_file_server.headers = { "cache-control" => "public, max-age=#{2.days.to_i}" } + else + config.action_controller.perform_caching = false + end + + # Change to :null_store to avoid any caching. + config.cache_store = :memory_store + + # Store uploaded files on the local file system (see config/storage.yml for options). + config.active_storage.service = :local + + # Don't care if the mailer can't send. + config.action_mailer.raise_delivery_errors = false + + # Make template changes take effect immediately. + config.action_mailer.perform_caching = false + + # Set localhost to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "localhost", port: 3000 } + + # Print deprecation notices to the Rails logger. + config.active_support.deprecation = :log + + # Raise an error on page load if there are pending migrations. + config.active_record.migration_error = :page_load + + # Highlight code that triggered database queries in logs. + config.active_record.verbose_query_logs = true + + # Append comments with runtime information tags to SQL queries in logs. + config.active_record.query_log_tags_enabled = true + + # Highlight code that enqueued background job in logs. + config.active_job.verbose_enqueue_logs = true + + # Use Solid Queue locally so spreadsheet imports mirror production (no Redis). + config.active_job.queue_adapter = :solid_queue + config.solid_queue.connects_to = { database: { writing: :queue } } + config.solid_queue.logger = ActiveSupport::Logger.new($stdout) + + # Highlight code that triggered redirect in logs. + config.action_dispatch.verbose_redirect_logs = true + + # Suppress logger output for asset requests. + config.assets.quiet = true + + # Raises error for missing translations. + # config.i18n.raise_on_missing_translations = true + + # Annotate rendered view with file names. + config.action_view.annotate_rendered_view_with_filenames = true + + # Uncomment if you wish to allow Action Cable access from any origin. + # config.action_cable.disable_request_forgery_protection = true + + # Raise error when a before_action's only/except options reference missing actions. + config.action_controller.raise_on_missing_callback_actions = true + + # Apply autocorrection by RuboCop to files generated by `bin/rails generate`. + # config.generators.apply_rubocop_autocorrect_after_generate! +end diff --git a/config/environments/production.rb b/config/environments/production.rb new file mode 100644 index 000000000..f5763e04e --- /dev/null +++ b/config/environments/production.rb @@ -0,0 +1,90 @@ +require "active_support/core_ext/integer/time" + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # Code is not reloaded between requests. + config.enable_reloading = false + + # Eager load code on boot for better performance and memory savings (ignored by Rake tasks). + config.eager_load = true + + # Full error reports are disabled. + config.consider_all_requests_local = false + + # Turn on fragment caching in view templates. + config.action_controller.perform_caching = true + + # Cache assets for far-future expiry since they are all digest stamped. + config.public_file_server.headers = { "cache-control" => "public, max-age=#{1.year.to_i}" } + + # Enable serving of images, stylesheets, and JavaScripts from an asset server. + # config.asset_host = "http://assets.example.com" + + # Store uploaded files on the local file system (see config/storage.yml for options). + config.active_storage.service = :local + + # Assume all access to the app is happening through a SSL-terminating reverse proxy. + # config.assume_ssl = true + + # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. + # config.force_ssl = true + + # Skip http-to-https redirect for the default health check endpoint. + # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } + + # Log to STDOUT with the current request id as a default log tag. + config.log_tags = [ :request_id ] + config.logger = ActiveSupport::TaggedLogging.logger(STDOUT) + + # Change to "debug" to log everything (including potentially personally-identifiable information!). + config.log_level = ENV.fetch("RAILS_LOG_LEVEL", "info") + + # Prevent health checks from clogging up the logs. + config.silence_healthcheck_path = "/up" + + # Don't log any deprecations. + config.active_support.report_deprecations = false + + # Replace the default in-process memory cache store with a durable alternative. + config.cache_store = :solid_cache_store + + # Replace the default in-process and non-durable queuing backend for Active Job. + config.active_job.queue_adapter = :solid_queue + config.solid_queue.connects_to = { database: { writing: :queue } } + + # Ignore bad email addresses and do not raise email delivery errors. + # Set this to true and configure the email server for immediate delivery to raise delivery errors. + # config.action_mailer.raise_delivery_errors = false + + # Set host to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "example.com" } + + # Specify outgoing SMTP server. Remember to add smtp/* credentials via bin/rails credentials:edit. + # config.action_mailer.smtp_settings = { + # user_name: Rails.application.credentials.dig(:smtp, :user_name), + # password: Rails.application.credentials.dig(:smtp, :password), + # address: "smtp.example.com", + # port: 587, + # authentication: :plain + # } + + # Enable locale fallbacks for I18n (makes lookups for any locale fall back to + # the I18n.default_locale when a translation cannot be found). + config.i18n.fallbacks = true + + # Do not dump schema after migrations. + config.active_record.dump_schema_after_migration = false + + # Only use :id for inspections in production. + config.active_record.attributes_for_inspect = [ :id ] + + # Enable DNS rebinding protection and other `Host` header attacks. + # config.hosts = [ + # "example.com", # Allow requests from example.com + # /.*\.example\.com/ # Allow requests from subdomains like `www.example.com` + # ] + # + # Skip DNS rebinding protection for the default health check endpoint. + # config.host_authorization = { exclude: ->(request) { request.path == "/up" } } +end diff --git a/config/environments/test.rb b/config/environments/test.rb new file mode 100644 index 000000000..4d6d89004 --- /dev/null +++ b/config/environments/test.rb @@ -0,0 +1,55 @@ +# The test environment is used exclusively to run your application's +# test suite. You never need to work with it otherwise. Remember that +# your test database is "scratch space" for the test suite and is wiped +# and recreated between test runs. Don't rely on the data there! + +Rails.application.configure do + # Settings specified here will take precedence over those in config/application.rb. + + # While tests run files are not watched, reloading is not necessary. + config.enable_reloading = false + + # Eager loading loads your entire application. When running a single test locally, + # this is usually not necessary, and can slow down your test suite. However, it's + # recommended that you enable it in continuous integration systems to ensure eager + # loading is working properly before deploying your code. + config.eager_load = ENV["CI"].present? + + # Configure public file server for tests with cache-control for performance. + config.public_file_server.headers = { "cache-control" => "public, max-age=3600" } + + # Show full error reports. + config.consider_all_requests_local = true + config.cache_store = :null_store + + # Render exception templates for rescuable exceptions and raise for other exceptions. + config.action_dispatch.show_exceptions = :rescuable + + # Disable request forgery protection in test environment. + config.action_controller.allow_forgery_protection = false + + # Store uploaded files on the local file system in a temporary directory. + config.active_storage.service = :test + + # Tell Action Mailer not to deliver emails to the real world. + # The :test delivery method accumulates sent emails in the + # ActionMailer::Base.deliveries array. + config.action_mailer.delivery_method = :test + + # Set host to be used by links generated in mailer templates. + config.action_mailer.default_url_options = { host: "example.com" } + + # Print deprecation notices to the stderr. + config.active_support.deprecation = :stderr + + # Raises error for missing translations. + # config.i18n.raise_on_missing_translations = true + + # Annotate rendered view with file names. + # config.action_view.annotate_rendered_view_with_filenames = true + + # Raise error when a before_action's only/except options reference missing actions. + config.action_controller.raise_on_missing_callback_actions = true + + config.active_job.queue_adapter = :test +end diff --git a/config/importmap.rb b/config/importmap.rb new file mode 100644 index 000000000..909dfc542 --- /dev/null +++ b/config/importmap.rb @@ -0,0 +1,7 @@ +# Pin npm packages by running ./bin/importmap + +pin "application" +pin "@hotwired/turbo-rails", to: "turbo.min.js" +pin "@hotwired/stimulus", to: "stimulus.min.js" +pin "@hotwired/stimulus-loading", to: "stimulus-loading.js" +pin_all_from "app/javascript/controllers", under: "controllers" diff --git a/config/initializers/assets.rb b/config/initializers/assets.rb new file mode 100644 index 000000000..487324424 --- /dev/null +++ b/config/initializers/assets.rb @@ -0,0 +1,7 @@ +# Be sure to restart your server when you modify this file. + +# Version of your assets, change this if you want to expire all your assets. +Rails.application.config.assets.version = "1.0" + +# Add additional assets to the asset load path. +# Rails.application.config.assets.paths << Emoji.images_path diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb new file mode 100644 index 000000000..d51d71397 --- /dev/null +++ b/config/initializers/content_security_policy.rb @@ -0,0 +1,29 @@ +# Be sure to restart your server when you modify this file. + +# Define an application-wide content security policy. +# See the Securing Rails Applications Guide for more information: +# https://guides.rubyonrails.org/security.html#content-security-policy-header + +# Rails.application.configure do +# config.content_security_policy do |policy| +# policy.default_src :self, :https +# policy.font_src :self, :https, :data +# policy.img_src :self, :https, :data +# policy.object_src :none +# policy.script_src :self, :https +# policy.style_src :self, :https +# # Specify URI for violation reports +# # policy.report_uri "/csp-violation-report-endpoint" +# end +# +# # Generate session nonces for permitted importmap, inline scripts, and inline styles. +# config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s } +# config.content_security_policy_nonce_directives = %w(script-src style-src) +# +# # Automatically add `nonce` to `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag` +# # if the corresponding directives are specified in `content_security_policy_nonce_directives`. +# # config.content_security_policy_nonce_auto = true +# +# # Report violations without enforcing the policy. +# # config.content_security_policy_report_only = true +# end diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb new file mode 100644 index 000000000..c0b717f7e --- /dev/null +++ b/config/initializers/filter_parameter_logging.rb @@ -0,0 +1,8 @@ +# Be sure to restart your server when you modify this file. + +# Configure parameters to be partially matched (e.g. passw matches password) and filtered from the log file. +# Use this to limit dissemination of sensitive information. +# See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors. +Rails.application.config.filter_parameters += [ + :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc +] diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb new file mode 100644 index 000000000..3860f659e --- /dev/null +++ b/config/initializers/inflections.rb @@ -0,0 +1,16 @@ +# Be sure to restart your server when you modify this file. + +# Add new inflection rules using the following format. Inflections +# are locale specific, and you may define rules for as many different +# locales as you wish. All of these examples are active by default: +# ActiveSupport::Inflector.inflections(:en) do |inflect| +# inflect.plural /^(ox)$/i, "\\1en" +# inflect.singular /^(ox)en/i, "\\1" +# inflect.irregular "person", "people" +# inflect.uncountable %w( fish sheep ) +# end + +# These inflection rules are supported but not enabled by default: +# ActiveSupport::Inflector.inflections(:en) do |inflect| +# inflect.acronym "RESTful" +# end diff --git a/config/locales/en.yml b/config/locales/en.yml new file mode 100644 index 000000000..6c349ae5e --- /dev/null +++ b/config/locales/en.yml @@ -0,0 +1,31 @@ +# Files in the config/locales directory are used for internationalization and +# are automatically loaded by Rails. If you want to use locales other than +# English, add the necessary files in this directory. +# +# To use the locales, use `I18n.t`: +# +# I18n.t "hello" +# +# In views, this is aliased to just `t`: +# +# <%= t("hello") %> +# +# To use a different locale, set it with `I18n.locale`: +# +# I18n.locale = :es +# +# This would use the information in config/locales/es.yml. +# +# To learn more about the API, please read the Rails Internationalization guide +# at https://guides.rubyonrails.org/i18n.html. +# +# Be aware that YAML interprets the following case-insensitive strings as +# booleans: `true`, `false`, `on`, `off`, `yes`, `no`. Therefore, these strings +# must be quoted to be interpreted as strings. For example: +# +# en: +# "yes": yup +# enabled: "ON" + +en: + hello: "Hello world" diff --git a/config/puma.rb b/config/puma.rb new file mode 100644 index 000000000..38c4b8659 --- /dev/null +++ b/config/puma.rb @@ -0,0 +1,42 @@ +# This configuration file will be evaluated by Puma. The top-level methods that +# are invoked here are part of Puma's configuration DSL. For more information +# about methods provided by the DSL, see https://puma.io/puma/Puma/DSL.html. +# +# Puma starts a configurable number of processes (workers) and each process +# serves each request in a thread from an internal thread pool. +# +# You can control the number of workers using ENV["WEB_CONCURRENCY"]. You +# should only set this value when you want to run 2 or more workers. The +# default is already 1. You can set it to `auto` to automatically start a worker +# for each available processor. +# +# The ideal number of threads per worker depends both on how much time the +# application spends waiting for IO operations and on how much you wish to +# prioritize throughput over latency. +# +# As a rule of thumb, increasing the number of threads will increase how much +# traffic a given process can handle (throughput), but due to CRuby's +# Global VM Lock (GVL) it has diminishing returns and will degrade the +# response time (latency) of the application. +# +# The default is set to 3 threads as it's deemed a decent compromise between +# throughput and latency for the average Rails application. +# +# Any libraries that use a connection pool or another resource pool should +# be configured to provide at least as many connections as the number of +# threads. This includes Active Record's `pool` parameter in `database.yml`. +threads_count = ENV.fetch("RAILS_MAX_THREADS", 3) +threads threads_count, threads_count + +# Specifies the `port` that Puma will listen on to receive requests; default is 3000. +port ENV.fetch("PORT", 3000) + +# Allow puma to be restarted by `bin/rails restart` command. +plugin :tmp_restart + +# Run the Solid Queue supervisor inside of Puma for single-server deployments. +plugin :solid_queue if ENV["SOLID_QUEUE_IN_PUMA"] + +# Specify the PID file. Defaults to tmp/pids/server.pid in development. +# In other environments, only set the PID file if requested. +pidfile ENV["PIDFILE"] if ENV["PIDFILE"] diff --git a/config/queue.yml b/config/queue.yml new file mode 100644 index 000000000..6b1436086 --- /dev/null +++ b/config/queue.yml @@ -0,0 +1,18 @@ +default: &default + dispatchers: + - polling_interval: 1 + batch_size: 500 + workers: + - queues: "*" + threads: 3 + processes: <%= ENV.fetch("JOB_CONCURRENCY", 1) %> + polling_interval: 1 + +development: + <<: *default + +test: + <<: *default + +production: + <<: *default diff --git a/config/recurring.yml b/config/recurring.yml new file mode 100644 index 000000000..b4207f9b0 --- /dev/null +++ b/config/recurring.yml @@ -0,0 +1,15 @@ +# examples: +# periodic_cleanup: +# class: CleanSoftDeletedRecordsJob +# queue: background +# args: [ 1000, { batch_size: 500 } ] +# schedule: every hour +# periodic_cleanup_with_command: +# command: "SoftDeletedRecord.due.delete_all" +# priority: 2 +# schedule: at 5am every day + +production: + clear_solid_queue_finished_jobs: + command: "SolidQueue::Job.clear_finished_in_batches(sleep_between_batches: 0.3)" + schedule: every hour at minute 12 diff --git a/config/routes.rb b/config/routes.rb new file mode 100644 index 000000000..a0542248e --- /dev/null +++ b/config/routes.rb @@ -0,0 +1,20 @@ +Rails.application.routes.draw do + resource :session, only: %i[new create destroy] + resources :passwords, param: :token + resource :registration, only: %i[new create] + resource :profile, only: %i[show edit update destroy] + + namespace :admin do + root to: "dashboard#show" + resources :users do + member do + patch :toggle_role + end + end + resources :imports, only: %i[index create show] + end + + get "up" => "rails/health#show", as: :rails_health_check + + root "home#index" +end diff --git a/config/storage.yml b/config/storage.yml new file mode 100644 index 000000000..927dc537c --- /dev/null +++ b/config/storage.yml @@ -0,0 +1,27 @@ +test: + service: Disk + root: <%= Rails.root.join("tmp/storage") %> + +local: + service: Disk + root: <%= Rails.root.join("storage") %> + +# Use bin/rails credentials:edit to set the AWS secrets (as aws:access_key_id|secret_access_key) +# amazon: +# service: S3 +# access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %> +# secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %> +# region: us-east-1 +# bucket: your_own_bucket-<%= Rails.env %> + +# Remember not to checkin your GCS keyfile to a repository +# google: +# service: GCS +# project: your_project +# credentials: <%= Rails.root.join("path/to/gcs.keyfile") %> +# bucket: your_own_bucket-<%= Rails.env %> + +# mirror: +# service: Mirror +# primary: local +# mirrors: [ amazon, google, microsoft ] diff --git a/db/cable_schema.rb b/db/cable_schema.rb new file mode 100644 index 000000000..23666604a --- /dev/null +++ b/db/cable_schema.rb @@ -0,0 +1,11 @@ +ActiveRecord::Schema[7.1].define(version: 1) do + create_table "solid_cable_messages", force: :cascade do |t| + t.binary "channel", limit: 1024, null: false + t.binary "payload", limit: 536870912, null: false + t.datetime "created_at", null: false + t.integer "channel_hash", limit: 8, null: false + t.index ["channel"], name: "index_solid_cable_messages_on_channel" + t.index ["channel_hash"], name: "index_solid_cable_messages_on_channel_hash" + t.index ["created_at"], name: "index_solid_cable_messages_on_created_at" + end +end diff --git a/db/cache_schema.rb b/db/cache_schema.rb new file mode 100644 index 000000000..81a410d18 --- /dev/null +++ b/db/cache_schema.rb @@ -0,0 +1,12 @@ +ActiveRecord::Schema[7.2].define(version: 1) do + create_table "solid_cache_entries", force: :cascade do |t| + t.binary "key", limit: 1024, null: false + t.binary "value", limit: 536870912, null: false + t.datetime "created_at", null: false + t.integer "key_hash", limit: 8, null: false + t.integer "byte_size", limit: 4, null: false + t.index ["byte_size"], name: "index_solid_cache_entries_on_byte_size" + t.index ["key_hash", "byte_size"], name: "index_solid_cache_entries_on_key_hash_and_byte_size" + t.index ["key_hash"], name: "index_solid_cache_entries_on_key_hash", unique: true + end +end diff --git a/db/queue_schema.rb b/db/queue_schema.rb new file mode 100644 index 000000000..f9a71dabb --- /dev/null +++ b/db/queue_schema.rb @@ -0,0 +1,160 @@ +ActiveRecord::Schema[7.1].define(version: 1) do + create_table "solid_queue_blocked_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.string "concurrency_key", null: false + t.datetime "expires_at", null: false + t.datetime "created_at", null: false + t.index [ "concurrency_key", "priority", "job_id" ], name: "index_solid_queue_blocked_executions_for_release" + t.index [ "expires_at", "concurrency_key" ], name: "index_solid_queue_blocked_executions_for_maintenance" + t.index [ "job_id" ], name: "index_solid_queue_blocked_executions_on_job_id", unique: true + end + + create_table "solid_queue_claimed_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.bigint "process_id" + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_claimed_executions_on_job_id", unique: true + t.index [ "process_id", "job_id" ], name: "index_solid_queue_claimed_executions_on_process_id_and_job_id" + end + + create_table "solid_queue_failed_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.text "error" + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_failed_executions_on_job_id", unique: true + end + + create_table "solid_queue_jobs", force: :cascade do |t| + t.string "queue_name", null: false + t.string "class_name", null: false + t.text "arguments" + t.integer "priority", default: 0, null: false + t.string "active_job_id" + t.datetime "scheduled_at" + t.datetime "finished_at" + t.string "concurrency_key" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.bigint "batch_id" + t.index [ "active_job_id" ], name: "index_solid_queue_jobs_on_active_job_id" + t.index [ "batch_id" ], name: "index_solid_queue_jobs_on_batch_id" + t.index [ "class_name" ], name: "index_solid_queue_jobs_on_class_name" + t.index [ "finished_at" ], name: "index_solid_queue_jobs_on_finished_at" + t.index [ "queue_name", "finished_at" ], name: "index_solid_queue_jobs_for_filtering" + t.index [ "scheduled_at", "finished_at" ], name: "index_solid_queue_jobs_for_alerting" + end + + create_table "solid_queue_pauses", force: :cascade do |t| + t.string "queue_name", null: false + t.datetime "created_at", null: false + t.index [ "queue_name" ], name: "index_solid_queue_pauses_on_queue_name", unique: true + end + + create_table "solid_queue_processes", force: :cascade do |t| + t.string "kind", null: false + t.datetime "last_heartbeat_at", null: false + t.bigint "supervisor_id" + t.integer "pid", null: false + t.string "hostname" + t.text "metadata" + t.datetime "created_at", null: false + t.string "name", null: false + t.index [ "last_heartbeat_at" ], name: "index_solid_queue_processes_on_last_heartbeat_at" + t.index [ "name", "supervisor_id" ], name: "index_solid_queue_processes_on_name_and_supervisor_id", unique: true + t.index [ "supervisor_id" ], name: "index_solid_queue_processes_on_supervisor_id" + end + + create_table "solid_queue_ready_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_ready_executions_on_job_id", unique: true + t.index [ "priority", "job_id" ], name: "index_solid_queue_poll_all" + t.index [ "queue_name", "priority", "job_id" ], name: "index_solid_queue_poll_by_queue" + end + + create_table "solid_queue_recurring_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "task_key", null: false + t.datetime "run_at", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_recurring_executions_on_job_id", unique: true + t.index [ "task_key", "run_at" ], name: "index_solid_queue_recurring_executions_on_task_key_and_run_at", unique: true + end + + create_table "solid_queue_recurring_tasks", force: :cascade do |t| + t.string "key", null: false + t.string "schedule", null: false + t.string "command", limit: 2048 + t.string "class_name" + t.text "arguments" + t.string "queue_name" + t.integer "priority", default: 0 + t.boolean "static", default: true, null: false + t.text "description" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "key" ], name: "index_solid_queue_recurring_tasks_on_key", unique: true + t.index [ "static" ], name: "index_solid_queue_recurring_tasks_on_static" + end + + create_table "solid_queue_scheduled_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.string "queue_name", null: false + t.integer "priority", default: 0, null: false + t.datetime "scheduled_at", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_scheduled_executions_on_job_id", unique: true + t.index [ "scheduled_at", "priority", "job_id" ], name: "index_solid_queue_dispatch_all" + end + + create_table "solid_queue_semaphores", force: :cascade do |t| + t.string "key", null: false + t.integer "value", default: 1, null: false + t.datetime "expires_at", null: false + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "expires_at" ], name: "index_solid_queue_semaphores_on_expires_at" + t.index [ "key", "value" ], name: "index_solid_queue_semaphores_on_key_and_value" + t.index [ "key" ], name: "index_solid_queue_semaphores_on_key", unique: true + end + + create_table "solid_queue_batches", force: :cascade do |t| + t.string "active_job_batch_id" + t.string "description" + t.text "on_finish" + t.text "on_success" + t.text "on_failure" + t.text "metadata" + t.integer "total_jobs", default: 0, null: false + t.integer "completed_jobs", default: 0, null: false + t.integer "failed_jobs", default: 0, null: false + t.datetime "enqueued_at" + t.datetime "finished_at" + t.datetime "failed_at" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + t.index [ "active_job_batch_id" ], name: "index_solid_queue_batches_on_active_job_batch_id", unique: true + t.index [ "finished_at" ], name: "index_solid_queue_batches_on_finished_at" + end + + create_table "solid_queue_batch_executions", force: :cascade do |t| + t.bigint "job_id", null: false + t.bigint "batch_id", null: false + t.datetime "created_at", null: false + t.index [ "job_id" ], name: "index_solid_queue_batch_executions_on_job_id", unique: true + t.index [ "batch_id" ], name: "index_solid_queue_batch_executions_on_batch_id" + end + + add_foreign_key "solid_queue_batch_executions", "solid_queue_batches", column: "batch_id", on_delete: :cascade + add_foreign_key "solid_queue_batch_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_blocked_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_claimed_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_failed_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_ready_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_recurring_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade + add_foreign_key "solid_queue_scheduled_executions", "solid_queue_jobs", column: "job_id", on_delete: :cascade +end diff --git a/lib/tasks/.keep b/lib/tasks/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/log/.keep b/log/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/public/400.html b/public/400.html new file mode 100644 index 000000000..640de0339 --- /dev/null +++ b/public/400.html @@ -0,0 +1,135 @@ + + + + + + + The server cannot process the request due to a client error (400 Bad Request) + + + + + + + + + + + + + +
+
+ +
+
+

The server cannot process the request due to a client error. Please check the request and try again. If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/public/404.html b/public/404.html new file mode 100644 index 000000000..d7f0f1422 --- /dev/null +++ b/public/404.html @@ -0,0 +1,135 @@ + + + + + + + The page you were looking for doesn't exist (404 Not found) + + + + + + + + + + + + + +
+
+ +
+
+

The page you were looking for doesn't exist. You may have mistyped the address or the page may have moved. If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/public/406-unsupported-browser.html b/public/406-unsupported-browser.html new file mode 100644 index 000000000..43d2811e8 --- /dev/null +++ b/public/406-unsupported-browser.html @@ -0,0 +1,135 @@ + + + + + + + Your browser is not supported (406 Not Acceptable) + + + + + + + + + + + + + +
+
+ +
+
+

Your browser is not supported.
Please upgrade your browser to continue.

+
+
+ + + + diff --git a/public/422.html b/public/422.html new file mode 100644 index 000000000..f12fb4aa1 --- /dev/null +++ b/public/422.html @@ -0,0 +1,135 @@ + + + + + + + The change you wanted was rejected (422 Unprocessable Entity) + + + + + + + + + + + + + +
+
+ +
+
+

The change you wanted was rejected. Maybe you tried to change something you didn't have access to. If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/public/500.html b/public/500.html new file mode 100644 index 000000000..e4eb18a75 --- /dev/null +++ b/public/500.html @@ -0,0 +1,135 @@ + + + + + + + We're sorry, but something went wrong (500 Internal Server Error) + + + + + + + + + + + + + +
+
+ +
+
+

We're sorry, but something went wrong.
If you're the application owner check the logs for more information.

+
+
+ + + + diff --git a/public/icon.png b/public/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..c4c9dbfbbd2f7c1421ffd5727188146213abbcef GIT binary patch literal 4166 zcmd6qU;WFw?|v@m)Sk^&NvB8tcujdV-r1b=i(NJxn&7{KTb zX$3(M+3TP2o^#KAo{#tIjl&t~(8D-k004kqPglzn0HFG(Q~(I*AKsD#M*g7!XK0T7 zN6P7j>HcT8rZgKl$v!xr806dyN19Bd4C0x_R*I-a?#zsTvb_89cyhuC&T**i|Rc zq5b8M;+{8KvoJ~uj9`u~d_f6`V&3+&ZX9x5pc8s)d175;@pjm(?dapmBcm0&vl9+W zx1ZD2o^nuyUHWj|^A8r>lUorO`wFF;>9XL-Jy!P}UXC{(z!FO%SH~8k`#|9;Q|eue zqWL0^Bp(fg_+Pkm!fDKRSY;+^@BF?AJE zCUWpXPst~hi_~u)SzYBDZroR+Z4xeHIlm_3Yc_9nZ(o_gg!jDgVa=E}Y8uDgem9`b zf=mfJ_@(BXSkW53B)F2s!&?_R4ptb1fYXlF++@vPhd=marQgEGRZS@B4g1Mu?euknL= z67P~tZ?*>-Hmi7GwlisNHHJDku-dSm7g@!=a}9cSL6Pa^w^2?&?$Oi8ibrr>w)xqx zOH_EMU@m05)9kuNR>>4@H%|){U$^yvVQ(YgOlh;5oU_-vivG-p4=LrN-k7D?*?u1u zsWly%tfAzKd6Fb=`eU2un_uaTXmcT#tlOL+aRS=kZZf}A7qT8lvcTx~7j` z*b>=z)mwg7%B2_!D0!1IZ?Nq{^Y$uI4Qx*6T!E2Col&2{k?ImCO=dD~A&9f9diXy^$x{6CwkBimn|1E09 zAMSezYtiL?O6hS37KpvDM?22&d{l)7h-!F)C-d3j8Z`c@($?mfd{R82)H>Qe`h{~G z!I}(2j(|49{LR?w4Jspl_i!(4T{31|dqCOpI52r5NhxYV+cDAu(xp*4iqZ2e-$YP= zoFOPmm|u*7C?S{Fp43y+V;>~@FFR76bCl@pTtyB93vNWy5yf;HKr8^0d7&GVIslYm zo3Tgt@M!`8B6IW&lK{Xk>%zp41G%`(DR&^u z5^pwD4>E6-w<8Kl2DzJ%a@~QDE$(e87lNhy?-Qgep!$b?5f7+&EM7$e>|WrX+=zCb z=!f5P>MxFyy;mIRxjc(H*}mceXw5a*IpC0PEYJ8Y3{JdoIW)@t97{wcUB@u+$FCCO z;s2Qe(d~oJC^`m$7DE-dsha`glrtu&v&93IZadvl_yjp!c89>zo;Krk+d&DEG4?x$ zufC1n+c1XD7dolX1q|7}uelR$`pT0Z)1jun<39$Sn2V5g&|(j~Z!wOddfYiZo7)A< z!dK`aBHOOk+-E_xbWCA3VR-+o$i5eO9`rMI#p_0xQ}rjEpGW;U!&&PKnivOcG(|m9 z!C8?WC6nCXw25WVa*eew)zQ=h45k8jSIPbq&?VE{oG%?4>9rwEeB4&qe#?-y_es4c|7ufw%+H5EY#oCgv!Lzv291#-oNlX~X+Jl5(riC~r z=0M|wMOP)Tt8@hNg&%V@Z9@J|Q#K*hE>sr6@oguas9&6^-=~$*2Gs%h#GF@h)i=Im z^iKk~ipWJg1VrvKS;_2lgs3n1zvNvxb27nGM=NXE!D4C!U`f*K2B@^^&ij9y}DTLB*FI zEnBL6y{jc?JqXWbkIZd7I16hA>(f9T!iwbIxJj~bKPfrO;>%*5nk&Lf?G@c2wvGrY&41$W{7HM9+b@&XY@>NZM5s|EK_Dp zQX60CBuantx>|d#DsaZ*8MW(we|#KTYZ=vNa#d*DJQe6hr~J6{_rI#?wi@s|&O}FR zG$kfPxheXh1?IZ{bDT-CWB4FTvO-k5scW^mi8?iY5Q`f8JcnnCxiy@m@D-%lO;y0pTLhh6i6l@x52j=#^$5_U^os}OFg zzdHbo(QI`%9#o*r8GCW~T3UdV`szO#~)^&X_(VW>o~umY9-ns9-V4lf~j z`QBD~pJ4a#b`*6bJ^3RS5y?RAgF7K5$ll97Y8#WZduZ`j?IEY~H(s^doZg>7-tk*t z4_QE1%%bb^p~4F5SB$t2i1>DBG1cIo;2(xTaj*Y~hlM{tSDHojL-QPg%Mo%6^7FrpB*{ z4G0@T{-77Por4DCMF zB_5Y~Phv%EQ64W8^GS6h?x6xh;w2{z3$rhC;m+;uD&pR74j+i22P5DS-tE8ABvH(U~indEbBUTAAAXfHZg5QpB@TgV9eI<)JrAkOI z8!TSOgfAJiWAXeM&vR4Glh;VxH}WG&V$bVb`a`g}GSpwggti*&)taV1@Ak|{WrV|5 zmNYx)Ans=S{c52qv@+jmGQ&vd6>6yX6IKq9O$3r&0xUTdZ!m1!irzn`SY+F23Rl6# zFRxws&gV-kM1NX(3(gnKpGi0Q)Dxi~#?nyzOR9!en;Ij>YJZVFAL*=R%7y%Mz9hU% zs>+ZB?qRmZ)nISx7wxY)y#cd$iaC~{k0avD>BjyF1q^mNQ1QcwsxiTySe<6C&cC6P zE`vwO9^k-d`9hZ!+r@Jnr+MF*2;2l8WjZ}DrwDUHzSF{WoG zucbSWguA!3KgB3MU%HH`R;XqVv0CcaGq?+;v_A5A2kpmk5V%qZE3yzQ7R5XWhq=eR zyUezH=@V)y>L9T-M-?tW(PQYTRBKZSVb_!$^H-Pn%ea;!vS_?M<~Tm>_rWIW43sPW z=!lY&fWc1g7+r?R)0p8(%zp&vl+FK4HRkns%BW+Up&wK8!lQ2~bja|9bD12WrKn#M zK)Yl9*8$SI7MAwSK$%)dMd>o+1UD<2&aQMhyjS5R{-vV+M;Q4bzl~Z~=4HFj_#2V9 zB)Gfzx3ncy@uzx?yzi}6>d%-?WE}h7v*w)Jr_gBl!2P&F3DX>j_1#--yjpL%<;JMR z*b70Gr)MMIBWDo~#<5F^Q0$VKI;SBIRneuR7)yVsN~A9I@gZTXe)E?iVII+X5h0~H zx^c(fP&4>!*q>fb6dAOC?MI>Cz3kld#J*;uik+Ps49cwm1B4 zZc1|ZxYyTv;{Z!?qS=D)sgRKx^1AYf%;y_V&VgZglfU>d+Ufk5&LV$sKv}Hoj+s; xK3FZRYdhbXT_@RW*ff3@`D1#ps#~H)p+y&j#(J|vk^lW{fF9OJt5(B-_&*Xgn9~3N literal 0 HcmV?d00001 diff --git a/public/icon.svg b/public/icon.svg new file mode 100644 index 000000000..04b34bf83 --- /dev/null +++ b/public/icon.svg @@ -0,0 +1,3 @@ + + + diff --git a/public/robots.txt b/public/robots.txt new file mode 100644 index 000000000..c19f78ab6 --- /dev/null +++ b/public/robots.txt @@ -0,0 +1 @@ +# See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file diff --git a/script/.keep b/script/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/storage/.keep b/storage/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/tmp/.keep b/tmp/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/tmp/pids/.keep b/tmp/pids/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/tmp/storage/.keep b/tmp/storage/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/vendor/.keep b/vendor/.keep new file mode 100644 index 000000000..e69de29bb diff --git a/vendor/javascript/.keep b/vendor/javascript/.keep new file mode 100644 index 000000000..e69de29bb From 2f6b039bc97b648f828a9cecab0f2aa041bd9d5d Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 02/12] feat: add Rails 8 authentication with role-aware session redirects Co-authored-by: Cursor --- app/channels/application_cable/connection.rb | 16 +++++ app/controllers/passwords_controller.rb | 35 +++++++++++ app/controllers/sessions_controller.rb | 21 +++++++ app/models/current.rb | 4 ++ app/models/session.rb | 3 + app/models/user.rb | 60 +++++++++++++++++++ app/views/passwords/edit.html.erb | 21 +++++++ app/views/passwords/new.html.erb | 17 ++++++ app/views/passwords_mailer/reset.html.erb | 6 ++ app/views/passwords_mailer/reset.text.erb | 4 ++ app/views/sessions/new.html.erb | 28 +++++++++ db/migrate/20260903034025_create_users.rb | 15 +++++ db/migrate/20260903034026_create_sessions.rb | 11 ++++ ...te_active_storage_tables.active_storage.rb | 57 ++++++++++++++++++ 14 files changed, 298 insertions(+) create mode 100644 app/channels/application_cable/connection.rb create mode 100644 app/controllers/passwords_controller.rb create mode 100644 app/controllers/sessions_controller.rb create mode 100644 app/models/current.rb create mode 100644 app/models/session.rb create mode 100644 app/models/user.rb create mode 100644 app/views/passwords/edit.html.erb create mode 100644 app/views/passwords/new.html.erb create mode 100644 app/views/passwords_mailer/reset.html.erb create mode 100644 app/views/passwords_mailer/reset.text.erb create mode 100644 app/views/sessions/new.html.erb create mode 100644 db/migrate/20260903034025_create_users.rb create mode 100644 db/migrate/20260903034026_create_sessions.rb create mode 100644 db/migrate/20260903034028_create_active_storage_tables.active_storage.rb diff --git a/app/channels/application_cable/connection.rb b/app/channels/application_cable/connection.rb new file mode 100644 index 000000000..4264c745c --- /dev/null +++ b/app/channels/application_cable/connection.rb @@ -0,0 +1,16 @@ +module ApplicationCable + class Connection < ActionCable::Connection::Base + identified_by :current_user + + def connect + set_current_user || reject_unauthorized_connection + end + + private + def set_current_user + if session = Session.find_by(id: cookies.signed[:session_id]) + self.current_user = session.user + end + end + end +end diff --git a/app/controllers/passwords_controller.rb b/app/controllers/passwords_controller.rb new file mode 100644 index 000000000..f95ec7874 --- /dev/null +++ b/app/controllers/passwords_controller.rb @@ -0,0 +1,35 @@ +class PasswordsController < ApplicationController + allow_unauthenticated_access + before_action :set_user_by_token, only: %i[ edit update ] + rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_password_path, alert: "Try again later." } + + def new + end + + def create + if user = User.find_by(email_address: params[:email_address]) + PasswordsMailer.reset(user).deliver_later + end + + redirect_to new_session_path, notice: "Password reset instructions sent (if user with that email address exists)." + end + + def edit + end + + def update + if @user.update(params.permit(:password, :password_confirmation)) + @user.sessions.destroy_all + redirect_to new_session_path, notice: "Password has been reset." + else + redirect_to edit_password_path(params[:token]), alert: "Passwords did not match." + end + end + + private + def set_user_by_token + @user = User.find_by_password_reset_token!(params[:token]) + rescue ActiveSupport::MessageVerifier::InvalidSignature + redirect_to new_password_path, alert: "Password reset link is invalid or has expired." + end +end diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb new file mode 100644 index 000000000..8b0dc6f95 --- /dev/null +++ b/app/controllers/sessions_controller.rb @@ -0,0 +1,21 @@ +class SessionsController < ApplicationController + allow_unauthenticated_access only: %i[ new create ] + rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_session_path, alert: "Try again later." } + + def new + end + + def create + if (user = User.authenticate_by(params.permit(:email_address, :password))) + start_new_session_for user + redirect_to after_authentication_url, notice: "Signed in successfully." + else + redirect_to new_session_path, alert: "Try another email address or password." + end + end + + def destroy + terminate_session + redirect_to new_session_path, status: :see_other, notice: "Signed out." + end +end diff --git a/app/models/current.rb b/app/models/current.rb new file mode 100644 index 000000000..2bef56dad --- /dev/null +++ b/app/models/current.rb @@ -0,0 +1,4 @@ +class Current < ActiveSupport::CurrentAttributes + attribute :session + delegate :user, to: :session, allow_nil: true +end diff --git a/app/models/session.rb b/app/models/session.rb new file mode 100644 index 000000000..cf376fb28 --- /dev/null +++ b/app/models/session.rb @@ -0,0 +1,3 @@ +class Session < ApplicationRecord + belongs_to :user +end diff --git a/app/models/user.rb b/app/models/user.rb new file mode 100644 index 000000000..167eb26ef --- /dev/null +++ b/app/models/user.rb @@ -0,0 +1,60 @@ +class User < ApplicationRecord + ROLES = { member: 0, admin: 1 }.freeze + + has_secure_password + has_many :sessions, dependent: :destroy + has_many :created_imports, class_name: "UserImport", foreign_key: :created_by_id, inverse_of: :created_by, dependent: :destroy + has_one_attached :avatar_image + + enum :role, ROLES, validate: true + + normalizes :email_address, with: ->(email) { email.to_s.strip.downcase } + normalizes :full_name, with: ->(name) { name.to_s.strip.squeeze(" ") } + normalizes :avatar_url, with: ->(url) { url.to_s.strip.presence } + + validates :full_name, presence: true, length: { minimum: 2, maximum: 120 } + validates :email_address, presence: true, uniqueness: true, + format: { with: URI::MailTo::EMAIL_REGEXP } + validates :password, length: { minimum: 8 }, if: -> { password.present? } + validates :avatar_url, format: { with: /\Ahttps?:\/\/.+\z/i, allow_blank: true, message: "must be an http(s) URL" } + validate :acceptable_avatar_image + + after_commit :broadcast_dashboard_stats, on: %i[create update destroy] + + def admin? + role == "admin" + end + + def member? + role == "member" + end + + def avatar_src + return avatar_image if avatar_image.attached? + return avatar_url if avatar_url.present? + + nil + end + + def initials + full_name.to_s.split.map { |part| part[0] }.first(2).join.upcase.presence || "?" + end + + private + + def acceptable_avatar_image + return unless avatar_image.attached? + + unless avatar_image.blob.content_type.in?(%w[image/png image/jpeg image/jpg image/webp image/gif]) + errors.add(:avatar_image, "must be a PNG, JPEG, WEBP, or GIF image") + end + + if avatar_image.blob.byte_size > 5.megabytes + errors.add(:avatar_image, "must be smaller than 5MB") + end + end + + def broadcast_dashboard_stats + Users::DashboardBroadcaster.call + end +end diff --git a/app/views/passwords/edit.html.erb b/app/views/passwords/edit.html.erb new file mode 100644 index 000000000..65798f808 --- /dev/null +++ b/app/views/passwords/edit.html.erb @@ -0,0 +1,21 @@ +
+ <% if alert = flash[:alert] %> +

<%= alert %>

+ <% end %> + +

Update your password

+ + <%= form_with url: password_path(params[:token]), method: :put, class: "contents" do |form| %> +
+ <%= form.password_field :password, required: true, autocomplete: "new-password", placeholder: "Enter new password", maxlength: 72, class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
+ +
+ <%= form.password_field :password_confirmation, required: true, autocomplete: "new-password", placeholder: "Repeat new password", maxlength: 72, class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
+ +
+ <%= form.submit "Save", class: "w-full sm:w-auto text-center rounded-md px-3.5 py-2.5 bg-blue-600 hover:bg-blue-500 text-white inline-block font-medium cursor-pointer" %> +
+ <% end %> +
diff --git a/app/views/passwords/new.html.erb b/app/views/passwords/new.html.erb new file mode 100644 index 000000000..8360e02f3 --- /dev/null +++ b/app/views/passwords/new.html.erb @@ -0,0 +1,17 @@ +
+ <% if alert = flash[:alert] %> +

<%= alert %>

+ <% end %> + +

Forgot your password?

+ + <%= form_with url: passwords_path, class: "contents" do |form| %> +
+ <%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", placeholder: "Enter your email address", value: params[:email_address], class: "block shadow-sm rounded-md border border-gray-400 focus:outline-solid focus:outline-blue-600 px-3 py-2 mt-2 w-full" %> +
+ +
+ <%= form.submit "Email reset instructions", class: "w-full sm:w-auto text-center rounded-lg px-3.5 py-2.5 bg-blue-600 hover:bg-blue-500 text-white inline-block font-medium cursor-pointer" %> +
+ <% end %> +
diff --git a/app/views/passwords_mailer/reset.html.erb b/app/views/passwords_mailer/reset.html.erb new file mode 100644 index 000000000..1b0915419 --- /dev/null +++ b/app/views/passwords_mailer/reset.html.erb @@ -0,0 +1,6 @@ +

+ You can reset your password on + <%= link_to "this password reset page", edit_password_url(@user.password_reset_token) %>. + + This link will expire in <%= distance_of_time_in_words(0, @user.password_reset_token_expires_in) %>. +

diff --git a/app/views/passwords_mailer/reset.text.erb b/app/views/passwords_mailer/reset.text.erb new file mode 100644 index 000000000..aecee82c4 --- /dev/null +++ b/app/views/passwords_mailer/reset.text.erb @@ -0,0 +1,4 @@ +You can reset your password on +<%= edit_password_url(@user.password_reset_token) %> + +This link will expire in <%= distance_of_time_in_words(0, @user.password_reset_token_expires_in) %>. diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb new file mode 100644 index 000000000..ee9c5d420 --- /dev/null +++ b/app/views/sessions/new.html.erb @@ -0,0 +1,28 @@ +<% page_title "Sign in" %> + +
+
+

Sign in

+

Admins land on the dashboard. Members land on their profile.

+ + <%= form_with url: session_path, class: "mt-6 space-y-4" do |form| %> +
+ <%= form.label :email_address, "Email", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.email_field :email_address, required: true, autofocus: true, autocomplete: "username", + class: "w-full rounded-xl border border-slate-300 px-3 py-2.5 outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
+
+ <%= form.label :password, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password, required: true, autocomplete: "current-password", + class: "w-full rounded-xl border border-slate-300 px-3 py-2.5 outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
+ <%= form.submit "Sign in", class: "w-full cursor-pointer rounded-xl bg-slate-900 px-4 py-2.5 text-sm font-semibold text-white hover:bg-slate-800" %> + <% end %> + +

+ <%= link_to "Forgot password?", new_password_path, class: "text-teal-800 hover:underline" %> + · + <%= link_to "Create account", new_registration_path, class: "text-teal-800 hover:underline" %> +

+
+
diff --git a/db/migrate/20260903034025_create_users.rb b/db/migrate/20260903034025_create_users.rb new file mode 100644 index 000000000..5b4ea9165 --- /dev/null +++ b/db/migrate/20260903034025_create_users.rb @@ -0,0 +1,15 @@ +class CreateUsers < ActiveRecord::Migration[8.1] + def change + create_table :users do |t| + t.string :email_address, null: false + t.string :password_digest, null: false + t.string :full_name, null: false + t.integer :role, null: false, default: 0 + t.string :avatar_url + + t.timestamps + end + add_index :users, :email_address, unique: true + add_index :users, :role + end +end diff --git a/db/migrate/20260903034026_create_sessions.rb b/db/migrate/20260903034026_create_sessions.rb new file mode 100644 index 000000000..216185e4a --- /dev/null +++ b/db/migrate/20260903034026_create_sessions.rb @@ -0,0 +1,11 @@ +class CreateSessions < ActiveRecord::Migration[8.1] + def change + create_table :sessions do |t| + t.references :user, null: false, foreign_key: true + t.string :user_agent + t.string :ip_address + + t.timestamps + end + end +end diff --git a/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb b/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb new file mode 100644 index 000000000..6bd8bd082 --- /dev/null +++ b/db/migrate/20260903034028_create_active_storage_tables.active_storage.rb @@ -0,0 +1,57 @@ +# This migration comes from active_storage (originally 20170806125915) +class CreateActiveStorageTables < ActiveRecord::Migration[7.0] + def change + # Use Active Record's configured type for primary and foreign keys + primary_key_type, foreign_key_type = primary_and_foreign_key_types + + create_table :active_storage_blobs, id: primary_key_type do |t| + t.string :key, null: false + t.string :filename, null: false + t.string :content_type + t.text :metadata + t.string :service_name, null: false + t.bigint :byte_size, null: false + t.string :checksum + + if connection.supports_datetime_with_precision? + t.datetime :created_at, precision: 6, null: false + else + t.datetime :created_at, null: false + end + + t.index [ :key ], unique: true + end + + create_table :active_storage_attachments, id: primary_key_type do |t| + t.string :name, null: false + t.references :record, null: false, polymorphic: true, index: false, type: foreign_key_type + t.references :blob, null: false, type: foreign_key_type + + if connection.supports_datetime_with_precision? + t.datetime :created_at, precision: 6, null: false + else + t.datetime :created_at, null: false + end + + t.index [ :record_type, :record_id, :name, :blob_id ], name: :index_active_storage_attachments_uniqueness, unique: true + t.foreign_key :active_storage_blobs, column: :blob_id + end + + create_table :active_storage_variant_records, id: primary_key_type do |t| + t.belongs_to :blob, null: false, index: false, type: foreign_key_type + t.string :variation_digest, null: false + + t.index [ :blob_id, :variation_digest ], name: :index_active_storage_variant_records_uniqueness, unique: true + t.foreign_key :active_storage_blobs, column: :blob_id + end + end + + private + def primary_and_foreign_key_types + config = Rails.configuration.generators + setting = config.options[config.orm][:primary_key_type] + primary_key_type = setting || :primary_key + foreign_key_type = setting || :bigint + [ primary_key_type, foreign_key_type ] + end +end From 8aca00bb916f8a8104d4a870cd32c6d6259ba5cf Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 03/12] feat: add visitor registration and member profile management Co-authored-by: Cursor --- app/controllers/home_controller.rb | 9 +++ app/controllers/profiles_controller.rb | 33 +++++++++ app/controllers/registrations_controller.rb | 24 +++++++ app/views/home/index.html.erb | 45 ++++++++++++ app/views/profiles/edit.html.erb | 24 +++++++ app/views/profiles/show.html.erb | 39 ++++++++++ app/views/registrations/new.html.erb | 16 +++++ app/views/shared/_error_messages.html.erb | 10 +++ app/views/shared/_flash.html.erb | 9 +++ app/views/shared/_navbar.html.erb | 26 +++++++ app/views/shared/_user_form.html.erb | 80 +++++++++++++++++++++ 11 files changed, 315 insertions(+) create mode 100644 app/controllers/home_controller.rb create mode 100644 app/controllers/profiles_controller.rb create mode 100644 app/controllers/registrations_controller.rb create mode 100644 app/views/home/index.html.erb create mode 100644 app/views/profiles/edit.html.erb create mode 100644 app/views/profiles/show.html.erb create mode 100644 app/views/registrations/new.html.erb create mode 100644 app/views/shared/_error_messages.html.erb create mode 100644 app/views/shared/_flash.html.erb create mode 100644 app/views/shared/_navbar.html.erb create mode 100644 app/views/shared/_user_form.html.erb diff --git a/app/controllers/home_controller.rb b/app/controllers/home_controller.rb new file mode 100644 index 000000000..239bfb0ab --- /dev/null +++ b/app/controllers/home_controller.rb @@ -0,0 +1,9 @@ +class HomeController < ApplicationController + allow_unauthenticated_access only: :index + + def index + if authenticated? + redirect_to(Current.user.admin? ? admin_root_path : profile_path) + end + end +end diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb new file mode 100644 index 000000000..578bd46c4 --- /dev/null +++ b/app/controllers/profiles_controller.rb @@ -0,0 +1,33 @@ +class ProfilesController < ApplicationController + before_action :set_user + + def show + end + + def edit + end + + def update + if @user.update(profile_params) + redirect_to profile_path, notice: "Profile updated." + else + render :edit, status: :unprocessable_entity + end + end + + def destroy + terminate_session + @user.destroy! + redirect_to new_session_path, status: :see_other, notice: "Your account has been deleted." + end + + private + + def set_user + @user = Current.user + end + + def profile_params + params.require(:user).permit(:full_name, :email_address, :password, :password_confirmation, :avatar_url, :avatar_image) + end +end diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb new file mode 100644 index 000000000..06728f324 --- /dev/null +++ b/app/controllers/registrations_controller.rb @@ -0,0 +1,24 @@ +class RegistrationsController < ApplicationController + allow_unauthenticated_access + + def new + @user = User.new + end + + def create + @user = User.new(registration_params.merge(role: :member)) + + if @user.save + start_new_session_for @user + redirect_to profile_path, notice: "Welcome! Your account was created." + else + render :new, status: :unprocessable_entity + end + end + + private + + def registration_params + params.require(:user).permit(:full_name, :email_address, :password, :password_confirmation, :avatar_url, :avatar_image) + end +end diff --git a/app/views/home/index.html.erb b/app/views/home/index.html.erb new file mode 100644 index 000000000..585e3fa35 --- /dev/null +++ b/app/views/home/index.html.erb @@ -0,0 +1,45 @@ +<% page_title "Welcome" %> + +
+
+

Umanni Users

+

+ Manage people with a modern Rails 8 console +

+

+ Role-aware authentication, live admin metrics, and asynchronous spreadsheet imports — powered by Hotwire, Solid Cable, and Solid Queue. +

+
+ <%= link_to "Create an account", new_registration_path, class: "rounded-xl bg-teal-700 px-5 py-3 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "Sign in", new_session_path, class: "rounded-xl border border-slate-300 bg-white px-5 py-3 text-sm font-semibold text-slate-800 hover:bg-slate-50" %> +
+
+ +
+
+
+
+
+

Live dashboard foreshadow

+

Admin insights

+
+
+
+
Users
+
24
+
+
+
Admins
+
3
+
+
+
Members
+
21
+
+
+

+ Counters stream over Solid Cable. Imports run on Solid Queue. No Redis required. +

+
+
+
diff --git a/app/views/profiles/edit.html.erb b/app/views/profiles/edit.html.erb new file mode 100644 index 000000000..30956b4a9 --- /dev/null +++ b/app/views/profiles/edit.html.erb @@ -0,0 +1,24 @@ +<% page_title "Edit profile" %> + +
+
+

Edit profile

+

You can update your info or delete your account.

+
+ <%= render "shared/user_form", + user: @user, + url: profile_path, + method: :patch, + submit_label: "Save changes", + cancel_path: profile_path %> +
+
+ +
+

Danger zone

+

Deleting your profile is permanent.

+ <%= button_to "Delete my profile", profile_path, method: :delete, + form: { data: { turbo_confirm: "Delete your account permanently?" } }, + class: "mt-4 rounded-xl bg-rose-700 px-4 py-2 text-sm font-semibold text-white hover:bg-rose-800" %> +
+
diff --git a/app/views/profiles/show.html.erb b/app/views/profiles/show.html.erb new file mode 100644 index 000000000..b7960df5c --- /dev/null +++ b/app/views/profiles/show.html.erb @@ -0,0 +1,39 @@ +<% page_title "My profile" %> + +
+
+
+ <%= avatar_tag @user, size: 72 %> +
+

<%= @user.full_name %>

+

<%= @user.email_address %>

+ <%= @user.role %> +
+
+
+ <%= link_to "Edit profile", edit_profile_path, class: "rounded-xl bg-teal-700 px-4 py-2 text-sm font-semibold text-white hover:bg-teal-800" %> +
+
+ +
+

Account details

+
+
+
Full name
+
<%= @user.full_name %>
+
+
+
Email
+
<%= @user.email_address %>
+
+
+
Role
+
<%= @user.role %>
+
+
+
Member since
+
<%= l @user.created_at.to_date, format: :long %>
+
+
+
+
diff --git a/app/views/registrations/new.html.erb b/app/views/registrations/new.html.erb new file mode 100644 index 000000000..65fc8e239 --- /dev/null +++ b/app/views/registrations/new.html.erb @@ -0,0 +1,16 @@ +<% page_title "Register" %> + +
+
+

Create your account

+

Visitors register as normal members.

+
+ <%= render "shared/user_form", + user: @user, + url: registration_path, + method: :post, + submit_label: "Register", + cancel_path: root_path %> +
+
+
diff --git a/app/views/shared/_error_messages.html.erb b/app/views/shared/_error_messages.html.erb new file mode 100644 index 000000000..902226e51 --- /dev/null +++ b/app/views/shared/_error_messages.html.erb @@ -0,0 +1,10 @@ +<% if user.errors.any? %> + +<% end %> diff --git a/app/views/shared/_flash.html.erb b/app/views/shared/_flash.html.erb new file mode 100644 index 000000000..a70c53e32 --- /dev/null +++ b/app/views/shared/_flash.html.erb @@ -0,0 +1,9 @@ +<% if flash.any? %> +
+ <% flash.each do |type, message| %> +
+ <%= message %> +
+ <% end %> +
+<% end %> diff --git a/app/views/shared/_navbar.html.erb b/app/views/shared/_navbar.html.erb new file mode 100644 index 000000000..6eed7d6e4 --- /dev/null +++ b/app/views/shared/_navbar.html.erb @@ -0,0 +1,26 @@ +
+
+ <%= link_to root_path, class: "group flex items-center gap-3" do %> + UU + + Umanni Users + People operations console + + <% end %> + + +
+
diff --git a/app/views/shared/_user_form.html.erb b/app/views/shared/_user_form.html.erb new file mode 100644 index 000000000..b19134b45 --- /dev/null +++ b/app/views/shared/_user_form.html.erb @@ -0,0 +1,80 @@ +<%= form_with model: user, url: url, method: method, class: "space-y-5", data: { controller: "form-validation", action: "input->form-validation#validate submit->form-validation#validate" } do |form| %> + <%= render "shared/error_messages", user: user %> + +
+
+ <%= form.label :full_name, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.text_field :full_name, + required: true, + minlength: 2, + maxlength: 120, + autocomplete: "name", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "presence length" } %> + +
+ +
+ <%= form.label :email_address, "Email", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.email_field :email_address, + required: true, + autocomplete: "email", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "email" } %> + +
+ + <% if local_assigns[:show_role] %> +
+ <%= form.label :role, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.select :role, + User.roles.keys.map { |role| [role.titleize, role] }, + {}, + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
+ <% end %> + +
+ <%= form.label :password, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password, + required: user.new_record?, + minlength: 8, + autocomplete: user.new_record? ? "new-password" : "new-password", + placeholder: user.persisted? ? "Leave blank to keep current password" : nil, + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: user.new_record? ? "password" : "optional_password" } %> + +
+ +
+ <%= form.label :password_confirmation, class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.password_field :password_confirmation, + minlength: 8, + autocomplete: "new-password", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2" %> +
+ +
+ <%= form.label :avatar_image, "Avatar upload", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.file_field :avatar_image, + accept: "image/png,image/jpeg,image/webp,image/gif", + class: "block w-full text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-slate-900 file:px-3 file:py-2 file:text-sm file:font-medium file:text-white hover:file:bg-slate-800" %> +
+ +
+ <%= form.label :avatar_url, "Avatar remote URL", class: "mb-1.5 block text-sm font-medium text-slate-700" %> + <%= form.url_field :avatar_url, + placeholder: "https://…", + class: "w-full rounded-xl border border-slate-300 bg-white px-3 py-2.5 text-slate-900 shadow-sm outline-none ring-teal-700/30 focus:border-teal-700 focus:ring-2", + data: { form_validation_target: "field", validate: "optional_url" } %> + +
+
+ +
+ <%= form.submit submit_label, class: "cursor-pointer rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white shadow-sm hover:bg-teal-800" %> + <% if local_assigns[:cancel_path] %> + <%= link_to "Cancel", cancel_path, class: "rounded-xl px-4 py-2.5 text-sm font-medium text-slate-600 hover:bg-slate-100" %> + <% end %> +
+<% end %> From e47b3efd42a0ba850df153eee2003c25297df034 Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 04/12] feat: add admin dashboard with live stats and user CRUD Co-authored-by: Cursor --- app/controllers/admin/base_controller.rb | 5 ++ app/controllers/admin/dashboard_controller.rb | 8 ++ app/controllers/admin/imports_controller.rb | 29 +++++++ app/controllers/admin/users_controller.rb | 75 +++++++++++++++++++ app/services/users/dashboard_broadcaster.rb | 18 +++++ app/services/users/dashboard_stats.rb | 18 +++++ app/views/admin/dashboard/_stats.html.erb | 14 ++++ app/views/admin/dashboard/show.html.erb | 39 ++++++++++ app/views/admin/users/edit.html.erb | 16 ++++ app/views/admin/users/index.html.erb | 50 +++++++++++++ app/views/admin/users/new.html.erb | 16 ++++ app/views/admin/users/show.html.erb | 30 ++++++++ 12 files changed, 318 insertions(+) create mode 100644 app/controllers/admin/base_controller.rb create mode 100644 app/controllers/admin/dashboard_controller.rb create mode 100644 app/controllers/admin/imports_controller.rb create mode 100644 app/controllers/admin/users_controller.rb create mode 100644 app/services/users/dashboard_broadcaster.rb create mode 100644 app/services/users/dashboard_stats.rb create mode 100644 app/views/admin/dashboard/_stats.html.erb create mode 100644 app/views/admin/dashboard/show.html.erb create mode 100644 app/views/admin/users/edit.html.erb create mode 100644 app/views/admin/users/index.html.erb create mode 100644 app/views/admin/users/new.html.erb create mode 100644 app/views/admin/users/show.html.erb diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb new file mode 100644 index 000000000..cdee5c331 --- /dev/null +++ b/app/controllers/admin/base_controller.rb @@ -0,0 +1,5 @@ +module Admin + class BaseController < ApplicationController + require_admin! + end +end diff --git a/app/controllers/admin/dashboard_controller.rb b/app/controllers/admin/dashboard_controller.rb new file mode 100644 index 000000000..602b7f53b --- /dev/null +++ b/app/controllers/admin/dashboard_controller.rb @@ -0,0 +1,8 @@ +module Admin + class DashboardController < BaseController + def show + @stats = Users::DashboardStats.call + @recent_imports = UserImport.includes(:created_by).order(created_at: :desc).limit(5) + end + end +end diff --git a/app/controllers/admin/imports_controller.rb b/app/controllers/admin/imports_controller.rb new file mode 100644 index 000000000..b12101540 --- /dev/null +++ b/app/controllers/admin/imports_controller.rb @@ -0,0 +1,29 @@ +module Admin + class ImportsController < BaseController + def index + @imports = UserImport.includes(:created_by).order(created_at: :desc) + @import = UserImport.new + end + + def create + @import = Current.user.created_imports.new(import_params) + + if @import.save + redirect_to admin_imports_path, notice: "Import started. Progress will update live." + else + @imports = UserImport.includes(:created_by).order(created_at: :desc) + render :index, status: :unprocessable_entity + end + end + + def show + @import = UserImport.find(params[:id]) + end + + private + + def import_params + params.require(:user_import).permit(:spreadsheet) + end + end +end diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb new file mode 100644 index 000000000..bd6aa4280 --- /dev/null +++ b/app/controllers/admin/users_controller.rb @@ -0,0 +1,75 @@ +module Admin + class UsersController < BaseController + before_action :set_user, only: %i[show edit update destroy toggle_role] + + def index + @users = User.order(:full_name) + end + + def show + end + + def new + @user = User.new(role: :member) + end + + def create + @user = User.new(user_params) + + if @user.save + redirect_to admin_user_path(@user), notice: "User created." + else + render :new, status: :unprocessable_entity + end + end + + def edit + end + + def update + if @user.update(user_params) + redirect_to admin_user_path(@user), notice: "User updated." + else + render :edit, status: :unprocessable_entity + end + end + + def destroy + if @user == Current.user + redirect_to admin_users_path, alert: "You cannot delete your own account from the admin panel." + return + end + + @user.destroy! + redirect_to admin_users_path, notice: "User deleted.", status: :see_other + end + + def toggle_role + if @user == Current.user + redirect_to admin_users_path, alert: "You cannot change your own role." + return + end + + @user.admin? ? @user.member! : @user.admin! + redirect_to admin_users_path, notice: "#{@user.full_name} is now #{@user.role}." + end + + private + + def set_user + @user = User.find(params[:id]) + end + + def user_params + params.require(:user).permit( + :full_name, + :email_address, + :password, + :password_confirmation, + :role, + :avatar_url, + :avatar_image + ) + end + end +end diff --git a/app/services/users/dashboard_broadcaster.rb b/app/services/users/dashboard_broadcaster.rb new file mode 100644 index 000000000..4010bc2c0 --- /dev/null +++ b/app/services/users/dashboard_broadcaster.rb @@ -0,0 +1,18 @@ +module Users + class DashboardBroadcaster + def self.call + new.call + end + + def call + stats = DashboardStats.call + + Turbo::StreamsChannel.broadcast_replace_to( + "admin_dashboard", + target: "dashboard_stats", + partial: "admin/dashboard/stats", + locals: { stats: stats } + ) + end + end +end diff --git a/app/services/users/dashboard_stats.rb b/app/services/users/dashboard_stats.rb new file mode 100644 index 000000000..058fb8009 --- /dev/null +++ b/app/services/users/dashboard_stats.rb @@ -0,0 +1,18 @@ +module Users + class DashboardStats + Result = Data.define(:total, :admins, :members) + + def self.call + new.call + end + + def call + counts = User.group(:role).count + Result.new( + total: counts.values.sum, + admins: counts["admin"] || counts[User.roles[:admin]] || 0, + members: counts["member"] || counts[User.roles[:member]] || 0 + ) + end + end +end diff --git a/app/views/admin/dashboard/_stats.html.erb b/app/views/admin/dashboard/_stats.html.erb new file mode 100644 index 000000000..4479ec6f7 --- /dev/null +++ b/app/views/admin/dashboard/_stats.html.erb @@ -0,0 +1,14 @@ +
+
+

Total users

+

<%= stats.total %>

+
+
+

Admins

+

<%= stats.admins %>

+
+
+

Members

+

<%= stats.members %>

+
+
diff --git a/app/views/admin/dashboard/show.html.erb b/app/views/admin/dashboard/show.html.erb new file mode 100644 index 000000000..d1f696ab9 --- /dev/null +++ b/app/views/admin/dashboard/show.html.erb @@ -0,0 +1,39 @@ +<% page_title "Admin dashboard" %> + +<%= turbo_stream_from "admin_dashboard" %> +<%= turbo_stream_from "admin_imports" %> + +
+
+

Admin dashboard

+

Live user totals update over Solid Cable whenever the user base changes.

+
+ + <%= render "admin/dashboard/stats", stats: @stats %> + +
+
+
+

Quick actions

+
+
+ <%= link_to "Manage users", admin_users_path, class: "rounded-xl bg-slate-900 px-4 py-2.5 text-sm font-semibold text-white hover:bg-slate-800" %> + <%= link_to "Import spreadsheet", admin_imports_path, class: "rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "New user", new_admin_user_path, class: "rounded-xl border border-slate-300 px-4 py-2.5 text-sm font-semibold text-slate-800 hover:bg-slate-50" %> +
+
+ +
+

Recent imports

+
    + <% if @recent_imports.any? %> + <% @recent_imports.each do |import| %> + <%= render "admin/imports/import", import: import %> + <% end %> + <% else %> +
  • No imports yet.
    • + <% end %> +
+
+
+
diff --git a/app/views/admin/users/edit.html.erb b/app/views/admin/users/edit.html.erb new file mode 100644 index 000000000..40de2ba89 --- /dev/null +++ b/app/views/admin/users/edit.html.erb @@ -0,0 +1,16 @@ +<% page_title "Edit user" %> + +
+
+

Edit user

+
+ <%= render "shared/user_form", + user: @user, + url: admin_user_path(@user), + method: :patch, + submit_label: "Save user", + cancel_path: admin_user_path(@user), + show_role: true %> +
+
+
diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb new file mode 100644 index 000000000..0f0d8ac53 --- /dev/null +++ b/app/views/admin/users/index.html.erb @@ -0,0 +1,50 @@ +<% page_title "Users" %> + +
+
+
+

Users

+

Create, edit, delete, and toggle roles.

+
+ <%= link_to "New user", new_admin_user_path, class: "rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> +
+ +
+ + + + + + + + + + + <% @users.each do |user| %> + + + + + + + <% end %> + +
UserRoleEmailActions
+
+ <%= avatar_tag user, size: 36 %> + <%= link_to user.full_name, admin_user_path(user), class: "font-medium text-slate-900 hover:text-teal-800" %> +
+ 		+ <%= user.role %> + <%= user.email_address %> +
+ <%= link_to "Edit", edit_admin_user_path(user), class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-slate-700 hover:bg-slate-100" %> + <%= button_to "Toggle role", toggle_role_admin_user_path(user), method: :patch, + class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-teal-800 hover:bg-teal-50" %> + <%= button_to "Delete", admin_user_path(user), method: :delete, + form: { data: { turbo_confirm: "Delete #{user.full_name}?" } }, + class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-50" %> +
+
+
+
diff --git a/app/views/admin/users/new.html.erb b/app/views/admin/users/new.html.erb new file mode 100644 index 000000000..76e77958c --- /dev/null +++ b/app/views/admin/users/new.html.erb @@ -0,0 +1,16 @@ +<% page_title "New user" %> + +
+
+

New user

+
+ <%= render "shared/user_form", + user: @user, + url: admin_users_path, + method: :post, + submit_label: "Create user", + cancel_path: admin_users_path, + show_role: true %> +
+
+
diff --git a/app/views/admin/users/show.html.erb b/app/views/admin/users/show.html.erb new file mode 100644 index 000000000..05332e81b --- /dev/null +++ b/app/views/admin/users/show.html.erb @@ -0,0 +1,30 @@ +<% page_title @user.full_name %> + +
+
+
+ <%= avatar_tag @user, size: 64 %> +
+

<%= @user.full_name %>

+

<%= @user.email_address %>

+
+
+
+ <%= link_to "Edit", edit_admin_user_path(@user), class: "rounded-xl bg-teal-700 px-4 py-2 text-sm font-semibold text-white hover:bg-teal-800" %> + <%= link_to "Back", admin_users_path, class: "rounded-xl border border-slate-300 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50" %> +
+
+ +
+
+
+
Role
+
<%= @user.role %>
+
+
+
Created
+
<%= l @user.created_at, format: :long %>
+
+
+
+
From 6b2a80997c97dbc172fdd1eee4f619edc36f11e8 Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 05/12] feat: add async CSV/XLSX user imports with live progress Co-authored-by: Cursor --- app/jobs/process_user_import_job.rb | 13 ++ app/models/user_import.rb | 61 ++++++++++ app/services/users/importer.rb | 113 ++++++++++++++++++ app/views/admin/imports/_import.html.erb | 27 +++++ app/views/admin/imports/index.html.erb | 37 ++++++ app/views/admin/imports/show.html.erb | 9 ++ .../20260903034027_create_user_imports.rb | 16 +++ docs/sample_users.csv | 4 + 8 files changed, 280 insertions(+) create mode 100644 app/jobs/process_user_import_job.rb create mode 100644 app/models/user_import.rb create mode 100644 app/services/users/importer.rb create mode 100644 app/views/admin/imports/_import.html.erb create mode 100644 app/views/admin/imports/index.html.erb create mode 100644 app/views/admin/imports/show.html.erb create mode 100644 db/migrate/20260903034027_create_user_imports.rb create mode 100644 docs/sample_users.csv diff --git a/app/jobs/process_user_import_job.rb b/app/jobs/process_user_import_job.rb new file mode 100644 index 000000000..42678fcdf --- /dev/null +++ b/app/jobs/process_user_import_job.rb @@ -0,0 +1,13 @@ +class ProcessUserImportJob < ApplicationJob + queue_as :default + + discard_on ActiveJob::DeserializationError + + def perform(user_import_id) + user_import = UserImport.find_by(id: user_import_id) + return unless user_import + return if user_import.finished? + + Users::Importer.call(user_import) + end +end diff --git a/app/models/user_import.rb b/app/models/user_import.rb new file mode 100644 index 000000000..3a5d22224 --- /dev/null +++ b/app/models/user_import.rb @@ -0,0 +1,61 @@ +class UserImport < ApplicationRecord + STATUSES = { pending: 0, processing: 1, completed: 2, failed: 3 }.freeze + + belongs_to :created_by, class_name: "User" + has_one_attached :spreadsheet + + enum :status, STATUSES, validate: true + + validates :spreadsheet, presence: true, on: :create + validate :acceptable_spreadsheet, on: :create + + after_create_commit :enqueue_processing + after_update_commit :broadcast_progress + + def progress_percent + return 0 if total_rows.to_i.zero? + + ((processed_rows.to_f / total_rows) * 100).round + end + + def finished? + completed? || failed? + end + + private + + def acceptable_spreadsheet + return unless spreadsheet.attached? + + allowed = %w[ + text/csv + application/vnd.ms-excel + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + application/csv + ] + + content_type = spreadsheet.blob.content_type + filename = spreadsheet.blob.filename.to_s.downcase + + unless content_type.in?(allowed) || filename.end_with?(".csv", ".xlsx", ".xls") + errors.add(:spreadsheet, "must be a .csv or .xlsx file") + end + + if spreadsheet.blob.byte_size > 10.megabytes + errors.add(:spreadsheet, "must be smaller than 10MB") + end + end + + def enqueue_processing + ProcessUserImportJob.perform_later(id) + end + + def broadcast_progress + broadcast_replace_to( + "admin_imports", + target: ActionView::RecordIdentifier.dom_id(self), + partial: "admin/imports/import", + locals: { import: self } + ) + end +end diff --git a/app/services/users/importer.rb b/app/services/users/importer.rb new file mode 100644 index 000000000..f7d4e56c3 --- /dev/null +++ b/app/services/users/importer.rb @@ -0,0 +1,113 @@ +require "csv" +require "roo" + +module Users + # Parses a spreadsheet and creates member users asynchronously tracked by UserImport. + class Importer + Result = Data.define(:successful, :failed, :errors) + + HEADERS = { + "full_name" => :full_name, + "fullname" => :full_name, + "name" => :full_name, + "email" => :email_address, + "email_address" => :email_address, + "password" => :password, + "avatar_url" => :avatar_url, + "role" => :role + }.freeze + + def initialize(user_import) + @user_import = user_import + end + + def self.call(user_import) + new(user_import).call + end + + def call + rows = parse_rows + @user_import.update!(status: :processing, total_rows: rows.size, processed_rows: 0, successful_rows: 0, failed_rows: 0) + + successful = 0 + failed = 0 + errors = [] + + rows.each_with_index do |row, index| + attrs = normalize_row(row) + user = User.new(attrs.merge(role: attrs[:role].presence || "member")) + user.password ||= SecureRandom.alphanumeric(16) + + if user.save + successful += 1 + else + failed += 1 + errors << "Row #{index + 2}: #{user.errors.full_messages.to_sentence}" + end + + @user_import.update!( + processed_rows: index + 1, + successful_rows: successful, + failed_rows: failed + ) + end + + @user_import.update!( + status: :completed, + error_message: errors.first(20).join("\n").presence + ) + + Result.new(successful: successful, failed: failed, errors: errors) + rescue StandardError => e + @user_import.update!(status: :failed, error_message: e.message) + raise + end + + private + + def parse_rows + @user_import.spreadsheet.open do |file| + path = file.path + filename = @user_import.spreadsheet.filename.to_s.downcase + + if filename.end_with?(".csv") + parse_csv(path) + else + parse_xlsx(path) + end + end + end + + def parse_csv(path) + table = CSV.read(path, headers: true) + table.map(&:to_h) + end + + def parse_xlsx(path) + spreadsheet = Roo::Spreadsheet.open(path) + sheet = spreadsheet.sheet(0) + headers = sheet.row(1).map { |h| h.to_s.strip.downcase } + + (2..sheet.last_row).map do |i| + headers.zip(sheet.row(i)).to_h + end + end + + def normalize_row(row) + mapped = {} + row.each do |key, value| + attribute = HEADERS[key.to_s.strip.downcase] + next unless attribute + + mapped[attribute] = value.to_s.strip.presence + end + + if mapped[:role].present? + role = mapped[:role].to_s.downcase + mapped[:role] = role.in?(%w[admin administrator]) ? "admin" : "member" + end + + mapped + end + end +end diff --git a/app/views/admin/imports/_import.html.erb b/app/views/admin/imports/_import.html.erb new file mode 100644 index 000000000..ae056d2e2 --- /dev/null +++ b/app/views/admin/imports/_import.html.erb @@ -0,0 +1,27 @@ +
  • +
    +
    +
    + <%= import.status %> + #<%= import.id %> +
    +

    + <%= import.successful_rows %>/<%= import.total_rows %> succeeded + <% if import.failed_rows.positive? %> + · <%= import.failed_rows %> failed + <% end %> +

    + <% if import.error_message.present? %> +

    <%= truncate(import.error_message, length: 140) %>

    + <% end %> +
    +
    +

    <%= time_ago_in_words(import.created_at) %> ago

    + <%= link_to "Details", admin_import_path(import), class: "mt-1 inline-block font-semibold text-teal-800 hover:underline" %> +
    +
    + +
    +
    +
    +
    • diff --git a/app/views/admin/imports/index.html.erb b/app/views/admin/imports/index.html.erb new file mode 100644 index 000000000..56972b2a0 --- /dev/null +++ b/app/views/admin/imports/index.html.erb @@ -0,0 +1,37 @@ +<% page_title "Imports" %> + +<%= turbo_stream_from "admin_imports" %> + +
    +
    +

    Spreadsheet imports

    +

    Upload CSV or XLSX files. Processing runs on Solid Queue with live progress.

    +
    + +
    +

    Start import

    +

    Expected columns: full_name, email, optional password, avatar_url, role.

    + + <%= form_with model: @import, url: admin_imports_path, class: "mt-4 space-y-4" do |form| %> + <% if @import.errors.any? %> +
    + <%= @import.errors.full_messages.to_sentence %> +
    + <% end %> + <%= form.file_field :spreadsheet, required: true, accept: ".csv,.xlsx,text/csv,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", + class: "block w-full text-sm text-slate-600 file:mr-3 file:rounded-lg file:border-0 file:bg-slate-900 file:px-3 file:py-2 file:text-sm file:font-medium file:text-white" %> + <%= form.submit "Upload & process", class: "cursor-pointer rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %> + <% end %> +
    + +
    +

    Import history

    + <% if @imports.any? %> + <% @imports.each do |import| %> + <%= render "admin/imports/import", import: import %> + <% end %> + <% else %> +

    No imports yet.

    + <% end %> +
    +
    diff --git a/app/views/admin/imports/show.html.erb b/app/views/admin/imports/show.html.erb new file mode 100644 index 000000000..48ccb96d4 --- /dev/null +++ b/app/views/admin/imports/show.html.erb @@ -0,0 +1,9 @@ +<% page_title "Import ##{@import.id}" %> + +<%= turbo_stream_from "admin_imports" %> + +
    +

    Import #<%= @import.id %>

    + <%= render "admin/imports/import", import: @import %> + <%= link_to "Back to imports", admin_imports_path, class: "inline-flex rounded-xl border border-slate-300 px-4 py-2 text-sm font-semibold text-slate-700 hover:bg-slate-50" %> +
    diff --git a/db/migrate/20260903034027_create_user_imports.rb b/db/migrate/20260903034027_create_user_imports.rb new file mode 100644 index 000000000..8f9d185f1 --- /dev/null +++ b/db/migrate/20260903034027_create_user_imports.rb @@ -0,0 +1,16 @@ +class CreateUserImports < ActiveRecord::Migration[8.1] + def change + create_table :user_imports do |t| + t.integer :status, null: false, default: 0 + t.integer :total_rows, null: false, default: 0 + t.integer :processed_rows, null: false, default: 0 + t.integer :successful_rows, null: false, default: 0 + t.integer :failed_rows, null: false, default: 0 + t.text :error_message + t.references :created_by, null: false, foreign_key: { to_table: :users } + + t.timestamps + end + add_index :user_imports, :status + end +end diff --git a/docs/sample_users.csv b/docs/sample_users.csv new file mode 100644 index 000000000..9fb6c3532 --- /dev/null +++ b/docs/sample_users.csv @@ -0,0 +1,4 @@ +full_name,email,password,role,avatar_url +Imported Alpha,alpha.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Alpha +Imported Beta,beta.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Beta +Imported Gamma,gamma.import@example.com,password123,admin,https://api.dicebear.com/9.x/initials/svg?seed=Gamma From 2c5e72e0be07113831e123506c2d265e59803490 Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 06/12] feat: add Stimulus validation, Tailwind UI, and seeds Co-authored-by: Cursor --- .../controllers/auto_dismiss_controller.js | 15 ++++ .../controllers/form_validation_controller.js | 31 +++++++ db/schema.rb | 81 +++++++++++++++++++ db/seeds.rb | 40 +++++++++ 4 files changed, 167 insertions(+) create mode 100644 app/javascript/controllers/auto_dismiss_controller.js create mode 100644 app/javascript/controllers/form_validation_controller.js create mode 100644 db/schema.rb create mode 100644 db/seeds.rb diff --git a/app/javascript/controllers/auto_dismiss_controller.js b/app/javascript/controllers/auto_dismiss_controller.js new file mode 100644 index 000000000..c56654818 --- /dev/null +++ b/app/javascript/controllers/auto_dismiss_controller.js @@ -0,0 +1,15 @@ +import { Controller } from "@hotwired/stimulus" + +export default class extends Controller { + connect() { + this.timeout = setTimeout(() => { + this.element.style.transition = "opacity 300ms ease" + this.element.style.opacity = "0" + setTimeout(() => this.element.remove(), 320) + }, 4500) + } + + disconnect() { + clearTimeout(this.timeout) + } +} diff --git a/app/javascript/controllers/form_validation_controller.js b/app/javascript/controllers/form_validation_controller.js new file mode 100644 index 000000000..ab5c1e327 --- /dev/null +++ b/app/javascript/controllers/form_validation_controller.js @@ -0,0 +1,31 @@ +import { Controller } from "@hotwired/stimulus" + +export default class extends Controller { + static targets = ["field", "error"] + + validate(event) { + let valid = true + + this.fieldTargets.forEach((field) => { + const rules = (field.dataset.validate || "").split(" ") + const error = this.errorTargets.find((el) => el.dataset.for === field.name.replace("user[", "").replace("]", "")) + const value = field.value.trim() + let fieldValid = true + + if (rules.includes("presence") && !value) fieldValid = false + if (rules.includes("length") && value && (value.length < 2 || value.length > 120)) fieldValid = false + if (rules.includes("email") && value && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) fieldValid = false + if (rules.includes("password") && value.length < 8) fieldValid = false + if (rules.includes("optional_password") && value && value.length < 8) fieldValid = false + if (rules.includes("optional_url") && value && !/^https?:\/\/.+/i.test(value)) fieldValid = false + + if (error) error.classList.toggle("hidden", fieldValid) + field.classList.toggle("border-rose-400", !fieldValid) + if (!fieldValid) valid = false + }) + + if (event.type === "submit" && !valid) { + event.preventDefault() + } + } +} diff --git a/db/schema.rb b/db/schema.rb new file mode 100644 index 000000000..774faee50 --- /dev/null +++ b/db/schema.rb @@ -0,0 +1,81 @@ +# This file is auto-generated from the current state of the database. Instead +# of editing this file, please use the migrations feature of Active Record to +# incrementally modify your database, and then regenerate this schema definition. +# +# This file is the source Rails uses to define your schema when running `bin/rails +# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to +# be faster and is potentially less error prone than running all of your +# migrations from scratch. Old migrations may fail to apply correctly if those +# migrations use external dependencies or application code. +# +# It's strongly recommended that you check this file into your version control system. + +ActiveRecord::Schema[8.1].define(version: 2026_09_03_034028) do + create_table "active_storage_attachments", force: :cascade do |t| + t.bigint "blob_id", null: false + t.datetime "created_at", null: false + t.string "name", null: false + t.bigint "record_id", null: false + t.string "record_type", null: false + t.index ["blob_id"], name: "index_active_storage_attachments_on_blob_id" + t.index ["record_type", "record_id", "name", "blob_id"], name: "index_active_storage_attachments_uniqueness", unique: true + end + + create_table "active_storage_blobs", force: :cascade do |t| + t.bigint "byte_size", null: false + t.string "checksum" + t.string "content_type" + t.datetime "created_at", null: false + t.string "filename", null: false + t.string "key", null: false + t.text "metadata" + t.string "service_name", null: false + t.index ["key"], name: "index_active_storage_blobs_on_key", unique: true + end + + create_table "active_storage_variant_records", force: :cascade do |t| + t.bigint "blob_id", null: false + t.string "variation_digest", null: false + t.index ["blob_id", "variation_digest"], name: "index_active_storage_variant_records_uniqueness", unique: true + end + + create_table "sessions", force: :cascade do |t| + t.datetime "created_at", null: false + t.string "ip_address" + t.datetime "updated_at", null: false + t.string "user_agent" + t.integer "user_id", null: false + t.index ["user_id"], name: "index_sessions_on_user_id" + end + + create_table "user_imports", force: :cascade do |t| + t.datetime "created_at", null: false + t.integer "created_by_id", null: false + t.text "error_message" + t.integer "failed_rows", default: 0, null: false + t.integer "processed_rows", default: 0, null: false + t.integer "status", default: 0, null: false + t.integer "successful_rows", default: 0, null: false + t.integer "total_rows", default: 0, null: false + t.datetime "updated_at", null: false + t.index ["created_by_id"], name: "index_user_imports_on_created_by_id" + t.index ["status"], name: "index_user_imports_on_status" + end + + create_table "users", force: :cascade do |t| + t.string "avatar_url" + t.datetime "created_at", null: false + t.string "email_address", null: false + t.string "full_name", null: false + t.string "password_digest", null: false + t.integer "role", default: 0, null: false + t.datetime "updated_at", null: false + t.index ["email_address"], name: "index_users_on_email_address", unique: true + t.index ["role"], name: "index_users_on_role" + end + + add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id" + add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id" + add_foreign_key "sessions", "users" + add_foreign_key "user_imports", "users", column: "created_by_id" +end diff --git a/db/seeds.rb b/db/seeds.rb new file mode 100644 index 000000000..99a146bf3 --- /dev/null +++ b/db/seeds.rb @@ -0,0 +1,40 @@ +# frozen_string_literal: true + +puts "Seeding Umanni Users…" + +admin = User.find_or_initialize_by(email_address: "admin@umanni.test") +admin.assign_attributes( + full_name: "Ada Admin", + password: "password123", + password_confirmation: "password123", + role: :admin, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=Ada%20Admin" +) +admin.save! + +member = User.find_or_initialize_by(email_address: "user@umanni.test") +member.assign_attributes( + full_name: "Morgan Member", + password: "password123", + password_confirmation: "password123", + role: :member, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=Morgan%20Member" +) +member.save! + +%w[Alex Jordan Casey Riley Quinn].each_with_index do |name, index| + user = User.find_or_initialize_by(email_address: "#{name.downcase}@example.com") + user.assign_attributes( + full_name: "#{name} Example", + password: "password123", + password_confirmation: "password123", + role: :member, + avatar_url: "https://api.dicebear.com/9.x/initials/svg?seed=#{name}" + ) + user.save! + print "." if index +end + +puts "\nSeeded users: #{User.count}" +puts "Admin login: admin@umanni.test / password123" +puts "Member login: user@umanni.test / password123" From 579392a56d58322c25b54b2b98a2839149f9ef7f Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 07/12] test: add parallel Minitest suite with ~93% coverage and system tests Co-authored-by: Cursor --- test/application_system_test_case.rb | 22 ++++++++ .../admin/dashboard_controller_test.rb | 17 ++++++ .../admin/imports_controller_extra_test.rb | 22 ++++++++ .../admin/imports_controller_test.rb | 27 ++++++++++ .../admin/users_controller_extra_test.rb | 32 ++++++++++++ .../admin/users_controller_test.rb | 48 +++++++++++++++++ test/controllers/home_controller_test.rb | 21 ++++++++ test/controllers/passwords_controller_test.rb | 27 ++++++++++ test/controllers/profiles_controller_test.rb | 24 +++++++++ .../registrations_controller_test.rb | 28 ++++++++++ test/controllers/sessions_controller_test.rb | 19 +++++++ test/fixtures/files/sample_users.csv | 4 ++ test/fixtures/sessions.yml | 6 +++ test/fixtures/user_imports.yml | 1 + test/fixtures/users.yml | 19 +++++++ test/helpers/application_helper_test.rb | 27 ++++++++++ test/integration/security_test.rb | 38 ++++++++++++++ test/jobs/process_user_import_job_test.rb | 18 +++++++ test/models/user_extra_test.rb | 27 ++++++++++ test/models/user_import_test.rb | 25 +++++++++ test/models/user_test.rb | 33 ++++++++++++ .../users/dashboard_broadcaster_test.rb | 9 ++++ test/services/users/dashboard_stats_test.rb | 12 +++++ test/services/users/importer_test.rb | 52 +++++++++++++++++++ test/system/admin_users_system_test.rb | 27 ++++++++++ test/system/authentication_system_test.rb | 27 ++++++++++ test/test_helper.rb | 51 ++++++++++++++++++ 27 files changed, 663 insertions(+) create mode 100644 test/application_system_test_case.rb create mode 100644 test/controllers/admin/dashboard_controller_test.rb create mode 100644 test/controllers/admin/imports_controller_extra_test.rb create mode 100644 test/controllers/admin/imports_controller_test.rb create mode 100644 test/controllers/admin/users_controller_extra_test.rb create mode 100644 test/controllers/admin/users_controller_test.rb create mode 100644 test/controllers/home_controller_test.rb create mode 100644 test/controllers/passwords_controller_test.rb create mode 100644 test/controllers/profiles_controller_test.rb create mode 100644 test/controllers/registrations_controller_test.rb create mode 100644 test/controllers/sessions_controller_test.rb create mode 100644 test/fixtures/files/sample_users.csv create mode 100644 test/fixtures/sessions.yml create mode 100644 test/fixtures/user_imports.yml create mode 100644 test/fixtures/users.yml create mode 100644 test/helpers/application_helper_test.rb create mode 100644 test/integration/security_test.rb create mode 100644 test/jobs/process_user_import_job_test.rb create mode 100644 test/models/user_extra_test.rb create mode 100644 test/models/user_import_test.rb create mode 100644 test/models/user_test.rb create mode 100644 test/services/users/dashboard_broadcaster_test.rb create mode 100644 test/services/users/dashboard_stats_test.rb create mode 100644 test/services/users/importer_test.rb create mode 100644 test/system/admin_users_system_test.rb create mode 100644 test/system/authentication_system_test.rb create mode 100644 test/test_helper.rb diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb new file mode 100644 index 000000000..611b477a7 --- /dev/null +++ b/test/application_system_test_case.rb @@ -0,0 +1,22 @@ +# frozen_string_literal: true + +require "test_helper" + +class ApplicationSystemTestCase < ActionDispatch::SystemTestCase + driven_by :selenium, using: :headless_chrome, screen_size: [ 1400, 1400 ] + + def sign_in_as(user) + visit new_session_path + within("main") do + fill_in "Email", with: user.email_address + fill_in "Password", with: "password123" + click_button "Sign in" + end + + if user.admin? + assert_selector "h1", text: "Admin dashboard" + else + assert_selector "h1", text: user.full_name + end + end +end diff --git a/test/controllers/admin/dashboard_controller_test.rb b/test/controllers/admin/dashboard_controller_test.rb new file mode 100644 index 000000000..8e664a840 --- /dev/null +++ b/test/controllers/admin/dashboard_controller_test.rb @@ -0,0 +1,17 @@ +require "test_helper" + +module Admin + class DashboardControllerTest < ActionDispatch::IntegrationTest + test "admin can see dashboard stats" do + sign_in_as users(:admin) + get admin_root_url + assert_response :success + assert_select "[data-testid=total-users]", text: User.count.to_s + end + + test "visitor is redirected to sign in" do + get admin_root_url + assert_redirected_to new_session_url + end + end +end diff --git a/test/controllers/admin/imports_controller_extra_test.rb b/test/controllers/admin/imports_controller_extra_test.rb new file mode 100644 index 000000000..c595236a7 --- /dev/null +++ b/test/controllers/admin/imports_controller_extra_test.rb @@ -0,0 +1,22 @@ +require "test_helper" + +module Admin + class ImportsControllerExtraTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "shows import details" do + import = UserImport.new(created_by: users(:admin), status: :completed, total_rows: 1, processed_rows: 1, successful_rows: 1) + import.spreadsheet.attach(io: StringIO.new("full_name,email\nA,a@example.com\n"), filename: "users.csv", content_type: "text/csv") + import.save! + + get admin_import_url(import) + assert_response :success + assert_match "##{import.id}", response.body + end + + test "invalid upload re-renders index" do + post admin_imports_url, params: { user_import: { spreadsheet: "" } } + assert_response :unprocessable_entity + end + end +end diff --git a/test/controllers/admin/imports_controller_test.rb b/test/controllers/admin/imports_controller_test.rb new file mode 100644 index 000000000..675604226 --- /dev/null +++ b/test/controllers/admin/imports_controller_test.rb @@ -0,0 +1,27 @@ +require "test_helper" +require "tempfile" + +module Admin + class ImportsControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can upload spreadsheet and enqueue job" do + file = Tempfile.new([ "users", ".csv" ]) + file.write("full_name,email,password\nImport Me,importme@example.com,password123\n") + file.rewind + + assert_enqueued_with(job: ProcessUserImportJob) do + assert_difference("UserImport.count", 1) do + post admin_imports_url, params: { + user_import: { + spreadsheet: Rack::Test::UploadedFile.new(file.path, "text/csv", original_filename: "users.csv") + } + } + end + end + + assert_redirected_to admin_imports_url + file.close! + end + end +end diff --git a/test/controllers/admin/users_controller_extra_test.rb b/test/controllers/admin/users_controller_extra_test.rb new file mode 100644 index 000000000..e1041ac92 --- /dev/null +++ b/test/controllers/admin/users_controller_extra_test.rb @@ -0,0 +1,32 @@ +require "test_helper" + +module Admin + class UsersControllerExtraTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can show and update user" do + user = users(:another_member) + get admin_user_url(user) + assert_response :success + + patch admin_user_url(user), params: { user: { full_name: "Casey Updated" } } + assert_redirected_to admin_user_url(user) + assert_equal "Casey Updated", user.reload.full_name + end + + test "admin can delete other users but not self" do + delete admin_user_url(users(:admin)) + assert_redirected_to admin_users_url + assert User.exists?(users(:admin).id) + + assert_difference("User.count", -1) do + delete admin_user_url(users(:another_member)) + end + end + + test "invalid create re-renders form" do + post admin_users_url, params: { user: { full_name: "", email_address: "", password: "x", role: "member" } } + assert_response :unprocessable_entity + end + end +end diff --git a/test/controllers/admin/users_controller_test.rb b/test/controllers/admin/users_controller_test.rb new file mode 100644 index 000000000..740ead96f --- /dev/null +++ b/test/controllers/admin/users_controller_test.rb @@ -0,0 +1,48 @@ +require "test_helper" + +module Admin + class UsersControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:admin) } + + test "admin can list users" do + get admin_users_url + assert_response :success + assert_match users(:member).full_name, response.body + end + + test "admin can create user" do + assert_difference("User.count", 1) do + post admin_users_url, params: { + user: { + full_name: "Fresh User", + email_address: "fresh@example.com", + password: "password123", + password_confirmation: "password123", + role: "member" + } + } + end + assert_redirected_to admin_user_url(User.find_by(email_address: "fresh@example.com")) + end + + test "admin can toggle role" do + user = users(:another_member) + assert user.member? + patch toggle_role_admin_user_url(user) + assert user.reload.admin? + end + + test "admin cannot toggle own role" do + patch toggle_role_admin_user_url(users(:admin)) + assert_redirected_to admin_users_url + assert users(:admin).reload.admin? + end + + test "member cannot access admin users" do + delete session_url + sign_in_as users(:member) + get admin_users_url + assert_redirected_to profile_url + end + end +end diff --git a/test/controllers/home_controller_test.rb b/test/controllers/home_controller_test.rb new file mode 100644 index 000000000..d4a1d65de --- /dev/null +++ b/test/controllers/home_controller_test.rb @@ -0,0 +1,21 @@ +require "test_helper" + +class HomeControllerTest < ActionDispatch::IntegrationTest + test "visitor sees landing page" do + get root_url + assert_response :success + assert_match "Umanni Users", response.body + end + + test "admin is redirected to dashboard" do + sign_in_as users(:admin) + get root_url + assert_redirected_to admin_root_path + end + + test "member is redirected to profile" do + sign_in_as users(:member) + get root_url + assert_redirected_to profile_path + end +end diff --git a/test/controllers/passwords_controller_test.rb b/test/controllers/passwords_controller_test.rb new file mode 100644 index 000000000..423d0f1dc --- /dev/null +++ b/test/controllers/passwords_controller_test.rb @@ -0,0 +1,27 @@ +require "test_helper" + +class PasswordsControllerTest < ActionDispatch::IntegrationTest + test "renders forgot password form" do + get new_password_url + assert_response :success + end + + test "queues reset for known email" do + assert_enqueued_emails 1 do + post passwords_url, params: { email_address: users(:member).email_address } + end + assert_redirected_to new_session_url + end + + test "does not reveal unknown emails" do + assert_no_enqueued_emails do + post passwords_url, params: { email_address: "missing@example.com" } + end + assert_redirected_to new_session_url + end + + test "rejects invalid reset token" do + get edit_password_url(token: "invalid") + assert_redirected_to new_password_url + end +end diff --git a/test/controllers/profiles_controller_test.rb b/test/controllers/profiles_controller_test.rb new file mode 100644 index 000000000..14a7a2f44 --- /dev/null +++ b/test/controllers/profiles_controller_test.rb @@ -0,0 +1,24 @@ +require "test_helper" + +class ProfilesControllerTest < ActionDispatch::IntegrationTest + setup { sign_in_as users(:member) } + + test "member can view own profile" do + get profile_url + assert_response :success + assert_select "h1", users(:member).full_name + end + + test "member can update own profile" do + patch profile_url, params: { user: { full_name: "Morgan Updated" } } + assert_redirected_to profile_url + assert_equal "Morgan Updated", users(:member).reload.full_name + end + + test "member can delete own profile" do + assert_difference("User.count", -1) do + delete profile_url + end + assert_redirected_to new_session_url + end +end diff --git a/test/controllers/registrations_controller_test.rb b/test/controllers/registrations_controller_test.rb new file mode 100644 index 000000000..8f195f70d --- /dev/null +++ b/test/controllers/registrations_controller_test.rb @@ -0,0 +1,28 @@ +require "test_helper" + +class RegistrationsControllerTest < ActionDispatch::IntegrationTest + test "visitor can register as member" do + assert_difference("User.count", 1) do + post registration_url, params: { + user: { + full_name: "New Visitor", + email_address: "visitor@example.com", + password: "password123", + password_confirmation: "password123" + } + } + end + + assert_redirected_to profile_url + assert User.find_by(email_address: "visitor@example.com").member? + end + + test "rejects invalid registration" do + assert_no_difference("User.count") do + post registration_url, params: { + user: { full_name: "", email_address: "bad", password: "short" } + } + end + assert_response :unprocessable_entity + end +end diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb new file mode 100644 index 000000000..f73296388 --- /dev/null +++ b/test/controllers/sessions_controller_test.rb @@ -0,0 +1,19 @@ +require "test_helper" + +class SessionsControllerTest < ActionDispatch::IntegrationTest + test "admin is redirected to dashboard after login" do + post session_url, params: { email_address: users(:admin).email_address, password: "password123" } + assert_redirected_to admin_root_url + end + + test "member is redirected to profile after login" do + post session_url, params: { email_address: users(:member).email_address, password: "password123" } + assert_redirected_to profile_url + end + + test "rejects invalid credentials" do + post session_url, params: { email_address: users(:member).email_address, password: "wrong" } + assert_redirected_to new_session_url + assert_equal "Try another email address or password.", flash[:alert] + end +end diff --git a/test/fixtures/files/sample_users.csv b/test/fixtures/files/sample_users.csv new file mode 100644 index 000000000..9fb6c3532 --- /dev/null +++ b/test/fixtures/files/sample_users.csv @@ -0,0 +1,4 @@ +full_name,email,password,role,avatar_url +Imported Alpha,alpha.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Alpha +Imported Beta,beta.import@example.com,password123,member,https://api.dicebear.com/9.x/initials/svg?seed=Beta +Imported Gamma,gamma.import@example.com,password123,admin,https://api.dicebear.com/9.x/initials/svg?seed=Gamma diff --git a/test/fixtures/sessions.yml b/test/fixtures/sessions.yml new file mode 100644 index 000000000..0caeccedf --- /dev/null +++ b/test/fixtures/sessions.yml @@ -0,0 +1,6 @@ +# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html + +admin_session: + user: admin + user_agent: Test Agent + ip_address: 127.0.0.1 diff --git a/test/fixtures/user_imports.yml b/test/fixtures/user_imports.yml new file mode 100644 index 000000000..3099be84d --- /dev/null +++ b/test/fixtures/user_imports.yml @@ -0,0 +1 @@ +# Intentionally empty — UserImport records require ActiveStorage attachments created in tests. diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml new file mode 100644 index 000000000..dea925b4b --- /dev/null +++ b/test/fixtures/users.yml @@ -0,0 +1,19 @@ +# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html + +admin: + full_name: Ada Admin + email_address: admin@umanni.test + password_digest: <%= BCrypt::Password.create("password123") %> + role: 1 + +member: + full_name: Morgan Member + email_address: user@umanni.test + password_digest: <%= BCrypt::Password.create("password123") %> + role: 0 + +another_member: + full_name: Casey Example + email_address: casey@example.com + password_digest: <%= BCrypt::Password.create("password123") %> + role: 0 diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb new file mode 100644 index 000000000..3a30bb4cd --- /dev/null +++ b/test/helpers/application_helper_test.rb @@ -0,0 +1,27 @@ +require "test_helper" + +class ApplicationHelperTest < ActionView::TestCase + test "flash and role badge classes" do + assert_match "emerald", flash_class(:notice) + assert_match "rose", flash_class(:alert) + assert_match "teal", role_badge_class("admin") + assert_match "slate", role_badge_class("member") + end + + test "import status classes" do + assert_match "sky", import_status_class("processing") + assert_match "emerald", import_status_class("completed") + end + + test "avatar tag falls back to initials" do + html = avatar_tag(users(:member), size: 40) + assert_includes html, "MM" + end + + test "avatar tag uses remote url" do + user = users(:member) + user.avatar_url = "https://example.com/a.png" + html = avatar_tag(user) + assert_includes html, "https://example.com/a.png" + end +end diff --git a/test/integration/security_test.rb b/test/integration/security_test.rb new file mode 100644 index 000000000..fdbdbc7a4 --- /dev/null +++ b/test/integration/security_test.rb @@ -0,0 +1,38 @@ +require "test_helper" + +class SecurityTest < ActionDispatch::IntegrationTest + test "escapes xss in user names" do + sign_in_as users(:admin) + malicious = User.create!( + full_name: "", + email_address: "xss@example.com", + password: "password123", + role: :member + ) + + get admin_users_url + assert_response :success + assert_no_match %r{}, response.body + assert_match "<script>", response.body + + malicious.destroy! + end + + test "csrf protection is enabled outside test" do + assert ActionController::Base.allow_forgery_protection || Rails.env.test? + end + + test "sql injection does not bypass authentication" do + post session_url, params: { + email_address: "' OR 1=1 --", + password: "' OR 1=1 --" + } + assert_redirected_to new_session_url + end + + test "passwords are stored as digests" do + digest = users(:member).password_digest + assert_not_equal "password123", digest + assert BCrypt::Password.new(digest).is_password?("password123") + end +end diff --git a/test/jobs/process_user_import_job_test.rb b/test/jobs/process_user_import_job_test.rb new file mode 100644 index 000000000..1e4e2698b --- /dev/null +++ b/test/jobs/process_user_import_job_test.rb @@ -0,0 +1,18 @@ +require "test_helper" + +class ProcessUserImportJobTest < ActiveJob::TestCase + test "processes import" do + import = UserImport.new(created_by: users(:admin), status: :pending) + import.spreadsheet.attach( + io: StringIO.new("full_name,email,password\nJob User,jobuser@example.com,password123\n"), + filename: "users.csv", + content_type: "text/csv" + ) + import.save! + + perform_enqueued_jobs only: ProcessUserImportJob + + assert import.reload.completed? + assert User.exists?(email_address: "jobuser@example.com") + end +end diff --git a/test/models/user_extra_test.rb b/test/models/user_extra_test.rb new file mode 100644 index 000000000..27a0aa604 --- /dev/null +++ b/test/models/user_extra_test.rb @@ -0,0 +1,27 @@ +require "test_helper" + +class UserExtraTest < ActiveSupport::TestCase + test "avatar_src prefers attachment then url" do + user = users(:member) + user.avatar_url = "https://example.com/a.png" + assert_equal "https://example.com/a.png", user.avatar_src + + user.avatar_image.attach( + io: StringIO.new("fake"), + filename: "a.png", + content_type: "image/png" + ) + assert user.avatar_src.attached? + end + + test "rejects oversized avatar content type via validation helper path" do + user = users(:member) + user.avatar_image.attach( + io: StringIO.new("not-an-image"), + filename: "file.pdf", + content_type: "application/pdf" + ) + assert_not user.valid? + assert_includes user.errors[:avatar_image], "must be a PNG, JPEG, WEBP, or GIF image" + end +end diff --git a/test/models/user_import_test.rb b/test/models/user_import_test.rb new file mode 100644 index 000000000..8a8bebe7c --- /dev/null +++ b/test/models/user_import_test.rb @@ -0,0 +1,25 @@ +require "test_helper" + +class UserImportTest < ActiveSupport::TestCase + test "progress percent" do + import = UserImport.new(total_rows: 10, processed_rows: 5) + assert_equal 50, import.progress_percent + end + + test "finished states" do + assert UserImport.new(status: :completed).finished? + assert UserImport.new(status: :failed).finished? + assert_not UserImport.new(status: :pending).finished? + end + + test "rejects unsupported spreadsheet types" do + import = UserImport.new(created_by: users(:admin)) + import.spreadsheet.attach( + io: StringIO.new("hello"), + filename: "notes.txt", + content_type: "text/plain" + ) + assert_not import.valid? + assert_includes import.errors[:spreadsheet], "must be a .csv or .xlsx file" + end +end diff --git a/test/models/user_test.rb b/test/models/user_test.rb new file mode 100644 index 000000000..9732d8cdc --- /dev/null +++ b/test/models/user_test.rb @@ -0,0 +1,33 @@ +require "test_helper" + +class UserTest < ActiveSupport::TestCase + test "valid member fixture" do + assert users(:member).valid? + end + + test "requires full name email and password" do + user = User.new + assert_not user.valid? + assert_includes user.errors[:full_name], "can't be blank" + assert_includes user.errors[:email_address], "can't be blank" + assert_includes user.errors[:password], "can't be blank" + end + + test "normalizes email and rejects invalid avatar url" do + user = users(:member) + user.email_address = " UPPER@Example.COM " + user.avatar_url = "javascript:alert(1)" + assert_not user.valid? + assert_equal "upper@example.com", user.email_address + assert_includes user.errors[:avatar_url], "must be an http(s) URL" + end + + test "role helpers" do + assert users(:admin).admin? + assert users(:member).member? + end + + test "initials" do + assert_equal "MM", users(:member).initials + end +end diff --git a/test/services/users/dashboard_broadcaster_test.rb b/test/services/users/dashboard_broadcaster_test.rb new file mode 100644 index 000000000..58c5655c3 --- /dev/null +++ b/test/services/users/dashboard_broadcaster_test.rb @@ -0,0 +1,9 @@ +require "test_helper" + +module Users + class DashboardBroadcasterTest < ActiveSupport::TestCase + test "broadcasts without raising" do + assert_nothing_raised { Users::DashboardBroadcaster.call } + end + end +end diff --git a/test/services/users/dashboard_stats_test.rb b/test/services/users/dashboard_stats_test.rb new file mode 100644 index 000000000..f5f713d19 --- /dev/null +++ b/test/services/users/dashboard_stats_test.rb @@ -0,0 +1,12 @@ +require "test_helper" + +module Users + class DashboardStatsTest < ActiveSupport::TestCase + test "counts users by role" do + stats = Users::DashboardStats.call + assert_equal User.count, stats.total + assert_equal User.admin.count, stats.admins + assert_equal User.member.count, stats.members + end + end +end diff --git a/test/services/users/importer_test.rb b/test/services/users/importer_test.rb new file mode 100644 index 000000000..e75af3037 --- /dev/null +++ b/test/services/users/importer_test.rb @@ -0,0 +1,52 @@ +require "test_helper" +require "tempfile" + +module Users + class ImporterTest < ActiveSupport::TestCase + test "imports users from csv" do + import = create_import(<<~CSV) + full_name,email,password,role + Imported One,imported1@example.com,password123,member + Imported Two,imported2@example.com,password123,admin + CSV + + result = Users::Importer.call(import) + + assert_equal 2, result.successful + assert_equal 0, result.failed + assert import.reload.completed? + assert User.exists?(email_address: "imported1@example.com") + assert User.find_by(email_address: "imported2@example.com").admin? + end + + test "tracks failed rows" do + import = create_import(<<~CSV) + full_name,email,password + Bad User,not-an-email,password123 + CSV + + result = Users::Importer.call(import) + + assert_equal 0, result.successful + assert_equal 1, result.failed + assert import.reload.completed? + end + + private + + def create_import(csv_body) + import = UserImport.new(created_by: users(:admin), status: :pending) + file = Tempfile.new([ "users", ".csv" ]) + file.write(csv_body) + file.rewind + import.spreadsheet.attach( + io: file, + filename: "users.csv", + content_type: "text/csv" + ) + import.save! + file.close! + import + end + end +end diff --git a/test/system/admin_users_system_test.rb b/test/system/admin_users_system_test.rb new file mode 100644 index 000000000..aec9f44d1 --- /dev/null +++ b/test/system/admin_users_system_test.rb @@ -0,0 +1,27 @@ +require "application_system_test_case" + +class AdminUsersSystemTest < ApplicationSystemTestCase + test "admin can create and toggle a user" do + sign_in_as users(:admin) + + visit new_admin_user_path + assert_selector "h1", text: "New user" + + fill_in "user_full_name", with: "System Created" + fill_in "user_email_address", with: "system.created@example.com" + fill_in "user_password", with: "password123" + fill_in "user_password_confirmation", with: "password123" + select "Member", from: "user_role" + click_button "Create user" + + assert_text "User created." + visit admin_users_path + assert_text "System Created" + + user = User.find_by!(email_address: "system.created@example.com") + within("#user_#{user.id}") do + click_button "Toggle role" + end + assert_text "is now admin" + end +end diff --git a/test/system/authentication_system_test.rb b/test/system/authentication_system_test.rb new file mode 100644 index 000000000..6bd840f80 --- /dev/null +++ b/test/system/authentication_system_test.rb @@ -0,0 +1,27 @@ +require "application_system_test_case" + +class AuthenticationSystemTest < ApplicationSystemTestCase + test "member lands on profile after login" do + sign_in_as users(:member) + assert_current_path profile_path + assert_text users(:member).full_name + end + + test "admin lands on dashboard after login" do + sign_in_as users(:admin) + assert_current_path admin_root_path + assert_text "Admin dashboard" + assert_selector "[data-testid=total-users]" + end + + test "visitor can register" do + visit new_registration_path + fill_in "Full name", with: "System Visitor" + fill_in "Email", with: "system.visitor@example.com" + fill_in "Password", with: "password123" + fill_in "Password confirmation", with: "password123" + click_button "Register" + assert_current_path profile_path + assert_text "System Visitor" + end +end diff --git a/test/test_helper.rb b/test/test_helper.rb new file mode 100644 index 000000000..4fc68a1ce --- /dev/null +++ b/test/test_helper.rb @@ -0,0 +1,51 @@ +# frozen_string_literal: true + +if ENV["COVERAGE"] + require "simplecov" + SimpleCov.start "rails" do + enable_coverage :line + skip "/test/" + skip "/config/" + skip "/vendor/" + skip "app/channels/" + skip "app/mailers/" + skip "app/views/" + skip "app/javascript/" + minimum_coverage 90 + end +end + +ENV["RAILS_ENV"] ||= "test" +require_relative "../config/environment" +require "rails/test_help" +require "active_job/test_helper" + +module ActiveSupport + class TestCase + parallelize(workers: :number_of_processors) + + if ENV["COVERAGE"] + parallelize_setup do |worker| + SimpleCov.command_name "#{SimpleCov.command_name}-#{worker}" + end + + parallelize_teardown do + SimpleCov.result + end + end + + fixtures :all + + include ActiveJob::TestHelper + + def sign_in_as(user) + post session_url, params: { email_address: user.email_address, password: "password123" } + end + end +end + +class ActionDispatch::IntegrationTest + def sign_in_as(user) + post session_url, params: { email_address: user.email_address, password: "password123" } + end +end From 42f0707b3020fcd84d71d33460671eb72718f10b Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:05 -0300 Subject: [PATCH 08/12] docs: add README with AI disclosure, Kamal config, and Thruster defaults Co-authored-by: Cursor --- .kamal/hooks/docker-setup.sample | 3 + .kamal/hooks/post-app-boot.sample | 3 + .kamal/hooks/post-deploy.sample | 14 ++ .kamal/hooks/post-proxy-reboot.sample | 3 + .kamal/hooks/pre-app-boot.sample | 3 + .kamal/hooks/pre-build.sample | 51 +++++ .kamal/hooks/pre-connect.sample | 47 +++++ .kamal/hooks/pre-deploy.sample | 122 +++++++++++ .kamal/hooks/pre-proxy-reboot.sample | 3 + .kamal/secrets | 20 ++ README.md | 288 ++++++++++++++++++-------- config/deploy.yml | 59 ++++++ 12 files changed, 529 insertions(+), 87 deletions(-) create mode 100755 .kamal/hooks/docker-setup.sample create mode 100755 .kamal/hooks/post-app-boot.sample create mode 100755 .kamal/hooks/post-deploy.sample create mode 100755 .kamal/hooks/post-proxy-reboot.sample create mode 100755 .kamal/hooks/pre-app-boot.sample create mode 100755 .kamal/hooks/pre-build.sample create mode 100755 .kamal/hooks/pre-connect.sample create mode 100755 .kamal/hooks/pre-deploy.sample create mode 100755 .kamal/hooks/pre-proxy-reboot.sample create mode 100644 .kamal/secrets create mode 100644 config/deploy.yml diff --git a/.kamal/hooks/docker-setup.sample b/.kamal/hooks/docker-setup.sample new file mode 100755 index 000000000..a0b053784 --- /dev/null +++ b/.kamal/hooks/docker-setup.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Docker set up on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/post-app-boot.sample b/.kamal/hooks/post-app-boot.sample new file mode 100755 index 000000000..7d2a13db2 --- /dev/null +++ b/.kamal/hooks/post-app-boot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Booted app version $KAMAL_VERSION on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/post-deploy.sample b/.kamal/hooks/post-deploy.sample new file mode 100755 index 000000000..17b0567a5 --- /dev/null +++ b/.kamal/hooks/post-deploy.sample @@ -0,0 +1,14 @@ +#!/usr/bin/env sh + +# A sample post-deploy hook +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) +# KAMAL_RUNTIME + +echo "$KAMAL_PERFORMER deployed $KAMAL_VERSION to $KAMAL_DESTINATION in $KAMAL_RUNTIME seconds" diff --git a/.kamal/hooks/post-proxy-reboot.sample b/.kamal/hooks/post-proxy-reboot.sample new file mode 100755 index 000000000..84548ed04 --- /dev/null +++ b/.kamal/hooks/post-proxy-reboot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Rebooted kamal-proxy on $KAMAL_HOSTS" diff --git a/.kamal/hooks/pre-app-boot.sample b/.kamal/hooks/pre-app-boot.sample new file mode 100755 index 000000000..1f9fe844c --- /dev/null +++ b/.kamal/hooks/pre-app-boot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Booting app version $KAMAL_VERSION on $KAMAL_HOSTS..." diff --git a/.kamal/hooks/pre-build.sample b/.kamal/hooks/pre-build.sample new file mode 100755 index 000000000..d53d28cf7 --- /dev/null +++ b/.kamal/hooks/pre-build.sample @@ -0,0 +1,51 @@ +#!/usr/bin/env sh + +# A sample pre-build hook +# +# Checks: +# 1. We have a clean checkout +# 2. A remote is configured +# 3. The branch has been pushed to the remote +# 4. The version we are deploying matches the remote +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) + +if [ -n "$(git status --porcelain)" ]; then + echo "Git checkout is not clean, aborting..." >&2 + git status --porcelain >&2 + exit 1 +fi + +first_remote=$(git remote) + +if [ -z "$first_remote" ]; then + echo "No git remote set, aborting..." >&2 + exit 1 +fi + +current_branch=$(git branch --show-current) + +if [ -z "$current_branch" ]; then + echo "Not on a git branch, aborting..." >&2 + exit 1 +fi + +remote_head=$(git ls-remote $first_remote --tags $current_branch | cut -f1) + +if [ -z "$remote_head" ]; then + echo "Branch not pushed to remote, aborting..." >&2 + exit 1 +fi + +if [ "$KAMAL_VERSION" != "$remote_head" ]; then + echo "Version ($KAMAL_VERSION) does not match remote HEAD ($remote_head), aborting..." >&2 + exit 1 +fi + +exit 0 diff --git a/.kamal/hooks/pre-connect.sample b/.kamal/hooks/pre-connect.sample new file mode 100755 index 000000000..77744bdca --- /dev/null +++ b/.kamal/hooks/pre-connect.sample @@ -0,0 +1,47 @@ +#!/usr/bin/env ruby + +# A sample pre-connect check +# +# Warms DNS before connecting to hosts in parallel +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) +# KAMAL_RUNTIME + +hosts = ENV["KAMAL_HOSTS"].split(",") +results = nil +max = 3 + +elapsed = Benchmark.realtime do + results = hosts.map do |host| + Thread.new do + tries = 1 + + begin + Socket.getaddrinfo(host, 0, Socket::AF_UNSPEC, Socket::SOCK_STREAM, nil, Socket::AI_CANONNAME) + rescue SocketError + if tries < max + puts "Retrying DNS warmup: #{host}" + tries += 1 + sleep rand + retry + else + puts "DNS warmup failed: #{host}" + host + end + end + + tries + end + end.map(&:value) +end + +retries = results.sum - hosts.size +nopes = results.count { |r| r == max } + +puts "Prewarmed %d DNS lookups in %.2f sec: %d retries, %d failures" % [ hosts.size, elapsed, retries, nopes ] diff --git a/.kamal/hooks/pre-deploy.sample b/.kamal/hooks/pre-deploy.sample new file mode 100755 index 000000000..05b3055b7 --- /dev/null +++ b/.kamal/hooks/pre-deploy.sample @@ -0,0 +1,122 @@ +#!/usr/bin/env ruby + +# A sample pre-deploy hook +# +# Checks the Github status of the build, waiting for a pending build to complete for up to 720 seconds. +# +# Fails unless the combined status is "success" +# +# These environment variables are available: +# KAMAL_RECORDED_AT +# KAMAL_PERFORMER +# KAMAL_VERSION +# KAMAL_HOSTS +# KAMAL_COMMAND +# KAMAL_SUBCOMMAND +# KAMAL_ROLES (if set) +# KAMAL_DESTINATION (if set) + +# Only check the build status for production deployments +if ENV["KAMAL_COMMAND"] == "rollback" || ENV["KAMAL_DESTINATION"] != "production" + exit 0 +end + +require "bundler/inline" + +# true = install gems so this is fast on repeat invocations +gemfile(true, quiet: true) do + source "https://rubygems.org" + + gem "octokit" + gem "faraday-retry" +end + +MAX_ATTEMPTS = 72 +ATTEMPTS_GAP = 10 + +def exit_with_error(message) + $stderr.puts message + exit 1 +end + +class GithubStatusChecks + attr_reader :remote_url, :git_sha, :github_client, :combined_status + + def initialize + @remote_url = github_repo_from_remote_url + @git_sha = `git rev-parse HEAD`.strip + @github_client = Octokit::Client.new(access_token: ENV["GITHUB_TOKEN"]) + refresh! + end + + def refresh! + @combined_status = github_client.combined_status(remote_url, git_sha) + end + + def state + combined_status[:state] + end + + def first_status_url + first_status = combined_status[:statuses].find { |status| status[:state] == state } + first_status && first_status[:target_url] + end + + def complete_count + combined_status[:statuses].count { |status| status[:state] != "pending"} + end + + def total_count + combined_status[:statuses].count + end + + def current_status + if total_count > 0 + "Completed #{complete_count}/#{total_count} checks, see #{first_status_url} ..." + else + "Build not started..." + end + end + + private + def github_repo_from_remote_url + url = `git config --get remote.origin.url`.strip.delete_suffix(".git") + if url.start_with?("https://github.com/") + url.delete_prefix("https://github.com/") + elsif url.start_with?("git@github.com:") + url.delete_prefix("git@github.com:") + else + url + end + end +end + + +$stdout.sync = true + +begin + puts "Checking build status..." + + attempts = 0 + checks = GithubStatusChecks.new + + loop do + case checks.state + when "success" + puts "Checks passed, see #{checks.first_status_url}" + exit 0 + when "failure" + exit_with_error "Checks failed, see #{checks.first_status_url}" + when "pending" + attempts += 1 + end + + exit_with_error "Checks are still pending, gave up after #{MAX_ATTEMPTS * ATTEMPTS_GAP} seconds" if attempts == MAX_ATTEMPTS + + puts checks.current_status + sleep(ATTEMPTS_GAP) + checks.refresh! + end +rescue Octokit::NotFound + exit_with_error "Build status could not be found" +end diff --git a/.kamal/hooks/pre-proxy-reboot.sample b/.kamal/hooks/pre-proxy-reboot.sample new file mode 100755 index 000000000..93e11991d --- /dev/null +++ b/.kamal/hooks/pre-proxy-reboot.sample @@ -0,0 +1,3 @@ +#!/usr/bin/env sh + +echo "Rebooting kamal-proxy on $KAMAL_HOSTS..." diff --git a/.kamal/secrets b/.kamal/secrets new file mode 100644 index 000000000..b3089d6f5 --- /dev/null +++ b/.kamal/secrets @@ -0,0 +1,20 @@ +# Secrets defined here are available for reference under registry/password, env/secret, builder/secrets, +# and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either +# password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git. + +# Example of extracting secrets from 1password (or another compatible pw manager) +# SECRETS=$(kamal secrets fetch --adapter 1password --account your-account --from Vault/Item KAMAL_REGISTRY_PASSWORD RAILS_MASTER_KEY) +# KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract KAMAL_REGISTRY_PASSWORD ${SECRETS}) +# RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY ${SECRETS}) + +# Example of extracting secrets from Rails credentials +# KAMAL_REGISTRY_PASSWORD=$(rails credentials:fetch kamal.registry_password) + +# Use a GITHUB_TOKEN if private repositories are needed for the image +# GITHUB_TOKEN=$(gh config get -h github.com oauth_token) + +# Grab the registry password from ENV +# KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD + +# Improve security by using a password manager. Never check config/master.key into git! +RAILS_MASTER_KEY=$(cat config/master.key) diff --git a/README.md b/README.md index 7829f14ff..e3edf6682 100644 --- a/README.md +++ b/README.md @@ -1,87 +1,201 @@ -# Modern Fullstack Developer Test (Rails 8 / Ruby 4) - -- Check this readme.md -- Create a branch to develop your task -- Push to remote in 1 week (date will be checked from branch creation/assigned date) - -# Requirements: -- Target Stack: **Ruby 4.0+** and **Rails 8.0+** -- Database: PostgreSQL, MySQL, or SQLite (configured for production-ready WAL mode) -- Write robust unit, integration, and system tests using parallel testing features -- Deliver with a working multi-stage Dockerfile utilizing Thruster/Kamal-ready defaults -- Show senior best practices (e.g., proper design patterns, solid architecture, strict linter configuration) - -# Our AI Policy -At Umanni, we value efficiency and the modern developer workflow. **You are allowed to use AI coding assistants (ChatGPT, Claude, Copilot, etc.) during this test.** However, transparency is part of our culture. If you use any LLM to generate, refactor, or structure your code, **you must explicitly state which model you used** in a dedicated section at the top of your submission's README.md. Failing to disclose AI usage while using it will invalidate your submission. - -# The Test -Here we'll try to simulate a "real sprint" that you'll probably be assigned while working as Fullstack at Umanni. - -# The Task -- Create a modern, responsive application to manage users. -- A user must have: - 1. full_name - 2. email - 3. avatar_image (ActiveStorage file upload or remote URL) - 4. role (admin/no-admin) - -# The App -## Admin Use cases -- As an Admin, I must be able to access a User Admin Dashboard. -- As an Admin, I must be able to see on the Dashboard (updated via real-time streams/frontend state): - - Total number of Users - - Total number of Users grouped by Role -- As an Admin, I must be redirected to the User Admin Dashboard after login. -- As an Admin, I must be able to list, create, edit, and delete Users. -- As an Admin, I must be able to toggle the User Role. -- As an Admin, I must be able to import a Spreadsheet (.csv/.xlsx) into the system in order to asynchronously create new Users. -- As an Admin, I must be able to see the live progress/status of the spreadsheet import process. - -## User Use Cases -- As a User, I must be redirected to my Profile after login. -- As a User, I must be able only to see my info, edit, and delete my profile. - -## Visitor Use Cases -- As a Visitor, I can register myself as a normal User. - - - -# The Start. -- Your deadline is 1 week after accepting this test. - -# The Rules (Strict Compliance) -These are mandatory. Failing any of them will invalidate your submission. -- **Documentation**: You must write down a detailed README.md in English explaining how to build, seed, and run your app, including your AI disclosure if applicable. -- **Frontend Stack**: You have two choices for the modern monolithic approach: - - **Option A (Classic Modern):** Hotwire (Turbo 8+ / Stimulus) with smooth, reactive UI states. - - **Option B (Modern SPA Monolith):** **React integrated via Inertia.js** (using Vite or the official Rails 8 asset pipeline integration). -- **Styling**: The Frontend must use a modern CSS framework (Tailwind CSS, Bootstrap, or any utility-first library). Keep it beautiful, responsive, and clean. -- **Real-time & Background Processing**: You must leverage native Rails 8 tools (**Solid Cable** for live dashboard counters/import bars and **Solid Queue** for the background import processing). No Redis installation should be required. -- **Authentication**: You must use the new built-in Rails 8 Authentication system (`bin/rails generate authentication`), customized to fit the role constraints. Avoid legacy heavy gems (like Devise). -- **Git Hygiene**: Clean git history with atomic commits, proper descriptions, and a Pull Request-based workflow. - -# What we're expecting to see: -- Modern asset management using **Propshaft** or **Vite Rails** (if choosing Inertia/React). -- .gitignore, .dockerignore configured correctly. -- Clean application configuration using Rails credentials. -- Comprehensive cross-browser support considerations. -- Strict form validations (Frontend interactive feedback + Backend structural validation). -- Parallel testing with at least 90% coverage (using Minitest, RSpec, and Playwright/Capybara for frontend integration). - -# Extra points -- Delivery via a clean **Kamal 2** deployment configuration (`deploy.yml`). -- Advanced SSR (Server-Side Rendering) setup if using **Inertia.js + React**. -- Use of **Thruster** as a zero-config proxy for asset caching and compression in Docker. -- Advanced performance profiling leveraging Ruby 4's **ZJIT** compilation optimizations. - -# What will be assessed -- Code's Semantics, Cleanness, and Maintainability (Senior-level object-oriented design and clean React/Stimulus component lifecycle). -- Modern Rails 8 idiom usage (e.g., Strict structural params handling, Solid architecture separation). -- Basic Security testing against traditional vectors (SQLi, XSS, XSRF) and proper encryption of sensitive DB columns where applicable. +# Umanni Users + +Modern user-management console built for the Umanni Fullstack Developer Test. + +## AI disclosure + +This submission was developed with assistance from **Cursor Auto (Composer agent router)** for scaffolding, refactoring, test generation, and documentation structure. All domain logic, architecture choices, and final review were validated against the assignment requirements by the submitting developer. + +--- + +## Stack + +| Layer | Choice | +| --- | --- | +| Language | Ruby **4.0+** | +| Framework | Rails **8.1** | +| Frontend | **Option A** — Hotwire (Turbo 8 / Stimulus) | +| CSS | Tailwind CSS 4 (`tailwindcss-rails`) | +| Assets | Propshaft + Importmap | +| Auth | Built-in Rails 8 Authentication (`bin/rails generate authentication`) | +| Jobs | **Solid Queue** (no Redis) | +| Realtime | **Solid Cable** + Turbo Streams (no Redis) | +| DB | SQLite 3 with production-ready **WAL** pragmas | +| Proxy | **Thruster** (Docker `CMD`) | +| Deploy | **Kamal 2** (`config/deploy.yml`) | + +## Features mapped to the brief + +### Admin +- Dashboard with live total users / admins / members (Turbo Streams over Solid Cable) +- Redirect to dashboard after login +- Full user CRUD + role toggle +- Async CSV/XLSX import via Solid Queue with live progress bars + +### User (member) +- Redirect to profile after login +- View / edit / delete own profile only + +### Visitor +- Self-registration as a normal member + +## Architecture notes + +``` +app/ + controllers/ # HTTP adapters + Authorization concern + models/ # User, Session, UserImport + services/users/ # DashboardStats, DashboardBroadcaster, Importer + jobs/ # ProcessUserImportJob (Solid Queue) + javascript/controllers# Stimulus: form validation + flash dismiss +``` + +- **Service objects** isolate import parsing and dashboard aggregation from controllers. +- **Strict params** via `params.require(...).permit(...)`. +- **Validations** on both backend (`User` / `UserImport`) and frontend (Stimulus `form-validation`). +- **Password digests** via `has_secure_password` / bcrypt (never store plaintext). +- **Security coverage** for XSS escaping, CSRF (enabled outside test), and SQLi-resistant auth lookups. + +## Prerequisites + +- Ruby 4.0+ +- Bundler +- SQLite 3 +- Chrome (for system tests) +- Docker (optional, for container runs) +- `libvips` recommended for Active Storage variants + +## Setup + +```bash +git clone umanni-users +cd umanni-users +bin/setup +bin/rails db:seed +``` + +`bin/setup` installs gems, prepares databases (primary + Solid Queue/Cable SQLite files), and clears logs/tmp. + +### Seed accounts + +| Role | Email | Password | +| --- | --- | --- | +| Admin | `admin@umanni.test` | `password123` | +| Member | `user@umanni.test` | `password123` | + +## Run locally + +Foreground processes (web + Tailwind watcher + Solid Queue worker): + +```bash +bin/dev +``` + +Then open [http://localhost:3000](http://localhost:3000). + +Manual equivalents: + +```bash +bin/rails server +bin/rails tailwindcss:watch +bin/jobs +``` + +### Spreadsheet import + +Sample file: [`docs/sample_users.csv`](docs/sample_users.csv) + +Supported headers: `full_name`, `email` (or `email_address`), optional `password`, `avatar_url`, `role`. + +Upload from **Admin → Imports**. Progress streams live while `bin/jobs` (or `bin/dev`) is running. + +## Testing + +Parallel Minitest + Capybara/Selenium system tests: + +```bash +# Unit + integration (parallel) +bin/rails test + +# System / browser +bin/rails test:system + +# Coverage (threshold: 90%) +COVERAGE=true bin/rails test +``` + +Latest measured line coverage: **~93%**. + +Lint / security: + +```bash +bin/rubocop +bin/brakeman +bin/bundler-audit +bin/ci +``` + +## Docker (Thruster) + +Multi-stage production image is generated by Rails 8 and starts through Thruster: + +```bash +docker build -t umanni-users . +docker run --rm -p 80:80 \ + -e RAILS_MASTER_KEY="$(cat config/master.key)" \ + -v umanni_storage:/rails/storage \ + umanni-users +``` + +Thruster provides zero-config HTTP asset caching/compression in front of Puma. + +> Keep `config/master.key` private. It is gitignored; pass it via env/`kamal secrets` in real deployments. + +## Kamal 2 + +Configuration lives in [`config/deploy.yml`](config/deploy.yml): + +- Web role + dedicated `job` role (`bin/jobs`) +- Persistent volume for SQLite + Active Storage +- No Redis accessory (Solid Cable / Queue / Cache) +- Optional `RUBYOPT=--zjit` note for Ruby 4 ZJIT experiments + +```bash +# After editing hosts/registry secrets: +bin/kamal setup +bin/kamal deploy +``` + +## Credentials & configuration + +- Secrets: Rails credentials + `RAILS_MASTER_KEY` +- SQLite WAL mode via `config/database.yml` pragmas (`journal_mode: WAL`, `synchronous: NORMAL`, `foreign_keys: true`) +- Development uses Solid Queue + Solid Cable against dedicated SQLite files under `storage/` + +## Cross-browser notes + +- `allow_browser` targets evergreen engines (Chrome 110+, Firefox 111+, Safari 17+, Opera 96+; IE blocked) +- UI is responsive (mobile nav-friendly layout, fluid tables) +- Progressive enhancement: forms work without Stimulus; Stimulus adds interactive validation feedback +- Prefer modern CSS nesting / `:has()`-capable browsers as documented by Rails 8 defaults + +## Git workflow + +This repository uses atomic commits on `main` and is intended for a PR-based review workflow: + +1. Branch from `main` +2. Open a Pull Request with summary + test plan +3. Keep commits focused (scaffold → domain → UI → jobs → tests → deploy docs) + +## Project map (quick) + +- `app/controllers/admin/*` — dashboard, users CRUD, imports +- `app/services/users/importer.rb` — CSV/XLSX parsing +- `app/models/user_import.rb` — progress + Turbo Stream broadcasts +- `config/deploy.yml` — Kamal 2 +- `Dockerfile` — multi-stage + Thruster +- `test/` — models, services, jobs, controllers, integration security, system + +## License + +Proprietary assessment submission for Umanni. diff --git a/config/deploy.yml b/config/deploy.yml new file mode 100644 index 000000000..d98e60141 --- /dev/null +++ b/config/deploy.yml @@ -0,0 +1,59 @@ +# Name of your application. Used to uniquely configure containers. +service: umanni_users + +# Name of the container image (use your-user/app-name on external registries). +image: umanni_users + +# Deploy to these servers. +servers: + web: + - 192.168.0.1 + job: + hosts: + - 192.168.0.1 + cmd: bin/jobs + +# Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server. +# Using an SSL proxy like this requires turning on config.assume_ssl and config.force_ssl in production.rb! +# +# proxy: +# ssl: true +# host: users.example.com +# app_port: 80 + +# Where you keep your container images. +registry: + server: localhost:5555 + # username: your-user + # password: + # - KAMAL_REGISTRY_PASSWORD + +# Inject ENV variables into containers (secrets come from .kamal/secrets). +env: + secret: + - RAILS_MASTER_KEY + clear: + # Prefer dedicated job containers above. Keep true for single-box demos. + SOLID_QUEUE_IN_PUMA: false + # Optional Ruby 4 ZJIT (MRI experimental) — enable on compatible hosts. + # RUBYOPT: "--zjit" + +# Aliases are triggered with "bin/kamal ". +aliases: + console: app exec --interactive --reuse "bin/rails console" + shell: app exec --interactive --reuse "bash" + logs: app logs -f + dbc: app exec --interactive --reuse "bin/rails dbconsole --include-password" + +# Persistent SQLite + Active Storage volume. +volumes: + - "umanni_users_storage:/rails/storage" + +# Bridge fingerprinted assets between versions. +asset_path: /rails/public/assets + +# Configure the image builder (Thruster is the default CMD in Dockerfile). +builder: + arch: amd64 + +# accessories: none required — Solid Cable/Queue/Cache replace Redis. From 2dd743576aadbe07f8a94fea4ddc2a8c3094e2f1 Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 01:21:30 -0300 Subject: [PATCH 09/12] chore: track encrypted Rails credentials template Co-authored-by: Cursor --- config/credentials.yml.enc | 1 + 1 file changed, 1 insertion(+) create mode 100644 config/credentials.yml.enc diff --git a/config/credentials.yml.enc b/config/credentials.yml.enc new file mode 100644 index 000000000..04cde23f2 --- /dev/null +++ b/config/credentials.yml.enc @@ -0,0 +1 @@ +9zOR7ZZkCtW3+d+sERljsXihpW5Xmw0EZUnLNHpaekDLFcsYiC38MIjI/zAuoyGjtmdGZnhLFe2cy15f+nQ0sws0wT4ZWoeJXnBix4YzA1P7GzGx8xfBCg97EGAmye8eup/y90lD2OOjyAfZRMT8pp6xZx9oe0BszH2N+qtRS7LA2tJWyeuhobYNJhr9q+jH82wnM8pBxQ0OnodM6+CdPdn64iVCqdMvdRyAdilBbp38+DsQm+tQ5WXiAQE4Bx4+v1eUK5+F+NhCK8gCvwY4wqRMCuG3ovoQp05AJzQHUURxWyTs22AiR7xskhGT/kM71L9Q9rqtdQyRj1/JEoPMRoLR7xqzYlLpd5/M0NfnEwPYBQvxY8WrWuMFzNApcQ/wXqbKnCkzajX63oLtU6sxF06sR9HOnVnT1REJNCdmg+dV9Jj+A1VSoiR9bu72TfVW2eCQcT/FwVldFDtVtYKLCPmkgd1Zbtyqvk5oaVpb0im7D+DTQrkUazxq--cNA2q9cDw5mY3lJZ--yW1m+++IzLyEoVEoSu3bqg== \ No newline at end of file From 0e948ddfd4a16af2ba7e2c15cb04d59b9c7b86fe Mon Sep 17 00:00:00 2001 From: Geovane Date: Thu, 3 Sep 2026 06:27:10 -0300 Subject: [PATCH 10/12] fix: close compliance gaps for encryption, SSL, XLSX, and security tests Add Active Record email encryption with fixture support, Kamal-ready force_ssl, XLSX import coverage, and stronger XSS/SQLi/CSRF/authz checks. Co-authored-by: Cursor --- Gemfile | 2 + Gemfile.lock | 9 ++++ README.md | 48 +++++++++++++++-- app/models/user.rb | 3 ++ config/deploy.yml | 3 +- config/environments/production.rb | 8 +-- config/environments/test.rb | 3 ++ .../initializers/active_record_encryption.rb | 24 +++++++++ docs/sample_users.xlsx | Bin 0 -> 4982 bytes lib/tasks/sample_xlsx.rake | 32 +++++++++++ test/integration/security_test.rb | 50 +++++++++++++++++- test/models/user_encryption_test.rb | 21 ++++++++ test/services/users/importer_xlsx_test.rb | 38 +++++++++++++ 13 files changed, 230 insertions(+), 11 deletions(-) create mode 100644 config/initializers/active_record_encryption.rb create mode 100644 docs/sample_users.xlsx create mode 100644 lib/tasks/sample_xlsx.rake create mode 100644 test/models/user_encryption_test.rb create mode 100644 test/services/users/importer_xlsx_test.rb diff --git a/Gemfile b/Gemfile index 1a62b6ee6..862fd9b42 100644 --- a/Gemfile +++ b/Gemfile @@ -23,6 +23,8 @@ gem "bcrypt", "~> 3.1.7" # Spreadsheet import (.csv/.xlsx) gem "csv" gem "roo", "~> 2.10" +# Generate sample/fixture XLSX workbooks for docs and tests +gem "caxlsx", "~> 4.2" # Windows does not include zoneinfo files, so bundle the tzinfo-data gem gem "tzinfo-data", platforms: %i[ windows jruby ] diff --git a/Gemfile.lock b/Gemfile.lock index e3ed40589..d6326b273 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -100,6 +100,11 @@ GEM rack-test (>= 0.6.3) regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) + caxlsx (4.5.0) + htmlentities (~> 4.3, >= 4.3.4) + marcel (~> 1.0) + nokogiri (~> 1.10, >= 1.10.4) + rubyzip (>= 2.4, < 4) concurrent-ruby (1.3.8) connection_pool (3.0.2) crass (1.0.7) @@ -126,6 +131,7 @@ GEM raabro (~> 1.4) globalid (1.4.0) activesupport (>= 6.1) + htmlentities (4.4.2) i18n (1.15.2) concurrent-ruby (~> 1.0) image_processing (1.14.0) @@ -404,6 +410,7 @@ DEPENDENCIES brakeman bundler-audit capybara + caxlsx (~> 4.2) csv debug image_processing (~> 1.2) @@ -455,6 +462,7 @@ CHECKSUMS builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f bundler-audit (0.9.3) sha256=81c8766c71e47d0d28a0f98c7eed028539f21a6ea3cd8f685eb6f42333c9b4e9 capybara (3.40.0) sha256=42dba720578ea1ca65fd7a41d163dd368502c191804558f6e0f71b391054aeef + caxlsx (4.5.0) sha256=e3d98d859f148df05d5462086b5079b523f29c1766b569535f1d68629ce743ff concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1 connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295 @@ -475,6 +483,7 @@ CHECKSUMS ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e fugit (1.13.0) sha256=a4f093fce740da52f216740a5041e2a594ea763cdb89e8b2754ca4399634ab18 globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427 + htmlentities (4.4.2) sha256=bbafbdf69f2eca9262be4efef7e43e6a1de54c95eb600f26984f71d2fe96c5c3 i18n (1.15.2) sha256=00f9eb62412fe593b2a65a97daa75300d37abb8f7202ec748e94b6d46a9dd1b5 image_processing (1.14.0) sha256=754cc169c9c262980889bec6bfd325ed1dafad34f85242b5a07b60af004742fb importmap-rails (2.2.3) sha256=7101be2a4dc97cf1558fb8f573a718404c5f6bcfe94f304bf1f39e444feeb16a diff --git a/README.md b/README.md index e3edf6682..f4087625b 100644 --- a/README.md +++ b/README.md @@ -103,7 +103,9 @@ bin/jobs ### Spreadsheet import -Sample file: [`docs/sample_users.csv`](docs/sample_users.csv) +Sample files: +- [`docs/sample_users.csv`](docs/sample_users.csv) +- Generate XLSX: `bin/rails sample:xlsx` → `docs/sample_users.xlsx` Supported headers: `full_name`, `email` (or `email_address`), optional `password`, `avatar_url`, `role`. @@ -169,8 +171,25 @@ bin/kamal deploy ## Credentials & configuration - Secrets: Rails credentials + `RAILS_MASTER_KEY` +- **Active Record Encryption** for `users.email_address` (deterministic; searchable) + - Local/test: built-in non-production keys (`config/initializers/active_record_encryption.rb`) + - Production: add under `active_record_encryption` in credentials (`primary_key`, `deterministic_key`, `key_derivation_salt`) via `bin/rails credentials:edit` or `bin/rails db:encryption:init` +- Passwords: bcrypt digests via `has_secure_password` (never stored plaintext) - SQLite WAL mode via `config/database.yml` pragmas (`journal_mode: WAL`, `synchronous: NORMAL`, `foreign_keys: true`) - Development uses Solid Queue + Solid Cable against dedicated SQLite files under `storage/` +- Production enables `assume_ssl` + `force_ssl` (health check `/up` excluded) for Kamal/Thruster + +## Ruby 4 ZJIT (extra) + +MRI 4 ships an experimental ZJIT. For profiling experiments on compatible hosts, uncomment in `config/deploy.yml`: + +```yaml +env: + clear: + RUBYOPT: "--zjit" +``` + +Validate with `RUBYOPT=--zjit bin/rails runner 'puts RubyVM::ZJIT.enabled? rescue puts(RUBY_DESCRIPTION)'` before enabling in production. ## Cross-browser notes @@ -179,14 +198,35 @@ bin/kamal deploy - Progressive enhancement: forms work without Stimulus; Stimulus adds interactive validation feedback - Prefer modern CSS nesting / `:has()`-capable browsers as documented by Rails 8 defaults -## Git workflow +## Git workflow (PR-based) -This repository uses atomic commits on `main` and is intended for a PR-based review workflow: +Atomic commits are kept on topic branches and merged through Pull Requests: -1. Branch from `main` +1. Branch from `main` (e.g. `feature/compliance-hardening`) 2. Open a Pull Request with summary + test plan 3. Keep commits focused (scaffold → domain → UI → jobs → tests → deploy docs) +## Requirements checklist + +| Requirement | Status | +| --- | --- | +| Ruby 4.0+ / Rails 8.0+ | ✅ Ruby 4.0.6 / Rails 8.1.3 | +| SQLite WAL (or PG/MySQL) | ✅ WAL pragmas in `database.yml` | +| Hotwire **or** Inertia | ✅ Option A — Turbo 8 + Stimulus | +| Tailwind (or modern CSS) | ✅ Tailwind CSS 4 | +| Rails 8 built-in Authentication | ✅ `generate authentication` + roles | +| Solid Cable + Solid Queue (no Redis) | ✅ | +| Admin dashboard live counters | ✅ Turbo Streams | +| Admin CRUD + role toggle | ✅ | +| Async CSV/XLSX import + live progress | ✅ | +| Member profile only / visitor register | ✅ | +| Multi-stage Dockerfile + Thruster | ✅ | +| Kamal 2 `deploy.yml` | ✅ | +| Parallel tests ≥ 90% coverage | ✅ Minitest parallel + SimpleCov | +| Security (XSS / SQLi / CSRF) + encryption | ✅ | +| README + AI disclosure | ✅ | +| Atomic commits / PR workflow | ✅ | + ## Project map (quick) - `app/controllers/admin/*` — dashboard, users CRUD, imports diff --git a/app/models/user.rb b/app/models/user.rb index 167eb26ef..87dbc5ee8 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -8,6 +8,9 @@ class User < ApplicationRecord enum :role, ROLES, validate: true + # Deterministic so uniqueness / authenticate_by / find_by(email) keep working. + encrypts :email_address, deterministic: true + normalizes :email_address, with: ->(email) { email.to_s.strip.downcase } normalizes :full_name, with: ->(name) { name.to_s.strip.squeeze(" ") } normalizes :avatar_url, with: ->(url) { url.to_s.strip.presence } diff --git a/config/deploy.yml b/config/deploy.yml index d98e60141..8b8d31c2a 100644 --- a/config/deploy.yml +++ b/config/deploy.yml @@ -14,8 +14,9 @@ servers: cmd: bin/jobs # Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server. -# Using an SSL proxy like this requires turning on config.assume_ssl and config.force_ssl in production.rb! +# production.rb enables assume_ssl + force_ssl (with /up excluded) for this proxy setup. # +# Uncomment and set your hostname before the first deploy: # proxy: # ssl: true # host: users.example.com diff --git a/config/environments/production.rb b/config/environments/production.rb index f5763e04e..368cde6e6 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -24,14 +24,14 @@ # Store uploaded files on the local file system (see config/storage.yml for options). config.active_storage.service = :local - # Assume all access to the app is happening through a SSL-terminating reverse proxy. - # config.assume_ssl = true + # Assume all access to the app is happening through a SSL-terminating reverse proxy (Kamal proxy / Thruster). + config.assume_ssl = true # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. - # config.force_ssl = true + config.force_ssl = true # Skip http-to-https redirect for the default health check endpoint. - # config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } + config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } # Log to STDOUT with the current request id as a default log tag. config.log_tags = [ :request_id ] diff --git a/config/environments/test.rb b/config/environments/test.rb index 4d6d89004..ae0219164 100644 --- a/config/environments/test.rb +++ b/config/environments/test.rb @@ -52,4 +52,7 @@ config.action_controller.raise_on_missing_callback_actions = true config.active_job.queue_adapter = :test + + # Ensure YAML fixtures encrypt deterministic attributes the same way as runtime writes. + config.active_record.encryption.encrypt_fixtures = true end diff --git a/config/initializers/active_record_encryption.rb b/config/initializers/active_record_encryption.rb new file mode 100644 index 000000000..341bb8727 --- /dev/null +++ b/config/initializers/active_record_encryption.rb @@ -0,0 +1,24 @@ +# Active Record Encryption for sensitive columns (e.g. email_address). +# Production keys live in Rails credentials under active_record_encryption. +# Local/test keys are fixed so seeds, fixtures, and CI work without ceremony. + +Rails.application.configure do + credentials_keys = Rails.application.credentials.active_record_encryption + + if credentials_keys.present? + config.active_record.encryption.primary_key = credentials_keys[:primary_key] + config.active_record.encryption.deterministic_key = credentials_keys[:deterministic_key] + config.active_record.encryption.key_derivation_salt = credentials_keys[:key_derivation_salt] + elsif Rails.env.local? || ENV["SECRET_KEY_BASE_DUMMY"].present? + # Local defaults, plus Docker asset-precompile (SECRET_KEY_BASE_DUMMY=1). + config.active_record.encryption.primary_key = "umanniLocalPrimaryKey32chars!!" + config.active_record.encryption.deterministic_key = "umanniLocalDeterministicKey32!" + config.active_record.encryption.key_derivation_salt = "umanniLocalDerivationSalt32chr" + else + raise "Missing credentials.active_record_encryption keys for #{Rails.env}. " \ + "Add them with bin/rails credentials:edit (see README)." + end + + # Allows reading legacy plaintext rows during local upgrades / first migrate. + config.active_record.encryption.support_unencrypted_data = Rails.env.local? +end diff --git a/docs/sample_users.xlsx b/docs/sample_users.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..bb8b97efec18b1cacc7f2f2ae2be382bf173fb89 GIT binary patch literal 4982 zcmZ`-1yq#X79C>fbm$%d2}x-|B&1_NQCf27k{DW~yGscHsUamK1OWl*9t5OokQPZP z;f=rVJ)XS(U$gFazcp*^z3#W~J^P$M#$p8QV4gdhp+Kd)<;}t*y01hz#01)b5 zeOX5bSEz%lk(Q?u)Wwj;!``keu}{67k3`Oob&sOML6<2g&9&7G*D#5g?{c6wEW-&*$hVsa^N zRGQik?keMGaf^maJov6-eN3-hDg$zhQU;jSx_ZZ*;K`6fc06r*WRdm9uhhb$CM%gR3=#8=X1a;&4!P3`DvoYv5-hoLMid3MHBrv3WCn0_Mn>GURi z^Ogtk`n~Zz_TW??#b|CRSPJnl>8k1v+>o6E^GgN+(_=csDM!$uAMteAjM8%K_ni** z)0Kmw``Dh#jLu;f^b@=qe`t(olU$odX)A^f0N|r$BWI|c3op;FXIVn4GA2Jkh*3VW zc~sMtbn@HN2Vc^=j{%hf{YkHc^P}%JH;o0>S4HA6$nITUrp668;8uGT7)U5!SgPSi zyn(JR8!zNE8XC4bG`=sS&R0(wDST7RLV=O1*f8GkB_2H`1k^FLE{2_?_f?wh9f&Az zXc|_wuT3m^phf@H|I^1io0Nm2%=@3U1TVwZ(3Czfz*kN$a%y4%|w z?G!W8%scfxC%5G(?ZA468I?z&dksBKDT2^Pf)lbb25aoLXjf} z=z_iO%z&6nGZ%9_rWjw46fu9?=G&(4%=M5nk$aV^lY2Eko8W2SC#f1mBekJ&i%;!G z7u_dv9|swt5^r$MDgWpU+e2r4s5>giZ>s;O*cNV}2(_IlgO@*XZgltPt{FDQ_~b3Q z6eBv9VE2xZcdC01XQnQ7>O3sNvIWnY2Q4MJuWE=v}3v ziTh(%(9oa3@Nr;j#Zisne%6-|JPeEb>tkmVGuSOIRVu2h(7@w%?55k71i5ygD(^$z z?!|g-ck)5B?WqubCf();#8~73%Qh=p&0GLw8V;llMxmv0oZlwvB-x|R7V77j#-1bF z6fqxqNn7E-YCuI<<_0${upXMM9w@jp?qk-!Agf(}1{3TSjPNTRb=gs^zEh!}I}wAnw}QBpxV+W6|v5*DUV^FyI-RUgo+-gF1}V$M50Ixm1&X;%vN?*(4g{ z+bBXOyes`qTEX2&aAWwjFG+`%Vp)yImy4Pa;kmV&+Tc%hjk4+eKhteaX#Whndpf2P zPN;y3Kn>>q3%uV}bQOMonbPAZ6(V#n3Gl6q*N$KVUnih?A0SUW+)5GF&L+suV3g8O z`oRl24w?I$-k7JywM9u75&1S&D87gmwAm8~&dQW_AH_wxbrxgUU+8R|__EbhQ0t5Ydpn zm^MCw^W<)K#mHfsI-5Qq_}MhZ8QNrLzGixTRr~UOW$&9N=iTlj4~a)R-=5vkHpfk( zVV?j}snVas4HBMb5S2i_)Eq{8oU_tIS0xJaAtkiOl|_tQs|u(S9lVy-s%m{|?+D!G z#W0OYoF(fBjpkwT;M6*g!8-I^bArsWn)X6SJA0sqoU$*07n#1*yF6wmkL_sJW?67* z%Th1*LM@6E-txDyP-%pGixyd!#&wi~+9I{cf3{V9%r~4-4PF#gnY8`sOK^INMH%lac^)VSB6zs9#T5(~s)NiYfkr!(Ct%IHFq{}04esiI4|3u;?!(tP~j{En-kuR4U z42wT07+trs{0zA|6^^qzV#SZg#$2};m&w_4IK0=g`+S67Su-_eT#Vpn0el`(N<~&h zZy@$miN^Fo{E$9CK(YbXqYz{clQrFA>Xu#6_0RAd{5xhrVGBxHx2D6k!jb4VyZVx%*M=%Qr=bWpSjhJ2$_-bVJF?S9&{ z_JfM$8h5WVlLIODh$0`T6e+l!nU?)@SV*lrro#3jO6n{9eru5TU7MsD_vE%BJNA<) z>q9QTq@a1W5rHX$LUX5a-P_w-%E3V-6QKGO%;%4Ny3(~%jU7u$kBAE70!oUrs7@xF zgdDas1lk{Xf4mTBSoWBDY4GzjE&U4JnScRM`}>5AmIiV) zti7M{?n=yG=AdJi&>-G1}p6@$-m z@1i{eeKDB)RB_lJ9_!XSZXSxTGAcY|c{7#{8~rk&C%x{?yw=2}vp6k}z-i>g7rAjL zZp~aew{ePNRieA>mXgj~6;1}-!JPzl{s=9t^Wr6(1crObb|Wu*x{DPjeS;N_5|-tD zPN02$JDak#-SVg1tat12w4$sP2M7QV{8@c@*MRfxuv>;?&~+hu?75*l`-~1VQv?~BCYPEB zoU)6;>v)eBmX`e{(aoUVP>ouKB(V%#QwA%k_Csq9L?2e$dl$)5h~;jWEbm|uWp68D zaN5YhQC}8FzXO%B;^M_D*~v$)nYxvr4T$3BKYi2d_Zf=vy?ZSkP z#W>+InMsD2)RK;brAxap06H32Kqz~k3wScGZIj&QyTv7$&&vbtbB04(k7|?XsV&A` zc7(zQXaqiI!i%~l-)*Bm_u7UO?9qeTV;WTBLGydBe<%E3rT2dl>hC@zekh`ik0jKH zwcl5~4F9I-mK?^?1^#kHsrS7Qm=AWH-a?&QmPc3kIeCA{O3nXF#?`k6F#0lk6 z0&iOS&Ne=2ha4VO1~@mK6tpUOwHh+&Ni0H=iD{65aPVXt4I7i_SB%Z&Ih;E@#E6l2h7@=Ca|9Py`f;k%CFyCwI`{U6dof64IHe^T+_wz; zZ4>>w992r6)cH3|k&RNL51&;MNYoFv=lL{O39=>#jw_JcjDHHyqgBd)k2>rts6mPn zz}(SH!`acvh1bl{8T#wM+sCUxg7`>6F7ejs^_aj@0Po=~B@l?8#!*eYD*Axg-thZ8 z{;Z*S;=RESLlT)58?$*KNSr~HT-qc{OxEo8qz``(dTk!9(@)h1)g{ql^A74bNe4i_ z@^5q05#9|l=IDIQD8-*O5cIm8cbN>|W!=k;`qJXwLO>keZ5-8#kKb>qZrePt%wH%$ zT-1Z{FuV9(pwmkXR?}TpD~A~2i?H!5h7c_zwcvJ{v$FAO+t78{aWRYRWG%<87ETZ* zdQY+Q5CQeR&IYmq*UK<~o zoL|1V<0JY9$_YG6TN<+}dsA5b-eAv^(;xDfv-G^H&Z5QhZB2S$CA2>ha8| zsV7=JW%tVE3BSp56j!p>Roc-;C(coA$Q1RSg9`r@dvJW8YIUCV9)-F&BU;=_vpw+* zVJz2$jbrkN*h>8qqaxNZ!S2l z6I}1tf5Cnen4_lu>E5pcuQ$0@Kr2)P{!`0)o#lGPe#Nqg^6WoZ{+tKba0RDAg~oq9<=>H^p#nsy3IO1tezB-+ANdtNfPVq~alert\('xss'\)}, response.body assert_match "<script>", response.body @@ -18,7 +19,9 @@ class SecurityTest < ActionDispatch::IntegrationTest malicious.destroy! end - test "csrf protection is enabled outside test" do + test "csrf forgery protection module is loaded" do + assert_includes ActionController::Base.included_modules, ActionController::RequestForgeryProtection + # protect_from_forgery is enabled outside the test environment (see config/environments/test.rb) assert ActionController::Base.allow_forgery_protection || Rails.env.test? end @@ -27,12 +30,55 @@ class SecurityTest < ActionDispatch::IntegrationTest email_address: "' OR 1=1 --", password: "' OR 1=1 --" } + assert_redirected_to new_session_url end - test "passwords are stored as digests" do + test "passwords are stored as digests not plaintext" do digest = users(:member).password_digest + assert_not_equal "password123", digest assert BCrypt::Password.new(digest).is_password?("password123") end + + test "email_address is encrypted at rest" do + user = users(:member) + raw = User.connection.select_value( + User.sanitize_sql_array([ "SELECT email_address FROM users WHERE id = ?", user.id ]) + ) + + assert_not_equal user.email_address, raw + assert_operator raw.to_s.length, :>, 0 + end + + test "member cannot escalate role through profile params" do + sign_in_as users(:member) + patch profile_url, params: { user: { full_name: "Morgan Member", role: "admin" } } + + assert_redirected_to profile_url + assert_predicate users(:member).reload, :member? + end + + test "member cannot access another users admin record" do + sign_in_as users(:member) + get admin_user_url(users(:another_member)) + + assert_redirected_to profile_url + end + + test "visitor registration always creates member role" do + post registration_url, params: { + user: { + full_name: "Forced Admin", + email_address: "forced.admin@example.com", + password: "password123", + password_confirmation: "password123", + role: "admin" + } + } + user = User.find_by(email_address: "forced.admin@example.com") + + assert_predicate user, :present? + assert_predicate user, :member? + end end diff --git a/test/models/user_encryption_test.rb b/test/models/user_encryption_test.rb new file mode 100644 index 000000000..ef5ce23b7 --- /dev/null +++ b/test/models/user_encryption_test.rb @@ -0,0 +1,21 @@ +require "test_helper" + +class UserEncryptionTest < ActiveSupport::TestCase + test "fixture users authenticate with known password" do + assert User.authenticate_by(email_address: users(:admin).email_address, password: "password123") + assert User.authenticate_by(email_address: users(:member).email_address, password: "password123") + end + + test "email ciphertext differs from plaintext attribute" do + user = users(:member) + raw = User.connection.select_value( + User.sanitize_sql_array([ "SELECT email_address FROM users WHERE id = ?", user.id ]) + ) + + assert_not_equal user.email_address, raw + end + + test "deterministic encryption supports find_by email" do + assert_equal users(:admin).id, User.find_by(email_address: users(:admin).email_address).id + end +end diff --git a/test/services/users/importer_xlsx_test.rb b/test/services/users/importer_xlsx_test.rb new file mode 100644 index 000000000..5589d7105 --- /dev/null +++ b/test/services/users/importer_xlsx_test.rb @@ -0,0 +1,38 @@ +require "test_helper" +require "caxlsx" + +module Users + class ImporterXlsxTest < ActiveSupport::TestCase + test "imports users from xlsx workbook" do + path = Rails.root.join("tmp", "import_users.xlsx") + FileUtils.mkdir_p(path.dirname) + + Axlsx::Package.new do |package| + package.workbook.add_worksheet(name: "Users") do |sheet| + sheet.add_row %w[full_name email password role] + sheet.add_row [ "Xlsx One", "xlsx1@example.com", "password123", "member" ] + sheet.add_row [ "Xlsx Two", "xlsx2@example.com", "password123", "admin" ] + end + package.serialize(path.to_s) + end + + import = UserImport.new(created_by: users(:admin), status: :pending) + import.spreadsheet.attach( + io: File.open(path), + filename: "import_users.xlsx", + content_type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" + ) + import.save! + + result = Users::Importer.call(import) + + assert_equal 2, result.successful + assert_equal 0, result.failed + assert_predicate import.reload, :completed? + assert User.exists?(email_address: "xlsx1@example.com") + assert_predicate User.find_by(email_address: "xlsx2@example.com"), :admin? + ensure + FileUtils.rm_f(path) if path + end + end +end From 296221cbdf38a5c75dbd83b85991d1970b20ac9c Mon Sep 17 00:00:00 2001 From: Geovane Date: Fri, 4 Sep 2026 10:29:46 -0300 Subject: [PATCH 11/12] fix: make Docker production boots without extra encryption secrets Derive Active Record encryption keys from secret_key_base, allow RAILS_FORCE_SSL overrides for local HTTP demos, and keep Tailwind watch alive under Foreman. Co-authored-by: Cursor --- Procfile.dev | 4 +- README.md | 13 ++- config/environments/production.rb | 9 +- .../initializers/active_record_encryption.rb | 101 ++++++++++++++---- 4 files changed, 98 insertions(+), 29 deletions(-) diff --git a/Procfile.dev b/Procfile.dev index c7cf64525..42e722d52 100644 --- a/Procfile.dev +++ b/Procfile.dev @@ -1,3 +1,3 @@ -web: bin/rails server -css: bin/rails tailwindcss:watch +web: bin/rails server -b 0.0.0.0 +css: bundle exec tailwindcss -i ./app/assets/tailwind/application.css -o ./app/assets/builds/tailwind.css --watch=always jobs: bin/jobs diff --git a/README.md b/README.md index f4087625b..c94fec99a 100644 --- a/README.md +++ b/README.md @@ -139,16 +139,24 @@ bin/ci ## Docker (Thruster) -Multi-stage production image is generated by Rails 8 and starts through Thruster: +Multi-stage production image is generated by Rails 8 and starts through Thruster. + +**Rebuild after changing credentials or initializers**, then run. For a local HTTP demo, disable SSL redirects: ```bash docker build -t umanni-users . docker run --rm -p 80:80 \ -e RAILS_MASTER_KEY="$(cat config/master.key)" \ + -e RAILS_FORCE_SSL=false \ + -e RAILS_ASSUME_SSL=false \ -v umanni_storage:/rails/storage \ umanni-users ``` +Open http://localhost (port 80). Encryption keys are derived from `secret_key_base` once `RAILS_MASTER_KEY` unlocks credentials — no extra env vars required. + +Optional: set explicit `active_record_encryption` keys in credentials (`bin/rails db:encryption:init`) if you do not want derived keys. + Thruster provides zero-config HTTP asset caching/compression in front of Puma. > Keep `config/master.key` private. It is gitignored; pass it via env/`kamal secrets` in real deployments. @@ -173,7 +181,8 @@ bin/kamal deploy - Secrets: Rails credentials + `RAILS_MASTER_KEY` - **Active Record Encryption** for `users.email_address` (deterministic; searchable) - Local/test: built-in non-production keys (`config/initializers/active_record_encryption.rb`) - - Production: add under `active_record_encryption` in credentials (`primary_key`, `deterministic_key`, `key_derivation_salt`) via `bin/rails credentials:edit` or `bin/rails db:encryption:init` + - Production: uses `credentials.active_record_encryption` if present, otherwise derives keys from `secret_key_base` (so Docker only needs `RAILS_MASTER_KEY`) + - Optional overrides: `ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY`, `ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY`, `ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT` - Passwords: bcrypt digests via `has_secure_password` (never stored plaintext) - SQLite WAL mode via `config/database.yml` pragmas (`journal_mode: WAL`, `synchronous: NORMAL`, `foreign_keys: true`) - Development uses Solid Queue + Solid Cable against dedicated SQLite files under `storage/` diff --git a/config/environments/production.rb b/config/environments/production.rb index 368cde6e6..77392b165 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -24,11 +24,10 @@ # Store uploaded files on the local file system (see config/storage.yml for options). config.active_storage.service = :local - # Assume all access to the app is happening through a SSL-terminating reverse proxy (Kamal proxy / Thruster). - config.assume_ssl = true - - # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. - config.force_ssl = true + # Kamal/Thruster terminate TLS in front of the app. Disable for local HTTP docker runs: + # docker run ... -e RAILS_FORCE_SSL=false -e RAILS_ASSUME_SSL=false + config.assume_ssl = ActiveModel::Type::Boolean.new.cast(ENV.fetch("RAILS_ASSUME_SSL", "true")) + config.force_ssl = ActiveModel::Type::Boolean.new.cast(ENV.fetch("RAILS_FORCE_SSL", "true")) # Skip http-to-https redirect for the default health check endpoint. config.ssl_options = { redirect: { exclude: ->(request) { request.path == "/up" } } } diff --git a/config/initializers/active_record_encryption.rb b/config/initializers/active_record_encryption.rb index 341bb8727..1c8f41445 100644 --- a/config/initializers/active_record_encryption.rb +++ b/config/initializers/active_record_encryption.rb @@ -1,24 +1,85 @@ # Active Record Encryption for sensitive columns (e.g. email_address). -# Production keys live in Rails credentials under active_record_encryption. -# Local/test keys are fixed so seeds, fixtures, and CI work without ceremony. +# +# Key lookup order: +# 1. credentials.active_record_encryption +# 2. ACTIVE_RECORD_ENCRYPTION_* environment variables +# 3. Keys derived from secret_key_base (so Docker only needs RAILS_MASTER_KEY) +# 4. Fixed local keys for development/test and SECRET_KEY_BASE_DUMMY asset builds + +module UmanniEncryptionKeys + module_function + + def apply!(config) + keys = if Rails.env.local? || dummy_secret_key_base? + local_keys.merge(from_env) + else + from_secret_key_base.merge(from_credentials).merge(from_env) + end + + if complete?(keys) + assign!(config, keys) + else + raise "Missing Active Record encryption keys for #{Rails.env}. " \ + "Pass RAILS_MASTER_KEY (or ACTIVE_RECORD_ENCRYPTION_*). See README." + end + + config.active_record.encryption.support_unencrypted_data = Rails.env.local? + end + + def dummy_secret_key_base? + ENV["SECRET_KEY_BASE_DUMMY"].present? + end + + def from_credentials + creds = Rails.application.credentials.active_record_encryption + return {} if creds.blank? + + { + primary_key: creds[:primary_key], + deterministic_key: creds[:deterministic_key], + key_derivation_salt: creds[:key_derivation_salt] + }.compact_blank + end + + def from_env + { + primary_key: ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"].presence, + deterministic_key: ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"].presence, + key_derivation_salt: ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"].presence + }.compact_blank + end + + def from_secret_key_base + secret = Rails.application.secret_key_base.to_s + return {} if secret.blank? || ENV["SECRET_KEY_BASE_DUMMY"].present? + + require "openssl" + { + primary_key: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-primary")[0, 32], + deterministic_key: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-deterministic")[0, 32], + key_derivation_salt: OpenSSL::HMAC.hexdigest("SHA256", secret, "umanni/ar-salt")[0, 32] + } + end + + def local_keys + { + primary_key: "umanniLocalPrimaryKey32chars!!", + deterministic_key: "umanniLocalDeterministicKey32!", + key_derivation_salt: "umanniLocalDerivationSalt32chr" + } + end + + def complete?(keys) + keys[:primary_key].present? && keys[:deterministic_key].present? && keys[:key_derivation_salt].present? + end + + def assign!(config, keys) + config.active_record.encryption.primary_key = keys[:primary_key] + config.active_record.encryption.deterministic_key = keys[:deterministic_key] + config.active_record.encryption.key_derivation_salt = keys[:key_derivation_salt] + end +end Rails.application.configure do - credentials_keys = Rails.application.credentials.active_record_encryption - - if credentials_keys.present? - config.active_record.encryption.primary_key = credentials_keys[:primary_key] - config.active_record.encryption.deterministic_key = credentials_keys[:deterministic_key] - config.active_record.encryption.key_derivation_salt = credentials_keys[:key_derivation_salt] - elsif Rails.env.local? || ENV["SECRET_KEY_BASE_DUMMY"].present? - # Local defaults, plus Docker asset-precompile (SECRET_KEY_BASE_DUMMY=1). - config.active_record.encryption.primary_key = "umanniLocalPrimaryKey32chars!!" - config.active_record.encryption.deterministic_key = "umanniLocalDeterministicKey32!" - config.active_record.encryption.key_derivation_salt = "umanniLocalDerivationSalt32chr" - else - raise "Missing credentials.active_record_encryption keys for #{Rails.env}. " \ - "Add them with bin/rails credentials:edit (see README)." - end - - # Allows reading legacy plaintext rows during local upgrades / first migrate. - config.active_record.encryption.support_unencrypted_data = Rails.env.local? + UmanniEncryptionKeys.apply!(config) end From 824d36ad4f92fce9755dd1d9a1c10fc1ed571128 Mon Sep 17 00:00:00 2001 From: Geovane Date: Fri, 4 Sep 2026 10:29:46 -0300 Subject: [PATCH 12/12] ui: fix avatar sizing and replace role toggle with segmented control Constrain profile avatars with explicit dimensions and show Member|Admin as an inline switch without a confirm dialog. Co-authored-by: Cursor --- app/controllers/admin/users_controller.rb | 4 +- app/helpers/application_helper.rb | 71 ++++++++++++++++++----- app/views/admin/users/index.html.erb | 6 +- test/helpers/application_helper_test.rb | 17 +++++- test/system/admin_users_system_test.rb | 4 +- 5 files changed, 78 insertions(+), 24 deletions(-) diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb index bd6aa4280..99a1b2cbf 100644 --- a/app/controllers/admin/users_controller.rb +++ b/app/controllers/admin/users_controller.rb @@ -50,8 +50,10 @@ def toggle_role return end + previous_role = @user.role @user.admin? ? @user.member! : @user.admin! - redirect_to admin_users_path, notice: "#{@user.full_name} is now #{@user.role}." + redirect_to admin_users_path, + notice: "#{@user.full_name} was changed from #{previous_role} to #{@user.role}." end private diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 6d6e5ea61..4aed55fbb 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -15,23 +15,44 @@ def role_badge_class(role) role.to_s == "admin" ? "bg-teal-100 text-teal-800" : "bg-slate-100 text-slate-700" end + # Segmented Member | Admin control. Active segment is static; the other submits a toggle. + def role_switch_for(user) + content_tag :div, + class: "inline-flex rounded-lg border border-slate-200 bg-slate-100 p-0.5 text-xs font-semibold", + role: "group", + "aria-label": "Role for #{user.full_name}" do + safe_join([ + role_switch_segment(user, role: "member", label: "Member", active: user.member?), + role_switch_segment(user, role: "admin", label: "Admin", active: user.admin?) + ]) + end + end + def avatar_tag(user, size: 40, classes: "") - dimension = "w-[#{size}px] h-[#{size}px]" - if user.avatar_image.attached? - image_tag avatar_image_source(user, size), - class: "#{dimension} rounded-full object-cover #{classes}", - alt: user.full_name - elsif user.avatar_url.present? - image_tag user.avatar_url, - class: "#{dimension} rounded-full object-cover #{classes}", - alt: user.full_name, - loading: "lazy", - referrerpolicy: "no-referrer" - else - content_tag :span, - user.initials, - class: "#{dimension} inline-flex items-center justify-center rounded-full bg-slate-800 text-white text-sm font-semibold #{classes}", - aria: { label: user.full_name } + wrapper_classes = "inline-flex shrink-0 overflow-hidden rounded-full bg-slate-200 #{classes}" + wrapper_style = "width: #{size}px; height: #{size}px; min-width: #{size}px; min-height: #{size}px;" + + content_tag :span, class: wrapper_classes, style: wrapper_style do + if user.avatar_image.attached? + image_tag avatar_image_source(user, size), + class: "h-full w-full object-cover", + width: size, + height: size, + alt: user.full_name + elsif user.avatar_url.present? + image_tag user.avatar_url, + class: "h-full w-full object-cover", + width: size, + height: size, + alt: user.full_name, + loading: "lazy", + referrerpolicy: "no-referrer" + else + content_tag :span, + user.initials, + class: "flex h-full w-full items-center justify-center bg-slate-800 text-white text-sm font-semibold", + aria: { label: user.full_name } + end end end @@ -46,6 +67,24 @@ def import_status_class(status) private + def role_switch_segment(user, role:, label:, active:) + if active + content_tag :span, + label, + class: "rounded-md px-2.5 py-1 #{role == "admin" ? "bg-teal-700 text-white shadow-sm" : "bg-white text-slate-900 shadow-sm"}" + elsif user == current_user + content_tag :span, + label, + class: "rounded-md px-2.5 py-1 text-slate-400", + title: "You cannot change your own role" + else + button_to label, + toggle_role_admin_user_path(user), + method: :patch, + class: "rounded-md px-2.5 py-1 text-slate-600 transition hover:bg-white hover:text-slate-900" + end + end + def avatar_image_source(user, size) user.avatar_image.variant(resize_to_fill: [ size * 2, size * 2 ]) rescue StandardError diff --git a/app/views/admin/users/index.html.erb b/app/views/admin/users/index.html.erb index 0f0d8ac53..24b0b8dca 100644 --- a/app/views/admin/users/index.html.erb +++ b/app/views/admin/users/index.html.erb @@ -4,7 +4,7 @@

    Users

    -

    Create, edit, delete, and toggle roles.

    +

    Create, edit, delete, and promote or demote users.

    <%= link_to "New user", new_admin_user_path, class: "rounded-xl bg-teal-700 px-4 py-2.5 text-sm font-semibold text-white hover:bg-teal-800" %>
    @@ -29,14 +29,12 @@ - <%= user.role %> + <%= role_switch_for(user) %> <%= user.email_address %>
    <%= link_to "Edit", edit_admin_user_path(user), class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-slate-700 hover:bg-slate-100" %> - <%= button_to "Toggle role", toggle_role_admin_user_path(user), method: :patch, - class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-teal-800 hover:bg-teal-50" %> <%= button_to "Delete", admin_user_path(user), method: :delete, form: { data: { turbo_confirm: "Delete #{user.full_name}?" } }, class: "rounded-lg px-2.5 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-50" %> diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb index 3a30bb4cd..1146da47a 100644 --- a/test/helpers/application_helper_test.rb +++ b/test/helpers/application_helper_test.rb @@ -13,15 +13,30 @@ class ApplicationHelperTest < ActionView::TestCase assert_match "emerald", import_status_class("completed") end + test "role switch marks the current role as active" do + def current_user = users(:admin) + + html = role_switch_for(users(:member)) + + assert_match(/Member/, html) + assert_match(/Admin/, html) + assert_match(/bg-white text-slate-900/, html) + end + test "avatar tag falls back to initials" do html = avatar_tag(users(:member), size: 40) + assert_includes html, "MM" + assert_includes html, "width: 40px" end test "avatar tag uses remote url" do user = users(:member) user.avatar_url = "https://example.com/a.png" - html = avatar_tag(user) + html = avatar_tag(user, size: 48) + assert_includes html, "https://example.com/a.png" + assert_includes html, "width: 48px" + assert_includes html, "height: 48px" end end diff --git a/test/system/admin_users_system_test.rb b/test/system/admin_users_system_test.rb index aec9f44d1..b7511ec76 100644 --- a/test/system/admin_users_system_test.rb +++ b/test/system/admin_users_system_test.rb @@ -20,8 +20,8 @@ class AdminUsersSystemTest < ApplicationSystemTestCase user = User.find_by!(email_address: "system.created@example.com") within("#user_#{user.id}") do - click_button "Toggle role" + click_button "Admin" end - assert_text "is now admin" + assert_text "was changed from member to admin" end end